The sign-in on Amplify v6, and its new pages

The auth module leaves amazon-cognito-identity-js (Amplify v5, end of support on 2027-03-01) for aws-amplify/auth v6: AWS stops flagging the apps, the sessions in place carry on, and the API stays almost the same. Next to the pages of today, which don't change, come new sign-in pages that an app brands with tokens only.

What changes

• Auth. IDEAAuthService runs on aws-amplify/auth v6 (#160). It identifies itself to Cognito as aws-amplify/6: the AWS Health notices about Amplify v5 stop once every app is updated.
• Auth. New sign-in pages, opt-in (#164): IDEAAuthRoutes, mounted in place of routes on the same path. The email first, then the password (or the page of the email's external provider); every flow (new password, MFA, password reset, sign-up, Okta) on one minimal layout, from a 320px phone to the desktop, light and dark. An app brands them with the --idea-auth-* tokens and the logo setting, with no selector on the pages, and names the footer's credit and link to the intro page with IDEA_VARIABLES.MADE_BY and IDEA_VARIABLES.INTRO_LINK (see the module's README). The pages of routes stay exactly as they are, in legacyAuthPages.
• Common, Uncommon, Teams. The route sets and the guard take the IDEA prefix of the other exports: IDEAAppStatusRoutes, IDEAAppStatusGuard, IDEAEchoRoutes, IDEATeamsRoutes, IDEAAccountRoutes. The old names (ideaAppStatusRoutes, …) stay, deprecated.

Behaviour changes for older versions

• The challenges of the sign-in (new password, MFA code) last 3 minutes: the app client's default, up to 15. The password is no longer kept to answer them, so past that time the module's pages say so (IDEA_AUTH.SIGN_IN_SESSION_EXPIRED) and go back to the sign-in. A wrong MFA code can be given again, within the time.
• The tokens are refreshed through Cognito's GetTokensFromRefreshToken.

How to adopt the new version

1. Update the @idea-ionic/* modules to 8.15.0: aws-amplify comes with @idea-ionic/auth, and amazon-cognito-identity-js goes away.
2. Copy i18n/auth again: new term SIGN_IN_SESSION_EXPIRED, plus WARNING and CHANGE_YOUR_PASSWORD_TO_LOGIN back, and the terms of the new pages. Without it, an expired challenge shows an empty message.
3. Check in the app: sign-in, first access (new password), MFA (setup, challenge, disable), password reset and logout.
4. Optional, to switch to the new pages: mount IDEAAuthRoutes in place of routes, set the tokens and the logo where the app sets its theme, then delete the app's CSS aimed at the old pages.