@kensio/yulin 1.14.2 → 1.15.1

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.js

@@ -1,12 +1,16 @@
 import { SimCognitoAdminInitiateAuth } from "./sim-cognito-admin-initiate-auth.js";
 import { SimCognitoAdminRespondToChallenge } from "./sim-cognito-admin-respond-to-challenge.js";
 import { SimCognitoAuthFlowRunner } from "./sim-cognito-auth-flow-runner.js";
+import { SimCognitoChallengeResponses } from "./sim-cognito-challenge-responses.js";
 import { SimCognitoInitiateAuth } from "./sim-cognito-initiate-auth.js";
+import { SimCognitoMfaChallenge } from "./sim-cognito-mfa-challenge.js";
+import { SimCognitoMfaResponse } from "./sim-cognito-mfa-response.js";
 import { SimCognitoNewPasswordChallenge } from "./sim-cognito-new-password-challenge.js";
 import { SimCognitoNewPasswordResponse } from "./sim-cognito-new-password-response.js";
 import { SimCognitoPasswordSignIn } from "./sim-cognito-password-sign-in.js";
 import { SimCognitoRefreshSignIn } from "./sim-cognito-refresh-sign-in.js";
 import { SimCognitoRespondToChallenge } from "./sim-cognito-respond-to-challenge.js";
+import { SimCognitoSignInCompletion } from "./sim-cognito-sign-in-completion.js";
 import { SimCognitoSignOutCommands } from "./sim-cognito-sign-out.js";
 /**
  * The authentication command handlers of one simulated Cognito scope.
@@ -26,21 +30,31 @@ export class SimCognitoAuthCommands {
     respondToChallenge;
     signOut;
     constructor(properties) {
-        const { resolver, authResolver, pools, clock, triggers, tokenIssuer } = properties;
+        const { resolver, authResolver, pools, clock, triggers, tokenIssuer, messenger, } = properties;
+        // Every sign-in ends the same way, wherever it finished: with the second
+        // factor where the user owes one, and with the tokens and the
+        // PostAuthentication trigger where it does not.
+        const completion = new SimCognitoSignInCompletion({
+            tokenIssuer,
+            triggers,
+            mfaChallenge: new SimCognitoMfaChallenge({ messenger, clock }),
+        });
         const flowRunner = new SimCognitoAuthFlowRunner({
             passwordSignIn: new SimCognitoPasswordSignIn({
                 authResolver,
-                tokenIssuer,
+                completion,
                 challenge: new SimCognitoNewPasswordChallenge({ clock }),
                 triggers,
             }),
             refreshSignIn: new SimCognitoRefreshSignIn({ tokenIssuer, clock }),
         });
-        const newPassword = new SimCognitoNewPasswordResponse({
-            authResolver,
-            tokenIssuer,
-            triggers,
-            clock,
+        const responses = new SimCognitoChallengeResponses({
+            newPassword: new SimCognitoNewPasswordResponse({
+                authResolver,
+                completion,
+                clock,
+            }),
+            mfa: new SimCognitoMfaResponse({ authResolver, completion, clock }),
         });
         this.adminInitiateAuth = new SimCognitoAdminInitiateAuth({
             authResolver,
@@ -48,7 +62,7 @@ export class SimCognitoAuthCommands {
         });
         this.adminRespondToChallenge = new SimCognitoAdminRespondToChallenge({
             authResolver,
-            newPassword,
+            responses,
         });
         this.initiateAuth = new SimCognitoInitiateAuth({
             authResolver,
@@ -56,7 +70,7 @@ export class SimCognitoAuthCommands {
         });
         this.respondToChallenge = new SimCognitoRespondToChallenge({
             authResolver,
-            newPassword,
+            responses,
         });
         this.signOut = new SimCognitoSignOutCommands({ resolver, pools, clock });
     }

