@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/cognito/command/user-pool/sim-cognito-user-pool-commands.d.ts

@@ -1,12 +1,14 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoUserPoolFactory } from "../../user-pool/sim-cognito-user-pool-factory.js";
 import type { SimCognitoUserPoolStore } from "../../user-pool/sim-cognito-user-pool-store.js";
+import type { SimWafProtection } from "../../../wafv2/association/sim-waf-protection.js";
 import type { SimCognitoAuthorizer } from "../authorize/sim-cognito-authorizer.js";
 import type { SimCreateUserPoolCommand, SimCreateUserPoolCommandOutput, SimDeleteUserPoolCommand, SimDeleteUserPoolCommandOutput, SimDescribeUserPoolCommand, SimDescribeUserPoolCommandOutput, SimUpdateUserPoolCommand, SimUpdateUserPoolCommandOutput } from "./user-pool.command.js";
 interface SimCognitoUserPoolCommandsProperties {
     readonly pools: SimCognitoUserPoolStore;
     readonly poolFactory: SimCognitoUserPoolFactory;
     readonly authorizer: SimCognitoAuthorizer;
+    readonly webAcls: SimWafProtection;
 }
 interface SimCognitoCommandOptions {
     readonly caller?: SimAwsCaller;
@@ -19,6 +21,7 @@ export declare class SimCognitoUserPoolCommands {
     private readonly pools;
     private readonly poolFactory;
     private readonly authorizer;
+    private readonly webAcls;
     private readonly view;
     private readonly unsimulatedOptions;
     private readonly unsimulatedIdentity;
@@ -49,6 +52,10 @@ export declare class SimCognitoUserPoolCommands {
     describe(command: SimDescribeUserPoolCommand, options?: SimCognitoCommandOptions): SimDescribeUserPoolCommandOutput;
     /**
      * Delete a user pool, and with it every app client in it.
+     *
+     * A web ACL in front of the pool is let go of, as it is on AWS: the
+     * association names a pool that no longer exists, and nothing is left
+     * holding it.
      */
     delete(command: SimDeleteUserPoolCommand, options?: SimCognitoCommandOptions): SimDeleteUserPoolCommandOutput;
 }

package/dist/service/cognito/command/user-pool/sim-cognito-user-pool-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/user-pool/sim-cognito-user-pool-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAGlG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAKnF,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,0BAA0B,EAC1B,gCAAgC,EAChC,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAEhC,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;CAC3C;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;GAGG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAC0B;IAC7D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CACU;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CACU;IAE7C,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;;;;OAKG;IACH,MAAM,CACJ,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,wBAAwB,GACjC,8BAA8B,CAehC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CACJ,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,wBAAwB,GACjC,8BAA8B,CA+BhC;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,gCAAgC,CAalC;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,wBAAwB,GACjC,8BAA8B,CAsBhC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/user-pool/sim-cognito-user-pool-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAGlG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAKnF,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,0BAA0B,EAC1B,gCAAgC,EAChC,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAEhC,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;GAGG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAC0B;IAC7D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CACU;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CACU;IAE7C,YAAY,UAAU,EAAE,oCAAoC,EAK3D;IAED;;;;;OAKG;IACH,MAAM,CACJ,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,wBAAwB,GACjC,8BAA8B,CAehC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CACJ,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,wBAAwB,GACjC,8BAA8B,CA+BhC;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,wBAAwB,GACjC,gCAAgC,CAalC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,wBAAwB,GACjC,8BAA8B,CAuBhC;CACF"}

package/dist/service/cognito/command/user-pool/sim-cognito-user-pool-commands.js

@@ -13,6 +13,7 @@ export class SimCognitoUserPoolCommands {
     pools;
     poolFactory;
     authorizer;
+    webAcls;
     view = new SimCognitoUserPoolView();
     unsimulatedOptions = new SimCognitoUnsimulatedUserPoolOptions("CreateUserPool");
     unsimulatedIdentity = new SimCognitoUnsimulatedUserPoolIdentity();
@@ -21,6 +22,7 @@ export class SimCognitoUserPoolCommands {
         this.pools = properties.pools;
         this.poolFactory = properties.poolFactory;
         this.authorizer = properties.authorizer;
+        this.webAcls = properties.webAcls;
     }
     /**
      * Create a user pool.
@@ -87,6 +89,10 @@ export class SimCognitoUserPoolCommands {
     }
     /**
      * Delete a user pool, and with it every app client in it.
+     *
+     * A web ACL in front of the pool is let go of, as it is on AWS: the
+     * association names a pool that no longer exists, and nothing is left
+     * holding it.
      */
     delete(command, options) {
         const userPoolId = requireSimCognitoUserPoolId(command.input.UserPoolId);
@@ -98,6 +104,7 @@ export class SimCognitoUserPoolCommands {
                 `first, as real Cognito wants.`);
         }
         this.pools.remove(pool);
+        this.webAcls.release(pool.arn.value);
         return { $metadata: {} };
     }
 }

