@kensio/yulin 1.15.1 → 1.16.1

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts

@@ -17,6 +17,16 @@ export interface SimCognitoAuthorizeInput {
     readonly idp_identifier?: string | undefined;
     readonly code_challenge?: string | undefined;
     readonly code_challenge_method?: string | undefined;
+    /**
+     * The username a pool's own user signs in with.
+     *
+     * Real Cognito takes these two from the managed login form rather than from
+     * the query string, and a request carrying them here is the form post the
+     * simulation's own sign-in page makes. Naming no identity provider and
+     * carrying these two is what tells a local sign-in from a federated one.
+     */
+    readonly username?: string | undefined;
+    readonly password?: string | undefined;
 }
 /**
  * Where a hosted endpoint sends the browser next.

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}
+{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts

@@ -1,9 +1,9 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
-import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoHostedSignIn } from "./sim-cognito-hosted-sign-in.js";
 import type { SimCognitoAuthorizeInput, SimCognitoHostedRedirect } from "./hosted-auth.command.js";
 interface SimCognitoAuthorizeEndpointProperties {
-    readonly federatedSignIn: SimCognitoFederatedSignIn;
+    readonly signIn: SimCognitoHostedSignIn;
     readonly clock: SimClock;
 }
 /**
@@ -11,25 +11,26 @@ interface SimCognitoAuthorizeEndpointProperties {
  *
  * Real Cognito answers this request in one of two ways: it sends the browser
  * to an identity provider's sign-in page when the request names a provider,
- * and to managed login's own page when it does not. Only the first has an
- * equivalent here, because the second is a web page a person fills in, and a
- * simulation of a person filling it in would be a simulation of nothing.
+ * and to managed login's own form when it does not. Both end in the same
+ * place, which is the app client's callback URL carrying an authorization
+ * code, and both end there here.
  *
- * So a request naming a provider signs in the user that provider has been told
- * is signed in at it, and answers with the code real Cognito would answer
- * with. A request naming no provider, or naming the pool's own users, is
- * refused with a message saying so, rather than being answered with a page or
- * with a user nothing put there.
+ * A request naming a provider signs in the user that provider has been told is
+ * signed in at it. A request naming none signs in one of the pool's own users,
+ * with the username and password real managed login would have taken from its
+ * form. Nothing here draws the form: the serving layer is what answers a
+ * browser with a page, and a test calling this directly passes the two fields
+ * the form would have posted.
  */
 export declare class SimCognitoAuthorizeEndpoint {
-    private readonly federatedSignIn;
+    private readonly signIn;
     private readonly clock;
     private readonly hostedClient;
     private readonly request;
     constructor(properties: SimCognitoAuthorizeEndpointProperties);
     /**
-     * Sign a user in through an identity provider, and send the browser back to
-     * the application with an authorization code.
+     * Sign a user in, and send the browser back to the application with an
+     * authorization code.
      */
     handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput): SimCognitoHostedRedirect;
     private redirectWithCode;

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAqC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}
+{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAgC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js

@@ -7,28 +7,29 @@ import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
  *
  * Real Cognito answers this request in one of two ways: it sends the browser
  * to an identity provider's sign-in page when the request names a provider,
- * and to managed login's own page when it does not. Only the first has an
- * equivalent here, because the second is a web page a person fills in, and a
- * simulation of a person filling it in would be a simulation of nothing.
+ * and to managed login's own form when it does not. Both end in the same
+ * place, which is the app client's callback URL carrying an authorization
+ * code, and both end there here.
  *
- * So a request naming a provider signs in the user that provider has been told
- * is signed in at it, and answers with the code real Cognito would answer
- * with. A request naming no provider, or naming the pool's own users, is
- * refused with a message saying so, rather than being answered with a page or
- * with a user nothing put there.
+ * A request naming a provider signs in the user that provider has been told is
+ * signed in at it. A request naming none signs in one of the pool's own users,
+ * with the username and password real managed login would have taken from its
+ * form. Nothing here draws the form: the serving layer is what answers a
+ * browser with a page, and a test calling this directly passes the two fields
+ * the form would have posted.
  */
 export class SimCognitoAuthorizeEndpoint {
-    federatedSignIn;
+    signIn;
     clock;
     hostedClient = new SimCognitoHostedClient();
     request = new SimCognitoAuthorizeRequest();
     constructor(properties) {
-        this.federatedSignIn = properties.federatedSignIn;
+        this.signIn = properties.signIn;
         this.clock = properties.clock;
     }
     /**
-     * Sign a user in through an identity provider, and send the browser back to
-     * the application with an authorization code.
+     * Sign a user in, and send the browser back to the application with an
+     * authorization code.
      */
     handle(pool, input) {
         const client = this.hostedClient.forAuthorize(pool, input.client_id);
@@ -40,12 +41,7 @@ export class SimCognitoAuthorizeEndpoint {
         this.hostedClient.requireCodeGrant(client, true);
         this.request.requireChallengeMethod(input);
         const scopes = new SimCognitoGrantedScopes(client, input.scope);
-        const provider = this.request.requiredProvider(pool, client, input);
-        const user = this.federatedSignIn.signIn({
-            pool,
-            provider,
-            now: this.clock.now(),
-        });
+        const user = this.signIn.signIn(pool, client, input);
         const code = new SimCognitoAuthorizationCode({
             username: user.username,
             clientId: client.id,

