@kensio/yulin 1.16.0 → 1.16.1

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.js

@@ -10,8 +10,12 @@ const codeResponseType = "code";
 const tokenResponseType = "token";
 /**
  * The provider name the pool's own users sign in under.
+ *
+ * Real Cognito takes this in an `identity_provider` to mean the local sign-in
+ * form rather than any external provider, and a request naming no provider at
+ * all reaches the same place once the person has chosen it.
  */
-const localProviderName = "COGNITO";
+const simCognitoLocalProviderName = "COGNITO";
 /**
  * What an authorize request asked for, once it has been checked.
  *
@@ -78,23 +82,18 @@ export class SimCognitoAuthorizeRequest {
         }
     }
     /**
-     * The identity provider this request signs the user in through.
+     * The identity provider this request signs the user in through, and nothing
+     * where it signs one of the pool's own users in.
      *
-     * A request naming none would reach managed login on real Cognito, which is
-     * a page rather than anything an API answers, so it is refused here with a
-     * message saying what to do instead.
+     * A request naming no provider, or naming `COGNITO`, is a local sign-in: on
+     * real Cognito it reaches managed login's own form, and here it carries the
+     * username and password that form would have posted.
      */
-    requiredProvider(pool, client, input) {
+    signInProvider(pool, client, input) {
         const named = input.identity_provider ?? input.idp_identifier;
-        if (named === undefined || named === localProviderName) {
-            throw new SimCognitoOAuthError({
-                code: "invalid_request",
-                description: "This request would reach managed login, which is a sign-in page " +
-                    "rather than anything this simulation can answer. Name an " +
-                    "identity_provider to sign in through, or sign the pool's own " +
-                    "users in with InitiateAuth or AdminInitiateAuth.",
-                redirectable: false,
-            });
+        if (named === undefined || named === simCognitoLocalProviderName) {
+            this.requireSupportedProviderName(client, simCognitoLocalProviderName);
+            return undefined;
         }
         const providers = pool.auth.identityProviders;
         const provider = providers.find(named) ?? providers.findByIdentifier(named);
@@ -105,14 +104,22 @@ export class SimCognitoAuthorizeRequest {
                 redirectable: true,
             });
         }
-        this.requireSupportedProvider(client, provider);
+        this.requireSupportedProviderName(client, provider.name);
         return provider;
     }
-    requireSupportedProvider(client, provider) {
-        if (!client.oauth.allowsIdentityProvider(provider.name)) {
+    /**
+     * Refuse a provider the app client does not offer.
+     *
+     * `COGNITO` is checked the same way, because real Cognito treats it as one
+     * of the entries in `SupportedIdentityProviders`: a client without it there
+     * signs nobody in at the hosted domain with a password, however many local
+     * users the pool holds.
+     */
+    requireSupportedProviderName(client, providerName) {
+        if (!client.oauth.allowsIdentityProvider(providerName)) {
             throw new SimCognitoOAuthError({
                 code: "unauthorized_client",
-                description: `App client ${client.id} does not support the ${provider.name} ` +
+                description: `App client ${client.id} does not support the ${providerName} ` +
                     `identity provider: add it to the client's ` +
                     `SupportedIdentityProviders`,
                 redirectable: true,

