@kensio/yulin 1.12.0 → 1.13.0

package/dist/service/cognito/user-pool/domain/sim-cognito-pool-domains.js

@@ -0,0 +1,66 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { simCognitoUserPoolRegionName } from "../sim-cognito-user-pool-id.js";
+import { SimCognitoCustomDomainConfig, } from "./sim-cognito-custom-domain-config.js";
+import { SimCognitoDomainName } from "./sim-cognito-domain-name.js";
+import { SimCognitoUserPoolDomain } from "./sim-cognito-user-pool-domain.js";
+/**
+ * The one domain a pool can have: building the one a request asked for, and
+ * resolving the one the pool holds.
+ *
+ * A `CustomDomainConfig` is what says the request wants a custom domain rather
+ * than a Cognito prefix, so it decides both how the domain string is checked
+ * and whether a certificate is required.
+ */
+export class SimCognitoPoolDomains {
+    /**
+     * Refuse a second domain on a pool that has one.
+     *
+     * Real Cognito allows one domain per pool, prefix or custom, so a request
+     * adding another is refused rather than quietly replacing what is there.
+     */
+    static requireNoDomain(pool) {
+        const existing = pool.auth.domain;
+        if (existing !== undefined) {
+            throw new SimCognitoInvalidParameterException(`User pool ${pool.id} already has the domain '${existing.value}': a ` +
+                `pool has one domain, so delete that one before adding another`);
+        }
+    }
+    static customDomainConfig(config) {
+        if (config === undefined) {
+            return undefined;
+        }
+        return new SimCognitoCustomDomainConfig(config);
+    }
+    /**
+     * Make a pool's domain, refusing a pool that already has one.
+     */
+    make(pool, input) {
+        SimCognitoPoolDomains.requireNoDomain(pool);
+        return new SimCognitoUserPoolDomain({
+            name: new SimCognitoDomainName({
+                value: input.Domain,
+                custom: input.CustomDomainConfig !== undefined,
+                // A prefix domain is served under the pool's own region, which the
+                // pool id names, so no separate region is needed here.
+                regionName: simCognitoUserPoolRegionName(pool.id),
+            }),
+            userPoolId: pool.id,
+            customDomainConfig: SimCognitoPoolDomains.customDomainConfig(input.CustomDomainConfig),
+            managedLoginVersion: input.ManagedLoginVersion,
+        });
+    }
+    /**
+     * The domain a delete request named, or a refusal.
+     *
+     * Real Cognito answers a request naming a domain the pool does not hold the
+     * same way it answers one naming no pool at all, and says no more than that.
+     */
+    require(pool, domainValue) {
+        const domain = pool.auth.domain;
+        if (domain === undefined || domain.value !== domainValue) {
+            throw new SimCognitoInvalidParameterException("No such domain or user pool exists.");
+        }
+        return domain;
+    }
+}
+//# sourceMappingURL=sim-cognito-pool-domains.js.map

package/dist/service/cognito/user-pool/domain/sim-cognito-pool-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-domains.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/domain/sim-cognito-pool-domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAGvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EACL,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChC;;;;;OAKG;IACK,MAAM,CAAC,eAAe,CAAC,IAAwB;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAElC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,mCAAmC,CAC3C,aAAa,IAAI,CAAC,EAAE,4BAA4B,QAAQ,CAAC,KAAK,OAAO;gBACnE,+DAA+D,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAC/B,MAAoD;QAEpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,IAAI,CACF,IAAwB,EACxB,KAA0C;QAE1C,qBAAqB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE5C,OAAO,IAAI,wBAAwB,CAAC;YAClC,IAAI,EAAE,IAAI,oBAAoB,CAAC;gBAC7B,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,MAAM,EAAE,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBAC9C,mEAAmE;gBACnE,uDAAuD;gBACvD,UAAU,EAAE,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;aAClD,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,kBAAkB,EAAE,qBAAqB,CAAC,kBAAkB,CAC1D,KAAK,CAAC,kBAAkB,CACzB;YACD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,OAAO,CACL,IAAwB,EACxB,WAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAEhC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,mCAAmC,CAC3C,qCAAqC,CACtC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/service/cognito/user-pool/domain/sim-cognito-user-pool-domain.d.ts

