@kensio/yulin 1.11.1 → 1.12.1

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.js

@@ -0,0 +1,55 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { SimCognitoAttributeMapping, } from "./sim-cognito-attribute-mapping.js";
+import { SimCognitoProviderDetails, } from "./sim-cognito-provider-details.js";
+import { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
+/**
+ * How long a provider name may be.
+ */
+const maxProviderNameLength = 32;
+/**
+ * The name a pool's own users sign in under, which no provider may take.
+ */
+const localProviderName = "COGNITO";
+/**
+ * The settable properties of one identity provider.
+ *
+ * `CreateIdentityProvider` builds one of these from its request. The provider
+ * name is among them although an update cannot change it, because the name is
+ * what the update names the provider by and the settings are what hold it.
+ */
+export class SimCognitoIdentityProviderSettings {
+    name;
+    type;
+    details;
+    attributeMapping;
+    idpIdentifiers;
+    constructor(input) {
+        this.name = SimCognitoIdentityProviderSettings.requiredName(input.ProviderName);
+        this.type = new SimCognitoProviderType(input.ProviderType);
+        this.details = new SimCognitoProviderDetails(this.type, input.ProviderDetails);
+        this.attributeMapping = new SimCognitoAttributeMapping(input.AttributeMapping);
+        this.idpIdentifiers = [...(input.IdpIdentifiers ?? [])];
+    }
+    /**
+     * Check the name a provider is known by in its pool.
+     *
+     * `COGNITO` is refused because it is the name the pool's own users already
+     * sign in under, and a provider taking it would make an authorize request
+     * ambiguous.
+     */
+    static requiredName(value) {
+        if (value === undefined || value === "") {
+            throw new SimCognitoInvalidParameterException("ProviderName is required: name the provider being added to the pool");
+        }
+        if (value.length > maxProviderNameLength) {
+            throw new SimCognitoInvalidParameterException(`ProviderName '${value}' is too long: a provider name is at most ` +
+                `${String(maxProviderNameLength)} characters`);
+        }
+        if (value === localProviderName) {
+            throw new SimCognitoInvalidParameterException(`ProviderName '${localProviderName}' is reserved: it is the name the ` +
+                `pool's own users sign in under`);
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=sim-cognito-identity-provider-settings.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,0BAA0B,GAE3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAapC;;;;;;GAMG;AACH,MAAM,OAAO,kCAAkC;IAC7B,IAAI,CAAS;IACb,IAAI,CAAyB;IAC7B,OAAO,CAA4B;IACnC,gBAAgB,CAA6B;IAC7C,cAAc,CAAoB;IAElD,YAAY,KAA8C;QACxD,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC,YAAY,CACzD,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAC1C,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CACpD,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,YAAY,CAAC,KAAyB;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,KAAK,4CAA4C;gBAChE,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,iBAAiB,oCAAoC;gBACpE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.d.ts

@@ -0,0 +1,39 @@
+import type { SimCognitoUserPoolIdentityProvider } from "./sim-cognito-user-pool-identity-provider.js";
+/**
+ * The external identity providers of one simulated user pool.
+ *
+ * Providers are keyed by name, which is what every provider operation names
+ * one by and what an authorize request carries in `identity_provider`. A name
+ * is unique within its pool, as it is on real Cognito.
+ */
+export declare class SimCognitoIdentityProviderStore {
+    private readonly providers;
+    /**
+     * Every provider in this pool, in creation order.
+     */
+    get all(): readonly SimCognitoUserPoolIdentityProvider[];
+    /**
+     * Store a newly created provider, refusing a name the pool already holds.
+     *
+     * Real Cognito reports the second provider of one name as a duplicate
+     * request rather than as a bad parameter, and says which name it was.
+     */
+    add(provider: SimCognitoUserPoolIdentityProvider): void;
+    /**
+     * Forget a deleted provider.
+     */
+    remove(provider: SimCognitoUserPoolIdentityProvider): void;
+    /**
+     * Find a provider by name.
