@kensio/yulin 0.42.0 → 0.43.0

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.js

@@ -0,0 +1,20 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The challenge this simulation can answer.
+ */
+export const newPasswordRequiredChallenge = "NEW_PASSWORD_REQUIRED";
+/**
+ * Refuse a challenge this simulation cannot answer.
+ *
+ * MFA and custom authentication challenges are refused rather than answered as
+ * this one, because what a caller has to send back is different for each.
+ */
+export function requireSimCognitoNewPasswordChallenge(challengeName) {
+    if (challengeName === newPasswordRequiredChallenge) {
+        return;
+    }
+    throw new SimCognitoInvalidParameterException(`ChallengeName '${String(challengeName)}' is not simulated: ` +
+        `${newPasswordRequiredChallenge} is the only challenge this ` +
+        `simulation issues.`);
+}
+//# sourceMappingURL=sim-cognito-auth-challenge.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,aAAiC;IAEjC,IAAI,aAAa,KAAK,4BAA4B,EAAE,CAAC;QACnD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,MAAM,CAAC,aAAa,CAAC,sBAAsB;QAC3D,GAAG,4BAA4B,8BAA8B;QAC7D,oBAAoB,CACvB,CAAC;AACJ,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.d.ts

@@ -0,0 +1,31 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolStore } from "../../user-pool/sim-cognito-user-pool-store.js";
+import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
+import { SimCognitoAdminInitiateAuth } from "./sim-cognito-admin-initiate-auth.js";
+import { SimCognitoAdminRespondToChallenge } from "./sim-cognito-admin-respond-to-challenge.js";
+import { SimCognitoInitiateAuth } from "./sim-cognito-initiate-auth.js";
+import { SimCognitoRespondToChallenge } from "./sim-cognito-respond-to-challenge.js";
+import { SimCognitoSignOutCommands } from "./sim-cognito-sign-out.js";
+interface SimCognitoAuthCommandsProperties {
+    readonly resolver: SimCognitoRequestResolver;
+    readonly pools: SimCognitoUserPoolStore;
+    readonly clock: SimClock;
+}
+/**
+ * The authentication command handlers of one simulated Cognito scope.
+ *
+ * The four sign-in commands share a resolver, a token issuer and the bodies of
+ * the flows they run, and the sign-out commands share the pool store with
+ * them, so they are built together here rather than among the pool and
+ * directory commands.
+ */
+export declare class SimCognitoAuthCommands {
+    readonly adminInitiateAuth: SimCognitoAdminInitiateAuth;
+    readonly adminRespondToChallenge: SimCognitoAdminRespondToChallenge;
+    readonly initiateAuth: SimCognitoInitiateAuth;
+    readonly respondToChallenge: SimCognitoRespondToChallenge;
+    readonly signOut: SimCognitoSignOutCommands;
+    constructor(properties: SimCognitoAuthCommandsProperties);
+}
+export {};
+//# sourceMappingURL=sim-cognito-auth-commands.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAE9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAGhG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAKxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,uBAAuB,EAAE,iCAAiC,CAAC;IAC3E,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IAEnD,YAAY,UAAU,EAAE,gCAAgC,EAmCvD;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.js

