cognitoidp

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 39 Imported by: 0

README

Cognito Identity Provider

Parity grade: A · SDK aws-sdk-go-v2/service/cognitoidentityprovider@1.67.0 · last audited 2026-07-25 (pending (uncommitted this pass -- see git log at merge time))

Coverage

Metric Value
Operations audited 57 (57 ok)
Known gaps 1
Deferred items 1
Resource leaks clean
Known gaps
  • USER_SRP_AUTH does not implement real SRP-6a: InitiateAuth requires AuthParameters[PASSWORD] directly (server-side bcrypt check), then returns a PASSWORD_VERIFIER challenge that RespondToAuthChallenge completes without any zero-knowledge proof exchange. A real SRP client never sends PASSWORD and cannot authenticate here. Investigated in depth in a prior pass; not fixed because a byte-perfect implementation of Cognito's SRP variant (3072-bit N, HKDF-SHA256 with the "Caldera Derived Key" info string, HMAC-SHA256 M1 proof) could not be verified against a real client/reference vectors in that session, and a subtly-wrong crypto implementation would be worse than the current honestly-documented simplification. Unchanged this pass -- CUSTOM_AUTH (fixed this pass) is a fully separate, unrelated flow and does nothing to close this gap. (bd: gopherstack-p8i)
Deferred
  • user_import_jobs, devices, webauthn, managed_login_branding, risk_config, terms, log_delivery: verified at a family/smoke level (dispatch wired, backend mutates real maps, persisted in backendSnapshot, no bare stubs found) in prior sweeps, NOT re-walked op-by-op field-by-field this pass. domains/identity_providers/resource_servers were spot-checked or field-diffed this pass (see families above) but domains/identity_providers still have individual ops (e.g. CreateIdentityProvider input validation, UpdateIdentityProvider) not walked line-by-line.

More

Documentation

Overview

Package cognitoidp provides a mock implementation of the AWS Cognito User Pools service.

Index

Constants

View Source 
const (
	AuthEventFeedbackValid   = "Valid"
	AuthEventFeedbackInvalid = "Invalid"
)

Auth event feedback values (FeedbackValueType).

View Source 
const (
	DeviceStatusRemembered    = "remembered"
	DeviceStatusNotRemembered = "not_remembered"
)

Device tracking status values (DeviceRememberedStatusType).

View Source 
const (

	// UserStatusUnconfirmed indicates the user has signed up but not confirmed their account.
	UserStatusUnconfirmed = "UNCONFIRMED"

	// UserStatusConfirmed indicates the user has confirmed their account.
	UserStatusConfirmed = "CONFIRMED"

	// UserStatusForceChangePassword indicates the user must change their password on next login.
	UserStatusForceChangePassword = "FORCE_CHANGE_PASSWORD"
)

Variables

View Source 
var (
	// ErrUserNotFound is returned when a user does not exist in the user pool.
	ErrUserNotFound = awserr.New("UserNotFoundException", awserr.ErrNotFound)

	// ErrUserAlreadyExists is returned when a user already exists in the user pool.
	ErrUserAlreadyExists = awserr.New("UserAlreadyExistsException", awserr.ErrAlreadyExists)

	// ErrUserPoolNotFound is returned when the requested user pool does not exist.
	ErrUserPoolNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)

	// ErrUserPoolAlreadyExists is returned when a user pool with the given name already exists.
	ErrUserPoolAlreadyExists = awserr.New("UserPoolAlreadyExistsException", awserr.ErrAlreadyExists)

	// ErrClientNotFound is returned when the requested app client does not exist.
	ErrClientNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)

	// ErrInvalidPassword is returned when the password does not meet policy requirements.
	ErrInvalidPassword = awserr.New("InvalidPasswordException", awserr.ErrInvalidParameter)

	// ErrNotAuthorized is returned when authentication fails (wrong password, etc.).
	ErrNotAuthorized = awserr.New("NotAuthorizedException", awserr.ErrInvalidParameter)

	// ErrCodeMismatch is returned when the provided confirmation code does not match.
	ErrCodeMismatch = awserr.New("CodeMismatchException", awserr.ErrInvalidParameter)

	// ErrExpiredCode is returned when the provided confirmation code has expired.
	ErrExpiredCode = awserr.New("ExpiredCodeException", awserr.ErrNotFound)

	// ErrUsernameExists is returned when attempting to sign up with an existing username.
	ErrUsernameExists = awserr.New("UsernameExistsException", awserr.ErrAlreadyExists)

	// ErrUserNotConfirmed is returned when a user has not yet confirmed their account.
	ErrUserNotConfirmed = awserr.New("UserNotConfirmedException", awserr.ErrInvalidParameter)

	// ErrPasswordResetRequired is returned when the user must reset their password before authenticating.
	ErrPasswordResetRequired = awserr.New("PasswordResetRequiredException", awserr.ErrInvalidParameter)

	// ErrInvalidUserPoolConfig is returned when the user pool configuration is invalid.
	ErrInvalidUserPoolConfig = awserr.New("InvalidUserPoolConfigurationException", awserr.ErrInvalidParameter)

	// ErrInvalidToken is returned when a JWT token is structurally invalid or has unexpected claims.
	ErrInvalidToken = awserr.New("InvalidParameterException", awserr.ErrInvalidParameter)

	// ErrInvalidParameter signals an InvalidParameterException for general
	// request-validation failures (e.g., out-of-range password policy fields).
	ErrInvalidParameter = awserr.New("InvalidParameterException", awserr.ErrInvalidParameter)

	// ErrGroupNotFound is returned when a user pool group does not exist.
	ErrGroupNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)

	// ErrAlreadyExists is returned when a resource with the same identifier already exists.
	ErrAlreadyExists = awserr.New("GroupExistsException", awserr.ErrAlreadyExists)

	// ErrDuplicateProvider is returned when an identity provider with the same name already exists.
	ErrDuplicateProvider = awserr.New("DuplicateProviderException", awserr.ErrAlreadyExists)

	// ErrDeviceNotFound is returned when a tracked device does not exist for a user.
	ErrDeviceNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)

	// ErrWebAuthnCredentialNotFound is returned when a WebAuthn/passkey credential does not exist.
	ErrWebAuthnCredentialNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)

	// ErrAuthEventNotFound is returned when an adaptive-authentication event does not exist.
	ErrAuthEventNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)

	// ErrUserLambdaValidation is returned when a configured Lambda trigger (PreSignUp,
	// PostConfirmation, PreTokenGeneration, CustomMessage, ...) fails during invocation --
	// mirrors AWS Cognito's UserLambdaValidationException, which wraps any error the
	// trigger function returns.
	ErrUserLambdaValidation = awserr.New("UserLambdaValidationException", awserr.ErrInvalidParameter)

	// ErrUnexpectedLambda is returned when a configured Lambda trigger responds with a
	// malformed payload (missing/invalid "response" object) rather than a genuine
	// business-logic error -- mirrors AWS Cognito's UnexpectedLambdaException.
	ErrUnexpectedLambda = awserr.New("UnexpectedLambdaException", awserr.ErrInvalidParameter)

	// ErrReplicaNotFound is returned when a user pool has no secondary replica
	// in the requested Region (UpdateUserPoolReplica/DeleteUserPoolReplica).
	ErrReplicaNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)

	// ErrServiceQuotaExceeded is returned when a requested provisioned-limit
	// value falls outside what the account is allowed to provision
	// (UpdateProvisionedLimit) -- mirrors AWS Cognito's ServiceQuotaExceededException.
	ErrServiceQuotaExceeded = awserr.New("ServiceQuotaExceededException", awserr.ErrConflict)
)

Sentinel errors for Cognito IDP operations.

View Source 
var ErrJWTIssuerUnknown = errors.New("JWT issuer not managed by this emulator")

ErrJWTIssuerUnknown is returned when no pool matches the given issuer URL.

View Source 
var ErrJWTKeyNotFound = errors.New("JWT key ID not found for issuer")

ErrJWTKeyNotFound is returned when a JWT key ID is not found for a known issuer.

View Source 
var ErrNilAppContext = errors.New("cognitoidp: nil AppContext")

ErrNilAppContext is returned when Provider.Init receives a nil AppContext.

Functions

func GenerateTOTPCode 

func GenerateTOTPCode(secretBase32 string, t time.Time) (string, error)

GenerateTOTPCode computes the RFC 6238 TOTP code for the given base32-encoded secret at time t. It is exported so integration tests (and any AWS-SDK-driven caller that needs to simulate a real authenticator app) can compute the expected code for a secret returned by AssociateSoftwareToken, the same way a real TOTP app would.

Types

type AccountTakeoverActionType 

type AccountTakeoverActionType struct {
	EventAction string `json:"EventAction,omitempty"`
	Notify      bool   `json:"Notify,omitempty"`
}

AccountTakeoverActionType defines an action for a specific risk level.

type AccountTakeoverActions 

type AccountTakeoverActions struct {
	LowAction    *AccountTakeoverActionType `json:"LowAction,omitempty"`
	MediumAction *AccountTakeoverActionType `json:"MediumAction,omitempty"`
	HighAction   *AccountTakeoverActionType `json:"HighAction,omitempty"`
}

AccountTakeoverActions defines actions per risk level.

type AccountTakeoverRiskConfig 

type AccountTakeoverRiskConfig struct {
	Actions             *AccountTakeoverActions  `json:"Actions,omitempty"`
	NotifyConfiguration *NotifyConfigurationType `json:"NotifyConfiguration,omitempty"`
}

AccountTakeoverRiskConfig holds account takeover risk configuration.

type AuthEvent 

type AuthEvent struct {
	CreatedAt     time.Time `json:"createdAt"`
	FeedbackDate  time.Time `json:"feedbackDate"`
	EventID       string    `json:"eventID,omitempty"`
	EventType     string    `json:"eventType,omitempty"`
	EventResponse string    `json:"eventResponse,omitempty"`
	FeedbackValue string    `json:"feedbackValue,omitempty"`
}

AuthEvent represents an adaptive-authentication (risk) sign-in event for a user, and its feedback state once reviewed via [Admin]UpdateAuthEventFeedback.

type AuthResult 

type AuthResult struct {
	Tokens              *TokenResult      `json:"tokens,omitempty"`
	ChallengeParameters map[string]string `json:"challengeParameters,omitempty"`
	MFASession          string            `json:"mfaSession,omitempty"`
	ChallengeName       string            `json:"challengeName,omitempty"`
}

