@kensio/yulin 0.42.0 → 0.44.0

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session-store.js

@@ -0,0 +1,60 @@
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
+/**
+ * The unfinished authentications of one simulated user pool.
+ *
+ * A session is forgotten as soon as it is used, so a replayed one fails the
+ * way it does on real Cognito.
+ */
+export class SimCognitoAuthSessionStore {
+    sessions = new Map();
+    /**
+     * Remember a session a challenge was issued with.
+     *
+     * A session nobody answered is dropped here once it has run out, so a
+     * simulation left running does not hold every abandoned sign-in. The new
+     * session's own issue time is the simulation's now, so no clock is needed.
+     */
+    add(session) {
+        this.forgetExpired(session.issuedAt);
+        this.sessions.set(session.id, session);
+    }
+    /**
+     * Find a session by the opaque string it was issued as.
+     */
+    find(sessionId) {
+        if (sessionId === undefined) {
+            return undefined;
+        }
+        return this.sessions.get(sessionId);
+    }
+    /**
+     * Resolve the session a challenge response carries, or refuse.
+     *
+     * A session this pool never issued, one already used, one for another user
+     * or app client, and one that has run out all fail the same way, as they do
+     * on real Cognito.
+     */
+    require(request) {
+        const session = this.find(request.sessionId);
+        if (session === undefined ||
+            !session.belongsTo(request.username, request.clientId) ||
+            session.isExpiredAt(request.now)) {
+            throw new SimCognitoNotAuthorizedException("Invalid session for the user.");
+        }
+        return session;
+    }
+    /**
+     * Forget a session that has been used.
+     */
+    remove(session) {
+        this.sessions.delete(session.id);
+    }
+    forgetExpired(now) {
+        for (const session of this.sessions.values()) {
+            if (session.isExpiredAt(now)) {
+                this.remove(session);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-auth-session-store.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-session-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAapF;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IACpB,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAErE;;;;;;OAMG;IACH,GAAG,CAAC,OAA8B;QAChC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,SAA6B;QAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,OAAqC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7C,IACE,OAAO,KAAK,SAAS;YACrB,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;YACtD,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,gCAAgC,CACxC,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA8B;QACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAEO,aAAa,CAAC,GAAS;QAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.d.ts

@@ -0,0 +1,31 @@
+interface SimCognitoAuthSessionProperties {
+    readonly username: string;
+    readonly clientId: string;
+    readonly challengeName: string;
+    readonly issuedAt: Date;
+}
+/**
+ * One challenge session, which is what an unfinished authentication carries
+ * between the request that started it and the response that completes it.
+ *
+ * The session is opaque, single use, and tied to the user and app client that
+ * got it: a session from one sign-in cannot complete another.
+ */
+export declare class SimCognitoAuthSession {
+    readonly id: string;
+    readonly username: string;
+    readonly clientId: string;
+    readonly challengeName: string;
+    readonly issuedAt: Date;
+    constructor(properties: SimCognitoAuthSessionProperties);
+    /**
+     * Whether this session has run out by a given moment.
+     */
+    isExpiredAt(now: Date): boolean;
+    /**
+     * Whether this session belongs to a user and app client.
+     */
+    belongsTo(username: string, clientId: string): boolean;
+}
+export {};
+//# sourceMappingURL=sim-cognito-auth-session.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAaA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAE/B,YAAY,UAAU,EAAE,+BAA+B,EAMtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAM9B;IAED;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.js

@@ -0,0 +1,45 @@
+import { randomBytes } from "node:crypto";
+/**
+ * How long a challenge session lasts.
+ *
+ * Real Cognito gives an app client an `AuthSessionValidity` of three minutes
+ * unless the client says otherwise, and `CreateUserPoolClient` refuses that
+ * input here, so three minutes is what every session gets.
+ */
+const sessionMinutes = 3;
+const sessionBytes = 48;
+/**
+ * One challenge session, which is what an unfinished authentication carries
+ * between the request that started it and the response that completes it.
+ *
+ * The session is opaque, single use, and tied to the user and app client that
+ * got it: a session from one sign-in cannot complete another.
+ */
+export class SimCognitoAuthSession {
+    id;
+    username;
+    clientId;
+    challengeName;
+    issuedAt;
+    constructor(properties) {
+        this.id = randomBytes(sessionBytes).toString("base64url");
+        this.username = properties.username;
+        this.clientId = properties.clientId;
+        this.challengeName = properties.challengeName;
+        this.issuedAt = properties.issuedAt;
+    }
+    /**
+     * Whether this session has run out by a given moment.
+     */
+    isExpiredAt(now) {
+        const expiresAt = new Date(this.issuedAt.getTime() + sessionMinutes * 60 * 1000);
+        return now.getTime() >= expiresAt.getTime();
+    }
+    /**
+     * Whether this session belongs to a user and app client.
+     */
+    belongsTo(username, clientId) {
+        return this.username === username && this.clientId === clientId;
+    }
+}
+//# sourceMappingURL=sim-cognito-auth-session.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,YAAY,GAAG,EAAE,CAAC;AASxB;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAChB,EAAE,CAAS;IACX,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAO;IAE/B,YAAY,UAA2C;QACrD,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,IAAI,CACrD,CAAC;QAEF,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,QAAgB;QAC1C,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAClE,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts

@@ -0,0 +1,59 @@
+import type { SimCognitoIssuedToken } from "./sim-cognito-issued-token.js";
+/**
+ * What a refresh request has to match for its token to be accepted.
+ */
+export interface SimCognitoRefreshTokenRequest {
+    readonly value: string;
+    readonly clientId: string;
+    readonly now: Date;
+}
+/**
+ * The tokens one simulated user pool has issued and still honours.
+ *
+ * Signing a user out forgets theirs, which is what makes a later refresh fail:
+ * real Cognito revokes a signed-out user's tokens rather than waiting for them
+ * to expire. A token that has run out is forgotten too, so a long-running
+ * simulation does not hold every token it ever signed.
+ */
+export declare class SimCognitoIssuedTokenStore {
+    private readonly refreshTokens;
+    private readonly accessTokens;
+    /**
+     * Forget the tokens a rule marks as spent, taking their values out first so
+     * nothing is deleted while it is still being read.
+     */
+    private static forgetSpent;
+    /**
+     * Remember a refresh token, so it can be exchanged later.
+     */
+    addRefreshToken(token: SimCognitoIssuedToken): void;
+    /**
+     * Remember an access token, so a sign-out can be authorized with it.
+     */
+    addAccessToken(token: SimCognitoIssuedToken): void;
+    /**
+     * Resolve the refresh token a request carries, or refuse.
+     *
+     * A token this pool never issued, one belonging to another app client, one
+     * that has run out, and one the user has been signed out of all fail the
+     * same way, as they do on real Cognito.
+     */
+    requireRefreshToken(request: SimCognitoRefreshTokenRequest): SimCognitoIssuedToken;
+    /**
+     * Find an access token this pool issued and still honours.
+     *
+     * A token from a signed-out session has been forgotten by then, so nothing
+     * comes back for it, which is the `Access Token has been revoked` real
+     * Cognito answers a request carrying one with.
+     */
+    findAccessToken(value: string): SimCognitoIssuedToken | undefined;
+    /**
+     * Forget every token issued to a user, whichever app client got it.
+     *
+     * This is what a global sign-out does, and what deleting a user does: a
+     * token outliving the user it names would sign in someone the pool cannot
+     * describe.
+     */
+    forgetUser(username: string): void;
+}
+//# sourceMappingURL=sim-cognito-issued-token-store.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAYvB;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js

