@kensio/yulin 1.18.0 → 1.18.2

package/dist/service/cognito/sim-cognito-authentication.js

@@ -48,6 +48,17 @@ export class SimCognitoAuthentication {
         await this.background.sequence();
         return this.commands.auth.respondToChallenge.handle(command);
     }
+    /**
+     * Handle a GetTokensFromRefreshToken Command from the SDK.
+     *
+     * No caller is read, because real Cognito authorizes this operation with no
+     * IAM policy at all: it is what an application calls to renew a session, and
+     * the refresh token and the client secret are what it is checked against.
+     */
+    async getTokensFromRefreshToken(command) {
+        await this.background.sequence();
+        return this.commands.auth.getTokensFromRefreshToken.handle(command);
+    }
     /**
      * Handle a GlobalSignOut Command from the SDK.
      *

package/dist/service/cognito/sim-cognito-authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authentication.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-authentication.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,wBAAwB;IACzB,QAAQ,CAAqB;IAC7B,UAAU,CAAsB;IAEnD,YAAsB,UAA8C;QAClE,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAuD,EACvD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,2BAA2B,CAC/B,OAAiE,EACjE,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,OAAmD;QAEnD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-authentication.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-authentication.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,wBAAwB;IACzB,QAAQ,CAAqB;IAC7B,UAAU,CAAsB;IAEnD,YAAsB,UAA8C;QAClE,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAuD,EACvD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,2BAA2B,CAC/B,OAAiE,EACjE,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,yBAAyB,CAC7B,OAA+D;QAE/D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,OAAmD;QAEnD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts

@@ -27,6 +27,15 @@ export declare class SimCognitoIssuedTokenStore {
      * Remember a refresh token, so it can be exchanged later.
      */
     addRefreshToken(token: SimCognitoIssuedToken): void;
+    /**
+     * Stop honouring a refresh token from a moment on, because a rotation has
+     * replaced it.
+     *
+     * The moment is the end of the app client's retry grace period rather than
+     * now, so a client that retried a request whose answer it never saw is
+     * answered with the tokens instead of being sent back to the sign-in page.
+     */
+    revokeRefreshTokenAt(token: SimCognitoIssuedToken, revokedAt: Date): void;
     /**
      * Remember an access token, so a sign-out can be authorized with it.
      */
@@ -36,7 +45,8 @@ export declare class SimCognitoIssuedTokenStore {
      *
      * A token this pool never issued, one belonging to another app client, one
      * that has run out, and one the user has been signed out of all fail the
-     * same way, as they do on real Cognito.
+     * same way, as they do on real Cognito. A rotated-out token whose grace
+     * period is up is refused as a revoked one, which is what it now is.
      */
     requireRefreshToken(request: SimCognitoRefreshTokenRequest): SimCognitoIssuedToken;
     /**

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAYvB;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAMnC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAExE;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAkBvB;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAMnC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js

@@ -28,9 +28,20 @@ export class SimCognitoIssuedTokenStore {
      * Remember a refresh token, so it can be exchanged later.
      */
     addRefreshToken(token) {
-        SimCognitoIssuedTokenStore.forgetSpent(this.refreshTokens, (issued) => issued.isExpiredAt(token.issuedAt));
+        SimCognitoIssuedTokenStore.forgetSpent(this.refreshTokens, (issued) => issued.isSpentAt(token.issuedAt));
         this.refreshTokens.set(token.value, token);
     }
+    /**
+     * Stop honouring a refresh token from a moment on, because a rotation has
+     * replaced it.
+     *
+     * The moment is the end of the app client's retry grace period rather than
+     * now, so a client that retried a request whose answer it never saw is
+     * answered with the tokens instead of being sent back to the sign-in page.
+     */
+    revokeRefreshTokenAt(token, revokedAt) {
+        this.refreshTokens.set(token.value, token.rotatedOutAt(revokedAt));
+    }
     /**
      * Remember an access token, so a sign-out can be authorized with it.
      */
@@ -43,7 +54,8 @@ export class SimCognitoIssuedTokenStore {
      *
      * A token this pool never issued, one belonging to another app client, one
      * that has run out, and one the user has been signed out of all fail the
-     * same way, as they do on real Cognito.
+     * same way, as they do on real Cognito. A rotated-out token whose grace
+     * period is up is refused as a revoked one, which is what it now is.
      */
     requireRefreshToken(request) {
         const issued = this.refreshTokens.get(request.value);
@@ -53,6 +65,9 @@ export class SimCognitoIssuedTokenStore {
         if (issued.isExpiredAt(request.now)) {
             throw new SimCognitoNotAuthorizedException("Refresh Token has expired.");
         }
+        if (issued.isRevokedAt(request.now)) {
+            throw new SimCognitoNotAuthorizedException("Refresh Token has been revoked.");
+        }
         return issued;
     }
     /**