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAgBtE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IACjB,iBAAiB,CAA8B;IAC/C,uBAAuB,CAAoC;IAC3D,YAAY,CAAyB;IACrC,kBAAkB,CAA+B;IACjD,OAAO,CAA4B;IAEnD,YAAY,UAA4C;QACtD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GACnE,UAAU,CAAC;QACb,MAAM,UAAU,GAAG,IAAI,wBAAwB,CAAC;YAC9C,cAAc,EAAE,IAAI,wBAAwB,CAAC;gBAC3C,YAAY;gBACZ,WAAW;gBACX,SAAS,EAAE,IAAI,8BAA8B,CAAC,EAAE,KAAK,EAAE,CAAC;gBACxD,QAAQ;aACT,CAAC;YACF,aAAa,EAAE,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,6BAA6B,CAAC;YACpD,YAAY;YACZ,WAAW;YACX,QAAQ;YACR,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CAAC;YACvD,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,GAAG,IAAI,iCAAiC,CAAC;YACnE,YAAY;YACZ,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC;YAC7C,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CAAC;YACzD,YAAY;YACZ,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-auth-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAuBtE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IACjB,iBAAiB,CAA8B;IAC/C,uBAAuB,CAAoC;IAC3D,YAAY,CAAyB;IACrC,kBAAkB,CAA+B;IACjD,OAAO,CAA4B;IAEnD,YAAY,UAA4C;QACtD,MAAM,EACJ,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,KAAK,EACL,QAAQ,EACR,WAAW,EACX,SAAS,GACV,GAAG,UAAU,CAAC;QACf,yEAAyE;QACzE,8DAA8D;QAC9D,gDAAgD;QAChD,MAAM,UAAU,GAAG,IAAI,0BAA0B,CAAC;YAChD,WAAW;YACX,QAAQ;YACR,YAAY,EAAE,IAAI,sBAAsB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,wBAAwB,CAAC;YAC9C,cAAc,EAAE,IAAI,wBAAwB,CAAC;gBAC3C,YAAY;gBACZ,UAAU;gBACV,SAAS,EAAE,IAAI,8BAA8B,CAAC,EAAE,KAAK,EAAE,CAAC;gBACxD,QAAQ;aACT,CAAC;YACF,aAAa,EAAE,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,4BAA4B,CAAC;YACjD,WAAW,EAAE,IAAI,6BAA6B,CAAC;gBAC7C,YAAY;gBACZ,UAAU;gBACV,KAAK;aACN,CAAC;YACF,GAAG,EAAE,IAAI,qBAAqB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;SACpE,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CAAC;YACvD,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,GAAG,IAAI,iCAAiC,CAAC;YACnE,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC;YAC7C,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CAAC;YACzD,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.d.ts

@@ -0,0 +1,26 @@
+import type { SimCognitoMfaResponse } from "./sim-cognito-mfa-response.js";
+import type { SimCognitoChallengeResponseRequest, SimCognitoNewPasswordResponse } from "./sim-cognito-new-password-response.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoChallengeResponsesProperties {
+    readonly newPassword: SimCognitoNewPasswordResponse;
+    readonly mfa: SimCognitoMfaResponse;
+}
+/**
+ * Sends a challenge response to whichever challenge it is answering.
+ *
+ * `RespondToAuthChallenge` and `AdminRespondToAuthChallenge` both arrive here,
+ * because the two differ in how they reach the pool and in nothing after that:
+ * the same response completes the same challenge either way.
+ */
+export declare class SimCognitoChallengeResponses {
+    private readonly newPassword;
+    private readonly mfa;
+    constructor(properties: SimCognitoChallengeResponsesProperties);
+    /**
+     * Answer the challenge the request names, or refuse a challenge this
+     * simulation does not issue.
+     */
+    handle(challengeName: string | undefined, request: SimCognitoChallengeResponseRequest): Promise<SimCognitoAuthenticationOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-challenge-responses.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-challenge-responses.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EACV,kCAAkC,EAClC,6BAA6B,EAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAE5C,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;;OAGG;IACG,MAAM,CACV,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAQzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.js

