@kensio/yulin 1.14.2 → 1.15.1

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.js

@@ -21,12 +21,15 @@ export class SimCognitoAuthSession {
     clientId;
     challengeName;
     issuedAt;
+    /** The code this challenge sent, where it sent one. */
+    code;
     constructor(properties) {
         this.id = randomBytes(sessionBytes).toString("base64url");
         this.username = properties.username;
         this.clientId = properties.clientId;
         this.challengeName = properties.challengeName;
         this.issuedAt = properties.issuedAt;
+        this.code = properties.code;
     }
     /**
      * Whether this session has run out by a given moment.
@@ -41,5 +44,15 @@ export class SimCognitoAuthSession {
     belongsTo(username, clientId) {
         return this.username === username && this.clientId === clientId;
     }
+    /**
+     * Whether this session was issued for the challenge being answered.
+     *
+     * A session carries one challenge, so answering an `SMS_MFA` challenge with
+     * the session from a `NEW_PASSWORD_REQUIRED` one is no more a valid session
+     * than one from another user.
+     */
+    answers(challengeName) {
+        return this.challengeName === challengeName;
+    }
 }
 //# sourceMappingURL=sim-cognito-auth-session.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,YAAY,GAAG,EAAE,CAAC;AASxB;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAChB,EAAE,CAAS;IACX,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAO;IAE/B,YAAY,UAA2C;QACrD,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,IAAI,CACrD,CAAC;QAEF,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,QAAgB;QAC1C,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAClE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-auth-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,YAAY,GAAG,EAAE,CAAC;AAoBxB;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAChB,EAAE,CAAS;IACX,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAO;IAE/B,uDAAuD;IACvC,IAAI,CAAqB;IAEzC,YAAY,UAA2C;QACrD,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,IAAI,CACrD,CAAC;QAEF,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,QAAgB;QAC1C,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAqB;QAC3B,OAAO,IAAI,CAAC,aAAa,KAAK,aAAa,CAAC;IAC9C,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts

@@ -31,6 +31,16 @@ export declare class SimCognitoIssuedToken {
      */
     readonly scopes: readonly string[];
     constructor(properties: SimCognitoIssuedTokenProperties);
+    /**
+     * Whether this token may act on the user it was issued to.
+     *
+     * Real Cognito refuses an operation a user performs on itself where the
+     * access token does not carry `aws.cognito.signin.user.admin`. A token from
+     * an API sign-in always carries it, which is what an empty scope list here
+     * means, and a hosted sign-in carries it only where the app client asked for
+     * it among its `AllowedOAuthScopes`.
+     */
+    get actsForUser(): boolean;
     /**
      * Whether this token has run out by a given moment.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC;;;OAGG;IACH,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,UAAU,EAAE,+BAA+B,EAOtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAEA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC;;;OAGG;IACH,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,UAAU,EAAE,+BAA+B,EAOtD;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW,IAAI,OAAO,CAKzB;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js

@@ -1,3 +1,4 @@
+import { simCognitoUserPoolAdminScope } from "../token/sim-cognito-access-token.js";
 /**
  * One token a pool has issued, as the pool remembers it.
  *
@@ -26,6 +27,19 @@ export class SimCognitoIssuedToken {
         this.expiresAt = properties.expiresAt;
         this.scopes = properties.scopes ?? [];
     }
+    /**
+     * Whether this token may act on the user it was issued to.
+     *
+     * Real Cognito refuses an operation a user performs on itself where the
+     * access token does not carry `aws.cognito.signin.user.admin`. A token from
+     * an API sign-in always carries it, which is what an empty scope list here
+     * means, and a hosted sign-in carries it only where the app client asked for
+     * it among its `AllowedOAuthScopes`.
+     */
+    get actsForUser() {
+        return (this.scopes.length === 0 ||
+            this.scopes.includes(simCognitoUserPoolAdminScope));
+    }
     /**
      * Whether this token has run out by a given moment.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAcA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC;;;OAGG;IACa,MAAM,CAAoB;IAE1C,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAgBpF;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC;;;OAGG;IACa,MAAM,CAAoB;IAE1C,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW;QACb,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CACnD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.d.ts