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAA4B,EAAE,SAAe;QAChE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CACxC,iCAAiC,CAClC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts

@@ -9,6 +9,12 @@ interface SimCognitoIssuedTokenProperties {
      * gives the tokens it hands out next.
      */
     readonly scopes?: readonly string[] | undefined;
+    /**
+     * When this token stops being honoured, where something has spent it before
+     * its expiry. A refresh token that has been rotated out has one, set to the
+     * end of the app client's retry grace period.
+     */
+    readonly revokedAt?: Date | undefined;
 }
 /**
  * One token a pool has issued, as the pool remembers it.
@@ -30,6 +36,11 @@ export declare class SimCognitoIssuedToken {
      * none of: the scope of one of those is settled where the token is signed.
      */
     readonly scopes: readonly string[];
+    /**
+     * When a rotated-out refresh token stops working, which is undefined for
+     * every token nothing has replaced.
+     */
+    readonly revokedAt: Date | undefined;
     constructor(properties: SimCognitoIssuedTokenProperties);
     /**
      * Whether this token may act on the user it was issued to.
@@ -45,6 +56,31 @@ export declare class SimCognitoIssuedToken {
      * Whether this token has run out by a given moment.
      */
     isExpiredAt(now: Date): boolean;
+    /**
+     * Whether this token has been spent by a rotation that replaced it.
+     */
+    isRevokedAt(now: Date): boolean;
+    /**
+     * Whether this token is worth remembering any longer.
+     */
+    isSpentAt(now: Date): boolean;
+    /**
+     * This token as it is once a rotation has replaced it.
+     *
+     * It goes on working until the app client's retry grace period is up, so a
+     * client retrying a request whose answer it never saw is answered rather
+     * than signed out. A token already rotated out keeps the window it was
+     * given, so retrying inside the grace period does not extend it.
+     */
+    rotatedOutAt(revokedAt: Date): SimCognitoIssuedToken;
+    /**
+     * The token that replaces this one when a rotation spends it.
+     *
+     * The replacement runs out when this token would have, rather than starting
+     * a fresh `RefreshTokenValidity`, which is what real Cognito does: rotating
+     * a session cannot extend it indefinitely.
+     */
+    replacedBy(value: string, issuedAt: Date): SimCognitoIssuedToken;
     /**
      * Whether this token was issued to an app client.
      *
@@ -52,6 +88,11 @@ export declare class SimCognitoIssuedToken {
      * another client fails, as it does on real Cognito.
      */
     isFor(clientId: string): boolean;
+    /**
+     * What this token is made of, so a copy of it can be made with one part
+     * changed.
+     */
+    private parts;
 }
 export {};
 //# sourceMappingURL=sim-cognito-issued-token.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAEA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC;;;OAGG;IACH,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,UAAU,EAAE,+BAA+B,EAOtD;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW,IAAI,OAAO,CAKzB;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAEA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAEhD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC;;;OAGG;IACH,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C;;;OAGG;IACH,SAAgB,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;IAE5C,YAAY,UAAU,EAAE,+BAA+B,EAQtD;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW,IAAI,OAAO,CAKzB;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE5B;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,IAAI,GAAG,qBAAqB,CAMnD;IAED;;;;;;OAMG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,qBAAqB,CAO/D;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;CAWd"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js

