@kensio/yulin 0.42.0 → 0.43.0

package/dist/service/cognito/user-pool/group/sim-cognito-group.d.ts

@@ -0,0 +1,77 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolId } from "../sim-cognito-user-pool-id.js";
+import type { SimCognitoGroupName } from "./sim-cognito-group-name.js";
+import type { SimCognitoGroupSettings } from "./sim-cognito-group-settings.js";
+interface SimCognitoGroupProperties {
+    readonly name: SimCognitoGroupName;
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly settings: SimCognitoGroupSettings;
+    readonly clock: SimClock;
+}
+/**
+ * One simulated Cognito group, and the users in it.
+ *
+ * The group holds its members rather than each user holding its groups,
+ * because that is the direction deletion runs: deleting a group takes its
+ * membership with it, and leaves the users alone.
+ *
+ * `Precedence` is the property that matters most. It decides the order the
+ * `cognito:groups` claim will list a user's groups in, and which group's role
+ * reaches the `cognito:preferred_role` claim. Zero is the strongest, and a
+ * group with no precedence is weaker than any group that has one.
+ */
+export declare class SimCognitoGroup {
+    readonly name: SimCognitoGroupName;
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly creationDate: Date;
+    private readonly clock;
+    private readonly members;
+    private groupSettings;
+    private modifiedDate;
+    constructor(properties: SimCognitoGroupProperties);
+    /**
+     * What the group is for, if the request that made it said.
+     */
+    get description(): string | undefined;
+    /**
+     * Where this group sits against the others a user may belong to, if it has
+     * a precedence at all.
+     */
+    get precedence(): number | undefined;
+    /**
+     * The IAM role a member of this group prefers, if the group has one.
+     *
+     * Nothing here assumes that role. It reaches the token claims, which are
+     * not simulated yet, and identity pools, which are not simulated at all.
+     */
+    get roleArn(): string | undefined;
+    /**
+     * When the group's properties last changed.
+     */
+    get lastModifiedDate(): Date;
+    /**
+     * Replace the group's properties.
+     *
+     * `UpdateGroup` replaces all three rather than merging: real Cognito does
+     * not say which it does, and a request naming every property is the one
+     * thing that behaves the same either way.
+     */
+    update(settings: SimCognitoGroupSettings): void;
+    /**
+     * Put a user in this group.
+     *
+     * Adding a user already in the group changes nothing and is not an error,
+     * as it is not on real Cognito.
+     */
+    addMember(username: string): void;
+    /**
+     * Take a user out of this group, whether or not they were in it.
+     */
+    removeMember(username: string): void;
+    /**
+     * Whether a user is in this group.
+     */
+    hasMember(username: string): boolean;
+}
+export {};
+//# sourceMappingURL=sim-cognito-group.d.ts.map

package/dist/service/cognito/user-pool/group/sim-cognito-group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,UAAU,yBAAyB;IACjC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAe;IAC1B,SAAgB,IAAI,EAAE,mBAAmB,CAAC;IAC1C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,yBAAyB,EAOhD;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED;;;OAGG;IACH,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED;;;;;OAKG;IACH,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAG9C;IAED;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEhC;IAED;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEnC;IAED;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnC;CACF"}

