@kensio/yulin 1.11.1 → 1.12.1

package/dist/service/cognito/command/hosted/sim-cognito-granted-tokens.js

@@ -0,0 +1,32 @@
+/**
+ * The token type every OAuth 2.0 bearer token is.
+ */
+const bearerTokenType = "Bearer";
+/**
+ * The scope that makes a grant carry an id token.
+ */
+const openIdScope = "openid";
+/**
+ * What the token endpoint answers a completed grant with.
+ *
+ * An id token comes back only where the grant was made with the `openid`
+ * scope, as it does on real Cognito, and a refresh token only where the grant
+ * issued one: a refresh answers with none.
+ */
+export class SimCognitoGrantedTokens {
+    /**
+     * The answer to a completed grant.
+     */
+    body(issued, scopes) {
+        return {
+            access_token: issued.accessToken,
+            ...(scopes.includes(openIdScope) && { id_token: issued.idToken }),
+            ...(issued.refreshToken !== undefined && {
+                refresh_token: issued.refreshToken,
+            }),
+            token_type: bearerTokenType,
+            expires_in: issued.expiresIn,
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-granted-tokens.js.map

package/dist/service/cognito/command/hosted/sim-cognito-granted-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-granted-tokens.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-granted-tokens.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC;;GAEG;AACH,MAAM,WAAW,GAAG,QAAQ,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACH,IAAI,CACF,MAA8B,EAC9B,MAAyB;QAEzB,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;gBACvC,aAAa,EAAE,MAAM,CAAC,YAAY;aACnC,CAAC;YACF,UAAU,EAAE,eAAe;YAC3B,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-client.d.ts

@@ -0,0 +1,49 @@
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+/**
+ * Resolves the app client a request to a hosted endpoint names.
+ *
+ * The two endpoints refuse an unknown client differently, because they are
+ * answering different callers: the authorize endpoint is answering a browser
+ * and says the request was bad, and the token endpoint is answering an
+ * application and says its client authentication failed.
+ */
+export declare class SimCognitoHostedClient {
+    /**
+     * The app client an authorize request names, or a refusal the browser sees.
+     *
+     * Nothing is redirected here. The request has not yet shown that it knows a
+     * redirect URI this client registered, so sending the error to the URI it
+     * asked for would send it anywhere it liked.
+     */
+    forAuthorize(pool: SimCognitoUserPool, clientId: string | undefined): SimCognitoUserPoolClient;
+    /**
+     * The app client a token request names, having authenticated it.
+     *
+     * A client with a secret has to present it, either in the body or in a basic
+     * authorization header. A public client has none to present, and presenting
+     * one for it fails rather than being ignored: the request believes it is
+     * talking to a client that does not exist.
+     */
+    forToken(pool: SimCognitoUserPool, clientId: string | undefined, clientSecret: string | undefined): SimCognitoUserPoolClient;
+    /**
+     * The URI the browser is sent back to.
+     *
+     * A request naming none is sent to the app client's `DefaultRedirectURI`,
+     * which is what real Cognito falls back to. One naming a URI the client did
+     * not register is refused without redirecting anywhere, because that URI is
+     * exactly what cannot be trusted.
+     */
+    requiredRedirectUri(client: SimCognitoUserPoolClient, requested: string | undefined): string;
+    /**
+     * Refuse a client that cannot complete an authorization code grant.
+     *
+     * A client is only an authorization server client once
+     * `AllowedOAuthFlowsUserPoolClient` is true and `code` is among its
+     * `AllowedOAuthFlows`, so one configured for the API alone is refused at the
+     * hosted endpoints, as it is on real Cognito.
+     */
+    requireCodeGrant(client: SimCognitoUserPoolClient, redirectable: boolean): void;
+    private find;
+}
+//# sourceMappingURL=sim-cognito-hosted-client.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-client.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC;;;;;;OAMG;IACH,YAAY,CACV,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,wBAAwB,CAc1B;IAED;;;;;;;OAOG;IACH,QAAQ,CACN,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,wBAAwB,CAc1B;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,CAiBR;IAED;;;;;;;OAOG;IACH,gBAAgB,CACd,MAAM,EAAE,wBAAwB,EAChC,YAAY,EAAE,OAAO,GACpB,IAAI,CAaN;IAED,OAAO,CAAC,IAAI;CAUb"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-client.js

