@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/cognito/serve/sim-cognito-pool-documents.d.ts

@@ -0,0 +1,40 @@
+import type { SimCognitoUserPool } from "../user-pool/sim-cognito-user-pool.js";
+/**
+ * The parts of a request that decide which document it is asking for.
+ */
+export interface SimCognitoServedRequest {
+    readonly segment: string;
+    readonly document: string | undefined;
+    readonly url: URL;
+    readonly method: string;
+}
+/**
+ * Whether a path segment after the pool id names anything this endpoint
+ * serves.
+ */
+export declare function simCognitoServesSegment(segment: string): boolean;
+/**
+ * Whether a web ACL in front of the pool is evaluated for a path segment.
+ *
+ * AWS WAF inspects every user pool endpoint, and the two `.well-known`
+ * documents are user pool endpoints. The recorded messages are a path of this
+ * simulation's own, and no web ACL on AWS has an opinion about it.
+ */
+export declare function simCognitoProtectedSegment(segment: string): boolean;
+/**
+ * The documents a pool publishes on the regional endpoint.
+ *
+ * Real Cognito serves the JWKS and the OpenID configuration to anyone, with no
+ * SigV4 signature, because a token verifier holding no AWS credentials has to
+ * be able to fetch them. Both are anonymous here for the same reason. The
+ * messages listing sits beside them and is Yulin's own.
+ */
+export declare class SimCognitoPoolDocuments {
+    private readonly openIdConfiguration;
+    private readonly response;
+    /**
+     * The document a request names, or nothing served at that path.
+     */
+    serve(pool: SimCognitoUserPool, request: SimCognitoServedRequest): Response;
+}
+//# sourceMappingURL=sim-cognito-pool-documents.d.ts.map

package/dist/service/cognito/serve/sim-cognito-pool-documents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-documents.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-pool-documents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAqBhF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAuC;IAC3E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAE7D;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,uBAAuB,GAAG,QAAQ,CA6B1E;CACF"}

package/dist/service/cognito/serve/sim-cognito-pool-documents.js

@@ -0,0 +1,68 @@
+import { SimCognitoEndpointResponse } from "./sim-cognito-endpoint-response.js";
+import { SimCognitoOpenIdConfiguration } from "./sim-cognito-openid-configuration.js";
+/**
+ * The path segment both public pool endpoints sit under.
+ */
+const wellKnownSegment = ".well-known";
+/**
+ * The path segment the recorded messages are listed under.
+ *
+ * Real Cognito serves nothing here. It is the serving side of
+ * `SimCognitoUserPool.sentMessages`, so that a browser or a curl can read what
+ * a pool would have sent during local development, and it is a divergence for
+ * the same reason that accessor is one: nothing here delivers a message.
+ */
+const messagesSegment = "messages";
+const servedSegments = new Set([wellKnownSegment, messagesSegment]);
+/**
+ * Whether a path segment after the pool id names anything this endpoint
+ * serves.
+ */
+export function simCognitoServesSegment(segment) {
+    return servedSegments.has(segment);
+}
+/**
+ * Whether a web ACL in front of the pool is evaluated for a path segment.
+ *
+ * AWS WAF inspects every user pool endpoint, and the two `.well-known`
+ * documents are user pool endpoints. The recorded messages are a path of this
+ * simulation's own, and no web ACL on AWS has an opinion about it.
+ */
+export function simCognitoProtectedSegment(segment) {
+    return segment === wellKnownSegment;
+}
+/**
+ * The documents a pool publishes on the regional endpoint.
+ *
+ * Real Cognito serves the JWKS and the OpenID configuration to anyone, with no
+ * SigV4 signature, because a token verifier holding no AWS credentials has to
+ * be able to fetch them. Both are anonymous here for the same reason. The
+ * messages listing sits beside them and is Yulin's own.
+ */
+export class SimCognitoPoolDocuments {
+    openIdConfiguration = new SimCognitoOpenIdConfiguration();
+    response = new SimCognitoEndpointResponse();
+    /**
+     * The document a request names, or nothing served at that path.
+     */
+    serve(pool, request) {
+        const { segment, document, url, method } = request;
+        // The listing is the whole of what the messages segment serves, and the
+        // two published documents sit under `.well-known` and nowhere else, so a
+        // path that mixes the two reaches neither.
+        if (segment === messagesSegment && document === undefined) {
+            return this.response.document({ messages: pool.sentMessages().map((message) => message.toOutput()) }, method);
+        }
+        if (segment !== wellKnownSegment) {
+            return this.response.noSuchEndpoint(url.pathname);
+        }
+        if (document === "jwks.json") {
+            return this.response.document(pool.jwks(), method);
+        }
+        if (document === "openid-configuration") {
+            return this.response.document(this.openIdConfiguration.document(pool, url.origin), method);
+        }
+        return this.response.noSuchEndpoint(url.pathname);
+    }
+}
+//# sourceMappingURL=sim-cognito-pool-documents.js.map

