Conversation
#4231) * fix(auth): defer keychain-sharing reconfigure during in-flight sign-in When AWSCognitoAuthPlugin is configured with a shared keychain access group, every fetchAuthSession unconditionally sent a .reconfigure event to the auth state machine. If a fetchAuthSession landed between a sign-in step that returned .confirmSignInWithCustomChallenge and the caller's confirmSignIn, the reconfigure tore down the .signingIn substate and the next confirmSignIn threw AuthError.invalidState("User is not attempting signIn operation"). Replace the unconditional reconfigure with a reconcile that: - Reads the shared keychain credentials, compares against the local state machine's authZ credentials, and skips reconfigure when they match — eliminating wasted reconfigures on every fetch. - Defers reconfigure during locally-originated in-flight flows (.signingIn, .signingOut, .deletingUser, .federatingToIdentityPool, .clearingFederation) when the keychain has no signed-in credentials. - Adopts a sibling app's sign-in by reconfiguring even during .signingIn when the remote keychain has user-pool tokens. Relax the AWSAuthConfirmSignInTask top-level guard to accept .signedIn and return .done so the pending confirmSignIn resolves cleanly. Fixes #4224. * refactor(auth): consolidate confirmSignIn state dispatch into a switch Fold the .signedIn early-return into the same switch that handles .signingIn dispatch. The listener loop already returns .done on .signedIn(.sessionEstablished), so the early return was redundant — the only thing the .signedIn branch needs to do is skip the event dispatch that's specific to the .signingIn path. * refactor(auth): inline .signedIn handling into analyzeCurrentStateAndCreateEvent and clarify keychain/state-machine fetch helper names Move the .signedIn early-return for shared-keychain adoption into analyzeCurrentStateAndCreateEvent so execute() has a single guard + single dispatch. Rename fetchRemoteCredentials and the local-state snapshot helper to fetchCredentialsFromKeychain and fetchCredentialsFromStateMachine to make the source-of-truth pairing explicit at the call site.
harsh62
approved these changes
Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
kickoff release