@@ -0,0 +1,63 @@
+import { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import { SimCognitoAdminInitiateAuth } from "./sim-cognito-admin-initiate-auth.js";
+import { SimCognitoAdminRespondToChallenge } from "./sim-cognito-admin-respond-to-challenge.js";
+import { SimCognitoAuthFlowRunner } from "./sim-cognito-auth-flow-runner.js";
+import { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import { SimCognitoInitiateAuth } from "./sim-cognito-initiate-auth.js";
+import { SimCognitoNewPasswordChallenge } from "./sim-cognito-new-password-challenge.js";
+import { SimCognitoNewPasswordResponse } from "./sim-cognito-new-password-response.js";
+import { SimCognitoPasswordSignIn } from "./sim-cognito-password-sign-in.js";
+import { SimCognitoRefreshSignIn } from "./sim-cognito-refresh-sign-in.js";
+import { SimCognitoRespondToChallenge } from "./sim-cognito-respond-to-challenge.js";
+import { SimCognitoSignOutCommands } from "./sim-cognito-sign-out.js";
+/**
+ * The authentication command handlers of one simulated Cognito scope.
+ *
+ * The four sign-in commands share a resolver, a token issuer and the bodies of
+ * the flows they run, and the sign-out commands share the pool store with
+ * them, so they are built together here rather than among the pool and
+ * directory commands.
+ */
+export class SimCognitoAuthCommands {
+    adminInitiateAuth;
+    adminRespondToChallenge;
+    initiateAuth;
+    respondToChallenge;
+    signOut;
+    constructor(properties) {
+        const { resolver, pools, clock } = properties;
+        const authResolver = new SimCognitoAuthResolver({ resolver, pools });
+        const tokenIssuer = new SimCognitoTokenIssuer({ clock });
+        const flowRunner = new SimCognitoAuthFlowRunner({
+            passwordSignIn: new SimCognitoPasswordSignIn({
+                authResolver,
+                tokenIssuer,
+                challenge: new SimCognitoNewPasswordChallenge({ clock }),
+            }),
+            refreshSignIn: new SimCognitoRefreshSignIn({ tokenIssuer, clock }),
+        });
+        const newPassword = new SimCognitoNewPasswordResponse({
+            authResolver,
+            tokenIssuer,
+            clock,
+        });
+        this.adminInitiateAuth = new SimCognitoAdminInitiateAuth({
+            authResolver,
+            flowRunner,
+        });
+        this.adminRespondToChallenge = new SimCognitoAdminRespondToChallenge({
+            authResolver,
+            newPassword,
+        });
+        this.initiateAuth = new SimCognitoInitiateAuth({
+            authResolver,
+            flowRunner,
+        });
+        this.respondToChallenge = new SimCognitoRespondToChallenge({
+            authResolver,
+            newPassword,
+        });
+        this.signOut = new SimCognitoSignOutCommands({ resolver, pools, clock });
+    }
+}
+//# sourceMappingURL=sim-cognito-auth-commands.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAE1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAQtE;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACjB,iBAAiB,CAA8B;IAC/C,uBAAuB,CAAoC;IAC3D,YAAY,CAAyB;IACrC,kBAAkB,CAA+B;IACjD,OAAO,CAA4B;IAEnD,YAAY,UAA4C;QACtD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,sBAAsB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,IAAI,wBAAwB,CAAC;YAC9C,cAAc,EAAE,IAAI,wBAAwB,CAAC;gBAC3C,YAAY;gBACZ,WAAW;gBACX,SAAS,EAAE,IAAI,8BAA8B,CAAC,EAAE,KAAK,EAAE,CAAC;aACzD,CAAC;YACF,aAAa,EAAE,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,6BAA6B,CAAC;YACpD,YAAY;YACZ,WAAW;YACX,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CAAC;YACvD,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,GAAG,IAAI,iCAAiC,CAAC;YACnE,YAAY;YACZ,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC;YAC7C,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CAAC;YACzD,YAAY;YACZ,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.d.ts

@@ -0,0 +1,26 @@
+import type { SimCognitoAuthFlow } from "./sim-cognito-auth-flow.js";
+import type { SimCognitoPasswordSignIn, SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
+import type { SimCognitoRefreshSignIn } from "./sim-cognito-refresh-sign-in.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoAuthFlowRunnerProperties {
+    readonly passwordSignIn: SimCognitoPasswordSignIn;
+    readonly refreshSignIn: SimCognitoRefreshSignIn;
+}
+/**
+ * Runs whichever flow a request resolved to.
+ *
+ * `AdminInitiateAuth` and `InitiateAuth` accept different flow names and reach
+ * the pool differently, and once a flow is resolved they run the same bodies,
+ * so the running of one lives here rather than in either command.
+ */
+export declare class SimCognitoAuthFlowRunner {
+    private readonly passwordSignIn;
+    private readonly refreshSignIn;
+    constructor(properties: SimCognitoAuthFlowRunnerProperties);
+    /**
+     * Run a flow the app client is configured for.
+     */
+    run(flow: SimCognitoAuthFlow, request: SimCognitoAuthRequest): SimCognitoAuthenticationOutput;
+}
+export {};
+//# sourceMappingURL=sim-cognito-auth-flow-runner.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-flow-runner.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;CACjD;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAGzD;IAED;;OAEG;IACH,GAAG,CACD,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,qBAAqB,GAC7B,8BAA8B,CAMhC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.js