@@ -1,3 +1,4 @@
+import type { SimCognitoUserPoolSchema } from "../schema/sim-cognito-user-pool-schema.js";
 import type { SimCognitoAttributeType } from "../user/sim-cognito-user-attributes.js";
 import type { SimCognitoExternalUser } from "./sim-cognito-external-user.js";
 /**
@@ -18,7 +19,8 @@ export type SimCognitoAttributeMappingType = Readonly<Record<string, string>>;
  */
 export declare class SimCognitoAttributeMapping {
     private readonly mapping;
-    constructor(mapping: SimCognitoAttributeMappingType | undefined);
+    private readonly schema;
+    constructor(mapping: SimCognitoAttributeMappingType | undefined, schema: SimCognitoUserPoolSchema);
     /**
      * This mapping as a described provider reports it.
      */
@@ -28,12 +30,16 @@ export declare class SimCognitoAttributeMapping {
      */
     attributesFor(externalUser: SimCognitoExternalUser): readonly SimCognitoAttributeType[];
     /**
-     * Refuse a mapping onto an attribute no pool here holds.
+     * Refuse a mapping onto an attribute the pool's schema does not hold.
+     *
+     * A `custom:` attribute the pool declared is as good a target as a standard
+     * one, and one it did not declare is refused here rather than during a
+     * sign-in much later, which is where writing the attribute would otherwise
+     * catch it.
      *
      * `username` is refused with its own message: real Cognito builds a
      * federated user's username from the provider and the subject, and a mapping
-     * cannot change it. It is refused here rather than during a sign-in much
-     * later, which is where the pool's schema would otherwise catch it.
+     * cannot change it.
      */
     private requireMappedNames;
 }

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-attribute-mapping.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YAAY,OAAO,EAAE,8BAA8B,GAAG,SAAS,EAG9D;IAED;;OAEG;IACH,QAAQ,IAAI,8BAA8B,CAEzC;IAED;;OAEG;IACH,aAAa,CACX,YAAY,EAAE,sBAAsB,GACnC,SAAS,uBAAuB,EAAE,CAOpC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}
+{"version":3,"file":"sim-cognito-attribute-mapping.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAElD,YACE,OAAO,EAAE,8BAA8B,GAAG,SAAS,EACnD,MAAM,EAAE,wBAAwB,EAKjC;IAED;;OAEG;IACH,QAAQ,IAAI,8BAA8B,CAEzC;IAED;;OAEG;IACH,aAAa,CACX,YAAY,EAAE,sBAAsB,GACnC,SAAS,uBAAuB,EAAE,CAOpC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.js

@@ -1,5 +1,4 @@
 import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
-import { isSimCognitoStandardAttribute } from "../user/sim-cognito-standard-attributes.js";
 /**
  * What a provider's claims become on the pool user signing in.
  *
@@ -9,8 +8,10 @@ import { isSimCognitoStandardAttribute } from "../user/sim-cognito-standard-attr
  */
 export class SimCognitoAttributeMapping {
     mapping;
-    constructor(mapping) {
+    schema;
+    constructor(mapping, schema) {
         this.mapping = { ...mapping };
+        this.schema = schema;
         this.requireMappedNames();
     }
     /**
@@ -31,12 +32,16 @@ export class SimCognitoAttributeMapping {
             .filter((attribute) => attribute.Value !== undefined);
     }
     /**
-     * Refuse a mapping onto an attribute no pool here holds.
+     * Refuse a mapping onto an attribute the pool's schema does not hold.
+     *
+     * A `custom:` attribute the pool declared is as good a target as a standard
+     * one, and one it did not declare is refused here rather than during a
+     * sign-in much later, which is where writing the attribute would otherwise
+     * catch it.
      *
      * `username` is refused with its own message: real Cognito builds a
      * federated user's username from the provider and the subject, and a mapping
-     * cannot change it. It is refused here rather than during a sign-in much
-     * later, which is where the pool's schema would otherwise catch it.
+     * cannot change it.
      */
     requireMappedNames() {
         for (const attributeName of Object.keys(this.mapping)) {
@@ -45,10 +50,10 @@ export class SimCognitoAttributeMapping {
                     "federated user's username from the provider name and the " +
                     "subject it signed in with");
             }
-            if (!isSimCognitoStandardAttribute(attributeName)) {
+            if (!this.schema.holds(attributeName)) {
                 throw new SimCognitoInvalidParameterException(`AttributeMapping '${attributeName}' is not in the pool's schema: ` +
-                    `a pool here holds the standard attributes only, so there is ` +
-                    `nothing for the provider's claim to be mapped onto`);
+                    `${this.schema.describeHolding()}, so there is nothing for the ` +
+                    `provider's claim to be mapped onto`);
             }
         }
     }

