@kensio/yulin 1.14.2 → 1.15.0

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-totp.d.ts

@@ -0,0 +1,24 @@
+/**
+ * How many bytes a shared secret has, which is the SHA-1 block size an
+ * authenticator app expects.
+ */
+export declare const simCognitoSecretBytes = 20;
+/**
+ * Encode bytes as the base32 an authenticator app is given the secret in.
+ *
+ * Cognito's `SecretCode` is unpadded base32, which is what a QR code carries
+ * in the `otpauth://` URL and what every authenticator library decodes.
+ */
+export declare function simCognitoBase32(bytes: Uint8Array): string;
+/**
+ * The code an authenticator app holding this secret shows at a moment.
+ */
+export declare function simCognitoTotpCode(secret: Uint8Array, now: Date): string;
+/**
+ * Whether a candidate is a code this secret produces around a moment.
+ *
+ * A step before the epoch is skipped rather than hashed, because a counter is
+ * unsigned and a simulated clock can be set to anything.
+ */
+export declare function simCognitoTotpMatches(secret: Uint8Array, candidate: string | undefined, now: Date): boolean;
+//# sourceMappingURL=sim-cognito-totp.d.ts.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-totp.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-totp.ts"],"names":[],"mappings":"AAkCA;;;GAGG;AACH,eAAO,MAAM,qBAAqB,KAAc,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAsB1D;AAwBD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,IAAI,GACR,OAAO,CAcT"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-totp.js

@@ -0,0 +1,99 @@
+/* oxlint-disable no-secrets/no-secrets -- the base32 alphabet below is a
+ * constant of the encoding rather than anything secret. */
+import { createHmac } from "node:crypto";
+/**
+ * The time-based one-time password an authenticator app computes, as RFC 6238
+ * defines it and as Cognito reads one: six digits from an HMAC-SHA1 of the
+ * thirty-second step the shared secret is being read at.
+ *
+ * It is computed rather than stood in for, so the secret a pool hands out is a
+ * real shared secret: code that pairs it with a QR code and a TOTP library
+ * produces codes this accepts, and a code from the wrong secret is refused the
+ * way a real one is.
+ */
+const codeDigits = 6;
+const stepSeconds = 30;
+const counterBytes = 8;
+const secretBytes = 20;
+/**
+ * How far either side of the current step a code is still accepted.
+ *
+ * Real Cognito allows for the clock of the device that generated the code
+ * being a little out. Here it is what stops a code computed a moment before
+ * the request being refused for having crossed a step boundary in between.
+ */
+const driftSteps = 1;
+const base32Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const base32Bits = 5;
+const base32Mask = 0x1f;
+const byteBits = 8;
+/**
+ * How many bytes a shared secret has, which is the SHA-1 block size an
+ * authenticator app expects.
+ */
+export const simCognitoSecretBytes = secretBytes;
+/**
+ * Encode bytes as the base32 an authenticator app is given the secret in.
+ *
+ * Cognito's `SecretCode` is unpadded base32, which is what a QR code carries
+ * in the `otpauth://` URL and what every authenticator library decodes.
+ */
+export function simCognitoBase32(bytes) {
+    let bits = 0;
+    let buffer = 0;
+    let encoded = "";
+    for (const byte of bytes) {
+        buffer = (buffer << byteBits) | byte;
+        bits += byteBits;
+        while (bits >= base32Bits) {
+            bits -= base32Bits;
+            encoded += base32Alphabet.charAt((buffer >>> bits) & base32Mask);
+        }
+    }
+    if (bits > 0) {
+        encoded += base32Alphabet.charAt((buffer << (base32Bits - bits)) & base32Mask);
+    }
+    return encoded;
+}
+/**
+ * The step a moment falls in, which is what the code is computed over.
+ */
+function stepAt(now) {
+    return Math.floor(now.getTime() / 1000 / stepSeconds);
+}
+/**
+ * The code for one step, by the dynamic truncation RFC 4226 defines.
+ */
+function codeForStep(secret, step) {
+    const counter = Buffer.alloc(counterBytes);
+    counter.writeBigUInt64BE(BigInt(step));
+    const digest = createHmac("sha1", secret).update(counter).digest();
+    const offset = (digest.at(-1) ?? 0) & 0x0f;
+    const truncated = digest.readUInt32BE(offset) & 0x7f_ff_ff_ff;
+    return String(truncated % 10 ** codeDigits).padStart(codeDigits, "0");
+}
+/**
+ * The code an authenticator app holding this secret shows at a moment.
