@kensio/yulin 0.42.0 → 0.44.0

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts

@@ -1,10 +1,16 @@
+import { SimCognitoPoolAuth } from "./auth/sim-cognito-pool-auth.js";
 import type { SimCognitoUserPoolClient } from "./client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPoolClientId } from "./client/sim-cognito-user-pool-client-id.js";
+import type { SimCognitoGroup } from "./group/sim-cognito-group.js";
+import type { SimCognitoGroupName } from "./group/sim-cognito-group-name.js";
 import type { SimCognitoDeletionProtection } from "./sim-cognito-deletion-protection.js";
 import type { SimCognitoName } from "./sim-cognito-name.js";
 import type { SimCognitoPasswordPolicy } from "./sim-cognito-password-policy.js";
 import type { SimCognitoUserPoolArn } from "./sim-cognito-user-pool-arn.js";
 import type { SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+import { SimCognitoSigningKey, type SimCognitoJwks } from "./token/sim-cognito-signing-key.js";
+import type { SimCognitoUser } from "./user/sim-cognito-user.js";
+import type { SimCognitoUsername } from "./user/sim-cognito-username.js";
 interface SimCognitoUserPoolProperties {
     readonly id: SimCognitoUserPoolId;
     readonly arn: SimCognitoUserPoolArn;
@@ -21,14 +27,53 @@ interface SimCognitoUserPoolProperties {
  * nothing outside the pool that issued it.
  */
 export declare class SimCognitoUserPool {
+    #private;
     readonly id: SimCognitoUserPoolId;
     readonly arn: SimCognitoUserPoolArn;
     readonly name: string;
     readonly passwordPolicy: SimCognitoPasswordPolicy;
     readonly deletionProtection: SimCognitoDeletionProtection;
     readonly creationDate: Date;
+    /**
+     * The sign-ins part way through this pool, and the tokens it has issued.
+     */
+    readonly auth: SimCognitoPoolAuth;
     private readonly clientStore;
+    private readonly userStore;
+    private readonly groupStore;
     constructor(properties: SimCognitoUserPoolProperties);
+    /**
+     * The URL a token from this pool names as its issuer.
+     *
+     * The region comes out of the pool id, which is where SDK code and token
+     * verifiers get it from too.
+     */
+    get issuerUrl(): string;
+    /**
+     * The name this pool is known by where a scheme would be wrong.
+     *
+     * This is the issuer URL without `https://`, and it is what an identity pool
+     * names a user pool provider by, and what `AWS::Cognito::UserPool` answers
+     * `Fn::GetAtt ProviderName` with.
+     */
+    get providerName(): string;
+    /**
+     * The key this pool signs its tokens with, generated on first use.
+     *
+     * The key belongs to the pool, as it does on real Cognito, so a token from
+     * one pool does not carry a signature another pool's JWKS can verify.
+     */
+    get signingKey(): SimCognitoSigningKey;
+    /**
+     * The public keys this pool publishes, in the shape its JWKS endpoint
+     * serves.
+     *
+     * A verifier configured for this pool takes this document and verifies the
+     * pool's tokens with nothing else needed. Real Cognito publishes two keys
+     * and rotates between them, and this publishes one, so code assuming a
+     * single entry passes here and is still wrong against real AWS.
+     */
+    jwks(): SimCognitoJwks;
     /**
      * When the pool last changed.
      *
@@ -60,6 +105,59 @@ export declare class SimCognitoUserPool {
      * Resolve an app client of this pool by id, or refuse.
      */
     requireClient(clientId: SimCognitoUserPoolClientId): SimCognitoUserPoolClient;
+    /**
+     * Every user in this pool, in creation order.
+     */
+    get users(): readonly SimCognitoUser[];
+    /**
+     * How many users this pool holds.
+     */
+    get userCount(): number;
+    /**
+     * Store a newly created user, refusing a username already in this pool.
+     */
+    addUser(user: SimCognitoUser): void;
