Description of changes

Amplify supports two types of oauth flows in V5 "IDP (initiated by provider)" and "SP (initiated by client)". Since IDP flow is initiated outside of Amplify we uses a global urlListener to handle the oauth response when the url query params contain code,access_token or error.

However even if the app isn't redirected from HostedUI but contains the the url query params code,access_token or error, the global urlListener is hit and the url is replaced with the redirectSignIn url

Solution

• Add an option to Amplify.configure() to optionally disable IDP initiated flow to avoid calling the global urlListener
• Detect if a SP initiated flow is in flight using a amplify-sp-initiated-oauth-inFlight flag in local storage
• If SP initiated flow is in flight OR IDP initiated flow is enabled call the global urlListener to handle oauth response

Issue #, if available

Description of how you validated changes

// on sampleApp
import { Amplify } from "aws-amplify";
import awsconfig from "./aws-exports";

Amplify.configure({
  ...awsconfig,
  oauth: {
    ...awsconfig.oauth,
    idpEnabled: false, // defaults to true to avoid breaking change
  },
});

Tested the following flows

• SP flow works as expected irrespective of setting idpEnabled in Amplify.configure
• IDP flow works by default, idpEnabled: true and ignored when idpEnabled: false
• The url query params aren't swallowed when idpEnabled: false

Checklist

• PR description included
• yarn test passes
• Tests are changed or added
• Relevant documentation is changed or added (and PR referenced)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.