@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/cognito/serve/sim-cognito-controller.d.ts

@@ -7,28 +7,26 @@ interface SimCognitoServiceControllerProperties {
  * Localhost HTTP controller for the public endpoints of a simulated user pool,
  * and for the messages the pool would have sent.
  *
- * Real Cognito serves a pool's JWKS and its OpenID configuration to anyone,
- * with no SigV4 signature, because a token verifier holding no AWS credentials
- * has to be able to fetch them. Both are anonymous here for the same reason,
- * so a verifier pointed at the local URL fetches keys the way it does against
- * real Cognito rather than being handed them.
- *
- * The recorded messages are listed at `/<userPoolId>/messages`, which real
- * Cognito serves nothing at. Nothing here delivers a message, so this is where
- * one is read during local development.
+ * `SimCognitoPoolDocuments` answers with the pool's JWKS, its OpenID
+ * configuration and the messages listing, and this is the routing in front of
+ * it: the method, the path and the pool the path names.
  *
  * A pool's hosted domain is served too, on its own hostname rather than on the
  * regional endpoint, and `SimCognitoDomainController` answers those requests.
  * That is where the OAuth endpoints of an authorization code grant live.
  *
+ * A web ACL in front of the pool decides a request to either of the
+ * `.well-known` documents before the document is read.
+ *
  * The Cognito API itself is not served. An SDK client reaches the simulator
  * through `SimSdk` rather than through an endpoint override.
  */
 export declare class SimCognitoServiceController implements SimAwsServiceController {
     private readonly simAws;
-    private readonly openIdConfiguration;
+    private readonly documents;
     private readonly response;
     private readonly domainController;
+    private readonly webAcl;
     constructor(properties?: SimCognitoServiceControllerProperties);
     /**
      * Handle an HTTP request routed to a simulated Cognito regional endpoint.
@@ -36,9 +34,13 @@ export declare class SimCognitoServiceController implements SimAwsServiceControl
     handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
     private respond;
     /**
-     * The document a request names, or nothing served at that path.
+     * What the web ACL in front of a pool answers a request with, when it blocks
+     * it.
+     *
+     * A blocked request is answered before the document is read, so a verifier
+     * the rules turn away gets 403 and no keys.
      */
-    private served;
+    private blocked;
     /**
      * Find the pool a request names, if this endpoint serves it.
      *

package/dist/service/cognito/serve/sim-cognito-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EAErB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AA+B9C,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAuC;IAC3E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,GAAE,qCAA0C,EAIjE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAO3E;IAED,OAAO,CAAC,OAAO;IAuCf;;OAEG;IACH,OAAO,CAAC,MAAM;IAkCd;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;CAoBnB"}
+{"version":3,"file":"sim-cognito-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EAErB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAiB9C,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,YAAY,UAAU,GAAE,qCAA0C,EAIjE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAO3E;YAEa,OAAO;IAkDrB;;;;;;OAMG;YACW,OAAO;IAkBrB;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;CAoBnB"}

