@kensio/yulin 0.41.0 → 0.43.0

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.js

@@ -0,0 +1,39 @@
+import { SimCognitoAuthSession } from "../../user-pool/auth/sim-cognito-auth-session.js";
+import { newPasswordRequiredChallenge } from "./sim-cognito-auth-challenge.js";
+/**
+ * Issues the challenge a user has to get past before it can sign in.
+ *
+ * The session it hands back is what ties the response to this request, so it
+ * is remembered on the pool rather than only returned.
+ */
+export class SimCognitoNewPasswordChallenge {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Answer with `NEW_PASSWORD_REQUIRED` and a session.
+     */
+    issue(properties) {
+        const { pool, clientId, user } = properties;
+        const session = new SimCognitoAuthSession({
+            username: user.username,
+            clientId,
+            challengeName: newPasswordRequiredChallenge,
+            issuedAt: this.clock.now(),
+        });
+        pool.auth.addSession(session);
+        return {
+            $metadata: {},
+            ChallengeName: newPasswordRequiredChallenge,
+            Session: session.id,
+            ChallengeParameters: {
+                // eslint-disable-next-line @typescript-eslint/naming-convention -- the challenge parameter names are Cognito's own.
+                USER_ID_FOR_SRP: user.username,
+                requiredAttributes: "[]",
+                userAttributes: "{}",
+            },
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-new-password-challenge.js.map

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-new-password-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAGzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAa/E;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CACH,UAAyC;QAEzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,aAAa,EAAE,4BAA4B;YAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,4BAA4B;YAC3C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,oHAAoH;gBACpH,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,cAAc,EAAE,IAAI;aACrB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-new-password-response.d.ts

@@ -0,0 +1,39 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import type { SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoNewPasswordResponseProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly tokenIssuer: SimCognitoTokenIssuer;
+    readonly clock: SimClock;
+}
+/**
+ * A challenge response, and the session tying it to the request that issued
+ * the challenge.
+ */
+export interface SimCognitoChallengeResponseRequest extends SimCognitoAuthRequest {
+    readonly session: string | undefined;
+}
+/**
+ * Answering the `NEW_PASSWORD_REQUIRED` challenge.
+ *
+ * The new password is checked against the pool's policy, confirms the user,
+ * and is what the user signs in with from then on. The session is single use,
+ * so a replayed one fails. This is the body of both
+ * `AdminRespondToAuthChallenge` and `RespondToAuthChallenge`, which differ only
+ * in how they reach the pool.
+ */
+export declare class SimCognitoNewPasswordResponse {
+    private readonly authResolver;
+    private readonly tokenIssuer;
+    private readonly clock;
+    private readonly result;
+    constructor(properties: SimCognitoNewPasswordResponseProperties);
+    /**
+     * Complete the challenge, and sign the user in.
+     */
+    handle(request: SimCognitoChallengeResponseRequest): SimCognitoAuthenticationOutput;
+}
+export {};
+//# sourceMappingURL=sim-cognito-new-password-response.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-new-password-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-new-password-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAMpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAE/F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,uCAAuC,EAI9D;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,kCAAkC,GAC1C,8BAA8B,CA+BhC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-new-password-response.js

@@ -0,0 +1,47 @@
+import { requireSimCognitoEnabled, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoPasswordCheck } from "../../user-pool/sim-cognito-password-check.js";
+import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-result.js";
+/**
+ * Answering the `NEW_PASSWORD_REQUIRED` challenge.
+ *
+ * The new password is checked against the pool's policy, confirms the user,
+ * and is what the user signs in with from then on. The session is single use,
+ * so a replayed one fails. This is the body of both
+ * `AdminRespondToAuthChallenge` and `RespondToAuthChallenge`, which differ only
+ * in how they reach the pool.
+ */
+export class SimCognitoNewPasswordResponse {
+    authResolver;
+    tokenIssuer;
+    clock;
+    result = new SimCognitoAuthenticationResult();
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.tokenIssuer = properties.tokenIssuer;
+        this.clock = properties.clock;
+    }
+    /**
+     * Complete the challenge, and sign the user in.
+     */
+    handle(request) {
+        const { pool, client, parameters } = request;
+        const username = this.authResolver.username(client, parameters);
+        const session = pool.auth.requireSession({
+            sessionId: request.session,
+            username,
+            clientId: client.id,
+            now: this.clock.now(),
+        });
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        // A user disabled between the challenge and this response cannot finish
+        // the sign-in, as it cannot start one.
+        requireSimCognitoEnabled(user);
+        user.setPassword(new SimCognitoPasswordCheck(pool.passwordPolicy).require("NEW_PASSWORD", parameters.find("NEW_PASSWORD")), true);
+        pool.auth.removeSession(session);
+        return {
+            $metadata: {},
+            AuthenticationResult: this.result.of(this.tokenIssuer.issue({ pool, client, user })),
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-new-password-response.js.map