@@ -0,0 +1,28 @@
+import { newPasswordRequiredChallenge, requireSimCognitoChallengeName, } from "./sim-cognito-auth-challenge.js";
+/**
+ * Sends a challenge response to whichever challenge it is answering.
+ *
+ * `RespondToAuthChallenge` and `AdminRespondToAuthChallenge` both arrive here,
+ * because the two differ in how they reach the pool and in nothing after that:
+ * the same response completes the same challenge either way.
+ */
+export class SimCognitoChallengeResponses {
+    newPassword;
+    mfa;
+    constructor(properties) {
+        this.newPassword = properties.newPassword;
+        this.mfa = properties.mfa;
+    }
+    /**
+     * Answer the challenge the request names, or refuse a challenge this
+     * simulation does not issue.
+     */
+    async handle(challengeName, request) {
+        const challenge = requireSimCognitoChallengeName(challengeName);
+        if (challenge === newPasswordRequiredChallenge) {
+            return await this.newPassword.handle(request);
+        }
+        return await this.mfa.handle({ ...request, challengeName: challenge });
+    }
+}
+//# sourceMappingURL=sim-cognito-challenge-responses.js.map

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-challenge-responses.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AAazC;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,WAAW,CAAgC;IAC3C,GAAG,CAAwB;IAE5C,YAAY,UAAkD;QAC5D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,aAAiC,EACjC,OAA2C;QAE3C,MAAM,SAAS,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,SAAS,KAAK,4BAA4B,EAAE,CAAC;YAC/C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-challenge.d.ts

@@ -0,0 +1,59 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoPoolMessenger } from "../../user-pool/message/sim-cognito-pool-messenger.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoMfaChallengeProperties {
+    readonly messenger: SimCognitoPoolMessenger;
+    readonly clock: SimClock;
+}
+/**
+ * A sign-in that has got past the password and may have a factor to answer
+ * for.
+ */
+interface SimCognitoMfaChallengeRequest {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly user: SimCognitoUser;
+    readonly clientMetadata?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * The multi-factor challenge a pool answers a sign-in with.
+ *
+ * A user that has registered a factor is challenged for it: `SMS_MFA` for a
+ * phone number, which the pool texts a code to, and `SOFTWARE_TOKEN_MFA` for
+ * an authenticator app, whose code the user reads off its own device. Either
+ * way the request that carried the password is answered with a challenge and a
+ * session rather than with tokens, and `SimCognitoMfaResponse` is what
+ * completes it.
+ *
+ * A pool configured `OFF` challenges nobody. One configured `OPTIONAL`
+ * challenges the users that registered a factor, and one configured `ON`
+ * challenges every user, which is the case this simulation still cannot serve
+ * in full: real Cognito answers a user with no factor with `MFA_SETUP`, which
+ * registers one mid-sign-in, so that sign-in is refused here rather than
+ * handed tokens a deployment would not have handed out.
+ */
+export declare class SimCognitoMfaChallenge {
+    private readonly messenger;
+    private readonly clock;
+    constructor(properties: SimCognitoMfaChallengeProperties);
+    /**
+     * Where the code went, for the factor that sends one.
+     *
+     * Real Cognito reports the medium and a masked destination on an `SMS_MFA`
+     * challenge, and neither on a `SOFTWARE_TOKEN_MFA` one, because nothing was
+     * sent anywhere for that.
+     */
+    private static deliveryParameters;
+    /**
+     * The challenge this user has to get past, or nothing where it has none.
+     *
+     * A sign-in that gets nothing back from here is one that can be answered
+     * with tokens.
+     */
+    issueFor(request: SimCognitoMfaChallengeRequest): Promise<SimCognitoAuthenticationOutput | undefined>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-mfa-challenge.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAM/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;GAGG;AACH,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAgBjC;;;;;OAKG;IACG,QAAQ,CACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,CAuCrD;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-challenge.js

