@kensio/yulin 1.14.1 → 1.15.0

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.d.ts

@@ -1,3 +1,4 @@
+import type { SimCognitoUserPoolSchema } from "../schema/sim-cognito-user-pool-schema.js";
 import type { SimCognitoAttributeType } from "../user/sim-cognito-user-attributes.js";
 import type { SimCognitoExternalUser } from "./sim-cognito-external-user.js";
 /**
@@ -18,7 +19,8 @@ export type SimCognitoAttributeMappingType = Readonly<Record<string, string>>;
  */
 export declare class SimCognitoAttributeMapping {
     private readonly mapping;
-    constructor(mapping: SimCognitoAttributeMappingType | undefined);
+    private readonly schema;
+    constructor(mapping: SimCognitoAttributeMappingType | undefined, schema: SimCognitoUserPoolSchema);
     /**
      * This mapping as a described provider reports it.
      */
@@ -28,12 +30,16 @@ export declare class SimCognitoAttributeMapping {
      */
     attributesFor(externalUser: SimCognitoExternalUser): readonly SimCognitoAttributeType[];
     /**
-     * Refuse a mapping onto an attribute no pool here holds.
+     * Refuse a mapping onto an attribute the pool's schema does not hold.
+     *
+     * A `custom:` attribute the pool declared is as good a target as a standard
+     * one, and one it did not declare is refused here rather than during a
+     * sign-in much later, which is where writing the attribute would otherwise
+     * catch it.
      *
      * `username` is refused with its own message: real Cognito builds a
      * federated user's username from the provider and the subject, and a mapping
-     * cannot change it. It is refused here rather than during a sign-in much
-     * later, which is where the pool's schema would otherwise catch it.
+     * cannot change it.
      */
     private requireMappedNames;
 }

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-attribute-mapping.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YAAY,OAAO,EAAE,8BAA8B,GAAG,SAAS,EAG9D;IAED;;OAEG;IACH,QAAQ,IAAI,8BAA8B,CAEzC;IAED;;OAEG;IACH,aAAa,CACX,YAAY,EAAE,sBAAsB,GACnC,SAAS,uBAAuB,EAAE,CAOpC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}
+{"version":3,"file":"sim-cognito-attribute-mapping.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAElD,YACE,OAAO,EAAE,8BAA8B,GAAG,SAAS,EACnD,MAAM,EAAE,wBAAwB,EAKjC;IAED;;OAEG;IACH,QAAQ,IAAI,8BAA8B,CAEzC;IAED;;OAEG;IACH,aAAa,CACX,YAAY,EAAE,sBAAsB,GACnC,SAAS,uBAAuB,EAAE,CAOpC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.js

@@ -1,5 +1,4 @@
 import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
-import { isSimCognitoStandardAttribute } from "../user/sim-cognito-standard-attributes.js";
 /**
  * What a provider's claims become on the pool user signing in.
  *
@@ -9,8 +8,10 @@ import { isSimCognitoStandardAttribute } from "../user/sim-cognito-standard-attr
  */
 export class SimCognitoAttributeMapping {
     mapping;
-    constructor(mapping) {
+    schema;
+    constructor(mapping, schema) {
         this.mapping = { ...mapping };
+        this.schema = schema;
         this.requireMappedNames();
     }
     /**
@@ -31,12 +32,16 @@ export class SimCognitoAttributeMapping {
             .filter((attribute) => attribute.Value !== undefined);
     }
     /**
-     * Refuse a mapping onto an attribute no pool here holds.
+     * Refuse a mapping onto an attribute the pool's schema does not hold.
+     *
+     * A `custom:` attribute the pool declared is as good a target as a standard
+     * one, and one it did not declare is refused here rather than during a
+     * sign-in much later, which is where writing the attribute would otherwise
+     * catch it.
      *
      * `username` is refused with its own message: real Cognito builds a
      * federated user's username from the provider and the subject, and a mapping
-     * cannot change it. It is refused here rather than during a sign-in much
-     * later, which is where the pool's schema would otherwise catch it.
+     * cannot change it.
      */
     requireMappedNames() {
         for (const attributeName of Object.keys(this.mapping)) {
@@ -45,10 +50,10 @@ export class SimCognitoAttributeMapping {
                     "federated user's username from the provider name and the " +
                     "subject it signed in with");
             }
-            if (!isSimCognitoStandardAttribute(attributeName)) {
+            if (!this.schema.holds(attributeName)) {
                 throw new SimCognitoInvalidParameterException(`AttributeMapping '${attributeName}' is not in the pool's schema: ` +
-                    `a pool here holds the standard attributes only, so there is ` +
-                    `nothing for the provider's claim to be mapped onto`);
+                    `${this.schema.describeHolding()}, so there is nothing for the ` +
+                    `provider's claim to be mapped onto`);
             }
         }
     }

