@kensio/yulin 1.12.0 → 1.12.1

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The `/oauth2/authorize` query parameters this simulation reads.
+ *
+ * The names are the wire names rather than this repository's usual ones,
+ * because they are what an application puts in a URL and what a test asserts
+ * on.
+ *
+ * https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
+ */
+export interface SimCognitoAuthorizeInput {
+    readonly response_type?: string | undefined;
+    readonly client_id?: string | undefined;
+    readonly redirect_uri?: string | undefined;
+    readonly state?: string | undefined;
+    readonly scope?: string | undefined;
+    readonly identity_provider?: string | undefined;
+    readonly idp_identifier?: string | undefined;
+    readonly code_challenge?: string | undefined;
+    readonly code_challenge_method?: string | undefined;
+}
+/**
+ * Where a hosted endpoint sends the browser next.
+ */
+export interface SimCognitoHostedRedirect {
+    readonly location: string;
+    /** The user the redirect signed in, where one was signed in. */
+    readonly username?: string | undefined;
+}
+/**
+ * The `/oauth2/token` request fields this simulation reads.
+ *
+ * The client id and secret arrive either in the body or in a basic
+ * authorization header, and are read into the same two fields here, because
+ * which of the two a request used changes nothing about what it asked for.
+ *
+ * https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html
+ */
+export interface SimCognitoTokenInput {
+    readonly grant_type?: string | undefined;
+    readonly client_id?: string | undefined;
+    readonly client_secret?: string | undefined;
+    readonly code?: string | undefined;
+    readonly redirect_uri?: string | undefined;
+    readonly code_verifier?: string | undefined;
+    readonly refresh_token?: string | undefined;
+}
+/**
+ * What `/oauth2/token` answers a successful grant with.
+ *
+ * `id_token` is absent where the grant was made without the `openid` scope,
+ * and `refresh_token` is absent from a refresh, as both are on real Cognito.
+ */
+export interface SimCognitoTokenOutput {
+    readonly access_token: string;
+    readonly id_token?: string | undefined;
+    readonly refresh_token?: string | undefined;
+    readonly token_type: string;
+    readonly expires_in: number;
+}
+/**
+ * The `/logout` query parameters this simulation reads.
+ */
+export interface SimCognitoLogoutInput {
+    readonly client_id?: string | undefined;
+    readonly logout_uri?: string | undefined;
+    readonly redirect_uri?: string | undefined;
+    readonly state?: string | undefined;
+}
+//# sourceMappingURL=hosted-auth.command.d.ts.map

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}

package/dist/service/cognito/command/hosted/hosted-auth.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hosted-auth.command.js.map

package/dist/service/cognito/command/hosted/hosted-auth.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-auth.command.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":""}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts

@@ -0,0 +1,38 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoAuthorizeInput, SimCognitoHostedRedirect } from "./hosted-auth.command.js";
+interface SimCognitoAuthorizeEndpointProperties {
+    readonly federatedSignIn: SimCognitoFederatedSignIn;
+    readonly clock: SimClock;
+}
+/**
+ * The `/oauth2/authorize` endpoint of a pool's hosted domain.
+ *
+ * Real Cognito answers this request in one of two ways: it sends the browser
+ * to an identity provider's sign-in page when the request names a provider,
+ * and to managed login's own page when it does not. Only the first has an
+ * equivalent here, because the second is a web page a person fills in, and a
+ * simulation of a person filling it in would be a simulation of nothing.
+ *
+ * So a request naming a provider signs in the user that provider has been told
+ * is signed in at it, and answers with the code real Cognito would answer
+ * with. A request naming no provider, or naming the pool's own users, is
+ * refused with a message saying so, rather than being answered with a page or
+ * with a user nothing put there.
+ */
+export declare class SimCognitoAuthorizeEndpoint {
+    private readonly federatedSignIn;
+    private readonly clock;
+    private readonly hostedClient;
+    private readonly request;
+    constructor(properties: SimCognitoAuthorizeEndpointProperties);
+    /**
+     * Sign a user in through an identity provider, and send the browser back to
+     * the application with an authorization code.
+     */
+    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput): SimCognitoHostedRedirect;
+    private redirectWithCode;
+}
+export {};
+//# sourceMappingURL=sim-cognito-authorize-endpoint.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAqC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js

