get_tokens_from_refresh_token ¶

def get_tokens_from_refresh_token(
    self,
    refresh_token: "capo_cognito_identity_provider.types.token_model_type.TokenModelType",
    client_id: "capo_cognito_identity_provider.types.client_id_type.ClientIdType",
    *,
    config_overrides: Optional[CognitoIdentityProviderClientConfig] = None,
    client_secret: Optional[
        "capo_cognito_identity_provider.types.client_secret_type.ClientSecretType"
    ] = None,
    device_key: Optional[
        "capo_cognito_identity_provider.types.device_key_type.DeviceKeyType"
    ] = None,
    client_metadata: Optional[
        "capo_cognito_identity_provider.types.client_metadata_type.ClientMetadataType"
    ] = None,
) -> "capo_cognito_identity_provider.types.get_tokens_from_refresh_token_response.GetTokensFromRefreshTokenResponse":
    """<p>Given a refresh token, issues new ID, access, and optionally refresh tokens for the user who owns the submitted token. This operation issues a new refresh token and invalidates the original refresh token after an optional grace period when refresh token rotation is enabled. If refresh token rotation is disabled, issues new ID and access tokens only.</p>

    Args:
        refresh_token: <p>A valid refresh token that can authorize the request for new tokens. When refresh token rotation is active in the requested app client, this token is invalidated after the request is complete and after an optional grace period.</p>
        client_id: <p>The app client that issued the refresh token to the user who wants to request new tokens.</p>
        client_secret: <p>The client secret of the requested app client, if the client has a secret.</p>
        device_key: <p>When you enable device remembering, Amazon Cognito issues a device key that you can use for device authentication that bypasses multi-factor authentication (MFA). To implement <code>GetTokensFromRefreshToken</code> in a user pool with device remembering, you must capture the device key from the initial authentication request. If your application doesn't provide the key of a registered device, Amazon Cognito issues a new one. You must provide the confirmed device key in this request if device remembering is enabled in your user pool.</p> <p>For more information about device remembering, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html">Working with devices</a>.</p>
        client_metadata: <p>A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning Lambda functions to user pool triggers.</p> <p>When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the function receives as input. This payload contains a <code>clientMetadata</code> attribute that provides the data that you assigned to the ClientMetadata parameter in your request. In your function code, you can process the <code>clientMetadata</code> value to enhance your workflow for your specific needs.</p> <p>To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event"> Connecting API actions to Lambda triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p> <note> <p>When you use the <code>ClientMetadata</code> parameter, note that Amazon Cognito won't do the following:</p> <ul> <li> <p>Store the <code>ClientMetadata</code> value. This data is available only to Lambda triggers that are assigned to a user pool to support custom workflows. If your user pool configuration doesn't include triggers, the <code>ClientMetadata</code> parameter serves no purpose.</p> </li> <li> <p>Validate the <code>ClientMetadata</code> value.</p> </li> <li> <p>Encrypt the <code>ClientMetadata</code> value. Don't send sensitive information in this parameter.</p> </li> </ul> </note>

    Raises:
        capo_cognito_identity_provider.errors.forbidden_exception.ForbiddenException: <p>This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.</p>
        capo_cognito_identity_provider.errors.internal_error_exception.InternalErrorException: <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>
        capo_cognito_identity_provider.errors.invalid_lambda_response_exception.InvalidLambdaResponseException: <p>This exception is thrown when Amazon Cognito encounters an invalid Lambda response.</p>
        capo_cognito_identity_provider.errors.invalid_parameter_exception.InvalidParameterException: <p>This exception is thrown when the Amazon Cognito service encounters an invalid parameter.</p>
        capo_cognito_identity_provider.errors.not_authorized_exception.NotAuthorizedException: <p>This exception is thrown when a user isn't authorized.</p>
        capo_cognito_identity_provider.errors.operation_not_enabled_exception.OperationNotEnabledException: <p>This exception is thrown when an operation is not available in the current region or for the current user pool configuration. This can occur when attempting to perform operations that are not supported in secondary replica regions.</p>
        capo_cognito_identity_provider.errors.refresh_token_reuse_exception.RefreshTokenReuseException: <p>This exception is throw when your application requests token refresh with a refresh token that has been invalidated by refresh-token rotation.</p>
        capo_cognito_identity_provider.errors.resource_not_found_exception.ResourceNotFoundException: <p>This exception is thrown when the Amazon Cognito service can't find the requested resource.</p>
        capo_cognito_identity_provider.errors.too_many_requests_exception.TooManyRequestsException: <p>This exception is thrown when the user has made too many requests for a given operation.</p>
        capo_cognito_identity_provider.errors.unexpected_lambda_exception.UnexpectedLambdaException: <p>This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.</p>
        capo_cognito_identity_provider.errors.user_lambda_validation_exception.UserLambdaValidationException: <p>This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.</p>
        capo_cognito_identity_provider.errors.user_not_found_exception.UserNotFoundException: <p>This exception is thrown when a user isn't found.</p>
        capo_cognito_identity_provider.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_cognito_identity_provider.types.get_tokens_from_refresh_token_request.GetTokensFromRefreshTokenRequest]",
    ) -> OperationResponse[
        "capo_cognito_identity_provider.types.get_tokens_from_refresh_token_response.GetTokensFromRefreshTokenResponse"
    ]:
        import capo_cognito_identity_provider._operations.aws_cognito_identity_provider_service.get_tokens_from_refresh_token

        output, http_response = (
            capo_cognito_identity_provider._operations.aws_cognito_identity_provider_service.get_tokens_from_refresh_token.get_tokens_from_refresh_token(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_cognito_identity_provider.types.get_tokens_from_refresh_token_request.GetTokensFromRefreshTokenRequest",
    ) -> dict[str, Any]:
        import capo_cognito_identity_provider.types.get_tokens_from_refresh_token_request

        return capo_cognito_identity_provider.types.get_tokens_from_refresh_token_request.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_cognito_identity_provider.types.get_tokens_from_refresh_token_response.GetTokensFromRefreshTokenResponse",
    ) -> dict[str, Any]:
        import capo_cognito_identity_provider.types.get_tokens_from_refresh_token_response

        return capo_cognito_identity_provider.types.get_tokens_from_refresh_token_response.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "GetTokensFromRefreshToken",
            redact_input=_redact_input,
            redact_output=_redact_output,
        ),
    )
    input_: capo_cognito_identity_provider.types.get_tokens_from_refresh_token_request.GetTokensFromRefreshTokenRequest = {
        "refresh_token": refresh_token,
        "client_id": client_id,
    }
    if client_secret is not None:
        input_["client_secret"] = client_secret
    if device_key is not None:
        input_["device_key"] = device_key
    if client_metadata is not None:
        input_["client_metadata"] = client_metadata

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output