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-attribute-mapping.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAc3F;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,OAAO,CAAiC;IAEzD,YAAY,OAAmD;QAC7D,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CACX,YAAoC;QAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACK,kBAAkB;QACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D;oBAC5D,2DAA2D;oBAC3D,2BAA2B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,aAAa,iCAAiC;oBACjE,8DAA8D;oBAC9D,oDAAoD,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-attribute-mapping.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAevF;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,OAAO,CAAiC;IACxC,MAAM,CAA2B;IAElD,YACE,OAAmD,EACnD,MAAgC;QAEhC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CACX,YAAoC;QAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACK,kBAAkB;QACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D;oBAC5D,2DAA2D;oBAC3D,2BAA2B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,aAAa,iCAAiC;oBACjE,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,gCAAgC;oBAChE,oCAAoC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-federated-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAEvG,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAmBlC;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,gCAAgC,GAAG,cAAc,CA+BhE;CACF"}
+{"version":3,"file":"sim-cognito-federated-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAEvG,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAmBlC;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,gCAAgC,GAAG,cAAc,CAgChE;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js

@@ -57,6 +57,7 @@ export class SimCognitoFederatedSignIn {
         const user = this.userFactory.federated({
             username,
             attributes,
+            schema: pool.settings.schema,
             identity: new SimCognitoFederatedIdentity({
                 userId: externalUser.subject,
                 providerName: provider.name,

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-federated-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAalF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,CAAwB;IAEpD,YAAY,UAA+C;QACzD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB,CAChC,QAAwB,EACxB,QAA4C;QAE5C,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC9B,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAEpD,IACE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,IAAI;YACxC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,EACxC,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,QAAQ,QAAQ,CAAC,QAAQ,+BAA+B;gBACtD,GAAG,QAAQ,CAAC,UAAU,mBAAmB,QAAQ,CAAC,IAAI,aAAa;gBACnE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAyC;QAC9C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,yBAAyB,CACxC,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,CAC3C,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yBAAyB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAClE,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEtC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YACtC,QAAQ;YACR,UAAU;YACV,QAAQ,EAAE,IAAI,2BAA2B,CAAC;gBACxC,MAAM,EAAE,YAAY,CAAC,OAAO;gBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,GAAG;aACf,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-federated-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAalF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,CAAwB;IAEpD,YAAY,UAA+C;QACzD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB,CAChC,QAAwB,EACxB,QAA4C;QAE5C,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC9B,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAEpD,IACE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,IAAI;YACxC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,EACxC,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,QAAQ,QAAQ,CAAC,QAAQ,+BAA+B;gBACtD,GAAG,QAAQ,CAAC,UAAU,mBAAmB,QAAQ,CAAC,IAAI,aAAa;gBACnE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAyC;QAC9C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,yBAAyB,CACxC,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,CAC3C,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yBAAyB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAClE,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEtC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YACtC,QAAQ;YACR,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC5B,QAAQ,EAAE,IAAI,2BAA2B,CAAC;gBACxC,MAAM,EAAE,YAAY,CAAC,OAAO;gBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,GAAG;aACf,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.d.ts

@@ -1,3 +1,4 @@
+import type { SimCognitoUserPoolSchema } from "../schema/sim-cognito-user-pool-schema.js";
 import { SimCognitoAttributeMapping, type SimCognitoAttributeMappingType } from "./sim-cognito-attribute-mapping.js";
 import { SimCognitoProviderDetails, type SimCognitoProviderDetailsType } from "./sim-cognito-provider-details.js";
 import { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
@@ -17,6 +18,10 @@ export interface SimCognitoIdentityProviderSettingsInput {
  * `CreateIdentityProvider` builds one of these from its request. The provider
  * name is among them although an update cannot change it, because the name is
  * what the update names the provider by and the settings are what hold it.
+ *
+ * The pool's schema comes in alongside the request because the attribute
+ * mapping is checked against it: a claim can only be mapped onto an attribute
+ * the pool holds.
  */
 export declare class SimCognitoIdentityProviderSettings {
     readonly name: string;
@@ -24,7 +29,7 @@ export declare class SimCognitoIdentityProviderSettings {
     readonly details: SimCognitoProviderDetails;
     readonly attributeMapping: SimCognitoAttributeMapping;
     readonly idpIdentifiers: readonly string[];
-    constructor(input: SimCognitoIdentityProviderSettingsInput);
+    constructor(input: SimCognitoIdentityProviderSettingsInput, schema: SimCognitoUserPoolSchema);
     /**
      * Check the name a provider is known by in its pool.
      *

