@kensio/yulin 1.11.1 → 1.12.1

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts

@@ -4,6 +4,11 @@ interface SimCognitoIssuedTokenProperties {
     readonly clientId: string;
     readonly issuedAt: Date;
     readonly expiresAt: Date;
+    /**
+     * The scopes the sign-in this token came from was granted, which a refresh
+     * gives the tokens it hands out next.
+     */
+    readonly scopes?: readonly string[] | undefined;
 }
 /**
  * One token a pool has issued, as the pool remembers it.
@@ -20,6 +25,11 @@ export declare class SimCognitoIssuedToken {
     readonly clientId: string;
     readonly issuedAt: Date;
     readonly expiresAt: Date;
+    /**
+     * The scopes the sign-in was granted, which a token from the API carries
+     * none of: the scope of one of those is settled where the token is signed.
+     */
+    readonly scopes: readonly string[];
     constructor(properties: SimCognitoIssuedTokenProperties);
     /**
      * Whether this token has run out by a given moment.

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC,YAAY,UAAU,EAAE,+BAA+B,EAMtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC;;;OAGG;IACH,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,UAAU,EAAE,+BAA+B,EAOtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js

@@ -13,12 +13,18 @@ export class SimCognitoIssuedToken {
     clientId;
     issuedAt;
     expiresAt;
+    /**
+     * The scopes the sign-in was granted, which a token from the API carries
+     * none of: the scope of one of those is settled where the token is signed.
+     */
+    scopes;
     constructor(properties) {
         this.value = properties.value;
         this.username = properties.username;
         this.clientId = properties.clientId;
         this.issuedAt = properties.issuedAt;
         this.expiresAt = properties.expiresAt;
+        this.scopes = properties.scopes ?? [];
     }
     /**
      * Whether this token has run out by a given moment.

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAQA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAcA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC;;;OAGG;IACa,MAAM,CAAoB;IAE1C,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts

@@ -1,18 +1,57 @@
+import { SimCognitoIdentityProviderStore } from "../idp/sim-cognito-identity-provider-store.js";
+import type { SimCognitoUserPoolDomain } from "../domain/sim-cognito-user-pool-domain.js";
 import type { SimCognitoAuthSession } from "./sim-cognito-auth-session.js";
 import { type SimCognitoAuthSessionRequest } from "./sim-cognito-auth-session-store.js";
+import type { SimCognitoAuthorizationCode } from "./sim-cognito-authorization-code.js";
 import type { SimCognitoIssuedToken } from "./sim-cognito-issued-token.js";
 import { type SimCognitoRefreshTokenRequest } from "./sim-cognito-issued-token-store.js";
 /**
- * The authentication state of one simulated user pool: the sign-ins that are
- * part way through, and the tokens the finished ones handed out.
+ * The authentication state of one simulated user pool: where users can sign
+ * in, the sign-ins that are part way through, and the tokens the finished ones
+ * handed out.
  *
- * The two live together because signing a user out reaches both kinds of
- * state, and because keeping them here leaves `SimCognitoUserPool` as what it
+ * These live together because signing a user out reaches more than one of
+ * them, and because keeping them here leaves `SimCognitoUserPool` as what it
  * is elsewhere, a resource holding its contents.
+ *
+ * The hosted domain and the external identity providers are here for the same
+ * reason. A domain is where a browser signs in, a provider is who it signs in
+ * with, and an authorization code is a sign-in part way through, in the same
+ * way a challenge session is.
  */
 export declare class SimCognitoPoolAuth {
+    #private;
+    /**
+     * The external identity providers this pool federates to.
+     */
+    readonly identityProviders: SimCognitoIdentityProviderStore;
     private readonly sessions;
+    private readonly codes;
     private readonly tokens;
+    /**
+     * The hosted domain this pool serves its OAuth endpoints on, if it has one.
+     *
+     * A pool has at most one, as a real pool does: a prefix domain and a custom
+     * domain are two forms of the same thing rather than two domains.
+     */
+    get domain(): SimCognitoUserPoolDomain | undefined;
+    /**
+     * Give this pool the domain a `CreateUserPoolDomain` request asked for.
+     */
+    addDomain(domain: SimCognitoUserPoolDomain): void;
+    /**
+     * Forget this pool's domain, because it has been deleted.
+     */
+    removeDomain(): void;
+    /**
+     * Remember an authorization code this pool handed to a browser.
+     */
+    addAuthorizationCode(code: SimCognitoAuthorizationCode): void;
+    /**
+     * Take the authorization code a token request carries, if this pool still
+     * holds one that has not run out.
+     */
+    spendAuthorizationCode(value: string | undefined, now: Date): SimCognitoAuthorizationCode | undefined;
     /**
      * Remember a challenge session an authentication was left waiting on.
      */
@@ -37,6 +76,10 @@ export declare class SimCognitoPoolAuth {
      * Resolve the refresh token a refresh request carries, or refuse.
      */
     requireRefreshToken(request: SimCognitoRefreshTokenRequest): SimCognitoIssuedToken;
+    /**
+     * Find a refresh token this pool issued and still holds.
+     */
+    findRefreshToken(value: string | undefined): SimCognitoIssuedToken | undefined;
     /**
      * Find an access token this pool issued and still honours.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;;IAC7B;;OAEG;IACH,SAAgB,iBAAiB,kCAAyC;IAE1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAI3D;;;;;OAKG;IACH,IAAI,MAAM,IAAI,wBAAwB,GAAG,SAAS,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAEzC;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js

