feat(auth): migrate auth APIs to AmplifyContext (#14836)

* feat(auth): migrate auth APIs to AmplifyContext (B-auth split)

- Add AmplifyContext overloads to all public auth APIs (signIn, signUp,
  signOut, getCurrentUser, fetchUserAttributes, confirmSignIn, etc.)
- Public APIs use resolveCtxArgs with getGlobalContext() fallback
- Server wrappers (server/getCurrentUser, server/fetchUserAttributes)
  take AmplifyContext explicitly — no global fallback
- Internal signIn variants take (ctx, input) directly
- Utilities (assertUserNotAuthenticated, dispatchSignedInHubEvent) accept ctx
- Replace Amplify.getConfig() with ctx.resourcesConfig throughout
- Replace AmplifyClassV6 with AmplifyContext in internal APIs
- Add createMockAmplifyContext test utility
- Update affected test files to use mock context

* fix: use resolveCtxArgs<[]> for no-input overloads

resolveCtxArgs generic constraint requires T extends unknown[].
undefined does not satisfy this - use empty tuple [] instead.

* fix: use ctx.fetchAuthSession() instead of singleton fetchAuthSession()

The fetchAuthSession helper from core/internals/utils expects AmplifyClass,
not AmplifyContext. Use the context's own fetchAuthSession method directly.

* fix: server wrappers accept both AmplifyContext and ContextSpec

Maintain backward compatibility with adapter-nextjs which still uses
runWithAmplifyServerContext + ContextSpec pattern. Server wrappers now
detect whether they received an AmplifyContext or ContextSpec and
resolve accordingly.

* fix: resolve lint and formatting issues

- Remove unused Amplify imports from test files
- Fix prettier formatting (line length, indentation)

* fix: remove tsconfig.tsbuildinfo build artifact

* fix: update auth tests to use AmplifyContext directly

Migrate test mocking from Amplify.getConfig() singleton to passing
mockCtx directly via createMockAmplifyContext(). This aligns tests
with the new resolveCtxArgs pattern where APIs accept an optional
AmplifyContext as their first argument.

- Remove jest.mock('@aws-amplify/core') in favor of direct ctx passing
- Replace fetchAuthSession singleton mock with ctx.fetchAuthSession
- Use customCtx for endpoint override tests
- Fix autoSignInUserConfirmed to match updated signUpHelpers routing
- Add Amplify.configure() for tests that reach getSignInResult (still
  uses singleton internally)

* fix(auth): address PR review comments

- Restore USER_AUTH branch in signUpHelpers auto-sign-in: route directly
  to signInWithUserAuth(getGlobalContext(), input) instead of signIn(),
  which called resetAutoSignIn() and dropped the primed autoSignInStore
  session (regression). Re-add the dropped session assertion in
  autoSignIn.test.ts and correct autoSignInUserConfirmed.test.ts to
  assert the restored behavior.
- Extract duplicated server context resolution into resolveServerContext
  shared util, used by server/getCurrentUser and server/fetchUserAttributes.
- Add clearGlobalContext() cleanup in afterAll across test files that set
  a global context; make the Cognito ASF suite self-contained instead of
  relying on cross-describe context leakage.

* fix(auth): correct import order in autoSignInUserConfirmed test

Move @aws-amplify/core/internals/utils import before relative src imports
to satisfy eslint import/order.

* test(rtn-passkeys): use iPhone 17 simulator for iOS unit tests

macos-latest runner's Xcode no longer ships the iPhone 16 simulator by
default; target iPhone 17 so the xcodebuild test destination resolves.

* fix(auth): address review feedback on context threading

- Thread ctx:AmplifyContext through getSignInResult and
  handleWebAuthnSignInResult (incl. WEB_AUTHN recursion) so the
  MFA_SETUP/TOTP associateSoftwareToken call uses the same context as
  the rest of the sign-in flow instead of the global singleton config.
  Updated all 6 callers to pass ctx.
- signOut: use ctx.clearCredentials() instead of the singleton in the
  non-OAuth branch so per-request credential state is cleared.
- signUpHelpers: pass getGlobalContext() explicitly in the non-USER_AUTH
  auto-sign-in branch for symmetry with the USER_AUTH branch.
- Add focused unit test for resolveServerContext covering both the
  AmplifyContext and legacy ContextSpec branches.
- Collapse verbose comment in resolveServerContext to one line.

