@kensio/yulin 0.41.0 → 0.42.0

package/dist/service/cognito/sim-cognito-identity-provider.d.ts

@@ -0,0 +1,81 @@
+import { type BackgroundScheduler } from "../../util/background/background.js";
+import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
+import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type * as simCognitoCommands from "./command/sim-cognito-command.types.js";
+import type { SimCognitoUserPool } from "./user-pool/sim-cognito-user-pool.js";
+export interface SimCognitoIdentityProviderRequestOptions {
+    readonly caller?: SimAwsCaller;
+}
+interface SimCognitoIdentityProviderProperties {
+    readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated Cognito user pools. Handles SDK commands. Emulates AWS behaviour
+ * and state.
+ *
+ * Pools are scoped to an account and region, as they are on real AWS: a pool
+ * id names the region it was created in, and an app client id is only
+ * meaningful inside its pool.
+ *
+ * Only user pools are simulated. Cognito identity pools, which hand out AWS
+ * credentials, are a different service and are not simulated at all.
+ */
+export declare class SimCognitoIdentityProvider {
+    private readonly pools;
+    private readonly userPoolCommands;
+    private readonly listUserPoolsCommand;
+    private readonly clientCommands;
+    private readonly listClientsCommand;
+    private readonly background;
+    private readonly sdkRouter;
+    constructor(properties?: SimCognitoIdentityProviderProperties);
+    /**
+     * Find a user pool by id.
+     *
+     * This is the simulator's own accessor, for tests seeding or inspecting
+     * pool state without going through a Command and its authorization.
+     */
+    findUserPool(userPoolId: string): SimCognitoUserPool | undefined;
+    /**
+     * Handle a CreateUserPool Command from the SDK.
+     */
+    createUserPool(command: simCognitoCommands.SimCreateUserPoolCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimCreateUserPoolCommandOutput>;
+    /**
+     * Handle a DescribeUserPool Command from the SDK.
+     */
+    describeUserPool(command: simCognitoCommands.SimDescribeUserPoolCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimDescribeUserPoolCommandOutput>;
+    /**
+     * Handle a DeleteUserPool Command from the SDK.
+     */
+    deleteUserPool(command: simCognitoCommands.SimDeleteUserPoolCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimDeleteUserPoolCommandOutput>;
+    /**
+     * Handle a ListUserPools Command from the SDK.
+     */
+    listUserPools(command: simCognitoCommands.SimListUserPoolsCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimListUserPoolsCommandOutput>;
+    /**
+     * Handle a CreateUserPoolClient Command from the SDK.
+     */
+    createUserPoolClient(command: simCognitoCommands.SimCreateUserPoolClientCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimCreateUserPoolClientCommandOutput>;
+    /**
+     * Handle a DescribeUserPoolClient Command from the SDK.
+     */
+    describeUserPoolClient(command: simCognitoCommands.SimDescribeUserPoolClientCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimDescribeUserPoolClientCommandOutput>;
+    /**
+     * Handle a DeleteUserPoolClient Command from the SDK.
+     */
+    deleteUserPoolClient(command: simCognitoCommands.SimDeleteUserPoolClientCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimDeleteUserPoolClientCommandOutput>;
+    /**
+     * Handle a ListUserPoolClients Command from the SDK.
+     */
+    listUserPoolClients(command: simCognitoCommands.SimListUserPoolClientsCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimListUserPoolClientsCommandOutput>;
+    /**
+     * Get this service's SDK Command router for SDK client interception.
+     */
+    sdkCommandRouter(): SimSdkCommandRouter;
+}
+export {};
+//# sourceMappingURL=sim-cognito-identity-provider.d.ts.map

package/dist/service/cognito/sim-cognito-identity-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAI1D,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAKlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAK/E,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA0B;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmC;IAClE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAgC;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAElE,YAAY,UAAU,GAAE,oCAAyC,EAiChE;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE/D;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,kBAAkB,CAAC,0BAA0B,EACtD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAG9D;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,kBAAkB,CAAC,uBAAuB,EACnD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAG3D;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,kBAAkB,CAAC,6BAA6B,EACzD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,mCAAmC,CAAC,CAGjE;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}

