@kensio/yulin 1.12.0 → 1.13.0

package/dist/service/cognito/serve/sim-cognito-controller.js

@@ -1,4 +1,5 @@
 import { SimAws } from "../../aws/sim-aws.js";
+import { SimCognitoDomainController } from "./sim-cognito-domain-controller.js";
 import { SimCognitoEndpointResponse } from "./sim-cognito-endpoint-response.js";
 import { SimCognitoOpenIdConfiguration } from "./sim-cognito-openid-configuration.js";
 /**
@@ -36,6 +37,10 @@ const readMethods = new Set(["GET", "HEAD"]);
  * Cognito serves nothing at. Nothing here delivers a message, so this is where
  * one is read during local development.
  *
+ * A pool's hosted domain is served too, on its own hostname rather than on the
+ * regional endpoint, and `SimCognitoDomainController` answers those requests.
+ * That is where the OAuth endpoints of an authorization code grant live.
+ *
  * The Cognito API itself is not served. An SDK client reaches the simulator
  * through `SimSdk` rather than through an endpoint override.
  */
@@ -43,15 +48,20 @@ export class SimCognitoServiceController {
     simAws;
     openIdConfiguration = new SimCognitoOpenIdConfiguration();
     response = new SimCognitoEndpointResponse();
+    domainController;
     constructor(properties = {}) {
         const { simAws = new SimAws() } = properties;
         this.simAws = simAws;
+        this.domainController = new SimCognitoDomainController({ simAws });
     }
     /**
      * Handle an HTTP request routed to a simulated Cognito regional endpoint.
      */
-    handleRequest(serviceRequest) {
-        return Promise.resolve(this.respond(serviceRequest));
+    async handleRequest(serviceRequest) {
+        // A request that reached a hosted domain's hostname names that domain,
+        // where one to the regional endpoint names no resource at all.
+        const domainResponse = await this.domainController.handleRequest(serviceRequest);
+        return domainResponse ?? this.respond(serviceRequest);
     }
     respond(serviceRequest) {
         const { request } = serviceRequest;

package/dist/service/cognito/serve/sim-cognito-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAEtF;;GAEG;AACH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAgB7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAS;IACf,mBAAmB,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC1D,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE7D,YAAY,UAAU,GAA0C,EAAE;QAChE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,cAAoC;QAChD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD,CAAC;IAEO,OAAO,CAAC,cAAoC;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,6DAA6D;QAC7D,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ;aAC1D,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,GAAG,CAAC,CAAC;QAEd,IACE,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,OAAO,KAAK,SAAS;YACrB,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,MAAM,GAAG,CAAC,EACf,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACvB,OAAO;YACP,QAAQ;YACR,GAAG;YACH,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,IAAwB,EACxB,OAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEnD,wEAAwE;QACxE,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,OAAO,KAAK,eAAe,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EACtE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EACnD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACK,UAAU,CAChB,UAAkB,EAClB,MAA2B;QAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAEtF;;GAEG;AACH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAgB7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAS;IACf,mBAAmB,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC1D,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,GAA0C,EAAE;QAChE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAEO,OAAO,CAAC,cAAoC;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,6DAA6D;QAC7D,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ;aAC1D,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,GAAG,CAAC,CAAC;QAEd,IACE,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,OAAO,KAAK,SAAS;YACrB,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,MAAM,GAAG,CAAC,EACf,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACvB,OAAO;YACP,QAAQ;YACR,GAAG;YACH,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,IAAwB,EACxB,OAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEnD,wEAAwE;QACxE,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,OAAO,KAAK,eAAe,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EACtE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EACnD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACK,UAAU,CAChB,UAAkB,EAClB,MAA2B;QAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-domain-controller.d.ts