@@ -0,0 +1,58 @@
+import type { SimCognitoUserPoolId } from "../sim-cognito-user-pool-id.js";
+import type { SimCognitoCustomDomainConfig } from "./sim-cognito-custom-domain-config.js";
+import type { SimCognitoDomainName } from "./sim-cognito-domain-name.js";
+interface SimCognitoUserPoolDomainProperties {
+    readonly name: SimCognitoDomainName;
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly customDomainConfig?: SimCognitoCustomDomainConfig | undefined;
+    /**
+     * Which managed login branding the domain was created with: `1` for the
+     * classic hosted UI and `2` for managed login. Neither set of pages is
+     * simulated, so the version is recorded and reported rather than changing
+     * anything.
+     */
+    readonly managedLoginVersion?: number | undefined;
+}
+/**
+ * One simulated user pool domain.
+ *
+ * A pool has at most one domain, and the domain is where the OAuth endpoints
+ * are served: without one, a pool has an API and nothing a browser can reach.
+ *
+ * Real Cognito puts a CloudFront distribution in front of a custom domain and
+ * expects the domain's own DNS to point at it. This simulation answers on the
+ * custom hostname directly, so the distribution it reports is a name nothing
+ * here serves, and a test needs no DNS record of its own.
+ */
+export declare class SimCognitoUserPoolDomain {
+    readonly name: SimCognitoDomainName;
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly customDomainConfig: SimCognitoCustomDomainConfig | undefined;
+    readonly managedLoginVersion: number | undefined;
+    /**
+     * The CloudFront distribution real Cognito would put in front of a custom
+     * domain, which a prefix domain does not get.
+     */
+    readonly cloudFrontDistribution: string | undefined;
+    constructor(properties: SimCognitoUserPoolDomainProperties);
+    /**
+     * The distribution name a domain reports, which only a custom domain has.
+     */
+    private static distributionFor;
+    /** The domain string this domain was created with. */
+    get value(): string;
+    /** The hostname real Cognito would serve this domain on. */
+    get hostname(): string;
+    /** The hostname this domain answers on inside the simulation. */
+    get localHostname(): string;
+    /**
+     * The hostnames a request can reach this domain by.
+     *
+     * A prefix domain answers on both the real AWS hostname and the local one it
+     * is rewritten to, so a request that names either finds it. They are the
+     * same hostname for a custom domain, which has no AWS domain to drop.
+     */
+    get hostnames(): readonly string[];
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool-domain.d.ts.map

package/dist/service/cognito/user-pool/domain/sim-cognito-user-pool-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-domain.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/domain/sim-cognito-user-pool-domain.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAOzE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IAEvE;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,IAAI,EAAE,oBAAoB,CAAC;IAC3C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,kBAAkB,EAAE,4BAA4B,GAAG,SAAS,CAAC;IAC7E,SAAgB,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IAExD;;;OAGG;IACH,SAAgB,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3D,YAAY,UAAU,EAAE,kCAAkC,EAQzD;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAa9B,sDAAsD;IACtD,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,4DAA4D;IAC5D,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,iEAAiE;IACjE,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;OAMG;IACH,IAAI,SAAS,IAAI,SAAS,MAAM,EAAE,CAEjC;CACF"}

