@kensio/yulin 1.12.0 → 1.13.0

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code.js

@@ -0,0 +1,75 @@
+import { createHash, randomUUID } from "node:crypto";
+/**
+ * How long an authorization code lasts.
+ *
+ * Real Cognito gives one five minutes, and nothing configures that.
+ */
+const codeMinutes = 5;
+/**
+ * The only PKCE method real Cognito supports.
+ */
+export const simCognitoCodeChallengeMethod = "S256";
+/**
+ * One authorization code, which is what an authorization code grant carries
+ * from the browser to the application's own server.
+ *
+ * The code is opaque, single use and tied to the app client and redirect URI
+ * it was issued for. Everything the token endpoint needs to answer with tokens
+ * is here, because the code is all that request carries.
+ */
+export class SimCognitoAuthorizationCode {
+    value;
+    username;
+    clientId;
+    redirectUri;
+    scopes;
+    issuedAt;
+    codeChallenge;
+    constructor(properties) {
+        this.value = randomUUID();
+        this.username = properties.username;
+        this.clientId = properties.clientId;
+        this.redirectUri = properties.redirectUri;
+        this.scopes = properties.scopes;
+        this.issuedAt = properties.issuedAt;
+        this.codeChallenge = properties.codeChallenge;
+    }
+    /**
+     * Whether this code has run out by a given moment.
+     */
+    isExpiredAt(now) {
+        const expiresAt = new Date(this.issuedAt.getTime() + codeMinutes * 60_000);
+        return now.getTime() >= expiresAt.getTime();
+    }
+    /**
+     * Whether a token request presents the verifier this code was issued for.
+     *
+     * A code issued without a challenge needs no verifier, and one issued with a
+     * challenge is only redeemed by the verifier it was derived from. Real
+     * Cognito supports the `S256` method alone, so the verifier is hashed rather
+     * than compared as it stands.
+     */
+    matchesVerifier(codeVerifier) {
+        if (this.codeChallenge === undefined) {
+            return true;
+        }
+        if (codeVerifier === undefined) {
+            return false;
+        }
+        return (createHash("sha256").update(codeVerifier).digest("base64url") ===
+            this.codeChallenge);
+    }
+    /**
+     * Whether the token request names the redirect URI this code was issued for.
+     */
+    isForRedirect(redirectUri) {
+        return this.redirectUri === redirectUri;
+    }
+    /**
+     * Whether this code was issued to an app client.
+     */
+    isFor(clientId) {
+        return this.clientId === clientId;
+    }
+}
+//# sourceMappingURL=sim-cognito-authorization-code.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorization-code.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-authorization-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAgBpD;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,WAAW,CAAS;IACpB,MAAM,CAAoB;IAC1B,QAAQ,CAAO;IAEd,aAAa,CAAqB;IAEnD,YAAY,UAAiD;QAC3D,IAAI,CAAC,KAAK,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,MAAM,CAAC,CAAC;QAE3E,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,YAAgC;QAC9C,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7D,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,WAA+B;QAC3C,OAAO,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts

@@ -39,6 +39,14 @@ export declare class SimCognitoIssuedTokenStore {
      * same way, as they do on real Cognito.
      */
     requireRefreshToken(request: SimCognitoRefreshTokenRequest): SimCognitoIssuedToken;
+    /**
+     * Find a refresh token this pool issued and still holds.
+     *
+     * The hosted token endpoint reads one this way rather than through
+     * `requireRefreshToken`, because its refusal is an OAuth error rather than
+     * the API exception a `REFRESH_TOKEN_AUTH` request is answered with.
+     */
+    findRefreshToken(value: string | undefined): SimCognitoIssuedToken | undefined;
     /**
      * Find an access token this pool issued and still honours.
      *

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAYvB;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAYvB;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAMnC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js

@@ -55,6 +55,19 @@ export class SimCognitoIssuedTokenStore {
         }
         return issued;
     }
+    /**
+     * Find a refresh token this pool issued and still holds.
+     *
+     * The hosted token endpoint reads one this way rather than through
+     * `requireRefreshToken`, because its refusal is an OAuth error rather than
+     * the API exception a `REFRESH_TOKEN_AUTH` request is answered with.
+     */
+    findRefreshToken(value) {
+        if (value === undefined) {
+            return undefined;
+        }
+        return this.refreshTokens.get(value);
+    }
     /**
      * Find an access token this pool issued and still honours.
      *

