@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts

@@ -18,9 +18,10 @@ interface SimCognitoAuthorizeEndpointProperties {
  * A request naming a provider signs in the user that provider has been told is
  * signed in at it. A request naming none signs in one of the pool's own users,
  * with the username and password real managed login would have taken from its
- * form. Nothing here draws the form: the serving layer is what answers a
- * browser with a page, and a test calling this directly passes the two fields
- * the form would have posted.
+ * form, or from the managed login session the browser presented. Nothing here
+ * draws the form: the serving layer is what answers a browser with a page, and
+ * a test calling this directly passes the two fields the form would have
+ * posted.
  */
 export declare class SimCognitoAuthorizeEndpoint {
     private readonly signIn;
@@ -31,8 +32,11 @@ export declare class SimCognitoAuthorizeEndpoint {
     /**
      * Sign a user in, and send the browser back to the application with an
      * authorization code.
+     *
+     * `presentedSession` is the managed login session the browser carried, which
+     * the serving layer reads out of the `cognito` cookie.
      */
-    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput): SimCognitoHostedRedirect;
+    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput, presentedSession?: string): SimCognitoHostedRedirect;
     private redirectWithCode;
 }
 export {};

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAgC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}
+{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;;;;OAMG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,CAAC,EAAE,MAAM,GACxB,wBAAwB,CAkC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js

@@ -14,9 +14,10 @@ import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
  * A request naming a provider signs in the user that provider has been told is
  * signed in at it. A request naming none signs in one of the pool's own users,
  * with the username and password real managed login would have taken from its
- * form. Nothing here draws the form: the serving layer is what answers a
- * browser with a page, and a test calling this directly passes the two fields
- * the form would have posted.
+ * form, or from the managed login session the browser presented. Nothing here
+ * draws the form: the serving layer is what answers a browser with a page, and
+ * a test calling this directly passes the two fields the form would have
+ * posted.
  */
 export class SimCognitoAuthorizeEndpoint {
     signIn;
@@ -30,8 +31,11 @@ export class SimCognitoAuthorizeEndpoint {
     /**
      * Sign a user in, and send the browser back to the application with an
      * authorization code.
+     *
+     * `presentedSession` is the managed login session the browser carried, which
+     * the serving layer reads out of the `cognito` cookie.
      */
-    handle(pool, input) {
+    handle(pool, input, presentedSession) {
         const client = this.hostedClient.forAuthorize(pool, input.client_id);
         const redirectUri = this.hostedClient.requiredRedirectUri(client, input.redirect_uri);
         // Everything from here on is refused by sending the browser back to the
@@ -41,7 +45,8 @@ export class SimCognitoAuthorizeEndpoint {
         this.hostedClient.requireCodeGrant(client, true);
         this.request.requireChallengeMethod(input);
         const scopes = new SimCognitoGrantedScopes(client, input.scope);
-        const user = this.signIn.signIn(pool, client, input);
+        const signedIn = this.signIn.signIn(pool, client, input, presentedSession);
+        const { user } = signedIn;
         const code = new SimCognitoAuthorizationCode({
             username: user.username,
             clientId: client.id,
@@ -54,6 +59,7 @@ export class SimCognitoAuthorizeEndpoint {
         return {
             location: this.redirectWithCode(redirectUri, code.value, input.state),
             username: user.username,
+            session: signedIn.session,
         };
     }
     redirectWithCode(redirectUri, code, state) {

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAErG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAyB;IAC/B,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAErG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAyB;IAC/B,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B,EAC/B,gBAAyB;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;QAE1B,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-browser-session.d.ts