+ */
+export function simCognitoTotpCode(secret, now) {
+    return codeForStep(secret, stepAt(now));
+}
+/**
+ * Whether a candidate is a code this secret produces around a moment.
+ *
+ * A step before the epoch is skipped rather than hashed, because a counter is
+ * unsigned and a simulated clock can be set to anything.
+ */
+export function simCognitoTotpMatches(secret, candidate, now) {
+    if (candidate === undefined) {
+        return false;
+    }
+    const step = stepAt(now);
+    for (let drift = -driftSteps; drift <= driftSteps; drift += 1) {
+        if (step + drift >= 0 && codeForStep(secret, step + drift) === candidate) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=sim-cognito-totp.js.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-totp.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-totp.ts"],"names":[],"mappings":"AAAA;2DAC2D;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;GASG;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAC1D,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAEnB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC;QACrC,IAAI,IAAI,QAAQ,CAAC;QAEjB,OAAO,IAAI,IAAI,UAAU,EAAE,CAAC;YAC1B,IAAI,IAAI,UAAU,CAAC;YACnB,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,IAAI,cAAc,CAAC,MAAM,CAC9B,CAAC,MAAM,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,UAAU,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,MAAM,CAAC,GAAS;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAkB,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAE3C,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC;IAE9D,OAAO,MAAM,CAAC,SAAS,GAAG,EAAE,IAAI,UAAU,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,GAAS;IAC9D,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAA6B,EAC7B,GAAS;IAET,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAEzB,KAAK,IAAI,KAAK,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.d.ts

@@ -0,0 +1,103 @@
+import { type SimCognitoMfaPreferenceType } from "./sim-cognito-mfa-factors.js";
+import { SimCognitoSoftwareToken } from "./sim-cognito-software-token.js";
+interface SimCognitoUserMfaProperties {
+    /** The user's own attributes, which decide whether SMS is available to it. */
+    readonly attributes: ReadonlyMap<string, string>;
+    /** What to call when the user's factors change. */
+    readonly changed: () => void;
+}
+/**
+ * The second factors one simulated user has registered.
+ *
+ * This is what `AssociateSoftwareToken`, `VerifySoftwareToken` and the two MFA
+ * preference operations change, what `AdminGetUser` and `GetUser` report as
+ * `UserMFASettingList` and `PreferredMfaSetting`, and what a sign-in reads to
+ * decide which challenge to answer with.
+ *
+ * A software token is registered in two steps, as real Cognito registers one:
+ * a secret is associated, and a code computed from it shows that the user's
+ * authenticator app holds the same secret. Verifying registers the token and
+ * enables nothing. Enabling a factor is `SetUserMFAPreference`, which is the
+ * third step the Cognito documentation gives for setting up a TOTP factor, and
+ * whether real Cognito also activates one on verification alone was not
+ * checked against a live account.
+ *
+ * A factor a request says nothing about is left as it was, so an application
+ * enabling its authenticator app does not have to restate what it wants for
+ * SMS.
+ */
+export declare class SimCognitoUserMfa {
+    /** The secret associated and not yet verified, where there is one. */
+    private associated;
+    /** The secret the user's authenticator app has been shown to hold. */
+    private registered;
+    private readonly enabled;
+    private preference;
+    private readonly attributes;
+    /**
+     * What to tell the user when its factors change, so its last modified date
+     * moves on as it does for every other change to a user.
+     */
+    private readonly changed;
+    constructor(properties: SimCognitoUserMfaProperties);
+    /**
+     * The registered software token, which is what a challenge would read a code
+     * from.
+     */
+    get softwareToken(): SimCognitoSoftwareToken | undefined;
+    /**
+     * The factors this user is enabled for, as `UserMFASettingList` reports
+     * them.
+     */
+    get settings(): readonly string[];
+    /**
+     * The factor a challenge would use, as `PreferredMfaSetting` reports it.
+     */
+    get preferred(): string | undefined;
+    /**
+     * The factor a sign-in would be challenged for, and nothing where this user
+     * has none to be challenged for.
