@kensio/yulin 1.7.0 → 1.9.0

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-invocation.d.ts

@@ -0,0 +1,33 @@
+import type { SimCognitoTriggerContext } from "./sim-cognito-trigger-context.js";
+import type { SimCognitoTriggerFunctions } from "./sim-cognito-trigger-functions.js";
+import type { SimCognitoTriggerOccasion } from "./sim-cognito-trigger-occasion.js";
+/**
+ * Reaching the function a pool's trigger names.
+ *
+ * A pool with no trigger for the occasion runs nothing, which is the ordinary
+ * case and costs a map lookup. A pool with one invokes it and waits: these
+ * triggers are synchronous, so the request is held up until the handler
+ * answers, as it is on real Cognito.
+ *
+ * The function's resource policy is checked on every invocation rather than
+ * remembered from the first, because a permission revoked afterwards stops the
+ * trigger on real Cognito too.
+ */
+export declare class SimCognitoTriggerInvocation {
+    private readonly functions;
+    constructor(functions: SimCognitoTriggerFunctions);
+    /**
+     * Invoke the trigger for one occasion, answering with what the handler
+     * returned, or with nothing where the pool has no such trigger.
+     */
+    run(occasion: SimCognitoTriggerOccasion, context: SimCognitoTriggerContext): Promise<unknown>;
+    /**
+     * Invoke the handler, reporting a failure the way real Cognito reports one.
+     *
+     * The handler's own message is repeated because that is the whole mechanism a
+     * `PreSignUp` or `PreAuthentication` trigger refuses a request with: it
+     * throws, and the words it threw are what the caller is told.
+     */
+    private invoke;
+}
+//# sourceMappingURL=sim-cognito-trigger-invocation.d.ts.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-invocation.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-invocation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAGnF;;;;;;;;;;;GAWG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IAEvD,YAAY,SAAS,EAAE,0BAA0B,EAEhD;IAED;;;OAGG;IACG,GAAG,CACP,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA2BlB;IAED;;;;;;OAMG;YACW,MAAM;CAkBrB"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-invocation.js

@@ -0,0 +1,61 @@
+import { SimCognitoUnexpectedLambdaException, SimCognitoUserLambdaValidationException, } from "../../error/sim-cognito-trigger.error.js";
+import { SimCognitoTriggerEvent } from "./sim-cognito-trigger-event.js";
+import { requireSimCognitoTriggerResponse } from "./sim-cognito-trigger-response.js";
+/**
+ * Reaching the function a pool's trigger names.
+ *
+ * A pool with no trigger for the occasion runs nothing, which is the ordinary
+ * case and costs a map lookup. A pool with one invokes it and waits: these
+ * triggers are synchronous, so the request is held up until the handler
+ * answers, as it is on real Cognito.
+ *
+ * The function's resource policy is checked on every invocation rather than
+ * remembered from the first, because a permission revoked afterwards stops the
+ * trigger on real Cognito too.
+ */
+export class SimCognitoTriggerInvocation {
+    functions;
+    constructor(functions) {
+        this.functions = functions;
+    }
+    /**
+     * Invoke the trigger for one occasion, answering with what the handler
+     * returned, or with nothing where the pool has no such trigger.
+     */
+    async run(occasion, context) {
+        const { trigger } = occasion;
+        const functionArn = context.pool.settings.lambdaConfig.find(trigger);
+        if (functionArn === undefined) {
+            return undefined;
+        }
+        const request = {
+            functionArn,
+            userPoolArn: context.pool.arn.value,
+            userPoolAccountId: context.pool.arn.accountId,
+        };
+        const refusal = this.functions.invokeRefusal(request);
+        if (refusal !== undefined) {
+            throw new SimCognitoUnexpectedLambdaException(`The ${trigger} trigger of user pool ${context.pool.id} could not be ` +
+                `invoked. ${refusal}`);
+        }
+        const returned = await this.invoke(occasion, request, context);
+        requireSimCognitoTriggerResponse(trigger, returned);
+        return returned;
+    }
+    /**
+     * Invoke the handler, reporting a failure the way real Cognito reports one.