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-identity-provider-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,EACpC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,eAAe,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;GAMG;AACH,qBAAa,kCAAkC;IAC7C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,IAAI,EAAE,sBAAsB,CAAC;IAC7C,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IACnD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAC7D,SAAgB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAElD,YAAY,KAAK,EAAE,uCAAuC,EAazD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;CAuB5B"}
+{"version":3,"file":"sim-cognito-identity-provider-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,EACpC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,eAAe,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,kCAAkC;IAC7C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,IAAI,EAAE,sBAAsB,CAAC;IAC7C,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IACnD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAC7D,SAAgB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAElD,YACE,KAAK,EAAE,uCAAuC,EAC9C,MAAM,EAAE,wBAAwB,EAejC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;CAuB5B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.js

@@ -16,6 +16,10 @@ const localProviderName = "COGNITO";
  * `CreateIdentityProvider` builds one of these from its request. The provider
  * name is among them although an update cannot change it, because the name is
  * what the update names the provider by and the settings are what hold it.
+ *
+ * The pool's schema comes in alongside the request because the attribute
+ * mapping is checked against it: a claim can only be mapped onto an attribute
+ * the pool holds.
  */
 export class SimCognitoIdentityProviderSettings {
     name;
@@ -23,11 +27,11 @@ export class SimCognitoIdentityProviderSettings {
     details;
     attributeMapping;
     idpIdentifiers;
-    constructor(input) {
+    constructor(input, schema) {
         this.name = SimCognitoIdentityProviderSettings.requiredName(input.ProviderName);
         this.type = new SimCognitoProviderType(input.ProviderType);
         this.details = new SimCognitoProviderDetails(this.type, input.ProviderDetails);
-        this.attributeMapping = new SimCognitoAttributeMapping(input.AttributeMapping);
+        this.attributeMapping = new SimCognitoAttributeMapping(input.AttributeMapping, schema);
         this.idpIdentifiers = [...(input.IdpIdentifiers ?? [])];
     }
     /**

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-identity-provider-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,0BAA0B,GAE3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAapC;;;;;;GAMG;AACH,MAAM,OAAO,kCAAkC;IAC7B,IAAI,CAAS;IACb,IAAI,CAAyB;IAC7B,OAAO,CAA4B;IACnC,gBAAgB,CAA6B;IAC7C,cAAc,CAAoB;IAElD,YAAY,KAA8C;QACxD,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC,YAAY,CACzD,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAC1C,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CACpD,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,YAAY,CAAC,KAAyB;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,KAAK,4CAA4C;gBAChE,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,iBAAiB,oCAAoC;gBACpE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-identity-provider-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF,OAAO,EACL,0BAA0B,GAE3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAapC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kCAAkC;IAC7B,IAAI,CAAS;IACb,IAAI,CAAyB;IAC7B,OAAO,CAA4B;IACnC,gBAAgB,CAA6B;IAC7C,cAAc,CAAoB;IAElD,YACE,KAA8C,EAC9C,MAAgC;QAEhC,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC,YAAY,CACzD,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAC1C,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CACpD,KAAK,CAAC,gBAAgB,EACtB,MAAM,CACP,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,YAAY,CAAC,KAAyB;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,KAAK,4CAA4C;gBAChE,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,iBAAiB,oCAAoC;gBACpE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/user-pool/message/sim-cognito-message-delivery.d.ts

