@kensio/yulin 1.16.0 → 1.16.2

package/dist/service/cognito/user-pool/user/sim-cognito-user-confirmation.js

@@ -1,12 +1,14 @@
-import { SimCognitoCodeMismatchException } from "../../error/sim-cognito.error.js";
+import { SimCognitoCodeMismatchException, SimCognitoExpiredCodeException, } from "../../error/sim-cognito.error.js";
 import { SimCognitoConfirmationCode } from "./sim-cognito-confirmation-code.js";
 /**
- * The confirmation one user has outstanding.
+ * The code one user has outstanding.
  *
- * A user that signed itself up holds a code until it confirms, and a user that
- * did not holds none. Keeping the code and what it answers together is the
- * same modelling choice `SimCognitoUserPassword` makes: the user asks whether
- * a candidate is right, rather than reading the value out to compare it.
+ * A user that signed itself up holds one until it confirms, a user that asked
+ * to reset a forgotten password holds one until it sets the new one, and a
+ * user doing neither holds none. Keeping the code and what it answers together
+ * is the same modelling choice `SimCognitoUserPassword` makes: the user asks
+ * whether a candidate is right, rather than reading the value out to compare
+ * it.
  *
  * The value is readable, unlike a password, because nothing here delivers the
  * message that would carry it.
@@ -32,18 +34,27 @@ export class SimCognitoUserConfirmation {
      * Follow the user to a status.
      *
      * A user waiting to be confirmed holds a code, and one that has left
-     * `UNCONFIRMED` has spent it: a code confirms one sign-up and no more.
+     * `UNCONFIRMED` has spent it: a code confirms one sign-up and no more. A
+     * user an administrator has sent to `RESET_REQUIRED` is issued its code
+     * after the move, because the code is what the reset is answered with.
      */
     settle(status) {
-        this.#code = status.isUnconfirmed
+        this.#code = status.holdsCode
             ? SimCognitoConfirmationCode.issue()
             : undefined;
     }
     /**
      * Refuse a candidate that is not the code outstanding.
+     *
+     * A user holding no code at all is refused as having an expired one, which
+     * is what real Cognito answers a code that has already been spent with.
+     * Nothing here ages a code out, so that is the only way to reach it.
      */
     require(candidate) {
-        if (this.#code?.matches(candidate) !== true) {
+        if (this.#code === undefined) {
+            throw new SimCognitoExpiredCodeException("Invalid code provided, please request a code again.");
+        }
+        if (!this.#code.matches(candidate)) {
             throw new SimCognitoCodeMismatchException("Invalid verification code provided, please try again.");
         }
     }

package/dist/service/cognito/user-pool/user/sim-cognito-user-confirmation.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-confirmation.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAGhF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAyC;IAE9C,YAAY,MAA4B;QACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,0BAA0B,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAA4B;QACjC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa;YAC/B,CAAC,CAAC,0BAA0B,CAAC,KAAK,EAAE;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAA6B;QACnC,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,+BAA+B,CACvC,uDAAuD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-confirmation.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAGhF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAyC;IAE9C,YAAY,MAA4B;QACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,0BAA0B,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAA4B;QACjC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS;YAC3B,CAAC,CAAC,0BAA0B,CAAC,KAAK,EAAE;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAA6B;QACnC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,8BAA8B,CACtC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,+BAA+B,CACvC,uDAAuD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-password-reset.d.ts

@@ -0,0 +1,62 @@
+import type { SimCognitoUserConfirmation } from "./sim-cognito-user-confirmation.js";
+import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
+interface SimCognitoUserPasswordResetProperties {
+    /** The code the user has outstanding, which a reset issues and spends. */
+    readonly confirmation: SimCognitoUserConfirmation;
+    /** Where the user is now, which decides whether it can reset at all. */
+    readonly status: () => SimCognitoUserStatus;
+    /** Move the user to a status. */
+    readonly moved: (status: SimCognitoUserStatus) => void;
+    /** Give the user a permanent password of its own. */
+    readonly chosen: (password: string) => void;
+    /** Note that the user changed without moving to another status. */
+    readonly changed: () => void;
+}
+/**
+ * The password reset one simulated user can go through.