package/dist/service/cognito/command/auth/sim-cognito-new-password-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-new-password-response.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-response.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AAExF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAmBxF;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA6B;IACvB,YAAY,CAAyB;IACrC,WAAW,CAAwB;IACnC,KAAK,CAAW;IAChB,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAAmD;QAC7D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YACvC,SAAS,EAAE,OAAO,CAAC,OAAO;YAC1B,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,wEAAwE;QACxE,uCAAuC;QACvC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,WAAW,CACd,IAAI,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CACtD,cAAc,EACd,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAChC,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEjC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC/C;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.d.ts

@@ -0,0 +1,42 @@
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import type { SimCognitoNewPasswordChallenge } from "./sim-cognito-new-password-challenge.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoPasswordSignInProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly tokenIssuer: SimCognitoTokenIssuer;
+    readonly challenge: SimCognitoNewPasswordChallenge;
+}
+/**
+ * What a sign-in request has resolved before the flow runs.
+ */
+export interface SimCognitoAuthRequest {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly parameters: SimCognitoAuthParameters;
+}
+/**
+ * Signing a user in with a username and password.
+ *
+ * This is the body of both `ADMIN_USER_PASSWORD_AUTH` and
+ * `USER_PASSWORD_AUTH`. The two differ in what the caller has to be allowed to
+ * do and which `ExplicitAuthFlows` entry opens them, both of which are settled
+ * before this runs, and in nothing after that: real Cognito signs the same
+ * user in with the same password and answers with the same tokens.
+ */
+export declare class SimCognitoPasswordSignIn {
+    private readonly authResolver;
+    private readonly tokenIssuer;
+    private readonly challenge;
+    private readonly result;
+    constructor(properties: SimCognitoPasswordSignInProperties);
+    /**
+     * Sign the user in, or answer with the challenge it has to get past first.
+     */
+    handle(request: SimCognitoAuthRequest): SimCognitoAuthenticationOutput;
+}
+export {};
+//# sourceMappingURL=sim-cognito-password-sign-in.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAE/F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;CACpD;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;CAC/C;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,kCAAkC,EAIzD;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,CAiBrE;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.js

@@ -0,0 +1,39 @@
+import { requireSimCognitoSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-result.js";
+/**
+ * Signing a user in with a username and password.
+ *
+ * This is the body of both `ADMIN_USER_PASSWORD_AUTH` and
+ * `USER_PASSWORD_AUTH`. The two differ in what the caller has to be allowed to
+ * do and which `ExplicitAuthFlows` entry opens them, both of which are settled
+ * before this runs, and in nothing after that: real Cognito signs the same
+ * user in with the same password and answers with the same tokens.
+ */
+export class SimCognitoPasswordSignIn {
+    authResolver;
+    tokenIssuer;
+    challenge;
+    result = new SimCognitoAuthenticationResult();
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.tokenIssuer = properties.tokenIssuer;
+        this.challenge = properties.challenge;
+    }
+    /**
+     * Sign the user in, or answer with the challenge it has to get past first.
+     */
+    handle(request) {
+        const { pool, client, parameters } = request;
+        const username = this.authResolver.username(client, parameters);
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        requireSimCognitoSignIn(user, parameters.require("PASSWORD"));
+        if (user.status.mustChangePassword) {
+            return this.challenge.issue({ pool, clientId: client.id, user });
+        }
+        return {
+            $metadata: {},
+            AuthenticationResult: this.result.of(this.tokenIssuer.issue({ pool, client, user })),
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-password-sign-in.js.map

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAqBxF;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,WAAW,CAAwB;IACnC,SAAS,CAAiC;IAC1C,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA8B;QACnC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAE9D,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC/C;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.d.ts

