@kensio/yulin 1.21.0 → 1.21.2

package/dist/service/cognito/user-pool/auth/sim-cognito-request-throttle.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The kinds of request a pool counts, and can be told to turn away.
+ *
+ * These are the four real Cognito keeps a `*Successes` and a `*Throttles`
+ * metric for. The operation names the pair rather than either metric, because
+ * one request writes to both.
+ */
+export type SimCognitoThrottledOperation = "SignIn" | "SignUp" | "TokenRefresh" | "Federation";
+/**
+ * How many requests of each kind a pool has been told to turn away.
+ *
+ * Real Cognito turns a request away when the account has gone over a rate
+ * limit, and those limits are per account and mostly undocumented. Working one
+ * out here would be inventing a number, and a test asserting against an
+ * invented number proves nothing about a real pool. So a test says how many
+ * requests to refuse instead, and the pool refuses that many and no more.
+ *
+ * A pool refuses nothing until a test asks it to.
+ */
+export declare class SimCognitoRequestThrottle {
+    #private;
+    /** Turn away the next `count` sign-in requests. */
+    signIns(count: number): void;
+    /** Turn away the next `count` registrations. */
+    signUps(count: number): void;
+    /** Turn away the next `count` renewals from a refresh token. */
+    tokenRefreshes(count: number): void;
+    /** Turn away the next `count` sign-ins through an identity provider. */
+    federations(count: number): void;
+    /**
+     * Take one refusal for this operation, answering with whether there was one
+     * to take. A request that takes one is the request being turned away.
+     */
+    takesOne(operation: SimCognitoThrottledOperation): boolean;
+    private queue;
+}

package/dist/service/cognito/user-pool/auth/sim-cognito-request-throttle.js

@@ -0,0 +1,45 @@
+/**
+ * How many requests of each kind a pool has been told to turn away.
+ *
+ * Real Cognito turns a request away when the account has gone over a rate
+ * limit, and those limits are per account and mostly undocumented. Working one
+ * out here would be inventing a number, and a test asserting against an
+ * invented number proves nothing about a real pool. So a test says how many
+ * requests to refuse instead, and the pool refuses that many and no more.
+ *
+ * A pool refuses nothing until a test asks it to.
+ */
+export class SimCognitoRequestThrottle {
+    #queued = new Map();
+    /** Turn away the next `count` sign-in requests. */
+    signIns(count) {
+        this.queue("SignIn", count);
+    }
+    /** Turn away the next `count` registrations. */
+    signUps(count) {
+        this.queue("SignUp", count);
+    }
+    /** Turn away the next `count` renewals from a refresh token. */
+    tokenRefreshes(count) {
+        this.queue("TokenRefresh", count);
+    }
+    /** Turn away the next `count` sign-ins through an identity provider. */
+    federations(count) {
+        this.queue("Federation", count);
+    }
+    /**
+     * Take one refusal for this operation, answering with whether there was one
+     * to take. A request that takes one is the request being turned away.
+     */
+    takesOne(operation) {
+        const left = this.#queued.get(operation) ?? 0;
+        if (left < 1) {
+            return false;
+        }
+        this.#queued.set(operation, left - 1);
+        return true;
+    }
+    queue(operation, count) {
+        this.#queued.set(operation, (this.#queued.get(operation) ?? 0) + count);
+    }
+}

