@kensio/yulin 1.21.0 → 1.21.2

package/dist/service/cognito/error/sim-cognito-throttle.error.d.ts

@@ -0,0 +1,13 @@
+import { SimCognitoError } from "./sim-cognito.error.js";
+/**
+ * Simulated Cognito TooManyRequestsException error.
+ *
+ * Real Cognito answers this when a pool has turned a request away for rate
+ * limiting. Its own limits belong to the account and are mostly undocumented.
+ * Working one out here would be inventing a number, so a test says how many
+ * requests a pool should turn away and the pool turns away that many.
+ */
+export declare class SimCognitoTooManyRequestsException extends SimCognitoError {
+    readonly name = "TooManyRequestsException";
+    constructor(message: string);
+}

package/dist/service/cognito/error/sim-cognito-throttle.error.js

@@ -0,0 +1,15 @@
+import { SimCognitoError } from "./sim-cognito.error.js";
+/**
+ * Simulated Cognito TooManyRequestsException error.
+ *
+ * Real Cognito answers this when a pool has turned a request away for rate
+ * limiting. Its own limits belong to the account and are mostly undocumented.
+ * Working one out here would be inventing a number, so a test says how many
+ * requests a pool should turn away and the pool turns away that many.
+ */
+export class SimCognitoTooManyRequestsException extends SimCognitoError {
+    name = "TooManyRequestsException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}

package/dist/service/cognito/index.d.ts

@@ -65,5 +65,7 @@ export { SimCognitoAuthSession } from "./user-pool/auth/sim-cognito-auth-session
 export { SimCognitoIssuedToken } from "./user-pool/auth/sim-cognito-issued-token.js";
 export { SimCognitoPoolAuth } from "./user-pool/auth/sim-cognito-pool-auth.js";
 export { SimCognitoWebAuthnChallengeNotFoundException, SimCognitoWebAuthnConfigurationMissingException, SimCognitoWebAuthnCredentialNotSupportedException, SimCognitoWebAuthnOriginNotAllowedException, SimCognitoWebAuthnRelyingPartyMismatchException, } from "./error/sim-cognito-web-authn.error.js";
+export { SimCognitoTooManyRequestsException } from "./error/sim-cognito-throttle.error.js";
+export { SimCognitoRequestThrottle, type SimCognitoThrottledOperation, } from "./user-pool/auth/sim-cognito-request-throttle.js";
 export { isSimCognitoOAuthError, SimCognitoOAuthError, type SimCognitoOAuthErrorCode, } from "./error/sim-cognito-oauth.error.js";
 export { SimCognitoAliasExistsException, SimCognitoCodeMismatchException, SimCognitoDuplicateProviderException, SimCognitoEnableSoftwareTokenMfaException, SimCognitoError, SimCognitoExpiredCodeException, SimCognitoGroupExistsException, SimCognitoInvalidParameterException, SimCognitoInvalidPasswordException, SimCognitoNotAuthorizedException, SimCognitoPasswordResetRequiredException, SimCognitoResourceNotFoundException, SimCognitoSoftwareTokenMfaNotFoundException, SimCognitoUsernameExistsException, SimCognitoUserNotConfirmedException, SimCognitoUserNotFoundException, SimCognitoUserPoolAlreadyExists, SimCognitoUserPoolClientAlreadyExists, } from "./error/sim-cognito.error.js";