package/dist/service/cognito/serve/sim-cognito-pool-documents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-documents.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-pool-documents.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAEtF;;GAEG;AACH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAYpE;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,OAAO,KAAK,gBAAgB,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,mBAAmB,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC1D,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE7D;;OAEG;IACH,KAAK,CAAC,IAAwB,EAAE,OAAgC;QAC9D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEnD,wEAAwE;QACxE,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,OAAO,KAAK,eAAe,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EACtE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC3B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EACnD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-pool-scope.d.ts

@@ -0,0 +1,14 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCognitoIdentityProvider } from "../sim-cognito-identity-provider.js";
+import type { SimCognitoUserPool } from "../user-pool/sim-cognito-user-pool.js";
+/**
+ * The simulated Cognito scope that owns a pool.
+ *
+ * The Account comes from the pool's ARN and the Region from its id, and each
+ * scope's services are made once and kept, so this is the same service object
+ * that created the pool rather than another view of it. A served request finds
+ * the pool by id or by hostname, neither of which says which scope it came
+ * from, so this is how the serving layer gets back to it.
+ */
+export declare function simCognitoPoolScope(simAws: SimAws, pool: SimCognitoUserPool): SimCognitoIdentityProvider;
+//# sourceMappingURL=sim-cognito-pool-scope.d.ts.map

package/dist/service/cognito/serve/sim-cognito-pool-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-scope.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-pool-scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAEhF;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,GACvB,0BAA0B,CAK5B"}

package/dist/service/cognito/serve/sim-cognito-pool-scope.js

@@ -0,0 +1,17 @@
+import { simCognitoUserPoolRegionName } from "../user-pool/sim-cognito-user-pool-id.js";
+/**
+ * The simulated Cognito scope that owns a pool.
+ *
+ * The Account comes from the pool's ARN and the Region from its id, and each
+ * scope's services are made once and kept, so this is the same service object
+ * that created the pool rather than another view of it. A served request finds
+ * the pool by id or by hostname, neither of which says which scope it came
+ * from, so this is how the serving layer gets back to it.
+ */
+export function simCognitoPoolScope(simAws, pool) {
+    return simAws
+        .account(pool.arn.accountId)
+        .region(simCognitoUserPoolRegionName(pool.id))
+        .cognitoIdentityProvider();
+}
+//# sourceMappingURL=sim-cognito-pool-scope.js.map

package/dist/service/cognito/serve/sim-cognito-pool-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-scope.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-pool-scope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAGxF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,IAAwB;IAExB,OAAO,MAAM;SACV,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;SAC3B,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAkB,CAAC;SAC9D,uBAAuB,EAAE,CAAC;AAC/B,CAAC"}

