@kensio/yulin 0.41.0 → 0.43.0

package/dist/service/cognito/user-pool/sim-cognito-user-pool-arn.js

@@ -0,0 +1,26 @@
+/**
+ * The part of a user pool ARN that comes before the pool's own id.
+ */
+export function cognitoUserPoolArnPrefix(accountRegionScope) {
+    const { regionName, accountId } = accountRegionScope;
+    return `arn:aws:cognito-idp:${regionName}:${accountId}:userpool/`;
+}
+/**
+ * The ARN of one simulated user pool.
+ *
+ * A pool ARN is the pool id after `userpool/`, and the id already names its
+ * region, so the region appears twice:
+ * `arn:aws:cognito-idp:eu-west-2:111111111111:userpool/eu-west-2_aBcDeFgHi`.
+ * This is the resource every user pool IAM policy is written against,
+ * including the policies for app client operations, which have no ARN of
+ * their own.
+ */
+export class SimCognitoUserPoolArn {
+    value;
+    constructor(properties) {
+        this.value =
+            cognitoUserPoolArnPrefix(properties.accountRegionScope) +
+                properties.userPoolId;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-arn.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-arn.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-arn.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,kBAA4C;IAE5C,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;IAErD,OAAO,uBAAuB,UAAU,IAAI,SAAS,YAAY,CAAC;AACpE,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IAE9B,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK;YACR,wBAAwB,CAAC,UAAU,CAAC,kBAAkB,CAAC;gBACvD,UAAU,CAAC,UAAU,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.d.ts

@@ -0,0 +1,34 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimCognitoUserPoolPoliciesType } from "./sim-cognito-password-policy.js";
+import { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolStore } from "./sim-cognito-user-pool-store.js";
+interface SimCognitoUserPoolFactoryProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly pools: SimCognitoUserPoolStore;
+    readonly clock: SimClock;
+}
+interface SimCognitoMakeUserPoolProperties {
+    readonly name: string | undefined;
+    readonly policies?: SimCognitoUserPoolPoliciesType | undefined;
+    readonly deletionProtection?: string | undefined;
+}
+/**
+ * Builds simulated user pools, including their id, ARN and defaults.
+ *
+ * Creation has to produce an id carrying the region, an ARN built from that
+ * id, a validated name and the password policy defaults, so it happens in one
+ * place rather than at each call site that needs a pool.
+ */
+export declare class SimCognitoUserPoolFactory {
+    private readonly accountRegionScope;
+    private readonly pools;
+    private readonly clock;
+    constructor(properties: SimCognitoUserPoolFactoryProperties);
+    /**
+     * Make a new pool with no app clients yet.
+     */
+    make(properties: SimCognitoMakeUserPoolProperties): SimCognitoUserPool;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool-factory.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAG1F,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,gCAAgC,GAAG,kBAAkB,CAwBrE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.js

@@ -0,0 +1,44 @@
+import { SimCognitoDeletionProtection } from "./sim-cognito-deletion-protection.js";
+import { SimCognitoName } from "./sim-cognito-name.js";
+import { SimCognitoPasswordPolicy, } from "./sim-cognito-password-policy.js";
+import { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
+import { SimCognitoUserPoolArn } from "./sim-cognito-user-pool-arn.js";
+import { makeSimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+/**
+ * Builds simulated user pools, including their id, ARN and defaults.
+ *
+ * Creation has to produce an id carrying the region, an ARN built from that
+ * id, a validated name and the password policy defaults, so it happens in one
+ * place rather than at each call site that needs a pool.
+ */
+export class SimCognitoUserPoolFactory {
+    accountRegionScope;
+    pools;
+    clock;
+    constructor(properties) {
+        this.accountRegionScope = properties.accountRegionScope;
+        this.pools = properties.pools;
+        this.clock = properties.clock;
+    }
+    /**
+     * Make a new pool with no app clients yet.
