@kensio/yulin 1.14.1 → 1.15.0

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The second factor sent as a text message.
+ */
+export declare const simCognitoSmsMfa = "SMS_MFA";
+/**
+ * The second factor an authenticator app computes.
+ */
+export declare const simCognitoSoftwareTokenMfa = "SOFTWARE_TOKEN_MFA";
+/**
+ * What a request says about one of a user's factors.
+ *
+ * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SMSMfaSettingsType.html
+ */
+export interface SimCognitoMfaSettingsType {
+    readonly Enabled?: boolean | undefined;
+    readonly PreferredMfa?: boolean | undefined;
+}
+/**
+ * The factor settings `SetUserMFAPreference` and `AdminSetUserMFAPreference`
+ * carry.
+ */
+export interface SimCognitoMfaPreferenceType {
+    readonly SMSMfaSettings?: SimCognitoMfaSettingsType | undefined;
+    readonly SoftwareTokenMfaSettings?: SimCognitoMfaSettingsType | undefined;
+}
+/**
+ * One factor of a request, paired with the name it is enabled under.
+ */
+export type SimCognitoRequestedFactor = readonly [
+    string,
+    SimCognitoMfaSettingsType | undefined
+];
+/**
+ * The factors a request names, in the order they are reported in.
+ */
+export declare function simCognitoRequestedFactors(requested: SimCognitoMfaPreferenceType): readonly SimCognitoRequestedFactor[];
+/**
+ * Refuse a request preferring two factors, and one preferring a factor it is
+ * not also enabling.
+ *
+ * A user has one preferred factor at most, which is what `PreferredMfaSetting`
+ * reports, so a request naming two is refused rather than silently keeping
+ * whichever was applied last.
+ */
+export declare function requireSimCognitoPreference(factors: readonly SimCognitoRequestedFactor[]): void;
+/**
+ * Refuse enabling a factor a user has nothing to be challenged with.
+ *
+ * A code has to be sent somewhere, and a software token has to be one the
+ * user's app has been shown to hold. Real Cognito refuses both the same way.
+ */
+export declare function requireSimCognitoFactorAvailable(name: string, attributes: ReadonlyMap<string, string>, hasSoftwareToken: boolean): void;
+//# sourceMappingURL=sim-cognito-mfa-factors.d.ts.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-factors.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,SAAS;IAC/C,MAAM;IACN,yBAAyB,GAAG,SAAS;CACtC,CAAC;AAEF;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,2BAA2B,GACrC,SAAS,yBAAyB,EAAE,CAKtC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,yBAAyB,EAAE,GAC5C,IAAI,CAqBN;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,gBAAgB,EAAE,OAAO,GACxB,IAAI,CAeN"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.js

@@ -0,0 +1,58 @@
+import { SimCognitoInvalidParameterException } from "../../../error/sim-cognito.error.js";
+/**
+ * The second factor sent as a text message.
+ */
+export const simCognitoSmsMfa = "SMS_MFA";
+/**
+ * The second factor an authenticator app computes.
+ */
+export const simCognitoSoftwareTokenMfa = "SOFTWARE_TOKEN_MFA";
+/**
+ * The factors a request names, in the order they are reported in.
+ */
+export function simCognitoRequestedFactors(requested) {
+    return [
+        [simCognitoSmsMfa, requested.SMSMfaSettings],
+        [simCognitoSoftwareTokenMfa, requested.SoftwareTokenMfaSettings],
+    ];
+}
+/**
+ * Refuse a request preferring two factors, and one preferring a factor it is
+ * not also enabling.
+ *
+ * A user has one preferred factor at most, which is what `PreferredMfaSetting`
+ * reports, so a request naming two is refused rather than silently keeping
+ * whichever was applied last.