package/dist/service/cognito/user-pool/group/sim-cognito-group.js

@@ -0,0 +1,90 @@
+/**
+ * One simulated Cognito group, and the users in it.
+ *
+ * The group holds its members rather than each user holding its groups,
+ * because that is the direction deletion runs: deleting a group takes its
+ * membership with it, and leaves the users alone.
+ *
+ * `Precedence` is the property that matters most. It decides the order the
+ * `cognito:groups` claim will list a user's groups in, and which group's role
+ * reaches the `cognito:preferred_role` claim. Zero is the strongest, and a
+ * group with no precedence is weaker than any group that has one.
+ */
+export class SimCognitoGroup {
+    name;
+    userPoolId;
+    creationDate;
+    clock;
+    members = new Set();
+    groupSettings;
+    modifiedDate;
+    constructor(properties) {
+        this.name = properties.name;
+        this.userPoolId = properties.userPoolId;
+        this.groupSettings = properties.settings;
+        this.clock = properties.clock;
+        this.creationDate = this.clock.now();
+        this.modifiedDate = this.creationDate;
+    }
+    /**
+     * What the group is for, if the request that made it said.
+     */
+    get description() {
+        return this.groupSettings.description;
+    }
+    /**
+     * Where this group sits against the others a user may belong to, if it has
+     * a precedence at all.
+     */
+    get precedence() {
+        return this.groupSettings.precedence;
+    }
+    /**
+     * The IAM role a member of this group prefers, if the group has one.
+     *
+     * Nothing here assumes that role. It reaches the token claims, which are
+     * not simulated yet, and identity pools, which are not simulated at all.
+     */
+    get roleArn() {
+        return this.groupSettings.roleArn;
+    }
+    /**
+     * When the group's properties last changed.
+     */
+    get lastModifiedDate() {
+        return this.modifiedDate;
+    }
+    /**
+     * Replace the group's properties.
+     *
+     * `UpdateGroup` replaces all three rather than merging: real Cognito does
+     * not say which it does, and a request naming every property is the one
+     * thing that behaves the same either way.
+     */
+    update(settings) {
+        this.groupSettings = settings;
+        this.modifiedDate = this.clock.now();
+    }
+    /**
+     * Put a user in this group.
+     *
+     * Adding a user already in the group changes nothing and is not an error,
+     * as it is not on real Cognito.
+     */
+    addMember(username) {
+        this.members.add(username);
+    }
+    /**
+     * Take a user out of this group, whether or not they were in it.
+     */
+    removeMember(username) {
+        this.members.delete(username);
+    }
+    /**
+     * Whether a user is in this group.
+     */
+    hasMember(username) {
+        return this.members.has(username);
+    }
+}
+//# sourceMappingURL=sim-cognito-group.js.map

package/dist/service/cognito/user-pool/group/sim-cognito-group.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAe;IACV,IAAI,CAAsB;IAC1B,UAAU,CAAuB;IACjC,YAAY,CAAO;IAElB,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,aAAa,CAA0B;IACvC,YAAY,CAAO;IAE3B,YAAY,UAAqC;QAC/C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,QAAiC;QACtC,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,QAAgB;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-identifier.d.ts

@@ -0,0 +1,26 @@
+interface SimCognitoIdentifierProperties {
+    /**
+     * The request input the value came from, such as `GroupName`, so a refusal
+     * names the field the caller wrote.
+     */
+    readonly field: string;
+    /**
+     * What the identifier names, such as `group`, for the same reason.
+     */
+    readonly subject: string;
+    readonly value: string | undefined;
+}
+/**
+ * A username or a group name.
+ *
+ * Cognito gives both the same form, so the rule lives here once: required, at
+ * most 128 characters, and no whitespace. Both are validated before anything
+ * is looked up, so a value Cognito would reject fails as a validation error
+ * rather than as a missing user or group.
+ */
+export declare class SimCognitoIdentifier {
+    readonly value: string;
+    constructor(properties: SimCognitoIdentifierProperties);
+}
+export {};
+//# sourceMappingURL=sim-cognito-identifier.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-identifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identifier.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-identifier.ts"],"names":[],"mappings":"AAUA,UAAU,8BAA8B;IACtC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,UAAU,EAAE,8BAA8B,EAwBrD;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-identifier.js

@@ -0,0 +1,34 @@
+import { SimCognitoInvalidParameterException } from "../error/sim-cognito.error.js";
+const maxIdentifierLength = 128;
+/**
+ * The characters Cognito allows in a username and in a group name: letters,
+ * marks, symbols, numbers and punctuation, and no whitespace among them.
+ */
+const identifierPattern = /^[\p{L}\p{M}\p{S}\p{N}\p{P}]+$/u;
+/**
+ * A username or a group name.
+ *
+ * Cognito gives both the same form, so the rule lives here once: required, at
+ * most 128 characters, and no whitespace. Both are validated before anything
+ * is looked up, so a value Cognito would reject fails as a validation error
+ * rather than as a missing user or group.
+ */
+export class SimCognitoIdentifier {
+    value;
+    constructor(properties) {
+        const { field, subject, value } = properties;
+        if (value === undefined || value === "") {
+            throw new SimCognitoInvalidParameterException(`${field} is required: name the ${subject} the request is for`);
+        }
+        if (value.length > maxIdentifierLength) {
+            throw new SimCognitoInvalidParameterException(`${field} '${value}' is longer than the ` +
+                `${String(maxIdentifierLength)} characters Cognito allows`);
+        }
+        if (!identifierPattern.test(value)) {
+            throw new SimCognitoInvalidParameterException(`${field} '${value}' contains characters Cognito does not allow: a ` +
+                `${subject} name may not hold whitespace`);
+        }
+        this.value = value;
+    }
+}
+//# sourceMappingURL=sim-cognito-identifier.js.map

