@kensio/yulin 1.12.0 → 1.12.1

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.d.ts

@@ -0,0 +1,40 @@
+import type { SimCognitoAttributeType } from "../user/sim-cognito-user-attributes.js";
+import type { SimCognitoExternalUser } from "./sim-cognito-external-user.js";
+/**
+ * How a provider's claims are mapped onto pool attributes, as a request sets
+ * it and a described provider reports it.
+ *
+ * The key is the pool attribute and the value is the provider's claim, which
+ * is the direction real Cognito reads it in and the one most easily got
+ * backwards.
+ */
+export type SimCognitoAttributeMappingType = Readonly<Record<string, string>>;
+/**
+ * What a provider's claims become on the pool user signing in.
+ *
+ * A claim the mapping says nothing about is dropped, as it is on real Cognito:
+ * an attribute reaches a user only where something mapped it there. A mapped
+ * claim the provider did not send is left alone rather than written empty.
+ */
+export declare class SimCognitoAttributeMapping {
+    private readonly mapping;
+    constructor(mapping: SimCognitoAttributeMappingType | undefined);
+    /**
+     * This mapping as a described provider reports it.
+     */
+    toOutput(): SimCognitoAttributeMappingType;
+    /**
+     * The attributes an external user's claims map onto.
+     */
+    attributesFor(externalUser: SimCognitoExternalUser): readonly SimCognitoAttributeType[];
+    /**
+     * Refuse a mapping onto an attribute no pool here holds.
+     *
+     * `username` is refused with its own message: real Cognito builds a
+     * federated user's username from the provider and the subject, and a mapping
+     * cannot change it. It is refused here rather than during a sign-in much
+     * later, which is where the pool's schema would otherwise catch it.
+     */
+    private requireMappedNames;
+}
+//# sourceMappingURL=sim-cognito-attribute-mapping.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-attribute-mapping.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YAAY,OAAO,EAAE,8BAA8B,GAAG,SAAS,EAG9D;IAED;;OAEG;IACH,QAAQ,IAAI,8BAA8B,CAEzC;IAED;;OAEG;IACH,aAAa,CACX,YAAY,EAAE,sBAAsB,GACnC,SAAS,uBAAuB,EAAE,CAOpC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.js

@@ -0,0 +1,56 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { isSimCognitoStandardAttribute } from "../user/sim-cognito-standard-attributes.js";
+/**
+ * What a provider's claims become on the pool user signing in.
+ *
+ * A claim the mapping says nothing about is dropped, as it is on real Cognito:
+ * an attribute reaches a user only where something mapped it there. A mapped
+ * claim the provider did not send is left alone rather than written empty.
+ */
+export class SimCognitoAttributeMapping {
+    mapping;
+    constructor(mapping) {
+        this.mapping = { ...mapping };
+        this.requireMappedNames();
+    }
+    /**
+     * This mapping as a described provider reports it.
+     */
+    toOutput() {
+        return { ...this.mapping };
+    }
+    /**
+     * The attributes an external user's claims map onto.
+     */
+    attributesFor(externalUser) {
+        return Object.entries(this.mapping)
+            .map(([attributeName, claimName]) => ({
+            Name: attributeName,
+            Value: externalUser.claim(claimName),
+        }))
+            .filter((attribute) => attribute.Value !== undefined);
+    }
+    /**
+     * Refuse a mapping onto an attribute no pool here holds.
+     *
+     * `username` is refused with its own message: real Cognito builds a
+     * federated user's username from the provider and the subject, and a mapping
+     * cannot change it. It is refused here rather than during a sign-in much
+     * later, which is where the pool's schema would otherwise catch it.