@@ -0,0 +1,88 @@
+import { SimCognitoAuthSession } from "../../user-pool/auth/sim-cognito-auth-session.js";
+import { simCognitoSmsMfa } from "../../user-pool/user/mfa/sim-cognito-mfa-factors.js";
+import { simCognitoChallengeFactor } from "./sim-cognito-mfa-factor-choice.js";
+import { simCognitoMaskedDestination, simCognitoMfaCode, } from "./sim-cognito-mfa-code.js";
+/**
+ * The multi-factor challenge a pool answers a sign-in with.
+ *
+ * A user that has registered a factor is challenged for it: `SMS_MFA` for a
+ * phone number, which the pool texts a code to, and `SOFTWARE_TOKEN_MFA` for
+ * an authenticator app, whose code the user reads off its own device. Either
+ * way the request that carried the password is answered with a challenge and a
+ * session rather than with tokens, and `SimCognitoMfaResponse` is what
+ * completes it.
+ *
+ * A pool configured `OFF` challenges nobody. One configured `OPTIONAL`
+ * challenges the users that registered a factor, and one configured `ON`
+ * challenges every user, which is the case this simulation still cannot serve
+ * in full: real Cognito answers a user with no factor with `MFA_SETUP`, which
+ * registers one mid-sign-in, so that sign-in is refused here rather than
+ * handed tokens a deployment would not have handed out.
+ */
+export class SimCognitoMfaChallenge {
+    messenger;
+    clock;
+    constructor(properties) {
+        this.messenger = properties.messenger;
+        this.clock = properties.clock;
+    }
+    /**
+     * Where the code went, for the factor that sends one.
+     *
+     * Real Cognito reports the medium and a masked destination on an `SMS_MFA`
+     * challenge, and neither on a `SOFTWARE_TOKEN_MFA` one, because nothing was
+     * sent anywhere for that.
+     */
+    static deliveryParameters(factor, user) {
+        const destination = user.attributeValues.get("phone_number");
+        if (factor !== simCognitoSmsMfa || destination === undefined) {
+            return {};
+        }
+        return {
+            CODE_DELIVERY_DELIVERY_MEDIUM: "SMS",
+            CODE_DELIVERY_DESTINATION: simCognitoMaskedDestination(destination),
+        };
+    }
+    /**
+     * The challenge this user has to get past, or nothing where it has none.
+     *
+     * A sign-in that gets nothing back from here is one that can be answered
+     * with tokens.
+     */
+    async issueFor(request) {
+        const factor = simCognitoChallengeFactor(request.pool, request.user);
+        if (factor === undefined) {
+            return undefined;
+        }
+        const { pool, client, user } = request;
+        const code = factor === simCognitoSmsMfa ? simCognitoMfaCode() : undefined;
+        const session = new SimCognitoAuthSession({
+            username: user.username,
+            clientId: client.id,
+            challengeName: factor,
+            code,
+            issuedAt: this.clock.now(),
+        });
+        pool.auth.addSession(session);
+        if (code !== undefined) {
+            await this.messenger.send({
+                pool,
+                client,
+                user,
+                occasion: "Authentication",
+                code,
+                clientMetadata: request.clientMetadata,
+            });
+        }
+        return {
+            $metadata: {},
+            ChallengeName: factor,
+            Session: session.id,
+            ChallengeParameters: {
+                USER_ID_FOR_SRP: user.username,
+                ...SimCognitoMfaChallenge.deliveryParameters(factor, user),
+            },
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-mfa-challenge.js.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAIzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAmBnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,sBAAsB;IAChB,SAAS,CAA0B;IACnC,KAAK,CAAW;IAEjC,YAAY,UAA4C;QACtD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,kBAAkB,CAC/B,MAAc,EACd,IAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE7D,IAAI,MAAM,KAAK,gBAAgB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,6BAA6B,EAAE,KAAK;YACpC,yBAAyB,EAAE,2BAA2B,CAAC,WAAW,CAAC;SACpE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAsC;QAEtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAErE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,aAAa,EAAE,MAAM;YACrB,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBACxB,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,gBAAgB;gBAC1B,IAAI;gBACJ,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;aAC3D;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-code-check.d.ts

@@ -0,0 +1,31 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoAuthSession } from "../../user-pool/auth/sim-cognito-auth-session.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
+/**
+ * What a challenge response has to carry the right code for.
+ */
+interface SimCognitoMfaCodeRequest {
+    readonly user: SimCognitoUser;
+    readonly session: SimCognitoAuthSession;
+    readonly parameters: SimCognitoAuthParameters;
+}
+/**
+ * Whether a challenge response carries the code its challenge is waiting for.
+ *
+ * A texted code is compared with the one the pool sent, which the session
+ * holds. An authenticator app's code is computed from the secret the user
+ * registered, which is what makes a code from that secret work here as it
+ * would against a deployment.
+ */
+export declare class SimCognitoMfaCodeCheck {
+    private readonly clock;
+    constructor(clock: SimClock);
+    /**
+     * Refuse a code that is not the one this challenge is waiting for.
+     */
+    require(request: SimCognitoMfaCodeRequest): void;
+    private matches;
+}
+export {};
+//# sourceMappingURL=sim-cognito-mfa-code-check.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-code-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-code-check.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-code-check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF;;GAEG;AACH,UAAU,wBAAwB;IAChC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,KAAK,EAAE,QAAQ,EAE1B;IAED;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAM/C;IAED,OAAO,CAAC,OAAO;CAchB"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-code-check.js