package/dist/service/cognito/serve/sim-cognito-controller.js

@@ -1,24 +1,9 @@
 import { SimAws } from "../../aws/sim-aws.js";
 import { SimCognitoDomainController } from "./sim-cognito-domain-controller.js";
 import { SimCognitoEndpointResponse } from "./sim-cognito-endpoint-response.js";
-import { SimCognitoOpenIdConfiguration } from "./sim-cognito-openid-configuration.js";
-/**
- * The path segment both public pool endpoints sit under.
- */
-const wellKnownSegment = ".well-known";
-/**
- * The path segment the recorded messages are listed under.
- *
- * Real Cognito serves nothing here. It is the serving side of
- * `SimCognitoUserPool.sentMessages`, so that a browser or a curl can read what
- * a pool would have sent during local development, and it is a divergence for
- * the same reason that accessor is one: nothing here delivers a message.
- */
-const messagesSegment = "messages";
-/**
- * The segments a request can name after the pool id.
- */
-const servedSegments = new Set([wellKnownSegment, messagesSegment]);
+import { simCognitoPoolScope } from "./sim-cognito-pool-scope.js";
+import { SimCognitoPoolDocuments, simCognitoProtectedSegment, simCognitoServesSegment, } from "./sim-cognito-pool-documents.js";
+import { SimCognitoWebAclInspection } from "./sim-cognito-web-acl-inspection.js";
 /**
  * The methods a published document is read with.
  */
@@ -27,28 +12,26 @@ const readMethods = new Set(["GET", "HEAD"]);
  * Localhost HTTP controller for the public endpoints of a simulated user pool,
  * and for the messages the pool would have sent.
  *
- * Real Cognito serves a pool's JWKS and its OpenID configuration to anyone,
- * with no SigV4 signature, because a token verifier holding no AWS credentials
- * has to be able to fetch them. Both are anonymous here for the same reason,
- * so a verifier pointed at the local URL fetches keys the way it does against
- * real Cognito rather than being handed them.
- *
- * The recorded messages are listed at `/<userPoolId>/messages`, which real
- * Cognito serves nothing at. Nothing here delivers a message, so this is where
- * one is read during local development.
+ * `SimCognitoPoolDocuments` answers with the pool's JWKS, its OpenID
+ * configuration and the messages listing, and this is the routing in front of
+ * it: the method, the path and the pool the path names.
  *
  * A pool's hosted domain is served too, on its own hostname rather than on the
  * regional endpoint, and `SimCognitoDomainController` answers those requests.
  * That is where the OAuth endpoints of an authorization code grant live.
  *
+ * A web ACL in front of the pool decides a request to either of the
+ * `.well-known` documents before the document is read.
+ *
  * The Cognito API itself is not served. An SDK client reaches the simulator
  * through `SimSdk` rather than through an endpoint override.
  */
 export class SimCognitoServiceController {
     simAws;
-    openIdConfiguration = new SimCognitoOpenIdConfiguration();
+    documents = new SimCognitoPoolDocuments();
     response = new SimCognitoEndpointResponse();
     domainController;
+    webAcl = new SimCognitoWebAclInspection();
     constructor(properties = {}) {
         const { simAws = new SimAws() } = properties;
         this.simAws = simAws;
@@ -61,14 +44,11 @@ export class SimCognitoServiceController {
         // A request that reached a hosted domain's hostname names that domain,
         // where one to the regional endpoint names no resource at all.
         const domainResponse = await this.domainController.handleRequest(serviceRequest);
-        return domainResponse ?? this.respond(serviceRequest);
+        return domainResponse ?? (await this.respond(serviceRequest));
     }
-    respond(serviceRequest) {
+    async respond(serviceRequest) {
         const { request } = serviceRequest;
         const url = new URL(request.url);
-        if (!readMethods.has(request.method)) {
-            return this.response.notRead(request.method);
-        }
         // A path is exactly '<userPoolId>/.well-known/<document>' or
         // '<userPoolId>/messages'. Anything longer is a path nothing is served at,
         // rather than a prefix of one that is.
@@ -78,7 +58,7 @@ export class SimCognitoServiceController {
         if (userPoolId === undefined ||
             userPoolId === "" ||
             segment === undefined ||
-            !servedSegments.has(segment) ||
+            !simCognitoServesSegment(segment) ||
             rest.length > 0) {
             return this.response.noSuchEndpoint(url.pathname);
         }
@@ -86,7 +66,17 @@ export class SimCognitoServiceController {
         if (pool === undefined) {
             return this.response.noSuchUserPool(userPoolId);
         }
-        return this.served(pool, {
+        // The web ACL sits in front of the endpoint rather than behind it, so a
+        // request it blocks is answered before the method is judged. A write the
+        // rules turned away gets WAF's 403 and never learns the endpoint reads.
+        const blocked = await this.blocked(pool, segment, request);
+        if (blocked !== undefined) {
+            return blocked;
+        }
+        if (!readMethods.has(request.method)) {
+            return this.response.notRead(request.method);
+        }
+        return this.documents.serve(pool, {
             segment,
             document,
             url,
@@ -94,26 +84,22 @@ export class SimCognitoServiceController {
         });
     }
     /**
-     * The document a request names, or nothing served at that path.
+     * What the web ACL in front of a pool answers a request with, when it blocks
+     * it.
+     *
+     * A blocked request is answered before the document is read, so a verifier
+     * the rules turn away gets 403 and no keys.
      */
-    served(pool, request) {
-        const { segment, document, url, method } = request;
-        // The listing is the whole of what the messages segment serves, and the
-        // two published documents sit under `.well-known` and nowhere else, so a
-        // path that mixes the two reaches neither.
-        if (segment === messagesSegment && document === undefined) {
-            return this.response.document({ messages: pool.sentMessages().map((message) => message.toOutput()) }, method);
-        }
-        if (segment !== wellKnownSegment) {
-            return this.response.noSuchEndpoint(url.pathname);
-        }
-        if (document === "jwks.json") {
-            return this.response.document(pool.jwks(), method);
-        }
-        if (document === "openid-configuration") {
-            return this.response.document(this.openIdConfiguration.document(pool, url.origin), method);
+    async blocked(pool, segment, request) {
+        if (!simCognitoProtectedSegment(segment)) {
+            return undefined;
         }
-        return this.response.noSuchEndpoint(url.pathname);
+        const inspected = await this.webAcl.inspect({
+            pool,
+            cognito: simCognitoPoolScope(this.simAws, pool),
+            request,
+        });
+        return inspected.blocked;
     }
     /**
      * Find the pool a request names, if this endpoint serves it.