AuthResult is the result of a successful authentication or a pending challenge.

type CompromisedCredentialsActions 

type CompromisedCredentialsActions struct {
	EventAction string `json:"EventAction,omitempty"` // "BLOCK" | "NO_ACTION"
}

CompromisedCredentialsActions defines what action to take for compromised credentials.

type CompromisedCredentialsRiskConfig 

type CompromisedCredentialsRiskConfig struct {
	Actions     *CompromisedCredentialsActions `json:"Actions,omitempty"`
	EventFilter []string                       `json:"EventFilter,omitempty"`
}

CompromisedCredentialsRiskConfig holds the compromised credentials risk configuration.

type Device 

type Device struct {
	CreatedAt           time.Time         `json:"createdAt"`
	LastModifiedAt      time.Time         `json:"lastModifiedAt"`
	LastAuthenticatedAt time.Time         `json:"lastAuthenticatedAt"`
	Attributes          map[string]string `json:"attributes,omitempty"`
	DeviceKey           string            `json:"deviceKey,omitempty"`
	Status              string            `json:"status,omitempty"`
}

Device represents a tracked/remembered device for a user, keyed by DeviceKey.

type EmailMfaConfiguration 

type EmailMfaConfiguration struct {
	Message string `json:"Message,omitempty"`
	Subject string `json:"Subject,omitempty"`
}

EmailMfaConfiguration holds email OTP MFA settings for a user pool.

type Group 

type Group struct {
	CreatedAt      time.Time `json:"createdAt"`
	LastModifiedAt time.Time `json:"lastModifiedAt"`
	GroupName      string    `json:"groupName,omitempty"`
	UserPoolID     string    `json:"userPoolId,omitempty"`
	Description    string    `json:"description,omitempty"`
	RoleArn        string    `json:"roleArn,omitempty"`
	Precedence     int32     `json:"precedence,omitempty"`
}

Group represents a Cognito User Pool group.

type Handler 

type Handler struct {
	Backend *InMemoryBackend `json:"backend,omitempty"`
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for Cognito IDP operations.

func NewHandler 

func NewHandler(backend *InMemoryBackend, region string) *Handler

NewHandler creates a new Cognito IDP handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this Cognito IDP instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the Cognito action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the user pool or user resource from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all backend state. Useful for test isolation.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Cognito IDP requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker starts the background janitor if it is configured.

func (*Handler) WithJanitor 

func (h *Handler) WithJanitor(interval time.Duration, taskTimeout ...time.Duration) *Handler

WithJanitor attaches a background janitor to the handler. The janitor periodically evicts expired refresh tokens. interval=0 uses the default. The optional taskTimeout bounds each sweep; 0 means no per-task timeout.

type IdentityProvider 

type IdentityProvider struct {
	ProviderDetails  map[string]string `json:"providerDetails,omitempty"`
	AttributeMapping map[string]string `json:"attributeMapping,omitempty"`
	CreatedAt        time.Time         `json:"createdAt"`
	LastModifiedAt   time.Time         `json:"lastModifiedAt"`
	UserPoolID       string            `json:"userPoolID,omitempty"`
	ProviderName     string            `json:"providerName,omitempty"`
	ProviderType     string            `json:"providerType,omitempty"`
	IdpIdentifiers   []string          `json:"idpIdentifiers,omitempty"`
}

IdentityProvider represents a federated identity provider attached to a user pool.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for Cognito IDP resources.

Most resource collections are *store.Table[T] registered on b.registry (see store_setup.go for keyFns/composite keys and the full per-field rationale). A handful of fields remain plain maps because their value carries no pure identity for a store.Table key; store_setup.go's registerAllTables doc comment lists each one and why.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region, endpoint string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) AddCustomAttributes 

func (b *InMemoryBackend) AddCustomAttributes(userPoolID string, attrs []SchemaAttribute) error

AddCustomAttributes adds custom attribute definitions to a user pool schema. All attribute names must start with the "custom:" prefix as required by AWS Cognito.

func (*InMemoryBackend) AddUserInternal 

func (b *InMemoryBackend) AddUserInternal(user *User)

AddUserInternal seeds a user directly into the backend, bypassing normal sign-up. Intended for use in tests only. The pool must already exist.

func (*InMemoryBackend) AddUserPoolClientInternal 

func (b *InMemoryBackend) AddUserPoolClientInternal(client *UserPoolClient)

AddUserPoolClientInternal seeds a user pool client directly into the backend. Intended for use in tests only.

func (*InMemoryBackend) AddUserPoolClientSecret 

func (b *InMemoryBackend) AddUserPoolClientSecret(userPoolID, clientID string) (string, error)

AddUserPoolClientSecret generates and stores a client secret for the given app client.

func (*InMemoryBackend) AddUserPoolInternal 

func (b *InMemoryBackend) AddUserPoolInternal(pool *UserPool)

AddUserPoolInternal seeds a user pool directly into the backend, bypassing normal creation logic. Intended for use in tests only.

func (*InMemoryBackend) AdminAddUserToGroup 

func (b *InMemoryBackend) AdminAddUserToGroup(userPoolID, username, groupName string) error

AdminAddUserToGroup adds a user to a group.

func (*InMemoryBackend) AdminConfirmSignUp 

func (b *InMemoryBackend) AdminConfirmSignUp(userPoolID, username string) error

AdminConfirmSignUp confirms a user's registration without requiring a confirmation code. This is an admin operation that bypasses the normal confirmation flow.

func (*InMemoryBackend) AdminCreateUser 

func (b *InMemoryBackend) AdminCreateUser(
	userPoolID, username, tempPassword string,
	userAttributes map[string]string,
) (*User, error)

AdminCreateUser creates a new user in the pool with FORCE_CHANGE_PASSWORD status.

func (*InMemoryBackend) AdminCreateUserFull 

func (b *InMemoryBackend) AdminCreateUserFull(
	userPoolID, username, tempPassword string,
	userAttributes map[string]string,
	messageAction string,
	desiredDeliveryMediums []string,
	forceAliasCreation bool,
) (*User, error)

AdminCreateUserFull creates a user with optional MessageAction (SUPPRESS/RESEND) and delivery mediums.

func (*InMemoryBackend) AdminCreateUserWithPolicy 

func (b *InMemoryBackend) AdminCreateUserWithPolicy(
	userPoolID, username, tempPassword string,
	userAttributes map[string]string,
) (*User, error)

AdminCreateUserWithPolicy creates a new user in the pool with FORCE_CHANGE_PASSWORD status, enforcing the pool's PasswordPolicy on the temporary password.

func (*InMemoryBackend) AdminDeleteUser 

func (b *InMemoryBackend) AdminDeleteUser(userPoolID, username string) error

AdminDeleteUser deletes a user from a pool by username.

func (*InMemoryBackend) AdminDeleteUserAttributes 

func (b *InMemoryBackend) AdminDeleteUserAttributes(userPoolID, username string, attrNames []string) error

AdminDeleteUserAttributes removes specific attributes from a user in a pool.

func (*InMemoryBackend) AdminDisableProviderForUser 

func (b *InMemoryBackend) AdminDisableProviderForUser(userPoolID string) error

AdminDisableProviderForUser prevents a federated identity from signing in for a user. Since this mock does not track federated identity providers, this validates the pool exists and returns success (matching AWS behaviour for unknown provider links).

func (*InMemoryBackend) AdminDisableUser 

func (b *InMemoryBackend) AdminDisableUser(userPoolID, username string) error

AdminDisableUser disables a user account in a pool.

func (*InMemoryBackend) AdminEnableUser 

func (b *InMemoryBackend) AdminEnableUser(userPoolID, username string) error

AdminEnableUser re-enables a previously disabled user account in a pool.

func (*InMemoryBackend) AdminForgetDevice 

func (b *InMemoryBackend) AdminForgetDevice(userPoolID, username, deviceKey string) error

AdminForgetDevice removes a tracked device for a user. A device that is on record (registered via ConfirmDevice) is really deleted. A missing deviceKey is treated as a no-op rather than ResourceNotFoundException: pre-existing callers invoke this operation without ever having confirmed a device, and historically received success once the user was found; this keeps that contract while making the operation state-aware for devices that do exist.

func (*InMemoryBackend) AdminGetDevice 

func (b *InMemoryBackend) AdminGetDevice(userPoolID, username, deviceKey string) (*Device, error)

AdminGetDevice returns a single tracked device for a user (admin operation).

func (*InMemoryBackend) AdminGetUser 

func (b *InMemoryBackend) AdminGetUser(userPoolID, username string) (*User, error)

AdminGetUser returns a user from a pool by username.

func (*InMemoryBackend) AdminGetUserAuthFactors added in v1.2.0 

func (b *InMemoryBackend) AdminGetUserAuthFactors(userPoolID, username string) (*User, []string, error)

AdminGetUserAuthFactors returns the authentication factors currently configured for a user, derived from the same real password/MFA/WebAuthn state as GetUserAuthFactors, plus SOFTWARE_TOKEN (derived from user.TOTPVerified -- the user completed AssociateSoftwareToken + VerifySoftwareToken -- or "SOFTWARE_TOKEN_MFA" being present in user.UserMFASettingList, i.e. it is enabled as an active MFA method). AdminGetUserAuthFactorsOutput additionally carries PreferredMfaSetting and UserMFASettingList verbatim from the user record (fields the self-service GetUserAuthFactorsOutput does not have).

func (*InMemoryBackend) AdminInitiateAuth 

func (b *InMemoryBackend) AdminInitiateAuth(
	userPoolID, clientID, authFlow, username, password string,
) (*AuthResult, error)

AdminInitiateAuth authenticates a user as an admin using the specified auth flow.

func (*InMemoryBackend) AdminLinkProviderForUser 

func (b *InMemoryBackend) AdminLinkProviderForUser(
	userPoolID, destinationUsername string,
	sourceProviderName, sourceAttrName, sourceAttrValue string,
) error

AdminLinkProviderForUser links a federated identity (SourceUser) to an existing Cognito user (DestinationUser) in the given pool.

func (*InMemoryBackend) AdminListDevices 

func (b *InMemoryBackend) AdminListDevices(
	userPoolID, username string,
	limit int,
	nextToken string,
) ([]*Device, string, error)

AdminListDevices returns a page of tracked devices for a user (admin operation).