@@ -0,0 +1,25 @@
+/**
+ * Runs whichever flow a request resolved to.
+ *
+ * `AdminInitiateAuth` and `InitiateAuth` accept different flow names and reach
+ * the pool differently, and once a flow is resolved they run the same bodies,
+ * so the running of one lives here rather than in either command.
+ */
+export class SimCognitoAuthFlowRunner {
+    passwordSignIn;
+    refreshSignIn;
+    constructor(properties) {
+        this.passwordSignIn = properties.passwordSignIn;
+        this.refreshSignIn = properties.refreshSignIn;
+    }
+    /**
+     * Run a flow the app client is configured for.
+     */
+    run(flow, request) {
+        if (flow.exchangesRefreshToken) {
+            return this.refreshSignIn.handle(request);
+        }
+        return this.passwordSignIn.handle(request);
+    }
+}
+//# sourceMappingURL=sim-cognito-auth-flow-runner.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-flow-runner.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow-runner.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,cAAc,CAA2B;IACzC,aAAa,CAA0B;IAExD,YAAY,UAA8C;QACxD,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,GAAG,CACD,IAAwB,EACxB,OAA8B;QAE9B,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flow.d.ts

@@ -0,0 +1,42 @@
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+interface SimCognitoAuthFlowProperties {
+    readonly name: string;
+    readonly clientSetting: string;
+    readonly legacySettings?: readonly string[];
+    readonly aliases?: readonly string[];
+    readonly exchangesRefreshToken?: boolean;
+}
+/**
+ * One authentication flow this simulation runs.
+ *
+ * A flow knows the `ExplicitAuthFlows` entry that opens it, because which flow
+ * a request uses decides what the app client has to be configured for. That is
+ * checked before the user is looked at, as real Cognito checks it, so a client
+ * created without the flow fails the same way whatever the password was.
+ */
+export declare class SimCognitoAuthFlow {
+    readonly name: string;
+    readonly clientSetting: string;
+    /**
+     * Whether the flow trades a refresh token for new tokens rather than signing
+     * a user in with a password.
+     */
+    readonly exchangesRefreshToken: boolean;
+    private readonly aliases;
+    private readonly settings;
+    constructor(properties: SimCognitoAuthFlowProperties);
+    /**
+     * Whether a requested `AuthFlow` names this flow.
+     */
+    matches(authFlow: string): boolean;
+    /**
+     * Refuse a flow the app client is not configured for.
+     *
+     * The legacy `ExplicitAuthFlows` value a flow replaced opens it too, as it
+     * does on real Cognito, so a client made before the `ALLOW_` prefixed
+     * settings existed still signs users in.
+     */
+    requireEnabledFor(client: SimCognitoUserPoolClient): void;
+}
+export {};
+//# sourceMappingURL=sim-cognito-auth-flow.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-auth-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-flow.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAEvG,UAAU,4BAA4B;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,aAAa,EAAE,MAAM,CAAC;IAEtC;;;OAGG;IACH,SAAgB,qBAAqB,EAAE,OAAO,CAAC;IAE/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C,YAAY,UAAU,EAAE,4BAA4B,EASnD;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAaxD;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flow.js

