cognito

package
v0.0.1-alpha.21 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: MIT Imports: 42 Imported by: 0

Documentation

Overview

Package cognito provides emulation of Amazon Cognito User Pools (IDP). See docs/services/cognito.md for the support matrix.

Wire protocol: JSON (X-Amz-Target: AWSCognitoIdentityProviderService.*)

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AccessTokenReq 

type AccessTokenReq struct {
	AccessToken string `json:"AccessToken" cbor:"AccessToken"`
}

AccessTokenReq is shared by GetUser, GlobalSignOut, AssociateSoftwareToken.

type AdminCreateUserConfig 

type AdminCreateUserConfig struct {
	// AllowAdminCreateUserOnly when true prevents self-service sign-up.
	AllowAdminCreateUserOnly bool `json:"AllowAdminCreateUserOnly,omitempty"`

	// UnusedAccountValidityDays is how long a temp password stays valid (default 7).
	UnusedAccountValidityDays int `json:"UnusedAccountValidityDays,omitempty"`

	// InviteMessageTemplate controls the welcome message sent to admin-created users.
	// Template variables: {username}, {####} (temporary password).
	InviteMessageTemplate *InviteMessageTemplate `json:"InviteMessageTemplate,omitempty"`
}

AdminCreateUserConfig controls settings for admin-created users.

type AdminCreateUserReq 

type AdminCreateUserReq struct {
	UserPoolID         string          `json:"UserPoolId" cbor:"UserPoolId"`
	Username           string          `json:"Username" cbor:"Username"`
	TemporaryPassword  string          `json:"TemporaryPassword" cbor:"TemporaryPassword"`
	UserAttributes     []UserAttribute `json:"UserAttributes" cbor:"UserAttributes"`
	MessageAction      string          `json:"MessageAction" cbor:"MessageAction"`
	ForceAliasCreation bool            `json:"ForceAliasCreation" cbor:"ForceAliasCreation"`
}

type AdminCreateUserResp 

type AdminCreateUserResp struct {
	User userWire `json:"User" cbor:"User"`
}

type AdminDeleteUserAttributesReq 

type AdminDeleteUserAttributesReq struct {
	UserPoolID         string   `json:"UserPoolId" cbor:"UserPoolId"`
	Username           string   `json:"Username" cbor:"Username"`
	UserAttributeNames []string `json:"UserAttributeNames" cbor:"UserAttributeNames"`
}

type AdminDeviceReq 

type AdminDeviceReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	Username   string `json:"Username" cbor:"Username"`
	DeviceKey  string `json:"DeviceKey" cbor:"DeviceKey"`
}

type AdminGetUserResp 

type AdminGetUserResp struct {
	Username             string          `json:"Username" cbor:"Username"`
	UserAttributes       []UserAttribute `json:"UserAttributes" cbor:"UserAttributes"`
	UserCreateDate       float64         `json:"UserCreateDate" cbor:"UserCreateDate"`
	UserLastModifiedDate float64         `json:"UserLastModifiedDate" cbor:"UserLastModifiedDate"`
	Enabled              bool            `json:"Enabled" cbor:"Enabled"`
	UserStatus           string          `json:"UserStatus" cbor:"UserStatus"`
}

type AdminInitiateAuthReq 

type AdminInitiateAuthReq struct {
	UserPoolID     string            `json:"UserPoolId" cbor:"UserPoolId"`
	ClientID       string            `json:"ClientId" cbor:"ClientId"`
	AuthFlow       string            `json:"AuthFlow" cbor:"AuthFlow"`
	AuthParameters map[string]string `json:"AuthParameters" cbor:"AuthParameters"`
	Session        string            `json:"Session" cbor:"Session"`
}

type AdminListDevicesReq 

type AdminListDevicesReq struct {
	UserPoolID      string `json:"UserPoolId" cbor:"UserPoolId"`
	Username        string `json:"Username" cbor:"Username"`
	Limit           int    `json:"Limit" cbor:"Limit"`
	PaginationToken string `json:"PaginationToken" cbor:"PaginationToken"`
}