+ */
+export function requireSimCognitoPreference(factors) {
+    const preferred = factors.filter(([, settings]) => settings?.PreferredMfa === true);
+    if (preferred.length > 1) {
+        throw new SimCognitoInvalidParameterException(`Only one MFA factor can be preferred: this request prefers ${preferred
+            .map(([name]) => name)
+            .join(" and ")}`);
+    }
+    for (const [name, settings] of preferred) {
+        if (settings?.Enabled !== true) {
+            throw new SimCognitoInvalidParameterException(`${name} cannot be the preferred factor while it is not enabled: ` +
+                `set Enabled as well as PreferredMfa`);
+        }
+    }
+}
+/**
+ * Refuse enabling a factor a user has nothing to be challenged with.
+ *
+ * A code has to be sent somewhere, and a software token has to be one the
+ * user's app has been shown to hold. Real Cognito refuses both the same way.
+ */
+export function requireSimCognitoFactorAvailable(name, attributes, hasSoftwareToken) {
+    if (name === simCognitoSmsMfa && !attributes.has("phone_number")) {
+        throw new SimCognitoInvalidParameterException(`${simCognitoSmsMfa} cannot be enabled for a user with no ` +
+            `phone_number attribute: there is nowhere to send the code`);
+    }
+    if (name === simCognitoSoftwareTokenMfa && !hasSoftwareToken) {
+        throw new SimCognitoInvalidParameterException(`${simCognitoSoftwareTokenMfa} cannot be enabled for a user that has ` +
+            `not verified a software token: call AssociateSoftwareToken and ` +
+            `VerifySoftwareToken first`);
+    }
+}
+//# sourceMappingURL=sim-cognito-mfa-factors.js.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-factors.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAE1F;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAE1C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AA6B/D;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAsC;IAEtC,OAAO;QACL,CAAC,gBAAgB,EAAE,SAAS,CAAC,cAAc,CAAC;QAC5C,CAAC,0BAA0B,EAAE,SAAS,CAAC,wBAAwB,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA6C;IAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAClD,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D,SAAS;aACpE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;aACrB,IAAI,CAAC,OAAO,CAAC,EAAE,CACnB,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QACzC,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,mCAAmC,CAC3C,GAAG,IAAI,2DAA2D;gBAChE,qCAAqC,CACxC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAAY,EACZ,UAAuC,EACvC,gBAAyB;IAEzB,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,mCAAmC,CAC3C,GAAG,gBAAgB,wCAAwC;YACzD,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,IAAI,mCAAmC,CAC3C,GAAG,0BAA0B,yCAAyC;YACpE,iEAAiE;YACjE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-software-token.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The shared secret one user registers an authenticator app with.
+ *
+ * `AssociateSoftwareToken` issues one and hands back its `SecretCode`, which
+ * is the value real Cognito puts in the `otpauth://` URL behind a QR code.
+ * The secret is a real one: the codes it produces are genuine RFC 6238
+ * time-based one-time passwords, so an authenticator library given this
+ * `SecretCode` produces codes `VerifySoftwareToken` accepts.
+ *
+ * A secret is provisional until it is verified. `AssociateSoftwareToken`
+ * issues a fresh one each time it is called, as real Cognito does, so a user
+ * part way through registering an app and starting again has one secret rather
+ * than two.
+ */
+export declare class SimCognitoSoftwareToken {
+    /**
+     * The secret as a caller is given it, in unpadded base32.
+     */
+    readonly secretCode: string;
+    private readonly secret;
+    private constructor();
+    /**
+     * Issue a fresh shared secret.
+     */
+    static issue(): SimCognitoSoftwareToken;
+    /**
+     * The code an authenticator app holding this secret shows at a moment.
+     *
+     * Real Cognito never reports this, and neither would an app: the code is
+     * what the user reads off its own device. A pool reports it through
+     * `SimCognitoUserPool.softwareTokenCode` for the same reason it reports a
+     * confirmation code, because nothing here is holding the user's phone.
+     */
+    codeAt(now: Date): string;
+    /**
+     * Whether a candidate is a code this secret produces around a moment.