@@ -0,0 +1,52 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * One authentication flow this simulation runs.
+ *
+ * A flow knows the `ExplicitAuthFlows` entry that opens it, because which flow
+ * a request uses decides what the app client has to be configured for. That is
+ * checked before the user is looked at, as real Cognito checks it, so a client
+ * created without the flow fails the same way whatever the password was.
+ */
+export class SimCognitoAuthFlow {
+    name;
+    clientSetting;
+    /**
+     * Whether the flow trades a refresh token for new tokens rather than signing
+     * a user in with a password.
+     */
+    exchangesRefreshToken;
+    aliases;
+    settings;
+    constructor(properties) {
+        this.name = properties.name;
+        this.clientSetting = properties.clientSetting;
+        this.exchangesRefreshToken = properties.exchangesRefreshToken ?? false;
+        this.aliases = properties.aliases ?? [];
+        this.settings = [
+            properties.clientSetting,
+            ...(properties.legacySettings ?? []),
+        ];
+    }
+    /**
+     * Whether a requested `AuthFlow` names this flow.
+     */
+    matches(authFlow) {
+        return authFlow === this.name || this.aliases.includes(authFlow);
+    }
+    /**
+     * Refuse a flow the app client is not configured for.
+     *
+     * The legacy `ExplicitAuthFlows` value a flow replaced opens it too, as it
+     * does on real Cognito, so a client made before the `ALLOW_` prefixed
+     * settings existed still signs users in.
+     */
+    requireEnabledFor(client) {
+        const enabled = this.settings.some((setting) => client.explicitAuthFlows.allows(setting));
+        if (enabled) {
+            return;
+        }
+        throw new SimCognitoInvalidParameterException(`${this.name} is not enabled for the client ${client.id}: create the ` +
+            `app client with ${this.clientSetting} among its ExplicitAuthFlows`);
+    }
+}
+//# sourceMappingURL=sim-cognito-auth-flow.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-flow.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAWvF;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACb,IAAI,CAAS;IACb,aAAa,CAAS;IAEtC;;;OAGG;IACa,qBAAqB,CAAU;IAE9B,OAAO,CAAoB;IAC3B,QAAQ,CAAoB;IAE7C,YAAY,UAAwC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAC,qBAAqB,IAAI,KAAK,CAAC;QACvE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG;YACd,UAAU,CAAC,aAAa;YACxB,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,OAAO,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAgC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7C,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CACzC,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,GAAG,IAAI,CAAC,IAAI,kCAAkC,MAAM,CAAC,EAAE,eAAe;YACpE,mBAAmB,IAAI,CAAC,aAAa,8BAA8B,CACtE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flows.d.ts

@@ -0,0 +1,48 @@
+import { SimCognitoAuthFlow } from "./sim-cognito-auth-flow.js";
+/**
+ * Server-side sign-in with a username and password, through the admin API.
+ */
+export declare const adminUserPasswordFlow: SimCognitoAuthFlow;
+/**
+ * Client-side sign-in with a username and password.
+ *
+ * The legacy `USER_PASSWORD_AUTH` setting is the same name as the flow, which
+ * is why an app client can hold it as an `ExplicitAuthFlows` value.
+ */
+export declare const userPasswordFlow: SimCognitoAuthFlow;
+/**
+ * Exchanging a refresh token for a new access and id token.
+ *
+ * `REFRESH_TOKEN` is the same flow under its other name, and real Cognito
+ * accepts either.
+ */
+export declare const refreshTokenFlow: SimCognitoAuthFlow;
+/**
+ * The flows one entry point into authentication runs.
+ *
+ * `InitiateAuth` and `AdminInitiateAuth` do not run the same set, as real
+ * Cognito does not: `ADMIN_USER_PASSWORD_AUTH` is not valid for `InitiateAuth`,
+ * and `USER_PASSWORD_AUTH` is the client-side flow that replaces it.
+ */
+export declare class SimCognitoAuthFlows {
+    private readonly operation;
+    private readonly flows;
+    constructor(operation: string, flows: readonly SimCognitoAuthFlow[]);
+    /**
+     * Resolve the flow a request asked for, or refuse.
+     *
+     * A flow this simulation does not run is refused rather than treated as one
+     * it does, because which flow ran decides what the caller has to send and
+     * what it gets back.
+     */
+    require(authFlow: string | undefined): SimCognitoAuthFlow;
+}
+/**
+ * The flows `AdminInitiateAuth` runs.
+ */
+export declare const adminAuthFlows: SimCognitoAuthFlows;
+/**
+ * The flows `InitiateAuth` runs.
+ */
+export declare const clientAuthFlows: SimCognitoAuthFlows;
+//# sourceMappingURL=sim-cognito-auth-flows.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-auth-flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-flows.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flows.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,oBAIhC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,oBAI3B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,oBAK3B,CAAC;AAEH;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEtD,YAAY,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,kBAAkB,EAAE,EAGlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAcxD;CACF;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,qBAGzB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,eAAe,qBAG1B,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flows.js