+     */
+    requireMappedNames() {
+        for (const attributeName of Object.keys(this.mapping)) {
+            if (attributeName === "username") {
+                throw new SimCognitoInvalidParameterException("AttributeMapping cannot map to 'username': Cognito builds a " +
+                    "federated user's username from the provider name and the " +
+                    "subject it signed in with");
+            }
+            if (!isSimCognitoStandardAttribute(attributeName)) {
+                throw new SimCognitoInvalidParameterException(`AttributeMapping '${attributeName}' is not in the pool's schema: ` +
+                    `a pool here holds the standard attributes only, so there is ` +
+                    `nothing for the provider's claim to be mapped onto`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-attribute-mapping.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-attribute-mapping.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAc3F;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,OAAO,CAAiC;IAEzD,YAAY,OAAmD;QAC7D,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CACX,YAAoC;QAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACK,kBAAkB;QACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D;oBAC5D,2DAA2D;oBAC3D,2BAA2B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,aAAa,iCAAiC;oBACjE,8DAA8D;oBAC9D,oDAAoD,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-external-user.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A user as an external provider would hand it back, in the shape a test puts
+ * one there.
+ */
+export interface SimCognitoExternalUserType {
+    /**
+     * The provider's own identifier for the user, which is the `sub` of a social
+     * or OIDC provider and the name id of a SAML one. It is what the pool builds
+     * the federated username from, so the same subject signing in twice reaches
+     * the same pool user.
+     */
+    readonly Subject: string | undefined;
+    /**
+     * The claims the provider would return about the user. The provider's own
+     * claim names are used, and the identity provider's attribute mapping is
+     * what turns them into pool attributes.
+     */
+    readonly Claims?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * The user signed in at a simulated external identity provider.
+ *
+ * Nothing here calls Google or reads a SAML assertion, so the provider has to
+ * be told who is signed in at it. That is what this is: the answer the
+ * provider gives when a browser is redirected to it, put there by the test
+ * rather than by a user typing a password into someone else's login page.
+ */
+export declare class SimCognitoExternalUser {
+    readonly subject: string;
+    private readonly claims;
+    constructor(externalUser: SimCognitoExternalUserType);
+    /**
+     * One claim this user carries, if the provider would return it.
+     */
+    claim(name: string): string | undefined;
+}
+//# sourceMappingURL=sim-cognito-external-user.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-external-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-external-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-external-user.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CAChE;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,YAAY,EAAE,0BAA0B,EAUnD;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-external-user.js

@@ -0,0 +1,28 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The user signed in at a simulated external identity provider.
+ *
+ * Nothing here calls Google or reads a SAML assertion, so the provider has to
+ * be told who is signed in at it. That is what this is: the answer the
+ * provider gives when a browser is redirected to it, put there by the test
+ * rather than by a user typing a password into someone else's login page.
+ */
+export class SimCognitoExternalUser {
+    subject;
+    claims;
+    constructor(externalUser) {
+        if (externalUser.Subject === undefined || externalUser.Subject === "") {
+            throw new SimCognitoInvalidParameterException("An external user needs a Subject: it is what the provider " +
+                "identifies the user by, and what the pool builds its username from");
+        }
+        this.subject = externalUser.Subject;
+        this.claims = new Map(Object.entries(externalUser.Claims ?? {}));
+    }
+    /**
+     * One claim this user carries, if the provider would return it.
+     */
+    claim(name) {
+        return this.claims.get(name);
+    }
+}
+//# sourceMappingURL=sim-cognito-external-user.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-external-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-external-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-external-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAuBvF;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACjB,OAAO,CAAS;IACf,MAAM,CAA8B;IAErD,YAAY,YAAwC;QAClD,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,mCAAmC,CAC3C,4DAA4D;gBAC1D,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-identity.d.ts

@@ -0,0 +1,64 @@
+/**
+ * One entry of a user's `identities`, in the shape an id token carries it.
+ *
+ * `issuer` is null for the social providers, which have one issuer each, and
+ * names the issuer for a SAML or OIDC provider. `primary` says which identity
+ * a linked user signs in as, and is always true here because a user linked to
+ * more than one provider is what `AdminLinkProviderForUser` does, and that is
+ * not simulated.
