@kensio/yulin 1.18.1 → 1.19.0

package/dist/service/cognito/command/auth/sim-cognito-available-challenges.d.ts

@@ -0,0 +1,35 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+/**
+ * The challenge a user answers with a password.
+ */
+export declare const simCognitoPasswordChallenge = "PASSWORD";
+/**
+ * The challenge a user answers by presenting a passkey.
+ */
+export declare const simCognitoWebAuthnChallenge = "WEB_AUTHN";
+/**
+ * The challenges a `USER_AUTH` sign-in offers this user, in the order the
+ * pool's sign-in policy named them.
+ *
+ * A pool created with no `SignInPolicy` allows a password and nothing else,
+ * which is what real Cognito falls back to.
+ */
+export declare function simCognitoAvailableChallenges(pool: SimCognitoUserPool, user: SimCognitoUser): readonly string[];
+/**
+ * Refuse a challenge this sign-in cannot offer, naming the ones it can.
+ *
+ * A factor the pool does not allow, one this user has nothing to answer with,
+ * and one this simulation does not present all fail here, because each of them
+ * ends the sign-in either way and the caller is owed the reason.
+ */
+export declare function requireSimCognitoAvailableChallenge(challengeName: string, available: readonly string[], field: string): void;
+/**
+ * Refuse a password at a pool that allows none at the first prompt.
+ *
+ * A `USER_AUTH` request carrying a `PASSWORD` outright never reaches the
+ * choice, so the policy is read here instead. A pool that allows no password
+ * first refuses one, as it refuses one picked out of the choice.
+ */
+export declare function requireSimCognitoAllowedPassword(pool: SimCognitoUserPool): void;
+//# sourceMappingURL=sim-cognito-available-challenges.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-available-challenges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-available-challenges.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-available-challenges.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;GAEG;AACH,eAAO,MAAM,2BAA2B,aAAa,CAAC;AAEtD;;GAEG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAwCvD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,GACnB,SAAS,MAAM,EAAE,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,KAAK,EAAE,MAAM,GACZ,IAAI,CAgBN;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,kBAAkB,GACvB,IAAI,CASN"}

package/dist/service/cognito/command/auth/sim-cognito-available-challenges.js

@@ -0,0 +1,83 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The challenge a user answers with a password.
+ */
+export const simCognitoPasswordChallenge = "PASSWORD";
+/**
+ * The challenge a user answers by presenting a passkey.
+ */
+export const simCognitoWebAuthnChallenge = "WEB_AUTHN";
+/**
+ * The two first factors this simulation presents.
+ *
+ * A code sent by email or by text is a `USER_AUTH` challenge too, and neither
+ * is issued here. Nothing delivers a message, and the pool's own
+ * `EmailConfiguration` and `SmsConfiguration` are refused for the same reason.
+ */
+const presentedChallenges = [
+    simCognitoPasswordChallenge,
+    simCognitoWebAuthnChallenge,
+];
+/**
+ * Whether this user could present a factor the pool allows.
+ *
+ * A passkey has to have been registered, and a code has to have somewhere to
+ * be sent. Real Cognito answers a user with the challenges it could actually
+ * complete, and this is the same filter.
+ */
+function canPresent(factor, user) {
+    if (factor === simCognitoWebAuthnChallenge) {
+        return user.webAuthn.credentials.length > 0;
+    }
+    if (factor === "EMAIL_OTP") {
+        return user.attributeValues.has("email");
+    }
+    if (factor === "SMS_OTP") {
+        return user.attributeValues.has("phone_number");
+    }
+    return true;
+}
+/**
+ * The challenges a `USER_AUTH` sign-in offers this user, in the order the
+ * pool's sign-in policy named them.
+ *
+ * A pool created with no `SignInPolicy` allows a password and nothing else,
+ * which is what real Cognito falls back to.
+ */
+export function simCognitoAvailableChallenges(pool, user) {
+    return pool.settings.signInPolicy.factors.filter((factor) => canPresent(factor, user));
+}
+/**
+ * Refuse a challenge this sign-in cannot offer, naming the ones it can.
+ *
+ * A factor the pool does not allow, one this user has nothing to answer with,
+ * and one this simulation does not present all fail here, because each of them
+ * ends the sign-in either way and the caller is owed the reason.
+ */
+export function requireSimCognitoAvailableChallenge(challengeName, available, field) {
+    if (!available.includes(challengeName)) {
+        throw new SimCognitoInvalidParameterException(`${field} '${challengeName}' is not available to this user: the ` +
+            `sign-in offers ${available.join(", ")}`);
+    }
+    if (!presentedChallenges.includes(challengeName)) {
+        throw new SimCognitoInvalidParameterException(`${field} '${challengeName}' is not simulated: a code sent by email or ` +
+            `by text needs the pool's EmailConfiguration or SmsConfiguration, ` +
+            `and this simulation delivers no message. Sign in with ` +
+            `${presentedChallenges.join(" or ")} instead.`);
+    }
+}
+/**
+ * Refuse a password at a pool that allows none at the first prompt.
+ *
+ * A `USER_AUTH` request carrying a `PASSWORD` outright never reaches the
+ * choice, so the policy is read here instead. A pool that allows no password
+ * first refuses one, as it refuses one picked out of the choice.
+ */
+export function requireSimCognitoAllowedPassword(pool) {
+    const { factors } = pool.settings.signInPolicy;
+    if (!factors.includes(simCognitoPasswordChallenge)) {
+        throw new SimCognitoInvalidParameterException(`AuthParameters PASSWORD is not a first factor this user pool allows: ` +
+            `its SignInPolicy AllowedFirstAuthFactors names ${factors.join(", ")}`);
+    }
+}
+//# sourceMappingURL=sim-cognito-available-challenges.js.map