package/dist/service/cognito/index.js

@@ -57,5 +57,7 @@ export { SimCognitoAuthSession } from "./user-pool/auth/sim-cognito-auth-session
 export { SimCognitoIssuedToken } from "./user-pool/auth/sim-cognito-issued-token.js";
 export { SimCognitoPoolAuth } from "./user-pool/auth/sim-cognito-pool-auth.js";
 export { SimCognitoWebAuthnChallengeNotFoundException, SimCognitoWebAuthnConfigurationMissingException, SimCognitoWebAuthnCredentialNotSupportedException, SimCognitoWebAuthnOriginNotAllowedException, SimCognitoWebAuthnRelyingPartyMismatchException, } from "./error/sim-cognito-web-authn.error.js";
+export { SimCognitoTooManyRequestsException } from "./error/sim-cognito-throttle.error.js";
+export { SimCognitoRequestThrottle, } from "./user-pool/auth/sim-cognito-request-throttle.js";
 export { isSimCognitoOAuthError, SimCognitoOAuthError, } from "./error/sim-cognito-oauth.error.js";
 export { SimCognitoAliasExistsException, SimCognitoCodeMismatchException, SimCognitoDuplicateProviderException, SimCognitoEnableSoftwareTokenMfaException, SimCognitoError, SimCognitoExpiredCodeException, SimCognitoGroupExistsException, SimCognitoInvalidParameterException, SimCognitoInvalidPasswordException, SimCognitoNotAuthorizedException, SimCognitoPasswordResetRequiredException, SimCognitoResourceNotFoundException, SimCognitoSoftwareTokenMfaNotFoundException, SimCognitoUsernameExistsException, SimCognitoUserNotConfirmedException, SimCognitoUserNotFoundException, SimCognitoUserPoolAlreadyExists, SimCognitoUserPoolClientAlreadyExists, } from "./error/sim-cognito.error.js";

package/dist/service/cognito/metric/sim-cognito-counted-request.d.ts

@@ -0,0 +1,50 @@
+import type { SimCognitoRequestThrottle, SimCognitoThrottledOperation } from "../user-pool/auth/sim-cognito-request-throttle.js";
+import type { SimCognitoPoolMetrics } from "./sim-cognito-pool-metrics.js";
+/**
+ * What an authentication request answers with, as the count reads it.
+ */
+interface SimCognitoAuthenticationOutcome {
+    readonly AuthenticationResult?: unknown;
+}
+/**
+ * The pool and app client a counted request ran against.
+ *
+ * The client id is a string rather than a client, because a request an
+ * administrator made reaches the pool through no app client and is reported
+ * under a fixed name instead.
+ */
+export interface SimCognitoCountedScope {
+    readonly pool: {
+        readonly id: string;
+        readonly auth: {
+            readonly throttle: SimCognitoRequestThrottle;
+        };
+    };
+    readonly client: {
+        readonly id: string;
+    };
+}
+/**
+ * Run an authentication request and count whether it issued tokens.
+ *
+ * Real Cognito counts a sign-in successful once tokens have been issued, so a
+ * request answered with a challenge counts as a 0 and the response that
+ * finishes it counts as a 1.
+ */
+export declare function countedSimCognitoAuth<T extends SimCognitoAuthenticationOutcome>(metrics: SimCognitoPoolMetrics, operation: SimCognitoThrottledOperation, scope: SimCognitoCountedScope, run: () => Promise<T>): Promise<T>;
+/**
+ * Run a request that hands back no session and count whether it finished.
+ *
+ * A registration answers with a user rather than with tokens, so finishing is
+ * the whole of what makes one a success.
+ */
+export declare function countedSimCognitoCompletion<T>(metrics: SimCognitoPoolMetrics, operation: SimCognitoThrottledOperation, scope: SimCognitoCountedScope, run: () => Promise<T>): Promise<T>;
+/**
+ * Run a token grant and count it as a federation where it is one.
+ *
+ * A code from an identity provider becomes a `FederationSuccesses` at the
+ * tokens it is exchanged for. A code from the pool's own sign-in form is not a
+ * federation and counts nothing here.
+ */
+export declare function countedSimCognitoFederation<T>(metrics: SimCognitoPoolMetrics, scope: SimCognitoCountedScope, federated: boolean, run: () => Promise<T>): Promise<T>;
+export {};