@@ -0,0 +1,98 @@
+import { SimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
+/**
+ * Resolves the app client a request to a hosted endpoint names.
+ *
+ * The two endpoints refuse an unknown client differently, because they are
+ * answering different callers: the authorize endpoint is answering a browser
+ * and says the request was bad, and the token endpoint is answering an
+ * application and says its client authentication failed.
+ */
+export class SimCognitoHostedClient {
+    /**
+     * The app client an authorize request names, or a refusal the browser sees.
+     *
+     * Nothing is redirected here. The request has not yet shown that it knows a
+     * redirect URI this client registered, so sending the error to the URI it
+     * asked for would send it anywhere it liked.
+     */
+    forAuthorize(pool, clientId) {
+        const client = this.find(pool, clientId);
+        if (client === undefined) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_request",
+                description: `client_id '${String(clientId)}' is not an app client of user ` +
+                    `pool ${pool.id}`,
+                redirectable: false,
+            });
+        }
+        return client;
+    }
+    /**
+     * The app client a token request names, having authenticated it.
+     *
+     * A client with a secret has to present it, either in the body or in a basic
+     * authorization header. A public client has none to present, and presenting
+     * one for it fails rather than being ignored: the request believes it is
+     * talking to a client that does not exist.
+     */
+    forToken(pool, clientId, clientSecret) {
+        const client = this.find(pool, clientId);
+        if (client === undefined || client.secret !== clientSecret) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_client",
+                description: "The app client this request authenticated as does not exist, or " +
+                    "its client secret is not the one it was given",
+                redirectable: false,
+            });
+        }
+        return client;
+    }
+    /**
+     * The URI the browser is sent back to.
+     *
+     * A request naming none is sent to the app client's `DefaultRedirectURI`,
+     * which is what real Cognito falls back to. One naming a URI the client did
+     * not register is refused without redirecting anywhere, because that URI is
+     * exactly what cannot be trusted.
+     */
+    requiredRedirectUri(client, requested) {
+        const redirectUri = requested ?? client.oauth.defaultRedirectUri;
+        if (redirectUri === undefined ||
+            !client.oauth.allowsRedirectTo(redirectUri)) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_request",
+                description: `redirect_uri '${String(redirectUri)}' is not one of app client ` +
+                    `${client.id}'s CallbackURLs`,
+                redirectable: false,
+            });
+        }
+        return redirectUri;
+    }
+    /**
+     * Refuse a client that cannot complete an authorization code grant.
+     *
+     * A client is only an authorization server client once
+     * `AllowedOAuthFlowsUserPoolClient` is true and `code` is among its
+     * `AllowedOAuthFlows`, so one configured for the API alone is refused at the
+     * hosted endpoints, as it is on real Cognito.
+     */
+    requireCodeGrant(client, redirectable) {
+        if (client.oauth.allowsCodeGrant) {
+            return;
+        }
+        throw new SimCognitoOAuthError({
+            code: "unauthorized_client",
+            description: `App client ${client.id} is not allowed the authorization code ` +
+                `grant: set AllowedOAuthFlowsUserPoolClient and an AllowedOAuthFlows ` +
+                `of 'code' on it`,
+            redirectable,
+        });
+    }
+    find(pool, clientId) {
+        if (clientId === undefined || clientId === "") {
+            return undefined;
+        }
+        return pool.findClient(clientId);
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-client.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-client.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAI9E;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACjC;;;;;;OAMG;IACH,YAAY,CACV,IAAwB,EACxB,QAA4B;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,cAAc,MAAM,CAAC,QAAQ,CAAC,iCAAiC;oBAC/D,QAAQ,IAAI,CAAC,EAAE,EAAE;gBACnB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CACN,IAAwB,EACxB,QAA4B,EAC5B,YAAgC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEzC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAC3D,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EACT,kEAAkE;oBAClE,+CAA+C;gBACjD,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,MAAgC,EAChC,SAA6B;QAE7B,MAAM,WAAW,GAAG,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAEjE,IACE,WAAW,KAAK,SAAS;YACzB,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAC3C,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,iBAAiB,MAAM,CAAC,WAAW,CAAC,6BAA6B;oBACjE,GAAG,MAAM,CAAC,EAAE,iBAAiB;gBAC/B,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CACd,MAAgC,EAChC,YAAqB;QAErB,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EACT,cAAc,MAAM,CAAC,EAAE,yCAAyC;gBAChE,sEAAsE;gBACtE,iBAAiB;YACnB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAEO,IAAI,CACV,IAAwB,EACxB,QAA4B;QAE5B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.d.ts