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-request.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AAMvG;;GAEG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;GAEG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC;;GAEG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,YAAY,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,4DAA4D;oBAC5D,iEAAiE;oBACjE,kCAAkC;gBACpC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,2BAA2B;YACjC,WAAW,EACT,kBAAkB,MAAM,CAAC,YAAY,CAAC,+BAA+B;gBACrE,sCAAsC,gBAAgB,GAAG;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAA+B;QACpD,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,KAAK,CAAC,qBAAqB,KAAK,SAAS,EACzC,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,iEAAiE;oBACjE,qCAAqC;gBACvC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,6BAA6B,EAAE,CAAC;YAClE,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,0BAA0B,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO;oBACpE,kCAAkC;oBAClC,IAAI,6BAA6B,gCAAgC;oBACjE,WAAW;gBACb,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,cAAc,CAAC;QAE9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACvD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,2DAA2D;oBAC3D,+DAA+D;oBAC/D,kDAAkD;gBACpD,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAE5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,aAAa,IAAI,CAAC,EAAE,6BAA6B,KAAK,EAAE;gBACrE,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEhD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,wBAAwB,CAC9B,MAAgC,EAChC,QAA4C;QAE5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,cAAc,MAAM,CAAC,EAAE,yBAAyB,QAAQ,CAAC,IAAI,GAAG;oBAChE,4CAA4C;oBAC5C,4BAA4B;gBAC9B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-authorize-request.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AAMvG;;GAEG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;GAEG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAG,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,YAAY,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,4DAA4D;oBAC5D,iEAAiE;oBACjE,kCAAkC;gBACpC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,2BAA2B;YACjC,WAAW,EACT,kBAAkB,MAAM,CAAC,YAAY,CAAC,+BAA+B;gBACrE,sCAAsC,gBAAgB,GAAG;YAC3D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAA+B;QACpD,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;YAClC,KAAK,CAAC,qBAAqB,KAAK,SAAS,EACzC,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,iEAAiE;oBACjE,qCAAqC;gBACvC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,6BAA6B,EAAE,CAAC;YAClE,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,0BAA0B,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO;oBACpE,kCAAkC;oBAClC,IAAI,6BAA6B,gCAAgC;oBACjE,WAAW;gBACb,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CACZ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,cAAc,CAAC;QAE9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,2BAA2B,EAAE,CAAC;YACjE,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;YAEvE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAE5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,aAAa,IAAI,CAAC,EAAE,6BAA6B,KAAK,EAAE;gBACrE,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,4BAA4B,CAClC,MAAgC,EAChC,YAAoB;QAEpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,cAAc,MAAM,CAAC,EAAE,yBAAyB,YAAY,GAAG;oBAC/D,4CAA4C;oBAC5C,4BAA4B;gBAC9B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IACvD,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAC/C,SAAgB,MAAM,2BAAkC;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAQzD;CACF"}
+{"version":3,"file":"sim-cognito-hosted-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IACvD,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAC/C,SAAgB,MAAM,2BAAkC;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAWzD;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js

@@ -1,5 +1,6 @@
 import { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import { SimCognitoAuthorizeEndpoint } from "./sim-cognito-authorize-endpoint.js";
+import { SimCognitoHostedSignIn } from "./sim-cognito-hosted-sign-in.js";
 import { SimCognitoLogoutEndpoint } from "./sim-cognito-logout-endpoint.js";
 import { SimCognitoTokenEndpoint } from "./sim-cognito-token-endpoint.js";
 /**
@@ -18,7 +19,10 @@ export class SimCognitoHostedCommands {
     constructor(properties) {
         const { tokenIssuer, userFactory, clock } = properties;
         this.authorize = new SimCognitoAuthorizeEndpoint({
-            federatedSignIn: new SimCognitoFederatedSignIn({ userFactory }),
+            signIn: new SimCognitoHostedSignIn({
+                federatedSignIn: new SimCognitoFederatedSignIn({ userFactory }),
+                clock,
+            }),
             clock,
         });
         this.token = new SimCognitoTokenEndpoint({ tokenIssuer, clock });

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,SAAS,CAA8B;IACvC,KAAK,CAA0B;IAC/B,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAExD,YAAY,UAA8C;QACxD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAEvD,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,eAAe,EAAE,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/D,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-hosted-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,SAAS,CAA8B;IACvC,KAAK,CAA0B;IAC/B,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAExD,YAAY,UAA8C;QACxD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAEvD,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,MAAM,EAAE,IAAI,sBAAsB,CAAC;gBACjC,eAAe,EAAE,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;gBAC/D,KAAK;aACN,CAAC;YACF,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts

@@ -0,0 +1,41 @@
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+/**
+ * Signing one of a pool's own users in at the authorize endpoint.
+ *
+ * Real managed login takes the username and the password from its form and
+ * checks them the way `InitiateAuth` checks them. The same user lookup, the
+ * same refusal for a wrong password, and the same one for an account nobody
+ * has confirmed. Those checks are called from here, so the two sign-ins stay
+ * the same sign-in.
+ *
+ * Managed login has two more answers, and both are pages. A user owing a
+ * second factor is asked for the code, and one holding a temporary password is
+ * asked for a new one. Neither page is simulated, and a sign-in that would
+ * reach one is refused here with a message saying which.
+ */
+export declare class SimCognitoHostedPasswordSignIn {
+    /**
+     * The user this request signs in, having checked its password.
+     */
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUser;
+    /**
+     * The username and password the request carried.
+     *
+     * A request carrying neither, and naming no identity provider, is one a
+     * browser is shown the sign-in page for. The serving layer is what answers
+     * with that page, from this refusal.
+     */
+    private requiredCredentials;
+    /**
+     * Refuse a sign-in real managed login answers with a page of its own.
+     *
+     * `simCognitoChallengeFactor` refuses the second factors it cannot
+     * challenge for and answers with the ones it can, and neither is a code, so
+     * a user with a factor is refused here whichever it has.
+     */
+    private requireNoFurtherPage;
+}
+//# sourceMappingURL=sim-cognito-hosted-password-sign-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAUzE;;;;;;;;;;;;;GAaG;AACH,qBAAa,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,cAAc,CAUhB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;CAwB7B"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js

@@ -0,0 +1,71 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
+import { requireSimCognitoConfirmed, requireSimCognitoSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { simCognitoChallengeFactor } from "../auth/sim-cognito-mfa-factor-choice.js";
+/**
+ * Signing one of a pool's own users in at the authorize endpoint.
+ *
+ * Real managed login takes the username and the password from its form and
+ * checks them the way `InitiateAuth` checks them. The same user lookup, the
+ * same refusal for a wrong password, and the same one for an account nobody
+ * has confirmed. Those checks are called from here, so the two sign-ins stay
+ * the same sign-in.
+ *
+ * Managed login has two more answers, and both are pages. A user owing a
+ * second factor is asked for the code, and one holding a temporary password is
+ * asked for a new one. Neither page is simulated, and a sign-in that would
+ * reach one is refused here with a message saying which.
+ */
+export class SimCognitoHostedPasswordSignIn {
+    /**
+     * The user this request signs in, having checked its password.
+     */
+    signIn(pool, client, input) {
+        const { username, password } = this.requiredCredentials(input);
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        requireSimCognitoSignIn(user, password);
+        requireSimCognitoConfirmed(user);
+        this.requireNoFurtherPage(pool, user);
+        return user;
+    }
+    /**
+     * The username and password the request carried.
+     *
+     * A request carrying neither, and naming no identity provider, is one a
+     * browser is shown the sign-in page for. The serving layer is what answers
+     * with that page, from this refusal.
+     */
+    requiredCredentials(input) {
+        const { username, password } = input;
+        if (username === undefined ||
+            username === "" ||
+            password === undefined ||
+            password === "") {
+            throw new SimCognitoManagedLoginRequired();
+        }
+        return { username, password };
+    }
+    /**
+     * Refuse a sign-in real managed login answers with a page of its own.
+     *
+     * `simCognitoChallengeFactor` refuses the second factors it cannot
+     * challenge for and answers with the ones it can, and neither is a code, so
+     * a user with a factor is refused here whichever it has.
+     */
+    requireNoFurtherPage(pool, user) {
+        if (user.status.mustChangePassword) {
+            throw new SimCognitoInvalidParameterException(`User ${user.username} holds a temporary password, so real managed ` +
+                `login would answer this sign-in with a page asking for a new one, ` +
+                `which is not simulated. Set a permanent password on the user with ` +
+                `AdminSetUserPassword.`);
+        }
+        const factor = simCognitoChallengeFactor(pool, user);
+        if (factor !== undefined) {
+            throw new SimCognitoInvalidParameterException(`User ${user.username} is challenged for ${factor}, so real managed ` +
+                `login would answer this sign-in with a page asking for the code, ` +
+                `which is not simulated. Sign the user in with InitiateAuth, which ` +
+                `answers the challenge this simulation issues.`);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-password-sign-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAWrF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CACzB,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAErC,IACE,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,EAAE;YACf,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,EAAE,EACf,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,IAAwB,EACxB,IAAoB;QAEpB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,+CAA+C;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAErD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,sBAAsB,MAAM,oBAAoB;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,+CAA+C,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts

@@ -0,0 +1,32 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+interface SimCognitoHostedSignInProperties {
+    readonly federatedSignIn: SimCognitoFederatedSignIn;
+    readonly clock: SimClock;
+}
+/**
+ * Which user an authorize request signs in.
+ *
+ * Real Cognito has two answers here. A request naming an identity provider
+ * goes to that provider's own sign-in page, and one naming none goes to
+ * managed login's form. The choice is made from the same parameter either way,
+ * so it is made in one place, and what comes back is the pool user the
+ * authorization code is issued for.
+ */
+export declare class SimCognitoHostedSignIn {
+    private readonly federatedSignIn;
+    private readonly clock;
+    private readonly request;
+    private readonly passwordSignIn;
+    constructor(properties: SimCognitoHostedSignInProperties);
+    /**
+     * The user this request signs in, at a provider or in the pool itself.
+     */
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUser;
+}
+export {};
+//# sourceMappingURL=sim-cognito-hosted-sign-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAG/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,cAAc,CAYhB;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js

@@ -0,0 +1,36 @@
+import { SimCognitoAuthorizeRequest } from "./sim-cognito-authorize-request.js";
+import { SimCognitoHostedPasswordSignIn } from "./sim-cognito-hosted-password-sign-in.js";
+/**
+ * Which user an authorize request signs in.
+ *
+ * Real Cognito has two answers here. A request naming an identity provider
+ * goes to that provider's own sign-in page, and one naming none goes to
+ * managed login's form. The choice is made from the same parameter either way,
+ * so it is made in one place, and what comes back is the pool user the
+ * authorization code is issued for.
+ */
+export class SimCognitoHostedSignIn {
+    federatedSignIn;
+    clock;
+    request = new SimCognitoAuthorizeRequest();
+    passwordSignIn = new SimCognitoHostedPasswordSignIn();
+    constructor(properties) {
+        this.federatedSignIn = properties.federatedSignIn;
+        this.clock = properties.clock;
+    }
+    /**
+     * The user this request signs in, at a provider or in the pool itself.
+     */
+    signIn(pool, client, input) {
+        const provider = this.request.signInProvider(pool, client, input);
+        if (provider === undefined) {
+            return this.passwordSignIn.signIn(pool, client, input);
+        }
+        return this.federatedSignIn.signIn({
+            pool,
+            provider,
+            now: this.clock.now(),
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-sign-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAQ1F;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC3C,cAAc,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAEvE,YAAY,UAA4C;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAElE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,IAAI;YACJ,QAAQ;YACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/error/sim-cognito-managed-login.error.d.ts

@@ -0,0 +1,22 @@
+import { SimCognitoOAuthError } from "./sim-cognito-oauth.error.js";
+/**
+ * An authorize request that a person still has to fill a form in for.
+ *
+ * Real Cognito answers this request with managed login's sign-in form. The
+ * serving layer answers it with the simulation's own form, and a caller
+ * reaching `hostedAuthorize` without going through HTTP is answered with this
+ * refusal, which says which two fields the form would have posted.
+ *
+ * It is an OAuth error so that every other caller treats it as one. The
+ * serving layer is the only thing that tells it apart, because the serving
+ * layer is the only thing that can answer with a page.
+ */
+export declare class SimCognitoManagedLoginRequired extends SimCognitoOAuthError {
+    constructor();
+}
+/**
+ * Whether an authorize request was one managed login would have answered with
+ * its sign-in form.
+ */
+export declare function isSimCognitoManagedLoginRequired(error: unknown): error is SimCognitoManagedLoginRequired;
+//# sourceMappingURL=sim-cognito-managed-login.error.d.ts.map

package/dist/service/cognito/error/sim-cognito-managed-login.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-managed-login.error.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/error/sim-cognito-managed-login.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,qBAAa,8BAA+B,SAAQ,oBAAoB;IACtE,cASC;CACF;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,8BAA8B,CAEzC"}