package/dist/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-attribute-mapping.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAc3F;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,OAAO,CAAiC;IAEzD,YAAY,OAAmD;QAC7D,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CACX,YAAoC;QAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACK,kBAAkB;QACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D;oBAC5D,2DAA2D;oBAC3D,2BAA2B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,aAAa,iCAAiC;oBACjE,8DAA8D;oBAC9D,oDAAoD,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-attribute-mapping.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-attribute-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAevF;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,OAAO,CAAiC;IACxC,MAAM,CAA2B;IAElD,YACE,OAAmD,EACnD,MAAgC;QAEhC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CACX,YAAoC;QAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACK,kBAAkB;QACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D;oBAC5D,2DAA2D;oBAC3D,2BAA2B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,aAAa,iCAAiC;oBACjE,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,gCAAgC;oBAChE,oCAAoC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-federated-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAEvG,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAmBlC;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,gCAAgC,GAAG,cAAc,CA+BhE;CACF"}
+{"version":3,"file":"sim-cognito-federated-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAEvG,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAmBlC;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,gCAAgC,GAAG,cAAc,CAgChE;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js

@@ -57,6 +57,7 @@ export class SimCognitoFederatedSignIn {
         const user = this.userFactory.federated({
             username,
             attributes,
+            schema: pool.settings.schema,
             identity: new SimCognitoFederatedIdentity({
                 userId: externalUser.subject,
                 providerName: provider.name,

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-federated-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAalF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,CAAwB;IAEpD,YAAY,UAA+C;QACzD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB,CAChC,QAAwB,EACxB,QAA4C;QAE5C,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC9B,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAEpD,IACE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,IAAI;YACxC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,EACxC,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,QAAQ,QAAQ,CAAC,QAAQ,+BAA+B;gBACtD,GAAG,QAAQ,CAAC,UAAU,mBAAmB,QAAQ,CAAC,IAAI,aAAa;gBACnE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAyC;QAC9C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,yBAAyB,CACxC,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,CAC3C,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yBAAyB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAClE,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEtC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YACtC,QAAQ;YACR,UAAU;YACV,QAAQ,EAAE,IAAI,2BAA2B,CAAC;gBACxC,MAAM,EAAE,YAAY,CAAC,OAAO;gBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,GAAG;aACf,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-federated-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAIrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAalF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,CAAwB;IAEpD,YAAY,UAA+C;QACzD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB,CAChC,QAAwB,EACxB,QAA4C;QAE5C,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC9B,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAEpD,IACE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,IAAI;YACxC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,EACxC,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,QAAQ,QAAQ,CAAC,QAAQ,+BAA+B;gBACtD,GAAG,QAAQ,CAAC,UAAU,mBAAmB,QAAQ,CAAC,IAAI,aAAa;gBACnE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAyC;QAC9C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,yBAAyB,CACxC,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,CAC3C,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yBAAyB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAClE,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAEtC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YACtC,QAAQ;YACR,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC5B,QAAQ,EAAE,IAAI,2BAA2B,CAAC;gBACxC,MAAM,EAAE,YAAY,CAAC,OAAO;gBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,GAAG;aACf,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.d.ts

@@ -1,3 +1,4 @@
+import type { SimCognitoUserPoolSchema } from "../schema/sim-cognito-user-pool-schema.js";
 import { SimCognitoAttributeMapping, type SimCognitoAttributeMappingType } from "./sim-cognito-attribute-mapping.js";
 import { SimCognitoProviderDetails, type SimCognitoProviderDetailsType } from "./sim-cognito-provider-details.js";
 import { SimCognitoProviderType } from "./sim-cognito-provider-type.js";
@@ -17,6 +18,10 @@ export interface SimCognitoIdentityProviderSettingsInput {
  * `CreateIdentityProvider` builds one of these from its request. The provider
  * name is among them although an update cannot change it, because the name is
  * what the update names the provider by and the settings are what hold it.
+ *
+ * The pool's schema comes in alongside the request because the attribute
+ * mapping is checked against it: a claim can only be mapped onto an attribute
+ * the pool holds.
  */
 export declare class SimCognitoIdentityProviderSettings {
     readonly name: string;
@@ -24,7 +29,7 @@ export declare class SimCognitoIdentityProviderSettings {
     readonly details: SimCognitoProviderDetails;
     readonly attributeMapping: SimCognitoAttributeMapping;
     readonly idpIdentifiers: readonly string[];
-    constructor(input: SimCognitoIdentityProviderSettingsInput);
+    constructor(input: SimCognitoIdentityProviderSettingsInput, schema: SimCognitoUserPoolSchema);
     /**
      * Check the name a provider is known by in its pool.
      *