+     */
+    matches(candidate: string | undefined, now: Date): boolean;
+}
+//# sourceMappingURL=sim-cognito-software-token.d.ts.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-software-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-software-token.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-software-token.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;GAaG;AACH,qBAAa,uBAAuB;IAClC;;OAEG;IACH,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAEtC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,CAExB;IAED;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAEzD;CACF"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-software-token.js

@@ -0,0 +1,51 @@
+import { randomBytes } from "node:crypto";
+import { simCognitoBase32, simCognitoSecretBytes, simCognitoTotpCode, simCognitoTotpMatches, } from "./sim-cognito-totp.js";
+/**
+ * The shared secret one user registers an authenticator app with.
+ *
+ * `AssociateSoftwareToken` issues one and hands back its `SecretCode`, which
+ * is the value real Cognito puts in the `otpauth://` URL behind a QR code.
+ * The secret is a real one: the codes it produces are genuine RFC 6238
+ * time-based one-time passwords, so an authenticator library given this
+ * `SecretCode` produces codes `VerifySoftwareToken` accepts.
+ *
+ * A secret is provisional until it is verified. `AssociateSoftwareToken`
+ * issues a fresh one each time it is called, as real Cognito does, so a user
+ * part way through registering an app and starting again has one secret rather
+ * than two.
+ */
+export class SimCognitoSoftwareToken {
+    /**
+     * The secret as a caller is given it, in unpadded base32.
+     */
+    secretCode;
+    secret;
+    constructor(secret) {
+        this.secret = secret;
+        this.secretCode = simCognitoBase32(secret);
+    }
+    /**
+     * Issue a fresh shared secret.
+     */
+    static issue() {
+        return new SimCognitoSoftwareToken(randomBytes(simCognitoSecretBytes));
+    }
+    /**
+     * The code an authenticator app holding this secret shows at a moment.
+     *
+     * Real Cognito never reports this, and neither would an app: the code is
+     * what the user reads off its own device. A pool reports it through
+     * `SimCognitoUserPool.softwareTokenCode` for the same reason it reports a
+     * confirmation code, because nothing here is holding the user's phone.
+     */
+    codeAt(now) {
+        return simCognitoTotpCode(this.secret, now);
+    }
+    /**
+     * Whether a candidate is a code this secret produces around a moment.
+     */
+    matches(candidate, now) {
+        return simCognitoTotpMatches(this.secret, candidate, now);
+    }
+}
+//# sourceMappingURL=sim-cognito-software-token.js.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-software-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-software-token.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-software-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACa,UAAU,CAAS;IAElB,MAAM,CAAa;IAEpC,YAAoB,MAAkB;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,uBAAuB,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAS;QACd,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAA6B,EAAE,GAAS;QAC9C,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-totp.d.ts

@@ -0,0 +1,24 @@
+/**
+ * How many bytes a shared secret has, which is the SHA-1 block size an
+ * authenticator app expects.
+ */
+export declare const simCognitoSecretBytes = 20;
+/**
+ * Encode bytes as the base32 an authenticator app is given the secret in.
+ *
+ * Cognito's `SecretCode` is unpadded base32, which is what a QR code carries
+ * in the `otpauth://` URL and what every authenticator library decodes.
+ */
+export declare function simCognitoBase32(bytes: Uint8Array): string;
+/**
+ * The code an authenticator app holding this secret shows at a moment.
+ */
+export declare function simCognitoTotpCode(secret: Uint8Array, now: Date): string;
+/**
+ * Whether a candidate is a code this secret produces around a moment.
+ *
+ * A step before the epoch is skipped rather than hashed, because a counter is
+ * unsigned and a simulated clock can be set to anything.
+ */
+export declare function simCognitoTotpMatches(secret: Uint8Array, candidate: string | undefined, now: Date): boolean;
+//# sourceMappingURL=sim-cognito-totp.d.ts.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-totp.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-totp.ts"],"names":[],"mappings":"AAkCA;;;GAGG;AACH,eAAO,MAAM,qBAAqB,KAAc,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAsB1D;AAwBD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,IAAI,GACR,OAAO,CAcT"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-totp.js

@@ -0,0 +1,99 @@
+/* oxlint-disable no-secrets/no-secrets -- the base32 alphabet below is a
+ * constant of the encoding rather than anything secret. */
+import { createHmac } from "node:crypto";
+/**
+ * The time-based one-time password an authenticator app computes, as RFC 6238
+ * defines it and as Cognito reads one: six digits from an HMAC-SHA1 of the
+ * thirty-second step the shared secret is being read at.