package/dist/service/cognito/user-pool/domain/sim-cognito-user-pool-domain.js

@@ -0,0 +1,70 @@
+import { faker } from "@faker-js/faker";
+/**
+ * How many characters a simulated CloudFront distribution name carries.
+ */
+const distributionNameLength = 13;
+/**
+ * One simulated user pool domain.
+ *
+ * A pool has at most one domain, and the domain is where the OAuth endpoints
+ * are served: without one, a pool has an API and nothing a browser can reach.
+ *
+ * Real Cognito puts a CloudFront distribution in front of a custom domain and
+ * expects the domain's own DNS to point at it. This simulation answers on the
+ * custom hostname directly, so the distribution it reports is a name nothing
+ * here serves, and a test needs no DNS record of its own.
+ */
+export class SimCognitoUserPoolDomain {
+    name;
+    userPoolId;
+    customDomainConfig;
+    managedLoginVersion;
+    /**
+     * The CloudFront distribution real Cognito would put in front of a custom
+     * domain, which a prefix domain does not get.
+     */
+    cloudFrontDistribution;
+    constructor(properties) {
+        this.name = properties.name;
+        this.userPoolId = properties.userPoolId;
+        this.customDomainConfig = properties.customDomainConfig;
+        this.managedLoginVersion = properties.managedLoginVersion;
+        this.cloudFrontDistribution = SimCognitoUserPoolDomain.distributionFor(this.name.custom);
+    }
+    /**
+     * The distribution name a domain reports, which only a custom domain has.
+     */
+    static distributionFor(custom) {
+        if (!custom) {
+            return undefined;
+        }
+        const name = faker.string.alphanumeric({
+            length: distributionNameLength,
+            casing: "lower",
+        });
+        return `${name}.cloudfront.net`;
+    }
+    /** The domain string this domain was created with. */
+    get value() {
+        return this.name.value;
+    }
+    /** The hostname real Cognito would serve this domain on. */
+    get hostname() {
+        return this.name.hostname;
+    }
+    /** The hostname this domain answers on inside the simulation. */
+    get localHostname() {
+        return this.name.localHostname;
+    }
+    /**
+     * The hostnames a request can reach this domain by.
+     *
+     * A prefix domain answers on both the real AWS hostname and the local one it
+     * is rewritten to, so a request that names either finds it. They are the
+     * same hostname for a custom domain, which has no AWS domain to drop.
+     */
+    get hostnames() {
+        return [...new Set([this.hostname, this.localHostname])];
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-domain.js.map

package/dist/service/cognito/user-pool/domain/sim-cognito-user-pool-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-domain.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/domain/sim-cognito-user-pool-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAKxC;;GAEG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAgBlC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,wBAAwB;IACnB,IAAI,CAAuB;IAC3B,UAAU,CAAuB;IACjC,kBAAkB,CAA2C;IAC7D,mBAAmB,CAAqB;IAExD;;;OAGG;IACa,sBAAsB,CAAqB;IAE3D,YAAY,UAA8C;QACxD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAC1D,IAAI,CAAC,sBAAsB,GAAG,wBAAwB,CAAC,eAAe,CACpE,IAAI,CAAC,IAAI,CAAC,MAAM,CACjB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,eAAe,CAAC,MAAe;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YACrC,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;QAEH,OAAO,GAAG,IAAI,iBAAiB,CAAC;IAClC,CAAC;IAED,sDAAsD;IACtD,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,4DAA4D;IAC5D,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,iEAAiE;IACjE,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,SAAS;QACX,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.d.ts

@@ -0,0 +1,40 @@
+import type { SimCognitoAttributeType } from "../user/sim-cognito-user-attributes.js";
+import type { SimCognitoExternalUser } from "./sim-cognito-external-user.js";
+/**
+ * How a provider's claims are mapped onto pool attributes, as a request sets
+ * it and a described provider reports it.
+ *
+ * The key is the pool attribute and the value is the provider's claim, which
+ * is the direction real Cognito reads it in and the one most easily got
+ * backwards.
+ */
+export type SimCognitoAttributeMappingType = Readonly<Record<string, string>>;
+/**
+ * What a provider's claims become on the pool user signing in.
+ *
+ * A claim the mapping says nothing about is dropped, as it is on real Cognito:
+ * an attribute reaches a user only where something mapped it there. A mapped
+ * claim the provider did not send is left alone rather than written empty.
+ */
+export declare class SimCognitoAttributeMapping {
+    private readonly mapping;
+    constructor(mapping: SimCognitoAttributeMappingType | undefined);
+    /**
+     * This mapping as a described provider reports it.
+     */
+    toOutput(): SimCognitoAttributeMappingType;
+    /**
+     * The attributes an external user's claims map onto.
+     */
+    attributesFor(externalUser: SimCognitoExternalUser): readonly SimCognitoAttributeType[];
+    /**
+     * Refuse a mapping onto an attribute no pool here holds.
+     *
+     * `username` is refused with its own message: real Cognito builds a
+     * federated user's username from the provider and the subject, and a mapping
+     * cannot change it. It is refused here rather than during a sign-in much
+     * later, which is where the pool's schema would otherwise catch it.
+     */
+    private requireMappedNames;
+}
+//# sourceMappingURL=sim-cognito-attribute-mapping.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-attribute-mapping.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YAAY,OAAO,EAAE,8BAA8B,GAAG,SAAS,EAG9D;IAED;;OAEG;IACH,QAAQ,IAAI,8BAA8B,CAEzC;IAED;;OAEG;IACH,aAAa,CACX,YAAY,EAAE,sBAAsB,GACnC,SAAS,uBAAuB,EAAE,CAOpC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.js

