@kensio/yulin 1.6.1 → 1.8.0

package/dist/service/cognito/user-pool/token/sim-cognito-claims-override.js

@@ -0,0 +1,72 @@
+import { simCognitoGroupsClaim } from "./sim-cognito-reserved-claims.js";
+function withoutClaims(claims, dropped) {
+    return Object.fromEntries(Object.entries(claims).filter(([name]) => !dropped.has(name)));
+}
+/**
+ * What a `PreTokenGeneration` handler asked to change about a token's claims.
+ *
+ * A pool with no such trigger, and a handler that returned the event without
+ * writing a response, both produce an empty one of these, so the token layer
+ * applies an override either way rather than branching on whether there is one.
+ *
+ * The claim changes reach the id token, which is what a V1_0 trigger customises.
+ * The group override reaches the access token as well, because that is the one
+ * change real Cognito lets a V1_0 event make to an access token.
+ */
+export class SimCognitoClaimsOverride {
+    added;
+    suppressed;
+    groups;
+    constructor(properties) {
+        this.added = properties.added;
+        this.suppressed = properties.suppressed;
+        this.groups = properties.groups;
+    }
+    /**
+     * The override a token is issued under when no handler asked for one.
+     */
+    static none() {
+        return new SimCognitoClaimsOverride({
+            added: new Map(),
+            suppressed: new Set(),
+            groups: undefined,
+        });
+    }
+    /**
+     * The id token's claims, with the handler's changes applied.
+     *
+     * Suppression runs last, so a claim named in both `claimsToAddOrOverride` and
+     * `claimsToSuppress` is suppressed. Real Cognito resolves the pair the same
+     * way round.
+     */
+    applyTo(claims) {
+        return withoutClaims({ ...this.withGroups(claims), ...this.addedClaims() }, this.suppressed);
+    }
+    /**
+     * The access token's claims, with the group override applied and nothing
+     * else.
+     */
+    applyGroupsTo(claims) {
+        return this.withGroups(claims);
+    }
+    addedClaims() {
+        return Object.fromEntries(this.added);
+    }
+    /**
+     * The claims with `cognito:groups` replaced by the groups the handler named.
+     *
+     * A handler that named no group at all suppresses the claim rather than
+     * carrying an empty list, which is what a pool does for a user in no groups.
+     */
+    withGroups(claims) {
+        if (this.groups === undefined) {
+            return claims;
+        }
+        const withoutGroups = withoutClaims(claims, new Set([simCognitoGroupsClaim]));
+        if (this.groups.length === 0) {
+            return withoutGroups;
+        }
+        return { ...withoutGroups, [simCognitoGroupsClaim]: [...this.groups] };
+    }
+}
+//# sourceMappingURL=sim-cognito-claims-override.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-claims-override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-claims-override.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-claims-override.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAiBzE,SAAS,aAAa,CACpB,MAA6B,EAC7B,OAA4B;IAE5B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,wBAAwB;IAClB,KAAK,CAA8B;IACnC,UAAU,CAAsB;IAChC,MAAM,CAAgC;IAEvD,YAAY,UAA8C;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI;QACT,OAAO,IAAI,wBAAwB,CAAC;YAClC,KAAK,EAAE,IAAI,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,GAAG,EAAE;YACrB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAA6B;QACnC,OAAO,aAAa,CAClB,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,EACrD,IAAI,CAAC,UAAU,CAChB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,MAA6B;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAEO,WAAW;QACjB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,MAA6B;QAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CACjC,MAAM,EACN,IAAI,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CACjC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACzE,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-group-override.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The groups a handler asked the `cognito:groups` claim to carry, or nothing
+ * when it said nothing about groups and the user's own are to stand.
+ *
+ * A `groupOverrideDetails` that is there but empty, or null, suppresses the
+ * claim, as it does on real Cognito. That is why the key being present is what
+ * matters rather than what it holds.