@@ -0,0 +1,33 @@
+import { SimCognitoCodeMismatchException } from "../../error/sim-cognito.error.js";
+import { simCognitoSmsMfa } from "../../user-pool/user/mfa/sim-cognito-mfa-factors.js";
+/**
+ * Whether a challenge response carries the code its challenge is waiting for.
+ *
+ * A texted code is compared with the one the pool sent, which the session
+ * holds. An authenticator app's code is computed from the secret the user
+ * registered, which is what makes a code from that secret work here as it
+ * would against a deployment.
+ */
+export class SimCognitoMfaCodeCheck {
+    clock;
+    constructor(clock) {
+        this.clock = clock;
+    }
+    /**
+     * Refuse a code that is not the one this challenge is waiting for.
+     */
+    require(request) {
+        if (this.matches(request)) {
+            return;
+        }
+        throw new SimCognitoCodeMismatchException("Invalid code received for user");
+    }
+    matches(request) {
+        const { user, session, parameters } = request;
+        if (session.challengeName === simCognitoSmsMfa) {
+            return parameters.require("SMS_MFA_CODE") === session.code;
+        }
+        return (user.mfa.softwareToken?.matches(parameters.require("SOFTWARE_TOKEN_MFA_CODE"), this.clock.now()) ?? false);
+    }
+}
+//# sourceMappingURL=sim-cognito-mfa-code-check.js.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-code-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-code-check.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-code-check.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AAavF;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IAChB,KAAK,CAAW;IAEjC,YAAY,KAAe;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,OAAiC;QACvC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,+BAA+B,CAAC,gCAAgC,CAAC,CAAC;IAC9E,CAAC;IAEO,OAAO,CAAC,OAAiC;QAC/C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAE9C,IAAI,OAAO,CAAC,aAAa,KAAK,gBAAgB,EAAE,CAAC;YAC/C,OAAO,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;QAC7D,CAAC;QAED,OAAO,CACL,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAC7B,UAAU,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACjB,IAAI,KAAK,CACX,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-code.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Issue the code a pool texts a user it is challenging.
+ *
+ * Leading zeros are kept, because a real code has them and a test treating the
+ * value as a number would lose them.
+ */
+export declare function simCognitoMfaCode(): string;
+/**
+ * A destination as `CODE_DELIVERY_DESTINATION` reports it.
+ *
+ * Cognito never tells a caller the whole phone number it sent a code to: the
+ * challenge carries the last few characters behind a fixed run of asterisks,
+ * which is enough for an application to say which number it went to and not
+ * enough to learn one. The mask is a fixed length there rather than the length
+ * of what it hides, so a number's length cannot be read off it either.
+ */
+export declare function simCognitoMaskedDestination(destination: string): string;
+//# sourceMappingURL=sim-cognito-mfa-code.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-code.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-code.ts"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvE"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-code.js

@@ -0,0 +1,35 @@
+import { randomInt } from "node:crypto";
+/**
+ * How many digits an MFA code has, which is what a confirmation code has too.
+ */
+const codeDigits = 6;
+/**
+ * How many characters of a destination Cognito leaves readable.
+ */
+const readableCharacters = 4;
+/**
+ * The mask Cognito puts in front of them.
+ */
+const maskLength = 7;
+/**
+ * Issue the code a pool texts a user it is challenging.
+ *
+ * Leading zeros are kept, because a real code has them and a test treating the
+ * value as a number would lose them.
+ */
+export function simCognitoMfaCode() {
+    return String(randomInt(0, 10 ** codeDigits)).padStart(codeDigits, "0");
+}
+/**
+ * A destination as `CODE_DELIVERY_DESTINATION` reports it.
+ *
+ * Cognito never tells a caller the whole phone number it sent a code to: the
+ * challenge carries the last few characters behind a fixed run of asterisks,
+ * which is enough for an application to say which number it went to and not
+ * enough to learn one. The mask is a fixed length there rather than the length
+ * of what it hides, so a number's length cannot be read off it either.
+ */
+export function simCognitoMaskedDestination(destination) {
+    return `+${"*".repeat(maskLength)}${destination.slice(-readableCharacters)}`;
+}
+//# sourceMappingURL=sim-cognito-mfa-code.js.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-code.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB;;GAEG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB;IAC7D,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAC/E,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-factor-choice.d.ts