package/dist/service/cognito/metric/sim-cognito-counted-request.js

@@ -0,0 +1,51 @@
+import { throttledSimCognitoRequest } from "./sim-cognito-throttled-request.js";
+/**
+ * Run a request and count whether it issued tokens.
+ *
+ * A request the pool refused counts as a 0 rather than going uncounted, which
+ * is what makes `Average` over the metric a success rate. The failure itself
+ * still reaches the caller.
+ */
+async function countedSimCognitoRequest(metrics, operation, scope, run, succeeded) {
+    let counted = false;
+    try {
+        const output = await throttledSimCognitoRequest(metrics, operation, scope, run);
+        counted = succeeded(output);
+        return output;
+    }
+    finally {
+        metrics.count(operation, scope.pool.id, scope.client.id, counted);
+    }
+}
+/**
+ * Run an authentication request and count whether it issued tokens.
+ *
+ * Real Cognito counts a sign-in successful once tokens have been issued, so a
+ * request answered with a challenge counts as a 0 and the response that
+ * finishes it counts as a 1.
+ */
+export async function countedSimCognitoAuth(metrics, operation, scope, run) {
+    return await countedSimCognitoRequest(metrics, operation, scope, run, (output) => output.AuthenticationResult !== undefined);
+}
+/**
+ * Run a request that hands back no session and count whether it finished.
+ *
+ * A registration answers with a user rather than with tokens, so finishing is
+ * the whole of what makes one a success.
+ */
+export async function countedSimCognitoCompletion(metrics, operation, scope, run) {
+    return await countedSimCognitoRequest(metrics, operation, scope, run, () => true);
+}
+/**
+ * Run a token grant and count it as a federation where it is one.
+ *
+ * A code from an identity provider becomes a `FederationSuccesses` at the
+ * tokens it is exchanged for. A code from the pool's own sign-in form is not a
+ * federation and counts nothing here.
+ */
+export async function countedSimCognitoFederation(metrics, scope, federated, run) {
+    if (!federated) {
+        return await run();
+    }
+    return await countedSimCognitoCompletion(metrics, "Federation", scope, run);
+}

package/dist/service/cognito/metric/sim-cognito-metrics.d.ts

@@ -0,0 +1,22 @@
+import type { SimCloudWatchDimensionInput } from "../../cloudwatch/metric/sim-cloudwatch-dimension.js";
+/**
+ * The namespace real Cognito publishes what it counts about a pool under.
+ */
+export declare const simCognitoMetricNamespace = "AWS/Cognito";
+/**
+ * The `UserPoolClient` real Cognito reports for a request an administrator
+ * made, which reaches the pool without going through an app client at all.
+ */
+export declare const simCognitoAdminClientDimension = "Admin";
+/**
+ * The `UserPoolClient` real Cognito reports for a request naming an app client
+ * the pool has none of. The id given is left out of the metric.
+ */
+export declare const simCognitoInvalidClientDimension = "Invalid";
+/**
+ * The dimensions every metric here carries.
+ *
+ * Real Cognito reports a pool's counts per app client as well as per pool, so
+ * one client's traffic can be watched on its own.
+ */
+export declare function simCognitoPoolDimensions(poolId: string, clientId: string): readonly SimCloudWatchDimensionInput[];

package/dist/service/cognito/metric/sim-cognito-metrics.js

@@ -0,0 +1,26 @@
+/**
+ * The namespace real Cognito publishes what it counts about a pool under.
+ */
+export const simCognitoMetricNamespace = "AWS/Cognito";
+/**
+ * The `UserPoolClient` real Cognito reports for a request an administrator
+ * made, which reaches the pool without going through an app client at all.
+ */
+export const simCognitoAdminClientDimension = "Admin";
+/**
+ * The `UserPoolClient` real Cognito reports for a request naming an app client
+ * the pool has none of. The id given is left out of the metric.
+ */
+export const simCognitoInvalidClientDimension = "Invalid";
+/**
+ * The dimensions every metric here carries.
+ *
+ * Real Cognito reports a pool's counts per app client as well as per pool, so
+ * one client's traffic can be watched on its own.
+ */
+export function simCognitoPoolDimensions(poolId, clientId) {
+    return [
+        { Name: "UserPool", Value: poolId },
+        { Name: "UserPoolClient", Value: clientId },
+    ];
+}