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAGrG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAWxE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,2BAA2B;IACrB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACvC,IAAI;YACJ,QAAQ;YACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAErG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAyB;IAC/B,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.d.ts

@@ -25,13 +25,22 @@ export declare class SimCognitoAuthorizeRequest {
      */
     requireChallengeMethod(input: SimCognitoAuthorizeInput): void;
     /**
-     * The identity provider this request signs the user in through.
+     * The identity provider this request signs the user in through, and nothing
+     * where it signs one of the pool's own users in.
      *
-     * A request naming none would reach managed login on real Cognito, which is
-     * a page rather than anything an API answers, so it is refused here with a
-     * message saying what to do instead.
+     * A request naming no provider, or naming `COGNITO`, is a local sign-in: on
+     * real Cognito it reaches managed login's own form, and here it carries the
+     * username and password that form would have posted.
      */
-    requiredProvider(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUserPoolIdentityProvider;
-    private requireSupportedProvider;
+    signInProvider(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUserPoolIdentityProvider | undefined;
+    /**
+     * Refuse a provider the app client does not offer.
+     *
+     * `COGNITO` is checked the same way, because real Cognito treats it as one
+     * of the entries in `SupportedIdentityProviders`: a client without it there
+     * signs nobody in at the hosted domain with a password, however many local
+     * users the pool holds.
+     */
+    private requireSupportedProviderName;
 }
 //# sourceMappingURL=sim-cognito-authorize-request.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACzH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAiBzE;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAuB1D;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CA8B5D;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,kCAAkC,CA6BpC;IAED,OAAO,CAAC,wBAAwB;CAejC"}
+{"version":3,"file":"sim-cognito-authorize-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACzH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAqBzE;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAuB1D;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CA8B5D;IAED;;;;;;;OAOG;IACH,cAAc,CACZ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,kCAAkC,GAAG,SAAS,CAuBhD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,4BAA4B;CAerC"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.js