package/dist/service/cognito/command/user-pool/sim-cognito-user-pool-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/user-pool/sim-cognito-user-pool-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAG/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAsBzE;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IACpB,KAAK,CAA0B;IAC/B,WAAW,CAA4B;IACvC,UAAU,CAAuB;IACjC,IAAI,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACpC,kBAAkB,GACjC,IAAI,oCAAoC,CAAC,gBAAgB,CAAC,CAAC;IAC5C,mBAAmB,GAClC,IAAI,qCAAqC,EAAE,CAAC;IAC7B,kBAAkB,GACjC,IAAI,oCAAoC,EAAE,CAAC;IAE7C,YAAY,UAAgD;QAC1D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,OAAiC,EACjC,OAAkC;QAElC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,QAAQ;YACpB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CACJ,OAAiC,EACjC,OAAkC;QAElC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEjE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAC/B,4BAA4B,EAC5B,UAAU,EACV,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,0BAA0B,CAAC;YAC9C,KAAK;YACL,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC;QAEH,wEAAwE;QACxE,wDAAwD;QACxD,yEAAyE;QACzE,WAAW;QACX,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE9C,wEAAwE;QACxE,wEAAwE;QACxE,kEAAkE;QAClE,qDAAqD;QACrD,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,OAAmC,EACnC,OAAkC;QAElC,MAAM,UAAU,GAAG,2BAA2B,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAC/B,8BAA8B,EAC9B,UAAU,EACV,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAAiC,EACjC,OAAkC;QAElC,MAAM,UAAU,GAAG,2BAA2B,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAC/B,4BAA4B,EAC5B,UAAU,EACV,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,0CAA0C;gBAC/D,+DAA+D;gBAC/D,+BAA+B,CAClC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAExB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/user-pool/sim-cognito-user-pool-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAI/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAuBzE;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IACpB,KAAK,CAA0B;IAC/B,WAAW,CAA4B;IACvC,UAAU,CAAuB;IACjC,OAAO,CAAmB;IAC1B,IAAI,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACpC,kBAAkB,GACjC,IAAI,oCAAoC,CAAC,gBAAgB,CAAC,CAAC;IAC5C,mBAAmB,GAClC,IAAI,qCAAqC,EAAE,CAAC;IAC7B,kBAAkB,GACjC,IAAI,oCAAoC,EAAE,CAAC;IAE7C,YAAY,UAAgD;QAC1D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,OAAiC,EACjC,OAAkC;QAElC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,QAAQ;YACpB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CACJ,OAAiC,EACjC,OAAkC;QAElC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEjE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAC/B,4BAA4B,EAC5B,UAAU,EACV,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,0BAA0B,CAAC;YAC9C,KAAK;YACL,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC;QAEH,wEAAwE;QACxE,wDAAwD;QACxD,yEAAyE;QACzE,WAAW;QACX,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE9C,wEAAwE;QACxE,wEAAwE;QACxE,kEAAkE;QAClE,qDAAqD;QACrD,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,OAAmC,EACnC,OAAkC;QAElC,MAAM,UAAU,GAAG,2BAA2B,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAC/B,8BAA8B,EAC9B,UAAU,EACV,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAiC,EACjC,OAAkC;QAElC,MAAM,UAAU,GAAG,2BAA2B,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAC/B,4BAA4B,EAC5B,UAAU,EACV,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,0CAA0C;gBAC/D,+DAA+D;gBAC/D,+BAA+B,CAClC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAErC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-page-markup.d.ts

@@ -9,10 +9,10 @@ export type SimCognitoPageParameters = Readonly<Record<string, string>>;
 /**
  * The HTML the simulated managed login pages are built from.
  *
- * There is no styling and there is no script. The pages exist so that a
- * browser in a local development server can complete a sign-up and a sign-in,
- * and so that a test can post the same forms. Matching what real managed login
- * looks like would be work no test could tell apart from this.
+ * The pages exist so that a browser in a local development server can complete
+ * a sign-up and a sign-in, and so that a test can post the same forms. Every
+ * page carries `simCognitoPageStyle`, which approximates what real managed
+ * login looks like. There is no script on any of them.
  *
  * Every value that reaches the page goes through `escaped`. A `state` is
  * whatever the application put in it, and it is written back into a hidden