+     *
+     * The handler's own message is repeated because that is the whole mechanism a
+     * `PreSignUp` or `PreAuthentication` trigger refuses a request with: it
+     * throws, and the words it threw are what the caller is told.
+     */
+    async invoke(occasion, request, context) {
+        try {
+            return await this.functions.invoke(request, new SimCognitoTriggerEvent(context).document(occasion));
+        }
+        catch (error) {
+            throw new SimCognitoUserLambdaValidationException(`${occasion.trigger} failed with error ${error instanceof Error ? error.message : String(error)}.`);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-trigger-invocation.js.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-invocation.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,uCAAuC,GACxC,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAMxE,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AAErF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,2BAA2B;IACrB,SAAS,CAA6B;IAEvD,YAAY,SAAqC;QAC/C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CACP,QAAmC,EACnC,OAAiC;QAEjC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAErE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAqC;YAChD,WAAW;YACX,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;YACnC,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS;SAC9C,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,mCAAmC,CAC3C,OAAO,OAAO,yBAAyB,OAAO,CAAC,IAAI,CAAC,EAAE,gBAAgB;gBACpE,YAAY,OAAO,EAAE,CACxB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE/D,gCAAgC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEpD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,MAAM,CAClB,QAAmC,EACnC,OAAyC,EACzC,OAAiC;QAEjC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAChC,OAAO,EACP,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACvD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uCAAuC,CAC/C,GAAG,QAAQ,CAAC,OAAO,sBACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-name.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The Lambda triggers a simulated user pool runs.
+ *
+ * These are the ones that fire around a sign-up, around a sign-in, around a
+ * message, and over the tokens a sign-in hands out, which is the part of a
+ * user's life this simulation has. A pool federates with nobody, so the
+ * federation triggers would never run whatever a pool named for them.
+ */
+export declare const simCognitoTriggerNames: readonly ["PreSignUp", "PostConfirmation", "PreAuthentication", "PostAuthentication", "PreTokenGeneration", "CustomMessage"];
+export type SimCognitoTriggerName = (typeof simCognitoTriggerNames)[number];
+/**
+ * The `LambdaConfig` keys real Cognito has that this simulation does not run,
+ * and why each one is refused rather than accepted and ignored.
+ *
+ * A pool that accepted one of these would sign users up or in without ever
+ * calling the function the template named, which is the difference between a
+ * stack that works here and one that works deployed.
+ */
+export declare const simCognitoUnsimulatedTriggers: ReadonlyMap<string, string>;
+//# sourceMappingURL=sim-cognito-trigger-name.d.ts.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-name.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-name.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,YACjC,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,CACP,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAqBlE,CAAC"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-name.js

@@ -0,0 +1,46 @@
+/**
+ * The Lambda triggers a simulated user pool runs.
+ *
+ * These are the ones that fire around a sign-up, around a sign-in, around a
+ * message, and over the tokens a sign-in hands out, which is the part of a
+ * user's life this simulation has. A pool federates with nobody, so the
+ * federation triggers would never run whatever a pool named for them.
+ */
+export const simCognitoTriggerNames = [
+    "PreSignUp",
+    "PostConfirmation",
+    "PreAuthentication",
+    "PostAuthentication",
+    "PreTokenGeneration",
+    "CustomMessage",
+];
+/**
+ * The `LambdaConfig` keys real Cognito has that this simulation does not run,
+ * and why each one is refused rather than accepted and ignored.
+ *
+ * A pool that accepted one of these would sign users up or in without ever
+ * calling the function the template named, which is the difference between a
+ * stack that works here and one that works deployed.