@@ -0,0 +1,56 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { isSimCognitoStandardAttribute } from "../user/sim-cognito-standard-attributes.js";
+/**
+ * What a provider's claims become on the pool user signing in.
+ *
+ * A claim the mapping says nothing about is dropped, as it is on real Cognito:
+ * an attribute reaches a user only where something mapped it there. A mapped
+ * claim the provider did not send is left alone rather than written empty.
+ */
+export class SimCognitoAttributeMapping {
+    mapping;
+    constructor(mapping) {
+        this.mapping = { ...mapping };
+        this.requireMappedNames();
+    }
+    /**
+     * This mapping as a described provider reports it.
+     */
+    toOutput() {
+        return { ...this.mapping };
+    }
+    /**
+     * The attributes an external user's claims map onto.
+     */
+    attributesFor(externalUser) {
+        return Object.entries(this.mapping)
+            .map(([attributeName, claimName]) => ({
+            Name: attributeName,
+            Value: externalUser.claim(claimName),
+        }))
+            .filter((attribute) => attribute.Value !== undefined);
+    }
+    /**
+     * Refuse a mapping onto an attribute no pool here holds.
+     *
+     * `username` is refused with its own message: real Cognito builds a
+     * federated user's username from the provider and the subject, and a mapping
+     * cannot change it. It is refused here rather than during a sign-in much
+     * later, which is where the pool's schema would otherwise catch it.
+     */
+    requireMappedNames() {
+        for (const attributeName of Object.keys(this.mapping)) {
+            if (attributeName === "username") {
+                throw new SimCognitoInvalidParameterException("AttributeMapping cannot map to 'username': Cognito builds a " +
+                    "federated user's username from the provider name and the " +
+                    "subject it signed in with");
+            }
+            if (!isSimCognitoStandardAttribute(attributeName)) {
+                throw new SimCognitoInvalidParameterException(`AttributeMapping '${attributeName}' is not in the pool's schema: ` +
+                    `a pool here holds the standard attributes only, so there is ` +
+                    `nothing for the provider's claim to be mapped onto`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-attribute-mapping.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-attribute-mapping.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAc3F;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,OAAO,CAAiC;IAEzD,YAAY,OAAmD;QAC7D,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CACX,YAAoC;QAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACK,kBAAkB;QACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D;oBAC5D,2DAA2D;oBAC3D,2BAA2B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,aAAa,iCAAiC;oBACjE,8DAA8D;oBAC9D,oDAAoD,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-external-user.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A user as an external provider would hand it back, in the shape a test puts
+ * one there.
+ */
+export interface SimCognitoExternalUserType {
+    /**
+     * The provider's own identifier for the user, which is the `sub` of a social
+     * or OIDC provider and the name id of a SAML one. It is what the pool builds
+     * the federated username from, so the same subject signing in twice reaches
+     * the same pool user.
+     */
+    readonly Subject: string | undefined;
+    /**
+     * The claims the provider would return about the user. The provider's own
+     * claim names are used, and the identity provider's attribute mapping is
+     * what turns them into pool attributes.
+     */
+    readonly Claims?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * The user signed in at a simulated external identity provider.
+ *
+ * Nothing here calls Google or reads a SAML assertion, so the provider has to
+ * be told who is signed in at it. That is what this is: the answer the
+ * provider gives when a browser is redirected to it, put there by the test
+ * rather than by a user typing a password into someone else's login page.
+ */
+export declare class SimCognitoExternalUser {
+    readonly subject: string;
+    private readonly claims;
+    constructor(externalUser: SimCognitoExternalUserType);
+    /**
+     * One claim this user carries, if the provider would return it.
+     */
+    claim(name: string): string | undefined;
+}
+//# sourceMappingURL=sim-cognito-external-user.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-external-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-external-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-external-user.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CAChE;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,YAAY,EAAE,0BAA0B,EAUnD;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-external-user.js