+     *
+     * A user with one factor enabled is challenged for it whether or not it
+     * named a preference, and a user with two is challenged for the one it
+     * preferred. Real Cognito answers a user with two and no preference with
+     * `SELECT_MFA_TYPE`, which is a challenge of its own, so there is nothing to
+     * choose here and the caller says so.
+     */
+    get challengeFactor(): string | undefined;
+    /**
+     * The code this user's authenticator app is showing at a moment, for the
+     * secret it was last given.
+     *
+     * The secret being registered wins over the registered one, because that is
+     * the secret the app is holding once `AssociateSoftwareToken` has issued
+     * another.
+     */
+    codeAt(now: Date): string | undefined;
+    /**
+     * Associate a fresh shared secret, and answer with the code to give the
+     * user's authenticator app.
+     *
+     * A secret that was associated and never verified is forgotten, as real
+     * Cognito forgets one: each call starts the registration again.
+     */
+    associate(): string;
+    /**
+     * Verify the associated secret against a code the user's app computed.
+     *
+     * A wrong code leaves the secret associated, so the user can read the next
+     * code off its app and try again.
+     */
+    verify(code: string | undefined, now: Date): void;
+    /**
+     * Apply what a request says about this user's factors.
+     */
+    set(requested: SimCognitoMfaPreferenceType): void;
+    /**
+     * Apply one factor's settings, leaving a factor the request said nothing
+     * about as it was.
+     */
+    private apply;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-mfa.d.ts.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-mfa.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,2BAA2B,EAEjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,2BAA2B;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjD,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,iBAAiB;IAC5B,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAsC;IAExD,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAsC;IAExD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,OAAO,CAAC,UAAU,CAAqB;IAEvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAEzD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IAErC,YAAY,UAAU,EAAE,2BAA2B,EAGlD;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,uBAAuB,GAAG,SAAS,CAEvD;IAED;;;OAGG;IACH,IAAI,QAAQ,IAAI,SAAS,MAAM,EAAE,CAIhC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED;;;;;;;;;OASG;IACH,IAAI,eAAe,IAAI,MAAM,GAAG,SAAS,CAQxC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,IAAI,MAAM,CAKlB;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAoBhD;IAED;;OAEG;IACH,GAAG,CAAC,SAAS,EAAE,2BAA2B,GAAG,IAAI,CAoBhD;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;CAiBd"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.js

@@ -0,0 +1,159 @@
+import { SimCognitoEnableSoftwareTokenMfaException, SimCognitoSoftwareTokenMfaNotFoundException, } from "../../../error/sim-cognito.error.js";
+import { requireSimCognitoFactorAvailable, requireSimCognitoPreference, simCognitoRequestedFactors, simCognitoSmsMfa, simCognitoSoftwareTokenMfa, } from "./sim-cognito-mfa-factors.js";
+import { SimCognitoSoftwareToken } from "./sim-cognito-software-token.js";
+/**
+ * The second factors one simulated user has registered.
+ *
+ * This is what `AssociateSoftwareToken`, `VerifySoftwareToken` and the two MFA
+ * preference operations change, what `AdminGetUser` and `GetUser` report as
+ * `UserMFASettingList` and `PreferredMfaSetting`, and what a sign-in reads to
+ * decide which challenge to answer with.
+ *
+ * A software token is registered in two steps, as real Cognito registers one:
+ * a secret is associated, and a code computed from it shows that the user's
+ * authenticator app holds the same secret. Verifying registers the token and
+ * enables nothing. Enabling a factor is `SetUserMFAPreference`, which is the
+ * third step the Cognito documentation gives for setting up a TOTP factor, and
+ * whether real Cognito also activates one on verification alone was not
+ * checked against a live account.
+ *
+ * A factor a request says nothing about is left as it was, so an application
+ * enabling its authenticator app does not have to restate what it wants for
+ * SMS.
+ */
+export class SimCognitoUserMfa {
+    /** The secret associated and not yet verified, where there is one. */
+    associated;
+    /** The secret the user's authenticator app has been shown to hold. */
+    registered;
+    enabled = new Set();
+    preference;
+    attributes;
+    /**
+     * What to tell the user when its factors change, so its last modified date
+     * moves on as it does for every other change to a user.