@@ -1,16 +1,64 @@
+import { SimCognitoIdentityProviderStore } from "../idp/sim-cognito-identity-provider-store.js";
 import { SimCognitoAuthSessionStore, } from "./sim-cognito-auth-session-store.js";
+import { SimCognitoAuthorizationCodeStore } from "./sim-cognito-authorization-code-store.js";
 import { SimCognitoIssuedTokenStore, } from "./sim-cognito-issued-token-store.js";
 /**
- * The authentication state of one simulated user pool: the sign-ins that are
- * part way through, and the tokens the finished ones handed out.
+ * The authentication state of one simulated user pool: where users can sign
+ * in, the sign-ins that are part way through, and the tokens the finished ones
+ * handed out.
  *
- * The two live together because signing a user out reaches both kinds of
- * state, and because keeping them here leaves `SimCognitoUserPool` as what it
+ * These live together because signing a user out reaches more than one of
+ * them, and because keeping them here leaves `SimCognitoUserPool` as what it
  * is elsewhere, a resource holding its contents.
+ *
+ * The hosted domain and the external identity providers are here for the same
+ * reason. A domain is where a browser signs in, a provider is who it signs in
+ * with, and an authorization code is a sign-in part way through, in the same
+ * way a challenge session is.
  */
 export class SimCognitoPoolAuth {
+    /**
+     * The external identity providers this pool federates to.
+     */
+    identityProviders = new SimCognitoIdentityProviderStore();
     sessions = new SimCognitoAuthSessionStore();
+    codes = new SimCognitoAuthorizationCodeStore();
     tokens = new SimCognitoIssuedTokenStore();
+    #domain;
+    /**
+     * The hosted domain this pool serves its OAuth endpoints on, if it has one.
+     *
+     * A pool has at most one, as a real pool does: a prefix domain and a custom
+     * domain are two forms of the same thing rather than two domains.
+     */
+    get domain() {
+        return this.#domain;
+    }
+    /**
+     * Give this pool the domain a `CreateUserPoolDomain` request asked for.
+     */
+    addDomain(domain) {
+        this.#domain = domain;
+    }
+    /**
+     * Forget this pool's domain, because it has been deleted.
+     */
+    removeDomain() {
+        this.#domain = undefined;
+    }
+    /**
+     * Remember an authorization code this pool handed to a browser.
+     */
+    addAuthorizationCode(code) {
+        this.codes.add(code);
+    }
+    /**
+     * Take the authorization code a token request carries, if this pool still
+     * holds one that has not run out.
+     */
+    spendAuthorizationCode(value, now) {
+        return this.codes.spend(value, now);
+    }
     /**
      * Remember a challenge session an authentication was left waiting on.
      */
@@ -47,6 +95,12 @@ export class SimCognitoPoolAuth {
     requireRefreshToken(request) {
         return this.tokens.requireRefreshToken(request);
     }
+    /**
+     * Find a refresh token this pool issued and still holds.
+     */
+    findRefreshToken(value) {
+        return this.tokens.findRefreshToken(value);
+    }
     /**
      * Find an access token this pool issued and still honours.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAGhG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAE7F,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACa,iBAAiB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEzD,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,KAAK,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,OAAO,CAAuC;IAE9C;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAiC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-grants.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The OAuth grant this simulation runs.
+ *
+ * The implicit grant hands tokens to the browser in a URL fragment, and the
+ * client credentials grant needs the resource servers that define the scopes
+ * it is made for. Neither is simulated, so a client asking for one is refused
+ * rather than given an authorization server that would not answer it.
+ */
+export declare const simCognitoSimulatedOAuthFlow = "code";
+/**
+ * The OAuth grants an app client asked to be able to make.
+ */
+export declare function simCognitoRequiredOAuthFlows(requested: readonly string[] | undefined): readonly string[];
+/**
+ * The scopes an app client asked to be able to grant.
+ */
+export declare function simCognitoRequiredOAuthScopes(requested: readonly string[] | undefined): readonly string[];
+//# sourceMappingURL=sim-cognito-oauth-grants.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-grants.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-oauth-grants.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAsBnD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACvC,SAAS,MAAM,EAAE,CAqBnB;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACvC,SAAS,MAAM,EAAE,CAcnB"}