@@ -0,0 +1,48 @@
+import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import type { SimAws } from "../../aws/sim-aws.js";
+interface SimCognitoDomainControllerProperties {
+    readonly simAws: SimAws;
+}
+/**
+ * The localhost HTTP side of a pool's hosted domain.
+ *
+ * These are the endpoints a browser and an application's own server reach, and
+ * they carry no AWS credentials at all: an authorization code grant is signed
+ * by nobody, in the same way `InitiateAuth` is. What authenticates the
+ * application is its app client secret, at the token endpoint.
+ *
+ * The pool's own scope answers each request, found from the domain rather than
+ * assumed to be the default one, because a domain names a pool that any
+ * Account and Region of the simulation could have created.
+ */
+export declare class SimCognitoDomainController {
+    private readonly simAws;
+    private readonly endpoints;
+    constructor(properties: SimCognitoDomainControllerProperties);
+    /**
+     * Handle a request that reached a hosted domain's hostname, or answer
+     * nothing for one that named no domain at all.
+     *
+     * A request to the regional endpoint names no resource, and that is what
+     * tells the two apart.
+     */
+    handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response | undefined>;
+    /**
+     * The hosted domain a request arrived at, if it arrived at one.
+     */
+    private servedDomain;
+    /**
+     * The pool a hosted domain belongs to.
+     */
+    private pool;
+    /**
+     * The simulated Cognito scope that owns a pool.
+     *
+     * The Account comes from the pool's ARN and the Region from its id, and each
+     * scope's services are made once and kept, so this is the same service
+     * object that created the pool rather than another view of it.
+     */
+    private cognitoFor;
+}
+export {};
+//# sourceMappingURL=sim-cognito-domain-controller.d.ts.map

package/dist/service/cognito/serve/sim-cognito-domain-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-domain-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-controller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAOnD,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAE7D,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;;;;OAMG;IACG,aAAa,CACjB,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAgB/B;IAED;;OAEG;IACH,OAAO,CAAC,YAAY;IAcpB;;OAEG;IACH,OAAO,CAAC,IAAI;IAaZ;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;CAMnB"}

package/dist/service/cognito/serve/sim-cognito-domain-controller.js

@@ -0,0 +1,79 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { simCognitoUserPoolRegionName } from "../user-pool/sim-cognito-user-pool-id.js";
+import { SimCognitoDomainEndpoints } from "./sim-cognito-domain-endpoints.js";
+/**
+ * The localhost HTTP side of a pool's hosted domain.
+ *
+ * These are the endpoints a browser and an application's own server reach, and
+ * they carry no AWS credentials at all: an authorization code grant is signed
+ * by nobody, in the same way `InitiateAuth` is. What authenticates the
+ * application is its app client secret, at the token endpoint.
+ *
+ * The pool's own scope answers each request, found from the domain rather than
+ * assumed to be the default one, because a domain names a pool that any
+ * Account and Region of the simulation could have created.
+ */
+export class SimCognitoDomainController {
+    simAws;
+    endpoints = new SimCognitoDomainEndpoints();
+    constructor(properties) {
+        this.simAws = properties.simAws;
+    }
+    /**
+     * Handle a request that reached a hosted domain's hostname, or answer
+     * nothing for one that named no domain at all.
+     *
+     * A request to the regional endpoint names no resource, and that is what
+     * tells the two apart.
+     */
+    async handleRequest(serviceRequest) {
+        const domain = this.servedDomain(serviceRequest);
+        if (domain === undefined) {
+            return undefined;
+        }
+        const url = new URL(serviceRequest.request.url);
+        const pool = this.pool(domain);
+        return await this.endpoints.handleRequest({
+            pool,
+            cognito: this.cognitoFor(pool),
+            serviceRequest,
+            url,
+        });
+    }
+    /**
+     * The hosted domain a request arrived at, if it arrived at one.
+     */
+    servedDomain(serviceRequest) {
+        const { resourceName } = serviceRequest.target;
+        if (resourceName === "") {
+            return undefined;
+        }
+        return this.simAws
+            .cognitoIdentityProvider()
+            .findUserPoolDomainInAnyAccount(resourceName);
+    }
+    /**
+     * The pool a hosted domain belongs to.
+     */
+    pool(domain) {
+        const pool = this.simAws
+            .cognitoIdentityProvider()
+            .findUserPoolInAnyAccount(domain.userPoolId);
+        assertDefined(pool, `sim Cognito user pool ${domain.userPoolId} for domain ${domain.value}`);
+        return pool;
+    }
+    /**
+     * The simulated Cognito scope that owns a pool.
+     *
+     * The Account comes from the pool's ARN and the Region from its id, and each
+     * scope's services are made once and kept, so this is the same service
+     * object that created the pool rather than another view of it.
+     */
+    cognitoFor(pool) {
+        return this.simAws
+            .account(pool.arn.accountId)
+            .region(simCognitoUserPoolRegionName(pool.id))
+            .cognitoIdentityProvider();
+    }
+}
+//# sourceMappingURL=sim-cognito-domain-controller.js.map