package/dist/service/cognito/metric/sim-cognito-pool-metrics.d.ts

@@ -0,0 +1,40 @@
+import type { SimCloudWatchServiceWriter } from "../../cloudwatch/write/sim-cloudwatch-service-writer.js";
+import type { SimCognitoThrottledOperation } from "../user-pool/auth/sim-cognito-request-throttle.js";
+interface SimCognitoPoolMetricsProperties {
+    readonly metrics: SimCloudWatchServiceWriter | undefined;
+}
+/**
+ * What a simulated user pool publishes about the requests it handles.
+ *
+ * Real Cognito publishes these without being asked and without a caller
+ * needing any permission, so they go in through simulated CloudWatch's service
+ * writer rather than through `PutMetricData`, which refuses the `AWS/Cognito`
+ * namespace exactly as an account does.
+ *
+ * A pool built on its own, outside a `SimAws` instance, has no CloudWatch to
+ * publish into and counts nothing.
+ */
+export declare class SimCognitoPoolMetrics {
+    #private;
+    constructor(properties: SimCognitoPoolMetricsProperties);
+    /**
+     * Count one request against the pool and app client that made it.
+     *
+     * Real Cognito publishes a `*Successes` on every request of the kind, as a 1
+     * where it issued tokens and a 0 where it did not, so `Average` over one is
+     * a success rate and `SampleCount` is the number of requests. A request that
+     * was refused before the pool was known counts nothing, because there is no
+     * `UserPool` to report it under.
+     */
+    count(operation: SimCognitoThrottledOperation, poolId: string, clientId: string, issuedTokens: boolean): void;
+    /**
+     * Count one request the pool turned away for rate limiting.
+     *
+     * Real Cognito counts a throttled request in both places. It is a 1 here and
+     * a 0 in the `*Successes` beside it, because a request that was turned away
+     * issued no tokens.
+     */
+    throttled(operation: SimCognitoThrottledOperation, poolId: string, clientId: string): void;
+    private publish;
+}
+export {};

package/dist/service/cognito/metric/sim-cognito-pool-metrics.js

@@ -0,0 +1,51 @@
+import { simCognitoMetricNamespace, simCognitoPoolDimensions, } from "./sim-cognito-metrics.js";
+/**
+ * What a simulated user pool publishes about the requests it handles.
+ *
+ * Real Cognito publishes these without being asked and without a caller
+ * needing any permission, so they go in through simulated CloudWatch's service
+ * writer rather than through `PutMetricData`, which refuses the `AWS/Cognito`
+ * namespace exactly as an account does.
+ *
+ * A pool built on its own, outside a `SimAws` instance, has no CloudWatch to
+ * publish into and counts nothing.
+ */
+export class SimCognitoPoolMetrics {
+    #metrics;
+    constructor(properties) {
+        this.#metrics = properties.metrics;
+    }
+    /**
+     * Count one request against the pool and app client that made it.
+     *
+     * Real Cognito publishes a `*Successes` on every request of the kind, as a 1
+     * where it issued tokens and a 0 where it did not, so `Average` over one is
+     * a success rate and `SampleCount` is the number of requests. A request that
+     * was refused before the pool was known counts nothing, because there is no
+     * `UserPool` to report it under.
+     */
+    count(operation, poolId, clientId, issuedTokens) {
+        this.publish(`${operation}Successes`, poolId, clientId, issuedTokens ? 1 : 0);
+    }
+    /**
+     * Count one request the pool turned away for rate limiting.
+     *
+     * Real Cognito counts a throttled request in both places. It is a 1 here and
+     * a 0 in the `*Successes` beside it, because a request that was turned away
+     * issued no tokens.
+     */
+    throttled(operation, poolId, clientId) {
+        this.publish(`${operation}Throttles`, poolId, clientId, 1);
+    }
+    publish(metricName, poolId, clientId, value) {
+        this.#metrics?.publish([
+            {
+                namespace: simCognitoMetricNamespace,
+                metricName,
+                dimensions: simCognitoPoolDimensions(poolId, clientId),
+                value,
+                unit: "Count",
+            },
+        ]);
+    }
+}