+ *
+ * A reset is two operations apart: the user asks for one and is sent a code,
+ * then answers with that code and a password of its own. An administrator
+ * starts a third way, by taking the password away and leaving the user in
+ * `RESET_REQUIRED` holding the same kind of code.
+ *
+ * The code is the one `SimCognitoUserConfirmation` holds, because a user has
+ * one thing outstanding at a time and a reset code and a sign-up code are the
+ * same six digits sent the same way. A test reads it back off the pool for the
+ * same reason it reads a sign-up code back: nothing here delivers a message.
+ */
+export declare class SimCognitoUserPasswordReset {
+    private readonly confirmation;
+    private readonly status;
+    private readonly moved;
+    private readonly chosen;
+    private readonly changed;
+    constructor(properties: SimCognitoUserPasswordResetProperties);
+    /**
+     * Start a reset, issuing the code that finishes it.
+     *
+     * The user stays where it is: real Cognito moves nobody on for asking, and
+     * the password it has goes on working until the reset is confirmed. Asking
+     * twice issues a second code and forgets the first, as a resent sign-up code
+     * does.
+     */
+    start(): void;
+    /**
+     * Finish a reset with the code that started it.
+     *
+     * The user reaches `CONFIRMED`, which takes it out of `RESET_REQUIRED` and
+     * confirms one that never confirmed its sign-up, as real Cognito does. The
+     * old password stops working, and so does the code.
+     */
+    confirm(code: string | undefined, password: string): void;
+    /**
+     * Take the user's password away, and issue the code it sets another with.
+     *
+     * This is `AdminResetUserPassword`. The user is refused at sign-in until it
+     * answers `ConfirmForgotPassword`, which is the whole of what
+     * `RESET_REQUIRED` is for.
+     */
+    require(): void;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-password-reset.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-password-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-password-reset.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-password-reset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,UAAU,qCAAqC;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,0BAA0B,CAAC;IAElD,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,oBAAoB,CAAC;IAE5C,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAEvD,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAE5C,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IAErC,YAAY,UAAU,EAAE,qCAAqC,EAM5D;IAED;;;;;;;OAOG;IACH,KAAK,IAAI,IAAI,CAIZ;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAIxD;IAED;;;;;;OAMG;IACH,OAAO,IAAI,IAAI,CAGd;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-password-reset.js

@@ -0,0 +1,65 @@
+import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
+/**
+ * The password reset one simulated user can go through.
+ *
+ * A reset is two operations apart: the user asks for one and is sent a code,
+ * then answers with that code and a password of its own. An administrator
+ * starts a third way, by taking the password away and leaving the user in
+ * `RESET_REQUIRED` holding the same kind of code.
+ *
+ * The code is the one `SimCognitoUserConfirmation` holds, because a user has
+ * one thing outstanding at a time and a reset code and a sign-up code are the
+ * same six digits sent the same way. A test reads it back off the pool for the
+ * same reason it reads a sign-up code back: nothing here delivers a message.
+ */
+export class SimCognitoUserPasswordReset {
+    confirmation;
+    status;
+    moved;
+    chosen;
+    changed;
+    constructor(properties) {
+        this.confirmation = properties.confirmation;
+        this.status = properties.status;
+        this.moved = properties.moved;
+        this.chosen = properties.chosen;
+        this.changed = properties.changed;
+    }
+    /**
+     * Start a reset, issuing the code that finishes it.
+     *
+     * The user stays where it is: real Cognito moves nobody on for asking, and
+     * the password it has goes on working until the reset is confirmed. Asking
+     * twice issues a second code and forgets the first, as a resent sign-up code
+     * does.
+     */
+    start() {
+        this.status().requireSelfResettable();
+        this.confirmation.issue();
+        this.changed();
+    }
+    /**
+     * Finish a reset with the code that started it.
+     *
+     * The user reaches `CONFIRMED`, which takes it out of `RESET_REQUIRED` and
+     * confirms one that never confirmed its sign-up, as real Cognito does. The
+     * old password stops working, and so does the code.
+     */
+    confirm(code, password) {
+        this.status().requireSelfResettable();
+        this.confirmation.require(code);
+        this.chosen(password);
+    }
+    /**
+     * Take the user's password away, and issue the code it sets another with.