@@ -0,0 +1,72 @@
+import { SimCognitoAuthorizationCode } from "../../user-pool/auth/sim-cognito-authorization-code.js";
+import { SimCognitoAuthorizeRequest } from "./sim-cognito-authorize-request.js";
+import { SimCognitoGrantedScopes } from "./sim-cognito-granted-scopes.js";
+import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
+/**
+ * The `/oauth2/authorize` endpoint of a pool's hosted domain.
+ *
+ * Real Cognito answers this request in one of two ways: it sends the browser
+ * to an identity provider's sign-in page when the request names a provider,
+ * and to managed login's own page when it does not. Only the first has an
+ * equivalent here, because the second is a web page a person fills in, and a
+ * simulation of a person filling it in would be a simulation of nothing.
+ *
+ * So a request naming a provider signs in the user that provider has been told
+ * is signed in at it, and answers with the code real Cognito would answer
+ * with. A request naming no provider, or naming the pool's own users, is
+ * refused with a message saying so, rather than being answered with a page or
+ * with a user nothing put there.
+ */
+export class SimCognitoAuthorizeEndpoint {
+    federatedSignIn;
+    clock;
+    hostedClient = new SimCognitoHostedClient();
+    request = new SimCognitoAuthorizeRequest();
+    constructor(properties) {
+        this.federatedSignIn = properties.federatedSignIn;
+        this.clock = properties.clock;
+    }
+    /**
+     * Sign a user in through an identity provider, and send the browser back to
+     * the application with an authorization code.
+     */
+    handle(pool, input) {
+        const client = this.hostedClient.forAuthorize(pool, input.client_id);
+        const redirectUri = this.hostedClient.requiredRedirectUri(client, input.redirect_uri);
+        // Everything from here on is refused by sending the browser back to the
+        // application, because the request has shown it knows a redirect URI this
+        // app client registered.
+        this.request.requireResponseType(input.response_type);
+        this.hostedClient.requireCodeGrant(client, true);
+        this.request.requireChallengeMethod(input);
+        const scopes = new SimCognitoGrantedScopes(client, input.scope);
+        const provider = this.request.requiredProvider(pool, client, input);
+        const user = this.federatedSignIn.signIn({
+            pool,
+            provider,
+            now: this.clock.now(),
+        });
+        const code = new SimCognitoAuthorizationCode({
+            username: user.username,
+            clientId: client.id,
+            redirectUri,
+            scopes: scopes.values,
+            issuedAt: this.clock.now(),
+            codeChallenge: input.code_challenge,
+        });
+        pool.auth.addAuthorizationCode(code);
+        return {
+            location: this.redirectWithCode(redirectUri, code.value, input.state),
+            username: user.username,
+        };
+    }
+    redirectWithCode(redirectUri, code, state) {
+        const location = new URL(redirectUri);
+        location.searchParams.set("code", code);
+        if (state !== undefined) {
+            location.searchParams.set("state", state);
+        }
+        return location.href;
+    }
+}
+//# sourceMappingURL=sim-cognito-authorize-endpoint.js.map

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAGrG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAWxE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,2BAA2B;IACrB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACvC,IAAI;YACJ,QAAQ;YACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.d.ts

@@ -0,0 +1,37 @@
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPoolIdentityProvider } from "../../user-pool/idp/sim-cognito-user-pool-identity-provider.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+/**
+ * What an authorize request asked for, once it has been checked.
+ *
+ * Every check here answers by sending the browser back to the application,
+ * because by the time they run the request has shown it knows a redirect URI
+ * the app client registered. The two checks that come before that are on the
+ * endpoint itself, where the answer goes to the browser instead.
+ */
+export declare class SimCognitoAuthorizeRequest {
+    /**
+     * Refuse a response type this endpoint does not answer.
+     */
+    requireResponseType(responseType: string | undefined): void;
+    /**
+     * Check the PKCE parameters, which arrive together or not at all.
+     *
+     * Real Cognito supports the `S256` method alone, and requires each of the
+     * two parameters where the request carries the other. A method with no
+     * challenge is refused rather than answered with a code nothing has to
+     * produce a verifier for.
+     */
+    requireChallengeMethod(input: SimCognitoAuthorizeInput): void;
+    /**
+     * The identity provider this request signs the user in through.
+     *
+     * A request naming none would reach managed login on real Cognito, which is
+     * a page rather than anything an API answers, so it is refused here with a
+     * message saying what to do instead.
+     */
+    requiredProvider(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUserPoolIdentityProvider;
+    private requireSupportedProvider;
+}
+//# sourceMappingURL=sim-cognito-authorize-request.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorize-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACzH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAiBzE;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAuB1D;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CA8B5D;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,kCAAkC,CA6BpC;IAED,OAAO,CAAC,wBAAwB;CAejC"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.js

