feat(aws-cognito): groups, sign-up and password sign-in with RS256 tokens (C2)

docs/coverage/README.md

@@ -55,7 +55,7 @@ code does not implement. Machine-readable: [`coverage.json`](./coverage.json).
 | `cloudtasks` | - | - | [CloudTasks](./gcp/cloudtasks.md) | - | 11 |
 | `cloudtrail` | [CloudTrail](./aws/cloudtrail.md) | - | - | - | 60 |
 | `codeartifact` | [CodeArtifact](./aws/codeartifact.md) | - | - | - | 15 |
-| `cognito` | [Cognito](./aws/cognito.md) | - | - | - | 29 |
+| `cognito` | [Cognito](./aws/cognito.md) | - | - | - | 50 |
 | `communication` | - | [Communication](./azure/communication.md) | - | - | 10 |
 | `composer` | - | - | [Composer](./gcp/composer.md) | - | 6 |
 | `compute` | [EC2](./aws/ec2.md) | [VirtualMachines](./azure/virtualmachines.md) | [GCE](./gcp/gce.md) | - | 37 |

docs/coverage/aws/README.md

@@ -25,7 +25,7 @@ Services cloudemu emulates for AWS, by native name. Back to the [cross-provider
 | [CloudWatch](./cloudwatch.md) | `monitoring` | 12 |
 | [CloudWatchLogs](./cloudwatchlogs.md) | `logging` | 17 |
 | [CodeArtifact](./codeartifact.md) | `codeartifact` | 15 |
-| [Cognito](./cognito.md) | `cognito` | 29 |
+| [Cognito](./cognito.md) | `cognito` | 50 |
 | [Config](./config.md) | `configservice` | 102 |
 | [CostExplorer](./costexplorer.md) | (provider-native) | 4 |
 | [DynamoDB](./dynamodb.md) | `database` | 24 |

docs/coverage/aws/cognito.md

@@ -3,40 +3,81 @@
 
 AWS's `cognito` service · portable interface `driver.Cognito` · [AWS index](./README.md)
 
-## Operations (29)
+## Operations (50)
 