@@ -27,6 +27,23 @@ export declare class SimCognitoMessageDelivery {
      * to the user. An invitation goes wherever the user can be reached.
      */
     static forOccasion(pool: SimCognitoUserPool, user: SimCognitoUser, occasion: SimCognitoMessageOccasion): SimCognitoMessageDelivery | undefined;
+    /**
+     * The attributes this occasion could write to, in the order Cognito prefers
+     * them.
+     *
+     * An MFA code goes to the user's phone number and nowhere else, because the
+     * phone is the factor: a user with an email address as well is still
+     * challenged by text message, where every other occasion would have written
+     * to the address.
+     */
+    private static attributesFor;
+    /**
+     * A verification message goes only to an attribute the pool verifies
+     * automatically, because that is the address it is trying to prove belongs
+     * to the user. An invitation goes wherever the user can be reached, and so
+     * does an MFA code: the user registered that phone number as its second
+     * factor, whatever the pool verifies.
+     */
     private static writable;
 }
 //# sourceMappingURL=sim-cognito-message-delivery.d.ts.map

package/dist/service/cognito/user-pool/message/sim-cognito-message-delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-message-delivery.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAgB7E;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,MAAM,EAAE,uBAAuB,CAAC;IAEhD,OAAO,eAGN;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,WAAW,CAChB,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,GAAG,SAAS,CAUvC;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;CAUxB"}
+{"version":3,"file":"sim-cognito-message-delivery.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAgB7E;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,MAAM,EAAE,uBAAuB,CAAC;IAEhD,OAAO,eAGN;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,WAAW,CAChB,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,GAAG,SAAS,CAUvC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAU5B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;CAWxB"}

package/dist/service/cognito/user-pool/message/sim-cognito-message-delivery.js

@@ -36,7 +36,7 @@ export class SimCognitoMessageDelivery {
      * to the user. An invitation goes wherever the user can be reached.
      */
     static forOccasion(pool, user, occasion) {
-        for (const [name, medium] of deliverableAttributes) {
+        for (const [name, medium] of this.attributesFor(occasion)) {
             const value = user.attributeValues.get(name);
             if (value !== undefined && this.writable(pool, occasion, name)) {
                 return new SimCognitoMessageDelivery(value, medium);
@@ -44,8 +44,31 @@ export class SimCognitoMessageDelivery {
         }
         return undefined;
     }
+    /**
+     * The attributes this occasion could write to, in the order Cognito prefers
+     * them.
+     *
+     * An MFA code goes to the user's phone number and nowhere else, because the
+     * phone is the factor: a user with an email address as well is still
+     * challenged by text message, where every other occasion would have written
+     * to the address.
+     */
+    static attributesFor(occasion) {
+        if (occasion === "Authentication") {
+            return [["phone_number", "SMS"]];
+        }
+        return deliverableAttributes;
+    }
+    /**
+     * A verification message goes only to an attribute the pool verifies
+     * automatically, because that is the address it is trying to prove belongs
+     * to the user. An invitation goes wherever the user can be reached, and so
+     * does an MFA code: the user registered that phone number as its second
+     * factor, whatever the pool verifies.
+     */
     static writable(pool, occasion, name) {
         return (occasion === "AdminCreateUser" ||
+            occasion === "Authentication" ||
             pool.settings.autoVerifiedAttributes.names.includes(name));
     }
 }

package/dist/service/cognito/user-pool/message/sim-cognito-message-delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-message-delivery.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-delivery.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,MAAM,qBAAqB,GAGpB;IACL,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,cAAc,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACpB,SAAS,CAAS;IAClB,MAAM,CAA0B;IAEhD,YAAoB,SAAiB,EAAE,MAA+B;QACpE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,WAAW,CAChB,IAAwB,EACxB,IAAoB,EACpB,QAAmC;QAEnC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,QAAQ,CACrB,IAAwB,EACxB,QAAmC,EACnC,IAAY;QAEZ,OAAO,CACL,QAAQ,KAAK,iBAAiB;YAC9B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-message-delivery.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-delivery.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,MAAM,qBAAqB,GAGpB;IACL,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,cAAc,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACpB,SAAS,CAAS;IAClB,MAAM,CAA0B;IAEhD,YAAoB,SAAiB,EAAE,MAA+B;QACpE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,WAAW,CAChB,IAAwB,EACxB,IAAoB,EACpB,QAAmC;QAEnC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,aAAa,CAC1B,QAAmC;QAEnC,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,QAAQ,CACrB,IAAwB,EACxB,QAAmC,EACnC,IAAY;QAEZ,OAAO,CACL,QAAQ,KAAK,iBAAiB;YAC9B,QAAQ,KAAK,gBAAgB;YAC7B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/message/sim-cognito-message-occasion.d.ts

