@kensio/yulin 1.12.0 → 1.12.1

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-identity-provider-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAG1C;;;;;;GAMG;AACH,MAAM,OAAO,+BAA+B;IACzB,SAAS,GAAG,IAAI,GAAG,EAGjC,CAAC;IAEJ;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,QAA4C;QAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,oCAAoC,CAC5C,4BAA4B,QAAQ,CAAC,IAAI,8BAA8B,CACxE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAA4C;QACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,UAAkB;QAElB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,YAAoB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,YAAY,kBAAkB,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-details.d.ts

@@ -0,0 +1,29 @@
+import type { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
+/**
+ * How a provider is configured, as a request sets it and a described provider
+ * reports it.
+ */
+export type SimCognitoProviderDetailsType = Readonly<Record<string, string>>;
+/**
+ * The configuration of one external identity provider.
+ *
+ * The values are recorded and never used: a simulated sign-in reaches the
+ * provider this simulation holds rather than the one at the other end of a
+ * client id and secret. They are checked for presence all the same, so that a
+ * provider which could not have been created on real AWS is not created here.
+ */
+export declare class SimCognitoProviderDetails {
+    private readonly details;
+    constructor(providerType: SimCognitoProviderType, details: SimCognitoProviderDetailsType | undefined);
+    /**
+     * These details as a described provider reports them.
+     */
+    toOutput(): SimCognitoProviderDetailsType;
+    /**
+     * One configured value, if the provider was created with it.
+     */
+    value(key: string): string | undefined;
+    private requireDetailsFor;
+    private requireSamlMetadata;
+}
+//# sourceMappingURL=sim-cognito-provider-details.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-details.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-details.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-provider-details.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAO7E;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7E;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IAEtD,YACE,YAAY,EAAE,sBAAsB,EACpC,OAAO,EAAE,6BAA6B,GAAG,SAAS,EAInD;IAED;;OAEG;IACH,QAAQ,IAAI,6BAA6B,CAExC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErC;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,mBAAmB;CAU5B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-details.js

@@ -0,0 +1,52 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * Either of the two ways a SAML provider carries its metadata.
+ */
+const samlMetadataKeys = ["MetadataURL", "MetadataFile"];
+/**
+ * The configuration of one external identity provider.
+ *
+ * The values are recorded and never used: a simulated sign-in reaches the
+ * provider this simulation holds rather than the one at the other end of a
+ * client id and secret. They are checked for presence all the same, so that a
+ * provider which could not have been created on real AWS is not created here.
+ */
+export class SimCognitoProviderDetails {
+    details;
+    constructor(providerType, details) {
+        this.details = new Map(Object.entries(details ?? {}));
+        this.requireDetailsFor(providerType);
+    }
+    /**
+     * These details as a described provider reports them.
+     */
+    toOutput() {
+        return Object.fromEntries(this.details);
+    }
+    /**
+     * One configured value, if the provider was created with it.
+     */
+    value(key) {
+        return this.details.get(key);
+    }
+    requireDetailsFor(providerType) {
+        if (providerType.isSaml) {
+            this.requireSamlMetadata(providerType);
+            return;
+        }
+        const missing = providerType.requiredDetails.filter((key) => !this.details.has(key));
+        if (missing.length > 0) {
+            throw new SimCognitoInvalidParameterException(`ProviderDetails is missing ${missing.join(", ")}: a ` +
+                `${providerType.value} provider is configured with ` +
+                `${providerType.requiredDetails.join(", ")}.`);
+        }
+    }
+    requireSamlMetadata(providerType) {
+        const named = samlMetadataKeys.filter((key) => this.details.has(key));
+        if (named.length === 0) {
+            throw new SimCognitoInvalidParameterException(`ProviderDetails is missing ${samlMetadataKeys.join(" or ")}: a ` +
+                `${providerType.value} provider is configured with one of them`);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-provider-details.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-details.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-details.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-provider-details.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAGvF;;GAEG;AACH,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AAQzD;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,OAAO,CAA8B;IAEtD,YACE,YAAoC,EACpC,OAAkD;QAElD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAW;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEO,iBAAiB,CAAC,YAAoC;QAC5D,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,CAAC,MAAM,CACjD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAChC,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,mCAAmC,CAC3C,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBACpD,GAAG,YAAY,CAAC,KAAK,+BAA+B;gBACpD,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,YAAoC;QAC9D,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAEtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,mCAAmC,CAC3C,8BAA8B,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC/D,GAAG,YAAY,CAAC,KAAK,0CAA0C,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-type.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The kind of external directory an identity provider stands for.
+ *
+ * The type decides what a provider has to be configured with, and nothing
+ * else here: a simulated sign-in through a SAML provider and through Google
+ * both end in the same thing, an external subject with claims that the pool
+ * maps onto a user.
+ */
+export declare class SimCognitoProviderType {
+    readonly value: string;
+    constructor(value: string | undefined);
+    /**
+     * Whether this type carries assertions rather than an OAuth token.
+     */
+    get isSaml(): boolean;
+    /**
+     * The provider details this type has to be configured with.
+     *
+     * A SAML provider is configured with a metadata document instead, which is
+     * checked where the details are read rather than here.
+     */
+    get requiredDetails(): readonly string[];
+}
+//# sourceMappingURL=sim-cognito-provider-type.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-type.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-provider-type.ts"],"names":[],"mappings":"AAiCA;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,KAAK,EAAE,MAAM,GAAG,SAAS,EAepC;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,SAAS,MAAM,EAAE,CAEvC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-type.js