package/dist/service/cognito/sim-cognito-identity-provider.js

@@ -0,0 +1,132 @@
+import { BackgroundTasks, } from "../../util/background/background.js";
+import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimCognitoAuthorizer } from "./command/authorize/sim-cognito-authorizer.js";
+import { SimCognitoListUserPoolClients } from "./command/client/sim-cognito-list-user-pool-clients.js";
+import { SimCognitoUserPoolClientCommands } from "./command/client/sim-cognito-user-pool-client-commands.js";
+import { SimCognitoListUserPools } from "./command/user-pool/sim-cognito-list-user-pools.js";
+import { SimCognitoUserPoolCommands } from "./command/user-pool/sim-cognito-user-pool-commands.js";
+import { SimCognitoSdkCommandRouter } from "./sdk/sim-cognito-sdk-command-router.js";
+import { SimCognitoUserPoolClientFactory } from "./user-pool/client/sim-cognito-user-pool-client-factory.js";
+import { SimCognitoUserPoolFactory } from "./user-pool/sim-cognito-user-pool-factory.js";
+import { SimCognitoUserPoolStore } from "./user-pool/sim-cognito-user-pool-store.js";
+/**
+ * Simulated Cognito user pools. Handles SDK commands. Emulates AWS behaviour
+ * and state.
+ *
+ * Pools are scoped to an account and region, as they are on real AWS: a pool
+ * id names the region it was created in, and an app client id is only
+ * meaningful inside its pool.
+ *
+ * Only user pools are simulated. Cognito identity pools, which hand out AWS
+ * credentials, are a different service and are not simulated at all.
+ */
+export class SimCognitoIdentityProvider {
+    pools;
+    userPoolCommands;
+    listUserPoolsCommand;
+    clientCommands;
+    listClientsCommand;
+    background;
+    sdkRouter = new SimCognitoSdkCommandRouter(this);
+    constructor(properties = {}) {
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const authorizer = new SimCognitoAuthorizer({ iam, accountRegionScope });
+        this.background = background;
+        this.pools = new SimCognitoUserPoolStore();
+        this.userPoolCommands = new SimCognitoUserPoolCommands({
+            pools: this.pools,
+            poolFactory: new SimCognitoUserPoolFactory({
+                accountRegionScope,
+                pools: this.pools,
+                clock: background,
+            }),
+            authorizer,
+        });
+        this.listUserPoolsCommand = new SimCognitoListUserPools({
+            pools: this.pools,
+            authorizer,
+        });
+        this.clientCommands = new SimCognitoUserPoolClientCommands({
+            pools: this.pools,
+            clientFactory: new SimCognitoUserPoolClientFactory({ clock: background }),
+            authorizer,
+        });
+        this.listClientsCommand = new SimCognitoListUserPoolClients({
+            pools: this.pools,
+            authorizer,
+        });
+    }
+    /**
+     * Find a user pool by id.
+     *
+     * This is the simulator's own accessor, for tests seeding or inspecting
+     * pool state without going through a Command and its authorization.
+     */
+    findUserPool(userPoolId) {
+        return this.pools.find(userPoolId);
+    }
+    /**
+     * Handle a CreateUserPool Command from the SDK.
+     */
+    async createUserPool(command, options) {
+        await this.background.sequence();
+        return this.userPoolCommands.create(command, options);
+    }
+    /**
+     * Handle a DescribeUserPool Command from the SDK.
+     */
+    async describeUserPool(command, options) {
+        await this.background.sequence();
+        return this.userPoolCommands.describe(command, options);
+    }
+    /**
+     * Handle a DeleteUserPool Command from the SDK.
+     */
+    async deleteUserPool(command, options) {
+        await this.background.sequence();
+        return this.userPoolCommands.delete(command, options);
+    }
+    /**
+     * Handle a ListUserPools Command from the SDK.
+     */
+    async listUserPools(command, options) {
+        await this.background.sequence();
+        return this.listUserPoolsCommand.handle(command, options);
+    }
+    /**
+     * Handle a CreateUserPoolClient Command from the SDK.
+     */
+    async createUserPoolClient(command, options) {
+        await this.background.sequence();
+        return this.clientCommands.create(command, options);
+    }
+    /**
+     * Handle a DescribeUserPoolClient Command from the SDK.
+     */
+    async describeUserPoolClient(command, options) {
+        await this.background.sequence();
+        return this.clientCommands.describe(command, options);
+    }
+    /**
+     * Handle a DeleteUserPoolClient Command from the SDK.
+     */
+    async deleteUserPoolClient(command, options) {
+        await this.background.sequence();
+        return this.clientCommands.delete(command, options);
+    }
+    /**
+     * Handle a ListUserPoolClients Command from the SDK.
+     */
+    async listUserPoolClients(command, options) {
+        await this.background.sequence();
+        return this.listClientsCommand.handle(command, options);
+    }
+    /**
+     * Get this service's SDK Command router for SDK client interception.
+     */
+    sdkCommandRouter() {
+        return this.sdkRouter;
+    }
+}
+//# sourceMappingURL=sim-cognito-identity-provider.js.map