func (*InMemoryBackend) AdminListGroupsForUser 

func (b *InMemoryBackend) AdminListGroupsForUser(userPoolID, username string) ([]*Group, error)

AdminListGroupsForUser returns the groups a user belongs to, sorted by group name.

func (*InMemoryBackend) AdminListUserAuthEvents 

func (b *InMemoryBackend) AdminListUserAuthEvents(
	userPoolID, username string,
	limit int,
	nextToken string,
) ([]*AuthEvent, string, error)

AdminListUserAuthEvents returns stored adaptive-authentication events for a user (admin operation). This emulator does not hook sign-in flows (InitiateAuth/AdminInitiateAuth) to synthesize risk events, so the store is real but starts empty per user; it returns a real, validated, paginated empty result rather than a hardcoded one (pool/user existence and NextToken semantics are honored).

func (*InMemoryBackend) AdminRemoveUserFromGroup 

func (b *InMemoryBackend) AdminRemoveUserFromGroup(userPoolID, username, groupName string) error

AdminRemoveUserFromGroup removes a user from a group.

func (*InMemoryBackend) AdminResetUserPassword 

func (b *InMemoryBackend) AdminResetUserPassword(userPoolID, username string) error

AdminResetUserPassword resets a user back to FORCE_CHANGE_PASSWORD status so they must set a new password on next login.

func (*InMemoryBackend) AdminSetUserMFAPreference 

func (b *InMemoryBackend) AdminSetUserMFAPreference(
	userPoolID, username string,
	smsMFAEnabled, softwareTokenEnabled bool,
	preferredMFA string,
) error

AdminSetUserMFAPreference sets the MFA preferences for a specific user (admin operation). This is the modern preferred API (vs AdminSetUserSettings). It delegates to AdminSetUserMFASetting.

func (*InMemoryBackend) AdminSetUserMFASetting 

func (b *InMemoryBackend) AdminSetUserMFASetting(
	userPoolID, username string,
	smsMFAEnabled, softwareTokenEnabled bool,
	preferredMFA string,
) error

AdminSetUserMFASetting sets the MFA configuration for a specific user (admin operation).

func (*InMemoryBackend) AdminSetUserPassword 

func (b *InMemoryBackend) AdminSetUserPassword(userPoolID, username, password string, permanent bool) error

AdminSetUserPassword sets the password for a user in a pool.

func (*InMemoryBackend) AdminSetUserPasswordFull 

func (b *InMemoryBackend) AdminSetUserPasswordFull(userPoolID, username, password string, permanent bool) error

AdminSetUserPasswordFull sets password with proper status handling. If permanent=true, status becomes CONFIRMED. If permanent=false, status remains FORCE_CHANGE_PASSWORD.

func (*InMemoryBackend) AdminSetUserSettings 

func (b *InMemoryBackend) AdminSetUserSettings(userPoolID, username string, mfaOptions []MFAOptionType) error

AdminSetUserSettings persists legacy MFAOptions onto a user (admin operation).

func (*InMemoryBackend) AdminUpdateAuthEventFeedback 

func (b *InMemoryBackend) AdminUpdateAuthEventFeedback(userPoolID, username, eventID, feedbackValue string) error

AdminUpdateAuthEventFeedback records feedback on a stored auth event (admin operation).

func (*InMemoryBackend) AdminUpdateDeviceStatus 

func (b *InMemoryBackend) AdminUpdateDeviceStatus(userPoolID, username, deviceKey, status string) error

AdminUpdateDeviceStatus updates a tracked device's remembered status (admin operation).

func (*InMemoryBackend) AdminUpdateUserAttributes 

func (b *InMemoryBackend) AdminUpdateUserAttributes(userPoolID, username string, attributes map[string]string) error

AdminUpdateUserAttributes updates attributes for a user in a pool.

func (*InMemoryBackend) AdminUserGlobalSignOut 

func (b *InMemoryBackend) AdminUserGlobalSignOut(userPoolID, username string) error

AdminUserGlobalSignOut signs out a user from all sessions by revoking their refresh tokens and setting a per-user revocation timestamp so previously-issued access tokens are invalidated.

func (*InMemoryBackend) AssociateSoftwareToken 

func (b *InMemoryBackend) AssociateSoftwareToken(accessToken string) (string, error)

AssociateSoftwareToken generates a new TOTP secret for the authenticated user and stores it. Returns the base32-encoded secret for use with TOTP authenticator apps (RFC 6238).

func (*InMemoryBackend) ChangePassword 

func (b *InMemoryBackend) ChangePassword(accessToken, previousPassword, proposedPassword string) error

ChangePassword changes the password for an authenticated user (via access token). The pool's PasswordPolicy is enforced on the proposed password.

func (*InMemoryBackend) CompleteWebAuthnRegistration 

func (b *InMemoryBackend) CompleteWebAuthnRegistration(
	accessToken, credentialID, authenticatorAttachment string,
) (*WebAuthnCredential, error)

CompleteWebAuthnRegistration stores a WebAuthn credential for the authenticated user.

func (*InMemoryBackend) ConfirmDevice 

func (b *InMemoryBackend) ConfirmDevice(accessToken, deviceKey, deviceName string) (string, bool, error)

ConfirmDevice registers a new device for the authenticated user, or refreshes last-authenticated/attributes if the device is already known. If deviceKey is empty, a new one is generated: AWS normally derives DeviceKey client-side from SRP device-verifier material handed out during authentication, but this emulator does not mint device metadata during InitiateAuth, so it provisions a key here so ListDevices/GetDevice can enumerate the device afterward. Returns the confirmed device key and whether user confirmation is necessary (always false: this emulator does not model the adaptive-auth device-confirmation workflow).

func (*InMemoryBackend) ConfirmForgotPassword 

func (b *InMemoryBackend) ConfirmForgotPassword(clientID, username, code, newPassword string) error

ConfirmForgotPassword resets a user's password using the code generated by ForgotPassword.

func (*InMemoryBackend) ConfirmSignUp 

func (b *InMemoryBackend) ConfirmSignUp(clientID, username, confirmationCode string) error

ConfirmSignUp confirms a user's registration by validating the confirmation code.

func (*InMemoryBackend) CreateGroup 

func (b *InMemoryBackend) CreateGroup(userPoolID, groupName, description string, precedence int32) (*Group, error)

CreateGroup creates a group in a user pool.

func (*InMemoryBackend) CreateGroupFull 

func (b *InMemoryBackend) CreateGroupFull(
	userPoolID, groupName, description, roleArn string,
	precedence int32,
) (*Group, error)

CreateGroupFull creates a group with a RoleArn.

func (*InMemoryBackend) CreateIdentityProvider 

func (b *InMemoryBackend) CreateIdentityProvider(
	userPoolID, providerName, providerType string,
	providerDetails map[string]string,
) (*IdentityProvider, error)

CreateIdentityProvider creates a new identity provider in the given pool.

func (*InMemoryBackend) CreateIdentityProviderFull 

func (b *InMemoryBackend) CreateIdentityProviderFull(
	userPoolID, providerName, providerType string,
	providerDetails map[string]string,
	attributeMapping map[string]string,
	idpIdentifiers []string,
) (*IdentityProvider, error)

CreateIdentityProviderFull creates an identity provider with AttributeMapping and IdpIdentifiers.

func (*InMemoryBackend) CreateManagedLoginBranding 

func (b *InMemoryBackend) CreateManagedLoginBranding(userPoolID, clientID string) (*ManagedLoginBranding, error)

CreateManagedLoginBranding creates a managed login branding record.

func (*InMemoryBackend) CreateResourceServer 

func (b *InMemoryBackend) CreateResourceServer(
	userPoolID, identifier, name string,
	scopes []ResourceServerScope,
) (*ResourceServer, error)

CreateResourceServer creates an OAuth 2.0 resource server for a user pool.

func (*InMemoryBackend) CreateTerms 

func (b *InMemoryBackend) CreateTerms(userPoolID, text string) (*Terms, error)

CreateTerms sets the terms and conditions text for a user pool.

func (*InMemoryBackend) CreateUserImportJob 

func (b *InMemoryBackend) CreateUserImportJob(userPoolID, jobName string) (*UserImportJob, error)

CreateUserImportJob creates a new import job for a user pool.

func (*InMemoryBackend) CreateUserPool 

func (b *InMemoryBackend) CreateUserPool(name string) (*UserPool, error)

CreateUserPool creates a new user pool with the given name.

func (*InMemoryBackend) CreateUserPoolClient 

func (b *InMemoryBackend) CreateUserPoolClient(userPoolID, clientName string) (*UserPoolClient, error)

CreateUserPoolClient creates a new app client for the given user pool.

func (*InMemoryBackend) CreateUserPoolClientWithOpts 

func (b *InMemoryBackend) CreateUserPoolClientWithOpts(
	userPoolID, clientName string,
	opts UserPoolClientOptions,
) (*UserPoolClient, error)

CreateUserPoolClientWithOpts creates an app client with full OAuth and flow configuration.

func (*InMemoryBackend) CreateUserPoolDomain 

func (b *InMemoryBackend) CreateUserPoolDomain(userPoolID, domain string) (*UserPoolDomain, error)

CreateUserPoolDomain registers a domain for a user pool.

func (*InMemoryBackend) CreateUserPoolDomainFull 

func (b *InMemoryBackend) CreateUserPoolDomainFull(userPoolID, domain, certificateArn string) (*UserPoolDomain, error)

CreateUserPoolDomainFull creates a user pool domain with optional custom domain cert.

func (*InMemoryBackend) CreateUserPoolReplica added in v1.2.0 

func (b *InMemoryBackend) CreateUserPoolReplica(
	userPoolID, regionName string,
	tags map[string]string,
) (*UserPoolReplica, error)

CreateUserPoolReplica creates a secondary replica of userPoolID in regionName, optionally tagging the replica (tags are tracked independently of the primary pool's tags, matching "You can maintain tags independently on replica user pools" -- stored under the replica's own ARN via the existing resourceTags mechanism).