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-grants.js

@@ -0,0 +1,61 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The OAuth grant this simulation runs.
+ *
+ * The implicit grant hands tokens to the browser in a URL fragment, and the
+ * client credentials grant needs the resource servers that define the scopes
+ * it is made for. Neither is simulated, so a client asking for one is refused
+ * rather than given an authorization server that would not answer it.
+ */
+export const simCognitoSimulatedOAuthFlow = "code";
+const oauthFlows = new Set([
+    simCognitoSimulatedOAuthFlow,
+    "implicit",
+    "client_credentials",
+]);
+/**
+ * The scopes a pool defines without a resource server.
+ *
+ * A custom scope belongs to a resource server, which is not simulated, so a
+ * client is held to these.
+ */
+const systemScopes = new Set([
+    "openid",
+    "email",
+    "phone",
+    "profile",
+    "aws.cognito.signin.user.admin",
+]);
+/**
+ * The OAuth grants an app client asked to be able to make.
+ */
+export function simCognitoRequiredOAuthFlows(requested) {
+    const flows = [...(requested ?? [])];
+    for (const flow of flows) {
+        if (!oauthFlows.has(flow)) {
+            throw new SimCognitoInvalidParameterException(`AllowedOAuthFlows '${flow}' is not an OAuth flow: the flows are ` +
+                `${oauthFlows.values().toArray().join(", ")}.`);
+        }
+        if (flow !== simCognitoSimulatedOAuthFlow) {
+            throw new SimCognitoInvalidParameterException(`AllowedOAuthFlows '${flow}' is not simulated: the grant would be ` +
+                `offered here and answered on real AWS. Only '${simCognitoSimulatedOAuthFlow}' ` +
+                `is supported.`);
+        }
+    }
+    return flows;
+}
+/**
+ * The scopes an app client asked to be able to grant.
+ */
+export function simCognitoRequiredOAuthScopes(requested) {
+    const scopes = [...(requested ?? [])];
+    for (const scope of scopes) {
+        if (!systemScopes.has(scope)) {
+            throw new SimCognitoInvalidParameterException(`AllowedOAuthScopes '${scope}' is not simulated: a custom scope ` +
+                `belongs to a resource server, which is not simulated. The ` +
+                `system scopes are ${systemScopes.values().toArray().join(", ")}.`);
+        }
+    }
+    return scopes;
+}
+//# sourceMappingURL=sim-cognito-oauth-grants.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-grants.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-oauth-grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,4BAA4B;IAC5B,UAAU;IACV,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,QAAQ;IACR,OAAO;IACP,OAAO;IACP,SAAS;IACT,+BAA+B;CAChC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAwC;IAExC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAmC,CAC3C,sBAAsB,IAAI,wCAAwC;gBAChE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;YAC1C,MAAM,IAAI,mCAAmC,CAC3C,sBAAsB,IAAI,yCAAyC;gBACjE,gDAAgD,4BAA4B,IAAI;gBAChF,eAAe,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAwC;IAExC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,mCAAmC,CAC3C,uBAAuB,KAAK,qCAAqC;gBAC/D,4DAA4D;gBAC5D,qBAAqB,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-settings.d.ts