package/dist/service/cognito/sim-cognito-identity-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAE7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,uDAAuD,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAC;AAE7G,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAYrF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,0BAA0B;IACpB,KAAK,CAA0B;IAC/B,gBAAgB,CAA6B;IAC7C,oBAAoB,CAA0B;IAC9C,cAAc,CAAmC;IACjD,kBAAkB,CAAgC;IAClD,UAAU,CAAsB;IAChC,SAAS,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAElE,YAAY,UAAU,GAAyC,EAAE;QAC/D,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,MAAM,UAAU,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC3C,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CAAC;YACrD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,yBAAyB,CAAC;gBACzC,kBAAkB;gBAClB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,UAAU;aAClB,CAAC;YACF,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,GAAG,IAAI,uBAAuB,CAAC;YACtD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,gCAAgC,CAAC;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,+BAA+B,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YACzE,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,6BAA6B,CAAC;YAC1D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAkB;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAkC,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAoD,EACpD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAsD,EACtD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAoD,EACpD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAmD,EACnD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAyD,EACzD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-client-secret.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generate an app client secret.
+ *
+ * Only a client created with `GenerateSecret` has one. A client without a
+ * secret reports no `ClientSecret` at all rather than an empty one, which is
+ * what makes code computing a `SECRET_HASH` fail on the client it should fail
+ * on.
+ */
+export declare function makeSimCognitoClientSecret(): string;
+//# sourceMappingURL=sim-cognito-client-secret.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-client-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-client-secret.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-client-secret.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD"}

package/dist/service/cognito/user-pool/client/sim-cognito-client-secret.js

@@ -0,0 +1,22 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Real client secrets are fifty-two lowercase alphanumerics. The length is
+ * worth matching because application code sometimes carries an assertion or a
+ * configuration check on it.
+ */
+const clientSecretLength = 52;
+/**
+ * Generate an app client secret.
+ *
+ * Only a client created with `GenerateSecret` has one. A client without a
+ * secret reports no `ClientSecret` at all rather than an empty one, which is
+ * what makes code computing a `SECRET_HASH` fail on the client it should fail
+ * on.
+ */
+export function makeSimCognitoClientSecret() {
+    return faker.string.alphanumeric({
+        length: clientSecretLength,
+        casing: "lower",
+    });
+}
+//# sourceMappingURL=sim-cognito-client-secret.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-client-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-client-secret.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-client-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExC;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The authentication flows one simulated app client supports.
+ *
+ * This is the setting that decides whether an authentication request reaches
+ * the pool at all, so the values are validated rather than stored as written:
+ * a typo in a flow name would otherwise turn into a puzzling sign-in failure
+ * much later.
+ */
+export declare class SimCognitoExplicitAuthFlows {
+    readonly values: readonly string[];
+    constructor(requested: readonly string[] | undefined);
+    private static requireKnown;
+    /**
+     * Refuse a request naming both a legacy flow and an `ALLOW_` prefixed one,
+     * as real Cognito refuses it.
+     */
+    private static refuseMixedGenerations;
+    /**
+     * Whether the client supports an authentication flow.
+     */
+    allows(flow: string): boolean;
+}
+//# sourceMappingURL=sim-cognito-explicit-auth-flows.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-explicit-auth-flows.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.ts"],"names":[],"mappings":"AAiCA;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAanD;IAED,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAcrC;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5B;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.js