package/dist/service/cognito/serve/page/sim-cognito-page-markup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-page-markup.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-markup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAUxE;;;;;;;;;;;;GAYG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAc1C;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,QAAQ,CAOrE;IAED;;OAEG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,SAAS,GAAG,MAAM,CAQxD;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,EAAE,wBAAwB,GAAG,MAAM,CAQnD;IAED;;OAEG;IACH,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,wBAAwB,EACpC,IAAI,EAAE,MAAM,GACX,MAAM,CAIR;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5B;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,UAAQ,GAAG,MAAM,CAMlE;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7B;CACF"}
+{"version":3,"file":"sim-cognito-page-markup.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-markup.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAUxE;;;;;;;;;;;;GAYG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAgB1C;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,QAAQ,CAOrE;IAED;;OAEG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,SAAS,GAAG,MAAM,CAQxD;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,EAAE,wBAAwB,GAAG,MAAM,CAQnD;IAED;;OAEG;IACH,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,wBAAwB,EACpC,IAAI,EAAE,MAAM,GACX,MAAM,CAIR;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5B;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,UAAQ,GAAG,MAAM,CAMlE;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7B;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-page-markup.js

@@ -1,3 +1,4 @@
+import { simCognitoPageStyle } from "./sim-cognito-page-style.js";
 const escapes = new Map([
     ["&", "&"],
     ["<", "&lt;"],
@@ -8,10 +9,10 @@ const escapes = new Map([
 /**
  * The HTML the simulated managed login pages are built from.
  *
- * There is no styling and there is no script. The pages exist so that a
- * browser in a local development server can complete a sign-up and a sign-in,
- * and so that a test can post the same forms. Matching what real managed login
- * looks like would be work no test could tell apart from this.
+ * The pages exist so that a browser in a local development server can complete
+ * a sign-up and a sign-in, and so that a test can post the same forms. Every
+ * page carries `simCognitoPageStyle`, which approximates what real managed
+ * login looks like. There is no script on any of them.
  *
  * Every value that reaches the page goes through `escaped`. A `state` is
  * whatever the application put in it, and it is written back into a hidden
@@ -24,9 +25,11 @@ export class SimCognitoPageMarkup {
      */
     page(title, body) {
         const html = `<!doctype html>\n<html lang="en">\n<head>\n` +
-            `<meta charset="utf-8">\n<title>${this.escaped(title)}</title>\n` +
-            `</head>\n<body>\n<h1>${this.escaped(title)}</h1>\n${body}\n` +
-            `</body>\n</html>\n`;
+            `<meta charset="utf-8">\n` +
+            `<meta name="viewport" content="width=device-width, initial-scale=1">\n` +
+            `<title>${this.escaped(title)}</title>\n${simCognitoPageStyle}\n` +
+            `</head>\n<body>\n<main>\n<h1>${this.escaped(title)}</h1>\n${body}\n` +
+            `</main>\n</body>\n</html>\n`;
         return new Response(html, {
             status: 200,
             headers: {