+     */
+    find(providerName: string): SimCognitoUserPoolIdentityProvider | undefined;
+    /**
+     * Find a provider by one of the alternative names it was given.
+     */
+    findByIdentifier(identifier: string): SimCognitoUserPoolIdentityProvider | undefined;
+    /**
+     * Resolve a provider by name, or refuse.
+     */
+    require(providerName: string): SimCognitoUserPoolIdentityProvider;
+}
+//# sourceMappingURL=sim-cognito-identity-provider-store.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAEvG;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGtB;IAEJ;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kCAAkC,EAAE,CAEvD;IAED;;;;;OAKG;IACH,GAAG,CAAC,QAAQ,EAAE,kCAAkC,GAAG,IAAI,CAQtD;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,kCAAkC,GAAG,IAAI,CAEzD;IAED;;OAEG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,kCAAkC,GAAG,SAAS,CAEzE;IAED;;OAEG;IACH,gBAAgB,CACd,UAAU,EAAE,MAAM,GACjB,kCAAkC,GAAG,SAAS,CAEhD;IAED;;OAEG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,kCAAkC,CAUhE;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.js

@@ -0,0 +1,58 @@
+import { SimCognitoDuplicateProviderException, SimCognitoResourceNotFoundException, } from "../../error/sim-cognito.error.js";
+/**
+ * The external identity providers of one simulated user pool.
+ *
+ * Providers are keyed by name, which is what every provider operation names
+ * one by and what an authorize request carries in `identity_provider`. A name
+ * is unique within its pool, as it is on real Cognito.
+ */
+export class SimCognitoIdentityProviderStore {
+    providers = new Map();
+    /**
+     * Every provider in this pool, in creation order.
+     */
+    get all() {
+        return this.providers.values().toArray();
+    }
+    /**
+     * Store a newly created provider, refusing a name the pool already holds.
+     *
+     * Real Cognito reports the second provider of one name as a duplicate
+     * request rather than as a bad parameter, and says which name it was.
+     */
+    add(provider) {
+        if (this.providers.has(provider.name)) {
+            throw new SimCognitoDuplicateProviderException(`A provider with the name ${provider.name} already exists in the pool.`);
+        }
+        this.providers.set(provider.name, provider);
+    }
+    /**
+     * Forget a deleted provider.
+     */
+    remove(provider) {
+        this.providers.delete(provider.name);
+    }
+    /**
+     * Find a provider by name.
+     */
+    find(providerName) {
+        return this.providers.get(providerName);
+    }
+    /**
+     * Find a provider by one of the alternative names it was given.
+     */
+    findByIdentifier(identifier) {
+        return this.all.find((provider) => provider.hasIdpIdentifier(identifier));
+    }
+    /**
+     * Resolve a provider by name, or refuse.
+     */
+    require(providerName) {
+        const found = this.find(providerName);
+        if (found === undefined) {
+            throw new SimCognitoResourceNotFoundException(`Identity provider ${providerName} does not exist.`);
+        }
+        return found;
+    }
+}
+//# sourceMappingURL=sim-cognito-identity-provider-store.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAG1C;;;;;;GAMG;AACH,MAAM,OAAO,+BAA+B;IACzB,SAAS,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,QAA4C;QAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,oCAAoC,CAC5C,4BAA4B,QAAQ,CAAC,IAAI,8BAA8B,CACxE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAA4C;QACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,UAAkB;QAElB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,YAAoB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,YAAY,kBAAkB,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-details.d.ts

@@ -0,0 +1,29 @@
+import type { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
+/**
+ * How a provider is configured, as a request sets it and a described provider
+ * reports it.
+ */
+export type SimCognitoProviderDetailsType = Readonly<Record<string, string>>;
+/**
+ * The configuration of one external identity provider.