+     */
+    changed;
+    constructor(properties) {
+        this.attributes = properties.attributes;
+        this.changed = properties.changed;
+    }
+    /**
+     * The registered software token, which is what a challenge would read a code
+     * from.
+     */
+    get softwareToken() {
+        return this.registered;
+    }
+    /**
+     * The factors this user is enabled for, as `UserMFASettingList` reports
+     * them.
+     */
+    get settings() {
+        return [simCognitoSmsMfa, simCognitoSoftwareTokenMfa].filter((name) => this.enabled.has(name));
+    }
+    /**
+     * The factor a challenge would use, as `PreferredMfaSetting` reports it.
+     */
+    get preferred() {
+        return this.preference;
+    }
+    /**
+     * The factor a sign-in would be challenged for, and nothing where this user
+     * has none to be challenged for.
+     *
+     * A user with one factor enabled is challenged for it whether or not it
+     * named a preference, and a user with two is challenged for the one it
+     * preferred. Real Cognito answers a user with two and no preference with
+     * `SELECT_MFA_TYPE`, which is a challenge of its own, so there is nothing to
+     * choose here and the caller says so.
+     */
+    get challengeFactor() {
+        if (this.preference !== undefined) {
+            return this.preference;
+        }
+        const enabled = this.settings;
+        return enabled.length === 1 ? enabled[0] : undefined;
+    }
+    /**
+     * The code this user's authenticator app is showing at a moment, for the
+     * secret it was last given.
+     *
+     * The secret being registered wins over the registered one, because that is
+     * the secret the app is holding once `AssociateSoftwareToken` has issued
+     * another.
+     */
+    codeAt(now) {
+        return (this.associated ?? this.registered)?.codeAt(now);
+    }
+    /**
+     * Associate a fresh shared secret, and answer with the code to give the
+     * user's authenticator app.
+     *
+     * A secret that was associated and never verified is forgotten, as real
+     * Cognito forgets one: each call starts the registration again.
+     */
+    associate() {
+        this.associated = SimCognitoSoftwareToken.issue();
+        this.changed();
+        return this.associated.secretCode;
+    }
+    /**
+     * Verify the associated secret against a code the user's app computed.
+     *
+     * A wrong code leaves the secret associated, so the user can read the next
+     * code off its app and try again.
+     */
+    verify(code, now) {
+        const associated = this.associated;
+        if (associated === undefined) {
+            throw new SimCognitoSoftwareTokenMfaNotFoundException("No software token has been associated with this user: call " +
+                "AssociateSoftwareToken for a secret before verifying a code");
+        }
+        if (!associated.matches(code, now)) {
+            throw new SimCognitoEnableSoftwareTokenMfaException("Code mismatch: the code does not match the software token secret " +
+                "this user was given");
+        }
+        this.registered = associated;
+        this.associated = undefined;
+        this.changed();
+    }
+    /**
+     * Apply what a request says about this user's factors.
+     */
+    set(requested) {
+        const factors = simCognitoRequestedFactors(requested);
+        requireSimCognitoPreference(factors);
+        for (const [name, settings] of factors) {
+            if (settings?.Enabled === true) {
+                requireSimCognitoFactorAvailable(name, this.attributes, this.registered !== undefined);
+            }
+        }
+        for (const factor of factors) {
+            this.apply(factor);
+        }
+        this.changed();
+    }
+    /**
+     * Apply one factor's settings, leaving a factor the request said nothing
+     * about as it was.