package/dist/service/cognito/serve/page/sim-cognito-page-markup.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-page-markup.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-markup.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,QAAQ,CAAC;IACf,CAAC,GAAG,EAAE,OAAO,CAAC;CACf,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACH,IAAI,CAAC,KAAa,EAAE,IAAY;QAC9B,MAAM,IAAI,GACR,6CAA6C;YAC7C,kCAAkC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY;YACjE,wBAAwB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI;YAC7D,oBAAoB,CAAC;QAEvB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,eAAe,EAAE,UAAU;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAY,EAAE,UAAoC;QACzD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzD,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,MAAc,EAAE,IAAY;QAC/B,OAAO,+BAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAY,EAAE,KAAa,EAAE,IAAI,GAAG,MAAM;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvC,OAAO,CACL,kBAAkB,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY;YACjE,cAAc,WAAW,WAAW,WAAW,IAAI;YACnD,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAoC;QACzC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aAC9B,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,8BAA8B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;YACpD,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CACtC;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;OAEG;IACH,IAAI,CACF,IAAY,EACZ,UAAoC,EACpC,IAAY;QAEZ,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzD,OAAO,eAAe,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5F,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,OAAO,sBAAsB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,cAAc,GAAG,KAAK;QACxD,OAAO,CACL,kCAAkC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;YACxD,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG;YAC1E,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAAa;QACnB,OAAO,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE;YACjD,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-page-markup.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-markup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAWlE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,QAAQ,CAAC;IACf,CAAC,GAAG,EAAE,OAAO,CAAC;CACf,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACH,IAAI,CAAC,KAAa,EAAE,IAAY;QAC9B,MAAM,IAAI,GACR,6CAA6C;YAC7C,0BAA0B;YAC1B,wEAAwE;YACxE,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,mBAAmB,IAAI;YACjE,gCAAgC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI;YACrE,6BAA6B,CAAC;QAEhC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,eAAe,EAAE,UAAU;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAY,EAAE,UAAoC;QACzD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzD,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,MAAc,EAAE,IAAY;QAC/B,OAAO,+BAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAY,EAAE,KAAa,EAAE,IAAI,GAAG,MAAM;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvC,OAAO,CACL,kBAAkB,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY;YACjE,cAAc,WAAW,WAAW,WAAW,IAAI;YACnD,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAoC;QACzC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aAC9B,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,8BAA8B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;YACpD,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CACtC;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;OAEG;IACH,IAAI,CACF,IAAY,EACZ,UAAoC,EACpC,IAAY;QAEZ,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzD,OAAO,eAAe,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5F,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,OAAO,sBAAsB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,cAAc,GAAG,KAAK;QACxD,OAAO,CACL,kCAAkC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;YACxD,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG;YAC1E,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAAa;QACnB,OAAO,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE;YACjD,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-page-style.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Styling for the managed login pages.
+ *
+ * Held inline in each page. There is no asset route to serve and no second
+ * request from the browser.
+ *
+ * The values approximate real managed login, measured from a live sign-in
+ * page. A card centred on the page, a bold heading, labels above full-width
+ * fields, and a full-width primary button. A close match is no aim of this.
+ * Real managed login is built on Cloudscape and carries components these
+ * pages have no equivalent for.
+ *
+ * The second submit button on a page is the one carrying `formnovalidate`,
+ * and it is styled as the secondary of the two.
+ */
+export declare const simCognitoPageStyle = "<style>\nbody {\n  margin: 0;\n  min-height: 100vh;\n  padding: 24px;\n  box-sizing: border-box;\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  background: #f9f9fa;\n  color: #000716;\n  font: 400 14px/20px \"Helvetica Neue\", Roboto, Arial, sans-serif;\n}\nmain {\n  box-sizing: border-box;\n  width: 402px;\n  max-width: 100%;\n  padding: 24px;\n  background: #fff;\n  border: 1px solid #c6c6cd;\n  border-radius: 8px;\n}\nh1 { margin: 0 0 16px; font-size: 24px; line-height: 30px; }\np { margin: 0 0 16px; }\np:last-child { margin-bottom: 0; }\nlabel { display: block; margin-bottom: 4px; font-weight: 700; }\ninput:not([type=\"hidden\"]) {\n  box-sizing: border-box;\n  width: 100%;\n  padding: 5px 12px;\n  border: 1px solid #7d8998;\n  border-radius: 8px;\n  font: inherit;\n  color: #414d5c;\n}\nbutton {\n  box-sizing: border-box;\n  width: 100%;\n  padding: 4px 20px;\n  border: 2px solid #0972d3;\n  border-radius: 8px;\n  background: #0972d3;\n  color: #fff;\n  font: inherit;\n  font-weight: 700;\n  cursor: pointer;\n}\nbutton[formnovalidate] { background: #fff; color: #0972d3; }\na { color: #0972d3; text-decoration: none; }\na:hover { text-decoration: underline; }\n.message {\n  padding: 8px 12px;\n  border: 1px solid #7d8998;\n  border-radius: 8px;\n  background: #f9f9fa;\n}\n</style>";
+//# sourceMappingURL=sim-cognito-page-style.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-page-style.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-style.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,uzCAwDvB,CAAC"}