package/dist/service/cognito/serve/sim-cognito-session-cookie.d.ts

@@ -0,0 +1,25 @@
+import type { SimCognitoSessionChange } from "../command/hosted/sim-cognito-session-change.js";
+/**
+ * The `cognito` cookie a browser carries its managed login session in.
+ *
+ * Reading it is what tells a returning browser from a new one, and setting it
+ * is what makes the browser return. Both sit in the serving layer, because the
+ * endpoints behind it take the session as a value and know nothing about
+ * cookies.
+ */
+export declare class SimCognitoSessionCookie {
+    /**
+     * The managed login session a request carried, where it carried one.
+     */
+    read(request: Request): string | undefined;
+    /**
+     * The `Set-Cookie` header a response carries, where the request changed the
+     * browser's session.
+     *
+     * A sign-in the session itself answered sets nothing. Real Cognito leaves
+     * the hour where the sign-in that started it put the hour, so a returning
+     * browser keeps the cookie it already has.
+     */
+    headerFor(change: SimCognitoSessionChange): string | undefined;
+}
+//# sourceMappingURL=sim-cognito-session-cookie.d.ts.map

package/dist/service/cognito/serve/sim-cognito-session-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-session-cookie.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-session-cookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAsB/F;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAoBzC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,GAAG,SAAS,CAU7D;CACF"}

package/dist/service/cognito/serve/sim-cognito-session-cookie.js

@@ -0,0 +1,64 @@
+/**
+ * The name real managed login gives its session cookie.
+ */
+const cookieName = "cognito";
+/**
+ * How long the browser holds the cookie, which is the hour real Cognito gives
+ * a managed login session.
+ */
+const cookieSeconds = 3600;
+/**
+ * The attributes every form of the cookie carries.
+ *
+ * Real Cognito sets this cookie `Secure`, and this simulation leaves that off,
+ * because a user pool domain is served over http on localhost and a browser
+ * sends a `Secure` cookie back over https alone.
+ */
+const cookieAttributes = "Path=/; HttpOnly; SameSite=Lax";
+/**
+ * The `cognito` cookie a browser carries its managed login session in.
+ *
+ * Reading it is what tells a returning browser from a new one, and setting it
+ * is what makes the browser return. Both sit in the serving layer, because the
+ * endpoints behind it take the session as a value and know nothing about
+ * cookies.
+ */
+export class SimCognitoSessionCookie {
+    /**
+     * The managed login session a request carried, where it carried one.
+     */
+    read(request) {
+        const header = request.headers.get("cookie");
+        if (header === null) {
+            return undefined;
+        }
+        for (const pair of header.split(";")) {
+            const separator = pair.indexOf("=");
+            if (separator === -1) {
+                continue;
+            }
+            if (pair.slice(0, separator).trim() === cookieName) {
+                return pair.slice(separator + 1).trim();
+            }
+        }
+        return undefined;
+    }
+    /**
+     * The `Set-Cookie` header a response carries, where the request changed the
+     * browser's session.
+     *
+     * A sign-in the session itself answered sets nothing. Real Cognito leaves
+     * the hour where the sign-in that started it put the hour, so a returning
+     * browser keeps the cookie it already has.
+     */
+    headerFor(change) {
+        if (change.startedSession !== undefined) {
+            return `${cookieName}=${change.startedSession}; ${cookieAttributes}; Max-Age=${String(cookieSeconds)}`;
+        }
+        if (change.endsSession) {
+            return `${cookieName}=; ${cookieAttributes}; Max-Age=0`;
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=sim-cognito-session-cookie.js.map

package/dist/service/cognito/serve/sim-cognito-session-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-session-cookie.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-session-cookie.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B;;;GAGG;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACH,IAAI,CAAC,OAAgB;QACnB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEpC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,MAA+B;QACvC,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,GAAG,UAAU,IAAI,MAAM,CAAC,cAAc,KAAK,gBAAgB,aAAa,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACzG,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,GAAG,UAAU,MAAM,gBAAgB,aAAa,CAAC;QAC1D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.d.ts