+     *
+     * This is `AdminResetUserPassword`. The user is refused at sign-in until it
+     * answers `ConfirmForgotPassword`, which is the whole of what
+     * `RESET_REQUIRED` is for.
+     */
+    require() {
+        this.status().requireResettable();
+        this.moved(SimCognitoUserStatus.resetRequired);
+    }
+}
+//# sourceMappingURL=sim-cognito-user-password-reset.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-password-reset.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-password-reset.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAmBpE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,2BAA2B;IACrB,YAAY,CAA6B;IACzC,MAAM,CAA6B;IACnC,KAAK,CAAyC;IAC9C,MAAM,CAA6B;IACnC,OAAO,CAAa;IAErC,YAAY,UAAiD;QAC3D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAwB,EAAE,QAAgB;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.d.ts

@@ -1,17 +1,19 @@
-export type SimCognitoUserStatusValue = "UNCONFIRMED" | "FORCE_CHANGE_PASSWORD" | "CONFIRMED" | "EXTERNAL_PROVIDER";
+export type SimCognitoUserStatusValue = "UNCONFIRMED" | "FORCE_CHANGE_PASSWORD" | "CONFIRMED" | "RESET_REQUIRED" | "EXTERNAL_PROVIDER";
 /**
  * The status of one simulated user.
  *
- * Only the three statuses this simulation can reach are modelled. A user
- * created by `AdminCreateUser` starts in `FORCE_CHANGE_PASSWORD`, which is what
- * stops it signing in normally on real Cognito, and reaches `CONFIRMED` when an
- * admin sets a permanent password on it. A user that signed itself up with
- * `SignUp` starts in `UNCONFIRMED`, which is what stops that one signing in,
- * and reaches `CONFIRMED` through `ConfirmSignUp` or `AdminConfirmSignUp`. A
- * user the pool created for a federated sign-in is `EXTERNAL_PROVIDER` and
- * stays there, because its password is at the provider rather than in the
- * pool. `RESET_REQUIRED` and the rest belong to password resets, which are not
- * simulated.
+ * Only the statuses this simulation can reach are modelled. A user created by
+ * `AdminCreateUser` starts in `FORCE_CHANGE_PASSWORD`, which is what stops it
+ * signing in normally on real Cognito, and reaches `CONFIRMED` when an admin
+ * sets a permanent password on it. A user that signed itself up with `SignUp`
+ * starts in `UNCONFIRMED`, which is what stops that one signing in, and
+ * reaches `CONFIRMED` through `ConfirmSignUp` or `AdminConfirmSignUp`. A user
+ * an admin sent to `AdminResetUserPassword` is `RESET_REQUIRED` until it sets
+ * a password of its own again. A user the pool created for a federated sign-in
+ * is `EXTERNAL_PROVIDER` and stays there, because its password is at the
+ * provider rather than in the pool. `ARCHIVED`, `COMPROMISED` and `UNKNOWN`
+ * belong to threat protection and to accounts Cognito has retired, neither of
+ * which is simulated.
  */
 export declare class SimCognitoUserStatus {
     /**
@@ -26,6 +28,14 @@ export declare class SimCognitoUserStatus {
      * The status a user with a password of its own reaches.
      */
     static readonly confirmed: SimCognitoUserStatus;
+    /**
+     * The status a user whose password an administrator reset waits in.
+     *
+     * The user cannot sign in from here. It has a code to answer
+     * `ConfirmForgotPassword` with, and setting a password that way is what
+     * takes it back to `CONFIRMED`.
+     */
+    static readonly resetRequired: SimCognitoUserStatus;
     /**
      * The status a user created by a federated sign-in stays in.
      *
@@ -53,6 +63,15 @@ export declare class SimCognitoUserStatus {
      * challenge rather than into tokens.
      */
     get mustChangePassword(): boolean;
+    /**
+     * Whether the user has to set a password of its own before it can sign in.
+     *
+     * This is what turns an authentication into `PasswordResetRequiredException`
+     * rather than into tokens, and it is the whole point of the status: an
+     * administrator has taken the user's password away, and only the user can
+     * choose the next one.
+     */
+    get mustResetPassword(): boolean;
     /**
      * Whether the user has still to confirm the sign-up it made.