Author: bobbor

packages/auth/__tests__/providers/cognito/apis/server/resolveServerContext.test.ts

@@ -0,0 +1,40 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { getAmplifyServerContext } from '@aws-amplify/core/internals/adapter-core';
+
+import { resolveServerContext } from '../../../../../src/providers/cognito/apis/server/resolveServerContext';
+import { createMockAmplifyContext } from '../../../../testUtils/mockAmplifyContext';
+
+jest.mock('@aws-amplify/core/internals/adapter-core');
+
+const mockGetAmplifyServerContext = getAmplifyServerContext as jest.Mock;
+
+describe('resolveServerContext', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it('returns the AmplifyContext unchanged when it has a resourcesConfig', () => {
+		const ctx = createMockAmplifyContext({
+			Auth: {
+				Cognito: {
+					userPoolClientId: '111111-aaaaa-42d8-891d-ee81a1549398',
+					userPoolId: 'us-west-2_zzzzz',
+				},
+			},
+		});
+
+		expect(resolveServerContext(ctx)).toBe(ctx);
+		expect(mockGetAmplifyServerContext).not.toHaveBeenCalled();
+	});
+
+	it('resolves a legacy ContextSpec via getAmplifyServerContext(...).amplify', () => {
+		const sentinel = { resolved: 'amplify-server-context' } as any;
+		mockGetAmplifyServerContext.mockReturnValue({ amplify: sentinel });
+		const contextSpec = { token: { value: 'token' } } as any;
+
+		expect(resolveServerContext(contextSpec)).toBe(sentinel);
+		expect(mockGetAmplifyServerContext).toHaveBeenCalledWith(contextSpec);
+	});
+});

packages/auth/__tests__/providers/cognito/autoSignIn.test.ts

@@ -1,13 +1,10 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { Amplify } from 'aws-amplify';
+import { Amplify } from '@aws-amplify/core';
+import { clearGlobalContext } from '@aws-amplify/core/internals/utils';
 
-import {
-	cognitoUserPoolsTokenProvider,
-	confirmSignUp,
-	signUp,
-} from '../../../src/providers/cognito';
+import { confirmSignUp, signUp } from '../../../src/providers/cognito';
 import {
 	autoSignIn,
 	resetAutoSignIn,
@@ -45,10 +42,8 @@ const authConfig = {
 		userPoolId: 'us-west-2_zzzzz',
 	},
 };
-cognitoUserPoolsTokenProvider.setAuthConfig(authConfig);
-Amplify.configure({
-	Auth: authConfig,
-});
+
+Amplify.configure({ Auth: authConfig });
 
 const { user1 } = authAPITestParams;
 
@@ -73,6 +68,10 @@ describe('autoSignIn()', () => {
 	// to get around debounce on autoSignIn() APIs
 	jest.useFakeTimers();
 
+	afterAll(() => {
+		clearGlobalContext();
+	});
+
 	describe('handleUserSRPAuthFlow', () => {
 		beforeEach(() => {
 			mockCreateSignUpClient.mockReturnValueOnce(mockSignUp);

packages/auth/__tests__/providers/cognito/confirmResetPassword.test.ts

@@ -1,34 +1,23 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { Amplify } from '@aws-amplify/core';
-
 import { AuthError } from '../../../src/errors/AuthError';
 import { AuthValidationErrorCode } from '../../../src/errors/types/validation';
 import { confirmResetPassword } from '../../../src/providers/cognito';
 import { ConfirmForgotPasswordException } from '../../../src/providers/cognito/types/errors';
 import { createConfirmForgotPasswordClient } from '../../../src/foundation/factories/serviceClients/cognitoIdentityProvider';
 import { createCognitoUserPoolEndpointResolver } from '../../../src/providers/cognito/factories';
+import { createMockAmplifyContext } from '../../testUtils/mockAmplifyContext';
 
 import { authAPITestParams } from './testUtils/authApiTestParams';
 import { getMockError } from './testUtils/data';
-import { setUpGetConfig } from './testUtils/setUpGetConfig';
-
-jest.mock('@aws-amplify/core', () => ({
-	...(jest.createMockFromModule('@aws-amplify/core') as object),
-	Amplify: { getConfig: jest.fn(() => ({})) },
-}));
-jest.mock('@aws-amplify/core/internals/utils', () => ({
-	...jest.requireActual('@aws-amplify/core/internals/utils'),
-	isBrowser: jest.fn(() => false),
-}));
+
 jest.mock(
 	'../../../src/foundation/factories/serviceClients/cognitoIdentityProvider',
 );
 jest.mock('../../../src/providers/cognito/factories');
 