package/dist/service/cognito/serve/sim-cognito-domain-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-domain-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAM9E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,0BAA0B;IACpB,MAAM,CAAS;IACf,SAAS,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAE7D,YAAY,UAAgD;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,cAAoC;QAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/B,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YACxC,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC9B,cAAc;YACd,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,cAAoC;QAEpC,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC;QAE/C,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,uBAAuB,EAAE;aACzB,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACK,IAAI,CAAC,MAAgC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/C,aAAa,CACX,IAAI,EACJ,yBAAyB,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,KAAK,EAAE,CACxE,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,IAAwB;QACzC,OAAO,IAAI,CAAC,MAAM;aACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;aAC3B,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAkB,CAAC;aAC9D,uBAAuB,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.d.ts

@@ -0,0 +1,49 @@
+import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import type { SimCognitoIdentityProvider } from "../sim-cognito-identity-provider.js";
+import type { SimCognitoUserPool } from "../user-pool/sim-cognito-user-pool.js";
+/**
+ * One request to a hosted domain, and what answers it.
+ */
+export interface SimCognitoDomainRequest {
+    readonly pool: SimCognitoUserPool;
+    /** The simulated Cognito scope the pool belongs to. */
+    readonly cognito: SimCognitoIdentityProvider;
+    readonly serviceRequest: SimAwsServiceRequest;
+    readonly url: URL;
+}
+/**
+ * The three endpoints a pool's hosted domain serves.
+ *
+ * Each takes one HTTP method and one only, as real Cognito's do, and turns
+ * what the simulation answered into the redirect or the JSON body a browser or
+ * an application's own server reads.
+ */
+export declare class SimCognitoDomainEndpoints {
+    private readonly response;
+    private readonly tokenRequest;
+    /**
+     * Answer a request that reached the domain's hostname.
+     */
+    handleRequest(request: SimCognitoDomainRequest): Promise<Response>;
+    /**
+     * Sign a user in through an identity provider and send the browser back to
+     * the application with a code.
+     */
+    private authorize;
+    /**
+     * Exchange an authorization code or a refresh token for tokens.
+     */
+    private token;
+    /**
+     * Send the browser to the application's sign-out page.
+     */
+    private logout;
+    /**
+     * Answer a request that used the method its endpoint takes.
+     *
+     * Each endpoint takes one method and one only, as real Cognito's do, so what
+     * is left to say about any other is which one it was.
+     */
+    private answered;
+}
+//# sourceMappingURL=sim-cognito-domain-endpoints.d.ts.map

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-domain-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAWhF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAElC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;CACnB;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAE7D;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgBvE;IAED;;;OAGG;YACW,SAAS;IAkBvB;;OAEG;YACW,KAAK;IAenB;;OAEG;YACW,MAAM;IAcpB;;;;;OAKG;YACW,QAAQ;CAavB"}