@@ -0,0 +1,28 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoUserFactory } from "../../user-pool/user/sim-cognito-user-factory.js";
+import { SimCognitoAuthorizeEndpoint } from "./sim-cognito-authorize-endpoint.js";
+import { SimCognitoLogoutEndpoint } from "./sim-cognito-logout-endpoint.js";
+import { SimCognitoTokenEndpoint } from "./sim-cognito-token-endpoint.js";
+interface SimCognitoHostedCommandsProperties {
+    readonly tokenIssuer: SimCognitoTokenIssuer;
+    readonly userFactory: SimCognitoUserFactory;
+    readonly clock: SimClock;
+}
+/**
+ * The endpoints a pool's hosted domain serves.
+ *
+ * These are not SDK commands, and nothing authorizes an IAM caller for them:
+ * they are what a browser and an application's own server reach over HTTP,
+ * holding no AWS credentials at all, in the same way `InitiateAuth` holds
+ * none. They are built here with the token issuer the API sign-ins use, so a
+ * hosted sign-in and an API sign-in hand out the same kind of token.
+ */
+export declare class SimCognitoHostedCommands {
+    readonly authorize: SimCognitoAuthorizeEndpoint;
+    readonly token: SimCognitoTokenEndpoint;
+    readonly logout: SimCognitoLogoutEndpoint;
+    constructor(properties: SimCognitoHostedCommandsProperties);
+}
+export {};
+//# sourceMappingURL=sim-cognito-hosted-commands.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IACvD,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAC/C,SAAgB,MAAM,2BAAkC;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAQzD;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js

@@ -0,0 +1,27 @@
+import { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
+import { SimCognitoAuthorizeEndpoint } from "./sim-cognito-authorize-endpoint.js";
+import { SimCognitoLogoutEndpoint } from "./sim-cognito-logout-endpoint.js";
+import { SimCognitoTokenEndpoint } from "./sim-cognito-token-endpoint.js";
+/**
+ * The endpoints a pool's hosted domain serves.
+ *
+ * These are not SDK commands, and nothing authorizes an IAM caller for them:
+ * they are what a browser and an application's own server reach over HTTP,
+ * holding no AWS credentials at all, in the same way `InitiateAuth` holds
+ * none. They are built here with the token issuer the API sign-ins use, so a
+ * hosted sign-in and an API sign-in hand out the same kind of token.
+ */
+export class SimCognitoHostedCommands {
+    authorize;
+    token;
+    logout = new SimCognitoLogoutEndpoint();
+    constructor(properties) {
+        const { tokenIssuer, userFactory, clock } = properties;
+        this.authorize = new SimCognitoAuthorizeEndpoint({
+            federatedSignIn: new SimCognitoFederatedSignIn({ userFactory }),
+            clock,
+        });
+        this.token = new SimCognitoTokenEndpoint({ tokenIssuer, clock });
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-commands.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,SAAS,CAA8B;IACvC,KAAK,CAA0B;IAC/B,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAExD,YAAY,UAA8C;QACxD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAEvD,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,eAAe,EAAE,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/D,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.d.ts