+ */
+export const simCognitoUnsimulatedTriggers = new Map([
+    [
+        "PreTokenGenerationConfig",
+        "the V2_0 and V3_0 token triggers, which customise access token claims " +
+            "and scopes. Name the function in PreTokenGeneration for the V1_0 " +
+            "trigger, which customises the id token",
+    ],
+    ["DefineAuthChallenge", "the custom authentication challenge flow"],
+    ["CreateAuthChallenge", "the custom authentication challenge flow"],
+    ["VerifyAuthChallengeResponse", "the custom authentication challenge flow"],
+    [
+        "UserMigration",
+        "importing a user from an external directory on first sign-in",
+    ],
+    ["CustomEmailSender", "sending the pool's email through a function"],
+    ["CustomSMSSender", "sending the pool's SMS through a function"],
+    [
+        "KMSKeyID",
+        "the key the custom sender triggers encrypt their codes under",
+    ],
+]);
+//# sourceMappingURL=sim-cognito-trigger-name.js.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-name.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-name.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,kBAAkB;IAClB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,eAAe;CACP,CAAC;AAIX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,IAAI,GAAG,CAAC;IACN;QACE,0BAA0B;QAC1B,wEAAwE;YACtE,mEAAmE;YACnE,wCAAwC;KAC3C;IACD,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;IACnE,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;IACnE,CAAC,6BAA6B,EAAE,0CAA0C,CAAC;IAC3E;QACE,eAAe;QACf,8DAA8D;KAC/D;IACD,CAAC,mBAAmB,EAAE,6CAA6C,CAAC;IACpE,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;IAChE;QACE,UAAU;QACV,8DAA8D;KAC/D;CACF,CAAC,CAAC"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.d.ts

@@ -0,0 +1,89 @@
+import type { SimCognitoMessageOccasion } from "../message/sim-cognito-message-occasion.js";
+import type { SimCognitoTriggerName } from "./sim-cognito-trigger-name.js";
+/**
+ * One occasion a simulated user pool fires a trigger on.
+ *
+ * A trigger and the occasion it fired on are not the same thing. `PreSignUp`
+ * runs both when a user signs itself up and when an admin creates one, and a
+ * handler tells the two apart by the `triggerSource` on the event. The pair
+ * travels together so a source is never derived from a trigger name, which
+ * would only work while every trigger had one.
+ *
+ * The source is the real string real Cognito sends, because that is what a
+ * handler written against a deployed pool branches on.
+ */
+export declare class SimCognitoTriggerOccasion {
+    /**
+     * A user signing itself up with `SignUp`.
+     */
+    static readonly signUp: SimCognitoTriggerOccasion;
+    /**
+     * An admin creating a user with `AdminCreateUser`.
+     *
+     * Real Cognito ignores everything a handler writes into the response on this
+     * occasion, because the user it is about to create is already past
+     * confirmation.
+     */
+    static readonly adminCreateUser: SimCognitoTriggerOccasion;
+    /**
+     * A signed-up user reaching `CONFIRMED`.
+     *
+     * `ConfirmSignUp`, `AdminConfirmSignUp` and a `PreSignUp` handler that
+     * auto-confirmed the user all report this one source, as they do on real
+     * Cognito.
+     */
+    static readonly confirmSignUp: SimCognitoTriggerOccasion;
+    /**
+     * A sign-in, before the user's password is checked.
+     */
+    static readonly preAuthentication: SimCognitoTriggerOccasion;
+    /**
+     * A sign-in, once the tokens have been issued.
+     */
+    static readonly postAuthentication: SimCognitoTriggerOccasion;
+    /**
+     * The tokens a sign-in hands out.
+     */
+    static readonly tokenGeneration: SimCognitoTriggerOccasion;
+    /**
+     * The tokens handed out where a sign-in finishes by answering the new
+     * password challenge.
+     *
+     * This is also the one occasion a request's `ClientMetadata` reaches the
+     * token trigger, because real Cognito passes it on from
+     * `RespondToAuthChallenge` and `AdminRespondToAuthChallenge` alone.
+     */
+    static readonly newPasswordTokenGeneration: SimCognitoTriggerOccasion;
+    /**
+     * The tokens a `REFRESH_TOKEN_AUTH` refresh hands out.
+     *
+     * Real Cognito runs the token trigger again here, so a claim a handler has
+     * changed since the sign-in reaches the reissued token rather than being
+     * stale for the life of the session.
+     */
+    static readonly refreshTokenGeneration: SimCognitoTriggerOccasion;
+    /**
+     * The verification message a user signing itself up is sent.
+     */
+    static readonly customMessageSignUp: SimCognitoTriggerOccasion;
+    /**
+     * The verification message a user asking for another code is sent.
+     */
+    static readonly customMessageResendCode: SimCognitoTriggerOccasion;
+    /**
+     * The invitation an admin-created user is sent.