+ */
+export declare function readSimCognitoGroupOverride(details: Record<string, unknown>): readonly string[] | undefined;
+//# sourceMappingURL=sim-cognito-group-override.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-group-override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-override.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-group-override.ts"],"names":[],"mappings":"AAkBA;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,SAAS,MAAM,EAAE,GAAG,SAAS,CAsB/B"}

package/dist/service/cognito/user-pool/token/sim-cognito-group-override.js

@@ -0,0 +1,54 @@
+/* eslint-disable security/detect-object-injection -- every lookup here is a
+   field name this simulation asks for, such as `groupsToOverride`, read out of
+   the plain object a trigger handler returned. */
+import { refuseSimCognitoResponse, requireSimCognitoResponseObject, requireSimCognitoResponseStrings, } from "./sim-cognito-claims-override-values.js";
+/**
+ * The fields of `groupOverrideDetails` that name IAM roles.
+ *
+ * Both feed claims this simulation does not issue, so a handler naming one is
+ * refused rather than half-applied: the groups would change and the roles the
+ * handler asked for would silently not be there.
+ */
+const roleOverrideFields = ["iamRolesToOverride", "preferredRole"];
+/**
+ * The groups a handler asked the `cognito:groups` claim to carry, or nothing
+ * when it said nothing about groups and the user's own are to stand.
+ *
+ * A `groupOverrideDetails` that is there but empty, or null, suppresses the
+ * claim, as it does on real Cognito. That is why the key being present is what
+ * matters rather than what it holds.
+ */
+export function readSimCognitoGroupOverride(details) {
+    if (!("groupOverrideDetails" in details)) {
+        return undefined;
+    }
+    const overrideDetails = details["groupOverrideDetails"];
+    if (overrideDetails === undefined || overrideDetails === null) {
+        return [];
+    }
+    const group = requireSimCognitoResponseObject(overrideDetails, "groupOverrideDetails");
+    refuseRoleOverrides(group);
+    return requireSimCognitoResponseStrings(group["groupsToOverride"], "groupsToOverride");
+}
+/**
+ * Refuse a group override naming IAM roles.
+ *
+ * A field that is there and names no role is left alone, so a handler copying
+ * the request's group configuration back into its response, which is how real
+ * Cognito says to leave the groups as they are, is accepted.
+ */
+function refuseRoleOverrides(group) {
+    for (const field of roleOverrideFields) {
+        const value = group[field];
+        if (value === undefined || value === null) {
+            continue;
+        }
+        if (Array.isArray(value) && value.length === 0) {
+            continue;
+        }
+        refuseSimCognitoResponse(`a groupOverrideDetails naming ${field}. The cognito:roles and ` +
+            `cognito:preferred_role claims are not issued on a token here, so ` +
+            `the roles it names would go nowhere while its groups were applied.`);
+    }
+}
+//# sourceMappingURL=sim-cognito-group-override.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-group-override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-override.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-group-override.ts"],"names":[],"mappings":"AAAA;;kDAEkD;AAClD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAU,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAgC;IAEhC,IAAI,CAAC,CAAC,sBAAsB,IAAI,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,eAAe,GAAY,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEjE,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,+BAA+B,CAC3C,eAAe,EACf,sBAAsB,CACvB,CAAC;IAEF,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE3B,OAAO,gCAAgC,CACrC,KAAK,CAAC,kBAAkB,CAAC,EACzB,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAA8B;IACzD,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,wBAAwB,CACtB,iCAAiC,KAAK,0BAA0B;YAC9D,mEAAmE;YACnE,oEAAoE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/user-pool/token/sim-cognito-reserved-claims.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The claim a group override is written against, which is the one `cognito:`
+ * claim a handler may name in `claimsToSuppress`.
+ */
+export declare const simCognitoGroupsClaim = "cognito:groups";
+/**
+ * Refuse a claim a handler asked to add or override that it may not.
+ *
+ * Refusing is the divergence worth having. Real Cognito silently ignores an
+ * override of a reserved claim, so a handler that appears to work here and does
+ * nothing in production is exactly the failure this simulation exists to catch.