@@ -0,0 +1,12 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+/**
+ * Which factor a sign-in is challenged for, and nothing where the sign-in
+ * carries on without a challenge.
+ *
+ * A pool configured `OFF` challenges nobody, whatever its users have
+ * registered. One configured `OPTIONAL` challenges the users that registered a
+ * factor, and one configured `ON` challenges every user.
+ */
+export declare function simCognitoChallengeFactor(pool: SimCognitoUserPool, user: SimCognitoUser): string | undefined;
+//# sourceMappingURL=sim-cognito-mfa-factor-choice.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-factor-choice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-factor-choice.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-factor-choice.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,GACnB,MAAM,GAAG,SAAS,CAcpB"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-factor-choice.js

@@ -0,0 +1,46 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * Which factor a sign-in is challenged for, and nothing where the sign-in
+ * carries on without a challenge.
+ *
+ * A pool configured `OFF` challenges nobody, whatever its users have
+ * registered. One configured `OPTIONAL` challenges the users that registered a
+ * factor, and one configured `ON` challenges every user.
+ */
+export function simCognitoChallengeFactor(pool, user) {
+    if (!pool.settings.mfa.configuration.challengesAnySignIn) {
+        return undefined;
+    }
+    const factor = user.mfa.challengeFactor;
+    if (factor !== undefined) {
+        return factor;
+    }
+    refuseUnchallengeable(pool, user);
+    return undefined;
+}
+/**
+ * Refuse a sign-in real Cognito would answer with a challenge this simulation
+ * does not issue.
+ *
+ * A user with two factors enabled and no preference between them is answered
+ * with `SELECT_MFA_TYPE`, and a user of an `ON` pool with no factor at all
+ * with `MFA_SETUP`. Both choose or register something mid-sign-in, which is a
+ * flow of its own, so the sign-in is refused here rather than handed tokens a
+ * deployment would not have handed out.
+ */
+function refuseUnchallengeable(pool, user) {
+    if (user.mfa.settings.length > 1) {
+        throw new SimCognitoInvalidParameterException(`User ${user.username} has ${user.mfa.settings.join(" and ")} enabled ` +
+            `and prefers neither, so real Cognito would answer this sign-in with ` +
+            `a SELECT_MFA_TYPE challenge, which is not simulated. Prefer one of ` +
+            `them with SetUserMFAPreference.`);
+    }
+    if (pool.settings.mfa.configuration.challengesEverySignIn) {
+        throw new SimCognitoInvalidParameterException(`User pool ${pool.id} has an MfaConfiguration of 'ON' and user ` +
+            `${user.username} has registered no second factor, so real Cognito ` +
+            `would answer this sign-in with an MFA_SETUP challenge, which is not ` +
+            `simulated. Register a factor for the user, or set the pool's ` +
+            `MfaConfiguration to 'OPTIONAL' or 'OFF'.`);
+    }
+}
+//# sourceMappingURL=sim-cognito-mfa-factor-choice.js.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-factor-choice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-factor-choice.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-factor-choice.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAIvF;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAwB,EACxB,IAAoB;IAEpB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;IAExC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAElC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,IAAwB,EACxB,IAAoB;IAEpB,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;QAC1D,MAAM,IAAI,mCAAmC,CAC3C,aAAa,IAAI,CAAC,EAAE,4CAA4C;YAC9D,GAAG,IAAI,CAAC,QAAQ,oDAAoD;YACpE,sEAAsE;YACtE,+DAA+D;YAC/D,0CAA0C,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-response.d.ts