+ *
+ * The values are recorded and never used: a simulated sign-in reaches the
+ * provider this simulation holds rather than the one at the other end of a
+ * client id and secret. They are checked for presence all the same, so that a
+ * provider which could not have been created on real AWS is not created here.
+ */
+export declare class SimCognitoProviderDetails {
+    private readonly details;
+    constructor(providerType: SimCognitoProviderType, details: SimCognitoProviderDetailsType | undefined);
+    /**
+     * These details as a described provider reports them.
+     */
+    toOutput(): SimCognitoProviderDetailsType;
+    /**
+     * One configured value, if the provider was created with it.
+     */
+    value(key: string): string | undefined;
+    private requireDetailsFor;
+    private requireSamlMetadata;
+}
+//# sourceMappingURL=sim-cognito-provider-details.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-details.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-details.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-provider-details.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAO7E;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7E;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IAEtD,YACE,YAAY,EAAE,sBAAsB,EACpC,OAAO,EAAE,6BAA6B,GAAG,SAAS,EAInD;IAED;;OAEG;IACH,QAAQ,IAAI,6BAA6B,CAExC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErC;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,mBAAmB;CAU5B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-details.js

@@ -0,0 +1,52 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * Either of the two ways a SAML provider carries its metadata.
+ */
+const samlMetadataKeys = ["MetadataURL", "MetadataFile"];
+/**
+ * The configuration of one external identity provider.
+ *
+ * The values are recorded and never used: a simulated sign-in reaches the
+ * provider this simulation holds rather than the one at the other end of a
+ * client id and secret. They are checked for presence all the same, so that a
+ * provider which could not have been created on real AWS is not created here.
+ */
+export class SimCognitoProviderDetails {
+    details;
+    constructor(providerType, details) {
+        this.details = new Map(Object.entries(details ?? {}));
+        this.requireDetailsFor(providerType);
+    }
+    /**
+     * These details as a described provider reports them.
+     */
+    toOutput() {
+        return Object.fromEntries(this.details);
+    }
+    /**
+     * One configured value, if the provider was created with it.
+     */
+    value(key) {
+        return this.details.get(key);
+    }
+    requireDetailsFor(providerType) {
+        if (providerType.isSaml) {
+            this.requireSamlMetadata(providerType);
+            return;
+        }
+        const missing = providerType.requiredDetails.filter((key) => !this.details.has(key));
+        if (missing.length > 0) {
+            throw new SimCognitoInvalidParameterException(`ProviderDetails is missing ${missing.join(", ")}: a ` +
+                `${providerType.value} provider is configured with ` +
+                `${providerType.requiredDetails.join(", ")}.`);
+        }
+    }
+    requireSamlMetadata(providerType) {
+        const named = samlMetadataKeys.filter((key) => this.details.has(key));
+        if (named.length === 0) {
+            throw new SimCognitoInvalidParameterException(`ProviderDetails is missing ${samlMetadataKeys.join(" or ")}: a ` +
+                `${providerType.value} provider is configured with one of them`);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-provider-details.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-details.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-details.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-provider-details.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAGvF;;GAEG;AACH,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AAQzD;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,OAAO,CAA8B;IAEtD,YACE,YAAoC,EACpC,OAAkD;QAElD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAW;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEO,iBAAiB,CAAC,YAAoC;QAC5D,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,CAAC,MAAM,CACjD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAChC,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,mCAAmC,CAC3C,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBACpD,GAAG,YAAY,CAAC,KAAK,+BAA+B;gBACpD,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,YAAoC;QAC9D,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAEtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,mCAAmC,CAC3C,8BAA8B,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC/D,GAAG,YAAY,CAAC,KAAK,0CAA0C,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-type.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The kind of external directory an identity provider stands for.
+ *
+ * The type decides what a provider has to be configured with, and nothing
+ * else here: a simulated sign-in through a SAML provider and through Google
+ * both end in the same thing, an external subject with claims that the pool
+ * maps onto a user.
+ */
+export declare class SimCognitoProviderType {
+    readonly value: string;
+    constructor(value: string | undefined);
+    /**
+     * Whether this type carries assertions rather than an OAuth token.