+    /**
+     * Forget a deleted user, take them out of every group, and forget the
+     * tokens they hold.
+     *
+     * A group holding a user that no longer exists would answer `ListUsersInGroup`
+     * with a member this pool cannot describe, and a refresh token outliving its
+     * user would sign in someone the pool cannot describe either.
+     */
+    removeUser(user: SimCognitoUser): void;
+    /**
+     * Find a user of this pool by username.
+     */
+    findUser(username: string): SimCognitoUser | undefined;
+    /**
+     * Resolve a user of this pool by username, or refuse.
+     */
+    requireUser(username: SimCognitoUsername): SimCognitoUser;
+    /**
+     * Every group in this pool, in creation order.
+     */
+    get groups(): readonly SimCognitoGroup[];
+    /**
+     * Store a newly created group, refusing a name already in this pool.
+     */
+    addGroup(group: SimCognitoGroup): void;
+    /**
+     * Forget a deleted group, and with it the membership of its users.
+     */
+    removeGroup(group: SimCognitoGroup): void;
+    /**
+     * Find a group of this pool by name.
+     */
+    findGroup(groupName: string): SimCognitoGroup | undefined;
+    /**
+     * Resolve a group of this pool by name, or refuse.
+     */
+    requireGroup(groupName: SimCognitoGroupName): SimCognitoGroup;
+    /**
+     * The groups a user of this pool belongs to, strongest precedence first.
+     */
+    groupsOf(username: string): readonly SimCognitoGroup[];
 }
 export {};
 //# sourceMappingURL=sim-cognito-user-pool.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,UAAU,4BAA4B;IACpC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC1D,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,EAAE,EAAE,oBAAoB,CAAC;IACzC,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IAEnE,YAAY,UAAU,EAAE,4BAA4B,EAOnD;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,wBAAwB,EAAE,CAEjD;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAE3B;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEnD;IAED;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEjE;IAED;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,0BAA0B,GACnC,wBAAwB,CAE1B;CACF"}
+{"version":3,"file":"sim-cognito-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,UAAU,4BAA4B;IACpC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC1D,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;;IAC7B,SAAgB,EAAE,EAAE,oBAAoB,CAAC;IACzC,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;OAEG;IACH,SAAgB,IAAI,qBAA4B;IAEhD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAIzD,YAAY,UAAU,EAAE,4BAA4B,EAOnD;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,MAAM,CAItB;IAED;;;;;;OAMG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,oBAAoB,CAIrC;IAED;;;;;;;;OAQG;IACH,IAAI,IAAI,cAAc,CAErB;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,wBAAwB,EAAE,CAEjD;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAE3B;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEnD;IAED;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEjE;IAED;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,0BAA0B,GACnC,wBAAwB,CAE1B;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,cAAc,EAAE,CAErC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAElC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIrC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAErD;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,cAAc,CAExD;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,SAAS,eAAe,EAAE,CAEvC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAErC;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAExC;IAED;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAExD;IAED;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,eAAe,CAE5D;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAErD;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js