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.d.ts

@@ -1,13 +1,24 @@
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolTriggers } from "../trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUser } from "../user/sim-cognito-user.js";
 import type { SimCognitoUserFactory } from "../user/sim-cognito-user-factory.js";
+import type { SimCognitoExternalUser } from "./sim-cognito-external-user.js";
 import type { SimCognitoUserPoolIdentityProvider } from "./sim-cognito-user-pool-identity-provider.js";
 interface SimCognitoFederatedSignInProperties {
     readonly userFactory: SimCognitoUserFactory;
+    readonly triggers: SimCognitoUserPoolTriggers;
 }
 interface SimCognitoFederatedSignInRequest {
     readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
     readonly provider: SimCognitoUserPoolIdentityProvider;
+    /**
+     * Who the provider is signing in, which the caller settled before getting
+     * here: the user `signInAs` put at the provider, or the one the stand-in
+     * page for it posted back.
+     */
+    readonly externalUser: SimCognitoExternalUser;
     readonly now: Date;
 }
 /**
@@ -24,23 +35,45 @@ interface SimCognitoFederatedSignInRequest {
  * The provider's claims reach the user through the provider's attribute
  * mapping, on every sign-in rather than only the first, because real Cognito
  * updates a mapped attribute when the value at the provider changes.
+ *
+ * Which triggers fire depends on whether the pool has met this subject before.
+ * A first sign-in is a sign-up, and runs `PreSignUp` and `PostConfirmation`.
+ * Every sign-in after it is an authentication, and runs `PreAuthentication`
+ * and `PostAuthentication`. That is the split AWS documents for federated
+ * users, and it means a handler creating a profile record on first sight of a
+ * user runs once for a Google user rather than on every visit.
  */
 export declare class SimCognitoFederatedSignIn {
     private readonly userFactory;
+    private readonly triggers;
     constructor(properties: SimCognitoFederatedSignInProperties);
     /**
-     * Refuse a sign-in that would take over a user it did not create.
+     * Sign the user signed in at the provider in to the pool.
+     */
+    signIn(request: SimCognitoFederatedSignInRequest): Promise<SimCognitoUser>;
+    /**
+     * Sign in a subject the pool already holds a user for.
+     *
+     * `PreAuthentication` runs before the mapped attributes are brought up to
+     * date, so a handler that refuses the sign-in leaves the user as it was.
      *
-     * A username is only reserved by being taken, and a pool's own user may
-     * validly be called `Google_1234`, so the user found by name is only the
-     * federated one when its identity says so. Signing in as it otherwise would
-     * hand an application a token for someone else's account, which is worth
-     * refusing rather than guessing at.
+     * A disabled user is refused after that trigger and not before it, which is
+     * the order the API sign-ins use: real Cognito hands the trigger the user to
+     * decide about, and a sign-in the pool is going to refuse reaches it too.
      */
-    private static requireSameIdentity;
+    private returningUser;
     /**
-     * Sign the user signed in at the provider in to the pool.
+     * Build and sign in the pool's user for a subject it has never seen.
+     *
+     * The order is the sign-up's order. `PreSignUp` runs on a user that is not
+     * in the pool yet, so a handler that throws leaves the pool without it, and
+     * `PostConfirmation` runs on the user the pool now holds.
+     *
+     * `autoConfirmUser` has nothing to do here. A federated user is created in
+     * `EXTERNAL_PROVIDER` and never passes through `UNCONFIRMED`, so there is no
+     * confirmation for a handler to skip. `autoVerifyEmail` and `autoVerifyPhone`
+     * are applied, as they are for a sign-up.
      */
-    signIn(request: SimCognitoFederatedSignInRequest): SimCognitoUser;
+    private newUser;
 }
 export {};