@@ -19,6 +19,11 @@ export class SimCognitoIssuedToken {
      * none of: the scope of one of those is settled where the token is signed.
      */
     scopes;
+    /**
+     * When a rotated-out refresh token stops working, which is undefined for
+     * every token nothing has replaced.
+     */
+    revokedAt;
     constructor(properties) {
         this.value = properties.value;
         this.username = properties.username;
@@ -26,6 +31,7 @@ export class SimCognitoIssuedToken {
         this.issuedAt = properties.issuedAt;
         this.expiresAt = properties.expiresAt;
         this.scopes = properties.scopes ?? [];
+        this.revokedAt = properties.revokedAt;
     }
     /**
      * Whether this token may act on the user it was issued to.
@@ -46,6 +52,47 @@ export class SimCognitoIssuedToken {
     isExpiredAt(now) {
         return now.getTime() >= this.expiresAt.getTime();
     }
+    /**
+     * Whether this token has been spent by a rotation that replaced it.
+     */
+    isRevokedAt(now) {
+        return this.revokedAt !== undefined && now >= this.revokedAt;
+    }
+    /**
+     * Whether this token is worth remembering any longer.
+     */
+    isSpentAt(now) {
+        return this.isExpiredAt(now) || this.isRevokedAt(now);
+    }
+    /**
+     * This token as it is once a rotation has replaced it.
+     *
+     * It goes on working until the app client's retry grace period is up, so a
+     * client retrying a request whose answer it never saw is answered rather
+     * than signed out. A token already rotated out keeps the window it was
+     * given, so retrying inside the grace period does not extend it.
+     */
+    rotatedOutAt(revokedAt) {
+        if (this.revokedAt !== undefined) {
+            return this;
+        }
+        return new SimCognitoIssuedToken({ ...this.parts(), revokedAt });
+    }
+    /**
+     * The token that replaces this one when a rotation spends it.
+     *
+     * The replacement runs out when this token would have, rather than starting
+     * a fresh `RefreshTokenValidity`, which is what real Cognito does: rotating
+     * a session cannot extend it indefinitely.
+     */
+    replacedBy(value, issuedAt) {
+        return new SimCognitoIssuedToken({
+            ...this.parts(),
+            value,
+            issuedAt,
+            revokedAt: undefined,
+        });
+    }
     /**
      * Whether this token was issued to an app client.
      *
@@ -55,5 +102,20 @@ export class SimCognitoIssuedToken {
     isFor(clientId) {
         return this.clientId === clientId;
     }
+    /**
+     * What this token is made of, so a copy of it can be made with one part
+     * changed.
+     */
+    parts() {
+        return {
+            value: this.value,
+            username: this.username,
+            clientId: this.clientId,
+            issuedAt: this.issuedAt,
+            expiresAt: this.expiresAt,
+            scopes: this.scopes,
+            revokedAt: this.revokedAt,
+        };
+    }
 }
 //# sourceMappingURL=sim-cognito-issued-token.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAgBpF;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC;;;OAGG;IACa,MAAM,CAAoB;IAE1C,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW;QACb,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CACnD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAuBpF;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC;;;OAGG;IACa,MAAM,CAAoB;IAE1C;;;OAGG;IACa,SAAS,CAAmB;IAE5C,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW;QACb,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CACnD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAS;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,SAAe;QAC1B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,qBAAqB,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,KAAa,EAAE,QAAc;QACtC,OAAO,IAAI,qBAAqB,CAAC;YAC/B,GAAG,IAAI,CAAC,KAAK,EAAE;YACf,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;IAED;;;OAGG;IACK,KAAK;QACX,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts

@@ -70,6 +70,11 @@ export declare class SimCognitoPoolAuth {
      * Remember a refresh token this pool has issued.
      */
     addRefreshToken(token: SimCognitoIssuedToken): void;
+    /**
+     * Stop honouring a refresh token from a moment on, because a rotation has
+     * replaced it.
+     */
+    revokeRefreshTokenAt(token: SimCognitoIssuedToken, revokedAt: Date): void;
     /**
      * Remember an access token this pool has issued.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;;IAC7B;;OAEG;IACH,SAAgB,iBAAiB,kCAAyC;IAE1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IACzE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAI3D;;;;;OAKG;IACH,IAAI,MAAM,IAAI,wBAAwB,GAAG,SAAS,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAEzC;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,IAAI,CAEnE;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,6BAA6B,GAAG,SAAS,CAE3C;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEtD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;;IAC7B;;OAEG;IACH,SAAgB,iBAAiB,kCAAyC;IAE1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IACzE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAI3D;;;;;OAKG;IACH,IAAI,MAAM,IAAI,wBAAwB,GAAG,SAAS,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAEzC;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAExE;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,IAAI,CAEnE;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,6BAA6B,GAAG,SAAS,CAE3C;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEtD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js