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.js

@@ -0,0 +1,91 @@
+import { SimCognitoOAuthResponse } from "./sim-cognito-oauth-response.js";
+import { SimCognitoTokenRequest } from "./sim-cognito-token-request.js";
+/**
+ * The paths a hosted domain serves.
+ */
+const authorizePath = "/oauth2/authorize";
+const tokenPath = "/oauth2/token";
+const logoutPath = "/logout";
+/**
+ * The three endpoints a pool's hosted domain serves.
+ *
+ * Each takes one HTTP method and one only, as real Cognito's do, and turns
+ * what the simulation answered into the redirect or the JSON body a browser or
+ * an application's own server reads.
+ */
+export class SimCognitoDomainEndpoints {
+    response = new SimCognitoOAuthResponse();
+    tokenRequest = new SimCognitoTokenRequest();
+    /**
+     * Answer a request that reached the domain's hostname.
+     */
+    async handleRequest(request) {
+        const { pathname } = request.url;
+        if (pathname === authorizePath) {
+            return await this.authorize(request);
+        }
+        if (pathname === tokenPath) {
+            return await this.token(request);
+        }
+        if (pathname === logoutPath) {
+            return await this.logout(request);
+        }
+        return this.response.noSuchEndpoint(pathname);
+    }
+    /**
+     * Sign a user in through an identity provider and send the browser back to
+     * the application with a code.
+     */
+    async authorize(request) {
+        const parameters = Object.fromEntries(request.url.searchParams);
+        return await this.answered(request, "GET", async () => {
+            try {
+                return this.response.redirect(await request.cognito.hostedAuthorize(request.pool, parameters));
+            }
+            catch (error) {
+                return this.response.refusedRedirect(error, parameters["redirect_uri"], parameters["state"]);
+            }
+        });
+    }
+    /**
+     * Exchange an authorization code or a refresh token for tokens.
+     */
+    async token(request) {
+        return await this.answered(request, "POST", async () => {
+            try {
+                return this.response.tokens(await request.cognito.hostedToken(request.pool, this.tokenRequest.read(request.serviceRequest)));
+            }
+            catch (error) {
+                return this.response.refusedRequest(error);
+            }
+        });
+    }
+    /**
+     * Send the browser to the application's sign-out page.
+     */
+    async logout(request) {
+        const parameters = Object.fromEntries(request.url.searchParams);
+        return await this.answered(request, "GET", async () => {
+            try {
+                return this.response.redirect(await request.cognito.hostedSignOut(request.pool, parameters));
+            }
+            catch (error) {
+                return this.response.refusedRequest(error);
+            }
+        });
+    }
+    /**
+     * Answer a request that used the method its endpoint takes.
+     *
+     * Each endpoint takes one method and one only, as real Cognito's do, so what
+     * is left to say about any other is which one it was.
+     */
+    async answered(request, method, answer) {
+        const requested = request.serviceRequest.request.method;
+        if (requested !== method) {
+            return this.response.notAllowed(requested, method);
+        }
+        return await answer();
+    }
+}
+//# sourceMappingURL=sim-cognito-domain-endpoints.js.map

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-domain-endpoints.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,UAAU,GAAG,SAAS,CAAC;AAc7B;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACzC,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAE7D;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgC;QAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QAEjC,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS,CAAC,OAAgC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAChE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAClC,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,EAC1B,UAAU,CAAC,OAAO,CAAC,CACpB,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CAAC,OAAgC;QAClD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CACzB,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAC/B,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAC/C,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAAC,OAAgC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAC9D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CACpB,OAAgC,EAChC,MAAc,EACd,MAA+B;QAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;QAExD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-oauth-response.d.ts

@@ -0,0 +1,57 @@
+import type { SimCognitoHostedRedirect } from "../command/hosted/hosted-auth.command.js";
+/**
+ * The responses a pool's hosted OAuth endpoints answer with.
+ *
+ * A hosted endpoint is answering a browser rather than an SDK client, so its
+ * successes are redirects and its failures are either a redirect carrying an
+ * error or a JSON body, which is the difference between an error the
+ * application can be told about and one only the person in front of the
+ * browser can see.
+ */
+export declare class SimCognitoOAuthResponse {
+    /**
+     * Read an error as an OAuth one, whatever it turned out to be.
+     *
+     * A refusal from further inside the simulation, such as an identity provider
+     * with nobody signed in at it, is a server error to OAuth and its own
+     * message to the reader, so the message is kept rather than replaced.
+     */
+    private static oauthError;
+    private static describe;
+    /**
+     * Send the browser on to where an endpoint decided it goes.
+     */
+    redirect(redirect: SimCognitoHostedRedirect): Response;
+    /**
+     * Answer a token request with the tokens it asked for.
+     *
+     * The `Access-Control-Allow-Origin` header is the one real Cognito sets on
+     * this endpoint, so a browser-based application completing a grant with PKCE
+     * can read the answer.
+     */
+    tokens(body: object): Response;
+    /**
+     * Answer a refused request to the authorize or logout endpoint.
+     *
+     * An error is sent back to the application's own URL where the request has
+     * shown it knows one the app client registered, which is what real Cognito
+     * does. Anything else is answered in the browser, because there is nowhere
+     * trustworthy to send it.
+     */
+    refusedRedirect(error: unknown, redirectUri: string | undefined, state: string | undefined): Response;
+    /**
+     * Answer a refused request in the shape the OAuth 2.0 specification gives an
+     * error, which is what the token endpoint answers with and what a client
+     * library reads.
+     */
+    refusedRequest(error: unknown): Response;
+    /**
+     * Refuse a path the hosted domain serves nothing at.
+     */
+    noSuchEndpoint(pathname: string): Response;
+    /**
+     * Refuse a method an endpoint does not answer.
+     */
+    notAllowed(method: string, allowed: string): Response;
+}
+//# sourceMappingURL=sim-cognito-oauth-response.d.ts.map