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-sign-in.js

@@ -1,6 +1,8 @@
-import { SimCognitoUsernameExistsException } from "../../error/sim-cognito.error.js";
-import { requireSimCognitoUsername } from "../user/sim-cognito-username.js";
+import { requireSimCognitoEnabled } from "../auth/sim-cognito-sign-in.js";
+import { requireSimCognitoUsername, } from "../user/sim-cognito-username.js";
 import { SimCognitoFederatedIdentity } from "./sim-cognito-federated-identity.js";
+import { SimCognitoFederatedTriggers } from "./sim-cognito-federated-triggers.js";
+import { requireSimCognitoSameFederatedIdentity } from "./sim-cognito-same-federated-identity.js";
 /**
  * Signs an external user in to a pool, creating the pool's own user for it the
  * first time.
@@ -15,45 +17,69 @@ import { SimCognitoFederatedIdentity } from "./sim-cognito-federated-identity.js
  * The provider's claims reach the user through the provider's attribute
  * mapping, on every sign-in rather than only the first, because real Cognito
  * updates a mapped attribute when the value at the provider changes.
+ *
+ * Which triggers fire depends on whether the pool has met this subject before.
+ * A first sign-in is a sign-up, and runs `PreSignUp` and `PostConfirmation`.
+ * Every sign-in after it is an authentication, and runs `PreAuthentication`
+ * and `PostAuthentication`. That is the split AWS documents for federated
+ * users, and it means a handler creating a profile record on first sight of a
+ * user runs once for a Google user rather than on every visit.
  */
 export class SimCognitoFederatedSignIn {
     userFactory;
+    triggers;
     constructor(properties) {
         this.userFactory = properties.userFactory;
-    }
-    /**
-     * Refuse a sign-in that would take over a user it did not create.
-     *
-     * A username is only reserved by being taken, and a pool's own user may
-     * validly be called `Google_1234`, so the user found by name is only the
-     * federated one when its identity says so. Signing in as it otherwise would
-     * hand an application a token for someone else's account, which is worth
-     * refusing rather than guessing at.
-     */
-    static requireSameIdentity(existing, provider) {
-        const { identity } = existing;
-        const externalUser = provider.requireSignedInUser();
-        if (identity?.providerName !== provider.name ||
-            identity.userId !== externalUser.subject) {
-            throw new SimCognitoUsernameExistsException(`User ${existing.username} already exists in user pool ` +
-                `${provider.userPoolId} and is not the ${provider.name} user this ` +
-                `sign-in is for.`);
-        }
+        this.triggers = new SimCognitoFederatedTriggers({
+            triggers: properties.triggers,
+        });
     }
     /**
      * Sign the user signed in at the provider in to the pool.
      */
-    signIn(request) {
-        const { pool, provider, now } = request;
-        const externalUser = provider.requireSignedInUser();
+    async signIn(request) {
+        const { pool, provider, externalUser } = request;
         const username = requireSimCognitoUsername(`${provider.name}_${externalUser.subject}`);
         const attributes = provider.attributeMapping.attributesFor(externalUser);
         const existing = pool.findUser(username);
         if (existing !== undefined) {
-            SimCognitoFederatedSignIn.requireSameIdentity(existing, provider);
-            existing.updateAttributes(attributes);
-            return existing;
+            requireSimCognitoSameFederatedIdentity(existing, provider, externalUser);
+            return this.returningUser(request, existing, attributes);
         }
+        return this.newUser(request, username, attributes);
+    }
+    /**
+     * Sign in a subject the pool already holds a user for.
+     *
+     * `PreAuthentication` runs before the mapped attributes are brought up to
+     * date, so a handler that refuses the sign-in leaves the user as it was.
+     *
+     * A disabled user is refused after that trigger and not before it, which is
+     * the order the API sign-ins use: real Cognito hands the trigger the user to
+     * decide about, and a sign-in the pool is going to refuse reaches it too.
+     */
+    async returningUser(request, user, attributes) {
+        const { pool, client } = request;
+        await this.triggers.beforeSignIn({ pool, client, user });
+        requireSimCognitoEnabled(user);
+        user.updateAttributes(attributes);
+        await this.triggers.afterSignIn({ pool, client, user });
+        return user;
+    }
+    /**
+     * Build and sign in the pool's user for a subject it has never seen.
+     *
+     * The order is the sign-up's order. `PreSignUp` runs on a user that is not
+     * in the pool yet, so a handler that throws leaves the pool without it, and
+     * `PostConfirmation` runs on the user the pool now holds.
+     *
+     * `autoConfirmUser` has nothing to do here. A federated user is created in
+     * `EXTERNAL_PROVIDER` and never passes through `UNCONFIRMED`, so there is no
+     * confirmation for a handler to skip. `autoVerifyEmail` and `autoVerifyPhone`
+     * are applied, as they are for a sign-up.
+     */
+    async newUser(request, username, attributes) {
+        const { pool, client, provider, externalUser, now } = request;
         const user = this.userFactory.federated({
             username,
             attributes,
@@ -66,7 +92,10 @@ export class SimCognitoFederatedSignIn {
                 createdAt: now,
             }),
         });
+        const preSignUp = await this.triggers.beforeSignUp({ pool, client, user });
+        preSignUp.verifyAttributesOf(user);
         pool.addUser(user);
+        await this.triggers.afterSignUp({ pool, client, user });
         return user;
     }
 }

