Cannot update attributes of unverified user when signup attributes are incorrect

[james-cohen]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

Not applicable

Amplify APIs

Authentication

Amplify Categories

auth

Environment information

# Put output below this line

Describe the bug

My user pool is configured to allow a username signup with email and/or phone number. If I sign up as a new user e.g.

await Auth.signUp({ username: 'testuser123', password: '***', attributes: { email: 'testuser@gmail.com' } })

An authentication code is sent. However, if I accidentally entered the wrong email, there is no way to update it. If I try and sign up with the same user details again, I get a UsernameExistsException.

If I try and update the user attributes, this requires an authenticated user as a parameter, which isn't possible because the user is unconfirmed - if I call Auth.signIn() I get a UserNotConfirmedException

So now that username is stuck in limbo forever because it can't be confirmed as the email address doesn't exist, but the email can't be updated.

Expected behavior

Calling sign up with the same username and password on an unconfirmed user should be treated as a new sign up and allow the user to be recreated with the new attributes provided.

Reproduction steps

As above

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

[nadetastic]

Hi @james-cohen thank you for opening this issue.

This is a limitation from Cognito, and is actually working as expected. However a workaround/fix for this would be to have an Admin update the email/attribute for the user to the correct one which will allow the user to receive the verification code and confirm their account. This can be done via the Cognito console or by using the AdminAction API AdminUpdateUserAttribute

I'm discussing with the team to determine if there is an additional way to prevent this, but let me know if you are able to unblock via the Admin route.

[james-cohen]

Hi @nadetastic,

Yes for now I have worked around it with a preSignupTrigger that uses the admin API as you suggested. This works fine, it just seems like a basic enough issue that shouldn't require admin intervention - it's not ideal UX for a user to have to go and re-register from scratch because they mistyped their email or phone number. But if it's a Cognito issue then so be it.