@@ -0,0 +1,28 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The user signed in at a simulated external identity provider.
+ *
+ * Nothing here calls Google or reads a SAML assertion, so the provider has to
+ * be told who is signed in at it. That is what this is: the answer the
+ * provider gives when a browser is redirected to it, put there by the test
+ * rather than by a user typing a password into someone else's login page.
+ */
+export class SimCognitoExternalUser {
+    subject;
+    claims;
+    constructor(externalUser) {
+        if (externalUser.Subject === undefined || externalUser.Subject === "") {
+            throw new SimCognitoInvalidParameterException("An external user needs a Subject: it is what the provider " +
+                "identifies the user by, and what the pool builds its username from");
+        }
+        this.subject = externalUser.Subject;
+        this.claims = new Map(Object.entries(externalUser.Claims ?? {}));
+    }
+    /**
+     * One claim this user carries, if the provider would return it.
+     */
+    claim(name) {
+        return this.claims.get(name);
+    }
+}
+//# sourceMappingURL=sim-cognito-external-user.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-external-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-external-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-external-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAuBvF;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACjB,OAAO,CAAS;IACf,MAAM,CAA8B;IAErD,YAAY,YAAwC;QAClD,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,mCAAmC,CAC3C,4DAA4D;gBAC1D,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-identity.d.ts

@@ -0,0 +1,64 @@
+/**
+ * One entry of a user's `identities`, in the shape an id token carries it.
+ *
+ * `issuer` is null for the social providers, which have one issuer each, and
+ * names the issuer for a SAML or OIDC provider. `primary` says which identity
+ * a linked user signs in as, and is always true here because a user linked to
+ * more than one provider is what `AdminLinkProviderForUser` does, and that is
+ * not simulated.
+ */
+export interface SimCognitoIdentityClaim {
+    readonly userId: string;
+    readonly providerName: string;
+    readonly providerType: string;
+    readonly issuer: string | null;
+    /**
+     * Whether this is the identity the user signs in as, which Cognito writes as
+     * the string `"true"` rather than as a boolean, in the token as well as in
+     * the attribute.
+     */
+    readonly primary: string;
+    /** When the identity was linked, in milliseconds, written as a string. */
+    readonly dateCreated: string;
+}
+interface SimCognitoFederatedIdentityProperties {
+    readonly userId: string;
+    readonly providerName: string;
+    readonly providerType: string;
+    readonly issuer: string | undefined;
+    readonly createdAt: Date;
+}
+/**
+ * Where a federated user came from.
+ *
+ * Cognito records this on the user it creates for an external subject, and
+ * reports it in two places: as an `identities` attribute holding JSON, and as
+ * an `identities` claim in the id token holding the same thing as an array. A
+ * request cannot set it, so it lives on the user rather than among its
+ * attributes, in the same way `sub` does.
+ */
+export declare class SimCognitoFederatedIdentity {
+    readonly userId: string;
+    readonly providerName: string;
+    readonly providerType: string;
+    readonly issuer: string | null;
+    readonly dateCreated: number;
+    constructor(properties: SimCognitoFederatedIdentityProperties);
+    /**
+     * This identity as a token claim carries it.
+     *
+     * `primary` and `dateCreated` are strings, which is how the AWS
+     * documentation's own id token example writes them.
+     */
+    toClaim(): SimCognitoIdentityClaim;
+    /**
+     * This identity as the user's `identities` attribute holds it.
+     *
+     * The attribute is a JSON string, which is what a described user reports and
+     * what code reading `identities` from `AdminGetUser` has to parse. What it
+     * holds is what the token claim holds.
+     */
+    toAttributeValue(): string;
+}
+export {};
+//# sourceMappingURL=sim-cognito-federated-identity.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federated-identity.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,YAAY,UAAU,EAAE,qCAAqC,EAM5D;IAED;;;;;OAKG;IACH,OAAO,IAAI,uBAAuB,CASjC;IAED;;;;;;OAMG;IACH,gBAAgB,IAAI,MAAM,CAEzB;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-identity.js