+     */
+    make(properties) {
+        const userPoolId = makeSimCognitoUserPoolId(this.accountRegionScope.regionName, this.pools.ids);
+        return new SimCognitoUserPool({
+            id: userPoolId,
+            arn: new SimCognitoUserPoolArn({
+                userPoolId,
+                accountRegionScope: this.accountRegionScope,
+            }),
+            name: new SimCognitoName({
+                field: "PoolName",
+                value: properties.name,
+            }),
+            passwordPolicy: new SimCognitoPasswordPolicy(properties.policies?.PasswordPolicy),
+            deletionProtection: new SimCognitoDeletionProtection(properties.deletionProtection),
+            createdDate: this.clock.now(),
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-factory.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-factory.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,wBAAwB,GAEzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAezE;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,kBAAkB,CAA2B;IAC7C,KAAK,CAA0B;IAC/B,KAAK,CAAW;IAEjC,YAAY,UAA+C;QACzD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAA4C;QAC/C,MAAM,UAAU,GAAG,wBAAwB,CACzC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAC;QAEF,OAAO,IAAI,kBAAkB,CAAC;YAC5B,EAAE,EAAE,UAAU;YACd,GAAG,EAAE,IAAI,qBAAqB,CAAC;gBAC7B,UAAU;gBACV,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C,CAAC;YACF,IAAI,EAAE,IAAI,cAAc,CAAC;gBACvB,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,UAAU,CAAC,IAAI;aACvB,CAAC;YACF,cAAc,EAAE,IAAI,wBAAwB,CAC1C,UAAU,CAAC,QAAQ,EAAE,cAAc,CACpC;YACD,kBAAkB,EAAE,IAAI,4BAA4B,CAClD,UAAU,CAAC,kBAAkB,CAC9B;YACD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.d.ts

@@ -0,0 +1,20 @@
+import type { Brand } from "../../../util/brand.type.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+export type SimCognitoUserPoolId = Brand<string, "SimCognitoUserPoolId">;
+/**
+ * Allocate a user pool id for a region.
+ *
+ * The region is part of the id rather than decoration: SDK code routinely
+ * splits a pool id on the underscore to work out which region to talk to, and
+ * the hosted issuer URL is built from it the same way.
+ */
+export declare function makeSimCognitoUserPoolId(regionName: AwsRegionName, existing?: Set<string>): SimCognitoUserPoolId;
+/**
+ * Read a requested user pool id, or refuse a malformed one.
+ *
+ * Real Cognito validates the id's shape before it looks anything up, so a
+ * value that is not a pool id at all fails as a validation error rather than
+ * as a missing pool.
+ */
+export declare function requireSimCognitoUserPoolId(value: string | undefined): SimCognitoUserPoolId;
+//# sourceMappingURL=sim-cognito-user-pool-id.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-id.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAczE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,aAAa,EACzB,QAAQ,cAAoB,GAC3B,oBAAoB,CAatB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAetB"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.js

@@ -0,0 +1,48 @@
+import { faker } from "@faker-js/faker";
+import { SimCognitoInvalidParameterException } from "../error/sim-cognito.error.js";
+/**
+ * The number of random characters a user pool id carries after its region.
+ *
+ * Real Cognito ids look like `eu-west-2_aBcDeFgHi`: the region the pool lives
+ * in, an underscore, then nine mixed-case alphanumerics.
+ */
+const userPoolIdSuffixLength = 9;
+const userPoolIdPattern = /^[\w-]+_[0-9a-zA-Z]+$/u;
+const maxUserPoolIdLength = 55;
+/**
+ * Allocate a user pool id for a region.
+ *
+ * The region is part of the id rather than decoration: SDK code routinely
+ * splits a pool id on the underscore to work out which region to talk to, and
+ * the hosted issuer URL is built from it the same way.