@@ -0,0 +1,60 @@
+import type { SimCognitoRedirectUrls } from "./sim-cognito-redirect-urls.js";
+/**
+ * The OAuth properties of an app client, in the shape a request sets them and
+ * a described client reports them.
+ */
+export interface SimCognitoOAuthSettingsType {
+    readonly AllowedOAuthFlows?: readonly string[] | undefined;
+    readonly AllowedOAuthFlowsUserPoolClient?: boolean | undefined;
+    readonly AllowedOAuthScopes?: readonly string[] | undefined;
+    readonly CallbackURLs?: readonly string[] | undefined;
+    readonly LogoutURLs?: readonly string[] | undefined;
+    readonly DefaultRedirectURI?: string | undefined;
+    readonly SupportedIdentityProviders?: readonly string[] | undefined;
+}
+/**
+ * What an app client is allowed to do at a pool's hosted domain.
+ *
+ * These settings are what the authorize, token and logout endpoints check a
+ * request against: which grant it may ask for, which scopes it may be given,
+ * which URL it may be sent back to, and which identity provider it may sign a
+ * user in through. Nothing here is honoured without a domain, because there is
+ * no endpoint to reach until the pool has one.
+ *
+ * `AllowedOAuthFlowsUserPoolClient` gates the rest, as it does on real
+ * Cognito: the other settings cannot be configured until it is true.
+ */
+export declare class SimCognitoOAuthSettings {
+    readonly enabled: boolean;
+    readonly flows: readonly string[];
+    readonly scopes: readonly string[];
+    readonly callbackUrls: SimCognitoRedirectUrls;
+    readonly logoutUrls: SimCognitoRedirectUrls;
+    readonly defaultRedirectUri: string | undefined;
+    readonly identityProviders: readonly string[];
+    constructor(settings: SimCognitoOAuthSettingsType);
+    /**
+     * These settings as a described app client reports them.
+     *
+     * A list the request did not set is left out rather than reported empty, so
+     * a client created without any of this reports none of it.
+     */
+    toOutput(): SimCognitoOAuthSettingsType;
+    /**
+     * Whether this client may complete an authorization code grant.
+     */
+    get allowsCodeGrant(): boolean;
+    /**
+     * Whether a redirect URI is one this client registered.
+     */
+    allowsRedirectTo(redirectUri: string): boolean;
+    /**
+     * Whether a sign-out URL is one this client registered.
+     */
+    allowsSignOutTo(logoutUri: string): boolean;
+    /**
+     * Whether this client offers an identity provider by name.
+     */
+    allowsIdentityProvider(providerName: string): boolean;
+}
+//# sourceMappingURL=sim-cognito-oauth-settings.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-oauth-settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAI7E;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACrE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,uBAAuB;IAClC,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,UAAU,EAAE,sBAAsB,CAAC;IACnD,SAAgB,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvD,SAAgB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErD,YAAY,QAAQ,EAAE,2BAA2B,EAUhD;IAED;;;;;OAKG;IACH,QAAQ,IAAI,2BAA2B,CAkBtC;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED;;OAEG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE7C;IAED;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1C;IAED;;OAEG;IACH,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAEpD;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-settings.js