@@ -10,8 +10,12 @@ const codeResponseType = "code";
 const tokenResponseType = "token";
 /**
  * The provider name the pool's own users sign in under.
+ *
+ * Real Cognito takes this in an `identity_provider` to mean the local sign-in
+ * form rather than any external provider, and a request naming no provider at
+ * all reaches the same place once the person has chosen it.
  */
-const localProviderName = "COGNITO";
+const simCognitoLocalProviderName = "COGNITO";
 /**
  * What an authorize request asked for, once it has been checked.
  *
@@ -78,23 +82,18 @@ export class SimCognitoAuthorizeRequest {
         }
     }
     /**
-     * The identity provider this request signs the user in through.
+     * The identity provider this request signs the user in through, and nothing
+     * where it signs one of the pool's own users in.
      *
-     * A request naming none would reach managed login on real Cognito, which is
-     * a page rather than anything an API answers, so it is refused here with a
-     * message saying what to do instead.
+     * A request naming no provider, or naming `COGNITO`, is a local sign-in: on
+     * real Cognito it reaches managed login's own form, and here it carries the
+     * username and password that form would have posted.
      */
-    requiredProvider(pool, client, input) {
+    signInProvider(pool, client, input) {
         const named = input.identity_provider ?? input.idp_identifier;
-        if (named === undefined || named === localProviderName) {
-            throw new SimCognitoOAuthError({
-                code: "invalid_request",
-                description: "This request would reach managed login, which is a sign-in page " +
-                    "rather than anything this simulation can answer. Name an " +
-                    "identity_provider to sign in through, or sign the pool's own " +
-                    "users in with InitiateAuth or AdminInitiateAuth.",
-                redirectable: false,
-            });
+        if (named === undefined || named === simCognitoLocalProviderName) {
+            this.requireSupportedProviderName(client, simCognitoLocalProviderName);
+            return undefined;
         }
         const providers = pool.auth.identityProviders;
         const provider = providers.find(named) ?? providers.findByIdentifier(named);
@@ -105,14 +104,22 @@ export class SimCognitoAuthorizeRequest {
                 redirectable: true,
             });
         }
-        this.requireSupportedProvider(client, provider);
+        this.requireSupportedProviderName(client, provider.name);
         return provider;
     }
-    requireSupportedProvider(client, provider) {
-        if (!client.oauth.allowsIdentityProvider(provider.name)) {
+    /**
+     * Refuse a provider the app client does not offer.
+     *
+     * `COGNITO` is checked the same way, because real Cognito treats it as one
+     * of the entries in `SupportedIdentityProviders`: a client without it there
+     * signs nobody in at the hosted domain with a password, however many local
+     * users the pool holds.
+     */
+    requireSupportedProviderName(client, providerName) {
+        if (!client.oauth.allowsIdentityProvider(providerName)) {
             throw new SimCognitoOAuthError({
                 code: "unauthorized_client",
-                description: `App client ${client.id} does not support the ${provider.name} ` +
+                description: `App client ${client.id} does not support the ${providerName} ` +
                     `identity provider: add it to the client's ` +
                     `SupportedIdentityProviders`,
                 redirectable: true,

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-request.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AAMvG;;GAEG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;GAEG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,YAAY,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,4DAA4D;oBAC5D,iEAAiE;oBACjE,kCAAkC;gBACpC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,2BAA2B;YACjC,WAAW,EACT,kBAAkB,MAAM,CAAC,YAAY,CAAC,+BAA+B;gBACrE,sCAAsC,gBAAgB,GAAG;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAA+B;QACpD,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,KAAK,CAAC,qBAAqB,KAAK,SAAS,EACzC,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,iEAAiE;oBACjE,qCAAqC;gBACvC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,6BAA6B,EAAE,CAAC;YAClE,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,0BAA0B,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO;oBACpE,kCAAkC;oBAClC,IAAI,6BAA6B,gCAAgC;oBACjE,WAAW;gBACb,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,cAAc,CAAC;QAE9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACvD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,2DAA2D;oBAC3D,+DAA+D;oBAC/D,kDAAkD;gBACpD,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAE5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,aAAa,IAAI,CAAC,EAAE,6BAA6B,KAAK,EAAE;gBACrE,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEhD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,wBAAwB,CAC9B,MAAgC,EAChC,QAA4C;QAE5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,cAAc,MAAM,CAAC,EAAE,yBAAyB,QAAQ,CAAC,IAAI,GAAG;oBAChE,4CAA4C;oBAC5C,4BAA4B;gBAC9B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-authorize-request.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AAMvG;;GAEG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;GAEG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,YAAY,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,4DAA4D;oBAC5D,iEAAiE;oBACjE,kCAAkC;gBACpC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,2BAA2B;YACjC,WAAW,EACT,kBAAkB,MAAM,CAAC,YAAY,CAAC,+BAA+B;gBACrE,sCAAsC,gBAAgB,GAAG;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAA+B;QACpD,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,KAAK,CAAC,qBAAqB,KAAK,SAAS,EACzC,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,iEAAiE;oBACjE,qCAAqC;gBACvC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,6BAA6B,EAAE,CAAC;YAClE,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,0BAA0B,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO;oBACpE,kCAAkC;oBAClC,IAAI,6BAA6B,gCAAgC;oBACjE,WAAW;gBACb,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CACZ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,cAAc,CAAC;QAE9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,2BAA2B,EAAE,CAAC;YACjE,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;YAEvE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAE5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,aAAa,IAAI,CAAC,EAAE,6BAA6B,KAAK,EAAE;gBACrE,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,4BAA4B,CAClC,MAAgC,EAChC,YAAoB;QAEpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,cAAc,MAAM,CAAC,EAAE,yBAAyB,YAAY,GAAG;oBAC/D,4CAA4C;oBAC5C,4BAA4B;gBAC9B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IACvD,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAC/C,SAAgB,MAAM,2BAAkC;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAQzD;CACF"}
+{"version":3,"file":"sim-cognito-hosted-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IACvD,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAC/C,SAAgB,MAAM,2BAAkC;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAWzD;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js