+ */
+export interface SimCognitoIdentityClaim {
+    readonly userId: string;
+    readonly providerName: string;
+    readonly providerType: string;
+    readonly issuer: string | null;
+    /**
+     * Whether this is the identity the user signs in as, which Cognito writes as
+     * the string `"true"` rather than as a boolean, in the token as well as in
+     * the attribute.
+     */
+    readonly primary: string;
+    /** When the identity was linked, in milliseconds, written as a string. */
+    readonly dateCreated: string;
+}
+interface SimCognitoFederatedIdentityProperties {
+    readonly userId: string;
+    readonly providerName: string;
+    readonly providerType: string;
+    readonly issuer: string | undefined;
+    readonly createdAt: Date;
+}
+/**
+ * Where a federated user came from.
+ *
+ * Cognito records this on the user it creates for an external subject, and
+ * reports it in two places: as an `identities` attribute holding JSON, and as
+ * an `identities` claim in the id token holding the same thing as an array. A
+ * request cannot set it, so it lives on the user rather than among its
+ * attributes, in the same way `sub` does.
+ */
+export declare class SimCognitoFederatedIdentity {
+    readonly userId: string;
+    readonly providerName: string;
+    readonly providerType: string;
+    readonly issuer: string | null;
+    readonly dateCreated: number;
+    constructor(properties: SimCognitoFederatedIdentityProperties);
+    /**
+     * This identity as a token claim carries it.
+     *
+     * `primary` and `dateCreated` are strings, which is how the AWS
+     * documentation's own id token example writes them.
+     */
+    toClaim(): SimCognitoIdentityClaim;
+    /**
+     * This identity as the user's `identities` attribute holds it.
+     *
+     * The attribute is a JSON string, which is what a described user reports and
+     * what code reading `identities` from `AdminGetUser` has to parse. What it
+     * holds is what the token claim holds.
+     */
+    toAttributeValue(): string;
+}
+export {};
+//# sourceMappingURL=sim-cognito-federated-identity.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federated-identity.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,YAAY,UAAU,EAAE,qCAAqC,EAM5D;IAED;;;;;OAKG;IACH,OAAO,IAAI,uBAAuB,CASjC;IAED;;;;;;OAMG;IACH,gBAAgB,IAAI,MAAM,CAEzB;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-identity.js

@@ -0,0 +1,50 @@
+/**
+ * Where a federated user came from.
+ *
+ * Cognito records this on the user it creates for an external subject, and
+ * reports it in two places: as an `identities` attribute holding JSON, and as
+ * an `identities` claim in the id token holding the same thing as an array. A
+ * request cannot set it, so it lives on the user rather than among its
+ * attributes, in the same way `sub` does.
+ */
+export class SimCognitoFederatedIdentity {
+    userId;
+    providerName;
+    providerType;
+    issuer;
+    dateCreated;
+    constructor(properties) {
+        this.userId = properties.userId;
+        this.providerName = properties.providerName;
+        this.providerType = properties.providerType;
+        this.issuer = properties.issuer ?? null;
+        this.dateCreated = properties.createdAt.getTime();
+    }
+    /**
+     * This identity as a token claim carries it.
+     *
+     * `primary` and `dateCreated` are strings, which is how the AWS
+     * documentation's own id token example writes them.
+     */
+    toClaim() {
+        return {
+            userId: this.userId,
+            providerName: this.providerName,
+            providerType: this.providerType,
+            issuer: this.issuer,
+            primary: "true",
+            dateCreated: String(this.dateCreated),
+        };
+    }
+    /**
+     * This identity as the user's `identities` attribute holds it.
+     *
+     * The attribute is a JSON string, which is what a described user reports and
+     * what code reading `identities` from `AdminGetUser` has to parse. What it
+     * holds is what the token claim holds.