@@ -0,0 +1,79 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { SimCognitoAuthFlow } from "./sim-cognito-auth-flow.js";
+/**
+ * Server-side sign-in with a username and password, through the admin API.
+ */
+export const adminUserPasswordFlow = new SimCognitoAuthFlow({
+    name: "ADMIN_USER_PASSWORD_AUTH",
+    clientSetting: "ALLOW_ADMIN_USER_PASSWORD_AUTH",
+    legacySettings: ["ADMIN_NO_SRP_AUTH"],
+});
+/**
+ * Client-side sign-in with a username and password.
+ *
+ * The legacy `USER_PASSWORD_AUTH` setting is the same name as the flow, which
+ * is why an app client can hold it as an `ExplicitAuthFlows` value.
+ */
+export const userPasswordFlow = new SimCognitoAuthFlow({
+    name: "USER_PASSWORD_AUTH",
+    clientSetting: "ALLOW_USER_PASSWORD_AUTH",
+    legacySettings: ["USER_PASSWORD_AUTH"],
+});
+/**
+ * Exchanging a refresh token for a new access and id token.
+ *
+ * `REFRESH_TOKEN` is the same flow under its other name, and real Cognito
+ * accepts either.
+ */
+export const refreshTokenFlow = new SimCognitoAuthFlow({
+    name: "REFRESH_TOKEN_AUTH",
+    clientSetting: "ALLOW_REFRESH_TOKEN_AUTH",
+    aliases: ["REFRESH_TOKEN"],
+    exchangesRefreshToken: true,
+});
+/**
+ * The flows one entry point into authentication runs.
+ *
+ * `InitiateAuth` and `AdminInitiateAuth` do not run the same set, as real
+ * Cognito does not: `ADMIN_USER_PASSWORD_AUTH` is not valid for `InitiateAuth`,
+ * and `USER_PASSWORD_AUTH` is the client-side flow that replaces it.
+ */
+export class SimCognitoAuthFlows {
+    operation;
+    flows;
+    constructor(operation, flows) {
+        this.operation = operation;
+        this.flows = flows;
+    }
+    /**
+     * Resolve the flow a request asked for, or refuse.
+     *
+     * A flow this simulation does not run is refused rather than treated as one
+     * it does, because which flow ran decides what the caller has to send and
+     * what it gets back.
+     */
+    require(authFlow) {
+        const flow = this.flows.find((candidate) => candidate.matches(String(authFlow)));
+        if (flow !== undefined) {
+            return flow;
+        }
+        throw new SimCognitoInvalidParameterException(`AuthFlow '${String(authFlow)}' is not simulated: ${this.operation} ` +
+            `here runs ${this.flows.map((each) => each.name).join(" and ")}. SRP, ` +
+            `custom authentication and choice-based sign-in are not implemented.`);
+    }
+}
+/**
+ * The flows `AdminInitiateAuth` runs.
+ */
+export const adminAuthFlows = new SimCognitoAuthFlows("AdminInitiateAuth", [
+    adminUserPasswordFlow,
+    refreshTokenFlow,
+]);
+/**
+ * The flows `InitiateAuth` runs.
+ */
+export const clientAuthFlows = new SimCognitoAuthFlows("InitiateAuth", [
+    userPasswordFlow,
+    refreshTokenFlow,
+]);
+//# sourceMappingURL=sim-cognito-auth-flows.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-flows.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,kBAAkB,CAAC;IAC1D,IAAI,EAAE,0BAA0B;IAChC,aAAa,EAAE,gCAAgC;IAC/C,cAAc,EAAE,CAAC,mBAAmB,CAAC;CACtC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,kBAAkB,CAAC;IACrD,IAAI,EAAE,oBAAoB;IAC1B,aAAa,EAAE,0BAA0B;IACzC,cAAc,EAAE,CAAC,oBAAoB,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,kBAAkB,CAAC;IACrD,IAAI,EAAE,oBAAoB;IAC1B,aAAa,EAAE,0BAA0B;IACzC,OAAO,EAAE,CAAC,eAAe,CAAC;IAC1B,qBAAqB,EAAE,IAAI;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,SAAS,CAAS;IAClB,KAAK,CAAgC;IAEtD,YAAY,SAAiB,EAAE,KAAoC;QACjE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,QAA4B;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACzC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACpC,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,aAAa,MAAM,CAAC,QAAQ,CAAC,uBAAuB,IAAI,CAAC,SAAS,GAAG;YACnE,aAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;YACvE,qEAAqE,CACxE,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,mBAAmB,CAAC,mBAAmB,EAAE;IACzE,qBAAqB;IACrB,gBAAgB;CACjB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,mBAAmB,CAAC,cAAc,EAAE;IACrE,gBAAgB;IAChB,gBAAgB;CACjB,CAAC,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-auth-parameters.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The values an authentication request carries alongside the flow.
+ *
+ * `AdminInitiateAuth` calls them `AuthParameters` and
+ * `AdminRespondToAuthChallenge` calls them `ChallengeResponses`, so a refusal
+ * names whichever the caller wrote.
+ */
+export declare class SimCognitoAuthParameters {
+    private readonly field;
+    private readonly values;
+    constructor(field: string, values: Readonly<Record<string, string>> | undefined);
+    /**
+     * Read a value the flow needs, or refuse.
+     */
+    require(name: string): string;
+    /**
+     * Read a value that may or may not be there.
+     */
+    find(name: string): string | undefined;
+}
+//# sourceMappingURL=sim-cognito-auth-parameters.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-auth-parameters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-parameters.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-parameters.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YACE,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EAIrD;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU5B;IAED;;OAEG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-parameters.js