package/dist/service/cognito/serve/sim-cognito-oauth-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-response.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-oauth-response.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAEzF;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IAClC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;IAYzB,OAAO,CAAC,MAAM,CAAC,QAAQ;IAQvB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,GAAG,QAAQ,CAKrD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAQ7B;IAED;;;;;;;OAOG;IACH,eAAe,CACb,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,QAAQ,CAoBV;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAOvC;IAED;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAUzC;IAED;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAQpD;CACF"}

package/dist/service/cognito/serve/sim-cognito-oauth-response.js

@@ -0,0 +1,113 @@
+import { isSimCognitoOAuthError, SimCognitoOAuthError, } from "../error/sim-cognito-oauth.error.js";
+/**
+ * The responses a pool's hosted OAuth endpoints answer with.
+ *
+ * A hosted endpoint is answering a browser rather than an SDK client, so its
+ * successes are redirects and its failures are either a redirect carrying an
+ * error or a JSON body, which is the difference between an error the
+ * application can be told about and one only the person in front of the
+ * browser can see.
+ */
+export class SimCognitoOAuthResponse {
+    /**
+     * Read an error as an OAuth one, whatever it turned out to be.
+     *
+     * A refusal from further inside the simulation, such as an identity provider
+     * with nobody signed in at it, is a server error to OAuth and its own
+     * message to the reader, so the message is kept rather than replaced.
+     */
+    static oauthError(error) {
+        if (isSimCognitoOAuthError(error)) {
+            return error;
+        }
+        return new SimCognitoOAuthError({
+            code: "invalid_request",
+            description: this.describe(error),
+            redirectable: false,
+        });
+    }
+    static describe(error) {
+        if (error instanceof Error) {
+            return error.message;
+        }
+        return "The request was refused";
+    }
+    /**
+     * Send the browser on to where an endpoint decided it goes.
+     */
+    redirect(redirect) {
+        return new Response(undefined, {
+            status: 302,
+            headers: { location: redirect.location },
+        });
+    }
+    /**
+     * Answer a token request with the tokens it asked for.
+     *
+     * The `Access-Control-Allow-Origin` header is the one real Cognito sets on
+     * this endpoint, so a browser-based application completing a grant with PKCE
+     * can read the answer.
+     */
+    tokens(body) {
+        return Response.json(body, {
+            status: 200,
+            headers: {
+                "cache-control": "no-store",
+                "access-control-allow-origin": "*",
+            },
+        });
+    }
+    /**
+     * Answer a refused request to the authorize or logout endpoint.
+     *
+     * An error is sent back to the application's own URL where the request has
+     * shown it knows one the app client registered, which is what real Cognito
+     * does. Anything else is answered in the browser, because there is nowhere
+     * trustworthy to send it.
+     */
+    refusedRedirect(error, redirectUri, state) {
+        const oauthError = SimCognitoOAuthResponse.oauthError(error);
+        if (redirectUri === undefined || !oauthError.redirectable) {
+            return this.refusedRequest(oauthError);
+        }
+        const location = new URL(redirectUri);
+        location.searchParams.set("error", oauthError.code);
+        location.searchParams.set("error_description", oauthError.description);
+        if (state !== undefined) {
+            location.searchParams.set("state", state);
+        }
+        return new Response(undefined, {
+            status: 302,
+            headers: { location: location.href },
+        });
+    }
+    /**
+     * Answer a refused request in the shape the OAuth 2.0 specification gives an
+     * error, which is what the token endpoint answers with and what a client
+     * library reads.
+     */
+    refusedRequest(error) {
+        const oauthError = SimCognitoOAuthResponse.oauthError(error);
+        return Response.json({ error: oauthError.code, error_description: oauthError.description }, { status: 400 });
+    }
+    /**
+     * Refuse a path the hosted domain serves nothing at.
+     */
+    noSuchEndpoint(pathname) {
+        return Response.json({
+            error: "invalid_request",
+            error_description: `A simulated user pool domain serves nothing at ${pathname}. It ` +
+                `serves /oauth2/authorize, /oauth2/token and /logout.`,
+        }, { status: 404 });
+    }
+    /**
+     * Refuse a method an endpoint does not answer.
+     */
+    notAllowed(method, allowed) {
+        return Response.json({
+            error: "invalid_request",
+            error_description: `This endpoint answers ${allowed}, not ${method}`,
+        }, { status: 405, headers: { allow: allowed } });
+    }
+}
+//# sourceMappingURL=sim-cognito-oauth-response.js.map