+ */
+export function makeSimCognitoUserPoolId(regionName, existing = new Set()) {
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+        const userPoolId = `${regionName}_${faker.string.alphanumeric({
+            length: userPoolIdSuffixLength,
+        })}`;
+        if (!existing.has(userPoolId)) {
+            return userPoolId;
+        }
+    }
+    /* v8 ignore next -- unlikely to happen in practice */
+    throw new Error("Could not allocate unique Cognito user pool id");
+}
+/**
+ * Read a requested user pool id, or refuse a malformed one.
+ *
+ * Real Cognito validates the id's shape before it looks anything up, so a
+ * value that is not a pool id at all fails as a validation error rather than
+ * as a missing pool.
+ */
+export function requireSimCognitoUserPoolId(value) {
+    if (value === undefined || value === "") {
+        throw new SimCognitoInvalidParameterException("UserPoolId is required: name the pool the request is for");
+    }
+    if (value.length > maxUserPoolIdLength || !userPoolIdPattern.test(value)) {
+        throw new SimCognitoInvalidParameterException(`UserPoolId '${value}' is not a user pool id: ids take the ` +
+            `'<region>_<characters>' form, such as 'eu-west-2_aBcDeFgHi'`);
+    }
+    return value;
+}
+//# sourceMappingURL=sim-cognito-user-pool-id.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-id.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAGxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAIpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAyB,EACzB,QAAQ,GAAG,IAAI,GAAG,EAAU;IAE5B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5D,MAAM,EAAE,sBAAsB;SAC/B,CAAC,EAA0B,CAAC;QAE7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,mCAAmC,CAC3C,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,mCAAmC,CAC3C,eAAe,KAAK,wCAAwC;YAC1D,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,KAA6B,CAAC;AACvC,CAAC"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts

@@ -0,0 +1,86 @@
+import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
+import type { SimCognitoIssuedToken } from "./auth/sim-cognito-issued-token.js";
+import type { SimCognitoUserPoolClient } from "./client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPoolClientId } from "./client/sim-cognito-user-pool-client-id.js";
+import type { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+/**
+ * An app client, and the pool that issued its id.
+ */
+export interface SimCognitoClientInPool {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+}
+/**
+ * An access token, and the pool that signed it.
+ */
+export interface SimCognitoAccessTokenInPool {
+    readonly pool: SimCognitoUserPool;
+    readonly token: SimCognitoIssuedToken;
+}
+interface SimCognitoUserPoolStoreProperties {
+    readonly registry?: SimCognitoUserPoolRegistry;
+}
+/**
+ * The user pools of one simulated Cognito scope.
+ *
+ * Pools are keyed by id rather than by name, as real Cognito keys them: two
+ * pools may share a name, and only the id ever identifies one.
+ *
+ * A store also keeps the simulation-wide registry up to date, because a pool
+ * id has to be unique beyond this one scope and the serving layer resolves a
+ * pool from its id alone.
+ */
+export declare class SimCognitoUserPoolStore {
+    private readonly pools;
+    private readonly registry;
+    constructor(properties?: SimCognitoUserPoolStoreProperties);
+    private static unexpired;
+    /**
+     * Every pool in this scope, in creation order.
+     */
+    get all(): readonly SimCognitoUserPool[];
+    /**
+     * The pool ids already in use, so a new one can avoid them.
+     *
+     * These come from the whole simulation rather than from this scope, because
+     * a pool id is what the serving layer looks a pool up by and two Accounts
+     * sharing one would be ambiguous.
+     */
+    get ids(): Set<string>;
+    /**
+     * Store a newly created pool.
+     */
+    add(pool: SimCognitoUserPool): void;
+    /**
+     * Forget a deleted pool.
+     */
+    remove(pool: SimCognitoUserPool): void;
+    /**
+     * Find a pool by id.
+     */
+    find(userPoolId: SimCognitoUserPoolId): SimCognitoUserPool | undefined;
+    /**
+     * Resolve a pool by id, or refuse.
+     */
+    require(userPoolId: SimCognitoUserPoolId): SimCognitoUserPool;
+    /**
+     * Resolve an app client by id alone, and the pool holding it, or refuse.