type AdminRespondToAuthChallengeReq 

type AdminRespondToAuthChallengeReq struct {
	UserPoolID         string            `json:"UserPoolId" cbor:"UserPoolId"`
	ClientID           string            `json:"ClientId" cbor:"ClientId"`
	ChallengeName      string            `json:"ChallengeName" cbor:"ChallengeName"`
	Session            string            `json:"Session" cbor:"Session"`
	ChallengeResponses map[string]string `json:"ChallengeResponses" cbor:"ChallengeResponses"`
}

type AdminSetUserMFAPreferenceReq 

type AdminSetUserMFAPreferenceReq struct {
	UserPoolID               string       `json:"UserPoolId" cbor:"UserPoolId"`
	Username                 string       `json:"Username" cbor:"Username"`
	SoftwareTokenMfaSettings *MfaSettings `json:"SoftwareTokenMfaSettings" cbor:"SoftwareTokenMfaSettings"`
}

type AdminSetUserPasswordReq 

type AdminSetUserPasswordReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	Username   string `json:"Username" cbor:"Username"`
	Password   string `json:"Password" cbor:"Password"`
	Permanent  bool   `json:"Permanent" cbor:"Permanent"`
}

type AdminUpdateDeviceStatusReq 

type AdminUpdateDeviceStatusReq struct {
	UserPoolID             string `json:"UserPoolId" cbor:"UserPoolId"`
	Username               string `json:"Username" cbor:"Username"`
	DeviceKey              string `json:"DeviceKey" cbor:"DeviceKey"`
	DeviceRememberedStatus string `json:"DeviceRememberedStatus" cbor:"DeviceRememberedStatus"`
}

type AdminUpdateUserAttributesReq 

type AdminUpdateUserAttributesReq struct {
	UserPoolID     string          `json:"UserPoolId" cbor:"UserPoolId"`
	Username       string          `json:"Username" cbor:"Username"`
	UserAttributes []UserAttribute `json:"UserAttributes" cbor:"UserAttributes"`
}

type AssociateSoftwareTokenResp 

type AssociateSoftwareTokenResp struct {
	SecretCode string `json:"SecretCode" cbor:"SecretCode"`
}

type AuthChallengeCode 

type AuthChallengeCode struct {
	ChallengeName string    `json:"ChallengeName"`
	Code          string    `json:"Code"`
	ExpiresAt     time.Time `json:"ExpiresAt,omitempty"`
}

type AuthChallengeResponse 

type AuthChallengeResponse struct {
	ChallengeName       string            `json:"ChallengeName" cbor:"ChallengeName"`
	Session             string            `json:"Session" cbor:"Session"`
	ChallengeParameters map[string]string `json:"ChallengeParameters" cbor:"ChallengeParameters"`
}

type AuthCode 

type AuthCode struct {
	Code            string    `json:"Code"`
	ClientID        string    `json:"ClientId"`
	UserPoolID      string    `json:"UserPoolId"`
	Username        string    `json:"Username"`
	RedirectURI     string    `json:"RedirectUri"`
	Scopes          []string  `json:"Scopes"`
	State           string    `json:"State,omitempty"`
	Nonce           string    `json:"Nonce,omitempty"`
	CodeChallenge   string    `json:"CodeChallenge,omitempty"`   // PKCE
	ChallengeMethod string    `json:"ChallengeMethod,omitempty"` // "S256" or "plain"
	CreatedAt       time.Time `json:"CreatedAt"`
	ExpiresAt       time.Time `json:"ExpiresAt"`
}

AuthCode is a short-lived authorization code issued during the OAuth2 authorization code flow. Single-use, expires in 5 minutes.

type ChangePasswordReq 

type ChangePasswordReq struct {
	AccessToken      string `json:"AccessToken" cbor:"AccessToken"`
	PreviousPassword string `json:"PreviousPassword" cbor:"PreviousPassword"`
	ProposedPassword string `json:"ProposedPassword" cbor:"ProposedPassword"`
}

type ClientUserSecretReq 

type ClientUserSecretReq struct {
	ClientID   string `json:"ClientId" cbor:"ClientId"`
	Username   string `json:"Username" cbor:"Username"`
	SecretHash string `json:"SecretHash" cbor:"SecretHash"`
}