@@ -1,4 +1,8 @@
+import { SimCognitoPoolAuth } from "./auth/sim-cognito-pool-auth.js";
 import { SimCognitoUserPoolClientStore } from "./client/sim-cognito-user-pool-client-store.js";
+import { SimCognitoGroupStore } from "./group/sim-cognito-group-store.js";
+import { SimCognitoSigningKey, } from "./token/sim-cognito-signing-key.js";
+import { SimCognitoUserStore } from "./user/sim-cognito-user-store.js";
 /**
  * One simulated Cognito user pool.
  *
@@ -13,7 +17,14 @@ export class SimCognitoUserPool {
     passwordPolicy;
     deletionProtection;
     creationDate;
+    /**
+     * The sign-ins part way through this pool, and the tokens it has issued.
+     */
+    auth = new SimCognitoPoolAuth();
     clientStore = new SimCognitoUserPoolClientStore();
+    userStore = new SimCognitoUserStore();
+    groupStore = new SimCognitoGroupStore();
+    #signingKey;
     constructor(properties) {
         this.id = properties.id;
         this.arn = properties.arn;
@@ -22,6 +33,48 @@ export class SimCognitoUserPool {
         this.deletionProtection = properties.deletionProtection;
         this.creationDate = properties.createdDate;
     }
+    /**
+     * The URL a token from this pool names as its issuer.
+     *
+     * The region comes out of the pool id, which is where SDK code and token
+     * verifiers get it from too.
+     */
+    get issuerUrl() {
+        const [regionName] = this.id.split("_", 1);
+        return `https://cognito-idp.${String(regionName)}.amazonaws.com/${this.id}`;
+    }
+    /**
+     * The name this pool is known by where a scheme would be wrong.
+     *
+     * This is the issuer URL without `https://`, and it is what an identity pool
+     * names a user pool provider by, and what `AWS::Cognito::UserPool` answers
+     * `Fn::GetAtt ProviderName` with.
+     */
+    get providerName() {
+        return this.issuerUrl.replace("https://", "");
+    }
+    /**
+     * The key this pool signs its tokens with, generated on first use.
+     *
+     * The key belongs to the pool, as it does on real Cognito, so a token from
+     * one pool does not carry a signature another pool's JWKS can verify.
+     */
+    get signingKey() {
+        this.#signingKey ??= SimCognitoSigningKey.generate();
+        return this.#signingKey;
+    }
+    /**
+     * The public keys this pool publishes, in the shape its JWKS endpoint
+     * serves.
+     *
+     * A verifier configured for this pool takes this document and verifies the
+     * pool's tokens with nothing else needed. Real Cognito publishes two keys
+     * and rotates between them, and this publishes one, so code assuming a
+     * single entry passes here and is still wrong against real AWS.
+     */
+    jwks() {
+        return { keys: [this.signingKey.publicJwk()] };
+    }
     /**
      * When the pool last changed.
      *
@@ -67,5 +120,84 @@ export class SimCognitoUserPool {
     requireClient(clientId) {
         return this.clientStore.require(clientId);
     }
+    /**
+     * Every user in this pool, in creation order.
+     */
+    get users() {
+        return this.userStore.all;
+    }
+    /**
+     * How many users this pool holds.
+     */
+    get userCount() {
+        return this.userStore.count;
+    }
+    /**
+     * Store a newly created user, refusing a username already in this pool.
+     */
+    addUser(user) {
+        this.userStore.add(user);
+    }
+    /**
+     * Forget a deleted user, take them out of every group, and forget the
+     * tokens they hold.
+     *
+     * A group holding a user that no longer exists would answer `ListUsersInGroup`
+     * with a member this pool cannot describe, and a refresh token outliving its
+     * user would sign in someone the pool cannot describe either.
+     */
+    removeUser(user) {
+        this.userStore.remove(user);
+        this.groupStore.forgetUser(user.username);
+        this.auth.signOut(user.username);
+    }
+    /**
+     * Find a user of this pool by username.
+     */
+    findUser(username) {
+        return this.userStore.find(username);
+    }
+    /**
+     * Resolve a user of this pool by username, or refuse.
+     */
+    requireUser(username) {
+        return this.userStore.require(username);
+    }
+    /**
+     * Every group in this pool, in creation order.
+     */
+    get groups() {
+        return this.groupStore.all;
+    }
+    /**
+     * Store a newly created group, refusing a name already in this pool.
+     */
+    addGroup(group) {
+        this.groupStore.add(group);
+    }
+    /**
+     * Forget a deleted group, and with it the membership of its users.
+     */
+    removeGroup(group) {
+        this.groupStore.remove(group);
+    }
+    /**
+     * Find a group of this pool by name.
+     */
+    findGroup(groupName) {
+        return this.groupStore.find(groupName);
+    }
+    /**
+     * Resolve a group of this pool by name, or refuse.
+     */
+    requireGroup(groupName) {
+        return this.groupStore.require(groupName);
+    }
+    /**
+     * The groups a user of this pool belongs to, strongest precedence first.
+     */
+    groupsOf(username) {
+        return this.groupStore.forUser(username);
+    }
 }
 //# sourceMappingURL=sim-cognito-user-pool.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAgB/F;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,EAAE,CAAuB;IACzB,GAAG,CAAwB;IAC3B,IAAI,CAAS;IACb,cAAc,CAA2B;IACzC,kBAAkB,CAA+B;IACjD,YAAY,CAAO;IAElB,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAEnE,YAAY,UAAwC;QAClD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAoC;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAG/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAM1E,OAAO,EACL,oBAAoB,GAErB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAYvE;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,EAAE,CAAuB;IACzB,GAAG,CAAwB;IAC3B,IAAI,CAAS;IACb,cAAc,CAA2B;IACzC,kBAAkB,CAA+B;IACjD,YAAY,CAAO;IAEnC;;OAEG;IACa,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAE/B,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAClD,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;IACtC,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEzD,WAAW,CAAmC;IAE9C,YAAY,UAAwC;QAClD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE3C,OAAO,uBAAuB,MAAM,CAAC,UAAU,CAAC,kBAAkB,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,IAAI,CAAC,WAAW,KAAK,oBAAoB,CAAC,QAAQ,EAAE,CAAC;QAErD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAoC;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAoB;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA4B;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAsB;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAA8B;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts

@@ -0,0 +1,18 @@
+import { type SimCognitoTokenClaims, type SimCognitoTokenClaimsProperties } from "./sim-cognito-token-claims.js";
+/**
+ * The claims of a simulated access token.
+ *
+ * An access token says what the caller may do, so it names the app client in
+ * `client_id`, carries a `scope`, and has no `aud`. Its `username` is the
+ * user's username, where an id token calls the same thing `cognito:username`.
+ */
+export declare class SimCognitoAccessToken {
+    private readonly properties;
+    private readonly shared;
+    constructor(properties: SimCognitoTokenClaimsProperties);
+    /**
+     * The claims this token is signed with.
+     */
+    claims(): SimCognitoTokenClaims;
+}
+//# sourceMappingURL=sim-cognito-access-token.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-access-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAWvC;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js

@@ -0,0 +1,40 @@
+/* eslint-disable @typescript-eslint/naming-convention -- JWT claim names are the
+   ones RFC 7519 and Cognito define, rather than identifier names. */
+import { SimCognitoSharedTokenClaims, } from "./sim-cognito-token-claims.js";
+/**
+ * The scope an access token from an admin authentication flow carries.
+ *
+ * Real Cognito issues this scope for sign-in through the user pool API. The
+ * scopes a resource server defines reach a token through the hosted UI and
+ * client credentials flows, neither of which is simulated.
+ */
+const userPoolAdminScope = "aws.cognito.signin.user.admin";
+/**
+ * The claims of a simulated access token.
+ *
+ * An access token says what the caller may do, so it names the app client in
+ * `client_id`, carries a `scope`, and has no `aud`. Its `username` is the
+ * user's username, where an id token calls the same thing `cognito:username`.
+ */
+export class SimCognitoAccessToken {
+    properties;
+    shared;
+    constructor(properties) {
+        this.properties = properties;
+        this.shared = new SimCognitoSharedTokenClaims(properties);
+    }
+    /**
+     * The claims this token is signed with.
+     */
+    claims() {
+        const { client, user } = this.properties;
+        return {
+            ...this.shared.build(),
+            client_id: client.id,
+            token_use: "access",
+            scope: userPoolAdminScope,
+            username: user.username,
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-access-token.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-access-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA;qEACqE;AACrE,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.d.ts

@@ -0,0 +1,26 @@
+import { type SimCognitoTokenClaims, type SimCognitoTokenClaimsProperties } from "./sim-cognito-token-claims.js";
+/**
+ * The claims of a simulated id token.
+ *
+ * An id token says who the user is, so it carries the user's attributes and
+ * names the app client it was issued to in `aud`. An access token names the
+ * same client in `client_id` and has no `aud` at all, which is the difference
+ * verification libraries check and the one code most often gets wrong.
+ */
+export declare class SimCognitoIdToken {
+    private readonly properties;
+    private readonly shared;
+    constructor(properties: SimCognitoTokenClaimsProperties);
+    /**
+     * The claims this token is signed with.
+     */
+    claims(): SimCognitoTokenClaims;
+    /**
+     * The user's attributes, as an id token carries them.
+     *
+     * Each is reported under its own name, as real Cognito reports them. `sub`
+     * is not among them, because the shared claims already hold it.
+     */
+    private attributeClaims;
+}
+//# sourceMappingURL=sim-cognito-id-token.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-id-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAGxB"}

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.js

@@ -0,0 +1,42 @@
+/* eslint-disable @typescript-eslint/naming-convention -- JWT claim names are the
+   ones RFC 7519 and Cognito define, rather than identifier names. */
+import { SimCognitoSharedTokenClaims, } from "./sim-cognito-token-claims.js";
+/**
+ * The claims of a simulated id token.
+ *
+ * An id token says who the user is, so it carries the user's attributes and
+ * names the app client it was issued to in `aud`. An access token names the
+ * same client in `client_id` and has no `aud` at all, which is the difference
+ * verification libraries check and the one code most often gets wrong.
+ */
+export class SimCognitoIdToken {
+    properties;
+    shared;
+    constructor(properties) {
+        this.properties = properties;
+        this.shared = new SimCognitoSharedTokenClaims(properties);
+    }
+    /**
+     * The claims this token is signed with.
+     */
+    claims() {
+        const { client, user } = this.properties;
+        return {
+            ...this.shared.build(),
+            ...this.attributeClaims(),
+            aud: client.id,
+            token_use: "id",
+            "cognito:username": user.username,
+        };
+    }
+    /**
+     * The user's attributes, as an id token carries them.
+     *
+     * Each is reported under its own name, as real Cognito reports them. `sub`
+     * is not among them, because the shared claims already hold it.
+     */
+    attributeClaims() {
+        return Object.fromEntries(this.properties.user.attributeValues);
+    }
+}
+//# sourceMappingURL=sim-cognito-id-token.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-id-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA;qEACqE;AACrE,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,IAAI,CAAC,QAAQ;SAClC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-signing-key.d.ts