      *
@@ -60,6 +79,15 @@ export declare class SimCognitoUserStatus {
      * which real Cognito answers with even when the password was right.
      */
     get isUnconfirmed(): boolean;
+    /**
+     * Whether a user in this status is holding a code it has still to answer
+     * with.
+     *
+     * A user waiting to confirm its sign-up holds the code its pool issued, and
+     * one an administrator has reset holds the code it sets a new password with.
+     * Nothing else has anything outstanding.
+     */
+    get holdsCode(): boolean;
     /**
      * Refuse to confirm a user that is not waiting to be confirmed.
      *
@@ -68,6 +96,22 @@ export declare class SimCognitoUserStatus {
      * `FORCE_CHANGE_PASSWORD` is the new password challenge.
      */
     requireConfirmable(): void;
+    /**
+     * Refuse a `ForgotPassword` or `ConfirmForgotPassword` for a user that
+     * cannot reset its own password.
+     *
+     * A user still on a temporary password is refused here and not by
+     * `AdminResetUserPassword`: it has the `NEW_PASSWORD_REQUIRED` challenge to
+     * answer, so real Cognito sends it to that rather than to a reset code.
+     */
+    requireSelfResettable(): void;
+    /**
+     * Refuse a password reset for a user that has no password in this pool.
+     *
+     * A federated user signs in at its provider, so there is nothing here to
+     * reset and nothing a code could set, whoever asked for the reset.
+     */
+    requireResettable(): void;
     /**
      * Refuse to issue another confirmation code to a user that needs none.
      *

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-status.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,uBAAuB,GACvB,WAAW,GACX,mBAAmB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,gBAAuB,WAAW,uBAA2C;IAE7E;;OAEG;IACH,gBAAuB,mBAAmB,uBAExC;IAEF;;OAEG;IACH,gBAAuB,SAAS,uBAAyC;IAEzE;;;;;;OAMG;IACH,gBAAuB,gBAAgB,uBAErC;IAEF,SAAgB,KAAK,EAAE,yBAAyB,CAAC;IAEjD,OAAO,eAEN;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,oBAAoB,CAMtB;IAED;;;;;OAKG;IACH,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED;;;;;OAKG;IACH,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED;;;;;;OAMG;IACH,kBAAkB,IAAI,IAAI,CAMzB;IAED;;;;;;OAMG;IACH,iBAAiB,IAAI,IAAI,CAOxB;CACF"}
+{"version":3,"file":"sim-cognito-user-status.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,uBAAuB,GACvB,WAAW,GACX,gBAAgB,GAChB,mBAAmB,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,gBAAuB,WAAW,uBAA2C;IAE7E;;OAEG;IACH,gBAAuB,mBAAmB,uBAExC;IAEF;;OAEG;IACH,gBAAuB,SAAS,uBAAyC;IAEzE;;;;;;OAMG;IACH,gBAAuB,aAAa,uBAElC;IAEF;;;;;;OAMG;IACH,gBAAuB,gBAAgB,uBAErC;IAEF,SAAgB,KAAK,EAAE,yBAAyB,CAAC;IAEjD,OAAO,eAEN;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,oBAAoB,CAMtB;IAED;;;;;OAKG;IACH,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED;;;;;;;OAOG;IACH,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED;;;;;OAKG;IACH,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED;;;;;;;OAOG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;OAMG;IACH,kBAAkB,IAAI,IAAI,CAMzB;IAED;;;;;;;OAOG;IACH,qBAAqB,IAAI,IAAI,CAQ5B;IAED;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI,CAMxB;IAED;;;;;;OAMG;IACH,iBAAiB,IAAI,IAAI,CAOxB;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.js

@@ -2,16 +2,18 @@ import { SimCognitoInvalidParameterException, SimCognitoNotAuthorizedException,
 /**
  * The status of one simulated user.