+     */
+    apply([name, settings]) {
+        if (settings === undefined) {
+            return;
+        }
+        if (settings.Enabled === true) {
+            this.enabled.add(name);
+        }
+        else {
+            this.enabled.delete(name);
+        }
+        if (settings.PreferredMfa === true) {
+            this.preference = name;
+        }
+        else if (this.preference === name) {
+            this.preference = undefined;
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-user-mfa.js.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-mfa.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-user-mfa.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yCAAyC,EACzC,2CAA2C,GAC5C,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAU1E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,iBAAiB;IAC5B,sEAAsE;IAC9D,UAAU,CAAsC;IAExD,sEAAsE;IAC9D,UAAU,CAAsC;IAEvC,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,UAAU,CAAqB;IAEtB,UAAU,CAA8B;IAEzD;;;OAGG;IACc,OAAO,CAAa;IAErC,YAAY,UAAuC;QACjD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;;;OASG;IACH,IAAI,eAAe;QACjB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAS;QACd,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,SAAS;QACP,IAAI,CAAC,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QAEf,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAwB,EAAE,GAAS;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,2CAA2C,CACnD,6DAA6D;gBAC3D,6DAA6D,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,yCAAyC,CACjD,mEAAmE;gBACjE,qBAAqB,CACxB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,SAAsC;QACxC,MAAM,OAAO,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAEtD,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAErC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC/B,gCAAgC,CAC9B,IAAI,EACJ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,KAAK,SAAS,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,CAA4B;QACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.d.ts

@@ -1,3 +1,4 @@
+import type { SimCognitoUserPoolSchema } from "../schema/sim-cognito-user-pool-schema.js";
 /**
  * One user attribute, in the shape Cognito reads and reports it.
  *
@@ -7,22 +8,38 @@ export interface SimCognitoAttributeType {
     readonly Name?: string | undefined;
     readonly Value?: string | undefined;
 }
+interface SimCognitoUserAttributesProperties {
+    /** The schema of the pool the user belongs to, which every write is held to. */
+    readonly schema: SimCognitoUserPoolSchema;
+    /** The attributes the request creating the user set. */
+    readonly requested?: readonly SimCognitoAttributeType[] | undefined;
+}
 /**
  * The attributes held on one simulated user.
  *
  * Attribute names are checked against the pool's schema rather than stored as
  * written, because real Cognito refuses an attribute its schema does not hold.
- * A pool created here has the standard schema and nothing else, so a
- * `custom:` attribute is refused the same way it would be on a real pool
- * created without it.
+ * A pool created without a `Schema` of its own has the standard attributes and
+ * nothing else, so a `custom:` attribute is refused there exactly as it would
+ * be on a real pool created the same way.
+ *
+ * The schema decides more than the name: what kind of value the attribute
+ * holds, how long or how large it may be, and whether a user that already has
+ * it can be given another value.
  *
  * `sub` is not among them. Cognito allocates it, and a request setting it is
  * refused, so it lives on the user rather than in its attributes.
  */
 export declare class SimCognitoUserAttributes {
     private readonly byName;
-    constructor(requested?: readonly SimCognitoAttributeType[]);
-    private static requireName;
+    private readonly schema;
+    /**
+     * Whether the user this belongs to exists yet, which is what decides an
+     * immutable attribute: Cognito takes one while the user is being created and
+     * refuses every write afterwards.
+     */
+    private readonly created;
+    constructor(properties: SimCognitoUserAttributesProperties);
     private static requireValue;
     /**
      * The attributes by name, in the order they were first set.
@@ -48,5 +65,21 @@ export declare class SimCognitoUserAttributes {
      * value rather than being cleared.
      */
     update(requested?: readonly SimCognitoAttributeType[]): void;
+    /**
+     * Write one attribute, holding it to everything the schema says about it.
+     *
+     * Every write after the user was created is held to the attribute's
+     * mutability, whether or not the user has the attribute already. Real
+     * Cognito refuses both: an immutable attribute is one a user is created with
+     * or does without, and `AdminUpdateUserAttributes` cannot give it a first
+     * value any more than a second one.
+     */
+    private write;
+    /**
+     * The schema attribute a request names, or a refusal saying why the pool has
+     * no such attribute.
+     */
+    private requireInSchema;
 }
+export {};
 //# sourceMappingURL=sim-cognito-user-attributes.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-attributes.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAID;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,YAAY,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,EAEzD;IAED,OAAO,CAAC,MAAM,CAAC,WAAW;IAyB1B,OAAO,CAAC,MAAM,CAAC,YAAY;IAiB3B;;OAEG;IACH,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAExC;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,uBAAuB,EAAE,CAKhD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAMrC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,IAAI,CAa3D;CACF"}
+{"version":3,"file":"sim-cognito-user-attributes.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,UAAU,kCAAkC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAE1C,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;CACrE;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAElD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAE1C,YAAY,UAAU,EAAE,kCAAkC,EAKzD;IAED,OAAO,CAAC,MAAM,CAAC,YAAY;IAU3B;;OAEG;IACH,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAExC;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,uBAAuB,EAAE,CAKhD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAMrC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,IAAI,CAQ3D;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK;IAeb;;;OAGG;IACH,OAAO,CAAC,eAAe;CAwBxB"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.js

@@ -1,46 +1,39 @@
 import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
-import { isSimCognitoStandardAttribute } from "./sim-cognito-standard-attributes.js";
-const maxAttributeValueLength = 2048;
 /**
  * The attributes held on one simulated user.