+ */
+export declare function requireSimCognitoOverridableClaim(claim: string): void;
+/**
+ * Refuse a claim a handler asked to suppress that it may not.
+ *
+ * `cognito:groups` is suppressible, as it is on real Cognito, and it is the one
+ * `cognito:` claim that is. Suppressing it is also how real Cognito takes the
+ * role claims off a token, so a handler naming one of those directly is refused
+ * and told which claim to name instead.
+ */
+export declare function requireSimCognitoSuppressibleClaim(claim: string): void;
+//# sourceMappingURL=sim-cognito-reserved-claims.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-reserved-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-reserved-claims.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-reserved-claims.ts"],"names":[],"mappings":"AA8BA;;;GAGG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAoBrE;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAWtE"}

package/dist/service/cognito/user-pool/token/sim-cognito-reserved-claims.js

@@ -0,0 +1,82 @@
+import { SimCognitoInvalidLambdaResponseException } from "../../error/sim-cognito-trigger.error.js";
+/**
+ * The claims a `PreTokenGeneration` handler may not add, override or suppress.
+ *
+ * These are the ones real Cognito reserves: the JWT registered claims that say
+ * when a token was issued and who by, and the Cognito claims that identify the
+ * user and the token. A handler naming one of them changes nothing on real
+ * Cognito, which drops the override without saying so.
+ */
+const reservedClaims = new Set([
+    "acr",
+    "amr",
+    "at_hash",
+    "aud",
+    "auth_time",
+    "azp",
+    "cognito:username",
+    "exp",
+    "iat",
+    "identities",
+    "iss",
+    "jti",
+    "nbf",
+    "nonce",
+    "origin_jti",
+    "sub",
+    "token_use",
+]);
+/**
+ * The claim a group override is written against, which is the one `cognito:`
+ * claim a handler may name in `claimsToSuppress`.
+ */
+export const simCognitoGroupsClaim = "cognito:groups";
+/**
+ * Refuse a claim a handler asked to add or override that it may not.
+ *
+ * Refusing is the divergence worth having. Real Cognito silently ignores an
+ * override of a reserved claim, so a handler that appears to work here and does
+ * nothing in production is exactly the failure this simulation exists to catch.
+ */
+export function requireSimCognitoOverridableClaim(claim) {
+    if (claim === simCognitoGroupsClaim) {
+        throw new SimCognitoInvalidLambdaResponseException(`The PreTokenGeneration trigger returned claimsToAddOrOverride naming ` +
+            `${simCognitoGroupsClaim}, which real Cognito ignores there. Use ` +
+            `groupOverrideDetails.groupsToOverride to change the groups on a ` +
+            `token.`);
+    }
+    if (claim.startsWith("cognito:")) {
+        throw new SimCognitoInvalidLambdaResponseException(`The PreTokenGeneration trigger returned claimsToAddOrOverride naming ` +
+            `${claim}. Real Cognito reserves the cognito: claims and ignores an ` +
+            `override of one, so the token would carry the value it was going to ` +
+            `carry anyway.`);
+    }
+    requireUnreservedClaim(claim, "claimsToAddOrOverride");
+}
+/**
+ * Refuse a claim a handler asked to suppress that it may not.
+ *
+ * `cognito:groups` is suppressible, as it is on real Cognito, and it is the one
+ * `cognito:` claim that is. Suppressing it is also how real Cognito takes the
+ * role claims off a token, so a handler naming one of those directly is refused
+ * and told which claim to name instead.