+     *
+     * `InitiateAuth` names no pool, because an app client id is enough to find
+     * one on real Cognito, so this is the lookup the client-side flows start
+     * from.
+     */
+    requireClient(clientId: SimCognitoUserPoolClientId): SimCognitoClientInPool;
+    /**
+     * Resolve the access token a request is authorized with, and the pool that
+     * signed it, or refuse.
+     *
+     * `GlobalSignOut` names no pool either: the token is what says which pool
+     * the request is for. A token from a signed-out session has been forgotten
+     * by then, which is what real Cognito reports as a revoked access token.
+     */
+    requireAccessToken(value: string, now: Date): SimCognitoAccessTokenInPool;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool-store.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;CAChD;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAE,iCAAsC,EAE7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js

@@ -0,0 +1,105 @@
+import { SimCognitoNotAuthorizedException, SimCognitoResourceNotFoundException, } from "../error/sim-cognito.error.js";
+import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
+/**
+ * The user pools of one simulated Cognito scope.
+ *
+ * Pools are keyed by id rather than by name, as real Cognito keys them: two
+ * pools may share a name, and only the id ever identifies one.
+ *
+ * A store also keeps the simulation-wide registry up to date, because a pool
+ * id has to be unique beyond this one scope and the serving layer resolves a
+ * pool from its id alone.
+ */
+export class SimCognitoUserPoolStore {
+    pools = new Map();
+    registry;
+    constructor(properties = {}) {
+        this.registry = properties.registry ?? new SimCognitoUserPoolRegistry();
+    }
+    static unexpired(issued, now) {
+        if (issued.isExpiredAt(now)) {
+            throw new SimCognitoNotAuthorizedException("Access Token has expired.");
+        }
+        return issued;
+    }
+    /**
+     * Every pool in this scope, in creation order.
+     */
+    get all() {
+        return this.pools.values().toArray();
+    }
+    /**
+     * The pool ids already in use, so a new one can avoid them.
+     *
+     * These come from the whole simulation rather than from this scope, because
+     * a pool id is what the serving layer looks a pool up by and two Accounts
+     * sharing one would be ambiguous.
+     */
+    get ids() {
+        return this.registry.ids;
+    }
+    /**
+     * Store a newly created pool.
+     */
+    add(pool) {
+        this.pools.set(pool.id, pool);
+        this.registry.register(pool);
+    }
+    /**
+     * Forget a deleted pool.
+     */
+    remove(pool) {
+        this.pools.delete(pool.id);
+        this.registry.deregister(pool);
+    }
+    /**
+     * Find a pool by id.
+     */
+    find(userPoolId) {
+        return this.pools.get(userPoolId);
+    }
+    /**
+     * Resolve a pool by id, or refuse.
+     */
+    require(userPoolId) {
+        const found = this.find(userPoolId);
+        if (found === undefined) {
+            throw new SimCognitoResourceNotFoundException(`User pool ${userPoolId} does not exist.`);
+        }
+        return found;
+    }
+    /**
+     * Resolve an app client by id alone, and the pool holding it, or refuse.
+     *
+     * `InitiateAuth` names no pool, because an app client id is enough to find
+     * one on real Cognito, so this is the lookup the client-side flows start
+     * from.
+     */
+    requireClient(clientId) {
+        for (const pool of this.all) {
+            const client = pool.findClient(clientId);
+            if (client !== undefined) {
+                return { pool, client };
+            }
+        }
+        throw new SimCognitoResourceNotFoundException(`App client ${clientId} does not exist.`);
+    }
+    /**
+     * Resolve the access token a request is authorized with, and the pool that
+     * signed it, or refuse.
+     *
+     * `GlobalSignOut` names no pool either: the token is what says which pool
+     * the request is for. A token from a signed-out session has been forgotten
+     * by then, which is what real Cognito reports as a revoked access token.
