@kensio/yulin 1.16.0 → 1.16.1

package/dist/service/cognito/serve/page/sim-cognito-sign-up-page.js

@@ -0,0 +1,85 @@
+import { SimCognitoPageForm } from "./sim-cognito-page-form.js";
+import { SimCognitoPageMarkup } from "./sim-cognito-page-markup.js";
+import { simCognitoAuthorizePath, simCognitoConfirmPath, simCognitoSignUpPath, } from "./sim-cognito-page-paths.js";
+/**
+ * The sign-up form, reached from a link on the sign-in page.
+ *
+ * The form asks for a username, a password and the attributes the pool needs
+ * of a new user. Those are the ones its `Schema` made required, and the ones
+ * its `AutoVerifiedAttributes` names, because the second is where the
+ * confirmation code would have been delivered.
+ *
+ * Posting it is `SignUp`, called as an application calls it. A refusal is
+ * shown on the form, which is what managed login does with a password the
+ * pool's policy turns down.
+ */
+export class SimCognitoSignUpPage {
+    markup = new SimCognitoPageMarkup();
+    /**
+     * The attributes this pool's sign-up form asks for.
+     */
+    static attributeNames(pool) {
+        const { schema, autoVerifiedAttributes, usernameAttributes } = pool.settings;
+        const asked = new Set([
+            ...schema.requiredNames,
+            ...autoVerifiedAttributes.names,
+        ]);
+        // A pool signing users in by an address takes that address as the
+        // username, so asking for it again would be asking the same question
+        // twice.
+        return [...asked.difference(new Set(usernameAttributes.names))];
+    }
+    /**
+     * The attributes the form asked for, as `SignUp` takes them.
+     */
+    static attributesIn(form) {
+        return this.attributeNames(form.pool)
+            .map((name) => ({ Name: name, Value: form.field(name) }))
+            .filter((attribute) => (attribute.Value ?? "") !== "");
+    }
+    /**
+     * The page, or the sign-up its form has just posted.
+     */
+    async handle(form) {
+        if (!form.isPosted) {
+            return this.render(form);
+        }
+        try {
+            await form.cognito.signUp({
+                input: {
+                    ClientId: form.clientId,
+                    Username: form.username,
+                    Password: form.field("password"),
+                    UserAttributes: SimCognitoSignUpPage.attributesIn(form),
+                    ...form.secretHash(),
+                },
+            });
+        }
+        catch (error) {
+            return this.render(form, SimCognitoPageForm.messageIn(error));
+        }
+        return this.markup.redirect(simCognitoConfirmPath, {
+            ...form.parameters,
+            username: form.username,
+        });
+    }
+    /**
+     * The page a browser is answered with, with a message where a sign-up has
+     * already been refused once.
+     */
+    render(form, message) {
+        const { parameters } = form;
+        const attributes = SimCognitoSignUpPage.attributeNames(form.pool)
+            .map((name) => this.markup.field(name, name))
+            .join("");
+        const body = (message === undefined ? "" : this.markup.message(message)) +
+            this.markup.form(simCognitoSignUpPath, this.markup.hidden(parameters) +
+                this.markup.field("username", "Username") +
+                this.markup.field("password", "Password", "password") +
+                attributes +
+                this.markup.submit("signUp", "Sign up")) +
+            this.markup.link(simCognitoAuthorizePath, parameters, "Back to sign in");
+        return this.markup.page("Sign up", body);
+    }
+}
+//# sourceMappingURL=sim-cognito-sign-up-page.js.map