+     */
+    static readonly customMessageAdminCreateUser: SimCognitoTriggerOccasion;
+    readonly trigger: SimCognitoTriggerName;
+    readonly source: string;
+    private constructor();
+    /**
+     * The `CustomMessage` occasion a message is being sent on.
+     *
+     * One trigger covers all three, and the source is the only thing telling a
+     * handler which it is firing for, so an application customising one message
+     * and not another branches on it.
+     */
+    static customMessage(occasion: SimCognitoMessageOccasion): SimCognitoTriggerOccasion;
+}
+//# sourceMappingURL=sim-cognito-trigger-occasion.d.ts.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-occasion.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;;;;;;GAWG;AACH,qBAAa,yBAAyB;IACpC;;OAEG;IACH,gBAAuB,MAAM,4BAG3B;IAEF;;;;;;OAMG;IACH,gBAAuB,eAAe,4BAGpC;IAEF;;;;;;OAMG;IACH,gBAAuB,aAAa,4BAGlC;IAEF;;OAEG;IACH,gBAAuB,iBAAiB,4BAGtC;IAEF;;OAEG;IACH,gBAAuB,kBAAkB,4BAGvC;IAEF;;OAEG;IACH,gBAAuB,eAAe,4BAGpC;IAEF;;;;;;;OAOG;IACH,gBAAuB,0BAA0B,4BAI7C;IAEJ;;;;;;OAMG;IACH,gBAAuB,sBAAsB,4BAG3C;IAEF;;OAEG;IACH,gBAAuB,mBAAmB,4BAGxC;IAEF;;OAEG;IACH,gBAAuB,uBAAuB,4BAC+B;IAE7E;;OAEG;IACH,gBAAuB,4BAA4B,4BAI/C;IAEJ,SAAgB,OAAO,EAAE,qBAAqB,CAAC;IAC/C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,eAGN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAClB,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,CAY3B;CACF"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.js

@@ -0,0 +1,102 @@
+/**
+ * One occasion a simulated user pool fires a trigger on.
+ *
+ * A trigger and the occasion it fired on are not the same thing. `PreSignUp`
+ * runs both when a user signs itself up and when an admin creates one, and a
+ * handler tells the two apart by the `triggerSource` on the event. The pair
+ * travels together so a source is never derived from a trigger name, which
+ * would only work while every trigger had one.
+ *
+ * The source is the real string real Cognito sends, because that is what a
+ * handler written against a deployed pool branches on.
+ */
+export class SimCognitoTriggerOccasion {
+    /**
+     * A user signing itself up with `SignUp`.
+     */
+    static signUp = new SimCognitoTriggerOccasion("PreSignUp", "PreSignUp_SignUp");
+    /**
+     * An admin creating a user with `AdminCreateUser`.
+     *
+     * Real Cognito ignores everything a handler writes into the response on this
+     * occasion, because the user it is about to create is already past
+     * confirmation.
+     */
+    static adminCreateUser = new SimCognitoTriggerOccasion("PreSignUp", "PreSignUp_AdminCreateUser");
+    /**
+     * A signed-up user reaching `CONFIRMED`.
+     *
+     * `ConfirmSignUp`, `AdminConfirmSignUp` and a `PreSignUp` handler that
+     * auto-confirmed the user all report this one source, as they do on real
+     * Cognito.
+     */
+    static confirmSignUp = new SimCognitoTriggerOccasion("PostConfirmation", "PostConfirmation_ConfirmSignUp");
+    /**
+     * A sign-in, before the user's password is checked.
+     */
+    static preAuthentication = new SimCognitoTriggerOccasion("PreAuthentication", "PreAuthentication_Authentication");
+    /**
+     * A sign-in, once the tokens have been issued.
+     */
+    static postAuthentication = new SimCognitoTriggerOccasion("PostAuthentication", "PostAuthentication_Authentication");
+    /**
+     * The tokens a sign-in hands out.
+     */
+    static tokenGeneration = new SimCognitoTriggerOccasion("PreTokenGeneration", "TokenGeneration_Authentication");
+    /**
+     * The tokens handed out where a sign-in finishes by answering the new
+     * password challenge.