@@ -0,0 +1,28 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
+/**
+ * The managed login session a browser holds at a pool's hosted domain.
+ *
+ * Real managed login starts one whenever a user signs in at the domain, with
+ * its own credentials or at an identity provider, and answers an authorize
+ * request carrying it with a code and no further questions. That is what makes
+ * a sign-out which clears the application's own cookies and revokes the user's
+ * tokens leave the browser signed in here.
+ */
+export declare class SimCognitoBrowserSession {
+    /**
+     * Start a session for a browser that has just signed in.
+     */
+    start(pool: SimCognitoUserPool, user: SimCognitoUser, now: Date): SimCognitoHostedSignedIn;
+    /**
+     * The user the session a browser presented signs in, where it still has one.
+     *
+     * Real Cognito lets attribute and authentication changes go by without
+     * disturbing the session, so nothing is rechecked but the user itself. A
+     * user deleted since the session started leaves it with nobody to sign in,
+     * and a disabled user is refused the way every other sign-in refuses one.
+     */
+    signIn(pool: SimCognitoUserPool, presented: string | undefined, now: Date): SimCognitoHostedSignedIn | undefined;
+}
+//# sourceMappingURL=sim-cognito-browser-session.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-browser-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-browser-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-browser-session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAG7E;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC;;OAEG;IACH,KAAK,CACH,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,IAAI,GACR,wBAAwB,CAY1B;IAED;;;;;;;OAOG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,IAAI,GACR,wBAAwB,GAAG,SAAS,CAqBtC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-browser-session.js

@@ -0,0 +1,54 @@
+import { SimCognitoManagedLoginSession } from "../../user-pool/auth/sim-cognito-managed-login-session.js";
+import { requireSimCognitoEnabled } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
+import { SimCognitoSessionChange } from "./sim-cognito-session-change.js";
+/**
+ * The managed login session a browser holds at a pool's hosted domain.
+ *
+ * Real managed login starts one whenever a user signs in at the domain, with
+ * its own credentials or at an identity provider, and answers an authorize
+ * request carrying it with a code and no further questions. That is what makes
+ * a sign-out which clears the application's own cookies and revokes the user's
+ * tokens leave the browser signed in here.
+ */
+export class SimCognitoBrowserSession {
+    /**
+     * Start a session for a browser that has just signed in.
+     */
+    start(pool, user, now) {
+        const session = new SimCognitoManagedLoginSession({
+            username: user.username,
+            startedAt: now,
+        });
+        pool.auth.addManagedLoginSession(session);
+        return new SimCognitoHostedSignedIn({
+            user,
+            session: SimCognitoSessionChange.started(session.value),
+        });
+    }
+    /**
+     * The user the session a browser presented signs in, where it still has one.
+     *
+     * Real Cognito lets attribute and authentication changes go by without
+     * disturbing the session, so nothing is rechecked but the user itself. A
+     * user deleted since the session started leaves it with nobody to sign in,
+     * and a disabled user is refused the way every other sign-in refuses one.
+     */
+    signIn(pool, presented, now) {
+        const session = pool.auth.findManagedLoginSession(presented, now);
+        if (session === undefined) {
+            return undefined;
+        }
+        const user = pool.findUser(session.username);
+        if (user === undefined) {
+            pool.auth.endManagedLoginSession(session.value);
+            return undefined;
+        }
+        requireSimCognitoEnabled(user);
+        return new SimCognitoHostedSignedIn({
+            user,
+            session: SimCognitoSessionChange.reused(),
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-browser-session.js.map

package/dist/service/cognito/command/hosted/sim-cognito-browser-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-browser-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-browser-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAGvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnC;;OAEG;IACH,KAAK,CACH,IAAwB,EACxB,IAAoB,EACpB,GAAS;QAET,MAAM,OAAO,GAAG,IAAI,6BAA6B,CAAC;YAChD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAE1C,OAAO,IAAI,wBAAwB,CAAC;YAClC,IAAI;YACJ,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CACJ,IAAwB,EACxB,SAA6B,EAC7B,GAAS;QAET,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAElE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAEhD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,OAAO,IAAI,wBAAwB,CAAC;YAClC,IAAI;YACJ,OAAO,EAAE,uBAAuB,CAAC,MAAM,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-credentials.d.ts