@@ -1,5 +1,6 @@
 import { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import { SimCognitoAuthorizeEndpoint } from "./sim-cognito-authorize-endpoint.js";
+import { SimCognitoHostedSignIn } from "./sim-cognito-hosted-sign-in.js";
 import { SimCognitoLogoutEndpoint } from "./sim-cognito-logout-endpoint.js";
 import { SimCognitoTokenEndpoint } from "./sim-cognito-token-endpoint.js";
 /**
@@ -18,7 +19,10 @@ export class SimCognitoHostedCommands {
     constructor(properties) {
         const { tokenIssuer, userFactory, clock } = properties;
         this.authorize = new SimCognitoAuthorizeEndpoint({
-            federatedSignIn: new SimCognitoFederatedSignIn({ userFactory }),
+            signIn: new SimCognitoHostedSignIn({
+                federatedSignIn: new SimCognitoFederatedSignIn({ userFactory }),
+                clock,
+            }),
             clock,
         });
         this.token = new SimCognitoTokenEndpoint({ tokenIssuer, clock });

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,SAAS,CAA8B;IACvC,KAAK,CAA0B;IAC/B,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAExD,YAAY,UAA8C;QACxD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAEvD,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,eAAe,EAAE,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/D,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-hosted-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,SAAS,CAA8B;IACvC,KAAK,CAA0B;IAC/B,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAExD,YAAY,UAA8C;QACxD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAEvD,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,MAAM,EAAE,IAAI,sBAAsB,CAAC;gBACjC,eAAe,EAAE,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;gBAC/D,KAAK;aACN,CAAC;YACF,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts

@@ -0,0 +1,41 @@
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+/**
+ * Signing one of a pool's own users in at the authorize endpoint.
+ *
+ * Real managed login takes the username and the password from its form and
+ * checks them the way `InitiateAuth` checks them. The same user lookup, the
+ * same refusal for a wrong password, and the same one for an account nobody
+ * has confirmed. Those checks are called from here, so the two sign-ins stay
+ * the same sign-in.
+ *
+ * Managed login has two more answers, and both are pages. A user owing a
+ * second factor is asked for the code, and one holding a temporary password is
+ * asked for a new one. Neither page is simulated, and a sign-in that would
+ * reach one is refused here with a message saying which.
+ */
+export declare class SimCognitoHostedPasswordSignIn {
+    /**
+     * The user this request signs in, having checked its password.
+     */
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUser;
+    /**
+     * The username and password the request carried.
+     *
+     * A request carrying neither, and naming no identity provider, is one a
+     * browser is shown the sign-in page for. The serving layer is what answers
+     * with that page, from this refusal.
+     */
+    private requiredCredentials;
+    /**
+     * Refuse a sign-in real managed login answers with a page of its own.
+     *
+     * `simCognitoChallengeFactor` refuses the second factors it cannot
+     * challenge for and answers with the ones it can, and neither is a code, so
+     * a user with a factor is refused here whichever it has.
+     */
+    private requireNoFurtherPage;
+}
+//# sourceMappingURL=sim-cognito-hosted-password-sign-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAUzE;;;;;;;;;;;;;GAaG;AACH,qBAAa,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,cAAc,CAUhB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;CAwB7B"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js