+     */
+    get isSaml(): boolean;
+    /**
+     * The provider details this type has to be configured with.
+     *
+     * A SAML provider is configured with a metadata document instead, which is
+     * checked where the details are read rather than here.
+     */
+    get requiredDetails(): readonly string[];
+}
+//# sourceMappingURL=sim-cognito-provider-type.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-type.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-provider-type.ts"],"names":[],"mappings":"AAiCA;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,KAAK,EAAE,MAAM,GAAG,SAAS,EAepC;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,SAAS,MAAM,EAAE,CAEvC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-type.js

@@ -0,0 +1,67 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The details each kind of provider is configured with.
+ *
+ * Nothing here calls a provider, so none of these values is used. They are
+ * required anyway, because a provider created without them is a request that
+ * fails on the way to AWS, and a pool that accepted one here would send a user
+ * to a provider that was never configured.
+ */
+const socialDetails = ["client_id", "client_secret", "authorize_scopes"];
+const requiredDetails = new Map([
+    ["Facebook", socialDetails],
+    ["Google", socialDetails],
+    ["LoginWithAmazon", socialDetails],
+    [
+        "SignInWithApple",
+        ["client_id", "team_id", "key_id", "private_key", "authorize_scopes"],
+    ],
+    [
+        "OIDC",
+        [
+            "client_id",
+            "client_secret",
+            "attributes_request_method",
+            "oidc_issuer",
+            "authorize_scopes",
+        ],
+    ],
+    ["SAML", []],
+]);
+/**
+ * The kind of external directory an identity provider stands for.
+ *
+ * The type decides what a provider has to be configured with, and nothing
+ * else here: a simulated sign-in through a SAML provider and through Google
+ * both end in the same thing, an external subject with claims that the pool
+ * maps onto a user.
+ */
+export class SimCognitoProviderType {
+    value;
+    constructor(value) {
+        if (value === undefined || value === "") {
+            throw new SimCognitoInvalidParameterException("ProviderType is required: name the kind of provider being added");
+        }
+        if (!requiredDetails.has(value)) {
+            throw new SimCognitoInvalidParameterException(`ProviderType '${value}' is not a provider type: the types are ` +
+                `${requiredDetails.keys().toArray().join(", ")}.`);
+        }
+        this.value = value;
+    }
+    /**
+     * Whether this type carries assertions rather than an OAuth token.
+     */
+    get isSaml() {
+        return this.value === "SAML";
+    }
+    /**
+     * The provider details this type has to be configured with.
+     *
+     * A SAML provider is configured with a metadata document instead, which is
+     * checked where the details are read rather than here.
+     */
+    get requiredDetails() {
+        return requiredDetails.get(this.value) ?? [];
+    }
+}
+//# sourceMappingURL=sim-cognito-provider-type.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-type.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-provider-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAEzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAA4B;IACzD,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3B,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzB,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC;QACE,iBAAiB;QACjB,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,kBAAkB,CAAC;KACtE;IACD;QACE,MAAM;QACN;YACE,WAAW;YACX,eAAe;YACf,2BAA2B;YAC3B,aAAa;YACb,kBAAkB;SACnB;KACF;IACD,CAAC,MAAM,EAAE,EAAE,CAAC;CACb,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACjB,KAAK,CAAS;IAE9B,YAAY,KAAyB;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,KAAK,0CAA0C;gBAC9D,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.d.ts

@@ -0,0 +1,82 @@
+import type { SimCognitoUserPoolId } from "../sim-cognito-user-pool-id.js";
+import type { SimCognitoAttributeMapping } from "./sim-cognito-attribute-mapping.js";
+import { SimCognitoExternalUser, type SimCognitoExternalUserType } from "./sim-cognito-external-user.js";
+import type { SimCognitoIdentityProviderSettings } from "./sim-cognito-identity-provider-settings.js";
+import type { SimCognitoProviderDetails } from "./sim-cognito-provider-details.js";
+import type { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
+interface SimCognitoUserPoolIdentityProviderProperties {
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly settings: SimCognitoIdentityProviderSettings;
+    readonly createdAt: Date;
+}
+/**
+ * One external identity provider configured on a simulated user pool.