+ */
+export function requireSimCognitoSuppressibleClaim(claim) {
+    if (claim !== simCognitoGroupsClaim && claim.startsWith("cognito:")) {
+        throw new SimCognitoInvalidLambdaResponseException(`The PreTokenGeneration trigger returned claimsToSuppress naming ` +
+            `${claim}. ${simCognitoGroupsClaim} is the only cognito: claim real ` +
+            `Cognito suppresses, and suppressing that one is what takes the ` +
+            `cognito:roles and cognito:preferred_role claims with it.`);
+    }
+    requireUnreservedClaim(claim, "claimsToSuppress");
+}
+function requireUnreservedClaim(claim, field) {
+    if (!reservedClaims.has(claim)) {
+        return;
+    }
+    throw new SimCognitoInvalidLambdaResponseException(`The PreTokenGeneration trigger returned ${field} naming the reserved ` +
+        `claim ${claim}. Real Cognito issues that claim itself and ignores a ` +
+        `handler that names it, so a token here would not carry what the ` +
+        `handler asked for either.`);
+}
+//# sourceMappingURL=sim-cognito-reserved-claims.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-reserved-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-reserved-claims.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-reserved-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wCAAwC,EAAE,MAAM,0CAA0C,CAAC;AAEpG;;;;;;;GAOG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,KAAK;IACL,KAAK;IACL,SAAS;IACT,KAAK;IACL,WAAW;IACX,KAAK;IACL,kBAAkB;IAClB,KAAK;IACL,KAAK;IACL,YAAY;IACZ,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,YAAY;IACZ,KAAK;IACL,WAAW;CACZ,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAAa;IAC7D,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;QACpC,MAAM,IAAI,wCAAwC,CAChD,uEAAuE;YACrE,GAAG,qBAAqB,0CAA0C;YAClE,kEAAkE;YAClE,QAAQ,CACX,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,wCAAwC,CAChD,uEAAuE;YACrE,GAAG,KAAK,6DAA6D;YACrE,sEAAsE;YACtE,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAAa;IAC9D,IAAI,KAAK,KAAK,qBAAqB,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,wCAAwC,CAChD,kEAAkE;YAChE,GAAG,KAAK,KAAK,qBAAqB,mCAAmC;YACrE,iEAAiE;YACjE,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,wCAAwC,CAChD,2CAA2C,KAAK,uBAAuB;QACrE,SAAS,KAAK,wDAAwD;QACtE,kEAAkE;QAClE,2BAA2B,CAC9B,CAAC;AACJ,CAAC"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts

@@ -1,6 +1,8 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoTriggerOccasion } from "../trigger/sim-cognito-trigger-occasion.js";
+import type { SimCognitoUserPoolTriggers } from "../trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUser } from "../user/sim-cognito-user.js";
 /**
  * The tokens one authentication produced.
@@ -17,11 +19,22 @@ export interface SimCognitoIssuedTokens {
 }
 interface SimCognitoTokenIssuerProperties {
     readonly clock: SimClock;
+    readonly triggers: SimCognitoUserPoolTriggers;
 }
 interface SimCognitoIssueTokensProperties {
     readonly pool: SimCognitoUserPool;
     readonly client: SimCognitoUserPoolClient;
     readonly user: SimCognitoUser;
+    /**
+     * What the pool is issuing tokens for, which is what a `PreTokenGeneration`
+     * handler reads as its `triggerSource`.
+     */
+    readonly occasion: SimCognitoTriggerOccasion;
+    /**
+     * The `ClientMetadata` the request carried, which reaches the token trigger
+     * from a challenge response and from nowhere else, as on real Cognito.
+     */
+    readonly clientMetadata?: Readonly<Record<string, string>> | undefined;
 }
 /**
  * Issues the tokens a successful authentication answers with.
@@ -33,9 +46,15 @@ interface SimCognitoIssueTokensProperties {
  *
  * What it issues is remembered on the pool, because the pool is what a refresh
  * or a sign-out presents a token back to.
+ *
+ * The pool's `PreTokenGeneration` trigger runs here, because this is where the
+ * claims of a token are settled. It runs on a refresh as well as on a sign-in,
+ * so a claim a handler changed between the two is not stale on the reissued
+ * token.