package/dist/service/cognito/command/auth/sim-cognito-available-challenges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-available-challenges.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-available-challenges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAKvF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,MAAiC,EACjC,IAAoB;IAEpB,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAAwB,EACxB,IAAoB;IAEpB,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1D,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,aAAqB,EACrB,SAA4B,EAC5B,KAAa;IAEb,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,KAAK,aAAa,uCAAuC;YAC/D,kBAAkB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,KAAK,aAAa,8CAA8C;YACtE,mEAAmE;YACnE,wDAAwD;YACxD,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IAE/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,mCAAmC,CAC3C,uEAAuE;YACrE,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.d.ts

@@ -1,9 +1,11 @@
+import type { SimCognitoFirstFactorResponse } from "./sim-cognito-first-factor-response.js";
 import type { SimCognitoMfaResponse } from "./sim-cognito-mfa-response.js";
 import type { SimCognitoChallengeResponseRequest, SimCognitoNewPasswordResponse } from "./sim-cognito-new-password-response.js";
 import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
 interface SimCognitoChallengeResponsesProperties {
     readonly newPassword: SimCognitoNewPasswordResponse;
     readonly mfa: SimCognitoMfaResponse;
+    readonly firstFactor: SimCognitoFirstFactorResponse;
 }
 /**
  * Sends a challenge response to whichever challenge it is answering.
@@ -15,6 +17,7 @@ interface SimCognitoChallengeResponsesProperties {
 export declare class SimCognitoChallengeResponses {
     private readonly newPassword;
     private readonly mfa;
+    private readonly firstFactor;
     constructor(properties: SimCognitoChallengeResponsesProperties);
     /**
      * Answer the challenge the request names, or refuse a challenge this

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-challenge-responses.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EACV,kCAAkC,EAClC,6BAA6B,EAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAE5C,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;;OAGG;IACG,MAAM,CACV,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAQzC;CACF"}
+{"version":3,"file":"sim-cognito-challenge-responses.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EACV,kCAAkC,EAClC,6BAA6B,EAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;CACrD;AAWD;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAE5D,YAAY,UAAU,EAAE,sCAAsC,EAI7D;IAED;;;OAGG;IACG,MAAM,CACV,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAezC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.js