@@ -0,0 +1,81 @@
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
+/**
+ * The tokens one simulated user pool has issued and still honours.
+ *
+ * Signing a user out forgets theirs, which is what makes a later refresh fail:
+ * real Cognito revokes a signed-out user's tokens rather than waiting for them
+ * to expire. A token that has run out is forgotten too, so a long-running
+ * simulation does not hold every token it ever signed.
+ */
+export class SimCognitoIssuedTokenStore {
+    refreshTokens = new Map();
+    accessTokens = new Map();
+    /**
+     * Forget the tokens a rule marks as spent, taking their values out first so
+     * nothing is deleted while it is still being read.
+     */
+    static forgetSpent(tokens, spent) {
+        const values = tokens
+            .values()
+            .filter(spent)
+            .map((issued) => issued.value)
+            .toArray();
+        for (const value of values) {
+            tokens.delete(value);
+        }
+    }
+    /**
+     * Remember a refresh token, so it can be exchanged later.
+     */
+    addRefreshToken(token) {
+        SimCognitoIssuedTokenStore.forgetSpent(this.refreshTokens, (issued) => issued.isExpiredAt(token.issuedAt));
+        this.refreshTokens.set(token.value, token);
+    }
+    /**
+     * Remember an access token, so a sign-out can be authorized with it.
+     */
+    addAccessToken(token) {
+        SimCognitoIssuedTokenStore.forgetSpent(this.accessTokens, (issued) => issued.isExpiredAt(token.issuedAt));
+        this.accessTokens.set(token.value, token);
+    }
+    /**
+     * Resolve the refresh token a request carries, or refuse.
+     *
+     * A token this pool never issued, one belonging to another app client, one
+     * that has run out, and one the user has been signed out of all fail the
+     * same way, as they do on real Cognito.
+     */
+    requireRefreshToken(request) {
+        const issued = this.refreshTokens.get(request.value);
+        if (issued?.isFor(request.clientId) !== true) {
+            throw new SimCognitoNotAuthorizedException("Invalid Refresh Token.");
+        }
+        if (issued.isExpiredAt(request.now)) {
+            throw new SimCognitoNotAuthorizedException("Refresh Token has expired.");
+        }
+        return issued;
+    }
+    /**
+     * Find an access token this pool issued and still honours.
+     *
+     * A token from a signed-out session has been forgotten by then, so nothing
+     * comes back for it, which is the `Access Token has been revoked` real
+     * Cognito answers a request carrying one with.
+     */
+    findAccessToken(value) {
+        return this.accessTokens.get(value);
+    }
+    /**
+     * Forget every token issued to a user, whichever app client got it.
+     *
+     * This is what a global sign-out does, and what deleting a user does: a
+     * token outliving the user it names would sign in someone the pool cannot
+     * describe.
+     */
+    forgetUser(username) {
+        const theirs = (issued) => issued.username === username;
+        SimCognitoIssuedTokenStore.forgetSpent(this.refreshTokens, theirs);
+        SimCognitoIssuedTokenStore.forgetSpent(this.accessTokens, theirs);
+    }
+}
+//# sourceMappingURL=sim-cognito-issued-token-store.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts

@@ -0,0 +1,37 @@
+interface SimCognitoIssuedTokenProperties {
+    readonly value: string;
+    readonly username: string;
+    readonly clientId: string;
+    readonly issuedAt: Date;
+    readonly expiresAt: Date;
+}
+/**
+ * One token a pool has issued, as the pool remembers it.
+ *
+ * A refresh token is remembered because the pool is what exchanges it later,
+ * and an access token because the pool is what a sign-out presents one to. The
+ * token this describes is the string the caller holds: an access token is a
+ * signed JWT and a refresh token is opaque, and neither says anything to this
+ * pool that this record does not.
+ */
+export declare class SimCognitoIssuedToken {
+    readonly value: string;
+    readonly username: string;
+    readonly clientId: string;
+    readonly issuedAt: Date;
+    readonly expiresAt: Date;
+    constructor(properties: SimCognitoIssuedTokenProperties);
+    /**
+     * Whether this token has run out by a given moment.
+     */
+    isExpiredAt(now: Date): boolean;
+    /**
+     * Whether this token was issued to an app client.
+     *
+     * A refresh token belongs to the client that got it, so presenting one to
+     * another client fails, as it does on real Cognito.
+     */
+    isFor(clientId: string): boolean;
+}
+export {};
+//# sourceMappingURL=sim-cognito-issued-token.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC,YAAY,UAAU,EAAE,+BAA+B,EAMtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js

@@ -0,0 +1,39 @@
+/**
+ * One token a pool has issued, as the pool remembers it.
+ *
+ * A refresh token is remembered because the pool is what exchanges it later,
+ * and an access token because the pool is what a sign-out presents one to. The
+ * token this describes is the string the caller holds: an access token is a
+ * signed JWT and a refresh token is opaque, and neither says anything to this
+ * pool that this record does not.
+ */
+export class SimCognitoIssuedToken {
+    value;
+    username;
+    clientId;
+    issuedAt;
+    expiresAt;
+    constructor(properties) {
+        this.value = properties.value;
+        this.username = properties.username;
+        this.clientId = properties.clientId;
+        this.issuedAt = properties.issuedAt;
+        this.expiresAt = properties.expiresAt;
+    }
+    /**
+     * Whether this token has run out by a given moment.
+     */
+    isExpiredAt(now) {
+        return now.getTime() >= this.expiresAt.getTime();
+    }
+    /**
+     * Whether this token was issued to an app client.
+     *
+     * A refresh token belongs to the client that got it, so presenting one to
+     * another client fails, as it does on real Cognito.
+     */
+    isFor(clientId) {
+        return this.clientId === clientId;
+    }
+}
+//# sourceMappingURL=sim-cognito-issued-token.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAQA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts

@@ -0,0 +1,49 @@
+import type { SimCognitoAuthSession } from "./sim-cognito-auth-session.js";
+import { type SimCognitoAuthSessionRequest } from "./sim-cognito-auth-session-store.js";
+import type { SimCognitoIssuedToken } from "./sim-cognito-issued-token.js";
+import { type SimCognitoRefreshTokenRequest } from "./sim-cognito-issued-token-store.js";
+/**
+ * The authentication state of one simulated user pool: the sign-ins that are
+ * part way through, and the tokens the finished ones handed out.
+ *
+ * The two live together because signing a user out reaches both kinds of
+ * state, and because keeping them here leaves `SimCognitoUserPool` as what it
+ * is elsewhere, a resource holding its contents.
+ */
+export declare class SimCognitoPoolAuth {
+    private readonly sessions;
+    private readonly tokens;
+    /**
+     * Remember a challenge session an authentication was left waiting on.
+     */
+    addSession(session: SimCognitoAuthSession): void;
+    /**
+     * Resolve the challenge session a response carries, or refuse.
+     */
+    requireSession(request: SimCognitoAuthSessionRequest): SimCognitoAuthSession;
+    /**
+     * Forget a challenge session that has been used.
+     */
+    removeSession(session: SimCognitoAuthSession): void;
+    /**
+     * Remember a refresh token this pool has issued.
+     */
+    addRefreshToken(token: SimCognitoIssuedToken): void;
+    /**
+     * Remember an access token this pool has issued.
+     */
+    addAccessToken(token: SimCognitoIssuedToken): void;
+    /**
+     * Resolve the refresh token a refresh request carries, or refuse.
+     */
+    requireRefreshToken(request: SimCognitoRefreshTokenRequest): SimCognitoIssuedToken;
+    /**
+     * Find an access token this pool issued and still honours.
+     */
+    findAccessToken(value: string): SimCognitoIssuedToken | undefined;
+    /**
+     * Sign a user out of every app client, forgetting the tokens it holds.
+     */
+    signOut(username: string): void;
+}
+//# sourceMappingURL=sim-cognito-pool-auth.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js

@@ -0,0 +1,63 @@
+import { SimCognitoAuthSessionStore, } from "./sim-cognito-auth-session-store.js";
+import { SimCognitoIssuedTokenStore, } from "./sim-cognito-issued-token-store.js";
+/**
+ * The authentication state of one simulated user pool: the sign-ins that are
+ * part way through, and the tokens the finished ones handed out.
+ *
+ * The two live together because signing a user out reaches both kinds of
+ * state, and because keeping them here leaves `SimCognitoUserPool` as what it
+ * is elsewhere, a resource holding its contents.
+ */
+export class SimCognitoPoolAuth {
+    sessions = new SimCognitoAuthSessionStore();
+    tokens = new SimCognitoIssuedTokenStore();
+    /**
+     * Remember a challenge session an authentication was left waiting on.
+     */
+    addSession(session) {
+        this.sessions.add(session);
+    }
+    /**
+     * Resolve the challenge session a response carries, or refuse.
+     */
+    requireSession(request) {
+        return this.sessions.require(request);
+    }
+    /**
+     * Forget a challenge session that has been used.
+     */
+    removeSession(session) {
+        this.sessions.remove(session);
+    }
+    /**
+     * Remember a refresh token this pool has issued.
+     */
+    addRefreshToken(token) {
+        this.tokens.addRefreshToken(token);
+    }
+    /**
+     * Remember an access token this pool has issued.
+     */
+    addAccessToken(token) {
+        this.tokens.addAccessToken(token);
+    }
+    /**
+     * Resolve the refresh token a refresh request carries, or refuse.
+     */
+    requireRefreshToken(request) {
+        return this.tokens.requireRefreshToken(request);
+    }
+    /**
+     * Find an access token this pool issued and still honours.
+     */
+    findAccessToken(value) {
+        return this.tokens.findAccessToken(value);
+    }
+    /**
+     * Sign a user out of every app client, forgetting the tokens it holds.
+     */
+    signOut(username) {
+        this.tokens.forgetUser(username);
+    }
+}
+//# sourceMappingURL=sim-cognito-pool-auth.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-secret-hash.d.ts