+     *
+     * This is also the one occasion a request's `ClientMetadata` reaches the
+     * token trigger, because real Cognito passes it on from
+     * `RespondToAuthChallenge` and `AdminRespondToAuthChallenge` alone.
+     */
+    static newPasswordTokenGeneration = new SimCognitoTriggerOccasion("PreTokenGeneration", "TokenGeneration_NewPasswordChallenge");
+    /**
+     * The tokens a `REFRESH_TOKEN_AUTH` refresh hands out.
+     *
+     * Real Cognito runs the token trigger again here, so a claim a handler has
+     * changed since the sign-in reaches the reissued token rather than being
+     * stale for the life of the session.
+     */
+    static refreshTokenGeneration = new SimCognitoTriggerOccasion("PreTokenGeneration", "TokenGeneration_RefreshTokens");
+    /**
+     * The verification message a user signing itself up is sent.
+     */
+    static customMessageSignUp = new SimCognitoTriggerOccasion("CustomMessage", "CustomMessage_SignUp");
+    /**
+     * The verification message a user asking for another code is sent.
+     */
+    static customMessageResendCode = new SimCognitoTriggerOccasion("CustomMessage", "CustomMessage_ResendCode");
+    /**
+     * The invitation an admin-created user is sent.
+     */
+    static customMessageAdminCreateUser = new SimCognitoTriggerOccasion("CustomMessage", "CustomMessage_AdminCreateUser");
+    trigger;
+    source;
+    constructor(trigger, source) {
+        this.trigger = trigger;
+        this.source = source;
+    }
+    /**
+     * The `CustomMessage` occasion a message is being sent on.
+     *
+     * One trigger covers all three, and the source is the only thing telling a
+     * handler which it is firing for, so an application customising one message
+     * and not another branches on it.
+     */
+    static customMessage(occasion) {
+        switch (occasion) {
+            case "SignUp": {
+                return this.customMessageSignUp;
+            }
+            case "ResendCode": {
+                return this.customMessageResendCode;
+            }
+            case "AdminCreateUser": {
+                return this.customMessageAdminCreateUser;
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-trigger-occasion.js.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-occasion.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACI,MAAM,CAAU,MAAM,GAAG,IAAI,yBAAyB,CAC3D,WAAW,EACX,kBAAkB,CACnB,CAAC;IAEF;;;;;;OAMG;IACI,MAAM,CAAU,eAAe,GAAG,IAAI,yBAAyB,CACpE,WAAW,EACX,2BAA2B,CAC5B,CAAC;IAEF;;;;;;OAMG;IACI,MAAM,CAAU,aAAa,GAAG,IAAI,yBAAyB,CAClE,kBAAkB,EAClB,gCAAgC,CACjC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,iBAAiB,GAAG,IAAI,yBAAyB,CACtE,mBAAmB,EACnB,kCAAkC,CACnC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,kBAAkB,GAAG,IAAI,yBAAyB,CACvE,oBAAoB,EACpB,mCAAmC,CACpC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,eAAe,GAAG,IAAI,yBAAyB,CACpE,oBAAoB,EACpB,gCAAgC,CACjC,CAAC;IAEF;;;;;;;OAOG;IACI,MAAM,CAAU,0BAA0B,GAC/C,IAAI,yBAAyB,CAC3B,oBAAoB,EACpB,sCAAsC,CACvC,CAAC;IAEJ;;;;;;OAMG;IACI,MAAM,CAAU,sBAAsB,GAAG,IAAI,yBAAyB,CAC3E,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,mBAAmB,GAAG,IAAI,yBAAyB,CACxE,eAAe,EACf,sBAAsB,CACvB,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,uBAAuB,GAC5C,IAAI,yBAAyB,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IAE7E;;OAEG;IACI,MAAM,CAAU,4BAA4B,GACjD,IAAI,yBAAyB,CAC3B,eAAe,EACf,+BAA+B,CAChC,CAAC;IAEY,OAAO,CAAwB;IAC/B,MAAM,CAAS;IAE/B,YAAoB,OAA8B,EAAE,MAAc;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAClB,QAAmC;QAEnC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC,mBAAmB,CAAC;YAClC,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,uBAAuB,CAAC;YACtC,CAAC;YACD,KAAK,iBAAiB,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,4BAA4B,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-request.d.ts

@@ -0,0 +1,75 @@
+import type { SimCognitoTriggerContext } from "./sim-cognito-trigger-context.js";
+import { SimCognitoTriggerOccasion } from "./sim-cognito-trigger-occasion.js";
+/**
+ * The `request` half of the event one trigger is given.