package/dist/service/cognito/serve/page/sim-cognito-page-style.js

@@ -0,0 +1,73 @@
+/**
+ * Styling for the managed login pages.
+ *
+ * Held inline in each page. There is no asset route to serve and no second
+ * request from the browser.
+ *
+ * The values approximate real managed login, measured from a live sign-in
+ * page. A card centred on the page, a bold heading, labels above full-width
+ * fields, and a full-width primary button. A close match is no aim of this.
+ * Real managed login is built on Cloudscape and carries components these
+ * pages have no equivalent for.
+ *
+ * The second submit button on a page is the one carrying `formnovalidate`,
+ * and it is styled as the secondary of the two.
+ */
+export const simCognitoPageStyle = `<style>
+body {
+  margin: 0;
+  min-height: 100vh;
+  padding: 24px;
+  box-sizing: border-box;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: #f9f9fa;
+  color: #000716;
+  font: 400 14px/20px "Helvetica Neue", Roboto, Arial, sans-serif;
+}
+main {
+  box-sizing: border-box;
+  width: 402px;
+  max-width: 100%;
+  padding: 24px;
+  background: #fff;
+  border: 1px solid #c6c6cd;
+  border-radius: 8px;
+}
+h1 { margin: 0 0 16px; font-size: 24px; line-height: 30px; }
+p { margin: 0 0 16px; }
+p:last-child { margin-bottom: 0; }
+label { display: block; margin-bottom: 4px; font-weight: 700; }
+input:not([type="hidden"]) {
+  box-sizing: border-box;
+  width: 100%;
+  padding: 5px 12px;
+  border: 1px solid #7d8998;
+  border-radius: 8px;
+  font: inherit;
+  color: #414d5c;
+}
+button {
+  box-sizing: border-box;
+  width: 100%;
+  padding: 4px 20px;
+  border: 2px solid #0972d3;
+  border-radius: 8px;
+  background: #0972d3;
+  color: #fff;
+  font: inherit;
+  font-weight: 700;
+  cursor: pointer;
+}
+button[formnovalidate] { background: #fff; color: #0972d3; }
+a { color: #0972d3; text-decoration: none; }
+a:hover { text-decoration: underline; }
+.message {
+  padding: 8px 12px;
+  border: 1px solid #7d8998;
+  border-radius: 8px;
+  background: #f9f9fa;
+}
+</style>`;
+//# sourceMappingURL=sim-cognito-page-style.js.map

package/dist/service/cognito/serve/page/sim-cognito-page-style.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-style.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAwD1B,CAAC"}

package/dist/service/cognito/serve/sim-cognito-authorize-route.d.ts

@@ -0,0 +1,27 @@
+import type { SimCognitoDomainRequest } from "./sim-cognito-domain-request.js";
+/**
+ * What a served `/oauth2/authorize` request is answered with.
+ *
+ * Three requests reach this one path. An application sends the browser here to
+ * start a sign-in, the sign-in form posts back here to finish one, and a
+ * browser holding a managed login session arrives here and is signed in
+ * without being asked anything. They are one endpoint because real Cognito
+ * serves them as one, and the parameters are read the same way whichever
+ * arrived.
+ */
+export declare class SimCognitoAuthorizeRoute {
+    private readonly response;
+    private readonly pageRequest;
+    private readonly pages;
+    private readonly sessionCookie;
+    /**
+     * Sign a user in and send the browser back to the application with a code,
+     * or serve the form that asks who is signing in.
+     */
+    handle(request: SimCognitoDomainRequest): Promise<Response>;
+    /**
+     * Answer a refused sign-in, on the form or at the application.
+     */
+    private refused;
+}
+//# sourceMappingURL=sim-cognito-authorize-route.d.ts.map

package/dist/service/cognito/serve/sim-cognito-authorize-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorize-route.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-authorize-route.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI/E;;;;;;;;;GASG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAE/D;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiBhE;IAED;;OAEG;IACH,OAAO,CAAC,OAAO;CAchB"}

package/dist/service/cognito/serve/sim-cognito-authorize-route.js

@@ -0,0 +1,41 @@
+import { SimCognitoManagedLogin } from "./page/sim-cognito-managed-login.js";
+import { SimCognitoPageRequest } from "./page/sim-cognito-page-request.js";
+import { SimCognitoOAuthResponse } from "./sim-cognito-oauth-response.js";
+import { SimCognitoSessionCookie } from "./sim-cognito-session-cookie.js";
+/**
+ * What a served `/oauth2/authorize` request is answered with.
+ *
+ * Three requests reach this one path. An application sends the browser here to
+ * start a sign-in, the sign-in form posts back here to finish one, and a
+ * browser holding a managed login session arrives here and is signed in
+ * without being asked anything. They are one endpoint because real Cognito
+ * serves them as one, and the parameters are read the same way whichever
+ * arrived.
+ */
+export class SimCognitoAuthorizeRoute {
+    response = new SimCognitoOAuthResponse();
+    pageRequest = new SimCognitoPageRequest();
+    pages = new SimCognitoManagedLogin();
+    sessionCookie = new SimCognitoSessionCookie();
+    /**
+     * Sign a user in and send the browser back to the application with a code,
+     * or serve the form that asks who is signing in.
+     */
+    async handle(request) {
+        const parameters = this.pageRequest.values(request.serviceRequest, request.url);
+        try {
+            return this.response.redirect(await request.cognito.hostedAuthorize(request.pool, parameters, this.sessionCookie.read(request.serviceRequest.request)));
+        }
+        catch (error) {
+            return this.refused(request, parameters, error);
+        }
+    }
+    /**
+     * Answer a refused sign-in, on the form or at the application.
+     */
+    refused(request, parameters, error) {
+        return (this.pages.refusedSignIn(request, parameters, error) ??
+            this.response.refusedRedirect(error, parameters["redirect_uri"], parameters["state"]));
+    }
+}
+//# sourceMappingURL=sim-cognito-authorize-route.js.map