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts

@@ -4,6 +4,11 @@ interface SimCognitoIssuedTokenProperties {
     readonly clientId: string;
     readonly issuedAt: Date;
     readonly expiresAt: Date;
+    /**
+     * The scopes the sign-in this token came from was granted, which a refresh
+     * gives the tokens it hands out next.
+     */
+    readonly scopes?: readonly string[] | undefined;
 }
 /**
  * One token a pool has issued, as the pool remembers it.
@@ -20,6 +25,11 @@ export declare class SimCognitoIssuedToken {
     readonly clientId: string;
     readonly issuedAt: Date;
     readonly expiresAt: Date;
+    /**
+     * The scopes the sign-in was granted, which a token from the API carries
+     * none of: the scope of one of those is settled where the token is signed.
+     */
+    readonly scopes: readonly string[];
     constructor(properties: SimCognitoIssuedTokenProperties);
     /**
      * Whether this token has run out by a given moment.

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC,YAAY,UAAU,EAAE,+BAA+B,EAMtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC;;;OAGG;IACH,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,UAAU,EAAE,+BAA+B,EAOtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js

@@ -13,12 +13,18 @@ export class SimCognitoIssuedToken {
     clientId;
     issuedAt;
     expiresAt;
+    /**
+     * The scopes the sign-in was granted, which a token from the API carries
+     * none of: the scope of one of those is settled where the token is signed.
+     */
+    scopes;
     constructor(properties) {
         this.value = properties.value;
         this.username = properties.username;
         this.clientId = properties.clientId;
         this.issuedAt = properties.issuedAt;
         this.expiresAt = properties.expiresAt;
+        this.scopes = properties.scopes ?? [];
     }
     /**
      * Whether this token has run out by a given moment.

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAQA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAcA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC;;;OAGG;IACa,MAAM,CAAoB;IAE1C,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts

@@ -1,18 +1,57 @@
+import { SimCognitoIdentityProviderStore } from "../idp/sim-cognito-identity-provider-store.js";
+import type { SimCognitoUserPoolDomain } from "../domain/sim-cognito-user-pool-domain.js";
 import type { SimCognitoAuthSession } from "./sim-cognito-auth-session.js";
 import { type SimCognitoAuthSessionRequest } from "./sim-cognito-auth-session-store.js";
+import type { SimCognitoAuthorizationCode } from "./sim-cognito-authorization-code.js";
 import type { SimCognitoIssuedToken } from "./sim-cognito-issued-token.js";
 import { type SimCognitoRefreshTokenRequest } from "./sim-cognito-issued-token-store.js";
 /**
- * The authentication state of one simulated user pool: the sign-ins that are
- * part way through, and the tokens the finished ones handed out.
+ * The authentication state of one simulated user pool: where users can sign
+ * in, the sign-ins that are part way through, and the tokens the finished ones
+ * handed out.
  *
- * The two live together because signing a user out reaches both kinds of
- * state, and because keeping them here leaves `SimCognitoUserPool` as what it
+ * These live together because signing a user out reaches more than one of
+ * them, and because keeping them here leaves `SimCognitoUserPool` as what it
  * is elsewhere, a resource holding its contents.
+ *
+ * The hosted domain and the external identity providers are here for the same
+ * reason. A domain is where a browser signs in, a provider is who it signs in
+ * with, and an authorization code is a sign-in part way through, in the same
+ * way a challenge session is.
  */
 export declare class SimCognitoPoolAuth {
+    #private;
+    /**
+     * The external identity providers this pool federates to.
+     */
+    readonly identityProviders: SimCognitoIdentityProviderStore;
     private readonly sessions;
+    private readonly codes;
     private readonly tokens;
+    /**
+     * The hosted domain this pool serves its OAuth endpoints on, if it has one.
+     *
+     * A pool has at most one, as a real pool does: a prefix domain and a custom
+     * domain are two forms of the same thing rather than two domains.
+     */
+    get domain(): SimCognitoUserPoolDomain | undefined;
+    /**
+     * Give this pool the domain a `CreateUserPoolDomain` request asked for.
+     */
+    addDomain(domain: SimCognitoUserPoolDomain): void;
+    /**
+     * Forget this pool's domain, because it has been deleted.
+     */
+    removeDomain(): void;
+    /**
+     * Remember an authorization code this pool handed to a browser.
+     */
+    addAuthorizationCode(code: SimCognitoAuthorizationCode): void;
+    /**
+     * Take the authorization code a token request carries, if this pool still
+     * holds one that has not run out.
+     */
+    spendAuthorizationCode(value: string | undefined, now: Date): SimCognitoAuthorizationCode | undefined;
     /**
      * Remember a challenge session an authentication was left waiting on.
      */
@@ -37,6 +76,10 @@ export declare class SimCognitoPoolAuth {
      * Resolve the refresh token a refresh request carries, or refuse.
      */
     requireRefreshToken(request: SimCognitoRefreshTokenRequest): SimCognitoIssuedToken;
+    /**
+     * Find a refresh token this pool issued and still holds.
+     */
+    findRefreshToken(value: string | undefined): SimCognitoIssuedToken | undefined;
     /**
      * Find an access token this pool issued and still honours.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;;IAC7B;;OAEG;IACH,SAAgB,iBAAiB,kCAAyC;IAE1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAI3D;;;;;OAKG;IACH,IAAI,MAAM,IAAI,wBAAwB,GAAG,SAAS,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAEzC;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js