@@ -0,0 +1,64 @@
+/**
+ * One public key as a user pool publishes it.
+ */
+export type SimCognitoJwk = {
+    readonly kty: "RSA";
+    readonly use: "sig";
+    readonly alg: "RS256";
+    readonly kid: string;
+    readonly n: string;
+    readonly e: string;
+};
+/**
+ * A user pool's JWKS document, in the shape the real
+ * `.../.well-known/jwks.json` endpoint serves.
+ */
+export type SimCognitoJwks = {
+    keys: SimCognitoJwk[];
+};
+/**
+ * The key a simulated user pool signs its tokens with.
+ *
+ * The key material is real, generated with `node:crypto`, and the signature is
+ * a real RS256 signature over the real signing input. A token from here
+ * verifies in `aws-jwt-verify` or `jose` with nothing stubbed, which is the
+ * point: a test that verifies a simulated token has exercised the verifier it
+ * runs in production.
+ */
+export declare class SimCognitoSigningKey {
+    readonly kid: string;
+    private readonly privateKey;
+    private readonly modulus;
+    private readonly exponent;
+    private constructor();
+    /**
+     * Generate a key pair for a pool.
+     *
+     * A pool generates its own on first use rather than at creation, because
+     * generating 2048-bit RSA takes long enough to notice and most pools in a
+     * test suite never sign anything. Nothing is written to disk, and no key
+     * material is committed: a private key in the repository would set off
+     * secret scanners for no gain.
+     */
+    static generate(): SimCognitoSigningKey;
+    /**
+     * The key id, which is the RFC 7638 thumbprint of the public key.
+     *
+     * Real Cognito's key ids are opaque. A thumbprint is opaque enough, and it
+     * means the id names the key it actually belongs to.
+     */
+    private static thumbprint;
+    private static encode;
+    /**
+     * The public half of the key, as a pool publishes it in its JWKS.
+     */
+    publicJwk(): SimCognitoJwk;
+    /**
+     * Sign claims into a JWT.
+     *
+     * The header names RS256 and the key id, as a real Cognito token's header
+     * does, so a verifier finds the key in the pool's JWKS the same way.
+     */
+    sign(claims: object): string;
+}
+//# sourceMappingURL=sim-cognito-signing-key.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-signing-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-signing-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-signing-key.ts"],"names":[],"mappings":"AAaA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB,CAAC;AASF;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,GAAG,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,OAAO,eAaN;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,IAAI,oBAAoB,CAEtC;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;IAMzB,OAAO,CAAC,MAAM,CAAC,MAAM;IAIrB;;OAEG;IACH,SAAS,IAAI,aAAa,CASzB;IAED;;;;;OAKG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAY3B;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-signing-key.js

