fix(cli): preserve phone-based sign-in in gen2 migration - #14969
Merged
sharonyajain merged 2 commits intoAug 12, 2026
Merged
Conversation
The gen2 migration auth renderer unconditionally emitted loginWith.email and never emitted loginWith.phone, so Gen1 user pools that verify via phone_number (email verification disabled) were migrated to email login. This broke sign-in, auto-verification, and forgot-password parity. Derive login mechanisms from the source pool's UsernameAttributes, AliasAttributes, and AutoVerifiedAttributes, emitting phone and/or email to match Gen1 (falling back to email when neither is present, since defineAuth requires at least one). Email is kept as a required user attribute when it is not a sign-in mechanism. Refs aws-amplify#14810
soberm
reviewed
Aug 11, 2026
…tion Address PR review feedback: - Weight UsernameAttributes/AliasAttributes over AutoVerifiedAttributes when deriving login mechanisms. Auto-verify only controls verification-code delivery and does not by itself make an attribute a usable sign-in method, so it is now consulted only when no sign-in attribute is populated. - Add unit tests for the AliasAttributes source and for a pool that enables both email and phone sign-in. - Tighten the regression test assertion to pin email under userAttributes. Refs aws-amplify#14810
soberm
approved these changes
Aug 12, 2026
Simone319
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes
The Gen2 migration auth renderer (
packages/amplify-cli/src/commands/gen2-migration/generate/amplify/auth/auth.renderer.ts) unconditionally emittedloginWith.emailand never emittedloginWith.phone. As a result, Gen1 Cognito user pools that verify viaphone_number(email verification disabled, using SMS/TOTP) were migrated to email-based login, breaking parity for sign-in, auto-verification, and forgot-password.This change derives the login mechanisms from the source pool's
UsernameAttributes,AliasAttributes, andAutoVerifiedAttributes, emittingphoneand/oremailto match the Gen1 configuration. It falls back to email only when neither is present (sincedefineAuthrequires at least one). Email is preserved as a required user attribute when it is not a sign-in mechanism.Issue #, if available
Addresses part of #14810 (the
loginWithmechanism). The SMS configuration / SNS caller-role carry-over described in that issue is a separate concern (Gen2defineAuthdoes not auto-provision an SNS role fromloginWith: { phone: true })and is tracked as a follow-up.
Description of how you validated changes
generates phone loginunit test snapshot, which previously asserted the buggyloginWith: { email: true }output for a phone-based pool.AutoVerifiedAttributes: ['phone_number'], email as a required attribute) assertingphone: trueand no email login.discussionsandmedia-vaultmigration-app snapshots to reflect correct phone/combined login.yarn testfor the gen2-migration suite: 432/432 tests pass across 48 suites.Checklist
yarn testpassesBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.