@@ -1,16 +1,64 @@
+import { SimCognitoIdentityProviderStore } from "../idp/sim-cognito-identity-provider-store.js";
 import { SimCognitoAuthSessionStore, } from "./sim-cognito-auth-session-store.js";
+import { SimCognitoAuthorizationCodeStore } from "./sim-cognito-authorization-code-store.js";
 import { SimCognitoIssuedTokenStore, } from "./sim-cognito-issued-token-store.js";
 /**
- * The authentication state of one simulated user pool: the sign-ins that are
- * part way through, and the tokens the finished ones handed out.
+ * The authentication state of one simulated user pool: where users can sign
+ * in, the sign-ins that are part way through, and the tokens the finished ones
+ * handed out.
  *
- * The two live together because signing a user out reaches both kinds of
- * state, and because keeping them here leaves `SimCognitoUserPool` as what it
+ * These live together because signing a user out reaches more than one of
+ * them, and because keeping them here leaves `SimCognitoUserPool` as what it
  * is elsewhere, a resource holding its contents.
+ *
+ * The hosted domain and the external identity providers are here for the same
+ * reason. A domain is where a browser signs in, a provider is who it signs in
+ * with, and an authorization code is a sign-in part way through, in the same
+ * way a challenge session is.
  */
 export class SimCognitoPoolAuth {
+    /**
+     * The external identity providers this pool federates to.
+     */
+    identityProviders = new SimCognitoIdentityProviderStore();
     sessions = new SimCognitoAuthSessionStore();
+    codes = new SimCognitoAuthorizationCodeStore();
     tokens = new SimCognitoIssuedTokenStore();
+    #domain;
+    /**
+     * The hosted domain this pool serves its OAuth endpoints on, if it has one.
+     *
+     * A pool has at most one, as a real pool does: a prefix domain and a custom
+     * domain are two forms of the same thing rather than two domains.
+     */
+    get domain() {
+        return this.#domain;
+    }
+    /**
+     * Give this pool the domain a `CreateUserPoolDomain` request asked for.
+     */
+    addDomain(domain) {
+        this.#domain = domain;
+    }
+    /**
+     * Forget this pool's domain, because it has been deleted.
+     */
+    removeDomain() {
+        this.#domain = undefined;
+    }
+    /**
+     * Remember an authorization code this pool handed to a browser.
+     */
+    addAuthorizationCode(code) {
+        this.codes.add(code);
+    }
+    /**
+     * Take the authorization code a token request carries, if this pool still
+     * holds one that has not run out.
+     */
+    spendAuthorizationCode(value, now) {
+        return this.codes.spend(value, now);
+    }
     /**
      * Remember a challenge session an authentication was left waiting on.
      */
@@ -47,6 +95,12 @@ export class SimCognitoPoolAuth {
     requireRefreshToken(request) {
         return this.tokens.requireRefreshToken(request);
     }
+    /**
+     * Find a refresh token this pool issued and still holds.
+     */
+    findRefreshToken(value) {
+        return this.tokens.findRefreshToken(value);
+    }
     /**
      * Find an access token this pool issued and still honours.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAGhG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAE7F,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACa,iBAAiB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEzD,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,KAAK,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,OAAO,CAAuC;IAE9C;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAiC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-grants.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The OAuth grant this simulation runs.
+ *
+ * The implicit grant hands tokens to the browser in a URL fragment, and the
+ * client credentials grant needs the resource servers that define the scopes
+ * it is made for. Neither is simulated, so a client asking for one is refused
+ * rather than given an authorization server that would not answer it.
+ */
+export declare const simCognitoSimulatedOAuthFlow = "code";
+/**
+ * The OAuth grants an app client asked to be able to make.
+ */
+export declare function simCognitoRequiredOAuthFlows(requested: readonly string[] | undefined): readonly string[];
+/**
+ * The scopes an app client asked to be able to grant.
+ */
+export declare function simCognitoRequiredOAuthScopes(requested: readonly string[] | undefined): readonly string[];
+//# sourceMappingURL=sim-cognito-oauth-grants.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-grants.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-oauth-grants.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAsBnD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACvC,SAAS,MAAM,EAAE,CAqBnB;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACvC,SAAS,MAAM,EAAE,CAcnB"}