@@ -0,0 +1,50 @@
+/**
+ * Where a federated user came from.
+ *
+ * Cognito records this on the user it creates for an external subject, and
+ * reports it in two places: as an `identities` attribute holding JSON, and as
+ * an `identities` claim in the id token holding the same thing as an array. A
+ * request cannot set it, so it lives on the user rather than among its
+ * attributes, in the same way `sub` does.
+ */
+export class SimCognitoFederatedIdentity {
+    userId;
+    providerName;
+    providerType;
+    issuer;
+    dateCreated;
+    constructor(properties) {
+        this.userId = properties.userId;
+        this.providerName = properties.providerName;
+        this.providerType = properties.providerType;
+        this.issuer = properties.issuer ?? null;
+        this.dateCreated = properties.createdAt.getTime();
+    }
+    /**
+     * This identity as a token claim carries it.
+     *
+     * `primary` and `dateCreated` are strings, which is how the AWS
+     * documentation's own id token example writes them.
+     */
+    toClaim() {
+        return {
+            userId: this.userId,
+            providerName: this.providerName,
+            providerType: this.providerType,
+            issuer: this.issuer,
+            primary: "true",
+            dateCreated: String(this.dateCreated),
+        };
+    }
+    /**
+     * This identity as the user's `identities` attribute holds it.
+     *
+     * The attribute is a JSON string, which is what a described user reports and
+     * what code reading `identities` from `AdminGetUser` has to parse. What it
+     * holds is what the token claim holds.
+     */
+    toAttributeValue() {
+        return JSON.stringify([this.toClaim()]);
+    }
+}
+//# sourceMappingURL=sim-cognito-federated-identity.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federated-identity.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-identity.ts"],"names":[],"mappings":"AAkCA;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACtB,MAAM,CAAS;IACf,YAAY,CAAS;IACrB,YAAY,CAAS;IACrB,MAAM,CAAgB;IACtB,WAAW,CAAS;IAEpC,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,OAAO;QACL,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;SACtC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.d.ts

@@ -0,0 +1,47 @@
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../user/sim-cognito-user.js";
+import type { SimCognitoUserFactory } from "../user/sim-cognito-user-factory.js";
+import type { SimCognitoUserPoolIdentityProvider } from "./sim-cognito-user-pool-identity-provider.js";
+interface SimCognitoFederatedSignInProperties {
+    readonly userFactory: SimCognitoUserFactory;
+}
+interface SimCognitoFederatedSignInRequest {
+    readonly pool: SimCognitoUserPool;
+    readonly provider: SimCognitoUserPoolIdentityProvider;
+    readonly now: Date;
+}
+/**
+ * Signs an external user in to a pool, creating the pool's own user for it the
+ * first time.
+ *
+ * Cognito keeps a user of its own for every external subject that signs in,
+ * because everything downstream of the sign-in works on pool users: the tokens
+ * name one, groups hold one, and the pool's own operations describe one. The
+ * username it builds is the provider name and the subject with an underscore
+ * between them, which is what makes the same subject signing in twice reach
+ * the same user rather than a second one.
+ *
+ * The provider's claims reach the user through the provider's attribute
+ * mapping, on every sign-in rather than only the first, because real Cognito
+ * updates a mapped attribute when the value at the provider changes.
+ */
+export declare class SimCognitoFederatedSignIn {
+    private readonly userFactory;
+    constructor(properties: SimCognitoFederatedSignInProperties);
+    /**
+     * Refuse a sign-in that would take over a user it did not create.
+     *
+     * A username is only reserved by being taken, and a pool's own user may
+     * validly be called `Google_1234`, so the user found by name is only the
+     * federated one when its identity says so. Signing in as it otherwise would
+     * hand an application a token for someone else's account, which is worth
+     * refusing rather than guessing at.
+     */
+    private static requireSameIdentity;
+    /**
+     * Sign the user signed in at the provider in to the pool.
+     */
+    signIn(request: SimCognitoFederatedSignInRequest): SimCognitoUser;
+}
+export {};
+//# sourceMappingURL=sim-cognito-federated-sign-in.d.ts.map