@@ -1,4 +1,14 @@
 import { newPasswordRequiredChallenge, requireSimCognitoChallengeName, } from "./sim-cognito-auth-challenge.js";
+import { simCognitoPasswordChallenge, simCognitoWebAuthnChallenge, } from "./sim-cognito-available-challenges.js";
+import { simCognitoSelectChallenge } from "./sim-cognito-first-factor-challenge.js";
+/**
+ * The challenges a `USER_AUTH` sign-in issues, which one responder answers.
+ */
+const firstFactorChallenges = new Set([
+    simCognitoSelectChallenge,
+    simCognitoPasswordChallenge,
+    simCognitoWebAuthnChallenge,
+]);
 /**
  * Sends a challenge response to whichever challenge it is answering.
  *
@@ -9,9 +19,11 @@ import { newPasswordRequiredChallenge, requireSimCognitoChallengeName, } from ".
 export class SimCognitoChallengeResponses {
     newPassword;
     mfa;
+    firstFactor;
     constructor(properties) {
         this.newPassword = properties.newPassword;
         this.mfa = properties.mfa;
+        this.firstFactor = properties.firstFactor;
     }
     /**
      * Answer the challenge the request names, or refuse a challenge this
@@ -22,6 +34,12 @@ export class SimCognitoChallengeResponses {
         if (challenge === newPasswordRequiredChallenge) {
             return await this.newPassword.handle(request);
         }
+        if (firstFactorChallenges.has(challenge)) {
+            return await this.firstFactor.handle({
+                ...request,
+                challengeName: challenge,
+            });
+        }
         return await this.mfa.handle({ ...request, challengeName: challenge });
     }
 }

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-challenge-responses.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AAazC;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,WAAW,CAAgC;IAC3C,GAAG,CAAwB;IAE5C,YAAY,UAAkD;QAC5D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,aAAiC,EACjC,OAA2C;QAE3C,MAAM,SAAS,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,SAAS,KAAK,4BAA4B,EAAE,CAAC;YAC/C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-challenge-responses.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAepF;;GAEG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,WAAW,CAAgC;IAC3C,GAAG,CAAwB;IAC3B,WAAW,CAAgC;IAE5D,YAAY,UAAkD;QAC5D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,aAAiC,EACjC,OAA2C;QAE3C,MAAM,SAAS,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,SAAS,KAAK,4BAA4B,EAAE,CAAC;YAC/C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACnC,GAAG,OAAO;gBACV,aAAa,EAAE,SAAS;aACzB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-first-factor-challenge.d.ts

@@ -0,0 +1,54 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+/**
+ * The challenge a pool answers a choice-based sign-in with when the request
+ * named no preference.
+ */
+export declare const simCognitoSelectChallenge = "SELECT_CHALLENGE";
+interface SimCognitoFirstFactorChallengeProperties {
+    readonly clock: SimClock;
+}
+/**
+ * A sign-in that has found its user and has a factor left to ask for.
+ */
+export interface SimCognitoFirstFactorRequest {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly user: SimCognitoUser;
+}
+/**
+ * The first factor a `USER_AUTH` sign-in asks for.
+ *
+ * A request naming no `PREFERRED_CHALLENGE` is answered with
+ * `SELECT_CHALLENGE` and the factors this user could present, and the caller
+ * picks one through `RespondToAuthChallenge`. A request naming one is answered
+ * with that challenge directly. Either way the answer carries a session, and
+ * `SimCognitoFirstFactorResponse` is what completes it.
+ */
+export declare class SimCognitoFirstFactorChallenge {
+    private readonly clock;
+    constructor(properties: SimCognitoFirstFactorChallengeProperties);
+    /**
+     * Answer with the factors this user could present, and a session to come
+     * back with.
+     */
+    offer(request: SimCognitoFirstFactorRequest): SimCognitoAuthenticationOutput;
+    /**
+     * Answer with one named factor, or refuse one this sign-in cannot offer.
+     */
+    issue(request: SimCognitoFirstFactorRequest, challengeName: string, field: string): SimCognitoAuthenticationOutput;
+    /**
+     * Ask for a passkey, carrying the options a browser presents one against.
+     *
+     * The options live on the session as well as in the answer, because the
+     * challenge inside them is what the credential coming back has to sign.
+     */
+    private presentPasskey;
+    private answer;
+    private remember;
+}
+export {};
+//# sourceMappingURL=sim-cognito-first-factor-challenge.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-first-factor-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-first-factor-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-first-factor-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAKvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAQ/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,EAAE,4BAA4B,GAAG,8BAA8B,CAO3E;IAED;;OAEG;IACH,KAAK,CACH,OAAO,EAAE,4BAA4B,EACrC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,8BAA8B,CAchC;IAED;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4BtB,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,QAAQ;CAmBjB"}