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-triggers.d.ts

@@ -0,0 +1,52 @@
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoPreSignUpResponse } from "../trigger/sim-cognito-pre-sign-up-response.js";
+import type { SimCognitoUserPoolTriggers } from "../trigger/sim-cognito-user-pool-triggers.js";
+import type { SimCognitoUser } from "../user/sim-cognito-user.js";
+interface SimCognitoFederatedTriggersProperties {
+    readonly triggers: SimCognitoUserPoolTriggers;
+}
+interface SimCognitoFederatedTriggerContext {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly user: SimCognitoUser;
+}
+/**
+ * The triggers a sign-in at an identity provider runs, in the order they run.
+ *
+ * AWS documents two sets. A subject the pool has never seen is signing up, and
+ * runs `PreSignUp` and then `PostConfirmation`. A subject it already holds a
+ * user for is authenticating, and runs `PreAuthentication` and then
+ * `PostAuthentication`. Keeping the pair here rather than in the sign-in makes
+ * the two sequences the whole of what this says.
+ */
+export declare class SimCognitoFederatedTriggers {
+    private readonly triggers;
+    constructor(properties: SimCognitoFederatedTriggersProperties);
+    /**
+     * Run the trigger that guards a first sign-in, and answer with what its
+     * handler asked for.
+     *
+     * It runs on a user the pool has yet to be given, so a handler that throws
+     * leaves the pool without it.
+     */
+    beforeSignUp(context: SimCognitoFederatedTriggerContext): Promise<SimCognitoPreSignUpResponse>;
+    /**
+     * Run the trigger that follows a first sign-in, on the user the pool now
+     * holds.
+     *
+     * The source is the one a local confirmation reports, so an application
+     * writing its own user record from that handler writes one for a federated
+     * user without adding anything.
+     */
+    afterSignUp(context: SimCognitoFederatedTriggerContext): Promise<void>;
+    /**
+     * Run the trigger that guards a sign-in by a subject the pool already knows.
+     */
+    beforeSignIn(context: SimCognitoFederatedTriggerContext): Promise<void>;
+    /**
+     * Run the trigger that follows one.
+     */
+    afterSignIn(context: SimCognitoFederatedTriggerContext): Promise<void>;
+}
+export {};

package/dist/service/cognito/user-pool/idp/sim-cognito-federated-triggers.js

@@ -0,0 +1,49 @@
+import { SimCognitoTriggerOccasion } from "../trigger/sim-cognito-trigger-occasion.js";
+/**
+ * The triggers a sign-in at an identity provider runs, in the order they run.
+ *
+ * AWS documents two sets. A subject the pool has never seen is signing up, and
+ * runs `PreSignUp` and then `PostConfirmation`. A subject it already holds a
+ * user for is authenticating, and runs `PreAuthentication` and then
+ * `PostAuthentication`. Keeping the pair here rather than in the sign-in makes
+ * the two sequences the whole of what this says.
+ */
+export class SimCognitoFederatedTriggers {
+    triggers;
+    constructor(properties) {
+        this.triggers = properties.triggers;
+    }
+    /**
+     * Run the trigger that guards a first sign-in, and answer with what its
+     * handler asked for.
+     *
+     * It runs on a user the pool has yet to be given, so a handler that throws
+     * leaves the pool without it.
+     */
+    async beforeSignUp(context) {
+        return this.triggers.preSignUp(SimCognitoTriggerOccasion.externalProviderSignUp, context);
+    }
+    /**
+     * Run the trigger that follows a first sign-in, on the user the pool now
+     * holds.
+     *
+     * The source is the one a local confirmation reports, so an application
+     * writing its own user record from that handler writes one for a federated
+     * user without adding anything.
+     */
+    async afterSignUp(context) {
+        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, context);
+    }
+    /**
+     * Run the trigger that guards a sign-in by a subject the pool already knows.
+     */
+    async beforeSignIn(context) {
+        await this.triggers.preAuthentication(context);
+    }
+    /**
+     * Run the trigger that follows one.
+     */
+    async afterSignIn(context) {
+        await this.triggers.postAuthentication(context);
+    }
+}

package/dist/service/cognito/user-pool/idp/sim-cognito-presented-external-user.d.ts