 describe('confirmResetPassword', () => {
-	// assert mocks
 	const mockConfirmForgotPassword = jest.fn();
 	const mockCreateConfirmResetPasswordClient = jest.mocked(
 		createConfirmForgotPasswordClient,
@@ -37,8 +26,14 @@ describe('confirmResetPassword', () => {
 		createCognitoUserPoolEndpointResolver,
 	);
 
-	beforeAll(() => {
-		setUpGetConfig(Amplify);
+	const mockCtx = createMockAmplifyContext({
+		Auth: {
+			Cognito: {
+				userPoolClientId: '111111-aaaaa-42d8-891d-ee81a1549398',
+				userPoolId: 'us-west-2_zzzzz',
+				identityPoolId: 'us-west-2:xxxxxx',
+			},
+		},
 	});
 
 	beforeEach(() => {
@@ -58,14 +53,17 @@ describe('confirmResetPassword', () => {
 
 	it('should call the confirmForgotPassword and return void', async () => {
 		await expect(
-			confirmResetPassword(authAPITestParams.confirmResetPasswordRequest),
+			confirmResetPassword(
+				mockCtx,
+				authAPITestParams.confirmResetPasswordRequest,
+			),
 		).resolves.toBeUndefined();
 		expect(mockConfirmForgotPassword).toHaveBeenCalled();
 	});
 
 	it('invokes createCognitoUserPoolEndpointResolver with expected endpointOverride', async () => {
 		const expectedUserPoolEndpoint = 'https://my-custom-endpoint.com';
-		jest.mocked(Amplify.getConfig).mockReturnValueOnce({
+		const customCtx = createMockAmplifyContext({
 			Auth: {
 				Cognito: {
 					userPoolClientId: '111111-aaaaa-42d8-891d-ee81a1549398',
@@ -76,15 +74,18 @@ describe('confirmResetPassword', () => {
 			},
 		});
 
-		await confirmResetPassword(authAPITestParams.confirmResetPasswordRequest);
+		await confirmResetPassword(
+			customCtx,
+			authAPITestParams.confirmResetPasswordRequest,
+		);
 
 		expect(mockCreateCognitoUserPoolEndpointResolver).toHaveBeenCalledWith({
 			endpointOverride: expectedUserPoolEndpoint,
 		});
 	});
 
 	it('should contain clientMetadata from request', async () => {
-		await confirmResetPassword({
+		await confirmResetPassword(mockCtx, {
 			username: 'username',
 			newPassword: 'password',
 			confirmationCode: 'code',
@@ -107,7 +108,7 @@ describe('confirmResetPassword', () => {
 	it('should throw an error when username is empty', async () => {
 		expect.assertions(2);
 		try {
-			await confirmResetPassword({
+			await confirmResetPassword(mockCtx, {
 				username: '',
 				newPassword: 'password',
 				confirmationCode: 'code',
@@ -123,7 +124,7 @@ describe('confirmResetPassword', () => {
 	it('should throw an error when newPassword is empty', async () => {
 		expect.assertions(2);
 		try {
-			await confirmResetPassword({
+			await confirmResetPassword(mockCtx, {
 				username: 'username',
 				newPassword: '',
 				confirmationCode: 'code',
@@ -139,7 +140,7 @@ describe('confirmResetPassword', () => {
 	it('should throw an error when confirmationCode is empty', async () => {
 		expect.assertions(2);
 		try {
-			await confirmResetPassword({
+			await confirmResetPassword(mockCtx, {
 				username: 'username',
 				newPassword: 'password',
 				confirmationCode: '',
@@ -160,7 +161,10 @@ describe('confirmResetPassword', () => {
 			);
 		});
 		try {
-			await confirmResetPassword(authAPITestParams.confirmResetPasswordRequest);
+			await confirmResetPassword(
+				mockCtx,
+				authAPITestParams.confirmResetPasswordRequest,
+			);
 		} catch (error: any) {
 			expect(error).toBeInstanceOf(AuthError);
 			expect(error.name).toBe(
@@ -176,7 +180,7 @@ describe('confirmResetPassword', () => {
 			},
 		};
 