Real AWS constraints enforced here (Cognito multi-Region replication developer guide): the replica Region must differ from the pool's own (primary) Region, and a user pool can have at most one secondary replica -- "You can have at most one secondary replica in an additional Region per user directory." New replicas start INACTIVE ("New secondary user pools start in the INACTIVE state[.] Review and configure regional settings before activating the user pool for production use.") -- callers activate with UpdateUserPoolReplica(Status: ACTIVE).

func (*InMemoryBackend) CreateUserPoolWithOpts 

func (b *InMemoryBackend) CreateUserPoolWithOpts(name string, opts UserPoolOptions) (*UserPool, error)

CreateUserPoolWithOpts creates a user pool with optional PasswordPolicy and AutoVerifiedAttributes.

func (*InMemoryBackend) DeleteGroup 

func (b *InMemoryBackend) DeleteGroup(userPoolID, groupName string) error

DeleteGroup removes a group from a user pool.

func (*InMemoryBackend) DeleteIdentityProvider 

func (b *InMemoryBackend) DeleteIdentityProvider(userPoolID, providerName string) error

DeleteIdentityProvider removes an identity provider from a pool.

func (*InMemoryBackend) DeleteManagedLoginBranding 

func (b *InMemoryBackend) DeleteManagedLoginBranding(userPoolID, brandingID string) error

DeleteManagedLoginBranding removes a managed login branding record.

func (*InMemoryBackend) DeleteResourceServer 

func (b *InMemoryBackend) DeleteResourceServer(userPoolID, identifier string) error

DeleteResourceServer removes a resource server from a user pool.

func (*InMemoryBackend) DeleteTerms 

func (b *InMemoryBackend) DeleteTerms(userPoolID string) error

DeleteTerms removes the terms and conditions for a user pool.

func (*InMemoryBackend) DeleteUser 

func (b *InMemoryBackend) DeleteUser(accessToken string) error

DeleteUser deletes the currently authenticated user (self-service).

func (*InMemoryBackend) DeleteUserAttributes 

func (b *InMemoryBackend) DeleteUserAttributes(accessToken string, attrNames []string) error

DeleteUserAttributes removes specific attributes from the authenticated user (self-service).

func (*InMemoryBackend) DeleteUserPool 

func (b *InMemoryBackend) DeleteUserPool(userPoolID string) error

DeleteUserPool removes the user pool with the given ID and all of its associated clients.

func (*InMemoryBackend) DeleteUserPoolClient 

func (b *InMemoryBackend) DeleteUserPoolClient(userPoolID, clientID string) error

DeleteUserPoolClient removes the app client with the given client ID from the given pool. If userPoolID is empty the pool ownership check is skipped.

func (*InMemoryBackend) DeleteUserPoolClientSecret 

func (b *InMemoryBackend) DeleteUserPoolClientSecret(userPoolID, clientID string) error

DeleteUserPoolClientSecret removes the client secret from a pool client.

func (*InMemoryBackend) DeleteUserPoolDomain 

func (b *InMemoryBackend) DeleteUserPoolDomain(userPoolID, domain string) error

DeleteUserPoolDomain removes a domain from a user pool.

func (*InMemoryBackend) DeleteUserPoolReplica added in v1.2.0 

func (b *InMemoryBackend) DeleteUserPoolReplica(userPoolID, regionName string) (*UserPoolReplica, error)

DeleteUserPoolReplica deletes the secondary replica of userPoolID in regionName, returning the replica's final state with Status transitioned to DELETING, mirroring the real (asynchronous) deletion the API documents.

func (*InMemoryBackend) DeleteWebAuthnCredential 

func (b *InMemoryBackend) DeleteWebAuthnCredential(accessToken, credentialID string) error

DeleteWebAuthnCredential removes a WebAuthn credential for the authenticated user.

func (*InMemoryBackend) DescribeIdentityProvider 

func (b *InMemoryBackend) DescribeIdentityProvider(userPoolID, providerName string) (*IdentityProvider, error)

DescribeIdentityProvider returns an identity provider by pool and provider name.

func (*InMemoryBackend) DescribeManagedLoginBranding 

func (b *InMemoryBackend) DescribeManagedLoginBranding(userPoolID, brandingID string) (*ManagedLoginBranding, error)

DescribeManagedLoginBranding returns a managed login branding by ID.

func (*InMemoryBackend) DescribeManagedLoginBrandingByClient 

func (b *InMemoryBackend) DescribeManagedLoginBrandingByClient(
	userPoolID, clientID string,
) (*ManagedLoginBranding, error)

DescribeManagedLoginBrandingByClient returns the managed login branding for a client.

func (*InMemoryBackend) DescribeResourceServer 

func (b *InMemoryBackend) DescribeResourceServer(userPoolID, identifier string) (*ResourceServer, error)

DescribeResourceServer returns a resource server by pool ID and identifier.

func (*InMemoryBackend) DescribeRiskConfiguration 

func (b *InMemoryBackend) DescribeRiskConfiguration(poolID, clientID string) (*RiskConfiguration, error)

DescribeRiskConfiguration retrieves the risk configuration for a pool and optional client.

func (*InMemoryBackend) DescribeTerms 

func (b *InMemoryBackend) DescribeTerms(userPoolID string) (*Terms, error)

DescribeTerms returns the terms and conditions for a user pool.

func (*InMemoryBackend) DescribeUserImportJob 

func (b *InMemoryBackend) DescribeUserImportJob(userPoolID, jobID string) (*UserImportJob, error)

DescribeUserImportJob returns a user import job by pool and job ID.

func (*InMemoryBackend) DescribeUserPool 

func (b *InMemoryBackend) DescribeUserPool(userPoolID string) (*UserPool, error)

DescribeUserPool returns the user pool with the given ID.

func (*InMemoryBackend) DescribeUserPoolClient 

func (b *InMemoryBackend) DescribeUserPoolClient(userPoolID, clientID string) (*UserPoolClient, error)

DescribeUserPoolClient returns the app client with the given client ID.

func (*InMemoryBackend) DescribeUserPoolDomain 

func (b *InMemoryBackend) DescribeUserPoolDomain(domain string) (*UserPoolDomain, error)

DescribeUserPoolDomain returns domain details by domain name.

func (*InMemoryBackend) EvictExpiredAttrVerificationCodes 

func (b *InMemoryBackend) EvictExpiredAttrVerificationCodes()

func (*InMemoryBackend) EvictExpiredMFASessions 

func (b *InMemoryBackend) EvictExpiredMFASessions()

EvictExpiredMFASessions removes mfaSession entries that have expired or whose pool or user no longer exists. The janitor calls this periodically to prevent unbounded accumulation.

func (*InMemoryBackend) FindUserPoolDomain 

func (b *InMemoryBackend) FindUserPoolDomain(domain string) *UserPoolDomain

FindUserPoolDomain returns a domain by name, or nil if not found (no error). Use instead of DescribeUserPoolDomain when the caller treats "not found" as an empty result.

func (*InMemoryBackend) ForgetDevice 

func (b *InMemoryBackend) ForgetDevice(accessToken, deviceKey string) error

ForgetDevice deletes a tracked device for the authenticated user.

func (*InMemoryBackend) ForgotPassword 

func (b *InMemoryBackend) ForgotPassword(clientID, username string) (string, error)

ForgotPassword initiates a password reset for a user. In this mock the reset code is generated and stored on the user.

func (*InMemoryBackend) GetDevice 

func (b *InMemoryBackend) GetDevice(accessToken, deviceKey string) (*Device, error)

GetDevice returns a single tracked device for the authenticated user.

func (*InMemoryBackend) GetGroup 

func (b *InMemoryBackend) GetGroup(userPoolID, groupName string) (*Group, error)

GetGroup returns a single group from a user pool by name.

func (*InMemoryBackend) GetIdentityProviderByIdentifier 

func (b *InMemoryBackend) GetIdentityProviderByIdentifier(userPoolID, identifier string) (*IdentityProvider, error)

GetIdentityProviderByIdentifier searches all providers in a pool for the given identifier string.

func (*InMemoryBackend) GetJWTPublicKey 

func (b *InMemoryBackend) GetJWTPublicKey(issuerURL, kid string) (*rsa.PublicKey, error)

GetJWTPublicKey returns the RSA public key for the user pool whose issuerURL matches and whose key ID equals kid. Returns nil, nil when no pool matches (caller should reject the token as unauthorized).

func (*InMemoryBackend) GetLogDeliveryConfiguration 

func (b *InMemoryBackend) GetLogDeliveryConfiguration(poolID string) (*LogDeliveryConfig, error)

GetLogDeliveryConfiguration retrieves the log delivery config for a pool.

func (*InMemoryBackend) GetPoolMetrics 

func (b *InMemoryBackend) GetPoolMetrics(userPoolID string) (*PoolMetrics, error)

GetPoolMetrics returns aggregate statistics for a user pool.

func (*InMemoryBackend) GetProvisionedLimit added in v1.2.0 

func (b *InMemoryBackend) GetProvisionedLimit(
	limitClass string, attributes map[string]string,
) (*ProvisionedLimit, error)

GetProvisionedLimit returns the current provisioned and default (free) values for a Cognito user pools API rate-limit category. Provisioned limits are account-level (and Region-level) resources, not per-user-pool -- see "Managing provisioned limits" in the Cognito quotas guide: "Provisioned limits are account-level resources. They apply to the aggregate rate of all requests from all user pools in one AWS Region in your AWS account." This backend models exactly one account+Region, so no user pool ID is involved and no pool-existence check applies.

func (*InMemoryBackend) GetSigningCertificate 

func (b *InMemoryBackend) GetSigningCertificate(userPoolID string) (string, error)

GetSigningCertificate returns a deterministic, PEM-encoded self-signed X.509 certificate for the user pool's JWT signing key. The certificate is cached on the pool's token issuer, so repeated calls for the same pool return a stable PEM.

func (*InMemoryBackend) GetTypedRiskConfiguration 

func (b *InMemoryBackend) GetTypedRiskConfiguration(poolID, clientID string) (*TypedRiskConfiguration, error)

GetTypedRiskConfiguration returns the typed risk configuration for a pool or client.

func (*InMemoryBackend) GetUICustomization 

func (b *InMemoryBackend) GetUICustomization(poolID, clientID string) (*UICustomization, error)

GetUICustomization retrieves hosted-UI CSS for a pool and optional client.

func (*InMemoryBackend) GetUICustomizationFull 

func (b *InMemoryBackend) GetUICustomizationFull(poolID, clientID string) (*UICustomization, error)

GetUICustomizationFull returns extended UI customization.

func (*InMemoryBackend) GetUser 

func (b *InMemoryBackend) GetUser(accessToken string) (*User, error)

GetUser returns user attributes for an authenticated user (via access token).