@@ -0,0 +1,32 @@
+import { type SimWafInspected } from "../../wafv2/association/sim-waf-request-inspection.js";
+import type { SimCognitoIdentityProvider } from "../sim-cognito-identity-provider.js";
+import type { SimCognitoUserPool } from "../user-pool/sim-cognito-user-pool.js";
+interface SimCognitoInspectionInput {
+    readonly pool: SimCognitoUserPool;
+    /** The simulated Cognito scope the pool belongs to. */
+    readonly cognito: SimCognitoIdentityProvider;
+    readonly request: Request;
+}
+/**
+ * Puts a request to the web ACL in front of the pool it reached.
+ *
+ * This runs before the endpoint the request named answers it, so a blocked
+ * request gets 403 and the endpoint does not run. Everything the pool serves
+ * over HTTP goes through it, which is what real AWS WAF covers: managed login,
+ * the classic hosted UI and the pool's own OIDC documents.
+ *
+ * The body is not forwarded. Cognito sends AWS WAF the headers and the path of
+ * a managed login request and none of its body, so a rule inspecting the body
+ * matches nothing at a hosted domain, however well formed it is. Body rules do
+ * reach the user pool API operations, which arrive here as SDK Commands rather
+ * than as HTTP requests and carry no web ACL evaluation at all.
+ */
+export declare class SimCognitoWebAclInspection {
+    private readonly inspection;
+    /**
+     * Put one request to whatever protects the pool it addressed.
+     */
+    inspect(input: SimCognitoInspectionInput): Promise<SimWafInspected>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-web-acl-inspection.d.ts.map

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-acl-inspection.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-web-acl-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EAErB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,UAAU,yBAAyB;IACjC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAElC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAE5D;;OAEG;IACG,OAAO,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,eAAe,CAAC,CAOxE;CACF"}

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.js

@@ -0,0 +1,30 @@
+import { SimWafRequestInspection, } from "../../wafv2/association/sim-waf-request-inspection.js";
+/**
+ * Puts a request to the web ACL in front of the pool it reached.
+ *
+ * This runs before the endpoint the request named answers it, so a blocked
+ * request gets 403 and the endpoint does not run. Everything the pool serves
+ * over HTTP goes through it, which is what real AWS WAF covers: managed login,
+ * the classic hosted UI and the pool's own OIDC documents.
+ *
+ * The body is not forwarded. Cognito sends AWS WAF the headers and the path of
+ * a managed login request and none of its body, so a rule inspecting the body
+ * matches nothing at a hosted domain, however well formed it is. Body rules do
+ * reach the user pool API operations, which arrive here as SDK Commands rather
+ * than as HTTP requests and carry no web ACL evaluation at all.
+ */
+export class SimCognitoWebAclInspection {
+    inspection = new SimWafRequestInspection();
+    /**
+     * Put one request to whatever protects the pool it addressed.
+     */
+    async inspect(input) {
+        return await this.inspection.inspect({
+            protection: input.cognito.webAcls(),
+            resourceArn: input.pool.arn.value,
+            request: input.request,
+            forwardBody: false,
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-web-acl-inspection.js.map

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-acl-inspection.js","sourceRoot":"","sources":["../../../../src/service/cognito/serve/sim-cognito-web-acl-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,uDAAuD,CAAC;AAa/D;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,0BAA0B;IACpB,UAAU,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE5D;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,KAAgC;QAC5C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACnC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE;YACnC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/sim-cognito-federation.d.ts

@@ -60,15 +60,23 @@ export declare abstract class SimCognitoFederation extends SimCognitoUserDirecto
      *
      * The answer is where the browser goes next, which for a request that signs
      * a user in is the app client's callback URL carrying an authorization code.
+     *
+     * `presentedSession` is the managed login session the browser holds, which a
+     * served request carries in the `cognito` cookie. Passing one signs the
+     * browser in without credentials, the way real managed login answers a
+     * browser it recognises.
      */
-    hostedAuthorize(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput): Promise<SimCognitoHostedRedirect>;
+    hostedAuthorize(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput, presentedSession?: string): Promise<SimCognitoHostedRedirect>;
     /**
      * Handle a request to a pool's `/oauth2/token` endpoint.
      */
     hostedToken(pool: SimCognitoUserPool, input: SimCognitoTokenInput): Promise<SimCognitoTokenOutput>;
     /**
      * Handle a request to a pool's `/logout` endpoint.
+     *
+     * `presentedSession` is the managed login session the browser holds. Ending
+     * it is what makes the next authorize request ask for a password again.
      */
-    hostedSignOut(pool: SimCognitoUserPool, input: SimCognitoLogoutInput): Promise<SimCognitoHostedRedirect>;
+    hostedSignOut(pool: SimCognitoUserPool, input: SimCognitoLogoutInput, presentedSession?: string): Promise<SimCognitoHostedRedirect>;
 }
 //# sourceMappingURL=sim-cognito-federation.d.ts.map