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-identity-provider-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,EACpC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,eAAe,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;GAMG;AACH,qBAAa,kCAAkC;IAC7C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,IAAI,EAAE,sBAAsB,CAAC;IAC7C,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IACnD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAC7D,SAAgB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAElD,YAAY,KAAK,EAAE,uCAAuC,EAazD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;CAuB5B"}
+{"version":3,"file":"sim-cognito-identity-provider-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,EACpC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,eAAe,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,kCAAkC;IAC7C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,IAAI,EAAE,sBAAsB,CAAC;IAC7C,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IACnD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAC7D,SAAgB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAElD,YACE,KAAK,EAAE,uCAAuC,EAC9C,MAAM,EAAE,wBAAwB,EAejC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;CAuB5B"}

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.js

@@ -16,6 +16,10 @@ const localProviderName = "COGNITO";
  * `CreateIdentityProvider` builds one of these from its request. The provider
  * name is among them although an update cannot change it, because the name is
  * what the update names the provider by and the settings are what hold it.
+ *
+ * The pool's schema comes in alongside the request because the attribute
+ * mapping is checked against it: a claim can only be mapped onto an attribute
+ * the pool holds.
  */
 export class SimCognitoIdentityProviderSettings {
     name;
@@ -23,11 +27,11 @@ export class SimCognitoIdentityProviderSettings {
     details;
     attributeMapping;
     idpIdentifiers;
-    constructor(input) {
+    constructor(input, schema) {
         this.name = SimCognitoIdentityProviderSettings.requiredName(input.ProviderName);
         this.type = new SimCognitoProviderType(input.ProviderType);
         this.details = new SimCognitoProviderDetails(this.type, input.ProviderDetails);
-        this.attributeMapping = new SimCognitoAttributeMapping(input.AttributeMapping);
+        this.attributeMapping = new SimCognitoAttributeMapping(input.AttributeMapping, schema);
         this.idpIdentifiers = [...(input.IdpIdentifiers ?? [])];
     }
     /**

package/dist/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-identity-provider-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,0BAA0B,GAE3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAapC;;;;;;GAMG;AACH,MAAM,OAAO,kCAAkC;IAC7B,IAAI,CAAS;IACb,IAAI,CAAyB;IAC7B,OAAO,CAA4B;IACnC,gBAAgB,CAA6B;IAC7C,cAAc,CAAoB;IAElD,YAAY,KAA8C;QACxD,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC,YAAY,CACzD,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAC1C,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CACpD,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,YAAY,CAAC,KAAyB;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,KAAK,4CAA4C;gBAChE,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,iBAAiB,oCAAoC;gBACpE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-identity-provider-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/idp/sim-cognito-identity-provider-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF,OAAO,EACL,0BAA0B,GAE3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAapC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kCAAkC;IAC7B,IAAI,CAAS;IACb,IAAI,CAAyB;IAC7B,OAAO,CAA4B;IACnC,gBAAgB,CAA6B;IAC7C,cAAc,CAAoB;IAElD,YACE,KAA8C,EAC9C,MAAgC;QAEhC,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC,YAAY,CACzD,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAC1C,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CACpD,KAAK,CAAC,gBAAgB,EACtB,MAAM,CACP,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,YAAY,CAAC,KAAyB;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,KAAK,4CAA4C;gBAChE,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAChC,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,iBAAiB,oCAAoC;gBACpE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/user-pool/message/sim-cognito-message-delivery.d.ts