package/dist/service/cognito/metric/sim-cognito-throttled-request.d.ts

@@ -0,0 +1,11 @@
+import type { SimCognitoThrottledOperation } from "../user-pool/auth/sim-cognito-request-throttle.js";
+import type { SimCognitoCountedScope } from "./sim-cognito-counted-request.js";
+import type { SimCognitoPoolMetrics } from "./sim-cognito-pool-metrics.js";
+/**
+ * Turn a request away where the pool has been told to, and run it otherwise.
+ *
+ * The refusal is counted here, and the `*Successes` beside it is counted by
+ * the caller that wrapped this, because real Cognito counts a throttled
+ * request as an unsuccessful one as well as a throttled one.
+ */
+export declare function throttledSimCognitoRequest<T>(metrics: SimCognitoPoolMetrics, operation: SimCognitoThrottledOperation, scope: SimCognitoCountedScope, run: () => Promise<T>): Promise<T>;

package/dist/service/cognito/metric/sim-cognito-throttled-request.js

@@ -0,0 +1,15 @@
+import { SimCognitoTooManyRequestsException } from "../error/sim-cognito-throttle.error.js";
+/**
+ * Turn a request away where the pool has been told to, and run it otherwise.
+ *
+ * The refusal is counted here, and the `*Successes` beside it is counted by
+ * the caller that wrapped this, because real Cognito counts a throttled
+ * request as an unsuccessful one as well as a throttled one.
+ */
+export async function throttledSimCognitoRequest(metrics, operation, scope, run) {
+    if (!scope.pool.auth.throttle.takesOne(operation)) {
+        return await run();
+    }
+    metrics.throttled(operation, scope.pool.id, scope.client.id);
+    throw new SimCognitoTooManyRequestsException(`Rate exceeded for ${operation} on user pool ${scope.pool.id}.`);
+}

package/dist/service/cognito/serve/page/sim-cognito-managed-login.d.ts

@@ -14,6 +14,7 @@ export declare class SimCognitoManagedLogin {
     private readonly pageRequest;
     private readonly signInPage;
     private readonly passkeyPage;
+    private readonly providerPage;
     private readonly signUpPage;
     private readonly confirmPage;
     private readonly forgotPasswordPage;

package/dist/service/cognito/serve/page/sim-cognito-managed-login.js

@@ -1,9 +1,10 @@
-import { isSimCognitoManagedLoginRequired, isSimCognitoPasskeyRequired, } from "../../error/sim-cognito-managed-login.error.js";
+import { isSimCognitoManagedLoginRequired, isSimCognitoPasskeyRequired, isSimCognitoProviderSignInRequired, } from "../../error/sim-cognito-managed-login.error.js";
 import { isSimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
 import { SimCognitoConfirmPage } from "./sim-cognito-confirm-page.js";
 import { SimCognitoForgotPasswordPage } from "./sim-cognito-forgot-password-page.js";
 import { SimCognitoPageForm } from "./sim-cognito-page-form.js";
 import { SimCognitoPasskeyPage } from "./sim-cognito-passkey-page.js";
+import { SimCognitoProviderPage } from "./sim-cognito-provider-page.js";
 import { simCognitoForgotPasswordPath, simCognitoIsLocalSignIn, simCognitoPagePaths, simCognitoResetPasswordPath, simCognitoSignUpPath, } from "./sim-cognito-page-paths.js";
 import { SimCognitoResetPasswordPage } from "./sim-cognito-reset-password-page.js";
 import { SimCognitoPageRequest } from "./sim-cognito-page-request.js";
@@ -23,6 +24,7 @@ export class SimCognitoManagedLogin {
     pageRequest = new SimCognitoPageRequest();
     signInPage = new SimCognitoSignInPage();
     passkeyPage = new SimCognitoPasskeyPage();
+    providerPage = new SimCognitoProviderPage();
     signUpPage = new SimCognitoSignUpPage();
     confirmPage = new SimCognitoConfirmPage();
     forgotPasswordPage = new SimCognitoForgotPasswordPage();
@@ -71,6 +73,9 @@ export class SimCognitoManagedLogin {
         if (isSimCognitoPasskeyRequired(error)) {
             return this.passkeyPage.render(parameters, error.username, error.session);
         }
+        if (isSimCognitoProviderSignInRequired(error)) {
+            return this.providerPage.render(request.pool.auth.identityProviders.require(error.providerName), parameters);
+        }
         if (isSimCognitoOAuthError(error) || !simCognitoIsLocalSignIn(parameters)) {
             return undefined;
         }