package/dist/service/cognito/serve/sim-cognito-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAEtF;;GAEG;AACH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAgB7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAS;IACf,mBAAmB,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC1D,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,GAA0C,EAAE;QAChE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAEO,OAAO,CAAC,cAAoC;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,6DAA6D;QAC7D,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ;aAC1D,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,GAAG,CAAC,CAAC;QAEd,IACE,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,OAAO,KAAK,SAAS;YACrB,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,MAAM,GAAG,CAAC,EACf,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACvB,OAAO;YACP,QAAQ;YACR,GAAG;YACH,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,IAAwB,EACxB,OAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEnD,wEAAwE;QACxE,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,OAAO,KAAK,eAAe,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EACtE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EACnD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACK,UAAU,CAChB,UAAkB,EAClB,MAA2B;QAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-controller.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAM7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAS;IACf,SAAS,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAC1C,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,gBAAgB,CAA6B;IAC7C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,YAAY,UAAU,GAA0C,EAAE;QAChE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,cAAoC;QAEpC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,6DAA6D;QAC7D,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ;aAC1D,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,GAAG,CAAC,CAAC;QAEd,IACE,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,EAAE;YACjB,OAAO,KAAK,SAAS;YACrB,CAAC,uBAAuB,CAAC,OAAO,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,CAAC,EACf,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE;YAChC,OAAO;YACP,QAAQ;YACR,GAAG;YACH,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,OAAO,CACnB,IAAwB,EACxB,OAAe,EACf,OAAgB;QAEhB,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1C,IAAI;YACJ,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;YAC/C,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IACK,UAAU,CAChB,UAAkB,EAClB,MAA2B;QAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-domain-controller.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
 import type { SimAws } from "../../aws/sim-aws.js";
 interface SimCognitoDomainControllerProperties {
     readonly simAws: SimAws;
@@ -14,10 +14,15 @@ interface SimCognitoDomainControllerProperties {
  * The pool's own scope answers each request, found from the domain rather than
  * assumed to be the default one, because a domain names a pool that any
  * Account and Region of the simulation could have created.
+ *
+ * A web ACL in front of the pool sees the request before any of the endpoints
+ * do, as it does on real Cognito. A blocked request is answered with 403 and
+ * reaches no endpoint.
  */
 export declare class SimCognitoDomainController {
     private readonly simAws;
     private readonly endpoints;
+    private readonly webAcl;
     constructor(properties: SimCognitoDomainControllerProperties);
     /**
      * Handle a request that reached a hosted domain's hostname, or answer
@@ -35,14 +40,6 @@ export declare class SimCognitoDomainController {
      * The pool a hosted domain belongs to.
      */
     private pool;
-    /**
-     * The simulated Cognito scope that owns a pool.
-     *
-     * The Account comes from the pool's ARN and the Region from its id, and each
-     * scope's services are made once and kept, so this is the same service
-     * object that created the pool rather than another view of it.
-     */
-    private cognitoFor;
 }
 export {};
 //# sourceMappingURL=sim-cognito-domain-controller.d.ts.map