@@ -0,0 +1,83 @@
+import { simCognitoSimulatedOAuthFlow } from "./sim-cognito-oauth-grants.js";
+import { SimCognitoRequestedOAuth } from "./sim-cognito-requested-oauth.js";
+/**
+ * What an app client is allowed to do at a pool's hosted domain.
+ *
+ * These settings are what the authorize, token and logout endpoints check a
+ * request against: which grant it may ask for, which scopes it may be given,
+ * which URL it may be sent back to, and which identity provider it may sign a
+ * user in through. Nothing here is honoured without a domain, because there is
+ * no endpoint to reach until the pool has one.
+ *
+ * `AllowedOAuthFlowsUserPoolClient` gates the rest, as it does on real
+ * Cognito: the other settings cannot be configured until it is true.
+ */
+export class SimCognitoOAuthSettings {
+    enabled;
+    flows;
+    scopes;
+    callbackUrls;
+    logoutUrls;
+    defaultRedirectUri;
+    identityProviders;
+    constructor(settings) {
+        const requested = new SimCognitoRequestedOAuth(settings);
+        this.enabled = requested.enabled;
+        this.flows = requested.flows;
+        this.scopes = requested.scopes;
+        this.callbackUrls = requested.callbackUrls;
+        this.logoutUrls = requested.logoutUrls;
+        this.defaultRedirectUri = requested.defaultRedirectUri;
+        this.identityProviders = requested.identityProviders;
+    }
+    /**
+     * These settings as a described app client reports them.
+     *
+     * A list the request did not set is left out rather than reported empty, so
+     * a client created without any of this reports none of it.
+     */
+    toOutput() {
+        return {
+            AllowedOAuthFlowsUserPoolClient: this.enabled,
+            ...(this.flows.length > 0 && { AllowedOAuthFlows: [...this.flows] }),
+            ...(this.scopes.length > 0 && { AllowedOAuthScopes: [...this.scopes] }),
+            ...(this.callbackUrls.values.length > 0 && {
+                CallbackURLs: [...this.callbackUrls.values],
+            }),
+            ...(this.logoutUrls.values.length > 0 && {
+                LogoutURLs: [...this.logoutUrls.values],
+            }),
+            ...(this.defaultRedirectUri !== undefined && {
+                DefaultRedirectURI: this.defaultRedirectUri,
+            }),
+            ...(this.identityProviders.length > 0 && {
+                SupportedIdentityProviders: [...this.identityProviders],
+            }),
+        };
+    }
+    /**
+     * Whether this client may complete an authorization code grant.
+     */
+    get allowsCodeGrant() {
+        return this.enabled && this.flows.includes(simCognitoSimulatedOAuthFlow);
+    }
+    /**
+     * Whether a redirect URI is one this client registered.
+     */
+    allowsRedirectTo(redirectUri) {
+        return this.callbackUrls.includes(redirectUri);
+    }
+    /**
+     * Whether a sign-out URL is one this client registered.
+     */
+    allowsSignOutTo(logoutUri) {
+        return this.logoutUrls.includes(logoutUri);
+    }
+    /**
+     * Whether this client offers an identity provider by name.
+     */
+    allowsIdentityProvider(providerName) {
+        return this.identityProviders.includes(providerName);
+    }
+}
+//# sourceMappingURL=sim-cognito-oauth-settings.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-oauth-settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAgB5E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,uBAAuB;IAClB,OAAO,CAAU;IACjB,KAAK,CAAoB;IACzB,MAAM,CAAoB;IAC1B,YAAY,CAAyB;IACrC,UAAU,CAAyB;IACnC,kBAAkB,CAAqB;IACvC,iBAAiB,CAAoB;IAErD,YAAY,QAAqC;QAC/C,MAAM,SAAS,GAAG,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAEzD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;QACvC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC,kBAAkB,CAAC;QACvD,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,QAAQ;QACN,OAAO;YACL,+BAA+B,EAAE,IAAI,CAAC,OAAO;YAC7C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI;gBACzC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;aAC5C,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI;gBACvC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;aACxC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS,IAAI;gBAC3C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI;gBACvC,0BAA0B,EAAE,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;aACxD,CAAC;SACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,YAAoB;QACzC,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-redirect-urls.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The URLs an app client may send a browser to, checked as real Cognito checks
+ * them.
+ *
+ * A redirect URI has to be an absolute URI with no fragment, over HTTPS unless
+ * it is a loopback address, and an application's own scheme such as
+ * `myapp://example` is allowed. Checking them where they are set is what stops
+ * a callback URL that could never have been registered on real AWS reaching an
+ * authorize request here.
+ */
+export declare class SimCognitoRedirectUrls {
+    readonly values: readonly string[];
+    constructor(option: string, requested: readonly string[] | undefined);
+    private static requireRedirect;
+    /**
+     * Whether a URI is one of these, compared exactly as real Cognito compares
+     * one: a URL that differs by a trailing slash is a different URL, and one
+     * that matched loosely here would fail in a deployment.
+     */
+    includes(redirectUri: string): boolean;
+}
+//# sourceMappingURL=sim-cognito-redirect-urls.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-redirect-urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-redirect-urls.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-redirect-urls.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAMnE;IAED,OAAO,CAAC,MAAM,CAAC,eAAe;IAqB9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAErC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-redirect-urls.js