+     */
+    requireAccessToken(value, now) {
+        for (const pool of this.all) {
+            const issued = pool.auth.findAccessToken(value);
+            if (issued !== undefined) {
+                return { pool, token: SimCognitoUserPoolStore.unexpired(issued, now) };
+            }
+        }
+        throw new SimCognitoNotAuthorizedException("Access Token has been revoked.");
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-store.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AA2B3F;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAsC,EAAE;QAC5D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,0BAA0B,EAAE,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,MAA6B,EAC7B,GAAS;QAET,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,2BAA2B,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAoC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,cAAc,QAAQ,kBAAkB,CACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa,EAAE,GAAS;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,gCAAgC,CACxC,gCAAgC,CACjC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts

@@ -0,0 +1,163 @@
+import { SimCognitoPoolAuth } from "./auth/sim-cognito-pool-auth.js";
+import type { SimCognitoUserPoolClient } from "./client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPoolClientId } from "./client/sim-cognito-user-pool-client-id.js";
+import type { SimCognitoGroup } from "./group/sim-cognito-group.js";
+import type { SimCognitoGroupName } from "./group/sim-cognito-group-name.js";
+import type { SimCognitoDeletionProtection } from "./sim-cognito-deletion-protection.js";
+import type { SimCognitoName } from "./sim-cognito-name.js";
+import type { SimCognitoPasswordPolicy } from "./sim-cognito-password-policy.js";
+import type { SimCognitoUserPoolArn } from "./sim-cognito-user-pool-arn.js";
+import type { SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+import { SimCognitoSigningKey, type SimCognitoJwks } from "./token/sim-cognito-signing-key.js";
+import type { SimCognitoUser } from "./user/sim-cognito-user.js";
+import type { SimCognitoUsername } from "./user/sim-cognito-username.js";
+interface SimCognitoUserPoolProperties {
+    readonly id: SimCognitoUserPoolId;
+    readonly arn: SimCognitoUserPoolArn;
+    readonly name: SimCognitoName;
+    readonly passwordPolicy: SimCognitoPasswordPolicy;
+    readonly deletionProtection: SimCognitoDeletionProtection;
+    readonly createdDate: Date;
+}
+/**
+ * One simulated Cognito user pool.
+ *
+ * The pool owns its app clients, because that is where they live on real
+ * Cognito: deleting a pool takes its clients with it, and a client id means
+ * nothing outside the pool that issued it.
+ */
+export declare class SimCognitoUserPool {
+    #private;
+    readonly id: SimCognitoUserPoolId;
+    readonly arn: SimCognitoUserPoolArn;
+    readonly name: string;
+    readonly passwordPolicy: SimCognitoPasswordPolicy;
+    readonly deletionProtection: SimCognitoDeletionProtection;
+    readonly creationDate: Date;
+    /**
+     * The sign-ins part way through this pool, and the tokens it has issued.
+     */
+    readonly auth: SimCognitoPoolAuth;
+    private readonly clientStore;
+    private readonly userStore;
+    private readonly groupStore;
+    constructor(properties: SimCognitoUserPoolProperties);
+    /**
+     * The URL a token from this pool names as its issuer.
+     *
+     * The region comes out of the pool id, which is where SDK code and token
+     * verifiers get it from too.
+     */
+    get issuerUrl(): string;
+    /**
+     * The name this pool is known by where a scheme would be wrong.
+     *
+     * This is the issuer URL without `https://`, and it is what an identity pool
+     * names a user pool provider by, and what `AWS::Cognito::UserPool` answers
+     * `Fn::GetAtt ProviderName` with.
+     */
+    get providerName(): string;
+    /**
+     * The key this pool signs its tokens with, generated on first use.
+     *
+     * The key belongs to the pool, as it does on real Cognito, so a token from
+     * one pool does not carry a signature another pool's JWKS can verify.
+     */
+    get signingKey(): SimCognitoSigningKey;
+    /**
+     * The public keys this pool publishes, in the shape its JWKS endpoint
+     * serves.
+     *
+     * A verifier configured for this pool takes this document and verifies the
+     * pool's tokens with nothing else needed. Real Cognito publishes two keys
+     * and rotates between them, and this publishes one, so code assuming a
+     * single entry passes here and is still wrong against real AWS.