package/dist/service/cognito/serve/page/sim-cognito-page-markup.d.ts

@@ -37,8 +37,11 @@ export declare class SimCognitoPageMarkup {
     form(action: string, body: string): string;
     /**
      * One labelled input, with the label naming the field it is for.
+     *
+     * A field given a value arrives filled in, which is what lets a page a
+     * person only has to press the button on still carry what it needs.
      */
-    field(name: string, label: string, type?: string): string;
+    field(name: string, label: string, type?: string, value?: string): string;
     /**
      * The parameters this page carries on to the next one.
      */

package/dist/service/cognito/serve/page/sim-cognito-page-markup.js

@@ -59,12 +59,16 @@ export class SimCognitoPageMarkup {
     }
     /**
      * One labelled input, with the label naming the field it is for.
+     *
+     * A field given a value arrives filled in, which is what lets a page a
+     * person only has to press the button on still carry what it needs.
      */
-    field(name, label, type = "text") {
+    field(name, label, type = "text", value = "") {
         const escapedName = this.escaped(name);
         return (`<p><label for="${escapedName}">${this.escaped(label)}</label>\n` +
             `<input id="${escapedName}" name="${escapedName}" ` +
-            `type="${this.escaped(type)}" required></p>\n`);
+            `type="${this.escaped(type)}" value="${this.escaped(value)}" ` +
+            `required></p>\n`);
     }
     /**
      * The parameters this page carries on to the next one.

package/dist/service/cognito/serve/page/sim-cognito-provider-page.d.ts

@@ -0,0 +1,35 @@
+import type { SimCognitoUserPoolIdentityProvider } from "../../user-pool/idp/sim-cognito-user-pool-identity-provider.js";
+import { type SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
+/**
+ * The page a browser reaches where real Cognito would have sent it to an
+ * identity provider's own sign-in page.
+ *
+ * Nothing here calls Google, so there is no page to send anybody to and no
+ * password for anybody to type. This stands in for that page: it asks who the
+ * provider would have said is signing in, and the answer goes back to the
+ * authorize endpoint as the subject and the claims a provider asserts. A test
+ * says the same thing with `signInAs` and never sees this.
+ *
+ * It says whose page it is on its face, twice, because somebody meeting it in
+ * a screenshot or a screen recording has to be able to tell at a glance that
+ * no real sign-in happened here.
+ */
+export declare class SimCognitoProviderPage {
+    private readonly markup;
+    /**
+     * The page asking who the provider is signing in.
+     *
+     * Every field arrives filled in, so the common case is pressing the button.
+     * Editing the address is what drives a federated sign-up against a pool that
+     * already holds a local user at the same address, which real Cognito keeps
+     * as two accounts.
+     */
+    render(provider: SimCognitoUserPoolIdentityProvider, parameters: SimCognitoPageParameters): Response;
+    /**
+     * One field per claim the provider's attribute mapping reads.
+     *
+     * A claim the mapping says nothing about reaches no pool attribute, so
+     * asking for one would be asking for something to throw away.
+     */
+    private claimFields;
+}