@@ -0,0 +1,20 @@
+import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+/**
+ * The username and password managed login's form posts.
+ *
+ * Real managed login reads these two out of its form, and this simulation
+ * reads them out of the authorize request, because a get carrying them and a
+ * post of the form it serves are the same request here. A request carrying
+ * neither has nobody to sign in, and the sign-in it is part of decides what to
+ * do about that.
+ */
+export declare class SimCognitoHostedCredentials {
+    readonly username: string;
+    readonly password: string;
+    private constructor();
+    /**
+     * The credentials an authorize request carries, where it carries both.
+     */
+    static in(input: SimCognitoAuthorizeInput): SimCognitoHostedCredentials | undefined;
+}
+//# sourceMappingURL=sim-cognito-hosted-credentials.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-credentials.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,wBAAwB,GAC9B,2BAA2B,GAAG,SAAS,CAYzC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-credentials.js

@@ -0,0 +1,31 @@
+/**
+ * The username and password managed login's form posts.
+ *
+ * Real managed login reads these two out of its form, and this simulation
+ * reads them out of the authorize request, because a get carrying them and a
+ * post of the form it serves are the same request here. A request carrying
+ * neither has nobody to sign in, and the sign-in it is part of decides what to
+ * do about that.
+ */
+export class SimCognitoHostedCredentials {
+    username;
+    password;
+    constructor(username, password) {
+        this.username = username;
+        this.password = password;
+    }
+    /**
+     * The credentials an authorize request carries, where it carries both.
+     */
+    static in(input) {
+        const { username, password } = input;
+        if (username === undefined || username === "") {
+            return undefined;
+        }
+        if (password === undefined || password === "") {
+            return undefined;
+        }
+        return new SimCognitoHostedCredentials(username, password);
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-credentials.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-credentials.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-credentials.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACtB,QAAQ,CAAS;IACjB,QAAQ,CAAS;IAEjC,YAAoB,QAAgB,EAAE,QAAgB;QACpD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CACP,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts

@@ -1,7 +1,7 @@
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
-import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+import type { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
 /**
  * Signing one of a pool's own users in at the authorize endpoint.
  *
@@ -18,17 +18,9 @@ import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
  */
 export declare class SimCognitoHostedPasswordSignIn {
     /**
-     * The user this request signs in, having checked its password.
+     * The user these credentials sign in, having checked the password.
      */
-    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUser;
-    /**
-     * The username and password the request carried.
-     *
-     * A request carrying neither, and naming no identity provider, is one a
-     * browser is shown the sign-in page for. The serving layer is what answers
-     * with that page, from this refusal.
-     */
-    private requiredCredentials;
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, credentials: SimCognitoHostedCredentials): SimCognitoUser;
     /**
      * Refuse a sign-in real managed login answers with a page of its own.
      *

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAUzE;;;;;;;;;;;;;GAaG;AACH,qBAAa,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,cAAc,CAWhB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;CAwB7B"}
+{"version":3,"file":"sim-cognito-hosted-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,qBAAa,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,WAAW,EAAE,2BAA2B,GACvC,cAAc,CAWhB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;CAwB7B"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js

