@kensio/yulin 0.41.0 → 0.43.0

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js

@@ -0,0 +1,203 @@
+import { SimCognitoPoolAuth } from "./auth/sim-cognito-pool-auth.js";
+import { SimCognitoUserPoolClientStore } from "./client/sim-cognito-user-pool-client-store.js";
+import { SimCognitoGroupStore } from "./group/sim-cognito-group-store.js";
+import { SimCognitoSigningKey, } from "./token/sim-cognito-signing-key.js";
+import { SimCognitoUserStore } from "./user/sim-cognito-user-store.js";
+/**
+ * One simulated Cognito user pool.
+ *
+ * The pool owns its app clients, because that is where they live on real
+ * Cognito: deleting a pool takes its clients with it, and a client id means
+ * nothing outside the pool that issued it.
+ */
+export class SimCognitoUserPool {
+    id;
+    arn;
+    name;
+    passwordPolicy;
+    deletionProtection;
+    creationDate;
+    /**
+     * The sign-ins part way through this pool, and the tokens it has issued.
+     */
+    auth = new SimCognitoPoolAuth();
+    clientStore = new SimCognitoUserPoolClientStore();
+    userStore = new SimCognitoUserStore();
+    groupStore = new SimCognitoGroupStore();
+    #signingKey;
+    constructor(properties) {
+        this.id = properties.id;
+        this.arn = properties.arn;
+        this.name = properties.name.value;
+        this.passwordPolicy = properties.passwordPolicy;
+        this.deletionProtection = properties.deletionProtection;
+        this.creationDate = properties.createdDate;
+    }
+    /**
+     * The URL a token from this pool names as its issuer.
+     *
+     * The region comes out of the pool id, which is where SDK code and token
+     * verifiers get it from too.
+     */
+    get issuerUrl() {
+        const [regionName] = this.id.split("_", 1);
+        return `https://cognito-idp.${String(regionName)}.amazonaws.com/${this.id}`;
+    }
+    /**
+     * The name this pool is known by where a scheme would be wrong.
+     *
+     * This is the issuer URL without `https://`, and it is what an identity pool
+     * names a user pool provider by, and what `AWS::Cognito::UserPool` answers
+     * `Fn::GetAtt ProviderName` with.
+     */
+    get providerName() {
+        return this.issuerUrl.replace("https://", "");
+    }
+    /**
+     * The key this pool signs its tokens with, generated on first use.
+     *
+     * The key belongs to the pool, as it does on real Cognito, so a token from
+     * one pool does not carry a signature another pool's JWKS can verify.
+     */
+    get signingKey() {
+        this.#signingKey ??= SimCognitoSigningKey.generate();
+        return this.#signingKey;
+    }
+    /**
+     * The public keys this pool publishes, in the shape its JWKS endpoint
+     * serves.
+     *
+     * A verifier configured for this pool takes this document and verifies the
+     * pool's tokens with nothing else needed. Real Cognito publishes two keys
+     * and rotates between them, and this publishes one, so code assuming a
+     * single entry passes here and is still wrong against real AWS.
+     */
+    jwks() {
+        return { keys: [this.signingKey.publicJwk()] };
+    }
+    /**
+     * When the pool last changed.
+     *
+     * Nothing can change a pool here, as `UpdateUserPool` is not simulated, so
+     * this is its creation date.
+     */
+    get lastModifiedDate() {
+        return this.creationDate;
+    }
+    /**
+     * Every app client of this pool, in creation order.
+     */
+    get clients() {
+        return this.clientStore.all;
+    }
+    /**
+     * The app client ids already in use in this pool.
+     */
+    get clientIds() {
+        return this.clientStore.ids;
+    }
+    /**
+     * Store a newly created app client.
+     */
+    addClient(client) {
+        this.clientStore.add(client);
+    }
+    /**
+     * Forget a deleted app client.
+     */
+    removeClient(client) {
+        this.clientStore.remove(client);
+    }
+    /**
+     * Find an app client of this pool by id.
+     */
+    findClient(clientId) {
+        return this.clientStore.find(clientId);
+    }
+    /**
+     * Resolve an app client of this pool by id, or refuse.
+     */
+    requireClient(clientId) {
+        return this.clientStore.require(clientId);
+    }
+    /**
+     * Every user in this pool, in creation order.
+     */
+    get users() {
+        return this.userStore.all;
+    }
+    /**
+     * How many users this pool holds.
+     */
+    get userCount() {
+        return this.userStore.count;
+    }
+    /**
+     * Store a newly created user, refusing a username already in this pool.
+     */
+    addUser(user) {
+        this.userStore.add(user);
+    }
+    /**
+     * Forget a deleted user, take them out of every group, and forget the
+     * tokens they hold.
+     *
+     * A group holding a user that no longer exists would answer `ListUsersInGroup`
+     * with a member this pool cannot describe, and a refresh token outliving its
+     * user would sign in someone the pool cannot describe either.
+     */
+    removeUser(user) {
+        this.userStore.remove(user);
+        this.groupStore.forgetUser(user.username);
+        this.auth.signOut(user.username);
+    }
+    /**
+     * Find a user of this pool by username.
+     */
+    findUser(username) {
+        return this.userStore.find(username);
+    }
+    /**
+     * Resolve a user of this pool by username, or refuse.
+     */
+    requireUser(username) {
+        return this.userStore.require(username);
+    }
+    /**
+     * Every group in this pool, in creation order.
+     */
+    get groups() {
+        return this.groupStore.all;
+    }
+    /**
+     * Store a newly created group, refusing a name already in this pool.
+     */
+    addGroup(group) {
+        this.groupStore.add(group);
+    }
+    /**
+     * Forget a deleted group, and with it the membership of its users.
+     */
+    removeGroup(group) {
+        this.groupStore.remove(group);
+    }
+    /**
+     * Find a group of this pool by name.
+     */
+    findGroup(groupName) {
+        return this.groupStore.find(groupName);
+    }
+    /**
+     * Resolve a group of this pool by name, or refuse.
+     */
+    requireGroup(groupName) {
+        return this.groupStore.require(groupName);
+    }
+    /**
+     * The groups a user of this pool belongs to, strongest precedence first.
+     */
+    groupsOf(username) {
+        return this.groupStore.forUser(username);
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAG/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAM1E,OAAO,EACL,oBAAoB,GAErB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAYvE;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,EAAE,CAAuB;IACzB,GAAG,CAAwB;IAC3B,IAAI,CAAS;IACb,cAAc,CAA2B;IACzC,kBAAkB,CAA+B;IACjD,YAAY,CAAO;IAEnC;;OAEG;IACa,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAE/B,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAClD,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;IACtC,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEzD,WAAW,CAAmC;IAE9C,YAAY,UAAwC;QAClD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE3C,OAAO,uBAAuB,MAAM,CAAC,UAAU,CAAC,kBAAkB,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,IAAI,CAAC,WAAW,KAAK,oBAAoB,CAAC,QAAQ,EAAE,CAAC;QAErD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAoC;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAoB;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA4B;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAsB;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAA8B;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts

@@ -0,0 +1,18 @@
+import { type SimCognitoTokenClaims, type SimCognitoTokenClaimsProperties } from "./sim-cognito-token-claims.js";
+/**
+ * The claims of a simulated access token.
+ *
+ * An access token says what the caller may do, so it names the app client in
+ * `client_id`, carries a `scope`, and has no `aud`. Its `username` is the
+ * user's username, where an id token calls the same thing `cognito:username`.
+ */
+export declare class SimCognitoAccessToken {
+    private readonly properties;
+    private readonly shared;
+    constructor(properties: SimCognitoTokenClaimsProperties);
+    /**
+     * The claims this token is signed with.
+     */
+    claims(): SimCognitoTokenClaims;
+}
+//# sourceMappingURL=sim-cognito-access-token.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-access-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAWvC;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js

@@ -0,0 +1,40 @@
+/* eslint-disable @typescript-eslint/naming-convention -- JWT claim names are the
+   ones RFC 7519 and Cognito define, rather than identifier names. */
+import { SimCognitoSharedTokenClaims, } from "./sim-cognito-token-claims.js";
+/**
+ * The scope an access token from an admin authentication flow carries.
+ *
+ * Real Cognito issues this scope for sign-in through the user pool API. The
+ * scopes a resource server defines reach a token through the hosted UI and
+ * client credentials flows, neither of which is simulated.
+ */
+const userPoolAdminScope = "aws.cognito.signin.user.admin";
+/**
+ * The claims of a simulated access token.
+ *
+ * An access token says what the caller may do, so it names the app client in
+ * `client_id`, carries a `scope`, and has no `aud`. Its `username` is the
+ * user's username, where an id token calls the same thing `cognito:username`.
+ */
+export class SimCognitoAccessToken {
+    properties;
+    shared;
+    constructor(properties) {
+        this.properties = properties;
+        this.shared = new SimCognitoSharedTokenClaims(properties);
+    }
+    /**
+     * The claims this token is signed with.
+     */
+    claims() {
+        const { client, user } = this.properties;
+        return {
+            ...this.shared.build(),
+            client_id: client.id,
+            token_use: "access",
+            scope: userPoolAdminScope,
+            username: user.username,
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-access-token.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-access-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA;qEACqE;AACrE,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.d.ts