package/dist/service/cognito/command/auth/sim-cognito-first-factor-challenge.js

@@ -0,0 +1,87 @@
+import { SimCognitoAuthSession } from "../../user-pool/auth/sim-cognito-auth-session.js";
+import { requireSimCognitoRelyingParty, simCognitoUserVerification, } from "../../user-pool/mfa/sim-cognito-relying-party.js";
+import { simCognitoWebAuthnRequestOptions } from "../../user-pool/user/web-authn/sim-cognito-web-authn-assertion.js";
+import { requireSimCognitoAvailableChallenge, simCognitoAvailableChallenges, simCognitoWebAuthnChallenge, } from "./sim-cognito-available-challenges.js";
+/**
+ * The challenge a pool answers a choice-based sign-in with when the request
+ * named no preference.
+ */
+export const simCognitoSelectChallenge = "SELECT_CHALLENGE";
+/**
+ * The first factor a `USER_AUTH` sign-in asks for.
+ *
+ * A request naming no `PREFERRED_CHALLENGE` is answered with
+ * `SELECT_CHALLENGE` and the factors this user could present, and the caller
+ * picks one through `RespondToAuthChallenge`. A request naming one is answered
+ * with that challenge directly. Either way the answer carries a session, and
+ * `SimCognitoFirstFactorResponse` is what completes it.
+ */
+export class SimCognitoFirstFactorChallenge {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Answer with the factors this user could present, and a session to come
+     * back with.
+     */
+    offer(request) {
+        const { pool, user } = request;
+        return {
+            ...this.answer(request, simCognitoSelectChallenge),
+            AvailableChallenges: [...simCognitoAvailableChallenges(pool, user)],
+        };
+    }
+    /**
+     * Answer with one named factor, or refuse one this sign-in cannot offer.
+     */
+    issue(request, challengeName, field) {
+        const { pool, user } = request;
+        requireSimCognitoAvailableChallenge(challengeName, simCognitoAvailableChallenges(pool, user), field);
+        if (challengeName === simCognitoWebAuthnChallenge) {
+            return this.presentPasskey(request);
+        }
+        return this.answer(request, challengeName);
+    }
+    /**
+     * Ask for a passkey, carrying the options a browser presents one against.
+     *
+     * The options live on the session as well as in the answer, because the
+     * challenge inside them is what the credential coming back has to sign.
+     */
+    presentPasskey(request) {
+        const { pool, client, user } = request;
+        const options = simCognitoWebAuthnRequestOptions(requireSimCognitoRelyingParty(pool), simCognitoUserVerification(pool), user.webAuthn.credentials.map((each) => each.descriptor()));
+        const session = this.remember(pool, client, user, simCognitoWebAuthnChallenge, options);
+        return {
+            $metadata: {},
+            ChallengeName: simCognitoWebAuthnChallenge,
+            Session: session.id,
+            ChallengeParameters: {
+                USERNAME: user.username,
+                CREDENTIAL_REQUEST_OPTIONS: JSON.stringify(options),
+            },
+        };
+    }
+    answer(request, challengeName) {
+        const { pool, client, user } = request;
+        return {
+            $metadata: {},
+            ChallengeName: challengeName,
+            Session: this.remember(pool, client, user, challengeName).id,
+            ChallengeParameters: { USERNAME: user.username },
+        };
+    }
+    remember(pool, client, user, challengeName, webAuthnOptions) {
+        const session = new SimCognitoAuthSession({
+            username: user.username,
+            client,
+            challengeName,
+            issuedAt: this.clock.now(),
+            webAuthnOptions,
+        });
+        pool.auth.addSession(session);
+        return session;
+    }
+}
+//# sourceMappingURL=sim-cognito-first-factor-challenge.js.map