package/dist/service/cognito/sim-cognito-federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-federation.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,KAAK,wCAAwC,EAC9C,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,8BAA8B;IACtC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,8BAAsB,oBAAqB,SAAQ,uBAAuB;IACxE,SAAS,aAAa,UAAU,EAAE,8BAA8B,EAE/D;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,kBAAkB,CAAC,kCAAkC,EAC9D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,wCAAwC,CAAC,CAGtE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,qBAAqB,CACzB,OAAO,EAAE,kBAAkB,CAAC,+BAA+B,EAC3D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAGnE;IAED;;;;;OAKG;IACG,eAAe,CACnB,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAGnC;IAED;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAGhC;IAED;;OAEG;IACG,aAAa,CACjB,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,wBAAwB,CAAC,CAGnC;CACF"}
+{"version":3,"file":"sim-cognito-federation.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,KAAK,wCAAwC,EAC9C,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,8BAA8B;IACtC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,8BAAsB,oBAAqB,SAAQ,uBAAuB;IACxE,SAAS,aAAa,UAAU,EAAE,8BAA8B,EAE/D;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,kBAAkB,CAAC,kCAAkC,EAC9D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,wCAAwC,CAAC,CAGtE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,qBAAqB,CACzB,OAAO,EAAE,kBAAkB,CAAC,+BAA+B,EAC3D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAGnE;IAED;;;;;;;;;;OAUG;IACG,eAAe,CACnB,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAGnC;IAED;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAGhC;IAED;;;;;OAKG;IACG,aAAa,CACjB,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,qBAAqB,EAC5B,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAGnC;CACF"}

package/dist/service/cognito/sim-cognito-federation.js

@@ -76,10 +76,15 @@ export class SimCognitoFederation extends SimCognitoUserDirectory {
      *
      * The answer is where the browser goes next, which for a request that signs
      * a user in is the app client's callback URL carrying an authorization code.
+     *
+     * `presentedSession` is the managed login session the browser holds, which a
+     * served request carries in the `cognito` cookie. Passing one signs the
+     * browser in without credentials, the way real managed login answers a
+     * browser it recognises.
      */
-    async hostedAuthorize(pool, input) {
+    async hostedAuthorize(pool, input, presentedSession) {
         await this.background.sequence();
-        return this.commands.hosted.authorize.handle(pool, input);
+        return this.commands.hosted.authorize.handle(pool, input, presentedSession);
     }
     /**
      * Handle a request to a pool's `/oauth2/token` endpoint.
@@ -90,10 +95,13 @@ export class SimCognitoFederation extends SimCognitoUserDirectory {
     }
     /**
      * Handle a request to a pool's `/logout` endpoint.
+     *
+     * `presentedSession` is the managed login session the browser holds. Ending
+     * it is what makes the next authorize request ask for a password again.
      */
-    async hostedSignOut(pool, input) {
+    async hostedSignOut(pool, input, presentedSession) {
         await this.background.sequence();
-        return this.commands.hosted.logout.handle(pool, input);
+        return this.commands.hosted.logout.handle(pool, input, presentedSession);
     }
 }
 //# sourceMappingURL=sim-cognito-federation.js.map