 | Operation | Description |
 | --- | --- |
 | `AddCustomAttributes` | AddCustomAttributes appends custom attributes to a pool's schema. Names get |
+| `AdminAddUserToGroup` |  |
+| `AdminConfirmSignUp` |  |
 | `AdminCreateUser` | AdminCreateUser creates a user in FORCE_CHANGE_PASSWORD with a generated |
 | `AdminDeleteUser` |  |
 | `AdminDeleteUserAttributes` |  |
 | `AdminDisableUser` |  |
 | `AdminEnableUser` |  |
 | `AdminGetUser` |  |
+| `AdminInitiateAuth` | AdminInitiateAuth runs ADMIN_USER_PASSWORD_AUTH, ADMIN_NO_SRP_AUTH or |
+| `AdminListGroupsForUser` |  |
+| `AdminRemoveUserFromGroup` |  |
 | `AdminResetUserPassword` | AdminResetUserPassword moves the user to RESET_REQUIRED. |
+| `AdminRespondToAuthChallenge` |  |
 | `AdminSetUserPassword` | AdminSetUserPassword sets a password checked against the pool policy. A |
 | `AdminUpdateUserAttributes` |  |
+| `AdminUserGlobalSignOut` |  |
+| `ConfirmSignUp` | ConfirmSignUp confirms a user with the code SignUp or |
+| `CreateGroup` | CreateGroup creates a group. A name already in the pool fails with |
 | `CreateUserPool` | CreateUserPool creates a user pool, generating its id and ARN, seeding the |
 | `CreateUserPoolClient` | CreateUserPoolClient creates an app client, generating its 26-character id |
 | `CreateUserPoolDomain` |  |
+| `DeleteGroup` | DeleteGroup removes a group and every membership in it. |
 | `DeleteUserPool` | DeleteUserPool removes a user pool with its users, clients and tags. Like |
 | `DeleteUserPoolClient` |  |
 | `DeleteUserPoolDomain` |  |
 | `DescribeUserPool` | DescribeUserPool returns a deep copy of a user pool, or a |
 | `DescribeUserPoolClient` |  |
 | `DescribeUserPoolDomain` | DescribeUserPoolDomain returns a domain's description. An unknown domain |
+| `GetGroup` |  |
+| `GetUser` | GetUser returns the user an access token was issued to. |
 | `GetUserPoolMfaConfig` | GetUserPoolMfaConfig returns a pool's MFA configuration. The Terraform AWS |
+| `GlobalSignOut` | GlobalSignOut revokes every token issued to the access token's user. |
+| `InitiateAuth` | InitiateAuth runs USER_PASSWORD_AUTH or REFRESH_TOKEN_AUTH for a client. |
+| `ListGroups` |  |
 | `ListTagsForResource` |  |
 | `ListUserPoolClients` | ListUserPoolClients returns client descriptions in a user pool in a |
 | `ListUserPools` | ListUserPools returns pool descriptions in a deterministic order. |
 | `ListUsers` | ListUsers returns users sorted by username, filtered by an optional |
+| `ListUsersInGroup` |  |
+| `ResendConfirmationCode` |  |
+| `RespondToAuthChallenge` | RespondToAuthChallenge answers the NEW_PASSWORD_REQUIRED challenge. |
+| `RevokeToken` | RevokeToken revokes a refresh token and the access and ID tokens minted |
 | `SetUserPoolMfaConfig` | SetUserPoolMfaConfig replaces a pool's MFA configuration and returns the |
+| `SignUp` | SignUp registers an UNCONFIRMED user, checks the password against the |
 | `TagResource` |  |
 | `UntagResource` |  |
+| `UpdateGroup` | UpdateGroup changes the fields the input sets and returns the group. |
 | `UpdateUserPool` | UpdateUserPool applies the mutable pool settings. A nil field is left |
 | `UpdateUserPoolClient` | UpdateUserPoolClient replaces the client's settings and returns the result. |
 
+## Optional capabilities
+
+Discovered by type assertion; only some providers implement these.
+
+### CodeInspector
+
+CodeInspector exposes the confirmation codes the emulator would have sent by
+
+| Operation | Description |
+| --- | --- |
+| `ConfirmationCode` |  |
+
+### KeySetProvider
+
+KeySetProvider publishes a user pool's token-signing keys and issuer for the
+
+| Operation | Description |
+| --- | --- |
+| `SigningKeys` | SigningKeys returns the pool's issuer URL and its public JSON Web Key Set. |
+
 ## Not in scope
 
 _Not documented yet. See the [emulator boundary](../../../README.md) for cloudemu-wide non-goals._