package/dist/service/cognito/command/auth/sim-cognito-first-factor-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-first-factor-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-first-factor-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAEzF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,kDAAkD,CAAC;AAG1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,mEAAmE,CAAC;AAErH,OAAO,EACL,mCAAmC,EACnC,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAG/C;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAe5D;;;;;;;;GAQG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAqC;QACzC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAE/B,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAyB,CAAC;YAClD,mBAAmB,EAAE,CAAC,GAAG,6BAA6B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CACH,OAAqC,EACrC,aAAqB,EACrB,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAE/B,mCAAmC,CACjC,aAAa,EACb,6BAA6B,CAAC,IAAI,EAAE,IAAI,CAAC,EACzC,KAAK,CACN,CAAC;QAEF,IAAI,aAAa,KAAK,2BAA2B,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACK,cAAc,CACpB,OAAqC;QAErC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,OAAO,GAAG,gCAAgC,CAC9C,6BAA6B,CAAC,IAAI,CAAC,EACnC,0BAA0B,CAAC,IAAI,CAAC,EAChC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAC3D,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAC3B,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,2BAA2B,EAC3B,OAAO,CACR,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,2BAA2B;YAC1C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aACpD;SACF,CAAC;IACJ,CAAC;IAEO,MAAM,CACZ,OAAqC,EACrC,aAAqB;QAErB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAEvC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,aAAa;YAC5B,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE;YAC5D,mBAAmB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SACjD,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,IAAwB,EACxB,MAAgC,EAChC,IAAoB,EACpB,aAAqB,EACrB,eAAkD;QAElD,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;YACN,aAAa;YACb,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,eAAe;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-first-factor-response.d.ts

@@ -0,0 +1,55 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import { type SimCognitoFirstFactorChallenge } from "./sim-cognito-first-factor-challenge.js";
+import type { SimCognitoChallengeResponseRequest } from "./sim-cognito-new-password-response.js";
+import type { SimCognitoPasswordResponse } from "./sim-cognito-password-response.js";
+import type { SimCognitoWebAuthnResponse } from "./sim-cognito-web-authn-response.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoFirstFactorResponseProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly challenge: SimCognitoFirstFactorChallenge;
+    readonly password: SimCognitoPasswordResponse;
+    readonly webAuthn: SimCognitoWebAuthnResponse;
+    readonly clock: SimClock;
+}
+/**
+ * A response to one of the challenges a `USER_AUTH` sign-in issues.
+ */
+export interface SimCognitoFirstFactorResponseRequest extends SimCognitoChallengeResponseRequest {
+    readonly challengeName: string;
+}
+/**
+ * Answering the first factor of a choice-based sign-in.
+ *
+ * `SELECT_CHALLENGE` is answered with an `ANSWER` naming the factor the user
+ * picked. Picking `WEB_AUTHN` is answered with that challenge and the options
+ * a passkey is presented against, and picking `PASSWORD` carries the password
+ * in the same request and finishes the sign-in, which is how the Cognito
+ * documentation shows both.
+ *
+ * `PASSWORD` and `WEB_AUTHN` are what a sign-in that named a
+ * `PREFERRED_CHALLENGE` is answered with, and each is completed here.
+ *
+ * A session is spent when the challenge it carries has been got past, and a
+ * refusal leaves it standing, so a wrong password or a passkey the person
+ * cancelled can be answered again. That is what real Cognito does with the
+ * MFA challenges, and this holds the first factors to the same rule.
+ */
+export declare class SimCognitoFirstFactorResponse {
+    private readonly authResolver;
+    private readonly challenge;
+    private readonly password;
+    private readonly webAuthn;
+    private readonly clock;
+    constructor(properties: SimCognitoFirstFactorResponseProperties);
+    /**
+     * Answer whichever of the three challenges the request names.
+     */
+    handle(request: SimCognitoFirstFactorResponseRequest): Promise<SimCognitoAuthenticationOutput>;
+    /**
+     * Act on the factor a `SELECT_CHALLENGE` response picked.
+     */
+    private chosen;
+}
+export {};
+//# sourceMappingURL=sim-cognito-first-factor-response.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-first-factor-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-first-factor-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-first-factor-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAQpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oCAAqC,SAAQ,kCAAkC;IAC9F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,uCAAuC,EAM9D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,8BAA8B,CAAC,CAgBzC;IAED;;OAEG;YACW,MAAM;CAyBrB"}

