fix(cognito): reject unconfirmed users in SRP auth

[aniketshukla1]

Summary

Closes #2020.

• Reject UNCONFIRMED users before USER_SRP_AUTH creates a PASSWORD_VERIFIER session.
• Recheck the user state before PASSWORD_VERIFIER validates proof or issues tokens.
• Add regression coverage for both SRP stages.

Type of change

• Bug fix (fix:)
• New feature (feat:)
• Breaking change (feat!: or fix!:)
• Docs / chore

AWS Compatibility

Floci previously allowed UNCONFIRMED users to continue through the SRP flow and receive tokens after a valid verifier response. Both SRP stages now return UserNotConfirmedException, matching USER_PASSWORD_AUTH.

Checklist

• ./mvnw test passes locally (not run; focused suite below)
• New or updated integration test added
• Focused regression coverage added
• Commit messages follow Conventional Commits

Focused verification (JDK 25):

./mvnw -q -Dtest=CognitoServiceTest test

[github-actions]

🎉 Thanks for your first pull request to Floci!

Your CI checks need a maintainer to approve them before they run. That is GitHub's standard gate on first-time contributors, not a problem with your PR — so if the checks look like they are doing nothing, that is why. Once a maintainer approves, CI and the compatibility suite start automatically. Nothing is needed from you in the meantime.

While you wait, a couple of things that make review faster:

• Link the issue this fixes with Closes #N in the description
• Commits follow Conventional Commits (feat(s3): ..., fix(dynamodb): ...)
• Behaviour changes come with a test — see CONTRIBUTING.md

Come join us in Slack — it is the fastest way to reach maintainers if you get stuck, or want feedback on an approach before investing more time in it.

[greptile-apps]

Greptile Summary

Rejects UNCONFIRMED Cognito users in both USER_SRP_AUTH stages so behavior matches USER_PASSWORD_AUTH.

• In handleUserSrpAuth, throw UserNotConfirmedException before creating a PASSWORD_VERIFIER session.
• In handlePasswordVerifierChallenge, recheck status before verifier validation/token issue.
• Add regression tests for initiate SRP and challenge response after status flips to UNCONFIRMED.

Confidence Score: 5/5

Safe to merge; the SRP paths now reject unconfirmed users consistently with password auth and the new tests exercise both stages.

The change only adds matching UserNotConfirmedException gates on handleUserSrpAuth and handlePasswordVerifierChallenge, with focused regression coverage and no incorrect store keying or missed re-fetch on the challenge path.

Important Files Changed

Filename	Overview
src/main/java/io/github/hectorvent/floci/services/cognito/CognitoAuthFlowHandler.java	Adds UNCONFIRMED checks after RESET_REQUIRED in both SRP handlers, aligned with password-auth ordering.
src/test/java/io/github/hectorvent/floci/services/cognito/CognitoServiceTest.java	Covers initiate USER_SRP_AUTH rejection for signup-unconfirmed users and PASSWORD_VERIFIER after mid-session status change.

_{Reviews (1): Last reviewed commit: "fix(cognito): reject unconfirmed users i..." | Re-trigger Greptile}

[aniketshukla1]

@hectorvent , is there anything else needs to be done in this ? Let me know.
Thanks

[aniketshukla1]

@hectorvent can we merge this ? Thanks

[hectorvent]

Thanks @aniketshukla1,

Thank you for your patience.

Merging...

[hectorvent]

🎉 This PR is included in version 1.6.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