  *
- * Only the three statuses this simulation can reach are modelled. A user
- * created by `AdminCreateUser` starts in `FORCE_CHANGE_PASSWORD`, which is what
- * stops it signing in normally on real Cognito, and reaches `CONFIRMED` when an
- * admin sets a permanent password on it. A user that signed itself up with
- * `SignUp` starts in `UNCONFIRMED`, which is what stops that one signing in,
- * and reaches `CONFIRMED` through `ConfirmSignUp` or `AdminConfirmSignUp`. A
- * user the pool created for a federated sign-in is `EXTERNAL_PROVIDER` and
- * stays there, because its password is at the provider rather than in the
- * pool. `RESET_REQUIRED` and the rest belong to password resets, which are not
- * simulated.
+ * Only the statuses this simulation can reach are modelled. A user created by
+ * `AdminCreateUser` starts in `FORCE_CHANGE_PASSWORD`, which is what stops it
+ * signing in normally on real Cognito, and reaches `CONFIRMED` when an admin
+ * sets a permanent password on it. A user that signed itself up with `SignUp`
+ * starts in `UNCONFIRMED`, which is what stops that one signing in, and
+ * reaches `CONFIRMED` through `ConfirmSignUp` or `AdminConfirmSignUp`. A user
+ * an admin sent to `AdminResetUserPassword` is `RESET_REQUIRED` until it sets
+ * a password of its own again. A user the pool created for a federated sign-in
+ * is `EXTERNAL_PROVIDER` and stays there, because its password is at the
+ * provider rather than in the pool. `ARCHIVED`, `COMPROMISED` and `UNKNOWN`
+ * belong to threat protection and to accounts Cognito has retired, neither of
+ * which is simulated.
  */
 export class SimCognitoUserStatus {
     /**
@@ -26,6 +28,14 @@ export class SimCognitoUserStatus {
      * The status a user with a password of its own reaches.
      */
     static confirmed = new SimCognitoUserStatus("CONFIRMED");
+    /**
+     * The status a user whose password an administrator reset waits in.
+     *
+     * The user cannot sign in from here. It has a code to answer
+     * `ConfirmForgotPassword` with, and setting a password that way is what
+     * takes it back to `CONFIRMED`.
+     */
+    static resetRequired = new SimCognitoUserStatus("RESET_REQUIRED");
     /**
      * The status a user created by a federated sign-in stays in.
      *
@@ -62,6 +72,17 @@ export class SimCognitoUserStatus {
     get mustChangePassword() {
         return this.value === "FORCE_CHANGE_PASSWORD";
     }
+    /**
+     * Whether the user has to set a password of its own before it can sign in.
+     *
+     * This is what turns an authentication into `PasswordResetRequiredException`
+     * rather than into tokens, and it is the whole point of the status: an
+     * administrator has taken the user's password away, and only the user can
+     * choose the next one.
+     */
+    get mustResetPassword() {
+        return this.value === "RESET_REQUIRED";
+    }
     /**
      * Whether the user has still to confirm the sign-up it made.
      *
@@ -71,6 +92,17 @@ export class SimCognitoUserStatus {
     get isUnconfirmed() {
         return this.value === "UNCONFIRMED";
     }
+    /**
+     * Whether a user in this status is holding a code it has still to answer
+     * with.
+     *
+     * A user waiting to confirm its sign-up holds the code its pool issued, and
+     * one an administrator has reset holds the code it sets a new password with.
+     * Nothing else has anything outstanding.
+     */
+    get holdsCode() {
+        return this.isUnconfirmed || this.mustResetPassword;
+    }
     /**
      * Refuse to confirm a user that is not waiting to be confirmed.
      *
@@ -83,6 +115,31 @@ export class SimCognitoUserStatus {
             throw new SimCognitoNotAuthorizedException(`User cannot be confirmed. Current status is ${this.value}`);
         }
     }
+    /**
+     * Refuse a `ForgotPassword` or `ConfirmForgotPassword` for a user that
+     * cannot reset its own password.
+     *
+     * A user still on a temporary password is refused here and not by
+     * `AdminResetUserPassword`: it has the `NEW_PASSWORD_REQUIRED` challenge to
+     * answer, so real Cognito sends it to that rather than to a reset code.
+     */
+    requireSelfResettable() {
+        this.requireResettable();
+        if (this.mustChangePassword) {
+            throw new SimCognitoNotAuthorizedException("User password cannot be reset in the current state.");
+        }
+    }
+    /**
+     * Refuse a password reset for a user that has no password in this pool.