package/dist/service/cognito/serve/sim-cognito-authorize-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorize-route.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-authorize-route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E;;;;;;;;;GASG;AACH,MAAM,OAAO,wBAAwB;IAClB,QAAQ,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACzC,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACrC,aAAa,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE/D;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACxC,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,GAAG,CACZ,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CACnC,OAAO,CAAC,IAAI,EACZ,UAAU,EACV,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CACxD,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,OAAO,CACb,OAAgC,EAChC,UAAoC,EACpC,KAAc;QAEd,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAC3B,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,EAC1B,UAAU,CAAC,OAAO,CAAC,CACpB,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-controller.d.ts

@@ -7,28 +7,26 @@ interface SimCognitoServiceControllerProperties {
  * Localhost HTTP controller for the public endpoints of a simulated user pool,
  * and for the messages the pool would have sent.
  *
- * Real Cognito serves a pool's JWKS and its OpenID configuration to anyone,
- * with no SigV4 signature, because a token verifier holding no AWS credentials
- * has to be able to fetch them. Both are anonymous here for the same reason,
- * so a verifier pointed at the local URL fetches keys the way it does against
- * real Cognito rather than being handed them.
- *
- * The recorded messages are listed at `/<userPoolId>/messages`, which real
- * Cognito serves nothing at. Nothing here delivers a message, so this is where
- * one is read during local development.
+ * `SimCognitoPoolDocuments` answers with the pool's JWKS, its OpenID
+ * configuration and the messages listing, and this is the routing in front of
+ * it: the method, the path and the pool the path names.
  *
  * A pool's hosted domain is served too, on its own hostname rather than on the
  * regional endpoint, and `SimCognitoDomainController` answers those requests.
  * That is where the OAuth endpoints of an authorization code grant live.
  *
+ * A web ACL in front of the pool decides a request to either of the
+ * `.well-known` documents before the document is read.
+ *
  * The Cognito API itself is not served. An SDK client reaches the simulator
  * through `SimSdk` rather than through an endpoint override.
  */
 export declare class SimCognitoServiceController implements SimAwsServiceController {
     private readonly simAws;
-    private readonly openIdConfiguration;
+    private readonly documents;
     private readonly response;
     private readonly domainController;
+    private readonly webAcl;
     constructor(properties?: SimCognitoServiceControllerProperties);
     /**
      * Handle an HTTP request routed to a simulated Cognito regional endpoint.
@@ -36,9 +34,13 @@ export declare class SimCognitoServiceController implements SimAwsServiceControl
     handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
     private respond;
     /**
-     * The document a request names, or nothing served at that path.
+     * What the web ACL in front of a pool answers a request with, when it blocks
+     * it.
+     *
+     * A blocked request is answered before the document is read, so a verifier
+     * the rules turn away gets 403 and no keys.
      */
-    private served;
+    private blocked;
     /**
      * Find the pool a request names, if this endpoint serves it.
      *

package/dist/service/cognito/serve/sim-cognito-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EAErB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AA+B9C,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAuC;IAC3E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,GAAE,qCAA0C,EAIjE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAO3E;IAED,OAAO,CAAC,OAAO;IAuCf;;OAEG;IACH,OAAO,CAAC,MAAM;IAkCd;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;CAoBnB"}
+{"version":3,"file":"sim-cognito-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EAErB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAiB9C,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,YAAY,UAAU,GAAE,qCAA0C,EAIjE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAO3E;YAEa,OAAO;IAkDrB;;;;;;OAMG;YACW,OAAO;IAkBrB;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;CAoBnB"}