+ *
+ * Each trigger reads its own set of fields, and two of them name the same data
+ * differently, which is not a detail to smooth over: a `PreAuthentication`
+ * handler reads `request.validationData` where a `PostAuthentication` one reads
+ * `request.clientMetadata`, and both come from the `ClientMetadata` the sign-in
+ * carried.
+ */
+export declare class SimCognitoTriggerRequest {
+    private readonly context;
+    constructor(context: SimCognitoTriggerContext);
+    /**
+     * The request for one occasion.
+     *
+     * Only `CustomMessage` reads the occasion rather than the trigger: it covers
+     * three of them, and the invitation is the one that names the user.
+     */
+    document(occasion: SimCognitoTriggerOccasion): object;
+    /**
+     * What a `PreTokenGeneration` handler is given.
+     *
+     * `groupConfiguration.groupsToOverride` is the user's groups in precedence
+     * order, which is what a handler copies back into `groupOverrideDetails` to
+     * leave the `cognito:groups` claim alone. The `iamRolesToOverride` and
+     * `preferredRole` real Cognito sends beside it are left out, because the
+     * claims they feed are not issued here and a response naming them is refused.
+     *
+     * The client metadata is there only where the occasion carried it, which is a
+     * challenge response and nothing else: real Cognito does not pass an
+     * `InitiateAuth` request's `ClientMetadata` on to this trigger.
+     */
+    private preTokenGeneration;
+    /**
+     * What a `PreSignUp` handler is given.
+     *
+     * The attributes carry no `sub`, because the user does not exist yet: real
+     * Cognito allocates one only once the sign-up has got past this handler. A
+     * handler keying an external record on `sub` has to do it in
+     * `PostConfirmation` instead, here as there.
+     */
+    private preSignUp;
+    /**
+     * What a `PostConfirmation` handler is given, which is the confirmed user's
+     * attributes with the `sub` Cognito allocated among them.
+     */
+    private postConfirmation;
+    /**
+     * What a `CustomMessage` handler is given.
+     *
+     * `codeParameter` is the placeholder rather than the code, as it is on real
+     * Cognito: a handler writes it into the message it returns and the code goes
+     * in afterwards. `usernameParameter` is there for the invitation an
+     * administrator's user is sent, which is the message that names the user.
+     *
+     * There is no `linkParameter`. Real Cognito passes one for a pool verifying
+     * by link, and `CONFIRM_WITH_LINK` is refused here, so a handler given one
+     * would be writing a link into a message no simulation ever follows.
+     */
+    private customMessage;
+    private preAuthentication;
+    private postAuthentication;
+    /**
+     * The user's attributes by name, as a trigger event carries them.
+     *
+     * The event is a plain object of strings rather than the `Name`/`Value` pairs
+     * the API answers with, and `sub` is among them.
+     */
+    private userAttributes;
+    private clientMetadata;
+    private validationData;
+}
+//# sourceMappingURL=sim-cognito-trigger-request.d.ts.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-request.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,OAAO,EAAE,wBAAwB,EAE5C;IAED;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM,CAqBpD;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,kBAAkB;IAc1B;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;IAQjB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,kBAAkB;IAU1B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,cAAc;CAOvB"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-request.js

@@ -0,0 +1,162 @@
+import { simCognitoCodeParameter, simCognitoUsernameParameter, } from "../message/sim-cognito-message-placeholders.js";
+import { SimCognitoTriggerOccasion } from "./sim-cognito-trigger-occasion.js";
+/**
+ * The `request` half of the event one trigger is given.
+ *
+ * Each trigger reads its own set of fields, and two of them name the same data
+ * differently, which is not a detail to smooth over: a `PreAuthentication`
+ * handler reads `request.validationData` where a `PostAuthentication` one reads
+ * `request.clientMetadata`, and both come from the `ClientMetadata` the sign-in
+ * carried.