@@ -0,0 +1,48 @@
+import type { SimCognitoAuthorizeInput } from "../../command/hosted/hosted-auth.command.js";
+import { SimCognitoExternalUser } from "./sim-cognito-external-user.js";
+import type { SimCognitoUserPoolIdentityProvider } from "./sim-cognito-user-pool-identity-provider.js";
+/**
+ * What a claim field is called on the stand-in provider page.
+ *
+ * The names after it are the provider's own claim names, so they are prefixed
+ * to keep them apart from the authorize parameters the form posts beside them.
+ */
+export declare const simCognitoClaimFieldPrefix = "claim_";
+/**
+ * The claim names a provider's attribute mapping reads.
+ *
+ * The mapping is keyed by pool attribute and valued by claim, so the values
+ * are what a provider would have asserted and what the page asks for.
+ */
+export declare function simCognitoMappedClaimNames(provider: SimCognitoUserPoolIdentityProvider): readonly string[];
+/**
+ * What one claim field is pre-filled with, so that the page signs a user in
+ * when nobody edits it.
+ *
+ * An address has to look like one, because a pool that verifies or aliases by
+ * email holds it to that. Everything else is a name as far as this knows.
+ */
+export declare function simCognitoDefaultClaim(claimName: string): string;
+/**
+ * The subject the page pre-fills, which says on its face where it came from.
+ */
+export declare function simCognitoDefaultSubject(provider: SimCognitoUserPoolIdentityProvider): string;
+/**
+ * The external user an authorize request presented, where it presented one.
+ *
+ * This is the stand-in page for a provider coming back. Nothing is kept on the
+ * provider afterwards, because real Cognito asks the provider afresh on every
+ * authorize request, and `signInAs` stays what a test says it with.
+ */
+export declare function simCognitoPresentedExternalUser(input: SimCognitoAuthorizeInput): SimCognitoExternalUser | undefined;
+/**
+ * Who a provider is signing in for one authorize request.
+ *
+ * A request presenting a subject of its own is the stand-in page for the
+ * provider coming back, and it wins, because real Cognito asks the provider
+ * afresh every time rather than remembering the last answer. Where it presents
+ * none, the user `signInAs` put at the provider signs in. Where there is
+ * neither, the request is refused with what a served domain draws that page
+ * from.
+ */
+export declare function requireSimCognitoSigningInAt(provider: SimCognitoUserPoolIdentityProvider, input: SimCognitoAuthorizeInput): SimCognitoExternalUser;

package/dist/service/cognito/user-pool/idp/sim-cognito-presented-external-user.js

