Fix issue where unauthenticated logins caused 401 because refresh caused new credentials to be created #2752
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
#2751
Description of changes:
These changes were based off how amplify-swift state machine behaves for same scenario.
For the iOS SDK:
When a RefreshSession event occurs for an IdentityPool only, then a RefeshUnAuthAwsCredentials event is created with the identity ID. Refer to code here
Then when the event is processed in the state machine, it send an action to FetchAuthAWSCredentials with the passed identity ID and an empty login map. Refer to code here
However on Android SDK:
When a RefreshSession event occurs for an IdentityPool only, then a RefreshUnAuthSession event is created but the identity ID that the session needs to be refreshed for is not passed in. This is essentially where I believe we lose track of the anonymous user so when we create credentials, it creates it for a new user. Refer to code here
Then when the event is processed in the state machine, it sends an action to RefreshAuthSessionAction instead of FetchAWSCredentialsAction with the identity ID and empty login map. Refer to code here
The updates to this are to reflect the same logic that is expressed on the iOS SDK as going thru the same scenario there the correct identity ID is being kept and session is being refreshed as well. Please let me know if I misunderstood the logic of both SDKs and if more information is needed. Thanks
How did you test these changes?
(Please add a line here how the changes were tested)
Documentation update required?
General Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.