+ *
+ * It is computed rather than stood in for, so the secret a pool hands out is a
+ * real shared secret: code that pairs it with a QR code and a TOTP library
+ * produces codes this accepts, and a code from the wrong secret is refused the
+ * way a real one is.
+ */
+const codeDigits = 6;
+const stepSeconds = 30;
+const counterBytes = 8;
+const secretBytes = 20;
+/**
+ * How far either side of the current step a code is still accepted.
+ *
+ * Real Cognito allows for the clock of the device that generated the code
+ * being a little out. Here it is what stops a code computed a moment before
+ * the request being refused for having crossed a step boundary in between.
+ */
+const driftSteps = 1;
+const base32Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const base32Bits = 5;
+const base32Mask = 0x1f;
+const byteBits = 8;
+/**
+ * How many bytes a shared secret has, which is the SHA-1 block size an
+ * authenticator app expects.
+ */
+export const simCognitoSecretBytes = secretBytes;
+/**
+ * Encode bytes as the base32 an authenticator app is given the secret in.
+ *
+ * Cognito's `SecretCode` is unpadded base32, which is what a QR code carries
+ * in the `otpauth://` URL and what every authenticator library decodes.
+ */
+export function simCognitoBase32(bytes) {
+    let bits = 0;
+    let buffer = 0;
+    let encoded = "";
+    for (const byte of bytes) {
+        buffer = (buffer << byteBits) | byte;
+        bits += byteBits;
+        while (bits >= base32Bits) {
+            bits -= base32Bits;
+            encoded += base32Alphabet.charAt((buffer >>> bits) & base32Mask);
+        }
+    }
+    if (bits > 0) {
+        encoded += base32Alphabet.charAt((buffer << (base32Bits - bits)) & base32Mask);
+    }
+    return encoded;
+}
+/**
+ * The step a moment falls in, which is what the code is computed over.
+ */
+function stepAt(now) {
+    return Math.floor(now.getTime() / 1000 / stepSeconds);
+}
+/**
+ * The code for one step, by the dynamic truncation RFC 4226 defines.
+ */
+function codeForStep(secret, step) {
+    const counter = Buffer.alloc(counterBytes);
+    counter.writeBigUInt64BE(BigInt(step));
+    const digest = createHmac("sha1", secret).update(counter).digest();
+    const offset = (digest.at(-1) ?? 0) & 0x0f;
+    const truncated = digest.readUInt32BE(offset) & 0x7f_ff_ff_ff;
+    return String(truncated % 10 ** codeDigits).padStart(codeDigits, "0");
+}
+/**
+ * The code an authenticator app holding this secret shows at a moment.
+ */
+export function simCognitoTotpCode(secret, now) {
+    return codeForStep(secret, stepAt(now));
+}
+/**
+ * Whether a candidate is a code this secret produces around a moment.
+ *
+ * A step before the epoch is skipped rather than hashed, because a counter is
+ * unsigned and a simulated clock can be set to anything.