@@ -0,0 +1,22 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoHostedRedirect, SimCognitoLogoutInput } from "./hosted-auth.command.js";
+/**
+ * The `/logout` endpoint of a pool's hosted domain.
+ *
+ * Real Cognito ends the managed login session in the browser's cookie and
+ * sends the user to one of the app client's sign-out URLs. There is no such
+ * session here, because every authorize request signs in afresh at the
+ * identity provider rather than reusing a cookie, so what is left is the
+ * redirect and the check that the URL is one the app client registered.
+ *
+ * It signs nobody out at the identity provider either, which real Cognito also
+ * does not do: a user signed out here is still signed in at Google.
+ */
+export declare class SimCognitoLogoutEndpoint {
+    private readonly hostedClient;
+    /**
+     * Send the browser to the application's sign-out page.
+     */
+    handle(pool: SimCognitoUserPool, input: SimCognitoLogoutInput): SimCognitoHostedRedirect;
+}
+//# sourceMappingURL=sim-cognito-logout-endpoint.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-logout-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-logout-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAE7D;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,qBAAqB,GAC3B,wBAAwB,CA0B1B;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.js

@@ -0,0 +1,43 @@
+import { SimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
+import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
+/**
+ * The `/logout` endpoint of a pool's hosted domain.
+ *
+ * Real Cognito ends the managed login session in the browser's cookie and
+ * sends the user to one of the app client's sign-out URLs. There is no such
+ * session here, because every authorize request signs in afresh at the
+ * identity provider rather than reusing a cookie, so what is left is the
+ * redirect and the check that the URL is one the app client registered.
+ *
+ * It signs nobody out at the identity provider either, which real Cognito also
+ * does not do: a user signed out here is still signed in at Google.
+ */
+export class SimCognitoLogoutEndpoint {
+    hostedClient = new SimCognitoHostedClient();
+    /**
+     * Send the browser to the application's sign-out page.
+     */
+    handle(pool, input) {
+        const client = this.hostedClient.forAuthorize(pool, input.client_id);
+        const { logout_uri: logoutUri } = input;
+        if (logoutUri === undefined) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_request",
+                description: "logout_uri is required here. A logout request without one sends " +
+                    "the user to managed login to sign in again, which is a page " +
+                    "rather than anything this simulation can answer.",
+                redirectable: false,
+            });
+        }
+        if (!client.oauth.allowsSignOutTo(logoutUri)) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_request",
+                description: `logout_uri '${logoutUri}' is not one of app client ${client.id}'s ` +
+                    `LogoutURLs`,
+                redirectable: false,
+            });
+        }
+        return { location: logoutUri };
+    }
+}
+//# sourceMappingURL=sim-cognito-logout-endpoint.js.map

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-logout-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-logout-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAMxE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAE7D;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA4B;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAExC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,8DAA8D;oBAC9D,kDAAkD;gBACpD,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,eAAe,SAAS,8BAA8B,MAAM,CAAC,EAAE,KAAK;oBACpE,YAAY;gBACd,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-presented-grant.d.ts