@@ -0,0 +1,26 @@
+import { type SimCognitoTokenClaims, type SimCognitoTokenClaimsProperties } from "./sim-cognito-token-claims.js";
+/**
+ * The claims of a simulated id token.
+ *
+ * An id token says who the user is, so it carries the user's attributes and
+ * names the app client it was issued to in `aud`. An access token names the
+ * same client in `client_id` and has no `aud` at all, which is the difference
+ * verification libraries check and the one code most often gets wrong.
+ */
+export declare class SimCognitoIdToken {
+    private readonly properties;
+    private readonly shared;
+    constructor(properties: SimCognitoTokenClaimsProperties);
+    /**
+     * The claims this token is signed with.
+     */
+    claims(): SimCognitoTokenClaims;
+    /**
+     * The user's attributes, as an id token carries them.
+     *
+     * Each is reported under its own name, as real Cognito reports them. `sub`
+     * is not among them, because the shared claims already hold it.
+     */
+    private attributeClaims;
+}
+//# sourceMappingURL=sim-cognito-id-token.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-id-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAGxB"}

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.js

@@ -0,0 +1,42 @@
+/* eslint-disable @typescript-eslint/naming-convention -- JWT claim names are the
+   ones RFC 7519 and Cognito define, rather than identifier names. */
+import { SimCognitoSharedTokenClaims, } from "./sim-cognito-token-claims.js";
+/**
+ * The claims of a simulated id token.
+ *
+ * An id token says who the user is, so it carries the user's attributes and
+ * names the app client it was issued to in `aud`. An access token names the
+ * same client in `client_id` and has no `aud` at all, which is the difference
+ * verification libraries check and the one code most often gets wrong.
+ */
+export class SimCognitoIdToken {
+    properties;
+    shared;
+    constructor(properties) {
+        this.properties = properties;
+        this.shared = new SimCognitoSharedTokenClaims(properties);
+    }
+    /**
+     * The claims this token is signed with.
+     */
+    claims() {
+        const { client, user } = this.properties;
+        return {
+            ...this.shared.build(),
+            ...this.attributeClaims(),
+            aud: client.id,
+            token_use: "id",
+            "cognito:username": user.username,
+        };
+    }
+    /**
+     * The user's attributes, as an id token carries them.
+     *
+     * Each is reported under its own name, as real Cognito reports them. `sub`
+     * is not among them, because the shared claims already hold it.
+     */
+    attributeClaims() {
+        return Object.fromEntries(this.properties.user.attributeValues);
+    }
+}
+//# sourceMappingURL=sim-cognito-id-token.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-id-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA;qEACqE;AACrE,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,IAAI,CAAC,QAAQ;SAClC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-signing-key.d.ts

@@ -0,0 +1,64 @@
+/**
+ * One public key as a user pool publishes it.
+ */
+export type SimCognitoJwk = {
+    readonly kty: "RSA";
+    readonly use: "sig";
+    readonly alg: "RS256";
+    readonly kid: string;
+    readonly n: string;
+    readonly e: string;
+};
+/**
+ * A user pool's JWKS document, in the shape the real
+ * `.../.well-known/jwks.json` endpoint serves.
+ */
+export type SimCognitoJwks = {
+    keys: SimCognitoJwk[];
+};
+/**
+ * The key a simulated user pool signs its tokens with.
+ *
+ * The key material is real, generated with `node:crypto`, and the signature is
+ * a real RS256 signature over the real signing input. A token from here
+ * verifies in `aws-jwt-verify` or `jose` with nothing stubbed, which is the
+ * point: a test that verifies a simulated token has exercised the verifier it
+ * runs in production.
+ */
+export declare class SimCognitoSigningKey {
+    readonly kid: string;
+    private readonly privateKey;
+    private readonly modulus;
+    private readonly exponent;
+    private constructor();
+    /**
+     * Generate a key pair for a pool.
+     *
+     * A pool generates its own on first use rather than at creation, because
+     * generating 2048-bit RSA takes long enough to notice and most pools in a
+     * test suite never sign anything. Nothing is written to disk, and no key
+     * material is committed: a private key in the repository would set off
+     * secret scanners for no gain.
+     */
+    static generate(): SimCognitoSigningKey;
+    /**
+     * The key id, which is the RFC 7638 thumbprint of the public key.
+     *
+     * Real Cognito's key ids are opaque. A thumbprint is opaque enough, and it
+     * means the id names the key it actually belongs to.
+     */
+    private static thumbprint;
+    private static encode;
+    /**
+     * The public half of the key, as a pool publishes it in its JWKS.
+     */
+    publicJwk(): SimCognitoJwk;
+    /**
+     * Sign claims into a JWT.
+     *
+     * The header names RS256 and the key id, as a real Cognito token's header
+     * does, so a verifier finds the key in the pool's JWKS the same way.
+     */
+    sign(claims: object): string;
+}
+//# sourceMappingURL=sim-cognito-signing-key.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-signing-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-signing-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-signing-key.ts"],"names":[],"mappings":"AAaA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB,CAAC;AASF;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,GAAG,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,OAAO,eAaN;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,IAAI,oBAAoB,CAEtC;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;IAMzB,OAAO,CAAC,MAAM,CAAC,MAAM;IAIrB;;OAEG;IACH,SAAS,IAAI,aAAa,CASzB;IAED;;;;;OAKG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAY3B;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-signing-key.js