package/dist/service/cognito/serve/sim-cognito-domain-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-domain-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-controller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAOnD,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAE7D,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;;;;OAMG;IACG,aAAa,CACjB,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAgB/B;IAED;;OAEG;IACH,OAAO,CAAC,YAAY;IAcpB;;OAEG;IACH,OAAO,CAAC,IAAI;IAaZ;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;CAMnB"}
+{"version":3,"file":"sim-cognito-domain-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAOnD,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;;;;OAMG;IACG,aAAa,CACjB,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAyB/B;IAED;;OAEG;IACH,OAAO,CAAC,YAAY;IAcpB;;OAEG;IACH,OAAO,CAAC,IAAI;CAYb"}

package/dist/service/cognito/serve/sim-cognito-domain-controller.js

@@ -1,6 +1,8 @@
 import { assertDefined } from "../../../util/type-guard/defined.js";
-import { simCognitoUserPoolRegionName } from "../user-pool/sim-cognito-user-pool-id.js";
+import { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
 import { SimCognitoDomainEndpoints } from "./sim-cognito-domain-endpoints.js";
+import { simCognitoPoolScope } from "./sim-cognito-pool-scope.js";
+import { SimCognitoWebAclInspection } from "./sim-cognito-web-acl-inspection.js";
 /**
  * The localhost HTTP side of a pool's hosted domain.
  *
@@ -12,10 +14,15 @@ import { SimCognitoDomainEndpoints } from "./sim-cognito-domain-endpoints.js";
  * The pool's own scope answers each request, found from the domain rather than
  * assumed to be the default one, because a domain names a pool that any
  * Account and Region of the simulation could have created.
+ *
+ * A web ACL in front of the pool sees the request before any of the endpoints
+ * do, as it does on real Cognito. A blocked request is answered with 403 and
+ * reaches no endpoint.
  */
 export class SimCognitoDomainController {
     simAws;
     endpoints = new SimCognitoDomainEndpoints();
+    webAcl = new SimCognitoWebAclInspection();
     constructor(properties) {
         this.simAws = properties.simAws;
     }
@@ -31,13 +38,21 @@ export class SimCognitoDomainController {
         if (domain === undefined) {
             return undefined;
         }
-        const url = new URL(serviceRequest.request.url);
         const pool = this.pool(domain);
+        const cognito = simCognitoPoolScope(this.simAws, pool);
+        const inspected = await this.webAcl.inspect({
+            pool,
+            cognito,
+            request: serviceRequest.request,
+        });
+        if (inspected.blocked !== undefined) {
+            return inspected.blocked;
+        }
         return await this.endpoints.handleRequest({
             pool,
-            cognito: this.cognitoFor(pool),
-            serviceRequest,
-            url,
+            cognito,
+            serviceRequest: forwarded(serviceRequest, inspected.request),
+            url: new URL(inspected.request.url),
         });
     }
     /**
@@ -62,18 +77,25 @@ export class SimCognitoDomainController {
         assertDefined(pool, `sim Cognito user pool ${domain.userPoolId} for domain ${domain.value}`);
         return pool;
     }
-    /**
-     * The simulated Cognito scope that owns a pool.
-     *
-     * The Account comes from the pool's ARN and the Region from its id, and each
-     * scope's services are made once and kept, so this is the same service
-     * object that created the pool rather than another view of it.
-     */
-    cognitoFor(pool) {
-        return this.simAws
-            .account(pool.arn.accountId)
-            .region(simCognitoUserPoolRegionName(pool.id))
-            .cognitoIdentityProvider();
+}
+/**
+ * The request the endpoints answer, as the web ACL asked for it to be
+ * forwarded.
+ *
+ * A rule with custom request handling adds headers to what reaches the origin,
+ * and the hosted domain is the origin here. An allowed request no rule touched
+ * is the one that arrived.
+ */
+function forwarded(serviceRequest, request) {
+    if (request === serviceRequest.request) {
+        return serviceRequest;
     }
+    return new SimAwsServiceRequest({
+        target: serviceRequest.target,
+        request,
+        caller: serviceRequest.caller,
+        source: serviceRequest.source,
+        body: serviceRequest.body,
+    });
 }
 //# sourceMappingURL=sim-cognito-domain-controller.js.map

