feat(auth): add option to disable idp oauth flow

[ashwinkumar6]

Description of changes

Amplify supports two types of oauth flows in V5 "IDP (initiated by provider)" and "SP (initiated by client)". Since IDP flow is initiated outside of Amplify we uses a global urlListener to handle the oauth response when the url query params contain code,access_token or error.

However even if the app isn't redirected from HostedUI but contains the the url query params code,access_token or error, the global urlListener is hit and the url is replaced with the redirectSignIn url

Solution

• Add an option to Amplify.configure() to optionally disable IDP initiated flow to avoid calling the global urlListener
• Detect if a SP initiated flow is in flight using a amplify-sp-initiated-oauth-inFlight flag in local storage
• If SP initiated flow is in flight OR IDP initiated flow is enabled call the global urlListener to handle oauth response

Issue #, if available

Description of how you validated changes

// on sampleApp
import { Amplify } from "aws-amplify";
import awsconfig from "./aws-exports";

Amplify.configure({
  ...awsconfig,
  oauth: {
    ...awsconfig.oauth,
    idpEnabled: false, // defaults to true to avoid breaking change
  },
});

Tested the following flows

• SP flow works as expected irrespective of setting idpEnabled in Amplify.configure
• IDP flow works by default, idpEnabled: true and ignored when idpEnabled: false
• The url query params aren't swallowed when idpEnabled: false

Checklist

• PR description included
• yarn test passes
• Tests are changed or added
• Relevant documentation is changed or added (and PR referenced)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[israx]

is this flag set when Auth.federatedSignIn is called ?

if this issue is web specific, we probably can exclude RN

[ashwinkumar6]

Yep, this flag is set when Auth.federatedSignIn is called. This is to determine if an SP initiated oauth is in progress.

The following flow is common for web and RN

1. add a flag when Auth.federatedSignIn is called
2. When redirected back from HostedUI, if ^^ flag is present allow urlListener to get fired, hence handling oauth
3. remove flag from storage

[israx]

wondering if it make sense to clean any keys after the user has finished the oauth flow

[ashwinkumar6]

When _handleAuthResponse is called we handle Oauth only when the url contains code | error. Hence clearing the flag specifically here. Irrespective of success/failure clearing the flag early on.
WDYT

[ashwinkumar6]

NOTE: The actual naming of the flag (idpEnabled) is pending approval
rest of all the code changes are ready for review