@@ -0,0 +1,67 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The details each kind of provider is configured with.
+ *
+ * Nothing here calls a provider, so none of these values is used. They are
+ * required anyway, because a provider created without them is a request that
+ * fails on the way to AWS, and a pool that accepted one here would send a user
+ * to a provider that was never configured.
+ */
+const socialDetails = ["client_id", "client_secret", "authorize_scopes"];
+const requiredDetails = new Map([
+    ["Facebook", socialDetails],
+    ["Google", socialDetails],
+    ["LoginWithAmazon", socialDetails],
+    [
+        "SignInWithApple",
+        ["client_id", "team_id", "key_id", "private_key", "authorize_scopes"],
+    ],
+    [
+        "OIDC",
+        [
+            "client_id",
+            "client_secret",
+            "attributes_request_method",
+            "oidc_issuer",
+            "authorize_scopes",
+        ],
+    ],
+    ["SAML", []],
+]);
+/**
+ * The kind of external directory an identity provider stands for.
+ *
+ * The type decides what a provider has to be configured with, and nothing
+ * else here: a simulated sign-in through a SAML provider and through Google
+ * both end in the same thing, an external subject with claims that the pool
+ * maps onto a user.
+ */
+export class SimCognitoProviderType {
+    value;
+    constructor(value) {
+        if (value === undefined || value === "") {
+            throw new SimCognitoInvalidParameterException("ProviderType is required: name the kind of provider being added");
+        }
+        if (!requiredDetails.has(value)) {
+            throw new SimCognitoInvalidParameterException(`ProviderType '${value}' is not a provider type: the types are ` +
+                `${requiredDetails.keys().toArray().join(", ")}.`);
+        }
+        this.value = value;
+    }
+    /**
+     * Whether this type carries assertions rather than an OAuth token.
+     */
+    get isSaml() {
+        return this.value === "SAML";
+    }
+    /**
+     * The provider details this type has to be configured with.
+     *
+     * A SAML provider is configured with a metadata document instead, which is
+     * checked where the details are read rather than here.
+     */
+    get requiredDetails() {
+        return requiredDetails.get(this.value) ?? [];
+    }
+}
+//# sourceMappingURL=sim-cognito-provider-type.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-provider-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-type.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-provider-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAEzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAA4B;IACzD,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3B,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzB,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC;QACE,iBAAiB;QACjB,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,kBAAkB,CAAC;KACtE;IACD;QACE,MAAM;QACN;YACE,WAAW;YACX,eAAe;YACf,2BAA2B;YAC3B,aAAa;YACb,kBAAkB;SACnB;KACF;IACD,CAAC,MAAM,EAAE,EAAE,CAAC;CACb,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACjB,KAAK,CAAS;IAE9B,YAAY,KAAyB;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,KAAK,0CAA0C;gBAC9D,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.d.ts