@@ -27,6 +27,23 @@ export declare class SimCognitoMessageDelivery {
      * to the user. An invitation goes wherever the user can be reached.
      */
     static forOccasion(pool: SimCognitoUserPool, user: SimCognitoUser, occasion: SimCognitoMessageOccasion): SimCognitoMessageDelivery | undefined;
+    /**
+     * The attributes this occasion could write to, in the order Cognito prefers
+     * them.
+     *
+     * An MFA code goes to the user's phone number and nowhere else, because the
+     * phone is the factor: a user with an email address as well is still
+     * challenged by text message, where every other occasion would have written
+     * to the address.
+     */
+    private static attributesFor;
+    /**
+     * A verification message goes only to an attribute the pool verifies
+     * automatically, because that is the address it is trying to prove belongs
+     * to the user. An invitation goes wherever the user can be reached, and so
+     * does an MFA code: the user registered that phone number as its second
+     * factor, whatever the pool verifies.
+     */
     private static writable;
 }
 //# sourceMappingURL=sim-cognito-message-delivery.d.ts.map

package/dist/service/cognito/user-pool/message/sim-cognito-message-delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-message-delivery.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAgB7E;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,MAAM,EAAE,uBAAuB,CAAC;IAEhD,OAAO,eAGN;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,WAAW,CAChB,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,GAAG,SAAS,CAUvC;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;CAUxB"}
+{"version":3,"file":"sim-cognito-message-delivery.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAgB7E;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,MAAM,EAAE,uBAAuB,CAAC;IAEhD,OAAO,eAGN;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,WAAW,CAChB,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,GAAG,SAAS,CAUvC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAU5B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;CAWxB"}

package/dist/service/cognito/user-pool/message/sim-cognito-message-delivery.js

@@ -36,7 +36,7 @@ export class SimCognitoMessageDelivery {
      * to the user. An invitation goes wherever the user can be reached.
      */
     static forOccasion(pool, user, occasion) {
-        for (const [name, medium] of deliverableAttributes) {
+        for (const [name, medium] of this.attributesFor(occasion)) {
             const value = user.attributeValues.get(name);
             if (value !== undefined && this.writable(pool, occasion, name)) {
                 return new SimCognitoMessageDelivery(value, medium);
@@ -44,8 +44,31 @@ export class SimCognitoMessageDelivery {
         }
         return undefined;
     }
+    /**
+     * The attributes this occasion could write to, in the order Cognito prefers
+     * them.
+     *
+     * An MFA code goes to the user's phone number and nowhere else, because the
+     * phone is the factor: a user with an email address as well is still
+     * challenged by text message, where every other occasion would have written
+     * to the address.
+     */
+    static attributesFor(occasion) {
+        if (occasion === "Authentication") {
+            return [["phone_number", "SMS"]];
+        }
+        return deliverableAttributes;
+    }
+    /**
+     * A verification message goes only to an attribute the pool verifies
+     * automatically, because that is the address it is trying to prove belongs
+     * to the user. An invitation goes wherever the user can be reached, and so
+     * does an MFA code: the user registered that phone number as its second
+     * factor, whatever the pool verifies.
+     */
     static writable(pool, occasion, name) {
         return (occasion === "AdminCreateUser" ||
+            occasion === "Authentication" ||
             pool.settings.autoVerifiedAttributes.names.includes(name));
     }
 }

package/dist/service/cognito/user-pool/message/sim-cognito-message-delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-message-delivery.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-delivery.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,MAAM,qBAAqB,GAGpB;IACL,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,cAAc,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACpB,SAAS,CAAS;IAClB,MAAM,CAA0B;IAEhD,YAAoB,SAAiB,EAAE,MAA+B;QACpE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,WAAW,CAChB,IAAwB,EACxB,IAAoB,EACpB,QAAmC;QAEnC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,QAAQ,CACrB,IAAwB,EACxB,QAAmC,EACnC,IAAY;QAEZ,OAAO,CACL,QAAQ,KAAK,iBAAiB;YAC9B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-message-delivery.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-delivery.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,MAAM,qBAAqB,GAGpB;IACL,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,cAAc,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACpB,SAAS,CAAS;IAClB,MAAM,CAA0B;IAEhD,YAAoB,SAAiB,EAAE,MAA+B;QACpE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,WAAW,CAChB,IAAwB,EACxB,IAAoB,EACpB,QAAmC;QAEnC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,aAAa,CAC1B,QAAmC;QAEnC,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,QAAQ,CACrB,IAAwB,EACxB,QAAmC,EACnC,IAAY;QAEZ,OAAO,CACL,QAAQ,KAAK,iBAAiB;YAC9B,QAAQ,KAAK,gBAAgB;YAC7B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/message/sim-cognito-message-occasion.d.ts