package/dist/service/cognito/serve/page/sim-cognito-sign-up-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-up-page.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-up-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAErD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,GAC1D,IAAI,CAAC,QAAQ,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;YACpB,GAAG,MAAM,CAAC,aAAa;YACvB,GAAG,sBAAsB,CAAC,KAAK;SAChC,CAAC,CAAC;QAEH,kEAAkE;QAClE,qEAAqE;QACrE,SAAS;QACT,OAAO,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,YAAY,CACzB,IAAwB;QAExB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;aAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,IAAwB;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxB,KAAK,EAAE;oBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;oBAChC,cAAc,EAAE,oBAAoB,CAAC,YAAY,CAAC,IAAI,CAAC;oBACvD,GAAG,IAAI,CAAC,UAAU,EAAE;iBACrB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE;YACjD,GAAG,IAAI,CAAC,UAAU;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,IAAwB,EAAE,OAAgB;QACvD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,UAAU,GAAG,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;aAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC5C,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,IAAI,GACR,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oBAAoB,EACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;gBACrD,UAAU;gBACV,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC1C;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.d.ts

@@ -1,35 +1,35 @@
-import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
-import type { SimCognitoIdentityProvider } from "../sim-cognito-identity-provider.js";
-import type { SimCognitoUserPool } from "../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoDomainRequest } from "./sim-cognito-domain-request.js";
+export type { SimCognitoDomainRequest } from "./sim-cognito-domain-request.js";
 /**
- * One request to a hosted domain, and what answers it.
- */
-export interface SimCognitoDomainRequest {
-    readonly pool: SimCognitoUserPool;
-    /** The simulated Cognito scope the pool belongs to. */
-    readonly cognito: SimCognitoIdentityProvider;
-    readonly serviceRequest: SimAwsServiceRequest;
-    readonly url: URL;
-}
-/**
- * The three endpoints a pool's hosted domain serves.
+ * The endpoints and pages a pool's hosted domain serves.
  *
- * Each takes one HTTP method and one only, as real Cognito's do, and turns
- * what the simulation answered into the redirect or the JSON body a browser or
- * an application's own server reads.
+ * The token and logout endpoints take one HTTP method each, as real Cognito's
+ * do. The authorize endpoint takes the post of the sign-in form it serves as
+ * well as the get an application sends the browser on, and so do the two pages
+ * reached from that form.
  */
 export declare class SimCognitoDomainEndpoints {
     private readonly response;
     private readonly tokenRequest;
+    private readonly pageRequest;
+    private readonly pages;
     /**
      * Answer a request that reached the domain's hostname.
      */
     handleRequest(request: SimCognitoDomainRequest): Promise<Response>;
     /**
-     * Sign a user in through an identity provider and send the browser back to
-     * the application with a code.
+     * Sign a user in and send the browser back to the application with a code,
+     * or serve the form that asks who is signing in.
+     *
+     * A get carrying credentials and a post of the sign-in form are the same
+     * request to the simulation. Both name the user and its password, and the
+     * only difference is where those two were read from.
      */
     private authorize;
+    /**
+     * Answer a refused sign-in, on the form or at the application.
+     */
+    private refused;
     /**
      * Exchange an authorization code or a refresh token for tokens.
      */
@@ -39,10 +39,7 @@ export declare class SimCognitoDomainEndpoints {
      */
     private logout;
     /**
-     * Answer a request that used the method its endpoint takes.
-     *
-     * Each endpoint takes one method and one only, as real Cognito's do, so what
-     * is left to say about any other is which one it was.
+     * Answer a request that used a method its endpoint takes.
      */
     private answered;
 }

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-domain-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAWhF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAElC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;CACnB;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAE7D;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgBvE;IAED;;;OAGG;YACW,SAAS;IAkBvB;;OAEG;YACW,KAAK;IAenB;;OAEG;YACW,MAAM;IAcpB;;;;;OAKG;YACW,QAAQ;CAavB"}
+{"version":3,"file":"sim-cognito-domain-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAgB/E,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEtD;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBvE;IAED;;;;;;;OAOG;YACW,SAAS;IAiBvB;;OAEG;IACH,OAAO,CAAC,OAAO;IAef;;OAEG;YACW,KAAK;IAenB;;OAEG;YACW,MAAM;IAcpB;;OAEG;YACW,QAAQ;CAavB"}