@@ -0,0 +1,123 @@
+import { SimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
+import { simCognitoCodeChallengeMethod } from "../../user-pool/auth/sim-cognito-authorization-code.js";
+/**
+ * The response type an authorization code grant asks for.
+ */
+const codeResponseType = "code";
+/**
+ * The response type the implicit grant asks for, which is not simulated.
+ */
+const tokenResponseType = "token";
+/**
+ * The provider name the pool's own users sign in under.
+ */
+const localProviderName = "COGNITO";
+/**
+ * What an authorize request asked for, once it has been checked.
+ *
+ * Every check here answers by sending the browser back to the application,
+ * because by the time they run the request has shown it knows a redirect URI
+ * the app client registered. The two checks that come before that are on the
+ * endpoint itself, where the answer goes to the browser instead.
+ */
+export class SimCognitoAuthorizeRequest {
+    /**
+     * Refuse a response type this endpoint does not answer.
+     */
+    requireResponseType(responseType) {
+        if (responseType === codeResponseType) {
+            return;
+        }
+        if (responseType === tokenResponseType) {
+            throw new SimCognitoOAuthError({
+                code: "unauthorized_client",
+                description: "response_type 'token' is the implicit grant, which is not " +
+                    "simulated: it hands tokens to the browser, and AWS advises the " +
+                    "authorization code grant instead",
+                redirectable: true,
+            });
+        }
+        throw new SimCognitoOAuthError({
+            code: "unsupported_response_type",
+            description: `response_type '${String(responseType)}' is not a response type: an ` +
+                `authorization code grant asks for '${codeResponseType}'`,
+            redirectable: true,
+        });
+    }
+    /**
+     * Check the PKCE parameters, which arrive together or not at all.
+     *
+     * Real Cognito supports the `S256` method alone, and requires each of the
+     * two parameters where the request carries the other. A method with no
+     * challenge is refused rather than answered with a code nothing has to
+     * produce a verifier for.
+     */
+    requireChallengeMethod(input) {
+        if (input.code_challenge === undefined &&
+            input.code_challenge_method === undefined) {
+            return;
+        }
+        if (input.code_challenge === undefined) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_request",
+                description: "code_challenge is required alongside a code_challenge_method: a " +
+                    "grant made without the challenge would be redeemed without the " +
+                    "verifier, which is what PKCE is for",
+                redirectable: true,
+            });
+        }
+        if (input.code_challenge_method !== simCognitoCodeChallengeMethod) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_request",
+                description: `code_challenge_method '${String(input.code_challenge_method)}' is ` +
+                    `not supported: Cognito supports ` +
+                    `'${simCognitoCodeChallengeMethod}' alone, and a code_challenge ` +
+                    `needs one`,
+                redirectable: true,
+            });
+        }
+    }
+    /**
+     * The identity provider this request signs the user in through.
+     *
+     * A request naming none would reach managed login on real Cognito, which is
+     * a page rather than anything an API answers, so it is refused here with a
+     * message saying what to do instead.
+     */
+    requiredProvider(pool, client, input) {
+        const named = input.identity_provider ?? input.idp_identifier;
+        if (named === undefined || named === localProviderName) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_request",
+                description: "This request would reach managed login, which is a sign-in page " +
+                    "rather than anything this simulation can answer. Name an " +
+                    "identity_provider to sign in through, or sign the pool's own " +
+                    "users in with InitiateAuth or AdminInitiateAuth.",
+                redirectable: false,
+            });
+        }
+        const providers = pool.auth.identityProviders;
+        const provider = providers.find(named) ?? providers.findByIdentifier(named);
+        if (provider === undefined) {
+            throw new SimCognitoOAuthError({
+                code: "invalid_request",
+                description: `User pool ${pool.id} has no identity provider ${named}`,
+                redirectable: true,
+            });
+        }
+        this.requireSupportedProvider(client, provider);
+        return provider;
+    }
+    requireSupportedProvider(client, provider) {
+        if (!client.oauth.allowsIdentityProvider(provider.name)) {
+            throw new SimCognitoOAuthError({
+                code: "unauthorized_client",
+                description: `App client ${client.id} does not support the ${provider.name} ` +
+                    `identity provider: add it to the client's ` +
+                    `SupportedIdentityProviders`,
+                redirectable: true,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-authorize-request.js.map