package/dist/service/cognito/serve/sim-cognito-controller.js

@@ -1,24 +1,9 @@
 import { SimAws } from "../../aws/sim-aws.js";
 import { SimCognitoDomainController } from "./sim-cognito-domain-controller.js";
 import { SimCognitoEndpointResponse } from "./sim-cognito-endpoint-response.js";
-import { SimCognitoOpenIdConfiguration } from "./sim-cognito-openid-configuration.js";
-/**
- * The path segment both public pool endpoints sit under.
- */
-const wellKnownSegment = ".well-known";
-/**
- * The path segment the recorded messages are listed under.
- *
- * Real Cognito serves nothing here. It is the serving side of
- * `SimCognitoUserPool.sentMessages`, so that a browser or a curl can read what
- * a pool would have sent during local development, and it is a divergence for
- * the same reason that accessor is one: nothing here delivers a message.
- */
-const messagesSegment = "messages";
-/**
- * The segments a request can name after the pool id.
- */
-const servedSegments = new Set([wellKnownSegment, messagesSegment]);
+import { simCognitoPoolScope } from "./sim-cognito-pool-scope.js";
+import { SimCognitoPoolDocuments, simCognitoProtectedSegment, simCognitoServesSegment, } from "./sim-cognito-pool-documents.js";
+import { SimCognitoWebAclInspection } from "./sim-cognito-web-acl-inspection.js";
 /**
  * The methods a published document is read with.
  */
@@ -27,28 +12,26 @@ const readMethods = new Set(["GET", "HEAD"]);
  * Localhost HTTP controller for the public endpoints of a simulated user pool,
  * and for the messages the pool would have sent.
  *
- * Real Cognito serves a pool's JWKS and its OpenID configuration to anyone,
- * with no SigV4 signature, because a token verifier holding no AWS credentials
- * has to be able to fetch them. Both are anonymous here for the same reason,
- * so a verifier pointed at the local URL fetches keys the way it does against
- * real Cognito rather than being handed them.
- *
- * The recorded messages are listed at `/<userPoolId>/messages`, which real
- * Cognito serves nothing at. Nothing here delivers a message, so this is where
- * one is read during local development.
+ * `SimCognitoPoolDocuments` answers with the pool's JWKS, its OpenID
+ * configuration and the messages listing, and this is the routing in front of
+ * it: the method, the path and the pool the path names.
  *
  * A pool's hosted domain is served too, on its own hostname rather than on the
  * regional endpoint, and `SimCognitoDomainController` answers those requests.
  * That is where the OAuth endpoints of an authorization code grant live.
  *
+ * A web ACL in front of the pool decides a request to either of the
+ * `.well-known` documents before the document is read.
+ *
  * The Cognito API itself is not served. An SDK client reaches the simulator
  * through `SimSdk` rather than through an endpoint override.
  */
 export class SimCognitoServiceController {
     simAws;
-    openIdConfiguration = new SimCognitoOpenIdConfiguration();
+    documents = new SimCognitoPoolDocuments();
     response = new SimCognitoEndpointResponse();
     domainController;
+    webAcl = new SimCognitoWebAclInspection();
     constructor(properties = {}) {
         const { simAws = new SimAws() } = properties;
         this.simAws = simAws;
@@ -61,14 +44,11 @@ export class SimCognitoServiceController {
         // A request that reached a hosted domain's hostname names that domain,
         // where one to the regional endpoint names no resource at all.
         const domainResponse = await this.domainController.handleRequest(serviceRequest);
-        return domainResponse ?? this.respond(serviceRequest);
+        return domainResponse ?? (await this.respond(serviceRequest));
     }
-    respond(serviceRequest) {
+    async respond(serviceRequest) {
         const { request } = serviceRequest;
         const url = new URL(request.url);
-        if (!readMethods.has(request.method)) {
-            return this.response.notRead(request.method);
-        }
         // A path is exactly '<userPoolId>/.well-known/<document>' or
         // '<userPoolId>/messages'. Anything longer is a path nothing is served at,
         // rather than a prefix of one that is.
@@ -78,7 +58,7 @@ export class SimCognitoServiceController {
         if (userPoolId === undefined ||
             userPoolId === "" ||
             segment === undefined ||
-            !servedSegments.has(segment) ||
+            !simCognitoServesSegment(segment) ||
             rest.length > 0) {
             return this.response.noSuchEndpoint(url.pathname);
         }
@@ -86,7 +66,17 @@ export class SimCognitoServiceController {
         if (pool === undefined) {
             return this.response.noSuchUserPool(userPoolId);
         }
-        return this.served(pool, {
+        // The web ACL sits in front of the endpoint rather than behind it, so a
+        // request it blocks is answered before the method is judged. A write the
+        // rules turned away gets WAF's 403 and never learns the endpoint reads.
+        const blocked = await this.blocked(pool, segment, request);
+        if (blocked !== undefined) {
+            return blocked;
+        }
+        if (!readMethods.has(request.method)) {
+            return this.response.notRead(request.method);
+        }
+        return this.documents.serve(pool, {
             segment,
             document,
             url,
@@ -94,26 +84,22 @@ export class SimCognitoServiceController {
         });
     }
     /**
-     * The document a request names, or nothing served at that path.
+     * What the web ACL in front of a pool answers a request with, when it blocks
+     * it.
+     *
+     * A blocked request is answered before the document is read, so a verifier
+     * the rules turn away gets 403 and no keys.
      */
-    served(pool, request) {
-        const { segment, document, url, method } = request;
-        // The listing is the whole of what the messages segment serves, and the
-        // two published documents sit under `.well-known` and nowhere else, so a
-        // path that mixes the two reaches neither.
-        if (segment === messagesSegment && document === undefined) {
-            return this.response.document({ messages: pool.sentMessages().map((message) => message.toOutput()) }, method);
-        }
-        if (segment !== wellKnownSegment) {
-            return this.response.noSuchEndpoint(url.pathname);
-        }
-        if (document === "jwks.json") {
-            return this.response.document(pool.jwks(), method);
-        }
-        if (document === "openid-configuration") {
-            return this.response.document(this.openIdConfiguration.document(pool, url.origin), method);
+    async blocked(pool, segment, request) {
+        if (!simCognitoProtectedSegment(segment)) {
+            return undefined;
         }
-        return this.response.noSuchEndpoint(url.pathname);
+        const inspected = await this.webAcl.inspect({
+            pool,
+            cognito: simCognitoPoolScope(this.simAws, pool),
+            request,
+        });
+        return inspected.blocked;
     }
     /**
      * Find the pool a request names, if this endpoint serves it.