package/dist/service/cognito/error/sim-cognito-managed-login.error.js

@@ -0,0 +1,32 @@
+import { SimCognitoOAuthError } from "./sim-cognito-oauth.error.js";
+/**
+ * An authorize request that a person still has to fill a form in for.
+ *
+ * Real Cognito answers this request with managed login's sign-in form. The
+ * serving layer answers it with the simulation's own form, and a caller
+ * reaching `hostedAuthorize` without going through HTTP is answered with this
+ * refusal, which says which two fields the form would have posted.
+ *
+ * It is an OAuth error so that every other caller treats it as one. The
+ * serving layer is the only thing that tells it apart, because the serving
+ * layer is the only thing that can answer with a page.
+ */
+export class SimCognitoManagedLoginRequired extends SimCognitoOAuthError {
+    constructor() {
+        super({
+            code: "invalid_request",
+            description: "This request names no identity provider, so it signs in one of " +
+                "the pool's own users and needs a username and a password. Pass " +
+                "both, or name an identity_provider to sign in through.",
+            redirectable: false,
+        });
+    }
+}
+/**
+ * Whether an authorize request was one managed login would have answered with
+ * its sign-in form.
+ */
+export function isSimCognitoManagedLoginRequired(error) {
+    return error instanceof SimCognitoManagedLoginRequired;
+}
+//# sourceMappingURL=sim-cognito-managed-login.error.js.map

package/dist/service/cognito/error/sim-cognito-managed-login.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-managed-login.error.js","sourceRoot":"","sources":["../../../../src/service/cognito/error/sim-cognito-managed-login.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,8BAA+B,SAAQ,oBAAoB;IACtE;QACE,KAAK,CAAC;YACJ,IAAI,EAAE,iBAAiB;YACvB,WAAW,EACT,iEAAiE;gBACjE,iEAAiE;gBACjE,wDAAwD;YAC1D,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAc;IAEd,OAAO,KAAK,YAAY,8BAA8B,CAAC;AACzD,CAAC"}

package/dist/service/cognito/serve/page/sim-cognito-confirm-page.d.ts

@@ -0,0 +1,29 @@
+import { SimCognitoPageForm } from "./sim-cognito-page-form.js";
+/**
+ * The confirmation form, reached from the sign-up that has just been made.
+ *
+ * It takes the code the pool issued and confirms the sign-up with it, which is
+ * `ConfirmSignUp`. The second button is `ResendConfirmationCode`, and the code
+ * the user was holding stops working when it is pressed.
+ *
+ * Nothing here delivers a code to anybody. The pool records the message it
+ * would have sent, and `SimCognitoUserPool.confirmationCode` is where a test
+ * reads it from, which is where a person would have read it out of an inbox.
+ */
+export declare class SimCognitoConfirmPage {
+    private readonly markup;
+    /**
+     * The page, or one of the two operations its form has just posted.
+     */
+    handle(form: SimCognitoPageForm): Promise<Response>;
+    /**
+     * Issue a fresh confirmation code, and ask for it again.
+     */
+    private resend;
+    /**
+     * The page a browser is answered with, with a message where a confirmation
+     * has already been refused once or a fresh code has just been sent.
+     */
+    private render;
+}
+//# sourceMappingURL=sim-cognito-confirm-page.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-confirm-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-confirm-page.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-confirm-page.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAehE;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyBxD;IAED;;OAEG;YACW,MAAM;IAgBpB;;;OAGG;IACH,OAAO,CAAC,MAAM;CAwBf"}