@@ -0,0 +1,33 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The values an authentication request carries alongside the flow.
+ *
+ * `AdminInitiateAuth` calls them `AuthParameters` and
+ * `AdminRespondToAuthChallenge` calls them `ChallengeResponses`, so a refusal
+ * names whichever the caller wrote.
+ */
+export class SimCognitoAuthParameters {
+    field;
+    values;
+    constructor(field, values) {
+        this.field = field;
+        this.values = new Map(Object.entries(values ?? {}));
+    }
+    /**
+     * Read a value the flow needs, or refuse.
+     */
+    require(name) {
+        const value = this.find(name);
+        if (value === undefined || value === "") {
+            throw new SimCognitoInvalidParameterException(`Missing required parameter ${name} in ${this.field}`);
+        }
+        return value;
+    }
+    /**
+     * Read a value that may or may not be there.
+     */
+    find(name) {
+        return this.values.get(name);
+    }
+}
+//# sourceMappingURL=sim-cognito-auth-parameters.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-parameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-parameters.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-parameters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,KAAK,CAAS;IACd,MAAM,CAA8B;IAErD,YACE,KAAa,EACb,MAAoD;QAEpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,8BAA8B,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,CACtD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,IAAY;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-resolver.d.ts

@@ -0,0 +1,61 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoClientInPool, SimCognitoUserPoolStore } from "../../user-pool/sim-cognito-user-pool-store.js";
+import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
+import type { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
+interface SimCognitoAuthResolverProperties {
+    readonly resolver: SimCognitoRequestResolver;
+    readonly pools: SimCognitoUserPoolStore;
+}
+interface SimCognitoCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+interface SimCognitoAuthRequestInput {
+    readonly UserPoolId?: string | undefined;
+    readonly ClientId?: string | undefined;
+}
+/**
+ * The pool an authentication request runs against, and the app client it runs
+ * through.
+ */
+export type SimCognitoAuthenticatingClient = SimCognitoClientInPool;
+/**
+ * Resolves what an authentication request names before the flow itself runs.
+ *
+ * Every authentication command ends up needing the same things: the pool, the
+ * app client, a username whose `SECRET_HASH` has been checked, and the user
+ * that username reaches.
+ */
+export declare class SimCognitoAuthResolver {
+    private readonly resolver;
+    private readonly pools;
+    constructor(properties: SimCognitoAuthResolverProperties);
+    /**
+     * Resolve the pool and app client an admin request names, once the caller
+     * may reach the pool.
+     *
+     * An app client has no ARN of its own, so authorization is against the
+     * pool's, as it is everywhere else in this simulation.
+     */
+    poolClient(action: string, input: SimCognitoAuthRequestInput, options: SimCognitoCommandOptions | undefined): SimCognitoAuthenticatingClient;
+    /**
+     * Resolve the pool and app client a client-side request names, which is by
+     * app client id alone and with no IAM involved.
+     *
+     * Real Cognito evaluates no IAM policy for `InitiateAuth`,
+     * `RespondToAuthChallenge` or `GlobalSignOut`: they are what a browser or
+     * mobile app calls, holding no AWS credentials at all. Authorizing them here
+     * would pass tests that a real deployment then fails, and refuse code that
+     * really works.
+     */
+    client(clientId: string | undefined): SimCognitoAuthenticatingClient;
+    /**
+     * Read the username a request names, with its `SECRET_HASH` checked.
+     *
+     * The hash covers the username, so it can only be checked once the username
+     * is known, and it is checked before anything looks the user up.
+     */
+    username(client: SimCognitoUserPoolClient, parameters: SimCognitoAuthParameters): string;
+}
+export {};
+//# sourceMappingURL=sim-cognito-auth-resolver.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-auth-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAEvG,OAAO,KAAK,EACV,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,UAAU,gCAAgC;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACzC;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,0BAA0B;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,MAAM,8BAA8B,GAAG,sBAAsB,CAAC;AAEpE;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAEhD,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;;;;;OAMG;IACH,UAAU,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,0BAA0B,EACjC,OAAO,EAAE,wBAAwB,GAAG,SAAS,GAC5C,8BAA8B,CAShC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,8BAA8B,CAInE;IAED;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,wBAAwB,EAChC,UAAU,EAAE,wBAAwB,GACnC,MAAM,CAUR;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-resolver.js