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.js

@@ -1,27 +1,37 @@
+import { SimCognitoManagedLogin } from "./page/sim-cognito-managed-login.js";
+import { simCognitoAuthorizePath } from "./page/sim-cognito-page-paths.js";
+import { SimCognitoPageRequest } from "./page/sim-cognito-page-request.js";
 import { SimCognitoOAuthResponse } from "./sim-cognito-oauth-response.js";
 import { SimCognitoTokenRequest } from "./sim-cognito-token-request.js";
 /**
- * The paths a hosted domain serves.
+ * The remaining paths a hosted domain serves.
  */
-const authorizePath = "/oauth2/authorize";
 const tokenPath = "/oauth2/token";
 const logoutPath = "/logout";
 /**
- * The three endpoints a pool's hosted domain serves.
+ * The methods a page takes, which is both of them, because a form is fetched
+ * and then posted back.
+ */
+const pageMethods = "GET, POST";
+/**
+ * The endpoints and pages a pool's hosted domain serves.
  *
- * Each takes one HTTP method and one only, as real Cognito's do, and turns
- * what the simulation answered into the redirect or the JSON body a browser or
- * an application's own server reads.
+ * The token and logout endpoints take one HTTP method each, as real Cognito's
+ * do. The authorize endpoint takes the post of the sign-in form it serves as
+ * well as the get an application sends the browser on, and so do the two pages
+ * reached from that form.
  */
 export class SimCognitoDomainEndpoints {
     response = new SimCognitoOAuthResponse();
     tokenRequest = new SimCognitoTokenRequest();
+    pageRequest = new SimCognitoPageRequest();
+    pages = new SimCognitoManagedLogin();
     /**
      * Answer a request that reached the domain's hostname.
      */
     async handleRequest(request) {
         const { pathname } = request.url;
-        if (pathname === authorizePath) {
+        if (pathname === simCognitoAuthorizePath) {
             return await this.authorize(request);
         }
         if (pathname === tokenPath) {
@@ -30,23 +40,37 @@ export class SimCognitoDomainEndpoints {
         if (pathname === logoutPath) {
             return await this.logout(request);
         }
+        if (SimCognitoManagedLogin.servesPage(pathname)) {
+            return await this.answered(request, pageMethods, async () => this.pages.handlePage(request));
+        }
         return this.response.noSuchEndpoint(pathname);
     }
     /**
-     * Sign a user in through an identity provider and send the browser back to
-     * the application with a code.
+     * Sign a user in and send the browser back to the application with a code,
+     * or serve the form that asks who is signing in.
+     *
+     * A get carrying credentials and a post of the sign-in form are the same
+     * request to the simulation. Both name the user and its password, and the
+     * only difference is where those two were read from.
      */
     async authorize(request) {
-        const parameters = Object.fromEntries(request.url.searchParams);
-        return await this.answered(request, "GET", async () => {
+        return await this.answered(request, pageMethods, async () => {
+            const parameters = this.pageRequest.values(request.serviceRequest, request.url);
             try {
                 return this.response.redirect(await request.cognito.hostedAuthorize(request.pool, parameters));
             }
             catch (error) {
-                return this.response.refusedRedirect(error, parameters["redirect_uri"], parameters["state"]);
+                return this.refused(request, parameters, error);
             }
         });
     }
+    /**
+     * Answer a refused sign-in, on the form or at the application.
+     */
+    refused(request, parameters, error) {
+        return (this.pages.refusedSignIn(request, parameters, error) ??
+            this.response.refusedRedirect(error, parameters["redirect_uri"], parameters["state"]));
+    }
     /**
      * Exchange an authorization code or a refresh token for tokens.
      */
@@ -75,15 +99,12 @@ export class SimCognitoDomainEndpoints {
         });
     }
     /**
-     * Answer a request that used the method its endpoint takes.
-     *
-     * Each endpoint takes one method and one only, as real Cognito's do, so what
-     * is left to say about any other is which one it was.
+     * Answer a request that used a method its endpoint takes.
      */
-    async answered(request, method, answer) {
+    async answered(request, allowed, answer) {
         const requested = request.serviceRequest.request.method;
-        if (requested !== method) {
-            return this.response.notAllowed(requested, method);
+        if (!allowed.split(", ").includes(requested)) {
+            return this.response.notAllowed(requested, allowed);
         }
         return await answer();
     }