ClientUserSecretReq is shared by ForgotPassword, ResendConfirmationCode.

type CompleteWebAuthnRegistrationReq 

type CompleteWebAuthnRegistrationReq struct {
	AccessToken string `json:"AccessToken" cbor:"AccessToken"`
	Credential  any    `json:"Credential" cbor:"Credential"`
}

type ConfirmDeviceReq 

type ConfirmDeviceReq struct {
	AccessToken                string                         `json:"AccessToken" cbor:"AccessToken"`
	DeviceKey                  string                         `json:"DeviceKey" cbor:"DeviceKey"`
	DeviceName                 string                         `json:"DeviceName" cbor:"DeviceName"`
	DeviceSecretVerifierConfig *DeviceSecretVerifierConfigReq `json:"DeviceSecretVerifierConfig" cbor:"DeviceSecretVerifierConfig"`
}

type ConfirmDeviceResp 

type ConfirmDeviceResp struct {
	UserConfirmationNecessary bool `json:"UserConfirmationNecessary"`
}

type ConfirmForgotPasswordReq 

type ConfirmForgotPasswordReq struct {
	ClientID         string `json:"ClientId" cbor:"ClientId"`
	Username         string `json:"Username" cbor:"Username"`
	ConfirmationCode string `json:"ConfirmationCode" cbor:"ConfirmationCode"`
	Password         string `json:"Password" cbor:"Password"`
	SecretHash       string `json:"SecretHash" cbor:"SecretHash"`
}

type ConfirmSignUpReq 

type ConfirmSignUpReq struct {
	ClientID           string `json:"ClientId" cbor:"ClientId"`
	Username           string `json:"Username" cbor:"Username"`
	ConfirmationCode   string `json:"ConfirmationCode" cbor:"ConfirmationCode"`
	SecretHash         string `json:"SecretHash" cbor:"SecretHash"`
	ForceAliasCreation bool   `json:"ForceAliasCreation" cbor:"ForceAliasCreation"`
}

type ConfirmSignUpResp 

type ConfirmSignUpResp struct {
	Session string `json:"Session,omitempty" cbor:"Session,omitempty"`
}

type CreateGroupReq 

type CreateGroupReq struct {
	UserPoolID  string `json:"UserPoolId" cbor:"UserPoolId"`
	GroupName   string `json:"GroupName" cbor:"GroupName"`
	Description string `json:"Description" cbor:"Description"`
	Precedence  int    `json:"Precedence" cbor:"Precedence"`
	RoleARN     string `json:"RoleArn" cbor:"RoleArn"`
}

type CreateGroupResp 

type CreateGroupResp struct {
	Group groupWire `json:"Group" cbor:"Group"`
}

type CreateUserPoolClientReq 

type CreateUserPoolClientReq struct {
	UserPoolID                      string                  `json:"UserPoolId" cbor:"UserPoolId"`
	ClientName                      string                  `json:"ClientName" cbor:"ClientName"`
	GenerateSecret                  bool                    `json:"GenerateSecret" cbor:"GenerateSecret"`
	AccessTokenValidity             int                     `json:"AccessTokenValidity" cbor:"AccessTokenValidity"`
	IdTokenValidity                 int                     `json:"IdTokenValidity" cbor:"IdTokenValidity"`
	RefreshTokenValidity            int                     `json:"RefreshTokenValidity" cbor:"RefreshTokenValidity"`
	TokenValidityUnits              *TokenValidityUnitsType `json:"TokenValidityUnits" cbor:"TokenValidityUnits"`
	CallbackURLs                    []string                `json:"CallbackURLs" cbor:"CallbackURLs"`
	LogoutURLs                      []string                `json:"LogoutURLs" cbor:"LogoutURLs"`
	AllowedOAuthFlows               []string                `json:"AllowedOAuthFlows" cbor:"AllowedOAuthFlows"`
	AllowedOAuthScopes              []string                `json:"AllowedOAuthScopes" cbor:"AllowedOAuthScopes"`
	AllowedOAuthFlowsUserPoolClient bool                    `json:"AllowedOAuthFlowsUserPoolClient" cbor:"AllowedOAuthFlowsUserPoolClient"`
	ExplicitAuthFlows               []string                `json:"ExplicitAuthFlows" cbor:"ExplicitAuthFlows"`
	SupportedIdentityProviders      []string                `json:"SupportedIdentityProviders" cbor:"SupportedIdentityProviders"`
}