@@ -1,13 +1,14 @@
 /**
  * What made a simulated user pool send a message.
  *
- * These are the three occasions this simulation reaches: a user signing itself
- * up, that user asking for another code, and an administrator creating a user.
- * Real Cognito sends on more of them, password reset and MFA among them, and
- * neither of those is simulated here.
+ * These are the four occasions this simulation reaches: a user signing itself
+ * up, that user asking for another code, an administrator creating a user, and
+ * a sign-in being challenged for a code sent by text message. Real Cognito
+ * sends on more of them, a password reset among them, which is not simulated
+ * here.
  *
  * `SimCognitoTriggerOccasion.customMessage` turns one of these into the
  * occasion the `CustomMessage` trigger fires for.
  */
-export type SimCognitoMessageOccasion = "SignUp" | "ResendCode" | "AdminCreateUser";
+export type SimCognitoMessageOccasion = "SignUp" | "ResendCode" | "AdminCreateUser" | "Authentication";
 //# sourceMappingURL=sim-cognito-message-occasion.d.ts.map

package/dist/service/cognito/user-pool/message/sim-cognito-message-occasion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-message-occasion.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-occasion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,YAAY,GACZ,iBAAiB,CAAC"}
+{"version":3,"file":"sim-cognito-message-occasion.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-occasion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,YAAY,GACZ,iBAAiB,GACjB,gBAAgB,CAAC"}

package/dist/service/cognito/user-pool/message/sim-cognito-occasion-wording.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-occasion-wording.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-occasion-wording.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAe7E;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,yBAAyB,EACnC,MAAM,EAAE,uBAAuB,GAC9B,wBAAwB,CAa1B"}
+{"version":3,"file":"sim-cognito-occasion-wording.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-occasion-wording.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAwB7E;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,yBAAyB,EACnC,MAAM,EAAE,uBAAuB,GAC9B,wBAAwB,CAiB1B"}

package/dist/service/cognito/user-pool/message/sim-cognito-occasion-wording.js

@@ -10,6 +10,14 @@ import { SimCognitoMessageWording } from "./sim-cognito-message-wording.js";
  */
 const invitationSubject = "Your temporary password";
 const invitationMessage = "Your username is {username} and temporary password is {####}.";
+/**
+ * The wording real Cognito sends an MFA code with when the pool asked for
+ * none.
+ *
+ * `SmsAuthenticationMessage` is what a pool sets its own with, and that input
+ * is refused here, so this is the wording every MFA code goes out under.
+ */
+const authenticationMessage = "Your authentication code is {####}.";
 /**
  * What a pool says on the occasion it is sending on.
  *
@@ -18,6 +26,9 @@ const invitationMessage = "Your username is {username} and temporary password is
  * be set on a pool here.
  */
 export function simCognitoOccasionWording(pool, occasion, medium) {
+    if (occasion === "Authentication") {
+        return new SimCognitoMessageWording({ body: authenticationMessage });
+    }
     if (occasion !== "AdminCreateUser") {
         return pool.settings.verificationMessages.wording(medium);
     }

package/dist/service/cognito/user-pool/message/sim-cognito-occasion-wording.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-occasion-wording.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-occasion-wording.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAG5E;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,iBAAiB,GACrB,+DAA+D,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAwB,EACxB,QAAmC,EACnC,MAA+B;IAE/B,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,wBAAwB,CAAC;QAClC,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-cognito-occasion-wording.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-occasion-wording.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAG5E;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,iBAAiB,GACrB,+DAA+D,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,qCAAqC,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAwB,EACxB,QAAmC,EACnC,MAA+B;IAE/B,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,wBAAwB,CAAC;QAClC,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.d.ts