  */
 export declare class SimCognitoTokenIssuer {
     private readonly clock;
+    private readonly triggers;
     constructor(properties: SimCognitoTokenIssuerProperties);
     private static expiryOf;
     /**
@@ -45,8 +64,12 @@ export declare class SimCognitoTokenIssuer {
      * The two JWTs last as long as the app client says, which is an hour each
      * unless the client was created with its own validity, and the refresh token
      * lasts the thirty days real Cognito gives one by default.
+     *
+     * The refresh token is minted after the JWTs are signed, so a
+     * `PreTokenGeneration` handler that refuses the request leaves the pool
+     * holding no token from a sign-in that never answered with one.
      */
-    issue(properties: SimCognitoIssueTokensProperties): SimCognitoIssuedTokens;
+    issue(properties: SimCognitoIssueTokensProperties): Promise<SimCognitoIssuedTokens>;
     /**
      * Sign a fresh id token and access token for a user that presented a refresh
      * token.
@@ -55,8 +78,9 @@ export declare class SimCognitoTokenIssuer {
      * refresh token rotation off, so the caller keeps using the one it has until
      * that expires.
      */
-    reissue(properties: SimCognitoIssueTokensProperties): SimCognitoIssuedTokens;
+    reissue(properties: SimCognitoIssueTokensProperties): Promise<SimCognitoIssuedTokens>;
     private signTokens;
+    private claimsOverride;
 }
 export {};
 //# sourceMappingURL=sim-cognito-token-issuer.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAalE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,EAAE,+BAA+B,GAAG,sBAAsB,CAmBzE;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU,EAAE,+BAA+B,GAAG,sBAAsB,CAE3E;IAED,OAAO,CAAC,UAAU;CA8CnB"}
+{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAoBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;YAEa,UAAU;YAqDV,cAAc;CAY7B"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js

@@ -20,11 +20,18 @@ const refreshTokenBytes = 48;
  *
  * What it issues is remembered on the pool, because the pool is what a refresh
  * or a sign-out presents a token back to.
+ *
+ * The pool's `PreTokenGeneration` trigger runs here, because this is where the
+ * claims of a token are settled. It runs on a refresh as well as on a sign-in,
+ * so a claim a handler changed between the two is not stale on the reissued
+ * token.
  */
 export class SimCognitoTokenIssuer {
     clock;
+    triggers;
     constructor(properties) {
         this.clock = properties.clock;
+        this.triggers = properties.triggers;
     }
     static expiryOf(issuedAt, seconds) {
         return new Date(issuedAt.getTime() + seconds * 1000);
@@ -36,10 +43,15 @@ export class SimCognitoTokenIssuer {
      * The two JWTs last as long as the app client says, which is an hour each
      * unless the client was created with its own validity, and the refresh token
      * lasts the thirty days real Cognito gives one by default.
+     *
+     * The refresh token is minted after the JWTs are signed, so a
+     * `PreTokenGeneration` handler that refuses the request leaves the pool
+     * holding no token from a sign-in that never answered with one.
      */
-    issue(properties) {
+    async issue(properties) {
         const { pool, client, user } = properties;
         const issuedAt = this.clock.now();
+        const signed = await this.signTokens(properties, issuedAt);
         const refreshToken = randomBytes(refreshTokenBytes).toString("base64url");
         pool.auth.addRefreshToken(new SimCognitoIssuedToken({
             value: refreshToken,
@@ -48,7 +60,7 @@ export class SimCognitoTokenIssuer {
             issuedAt,
             expiresAt: SimCognitoTokenIssuer.expiryOf(issuedAt, client.tokenValidity.refreshToken.seconds),
         }));
-        return { ...this.signTokens(properties, issuedAt), refreshToken };
+        return { ...signed, refreshToken };
     }
     /**
      * Sign a fresh id token and access token for a user that presented a refresh
@@ -58,11 +70,12 @@ export class SimCognitoTokenIssuer {
      * refresh token rotation off, so the caller keeps using the one it has until
      * that expires.