@@ -0,0 +1,91 @@
+import { createHash, createSign, generateKeyPairSync, } from "node:crypto";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+/* eslint-enable @typescript-eslint/consistent-type-definitions */
+/**
+ * The RSA modulus size real Cognito signs with.
+ */
+const modulusLength = 2048;
+/**
+ * The key a simulated user pool signs its tokens with.
+ *
+ * The key material is real, generated with `node:crypto`, and the signature is
+ * a real RS256 signature over the real signing input. A token from here
+ * verifies in `aws-jwt-verify` or `jose` with nothing stubbed, which is the
+ * point: a test that verifies a simulated token has exercised the verifier it
+ * runs in production.
+ */
+export class SimCognitoSigningKey {
+    kid;
+    privateKey;
+    modulus;
+    exponent;
+    constructor() {
+        const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+            modulusLength,
+        });
+        const { n, e } = publicKey.export({ format: "jwk" });
+        assertDefined(n, "RSA public key modulus");
+        assertDefined(e, "RSA public key exponent");
+        this.privateKey = privateKey;
+        this.modulus = n;
+        this.exponent = e;
+        this.kid = SimCognitoSigningKey.thumbprint(n, e);
+    }
+    /**
+     * Generate a key pair for a pool.
+     *
+     * A pool generates its own on first use rather than at creation, because
+     * generating 2048-bit RSA takes long enough to notice and most pools in a
+     * test suite never sign anything. Nothing is written to disk, and no key
+     * material is committed: a private key in the repository would set off
+     * secret scanners for no gain.
+     */
+    static generate() {
+        return new SimCognitoSigningKey();
+    }
+    /**
+     * The key id, which is the RFC 7638 thumbprint of the public key.
+     *
+     * Real Cognito's key ids are opaque. A thumbprint is opaque enough, and it
+     * means the id names the key it actually belongs to.
+     */
+    static thumbprint(modulus, exponent) {
+        return createHash("sha256")
+            .update(`{"e":"${exponent}","kty":"RSA","n":"${modulus}"}`)
+            .digest("base64url");
+    }
+    static encode(claims) {
+        return Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+    }
+    /**
+     * The public half of the key, as a pool publishes it in its JWKS.
+     */
+    publicJwk() {
+        return {
+            kty: "RSA",
+            use: "sig",
+            alg: "RS256",
+            kid: this.kid,
+            n: this.modulus,
+            e: this.exponent,
+        };
+    }
+    /**
+     * Sign claims into a JWT.
+     *
+     * The header names RS256 and the key id, as a real Cognito token's header
+     * does, so a verifier finds the key in the pool's JWKS the same way.
+     */
+    sign(claims) {
+        const signingInput = [
+            SimCognitoSigningKey.encode({ alg: "RS256", kid: this.kid }),
+            SimCognitoSigningKey.encode(claims),
+        ].join(".");
+        const signature = createSign("RSA-SHA256")
+            .update(signingInput)
+            .sign(this.privateKey)
+            .toString("base64url");
+        return `${signingInput}.${signature}`;
+    }
+}
+//# sourceMappingURL=sim-cognito-signing-key.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-signing-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-signing-key.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-signing-key.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,UAAU,EACV,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AA2BvE,kEAAkE;AAElE;;GAEG;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACf,GAAG,CAAS;IAEX,UAAU,CAAY;IACtB,OAAO,CAAS;IAChB,QAAQ,CAAS;IAElC;QACE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;YAC3D,aAAa;SACd,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAErD,aAAa,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3C,aAAa,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAE5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ;QACb,OAAO,IAAI,oBAAoB,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,UAAU,CAAC,OAAe,EAAE,QAAgB;QACzD,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,SAAS,QAAQ,sBAAsB,OAAO,IAAI,CAAC;aAC1D,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,MAAM,CAAC,MAAc;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,CAAC,EAAE,IAAI,CAAC,OAAO;YACf,CAAC,EAAE,IAAI,CAAC,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,MAAc;QACjB,MAAM,YAAY,GAAG;YACnB,oBAAoB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5D,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC;SACpC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC;aACvC,MAAM,CAAC,YAAY,CAAC;aACpB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;aACrB,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEzB,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;IACxC,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.d.ts