@@ -0,0 +1,82 @@
+import type { SimCognitoUserPoolId } from "../sim-cognito-user-pool-id.js";
+import type { SimCognitoAttributeMapping } from "./sim-cognito-attribute-mapping.js";
+import { SimCognitoExternalUser, type SimCognitoExternalUserType } from "./sim-cognito-external-user.js";
+import type { SimCognitoIdentityProviderSettings } from "./sim-cognito-identity-provider-settings.js";
+import type { SimCognitoProviderDetails } from "./sim-cognito-provider-details.js";
+import type { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
+interface SimCognitoUserPoolIdentityProviderProperties {
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly settings: SimCognitoIdentityProviderSettings;
+    readonly createdAt: Date;
+}
+/**
+ * One external identity provider configured on a simulated user pool.
+ *
+ * On real Cognito this holds the credentials the pool signs users in with at
+ * Google, or the metadata of a SAML directory. Nothing here calls either, so
+ * what it holds instead is the user signed in at the provider: a test puts one
+ * there, and an authorize request naming this provider signs that user in.
+ *
+ * The configuration is still recorded and validated, so a provider that could
+ * not have been created on real AWS is not created here, and a described
+ * provider reports what the request set.
+ */
+export declare class SimCognitoUserPoolIdentityProvider {
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly creationDate: Date;
+    private settings;
+    private modifiedDate;
+    private externalUser;
+    constructor(properties: SimCognitoUserPoolIdentityProviderProperties);
+    /** The name this provider is known by in the pool. */
+    get name(): string;
+    /** The kind of external directory this provider stands for. */
+    get type(): SimCognitoProviderType;
+    /** How the provider is configured. */
+    get details(): SimCognitoProviderDetails;
+    /** What the provider's claims become on the pool user. */
+    get attributeMapping(): SimCognitoAttributeMapping;
+    /** The alternative names an authorize request can reach this provider by. */
+    get idpIdentifiers(): readonly string[];
+    /** When the provider's settings last changed. */
+    get lastModifiedDate(): Date;
+    /**
+     * The issuer a federated identity records for this provider, which only the
+     * providers configured with one have.
+     */
+    get issuer(): string | undefined;
+    /**
+     * Whether an authorize request naming this identifier reaches this provider.
+     *
+     * Real Cognito takes an `idp_identifier` as an alternative to the provider
+     * name, so that an application can send a user to the provider for their
+     * email domain without knowing what it was called.
+     */
+    hasIdpIdentifier(identifier: string): boolean;
+    /**
+     * Replace this provider's settings, as `UpdateIdentityProvider` does.
+     */
+    update(settings: SimCognitoIdentityProviderSettings, at: Date): void;
+    /**
+     * Say who is signed in at this provider.
+     *
+     * This is the simulator's own accessor. It stands in for everything that
+     * happens at the provider itself, which is where a real user types a
+     * password this simulation never sees.
+     */
+    signInAs(externalUser: SimCognitoExternalUserType): void;
+    /**
+     * Sign out of this provider, so a further authorize request finds nobody.
+     */
+    signOut(): void;
+    /**
+     * The user this provider signs in, or a refusal.
+     *
+     * Real Cognito would show the provider's own sign-in page here, and there is
+     * no page in a simulation. Refusing is what stops an authorize request
+     * quietly signing in a user nothing put there.
+     */
+    requireSignedInUser(): SimCognitoExternalUser;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool-identity-provider.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-identity-provider.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,EACL,sBAAsB,EACtB,KAAK,0BAA0B,EAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AACtG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,UAAU,4CAA4C;IACpD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,kCAAkC;IAC7C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,YAAY,CAAO;IAC3B,OAAO,CAAC,YAAY,CAAqC;IAEzD,YAAY,UAAU,EAAE,4CAA4C,EAKnE;IAED,sDAAsD;IACtD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+DAA+D;IAC/D,IAAI,IAAI,IAAI,sBAAsB,CAEjC;IAED,sCAAsC;IACtC,IAAI,OAAO,IAAI,yBAAyB,CAEvC;IAED,0DAA0D;IAC1D,IAAI,gBAAgB,IAAI,0BAA0B,CAEjD;IAED,6EAA6E;IAC7E,IAAI,cAAc,IAAI,SAAS,MAAM,EAAE,CAEtC;IAED,iDAAiD;IACjD,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAI/B;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE5C;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,kCAAkC,EAAE,EAAE,EAAE,IAAI,GAAG,IAAI,CAGnE;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,0BAA0B,GAAG,IAAI,CAEvD;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAEd;IAED;;;;;;OAMG;IACH,mBAAmB,IAAI,sBAAsB,CAW5C;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.js

