Amplify-js: Detect if user is not confirmed prior authentication

[EgidioCaprino]

* Which Category is your question related to? *
Auth

* What AWS Services are you utilizing? *
Cognito

* Provide additional details e.g. code snippets *
In our configuration Cognito user has to verify the email address or the phone number they used to register the account. If the user does not verify the account and tries to login, Amplify throws a UserNotFoundException. Is there a way to distinguish wether the user is not registered from when they are registered but not confirmed?

[haverchuck]

@EgidioCaprino Are you sure that the user is being created in the UserPool? If the user is created but not confirmed, a login attempt should result in a 'UserNotConfirmedException':

{code: "UserNotConfirmedException", name: "UserNotConfirmedException", message: "User is not confirmed."}

[stale[bot]]

This issue has been automatically closed because of inactivity. Please open a new issue if are still encountering problems.

[ricardoribas]

What about if the user tries to login with wrong credentials? I opened an issue with that:
https://github.com/aws-amplify/amplify-cli/issues/2657

[NL33]

Bump on this issue. It appears that if a user creates an account, but then leaves before being confirmed. And then later tries to:
1) Sign up--it says the account already exists
2) Sign in --it says the user is not confirmed.

So we do indeed need a way to know if the user is registered but not confirmed. In that case, when they try to sign in, they could sign in but then have to verify before proceeding.

[clintfoster]

I believe this ticket should be re-opened per the original description, which is slightly different than the last comment above. Steps to repro:

1. Sign up
2. Do not confirm email
3. Try to sign in
4. Expected: Some kind of specific error like UserNotConfirmedException
5. Actual: UserNotFoundException

This leaves the client app no way to distinguish between a user trying to sign in who never created an account versus a user who signed up but never entered the code. Sure, the user can simply sign up again. But we're having users call Support when they exit the app for whatever reason before completing registration. They expect to be prompted to enter the code when they go back in.

[clintfoster]

@Amplifiyer in similar issue https://github.com/aws-amplify/amplify-js/issues/4307 you indicated UserNotConfirmedException should be returned when the user attempts to sign into an unconfirmed account. In that issue the question was whether it should be returned both for correct & incorrect password. In our case we are getting UserNotFoundException instead of UserNotConfirmedException either way.

I'm wondering if what's different about us is we're using email _aliases_ for sign in because there was no option to literally use your email as your username a few years ago when we created our user pool (and it can't be changed after the fact). Here are slightly updated steps from what I posted above, in case this nuance matters:

1. Sign up with email _alias_ (we generate username as UUID in background)
2. Do not confirm email
3. Try to sign in with email alias
4. Expected: Some kind of specific error like UserNotConfirmedException
5. Actual: UserNotFoundException

This is happening both with the older JS SDK and the newer aws-sdk-ios 2.13.4 Swift SDK.

Update: I tried signing in with my generated _username_ (a UUID we don't show to users) instead of my email _alias_, and the correct error was returned: UserNotConfirmedException. So the issue is specifically related to attempting to sign in with an email alias after failing to enter the confirmation code.

[Amplifiyer]

@clintfoster, are you seeing this exception in latest amplify-js library? If yes, please create a new issue for us. For issues with aws-sdk-ios 2.13.4 sdk please cut an issue here https://github.com/aws-amplify/aws-sdk-ios/issues