func (*InMemoryBackend) GetUserAttributeVerificationCode 

func (b *InMemoryBackend) GetUserAttributeVerificationCode(
	accessToken, attributeName string,
) (string, string, string, error)

GetUserAttributeVerificationCode generates a verification code for a user attribute and stores it for later validation via VerifyUserAttributeWithCode.

func (*InMemoryBackend) GetUserAuthFactors 

func (b *InMemoryBackend) GetUserAuthFactors(accessToken string) (*User, []string, error)

GetUserAuthFactors returns the authenticated user and the sign-in factors currently configured for their account, derived from stored MFA/WebAuthn state.

func (*InMemoryBackend) GetUserPoolJWKS 

func (b *InMemoryBackend) GetUserPoolJWKS(userPoolID string) (*JWKSResponse, error)

GetUserPoolJWKS returns the JSON Web Key Set for the given user pool.

func (*InMemoryBackend) GetUserPoolMfaConfigFull 

func (b *InMemoryBackend) GetUserPoolMfaConfigFull(userPoolID string) (*UserPoolMfaFullConfig, error)

GetUserPoolMfaConfigFull returns the full MFA configuration for a pool.

func (*InMemoryBackend) GlobalSignOut 

func (b *InMemoryBackend) GlobalSignOut(accessToken string) error

GlobalSignOut signs out the authenticated user by revoking their refresh tokens and setting a per-user revocation timestamp so previously-issued access tokens are invalidated.

func (*InMemoryBackend) InitiateAuth 

func (b *InMemoryBackend) InitiateAuth(clientID, authFlow, username, password string) (*AuthResult, error)

InitiateAuth authenticates a user using the specified auth flow.

func (*InMemoryBackend) InitiateAuthRefreshToken 

func (b *InMemoryBackend) InitiateAuthRefreshToken(clientID, refreshToken string) (*TokenResult, error)

InitiateAuthRefreshToken exchanges a valid refresh token for new ID/Access tokens.

func (*InMemoryBackend) InvokeCustomMessageTrigger 

func (b *InMemoryBackend) InvokeCustomMessageTrigger(
	clientID, username, code, triggerSource string,
) (string, string, error)

InvokeCustomMessageTrigger fires the CustomMessage Lambda trigger (if configured) for a code-delivery flow (SignUp, ResendConfirmationCode, ForgotPassword) and returns any smsMessage/emailMessage/emailSubject override the Lambda supplied, with the "####" code placeholder (see customMessageCodeParameter) substituted for the real generated code. It is exported separately from the backend methods that generate the code (SignUpWithValidation, ResendConfirmationCode, ForgotPassword) so those methods' return signatures -- used across dozens of existing call sites -- do not need to change; callers request the override once they already have the code in hand.

A missing client/pool/user is treated as "no override" rather than an error: by the time a caller has a code to pass in, the primary operation already succeeded (or, for PreventUserExistenceErrors masking, deliberately has no real user), so this best-effort lookup must never turn a successful SignUp/ForgotPassword/ ResendConfirmationCode into a failure.

func (*InMemoryBackend) ListDevices 

func (b *InMemoryBackend) ListDevices(accessToken string, limit int, nextToken string) ([]*Device, string, error)

ListDevices returns a page of tracked devices for the authenticated user.

func (*InMemoryBackend) ListGroups 

func (b *InMemoryBackend) ListGroups(userPoolID string) ([]*Group, error)

ListGroups returns all groups in a user pool sorted by group name.

func (*InMemoryBackend) ListGroupsPage 

func (b *InMemoryBackend) ListGroupsPage(userPoolID string, limit int, nextToken string) ([]*Group, string, error)

ListGroupsPage returns a page of groups with optional NextToken pagination.

func (*InMemoryBackend) ListIdentityProviders 

func (b *InMemoryBackend) ListIdentityProviders(userPoolID string) ([]*IdentityProvider, error)

ListIdentityProviders returns all identity providers for a pool sorted by name.

func (*InMemoryBackend) ListResourceServers 

func (b *InMemoryBackend) ListResourceServers(userPoolID string) ([]*ResourceServer, error)

ListResourceServers returns all resource servers for a user pool sorted by identifier.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(arn string) map[string]string

ListTagsForResource returns a copy of the tag map for the given ARN.

func (*InMemoryBackend) ListTerms 

func (b *InMemoryBackend) ListTerms(userPoolID string) ([]*Terms, error)

ListTerms returns terms for a pool (returns slice of at most one element).

func (*InMemoryBackend) ListUserImportJobs 

func (b *InMemoryBackend) ListUserImportJobs(userPoolID string) ([]*UserImportJob, error)

ListUserImportJobs returns all import jobs for a pool sorted by creation time.

func (*InMemoryBackend) ListUserPoolClientSecrets 

func (b *InMemoryBackend) ListUserPoolClientSecrets(userPoolID, clientID string) ([]string, error)

ListUserPoolClientSecrets returns the secret(s) for a client. AWS allows at most one active secret.

func (*InMemoryBackend) ListUserPoolClients 

func (b *InMemoryBackend) ListUserPoolClients(userPoolID string) ([]*UserPoolClient, error)

ListUserPoolClients returns all app clients for the given user pool sorted by client name.

func (*InMemoryBackend) ListUserPoolReplicas added in v1.2.0 

func (b *InMemoryBackend) ListUserPoolReplicas(userPoolID string) ([]*UserPoolReplica, error)

ListUserPoolReplicas returns every secondary replica of userPoolID, sorted by Region for deterministic output. Real AWS caps a user directory at one secondary replica (see CreateUserPoolReplica's doc comment), so this never has more than one item to page over in practice; NextToken is accepted on the wire for shape compatibility but this backend never returns one.

func (*InMemoryBackend) ListUserPools 

func (b *InMemoryBackend) ListUserPools() []*UserPool

ListUserPools returns all user pools sorted by name.

func (*InMemoryBackend) ListUsers 

func (b *InMemoryBackend) ListUsers(userPoolID string) ([]*User, error)

ListUsers returns all users in a pool sorted by username.

func (*InMemoryBackend) ListUsersFiltered 

func (b *InMemoryBackend) ListUsersFiltered(userPoolID, filter string) ([]*User, error)

ListUsersFiltered returns users matching an optional AWS-style filter string. Supported filter form: "username = \"prefix*\"" or "username ^= \"prefix\"". If filter is empty all users are returned (same as ListUsers).

func (*InMemoryBackend) ListUsersInGroup 

func (b *InMemoryBackend) ListUsersInGroup(userPoolID, groupName string) ([]*User, error)

ListUsersInGroup returns all users belonging to a group, sorted by username.

func (*InMemoryBackend) ListUsersInGroupPage 

func (b *InMemoryBackend) ListUsersInGroupPage(
	userPoolID, groupName string,
	limit int,
	nextToken string,
) ([]*User, string, error)

ListUsersInGroupPage returns a page of users in a group with optional NextToken pagination.

func (*InMemoryBackend) ListWebAuthnCredentials 

func (b *InMemoryBackend) ListWebAuthnCredentials(
	accessToken string,
	limit int,
	nextToken string,
) ([]*WebAuthnCredential, string, error)

ListWebAuthnCredentials returns a page of WebAuthn credentials for the authenticated user.

func (*InMemoryBackend) ResendConfirmationCode 

func (b *InMemoryBackend) ResendConfirmationCode(clientID, username string) (string, error)

ResendConfirmationCode generates a new confirmation code for an unconfirmed user.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all backend state. Useful for test isolation.

func (*InMemoryBackend) RespondToCustomAuthChallenge added in v1.2.0 

func (b *InMemoryBackend) RespondToCustomAuthChallenge(clientID, session, answer string) (*AuthResult, error)

RespondToCustomAuthChallenge verifies answer for the pending CUSTOM_AUTH session (via VerifyAuthChallengeResponse), appends the round's outcome to the challenge history, and re-invokes DefineAuthChallenge to decide the next step. This mirrors AWS: a wrong answer does not automatically fail the attempt -- VerifyAuthChallengeResponse's answerCorrect is just one more entry in the session history DefineAuthChallenge sees, and it alone decides whether to retry, present a new challenge, or fail (e.g. "fail after 3 wrong answers").

func (*InMemoryBackend) RespondToMFAChallenge 

func (b *InMemoryBackend) RespondToMFAChallenge(clientID, session, code string) (*TokenResult, error)

RespondToMFAChallenge validates an MFA session and the user-supplied code, then issues tokens. SOFTWARE_TOKEN_MFA is verified as a real RFC 6238 TOTP code against the user's AssociateSoftwareToken secret; SMS_MFA/EMAIL_OTP are verified against the one-time code generated when the challenge session was created (see newMFASession). A wrong code returns CodeMismatchException without consuming the session, so the caller may retry until the session expires — matching real Cognito.

func (*InMemoryBackend) RespondToNewPasswordRequired 

func (b *InMemoryBackend) RespondToNewPasswordRequired(
	clientID, session, newPassword string,
) (*TokenResult, error)

RespondToNewPasswordRequired allows a user in FORCE_CHANGE_PASSWORD status to set a permanent password and receive tokens. The session token is from authenticate().

func (*InMemoryBackend) RespondToSRPChallenge 

func (b *InMemoryBackend) RespondToSRPChallenge(clientID, session string) (*TokenResult, error)

RespondToSRPChallenge completes the USER_SRP_AUTH two-step flow. The session token was issued by authenticate() after credentials were verified; this call issues tokens.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot.

func (*InMemoryBackend) RevokeToken 

func (b *InMemoryBackend) RevokeToken(token, clientID string) error

RevokeToken revokes a refresh token, preventing further use.

func (*InMemoryBackend) SetLambdaTriggerInvoker 

func (b *InMemoryBackend) SetLambdaTriggerInvoker(inv LambdaTriggerInvoker)

SetLambdaTriggerInvoker wires the invoker used to fire Cognito User Pool Lambda triggers. Passing nil disables trigger invocation entirely: pools with a configured LambdaConfig behave exactly as before this feature existed (LambdaConfig is stored/returned but never invoked). This is the safe default -- tests and deployments that never call SetLambdaTriggerInvoker see no behavior change.

func (*InMemoryBackend) SetLogDeliveryConfiguration 

func (b *InMemoryBackend) SetLogDeliveryConfiguration(poolID string, raw map[string]any) error

SetLogDeliveryConfiguration stores the log delivery config for a pool.