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-domain-endpoints.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,UAAU,GAAG,SAAS,CAAC;AAc7B;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACzC,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAE7D;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgC;QAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QAEjC,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS,CAAC,OAAgC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAChE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAClC,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,EAC1B,UAAU,CAAC,OAAO,CAAC,CACpB,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CAAC,OAAgC;QAClD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CACzB,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAC/B,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAC/C,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAAC,OAAgC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAC9D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CACpB,OAAgC,EAChC,MAAc,EACd,MAA+B;QAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;QAExD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-domain-endpoints.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B;;;GAGG;AACH,MAAM,WAAW,GAAG,WAAW,CAAC;AAIhC;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACzC,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAEtD;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgC;QAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QAEjC,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YACzC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,sBAAsB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAC1D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,SAAS,CAAC,OAAgC;QACtD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACxC,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,GAAG,CACZ,CAAC;YAEF,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAChE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,OAAO,CACb,OAAgC,EAChC,UAAoC,EACpC,KAAc;QAEd,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAC3B,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,EAC1B,UAAU,CAAC,OAAO,CAAC,CACpB,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CAAC,OAAgC;QAClD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CACzB,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAC/B,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAC/C,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAAC,OAAgC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAC9D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CACpB,OAAgC,EAChC,OAAe,EACf,MAA+B;QAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;QAExD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-domain-request.d.ts

@@ -0,0 +1,14 @@
+import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import type { SimCognitoIdentityProvider } from "../sim-cognito-identity-provider.js";
+import type { SimCognitoUserPool } from "../user-pool/sim-cognito-user-pool.js";
+/**
+ * One request to a hosted domain, and what answers it.
+ */
+export interface SimCognitoDomainRequest {
+    readonly pool: SimCognitoUserPool;
+    /** The simulated Cognito scope the pool belongs to. */
+    readonly cognito: SimCognitoIdentityProvider;
+    readonly serviceRequest: SimAwsServiceRequest;
+    readonly url: URL;
+}
+//# sourceMappingURL=sim-cognito-domain-request.d.ts.map

package/dist/service/cognito/serve/sim-cognito-domain-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-domain-request.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAElC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;CACnB"}

package/dist/service/cognito/serve/sim-cognito-domain-request.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-cognito-domain-request.js.map

package/dist/service/cognito/serve/sim-cognito-domain-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-domain-request.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-request.ts"],"names":[],"mappings":""}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.d.ts

@@ -1,4 +1,12 @@
 export declare const simIamSigV4UnsignedPayload = "UNSIGNED-PAYLOAD";
+/**
+ * The header a signed request declares its payload hash in.
+ *
+ * Whoever builds a signed request states the hash here, and whoever receives
+ * one reads it from here, so the name is shared rather than written out again
+ * at each end.
+ */
+export declare const simIamSigV4ContentSha256Header = "x-amz-content-sha256";
 /**
  * What a signed request declares its body hashes to.
  *

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-payload-hash.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAW7D;;;;;;;;GAQG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IAEzC,OAAO,eAEN;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,6BAA6B,CAElE;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,6BAA6B,CAOjE;IAED;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CA6B5C;CACF"}
+{"version":3,"file":"sim-iam-sigv4-payload-hash.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,yBAAyB,CAAC;AAUrE;;;;;;;;GAQG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IAEzC,OAAO,eAEN;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,6BAA6B,CAIlE;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,6BAA6B,CAOjE;IAED;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CA8B5C;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.js