package/dist/service/cognito/serve/sim-cognito-oauth-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-response.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-oauth-response.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAG7C;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAuB;IAClC;;;;;;OAMG;IACK,MAAM,CAAC,UAAU,CAAC,KAAc;QACtC,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,oBAAoB,CAAC;YAC9B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,KAAc;QACpC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAkC;QACzC,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAY;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;YACzB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU;gBAC3B,6BAA6B,EAAE,GAAG;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,KAAc,EACd,WAA+B,EAC/B,KAAyB;QAEzB,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7D,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAEvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAc;QAC3B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7D,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,iBAAiB,EAAE,UAAU,CAAC,WAAW,EAAE,EACrE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAAgB;QAC7B,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EACf,kDAAkD,QAAQ,OAAO;gBACjE,sDAAsD;SACzD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAc,EAAE,OAAe;QACxC,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,yBAAyB,OAAO,SAAS,MAAM,EAAE;SACrE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-openid-configuration.d.ts

@@ -6,6 +6,9 @@ import type { SimCognitoUserPool } from "../user-pool/sim-cognito-user-pool.js";
 export interface SimCognitoOpenIdConfigurationDocument {
     readonly issuer: string;
     readonly jwks_uri: string;
+    readonly authorization_endpoint?: string | undefined;
+    readonly token_endpoint?: string | undefined;
+    readonly end_session_endpoint?: string | undefined;
     readonly id_token_signing_alg_values_supported: readonly string[];
     readonly response_types_supported: readonly string[];
     readonly scopes_supported: readonly string[];
@@ -22,15 +25,23 @@ export interface SimCognitoOpenIdConfigurationDocument {
  * in `iss`, which is what a verifier builds from a pool id and checks against,
  * so the two disagree here and agree on real Cognito.
  *
- * No `authorization_endpoint`, `token_endpoint` or `userinfo_endpoint` is
- * published, because the hosted UI and the OAuth endpoints are not simulated.
- * A client discovering nothing there fails rather than calling an endpoint
- * that would not answer.
+ * The OAuth endpoints are published once the pool has a domain, and left out
+ * until then, because until then they do not exist. They name the domain's own
+ * local hostname for the same reason the issuer names the local one: a client
+ * that discovers an endpoint has to be able to reach it.
+ *
+ * No `userinfo_endpoint` is published, because that endpoint is not
+ * simulated. A client discovering nothing there fails rather than calling an
+ * endpoint that would not answer.
  */
 export declare class SimCognitoOpenIdConfiguration {
     /**
      * The discovery document for a pool, as served from an origin.
      */
     document(pool: SimCognitoUserPool, origin: string): SimCognitoOpenIdConfigurationDocument;
+    /**
+     * The endpoints a pool's hosted domain serves, for a pool that has one.
+     */
+    private hostedEndpoints;
 }
 //# sourceMappingURL=sim-cognito-openid-configuration.d.ts.map

package/dist/service/cognito/serve/sim-cognito-openid-configuration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-openid-configuration.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-openid-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,qCAAqC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClE,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,qCAAqC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnE;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,QAAQ,CACN,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,MAAM,GACb,qCAAqC,CAevC;CACF"}
+{"version":3,"file":"sim-cognito-openid-configuration.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-openid-configuration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,qCAAqC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClE,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,qCAAqC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,QAAQ,CACN,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,MAAM,GACb,qCAAqC,CAgBvC;IAED;;OAEG;IACH,OAAO,CAAC,eAAe;CAqBxB"}