@@ -0,0 +1,77 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The authentication flows Cognito has replaced, kept for app clients made
+ * before the `ALLOW_` prefixed values existed.
+ */
+const legacyAuthFlows = [
+    "ADMIN_NO_SRP_AUTH",
+    "CUSTOM_AUTH_FLOW_ONLY",
+    "USER_PASSWORD_AUTH",
+];
+const currentAuthFlows = [
+    "ALLOW_ADMIN_USER_PASSWORD_AUTH",
+    "ALLOW_CUSTOM_AUTH",
+    "ALLOW_REFRESH_TOKEN_AUTH",
+    "ALLOW_USER_AUTH",
+    "ALLOW_USER_PASSWORD_AUTH",
+    "ALLOW_USER_SRP_AUTH",
+];
+/**
+ * The flows an app client supports when its request named none.
+ *
+ * Sign-in with a username and password is deliberately not among them, which
+ * is why `USER_PASSWORD_AUTH` fails on a client nobody configured.
+ */
+const defaultAuthFlows = [
+    "ALLOW_REFRESH_TOKEN_AUTH",
+    "ALLOW_USER_SRP_AUTH",
+    "ALLOW_CUSTOM_AUTH",
+];
+/**
+ * The authentication flows one simulated app client supports.
+ *
+ * This is the setting that decides whether an authentication request reaches
+ * the pool at all, so the values are validated rather than stored as written:
+ * a typo in a flow name would otherwise turn into a puzzling sign-in failure
+ * much later.
+ */
+export class SimCognitoExplicitAuthFlows {
+    values;
+    constructor(requested) {
+        if (requested === undefined || requested.length === 0) {
+            this.values = defaultAuthFlows;
+            return;
+        }
+        for (const flow of requested) {
+            SimCognitoExplicitAuthFlows.requireKnown(flow);
+        }
+        SimCognitoExplicitAuthFlows.refuseMixedGenerations(requested);
+        this.values = [...requested];
+    }
+    static requireKnown(flow) {
+        if (legacyAuthFlows.includes(flow) || currentAuthFlows.includes(flow)) {
+            return;
+        }
+        throw new SimCognitoInvalidParameterException(`ExplicitAuthFlows '${flow}' is not a Cognito authentication flow: ` +
+            `use one of ${currentAuthFlows.join(", ")}`);
+    }
+    /**
+     * Refuse a request naming both a legacy flow and an `ALLOW_` prefixed one,
+     * as real Cognito refuses it.
+     */
+    static refuseMixedGenerations(requested) {
+        const hasLegacy = requested.some((flow) => legacyAuthFlows.includes(flow));
+        const hasCurrent = requested.some((flow) => currentAuthFlows.includes(flow));
+        if (hasLegacy && hasCurrent) {
+            throw new SimCognitoInvalidParameterException("ExplicitAuthFlows cannot mix the legacy flows " +
+                `(${legacyAuthFlows.join(", ")}) with the ALLOW_ prefixed ones`);
+        }
+    }
+    /**
+     * Whether the client supports an authentication flow.
+     */
+    allows(flow) {
+        return this.values.includes(flow);
+    }
+}
+//# sourceMappingURL=sim-cognito-explicit-auth-flows.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-explicit-auth-flows.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;GAGG;AACH,MAAM,eAAe,GAAsB;IACzC,mBAAmB;IACnB,uBAAuB;IACvB,oBAAoB;CACrB,CAAC;AAEF,MAAM,gBAAgB,GAAsB;IAC1C,gCAAgC;IAChC,mBAAmB;IACnB,0BAA0B;IAC1B,iBAAiB;IACjB,0BAA0B;IAC1B,qBAAqB;CACtB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAsB;IAC1C,0BAA0B;IAC1B,qBAAqB;IACrB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtB,MAAM,CAAoB;IAE1C,YAAY,SAAwC;QAClD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,2BAA2B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAED,2BAA2B,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAC/B,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,IAAY;QACtC,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,sBAAsB,IAAI,0CAA0C;YAClE,cAAc,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,sBAAsB,CAAC,SAA4B;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChC,CAAC;QAEF,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,mCAAmC,CAC3C,gDAAgD;gBAC9C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.d.ts

@@ -0,0 +1,13 @@
+import { SimCognitoTokenLifetime } from "./sim-cognito-token-lifetime.js";
+/**
+ * Build an app client's refresh token lifetime.
+ *
+ * This is the one lifetime with a rule of its own: Cognito substitutes thirty
+ * days both for an absent validity and for a zero. The substituted default is
+ * thirty days whatever unit the request named, so the unit is left out along
+ * with the value it would have counted. It is still checked first, because
+ * real Cognito refuses a unit it does not have whether or not the unit ends
+ * up counting anything.
+ */
+export declare function makeSimCognitoRefreshTokenLifetime(requested: number | undefined, unit: string | undefined): SimCognitoTokenLifetime;
+//# sourceMappingURL=sim-cognito-refresh-token-lifetime.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-token-lifetime.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,EACxB,MAAM,iCAAiC,CAAC;AAMzC;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,uBAAuB,CAoBzB"}