package/dist/service/cognito/command/auth/sim-cognito-first-factor-response.js

@@ -0,0 +1,64 @@
+import { requireSimCognitoAnsweringUser } from "./sim-cognito-answering-user.js";
+import { simCognitoPasswordChallenge, simCognitoWebAuthnChallenge, } from "./sim-cognito-available-challenges.js";
+import { simCognitoSelectChallenge, } from "./sim-cognito-first-factor-challenge.js";
+/**
+ * Answering the first factor of a choice-based sign-in.
+ *
+ * `SELECT_CHALLENGE` is answered with an `ANSWER` naming the factor the user
+ * picked. Picking `WEB_AUTHN` is answered with that challenge and the options
+ * a passkey is presented against, and picking `PASSWORD` carries the password
+ * in the same request and finishes the sign-in, which is how the Cognito
+ * documentation shows both.
+ *
+ * `PASSWORD` and `WEB_AUTHN` are what a sign-in that named a
+ * `PREFERRED_CHALLENGE` is answered with, and each is completed here.
+ *
+ * A session is spent when the challenge it carries has been got past, and a
+ * refusal leaves it standing, so a wrong password or a passkey the person
+ * cancelled can be answered again. That is what real Cognito does with the
+ * MFA challenges, and this holds the first factors to the same rule.
+ */
+export class SimCognitoFirstFactorResponse {
+    authResolver;
+    challenge;
+    password;
+    webAuthn;
+    clock;
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.challenge = properties.challenge;
+        this.password = properties.password;
+        this.webAuthn = properties.webAuthn;
+        this.clock = properties.clock;
+    }
+    /**
+     * Answer whichever of the three challenges the request names.
+     */
+    async handle(request) {
+        const { session, user } = requireSimCognitoAnsweringUser(this.authResolver, request, this.clock.now());
+        if (request.challengeName === simCognitoWebAuthnChallenge) {
+            return await this.webAuthn.complete(request, session, user);
+        }
+        if (request.challengeName === simCognitoSelectChallenge) {
+            return await this.chosen(request, session, user);
+        }
+        return await this.password.complete(request, session, user);
+    }
+    /**
+     * Act on the factor a `SELECT_CHALLENGE` response picked.
+     */
+    async chosen(request, session, user) {
+        const answer = request.parameters.require("ANSWER");
+        if (answer === simCognitoPasswordChallenge) {
+            return await this.password.complete(request, session, user);
+        }
+        const { pool, client } = request;
+        const issued = this.challenge.issue({ pool, client, user }, answer, "ANSWER");
+        // The choice is spent once it has been made, and the factor it picked is
+        // what the next session is for. A choice this sign-in could not offer
+        // leaves it standing, so the caller can pick again.
+        pool.auth.removeSession(session);
+        return issued;
+    }
+}
+//# sourceMappingURL=sim-cognito-first-factor-response.js.map