@@ -0,0 +1,28 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoRefreshSignInProperties {
+    readonly tokenIssuer: SimCognitoTokenIssuer;
+    readonly clock: SimClock;
+}
+/**
+ * Trading a refresh token for a new access and id token.
+ *
+ * The refresh token names no user: the pool that issued it is what knows whose
+ * it is, which is why one presented to another app client is refused. Nothing
+ * new comes back with the tokens, because real Cognito issues no new refresh
+ * token here, so a client keeps the one it has until that expires.
+ */
+export declare class SimCognitoRefreshSignIn {
+    private readonly tokenIssuer;
+    private readonly clock;
+    private readonly result;
+    constructor(properties: SimCognitoRefreshSignInProperties);
+    /**
+     * Refresh a session, or refuse the token it was asked for with.
+     */
+    handle(request: SimCognitoAuthRequest): SimCognitoAuthenticationOutput;
+}
+export {};
+//# sourceMappingURL=sim-cognito-refresh-sign-in.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAG/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,iCAAiC;IACzC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,iCAAiC,EAGxD;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,CA4BrE;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.js

@@ -0,0 +1,42 @@
+import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
+import { requireSimCognitoEnabled } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
+import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-result.js";
+/**
+ * Trading a refresh token for a new access and id token.
+ *
+ * The refresh token names no user: the pool that issued it is what knows whose
+ * it is, which is why one presented to another app client is refused. Nothing
+ * new comes back with the tokens, because real Cognito issues no new refresh
+ * token here, so a client keeps the one it has until that expires.
+ */
+export class SimCognitoRefreshSignIn {
+    tokenIssuer;
+    clock;
+    result = new SimCognitoAuthenticationResult();
+    constructor(properties) {
+        this.tokenIssuer = properties.tokenIssuer;
+        this.clock = properties.clock;
+    }
+    /**
+     * Refresh a session, or refuse the token it was asked for with.
+     */
+    handle(request) {
+        const { pool, client, parameters } = request;
+        const refreshToken = pool.auth.requireRefreshToken({
+            value: parameters.require("REFRESH_TOKEN"),
+            clientId: client.id,
+            now: this.clock.now(),
+        });
+        // The hash covers the username, and the request carries none, so the one
+        // the token was issued to is what it has to have been computed with.
+        requireSimCognitoSecretHash(refreshToken.username, client, parameters.find("SECRET_HASH"));
+        const user = pool.requireUser(requireSimCognitoUsername(refreshToken.username));
+        requireSimCognitoEnabled(user);
+        return {
+            $metadata: {},
+            AuthenticationResult: this.result.of(this.tokenIssuer.reissue({ pool, client, user })),
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-refresh-sign-in.js.map

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AASxF;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,WAAW,CAAwB;IACnC,KAAK,CAAW;IAChB,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAA6C;QACvD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA8B;QACnC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,yEAAyE;QACzE,qEAAqE;QACrE,2BAA2B,CACzB,YAAY,CAAC,QAAQ,EACrB,MAAM,EACN,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAC3B,yBAAyB,CAAC,YAAY,CAAC,QAAQ,CAAC,CACjD,CAAC;QAEF,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.d.ts

@@ -0,0 +1,26 @@
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import type { SimCognitoNewPasswordResponse } from "./sim-cognito-new-password-response.js";
+import type { SimRespondToAuthChallengeCommand, SimRespondToAuthChallengeCommandOutput } from "./auth.command.js";
+interface SimCognitoRespondToChallengeProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly newPassword: SimCognitoNewPasswordResponse;
+}
+/**
+ * The RespondToAuthChallenge command.
+ *
+ * This completes a challenge an `InitiateAuth` request was answered with, so
+ * it names the app client rather than the pool and needs no IAM permission,
+ * as real Cognito needs none for it.
+ */
+export declare class SimCognitoRespondToChallenge {
+    private readonly authResolver;
+    private readonly newPassword;
+    private readonly unsimulatedOptions;
+    constructor(properties: SimCognitoRespondToChallengeProperties);
+    /**
+     * Answer a challenge.
+     */
+    handle(command: SimRespondToAuthChallengeCommand): SimRespondToAuthChallengeCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-cognito-respond-to-challenge.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-respond-to-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-respond-to-challenge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,KAAK,EACV,gCAAgC,EAChC,sCAAsC,EACvC,MAAM,mBAAmB,CAAC;AAE3B,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;CACrD;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0C;IAE7E,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,gCAAgC,GACxC,sCAAsC,CAgBxC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.js