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.js

@@ -0,0 +1,28 @@
+import { requireCognitoTokenValidityUnit, SimCognitoTokenLifetime, } from "./sim-cognito-token-lifetime.js";
+import { defaultRefreshTokenValidityDays, refreshTokenLifetimeSpec, } from "./sim-cognito-token-lifetime-specs.js";
+/**
+ * Build an app client's refresh token lifetime.
+ *
+ * This is the one lifetime with a rule of its own: Cognito substitutes thirty
+ * days both for an absent validity and for a zero. The substituted default is
+ * thirty days whatever unit the request named, so the unit is left out along
+ * with the value it would have counted. It is still checked first, because
+ * real Cognito refuses a unit it does not have whether or not the unit ends
+ * up counting anything.
+ */
+export function makeSimCognitoRefreshTokenLifetime(requested, unit) {
+    requireCognitoTokenValidityUnit(refreshTokenLifetimeSpec.field, unit, refreshTokenLifetimeSpec.defaultUnit);
+    if (requested === undefined || requested === 0) {
+        return new SimCognitoTokenLifetime({
+            ...refreshTokenLifetimeSpec,
+            validity: defaultRefreshTokenValidityDays,
+            unit: undefined,
+        });
+    }
+    return new SimCognitoTokenLifetime({
+        ...refreshTokenLifetimeSpec,
+        validity: requested,
+        unit,
+    });
+}
+//# sourceMappingURL=sim-cognito-refresh-token-lifetime.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-token-lifetime.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,uCAAuC,CAAC;AAE/C;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAChD,SAA6B,EAC7B,IAAwB;IAExB,+BAA+B,CAC7B,wBAAwB,CAAC,KAAK,EAC9B,IAAI,EACJ,wBAAwB,CAAC,WAAW,CACrC,CAAC;IAEF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG,wBAAwB;YAC3B,QAAQ,EAAE,+BAA+B;YACzC,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,uBAAuB,CAAC;QACjC,GAAG,wBAAwB;QAC3B,QAAQ,EAAE,SAAS;QACnB,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.d.ts

@@ -0,0 +1,29 @@
+import type { SimCognitoTokenLifetimeProperties } from "./sim-cognito-token-lifetime.js";
+/**
+ * What Cognito allows one kind of token, apart from the validity a request
+ * asks for.
+ */
+type SimCognitoTokenLifetimeSpec = Omit<SimCognitoTokenLifetimeProperties, "validity" | "unit">;
+/**
+ * The number of days a refresh token lasts when the request says nothing.
+ *
+ * Cognito reports this default on the client rather than leaving the field
+ * out, and it overwrites a requested `0` with it.
+ */
+export declare const defaultRefreshTokenValidityDays = 30;
+/**
+ * Access tokens are counted in hours, last an hour by default, and may last
+ * between five minutes and a day.
+ */
+export declare const accessTokenLifetimeSpec: SimCognitoTokenLifetimeSpec;
+/**
+ * ID tokens follow the same rules as access tokens.
+ */
+export declare const idTokenLifetimeSpec: SimCognitoTokenLifetimeSpec;
+/**
+ * Refresh tokens are counted in days, last thirty by default, and may last
+ * between an hour and ten years.
+ */
+export declare const refreshTokenLifetimeSpec: SimCognitoTokenLifetimeSpec;
+export {};
+//# sourceMappingURL=sim-cognito-token-lifetime-specs.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-lifetime-specs.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAEzF;;;GAGG;AACH,KAAK,2BAA2B,GAAG,IAAI,CACrC,iCAAiC,EACjC,UAAU,GAAG,MAAM,CACpB,CAAC;AAOF;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,2BAMrC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,2BAGjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,2BAMtC,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.js