func (*InMemoryBackend) SetRiskConfiguration 

func (b *InMemoryBackend) SetRiskConfiguration(poolID, clientID string, raw map[string]any) error

SetRiskConfiguration stores a risk configuration blob for a pool (and optional client).

func (*InMemoryBackend) SetTypedRiskConfiguration 

func (b *InMemoryBackend) SetTypedRiskConfiguration(cfg *TypedRiskConfiguration) error

SetTypedRiskConfiguration stores a fully typed risk configuration for a pool or client.

func (*InMemoryBackend) SetUICustomization 

func (b *InMemoryBackend) SetUICustomization(poolID, clientID, css string) (*UICustomization, error)

SetUICustomization stores hosted-UI CSS for a pool (and optional client).

func (*InMemoryBackend) SetUICustomizationFull 

func (b *InMemoryBackend) SetUICustomizationFull(poolID, clientID, css, imageURL string) (*UICustomization, error)

SetUICustomizationFull stores extended UI customization including image URL.

func (*InMemoryBackend) SetUserMFAPreference 

func (b *InMemoryBackend) SetUserMFAPreference(
	accessToken string,
	smsMFAEnabled, softwareTokenEnabled bool,
	preferredMFA string,
) error

SetUserMFAPreference sets the preferred MFA method for the authenticated user.

func (*InMemoryBackend) SetUserPoolMfaConfig 

func (b *InMemoryBackend) SetUserPoolMfaConfig(userPoolID, mfaConfig string) error

SetUserPoolMfaConfig sets the MFA configuration for a user pool.

func (*InMemoryBackend) SetUserPoolMfaConfigFull 

func (b *InMemoryBackend) SetUserPoolMfaConfigFull(userPoolID string, cfg UserPoolMfaFullConfig) error

SetUserPoolMfaConfigFull stores the full MFA configuration for a pool.

func (*InMemoryBackend) SetUserSettings 

func (b *InMemoryBackend) SetUserSettings(accessToken string, mfaOptions []MFAOptionType) error

SetUserSettings persists legacy MFAOptions onto the authenticated user.

func (*InMemoryBackend) SignUp 

func (b *InMemoryBackend) SignUp(clientID, username, password string, userAttributes map[string]string) (*User, error)

SignUp registers a new user with UNCONFIRMED status.

func (*InMemoryBackend) SignUpWithValidation 

func (b *InMemoryBackend) SignUpWithValidation(
	clientID, username, password string,
	userAttributes map[string]string,
) (*User, error)

SignUpWithValidation is like SignUp but enforces the pool's PasswordPolicy and automatically verifies attributes configured in AutoVerifiedAttributes.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON.

func (*InMemoryBackend) StartUserImportJob 

func (b *InMemoryBackend) StartUserImportJob(userPoolID, jobID string) (*UserImportJob, error)

StartUserImportJob transitions a Created job to InProgress.

func (*InMemoryBackend) StartWebAuthnRegistration 

func (b *InMemoryBackend) StartWebAuthnRegistration(accessToken string) (map[string]any, error)

StartWebAuthnRegistration returns real WebAuthn CredentialCreationOptions (rp, user, challenge, pubKeyCredParams) for the authenticated user to pass to the browser's navigator.credentials.create().

func (*InMemoryBackend) StopUserImportJob 

func (b *InMemoryBackend) StopUserImportJob(userPoolID, jobID string) (*UserImportJob, error)

StopUserImportJob transitions an InProgress job to Stopped.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(arn string, tags map[string]string)

TagResource adds or updates tags on a resource identified by ARN.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(arn string, tagKeys []string)

UntagResource removes tag keys from a resource identified by ARN.

func (*InMemoryBackend) UpdateAuthEventFeedback 

func (b *InMemoryBackend) UpdateAuthEventFeedback(userPoolID, username, eventID, feedbackValue string) error

UpdateAuthEventFeedback records feedback on a stored auth event using an unauthenticated FeedbackToken flow (matches AWS: this op takes UserPoolId/Username directly rather than an AccessToken).

func (*InMemoryBackend) UpdateDeviceStatus 

func (b *InMemoryBackend) UpdateDeviceStatus(accessToken, deviceKey, status string) error

UpdateDeviceStatus updates a tracked device's remembered status for the authenticated user.

func (*InMemoryBackend) UpdateGroup 

func (b *InMemoryBackend) UpdateGroup(userPoolID, groupName, description string, precedence int32) (*Group, error)

UpdateGroup updates a group's description and precedence.

func (*InMemoryBackend) UpdateGroupFull 

func (b *InMemoryBackend) UpdateGroupFull(
	userPoolID, groupName, description, roleArn string,
	precedence int32,
) (*Group, error)

UpdateGroupFull updates group with description, roleArn, and precedence.

func (*InMemoryBackend) UpdateIdentityProvider 

func (b *InMemoryBackend) UpdateIdentityProvider(
	userPoolID, providerName string,
	providerDetails map[string]string,
) (*IdentityProvider, error)

UpdateIdentityProvider updates an existing identity provider's details.

func (*InMemoryBackend) UpdateIdentityProviderFull 

func (b *InMemoryBackend) UpdateIdentityProviderFull(
	userPoolID, providerName string,
	providerDetails map[string]string,
	attributeMapping map[string]string,
	idpIdentifiers []string,
) (*IdentityProvider, error)

UpdateIdentityProviderFull updates an identity provider with AttributeMapping and IdpIdentifiers.

func (*InMemoryBackend) UpdateManagedLoginBranding 

func (b *InMemoryBackend) UpdateManagedLoginBranding(userPoolID, brandingID string) (*ManagedLoginBranding, error)

UpdateManagedLoginBranding updates a managed login branding record.

func (*InMemoryBackend) UpdateProvisionedLimit added in v1.2.0 

func (b *InMemoryBackend) UpdateProvisionedLimit(
	limitClass string, attributes map[string]string, requested int32,
) (*ProvisionedLimit, error)

UpdateProvisionedLimit sets the provisioned rate for an adjustable API rate category. Only categories AWS documents as "Adjustable: Yes" may be provisioned -- every other category always enforces its fixed default, and UpdateProvisionedLimit on it is rejected ("Only adjustable quota categories support provisioning."). requested must fall between 0 and the category's modeled account-level max (see accountMaxMultiplier). AWS's own real constraint (per the Cognito quotas guide) is that the requested value must fall between the default limit and the account's Service Quotas account-level max limit.

func (*InMemoryBackend) UpdateResourceServer 

func (b *InMemoryBackend) UpdateResourceServer(
	userPoolID, identifier, name string,
	scopes []ResourceServerScope,
) (*ResourceServer, error)

UpdateResourceServer updates the name and scopes of an existing resource server.

func (*InMemoryBackend) UpdateTerms 

func (b *InMemoryBackend) UpdateTerms(userPoolID, text string) (*Terms, error)

UpdateTerms replaces the terms text for a user pool.

func (*InMemoryBackend) UpdateUserAttributes 

func (b *InMemoryBackend) UpdateUserAttributes(accessToken string, attributes map[string]string) error

UpdateUserAttributes updates the attributes of an authenticated user.

func (*InMemoryBackend) UpdateUserPool 

func (b *InMemoryBackend) UpdateUserPool(userPoolID, mfaConfiguration string) error

UpdateUserPool updates mutable properties of an existing user pool.

func (*InMemoryBackend) UpdateUserPoolClient 

func (b *InMemoryBackend) UpdateUserPoolClient(userPoolID, clientID, clientName string) (*UserPoolClient, error)

UpdateUserPoolClient updates mutable properties of an app client.

func (*InMemoryBackend) UpdateUserPoolClientWithOpts 

func (b *InMemoryBackend) UpdateUserPoolClientWithOpts(
	userPoolID, clientID, clientName string,
	opts UserPoolClientOptions,
) (*UserPoolClient, error)

UpdateUserPoolClientWithOpts updates app client fields including OAuth flows and scopes.

func (*InMemoryBackend) UpdateUserPoolDomain 

func (b *InMemoryBackend) UpdateUserPoolDomain(userPoolID, domain string) (string, error)

UpdateUserPoolDomain updates a domain (e.g., custom certificate). Returns the cloudfront domain.

func (*InMemoryBackend) UpdateUserPoolDomainFull 

func (b *InMemoryBackend) UpdateUserPoolDomainFull(userPoolID, domain, certificateArn string) (string, error)

UpdateUserPoolDomainFull updates a domain's certificate ARN and returns the CloudFront domain.

func (*InMemoryBackend) UpdateUserPoolReplica added in v1.2.0 

func (b *InMemoryBackend) UpdateUserPoolReplica(userPoolID, regionName, status string) (*UserPoolReplica, error)

UpdateUserPoolReplica sets the Status (ACTIVE or INACTIVE) of an existing replica -- the only field UpdateUserPoolReplica allows changing.

func (*InMemoryBackend) UpdateUserPoolWithOpts 

func (b *InMemoryBackend) UpdateUserPoolWithOpts(
	userPoolID, mfaConfiguration string,
	opts UserPoolOptions,
) error

UpdateUserPoolWithOpts updates user pool PasswordPolicy, AutoVerifiedAttributes, and MFA config.

func (*InMemoryBackend) ValidateAccessToken 

func (b *InMemoryBackend) ValidateAccessToken(accessToken string) error

ValidateAccessToken verifies that the supplied access token is valid and resolves to a live user, returning NotAuthorizedException otherwise. It is used by access-token-scoped operations that have no persistent state to mutate but must still authenticate the token.

func (*InMemoryBackend) ValidatePoolUser 

func (b *InMemoryBackend) ValidatePoolUser(userPoolID, username string) error

ValidatePoolUser validates that a pool and a user within it both exist. It is used by operations that have nothing to mutate but must still reject unknown pools/users with the AWS-accurate error shape.

func (*InMemoryBackend) ValidateSecretHash 

func (b *InMemoryBackend) ValidateSecretHash(clientID, username, providedHash string) error

ValidateSecretHash validates the SECRET_HASH field for a client that has a secret. AWS computes SecretHash = BASE64(HMAC-SHA256(username + clientId, clientSecret)). When a client has no secret, an empty hash is accepted (and a non-empty hash is rejected). When a client has a secret, the hash must be present and match.

func (*InMemoryBackend) VerifySoftwareToken 

func (b *InMemoryBackend) VerifySoftwareToken(accessToken, userCode string) error