@@ -0,0 +1,35 @@
+import { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
+import { requireSimCognitoNewPasswordChallenge } from "./sim-cognito-auth-challenge.js";
+import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth-options.js";
+/**
+ * The RespondToAuthChallenge command.
+ *
+ * This completes a challenge an `InitiateAuth` request was answered with, so
+ * it names the app client rather than the pool and needs no IAM permission,
+ * as real Cognito needs none for it.
+ */
+export class SimCognitoRespondToChallenge {
+    authResolver;
+    newPassword;
+    unsimulatedOptions = new SimCognitoUnsimulatedAuthOptions();
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.newPassword = properties.newPassword;
+    }
+    /**
+     * Answer a challenge.
+     */
+    handle(command) {
+        const { input } = command;
+        const { pool, client } = this.authResolver.client(input.ClientId);
+        this.unsimulatedOptions.refuseInResponse(input);
+        requireSimCognitoNewPasswordChallenge(input.ChallengeName);
+        return this.newPassword.handle({
+            pool,
+            client,
+            parameters: new SimCognitoAuthParameters("ChallengeResponses", input.ChallengeResponses),
+            session: input.Session,
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-respond-to-challenge.js.map

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-respond-to-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-respond-to-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,iCAAiC,CAAC;AAExF,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAW7F;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,YAAY,CAAyB;IACrC,WAAW,CAAgC;IAC3C,kBAAkB,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAE7E,YAAY,UAAkD;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAAyC;QAEzC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAElE,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAChD,qCAAqC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE3D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAC7B,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,IAAI,wBAAwB,CACtC,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,CACzB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-sign-out.d.ts

@@ -0,0 +1,39 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCognitoUserPoolStore } from "../../user-pool/sim-cognito-user-pool-store.js";
+import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
+import type { SimAdminUserGlobalSignOutCommand, SimAdminUserGlobalSignOutCommandOutput, SimGlobalSignOutCommand, SimGlobalSignOutCommandOutput } from "./auth.command.js";
+interface SimCognitoSignOutCommandsProperties {
+    readonly resolver: SimCognitoRequestResolver;
+    readonly pools: SimCognitoUserPoolStore;
+    readonly clock: SimClock;
+}
+interface SimCognitoCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The commands that sign a user out of every session it has.
+ *
+ * Both forget the refresh and access tokens the user holds, so a later
+ * `REFRESH_TOKEN_AUTH` fails and the access token that signed out cannot sign
+ * out again. Real Cognito revokes them the same way. Where they differ is
+ * authorization: `GlobalSignOut` is authorized by the user's own access token
+ * and evaluates no IAM policy, and `AdminUserGlobalSignOut` is an
+ * administrative call that needs the IAM permission on the pool.
+ */
+export declare class SimCognitoSignOutCommands {
+    private readonly resolver;
+    private readonly pools;
+    private readonly clock;
+    constructor(properties: SimCognitoSignOutCommandsProperties);
+    /**
+     * Sign out the user an access token was issued to.
+     */
+    globalSignOut(command: SimGlobalSignOutCommand): SimGlobalSignOutCommandOutput;
+    /**
+     * Sign out a user an administrator names.
+     */
+    adminUserGlobalSignOut(command: SimAdminUserGlobalSignOutCommand, options?: SimCognitoCommandOptions): SimAdminUserGlobalSignOutCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-cognito-sign-out.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-sign-out.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-out.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-sign-out.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EACV,gCAAgC,EAChC,sCAAsC,EACtC,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAC;AAE3B,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;OAEG;IACH,aAAa,CACX,OAAO,EAAE,uBAAuB,GAC/B,6BAA6B,CAiB/B;IAED;;OAEG;IACH,sBAAsB,CACpB,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,wBAAwB,GACjC,sCAAsC,CAUxC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-sign-out.js

@@ -0,0 +1,42 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The commands that sign a user out of every session it has.
+ *
+ * Both forget the refresh and access tokens the user holds, so a later
+ * `REFRESH_TOKEN_AUTH` fails and the access token that signed out cannot sign
+ * out again. Real Cognito revokes them the same way. Where they differ is
+ * authorization: `GlobalSignOut` is authorized by the user's own access token
+ * and evaluates no IAM policy, and `AdminUserGlobalSignOut` is an
+ * administrative call that needs the IAM permission on the pool.
+ */
+export class SimCognitoSignOutCommands {
+    resolver;
+    pools;
+    clock;
+    constructor(properties) {
+        this.resolver = properties.resolver;
+        this.pools = properties.pools;
+        this.clock = properties.clock;
+    }
+    /**
+     * Sign out the user an access token was issued to.
+     */
+    globalSignOut(command) {
+        const accessToken = command.input.AccessToken;
+        if (accessToken === undefined || accessToken === "") {
+            throw new SimCognitoInvalidParameterException("AccessToken is required: sign out the user it was issued to");
+        }
+        const { pool, token } = this.pools.requireAccessToken(accessToken, this.clock.now());
+        pool.auth.signOut(token.username);
+        return { $metadata: {} };
+    }
+    /**
+     * Sign out a user an administrator names.
+     */
+    adminUserGlobalSignOut(command, options) {
+        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminUserGlobalSignOut", command.input, options);
+        pool.auth.signOut(user.username);
+        return { $metadata: {} };
+    }
+}
+//# sourceMappingURL=sim-cognito-sign-out.js.map