+     */
+    toAttributeValue() {
+        return JSON.stringify([this.toClaim()]);
+    }
+}
+//# sourceMappingURL=sim-cognito-federated-identity.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federated-identity.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-identity.ts"],"names":[],"mappings":"AAkCA;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACtB,MAAM,CAAS;IACf,YAAY,CAAS;IACrB,YAAY,CAAS;IACrB,MAAM,CAAgB;IACtB,WAAW,CAAS;IAEpC,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,OAAO;QACL,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;SACtC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.d.ts

@@ -0,0 +1,47 @@
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../user/sim-cognito-user.js";
+import type { SimCognitoUserFactory } from "../user/sim-cognito-user-factory.js";
+import type { SimCognitoUserPoolIdentityProvider } from "./sim-cognito-user-pool-identity-provider.js";
+interface SimCognitoFederatedSignInProperties {
+    readonly userFactory: SimCognitoUserFactory;
+}
+interface SimCognitoFederatedSignInRequest {
+    readonly pool: SimCognitoUserPool;
+    readonly provider: SimCognitoUserPoolIdentityProvider;
+    readonly now: Date;
+}
+/**
+ * Signs an external user in to a pool, creating the pool's own user for it the
+ * first time.
+ *
+ * Cognito keeps a user of its own for every external subject that signs in,
+ * because everything downstream of the sign-in works on pool users: the tokens
+ * name one, groups hold one, and the pool's own operations describe one. The
+ * username it builds is the provider name and the subject with an underscore
+ * between them, which is what makes the same subject signing in twice reach
+ * the same user rather than a second one.
+ *
+ * The provider's claims reach the user through the provider's attribute
+ * mapping, on every sign-in rather than only the first, because real Cognito
+ * updates a mapped attribute when the value at the provider changes.
+ */
+export declare class SimCognitoFederatedSignIn {
+    private readonly userFactory;
+    constructor(properties: SimCognitoFederatedSignInProperties);
+    /**
+     * Refuse a sign-in that would take over a user it did not create.
+     *
+     * A username is only reserved by being taken, and a pool's own user may
+     * validly be called `Google_1234`, so the user found by name is only the
+     * federated one when its identity says so. Signing in as it otherwise would
+     * hand an application a token for someone else's account, which is worth
+     * refusing rather than guessing at.
+     */
+    private static requireSameIdentity;
+    /**
+     * Sign the user signed in at the provider in to the pool.
+     */
+    signIn(request: SimCognitoFederatedSignInRequest): SimCognitoUser;
+}
+export {};
+//# sourceMappingURL=sim-cognito-federated-sign-in.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federated-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAEvG,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAmBlC;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,gCAAgC,GAAG,cAAc,CA+BhE;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js

@@ -0,0 +1,72 @@
+import { SimCognitoUsernameExistsException } from "../../error/sim-cognito.error.js";
+import { requireSimCognitoUsername } from "../user/sim-cognito-username.js";
+import { SimCognitoFederatedIdentity } from "./sim-cognito-federated-identity.js";
+/**
+ * Signs an external user in to a pool, creating the pool's own user for it the
+ * first time.
+ *
+ * Cognito keeps a user of its own for every external subject that signs in,
+ * because everything downstream of the sign-in works on pool users: the tokens
+ * name one, groups hold one, and the pool's own operations describe one. The
+ * username it builds is the provider name and the subject with an underscore
+ * between them, which is what makes the same subject signing in twice reach
+ * the same user rather than a second one.
+ *
+ * The provider's claims reach the user through the provider's attribute
+ * mapping, on every sign-in rather than only the first, because real Cognito
+ * updates a mapped attribute when the value at the provider changes.
+ */
+export class SimCognitoFederatedSignIn {
+    userFactory;
+    constructor(properties) {
+        this.userFactory = properties.userFactory;
+    }
+    /**
+     * Refuse a sign-in that would take over a user it did not create.