+ */
+export function simCognitoTotpMatches(secret, candidate, now) {
+    if (candidate === undefined) {
+        return false;
+    }
+    const step = stepAt(now);
+    for (let drift = -driftSteps; drift <= driftSteps; drift += 1) {
+        if (step + drift >= 0 && codeForStep(secret, step + drift) === candidate) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=sim-cognito-totp.js.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-totp.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-totp.ts"],"names":[],"mappings":"AAAA;2DAC2D;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;GASG;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAC1D,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAEnB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC;QACrC,IAAI,IAAI,QAAQ,CAAC;QAEjB,OAAO,IAAI,IAAI,UAAU,EAAE,CAAC;YAC1B,IAAI,IAAI,UAAU,CAAC;YACnB,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,IAAI,cAAc,CAAC,MAAM,CAC9B,CAAC,MAAM,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,UAAU,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,MAAM,CAAC,GAAS;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAkB,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAE3C,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC;IAE9D,OAAO,MAAM,CAAC,SAAS,GAAG,EAAE,IAAI,UAAU,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,GAAS;IAC9D,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAA6B,EAC7B,GAAS;IAET,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAEzB,KAAK,IAAI,KAAK,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.d.ts

@@ -0,0 +1,103 @@
+import { type SimCognitoMfaPreferenceType } from "./sim-cognito-mfa-factors.js";
+import { SimCognitoSoftwareToken } from "./sim-cognito-software-token.js";
+interface SimCognitoUserMfaProperties {
+    /** The user's own attributes, which decide whether SMS is available to it. */
+    readonly attributes: ReadonlyMap<string, string>;
+    /** What to call when the user's factors change. */
+    readonly changed: () => void;
+}
+/**
+ * The second factors one simulated user has registered.
+ *
+ * This is what `AssociateSoftwareToken`, `VerifySoftwareToken` and the two MFA
+ * preference operations change, what `AdminGetUser` and `GetUser` report as
+ * `UserMFASettingList` and `PreferredMfaSetting`, and what a sign-in reads to
+ * decide which challenge to answer with.
+ *
+ * A software token is registered in two steps, as real Cognito registers one:
+ * a secret is associated, and a code computed from it shows that the user's
+ * authenticator app holds the same secret. Verifying registers the token and
+ * enables nothing. Enabling a factor is `SetUserMFAPreference`, which is the
+ * third step the Cognito documentation gives for setting up a TOTP factor, and
+ * whether real Cognito also activates one on verification alone was not
+ * checked against a live account.
+ *
+ * A factor a request says nothing about is left as it was, so an application
+ * enabling its authenticator app does not have to restate what it wants for
+ * SMS.
+ */
+export declare class SimCognitoUserMfa {
+    /** The secret associated and not yet verified, where there is one. */
+    private associated;
+    /** The secret the user's authenticator app has been shown to hold. */
+    private registered;
+    private readonly enabled;
+    private preference;
+    private readonly attributes;
+    /**
+     * What to tell the user when its factors change, so its last modified date
+     * moves on as it does for every other change to a user.
+     */
+    private readonly changed;
+    constructor(properties: SimCognitoUserMfaProperties);
+    /**
+     * The registered software token, which is what a challenge would read a code
+     * from.
+     */
+    get softwareToken(): SimCognitoSoftwareToken | undefined;
+    /**
+     * The factors this user is enabled for, as `UserMFASettingList` reports
+     * them.
+     */
+    get settings(): readonly string[];
+    /**
+     * The factor a challenge would use, as `PreferredMfaSetting` reports it.
+     */
+    get preferred(): string | undefined;
+    /**
+     * The factor a sign-in would be challenged for, and nothing where this user
+     * has none to be challenged for.
+     *
+     * A user with one factor enabled is challenged for it whether or not it
+     * named a preference, and a user with two is challenged for the one it
+     * preferred. Real Cognito answers a user with two and no preference with
+     * `SELECT_MFA_TYPE`, which is a challenge of its own, so there is nothing to
+     * choose here and the caller says so.
+     */
+    get challengeFactor(): string | undefined;
+    /**
+     * The code this user's authenticator app is showing at a moment, for the
+     * secret it was last given.
+     *
+     * The secret being registered wins over the registered one, because that is
+     * the secret the app is holding once `AssociateSoftwareToken` has issued
+     * another.
+     */
+    codeAt(now: Date): string | undefined;
+    /**
+     * Associate a fresh shared secret, and answer with the code to give the
+     * user's authenticator app.
+     *
+     * A secret that was associated and never verified is forgotten, as real
+     * Cognito forgets one: each call starts the registration again.
+     */
+    associate(): string;
+    /**
+     * Verify the associated secret against a code the user's app computed.
+     *
+     * A wrong code leaves the secret associated, so the user can read the next
+     * code off its app and try again.