@@ -0,0 +1,71 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
+import { requireSimCognitoConfirmed, requireSimCognitoSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { simCognitoChallengeFactor } from "../auth/sim-cognito-mfa-factor-choice.js";
+/**
+ * Signing one of a pool's own users in at the authorize endpoint.
+ *
+ * Real managed login takes the username and the password from its form and
+ * checks them the way `InitiateAuth` checks them. The same user lookup, the
+ * same refusal for a wrong password, and the same one for an account nobody
+ * has confirmed. Those checks are called from here, so the two sign-ins stay
+ * the same sign-in.
+ *
+ * Managed login has two more answers, and both are pages. A user owing a
+ * second factor is asked for the code, and one holding a temporary password is
+ * asked for a new one. Neither page is simulated, and a sign-in that would
+ * reach one is refused here with a message saying which.
+ */
+export class SimCognitoHostedPasswordSignIn {
+    /**
+     * The user this request signs in, having checked its password.
+     */
+    signIn(pool, client, input) {
+        const { username, password } = this.requiredCredentials(input);
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        requireSimCognitoSignIn(user, password);
+        requireSimCognitoConfirmed(user);
+        this.requireNoFurtherPage(pool, user);
+        return user;
+    }
+    /**
+     * The username and password the request carried.
+     *
+     * A request carrying neither, and naming no identity provider, is one a
+     * browser is shown the sign-in page for. The serving layer is what answers
+     * with that page, from this refusal.
+     */
+    requiredCredentials(input) {
+        const { username, password } = input;
+        if (username === undefined ||
+            username === "" ||
+            password === undefined ||
+            password === "") {
+            throw new SimCognitoManagedLoginRequired();
+        }
+        return { username, password };
+    }
+    /**
+     * Refuse a sign-in real managed login answers with a page of its own.
+     *
+     * `simCognitoChallengeFactor` refuses the second factors it cannot
+     * challenge for and answers with the ones it can, and neither is a code, so
+     * a user with a factor is refused here whichever it has.
+     */
+    requireNoFurtherPage(pool, user) {
+        if (user.status.mustChangePassword) {
+            throw new SimCognitoInvalidParameterException(`User ${user.username} holds a temporary password, so real managed ` +
+                `login would answer this sign-in with a page asking for a new one, ` +
+                `which is not simulated. Set a permanent password on the user with ` +
+                `AdminSetUserPassword.`);
+        }
+        const factor = simCognitoChallengeFactor(pool, user);
+        if (factor !== undefined) {
+            throw new SimCognitoInvalidParameterException(`User ${user.username} is challenged for ${factor}, so real managed ` +
+                `login would answer this sign-in with a page asking for the code, ` +
+                `which is not simulated. Sign the user in with InitiateAuth, which ` +
+                `answers the challenge this simulation issues.`);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-password-sign-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAWrF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CACzB,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAErC,IACE,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,EAAE;YACf,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,EAAE,EACf,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,IAAwB,EACxB,IAAoB;QAEpB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,+CAA+C;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAErD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,sBAAsB,MAAM,oBAAoB;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,+CAA+C,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts

@@ -0,0 +1,32 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+interface SimCognitoHostedSignInProperties {
+    readonly federatedSignIn: SimCognitoFederatedSignIn;
+    readonly clock: SimClock;
+}
+/**
+ * Which user an authorize request signs in.
+ *
+ * Real Cognito has two answers here. A request naming an identity provider
+ * goes to that provider's own sign-in page, and one naming none goes to
+ * managed login's form. The choice is made from the same parameter either way,
+ * so it is made in one place, and what comes back is the pool user the
+ * authorization code is issued for.
+ */
+export declare class SimCognitoHostedSignIn {
+    private readonly federatedSignIn;
+    private readonly clock;
+    private readonly request;
+    private readonly passwordSignIn;
+    constructor(properties: SimCognitoHostedSignInProperties);
+    /**
+     * The user this request signs in, at a provider or in the pool itself.
+     */
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUser;
+}
+export {};
+//# sourceMappingURL=sim-cognito-hosted-sign-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAG/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,cAAc,CAYhB;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js

@@ -0,0 +1,36 @@
+import { SimCognitoAuthorizeRequest } from "./sim-cognito-authorize-request.js";
+import { SimCognitoHostedPasswordSignIn } from "./sim-cognito-hosted-password-sign-in.js";
+/**
+ * Which user an authorize request signs in.
+ *
+ * Real Cognito has two answers here. A request naming an identity provider
+ * goes to that provider's own sign-in page, and one naming none goes to
+ * managed login's form. The choice is made from the same parameter either way,
+ * so it is made in one place, and what comes back is the pool user the
+ * authorization code is issued for.
+ */
+export class SimCognitoHostedSignIn {
+    federatedSignIn;
+    clock;
+    request = new SimCognitoAuthorizeRequest();
+    passwordSignIn = new SimCognitoHostedPasswordSignIn();
+    constructor(properties) {
+        this.federatedSignIn = properties.federatedSignIn;
+        this.clock = properties.clock;
+    }
+    /**
+     * The user this request signs in, at a provider or in the pool itself.
+     */
+    signIn(pool, client, input) {
+        const provider = this.request.signInProvider(pool, client, input);
+        if (provider === undefined) {
+            return this.passwordSignIn.signIn(pool, client, input);
+        }
+        return this.federatedSignIn.signIn({
+            pool,
+            provider,
+            now: this.clock.now(),
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-sign-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAQ1F;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC3C,cAAc,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAEvE,YAAY,UAA4C;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAElE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,IAAI;YACJ,QAAQ;YACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/user/sim-cognito-sign-in-value-check.d.ts