package/dist/service/cognito/serve/sim-cognito-domain-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-domain-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAM9E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,0BAA0B;IACpB,MAAM,CAAS;IACf,SAAS,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAE7D,YAAY,UAAgD;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,cAAoC;QAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/B,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YACxC,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC9B,cAAc;YACd,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,cAAoC;QAEpC,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC;QAE/C,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,uBAAuB,EAAE;aACzB,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACK,IAAI,CAAC,MAAgC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/C,aAAa,CACX,IAAI,EACJ,yBAAyB,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,KAAK,EAAE,CACxE,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,IAAwB;QACzC,OAAO,IAAI,CAAC,MAAM;aACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;aAC3B,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAkB,CAAC;aAC9D,uBAAuB,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-domain-controller.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAI3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAMjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,0BAA0B;IACpB,MAAM,CAAS;IACf,SAAS,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC5C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,YAAY,UAAgD;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,cAAoC;QAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1C,IAAI;YACJ,OAAO;YACP,OAAO,EAAE,cAAc,CAAC,OAAO;SAChC,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC;QAC3B,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YACxC,IAAI;YACJ,OAAO;YACP,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,OAAO,CAAC;YAC5D,GAAG,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,cAAoC;QAEpC,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC;QAE/C,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,uBAAuB,EAAE;aACzB,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACK,IAAI,CAAC,MAAgC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,uBAAuB,EAAE;aACzB,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/C,aAAa,CACX,IAAI,EACJ,yBAAyB,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,KAAK,EAAE,CACxE,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAChB,cAAoC,EACpC,OAAgB;IAEhB,IAAI,OAAO,KAAK,cAAc,CAAC,OAAO,EAAE,CAAC;QACvC,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,oBAAoB,CAAC;QAC9B,MAAM,EAAE,cAAc,CAAC,MAAM;QAC7B,OAAO;QACP,MAAM,EAAE,cAAc,CAAC,MAAM;QAC7B,MAAM,EAAE,cAAc,CAAC,MAAM;QAC7B,IAAI,EAAE,cAAc,CAAC,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.d.ts