package/dist/service/cognito/command/auth/sim-cognito-first-factor-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-first-factor-response.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-first-factor-response.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,yBAAyB,GAE1B,MAAM,yCAAyC,CAAC;AAqBjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,6BAA6B;IACvB,YAAY,CAAyB;IACrC,SAAS,CAAiC;IAC1C,QAAQ,CAA6B;IACrC,QAAQ,CAA6B;IACrC,KAAK,CAAW;IAEjC,YAAY,UAAmD;QAC7D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA6C;QAE7C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,8BAA8B,CACtD,IAAI,CAAC,YAAY,EACjB,OAAO,EACP,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACjB,CAAC;QAEF,IAAI,OAAO,CAAC,aAAa,KAAK,2BAA2B,EAAE,CAAC;YAC1D,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,KAAK,yBAAyB,EAAE,CAAC;YACxD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAClB,OAA6C,EAC7C,OAA8B,EAC9B,IAAoB;QAEpB,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;YAC3C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CACjC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EACtB,MAAM,EACN,QAAQ,CACT,CAAC;QAEF,yEAAyE;QACzE,sEAAsE;QACtE,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEjC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.d.ts

@@ -0,0 +1,35 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import type { SimCognitoRefreshedTokens } from "./sim-cognito-refreshed-tokens.js";
+import type { SimGetTokensFromRefreshTokenCommand, SimGetTokensFromRefreshTokenCommandOutput } from "./auth.command.js";
+interface SimCognitoGetTokensFromRefreshTokenProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly refreshedTokens: SimCognitoRefreshedTokens;
+    readonly clock: SimClock;
+}
+/**
+ * The GetTokensFromRefreshToken command.
+ *
+ * This is what renews a session on an app client that rotates its refresh
+ * tokens, and it renews one on a client that does not just as well. Like
+ * `InitiateAuth` it is what a browser or mobile app calls, so no IAM
+ * permission is involved and no caller is read.
+ *
+ * The request names no user and carries no `SECRET_HASH`. The refresh token is
+ * what says whose session this is, and the client secret is what proves the
+ * caller, which is why a confidential client sends `ClientSecret` here rather
+ * than a hash computed over a username it does not have.
+ */
+export declare class SimCognitoGetTokensFromRefreshToken {
+    private readonly authResolver;
+    private readonly refreshedTokens;
+    private readonly clock;
+    private readonly unsimulated;
+    constructor(properties: SimCognitoGetTokensFromRefreshTokenProperties);
+    /**
+     * Renew a session from the refresh token it holds.
+     */
+    handle(command: SimGetTokensFromRefreshTokenCommand): Promise<SimGetTokensFromRefreshTokenCommandOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-get-tokens-from-refresh-token.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-get-tokens-from-refresh-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAIpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EACV,mCAAmC,EACnC,yCAAyC,EAC1C,MAAM,mBAAmB,CAAC;AAE3B,UAAU,6CAA6C;IACrD,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAE1B;IAEF,YAAY,UAAU,EAAE,6CAA6C,EAIpE;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,yCAAyC,CAAC,CA0BpD;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.js

@@ -0,0 +1,51 @@
+import { requireSimCognitoRefreshTokenInput } from "../../user-pool/auth/sim-cognito-refresh-token-input.js";
+import { requireSimCognitoClientSecret } from "../../user-pool/client/sim-cognito-client-secret.js";
+import { SimCognitoUnsimulatedInput } from "../sim-cognito-unsimulated-input.js";
+/**
+ * The GetTokensFromRefreshToken command.
+ *
+ * This is what renews a session on an app client that rotates its refresh
+ * tokens, and it renews one on a client that does not just as well. Like
+ * `InitiateAuth` it is what a browser or mobile app calls, so no IAM
+ * permission is involved and no caller is read.
+ *
+ * The request names no user and carries no `SECRET_HASH`. The refresh token is
+ * what says whose session this is, and the client secret is what proves the
+ * caller, which is why a confidential client sends `ClientSecret` here rather
+ * than a hash computed over a username it does not have.
+ */
+export class SimCognitoGetTokensFromRefreshToken {
+    authResolver;
+    refreshedTokens;
+    clock;
+    unsimulated = new SimCognitoUnsimulatedInput("GetTokensFromRefreshToken");
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.refreshedTokens = properties.refreshedTokens;
+        this.clock = properties.clock;
+    }
+    /**
+     * Renew a session from the refresh token it holds.
+     */
+    async handle(command) {
+        const { input } = command;
+        const { pool, client } = this.authResolver.client(input.ClientId);
+        this.unsimulated.refuse("DeviceKey", input.DeviceKey, "device remembering, which signs a known device in without its second factor");
+        requireSimCognitoClientSecret(client, input.ClientSecret);
+        const refreshToken = pool.auth.requireRefreshToken({
+            value: requireSimCognitoRefreshTokenInput(input.RefreshToken),
+            clientId: client.id,
+            now: this.clock.now(),
+        });
+        return {
+            $metadata: {},
+            AuthenticationResult: await this.refreshedTokens.issue({
+                pool,
+                client,
+                refreshToken,
+                clientMetadata: input.ClientMetadata,
+            }),
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-get-tokens-from-refresh-token.js.map