@@ -85,6 +85,13 @@ export class SimCognitoPoolAuth {
     addRefreshToken(token) {
         this.tokens.addRefreshToken(token);
     }
+    /**
+     * Stop honouring a refresh token from a moment on, because a rotation has
+     * replaced it.
+     */
+    revokeRefreshTokenAt(token, revokedAt) {
+        this.tokens.revokeRefreshTokenAt(token, revokedAt);
+    }
     /**
      * Remember an access token this pool has issued.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAGhG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAG7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAClG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACa,iBAAiB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEzD,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,YAAY,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACxD,KAAK,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,OAAO,CAAuC;IAE9C;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAiC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAsC;QAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAyB;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAGhG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAG7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAClG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACa,iBAAiB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEzD,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,YAAY,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACxD,KAAK,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,OAAO,CAAuC;IAE9C;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAiC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,KAA4B,EAAE,SAAe;QAChE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAsC;QAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAyB;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-refresh-token-input.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Read the refresh token a request was made with, or refuse a request that
+ * carries none.
+ *
+ * `GetTokensFromRefreshToken` names the token in an input of its own rather
+ * than among `AuthParameters`, which is why this is not the check
+ * `REFRESH_TOKEN_AUTH` makes. It is required on real Cognito, so an empty one
+ * is as missing as an absent one.
+ */
+export declare function requireSimCognitoRefreshTokenInput(value: string | undefined): string;
+//# sourceMappingURL=sim-cognito-refresh-token-input.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-refresh-token-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-token-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-refresh-token-input.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAQR"}

package/dist/service/cognito/user-pool/auth/sim-cognito-refresh-token-input.js

@@ -0,0 +1,17 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * Read the refresh token a request was made with, or refuse a request that
+ * carries none.
+ *
+ * `GetTokensFromRefreshToken` names the token in an input of its own rather
+ * than among `AuthParameters`, which is why this is not the check
+ * `REFRESH_TOKEN_AUTH` makes. It is required on real Cognito, so an empty one
+ * is as missing as an absent one.
+ */
+export function requireSimCognitoRefreshTokenInput(value) {
+    if (value === undefined || value === "") {
+        throw new SimCognitoInvalidParameterException("Missing required parameter RefreshToken");
+    }
+    return value;
+}
+//# sourceMappingURL=sim-cognito-refresh-token-input.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-refresh-token-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-token-input.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-refresh-token-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;;;;;;GAQG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,mCAAmC,CAC3C,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/cognito/user-pool/auth/sim-cognito-refreshable-session.factory.d.ts

@@ -0,0 +1,61 @@
+import { AsyncMappedFactory } from "@kensio/part-factory";
+import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimCognitoRefreshTokenRotationType } from "../client/sim-cognito-refresh-token-rotation.js";
+/**
+ * What a test asks for when it wants a session it can renew.
+ */
+export interface SimCognitoRefreshableSessionInput {
+    readonly poolName: string;
+    readonly clientName: string;
+    readonly username: string;
+    readonly password: string;
+    /**
+     * The flows the app client allows. A rotating client is created without
+     * `ALLOW_REFRESH_TOKEN_AUTH`, which is what `aws-cdk-lib` synthesizes.
+     */
+    readonly explicitAuthFlows: readonly string[];
+    /**
+     * Whether the app client is a confidential one, whose requests have to carry
+     * its secret.
+     */
+    readonly generateSecret: boolean;
+    /**
+     * How long the refresh token lasts, in the app client's default unit of
+     * days. Left out, it lasts the thirty days Cognito gives one.
+     */
+    readonly refreshTokenValidity: number | undefined;
+    /**
+     * Whether the app client rotates its refresh tokens, and for how long it
+     * goes on honouring one it rotated out.
+     */
+    readonly refreshTokenRotation: SimCognitoRefreshTokenRotationType | undefined;
+}
+/**
+ * A pool, an app client, and a signed-in user holding a refresh token.
+ */
+export interface SimCognitoRefreshableSession {
+    readonly userPoolId: string;
+    readonly clientId: string;
+    /**
+     * The app client's secret, which only a client created with one has.
+     */
+    readonly clientSecret: string | undefined;
+    readonly username: string;
+    readonly refreshToken: string;
+}
+/**
+ * Signs a user in through a client-side sign-in and hands back the refresh
+ * token it was given.
+ *
+ * Four commands stand between a test and a refresh token, and a test about
+ * renewing a session is about none of them.
+ *
+ * ```typescript
+ * const session = await simCognitoRefreshableSessionFactory.make(
+ *   { refreshTokenRotation: { Feature: "ENABLED" } },
+ *   simAws,
+ * );
+ * ```
+ */
+export declare const simCognitoRefreshableSessionFactory: AsyncMappedFactory<SimCognitoRefreshableSessionInput, SimCognitoRefreshableSession, SimAws>;
+//# sourceMappingURL=sim-cognito-refreshable-session.factory.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-refreshable-session.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refreshable-session.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-refreshable-session.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AAG1G;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IAElD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,kCAAkC,GAAG,SAAS,CAAC;CAC/E;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mCAAmC,6FA6E/C,CAAC"}