+     *
+     * A federated user signs in at its provider, so there is nothing here to
+     * reset and nothing a code could set, whoever asked for the reset.
+     */
+    requireResettable() {
+        if (this.value === "EXTERNAL_PROVIDER") {
+            throw new SimCognitoNotAuthorizedException("User password cannot be reset in the current state.");
+        }
+    }
     /**
      * Refuse to issue another confirmation code to a user that needs none.
      *

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-status.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,gCAAgC,GACjC,MAAM,kCAAkC,CAAC;AAQ1C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACI,MAAM,CAAU,WAAW,GAAG,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAE7E;;OAEG;IACI,MAAM,CAAU,mBAAmB,GAAG,IAAI,oBAAoB,CACnE,uBAAuB,CACxB,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,SAAS,GAAG,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEzE;;;;;;OAMG;IACI,MAAM,CAAU,gBAAgB,GAAG,IAAI,oBAAoB,CAChE,mBAAmB,CACpB,CAAC;IAEc,KAAK,CAA4B;IAEjD,YAAoB,KAAgC;QAClD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAA8B;QAE9B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,KAAK,aAAa,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB;QAChB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,gCAAgC,CACxC,+CAA+C,IAAI,CAAC,KAAK,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,IAAI,CAAC,KAAK,aAAa;gBACjE,gCAAgC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-status.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,gCAAgC,GACjC,MAAM,kCAAkC,CAAC;AAS1C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACI,MAAM,CAAU,WAAW,GAAG,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAE7E;;OAEG;IACI,MAAM,CAAU,mBAAmB,GAAG,IAAI,oBAAoB,CACnE,uBAAuB,CACxB,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,SAAS,GAAG,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEzE;;;;;;OAMG;IACI,MAAM,CAAU,aAAa,GAAG,IAAI,oBAAoB,CAC7D,gBAAgB,CACjB,CAAC;IAEF;;;;;;OAMG;IACI,MAAM,CAAU,gBAAgB,GAAG,IAAI,oBAAoB,CAChE,mBAAmB,CACpB,CAAC;IAEc,KAAK,CAA4B;IAEjD,YAAoB,KAAgC;QAClD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAA8B;QAE9B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,KAAK,KAAK,gBAAgB,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,KAAK,aAAa,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,iBAAiB,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB;QAChB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,gCAAgC,CACxC,+CAA+C,IAAI,CAAC,KAAK,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,qBAAqB;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CACxC,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,iBAAiB;QACf,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,IAAI,gCAAgC,CACxC,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,IAAI,CAAC,KAAK,aAAa;gBACjE,gCAAgC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts

@@ -1,6 +1,7 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoFederatedIdentity } from "../idp/sim-cognito-federated-identity.js";
 import { SimCognitoUserMfa } from "./mfa/sim-cognito-user-mfa.js";
+import { SimCognitoUserPasswordReset } from "./sim-cognito-user-password-reset.js";
 import type { SimCognitoAttributeType, SimCognitoUserAttributes } from "./sim-cognito-user-attributes.js";
 import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
 import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
@@ -43,6 +44,7 @@ export declare class SimCognitoUser {
     private readonly userAttributes;
     private readonly confirmation;
     private readonly userMfa;
+    private readonly reset;
     private readonly federatedIdentity;
     private userStatus;
     private userPassword;
@@ -89,12 +91,13 @@ export declare class SimCognitoUser {
      */
     get attributeValues(): ReadonlyMap<string, string>;
     /**
-     * The confirmation code this user has outstanding, if it has one.
+     * The code this user has outstanding, if it has one.
      *
      * Real Cognito sends the code to the user and never reports it back. Nothing
      * here delivers a message, so a test reads the code from the pool instead,
-     * which is the divergence that makes a sign-up flow testable at all. A
-     * confirmed user has none: a code is single use, and confirming spends it.
+     * which is the divergence that makes a sign-up flow testable at all. A user
+     * with nothing outstanding has none: a code settles one sign-up or one
+     * password reset, and settling it spends it.
      */
     get confirmationCode(): string | undefined;
     /**
@@ -103,6 +106,11 @@ export declare class SimCognitoUser {
      * `UserLastModifiedDate` on, as every other change to a user does.