package/dist/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-get-tokens-from-refresh-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAcjF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mCAAmC;IAC7B,YAAY,CAAyB;IACrC,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,WAAW,GAAG,IAAI,0BAA0B,CAC3D,2BAA2B,CAC5B,CAAC;IAEF,YAAY,UAAyD;QACnE,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA4C;QAE5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAElE,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,WAAW,EACX,KAAK,CAAC,SAAS,EACf,6EAA6E,CAC9E,CAAC;QACF,6BAA6B,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAE1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACjD,KAAK,EAAE,kCAAkC,CAAC,KAAK,CAAC,YAAY,CAAC;YAC7D,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBACrD,IAAI;gBACJ,MAAM;gBACN,YAAY;gBACZ,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-mfa-challenge.js

@@ -58,7 +58,7 @@ export class SimCognitoMfaChallenge {
         const code = factor === simCognitoSmsMfa ? simCognitoMfaCode() : undefined;
         const session = new SimCognitoAuthSession({
             username: user.username,
-            clientId: client.id,
+            client,
             challengeName: factor,
             code,
             issuedAt: this.clock.now(),

package/dist/service/cognito/command/auth/sim-cognito-mfa-challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-mfa-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAIzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAmBnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,sBAAsB;IAChB,SAAS,CAA0B;IACnC,KAAK,CAAW;IAEjC,YAAY,UAA4C;QACtD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,kBAAkB,CAC/B,MAAc,EACd,IAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE7D,IAAI,MAAM,KAAK,gBAAgB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,6BAA6B,EAAE,KAAK;YACpC,yBAAyB,EAAE,2BAA2B,CAAC,WAAW,CAAC;SACpE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAsC;QAEtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAErE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,aAAa,EAAE,MAAM;YACrB,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBACxB,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,gBAAgB;gBAC1B,IAAI;gBACJ,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;aAC3D;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-mfa-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-mfa-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAIzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAmBnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,sBAAsB;IAChB,SAAS,CAA0B;IACnC,KAAK,CAAW;IAEjC,YAAY,UAA4C;QACtD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,kBAAkB,CAC/B,MAAc,EACd,IAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE7D,IAAI,MAAM,KAAK,gBAAgB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,6BAA6B,EAAE,KAAK;YACpC,yBAAyB,EAAE,2BAA2B,CAAC,WAAW,CAAC;SACpE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAsC;QAEtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAErE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBACxB,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,gBAAgB;gBAC1B,IAAI;gBACJ,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;aAC3D;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
 import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
@@ -7,7 +8,7 @@ interface SimCognitoNewPasswordChallengeProperties {
 }
 interface SimCognitoChallengeProperties {
     readonly pool: SimCognitoUserPool;
-    readonly clientId: string;
+    readonly client: SimCognitoUserPoolClient;
     readonly user: SimCognitoUser;
 }
 /**

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-new-password-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;OAEG;IACH,KAAK,CACH,UAAU,EAAE,6BAA6B,GACxC,8BAA8B,CAqBhC;CACF"}
+{"version":3,"file":"sim-cognito-new-password-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;OAEG;IACH,KAAK,CACH,UAAU,EAAE,6BAA6B,GACxC,8BAA8B,CAqBhC;CACF"}