@@ -1,13 +1,14 @@
 /**
  * What made a simulated user pool send a message.
  *
- * These are the three occasions this simulation reaches: a user signing itself
- * up, that user asking for another code, and an administrator creating a user.
- * Real Cognito sends on more of them, password reset and MFA among them, and
- * neither of those is simulated here.
+ * These are the four occasions this simulation reaches: a user signing itself
+ * up, that user asking for another code, an administrator creating a user, and
+ * a sign-in being challenged for a code sent by text message. Real Cognito
+ * sends on more of them, a password reset among them, which is not simulated
+ * here.
  *
  * `SimCognitoTriggerOccasion.customMessage` turns one of these into the
  * occasion the `CustomMessage` trigger fires for.
  */
-export type SimCognitoMessageOccasion = "SignUp" | "ResendCode" | "AdminCreateUser";
+export type SimCognitoMessageOccasion = "SignUp" | "ResendCode" | "AdminCreateUser" | "Authentication";
 //# sourceMappingURL=sim-cognito-message-occasion.d.ts.map

package/dist/service/cognito/user-pool/message/sim-cognito-message-occasion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-message-occasion.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-occasion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,YAAY,GACZ,iBAAiB,CAAC"}
+{"version":3,"file":"sim-cognito-message-occasion.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-message-occasion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,YAAY,GACZ,iBAAiB,GACjB,gBAAgB,CAAC"}

package/dist/service/cognito/user-pool/message/sim-cognito-occasion-wording.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-occasion-wording.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-occasion-wording.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAe7E;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,yBAAyB,EACnC,MAAM,EAAE,uBAAuB,GAC9B,wBAAwB,CAa1B"}
+{"version":3,"file":"sim-cognito-occasion-wording.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-occasion-wording.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAwB7E;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,yBAAyB,EACnC,MAAM,EAAE,uBAAuB,GAC9B,wBAAwB,CAiB1B"}

package/dist/service/cognito/user-pool/message/sim-cognito-occasion-wording.js

@@ -10,6 +10,14 @@ import { SimCognitoMessageWording } from "./sim-cognito-message-wording.js";
  */
 const invitationSubject = "Your temporary password";
 const invitationMessage = "Your username is {username} and temporary password is {####}.";
+/**
+ * The wording real Cognito sends an MFA code with when the pool asked for
+ * none.
+ *
+ * `SmsAuthenticationMessage` is what a pool sets its own with, and that input
+ * is refused here, so this is the wording every MFA code goes out under.
+ */
+const authenticationMessage = "Your authentication code is {####}.";
 /**
  * What a pool says on the occasion it is sending on.
  *
@@ -18,6 +26,9 @@ const invitationMessage = "Your username is {username} and temporary password is
  * be set on a pool here.
  */
 export function simCognitoOccasionWording(pool, occasion, medium) {
+    if (occasion === "Authentication") {
+        return new SimCognitoMessageWording({ body: authenticationMessage });
+    }
     if (occasion !== "AdminCreateUser") {
         return pool.settings.verificationMessages.wording(medium);
     }

package/dist/service/cognito/user-pool/message/sim-cognito-occasion-wording.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-occasion-wording.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-occasion-wording.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAG5E;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,iBAAiB,GACrB,+DAA+D,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAwB,EACxB,QAAmC,EACnC,MAA+B;IAE/B,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,wBAAwB,CAAC;QAClC,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-cognito-occasion-wording.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/message/sim-cognito-occasion-wording.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAG5E;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,iBAAiB,GACrB,+DAA+D,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,qCAAqC,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAwB,EACxB,QAAmC,EACnC,MAA+B;IAE/B,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,wBAAwB,CAAC;QAClC,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.d.ts