@@ -0,0 +1,108 @@
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
+import { SimCognitoExternalUser, } from "./sim-cognito-external-user.js";
+/**
+ * One external identity provider configured on a simulated user pool.
+ *
+ * On real Cognito this holds the credentials the pool signs users in with at
+ * Google, or the metadata of a SAML directory. Nothing here calls either, so
+ * what it holds instead is the user signed in at the provider: a test puts one
+ * there, and an authorize request naming this provider signs that user in.
+ *
+ * The configuration is still recorded and validated, so a provider that could
+ * not have been created on real AWS is not created here, and a described
+ * provider reports what the request set.
+ */
+export class SimCognitoUserPoolIdentityProvider {
+    userPoolId;
+    creationDate;
+    settings;
+    modifiedDate;
+    externalUser;
+    constructor(properties) {
+        this.userPoolId = properties.userPoolId;
+        this.settings = properties.settings;
+        this.creationDate = properties.createdAt;
+        this.modifiedDate = properties.createdAt;
+    }
+    /** The name this provider is known by in the pool. */
+    get name() {
+        return this.settings.name;
+    }
+    /** The kind of external directory this provider stands for. */
+    get type() {
+        return this.settings.type;
+    }
+    /** How the provider is configured. */
+    get details() {
+        return this.settings.details;
+    }
+    /** What the provider's claims become on the pool user. */
+    get attributeMapping() {
+        return this.settings.attributeMapping;
+    }
+    /** The alternative names an authorize request can reach this provider by. */
+    get idpIdentifiers() {
+        return this.settings.idpIdentifiers;
+    }
+    /** When the provider's settings last changed. */
+    get lastModifiedDate() {
+        return this.modifiedDate;
+    }
+    /**
+     * The issuer a federated identity records for this provider, which only the
+     * providers configured with one have.
+     */
+    get issuer() {
+        return (this.details.value("oidc_issuer") ?? this.details.value("MetadataURL"));
+    }
+    /**
+     * Whether an authorize request naming this identifier reaches this provider.
+     *
+     * Real Cognito takes an `idp_identifier` as an alternative to the provider
+     * name, so that an application can send a user to the provider for their
+     * email domain without knowing what it was called.
+     */
+    hasIdpIdentifier(identifier) {
+        return this.idpIdentifiers.includes(identifier);
+    }
+    /**
+     * Replace this provider's settings, as `UpdateIdentityProvider` does.
+     */
+    update(settings, at) {
+        this.settings = settings;
+        this.modifiedDate = at;
+    }
+    /**
+     * Say who is signed in at this provider.
+     *
+     * This is the simulator's own accessor. It stands in for everything that
+     * happens at the provider itself, which is where a real user types a
+     * password this simulation never sees.
+     */
+    signInAs(externalUser) {
+        this.externalUser = new SimCognitoExternalUser(externalUser);
+    }
+    /**
+     * Sign out of this provider, so a further authorize request finds nobody.
+     */
+    signOut() {
+        this.externalUser = undefined;
+    }
+    /**
+     * The user this provider signs in, or a refusal.
+     *
+     * Real Cognito would show the provider's own sign-in page here, and there is
+     * no page in a simulation. Refusing is what stops an authorize request
+     * quietly signing in a user nothing put there.
+     */
+    requireSignedInUser() {
+        if (this.externalUser === undefined) {
+            throw new SimCognitoNotAuthorizedException(`Nobody is signed in at the ${this.name} identity provider. Real ` +
+                `Cognito would send the user to the provider's own sign-in page, ` +
+                `which this simulation has no equivalent of. Say who is signed in ` +
+                `there with signInAs first.`);
+        }
+        return this.externalUser;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-identity-provider.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-identity-provider.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAGpF,OAAO,EACL,sBAAsB,GAEvB,MAAM,gCAAgC,CAAC;AAWxC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kCAAkC;IAC7B,UAAU,CAAuB;IACjC,YAAY,CAAO;IAE3B,QAAQ,CAAqC;IAC7C,YAAY,CAAO;IACnB,YAAY,CAAqC;IAEzD,YAAY,UAAwD;QAClE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,sDAAsD;IACtD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,0DAA0D;IAC1D,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;IACtC,CAAC;IAED,iDAAiD;IACjD,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CACvE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,UAAkB;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAA4C,EAAE,EAAQ;QAC3D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,YAAwC;QAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB;QACjB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CACxC,8BAA8B,IAAI,CAAC,IAAI,2BAA2B;gBAChE,kEAAkE;gBAClE,mEAAmE;gBACnE,4BAA4B,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts

@@ -1,3 +1,4 @@
+import { SimCognitoDomainRegistry } from "../registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
 import type { SimCognitoIssuedToken } from "./auth/sim-cognito-issued-token.js";
 import type { SimCognitoUserPoolClient } from "./client/sim-cognito-user-pool-client.js";
@@ -20,6 +21,11 @@ export interface SimCognitoAccessTokenInPool {
 }
 interface SimCognitoUserPoolStoreProperties {
     readonly registry?: SimCognitoUserPoolRegistry;
+    /**
+     * Where hosted domains are indexed, so a deleted pool's domain stops
+     * resolving and its name goes back into use.
+     */
+    readonly domains?: SimCognitoDomainRegistry;
 }
 /**
  * The user pools of one simulated Cognito scope.
@@ -34,6 +40,7 @@ interface SimCognitoUserPoolStoreProperties {
 export declare class SimCognitoUserPoolStore {
     private readonly pools;
     private readonly registry;
+    private readonly domains;
     constructor(properties?: SimCognitoUserPoolStoreProperties);
     private static unexpired;
     /**
@@ -53,7 +60,10 @@ export declare class SimCognitoUserPoolStore {
      */
     add(pool: SimCognitoUserPool): void;
     /**
-     * Forget a deleted pool.
+     * Forget a deleted pool, and with it the domain it was served on.
+     *
+     * Deleting a pool takes its domain with it on real Cognito, which is what
+     * frees the domain string for another pool.
      */
     remove(pool: SimCognitoUserPool): void;
     /**

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;CAChD;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAE,iCAAsC,EAE7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAE/C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAE,iCAAsC,EAG7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CASrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js

@@ -1,4 +1,5 @@
 import { SimCognitoNotAuthorizedException, SimCognitoResourceNotFoundException, } from "../error/sim-cognito.error.js";
+import { SimCognitoDomainRegistry } from "../registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
 /**
  * The user pools of one simulated Cognito scope.
@@ -13,8 +14,10 @@ import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-re
 export class SimCognitoUserPoolStore {
     pools = new Map();
     registry;
+    domains;
     constructor(properties = {}) {
         this.registry = properties.registry ?? new SimCognitoUserPoolRegistry();
+        this.domains = properties.domains ?? new SimCognitoDomainRegistry();
     }
     static unexpired(issued, now) {
         if (issued.isExpiredAt(now)) {
@@ -46,11 +49,18 @@ export class SimCognitoUserPoolStore {
         this.registry.register(pool);
     }
     /**
-     * Forget a deleted pool.
+     * Forget a deleted pool, and with it the domain it was served on.
+     *
+     * Deleting a pool takes its domain with it on real Cognito, which is what
+     * frees the domain string for another pool.
      */
     remove(pool) {
         this.pools.delete(pool.id);
         this.registry.deregister(pool);
+        const { domain } = pool.auth;
+        if (domain !== undefined) {
+            this.domains.deregister(domain);
+        }
     }
     /**
      * Find a pool by id.