@@ -2,7 +2,14 @@ import { createHash } from "node:crypto";
 import { SimIamSignatureDoesNotMatch } from "../error/sim-iam-sigv4.error.js";
 import { simIamSigV4PresignedParameter, simIamSigV4PresignedParameters, } from "../presign/sim-iam-sigv4-presigned-parameters.js";
 export const simIamSigV4UnsignedPayload = "UNSIGNED-PAYLOAD";
-const sha256Name = "x-amz-content-sha256";
+/**
+ * The header a signed request declares its payload hash in.
+ *
+ * Whoever builds a signed request states the hash here, and whoever receives
+ * one reads it from here, so the name is shared rather than written out again
+ * at each end.
+ */
+export const simIamSigV4ContentSha256Header = "x-amz-content-sha256";
 const sha256DigestPattern = /^[\da-f]{64}$/i;
 /**
  * The SHA-256 of an empty body, which SigV4 uses when a request has no body.
@@ -26,7 +33,7 @@ export class SimIamSigV4PayloadDeclaration {
      * The declaration a header-signed request makes.
      */
     static fromHeaders(headers) {
-        return new SimIamSigV4PayloadDeclaration(headers.get(sha256Name));
+        return new SimIamSigV4PayloadDeclaration(headers.get(simIamSigV4ContentSha256Header));
     }
     /**
      * The declaration a presigned URL makes, defaulting to an unsigned payload.
@@ -58,14 +65,15 @@ export class SimIamSigV4PayloadDeclaration {
             return declared;
         }
         if (!sha256DigestPattern.test(declared)) {
-            throw new SimIamSignatureDoesNotMatch(`Signed ${sha256Name} declares ${declared}, which is neither a ` +
-                `SHA-256 digest nor ${simIamSigV4UnsignedPayload}. Chunked and ` +
-                `streaming payload signing is not simulated.`);
+            throw new SimIamSignatureDoesNotMatch(`Signed ${simIamSigV4ContentSha256Header} declares ${declared}, ` +
+                `which is neither a SHA-256 digest nor ` +
+                `${simIamSigV4UnsignedPayload}. Chunked and streaming payload ` +
+                `signing is not simulated.`);
         }
         const received = hashOfBody(body);
         if (received !== declared.toLowerCase()) {
             throw new SimIamSignatureDoesNotMatch(`Request body hashes to ${received}, not the ${declared} its signed ` +
-                `${sha256Name} declares`);
+                `${simIamSigV4ContentSha256Header} declares`);
         }
         return declared;
     }