+ */
+export class SimCognitoTriggerRequest {
+    context;
+    constructor(context) {
+        this.context = context;
+    }
+    /**
+     * The request for one occasion.
+     *
+     * Only `CustomMessage` reads the occasion rather than the trigger: it covers
+     * three of them, and the invitation is the one that names the user.
+     */
+    document(occasion) {
+        switch (occasion.trigger) {
+            case "PreSignUp": {
+                return this.preSignUp();
+            }
+            case "PostConfirmation": {
+                return this.postConfirmation();
+            }
+            case "PreAuthentication": {
+                return this.preAuthentication();
+            }
+            case "PostAuthentication": {
+                return this.postAuthentication();
+            }
+            case "PreTokenGeneration": {
+                return this.preTokenGeneration();
+            }
+            case "CustomMessage": {
+                return this.customMessage(occasion);
+            }
+        }
+    }
+    /**
+     * What a `PreTokenGeneration` handler is given.
+     *
+     * `groupConfiguration.groupsToOverride` is the user's groups in precedence
+     * order, which is what a handler copies back into `groupOverrideDetails` to
+     * leave the `cognito:groups` claim alone. The `iamRolesToOverride` and
+     * `preferredRole` real Cognito sends beside it are left out, because the
+     * claims they feed are not issued here and a response naming them is refused.
+     *
+     * The client metadata is there only where the occasion carried it, which is a
+     * challenge response and nothing else: real Cognito does not pass an
+     * `InitiateAuth` request's `ClientMetadata` on to this trigger.
+     */
+    preTokenGeneration() {
+        const { pool, user } = this.context;
+        return {
+            userAttributes: this.userAttributes(),
+            groupConfiguration: {
+                groupsToOverride: pool
+                    .groupsOf(user.username)
+                    .map((group) => group.name),
+            },
+            ...this.clientMetadata(),
+        };
+    }
+    /**
+     * What a `PreSignUp` handler is given.
+     *
+     * The attributes carry no `sub`, because the user does not exist yet: real
+     * Cognito allocates one only once the sign-up has got past this handler. A
+     * handler keying an external record on `sub` has to do it in
+     * `PostConfirmation` instead, here as there.
+     */
+    preSignUp() {
+        return {
+            userAttributes: Object.fromEntries(this.context.user.attributeValues),
+            ...this.validationData(),
+            ...this.clientMetadata(),
+        };
+    }
+    /**
+     * What a `PostConfirmation` handler is given, which is the confirmed user's
+     * attributes with the `sub` Cognito allocated among them.
+     */
+    postConfirmation() {
+        return { userAttributes: this.userAttributes(), ...this.clientMetadata() };
+    }
+    /**
+     * What a `CustomMessage` handler is given.
+     *
+     * `codeParameter` is the placeholder rather than the code, as it is on real
+     * Cognito: a handler writes it into the message it returns and the code goes
+     * in afterwards. `usernameParameter` is there for the invitation an
+     * administrator's user is sent, which is the message that names the user.
+     *
+     * There is no `linkParameter`. Real Cognito passes one for a pool verifying
+     * by link, and `CONFIRM_WITH_LINK` is refused here, so a handler given one
+     * would be writing a link into a message no simulation ever follows.
+     */
+    customMessage(occasion) {
+        return {
+            userAttributes: this.userAttributes(),
+            codeParameter: simCognitoCodeParameter,
+            ...(occasion ===
+                SimCognitoTriggerOccasion.customMessageAdminCreateUser && {
+                usernameParameter: simCognitoUsernameParameter,
+            }),
+            ...this.clientMetadata(),
+        };
+    }
+    preAuthentication() {
+        return {
+            userAttributes: this.userAttributes(),
+            ...(this.context.clientMetadata !== undefined && {
+                validationData: { ...this.context.clientMetadata },
+            }),
+            // A sign-in naming a user the pool does not hold is refused before any
+            // trigger runs here, so the trigger only ever sees a user that exists.
+            // Real Cognito fires it with `userNotFound: true` for an app client
+            // that hides user existence, which this simulation does not do.