  *
  * Attribute names are checked against the pool's schema rather than stored as
  * written, because real Cognito refuses an attribute its schema does not hold.
- * A pool created here has the standard schema and nothing else, so a
- * `custom:` attribute is refused the same way it would be on a real pool
- * created without it.
+ * A pool created without a `Schema` of its own has the standard attributes and
+ * nothing else, so a `custom:` attribute is refused there exactly as it would
+ * be on a real pool created the same way.
+ *
+ * The schema decides more than the name: what kind of value the attribute
+ * holds, how long or how large it may be, and whether a user that already has
+ * it can be given another value.
  *
  * `sub` is not among them. Cognito allocates it, and a request setting it is
  * refused, so it lives on the user rather than in its attributes.
  */
 export class SimCognitoUserAttributes {
     byName = new Map();
-    constructor(requested) {
-        this.update(requested);
-    }
-    static requireName(name) {
-        if (name === undefined || name === "") {
-            throw new SimCognitoInvalidParameterException("A user attribute needs a Name saying which attribute it sets");
-        }
-        if (name === "sub") {
-            throw new SimCognitoInvalidParameterException("User attribute 'sub' is read-only: Cognito allocates a user's sub " +
-                "when the user is created, and a request cannot set it");
-        }
-        if (!isSimCognitoStandardAttribute(name)) {
-            throw new SimCognitoInvalidParameterException(`User attribute '${name}' is not in the pool's schema: a pool here ` +
-                `holds the standard attributes only, because CreateUserPool ` +
-                `refuses a Schema of its own, so custom attributes cannot exist`);
-        }
-        return name;
+    schema;
+    /**
+     * Whether the user this belongs to exists yet, which is what decides an
+     * immutable attribute: Cognito takes one while the user is being created and
+     * refuses every write afterwards.
+     */
+    created = false;
+    constructor(properties) {
+        this.schema = properties.schema;
+        this.update(properties.requested);
+        this.schema.requireEveryRequired(new Set(this.byName.keys()));
+        this.created = true;
     }
     static requireValue(name, value) {
         if (value === undefined) {
             throw new SimCognitoInvalidParameterException(`User attribute '${name}' needs a Value`);
         }
-        if (value.length > maxAttributeValueLength) {
-            throw new SimCognitoInvalidParameterException(`User attribute '${name}' is longer than the ` +
-                `${String(maxAttributeValueLength)} characters Cognito allows`);
-        }
         return value;
     }
     /**
@@ -82,9 +75,44 @@ export class SimCognitoUserAttributes {
             return;
         }
         for (const attribute of requested) {
-            const name = SimCognitoUserAttributes.requireName(attribute.Name);
-            this.byName.set(name, SimCognitoUserAttributes.requireValue(name, attribute.Value));
+            this.write(attribute);
+        }
+    }
+    /**
+     * Write one attribute, holding it to everything the schema says about it.
+     *
+     * Every write after the user was created is held to the attribute's
+     * mutability, whether or not the user has the attribute already. Real
+     * Cognito refuses both: an immutable attribute is one a user is created with
+     * or does without, and `AdminUpdateUserAttributes` cannot give it a first
+     * value any more than a second one.
+     */
+    write(requested) {
+        const attribute = this.requireInSchema(requested.Name);
+        const value = SimCognitoUserAttributes.requireValue(attribute.name, requested.Value);
+        if (this.created) {
+            attribute.requireMutable();
+        }
+        attribute.requireValue(value);
+        this.byName.set(attribute.name, value);
+    }
+    /**
+     * The schema attribute a request names, or a refusal saying why the pool has
+     * no such attribute.