package/dist/service/cognito/serve/page/sim-cognito-provider-page.js

@@ -0,0 +1,50 @@
+import { simCognitoClaimFieldPrefix, simCognitoDefaultClaim, simCognitoDefaultSubject, simCognitoMappedClaimNames, } from "../../user-pool/idp/sim-cognito-presented-external-user.js";
+import { SimCognitoPageMarkup, } from "./sim-cognito-page-markup.js";
+import { simCognitoAuthorizePath } from "./sim-cognito-page-paths.js";
+/**
+ * The page a browser reaches where real Cognito would have sent it to an
+ * identity provider's own sign-in page.
+ *
+ * Nothing here calls Google, so there is no page to send anybody to and no
+ * password for anybody to type. This stands in for that page: it asks who the
+ * provider would have said is signing in, and the answer goes back to the
+ * authorize endpoint as the subject and the claims a provider asserts. A test
+ * says the same thing with `signInAs` and never sees this.
+ *
+ * It says whose page it is on its face, twice, because somebody meeting it in
+ * a screenshot or a screen recording has to be able to tell at a glance that
+ * no real sign-in happened here.
+ */
+export class SimCognitoProviderPage {
+    markup = new SimCognitoPageMarkup();
+    /**
+     * The page asking who the provider is signing in.
+     *
+     * Every field arrives filled in, so the common case is pressing the button.
+     * Editing the address is what drives a federated sign-up against a pool that
+     * already holds a local user at the same address, which real Cognito keeps
+     * as two accounts.
+     */
+    render(provider, parameters) {
+        const body = this.markup.message(`This is Yulin standing in for ${provider.name}. It is not ` +
+            `${provider.name}, nobody has signed in there, and nothing on this ` +
+            `page reaches it. Say who ${provider.name} would have said is ` +
+            `signing in, and the pool signs that user in.`) +
+            this.markup.form(simCognitoAuthorizePath, this.markup.hidden(parameters) +
+                this.markup.field("subject", `Subject, which ${provider.name} identifies the user by`, "text", simCognitoDefaultSubject(provider)) +
+                this.claimFields(provider) +
+                this.markup.submit("continue", `Continue as this ${provider.name} user`));
+        return this.markup.page(`Simulated ${provider.name} sign-in`, body);
+    }
+    /**
+     * One field per claim the provider's attribute mapping reads.
+     *
+     * A claim the mapping says nothing about reaches no pool attribute, so
+     * asking for one would be asking for something to throw away.
+     */
+    claimFields(provider) {
+        return simCognitoMappedClaimNames(provider)
+            .map((claimName) => this.markup.field(`${simCognitoClaimFieldPrefix}${claimName}`, `${claimName} claim`, "text", simCognitoDefaultClaim(claimName)))
+            .join("");
+    }
+}

package/dist/service/cognito/sim-cognito-identity-provider.d.ts

@@ -1,6 +1,7 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimCloudWatchServiceWriter } from "../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import { SimAwsMessageLog } from "../aws/message/sim-aws-message-log.js";
 import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { type SimWafProtection } from "../wafv2/association/sim-waf-protection.js";
@@ -17,6 +18,11 @@ import { type SimCognitoTriggerFunctions } from "./user-pool/trigger/sim-cognito
 export type { SimCognitoIdentityProviderRequestOptions } from "./sim-cognito-user-directory.js";
 interface SimCognitoIdentityProviderProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
+    /**
+     * Where this pool's own `AWS/Cognito` metrics go. A provider built on its
+     * own has none, and counts nothing.
+     */
+    readonly metrics?: SimCloudWatchServiceWriter;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
     /**

package/dist/service/cognito/sim-cognito-identity-provider.js

@@ -55,6 +55,7 @@ export class SimCognitoIdentityProvider extends SimCognitoUserPools {
                 emailSenders,
                 webAcls,
                 messageLog,
+                metrics: properties.metrics,
             }),
             background,
         });

package/dist/service/cognito/sim-cognito-user-directory.js

@@ -33,21 +33,21 @@ export class SimCognitoUserDirectory extends SimCognitoUserFactors {
      */
     async confirmSignUp(command) {
         await this.background.sequence();
-        return this.commands.signUp.confirmSignUp(command);
+        return this.commands.confirmSignUp.confirmSignUp(command);
     }
     /**
      * Handle a ResendConfirmationCode Command from the SDK.
      */
     async resendConfirmationCode(command) {
         await this.background.sequence();
-        return this.commands.signUp.resendConfirmationCode(command);
+        return this.commands.confirmSignUp.resendConfirmationCode(command);
     }
     /**
      * Handle an AdminConfirmSignUp Command from the SDK.
      */
     async adminConfirmSignUp(command, options) {
         await this.background.sequence();
-        return this.commands.signUp.adminConfirmSignUp(command, options);
+        return this.commands.confirmSignUp.adminConfirmSignUp(command, options);
     }
     /**
      * Handle a ForgotPassword Command from the SDK.