VerifySoftwareToken validates userCode as a real RFC 6238 TOTP code for the secret previously issued by AssociateSoftwareToken (HMAC-SHA1, 30s step, +/-1 step clock skew, matching an authenticator app such as Google Authenticator/Authy). Only the code that the secret actually produces at (approximately) the current time is accepted.

func (*InMemoryBackend) VerifyUserAttribute 

func (b *InMemoryBackend) VerifyUserAttribute(accessToken, attributeName, _ string) error

VerifyUserAttribute is a no-op stub: the mock does not send verification codes so all attributes are considered already verified. Returns success for any code.

func (*InMemoryBackend) VerifyUserAttributeWithCode 

func (b *InMemoryBackend) VerifyUserAttributeWithCode(accessToken, attributeName, code string) error

VerifyUserAttributeWithCode validates the code stored by GetUserAttributeVerificationCode and marks the attribute as verified in the user record.

type JWK 

type JWK struct {
	Kty string `json:"kty,omitempty"`
	N   string `json:"n,omitempty"`
	E   string `json:"e,omitempty"`
	Kid string `json:"kid,omitempty"`
	Use string `json:"use,omitempty"`
	Alg string `json:"alg,omitempty"`
}

JWK represents a JSON Web Key.

type JWKSResponse 

type JWKSResponse struct {
	Keys []JWK `json:"keys,omitempty"`
}

type Janitor 

type Janitor struct {
	Backend     *InMemoryBackend `json:"backend,omitempty"`
	Interval    time.Duration    `json:"interval"`
	TaskTimeout time.Duration    `json:"taskTimeout"`
}

Janitor is the Cognito IDP background worker that evicts expired refresh tokens.

func NewJanitor 

func NewJanitor(backend *InMemoryBackend, interval time.Duration) *Janitor

NewJanitor creates a new Cognito IDP Janitor for the given backend. If interval is zero it falls back to defaultCognitoIDPJanitorInterval.

func (*Janitor) Run 

func (j *Janitor) Run(ctx context.Context)

Run runs the janitor loop until ctx is cancelled.

func (*Janitor) SweepOnce 

func (j *Janitor) SweepOnce(ctx context.Context)

SweepOnce runs a single sweep pass. Exposed for testing.

type LambdaTriggerInvoker 

type LambdaTriggerInvoker interface {
	InvokeTrigger(ctx context.Context, functionARN string, event map[string]any) (map[string]any, error)
}

LambdaTriggerInvoker invokes a Cognito Lambda trigger by function ARN with the given event payload (the standard Cognito trigger event envelope: version, triggerSource, region, userPoolId, userName, callerContext, request, response) and returns the event as returned by the function -- i.e. the same envelope with "response" populated/modified by the Lambda, exactly as AWS Cognito's real RequestResponse Lambda invocation contract works.

type LogDeliveryConfig 

type LogDeliveryConfig struct {
	Raw map[string]any `json:"raw,omitempty"`
}

LogDeliveryConfig holds log delivery destination configuration for a pool.

type MFAOptionType 

type MFAOptionType struct {
	DeliveryMedium string `json:"deliveryMedium,omitempty"`
	AttributeName  string `json:"attributeName,omitempty"`
}

MFAOptionType is the legacy per-user MFA delivery option (SetUserSettings/AdminSetUserSettings), e.g. {DeliveryMedium: "SMS", AttributeName: "phone_number"}.

type ManagedLoginBranding 

type ManagedLoginBranding struct {
	CreatedAt              time.Time `json:"createdAt"`
	LastModifiedAt         time.Time `json:"lastModifiedAt"`
	ManagedLoginBrandingID string    `json:"managedLoginBrandingID,omitempty"`
	UserPoolID             string    `json:"userPoolID,omitempty"`
	ClientID               string    `json:"clientID,omitempty"`
}

ManagedLoginBranding stores managed login branding for a pool client.

type NotifyConfigurationType 

type NotifyConfigurationType struct {
	BlockEmail    *NotifyEmailType `json:"BlockEmail,omitempty"`
	MfaEmail      *NotifyEmailType `json:"MfaEmail,omitempty"`
	NoActionEmail *NotifyEmailType `json:"NoActionEmail,omitempty"`
	From          string           `json:"From,omitempty"`
	ReplyTo       string           `json:"ReplyTo,omitempty"`
	SourceArn     string           `json:"SourceArn,omitempty"`
}

NotifyConfigurationType holds notification settings for account takeover.

type NotifyEmailType 

type NotifyEmailType struct {
	HTMLBody string `json:"HtmlBody,omitempty"`
	Subject  string `json:"Subject,omitempty"`
	TextBody string `json:"TextBody,omitempty"`
}

NotifyEmailType holds an email template for notifications.

type PasswordPolicy 

type PasswordPolicy struct {
	MinimumLength                 int  `json:"MinimumLength,omitempty"`
	RequireUppercase              bool `json:"RequireUppercase,omitempty"`
	RequireLowercase              bool `json:"RequireLowercase,omitempty"`
	RequireNumbers                bool `json:"RequireNumbers,omitempty"`
	RequireSymbols                bool `json:"RequireSymbols,omitempty"`
	TemporaryPasswordValidityDays int  `json:"TemporaryPasswordValidityDays,omitempty"`
}

PasswordPolicy holds the password-complexity requirements for a user pool.

type PoolMetrics 

type PoolMetrics struct {
	UserCount        int `json:"userCount,omitempty"`
	ClientCount      int `json:"clientCount,omitempty"`
	GroupCount       int `json:"groupCount,omitempty"`
	ActiveTokenCount int `json:"activeTokenCount,omitempty"`
}

PoolMetrics holds aggregate statistics for a user pool.

type Provider 

type Provider struct{}

Provider implements service.Provider for Amazon Cognito User Pools (IDP).

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Cognito IDP service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name. 

type ProviderLink struct {
	ProviderName           string `json:"providerName,omitempty"`
	ProviderAttributeName  string `json:"providerAttributeName,omitempty"`
	ProviderAttributeValue string `json:"providerAttributeValue,omitempty"`
}

ProviderLink records a federated identity linked to a user via AdminLinkProviderForUser.

type ProvisionedLimit added in v1.2.0 

type ProvisionedLimit struct {
	LimitClass            string
	Category              string
	FreeLimitValue        int32
	ProvisionedLimitValue int32
}

ProvisionedLimit is the (LimitDefinition, current values) pair returned by GetProvisionedLimit/UpdateProvisionedLimit.

type ResourceServer 

type ResourceServer struct {
	UserPoolID string                `json:"UserPoolId,omitempty"`
	Identifier string                `json:"Identifier,omitempty"`
	Name       string                `json:"Name,omitempty"`
	Scopes     []ResourceServerScope `json:"Scopes,omitempty"`
}

ResourceServer represents an OAuth 2.0 resource server registered to a user pool.

type ResourceServerScope 

type ResourceServerScope struct {
	ScopeName        string `json:"ScopeName,omitempty"`
	ScopeDescription string `json:"ScopeDescription,omitempty"`
}

ResourceServerScope defines a single OAuth scope on a resource server.

type RiskConfiguration 

type RiskConfiguration struct {
	// Stored as an opaque blob; individual fields not needed for emulation.
	Raw map[string]any `json:"raw,omitempty"`
}

RiskConfiguration stores adaptive authentication settings for a pool or client.

type RiskExceptionConfig 

type RiskExceptionConfig struct {
	BlockedIPRangeList []string `json:"blockedIPRangeList,omitempty"`
	SkippedIPRangeList []string `json:"skippedIPRangeList,omitempty"`
}

RiskExceptionConfig holds IP range exception configuration for adaptive authentication.

type SchemaAttribute 

type SchemaAttribute struct {
	Name                     string  `json:"Name,omitempty"`
	AttributeDataType        string  `json:"AttributeDataType,omitempty"`
	StringAttributeMinLength int64   `json:"StringAttributeMinLength,omitempty"`
	StringAttributeMaxLength int64   `json:"StringAttributeMaxLength,omitempty"`
	NumberAttributeMinValue  float64 `json:"NumberAttributeMinValue,omitempty"`
	NumberAttributeMaxValue  float64 `json:"NumberAttributeMaxValue,omitempty"`
	Mutable                  bool    `json:"Mutable,omitempty"`
	Required                 bool    `json:"Required,omitempty"`
	DeveloperOnlyAttribute   bool    `json:"DeveloperOnlyAttribute,omitempty"`
}

SchemaAttribute represents a custom attribute definition for a user pool.

type SmsConfiguration 

type SmsConfiguration struct {
	SnsCallerArn string `json:"SnsCallerArn,omitempty"`
	SnsRegion    string `json:"SnsRegion,omitempty"`
	ExternalID   string `json:"ExternalId,omitempty"`
}

SmsConfiguration holds the SNS topic ARN for SMS delivery.

type SmsMfaConfiguration 

type SmsMfaConfiguration struct {
	SmsConfiguration         *SmsConfiguration `json:"SmsConfiguration,omitempty"`
	SmsAuthenticationMessage string            `json:"SmsAuthenticationMessage,omitempty"`
}

SmsMfaConfiguration holds SMS MFA settings for a user pool.

type SoftwareTokenMfaConfiguration 

type SoftwareTokenMfaConfiguration struct {
	Enabled bool `json:"Enabled,omitempty"`
}

SoftwareTokenMfaConfiguration holds TOTP MFA settings for a user pool.

type Terms 

type Terms struct {
	UserPoolID string `json:"userPoolID,omitempty"`
	Text       string `json:"text,omitempty"`
}

Terms stores the terms and conditions text for a user pool.

type TokenParams 

type TokenParams struct {
	Attributes            map[string]string `json:"attributes,omitempty"`
	ClaimsToAddOrOverride map[string]string `json:"claimsToAddOrOverride,omitempty"`
	ClientID              string            `json:"clientID,omitempty"`
	Username              string            `json:"username,omitempty"`
	UserSub               string            `json:"userSub,omitempty"`
	Scopes                []string          `json:"scopes,omitempty"`
	Groups                []string          `json:"groups,omitempty"`
	ClaimsToSuppress      []string          `json:"claimsToSuppress,omitempty"`
	AuthTime              int64             `json:"authTime,omitempty"`
	AccessTokenExpiry     time.Duration     `json:"accessTokenExpiry,omitempty"`
	IDTokenExpiry         time.Duration     `json:"idTokenExpiry,omitempty"`
}