@@ -0,0 +1,35 @@
+export type SimCognitoMfaConfigurationValue = "OFF" | "ON" | "OPTIONAL";
+/**
+ * Whether a user pool asks a user for a second factor when it signs in.
+ *
+ * A pool is created `OFF` unless the request asks for something else.
+ * `OPTIONAL` challenges only the users that have registered a factor, and `ON`
+ * challenges every user.
+ *
+ * The setting is acted on: a sign-in by a user of an `OPTIONAL` or `ON` pool
+ * that has registered a factor is answered with the challenge for it. The one
+ * case left is a user of an `ON` pool that has registered none, which real
+ * Cognito answers with `MFA_SETUP`, and that sign-in is refused where the
+ * challenge would have been issued rather than at pool creation.
+ */
+export declare class SimCognitoMfaConfiguration {
+    readonly value: SimCognitoMfaConfigurationValue;
+    constructor(requested: string | undefined);
+    /**
+     * Whether any sign-in to the pool could be challenged for a second factor.
+     *
+     * A pool configured `OFF` challenges nobody, whatever factors its users
+     * have registered, so a sign-in to one goes straight to tokens.
+     */
+    get challengesAnySignIn(): boolean;
+    /**
+     * Whether every sign-in to the pool has to get past a second factor.
+     *
+     * A user of an `ON` pool is answered with a challenge on real Cognito
+     * whether or not it has registered a factor: one that has is challenged for
+     * it, and one that has not is answered with `MFA_SETUP`, which is the
+     * challenge this simulation does not issue.
+     */
+    get challengesEverySignIn(): boolean;
+}
+//# sourceMappingURL=sim-cognito-mfa-configuration.d.ts.map

package/dist/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-configuration.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,+BAA+B,GAAG,KAAK,GAAG,IAAI,GAAG,UAAU,CAAC;AAKxE;;;;;;;;;;;;GAYG;AACH,qBAAa,0BAA0B;IACrC,SAAgB,KAAK,EAAE,+BAA+B,CAAC;IAEvD,YAAY,SAAS,EAAE,MAAM,GAAG,SAAS,EAgBxC;IAED;;;;;OAKG;IACH,IAAI,mBAAmB,IAAI,OAAO,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,qBAAqB,IAAI,OAAO,CAEnC;CACF"}

package/dist/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.js

@@ -0,0 +1,50 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+const mfaConfigurationValues = new Set(["OFF", "ON", "OPTIONAL"]);
+/**
+ * Whether a user pool asks a user for a second factor when it signs in.
+ *
+ * A pool is created `OFF` unless the request asks for something else.
+ * `OPTIONAL` challenges only the users that have registered a factor, and `ON`
+ * challenges every user.
+ *
+ * The setting is acted on: a sign-in by a user of an `OPTIONAL` or `ON` pool
+ * that has registered a factor is answered with the challenge for it. The one
+ * case left is a user of an `ON` pool that has registered none, which real
+ * Cognito answers with `MFA_SETUP`, and that sign-in is refused where the
+ * challenge would have been issued rather than at pool creation.
+ */
+export class SimCognitoMfaConfiguration {
+    value;
+    constructor(requested) {
+        if (requested === undefined) {
+            this.value = "OFF";
+            return;
+        }
+        if (!mfaConfigurationValues.has(requested)) {
+            throw new SimCognitoInvalidParameterException(`MfaConfiguration '${requested}' is not a Cognito MFA ` +
+                `configuration: use OFF, OPTIONAL or ON`);
+        }
+        this.value = requested;
+    }
+    /**
+     * Whether any sign-in to the pool could be challenged for a second factor.
+     *
+     * A pool configured `OFF` challenges nobody, whatever factors its users
+     * have registered, so a sign-in to one goes straight to tokens.
+     */
+    get challengesAnySignIn() {
+        return this.value !== "OFF";
+    }
+    /**
+     * Whether every sign-in to the pool has to get past a second factor.
+     *
+     * A user of an `ON` pool is answered with a challenge on real Cognito
+     * whether or not it has registered a factor: one that has is challenged for
+     * it, and one that has not is answered with `MFA_SETUP`, which is the
+     * challenge this simulation does not issue.
+     */
+    get challengesEverySignIn() {
+        return this.value === "ON";
+    }
+}
+//# sourceMappingURL=sim-cognito-mfa-configuration.js.map

package/dist/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-configuration.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAIvF,MAAM,sBAAsB,GAC1B,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAErC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,0BAA0B;IACrB,KAAK,CAAkC;IAEvD,YAAY,SAA6B;QACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IACE,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAA4C,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,SAAS,yBAAyB;gBACrD,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,SAA4C,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACH,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;IAC9B,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/dist/service/cognito/user-pool/mfa/sim-cognito-user-pool-mfa.d.ts