-		await confirmResetPassword({
+		await confirmResetPassword(mockCtx, {
 			username: 'username',
 			newPassword: 'password',
 			confirmationCode: 'code',

packages/auth/__tests__/providers/cognito/confirmSignInErrorCases.test.ts

@@ -1,27 +1,31 @@
-import { Amplify } from '@aws-amplify/core';
-
 import { AuthError } from '../../../src/errors/AuthError';
 import { AuthValidationErrorCode } from '../../../src/errors/types/validation';
 import { confirmSignIn } from '../../../src/providers/cognito/apis/confirmSignIn';
 import { RespondToAuthChallengeException } from '../../../src/providers/cognito/types/errors';
 import { signInStore } from '../../../src/client/utils/store';
 import { AuthErrorCodes } from '../../../src/common/AuthErrorStrings';
 import { createRespondToAuthChallengeClient } from '../../../src/foundation/factories/serviceClients/cognitoIdentityProvider';
+import { createMockAmplifyContext } from '../../testUtils/mockAmplifyContext';
 
 import { getMockError } from './testUtils/data';
-import { setUpGetConfig } from './testUtils/setUpGetConfig';
 import { authAPITestParams } from './testUtils/authApiTestParams';
 
-jest.mock('@aws-amplify/core', () => ({
-	...(jest.createMockFromModule('@aws-amplify/core') as object),
-	Amplify: { getConfig: jest.fn(() => ({})) },
-}));
 jest.mock('../../../src/client/utils/store');
 jest.mock(
 	'../../../src/foundation/factories/serviceClients/cognitoIdentityProvider',
 );
 jest.mock('../../../src/providers/cognito/factories');
 
+const mockCtx = createMockAmplifyContext({
+	Auth: {
+		Cognito: {
+			userPoolClientId: '111111-aaaaa-42d8-891d-ee81a1549398',
+			userPoolId: 'us-west-2_zzzzz',
+			identityPoolId: 'us-west-2:xxxxxx',
+		},
+	},
+});
+
 describe('confirmSignIn API error path cases:', () => {
 	const challengeName = 'SELECT_MFA_TYPE';
 	const signInSession = '1234234232';
@@ -34,7 +38,6 @@ describe('confirmSignIn API error path cases:', () => {
 	);
 
 	beforeAll(() => {
-		setUpGetConfig(Amplify);
 		mockStoreGetState.mockReturnValue({
 			username,
 			challengeName,
@@ -56,7 +59,7 @@ describe('confirmSignIn API error path cases:', () => {
 	it('confirmSignIn API should throw an error when challengeResponse is empty', async () => {
 		expect.assertions(2);
 		try {
-			await confirmSignIn({ challengeResponse: '' });
+			await confirmSignIn(mockCtx, { challengeResponse: '' });
 		} catch (error: any) {
 			expect(error).toBeInstanceOf(AuthError);
 			expect(error.name).toBe(AuthValidationErrorCode.EmptyChallengeResponse);
@@ -66,7 +69,7 @@ describe('confirmSignIn API error path cases:', () => {
 	it('should throw an error when sign-in step is CONTINUE_SIGN_IN_WITH_MFA_SELECTION and challengeResponse is not "SMS", "TOTP", or "EMAIL"', async () => {
 		expect.assertions(2);
 		try {
-			await confirmSignIn({ challengeResponse: 'NO_SMS' });
+			await confirmSignIn(mockCtx, { challengeResponse: 'NO_SMS' });
 		} catch (error: any) {
 			expect(error).toBeInstanceOf(AuthError);
 			expect(error.name).toBe(AuthValidationErrorCode.IncorrectMFAMethod);
@@ -81,7 +84,7 @@ describe('confirmSignIn API error path cases:', () => {
 			);
 		});
 		try {
-			await confirmSignIn({ challengeResponse: 'TOTP' });
+			await confirmSignIn(mockCtx, { challengeResponse: 'TOTP' });
 		} catch (error: any) {
 			expect(error).toBeInstanceOf(AuthError);
 			expect(error.name).toBe(
@@ -99,7 +102,7 @@ describe('confirmSignIn API error path cases:', () => {
 		});
 
 		try {
-			await confirmSignIn({
+			await confirmSignIn(mockCtx, {
 				challengeResponse: 'SMS',
 			});
 		} catch (err: any) {