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorize-request.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AAMvG;;GAEG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;GAEG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,YAAY,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,4DAA4D;oBAC5D,iEAAiE;oBACjE,kCAAkC;gBACpC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,2BAA2B;YACjC,WAAW,EACT,kBAAkB,MAAM,CAAC,YAAY,CAAC,+BAA+B;gBACrE,sCAAsC,gBAAgB,GAAG;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAA+B;QACpD,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,KAAK,CAAC,qBAAqB,KAAK,SAAS,EACzC,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,iEAAiE;oBACjE,qCAAqC;gBACvC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,6BAA6B,EAAE,CAAC;YAClE,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,0BAA0B,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO;oBACpE,kCAAkC;oBAClC,IAAI,6BAA6B,gCAAgC;oBACjE,WAAW;gBACb,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,cAAc,CAAC;QAE9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACvD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,2DAA2D;oBAC3D,+DAA+D;oBAC/D,kDAAkD;gBACpD,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAE5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,aAAa,IAAI,CAAC,EAAE,6BAA6B,KAAK,EAAE;gBACrE,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEhD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,wBAAwB,CAC9B,MAAgC,EAChC,QAA4C;QAE5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,cAAc,MAAM,CAAC,EAAE,yBAAyB,QAAQ,CAAC,IAAI,GAAG;oBAChE,4CAA4C;oBAC5C,4BAA4B;gBAC9B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-granted-scopes.d.ts

@@ -0,0 +1,16 @@
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+/**
+ * What scopes a hosted sign-in was granted.
+ *
+ * A request asking for nothing is granted everything its app client allows,
+ * which is what real Cognito does. A request asking for a scope its client
+ * does not allow is refused rather than quietly granted less than it asked
+ * for, because an application holding a token without the scope it asked for
+ * fails later and further away.
+ */
+export declare class SimCognitoGrantedScopes {
+    readonly values: readonly string[];
+    constructor(client: SimCognitoUserPoolClient, requested: string | undefined);
+    private static granted;
+}
+//# sourceMappingURL=sim-cognito-granted-scopes.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-granted-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-granted-scopes.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-granted-scopes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAEvG;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IAClC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAE1E;IAED,OAAO,CAAC,MAAM,CAAC,OAAO;CAwBvB"}

package/dist/service/cognito/command/hosted/sim-cognito-granted-scopes.js

@@ -0,0 +1,34 @@
+import { SimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
+/**
+ * What scopes a hosted sign-in was granted.
+ *
+ * A request asking for nothing is granted everything its app client allows,
+ * which is what real Cognito does. A request asking for a scope its client
+ * does not allow is refused rather than quietly granted less than it asked
+ * for, because an application holding a token without the scope it asked for
+ * fails later and further away.
+ */
+export class SimCognitoGrantedScopes {
+    values;
+    constructor(client, requested) {
+        this.values = SimCognitoGrantedScopes.granted(client, requested);
+    }
+    static granted(client, requested) {
+        if (requested === undefined || requested === "") {
+            return client.oauth.scopes;
+        }
+        const asked = requested.split(" ").filter((scope) => scope !== "");
+        for (const scope of asked) {
+            if (!client.oauth.scopes.includes(scope)) {
+                throw new SimCognitoOAuthError({
+                    code: "invalid_scope",
+                    description: `scope '${scope}' is not one of app client ${client.id}'s ` +
+                        `AllowedOAuthScopes`,
+                    redirectable: true,
+                });
+            }
+        }
+        return asked;
+    }
+}
+//# sourceMappingURL=sim-cognito-granted-scopes.js.map

package/dist/service/cognito/command/hosted/sim-cognito-granted-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-granted-scopes.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-granted-scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAG9E;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAuB;IAClB,MAAM,CAAoB;IAE1C,YAAY,MAAgC,EAAE,SAA6B;QACzE,IAAI,CAAC,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAEO,MAAM,CAAC,OAAO,CACpB,MAAgC,EAChC,SAA6B;QAE7B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,oBAAoB,CAAC;oBAC7B,IAAI,EAAE,eAAe;oBACrB,WAAW,EACT,UAAU,KAAK,8BAA8B,MAAM,CAAC,EAAE,KAAK;wBAC3D,oBAAoB;oBACtB,YAAY,EAAE,IAAI;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-granted-tokens.d.ts

@@ -0,0 +1,16 @@
+import type { SimCognitoIssuedTokens } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoTokenOutput } from "./hosted-auth.command.js";
+/**
+ * What the token endpoint answers a completed grant with.
+ *
+ * An id token comes back only where the grant was made with the `openid`
+ * scope, as it does on real Cognito, and a refresh token only where the grant
+ * issued one: a refresh answers with none.
+ */
+export declare class SimCognitoGrantedTokens {
+    /**
+     * The answer to a completed grant.
+     */
+    body(issued: SimCognitoIssuedTokens, scopes: readonly string[]): SimCognitoTokenOutput;
+}
+//# sourceMappingURL=sim-cognito-granted-tokens.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-granted-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-granted-tokens.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-granted-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAYtE;;;;;;GAMG;AACH,qBAAa,uBAAuB;IAClC;;OAEG;IACH,IAAI,CACF,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,qBAAqB,CAUvB;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-granted-tokens.js