      */
     get mfa(): SimCognitoUserMfa;
+    /**
+     * The password reset this user can go through, which is what a forgotten
+     * password is replaced by and what an administrator can force.
+     */
+    get passwordReset(): SimCognitoUserPasswordReset;
     /**
      * Set the password an admin gave this user.
      *
@@ -160,18 +168,13 @@ export declare class SimCognitoUser {
      */
     disable(): void;
     /**
-     * Move the user to a status, and let its confirmation follow.
+     * Move the user to a status, and let the code it holds follow.
      *
-     * A code confirms one sign-up and no more, so it goes as soon as the user
-     * leaves `UNCONFIRMED`, whether it was `ConfirmSignUp` or an admin setting a
-     * permanent password that took it there.
+     * A code settles one thing and no more, so it goes as soon as the user
+     * leaves the status that issued it, and a user an administrator has sent to
+     * `RESET_REQUIRED` is issued the one it resets with on the way in.
      */
     private moveTo;
-    /**
-     * The `identities` attribute a federated user reports, which a local user
-     * does not have at all.
-     */
-    private identityAttribute;
     private touch;
 }
 export {};

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAEvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0C;IAC5E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,wBAAwB,EAkB/C;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,SAAS,uBAAuB,EAAE,CAMnD;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,2BAA2B,GAAG,SAAS,CAEtD;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjD;IAED;;;;;;;OAOG;IACH,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED;;;;OAIG;IACH,IAAI,GAAG,IAAI,iBAAiB,CAE3B;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAGlE;IAED;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI,CAI7B;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAI5C;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAG/C;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElD;IAED;;OAEG;IACH,gBAAgB,CACd,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACxD,IAAI,CAGN;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAGb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAMd;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,KAAK;CAGd"}
+{"version":3,"file":"sim-cognito-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAEvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0C;IAC5E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,wBAAwB,EA+B/C;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,SAAS,uBAAuB,EAAE,CAMnD;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,2BAA2B,GAAG,SAAS,CAEtD;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjD;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED;;;;OAIG;IACH,IAAI,GAAG,IAAI,iBAAiB,CAE3B;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,2BAA2B,CAE/C;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAGlE;IAED;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI,CAI7B;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAI5C;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAG/C;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElD;IAED;;OAEG;IACH,gBAAgB,CACd,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACxD,IAAI,CAGN;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAGb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,KAAK;CAGd"}

package/dist/service/cognito/user-pool/user/sim-cognito-user.js

@@ -1,5 +1,6 @@
 import { SimCognitoUserMfa } from "./mfa/sim-cognito-user-mfa.js";
 import { SimCognitoUserConfirmation } from "./sim-cognito-user-confirmation.js";
+import { SimCognitoUserPasswordReset } from "./sim-cognito-user-password-reset.js";
 import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
 import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
 /**
@@ -22,6 +23,7 @@ export class SimCognitoUser {
     userAttributes;
     confirmation;
     userMfa;
+    reset;
     federatedIdentity;
     userStatus;
     userPassword;
@@ -45,6 +47,19 @@ export class SimCognitoUser {
                 this.touch();
             },
         });
+        this.reset = new SimCognitoUserPasswordReset({
+            confirmation: this.confirmation,
+            status: () => this.userStatus,
+            moved: (status) => {
+                this.moveTo(status);
+            },
+            chosen: (password) => {
+                this.setPassword(password, true);
+            },
+            changed: () => {
+                this.touch();
+            },
+        });
     }
     /**
      * When the user last changed.
@@ -78,7 +93,7 @@ export class SimCognitoUser {
     get attributes() {
         return [
             { Name: "sub", Value: this.sub },
-            ...this.identityAttribute(),
+            ...(this.federatedIdentity?.attributes() ?? []),
             ...this.userAttributes.entries,
         ];
     }
@@ -102,12 +117,13 @@ export class SimCognitoUser {
         return this.userAttributes.values;
     }
     /**
-     * The confirmation code this user has outstanding, if it has one.
+     * The code this user has outstanding, if it has one.