+ *
+ * On real Cognito this holds the credentials the pool signs users in with at
+ * Google, or the metadata of a SAML directory. Nothing here calls either, so
+ * what it holds instead is the user signed in at the provider: a test puts one
+ * there, and an authorize request naming this provider signs that user in.
+ *
+ * The configuration is still recorded and validated, so a provider that could
+ * not have been created on real AWS is not created here, and a described
+ * provider reports what the request set.
+ */
+export declare class SimCognitoUserPoolIdentityProvider {
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly creationDate: Date;
+    private settings;
+    private modifiedDate;
+    private externalUser;
+    constructor(properties: SimCognitoUserPoolIdentityProviderProperties);
+    /** The name this provider is known by in the pool. */
+    get name(): string;
+    /** The kind of external directory this provider stands for. */
+    get type(): SimCognitoProviderType;
+    /** How the provider is configured. */
+    get details(): SimCognitoProviderDetails;
+    /** What the provider's claims become on the pool user. */
+    get attributeMapping(): SimCognitoAttributeMapping;
+    /** The alternative names an authorize request can reach this provider by. */
+    get idpIdentifiers(): readonly string[];
+    /** When the provider's settings last changed. */
+    get lastModifiedDate(): Date;
+    /**
+     * The issuer a federated identity records for this provider, which only the
+     * providers configured with one have.
+     */
+    get issuer(): string | undefined;
+    /**
+     * Whether an authorize request naming this identifier reaches this provider.
+     *
+     * Real Cognito takes an `idp_identifier` as an alternative to the provider
+     * name, so that an application can send a user to the provider for their
+     * email domain without knowing what it was called.
+     */
+    hasIdpIdentifier(identifier: string): boolean;
+    /**
+     * Replace this provider's settings, as `UpdateIdentityProvider` does.
+     */
+    update(settings: SimCognitoIdentityProviderSettings, at: Date): void;
+    /**
+     * Say who is signed in at this provider.
+     *
+     * This is the simulator's own accessor. It stands in for everything that
+     * happens at the provider itself, which is where a real user types a
+     * password this simulation never sees.
+     */
+    signInAs(externalUser: SimCognitoExternalUserType): void;
+    /**
+     * Sign out of this provider, so a further authorize request finds nobody.
+     */
+    signOut(): void;
+    /**
+     * The user this provider signs in, or a refusal.
+     *
+     * Real Cognito would show the provider's own sign-in page here, and there is
+     * no page in a simulation. Refusing is what stops an authorize request
+     * quietly signing in a user nothing put there.
+     */
+    requireSignedInUser(): SimCognitoExternalUser;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool-identity-provider.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-identity-provider.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,EACL,sBAAsB,EACtB,KAAK,0BAA0B,EAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AACtG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,UAAU,4CAA4C;IACpD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,kCAAkC;IAC7C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,YAAY,CAAO;IAC3B,OAAO,CAAC,YAAY,CAAqC;IAEzD,YAAY,UAAU,EAAE,4CAA4C,EAKnE;IAED,sDAAsD;IACtD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+DAA+D;IAC/D,IAAI,IAAI,IAAI,sBAAsB,CAEjC;IAED,sCAAsC;IACtC,IAAI,OAAO,IAAI,yBAAyB,CAEvC;IAED,0DAA0D;IAC1D,IAAI,gBAAgB,IAAI,0BAA0B,CAEjD;IAED,6EAA6E;IAC7E,IAAI,cAAc,IAAI,SAAS,MAAM,EAAE,CAEtC;IAED,iDAAiD;IACjD,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAI/B;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE5C;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,kCAAkC,EAAE,EAAE,EAAE,IAAI,GAAG,IAAI,CAGnE;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,0BAA0B,GAAG,IAAI,CAEvD;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAEd;IAED;;;;;;OAMG;IACH,mBAAmB,IAAI,sBAAsB,CAW5C;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.js

@@ -0,0 +1,108 @@
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
+import { SimCognitoExternalUser, } from "./sim-cognito-external-user.js";
+/**
+ * One external identity provider configured on a simulated user pool.