@@ -0,0 +1,37 @@
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUser } from "../user/sim-cognito-user.js";
+export type SimCognitoClaimValue = string | number | readonly string[];
+/**
+ * The claims of one token, in the shape they are signed in.
+ */
+export type SimCognitoTokenClaims = Readonly<Record<string, SimCognitoClaimValue>>;
+export interface SimCognitoTokenClaimsProperties {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly user: SimCognitoUser;
+    readonly issuedAt: Date;
+    readonly expiresAt: Date;
+    /**
+     * A fresh id for this token, which becomes its `jti` claim.
+     */
+    readonly tokenId: string;
+}
+/**
+ * The claims a simulated id token and access token share.
+ *
+ * `sub` is the same on both, as it is on real Cognito, so code keying on it
+ * gets the same user whichever token it read. `cognito:groups` is on both too,
+ * in precedence order, and is left out entirely when the user is in no groups
+ * rather than reported as an empty list.
+ */
+export declare class SimCognitoSharedTokenClaims {
+    private readonly properties;
+    constructor(properties: SimCognitoTokenClaimsProperties);
+    /**
+     * The claims every token from this pool carries.
+     */
+    build(): SimCognitoTokenClaims;
+    private groupClaim;
+}
+//# sourceMappingURL=sim-cognito-token-claims.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-claims.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-claims.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAC1C,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CACrC,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAE7D,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;OAEG;IACH,KAAK,IAAI,qBAAqB,CAY7B;IAED,OAAO,CAAC,UAAU;CAUnB"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.js

@@ -0,0 +1,41 @@
+function epochSeconds(instant) {
+    return Math.floor(instant.getTime() / 1000);
+}
+/**
+ * The claims a simulated id token and access token share.
+ *
+ * `sub` is the same on both, as it is on real Cognito, so code keying on it
+ * gets the same user whichever token it read. `cognito:groups` is on both too,
+ * in precedence order, and is left out entirely when the user is in no groups
+ * rather than reported as an empty list.
+ */
+export class SimCognitoSharedTokenClaims {
+    properties;
+    constructor(properties) {
+        this.properties = properties;
+    }
+    /**
+     * The claims every token from this pool carries.
+     */
+    build() {
+        const { pool, user, issuedAt, expiresAt, tokenId } = this.properties;
+        return {
+            sub: user.sub,
+            iss: pool.issuerUrl,
+            auth_time: epochSeconds(issuedAt),
+            iat: epochSeconds(issuedAt),
+            exp: epochSeconds(expiresAt),
+            jti: tokenId,
+            ...this.groupClaim(),
+        };
+    }
+    groupClaim() {
+        const { pool, user } = this.properties;
+        const groups = pool.groupsOf(user.username).map((group) => group.name);
+        if (groups.length === 0) {
+            return {};
+        }
+        return { "cognito:groups": groups };
+    }
+}
+//# sourceMappingURL=sim-cognito-token-claims.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-claims.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-claims.ts"],"names":[],"mappings":"AA2BA,SAAS,YAAY,CAAC,OAAa;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACrB,UAAU,CAAkC;IAE7D,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAErE,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC;YACjC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC;YAC3B,GAAG,EAAE,YAAY,CAAC,SAAS,CAAC;YAC5B,GAAG,EAAE,OAAO;YACZ,GAAG,IAAI,CAAC,UAAU,EAAE;SACrB,CAAC;IACJ,CAAC;IAEO,UAAU;QAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;CACF"}