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-grants.js

@@ -0,0 +1,61 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The OAuth grant this simulation runs.
+ *
+ * The implicit grant hands tokens to the browser in a URL fragment, and the
+ * client credentials grant needs the resource servers that define the scopes
+ * it is made for. Neither is simulated, so a client asking for one is refused
+ * rather than given an authorization server that would not answer it.
+ */
+export const simCognitoSimulatedOAuthFlow = "code";
+const oauthFlows = new Set([
+    simCognitoSimulatedOAuthFlow,
+    "implicit",
+    "client_credentials",
+]);
+/**
+ * The scopes a pool defines without a resource server.
+ *
+ * A custom scope belongs to a resource server, which is not simulated, so a
+ * client is held to these.
+ */
+const systemScopes = new Set([
+    "openid",
+    "email",
+    "phone",
+    "profile",
+    "aws.cognito.signin.user.admin",
+]);
+/**
+ * The OAuth grants an app client asked to be able to make.
+ */
+export function simCognitoRequiredOAuthFlows(requested) {
+    const flows = [...(requested ?? [])];
+    for (const flow of flows) {
+        if (!oauthFlows.has(flow)) {
+            throw new SimCognitoInvalidParameterException(`AllowedOAuthFlows '${flow}' is not an OAuth flow: the flows are ` +
+                `${oauthFlows.values().toArray().join(", ")}.`);
+        }
+        if (flow !== simCognitoSimulatedOAuthFlow) {
+            throw new SimCognitoInvalidParameterException(`AllowedOAuthFlows '${flow}' is not simulated: the grant would be ` +
+                `offered here and answered on real AWS. Only '${simCognitoSimulatedOAuthFlow}' ` +
+                `is supported.`);
+        }
+    }
+    return flows;
+}
+/**
+ * The scopes an app client asked to be able to grant.
+ */
+export function simCognitoRequiredOAuthScopes(requested) {
+    const scopes = [...(requested ?? [])];
+    for (const scope of scopes) {
+        if (!systemScopes.has(scope)) {
+            throw new SimCognitoInvalidParameterException(`AllowedOAuthScopes '${scope}' is not simulated: a custom scope ` +
+                `belongs to a resource server, which is not simulated. The ` +
+                `system scopes are ${systemScopes.values().toArray().join(", ")}.`);
+        }
+    }
+    return scopes;
+}
+//# sourceMappingURL=sim-cognito-oauth-grants.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-grants.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-oauth-grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,4BAA4B;IAC5B,UAAU;IACV,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,QAAQ;IACR,OAAO;IACP,OAAO;IACP,SAAS;IACT,+BAA+B;CAChC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAwC;IAExC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAmC,CAC3C,sBAAsB,IAAI,wCAAwC;gBAChE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;YAC1C,MAAM,IAAI,mCAAmC,CAC3C,sBAAsB,IAAI,yCAAyC;gBACjE,gDAAgD,4BAA4B,IAAI;gBAChF,eAAe,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAwC;IAExC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,mCAAmC,CAC3C,uBAAuB,KAAK,qCAAqC;gBAC/D,4DAA4D;gBAC5D,qBAAqB,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-settings.d.ts