      */
-    reissue(properties) {
-        return this.signTokens(properties, this.clock.now());
+    async reissue(properties) {
+        return await this.signTokens(properties, this.clock.now());
     }
-    signTokens(properties, issuedAt) {
+    async signTokens(properties, issuedAt) {
         const { pool, client, user } = properties;
+        const claimsOverride = await this.claimsOverride(properties);
         const accessTokenSeconds = client.tokenValidity.accessToken.seconds;
         const accessTokenExpiresAt = SimCognitoTokenIssuer.expiryOf(issuedAt, accessTokenSeconds);
         const idToken = new SimCognitoIdToken({
@@ -77,7 +90,10 @@ export class SimCognitoTokenIssuer {
             expiresAt: accessTokenExpiresAt,
             tokenId: randomUUID(),
         });
-        const signedAccessToken = pool.signingKey.sign(accessToken.claims());
+        // A V1_0 trigger customises the id token, and the one change it makes to an
+        // access token is the group override, which is why the access token is
+        // signed with that alone applied.
+        const signedAccessToken = pool.signingKey.sign(claimsOverride.applyGroupsTo(accessToken.claims()));
         pool.auth.addAccessToken(new SimCognitoIssuedToken({
             value: signedAccessToken,
             username: user.username,
@@ -86,10 +102,19 @@ export class SimCognitoTokenIssuer {
             expiresAt: accessTokenExpiresAt,
         }));
         return {
-            idToken: pool.signingKey.sign(idToken.claims()),
+            idToken: pool.signingKey.sign(claimsOverride.applyTo(idToken.claims())),
             accessToken: signedAccessToken,
             expiresIn: accessTokenSeconds,
         };
     }
+    async claimsOverride(properties) {
+        const { pool, client, user, occasion, clientMetadata } = properties;
+        return await this.triggers.preTokenGeneration(occasion, {
+            pool,
+            client,
+            user,
+            clientMetadata,
+        });
+    }
 }
 //# sourceMappingURL=sim-cognito-token-issuer.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAI5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA0B7B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAEjC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAA2C;QAC/C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;SACF,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IACpE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,UAA2C;QACjD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IAEO,UAAU,CAChB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;SAChC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/C,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAuC7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;SACF,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;SAChC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/trigger/sim-aws-cognito-trigger-functions.d.ts

@@ -0,0 +1,55 @@
+import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimCognitoTriggerFunctionRequest, SimCognitoTriggerFunctions } from "./sim-cognito-trigger-functions.js";
+/**
+ * The service principal real Cognito invokes a user pool trigger as.
+ */
+export declare const simCognitoServicePrincipal = "cognito-idp.amazonaws.com";
+interface SimAwsCognitoTriggerFunctionsProperties {
+    readonly simAws: SimAws;
+}
+/**
+ * The Lambda functions a simulated user pool's triggers can reach.
+ *
+ * A `LambdaConfig` names a function by ARN, and that ARN can name any Account
+ * and Region, so the functions come from the whole simulation rather than from
+ * the scope the pool belongs to.
+ */
+export declare function simAwsCognitoTriggerFunctions(simAws: SimAws): SimCognitoTriggerFunctions;
+/**
+ * The simulated Lambda functions of one simulated AWS instance, as user pool
+ * trigger targets.
+ *
+ * Functions are looked up when a trigger fires, never when a pool is created,
+ * so a pool can be created before the function it names and one deleted
+ * afterwards refuses the sign-in rather than having silently broken the pool.
+ * That also keeps CloudFormation free to deploy the two in either order.
+ */
+export declare class SimAwsCognitoTriggerFunctions implements SimCognitoTriggerFunctions {
+    private readonly simAws;
+    constructor(properties: SimAwsCognitoTriggerFunctionsProperties);
+    /**
+     * Why the pool may not invoke the function, or nothing when it may.
+     *
+     * Whether a service may invoke a function is Lambda's own rule, so the
+     * decision is made there. What Cognito adds is which pool is calling, supplied
+     * as the source ARN and source Account, so a permission granted for one pool
+     * does not open the function to another.
+     */
+    invokeRefusal(request: SimCognitoTriggerFunctionRequest): string | undefined;
+    /**
+     * Invoke the function with the trigger event, answering with what the
+     * handler returned.