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-payload-hash.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,kDAAkD,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAC1C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;GAEG;AACH,MAAM,aAAa,GACjB,kEAAkE,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA6B;IACvB,QAAQ,CAAgB;IAEzC,YAAoB,QAAuB;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAgB;QACjC,OAAO,IAAI,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAQ;QAChC,OAAO,IAAI,6BAA6B,CACtC,6BAA6B,CAC3B,GAAG,EACH,8BAA8B,CAAC,aAAa,CAC7C,IAAI,0BAA0B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,IAA4B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,QAAQ,KAAK,0BAA0B,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,2BAA2B,CACnC,UAAU,UAAU,aAAa,QAAQ,uBAAuB;gBAC9D,sBAAsB,0BAA0B,gBAAgB;gBAChE,6CAA6C,CAChD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAElC,IAAI,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,2BAA2B,CACnC,0BAA0B,QAAQ,aAAa,QAAQ,cAAc;gBACnE,GAAG,UAAU,WAAW,CAC3B,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAA4B;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-payload-hash.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,kDAAkD,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC;AAErE,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;GAEG;AACH,MAAM,aAAa,GACjB,kEAAkE,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA6B;IACvB,QAAQ,CAAgB;IAEzC,YAAoB,QAAuB;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAgB;QACjC,OAAO,IAAI,6BAA6B,CACtC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAQ;QAChC,OAAO,IAAI,6BAA6B,CACtC,6BAA6B,CAC3B,GAAG,EACH,8BAA8B,CAAC,aAAa,CAC7C,IAAI,0BAA0B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,IAA4B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,QAAQ,KAAK,0BAA0B,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,2BAA2B,CACnC,UAAU,8BAA8B,aAAa,QAAQ,IAAI;gBAC/D,wCAAwC;gBACxC,GAAG,0BAA0B,kCAAkC;gBAC/D,2BAA2B,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAElC,IAAI,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,2BAA2B,CACnC,0BAA0B,QAAQ,aAAa,QAAQ,cAAc;gBACnE,GAAG,8BAA8B,WAAW,CAC/C,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAA4B;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/service/lambda/serve/auth/sim-lambda-url-payload-hash.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Why a Function URL request's payload hash cannot be accepted, or nothing
+ * when it can.
+ *
+ * Lambda checks what a request declares its body hashes to before it looks at
+ * who is asking, and answers a request that fails the check with a signature
+ * mismatch. Two declarations fail it. One is a digest that disagrees with the
+ * bytes that arrived, which would otherwise let a signed request carry any body
+ * at all. The other is `UNSIGNED-PAYLOAD`, which Lambda refuses outright.
+ * CloudFront signs a POST or PUT with it when the viewer sent no hash, and that
+ * is why such a request through an origin access control never reaches the
+ * function.
+ *
+ * A request declaring nothing is not checked. The hash is an input to the
+ * signature rather than something a request has to state, so a caller that
+ * signed the body it sent and left the header off has said nothing to
+ * disagree with.
+ *
+ * The method the request used makes no difference here. A declaration is a
+ * claim about the body, and SigV4 covers it for a GET as much as for a POST,
+ * so a GET carrying a digest of other bytes is refused as well. The method
+ * matters on the CloudFront side, which invents a declaration for a POST or a
+ * PUT alone.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-lambda.html
+ */
+export declare function simLambdaUrlPayloadRefusal(request: Request): Promise<string | undefined>;
+//# sourceMappingURL=sim-lambda-url-payload-hash.d.ts.map

package/dist/service/lambda/serve/auth/sim-lambda-url-payload-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-url-payload-hash.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/auth/sim-lambda-url-payload-hash.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkC7B"}

package/dist/service/lambda/serve/auth/sim-lambda-url-payload-hash.js

@@ -0,0 +1,56 @@
+import { simIamSigV4ContentSha256Header, SimIamSigV4PayloadDeclaration, simIamSigV4UnsignedPayload, } from "../../../iam/sigv4/canonical/sim-iam-sigv4-payload-hash.js";
+import { SimIamSigV4Error } from "../../../iam/sigv4/error/sim-iam-sigv4.error.js";
+/**
+ * Why a Function URL request's payload hash cannot be accepted, or nothing
+ * when it can.
+ *
+ * Lambda checks what a request declares its body hashes to before it looks at
+ * who is asking, and answers a request that fails the check with a signature
+ * mismatch. Two declarations fail it. One is a digest that disagrees with the
+ * bytes that arrived, which would otherwise let a signed request carry any body
+ * at all. The other is `UNSIGNED-PAYLOAD`, which Lambda refuses outright.
+ * CloudFront signs a POST or PUT with it when the viewer sent no hash, and that
+ * is why such a request through an origin access control never reaches the
+ * function.
+ *
+ * A request declaring nothing is not checked. The hash is an input to the
+ * signature rather than something a request has to state, so a caller that
+ * signed the body it sent and left the header off has said nothing to
+ * disagree with.
+ *
+ * The method the request used makes no difference here. A declaration is a
+ * claim about the body, and SigV4 covers it for a GET as much as for a POST,
+ * so a GET carrying a digest of other bytes is refused as well. The method
+ * matters on the CloudFront side, which invents a declaration for a POST or a
+ * PUT alone.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-lambda.html
+ */
+export async function simLambdaUrlPayloadRefusal(request) {
+    if (!request.headers.has(simIamSigV4ContentSha256Header)) {
+        return undefined;
+    }
+    const declaration = SimIamSigV4PayloadDeclaration.fromHeaders(request.headers);
+    // A clone, so the body is still there for the invocation event to read.
+    const body = new Uint8Array(await request.clone().arrayBuffer());
+    let declared;
+    try {
+        declared = declaration.hashFor(body);
+    }
+    catch (error) {
+        if (error instanceof SimIamSigV4Error) {
+            return error.message;
+        }
+        /* v8 ignore next 2 -- a declaration is refused with nothing else */
+        throw error;
+    }
+    if (declared !== simIamSigV4UnsignedPayload) {
+        return undefined;
+    }
+    return (`Signed ${simIamSigV4ContentSha256Header} declares ` +
+        `${simIamSigV4UnsignedPayload}, which Lambda does not support. A ` +
+        `${request.method} to a Function URL has to declare the SHA-256 of its ` +
+        `body, and one sent through a CloudFront origin access control declares ` +
+        `whatever the viewer request declared.`);
+}
+//# sourceMappingURL=sim-lambda-url-payload-hash.js.map