@@ -0,0 +1,30 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAttributeType } from "../../user-pool/user/sim-cognito-user-attributes.js";
+/**
+ * Refuses an attribute update taking a value another user of the pool signs
+ * in by.
+ *
+ * A pool with `UsernameAttributes` identifies its users by that attribute, so
+ * two users holding the same value would leave a sign-in naming an account
+ * the pool has two of. Real Cognito answers `AliasExistsException` here, and
+ * so does this. A pool that signs users in by username has nothing to check:
+ * the attribute names nothing there.
+ */
+export declare class SimCognitoSignInValueCheck {
+    private readonly pool;
+    constructor(pool: SimCognitoUserPool);
+    /**
+     * Check an update before any of its attributes is written, so a refused one
+     * changes nothing.
+     *
+     * A user setting the value it already signs in by is left alone, because
+     * the user the value reaches is that same user.
+     */
+    requireFreeFor(user: SimCognitoUser, requested: readonly SimCognitoAttributeType[] | undefined): void;
+    /**
+     * Refuse one value another user of the pool holds.
+     */
+    private requireFree;
+}
+//# sourceMappingURL=sim-cognito-sign-in-value-check.d.ts.map

package/dist/service/cognito/command/user/sim-cognito-sign-in-value-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-in-value-check.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/user/sim-cognito-sign-in-value-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAEnG;;;;;;;;;GASG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAE1C,YAAY,IAAI,EAAE,kBAAkB,EAEnC;IAED;;;;;;OAMG;IACH,cAAc,CACZ,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACxD,IAAI,CAiBN;IAED;;OAEG;IACH,OAAO,CAAC,WAAW;CASpB"}

package/dist/service/cognito/command/user/sim-cognito-sign-in-value-check.js

@@ -0,0 +1,47 @@
+import { SimCognitoAliasExistsException } from "../../error/sim-cognito.error.js";
+/**
+ * Refuses an attribute update taking a value another user of the pool signs
+ * in by.
+ *
+ * A pool with `UsernameAttributes` identifies its users by that attribute, so
+ * two users holding the same value would leave a sign-in naming an account
+ * the pool has two of. Real Cognito answers `AliasExistsException` here, and
+ * so does this. A pool that signs users in by username has nothing to check:
+ * the attribute names nothing there.
+ */
+export class SimCognitoSignInValueCheck {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    /**
+     * Check an update before any of its attributes is written, so a refused one
+     * changes nothing.
+     *
+     * A user setting the value it already signs in by is left alone, because
+     * the user the value reaches is that same user.
+     */
+    requireFreeFor(user, requested) {
+        const signInBy = this.pool.settings.usernameAttributes;
+        const attributes = requested ?? [];
+        for (const attribute of attributes) {
+            const { Name: name, Value: value } = attribute;
+            if (name === undefined ||
+                value === undefined ||
+                !signInBy.names.includes(name)) {
+                continue;
+            }
+            this.requireFree(user, name, value);
+        }
+    }
+    /**
+     * Refuse one value another user of the pool holds.
+     */
+    requireFree(user, name, value) {
+        const held = this.pool.findUser(value);
+        if (held !== undefined && held !== user) {
+            throw new SimCognitoAliasExistsException(`An account with the given ${name} already exists.`);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-sign-in-value-check.js.map

package/dist/service/cognito/command/user/sim-cognito-sign-in-value-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-in-value-check.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/user/sim-cognito-sign-in-value-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAKlF;;;;;;;;;GASG;AACH,MAAM,OAAO,0BAA0B;IACpB,IAAI,CAAqB;IAE1C,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CACZ,IAAoB,EACpB,SAAyD;QAEzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACvD,MAAM,UAAU,GAAG,SAAS,IAAI,EAAE,CAAC;QAEnC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;YAE/C,IACE,IAAI,KAAK,SAAS;gBAClB,KAAK,KAAK,SAAS;gBACnB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,IAAoB,EAAE,IAAY,EAAE,KAAa;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,8BAA8B,CACtC,6BAA6B,IAAI,kBAAkB,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}