@@ -1,5 +1,4 @@
 import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
-import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
 import { requireSimCognitoConfirmed, requireSimCognitoPasswordSet, requireSimCognitoSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
 import { simCognitoChallengeFactor } from "../auth/sim-cognito-mfa-factor-choice.js";
 /**
@@ -18,10 +17,10 @@ import { simCognitoChallengeFactor } from "../auth/sim-cognito-mfa-factor-choice
  */
 export class SimCognitoHostedPasswordSignIn {
     /**
-     * The user this request signs in, having checked its password.
+     * The user these credentials sign in, having checked the password.
      */
-    signIn(pool, client, input) {
-        const { username, password } = this.requiredCredentials(input);
+    signIn(pool, client, credentials) {
+        const { username, password } = credentials;
         const user = requireSimCognitoSignInUser(pool, client, username);
         requireSimCognitoSignIn(user, password);
         requireSimCognitoConfirmed(user);
@@ -29,23 +28,6 @@ export class SimCognitoHostedPasswordSignIn {
         this.requireNoFurtherPage(pool, user);
         return user;
     }
-    /**
-     * The username and password the request carried.
-     *
-     * A request carrying neither, and naming no identity provider, is one a
-     * browser is shown the sign-in page for. The serving layer is what answers
-     * with that page, from this refusal.
-     */
-    requiredCredentials(input) {
-        const { username, password } = input;
-        if (username === undefined ||
-            username === "" ||
-            password === undefined ||
-            password === "") {
-            throw new SimCognitoManagedLoginRequired();
-        }
-        return { username, password };
-    }
     /**
      * Refuse a sign-in real managed login answers with a page of its own.
      *

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAWrF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CACzB,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAErC,IACE,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,EAAE;YACf,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,EAAE,EACf,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,IAAwB,EACxB,IAAoB;QAEpB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,+CAA+C;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAErD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,sBAAsB,MAAM,oBAAoB;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,+CAA+C,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-hosted-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAGrF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,WAAwC;QAExC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;QAC3C,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,IAAwB,EACxB,IAAoB;QAEpB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,+CAA+C;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAErD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,sBAAsB,MAAM,oBAAoB;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,+CAA+C,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts

@@ -2,7 +2,7 @@ import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
-import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
 import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
 interface SimCognitoHostedSignInProperties {
     readonly federatedSignIn: SimCognitoFederatedSignIn;
@@ -11,22 +11,36 @@ interface SimCognitoHostedSignInProperties {
 /**
  * Which user an authorize request signs in.
  *
- * Real Cognito has two answers here. A request naming an identity provider
- * goes to that provider's own sign-in page, and one naming none goes to
- * managed login's form. The choice is made from the same parameter either way,
- * so it is made in one place, and what comes back is the pool user the
- * authorization code is issued for.
+ * Real Cognito has three answers here. A request naming an identity provider
+ * goes to that provider's own sign-in page. A request carrying credentials is
+ * managed login's form coming back. A request carrying neither is answered by
+ * the browser's own managed login session, and by the form where the browser
+ * holds none. What comes back is the pool user the authorization code is
+ * issued for, and what the browser should hold afterwards.
  */
 export declare class SimCognitoHostedSignIn {
     private readonly federatedSignIn;
     private readonly clock;
     private readonly request;
     private readonly passwordSignIn;
+    private readonly browserSession;
     constructor(properties: SimCognitoHostedSignInProperties);
     /**
-     * The user this request signs in, at a provider or in the pool itself.
+     * The user this request signs in, at a provider, in the pool itself, or from
+     * the managed login session the browser presented.
      */
-    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUser;
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput, presentedSession: string | undefined): SimCognitoHostedSignedIn;
+    /**
+     * Sign in one of the pool's own users, from a password or from the session
+     * the browser is already holding.
+     *
+     * Credentials win over a session, because a request carrying them is the
+     * sign-in form coming back and real managed login answers that with a fresh
+     * sign-in. A request carrying neither, from a browser holding no session, is
+     * one the sign-in form is shown for. The serving layer answers with that
+     * page, from this refusal.
+     */
+    private localSignIn;
 }
 export {};
 //# sourceMappingURL=sim-cognito-hosted-sign-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAG/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,cAAc,CAYhB;CACF"}
+{"version":3,"file":"sim-cognito-hosted-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAKnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IAEjE,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,wBAAwB,CAW1B;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;CAuBpB"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js