+            userNotFound: false,
+        };
+    }
+    postAuthentication() {
+        return {
+            userAttributes: this.userAttributes(),
+            // Devices are not remembered here: `CreateUserPool` refuses a
+            // `DeviceConfiguration`, so no sign-in is ever made from a new device.
+            newDeviceUsed: false,
+            ...this.clientMetadata(),
+        };
+    }
+    /**
+     * The user's attributes by name, as a trigger event carries them.
+     *
+     * The event is a plain object of strings rather than the `Name`/`Value` pairs
+     * the API answers with, and `sub` is among them.
+     */
+    userAttributes() {
+        return {
+            sub: this.context.user.sub,
+            ...Object.fromEntries(this.context.user.attributeValues),
+        };
+    }
+    clientMetadata() {
+        if (this.context.clientMetadata === undefined) {
+            return {};
+        }
+        return { clientMetadata: { ...this.context.clientMetadata } };
+    }
+    validationData() {
+        if (this.context.validationData === undefined) {
+            return {};
+        }
+        return { validationData: { ...this.context.validationData } };
+    }
+}
+//# sourceMappingURL=sim-cognito-trigger-request.js.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-request.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,OAAO,CAA2B;IAEnD,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,QAAmC;QAC1C,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,KAAK,WAAW,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,CAAC;YACD,KAAK,kBAAkB,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,CAAC;YACD,KAAK,mBAAmB,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnC,CAAC;YACD,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnC,CAAC;YACD,KAAK,eAAe,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,kBAAkB;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEpC,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACrC,kBAAkB,EAAE;gBAClB,gBAAgB,EAAE,IAAI;qBACnB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;qBACvB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC9B;YACD,GAAG,IAAI,CAAC,cAAc,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,SAAS;QACf,OAAO;YACL,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;YACrE,GAAG,IAAI,CAAC,cAAc,EAAE;YACxB,GAAG,IAAI,CAAC,cAAc,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,gBAAgB;QACtB,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;OAWG;IACK,aAAa,CAAC,QAAmC;QACvD,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACrC,aAAa,EAAE,uBAAuB;YACtC,GAAG,CAAC,QAAQ;gBACV,yBAAyB,CAAC,4BAA4B,IAAI;gBAC1D,iBAAiB,EAAE,2BAA2B;aAC/C,CAAC;YACF,GAAG,IAAI,CAAC,cAAc,EAAE;SACzB,CAAC;IACJ,CAAC;IAEO,iBAAiB;QACvB,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI;gBAC/C,cAAc,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;aACnD,CAAC;YACF,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,gEAAgE;YAChE,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAEO,kBAAkB;QACxB,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACrC,8DAA8D;YAC9D,uEAAuE;YACvE,aAAa,EAAE,KAAK;YACpB,GAAG,IAAI,CAAC,cAAc,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;YAC1B,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;SACzD,CAAC;IACJ,CAAC;IAEO,cAAc;QACpB,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;IAChE,CAAC;IAEO,cAAc;QACpB,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;IAChE,CAAC;CACF"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-response.d.ts

@@ -0,0 +1,19 @@
+import type { SimCognitoTriggerName } from "./sim-cognito-trigger-name.js";
+/**
+ * Refuse what a Lambda trigger handler returned, unless it is the event it was
+ * given.
+ *
+ * A trigger handler is handed the event and has to return it, changed or not.
+ * Real Cognito reads the returned object rather than the one it sent, so a
+ * handler that returns nothing has dropped the event, and one that returns
+ * something without the `request` it was given has returned a different event.
+ * Both are `InvalidLambdaResponseException` there and here.
+ *
+ * `response` is not checked. `PreSignUp` is the only trigger here that reads
+ * anything out of it, and a handler that dropped it is read as having answered
+ * no to all three of its flags, which is what a handler with nothing to ask for
+ * means. Refusing a missing `response` would refuse handlers real Cognito
+ * accepts.
+ */
+export declare function requireSimCognitoTriggerResponse(trigger: SimCognitoTriggerName, returned: unknown): void;
+//# sourceMappingURL=sim-cognito-trigger-response.d.ts.map

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-trigger-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-response.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE,OAAO,GAChB,IAAI,CAoBN"}