+     *
+     * The function is invoked directly rather than through an Invoke command,
+     * because real Cognito invokes it as the service rather than as the caller
+     * signing in, and because the handler's return value and its failure both
+     * have to reach the sign-in rather than being reported as an invocation
+     * result.
+     */
+    invoke(request: SimCognitoTriggerFunctionRequest, event: object): Promise<unknown>;
+    private policyRefusal;
+    private findFunction;
+    private iam;
+}
+export {};
+//# sourceMappingURL=sim-aws-cognito-trigger-functions.d.ts.map

package/dist/service/cognito/user-pool/trigger/sim-aws-cognito-trigger-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-cognito-trigger-functions.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-aws-cognito-trigger-functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAQtD,OAAO,KAAK,EACV,gCAAgC,EAChC,0BAA0B,EAC3B,MAAM,oCAAoC,CAAC;AAE5C;;GAEG;AACH,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AAEtE,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,MAAM,GACb,0BAA0B,CAE5B;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA8B,YAAW,0BAA0B;IAC9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,UAAU,EAAE,uCAAuC,EAE9D;IAED;;;;;;;OAOG;IACH,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,MAAM,GAAG,SAAS,CAsB3E;IAED;;;;;;;;;OASG;IACG,MAAM,CACV,OAAO,EAAE,gCAAgC,EACzC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAWlB;IAED,OAAO,CAAC,aAAa;IAyBrB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,GAAG;CAKZ"}

package/dist/service/cognito/user-pool/trigger/sim-aws-cognito-trigger-functions.js

@@ -0,0 +1,101 @@
+import { SimLambdaServiceInvokeAuthorizer } from "../../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
+import { parseSimLambdaFunctionArn, } from "../../../lambda/function/sim-lambda-function-arn-parts.js";
+/**
+ * The service principal real Cognito invokes a user pool trigger as.
+ */
+export const simCognitoServicePrincipal = "cognito-idp.amazonaws.com";
+/**
+ * The Lambda functions a simulated user pool's triggers can reach.
+ *
+ * A `LambdaConfig` names a function by ARN, and that ARN can name any Account
+ * and Region, so the functions come from the whole simulation rather than from
+ * the scope the pool belongs to.
+ */
+export function simAwsCognitoTriggerFunctions(simAws) {
+    return new SimAwsCognitoTriggerFunctions({ simAws });
+}
+/**
+ * The simulated Lambda functions of one simulated AWS instance, as user pool
+ * trigger targets.
+ *
+ * Functions are looked up when a trigger fires, never when a pool is created,
+ * so a pool can be created before the function it names and one deleted
+ * afterwards refuses the sign-in rather than having silently broken the pool.
+ * That also keeps CloudFormation free to deploy the two in either order.
+ */
+export class SimAwsCognitoTriggerFunctions {
+    simAws;
+    constructor(properties) {
+        this.simAws = properties.simAws;
+    }
+    /**
+     * Why the pool may not invoke the function, or nothing when it may.
+     *
+     * Whether a service may invoke a function is Lambda's own rule, so the
+     * decision is made there. What Cognito adds is which pool is calling, supplied
+     * as the source ARN and source Account, so a permission granted for one pool
+     * does not open the function to another.
+     */
+    invokeRefusal(request) {
+        const arn = parseSimLambdaFunctionArn(request.functionArn);
+        if (arn === undefined) {
+            return `${request.functionArn} is not a Lambda function ARN.`;
+        }
+        if (arn.qualifier !== undefined) {
+            return (`${request.functionArn} names a function version or alias, and ` +
+                "simulated Lambda has neither, so it is refused rather than treated " +
+                "as the unqualified function.");
+        }
+        const simFunction = this.findFunction(arn);
+        if (simFunction === undefined) {
+            return `${request.functionArn} is not a simulated Lambda function.`;
+        }
+        return this.policyRefusal(simFunction, request);
+    }
+    /**
+     * Invoke the function with the trigger event, answering with what the
+     * handler returned.