@@ -0,0 +1,41 @@
+const oneHourSeconds = 60 * 60;
+const oneDaySeconds = 24 * oneHourSeconds;
+const fiveMinutesSeconds = 5 * 60;
+const tenYearsSeconds = 315_360_000;
+/**
+ * The number of days a refresh token lasts when the request says nothing.
+ *
+ * Cognito reports this default on the client rather than leaving the field
+ * out, and it overwrites a requested `0` with it.
+ */
+export const defaultRefreshTokenValidityDays = 30;
+/**
+ * Access tokens are counted in hours, last an hour by default, and may last
+ * between five minutes and a day.
+ */
+export const accessTokenLifetimeSpec = {
+    field: "AccessTokenValidity",
+    defaultUnit: "hours",
+    defaultSeconds: oneHourSeconds,
+    leastSeconds: fiveMinutesSeconds,
+    mostSeconds: oneDaySeconds,
+};
+/**
+ * ID tokens follow the same rules as access tokens.
+ */
+export const idTokenLifetimeSpec = {
+    ...accessTokenLifetimeSpec,
+    field: "IdTokenValidity",
+};
+/**
+ * Refresh tokens are counted in days, last thirty by default, and may last
+ * between an hour and ten years.
+ */
+export const refreshTokenLifetimeSpec = {
+    field: "RefreshTokenValidity",
+    defaultUnit: "days",
+    defaultSeconds: defaultRefreshTokenValidityDays * oneDaySeconds,
+    leastSeconds: oneHourSeconds,
+    mostSeconds: tenYearsSeconds,
+};
+//# sourceMappingURL=sim-cognito-token-lifetime-specs.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-lifetime-specs.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.ts"],"names":[],"mappings":"AAWA,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,CAAC;AAC/B,MAAM,aAAa,GAAG,EAAE,GAAG,cAAc,CAAC;AAC1C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,CAAC;AAClC,MAAM,eAAe,GAAG,WAAW,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAgC;IAClE,KAAK,EAAE,qBAAqB;IAC5B,WAAW,EAAE,OAAO;IACpB,cAAc,EAAE,cAAc;IAC9B,YAAY,EAAE,kBAAkB;IAChC,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D,GAAG,uBAAuB;IAC1B,KAAK,EAAE,iBAAiB;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC;IACnE,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,MAAM;IACnB,cAAc,EAAE,+BAA+B,GAAG,aAAa;IAC/D,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,eAAe;CAC7B,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime.d.ts

@@ -0,0 +1,49 @@
+export type SimCognitoTokenValidityUnit = "seconds" | "minutes" | "hours" | "days";
+/**
+ * What one token lifetime is made of: the validity a request asked for, the
+ * unit it is counted in, and what Cognito allows for that kind of token.
+ */
+export interface SimCognitoTokenLifetimeProperties {
+    /**
+     * The request input the validity came from, such as `AccessTokenValidity`.
+     */
+    readonly field: string;
+    readonly validity: number | undefined;
+    readonly unit: string | undefined;
+    readonly defaultUnit: SimCognitoTokenValidityUnit;
+    readonly defaultSeconds: number;
+    readonly leastSeconds: number;
+    readonly mostSeconds: number;
+}
+/**
+ * How long one kind of token from an app client lasts.
+ *
+ * A validity is a number in a unit, and the two arrive in separate request
+ * inputs, so the same `1` means an hour for an access token and a day for a
+ * refresh token. Resolving both into seconds in one place is what stops the
+ * pairing being got wrong somewhere later.
+ */
+export declare class SimCognitoTokenLifetime {
+    /**
+     * The validity as the request wrote it, which is what Cognito reports back.
+     */
+    readonly validity: number | undefined;
+    /**
+     * The unit the validity is counted in, defaulted as Cognito defaults it.
+     */
+    readonly unit: SimCognitoTokenValidityUnit;
+    /**
+     * How long the token lasts, in seconds.
+     */
+    readonly seconds: number;
+    constructor(properties: SimCognitoTokenLifetimeProperties);
+}
+/**
+ * Read a requested token validity unit, or refuse one Cognito does not have.
+ *
+ * This is separate from the lifetime it belongs to because a unit is refused
+ * whether or not the validity counted in it is used. A request naming a unit
+ * and no validity still fails on real Cognito, so it fails here.
+ */
+export declare function requireCognitoTokenValidityUnit(field: string, unit: string | undefined, fallback: SimCognitoTokenValidityUnit): SimCognitoTokenValidityUnit;
+//# sourceMappingURL=sim-cognito-token-lifetime.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-lifetime.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-lifetime.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,2BAA2B,GACrC,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAS3C;;;GAGG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC;;OAEG;IACH,SAAgB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAE7C;;OAEG;IACH,SAAgB,IAAI,EAAE,2BAA2B,CAAC;IAElD;;OAEG;IACH,SAAgB,OAAO,EAAE,MAAM,CAAC;IAEhC,YAAY,UAAU,EAAE,iCAAiC,EAiCxD;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,2BAA2B,GACpC,2BAA2B,CAa7B"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime.js