@@ -1,36 +1,63 @@
+import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
 import { SimCognitoAuthorizeRequest } from "./sim-cognito-authorize-request.js";
+import { SimCognitoBrowserSession } from "./sim-cognito-browser-session.js";
+import { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
 import { SimCognitoHostedPasswordSignIn } from "./sim-cognito-hosted-password-sign-in.js";
 /**
  * Which user an authorize request signs in.
  *
- * Real Cognito has two answers here. A request naming an identity provider
- * goes to that provider's own sign-in page, and one naming none goes to
- * managed login's form. The choice is made from the same parameter either way,
- * so it is made in one place, and what comes back is the pool user the
- * authorization code is issued for.
+ * Real Cognito has three answers here. A request naming an identity provider
+ * goes to that provider's own sign-in page. A request carrying credentials is
+ * managed login's form coming back. A request carrying neither is answered by
+ * the browser's own managed login session, and by the form where the browser
+ * holds none. What comes back is the pool user the authorization code is
+ * issued for, and what the browser should hold afterwards.
  */
 export class SimCognitoHostedSignIn {
     federatedSignIn;
     clock;
     request = new SimCognitoAuthorizeRequest();
     passwordSignIn = new SimCognitoHostedPasswordSignIn();
+    browserSession = new SimCognitoBrowserSession();
     constructor(properties) {
         this.federatedSignIn = properties.federatedSignIn;
         this.clock = properties.clock;
     }
     /**
-     * The user this request signs in, at a provider or in the pool itself.
+     * The user this request signs in, at a provider, in the pool itself, or from
+     * the managed login session the browser presented.
      */
-    signIn(pool, client, input) {
+    signIn(pool, client, input, presentedSession) {
         const provider = this.request.signInProvider(pool, client, input);
         if (provider === undefined) {
-            return this.passwordSignIn.signIn(pool, client, input);
+            return this.localSignIn(pool, client, input, presentedSession);
         }
-        return this.federatedSignIn.signIn({
-            pool,
-            provider,
-            now: this.clock.now(),
-        });
+        const now = this.clock.now();
+        const user = this.federatedSignIn.signIn({ pool, provider, now });
+        return this.browserSession.start(pool, user, now);
+    }
+    /**
+     * Sign in one of the pool's own users, from a password or from the session
+     * the browser is already holding.
+     *
+     * Credentials win over a session, because a request carrying them is the
+     * sign-in form coming back and real managed login answers that with a fresh
+     * sign-in. A request carrying neither, from a browser holding no session, is
+     * one the sign-in form is shown for. The serving layer answers with that
+     * page, from this refusal.
+     */
+    localSignIn(pool, client, input, presentedSession) {
+        const now = this.clock.now();
+        const credentials = SimCognitoHostedCredentials.in(input);
+        if (credentials === undefined) {
+            const returning = this.browserSession.signIn(pool, presentedSession, now);
+            if (returning === undefined) {
+                throw new SimCognitoManagedLoginRequired();
+            }
+            return returning;
+        }
+        const user = this.passwordSignIn.signIn(pool, client, credentials);
+        return this.browserSession.start(pool, user, now);
     }
 }
 //# sourceMappingURL=sim-cognito-hosted-sign-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAQ1F;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC3C,cAAc,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAEvE,YAAY,UAA4C;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAElE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,IAAI;YACJ,QAAQ;YACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-hosted-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAIhG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAS1F;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC3C,cAAc,GAAG,IAAI,8BAA8B,EAAE,CAAC;IACtD,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAEjE,YAAY,UAA4C;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B,EAC/B,gBAAoC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAElE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW,CACjB,IAAwB,EACxB,MAAgC,EAChC,KAA+B,EAC/B,gBAAoC;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,2BAA2B,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAE1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,8BAA8B,EAAE,CAAC;YAC7C,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.d.ts