+     *
+     * A username is only reserved by being taken, and a pool's own user may
+     * validly be called `Google_1234`, so the user found by name is only the
+     * federated one when its identity says so. Signing in as it otherwise would
+     * hand an application a token for someone else's account, which is worth
+     * refusing rather than guessing at.
+     */
+    static requireSameIdentity(existing, provider) {
+        const { identity } = existing;
+        const externalUser = provider.requireSignedInUser();
+        if (identity?.providerName !== provider.name ||
+            identity.userId !== externalUser.subject) {
+            throw new SimCognitoUsernameExistsException(`User ${existing.username} already exists in user pool ` +
+                `${provider.userPoolId} and is not the ${provider.name} user this ` +
+                `sign-in is for.`);
+        }
+    }
+    /**
+     * Sign the user signed in at the provider in to the pool.
+     */
+    signIn(request) {
+        const { pool, provider, now } = request;
+        const externalUser = provider.requireSignedInUser();
+        const username = requireSimCognitoUsername(`${provider.name}_${externalUser.subject}`);
+        const attributes = provider.attributeMapping.attributesFor(externalUser);
+        const existing = pool.findUser(username);
+        if (existing !== undefined) {
+            SimCognitoFederatedSignIn.requireSameIdentity(existing, provider);
+            existing.updateAttributes(attributes);
+            return existing;
+        }
+        const user = this.userFactory.federated({
+            username,
+            attributes,
+            identity: new SimCognitoFederatedIdentity({
+                userId: externalUser.subject,
+                providerName: provider.name,
+                providerType: provider.type.value,
+                issuer: provider.issuer,
+                createdAt: now,
+            }),
+        });
+        pool.addUser(user);
+        return user;
+    }
+}
+//# sourceMappingURL=sim-cognito-federated-sign-in.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federated-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAalF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,CAAwB;IAEpD,YAAY,UAA+C;QACzD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB,CAChC,QAAwB,EACxB,QAA4C;QAE5C,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC9B,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAEpD,IACE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,IAAI;YACxC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,EACxC,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,QAAQ,QAAQ,CAAC,QAAQ,+BAA+B;gBACtD,GAAG,QAAQ,CAAC,UAAU,mBAAmB,QAAQ,CAAC,IAAI,aAAa;gBACnE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAyC;QAC9C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,yBAAyB,CACxC,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,CAC3C,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yBAAyB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAClE,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEtC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YACtC,QAAQ;YACR,UAAU;YACV,QAAQ,EAAE,IAAI,2BAA2B,CAAC;gBACxC,MAAM,EAAE,YAAY,CAAC,OAAO;gBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,GAAG;aACf,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.d.ts

@@ -0,0 +1,37 @@
+import { SimCognitoAttributeMapping, type SimCognitoAttributeMappingType } from "./sim-cognito-attribute-mapping.js";
+import { SimCognitoProviderDetails, type SimCognitoProviderDetailsType } from "./sim-cognito-provider-details.js";
+import { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
+/**
+ * The properties `CreateIdentityProvider` and `UpdateIdentityProvider` set.
+ */
+export interface SimCognitoIdentityProviderSettingsInput {
+    readonly ProviderName?: string | undefined;
+    readonly ProviderType?: string | undefined;
+    readonly ProviderDetails?: SimCognitoProviderDetailsType | undefined;
+    readonly AttributeMapping?: SimCognitoAttributeMappingType | undefined;
+    readonly IdpIdentifiers?: readonly string[] | undefined;
+}
+/**
+ * The settable properties of one identity provider.
+ *
+ * `CreateIdentityProvider` builds one of these from its request. The provider
+ * name is among them although an update cannot change it, because the name is
+ * what the update names the provider by and the settings are what hold it.
+ */
+export declare class SimCognitoIdentityProviderSettings {
+    readonly name: string;
+    readonly type: SimCognitoProviderType;
+    readonly details: SimCognitoProviderDetails;
+    readonly attributeMapping: SimCognitoAttributeMapping;
+    readonly idpIdentifiers: readonly string[];
+    constructor(input: SimCognitoIdentityProviderSettingsInput);
+    /**
+     * Check the name a provider is known by in its pool.