TokenParams holds the inputs for token issuance.

type TokenResult 

type TokenResult struct {
	IDToken      string `json:"idToken,omitempty"`
	AccessToken  string `json:"accessToken,omitempty"`
	RefreshToken string `json:"refreshToken,omitempty"`
	ExpiresIn    int32  `json:"expiresIn,omitempty"`
}

TokenResult contains the three tokens returned on successful authentication.

type TypedRiskConfiguration 

type TypedRiskConfiguration struct {
	CompromisedCredentialsRiskConfig *CompromisedCredentialsRiskConfig `json:"compromisedCredentialsRiskConfig,omitempty"`
	AccountTakeoverRiskConfig        *AccountTakeoverRiskConfig        `json:"accountTakeoverRiskConfig,omitempty"`
	RiskExceptionConfiguration       *RiskExceptionConfig              `json:"riskExceptionConfiguration,omitempty"`
	UserPoolID                       string                            `json:"userPoolID,omitempty"`
	ClientID                         string                            `json:"clientID,omitempty"`
}

TypedRiskConfiguration holds fully typed risk config fields.

type UICustomization 

type UICustomization struct {
	CreatedAt      time.Time `json:"createdAt"`
	LastModifiedAt time.Time `json:"lastModifiedAt"`
	UserPoolID     string    `json:"userPoolID,omitempty"`
	ClientID       string    `json:"clientID,omitempty"`
	CSS            string    `json:"css,omitempty"`
	ImageURL       string    `json:"imageURL,omitempty"`
}

UICustomization stores hosted-UI CSS and logo settings for a pool or client.

type User 

type User struct {
	CreatedAt            time.Time         `json:"createdAt"`
	UpdatedAt            time.Time         `json:"updatedAt"`
	ConfirmCodeExpiresAt time.Time         `json:"confirmCodeExpiresAt"`
	LastAuthTime         time.Time         `json:"lastAuthTime"`
	Attributes           map[string]string `json:"attributes,omitempty"`
	UserPoolID           string            `json:"userPoolID,omitempty"`
	Sub                  string            `json:"sub,omitempty"`
	Username             string            `json:"username,omitempty"`
	PasswordHash         string            `json:"passwordHash,omitempty"`
	Status               string            `json:"status,omitempty"`
	ConfirmCode          string            `json:"confirmCode,omitempty"`
	PreferredMfaSetting  string            `json:"preferredMfaSetting,omitempty"`
	TOTPSecret           string            `json:"totpSecret,omitempty"`
	UserMFASettingList   []string          `json:"userMFASettingList,omitempty"`
	MFAOptions           []MFAOptionType   `json:"mfaOptions,omitempty"`
	LinkedProviders      []ProviderLink    `json:"linkedProviders,omitempty"`
	Enabled              bool              `json:"enabled,omitempty"`
	TOTPVerified         bool              `json:"totpVerified,omitempty"`
}

User represents a Cognito user within a pool.

type UserImportJob 

type UserImportJob struct {
	CreatedAt  time.Time `json:"createdAt"`
	JobID      string    `json:"jobID,omitempty"`
	JobName    string    `json:"jobName,omitempty"`
	UserPoolID string    `json:"userPoolID,omitempty"`
	Status     string    `json:"status,omitempty"` // Created | Pending | InProgress | Stopping ...
}

UserImportJob represents a bulk user import job.

type UserPool 

type UserPool struct {
	CreatedAt time.Time `json:"createdAt"`
	UpdatedAt time.Time `json:"updatedAt"`

	LambdaConfig           map[string]any    `json:"lambdaConfig,omitempty"`
	EmailConfiguration     map[string]any    `json:"emailConfiguration,omitempty"`
	AccountRecoverySetting map[string]any    `json:"accountRecoverySetting,omitempty"`
	PasswordPolicy         *PasswordPolicy   `json:"passwordPolicy,omitempty"`
	ID                     string            `json:"id,omitempty"`
	Name                   string            `json:"name,omitempty"`
	ARN                    string            `json:"arn,omitempty"`
	MfaConfiguration       string            `json:"mfaConfiguration,omitempty"`
	DeletionProtection     string            `json:"deletionProtection,omitempty"`
	CustomAttributes       []SchemaAttribute `json:"customAttributes,omitempty"`
	AutoVerifiedAttributes []string          `json:"autoVerifiedAttributes,omitempty"`
	// contains filtered or unexported fields
}

UserPool represents a Cognito User Pool.

type UserPoolClient 

type UserPoolClient struct {
	CreatedAt                       time.Time         `json:"createdAt"`
	UpdatedAt                       time.Time         `json:"updatedAt"`
	TokenValidityUnits              map[string]string `json:"tokenValidityUnits,omitempty"`
	ClientID                        string            `json:"clientId,omitempty"`
	ClientName                      string            `json:"clientName,omitempty"`
	UserPoolID                      string            `json:"userPoolId,omitempty"`
	ClientSecret                    string            `json:"clientSecret,omitempty"`
	PreventUserExistenceErrors      string            `json:"preventUserExistenceErrors,omitempty"`
	AllowedOAuthScopes              []string          `json:"allowedOAuthScopes,omitempty"`
	ExplicitAuthFlows               []string          `json:"explicitAuthFlows,omitempty"`
	CallbackURLs                    []string          `json:"callbackURLs,omitempty"`
	LogoutURLs                      []string          `json:"logoutURLs,omitempty"`
	SupportedIdentityProviders      []string          `json:"supportedIdentityProviders,omitempty"`
	AllowedOAuthFlows               []string          `json:"allowedOAuthFlows,omitempty"`
	AccessTokenValidity             int32             `json:"accessTokenValidity,omitempty"`
	IDTokenValidity                 int32             `json:"idTokenValidity,omitempty"`
	RefreshTokenValidity            int32             `json:"refreshTokenValidity,omitempty"`
	EnableTokenRevocation           bool              `json:"enableTokenRevocation,omitempty"`
	AllowedOAuthFlowsUserPoolClient bool              `json:"allowedOAuthFlowsUserPoolClient,omitempty"`
}

UserPoolClient represents an app client registered to a user pool.

type UserPoolClientOptions 

type UserPoolClientOptions struct {
	TokenValidityUnits              map[string]string `json:"tokenValidityUnits,omitempty"`
	PreventUserExistenceErrors      string            `json:"preventUserExistenceErrors,omitempty"`
	SupportedIdentityProviders      []string          `json:"supportedIdentityProviders,omitempty"`
	ExplicitAuthFlows               []string          `json:"explicitAuthFlows,omitempty"`
	CallbackURLs                    []string          `json:"callbackURLs,omitempty"`
	LogoutURLs                      []string          `json:"logoutURLs,omitempty"`
	AllowedOAuthScopes              []string          `json:"allowedOAuthScopes,omitempty"`
	AllowedOAuthFlows               []string          `json:"allowedOAuthFlows,omitempty"`
	AccessTokenValidity             int32             `json:"accessTokenValidity,omitempty"`
	IDTokenValidity                 int32             `json:"idTokenValidity,omitempty"`
	RefreshTokenValidity            int32             `json:"refreshTokenValidity,omitempty"`
	GenerateSecret                  bool              `json:"generateSecret,omitempty"`
	EnableTokenRevocation           bool              `json:"enableTokenRevocation,omitempty"`
	AllowedOAuthFlowsUserPoolClient bool              `json:"allowedOAuthFlowsUserPoolClient,omitempty"`
}

UserPoolClientOptions holds optional parameters for CreateUserPoolClientWithOpts and UpdateUserPoolClientWithOpts.

type UserPoolDomain 

type UserPoolDomain struct {
	Domain                 string `json:"domain,omitempty"`
	UserPoolID             string `json:"userPoolID,omitempty"`
	CloudFrontDistribution string `json:"cloudFrontDistribution,omitempty"`
	CertificateArn         string `json:"certificateArn,omitempty"`
	Status                 string `json:"status,omitempty"`
}

UserPoolDomain holds the custom domain configuration for a user pool.

type UserPoolMfaFullConfig 

type UserPoolMfaFullConfig struct {
	SmsMfaConfiguration   *SmsMfaConfiguration           `json:"smsMfaConfiguration,omitempty"`
	SoftwareTokenMfa      *SoftwareTokenMfaConfiguration `json:"softwareTokenMfa,omitempty"`
	EmailMfaConfiguration *EmailMfaConfiguration         `json:"emailMfaConfiguration,omitempty"`
	MfaConfiguration      string                         `json:"mfaConfiguration,omitempty"`
}

UserPoolMfaFullConfig holds the complete MFA configuration for a pool.

type UserPoolOptions 

type UserPoolOptions struct {
	LambdaConfig           map[string]any  `json:"lambdaConfig,omitempty"`
	EmailConfiguration     map[string]any  `json:"emailConfiguration,omitempty"`
	AccountRecoverySetting map[string]any  `json:"accountRecoverySetting,omitempty"`
	PasswordPolicy         *PasswordPolicy `json:"passwordPolicy,omitempty"`
	DeletionProtection     string          `json:"deletionProtection,omitempty"`
	AutoVerifiedAttributes []string        `json:"autoVerifiedAttributes,omitempty"`
}

UserPoolOptions holds optional parameters for CreateUserPoolWithOpts.

type UserPoolReplica added in v1.2.0 

type UserPoolReplica struct {
	UserPoolID string `json:"userPoolId,omitempty"`
	RegionName string `json:"regionName,omitempty"`
	Role       string `json:"role,omitempty"`
	Status     string `json:"status,omitempty"`
	ARN        string `json:"arn,omitempty"`
}

UserPoolReplica represents a multi-Region secondary replica of a user pool (Amazon Cognito's Multi-Region replication / MRR feature). Every replica this backend creates has Role SECONDARY -- the primary pool is the UserPool record itself and is never represented as a UserPoolReplica.

type WebAuthnCredential 

type WebAuthnCredential struct {
	CreatedAt               time.Time `json:"createdAt"`
	CredentialID            string    `json:"credentialID,omitempty"`
	FriendlyName            string    `json:"friendlyName,omitempty"`
	RelyingPartyID          string    `json:"relyingPartyID,omitempty"`
	AuthenticatorAttachment string    `json:"authenticatorAttachment,omitempty"`
}

WebAuthnCredential represents a registered passkey/WebAuthn credential for a user.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.