@@ -0,0 +1,49 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import type { SimCognitoChallengeResponseRequest } from "./sim-cognito-new-password-response.js";
+import type { SimCognitoSignInCompletion } from "./sim-cognito-sign-in-completion.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoMfaResponseProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly completion: SimCognitoSignInCompletion;
+    readonly clock: SimClock;
+}
+/**
+ * A response to one of the two MFA challenges.
+ */
+export interface SimCognitoMfaResponseRequest extends SimCognitoChallengeResponseRequest {
+    /** Which challenge is being answered, which its session has to match. */
+    readonly challengeName: string;
+}
+/**
+ * Answering an `SMS_MFA` or `SOFTWARE_TOKEN_MFA` challenge.
+ *
+ * The code is checked against whatever issued it: a texted code against the
+ * one the challenge sent, which the session holds, and an authenticator app's
+ * code against the secret the user registered. A wrong code leaves the session
+ * alone, so the caller can read the next code off its app or ask the user to
+ * retype the one it was sent, as real Cognito lets it. A right one spends the
+ * session, so the same code cannot sign in twice.
+ *
+ * This is the body of both `AdminRespondToAuthChallenge` and
+ * `RespondToAuthChallenge`, which differ only in how they reach the pool.
+ */
+export declare class SimCognitoMfaResponse {
+    private readonly authResolver;
+    private readonly completion;
+    private readonly clock;
+    private readonly codeCheck;
+    constructor(properties: SimCognitoMfaResponseProperties);
+    /**
+     * Complete the challenge, and sign the user in.
+     *
+     * This is where the sign-in the challenge interrupted finishes, so it is
+     * where `PostAuthentication` runs and where the tokens are issued.
+     * `PreAuthentication` does not run again: it ran when the password was
+     * checked, and real Cognito fires it once per sign-in rather than once per
+     * request.
+     */
+    handle(request: SimCognitoMfaResponseRequest): Promise<SimCognitoAuthenticationOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-mfa-response.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-mfa-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAMpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,kCAAkC;IACtF,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,YAAY,UAAU,EAAE,+BAA+B,EAKtD;IAED;;;;;;;;OAQG;IACG,MAAM,CACV,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,8BAA8B,CAAC,CA2BzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-response.js

@@ -0,0 +1,63 @@
+import { requireSimCognitoEnabled, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
+import { SimCognitoMfaCodeCheck } from "./sim-cognito-mfa-code-check.js";
+/**
+ * Answering an `SMS_MFA` or `SOFTWARE_TOKEN_MFA` challenge.
+ *
+ * The code is checked against whatever issued it: a texted code against the
+ * one the challenge sent, which the session holds, and an authenticator app's
+ * code against the secret the user registered. A wrong code leaves the session
+ * alone, so the caller can read the next code off its app or ask the user to
+ * retype the one it was sent, as real Cognito lets it. A right one spends the
+ * session, so the same code cannot sign in twice.
+ *
+ * This is the body of both `AdminRespondToAuthChallenge` and
+ * `RespondToAuthChallenge`, which differ only in how they reach the pool.
+ */
+export class SimCognitoMfaResponse {
+    authResolver;
+    completion;
+    clock;
+    codeCheck;
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.completion = properties.completion;
+        this.clock = properties.clock;
+        this.codeCheck = new SimCognitoMfaCodeCheck(properties.clock);
+    }
+    /**
+     * Complete the challenge, and sign the user in.
+     *
+     * This is where the sign-in the challenge interrupted finishes, so it is
+     * where `PostAuthentication` runs and where the tokens are issued.
+     * `PreAuthentication` does not run again: it ran when the password was
+     * checked, and real Cognito fires it once per sign-in rather than once per
+     * request.
+     */
+    async handle(request) {
+        const { pool, client, parameters, challengeName } = request;
+        const username = this.authResolver.username(client, parameters);
+        const session = pool.auth.requireSession({
+            sessionId: request.session,
+            username,
+            clientId: client.id,
+            challengeName,
+            now: this.clock.now(),
+        });
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        // A user disabled between the challenge and this response cannot finish
+        // the sign-in, as it cannot start one.
+        requireSimCognitoEnabled(user);
+        this.codeCheck.require({ user, session, parameters });
+        pool.auth.removeSession(session);
+        return await this.completion.complete({
+            pool,
+            client,
+            user,
+            occasion: SimCognitoTriggerOccasion.tokenGeneration,
+            tokenClientMetadata: request.clientMetadata,
+            clientMetadata: request.clientMetadata,
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-mfa-response.js.map