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federated-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAEvG,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAmBlC;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,gCAAgC,GAAG,cAAc,CA+BhE;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js

@@ -0,0 +1,72 @@
+import { SimCognitoUsernameExistsException } from "../../error/sim-cognito.error.js";
+import { requireSimCognitoUsername } from "../user/sim-cognito-username.js";
+import { SimCognitoFederatedIdentity } from "./sim-cognito-federated-identity.js";
+/**
+ * Signs an external user in to a pool, creating the pool's own user for it the
+ * first time.
+ *
+ * Cognito keeps a user of its own for every external subject that signs in,
+ * because everything downstream of the sign-in works on pool users: the tokens
+ * name one, groups hold one, and the pool's own operations describe one. The
+ * username it builds is the provider name and the subject with an underscore
+ * between them, which is what makes the same subject signing in twice reach
+ * the same user rather than a second one.
+ *
+ * The provider's claims reach the user through the provider's attribute
+ * mapping, on every sign-in rather than only the first, because real Cognito
+ * updates a mapped attribute when the value at the provider changes.
+ */
+export class SimCognitoFederatedSignIn {
+    userFactory;
+    constructor(properties) {
+        this.userFactory = properties.userFactory;
+    }
+    /**
+     * Refuse a sign-in that would take over a user it did not create.
+     *
+     * A username is only reserved by being taken, and a pool's own user may
+     * validly be called `Google_1234`, so the user found by name is only the
+     * federated one when its identity says so. Signing in as it otherwise would
+     * hand an application a token for someone else's account, which is worth
+     * refusing rather than guessing at.
+     */
+    static requireSameIdentity(existing, provider) {
+        const { identity } = existing;
+        const externalUser = provider.requireSignedInUser();
+        if (identity?.providerName !== provider.name ||
+            identity.userId !== externalUser.subject) {
+            throw new SimCognitoUsernameExistsException(`User ${existing.username} already exists in user pool ` +
+                `${provider.userPoolId} and is not the ${provider.name} user this ` +
+                `sign-in is for.`);
+        }
+    }
+    /**
+     * Sign the user signed in at the provider in to the pool.
+     */
+    signIn(request) {
+        const { pool, provider, now } = request;
+        const externalUser = provider.requireSignedInUser();
+        const username = requireSimCognitoUsername(`${provider.name}_${externalUser.subject}`);
+        const attributes = provider.attributeMapping.attributesFor(externalUser);
+        const existing = pool.findUser(username);
+        if (existing !== undefined) {
+            SimCognitoFederatedSignIn.requireSameIdentity(existing, provider);
+            existing.updateAttributes(attributes);
+            return existing;
+        }
+        const user = this.userFactory.federated({
+            username,
+            attributes,
+            identity: new SimCognitoFederatedIdentity({
+                userId: externalUser.subject,
+                providerName: provider.name,
+                providerType: provider.type.value,
+                issuer: provider.issuer,
+                createdAt: now,
+            }),
+        });
+        pool.addUser(user);
+        return user;
+    }
+}
+//# sourceMappingURL=sim-cognito-federated-sign-in.js.map

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federated-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAalF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,CAAwB;IAEpD,YAAY,UAA+C;QACzD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB,CAChC,QAAwB,EACxB,QAA4C;QAE5C,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC9B,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAEpD,IACE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,IAAI;YACxC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,EACxC,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,QAAQ,QAAQ,CAAC,QAAQ,+BAA+B;gBACtD,GAAG,QAAQ,CAAC,UAAU,mBAAmB,QAAQ,CAAC,IAAI,aAAa;gBACnE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAyC;QAC9C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,yBAAyB,CACxC,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,CAC3C,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yBAAyB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAClE,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEtC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YACtC,QAAQ;YACR,UAAU;YACV,QAAQ,EAAE,IAAI,2BAA2B,CAAC;gBACxC,MAAM,EAAE,YAAY,CAAC,OAAO;gBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,GAAG;aACf,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}