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code.d.ts

@@ -13,6 +13,14 @@ interface SimCognitoAuthorizationCodeProperties {
      * has to produce the verifier for.
      */
     readonly codeChallenge?: string | undefined;
+    /**
+     * Whether the sign-in this code came from happened at an identity provider.
+     *
+     * The token endpoint reads it to pick the `PreTokenGeneration` source, which
+     * real Cognito reports as `TokenGeneration_HostedAuth` for a federated grant
+     * and `TokenGeneration_Authentication` for a local one.
+     */
+    readonly federated?: boolean | undefined;
 }
 /**
  * One authorization code, which is what an authorization code grant carries
@@ -29,6 +37,7 @@ export declare class SimCognitoAuthorizationCode {
     readonly redirectUri: string;
     readonly scopes: readonly string[];
     readonly issuedAt: Date;
+    readonly federated: boolean;
     private readonly codeChallenge;
     constructor(properties: SimCognitoAuthorizationCodeProperties);
     /**

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code.js

@@ -24,6 +24,7 @@ export class SimCognitoAuthorizationCode {
     redirectUri;
     scopes;
     issuedAt;
+    federated;
     codeChallenge;
     constructor(properties) {
         this.value = randomUUID();
@@ -32,6 +33,7 @@ export class SimCognitoAuthorizationCode {
         this.redirectUri = properties.redirectUri;
         this.scopes = properties.scopes;
         this.issuedAt = properties.issuedAt;
+        this.federated = properties.federated ?? false;
         this.codeChallenge = properties.codeChallenge;
     }
     /**

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts

@@ -1,3 +1,4 @@
+import { SimCognitoRequestThrottle } from "./sim-cognito-request-throttle.js";
 import { SimCognitoIdentityProviderStore } from "../idp/sim-cognito-identity-provider-store.js";
 import type { SimCognitoUserPoolDomain } from "../domain/sim-cognito-user-pool-domain.js";
 import type { SimCognitoAuthSession } from "./sim-cognito-auth-session.js";
@@ -26,6 +27,13 @@ export declare class SimCognitoPoolAuth {
      * The external identity providers this pool federates to.
      */
     readonly identityProviders: SimCognitoIdentityProviderStore;
+    /**
+     * How many requests of each kind this pool has been told to turn away.
+     *
+     * The simulator's own control rather than anything real Cognito exposes: a
+     * real pool's rate limits belong to the account and no API sets them.
+     */
+    readonly throttle: SimCognitoRequestThrottle;
     private readonly sessions;
     private readonly managedLogin;
     private readonly codes;

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js

@@ -1,4 +1,5 @@
 import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
+import { SimCognitoRequestThrottle } from "./sim-cognito-request-throttle.js";
 import { SimCognitoIdentityProviderStore } from "../idp/sim-cognito-identity-provider-store.js";
 import { SimCognitoAuthSessionStore, } from "./sim-cognito-auth-session-store.js";
 import { SimCognitoAuthorizationCodeStore } from "./sim-cognito-authorization-code-store.js";
@@ -23,6 +24,13 @@ export class SimCognitoPoolAuth {
      * The external identity providers this pool federates to.
      */
     identityProviders = new SimCognitoIdentityProviderStore();
+    /**
+     * How many requests of each kind this pool has been told to turn away.
+     *
+     * The simulator's own control rather than anything real Cognito exposes: a
+     * real pool's rate limits belong to the account and no API sets them.
+     */
+    throttle = new SimCognitoRequestThrottle();
     sessions = new SimCognitoAuthSessionStore();
     managedLogin = new SimCognitoManagedLoginSessionStore();
     codes = new SimCognitoAuthorizationCodeStore();