@@ -0,0 +1,56 @@
+import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
+import { requireSimCognitoUserPoolClientId } from "../../user-pool/client/sim-cognito-user-pool-client-id.js";
+/**
+ * Resolves what an authentication request names before the flow itself runs.
+ *
+ * Every authentication command ends up needing the same things: the pool, the
+ * app client, a username whose `SECRET_HASH` has been checked, and the user
+ * that username reaches.
+ */
+export class SimCognitoAuthResolver {
+    resolver;
+    pools;
+    constructor(properties) {
+        this.resolver = properties.resolver;
+        this.pools = properties.pools;
+    }
+    /**
+     * Resolve the pool and app client an admin request names, once the caller
+     * may reach the pool.
+     *
+     * An app client has no ARN of its own, so authorization is against the
+     * pool's, as it is everywhere else in this simulation.
+     */
+    poolClient(action, input, options) {
+        const pool = this.resolver.pool(action, input.UserPoolId, options);
+        return {
+            pool,
+            client: pool.requireClient(requireSimCognitoUserPoolClientId(input.ClientId)),
+        };
+    }
+    /**
+     * Resolve the pool and app client a client-side request names, which is by
+     * app client id alone and with no IAM involved.
+     *
+     * Real Cognito evaluates no IAM policy for `InitiateAuth`,
+     * `RespondToAuthChallenge` or `GlobalSignOut`: they are what a browser or
+     * mobile app calls, holding no AWS credentials at all. Authorizing them here
+     * would pass tests that a real deployment then fails, and refuse code that
+     * really works.
+     */
+    client(clientId) {
+        return this.pools.requireClient(requireSimCognitoUserPoolClientId(clientId));
+    }
+    /**
+     * Read the username a request names, with its `SECRET_HASH` checked.
+     *
+     * The hash covers the username, so it can only be checked once the username
+     * is known, and it is checked before anything looks the user up.
+     */
+    username(client, parameters) {
+        const username = parameters.require("USERNAME");
+        requireSimCognitoSecretHash(username, client, parameters.find("SECRET_HASH"));
+        return username;
+    }
+}
+//# sourceMappingURL=sim-cognito-auth-resolver.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-resolver.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAE9F,OAAO,EAAE,iCAAiC,EAAE,MAAM,2DAA2D,CAAC;AA4B9G;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAChB,QAAQ,CAA4B;IACpC,KAAK,CAA0B;IAEhD,YAAY,UAA4C;QACtD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CACR,MAAc,EACd,KAAiC,EACjC,OAA6C;QAE7C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEnE,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,aAAa,CACxB,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAClD;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,QAA4B;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAC7B,iCAAiC,CAAC,QAAQ,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CACN,MAAgC,EAChC,UAAoC;QAEpC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEhD,2BAA2B,CACzB,QAAQ,EACR,MAAM,EACN,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAC/B,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}