@@ -0,0 +1,47 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The origins real Cognito allows a callback URL to reach without TLS.
+ */
+const insecureCallbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * The URLs an app client may send a browser to, checked as real Cognito checks
+ * them.
+ *
+ * A redirect URI has to be an absolute URI with no fragment, over HTTPS unless
+ * it is a loopback address, and an application's own scheme such as
+ * `myapp://example` is allowed. Checking them where they are set is what stops
+ * a callback URL that could never have been registered on real AWS reaching an
+ * authorize request here.
+ */
+export class SimCognitoRedirectUrls {
+    values;
+    constructor(option, requested) {
+        this.values = [...(requested ?? [])];
+        for (const value of this.values) {
+            SimCognitoRedirectUrls.requireRedirect(option, value);
+        }
+    }
+    static requireRedirect(option, value) {
+        const url = URL.parse(value);
+        if (url === null || value.includes("#")) {
+            throw new SimCognitoInvalidParameterException(`${option} '${value}' is not a redirect URI: a redirect URI is an ` +
+                `absolute URI with no fragment`);
+        }
+        if (url.protocol === "http:" && !insecureCallbackHosts.has(url.hostname)) {
+            throw new SimCognitoInvalidParameterException(`${option} '${value}' is not a redirect URI: Cognito requires ` +
+                `HTTPS except for ${insecureCallbackHosts
+                    .values()
+                    .toArray()
+                    .join(", ")}`);
+        }
+    }
+    /**
+     * Whether a URI is one of these, compared exactly as real Cognito compares
+     * one: a URL that differs by a trailing slash is a different URL, and one
+     * that matched loosely here would fail in a deployment.
+     */
+    includes(redirectUri) {
+        return this.values.includes(redirectUri);
+    }
+}
+//# sourceMappingURL=sim-cognito-redirect-urls.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-redirect-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-redirect-urls.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-redirect-urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;GAEG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IACjB,MAAM,CAAoB;IAE1C,YAAY,MAAc,EAAE,SAAwC;QAClE,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,sBAAsB,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,MAAc,EAAE,KAAa;QAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE7B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,MAAM,KAAK,KAAK,gDAAgD;gBACjE,+BAA+B,CAClC,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,mCAAmC,CAC3C,GAAG,MAAM,KAAK,KAAK,4CAA4C;gBAC7D,oBAAoB,qBAAqB;qBACtC,MAAM,EAAE;qBACR,OAAO,EAAE;qBACT,IAAI,CAAC,IAAI,CAAC,EAAE,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-requested-oauth.d.ts

@@ -0,0 +1,29 @@
+import type { SimCognitoOAuthSettingsType } from "./sim-cognito-oauth-settings.js";
+import { SimCognitoRedirectUrls } from "./sim-cognito-redirect-urls.js";
+/**
+ * The OAuth settings a request asked an app client for, checked.
+ *
+ * Everything an app client's OAuth settings can be refused for is here, so
+ * that what the client then holds is a set of values nothing has left to say
+ * no to.
+ */
+export declare class SimCognitoRequestedOAuth {
+    readonly enabled: boolean;
+    readonly flows: readonly string[];
+    readonly scopes: readonly string[];
+    readonly callbackUrls: SimCognitoRedirectUrls;
+    readonly logoutUrls: SimCognitoRedirectUrls;
+    readonly defaultRedirectUri: string | undefined;
+    readonly identityProviders: readonly string[];
+    constructor(settings: SimCognitoOAuthSettingsType);
+    /**
+     * Refuse the settings that need the authorization server turned on first.
+     *
+     * Real Cognito requires `AllowedOAuthFlowsUserPoolClient` to be true before
+     * any of these can be set, so a client carrying them with it left false is
+     * refused here as it is there.
+     */
+    private requireEnabledFor;
+    private requiredDefaultRedirect;
+}
+//# sourceMappingURL=sim-cognito-requested-oauth.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-requested-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-requested-oauth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-requested-oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,UAAU,EAAE,sBAAsB,CAAC;IACnD,SAAgB,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvD,SAAgB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErD,YAAY,QAAQ,EAAE,2BAA2B,EAkBhD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAsBzB,OAAO,CAAC,uBAAuB;CAgBhC"}