@@ -0,0 +1,66 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+const secondsPerUnit = {
+    seconds: 1,
+    minutes: 60,
+    hours: 60 * 60,
+    days: 24 * 60 * 60,
+};
+/**
+ * How long one kind of token from an app client lasts.
+ *
+ * A validity is a number in a unit, and the two arrive in separate request
+ * inputs, so the same `1` means an hour for an access token and a day for a
+ * refresh token. Resolving both into seconds in one place is what stops the
+ * pairing being got wrong somewhere later.
+ */
+export class SimCognitoTokenLifetime {
+    /**
+     * The validity as the request wrote it, which is what Cognito reports back.
+     */
+    validity;
+    /**
+     * The unit the validity is counted in, defaulted as Cognito defaults it.
+     */
+    unit;
+    /**
+     * How long the token lasts, in seconds.
+     */
+    seconds;
+    constructor(properties) {
+        const { field, validity, defaultSeconds, leastSeconds, mostSeconds } = properties;
+        this.unit = requireCognitoTokenValidityUnit(field, properties.unit, properties.defaultUnit);
+        this.validity = validity;
+        if (validity === undefined) {
+            this.seconds = defaultSeconds;
+            return;
+        }
+        if (!Number.isSafeInteger(validity) || validity < 0) {
+            throw new SimCognitoInvalidParameterException(`${field} must be a whole number of ${this.unit}`);
+        }
+        const seconds = validity * secondsPerUnit[this.unit];
+        if (seconds < leastSeconds || seconds > mostSeconds) {
+            throw new SimCognitoInvalidParameterException(`${field} of ${String(validity)} ${this.unit} is outside the range ` +
+                `Cognito allows: between ${String(leastSeconds)} and ` +
+                `${String(mostSeconds)} seconds`);
+        }
+        this.seconds = seconds;
+    }
+}
+/**
+ * Read a requested token validity unit, or refuse one Cognito does not have.
+ *
+ * This is separate from the lifetime it belongs to because a unit is refused
+ * whether or not the validity counted in it is used. A request naming a unit
+ * and no validity still fails on real Cognito, so it fails here.
+ */
+export function requireCognitoTokenValidityUnit(field, unit, fallback) {
+    if (unit === undefined) {
+        return fallback;
+    }
+    if (!Object.hasOwn(secondsPerUnit, unit)) {
+        throw new SimCognitoInvalidParameterException(`TokenValidityUnits for ${field} is '${unit}', which is not a ` +
+            `Cognito token validity unit: use seconds, minutes, hours or days`);
+    }
+    return unit;
+}
+//# sourceMappingURL=sim-cognito-token-lifetime.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-lifetime.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAKvF,MAAM,cAAc,GAA0D;IAC5E,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE,GAAG,EAAE;IACd,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;CACnB,CAAC;AAmBF;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACa,QAAQ,CAAqB;IAE7C;;OAEG;IACa,IAAI,CAA8B;IAElD;;OAEG;IACa,OAAO,CAAS;IAEhC,YAAY,UAA6C;QACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,GAClE,UAAU,CAAC;QAEb,IAAI,CAAC,IAAI,GAAG,+BAA+B,CACzC,KAAK,EACL,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,WAAW,CACvB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,8BAA8B,IAAI,CAAC,IAAI,EAAE,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAErD,IAAI,OAAO,GAAG,YAAY,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,wBAAwB;gBAClE,2BAA2B,MAAM,CAAC,YAAY,CAAC,OAAO;gBACtD,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CACnC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAa,EACb,IAAwB,EACxB,QAAqC;IAErC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,mCAAmC,CAC3C,0BAA0B,KAAK,QAAQ,IAAI,oBAAoB;YAC7D,kEAAkE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,IAAmC,CAAC;AAC7C,CAAC"}