+     *
+     * `COGNITO` is refused because it is the name the pool's own users already
+     * sign in under, and a provider taking it would make an authorize request
+     * ambiguous.
+     */
+    private static requiredName;
+}
+//# sourceMappingURL=sim-cognito-identity-provider-settings.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,EACpC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,eAAe,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;GAMG;AACH,qBAAa,kCAAkC;IAC7C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,IAAI,EAAE,sBAAsB,CAAC;IAC7C,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IACnD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAC7D,SAAgB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAElD,YAAY,KAAK,EAAE,uCAAuC,EAazD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;CAuB5B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.js

@@ -0,0 +1,55 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { SimCognitoAttributeMapping, } from "./sim-cognito-attribute-mapping.js";
+import { SimCognitoProviderDetails, } from "./sim-cognito-provider-details.js";
+import { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
+/**
+ * How long a provider name may be.
+ */
+const maxProviderNameLength = 32;
+/**
+ * The name a pool's own users sign in under, which no provider may take.
+ */
+const localProviderName = "COGNITO";
+/**
+ * The settable properties of one identity provider.
+ *
+ * `CreateIdentityProvider` builds one of these from its request. The provider
+ * name is among them although an update cannot change it, because the name is
+ * what the update names the provider by and the settings are what hold it.
+ */
+export class SimCognitoIdentityProviderSettings {
+    name;
+    type;
+    details;
+    attributeMapping;
+    idpIdentifiers;
+    constructor(input) {
+        this.name = SimCognitoIdentityProviderSettings.requiredName(input.ProviderName);
+        this.type = new SimCognitoProviderType(input.ProviderType);
+        this.details = new SimCognitoProviderDetails(this.type, input.ProviderDetails);
+        this.attributeMapping = new SimCognitoAttributeMapping(input.AttributeMapping);
+        this.idpIdentifiers = [...(input.IdpIdentifiers ?? [])];
+    }
+    /**
+     * Check the name a provider is known by in its pool.
+     *
+     * `COGNITO` is refused because it is the name the pool's own users already
+     * sign in under, and a provider taking it would make an authorize request
+     * ambiguous.
+     */
+    static requiredName(value) {
+        if (value === undefined || value === "") {
+            throw new SimCognitoInvalidParameterException("ProviderName is required: name the provider being added to the pool");
+        }
+        if (value.length > maxProviderNameLength) {
+            throw new SimCognitoInvalidParameterException(`ProviderName '${value}' is too long: a provider name is at most ` +
+                `${String(maxProviderNameLength)} characters`);
+        }
+        if (value === localProviderName) {
+            throw new SimCognitoInvalidParameterException(`ProviderName '${localProviderName}' is reserved: it is the name the ` +
+                `pool's own users sign in under`);
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=sim-cognito-identity-provider-settings.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,0BAA0B,GAE3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAapC;;;;;;GAMG;AACH,MAAM,OAAO,kCAAkC;IAC7B,IAAI,CAAS;IACb,IAAI,CAAyB;IAC7B,OAAO,CAA4B;IACnC,gBAAgB,CAA6B;IAC7C,cAAc,CAAoB;IAElD,YAAY,KAA8C;QACxD,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC,YAAY,CACzD,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAC1C,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CACpD,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,YAAY,CAAC,KAAyB;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,KAAK,4CAA4C;gBAChE,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,iBAAiB,oCAAoC;gBACpE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.d.ts

@@ -0,0 +1,39 @@
+import type { SimCognitoUserPoolIdentityProvider } from "./sim-cognito-user-pool-identity-provider.js";
+/**
+ * The external identity providers of one simulated user pool.