+     */
+    requireInSchema(name) {
+        if (name === undefined || name === "") {
+            throw new SimCognitoInvalidParameterException("A user attribute needs a Name saying which attribute it sets");
+        }
+        if (name === "sub") {
+            throw new SimCognitoInvalidParameterException("User attribute 'sub' is read-only: Cognito allocates a user's sub " +
+                "when the user is created, and a request cannot set it");
+        }
+        const attribute = this.schema.find(name);
+        if (attribute === undefined) {
+            throw new SimCognitoInvalidParameterException(`User attribute '${name}' is not in the pool's schema: ${this.schema.describeHolding()}`);
         }
+        return attribute;
     }
 }
 //# sourceMappingURL=sim-cognito-user-attributes.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-attributes.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAYrF,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAY,SAA8C;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,IAAwB;QACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mCAAmC,CAC3C,oEAAoE;gBAClE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,6CAA6C;gBAClE,6DAA6D;gBAC7D,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,KAAyB;QACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,iBAAiB,CACzC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC3C,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,uBAAuB;gBAC5C,GAAG,MAAM,CAAC,uBAAuB,CAAC,4BAA4B,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM;aACf,OAAO,EAAE;aACT,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACtD,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAwB;QAC7B,IAAI,CAAC,MAAM,CACT,KAAK;aACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAA8C;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,wBAAwB,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAElE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,IAAI,EACJ,wBAAwB,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-attributes.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAsBvF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,wBAAwB;IAClB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,MAAM,CAA2B;IAElD;;;;OAIG;IACc,OAAO,GAAY,KAAK,CAAC;IAE1C,YAAY,UAA8C;QACxD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,KAAyB;QACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,iBAAiB,CACzC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM;aACf,OAAO,EAAE;aACT,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACtD,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAwB;QAC7B,IAAI,CAAC,MAAM,CACT,KAAK;aACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAA8C;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,SAAkC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,YAAY,CACjD,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,KAAK,CAChB,CAAC;QAEF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS,CAAC,cAAc,EAAE,CAAC;QAC7B,CAAC;QAED,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,IAAwB;QAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mCAAmC,CAC3C,oEAAoE;gBAClE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,kCAAkC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CACzF,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.d.ts

@@ -1,5 +1,6 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoFederatedIdentity } from "../idp/sim-cognito-federated-identity.js";
+import type { SimCognitoUserPoolSchema } from "../schema/sim-cognito-user-pool-schema.js";
 import type { SimCognitoPasswordPolicy } from "../sim-cognito-password-policy.js";
 import { type SimCognitoAttributeType } from "./sim-cognito-user-attributes.js";
 import { SimCognitoUser } from "./sim-cognito-user.js";
@@ -7,9 +8,16 @@ import type { SimCognitoUsername } from "./sim-cognito-username.js";
 interface SimCognitoUserFactoryProperties {
     readonly clock: SimClock;
 }
-interface SimCognitoMakeUserProperties {
+interface SimCognitoNewUserProperties {
     readonly username: SimCognitoUsername;
     readonly attributes?: readonly SimCognitoAttributeType[] | undefined;
+    /**
+     * The schema of the pool the user is going into, which decides which
+     * attributes it may be given and what each of them may hold.
+     */
+    readonly schema: SimCognitoUserPoolSchema;
+}
+interface SimCognitoMakeUserProperties extends SimCognitoNewUserProperties {
     /**
      * The password the user starts with, checked here against the pool's policy.
      * A user made without one has no password at all.
@@ -18,15 +26,11 @@ interface SimCognitoMakeUserProperties {
     /** The policy the pool holds its users' passwords to. */
     readonly passwordPolicy: SimCognitoPasswordPolicy;
 }
-interface SimCognitoFederatedUserProperties {
-    readonly username: SimCognitoUsername;
-    readonly attributes?: readonly SimCognitoAttributeType[] | undefined;
+interface SimCognitoFederatedUserProperties extends SimCognitoNewUserProperties {
     /** Which provider signed the user in, and which subject it signed in as. */
     readonly identity: SimCognitoFederatedIdentity;
 }
-interface SimCognitoSignUpUserProperties {
-    readonly username: SimCognitoUsername;
-    readonly attributes?: readonly SimCognitoAttributeType[] | undefined;
+interface SimCognitoSignUpUserProperties extends SimCognitoNewUserProperties {
     /**
      * The password the user chose, checked here against the pool's policy. It is
      * the user's own rather than a temporary one, so the user signs in with it