@@ -11,31 +11,25 @@ export type { SimCognitoDomainRequest } from "./sim-cognito-domain-request.js";
 export declare class SimCognitoDomainEndpoints {
     private readonly response;
     private readonly tokenRequest;
-    private readonly pageRequest;
     private readonly pages;
+    private readonly sessionCookie;
+    private readonly authorizeRoute;
     /**
      * Answer a request that reached the domain's hostname.
      */
     handleRequest(request: SimCognitoDomainRequest): Promise<Response>;
     /**
-     * Sign a user in and send the browser back to the application with a code,
-     * or serve the form that asks who is signing in.
-     *
-     * A get carrying credentials and a post of the sign-in form are the same
-     * request to the simulation. Both name the user and its password, and the
-     * only difference is where those two were read from.
+     * Answer the pool's authorize endpoint, which takes the post of the sign-in
+     * form it serves as well as the get an application sends the browser on.
      */
     private authorize;
-    /**
-     * Answer a refused sign-in, on the form or at the application.
-     */
-    private refused;
     /**
      * Exchange an authorization code or a refresh token for tokens.
      */
     private token;
     /**
-     * Send the browser to the application's sign-out page.
+     * End the browser's managed login session and send it to the application's
+     * sign-out page.
      */
     private logout;
     /**

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-domain-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAgB/E,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEtD;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBvE;IAED;;;;;;;OAOG;YACW,SAAS;IAiBvB;;OAEG;IACH,OAAO,CAAC,OAAO;IAef;;OAEG;YACW,KAAK;IAenB;;OAEG;YACW,MAAM;IAcpB;;OAEG;YACW,QAAQ;CAavB"}
+{"version":3,"file":"sim-cognito-domain-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAiB/E,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IAEjE;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBvE;IAED;;;OAGG;YACW,SAAS;IAMvB;;OAEG;YACW,KAAK;IAenB;;;OAGG;YACW,MAAM;IAkBpB;;OAEG;YACW,QAAQ;CAavB"}

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.js

@@ -1,7 +1,8 @@
 import { SimCognitoManagedLogin } from "./page/sim-cognito-managed-login.js";
 import { simCognitoAuthorizePath } from "./page/sim-cognito-page-paths.js";
-import { SimCognitoPageRequest } from "./page/sim-cognito-page-request.js";
+import { SimCognitoAuthorizeRoute } from "./sim-cognito-authorize-route.js";
 import { SimCognitoOAuthResponse } from "./sim-cognito-oauth-response.js";
+import { SimCognitoSessionCookie } from "./sim-cognito-session-cookie.js";
 import { SimCognitoTokenRequest } from "./sim-cognito-token-request.js";
 /**
  * The remaining paths a hosted domain serves.
@@ -24,8 +25,9 @@ const pageMethods = "GET, POST";
 export class SimCognitoDomainEndpoints {
     response = new SimCognitoOAuthResponse();
     tokenRequest = new SimCognitoTokenRequest();
-    pageRequest = new SimCognitoPageRequest();
     pages = new SimCognitoManagedLogin();
+    sessionCookie = new SimCognitoSessionCookie();
+    authorizeRoute = new SimCognitoAuthorizeRoute();
     /**
      * Answer a request that reached the domain's hostname.
      */
@@ -46,30 +48,11 @@ export class SimCognitoDomainEndpoints {
         return this.response.noSuchEndpoint(pathname);
     }
     /**
-     * Sign a user in and send the browser back to the application with a code,
-     * or serve the form that asks who is signing in.
-     *
-     * A get carrying credentials and a post of the sign-in form are the same
-     * request to the simulation. Both name the user and its password, and the
-     * only difference is where those two were read from.
+     * Answer the pool's authorize endpoint, which takes the post of the sign-in
+     * form it serves as well as the get an application sends the browser on.
      */
     async authorize(request) {
-        return await this.answered(request, pageMethods, async () => {
-            const parameters = this.pageRequest.values(request.serviceRequest, request.url);
-            try {
-                return this.response.redirect(await request.cognito.hostedAuthorize(request.pool, parameters));
-            }
-            catch (error) {
-                return this.refused(request, parameters, error);
-            }
-        });
-    }
-    /**
-     * Answer a refused sign-in, on the form or at the application.
-     */
-    refused(request, parameters, error) {
-        return (this.pages.refusedSignIn(request, parameters, error) ??
-            this.response.refusedRedirect(error, parameters["redirect_uri"], parameters["state"]));
+        return await this.answered(request, pageMethods, async () => this.authorizeRoute.handle(request));
     }
     /**
      * Exchange an authorization code or a refresh token for tokens.
@@ -85,13 +68,14 @@ export class SimCognitoDomainEndpoints {
         });
     }
     /**
-     * Send the browser to the application's sign-out page.
+     * End the browser's managed login session and send it to the application's
+     * sign-out page.
      */
     async logout(request) {
         const parameters = Object.fromEntries(request.url.searchParams);
         return await this.answered(request, "GET", async () => {
             try {
-                return this.response.redirect(await request.cognito.hostedSignOut(request.pool, parameters));
+                return this.response.redirect(await request.cognito.hostedSignOut(request.pool, parameters, this.sessionCookie.read(request.serviceRequest.request)));
             }
             catch (error) {
                 return this.response.refusedRequest(error);