@@ -0,0 +1,32 @@
+/**
+ * The token type every OAuth 2.0 bearer token is.
+ */
+const bearerTokenType = "Bearer";
+/**
+ * The scope that makes a grant carry an id token.
+ */
+const openIdScope = "openid";
+/**
+ * What the token endpoint answers a completed grant with.
+ *
+ * An id token comes back only where the grant was made with the `openid`
+ * scope, as it does on real Cognito, and a refresh token only where the grant
+ * issued one: a refresh answers with none.
+ */
+export class SimCognitoGrantedTokens {
+    /**
+     * The answer to a completed grant.
+     */
+    body(issued, scopes) {
+        return {
+            access_token: issued.accessToken,
+            ...(scopes.includes(openIdScope) && { id_token: issued.idToken }),
+            ...(issued.refreshToken !== undefined && {
+                refresh_token: issued.refreshToken,
+            }),
+            token_type: bearerTokenType,
+            expires_in: issued.expiresIn,
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-granted-tokens.js.map

package/dist/service/cognito/command/hosted/sim-cognito-granted-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-granted-tokens.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-granted-tokens.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC;;GAEG;AACH,MAAM,WAAW,GAAG,QAAQ,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACH,IAAI,CACF,MAA8B,EAC9B,MAAyB;QAEzB,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;gBACvC,aAAa,EAAE,MAAM,CAAC,YAAY;aACnC,CAAC;YACF,UAAU,EAAE,eAAe;YAC3B,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-client.d.ts

@@ -0,0 +1,49 @@
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+/**
+ * Resolves the app client a request to a hosted endpoint names.
+ *
+ * The two endpoints refuse an unknown client differently, because they are
+ * answering different callers: the authorize endpoint is answering a browser
+ * and says the request was bad, and the token endpoint is answering an
+ * application and says its client authentication failed.
+ */
+export declare class SimCognitoHostedClient {
+    /**
+     * The app client an authorize request names, or a refusal the browser sees.
+     *
+     * Nothing is redirected here. The request has not yet shown that it knows a
+     * redirect URI this client registered, so sending the error to the URI it
+     * asked for would send it anywhere it liked.
+     */
+    forAuthorize(pool: SimCognitoUserPool, clientId: string | undefined): SimCognitoUserPoolClient;
+    /**
+     * The app client a token request names, having authenticated it.
+     *
+     * A client with a secret has to present it, either in the body or in a basic
+     * authorization header. A public client has none to present, and presenting
+     * one for it fails rather than being ignored: the request believes it is
+     * talking to a client that does not exist.
+     */
+    forToken(pool: SimCognitoUserPool, clientId: string | undefined, clientSecret: string | undefined): SimCognitoUserPoolClient;
+    /**
+     * The URI the browser is sent back to.
+     *
+     * A request naming none is sent to the app client's `DefaultRedirectURI`,
+     * which is what real Cognito falls back to. One naming a URI the client did
+     * not register is refused without redirecting anywhere, because that URI is
+     * exactly what cannot be trusted.
+     */
+    requiredRedirectUri(client: SimCognitoUserPoolClient, requested: string | undefined): string;
+    /**
+     * Refuse a client that cannot complete an authorization code grant.
+     *
+     * A client is only an authorization server client once
+     * `AllowedOAuthFlowsUserPoolClient` is true and `code` is among its
+     * `AllowedOAuthFlows`, so one configured for the API alone is refused at the
+     * hosted endpoints, as it is on real Cognito.
+     */
+    requireCodeGrant(client: SimCognitoUserPoolClient, redirectable: boolean): void;
+    private find;
+}
+//# sourceMappingURL=sim-cognito-hosted-client.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-client.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC;;;;;;OAMG;IACH,YAAY,CACV,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,wBAAwB,CAc1B;IAED;;;;;;;OAOG;IACH,QAAQ,CACN,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,wBAAwB,CAc1B;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,CAiBR;IAED;;;;;;;OAOG;IACH,gBAAgB,CACd,MAAM,EAAE,wBAAwB,EAChC,YAAY,EAAE,OAAO,GACpB,IAAI,CAaN;IAED,OAAO,CAAC,IAAI;CAUb"}