package/dist/service/cognito/command/auth/sim-cognito-sign-out.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-out.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-sign-out.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAoBvF;;;;;;;;;GASG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,CAA4B;IACpC,KAAK,CAA0B;IAC/B,KAAK,CAAW;IAEjC,YAAY,UAA+C;QACzD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,OAAgC;QAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAE9C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,mCAAmC,CAC3C,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACnD,WAAW,EACX,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACjB,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAElC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,sBAAsB,CACpB,OAAyC,EACzC,OAAkC;QAElC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3C,oCAAoC,EACpC,OAAO,CAAC,KAAK,EACb,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.d.ts

@@ -0,0 +1,37 @@
+import type { SimAdminInitiateAuthCommandInput, SimAdminRespondToAuthChallengeCommandInput, SimInitiateAuthCommandInput, SimRespondToAuthChallengeCommandInput } from "./auth.command.js";
+/**
+ * Refuses the authentication inputs this simulation does not model.
+ *
+ * All of them change what real Cognito does with a sign-in, and none of them
+ * can be honoured here, so a request carrying one is refused rather than
+ * signed in as if it had not.
+ *
+ * The admin operations and the client ones name the caller's device and
+ * address differently, `ContextData` against `UserContextData`, so each
+ * refusal names the input the caller actually wrote.
+ */
+export declare class SimCognitoUnsimulatedAuthOptions {
+    private readonly adminInitiation;
+    private readonly adminResponse;
+    private readonly initiation;
+    private readonly response;
+    private static refuseShared;
+    /**
+     * Refuse an `AdminInitiateAuth` request this simulation cannot honour.
+     */
+    refuseInAdminInitiate(input: SimAdminInitiateAuthCommandInput): void;
+    /**
+     * Refuse an `AdminRespondToAuthChallenge` request this simulation cannot
+     * honour.
+     */
+    refuseInAdminResponse(input: SimAdminRespondToAuthChallengeCommandInput): void;
+    /**
+     * Refuse an `InitiateAuth` request this simulation cannot honour.
+     */
+    refuseInInitiate(input: SimInitiateAuthCommandInput): void;
+    /**
+     * Refuse a `RespondToAuthChallenge` request this simulation cannot honour.
+     */
+    refuseInResponse(input: SimRespondToAuthChallengeCommandInput): void;
+}
+//# sourceMappingURL=sim-cognito-unsimulated-auth-options.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-unsimulated-auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC1C,2BAA2B,EAC3B,qCAAqC,EACtC,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;;GAUG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAE9B;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IAEF,OAAO,CAAC,MAAM,CAAC,YAAY;IAgB3B;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,GAAG,IAAI,CAYnE;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,0CAA0C,GAChD,IAAI,CAON;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAYzD;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAOnE;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.js