package/dist/service/cognito/sim-cognito-federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-federation.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-federation.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AAUzC;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,oBAAqB,SAAQ,uBAAuB;IACxE,YAAsB,UAA0C;QAC9D,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAA8D,EAC9D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAA2D,EAC3D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,IAAwB,EACxB,KAA+B;QAE/B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,IAAwB,EACxB,KAA2B;QAE3B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,IAAwB,EACxB,KAA4B;QAE5B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-federation.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-federation.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AAUzC;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,oBAAqB,SAAQ,uBAAuB;IACxE,YAAsB,UAA0C;QAC9D,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAA8D,EAC9D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAA2D,EAC3D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,IAAwB,EACxB,KAA+B,EAC/B,gBAAyB;QAEzB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,IAAwB,EACxB,KAA2B;QAE3B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,IAAwB,EACxB,KAA4B,EAC5B,gBAAyB;QAEzB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/cognito/sim-cognito-identity-provider.d.ts

@@ -2,12 +2,11 @@ import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { type SimWafProtection } from "../wafv2/association/sim-waf-protection.js";
 import { SimCognitoCfnResourceFactory } from "./cfn/sim-cfn-cognito-resource-factory.js";
-import type * as simCognitoCommands from "./command/sim-cognito-command.types.js";
 import { SimCognitoDomainRegistry } from "./registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "./registry/sim-cognito-user-pool-registry.js";
-import { SimCognitoAppClients } from "./sim-cognito-app-clients.js";
-import type { SimCognitoIdentityProviderRequestOptions } from "./sim-cognito-user-directory.js";
+import { SimCognitoUserPools } from "./sim-cognito-user-pools.js";
 import type { SimCognitoUserPoolClient } from "./user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPoolDomain } from "./user-pool/domain/sim-cognito-user-pool-domain.js";
 import type { SimCognitoUserPoolClientRegistration, SimCognitoUserPoolRegistration } from "./user-pool/sim-cognito-registration.types.js";
@@ -37,6 +36,12 @@ interface SimCognitoIdentityProviderProperties {
      * ARN, and that ARN can name any Account and Region.
      */
     readonly triggerFunctions?: SimCognitoTriggerFunctions;
+    /**
+     * The web ACLs this scope's pools can be protected by. A standalone
+     * simulated Cognito has none, so a hosted domain serves the requests it
+     * always did.
+     */
+    readonly webAcls?: SimWafProtection;
 }
 /**
  * Simulated Cognito user pools. Handles SDK commands. Emulates AWS behaviour
@@ -54,7 +59,7 @@ interface SimCognitoIdentityProviderProperties {
  * Only user pools are simulated. Cognito identity pools, which hand out AWS
  * credentials, are a different service and are not simulated at all.
  */
-export declare class SimCognitoIdentityProvider extends SimCognitoAppClients {
+export declare class SimCognitoIdentityProvider extends SimCognitoUserPools {
     private readonly pools;
     private readonly userPoolRegistry;
     private readonly domainRegistry;
@@ -115,37 +120,14 @@ export declare class SimCognitoIdentityProvider extends SimCognitoAppClients {
      */
     registerUserPoolClient(registration: SimCognitoUserPoolClientRegistration): SimCognitoUserPoolClient;
     /**
-     * Handle a CreateUserPool Command from the SDK.
-     */
-    createUserPool(command: simCognitoCommands.SimCreateUserPoolCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimCreateUserPoolCommandOutput>;
-    /**
-     * Handle a DescribeUserPool Command from the SDK.
-     */
-    describeUserPool(command: simCognitoCommands.SimDescribeUserPoolCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimDescribeUserPoolCommandOutput>;
-    /**
-     * Handle an UpdateUserPool Command from the SDK.
-     */