@@ -0,0 +1,17 @@
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+/**
+ * Compute the `SECRET_HASH` a request from an app client should carry.
+ *
+ * It is the HMAC-SHA256 of the username and the client id, keyed by the client
+ * secret, which is what the AWS SDKs compute.
+ */
+export declare function simCognitoSecretHash(username: string, clientId: string, clientSecret: string): string;
+/**
+ * Refuse a request whose `SECRET_HASH` is missing or wrong.
+ *
+ * Checking it is what makes a test notice a client secret it forgot to use,
+ * rather than finding out on a real pool. A client without a secret needs
+ * none, and one sent anyway is ignored, as real Cognito ignores it.
+ */
+export declare function requireSimCognitoSecretHash(username: string, client: SimCognitoUserPoolClient, secretHash: string | undefined): void;
+//# sourceMappingURL=sim-cognito-secret-hash.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-secret-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-secret-hash.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-secret-hash.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,wBAAwB,EAChC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,IAAI,CAYN"}

package/dist/service/cognito/user-pool/auth/sim-cognito-secret-hash.js

@@ -0,0 +1,34 @@
+/* eslint-disable security/detect-possible-timing-attacks -- this is a
+   simulator in one process, where the secret hash is checked so a test notices
+   a client secret it forgot to use, rather than as a defence against anyone
+   measuring how long the check took. */
+import { createHmac } from "node:crypto";
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
+/**
+ * Compute the `SECRET_HASH` a request from an app client should carry.
+ *
+ * It is the HMAC-SHA256 of the username and the client id, keyed by the client
+ * secret, which is what the AWS SDKs compute.
+ */
+export function simCognitoSecretHash(username, clientId, clientSecret) {
+    return createHmac("sha256", clientSecret)
+        .update(`${username}${clientId}`)
+        .digest("base64");
+}
+/**
+ * Refuse a request whose `SECRET_HASH` is missing or wrong.
+ *
+ * Checking it is what makes a test notice a client secret it forgot to use,
+ * rather than finding out on a real pool. A client without a secret needs
+ * none, and one sent anyway is ignored, as real Cognito ignores it.
+ */
+export function requireSimCognitoSecretHash(username, client, secretHash) {
+    const { secret } = client;
+    if (secret === undefined) {
+        return;
+    }
+    if (secretHash !== simCognitoSecretHash(username, client.id, secret)) {
+        throw new SimCognitoNotAuthorizedException(`Unable to verify secret hash for client ${client.id}.`);
+    }
+}
+//# sourceMappingURL=sim-cognito-secret-hash.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-secret-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-secret-hash.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-secret-hash.ts"],"names":[],"mappings":"AAAA;;;wCAGwC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAGpF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,QAAgB,EAChB,YAAoB;IAEpB,OAAO,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC;SAChC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,MAAgC,EAChC,UAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAE1B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,IAAI,UAAU,KAAK,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,gCAAgC,CACxC,2CAA2C,MAAM,CAAC,EAAE,GAAG,CACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/user-pool/auth/sim-cognito-sign-in.d.ts

@@ -0,0 +1,31 @@
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../user/sim-cognito-user.js";
+/**
+ * Resolve the user a sign-in names, as the app client reports one that is not
+ * there.
+ *
+ * A client with `PreventUserExistenceErrors` of `ENABLED` answers with the
+ * same refusal a wrong password gets, and one left on the `LEGACY` default
+ * says the user does not exist.
+ */
+export declare function requireSimCognitoSignInUser(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, username: string): SimCognitoUser;
+/**
+ * Refuse a user that has been disabled.
+ *
+ * Disabling a user stops it authenticating at all, so it is checked by a token
+ * refresh as well as by a sign-in: a user disabled after signing in cannot go
+ * on renewing its session.
+ */
+export declare function requireSimCognitoEnabled(user: SimCognitoUser): void;
+/**
+ * Refuse a sign-in the user cannot make.
+ *
+ * A disabled user and a wrong password both fail as `NotAuthorizedException`,
+ * saying no more than real Cognito says. A user created without a
+ * `TemporaryPassword` has no password at all, so nothing matches: real Cognito
+ * generates one and sends it to the user, and nothing here delivers a message
+ * for the user to read it from.
+ */
+export declare function requireSimCognitoSignIn(user: SimCognitoUser, password: string): void;
+//# sourceMappingURL=sim-cognito-sign-in.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,MAAM,GACf,cAAc,CAgBhB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAInE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN"}