@@ -0,0 +1,60 @@
+import type { SimCognitoRedirectUrls } from "./sim-cognito-redirect-urls.js";
+/**
+ * The OAuth properties of an app client, in the shape a request sets them and
+ * a described client reports them.
+ */
+export interface SimCognitoOAuthSettingsType {
+    readonly AllowedOAuthFlows?: readonly string[] | undefined;
+    readonly AllowedOAuthFlowsUserPoolClient?: boolean | undefined;
+    readonly AllowedOAuthScopes?: readonly string[] | undefined;
+    readonly CallbackURLs?: readonly string[] | undefined;
+    readonly LogoutURLs?: readonly string[] | undefined;
+    readonly DefaultRedirectURI?: string | undefined;
+    readonly SupportedIdentityProviders?: readonly string[] | undefined;
+}
+/**
+ * What an app client is allowed to do at a pool's hosted domain.
+ *
+ * These settings are what the authorize, token and logout endpoints check a
+ * request against: which grant it may ask for, which scopes it may be given,
+ * which URL it may be sent back to, and which identity provider it may sign a
+ * user in through. Nothing here is honoured without a domain, because there is
+ * no endpoint to reach until the pool has one.
+ *
+ * `AllowedOAuthFlowsUserPoolClient` gates the rest, as it does on real
+ * Cognito: the other settings cannot be configured until it is true.
+ */
+export declare class SimCognitoOAuthSettings {
+    readonly enabled: boolean;
+    readonly flows: readonly string[];
+    readonly scopes: readonly string[];
+    readonly callbackUrls: SimCognitoRedirectUrls;
+    readonly logoutUrls: SimCognitoRedirectUrls;
+    readonly defaultRedirectUri: string | undefined;
+    readonly identityProviders: readonly string[];
+    constructor(settings: SimCognitoOAuthSettingsType);
+    /**
+     * These settings as a described app client reports them.
+     *
+     * A list the request did not set is left out rather than reported empty, so
+     * a client created without any of this reports none of it.
+     */
+    toOutput(): SimCognitoOAuthSettingsType;
+    /**
+     * Whether this client may complete an authorization code grant.
+     */
+    get allowsCodeGrant(): boolean;
+    /**
+     * Whether a redirect URI is one this client registered.
+     */
+    allowsRedirectTo(redirectUri: string): boolean;
+    /**
+     * Whether a sign-out URL is one this client registered.
+     */
+    allowsSignOutTo(logoutUri: string): boolean;
+    /**
+     * Whether this client offers an identity provider by name.
+     */
+    allowsIdentityProvider(providerName: string): boolean;
+}
+//# sourceMappingURL=sim-cognito-oauth-settings.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-oauth-settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAI7E;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACrE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,uBAAuB;IAClC,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,UAAU,EAAE,sBAAsB,CAAC;IACnD,SAAgB,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvD,SAAgB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErD,YAAY,QAAQ,EAAE,2BAA2B,EAUhD;IAED;;;;;OAKG;IACH,QAAQ,IAAI,2BAA2B,CAkBtC;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED;;OAEG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE7C;IAED;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1C;IAED;;OAEG;IACH,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAEpD;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-settings.js