@@ -0,0 +1,94 @@
+import { SimCognitoProviderSignInRequired } from "../../error/sim-cognito-managed-login.error.js";
+import { SimCognitoExternalUser } from "./sim-cognito-external-user.js";
+/**
+ * What a claim field is called on the stand-in provider page.
+ *
+ * The names after it are the provider's own claim names, so they are prefixed
+ * to keep them apart from the authorize parameters the form posts beside them.
+ */
+export const simCognitoClaimFieldPrefix = "claim_";
+/**
+ * The address a claim the page reads as an email address is pre-filled with.
+ *
+ * `example.com` is reserved for exactly this, so nothing a person leaves
+ * unedited can reach a real mailbox.
+ */
+const defaultAddress = "someone@example.com";
+/**
+ * What every other claim is pre-filled with.
+ */
+const defaultClaimValue = "Someone";
+/**
+ * The claim names a provider's attribute mapping reads.
+ *
+ * The mapping is keyed by pool attribute and valued by claim, so the values
+ * are what a provider would have asserted and what the page asks for.
+ */
+export function simCognitoMappedClaimNames(provider) {
+    return [...new Set(Object.values(provider.attributeMapping.toOutput()))];
+}
+/**
+ * What one claim field is pre-filled with, so that the page signs a user in
+ * when nobody edits it.
+ *
+ * An address has to look like one, because a pool that verifies or aliases by
+ * email holds it to that. Everything else is a name as far as this knows.
+ */
+export function simCognitoDefaultClaim(claimName) {
+    return claimName.toLowerCase().includes("email")
+        ? defaultAddress
+        : defaultClaimValue;
+}
+/**
+ * The subject the page pre-fills, which says on its face where it came from.
+ */
+export function simCognitoDefaultSubject(provider) {
+    return `simulated-${provider.name.toLowerCase()}-subject`;
+}
+/**
+ * The external user an authorize request presented, where it presented one.
+ *
+ * This is the stand-in page for a provider coming back. Nothing is kept on the
+ * provider afterwards, because real Cognito asks the provider afresh on every
+ * authorize request, and `signInAs` stays what a test says it with.
+ */
+export function simCognitoPresentedExternalUser(input) {
+    const { subject } = input;
+    if (subject === undefined || subject === "") {
+        return undefined;
+    }
+    return new SimCognitoExternalUser({
+        Subject: subject,
+        Claims: simCognitoPresentedClaims(input),
+    });
+}
+/**
+ * Who a provider is signing in for one authorize request.
+ *
+ * A request presenting a subject of its own is the stand-in page for the
+ * provider coming back, and it wins, because real Cognito asks the provider
+ * afresh every time rather than remembering the last answer. Where it presents
+ * none, the user `signInAs` put at the provider signs in. Where there is
+ * neither, the request is refused with what a served domain draws that page
+ * from.
+ */
+export function requireSimCognitoSigningInAt(provider, input) {
+    const presented = simCognitoPresentedExternalUser(input) ?? provider.signedInUser;
+    if (presented === undefined) {
+        throw new SimCognitoProviderSignInRequired(provider.name);
+    }
+    return presented;
+}
+/**
+ * The claims a posted form carried, by the provider's own claim names.
+ */
+function simCognitoPresentedClaims(input) {
+    const claims = {};
+    const fields = Object.entries(input);
+    for (const [name, value] of fields) {
+        if (value !== undefined && name.startsWith(simCognitoClaimFieldPrefix)) {
+            claims[name.slice(simCognitoClaimFieldPrefix.length)] = value;
+        }
+    }
+    return claims;
+}

package/dist/service/cognito/user-pool/idp/sim-cognito-same-federated-identity.d.ts

@@ -0,0 +1,13 @@
+import type { SimCognitoUser } from "../user/sim-cognito-user.js";
+import type { SimCognitoExternalUser } from "./sim-cognito-external-user.js";
+import type { SimCognitoUserPoolIdentityProvider } from "./sim-cognito-user-pool-identity-provider.js";
+/**
+ * Refuse a federated sign-in that would take over a user it did not create.
+ *
+ * A username is only reserved by being taken, and a pool's own user may validly
+ * be called `Google_1234`, so the user found by name is the federated one only
+ * when its identity says so. Signing in as it otherwise would hand an
+ * application a token for someone else's account, which is worth refusing
+ * rather than guessing at.
+ */
+export declare function requireSimCognitoSameFederatedIdentity(existing: SimCognitoUser, provider: SimCognitoUserPoolIdentityProvider, externalUser: SimCognitoExternalUser): void;

package/dist/service/cognito/user-pool/idp/sim-cognito-same-federated-identity.js

@@ -0,0 +1,19 @@
+import { SimCognitoUsernameExistsException } from "../../error/sim-cognito.error.js";
+/**
+ * Refuse a federated sign-in that would take over a user it did not create.
+ *
+ * A username is only reserved by being taken, and a pool's own user may validly
+ * be called `Google_1234`, so the user found by name is the federated one only
+ * when its identity says so. Signing in as it otherwise would hand an
+ * application a token for someone else's account, which is worth refusing
+ * rather than guessing at.
+ */
+export function requireSimCognitoSameFederatedIdentity(existing, provider, externalUser) {
+    const { identity } = existing;
+    if (identity?.providerName !== provider.name ||
+        identity.userId !== externalUser.subject) {
+        throw new SimCognitoUsernameExistsException(`User ${existing.username} already exists in user pool ` +
+            `${provider.userPoolId} and is not the ${provider.name} user this ` +
+            `sign-in is for.`);
+    }
+}