package/dist/service/lambda/serve/auth/sim-lambda-url-payload-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-url-payload-hash.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/auth/sim-lambda-url-payload-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB;IAEhB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,WAAW,GAAG,6BAA6B,CAAC,WAAW,CAC3D,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,IAAI,QAAgB,CAAC;IAErB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,oEAAoE;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,0BAA0B,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CACL,UAAU,8BAA8B,YAAY;QACpD,GAAG,0BAA0B,qCAAqC;QAClE,GAAG,OAAO,CAAC,MAAM,uDAAuD;QACxE,yEAAyE;QACzE,uCAAuC,CACxC,CAAC;AACJ,CAAC"}

package/dist/service/lambda/serve/response/sim-lambda-url-error-response.d.ts

@@ -6,6 +6,14 @@
  * Lambda's, down to the link, because that is what someone will be reading.
  */
 export declare const simLambdaUrlForbiddenMessage: string;
+/**
+ * What real Lambda says when a Function URL request does not verify.
+ *
+ * This is the answer a request that failed authentication gets, as opposed to
+ * one that was authenticated and then not allowed, and the wording is what
+ * anyone searching for the failure will have in front of them.
+ */
+export declare const simLambdaUrlSignatureMismatchMessage: string;
 /**
  * The error responses a Function URL endpoint returns itself, before or
  * instead of the function producing one.
@@ -23,6 +31,14 @@ export declare class SimLambdaUrlErrorResponse {
      * The caller is not allowed to invoke this Function URL.
      */
     forbidden(): Response;
+    /**
+     * The request does not carry a signature over the body it arrived with.
+     *
+     * Real Lambda says only that the signature did not match, which is faithful
+     * and impossible to act on, so what the simulator worked out goes in a hint
+     * header where it changes nothing for a client reading the body.
+     */
+    signatureDoesNotMatch(detail: string): Response;
     /**
      * The function failed to handle the invocation.
      */

package/dist/service/lambda/serve/response/sim-lambda-url-error-response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-url-error-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/response/sim-lambda-url-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAEsB,CAAC;AAEhE;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC;;OAEG;IACH,QAAQ,IAAI,QAAQ,CAEnB;IAED;;OAEG;IACH,SAAS,IAAI,QAAQ,CAEpB;IAED;;OAEG;IACH,mBAAmB,IAAI,QAAQ,CAE9B;IAED,OAAO,CAAC,YAAY;CASrB"}
+{"version":3,"file":"sim-lambda-url-error-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/response/sim-lambda-url-error-response.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAEsB,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,QAGP,CAAC;AAE3C;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC;;OAEG;IACH,QAAQ,IAAI,QAAQ,CAEnB;IAED;;OAEG;IACH,SAAS,IAAI,QAAQ,CAEpB;IAED;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAU9C;IAED;;OAEG;IACH,mBAAmB,IAAI,QAAQ,CAE9B;IAED,OAAO,CAAC,YAAY;CASrB"}