+     */
+    verify(code: string | undefined, now: Date): void;
+    /**
+     * Apply what a request says about this user's factors.
+     */
+    set(requested: SimCognitoMfaPreferenceType): void;
+    /**
+     * Apply one factor's settings, leaving a factor the request said nothing
+     * about as it was.
+     */
+    private apply;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-mfa.d.ts.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-mfa.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,2BAA2B,EAEjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,2BAA2B;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjD,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,iBAAiB;IAC5B,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAsC;IAExD,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAsC;IAExD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,OAAO,CAAC,UAAU,CAAqB;IAEvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAEzD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IAErC,YAAY,UAAU,EAAE,2BAA2B,EAGlD;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,uBAAuB,GAAG,SAAS,CAEvD;IAED;;;OAGG;IACH,IAAI,QAAQ,IAAI,SAAS,MAAM,EAAE,CAIhC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED;;;;;;;;;OASG;IACH,IAAI,eAAe,IAAI,MAAM,GAAG,SAAS,CAQxC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,IAAI,MAAM,CAKlB;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAoBhD;IAED;;OAEG;IACH,GAAG,CAAC,SAAS,EAAE,2BAA2B,GAAG,IAAI,CAoBhD;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;CAiBd"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.js

@@ -0,0 +1,159 @@
+import { SimCognitoEnableSoftwareTokenMfaException, SimCognitoSoftwareTokenMfaNotFoundException, } from "../../../error/sim-cognito.error.js";
+import { requireSimCognitoFactorAvailable, requireSimCognitoPreference, simCognitoRequestedFactors, simCognitoSmsMfa, simCognitoSoftwareTokenMfa, } from "./sim-cognito-mfa-factors.js";
+import { SimCognitoSoftwareToken } from "./sim-cognito-software-token.js";
+/**
+ * The second factors one simulated user has registered.
+ *
+ * This is what `AssociateSoftwareToken`, `VerifySoftwareToken` and the two MFA
+ * preference operations change, what `AdminGetUser` and `GetUser` report as
+ * `UserMFASettingList` and `PreferredMfaSetting`, and what a sign-in reads to
+ * decide which challenge to answer with.
+ *
+ * A software token is registered in two steps, as real Cognito registers one:
+ * a secret is associated, and a code computed from it shows that the user's
+ * authenticator app holds the same secret. Verifying registers the token and
+ * enables nothing. Enabling a factor is `SetUserMFAPreference`, which is the
+ * third step the Cognito documentation gives for setting up a TOTP factor, and
+ * whether real Cognito also activates one on verification alone was not
+ * checked against a live account.
+ *
+ * A factor a request says nothing about is left as it was, so an application
+ * enabling its authenticator app does not have to restate what it wants for
+ * SMS.
+ */
+export class SimCognitoUserMfa {
+    /** The secret associated and not yet verified, where there is one. */
+    associated;
+    /** The secret the user's authenticator app has been shown to hold. */
+    registered;
+    enabled = new Set();
+    preference;
+    attributes;
+    /**
+     * What to tell the user when its factors change, so its last modified date
+     * moves on as it does for every other change to a user.
+     */
+    changed;
+    constructor(properties) {
+        this.attributes = properties.attributes;
+        this.changed = properties.changed;
+    }
+    /**
+     * The registered software token, which is what a challenge would read a code
+     * from.
+     */
+    get softwareToken() {
+        return this.registered;
+    }
+    /**
+     * The factors this user is enabled for, as `UserMFASettingList` reports
+     * them.
+     */
+    get settings() {
+        return [simCognitoSmsMfa, simCognitoSoftwareTokenMfa].filter((name) => this.enabled.has(name));
+    }
+    /**
+     * The factor a challenge would use, as `PreferredMfaSetting` reports it.
+     */
+    get preferred() {
+        return this.preference;
+    }
+    /**
+     * The factor a sign-in would be challenged for, and nothing where this user
+     * has none to be challenged for.