      *
      * Real Cognito sends the code to the user and never reports it back. Nothing
      * here delivers a message, so a test reads the code from the pool instead,
-     * which is the divergence that makes a sign-up flow testable at all. A
-     * confirmed user has none: a code is single use, and confirming spends it.
+     * which is the divergence that makes a sign-up flow testable at all. A user
+     * with nothing outstanding has none: a code settles one sign-up or one
+     * password reset, and settling it spends it.
      */
     get confirmationCode() {
         return this.confirmation.code;
@@ -120,6 +136,13 @@ export class SimCognitoUser {
     get mfa() {
         return this.userMfa;
     }
+    /**
+     * The password reset this user can go through, which is what a forgotten
+     * password is replaced by and what an administrator can force.
+     */
+    get passwordReset() {
+        return this.reset;
+    }
     /**
      * Set the password an admin gave this user.
      *
@@ -205,29 +228,17 @@ export class SimCognitoUser {
         this.touch();
     }
     /**
-     * Move the user to a status, and let its confirmation follow.
+     * Move the user to a status, and let the code it holds follow.
      *
-     * A code confirms one sign-up and no more, so it goes as soon as the user
-     * leaves `UNCONFIRMED`, whether it was `ConfirmSignUp` or an admin setting a
-     * permanent password that took it there.
+     * A code settles one thing and no more, so it goes as soon as the user
+     * leaves the status that issued it, and a user an administrator has sent to
+     * `RESET_REQUIRED` is issued the one it resets with on the way in.
      */
     moveTo(status) {
         this.userStatus = status;
         this.confirmation.settle(status);
         this.touch();
     }
-    /**
-     * The `identities` attribute a federated user reports, which a local user
-     * does not have at all.
-     */
-    identityAttribute() {
-        if (this.federatedIdentity === undefined) {
-            return [];
-        }
-        return [
-            { Name: "identities", Value: this.federatedIdentity.toAttributeValue() },
-        ];
-    }
     touch() {
         this.modifiedDate = this.clock.now();
     }

package/dist/service/cognito/user-pool/user/sim-cognito-user.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAKhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAwBpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACT,QAAQ,CAAqB;IAC7B,GAAG,CAAS;IACZ,YAAY,CAAO;IAElB,KAAK,CAAW;IAChB,cAAc,CAA2B;IACzC,YAAY,CAA6B;IACzC,OAAO,CAAoB;IAC3B,iBAAiB,CAA0C;IACpE,UAAU,CAAuB;IACjC,YAAY,CAAqC;IACjD,SAAS,GAAG,IAAI,CAAC;IACjB,YAAY,CAAO;IAE3B,YAAY,UAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,UAAU;YACb,UAAU,CAAC,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;YACtC,OAAO,EAAE,GAAS,EAAE;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YAChC,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB,EAAE,SAA8B;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB;QACpB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAwB;QACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAwB;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAA6B;QACvC,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,SAAyD;QAEzD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,MAA4B;QACzC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,iBAAiB;QACvB,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE;SACzE,CAAC;IACJ,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAwBpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACT,QAAQ,CAAqB;IAC7B,GAAG,CAAS;IACZ,YAAY,CAAO;IAElB,KAAK,CAAW;IAChB,cAAc,CAA2B;IACzC,YAAY,CAA6B;IACzC,OAAO,CAAoB;IAC3B,KAAK,CAA8B;IACnC,iBAAiB,CAA0C;IACpE,UAAU,CAAuB;IACjC,YAAY,CAAqC;IACjD,SAAS,GAAG,IAAI,CAAC;IACjB,YAAY,CAAO;IAE3B,YAAY,UAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,UAAU;YACb,UAAU,CAAC,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;YACtC,OAAO,EAAE,GAAS,EAAE;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,2BAA2B,CAAC;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,GAAyB,EAAE,CAAC,IAAI,CAAC,UAAU;YACnD,KAAK,EAAE,CAAC,MAAM,EAAQ,EAAE;gBACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,EAAE,CAAC,QAAQ,EAAQ,EAAE;gBACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,EAAE,GAAS,EAAE;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC/C,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB,EAAE,SAA8B;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB;QACpB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAwB;QACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAwB;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAA6B;QACvC,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,SAAyD;QAEzD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,MAA4B;QACzC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}