package/dist/service/cognito/serve/sim-cognito-domain-endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-domain-endpoints.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B;;;GAGG;AACH,MAAM,WAAW,GAAG,WAAW,CAAC;AAIhC;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACzC,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAEtD;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgC;QAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QAEjC,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YACzC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,sBAAsB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAC1D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,SAAS,CAAC,OAAgC;QACtD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACxC,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,GAAG,CACZ,CAAC;YAEF,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAChE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,OAAO,CACb,OAAgC,EAChC,UAAoC,EACpC,KAAc;QAEd,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAC3B,KAAK,EACL,UAAU,CAAC,cAAc,CAAC,EAC1B,UAAU,CAAC,OAAO,CAAC,CACpB,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CAAC,OAAgC;QAClD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CACzB,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAC/B,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAC/C,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAAC,OAAgC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAC9D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CACpB,OAAgC,EAChC,OAAe,EACf,MAA+B;QAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;QAExD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-domain-endpoints.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-domain-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;GAEG;AACH,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B;;;GAGG;AACH,MAAM,WAAW,GAAG,WAAW,CAAC;AAIhC;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACzC,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACrC,aAAa,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAC9C,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAEjE;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgC;QAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QAEjC,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YACzC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,sBAAsB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAC1D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS,CAAC,OAAgC;QACtD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAC1D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CACpC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CAAC,OAAgC;QAClD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CACzB,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAC/B,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAC/C,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,MAAM,CAAC,OAAgC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CACjC,OAAO,CAAC,IAAI,EACZ,UAAU,EACV,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CACxD,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CACpB,OAAgC,EAChC,OAAe,EACf,MAA+B;QAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;QAExD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-oauth-response.d.ts

@@ -9,6 +9,7 @@ import type { SimCognitoHostedRedirect } from "../command/hosted/hosted-auth.com
  * browser can see.
  */
 export declare class SimCognitoOAuthResponse {
+    private readonly sessionCookie;
     /**
      * Read an error as an OAuth one, whatever it turned out to be.
      *
@@ -19,7 +20,8 @@ export declare class SimCognitoOAuthResponse {
     private static oauthError;
     private static describe;
     /**
-     * Send the browser on to where an endpoint decided it goes.
+     * Send the browser on to where an endpoint decided it goes, holding the
+     * managed login session the endpoint gave it.
      */
     redirect(redirect: SimCognitoHostedRedirect): Response;
     /**

package/dist/service/cognito/serve/sim-cognito-oauth-response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-oauth-response.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-oauth-response.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAEzF;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IAClC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;IAYzB,OAAO,CAAC,MAAM,CAAC,QAAQ;IAQvB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,GAAG,QAAQ,CAKrD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAQ7B;IAED;;;;;;;OAOG;IACH,eAAe,CACb,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,QAAQ,CAoBV;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAOvC;IAED;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAUzC;IAED;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAQpD;CACF"}
+{"version":3,"file":"sim-cognito-oauth-response.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-oauth-response.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAE/D;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;IAYzB,OAAO,CAAC,MAAM,CAAC,QAAQ;IAQvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,GAAG,QAAQ,CASrD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAQ7B;IAED;;;;;;;OAOG;IACH,eAAe,CACb,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,QAAQ,CAoBV;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAOvC;IAED;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAUzC;IAED;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAQpD;CACF"}