package/dist/service/cognito/user-pool/auth/sim-cognito-refreshable-session.factory.js

@@ -0,0 +1,80 @@
+import { AsyncMappedFactory } from "@kensio/part-factory";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCognitoSecretHash } from "./sim-cognito-secret-hash.js";
+/**
+ * Signs a user in through a client-side sign-in and hands back the refresh
+ * token it was given.
+ *
+ * Four commands stand between a test and a refresh token, and a test about
+ * renewing a session is about none of them.
+ *
+ * ```typescript
+ * const session = await simCognitoRefreshableSessionFactory.make(
+ *   { refreshTokenRotation: { Feature: "ENABLED" } },
+ *   simAws,
+ * );
+ * ```
+ */
+export const simCognitoRefreshableSessionFactory = new AsyncMappedFactory(() => ({
+    poolName: "myapp-users",
+    clientName: "web",
+    username: "ada",
+    password: "Correct-horse-1",
+    explicitAuthFlows: ["ALLOW_USER_PASSWORD_AUTH", "ALLOW_REFRESH_TOKEN_AUTH"],
+    generateSecret: false,
+    refreshTokenValidity: undefined,
+    refreshTokenRotation: undefined,
+}), async (input, simAws) => {
+    const cognito = simAws.cognitoIdentityProvider();
+    const pool = await cognito.createUserPool({
+        input: { PoolName: input.poolName },
+    });
+    const userPoolId = pool.UserPool?.Id;
+    assertDefined(userPoolId, "the created sim Cognito user pool id");
+    const appClient = await cognito.createUserPoolClient({
+        input: {
+            UserPoolId: userPoolId,
+            ClientName: input.clientName,
+            ExplicitAuthFlows: input.explicitAuthFlows,
+            GenerateSecret: input.generateSecret,
+            RefreshTokenValidity: input.refreshTokenValidity,
+            RefreshTokenRotation: input.refreshTokenRotation,
+        },
+    });
+    const clientId = appClient.UserPoolClient?.ClientId;
+    assertDefined(clientId, "the created sim Cognito app client id");
+    await cognito.adminCreateUser({
+        input: { UserPoolId: userPoolId, Username: input.username },
+    });
+    await cognito.adminSetUserPassword({
+        input: {
+            UserPoolId: userPoolId,
+            Username: input.username,
+            Password: input.password,
+            Permanent: true,
+        },
+    });
+    const signedIn = await cognito.initiateAuth({
+        input: {
+            ClientId: clientId,
+            AuthFlow: "USER_PASSWORD_AUTH",
+            AuthParameters: {
+                USERNAME: input.username,
+                PASSWORD: input.password,
+                ...(appClient.UserPoolClient?.ClientSecret !== undefined && {
+                    SECRET_HASH: simCognitoSecretHash(input.username, clientId, appClient.UserPoolClient.ClientSecret),
+                }),
+            },
+        },
+    });
+    const refreshToken = signedIn.AuthenticationResult?.RefreshToken;
+    assertDefined(refreshToken, "the issued sim Cognito refresh token");
+    return {
+        userPoolId,
+        clientId,
+        clientSecret: appClient.UserPoolClient?.ClientSecret,
+        username: input.username,
+        refreshToken,
+    };
+});
+//# sourceMappingURL=sim-cognito-refreshable-session.factory.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-refreshable-session.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refreshable-session.factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-refreshable-session.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAmDpE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAI,kBAAkB,CAKvE,GAAG,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,aAAa;IACvB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,iBAAiB;IAC3B,iBAAiB,EAAE,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;IAC3E,cAAc,EAAE,KAAK;IACrB,oBAAoB,EAAE,SAAS;IAC/B,oBAAoB,EAAE,SAAS;CAChC,CAAC,EACF,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;QACxC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrC,aAAa,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;QACnD,KAAK,EAAE;YACL,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC;IACpD,aAAa,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;IAEjE,MAAM,OAAO,CAAC,eAAe,CAAC;QAC5B,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KAC5D,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,oBAAoB,CAAC;QACjC,KAAK,EAAE;YACL,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,IAAI;SAChB;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC1C,KAAK,EAAE;YACL,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,oBAAoB;YAC9B,cAAc,EAAE;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,KAAK,SAAS,IAAI;oBAC1D,WAAW,EAAE,oBAAoB,CAC/B,KAAK,CAAC,QAAQ,EACd,QAAQ,EACR,SAAS,CAAC,cAAc,CAAC,YAAY,CACtC;iBACF,CAAC;aACH;SACF;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,QAAQ,CAAC,oBAAoB,EAAE,YAAY,CAAC;IACjE,aAAa,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;IAEpE,OAAO;QACL,UAAU;QACV,QAAQ;QACR,YAAY,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY;KACb,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-client-secret.d.ts