@@ -0,0 +1,91 @@
+import { createHash, createSign, generateKeyPairSync, } from "node:crypto";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+/* eslint-enable @typescript-eslint/consistent-type-definitions */
+/**
+ * The RSA modulus size real Cognito signs with.
+ */
+const modulusLength = 2048;
+/**
+ * The key a simulated user pool signs its tokens with.
+ *
+ * The key material is real, generated with `node:crypto`, and the signature is
+ * a real RS256 signature over the real signing input. A token from here
+ * verifies in `aws-jwt-verify` or `jose` with nothing stubbed, which is the
+ * point: a test that verifies a simulated token has exercised the verifier it
+ * runs in production.
+ */
+export class SimCognitoSigningKey {
+    kid;
+    privateKey;
+    modulus;
+    exponent;
+    constructor() {
+        const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+            modulusLength,
+        });
+        const { n, e } = publicKey.export({ format: "jwk" });
+        assertDefined(n, "RSA public key modulus");
+        assertDefined(e, "RSA public key exponent");
+        this.privateKey = privateKey;
+        this.modulus = n;
+        this.exponent = e;
+        this.kid = SimCognitoSigningKey.thumbprint(n, e);
+    }
+    /**
+     * Generate a key pair for a pool.
+     *
+     * A pool generates its own on first use rather than at creation, because
+     * generating 2048-bit RSA takes long enough to notice and most pools in a
+     * test suite never sign anything. Nothing is written to disk, and no key
+     * material is committed: a private key in the repository would set off
+     * secret scanners for no gain.
+     */
+    static generate() {
+        return new SimCognitoSigningKey();
+    }
+    /**
+     * The key id, which is the RFC 7638 thumbprint of the public key.
+     *
+     * Real Cognito's key ids are opaque. A thumbprint is opaque enough, and it
+     * means the id names the key it actually belongs to.
+     */
+    static thumbprint(modulus, exponent) {
+        return createHash("sha256")
+            .update(`{"e":"${exponent}","kty":"RSA","n":"${modulus}"}`)
+            .digest("base64url");
+    }
+    static encode(claims) {
+        return Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+    }
+    /**
+     * The public half of the key, as a pool publishes it in its JWKS.
+     */
+    publicJwk() {
+        return {
+            kty: "RSA",
+            use: "sig",
+            alg: "RS256",
+            kid: this.kid,
+            n: this.modulus,
+            e: this.exponent,
+        };
+    }
+    /**
+     * Sign claims into a JWT.
+     *
+     * The header names RS256 and the key id, as a real Cognito token's header
+     * does, so a verifier finds the key in the pool's JWKS the same way.
+     */
+    sign(claims) {
+        const signingInput = [
+            SimCognitoSigningKey.encode({ alg: "RS256", kid: this.kid }),
+            SimCognitoSigningKey.encode(claims),
+        ].join(".");
+        const signature = createSign("RSA-SHA256")
+            .update(signingInput)
+            .sign(this.privateKey)
+            .toString("base64url");
+        return `${signingInput}.${signature}`;
+    }
+}
+//# sourceMappingURL=sim-cognito-signing-key.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-signing-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-signing-key.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-signing-key.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,UAAU,EACV,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AA2BvE,kEAAkE;AAElE;;GAEG;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACf,GAAG,CAAS;IAEX,UAAU,CAAY;IACtB,OAAO,CAAS;IAChB,QAAQ,CAAS;IAElC;QACE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;YAC3D,aAAa;SACd,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAErD,aAAa,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3C,aAAa,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAE5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ;QACb,OAAO,IAAI,oBAAoB,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,UAAU,CAAC,OAAe,EAAE,QAAgB;QACzD,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,SAAS,QAAQ,sBAAsB,OAAO,IAAI,CAAC;aAC1D,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,MAAM,CAAC,MAAc;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,CAAC,EAAE,IAAI,CAAC,OAAO;YACf,CAAC,EAAE,IAAI,CAAC,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,MAAc;QACjB,MAAM,YAAY,GAAG;YACnB,oBAAoB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5D,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC;SACpC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC;aACvC,MAAM,CAAC,YAAY,CAAC;aACpB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;aACrB,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEzB,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;IACxC,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.d.ts

@@ -0,0 +1,37 @@
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUser } from "../user/sim-cognito-user.js";
+export type SimCognitoClaimValue = string | number | readonly string[];
+/**
+ * The claims of one token, in the shape they are signed in.
+ */
+export type SimCognitoTokenClaims = Readonly<Record<string, SimCognitoClaimValue>>;
+export interface SimCognitoTokenClaimsProperties {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly user: SimCognitoUser;
+    readonly issuedAt: Date;
+    readonly expiresAt: Date;
+    /**
+     * A fresh id for this token, which becomes its `jti` claim.
+     */
+    readonly tokenId: string;
+}
+/**
+ * The claims a simulated id token and access token share.
+ *
+ * `sub` is the same on both, as it is on real Cognito, so code keying on it
+ * gets the same user whichever token it read. `cognito:groups` is on both too,
+ * in precedence order, and is left out entirely when the user is in no groups
+ * rather than reported as an empty list.
+ */
+export declare class SimCognitoSharedTokenClaims {
+    private readonly properties;
+    constructor(properties: SimCognitoTokenClaimsProperties);
+    /**
+     * The claims every token from this pool carries.
+     */
+    build(): SimCognitoTokenClaims;
+    private groupClaim;
+}
+//# sourceMappingURL=sim-cognito-token-claims.d.ts.map