package/dist/service/cognito/serve/page/sim-cognito-confirm-page.js

@@ -0,0 +1,90 @@
+import { SimCognitoPageForm } from "./sim-cognito-page-form.js";
+import { SimCognitoPageMarkup } from "./sim-cognito-page-markup.js";
+import { simCognitoAuthorizePath, simCognitoConfirmPath, } from "./sim-cognito-page-paths.js";
+/**
+ * The name of the button that asks for another confirmation code.
+ *
+ * The form has two submit buttons, and this is what tells the post which one
+ * was pressed.
+ */
+const resendField = "resend";
+/**
+ * The confirmation form, reached from the sign-up that has just been made.
+ *
+ * It takes the code the pool issued and confirms the sign-up with it, which is
+ * `ConfirmSignUp`. The second button is `ResendConfirmationCode`, and the code
+ * the user was holding stops working when it is pressed.
+ *
+ * Nothing here delivers a code to anybody. The pool records the message it
+ * would have sent, and `SimCognitoUserPool.confirmationCode` is where a test
+ * reads it from, which is where a person would have read it out of an inbox.
+ */
+export class SimCognitoConfirmPage {
+    markup = new SimCognitoPageMarkup();
+    /**
+     * The page, or one of the two operations its form has just posted.
+     */
+    async handle(form) {
+        if (!form.isPosted) {
+            return this.render(form);
+        }
+        if (form.field(resendField) !== undefined) {
+            return await this.resend(form);
+        }
+        try {
+            await form.cognito.confirmSignUp({
+                input: {
+                    ClientId: form.clientId,
+                    Username: form.username,
+                    ConfirmationCode: form.field("code"),
+                    ...form.secretHash(),
+                },
+            });
+        }
+        catch (error) {
+            return this.render(form, SimCognitoPageForm.messageIn(error));
+        }
+        // The confirmed user signs in at the endpoint the browser arrived on,
+        // which is where the grant it started carries on from.
+        return this.markup.redirect(simCognitoAuthorizePath, form.parameters);
+    }
+    /**
+     * Issue a fresh confirmation code, and ask for it again.
+     */
+    async resend(form) {
+        try {
+            await form.cognito.resendConfirmationCode({
+                input: {
+                    ClientId: form.clientId,
+                    Username: form.username,
+                    ...form.secretHash(),
+                },
+            });
+        }
+        catch (error) {
+            return this.render(form, SimCognitoPageForm.messageIn(error));
+        }
+        return this.render(form, "Another code has been sent.");
+    }
+    /**
+     * The page a browser is answered with, with a message where a confirmation
+     * has already been refused once or a fresh code has just been sent.
+     */
+    render(form, message) {
+        const { parameters, username } = form;
+        // The sign-up that has just been made names the user, and a browser that
+        // came here from the sign-in page instead has to say who it is.
+        const user = username === ""
+            ? this.markup.field("username", "Username")
+            : this.markup.hidden({ username });
+        const body = (message === undefined ? "" : this.markup.message(message)) +
+            this.markup.form(simCognitoConfirmPath, this.markup.hidden(parameters) +
+                user +
+                this.markup.field("code", "Confirmation code") +
+                this.markup.submit("confirm", "Confirm") +
+                this.markup.submit(resendField, "Send another code", true)) +
+            this.markup.link(simCognitoAuthorizePath, parameters, "Back to sign in");
+        return this.markup.page("Confirm your sign-up", body);
+    }
+}
+//# sourceMappingURL=sim-cognito-confirm-page.js.map

package/dist/service/cognito/serve/page/sim-cognito-confirm-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-confirm-page.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-confirm-page.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAErC;;;;;GAKG;AACH,MAAM,WAAW,GAAG,QAAQ,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAqB;IACf,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAErD;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,IAAwB;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;gBAC/B,KAAK,EAAE;oBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACpC,GAAG,IAAI,CAAC,UAAU,EAAE;iBACrB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,sEAAsE;QACtE,uDAAuD;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAAC,IAAwB;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBACxC,KAAK,EAAE;oBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,GAAG,IAAI,CAAC,UAAU,EAAE;iBACrB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,IAAwB,EAAE,OAAgB;QACvD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAEtC,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,GACR,QAAQ,KAAK,EAAE;YACb,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEvC,MAAM,IAAI,GACR,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qBAAqB,EACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC5B,IAAI;gBACJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAC7D;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-managed-login.d.ts