@@ -0,0 +1,83 @@
+import { SimCognitoMfaConfiguration } from "./sim-cognito-mfa-configuration.js";
+/**
+ * Whether a pool offers a time-based one-time password as a second factor.
+ */
+export interface SimCognitoSoftwareTokenMfaConfigType {
+    readonly Enabled?: boolean | undefined;
+}
+/**
+ * What a pool says in the text message carrying a second factor.
+ *
+ * Real Cognito also takes an `SmsConfiguration` here, naming the IAM role it
+ * assumes to call SNS. Nothing here delivers a message, and `CreateUserPool`
+ * refuses the pool's own `SmsConfiguration` for that reason, so the command
+ * refuses this one in the same words rather than recording a role it would
+ * never assume.
+ */
+export interface SimCognitoSmsMfaConfigType {
+    readonly SmsAuthenticationMessage?: string | undefined;
+    readonly SmsConfiguration?: object | undefined;
+}
+/**
+ * The MFA configuration of a pool, in the shape `SetUserPoolMfaConfig` and
+ * `GetUserPoolMfaConfig` carry it.
+ *
+ * Real Cognito carries one more factor configuration here, for the code sent
+ * by email. That one needs the pool's `EmailConfiguration`, which
+ * `CreateUserPool` refuses, so the command refuses it rather than reporting it
+ * back.
+ */
+export interface SimCognitoUserPoolMfaType {
+    readonly MfaConfiguration?: string | undefined;
+    readonly SoftwareTokenMfaConfiguration?: SimCognitoSoftwareTokenMfaConfigType | undefined;
+    readonly SmsMfaConfiguration?: SimCognitoSmsMfaConfigType | undefined;
+}
+/**
+ * The multi-factor authentication one simulated user pool is configured for:
+ * whether it challenges, and which factors it offers.
+ *
+ * The two arrive separately on real Cognito. `CreateUserPool` and
+ * `UpdateUserPool` carry the `MfaConfiguration` alone, and only
+ * `SetUserPoolMfaConfig` says which factors a challenge could use, which is why
+ * CloudFormation deploys a pool with MFA in two calls rather than one. That is
+ * also why an update replaces the challenging and leaves the factors where they
+ * were.
+ *
+ * A sign-in reads this to decide whether the user owes a second factor, and
+ * `GetUserPoolMfaConfig` reports it. The factors it lists are what a pool
+ * offers rather than what any one user registered: a challenge is issued for
+ * the factor the user itself enabled.
+ */
+export declare class SimCognitoUserPoolMfa {
+    #private;
+    constructor(configuration: SimCognitoMfaConfiguration);
+    /**
+     * Whether the pool challenges, and which users it challenges.
+     */
+    get configuration(): SimCognitoMfaConfiguration;
+    /**
+     * Replace the whole configuration, as `SetUserPoolMfaConfig` replaces it: a
+     * factor the request leaves out goes back to being unconfigured.
+     *
+     * A request naming `SoftwareTokenMfaConfiguration` without an `Enabled` is
+     * asking for it disabled, as real Cognito reads one.
+     */
+    set(input: SimCognitoUserPoolMfaType): void;
+    /**
+     * Whether the pool offers a second factor sent as a text message.
+     */
+    get sendsSms(): boolean;
+    /**
+     * Take on the factors of the configuration this one replaces.
+     *
+     * An `UpdateUserPool` request names an `MfaConfiguration` and no factor
+     * configuration at all, so an update changes whether the pool challenges and
+     * leaves what it would challenge with alone, as it does on real Cognito.
+     */
+    keepFactorsOf(replaced: SimCognitoUserPoolMfa): void;
+    /**
+     * This configuration as `GetUserPoolMfaConfig` reports it.
+     */
+    toOutput(): SimCognitoUserPoolMfaType;
+}
+//# sourceMappingURL=sim-cognito-user-pool-mfa.d.ts.map

package/dist/service/cognito/user-pool/mfa/sim-cognito-user-pool-mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-mfa.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/mfa/sim-cognito-user-pool-mfa.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,6BAA6B,CAAC,EACnC,oCAAoC,GACpC,SAAS,CAAC;IACd,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACvE;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;;IAgBhC,YAAY,aAAa,EAAE,0BAA0B,EAEpD;IAED;;OAEG;IACH,IAAI,aAAa,IAAI,0BAA0B,CAE9C;IAED;;;;;;OAMG;IACH,GAAG,CAAC,KAAK,EAAE,yBAAyB,GAAG,IAAI,CAM1C;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAGnD;IAED;;OAEG;IACH,QAAQ,IAAI,yBAAyB,CAQpC;CACF"}