package/dist/service/cognito/user-pool/sim-cognito-identifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identifier.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-identifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEpF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;GAGG;AACH,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAe5D;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IACf,KAAK,CAAS;IAE9B,YAAY,UAA0C;QACpD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAE7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,0BAA0B,OAAO,qBAAqB,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACvC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,KAAK,KAAK,uBAAuB;gBACvC,GAAG,MAAM,CAAC,mBAAmB,CAAC,4BAA4B,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,KAAK,KAAK,kDAAkD;gBAClE,GAAG,OAAO,+BAA+B,CAC5C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-password-check.d.ts

@@ -0,0 +1,24 @@
+import type { SimCognitoPasswordPolicy } from "./sim-cognito-password-policy.js";
+/**
+ * Checks a password against one pool's password policy.
+ *
+ * A password is checked wherever one arrives, so the rules live here once
+ * rather than at `AdminCreateUser` and `AdminSetUserPassword` separately. The
+ * refusals say which rule the password broke, in the words real Cognito uses,
+ * because that message is often the only thing a test has to go on.
+ */
+export declare class SimCognitoPasswordCheck {
+    private readonly policy;
+    constructor(policy: SimCognitoPasswordPolicy);
+    private static refuse;
+    /**
+     * Read a password this pool accepts, or refuse it.
+     *
+     * A missing password is a validation error rather than a policy failure,
+     * because real Cognito rejects the request before it reaches the policy.
+     */
+    require(field: string, password: string | undefined): string;
+    private requirePolicy;
+    private requireCharacters;
+}
+//# sourceMappingURL=sim-cognito-password-check.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-password-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-check.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-password-check.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAsBjF;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAElD,YAAY,MAAM,EAAE,wBAAwB,EAE3C;IAED,OAAO,CAAC,MAAM,CAAC,MAAM;IAMrB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAiB3D;IAED,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,iBAAiB;CAiB1B"}

package/dist/service/cognito/user-pool/sim-cognito-password-check.js

@@ -0,0 +1,73 @@
+import { SimCognitoInvalidParameterException, SimCognitoInvalidPasswordException, } from "../error/sim-cognito.error.js";
+const maxPasswordLength = 256;
+/**
+ * The characters Cognito counts as symbols in a password.
+ */
+const symbolPattern = /[\^$*.[\]{}()?"!@#%&/\\,><':;|_~`+= -]/u;
+/**
+ * The letters Cognito counts towards the uppercase and lowercase requirements.
+ *
+ * A password may hold any Unicode character, and which of them satisfy these
+ * two rules is not documented, so basic Latin is what counts here. That
+ * refuses a password of, say, Greek letters that real Cognito might accept.
+ * Refusing one it would have taken is a puzzling test failure; taking one it
+ * would have refused is a sign-up that fails in a deployment.
+ */
+const uppercasePattern = /[A-Z]/u;
+const lowercasePattern = /[a-z]/u;
+const numberPattern = /\d/u;
+/**
+ * Checks a password against one pool's password policy.
+ *
+ * A password is checked wherever one arrives, so the rules live here once
+ * rather than at `AdminCreateUser` and `AdminSetUserPassword` separately. The
+ * refusals say which rule the password broke, in the words real Cognito uses,
+ * because that message is often the only thing a test has to go on.
+ */
+export class SimCognitoPasswordCheck {
+    policy;
+    constructor(policy) {
+        this.policy = policy;
+    }
+    static refuse(reason) {
+        throw new SimCognitoInvalidPasswordException(`Password did not conform with policy: ${reason}`);
+    }
+    /**
+     * Read a password this pool accepts, or refuse it.
+     *
+     * A missing password is a validation error rather than a policy failure,
+     * because real Cognito rejects the request before it reaches the policy.
+     */
+    require(field, password) {
+        if (password === undefined || password === "") {
+            throw new SimCognitoInvalidParameterException(`${field} is required: give the user a password the pool's policy allows`);
+        }
+        if (password.length > maxPasswordLength) {
+            throw new SimCognitoInvalidPasswordException(`${field} is longer than the ${String(maxPasswordLength)} characters ` +
+                `Cognito allows`);
+        }
+        this.requirePolicy(password);
+        return password;
+    }
+    requirePolicy(password) {
+        if (password.length < this.policy.minimumLength) {
+            SimCognitoPasswordCheck.refuse("Password not long enough");
+        }
+        this.requireCharacters(password);
+    }
+    requireCharacters(password) {
+        if (this.policy.requiresUppercase && !uppercasePattern.test(password)) {
+            SimCognitoPasswordCheck.refuse("Password must have uppercase characters");
+        }
+        if (this.policy.requiresLowercase && !lowercasePattern.test(password)) {
+            SimCognitoPasswordCheck.refuse("Password must have lowercase characters");
+        }
+        if (this.policy.requiresNumbers && !numberPattern.test(password)) {
+            SimCognitoPasswordCheck.refuse("Password must have numeric characters");
+        }
+        if (this.policy.requiresSymbols && !symbolPattern.test(password)) {
+            SimCognitoPasswordCheck.refuse("Password must have symbol characters");
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-password-check.js.map