package/dist/service/cognito/serve/sim-cognito-openid-configuration.js

@@ -1,3 +1,4 @@
+import { SimAwsLocalUrl } from "../../../serve/http/url/sim-aws-local-url.js";
 /**
  * Builds the discovery document a simulated user pool publishes.
  *
@@ -8,10 +9,14 @@
  * in `iss`, which is what a verifier builds from a pool id and checks against,
  * so the two disagree here and agree on real Cognito.
  *
- * No `authorization_endpoint`, `token_endpoint` or `userinfo_endpoint` is
- * published, because the hosted UI and the OAuth endpoints are not simulated.
- * A client discovering nothing there fails rather than calling an endpoint
- * that would not answer.
+ * The OAuth endpoints are published once the pool has a domain, and left out
+ * until then, because until then they do not exist. They name the domain's own
+ * local hostname for the same reason the issuer names the local one: a client
+ * that discovers an endpoint has to be able to reach it.
+ *
+ * No `userinfo_endpoint` is published, because that endpoint is not
+ * simulated. A client discovering nothing there fails rather than calling an
+ * endpoint that would not answer.
  */
 export class SimCognitoOpenIdConfiguration {
     /**
@@ -22,6 +27,7 @@ export class SimCognitoOpenIdConfiguration {
         return {
             issuer,
             jwks_uri: `${issuer}/.well-known/jwks.json`,
+            ...this.hostedEndpoints(pool, origin),
             id_token_signing_alg_values_supported: ["RS256"],
             response_types_supported: ["code", "token"],
             scopes_supported: ["openid", "email", "phone", "profile"],
@@ -32,5 +38,23 @@ export class SimCognitoOpenIdConfiguration {
             ],
         };
     }
+    /**
+     * The endpoints a pool's hosted domain serves, for a pool that has one.
+     */
+    hostedEndpoints(pool, origin) {
+        const domain = pool.auth.domain;
+        if (domain === undefined) {
+            return {};
+        }
+        const domainUrl = new SimAwsLocalUrl({
+            input: `https://${domain.hostname}/`,
+            port: new URL(origin).port,
+        }).toURL();
+        return {
+            authorization_endpoint: `${domainUrl.origin}/oauth2/authorize`,
+            token_endpoint: `${domainUrl.origin}/oauth2/token`,
+            end_session_endpoint: `${domainUrl.origin}/logout`,
+        };
+    }
 }
 //# sourceMappingURL=sim-cognito-openid-configuration.js.map

package/dist/service/cognito/serve/sim-cognito-openid-configuration.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-openid-configuration.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-openid-configuration.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACH,QAAQ,CACN,IAAwB,EACxB,MAAc;QAEd,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QAEtC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,GAAG,MAAM,wBAAwB;YAC3C,qCAAqC,EAAE,CAAC,OAAO,CAAC;YAChD,wBAAwB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;YACzD,uBAAuB,EAAE,CAAC,QAAQ,CAAC;YACnC,qCAAqC,EAAE;gBACrC,qBAAqB;gBACrB,oBAAoB;aACrB;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-openid-configuration.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-openid-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAoB9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACH,QAAQ,CACN,IAAwB,EACxB,MAAc;QAEd,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QAEtC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,GAAG,MAAM,wBAAwB;YAC3C,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC;YACrC,qCAAqC,EAAE,CAAC,OAAO,CAAC;YAChD,wBAAwB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;YACzD,uBAAuB,EAAE,CAAC,QAAQ,CAAC;YACnC,qCAAqC,EAAE;gBACrC,qBAAqB;gBACrB,oBAAoB;aACrB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,IAAwB,EACxB,MAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAEhC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC;YACnC,KAAK,EAAE,WAAW,MAAM,CAAC,QAAQ,GAAG;YACpC,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI;SAC3B,CAAC,CAAC,KAAK,EAAE,CAAC;QAEX,OAAO;YACL,sBAAsB,EAAE,GAAG,SAAS,CAAC,MAAM,mBAAmB;YAC9D,cAAc,EAAE,GAAG,SAAS,CAAC,MAAM,eAAe;YAClD,oBAAoB,EAAE,GAAG,SAAS,CAAC,MAAM,SAAS;SACnD,CAAC;IACJ,CAAC;CACF"}