@@ -0,0 +1,47 @@
+import type { SimCognitoAuthorizationCode } from "../../user-pool/auth/sim-cognito-authorization-code.js";
+import type { SimCognitoIssuedToken } from "../../user-pool/auth/sim-cognito-issued-token.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoTokenInput } from "./hosted-auth.command.js";
+interface SimCognitoPresentedGrantRequest {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly input: SimCognitoTokenInput;
+    readonly now: Date;
+}
+/**
+ * What a token request presented, once everything that could be wrong with it
+ * has been checked.
+ *
+ * This is where a grant most often fails, and each way of failing has its own
+ * answer, so the checking lives here rather than among the token issuing.
+ */
+export declare class SimCognitoPresentedGrant {
+    /**
+     * Take the authorization code a request carries, or refuse.
+     *
+     * The code is spent whether or not the rest of the request turns out to be
+     * right, as real Cognito spends one, so nothing can be retried with a code
+     * that has already been presented.
+     */
+    code(request: SimCognitoPresentedGrantRequest): SimCognitoAuthorizationCode;
+    /**
+     * Take the refresh token a request carries, or refuse.
+     */
+    refreshToken(request: SimCognitoPresentedGrantRequest): SimCognitoIssuedToken;
+    /**
+     * The user a grant was made for, which the pool may no longer hold.
+     */
+    user(pool: SimCognitoUserPool, username: string): SimCognitoUser;
+    /**
+     * Refuse a redirect URI that is not the one the code was issued for.
+     *
+     * Real Cognito answers this with `unauthorized_client` rather than with
+     * `invalid_grant`, and says `invalid_redirect` in the description.
+     */
+    private requireMatchingRedirect;
+    private requireVerifier;
+}
+export {};
+//# sourceMappingURL=sim-cognito-presented-grant.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-presented-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-presented-grant.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-presented-grant.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,+BAA+B,GAAG,2BAA2B,CAkB1E;IAED;;OAEG;IACH,YAAY,CACV,OAAO,EAAE,+BAA+B,GACvC,qBAAqB,CAmBvB;IAED;;OAEG;IACH,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAc/D;IAED;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,eAAe;CAcxB"}

package/dist/service/cognito/command/hosted/sim-cognito-presented-grant.js

@@ -0,0 +1,92 @@
+import { SimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
+/**
+ * What a token request presented, once everything that could be wrong with it
+ * has been checked.
+ *
+ * This is where a grant most often fails, and each way of failing has its own
+ * answer, so the checking lives here rather than among the token issuing.
+ */
+export class SimCognitoPresentedGrant {
+    /**
+     * Take the authorization code a request carries, or refuse.
+     *
+     * The code is spent whether or not the rest of the request turns out to be
+     * right, as real Cognito spends one, so nothing can be retried with a code
+     * that has already been presented.
+     */
+    code(request) {
+        const { pool, client, input, now } = request;
+        const code = pool.auth.spendAuthorizationCode(input.code, now);
+        if (code === undefined || !code.isFor(client.id)) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_grant",
+                description: "The authorization code has been used already, has run out, or " +
+                    "was not issued to this app client",
+                redirectable: false,
+            });
+        }
+        this.requireMatchingRedirect(code, input.redirect_uri);
+        this.requireVerifier(code, input.code_verifier);
+        return code;
+    }
+    /**
+     * Take the refresh token a request carries, or refuse.
+     */
+    refreshToken(request) {
+        const { pool, client, input, now } = request;
+        const found = pool.auth.findRefreshToken(input.refresh_token);
+        if (found === undefined ||
+            !found.isFor(client.id) ||
+            found.isExpiredAt(now)) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_grant",
+                description: "The refresh token has been revoked, has run out, or was not " +
+                    "issued to this app client",
+                redirectable: false,
+            });
+        }
+        return found;
+    }
+    /**
+     * The user a grant was made for, which the pool may no longer hold.
+     */
+    user(pool, username) {
+        const user = pool.findUser(username);
+        if (user === undefined || !user.enabled) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_grant",
+                description: `The user this grant was made for is disabled or no longer in ` +
+                    `user pool ${pool.id}`,
+                redirectable: false,
+            });
+        }
+        return user;
+    }
+    /**
+     * Refuse a redirect URI that is not the one the code was issued for.
+     *
+     * Real Cognito answers this with `unauthorized_client` rather than with
+     * `invalid_grant`, and says `invalid_redirect` in the description.
+     */
+    requireMatchingRedirect(code, redirectUri) {
+        if (!code.isForRedirect(redirectUri)) {
+            throw new SimCognitoOAuthError({
+                code: "unauthorized_client",
+                description: "invalid_redirect: redirect_uri is not the one the authorization " +
+                    "code was issued for",
+                redirectable: false,
+            });
+        }
+    }
+    requireVerifier(code, codeVerifier) {
+        if (!code.matchesVerifier(codeVerifier)) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_grant",
+                description: "code_verifier is not the verifier the authorization request's " +
+                    "code_challenge was derived from",
+                redirectable: false,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-presented-grant.js.map