package/dist/service/lambda/serve/response/sim-lambda-url-error-response.js

@@ -1,3 +1,4 @@
+import { simAwsErrorDetailHeaderName, simAwsErrorHeaderName, } from "../../../../serve/http/response/sim-aws-response-hints.js";
 /**
  * What real Lambda says when it refuses a Function URL request.
  *
@@ -7,6 +8,16 @@
  */
 export const simLambdaUrlForbiddenMessage = "Forbidden. For troubleshooting Function URL authorization issues, see: " +
     "https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html";
+/**
+ * What real Lambda says when a Function URL request does not verify.
+ *
+ * This is the answer a request that failed authentication gets, as opposed to
+ * one that was authenticated and then not allowed, and the wording is what
+ * anyone searching for the failure will have in front of them.
+ */
+export const simLambdaUrlSignatureMismatchMessage = "The request signature we calculated does not match the signature you " +
+    "provided. Check your AWS Secret Access Key and signing method. Consult " +
+    "the service documentation for details.";
 /**
  * The error responses a Function URL endpoint returns itself, before or
  * instead of the function producing one.
@@ -28,6 +39,19 @@ export class SimLambdaUrlErrorResponse {
     forbidden() {
         return this.jsonResponse(403, simLambdaUrlForbiddenMessage);
     }
+    /**
+     * The request does not carry a signature over the body it arrived with.
+     *
+     * Real Lambda says only that the signature did not match, which is faithful
+     * and impossible to act on, so what the simulator worked out goes in a hint
+     * header where it changes nothing for a client reading the body.
+     */
+    signatureDoesNotMatch(detail) {
+        const response = this.jsonResponse(403, simLambdaUrlSignatureMismatchMessage);
+        response.headers.set(simAwsErrorHeaderName, "SignatureDoesNotMatch");
+        response.headers.set(simAwsErrorDetailHeaderName, detail);
+        return response;
+    }
     /**
      * The function failed to handle the invocation.
      */

package/dist/service/lambda/serve/response/sim-lambda-url-error-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-url-error-response.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/response/sim-lambda-url-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,yEAAyE;IACzE,6DAA6D,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,OAAe;QAClD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB;YACE,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-lambda-url-error-response.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/response/sim-lambda-url-error-response.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,yEAAyE;IACzE,6DAA6D,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,uEAAuE;IACvE,yEAAyE;IACzE,wCAAwC,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAChC,GAAG,EACH,oCAAoC,CACrC,CAAC;QAEF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACrE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;QAE1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,OAAe;QAClD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB;YACE,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/serve/sim-lambda-controller.d.ts

@@ -38,6 +38,12 @@ export declare class SimLambdaServiceController implements SimAwsServiceControll
      * What the request is being made on behalf of travels with it, so a
      * CloudFront Distribution reaching this URL through an origin access control
      * is judged against the Distribution the permission names.
+     *
+     * What the request declares its body hashes to is settled first, as real
+     * Lambda authenticates a request before it authorizes one. A POST or PUT
+     * arriving through an origin access control declares an unsigned payload
+     * unless the viewer sent a hash of its own, and Lambda takes no unsigned
+     * payload, so it is refused here rather than reaching the function.
      */
     private invokeAuthenticated;
     private invoke;

package/dist/service/lambda/serve/sim-lambda-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/lambda/serve/sim-lambda-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C,OAAO,EAEL,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAIpC,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA2B,YAAW,uBAAuB;IACxE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IAEjE,YAAY,UAAU,GAAE,oCAAyC,EAQhE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E;IAED;;;;;;;;;;;OAWG;YACW,mBAAmB;YAmBnB,MAAM;CAqBrB"}
+{"version":3,"file":"sim-lambda-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/lambda/serve/sim-lambda-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C,OAAO,EAEL,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAKpC,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA2B,YAAW,uBAAuB;IACxE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IAEjE,YAAY,UAAU,GAAE,oCAAyC,EAQhE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E;IAED;;;;;;;;;;;;;;;;;OAiBG;YACW,mBAAmB;YA2BnB,MAAM;CAqBrB"}