+     *
+     * The function is invoked directly rather than through an Invoke command,
+     * because real Cognito invokes it as the service rather than as the caller
+     * signing in, and because the handler's return value and its failure both
+     * have to reach the sign-in rather than being reported as an invocation
+     * result.
+     */
+    async invoke(request, event) {
+        const arn = parseSimLambdaFunctionArn(request.functionArn);
+        const simFunction = arn === undefined ? undefined : this.findFunction(arn);
+        if (simFunction === undefined) {
+            throw new Error(`${request.functionArn} is not a simulated Lambda function.`);
+        }
+        return await simFunction.invoke(event);
+    }
+    policyRefusal(simFunction, request) {
+        const decision = new SimLambdaServiceInvokeAuthorizer({
+            iam: this.iam(simFunction),
+        }).authorize({
+            simFunction,
+            servicePrincipal: simCognitoServicePrincipal,
+            sourceArn: request.userPoolArn,
+            sourceAccount: request.userPoolAccountId,
+        });
+        if (decision.isDenied) {
+            return (`The resource policy of ${request.functionArn} does not allow ` +
+                `${simCognitoServicePrincipal} to invoke it for ` +
+                `${request.userPoolArn}. Grant it with AddPermission, or with the ` +
+                "AWS::Lambda::Permission a CDK addTrigger emits.");
+        }
+        return undefined;
+    }
+    findFunction(arn) {
+        return this.simAws
+            .accountRegionScope(arn.accountId, arn.regionName)
+            .lambda()
+            .getSimFunctionByName(arn.functionName);
+    }
+    iam(simFunction) {
+        const { accountId, regionName } = simFunction.accountRegionScope;
+        return this.simAws.accountRegionScope(accountId, regionName).iam();
+    }
+}
+//# sourceMappingURL=sim-aws-cognito-trigger-functions.js.map

package/dist/service/cognito/user-pool/trigger/sim-aws-cognito-trigger-functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-cognito-trigger-functions.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-aws-cognito-trigger-functions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAE7H,OAAO,EACL,yBAAyB,GAE1B,MAAM,2DAA2D,CAAC;AAMnE;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAMtE;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAc;IAEd,OAAO,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA6B;IACvB,MAAM,CAAS;IAEhC,YAAY,UAAmD;QAC7D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CAAC,OAAyC;QACrD,MAAM,GAAG,GAAG,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAE3D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,GAAG,OAAO,CAAC,WAAW,gCAAgC,CAAC;QAChE,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CACL,GAAG,OAAO,CAAC,WAAW,0CAA0C;gBAChE,qEAAqE;gBACrE,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,GAAG,OAAO,CAAC,WAAW,sCAAsC,CAAC;QACtE,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CACV,OAAyC,EACzC,KAAa;QAEb,MAAM,GAAG,GAAG,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAE3E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,WAAW,sCAAsC,CAC7D,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEO,aAAa,CACnB,WAA8B,EAC9B,OAAyC;QAEzC,MAAM,QAAQ,GAAG,IAAI,gCAAgC,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;SAC3B,CAAC,CAAC,SAAS,CAAC;YACX,WAAW;YACX,gBAAgB,EAAE,0BAA0B;YAC5C,SAAS,EAAE,OAAO,CAAC,WAAW;YAC9B,aAAa,EAAE,OAAO,CAAC,iBAAiB;SACzC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,CACL,0BAA0B,OAAO,CAAC,WAAW,kBAAkB;gBAC/D,GAAG,0BAA0B,oBAAoB;gBACjD,GAAG,OAAO,CAAC,WAAW,6CAA6C;gBACnE,iDAAiD,CAClD,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,YAAY,CAClB,GAA8B;QAE9B,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;aACjD,MAAM,EAAE;aACR,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAEO,GAAG,CAAC,WAA8B;QACxC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,kBAAkB,CAAC;QAEjE,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;CACF"}