+     *
+     * A user with one factor enabled is challenged for it whether or not it
+     * named a preference, and a user with two is challenged for the one it
+     * preferred. Real Cognito answers a user with two and no preference with
+     * `SELECT_MFA_TYPE`, which is a challenge of its own, so there is nothing to
+     * choose here and the caller says so.
+     */
+    get challengeFactor() {
+        if (this.preference !== undefined) {
+            return this.preference;
+        }
+        const enabled = this.settings;
+        return enabled.length === 1 ? enabled[0] : undefined;
+    }
+    /**
+     * The code this user's authenticator app is showing at a moment, for the
+     * secret it was last given.
+     *
+     * The secret being registered wins over the registered one, because that is
+     * the secret the app is holding once `AssociateSoftwareToken` has issued
+     * another.
+     */
+    codeAt(now) {
+        return (this.associated ?? this.registered)?.codeAt(now);
+    }
+    /**
+     * Associate a fresh shared secret, and answer with the code to give the
+     * user's authenticator app.
+     *
+     * A secret that was associated and never verified is forgotten, as real
+     * Cognito forgets one: each call starts the registration again.
+     */
+    associate() {
+        this.associated = SimCognitoSoftwareToken.issue();
+        this.changed();
+        return this.associated.secretCode;
+    }
+    /**
+     * Verify the associated secret against a code the user's app computed.
+     *
+     * A wrong code leaves the secret associated, so the user can read the next
+     * code off its app and try again.
+     */
+    verify(code, now) {
+        const associated = this.associated;
+        if (associated === undefined) {
+            throw new SimCognitoSoftwareTokenMfaNotFoundException("No software token has been associated with this user: call " +
+                "AssociateSoftwareToken for a secret before verifying a code");
+        }
+        if (!associated.matches(code, now)) {
+            throw new SimCognitoEnableSoftwareTokenMfaException("Code mismatch: the code does not match the software token secret " +
+                "this user was given");
+        }
+        this.registered = associated;
+        this.associated = undefined;
+        this.changed();
+    }
+    /**
+     * Apply what a request says about this user's factors.
+     */
+    set(requested) {
+        const factors = simCognitoRequestedFactors(requested);
+        requireSimCognitoPreference(factors);
+        for (const [name, settings] of factors) {
+            if (settings?.Enabled === true) {
+                requireSimCognitoFactorAvailable(name, this.attributes, this.registered !== undefined);
+            }
+        }
+        for (const factor of factors) {
+            this.apply(factor);
+        }
+        this.changed();
+    }
+    /**
+     * Apply one factor's settings, leaving a factor the request said nothing
+     * about as it was.
+     */
+    apply([name, settings]) {
+        if (settings === undefined) {
+            return;
+        }
+        if (settings.Enabled === true) {
+            this.enabled.add(name);
+        }
+        else {
+            this.enabled.delete(name);
+        }
+        if (settings.PreferredMfa === true) {
+            this.preference = name;
+        }
+        else if (this.preference === name) {
+            this.preference = undefined;
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-user-mfa.js.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-mfa.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yCAAyC,EACzC,2CAA2C,GAC5C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAU1E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,iBAAiB;IAC5B,sEAAsE;IAC9D,UAAU,CAAsC;IAExD,sEAAsE;IAC9D,UAAU,CAAsC;IAEvC,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,UAAU,CAAqB;IAEtB,UAAU,CAA8B;IAEzD;;;OAGG;IACc,OAAO,CAAa;IAErC,YAAY,UAAuC;QACjD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;;;OASG;IACH,IAAI,eAAe;QACjB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAS;QACd,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,SAAS;QACP,IAAI,CAAC,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QAEf,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAwB,EAAE,GAAS;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,2CAA2C,CACnD,6DAA6D;gBAC3D,6DAA6D,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,yCAAyC,CACjD,mEAAmE;gBACjE,qBAAqB,CACxB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,SAAsC;QACxC,MAAM,OAAO,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAEtD,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAErC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC/B,gCAAgC,CAC9B,IAAI,EACJ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,KAAK,SAAS,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,CAA4B;QACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;IACH,CAAC;CACF"}