package/dist/service/cognito/command/hosted/sim-cognito-presented-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-presented-grant.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-presented-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAe9E;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,OAAwC;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAE/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,gEAAgE;oBAChE,mCAAmC;gBACrC,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,YAAY,CACV,OAAwC;QAExC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE9D,IACE,KAAK,KAAK,SAAS;YACnB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EACtB,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,8DAA8D;oBAC9D,2BAA2B;gBAC7B,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,IAAwB,EAAE,QAAgB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,+DAA+D;oBAC/D,aAAa,IAAI,CAAC,EAAE,EAAE;gBACxB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAC7B,IAAiC,EACjC,WAA+B;QAE/B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,kEAAkE;oBAClE,qBAAqB;gBACvB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,IAAiC,EACjC,YAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,gEAAgE;oBAChE,iCAAiC;gBACnC,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-token-endpoint.d.ts

@@ -0,0 +1,33 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoTokenInput, SimCognitoTokenOutput } from "./hosted-auth.command.js";
+interface SimCognitoTokenEndpointProperties {
+    readonly tokenIssuer: SimCognitoTokenIssuer;
+    readonly clock: SimClock;
+}
+/**
+ * The `/oauth2/token` endpoint of a pool's hosted domain.
+ *
+ * This is the half of an authorization code grant that happens on the
+ * application's own server: the browser carried the code back, and the
+ * application exchanges it here for the tokens, authenticating as the app
+ * client while it does.
+ *
+ * The tokens come from the pool's own token issuer rather than from anything
+ * here, so a token from a hosted sign-in is the same token an API sign-in
+ * issues, runs the same `PreTokenGeneration` trigger, and is remembered by the
+ * pool the same way.
+ */
+export declare class SimCognitoTokenEndpoint {
+    private readonly hostedClient;
+    private readonly grants;
+    constructor(properties: SimCognitoTokenEndpointProperties);
+    /**
+     * Exchange an authorization code or a refresh token for tokens.
+     */
+    handle(pool: SimCognitoUserPool, input: SimCognitoTokenInput): Promise<SimCognitoTokenOutput>;
+    private unsupportedGrantDescription;
+}
+export {};
+//# sourceMappingURL=sim-cognito-token-endpoint.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-token-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-token-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAG/F,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AASlC,UAAU,iCAAiC;IACzC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAE/C,YAAY,UAAU,EAAE,iCAAiC,EAExD;IAED;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAsBhC;IAED,OAAO,CAAC,2BAA2B;CAepC"}

package/dist/service/cognito/command/hosted/sim-cognito-token-endpoint.js

@@ -0,0 +1,58 @@
+import { SimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
+import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
+import { SimCognitoTokenGrants } from "./sim-cognito-token-grants.js";
+/**
+ * The grants this endpoint answers.
+ */
+const authorizationCodeGrant = "authorization_code";
+const refreshTokenGrant = "refresh_token";
+const clientCredentialsGrant = "client_credentials";
+/**
+ * The `/oauth2/token` endpoint of a pool's hosted domain.
+ *
+ * This is the half of an authorization code grant that happens on the
+ * application's own server: the browser carried the code back, and the
+ * application exchanges it here for the tokens, authenticating as the app
+ * client while it does.
+ *
+ * The tokens come from the pool's own token issuer rather than from anything
+ * here, so a token from a hosted sign-in is the same token an API sign-in
+ * issues, runs the same `PreTokenGeneration` trigger, and is remembered by the
+ * pool the same way.
+ */
+export class SimCognitoTokenEndpoint {
+    hostedClient = new SimCognitoHostedClient();
+    grants;
+    constructor(properties) {
+        this.grants = new SimCognitoTokenGrants(properties);
+    }
+    /**
+     * Exchange an authorization code or a refresh token for tokens.
+     */
+    async handle(pool, input) {
+        const client = this.hostedClient.forToken(pool, input.client_id, input.client_secret);
+        this.hostedClient.requireCodeGrant(client, false);
+        if (input.grant_type === authorizationCodeGrant) {
+            return await this.grants.exchangeCode(pool, client, input);
+        }
+        if (input.grant_type === refreshTokenGrant) {
+            return await this.grants.refresh(pool, client, input);
+        }
+        throw new SimCognitoOAuthError({
+            code: "unsupported_grant_type",
+            description: this.unsupportedGrantDescription(input.grant_type),
+            redirectable: false,
+        });
+    }
+    unsupportedGrantDescription(grantType) {
+        if (grantType === clientCredentialsGrant) {
+            return ("grant_type 'client_credentials' is not simulated: it issues a " +
+                "token for the custom scopes of a resource server, and resource " +
+                "servers are not simulated");
+        }
+        return (`grant_type '${String(grantType)}' is not a grant this endpoint ` +
+            `answers: it answers '${authorizationCodeGrant}' and ` +
+            `'${refreshTokenGrant}'`);
+    }
+}
+//# sourceMappingURL=sim-cognito-token-endpoint.js.map