package/dist/service/cognito/user-pool/sim-cognito-password-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-check.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-password-check.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AAGvC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;GAEG;AACH,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAClC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAClC,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,MAAM,CAA2B;IAElD,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEO,MAAM,CAAC,MAAM,CAAC,MAAc;QAClC,MAAM,IAAI,kCAAkC,CAC1C,yCAAyC,MAAM,EAAE,CAClD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAa,EAAE,QAA4B;QACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,iEAAiE,CAC1E,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAkC,CAC1C,GAAG,KAAK,uBAAuB,MAAM,CAAC,iBAAiB,CAAC,cAAc;gBACpE,gBAAgB,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,aAAa,CAAC,QAAgB;QACpC,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,uBAAuB,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAEO,iBAAiB,CAAC,QAAgB;QACxC,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,uBAAuB,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,uBAAuB,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,uBAAuB,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,uBAAuB,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts

@@ -1,19 +1,51 @@
+import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
+import type { SimCognitoIssuedToken } from "./auth/sim-cognito-issued-token.js";
+import type { SimCognitoUserPoolClient } from "./client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPoolClientId } from "./client/sim-cognito-user-pool-client-id.js";
 import type { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
 import type { SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+/**
+ * An app client, and the pool that issued its id.
+ */
+export interface SimCognitoClientInPool {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+}
+/**
+ * An access token, and the pool that signed it.
+ */
+export interface SimCognitoAccessTokenInPool {
+    readonly pool: SimCognitoUserPool;
+    readonly token: SimCognitoIssuedToken;
+}
+interface SimCognitoUserPoolStoreProperties {
+    readonly registry?: SimCognitoUserPoolRegistry;
+}
 /**
  * The user pools of one simulated Cognito scope.
  *
  * Pools are keyed by id rather than by name, as real Cognito keys them: two
  * pools may share a name, and only the id ever identifies one.
+ *
+ * A store also keeps the simulation-wide registry up to date, because a pool
+ * id has to be unique beyond this one scope and the serving layer resolves a
+ * pool from its id alone.
  */
 export declare class SimCognitoUserPoolStore {
     private readonly pools;
+    private readonly registry;
+    constructor(properties?: SimCognitoUserPoolStoreProperties);
+    private static unexpired;
     /**
      * Every pool in this scope, in creation order.
      */
     get all(): readonly SimCognitoUserPool[];
     /**
      * The pool ids already in use, so a new one can avoid them.
+     *
+     * These come from the whole simulation rather than from this scope, because
+     * a pool id is what the serving layer looks a pool up by and two Accounts
+     * sharing one would be ambiguous.
      */
     get ids(): Set<string>;
     /**
@@ -32,5 +64,23 @@ export declare class SimCognitoUserPoolStore {
      * Resolve a pool by id, or refuse.
      */
     require(userPoolId: SimCognitoUserPoolId): SimCognitoUserPool;
+    /**
+     * Resolve an app client by id alone, and the pool holding it, or refuse.
+     *
+     * `InitiateAuth` names no pool, because an app client id is enough to find
+     * one on real Cognito, so this is the lookup the client-side flows start
+     * from.
+     */
+    requireClient(clientId: SimCognitoUserPoolClientId): SimCognitoClientInPool;
+    /**
+     * Resolve the access token a request is authorized with, and the pool that
+     * signed it, or refuse.
+     *
+     * `GlobalSignOut` names no pool either: the token is what says which pool
+     * the request is for. A token from a signed-out session has been forgotten
+     * by then, which is what real Cognito reports as a revoked access token.
+     */
+    requireAccessToken(value: string, now: Date): SimCognitoAccessTokenInPool;
 }
+export {};
 //# sourceMappingURL=sim-cognito-user-pool-store.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;;;;GAKG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAElC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAErC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;CAChD;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAE,iCAAsC,EAE7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js