+ *
+ * On real Cognito this holds the credentials the pool signs users in with at
+ * Google, or the metadata of a SAML directory. Nothing here calls either, so
+ * what it holds instead is the user signed in at the provider: a test puts one
+ * there, and an authorize request naming this provider signs that user in.
+ *
+ * The configuration is still recorded and validated, so a provider that could
+ * not have been created on real AWS is not created here, and a described
+ * provider reports what the request set.
+ */
+export class SimCognitoUserPoolIdentityProvider {
+    userPoolId;
+    creationDate;
+    settings;
+    modifiedDate;
+    externalUser;
+    constructor(properties) {
+        this.userPoolId = properties.userPoolId;
+        this.settings = properties.settings;
+        this.creationDate = properties.createdAt;
+        this.modifiedDate = properties.createdAt;
+    }
+    /** The name this provider is known by in the pool. */
+    get name() {
+        return this.settings.name;
+    }
+    /** The kind of external directory this provider stands for. */
+    get type() {
+        return this.settings.type;
+    }
+    /** How the provider is configured. */
+    get details() {
+        return this.settings.details;
+    }
+    /** What the provider's claims become on the pool user. */
+    get attributeMapping() {
+        return this.settings.attributeMapping;
+    }
+    /** The alternative names an authorize request can reach this provider by. */
+    get idpIdentifiers() {
+        return this.settings.idpIdentifiers;
+    }
+    /** When the provider's settings last changed. */
+    get lastModifiedDate() {
+        return this.modifiedDate;
+    }
+    /**
+     * The issuer a federated identity records for this provider, which only the
+     * providers configured with one have.
+     */
+    get issuer() {
+        return (this.details.value("oidc_issuer") ?? this.details.value("MetadataURL"));
+    }
+    /**
+     * Whether an authorize request naming this identifier reaches this provider.
+     *
+     * Real Cognito takes an `idp_identifier` as an alternative to the provider
+     * name, so that an application can send a user to the provider for their
+     * email domain without knowing what it was called.
+     */
+    hasIdpIdentifier(identifier) {
+        return this.idpIdentifiers.includes(identifier);
+    }
+    /**
+     * Replace this provider's settings, as `UpdateIdentityProvider` does.
+     */
+    update(settings, at) {
+        this.settings = settings;
+        this.modifiedDate = at;
+    }
+    /**
+     * Say who is signed in at this provider.
+     *
+     * This is the simulator's own accessor. It stands in for everything that
+     * happens at the provider itself, which is where a real user types a
+     * password this simulation never sees.
+     */
+    signInAs(externalUser) {
+        this.externalUser = new SimCognitoExternalUser(externalUser);
+    }
+    /**
+     * Sign out of this provider, so a further authorize request finds nobody.
+     */
+    signOut() {
+        this.externalUser = undefined;
+    }
+    /**
+     * The user this provider signs in, or a refusal.
+     *
+     * Real Cognito would show the provider's own sign-in page here, and there is
+     * no page in a simulation. Refusing is what stops an authorize request
+     * quietly signing in a user nothing put there.