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AA2B3F;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAsC,EAAE;QAC5D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,0BAA0B,EAAE,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,MAA6B,EAC7B,GAAS;QAET,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,2BAA2B,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAoC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,cAAc,QAAQ,kBAAkB,CACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa,EAAE,GAAS;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,gCAAgC,CACxC,gCAAgC,CACjC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAiC3F;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,CAA6B;IACrC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAsC,EAAE;QAC5D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,0BAA0B,EAAE,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACtE,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,MAA6B,EAC7B,GAAS;QAET,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,2BAA2B,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAE7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAoC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,cAAc,QAAQ,kBAAkB,CACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa,EAAE,GAAS;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,gCAAgC,CACxC,gCAAgC,CACjC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts

@@ -14,5 +14,10 @@ export declare class SimCognitoAccessToken {
      * The claims this token is signed with.
      */
     claims(): SimCognitoTokenClaims;
+    /**
+     * The `scope` claim, which is a space separated list however many scopes
+     * the sign-in was granted.
+     */
+    private scope;
 }
 //# sourceMappingURL=sim-cognito-access-token.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-access-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAWvC;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;CACF"}
+{"version":3,"file":"sim-cognito-access-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAWvC;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;CASd"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js

@@ -1,10 +1,10 @@
 import { SimCognitoSharedTokenClaims, } from "./sim-cognito-token-claims.js";
 /**
- * The scope an access token from an admin authentication flow carries.
+ * The scope an access token from an authentication flow in the API carries.
  *
- * Real Cognito issues this scope for sign-in through the user pool API. The
- * scopes a resource server defines reach a token through the hosted UI and
- * client credentials flows, neither of which is simulated.
+ * Real Cognito issues this scope for sign-in through the user pool API, which
+ * asks for no scopes of its own. A sign-in through the hosted endpoints asks
+ * for scopes, and those are what its access token carries instead.
  */
 const userPoolAdminScope = "aws.cognito.signin.user.admin";
 /**
@@ -30,9 +30,20 @@ export class SimCognitoAccessToken {
             ...this.shared.build(),
             client_id: client.id,
             token_use: "access",
-            scope: userPoolAdminScope,
+            scope: this.scope(),
             username: user.username,
         };
     }
+    /**
+     * The `scope` claim, which is a space separated list however many scopes
+     * the sign-in was granted.
+     */
+    scope() {
+        const { scopes } = this.properties;
+        if (scopes === undefined) {
+            return userPoolAdminScope;
+        }
+        return scopes.join(" ");
+    }
 }
 //# sourceMappingURL=sim-cognito-access-token.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-access-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-access-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK;QACX,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.d.ts

@@ -15,6 +15,13 @@ export declare class SimCognitoIdToken {
      * The claims this token is signed with.
      */
     claims(): SimCognitoTokenClaims;
+    /**
+     * Where a federated user came from, which real Cognito reports in the id
+     * token as an array rather than as the JSON string the user attribute holds.
+     *
+     * A user of the pool's own has no such claim at all.
+     */
+    private identityClaims;
     /**
      * The user's attributes, as an id token carries them.
      *

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-id-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAGxB"}
+{"version":3,"file":"sim-cognito-id-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAW9B;IAED;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAGxB"}

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.js

@@ -22,11 +22,25 @@ export class SimCognitoIdToken {
         return {
             ...this.shared.build(),
             ...this.attributeClaims(),
+            ...this.identityClaims(),
             aud: client.id,
             token_use: "id",
             "cognito:username": user.username,
         };
     }
+    /**
+     * Where a federated user came from, which real Cognito reports in the id
+     * token as an array rather than as the JSON string the user attribute holds.
+     *
+     * A user of the pool's own has no such claim at all.
+     */
+    identityClaims() {
+        const identity = this.properties.user.identity;
+        if (identity === undefined) {
+            return {};
+        }
+        return { identities: [identity.toClaim()] };
+    }
     /**
      * The user's attributes, as an id token carries them.
      *

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-id-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,IAAI,CAAC,QAAQ;SAClC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-id-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,IAAI,CAAC,cAAc,EAAE;YACxB,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,IAAI,CAAC,QAAQ;SAClC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAE/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;CACF"}