+ *
+ * Providers are keyed by name, which is what every provider operation names
+ * one by and what an authorize request carries in `identity_provider`. A name
+ * is unique within its pool, as it is on real Cognito.
+ */
+export declare class SimCognitoIdentityProviderStore {
+    private readonly providers;
+    /**
+     * Every provider in this pool, in creation order.
+     */
+    get all(): readonly SimCognitoUserPoolIdentityProvider[];
+    /**
+     * Store a newly created provider, refusing a name the pool already holds.
+     *
+     * Real Cognito reports the second provider of one name as a duplicate
+     * request rather than as a bad parameter, and says which name it was.
+     */
+    add(provider: SimCognitoUserPoolIdentityProvider): void;
+    /**
+     * Forget a deleted provider.
+     */
+    remove(provider: SimCognitoUserPoolIdentityProvider): void;
+    /**
+     * Find a provider by name.
+     */
+    find(providerName: string): SimCognitoUserPoolIdentityProvider | undefined;
+    /**
+     * Find a provider by one of the alternative names it was given.
+     */
+    findByIdentifier(identifier: string): SimCognitoUserPoolIdentityProvider | undefined;
+    /**
+     * Resolve a provider by name, or refuse.
+     */
+    require(providerName: string): SimCognitoUserPoolIdentityProvider;
+}
+//# sourceMappingURL=sim-cognito-identity-provider-store.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAEvG;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGtB;IAEJ;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kCAAkC,EAAE,CAEvD;IAED;;;;;OAKG;IACH,GAAG,CAAC,QAAQ,EAAE,kCAAkC,GAAG,IAAI,CAQtD;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,kCAAkC,GAAG,IAAI,CAEzD;IAED;;OAEG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,kCAAkC,GAAG,SAAS,CAEzE;IAED;;OAEG;IACH,gBAAgB,CACd,UAAU,EAAE,MAAM,GACjB,kCAAkC,GAAG,SAAS,CAEhD;IAED;;OAEG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,kCAAkC,CAUhE;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.js

@@ -0,0 +1,58 @@
+import { SimCognitoDuplicateProviderException, SimCognitoResourceNotFoundException, } from "../../error/sim-cognito.error.js";
+/**
+ * The external identity providers of one simulated user pool.
+ *
+ * Providers are keyed by name, which is what every provider operation names
+ * one by and what an authorize request carries in `identity_provider`. A name
+ * is unique within its pool, as it is on real Cognito.
+ */
+export class SimCognitoIdentityProviderStore {
+    providers = new Map();
+    /**
+     * Every provider in this pool, in creation order.
+     */
+    get all() {
+        return this.providers.values().toArray();
+    }
+    /**
+     * Store a newly created provider, refusing a name the pool already holds.
+     *
+     * Real Cognito reports the second provider of one name as a duplicate
+     * request rather than as a bad parameter, and says which name it was.
+     */
+    add(provider) {
+        if (this.providers.has(provider.name)) {
+            throw new SimCognitoDuplicateProviderException(`A provider with the name ${provider.name} already exists in the pool.`);
+        }
+        this.providers.set(provider.name, provider);
+    }
+    /**
+     * Forget a deleted provider.
+     */
+    remove(provider) {
+        this.providers.delete(provider.name);
+    }
+    /**
+     * Find a provider by name.
+     */
+    find(providerName) {
+        return this.providers.get(providerName);
+    }
+    /**
+     * Find a provider by one of the alternative names it was given.
+     */
+    findByIdentifier(identifier) {
+        return this.all.find((provider) => provider.hasIdpIdentifier(identifier));
+    }
+    /**
+     * Resolve a provider by name, or refuse.
+     */
+    require(providerName) {
+        const found = this.find(providerName);
+        if (found === undefined) {
+            throw new SimCognitoResourceNotFoundException(`Identity provider ${providerName} does not exist.`);
+        }
+        return found;
+    }
+}
+//# sourceMappingURL=sim-cognito-identity-provider-store.js.map