package/dist/service/cognito/serve/sim-cognito-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAEtF;;GAEG;AACH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAgB7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAS;IACf,mBAAmB,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC1D,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,GAA0C,EAAE;QAChE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAEO,OAAO,CAAC,cAAoC;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,6DAA6D;QAC7D,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ;aAC1D,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,GAAG,CAAC,CAAC;QAEd,IACE,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,OAAO,KAAK,SAAS;YACrB,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,MAAM,GAAG,CAAC,EACf,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACvB,OAAO;YACP,QAAQ;YACR,GAAG;YACH,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,IAAwB,EACxB,OAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEnD,wEAAwE;QACxE,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,OAAO,KAAK,eAAe,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EACtE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EACnD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACK,UAAU,CAChB,UAAkB,EAClB,MAA2B;QAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAM7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAS;IACf,SAAS,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAC1C,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,gBAAgB,CAA6B;IAC7C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,YAAY,UAAU,GAA0C,EAAE;QAChE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,cAAoC;QAEpC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,6DAA6D;QAC7D,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ;aAC1D,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,GAAG,CAAC,CAAC;QAEd,IACE,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,OAAO,KAAK,SAAS;YACrB,CAAC,uBAAuB,CAAC,OAAO,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,CAAC,EACf,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE;YAChC,OAAO;YACP,QAAQ;YACR,GAAG;YACH,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,OAAO,CACnB,IAAwB,EACxB,OAAe,EACf,OAAgB;QAEhB,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1C,IAAI;YACJ,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;YAC/C,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IACK,UAAU,CAChB,UAAkB,EAClB,MAA2B;QAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-domain-controller.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
 import type { SimAws } from "../../aws/sim-aws.js";
 interface SimCognitoDomainControllerProperties {
     readonly simAws: SimAws;
@@ -14,10 +14,15 @@ interface SimCognitoDomainControllerProperties {
  * The pool's own scope answers each request, found from the domain rather than
  * assumed to be the default one, because a domain names a pool that any
  * Account and Region of the simulation could have created.
+ *
+ * A web ACL in front of the pool sees the request before any of the endpoints
+ * do, as it does on real Cognito. A blocked request is answered with 403 and
+ * reaches no endpoint.
  */
 export declare class SimCognitoDomainController {
     private readonly simAws;
     private readonly endpoints;
+    private readonly webAcl;
     constructor(properties: SimCognitoDomainControllerProperties);
     /**
      * Handle a request that reached a hosted domain's hostname, or answer
@@ -35,14 +40,6 @@ export declare class SimCognitoDomainController {
      * The pool a hosted domain belongs to.
      */
     private pool;
-    /**
-     * The simulated Cognito scope that owns a pool.
-     *
-     * The Account comes from the pool's ARN and the Region from its id, and each
-     * scope's services are made once and kept, so this is the same service
-     * object that created the pool rather than another view of it.
-     */
-    private cognitoFor;
 }
 export {};
 //# sourceMappingURL=sim-cognito-domain-controller.d.ts.map