@@ -0,0 +1,38 @@
+import type { SimCognitoDomainRequest } from "../sim-cognito-domain-request.js";
+import type { SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
+/**
+ * The pages simulated managed login serves.
+ *
+ * A person reaches the sign-in form at the authorize endpoint, the sign-up
+ * form from a link on it, and the confirmation form from the sign-up it has
+ * just made. Each form carries the authorize request's own parameters through
+ * as hidden inputs, so the sign-in at the end of it reaches the app client's
+ * callback URL the application asked for.
+ */
+export declare class SimCognitoManagedLogin {
+    private readonly pageRequest;
+    private readonly signInPage;
+    private readonly signUpPage;
+    private readonly confirmPage;
+    /**
+     * Whether a path is one of the two pages served beside the OAuth endpoints.
+     */
+    static servesPage(pathname: string): boolean;
+    /**
+     * Answer the sign-up or confirmation page a request reached.
+     */
+    handlePage(request: SimCognitoDomainRequest): Promise<Response>;
+    /**
+     * Answer a refused authorize request on the sign-in form, where the form is
+     * what real managed login would have answered with.
+     *
+     * A request carrying no credentials gets the empty form. One the person
+     * filled in wrongly gets it back with the refusal on it, because a wrong
+     * password is theirs to correct rather than the application's to be told
+     * about. Every other refusal belongs to the application, and nothing here
+     * answers it.
+     */
+    refusedSignIn(request: SimCognitoDomainRequest, parameters: SimCognitoPageParameters, error: unknown): Response | undefined;
+    private formIn;
+}
+//# sourceMappingURL=sim-cognito-managed-login.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-managed-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-managed-login.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-managed-login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAGhF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAU7E;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAE3D;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3C;IAED;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQpE;IAED;;;;;;;;;OASG;IACH,aAAa,CACX,OAAO,EAAE,uBAAuB,EAChC,UAAU,EAAE,wBAAwB,EACpC,KAAK,EAAE,OAAO,GACb,QAAQ,GAAG,SAAS,CActB;IAED,OAAO,CAAC,MAAM;CAMf"}

package/dist/service/cognito/serve/page/sim-cognito-managed-login.js

@@ -0,0 +1,62 @@
+import { isSimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
+import { isSimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
+import { SimCognitoConfirmPage } from "./sim-cognito-confirm-page.js";
+import { SimCognitoPageForm } from "./sim-cognito-page-form.js";
+import { simCognitoConfirmPath, simCognitoIsLocalSignIn, simCognitoSignUpPath, } from "./sim-cognito-page-paths.js";
+import { SimCognitoPageRequest } from "./sim-cognito-page-request.js";
+import { SimCognitoSignInPage } from "./sim-cognito-sign-in-page.js";
+import { SimCognitoSignUpPage } from "./sim-cognito-sign-up-page.js";
+/**
+ * The pages simulated managed login serves.
+ *
+ * A person reaches the sign-in form at the authorize endpoint, the sign-up
+ * form from a link on it, and the confirmation form from the sign-up it has
+ * just made. Each form carries the authorize request's own parameters through
+ * as hidden inputs, so the sign-in at the end of it reaches the app client's
+ * callback URL the application asked for.
+ */
+export class SimCognitoManagedLogin {
+    pageRequest = new SimCognitoPageRequest();
+    signInPage = new SimCognitoSignInPage();
+    signUpPage = new SimCognitoSignUpPage();
+    confirmPage = new SimCognitoConfirmPage();
+    /**
+     * Whether a path is one of the two pages served beside the OAuth endpoints.
+     */
+    static servesPage(pathname) {
+        return (pathname === simCognitoSignUpPath || pathname === simCognitoConfirmPath);
+    }
+    /**
+     * Answer the sign-up or confirmation page a request reached.
+     */
+    async handlePage(request) {
+        const form = this.formIn(request);
+        if (request.url.pathname === simCognitoSignUpPath) {
+            return await this.signUpPage.handle(form);
+        }
+        return await this.confirmPage.handle(form);
+    }
+    /**
+     * Answer a refused authorize request on the sign-in form, where the form is
+     * what real managed login would have answered with.
+     *
+     * A request carrying no credentials gets the empty form. One the person
+     * filled in wrongly gets it back with the refusal on it, because a wrong
+     * password is theirs to correct rather than the application's to be told
+     * about. Every other refusal belongs to the application, and nothing here
+     * answers it.
+     */
+    refusedSignIn(request, parameters, error) {
+        if (isSimCognitoManagedLoginRequired(error)) {
+            return this.signInPage.render(request.pool, parameters);
+        }
+        if (isSimCognitoOAuthError(error) || !simCognitoIsLocalSignIn(parameters)) {
+            return undefined;
+        }
+        return this.signInPage.render(request.pool, parameters, SimCognitoPageForm.messageIn(error));
+    }
+    formIn(request) {
+        return new SimCognitoPageForm(request, this.pageRequest.values(request.serviceRequest, request.url));
+    }
+}
+//# sourceMappingURL=sim-cognito-managed-login.js.map