+     */
+    jwks(): SimCognitoJwks;
+    /**
+     * When the pool last changed.
+     *
+     * Nothing can change a pool here, as `UpdateUserPool` is not simulated, so
+     * this is its creation date.
+     */
+    get lastModifiedDate(): Date;
+    /**
+     * Every app client of this pool, in creation order.
+     */
+    get clients(): readonly SimCognitoUserPoolClient[];
+    /**
+     * The app client ids already in use in this pool.
+     */
+    get clientIds(): Set<string>;
+    /**
+     * Store a newly created app client.
+     */
+    addClient(client: SimCognitoUserPoolClient): void;
+    /**
+     * Forget a deleted app client.
+     */
+    removeClient(client: SimCognitoUserPoolClient): void;
+    /**
+     * Find an app client of this pool by id.
+     */
+    findClient(clientId: string): SimCognitoUserPoolClient | undefined;
+    /**
+     * Resolve an app client of this pool by id, or refuse.
+     */
+    requireClient(clientId: SimCognitoUserPoolClientId): SimCognitoUserPoolClient;
+    /**
+     * Every user in this pool, in creation order.
+     */
+    get users(): readonly SimCognitoUser[];
+    /**
+     * How many users this pool holds.
+     */
+    get userCount(): number;
+    /**
+     * Store a newly created user, refusing a username already in this pool.
+     */
+    addUser(user: SimCognitoUser): void;
+    /**
+     * Forget a deleted user, take them out of every group, and forget the
+     * tokens they hold.
+     *
+     * A group holding a user that no longer exists would answer `ListUsersInGroup`
+     * with a member this pool cannot describe, and a refresh token outliving its
+     * user would sign in someone the pool cannot describe either.
+     */
+    removeUser(user: SimCognitoUser): void;
+    /**
+     * Find a user of this pool by username.
+     */
+    findUser(username: string): SimCognitoUser | undefined;
+    /**
+     * Resolve a user of this pool by username, or refuse.
+     */
+    requireUser(username: SimCognitoUsername): SimCognitoUser;
+    /**
+     * Every group in this pool, in creation order.
+     */
+    get groups(): readonly SimCognitoGroup[];
+    /**
+     * Store a newly created group, refusing a name already in this pool.
+     */
+    addGroup(group: SimCognitoGroup): void;
+    /**
+     * Forget a deleted group, and with it the membership of its users.
+     */
+    removeGroup(group: SimCognitoGroup): void;
+    /**
+     * Find a group of this pool by name.
+     */
+    findGroup(groupName: string): SimCognitoGroup | undefined;
+    /**
+     * Resolve a group of this pool by name, or refuse.
+     */
+    requireGroup(groupName: SimCognitoGroupName): SimCognitoGroup;
+    /**
+     * The groups a user of this pool belongs to, strongest precedence first.
+     */
+    groupsOf(username: string): readonly SimCognitoGroup[];
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,UAAU,4BAA4B;IACpC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC1D,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;;IAC7B,SAAgB,EAAE,EAAE,oBAAoB,CAAC;IACzC,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;OAEG;IACH,SAAgB,IAAI,qBAA4B;IAEhD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAIzD,YAAY,UAAU,EAAE,4BAA4B,EAOnD;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,MAAM,CAItB;IAED;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,oBAAoB,CAIrC;IAED;;;;;;;;OAQG;IACH,IAAI,IAAI,cAAc,CAErB;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,wBAAwB,EAAE,CAEjD;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAE3B;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEnD;IAED;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEjE;IAED;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,0BAA0B,GACnC,wBAAwB,CAE1B;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,cAAc,EAAE,CAErC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAElC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIrC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAErD;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,cAAc,CAExD;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,SAAS,eAAe,EAAE,CAEvC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAErC;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAExC;IAED;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAExD;IAED;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,eAAe,CAE5D;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAErD;CACF"}