@@ -0,0 +1,54 @@
+import { SimCognitoUnsimulatedInput } from "../sim-cognito-unsimulated-input.js";
+/**
+ * Refuses the authentication inputs this simulation does not model.
+ *
+ * All of them change what real Cognito does with a sign-in, and none of them
+ * can be honoured here, so a request carrying one is refused rather than
+ * signed in as if it had not.
+ *
+ * The admin operations and the client ones name the caller's device and
+ * address differently, `ContextData` against `UserContextData`, so each
+ * refusal names the input the caller actually wrote.
+ */
+export class SimCognitoUnsimulatedAuthOptions {
+    adminInitiation = new SimCognitoUnsimulatedInput("AdminInitiateAuth");
+    adminResponse = new SimCognitoUnsimulatedInput("AdminRespondToAuthChallenge");
+    initiation = new SimCognitoUnsimulatedInput("InitiateAuth");
+    response = new SimCognitoUnsimulatedInput("RespondToAuthChallenge");
+    static refuseShared(unsimulated, input) {
+        unsimulated.refuse("ClientMetadata", input.ClientMetadata, "passing data to a Lambda trigger");
+        unsimulated.refuse("AnalyticsMetadata", input.AnalyticsMetadata, "Pinpoint analytics");
+    }
+    /**
+     * Refuse an `AdminInitiateAuth` request this simulation cannot honour.
+     */
+    refuseInAdminInitiate(input) {
+        SimCognitoUnsimulatedAuthOptions.refuseShared(this.adminInitiation, input);
+        this.adminInitiation.refuse("ContextData", input.ContextData, "threat protection, which reads the caller's device and address");
+        this.adminInitiation.refuse("Session", input.Session, "continuing a USER_AUTH flow that offered a choice of factors");
+    }
+    /**
+     * Refuse an `AdminRespondToAuthChallenge` request this simulation cannot
+     * honour.
+     */
+    refuseInAdminResponse(input) {
+        SimCognitoUnsimulatedAuthOptions.refuseShared(this.adminResponse, input);
+        this.adminResponse.refuse("ContextData", input.ContextData, "threat protection, which reads the caller's device and address");
+    }
+    /**
+     * Refuse an `InitiateAuth` request this simulation cannot honour.
+     */
+    refuseInInitiate(input) {
+        SimCognitoUnsimulatedAuthOptions.refuseShared(this.initiation, input);
+        this.initiation.refuse("UserContextData", input.UserContextData, "threat protection, which reads the caller's device and address");
+        this.initiation.refuse("Session", input.Session, "signing in directly from ConfirmSignUp");
+    }
+    /**
+     * Refuse a `RespondToAuthChallenge` request this simulation cannot honour.
+     */
+    refuseInResponse(input) {
+        SimCognitoUnsimulatedAuthOptions.refuseShared(this.response, input);
+        this.response.refuse("UserContextData", input.UserContextData, "threat protection, which reads the caller's device and address");
+    }
+}
+//# sourceMappingURL=sim-cognito-unsimulated-auth-options.js.map

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-unsimulated-auth-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAiBjF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gCAAgC;IAC1B,eAAe,GAAG,IAAI,0BAA0B,CAC/D,mBAAmB,CACpB,CAAC;IACe,aAAa,GAAG,IAAI,0BAA0B,CAC7D,6BAA6B,CAC9B,CAAC;IACe,UAAU,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,0BAA0B,CACxD,wBAAwB,CACzB,CAAC;IAEM,MAAM,CAAC,YAAY,CACzB,WAAuC,EACvC,KAAqC;QAErC,WAAW,CAAC,MAAM,CAChB,gBAAgB,EAChB,KAAK,CAAC,cAAc,EACpB,kCAAkC,CACnC,CAAC;QACF,WAAW,CAAC,MAAM,CAChB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,KAAuC;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAiD;QAEjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,CAAC,MAAM,CACvB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAkC;QACjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAA4C;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/authorize/sim-cognito-authorizer.d.ts

@@ -0,0 +1,36 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimCognitoUserPoolId } from "../../user-pool/sim-cognito-user-pool-id.js";
+interface SimCognitoAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * Applies simulated IAM authorization to Cognito user pool requests.
+ *
+ * App clients have no ARN of their own, so operations on one authorize
+ * against the ARN of the pool it belongs to. A policy granting
+ * `cognito-idp:DescribeUserPoolClient` on a pool therefore reaches every
+ * client in it, as it does on real AWS.
+ */
+export declare class SimCognitoAuthorizer {
+    private readonly iam;
+    private readonly accountRegionScope;
+    constructor(properties: SimCognitoAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a user pool.
+     *
+     * The pool need not exist. Real IAM evaluates a request before the service
+     * handles it, so a caller with no permission is refused whether or not the
+     * pool is there, and never learns which it was.
+     */
+    authorizeUserPool(action: string, userPoolId: SimCognitoUserPoolId, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may perform an action that names no particular pool.
+     */
+    authorizeAny(action: string, caller?: SimAwsCaller): void;
+    private authorizeResource;
+}
+export {};
+//# sourceMappingURL=sim-cognito-authorizer.d.ts.map

package/dist/service/cognito/command/authorize/sim-cognito-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/authorize/sim-cognito-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAYxF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,UAAU,EAAE,8BAA8B,EAGrD;IAED;;;;;;OAMG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,oBAAoB,EAChC,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAMN;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAExD;IAED,OAAO,CAAC,iBAAiB;CAe1B"}