@@ -1,3 +1,4 @@
+import type { SimCognitoUserPoolClient } from "./sim-cognito-user-pool-client.js";
 /**
  * Generate an app client secret.
  *
@@ -7,4 +8,13 @@
  * on.
  */
 export declare function makeSimCognitoClientSecret(): string;
+/**
+ * Refuse a request whose `ClientSecret` is missing or wrong.
+ *
+ * `GetTokensFromRefreshToken` proves the caller with the secret itself rather
+ * than with a `SECRET_HASH`, because the request names no user for a hash to
+ * be computed over. A client without a secret needs none, and one sent anyway
+ * is ignored, as real Cognito ignores it.
+ */
+export declare function requireSimCognitoClientSecret(client: SimCognitoUserPoolClient, clientSecret: string | undefined): void;
 //# sourceMappingURL=sim-cognito-client-secret.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-client-secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-client-secret.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-client-secret.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD"}
+{"version":3,"file":"sim-cognito-client-secret.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-client-secret.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AASlF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,wBAAwB,EAChC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,IAAI,CAYN"}

package/dist/service/cognito/user-pool/client/sim-cognito-client-secret.js

@@ -1,4 +1,9 @@
+/* oxlint-disable security/detect-possible-timing-attacks -- this is a
+   simulator in one process, where the client secret is checked so a test
+   notices one it forgot to send, rather than as a defence against anyone
+   measuring how long the check took. */
 import { faker } from "@faker-js/faker";
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
 /**
  * Real client secrets are fifty-two lowercase alphanumerics. The length is
  * worth matching because application code sometimes carries an assertion or a
@@ -19,4 +24,21 @@ export function makeSimCognitoClientSecret() {
         casing: "lower",
     });
 }
+/**
+ * Refuse a request whose `ClientSecret` is missing or wrong.
+ *
+ * `GetTokensFromRefreshToken` proves the caller with the secret itself rather
+ * than with a `SECRET_HASH`, because the request names no user for a hash to
+ * be computed over. A client without a secret needs none, and one sent anyway
+ * is ignored, as real Cognito ignores it.
+ */
+export function requireSimCognitoClientSecret(client, clientSecret) {
+    const { secret } = client;
+    if (secret === undefined) {
+        return;
+    }
+    if (clientSecret !== secret) {
+        throw new SimCognitoNotAuthorizedException(`Invalid client secret for client ${client.id}.`);
+    }
+}
 //# sourceMappingURL=sim-cognito-client-secret.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-client-secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-client-secret.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-client-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExC;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-cognito-client-secret.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-client-secret.ts"],"names":[],"mappings":"AAAA;;;wCAGwC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAGpF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAgC,EAChC,YAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAE1B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,gCAAgC,CACxC,oCAAoC,MAAM,CAAC,EAAE,GAAG,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}