-    updateUserPool(command: simCognitoCommands.SimUpdateUserPoolCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimUpdateUserPoolCommandOutput>;
-    /**
-     * Handle a DeleteUserPool Command from the SDK.
-     */
-    deleteUserPool(command: simCognitoCommands.SimDeleteUserPoolCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimDeleteUserPoolCommandOutput>;
-    /**
-     * Handle a SetUserPoolMfaConfig Command from the SDK.
+     * The web ACLs in front of this scope's pools, as a served request sees
+     * them.
      *
-     * This is the second call real CloudFormation makes when a template declares
-     * a pool with MFA, and the only place the factors behind an `MfaConfiguration`
-     * are set.
-     */
-    setUserPoolMfaConfig(command: simCognitoCommands.SimSetUserPoolMfaConfigCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimSetUserPoolMfaConfigCommandOutput>;
-    /**
-     * Handle a GetUserPoolMfaConfig Command from the SDK.
-     */
-    getUserPoolMfaConfig(command: simCognitoCommands.SimGetUserPoolMfaConfigCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimGetUserPoolMfaConfigCommandOutput>;
-    /**
-     * Handle a ListUserPools Command from the SDK.
+     * The simulator's own accessor rather than a Cognito operation: a request to
+     * a pool's hosted domain is served without a Command, so this is how the
+     * serving layer reaches whatever a web ACL decided about it.
      */
-    listUserPools(command: simCognitoCommands.SimListUserPoolsCommand, options?: SimCognitoIdentityProviderRequestOptions): Promise<simCognitoCommands.SimListUserPoolsCommandOutput>;
+    webAcls(): SimWafProtection;
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/cognito/sim-cognito-identity-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-identity-provider.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAE1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC/B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAM/E,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sDAAsD,CAAC;AAE9D,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAEvD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAEnD;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;CACxD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,0BAA2B,SAAQ,oBAAoB;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;IAEH,YAAY,UAAU,GAAE,oCAAyC,EA6BhE;IAED;;;;;;OAMG;IACH,8BAA8B,CAC5B,WAAW,EAAE,MAAM,GAClB,wBAAwB,GAAG,SAAS,CAEtC;IAED;;;;;;;OAOG;IACH,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE3E;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE/D;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAE/C;IAED;;;;;;;;;;;;OAYG;IACH,gBAAgB,CACd,YAAY,EAAE,8BAA8B,GAC3C,kBAAkB,CAEpB;IAED;;;;;;OAMG;IACH,sBAAsB,CACpB,YAAY,EAAE,oCAAoC,GACjD,wBAAwB,CAE1B;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,kBAAkB,CAAC,0BAA0B,EACtD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAG9D;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;;;;;OAMG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,kBAAkB,CAAC,uBAAuB,EACnD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAG3D;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}
+{"version":3,"file":"sim-cognito-identity-provider.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAE1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC/B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAM/E,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sDAAsD,CAAC;AAE9D,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAEvD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAEnD;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAEvD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;IAEH,YAAY,UAAU,GAAE,oCAAyC,EA+BhE;IAED;;;;;;OAMG;IACH,8BAA8B,CAC5B,WAAW,EAAE,MAAM,GAClB,wBAAwB,GAAG,SAAS,CAEtC;IAED;;;;;;;OAOG;IACH,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE3E;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE/D;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAE/C;IAED;;;;;;;;;;;;OAYG;IACH,gBAAgB,CACd,YAAY,EAAE,8BAA8B,GAC3C,kBAAkB,CAEpB;IAED;;;;;;OAMG;IACH,sBAAsB,CACpB,YAAY,EAAE,oCAAoC,GACjD,wBAAwB,CAE1B;IAED;;;;;;;OAOG;IACH,OAAO,IAAI,gBAAgB,CAE1B;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}