@@ -0,0 +1,21 @@
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoSessionChange } from "./sim-cognito-session-change.js";
+interface SimCognitoHostedSignedInProperties {
+    readonly user: SimCognitoUser;
+    readonly session: SimCognitoSessionChange;
+}
+/**
+ * Who an authorize request signed in, and what it did to the browser's managed
+ * login session on the way.
+ *
+ * The two travel together because the endpoint needs both: the user is who the
+ * authorization code is issued for, and the session change is what the
+ * response tells the browser to hold.
+ */
+export declare class SimCognitoHostedSignedIn {
+    readonly user: SimCognitoUser;
+    readonly session: SimCognitoSessionChange;
+    constructor(properties: SimCognitoHostedSignedInProperties);
+}
+export {};
+//# sourceMappingURL=sim-cognito-hosted-signed-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-signed-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-signed-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,IAAI,EAAE,cAAc,CAAC;IACrC,SAAgB,OAAO,EAAE,uBAAuB,CAAC;IAEjD,YAAY,UAAU,EAAE,kCAAkC,EAGzD;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.js

@@ -0,0 +1,17 @@
+/**
+ * Who an authorize request signed in, and what it did to the browser's managed
+ * login session on the way.
+ *
+ * The two travel together because the endpoint needs both: the user is who the
+ * authorization code is issued for, and the session change is what the
+ * response tells the browser to hold.
+ */
+export class SimCognitoHostedSignedIn {
+    user;
+    session;
+    constructor(properties) {
+        this.user = properties.user;
+        this.session = properties.session;
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-signed-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-signed-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-signed-in.ts"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,IAAI,CAAiB;IACrB,OAAO,CAA0B;IAEjD,YAAY,UAA8C;QACxD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.d.ts

@@ -4,19 +4,26 @@ import type { SimCognitoHostedRedirect, SimCognitoLogoutInput } from "./hosted-a
  * The `/logout` endpoint of a pool's hosted domain.
  *
  * Real Cognito ends the managed login session in the browser's cookie and
- * sends the user to one of the app client's sign-out URLs. There is no such
- * session here, because every authorize request signs in afresh at the
- * identity provider rather than reusing a cookie, so what is left is the
- * redirect and the check that the URL is one the app client registered.
+ * sends the user to one of the app client's sign-out URLs. Both happen here.
+ * Ending the session is what makes the next authorize request ask for a
+ * password again, and it is why an application's own sign-out has to come
+ * through this endpoint. Clearing its own cookies and revoking the user's
+ * tokens leaves this session where it was.
  *
- * It signs nobody out at the identity provider either, which real Cognito also
- * does not do: a user signed out here is still signed in at Google.
+ * It signs nobody out at the identity provider, which real Cognito also does
+ * not do: a user signed out here is still signed in at Google.
  */
 export declare class SimCognitoLogoutEndpoint {
     private readonly hostedClient;
     /**
-     * Send the browser to the application's sign-out page.
+     * End the browser's managed login session, and send it to the application's
+     * sign-out page.
+     *
+     * `presentedSession` is the session the browser carried, which the serving
+     * layer reads out of the `cognito` cookie. A request arriving without one is
+     * a sign-out by a browser that holds no session, and it redirects the same
+     * way.
      */
-    handle(pool: SimCognitoUserPool, input: SimCognitoLogoutInput): SimCognitoHostedRedirect;
+    handle(pool: SimCognitoUserPool, input: SimCognitoLogoutInput, presentedSession?: string): SimCognitoHostedRedirect;
 }
 //# sourceMappingURL=sim-cognito-logout-endpoint.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-logout-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-logout-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAE7D;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,qBAAqB,GAC3B,wBAAwB,CA0B1B;CACF"}
+{"version":3,"file":"sim-cognito-logout-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-logout-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAGnF,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAE7D;;;;;;;;OAQG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,qBAAqB,EAC5B,gBAAgB,CAAC,EAAE,MAAM,GACxB,wBAAwB,CA4B1B;CACF"}