package/dist/service/cognito/command/hosted/sim-cognito-token-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-token-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAG9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAMtE;;GAEG;AACH,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AACpD,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAOpD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,uBAAuB;IACjB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,MAAM,CAAwB;IAE/C,YAAY,UAA6C;QACvD,IAAI,CAAC,MAAM,GAAG,IAAI,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAwB,EACxB,KAA2B;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CACvC,IAAI,EACJ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,aAAa,CACpB,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,KAAK,CAAC,UAAU,KAAK,sBAAsB,EAAE,CAAC;YAChD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC3C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EAAE,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/D,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAEO,2BAA2B,CAAC,SAA6B;QAC/D,IAAI,SAAS,KAAK,sBAAsB,EAAE,CAAC;YACzC,OAAO,CACL,gEAAgE;gBAChE,iEAAiE;gBACjE,2BAA2B,CAC5B,CAAC;QACJ,CAAC;QAED,OAAO,CACL,eAAe,MAAM,CAAC,SAAS,CAAC,iCAAiC;YACjE,wBAAwB,sBAAsB,QAAQ;YACtD,IAAI,iBAAiB,GAAG,CACzB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.d.ts

@@ -0,0 +1,42 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoTokenInput, SimCognitoTokenOutput } from "./hosted-auth.command.js";
+interface SimCognitoTokenGrantsProperties {
+    readonly tokenIssuer: SimCognitoTokenIssuer;
+    readonly clock: SimClock;
+}
+/**
+ * The two grants the token endpoint answers.
+ *
+ * The tokens come from the pool's own token issuer rather than from anything
+ * here, so a token from a hosted sign-in is the same token an API sign-in
+ * issues, runs the same `PreTokenGeneration` trigger, and is remembered by the
+ * pool the same way.
+ */
+export declare class SimCognitoTokenGrants {
+    private readonly tokenIssuer;
+    private readonly clock;
+    private readonly presented;
+    private readonly granted;
+    constructor(properties: SimCognitoTokenGrantsProperties);
+    /**
+     * Exchange an authorization code for tokens.
+     *
+     * The code is spent whether or not the rest of the request turns out to be
+     * right, as real Cognito spends one, so nothing can be retried with a code
+     * that has already been presented.
+     */
+    exchangeCode(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoTokenInput): Promise<SimCognitoTokenOutput>;
+    /**
+     * Sign fresh tokens for an application that presented a refresh token.
+     *
+     * No new refresh token comes back, as none does from real Cognito with
+     * refresh token rotation off, and the access token keeps the scopes the
+     * sign-in it came from was granted.
+     */
+    refresh(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoTokenInput): Promise<SimCognitoTokenOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-token-grants.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-grants.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-token-grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI/F,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAElC,UAAU,+BAA+B;IACvC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;;;;;OAMG;IACG,YAAY,CAChB,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;IAED;;;;;;OAMG;IACG,OAAO,CACX,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;CACF"}