package/dist/service/cognito/serve/sim-cognito-oauth-response.js

@@ -1,4 +1,5 @@
 import { isSimCognitoOAuthError, SimCognitoOAuthError, } from "../error/sim-cognito-oauth.error.js";
+import { SimCognitoSessionCookie } from "./sim-cognito-session-cookie.js";
 /**
  * The responses a pool's hosted OAuth endpoints answer with.
  *
@@ -9,6 +10,7 @@ import { isSimCognitoOAuthError, SimCognitoOAuthError, } from "../error/sim-cogn
  * browser can see.
  */
 export class SimCognitoOAuthResponse {
+    sessionCookie = new SimCognitoSessionCookie();
     /**
      * Read an error as an OAuth one, whatever it turned out to be.
      *
@@ -33,13 +35,16 @@ export class SimCognitoOAuthResponse {
         return "The request was refused";
     }
     /**
-     * Send the browser on to where an endpoint decided it goes.
+     * Send the browser on to where an endpoint decided it goes, holding the
+     * managed login session the endpoint gave it.
      */
     redirect(redirect) {
-        return new Response(undefined, {
-            status: 302,
-            headers: { location: redirect.location },
-        });
+        const headers = new Headers({ location: redirect.location });
+        const cookie = this.sessionCookie.headerFor(redirect.session);
+        if (cookie !== undefined) {
+            headers.set("set-cookie", cookie);
+        }
+        return new Response(undefined, { status: 302, headers });
     }
     /**
      * Answer a token request with the tokens it asked for.

package/dist/service/cognito/serve/sim-cognito-oauth-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-oauth-response.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-oauth-response.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAG7C;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAuB;IAClC;;;;;;OAMG;IACK,MAAM,CAAC,UAAU,CAAC,KAAc;QACtC,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,oBAAoB,CAAC;YAC9B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,KAAc;QACpC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAkC;QACzC,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAY;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;YACzB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU;gBAC3B,6BAA6B,EAAE,GAAG;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,KAAc,EACd,WAA+B,EAC/B,KAAyB;QAEzB,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7D,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAEvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAc;QAC3B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7D,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,iBAAiB,EAAE,UAAU,CAAC,WAAW,EAAE,EACrE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAAgB;QAC7B,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EACf,kDAAkD,QAAQ,OAAO;gBACjE,sDAAsD;SACzD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAc,EAAE,OAAe;QACxC,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,yBAAyB,OAAO,SAAS,MAAM,EAAE;SACrE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC7C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-oauth-response.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-oauth-response.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAuB;IACjB,aAAa,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE/D;;;;;;OAMG;IACK,MAAM,CAAC,UAAU,CAAC,KAAc;QACtC,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,oBAAoB,CAAC;YAC9B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,KAAc;QACpC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,QAAkC;QACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAY;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;YACzB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU;gBAC3B,6BAA6B,EAAE,GAAG;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,KAAc,EACd,WAA+B,EAC/B,KAAyB;QAEzB,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7D,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAEvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAc;QAC3B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7D,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,iBAAiB,EAAE,UAAU,CAAC,WAAW,EAAE,EACrE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAAgB;QAC7B,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EACf,kDAAkD,QAAQ,OAAO;gBACjE,sDAAsD;SACzD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAc,EAAE,OAAe;QACxC,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,yBAAyB,OAAO,SAAS,MAAM,EAAE;SACrE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC7C,CAAC;IACJ,CAAC;CACF"}