docs/coverage/coverage.json

@@ -4053,6 +4053,12 @@
         "name": "AddCustomAttributes",
         "doc": "AddCustomAttributes appends custom attributes to a pool's schema. Names get"
       },
+      {
+        "name": "AdminAddUserToGroup"
+      },
+      {
+        "name": "AdminConfirmSignUp"
+      },
       {
         "name": "AdminCreateUser",
         "doc": "AdminCreateUser creates a user in FORCE_CHANGE_PASSWORD with a generated"
@@ -4072,17 +4078,41 @@
       {
         "name": "AdminGetUser"
       },
+      {
+        "name": "AdminInitiateAuth",
+        "doc": "AdminInitiateAuth runs ADMIN_USER_PASSWORD_AUTH, ADMIN_NO_SRP_AUTH or"
+      },
+      {
+        "name": "AdminListGroupsForUser"
+      },
+      {
+        "name": "AdminRemoveUserFromGroup"
+      },
       {
         "name": "AdminResetUserPassword",
         "doc": "AdminResetUserPassword moves the user to RESET_REQUIRED."
       },
+      {
+        "name": "AdminRespondToAuthChallenge"
+      },
       {
         "name": "AdminSetUserPassword",
         "doc": "AdminSetUserPassword sets a password checked against the pool policy. A"
       },
       {
         "name": "AdminUpdateUserAttributes"
       },
+      {
+        "name": "AdminUserGlobalSignOut"
+      },
+      {
+        "name": "ConfirmSignUp",
+        "doc": "ConfirmSignUp confirms a user with the code SignUp or"
+      },
+      {
+        "name": "CreateGroup",
+        "doc": "CreateGroup creates a group. A name already in the pool fails with"
+      },
       {
         "name": "CreateUserPool",
         "doc": "CreateUserPool creates a user pool, generating its id and ARN, seeding the"
@@ -4094,6 +4124,10 @@
       {
         "name": "CreateUserPoolDomain"
       },
+      {
+        "name": "DeleteGroup",
+        "doc": "DeleteGroup removes a group and every membership in it."
+      },
       {
         "name": "DeleteUserPool",
         "doc": "DeleteUserPool removes a user pool with its users, clients and tags. Like"
@@ -4115,10 +4149,28 @@
         "name": "DescribeUserPoolDomain",
         "doc": "DescribeUserPoolDomain returns a domain's description. An unknown domain"
       },
+      {
+        "name": "GetGroup"
+      },
+      {
+        "name": "GetUser",
+        "doc": "GetUser returns the user an access token was issued to."
+      },
       {
         "name": "GetUserPoolMfaConfig",
         "doc": "GetUserPoolMfaConfig returns a pool's MFA configuration. The Terraform AWS"
       },
+      {
+        "name": "GlobalSignOut",
+        "doc": "GlobalSignOut revokes every token issued to the access token's user."
+      },
+      {
+        "name": "InitiateAuth",
+        "doc": "InitiateAuth runs USER_PASSWORD_AUTH or REFRESH_TOKEN_AUTH for a client."
+      },
+      {
+        "name": "ListGroups"
+      },
       {
         "name": "ListTagsForResource"
       },
@@ -4134,16 +4186,38 @@
         "name": "ListUsers",
         "doc": "ListUsers returns users sorted by username, filtered by an optional"
       },
+      {
+        "name": "ListUsersInGroup"
+      },
+      {
+        "name": "ResendConfirmationCode"
+      },
+      {
+        "name": "RespondToAuthChallenge",
+        "doc": "RespondToAuthChallenge answers the NEW_PASSWORD_REQUIRED challenge."
+      },
+      {
+        "name": "RevokeToken",
+        "doc": "RevokeToken revokes a refresh token and the access and ID tokens minted"
+      },
       {
         "name": "SetUserPoolMfaConfig",
         "doc": "SetUserPoolMfaConfig replaces a pool's MFA configuration and returns the"
       },
+      {
+        "name": "SignUp",
+        "doc": "SignUp registers an UNCONFIRMED user, checks the password against the"
+      },
       {
         "name": "TagResource"
       },
       {
         "name": "UntagResource"
       },
+      {
+        "name": "UpdateGroup",
+        "doc": "UpdateGroup changes the fields the input sets and returns the group."
+      },
       {
         "name": "UpdateUserPool",
         "doc": "UpdateUserPool applies the mutable pool settings. A nil field is left"
@@ -4153,6 +4227,27 @@
         "doc": "UpdateUserPoolClient replaces the client's settings and returns the result."
       }
     ],
+    "optionalCapabilities": [
+      {
+        "name": "CodeInspector",
+        "doc": "CodeInspector exposes the confirmation codes the emulator would have sent by",
+        "operations": [
+          {
+            "name": "ConfirmationCode"
+          }
+        ]
+      },
+      {
+        "name": "KeySetProvider",
+        "doc": "KeySetProvider publishes a user pool's token-signing keys and issuer for the",
+        "operations": [
+          {
+            "name": "SigningKeys",
+            "doc": "SigningKeys returns the pool's issuer URL and its public JSON Web Key Set."
+          }
+        ]
+      }
+    ],
     "providers": {
       "aws": "Cognito"
     }