package/dist/service/cognito/sim-cognito-identity-provider.js

@@ -1,12 +1,13 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimWafNoProtection, } from "../wafv2/association/sim-waf-protection.js";
 import { SimCognitoCfnResourceFactory } from "./cfn/sim-cfn-cognito-resource-factory.js";
 import { SimCognitoCommands } from "./command/sim-cognito-commands.js";
 import { SimCognitoDomainRegistry } from "./registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "./registry/sim-cognito-user-pool-registry.js";
 import { SimCognitoSdkCommandRouter } from "./sdk/sim-cognito-sdk-command-router.js";
-import { SimCognitoAppClients } from "./sim-cognito-app-clients.js";
+import { SimCognitoUserPools } from "./sim-cognito-user-pools.js";
 import { requireSimCognitoUserPoolId, } from "./user-pool/sim-cognito-user-pool-id.js";
 import { SimCognitoUserPoolStore } from "./user-pool/sim-cognito-user-pool-store.js";
 import { SimCognitoNoTriggerFunctions, } from "./user-pool/trigger/sim-cognito-trigger-functions.js";
@@ -26,7 +27,7 @@ import { SimCognitoNoTriggerFunctions, } from "./user-pool/trigger/sim-cognito-t
  * Only user pools are simulated. Cognito identity pools, which hand out AWS
  * credentials, are a different service and are not simulated at all.
  */
-export class SimCognitoIdentityProvider extends SimCognitoAppClients {
+export class SimCognitoIdentityProvider extends SimCognitoUserPools {
     pools;
     userPoolRegistry;
     domainRegistry;
@@ -35,7 +36,7 @@ export class SimCognitoIdentityProvider extends SimCognitoAppClients {
         cognito: this,
     });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), userPoolRegistry = new SimCognitoUserPoolRegistry(), domainRegistry = new SimCognitoDomainRegistry(), triggerFunctions = new SimCognitoNoTriggerFunctions(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), userPoolRegistry = new SimCognitoUserPoolRegistry(), domainRegistry = new SimCognitoDomainRegistry(), triggerFunctions = new SimCognitoNoTriggerFunctions(), webAcls = new SimWafNoProtection(), } = properties;
         const pools = new SimCognitoUserPoolStore({
             registry: userPoolRegistry,
             domains: domainRegistry,
@@ -48,6 +49,7 @@ export class SimCognitoIdentityProvider extends SimCognitoAppClients {
                 pools,
                 domains: domainRegistry,
                 triggerFunctions,
+                webAcls,
             }),
             background,
         });
@@ -121,57 +123,15 @@ export class SimCognitoIdentityProvider extends SimCognitoAppClients {
         return this.commands.registrations.userPoolClient(registration);
     }
     /**
-     * Handle a CreateUserPool Command from the SDK.
-     */
-    async createUserPool(command, options) {
-        await this.background.sequence();
-        return this.commands.userPools.create(command, options);
-    }
-    /**
-     * Handle a DescribeUserPool Command from the SDK.
-     */
-    async describeUserPool(command, options) {
-        await this.background.sequence();
-        return this.commands.userPools.describe(command, options);
-    }
-    /**
-     * Handle an UpdateUserPool Command from the SDK.
-     */
-    async updateUserPool(command, options) {
-        await this.background.sequence();
-        return this.commands.userPools.update(command, options);
-    }
-    /**
-     * Handle a DeleteUserPool Command from the SDK.
-     */
-    async deleteUserPool(command, options) {
-        await this.background.sequence();
-        return this.commands.userPools.delete(command, options);
-    }
-    /**
-     * Handle a SetUserPoolMfaConfig Command from the SDK.
+     * The web ACLs in front of this scope's pools, as a served request sees
+     * them.
      *
-     * This is the second call real CloudFormation makes when a template declares
-     * a pool with MFA, and the only place the factors behind an `MfaConfiguration`
-     * are set.
-     */
-    async setUserPoolMfaConfig(command, options) {
-        await this.background.sequence();
-        return this.commands.userPoolMfa.set(command, options);
-    }
-    /**
-     * Handle a GetUserPoolMfaConfig Command from the SDK.
-     */
-    async getUserPoolMfaConfig(command, options) {
-        await this.background.sequence();
-        return this.commands.userPoolMfa.get(command, options);
-    }
-    /**
-     * Handle a ListUserPools Command from the SDK.
+     * The simulator's own accessor rather than a Cognito operation: a request to
+     * a pool's hosted domain is served without a Command, so this is how the
+     * serving layer reaches whatever a web ACL decided about it.
      */
-    async listUserPools(command, options) {
-        await this.background.sequence();
-        return this.commands.listUserPools.handle(command, options);
+    webAcls() {
+        return this.commands.webAcls;
     }
     /**
      * Get this service's CloudFormation Resource factory.