@@ -1,12 +1,27 @@
-import { SimCognitoResourceNotFoundException } from "../error/sim-cognito.error.js";
+import { SimCognitoNotAuthorizedException, SimCognitoResourceNotFoundException, } from "../error/sim-cognito.error.js";
+import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
 /**
  * The user pools of one simulated Cognito scope.
  *
  * Pools are keyed by id rather than by name, as real Cognito keys them: two
  * pools may share a name, and only the id ever identifies one.
+ *
+ * A store also keeps the simulation-wide registry up to date, because a pool
+ * id has to be unique beyond this one scope and the serving layer resolves a
+ * pool from its id alone.
  */
 export class SimCognitoUserPoolStore {
     pools = new Map();
+    registry;
+    constructor(properties = {}) {
+        this.registry = properties.registry ?? new SimCognitoUserPoolRegistry();
+    }
+    static unexpired(issued, now) {
+        if (issued.isExpiredAt(now)) {
+            throw new SimCognitoNotAuthorizedException("Access Token has expired.");
+        }
+        return issued;
+    }
     /**
      * Every pool in this scope, in creation order.
      */
@@ -15,21 +30,27 @@ export class SimCognitoUserPoolStore {
     }
     /**
      * The pool ids already in use, so a new one can avoid them.
+     *
+     * These come from the whole simulation rather than from this scope, because
+     * a pool id is what the serving layer looks a pool up by and two Accounts
+     * sharing one would be ambiguous.
      */
     get ids() {
-        return new Set(this.pools.keys());
+        return this.registry.ids;
     }
     /**
      * Store a newly created pool.
      */
     add(pool) {
         this.pools.set(pool.id, pool);
+        this.registry.register(pool);
     }
     /**
      * Forget a deleted pool.
      */
     remove(pool) {
         this.pools.delete(pool.id);
+        this.registry.deregister(pool);
     }
     /**
      * Find a pool by id.
@@ -47,5 +68,38 @@ export class SimCognitoUserPoolStore {
         }
         return found;
     }
+    /**
+     * Resolve an app client by id alone, and the pool holding it, or refuse.
+     *
+     * `InitiateAuth` names no pool, because an app client id is enough to find
+     * one on real Cognito, so this is the lookup the client-side flows start
+     * from.
+     */
+    requireClient(clientId) {
+        for (const pool of this.all) {
+            const client = pool.findClient(clientId);
+            if (client !== undefined) {
+                return { pool, client };
+            }
+        }
+        throw new SimCognitoResourceNotFoundException(`App client ${clientId} does not exist.`);
+    }
+    /**
+     * Resolve the access token a request is authorized with, and the pool that
+     * signed it, or refuse.
+     *
+     * `GlobalSignOut` names no pool either: the token is what says which pool
+     * the request is for. A token from a signed-out session has been forgotten
+     * by then, which is what real Cognito reports as a revoked access token.
+     */
+    requireAccessToken(value, now) {
+        for (const pool of this.all) {
+            const issued = pool.auth.findAccessToken(value);
+            if (issued !== undefined) {
+                return { pool, token: SimCognitoUserPoolStore.unexpired(issued, now) };
+            }
+        }
+        throw new SimCognitoNotAuthorizedException("Access Token has been revoked.");
+    }
 }
 //# sourceMappingURL=sim-cognito-user-pool-store.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAIpF;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE/D;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AA2B3F;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAsC,EAAE;QAC5D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,0BAA0B,EAAE,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,MAA6B,EAC7B,GAAS;QAET,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,2BAA2B,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAoC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,cAAc,QAAQ,kBAAkB,CACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa,EAAE,GAAS;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,gCAAgC,CACxC,gCAAgC,CACjC,CAAC;IACJ,CAAC;CACF"}