+     */
+    requireSignedInUser() {
+        if (this.externalUser === undefined) {
+            throw new SimCognitoNotAuthorizedException(`Nobody is signed in at the ${this.name} identity provider. Real ` +
+                `Cognito would send the user to the provider's own sign-in page, ` +
+                `which this simulation has no equivalent of. Say who is signed in ` +
+                `there with signInAs first.`);
+        }
+        return this.externalUser;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-identity-provider.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-identity-provider.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAGpF,OAAO,EACL,sBAAsB,GAEvB,MAAM,gCAAgC,CAAC;AAWxC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kCAAkC;IAC7B,UAAU,CAAuB;IACjC,YAAY,CAAO;IAE3B,QAAQ,CAAqC;IAC7C,YAAY,CAAO;IACnB,YAAY,CAAqC;IAEzD,YAAY,UAAwD;QAClE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,sDAAsD;IACtD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,0DAA0D;IAC1D,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;IACtC,CAAC;IAED,iDAAiD;IACjD,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CACvE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,UAAkB;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAA4C,EAAE,EAAQ;QAC3D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,YAAwC;QAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB;QACjB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CACxC,8BAA8B,IAAI,CAAC,IAAI,2BAA2B;gBAChE,kEAAkE;gBAClE,mEAAmE;gBACnE,4BAA4B,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts

@@ -1,3 +1,4 @@
+import { SimCognitoDomainRegistry } from "../registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
 import type { SimCognitoIssuedToken } from "./auth/sim-cognito-issued-token.js";
 import type { SimCognitoUserPoolClient } from "./client/sim-cognito-user-pool-client.js";
@@ -20,6 +21,11 @@ export interface SimCognitoAccessTokenInPool {
 }
 interface SimCognitoUserPoolStoreProperties {
     readonly registry?: SimCognitoUserPoolRegistry;
+    /**
+     * Where hosted domains are indexed, so a deleted pool's domain stops
+     * resolving and its name goes back into use.
+     */
+    readonly domains?: SimCognitoDomainRegistry;
 }
 /**
  * The user pools of one simulated Cognito scope.
@@ -34,6 +40,7 @@ interface SimCognitoUserPoolStoreProperties {
 export declare class SimCognitoUserPoolStore {
     private readonly pools;
     private readonly registry;
+    private readonly domains;
     constructor(properties?: SimCognitoUserPoolStoreProperties);
     private static unexpired;
     /**
@@ -53,7 +60,10 @@ export declare class SimCognitoUserPoolStore {
      */
     add(pool: SimCognitoUserPool): void;
     /**
-     * Forget a deleted pool.
+     * Forget a deleted pool, and with it the domain it was served on.
+     *
+     * Deleting a pool takes its domain with it on real Cognito, which is what
+     * frees the domain string for another pool.
      */
     remove(pool: SimCognitoUserPool): void;
     /**

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;CAChD;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAE,iCAAsC,EAE7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAE/C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAE,iCAAsC,EAG7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CASrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js

@@ -1,4 +1,5 @@
 import { SimCognitoNotAuthorizedException, SimCognitoResourceNotFoundException, } from "../error/sim-cognito.error.js";
+import { SimCognitoDomainRegistry } from "../registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
 /**
  * The user pools of one simulated Cognito scope.
@@ -13,8 +14,10 @@ import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-re
 export class SimCognitoUserPoolStore {
     pools = new Map();
     registry;
+    domains;
     constructor(properties = {}) {
         this.registry = properties.registry ?? new SimCognitoUserPoolRegistry();
+        this.domains = properties.domains ?? new SimCognitoDomainRegistry();
     }
     static unexpired(issued, now) {
         if (issued.isExpiredAt(now)) {
@@ -46,11 +49,18 @@ export class SimCognitoUserPoolStore {
         this.registry.register(pool);
     }
     /**
-     * Forget a deleted pool.
+     * Forget a deleted pool, and with it the domain it was served on.
+     *
+     * Deleting a pool takes its domain with it on real Cognito, which is what
+     * frees the domain string for another pool.
      */
     remove(pool) {
         this.pools.delete(pool.id);
         this.registry.deregister(pool);
+        const { domain } = pool.auth;
+        if (domain !== undefined) {
+            this.domains.deregister(domain);
+        }
     }
     /**
      * Find a pool by id.