@@ -0,0 +1,83 @@
+import { simCognitoSimulatedOAuthFlow } from "./sim-cognito-oauth-grants.js";
+import { SimCognitoRequestedOAuth } from "./sim-cognito-requested-oauth.js";
+/**
+ * What an app client is allowed to do at a pool's hosted domain.
+ *
+ * These settings are what the authorize, token and logout endpoints check a
+ * request against: which grant it may ask for, which scopes it may be given,
+ * which URL it may be sent back to, and which identity provider it may sign a
+ * user in through. Nothing here is honoured without a domain, because there is
+ * no endpoint to reach until the pool has one.
+ *
+ * `AllowedOAuthFlowsUserPoolClient` gates the rest, as it does on real
+ * Cognito: the other settings cannot be configured until it is true.
+ */
+export class SimCognitoOAuthSettings {
+    enabled;
+    flows;
+    scopes;
+    callbackUrls;
+    logoutUrls;
+    defaultRedirectUri;
+    identityProviders;
+    constructor(settings) {
+        const requested = new SimCognitoRequestedOAuth(settings);
+        this.enabled = requested.enabled;
+        this.flows = requested.flows;
+        this.scopes = requested.scopes;
+        this.callbackUrls = requested.callbackUrls;
+        this.logoutUrls = requested.logoutUrls;
+        this.defaultRedirectUri = requested.defaultRedirectUri;
+        this.identityProviders = requested.identityProviders;
+    }
+    /**
+     * These settings as a described app client reports them.
+     *
+     * A list the request did not set is left out rather than reported empty, so
+     * a client created without any of this reports none of it.
+     */
+    toOutput() {
+        return {
+            AllowedOAuthFlowsUserPoolClient: this.enabled,
+            ...(this.flows.length > 0 && { AllowedOAuthFlows: [...this.flows] }),
+            ...(this.scopes.length > 0 && { AllowedOAuthScopes: [...this.scopes] }),
+            ...(this.callbackUrls.values.length > 0 && {
+                CallbackURLs: [...this.callbackUrls.values],
+            }),
+            ...(this.logoutUrls.values.length > 0 && {
+                LogoutURLs: [...this.logoutUrls.values],
+            }),
+            ...(this.defaultRedirectUri !== undefined && {
+                DefaultRedirectURI: this.defaultRedirectUri,
+            }),
+            ...(this.identityProviders.length > 0 && {
+                SupportedIdentityProviders: [...this.identityProviders],
+            }),
+        };
+    }
+    /**
+     * Whether this client may complete an authorization code grant.
+     */
+    get allowsCodeGrant() {
+        return this.enabled && this.flows.includes(simCognitoSimulatedOAuthFlow);
+    }
+    /**
+     * Whether a redirect URI is one this client registered.
+     */
+    allowsRedirectTo(redirectUri) {
+        return this.callbackUrls.includes(redirectUri);
+    }
+    /**
+     * Whether a sign-out URL is one this client registered.
+     */
+    allowsSignOutTo(logoutUri) {
+        return this.logoutUrls.includes(logoutUri);
+    }
+    /**
+     * Whether this client offers an identity provider by name.
+     */
+    allowsIdentityProvider(providerName) {
+        return this.identityProviders.includes(providerName);
+    }
+}
+//# sourceMappingURL=sim-cognito-oauth-settings.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-oauth-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-oauth-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-oauth-settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAgB5E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,uBAAuB;IAClB,OAAO,CAAU;IACjB,KAAK,CAAoB;IACzB,MAAM,CAAoB;IAC1B,YAAY,CAAyB;IACrC,UAAU,CAAyB;IACnC,kBAAkB,CAAqB;IACvC,iBAAiB,CAAoB;IAErD,YAAY,QAAqC;QAC/C,MAAM,SAAS,GAAG,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAEzD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;QACvC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC,kBAAkB,CAAC;QACvD,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,QAAQ;QACN,OAAO;YACL,+BAA+B,EAAE,IAAI,CAAC,OAAO;YAC7C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI;gBACzC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;aAC5C,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI;gBACvC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;aACxC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS,IAAI;gBAC3C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI;gBACvC,0BAA0B,EAAE,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;aACxD,CAAC;SACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,YAAoB;QACzC,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-redirect-urls.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The URLs an app client may send a browser to, checked as real Cognito checks
+ * them.
+ *
+ * A redirect URI has to be an absolute URI with no fragment, over HTTPS unless
+ * it is a loopback address, and an application's own scheme such as
+ * `myapp://example` is allowed. Checking them where they are set is what stops
+ * a callback URL that could never have been registered on real AWS reaching an
+ * authorize request here.
+ */
+export declare class SimCognitoRedirectUrls {
+    readonly values: readonly string[];
+    constructor(option: string, requested: readonly string[] | undefined);
+    private static requireRedirect;
+    /**
+     * Whether a URI is one of these, compared exactly as real Cognito compares
+     * one: a URL that differs by a trailing slash is a different URL, and one
+     * that matched loosely here would fail in a deployment.
+     */
+    includes(redirectUri: string): boolean;
+}
+//# sourceMappingURL=sim-cognito-redirect-urls.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-redirect-urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-redirect-urls.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-redirect-urls.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAMnE;IAED,OAAO,CAAC,MAAM,CAAC,eAAe;IAqB9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAErC;CACF"}