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.d.ts

@@ -69,6 +69,13 @@ export declare class SimCognitoUserPoolIdentityProvider {
      * Sign out of this provider, so a further authorize request finds nobody.
      */
     signOut(): void;
+    /**
+     * The user signed in at this provider, where anything has put one there.
+     *
+     * A request that presents an external user of its own reads this first, to
+     * find out whether it has to ask for one.
+     */
+    get signedInUser(): SimCognitoExternalUser | undefined;
     /**
      * The user this provider signs in, or a refusal.
      *

package/dist/service/cognito/user-pool/idp/sim-cognito-user-pool-identity-provider.js

@@ -88,6 +88,15 @@ export class SimCognitoUserPoolIdentityProvider {
     signOut() {
         this.externalUser = undefined;
     }
+    /**
+     * The user signed in at this provider, where anything has put one there.
+     *
+     * A request that presents an external user of its own reads this first, to
+     * find out whether it has to ask for one.
+     */
+    get signedInUser() {
+        return this.externalUser;
+    }
     /**
      * The user this provider signs in, or a refusal.
      *

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-name.d.ts

@@ -3,8 +3,9 @@
  *
  * These are the ones that fire around a sign-up, around a sign-in, around a
  * message, and over the tokens a sign-in hands out, which is the part of a
- * user's life this simulation has. A pool federates with nobody, so the
- * federation triggers would never run whatever a pool named for them.
+ * user's life this simulation has. A federated sign-in reaches four of them,
+ * under the sources real Cognito reports for a user arriving from an identity
+ * provider.
  */
 export declare const simCognitoTriggerNames: readonly ["PreSignUp", "PostConfirmation", "PreAuthentication", "PostAuthentication", "PreTokenGeneration", "CustomMessage"];
 export type SimCognitoTriggerName = (typeof simCognitoTriggerNames)[number];

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-name.js

@@ -3,8 +3,9 @@
  *
  * These are the ones that fire around a sign-up, around a sign-in, around a
  * message, and over the tokens a sign-in hands out, which is the part of a
- * user's life this simulation has. A pool federates with nobody, so the
- * federation triggers would never run whatever a pool named for them.
+ * user's life this simulation has. A federated sign-in reaches four of them,
+ * under the sources real Cognito reports for a user arriving from an identity
+ * provider.
  */
 export const simCognitoTriggerNames = [
     "PreSignUp",

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.d.ts

@@ -25,6 +25,15 @@ export declare class SimCognitoTriggerOccasion {
      * confirmation.
      */
     static readonly adminCreateUser: SimCognitoTriggerOccasion;
+    /**
+     * An external subject signing in at an identity provider for the first time.
+     *
+     * Real Cognito builds the pool's own user for a federated subject through
+     * the sign-up path, so the trigger that guards a sign-up guards this too.
+     * The attributes it carries are the ones the provider's `AttributeMapping`
+     * produced, which is what the handler has to decide on.
+     */
+    static readonly externalProviderSignUp: SimCognitoTriggerOccasion;
     /**
      * A signed-up user reaching `CONFIRMED`.
      *
@@ -53,6 +62,14 @@ export declare class SimCognitoTriggerOccasion {
      * The tokens a sign-in hands out.
      */
     static readonly tokenGeneration: SimCognitoTriggerOccasion;
+    /**
+     * The tokens a sign-in at an identity provider hands out.
+     *
+     * Real Cognito reports this source for a federated grant alone. A local
+     * user signing in at managed login reports `TokenGeneration_Authentication`,
+     * the same source its API sign-in reports.
+     */
+    static readonly hostedTokenGeneration: SimCognitoTriggerOccasion;
     /**
      * The tokens handed out where a sign-in finishes by answering the new
      * password challenge.
@@ -99,7 +116,7 @@ export declare class SimCognitoTriggerOccasion {
     /**
      * The `CustomMessage` occasion a message is being sent on.
      *
-     * One trigger covers all three, and the source is the only thing telling a
+     * One trigger covers all five, and the source is the only thing telling a
      * handler which it is firing for, so an application customising one message
      * and not another branches on it.
      */