@@ -0,0 +1,35 @@
+export type SimCognitoMfaConfigurationValue = "OFF" | "ON" | "OPTIONAL";
+/**
+ * Whether a user pool asks a user for a second factor when it signs in.
+ *
+ * A pool is created `OFF` unless the request asks for something else.
+ * `OPTIONAL` challenges only the users that have registered a factor, and `ON`
+ * challenges every user.
+ *
+ * The setting is acted on: a sign-in by a user of an `OPTIONAL` or `ON` pool
+ * that has registered a factor is answered with the challenge for it. The one
+ * case left is a user of an `ON` pool that has registered none, which real
+ * Cognito answers with `MFA_SETUP`, and that sign-in is refused where the
+ * challenge would have been issued rather than at pool creation.
+ */
+export declare class SimCognitoMfaConfiguration {
+    readonly value: SimCognitoMfaConfigurationValue;
+    constructor(requested: string | undefined);
+    /**
+     * Whether any sign-in to the pool could be challenged for a second factor.
+     *
+     * A pool configured `OFF` challenges nobody, whatever factors its users
+     * have registered, so a sign-in to one goes straight to tokens.
+     */
+    get challengesAnySignIn(): boolean;
+    /**
+     * Whether every sign-in to the pool has to get past a second factor.
+     *
+     * A user of an `ON` pool is answered with a challenge on real Cognito
+     * whether or not it has registered a factor: one that has is challenged for
+     * it, and one that has not is answered with `MFA_SETUP`, which is the
+     * challenge this simulation does not issue.
+     */
+    get challengesEverySignIn(): boolean;
+}
+//# sourceMappingURL=sim-cognito-mfa-configuration.d.ts.map

package/dist/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-configuration.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,+BAA+B,GAAG,KAAK,GAAG,IAAI,GAAG,UAAU,CAAC;AAKxE;;;;;;;;;;;;GAYG;AACH,qBAAa,0BAA0B;IACrC,SAAgB,KAAK,EAAE,+BAA+B,CAAC;IAEvD,YAAY,SAAS,EAAE,MAAM,GAAG,SAAS,EAgBxC;IAED;;;;;OAKG;IACH,IAAI,mBAAmB,IAAI,OAAO,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,qBAAqB,IAAI,OAAO,CAEnC;CACF"}

package/dist/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.js

@@ -0,0 +1,50 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+const mfaConfigurationValues = new Set(["OFF", "ON", "OPTIONAL"]);
+/**
+ * Whether a user pool asks a user for a second factor when it signs in.
+ *
+ * A pool is created `OFF` unless the request asks for something else.
+ * `OPTIONAL` challenges only the users that have registered a factor, and `ON`
+ * challenges every user.
+ *
+ * The setting is acted on: a sign-in by a user of an `OPTIONAL` or `ON` pool
+ * that has registered a factor is answered with the challenge for it. The one
+ * case left is a user of an `ON` pool that has registered none, which real
+ * Cognito answers with `MFA_SETUP`, and that sign-in is refused where the
+ * challenge would have been issued rather than at pool creation.
+ */
+export class SimCognitoMfaConfiguration {
+    value;
+    constructor(requested) {
+        if (requested === undefined) {
+            this.value = "OFF";
+            return;
+        }
+        if (!mfaConfigurationValues.has(requested)) {
+            throw new SimCognitoInvalidParameterException(`MfaConfiguration '${requested}' is not a Cognito MFA ` +
+                `configuration: use OFF, OPTIONAL or ON`);
+        }
+        this.value = requested;
+    }
+    /**
+     * Whether any sign-in to the pool could be challenged for a second factor.
+     *
+     * A pool configured `OFF` challenges nobody, whatever factors its users
+     * have registered, so a sign-in to one goes straight to tokens.
+     */
+    get challengesAnySignIn() {
+        return this.value !== "OFF";
+    }
+    /**
+     * Whether every sign-in to the pool has to get past a second factor.
+     *
+     * A user of an `ON` pool is answered with a challenge on real Cognito
+     * whether or not it has registered a factor: one that has is challenged for
+     * it, and one that has not is answered with `MFA_SETUP`, which is the
+     * challenge this simulation does not issue.
+     */
+    get challengesEverySignIn() {
+        return this.value === "ON";
+    }
+}
+//# sourceMappingURL=sim-cognito-mfa-configuration.js.map

package/dist/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-configuration.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/mfa/sim-cognito-mfa-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAIvF,MAAM,sBAAsB,GAC1B,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAErC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,0BAA0B;IACrB,KAAK,CAAkC;IAEvD,YAAY,SAA6B;QACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IACE,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAA4C,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,mCAAmC,CAC3C,qBAAqB,SAAS,yBAAyB;gBACrD,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,SAA4C,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACH,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;IAC9B,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;CACF"}