type CreateUserPoolClientResp 

type CreateUserPoolClientResp struct {
	UserPoolClient clientWire `json:"UserPoolClient" cbor:"UserPoolClient"`
}

type CreateUserPoolReq 

type CreateUserPoolReq struct {
	PoolName                    string                           `json:"PoolName" cbor:"PoolName"`
	UserPoolTier                string                           `json:"UserPoolTier" cbor:"UserPoolTier"`
	VerificationMessageTemplate *verificationMessageTemplateWire `json:"VerificationMessageTemplate" cbor:"VerificationMessageTemplate"`
	AdminCreateUserConfig       *adminCreateUserConfigWire       `json:"AdminCreateUserConfig" cbor:"AdminCreateUserConfig"`
	EmailConfiguration          *emailConfigurationWire          `json:"EmailConfiguration" cbor:"EmailConfiguration"`
	UserAttributeUpdateSettings *userAttributeUpdateSettingsWire `json:"UserAttributeUpdateSettings" cbor:"UserAttributeUpdateSettings"`
	DeviceConfiguration         *DeviceConfiguration             `json:"DeviceConfiguration" cbor:"DeviceConfiguration"`
	UsernameAttributes          []string                         `json:"UsernameAttributes" cbor:"UsernameAttributes"`
	AliasAttributes             []string                         `json:"AliasAttributes" cbor:"AliasAttributes"`
	Policies                    *userPoolPoliciesWire            `json:"Policies" cbor:"Policies"`
}

type CreateUserPoolResp 

type CreateUserPoolResp struct {
	UserPool userPoolWire `json:"UserPool" cbor:"UserPool"`
}

type DeleteUserAttributesReq 

type DeleteUserAttributesReq struct {
	AccessToken        string   `json:"AccessToken" cbor:"AccessToken"`
	UserAttributeNames []string `json:"UserAttributeNames" cbor:"UserAttributeNames"`
}

type DescribeUserPoolClientResp 

type DescribeUserPoolClientResp struct {
	UserPoolClient clientWire `json:"UserPoolClient" cbor:"UserPoolClient"`
}

type DescribeUserPoolDomainReq 

type DescribeUserPoolDomainReq struct {
	Domain string `json:"Domain" cbor:"Domain"`
}

type DescribeUserPoolDomainResp 

type DescribeUserPoolDomainResp struct {
	DomainDescription domainDescriptionWire `json:"DomainDescription" cbor:"DomainDescription"`
}

type DescribeUserPoolResp 

type DescribeUserPoolResp struct {
	UserPool userPoolWire `json:"UserPool" cbor:"UserPool"`
}

type DeviceConfiguration 

type DeviceConfiguration struct {
	ChallengeRequiredOnNewDevice     bool `json:"ChallengeRequiredOnNewDevice,omitempty"`
	DeviceOnlyRememberedOnUserPrompt bool `json:"DeviceOnlyRememberedOnUserPrompt,omitempty"`
}

type DeviceKeyAccessReq 

type DeviceKeyAccessReq struct {
	AccessToken string `json:"AccessToken" cbor:"AccessToken"`
	DeviceKey   string `json:"DeviceKey" cbor:"DeviceKey"`
}

type DeviceSecretVerifierConfigReq 

type DeviceSecretVerifierConfigReq struct {
	PasswordVerifier string `json:"PasswordVerifier" cbor:"PasswordVerifier"`
	Salt             string `json:"Salt" cbor:"Salt"`
}

type DomainAndPoolReq 

type DomainAndPoolReq struct {
	Domain     string `json:"Domain" cbor:"Domain"`
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
}

DomainAndPoolReq is shared by CreateUserPoolDomain, DeleteUserPoolDomain, UpdateUserPoolDomain.

type EmailConfiguration 

type EmailConfiguration struct {
	// EmailSendingAccount is "COGNITO_DEFAULT" or "DEVELOPER" (SES).
	EmailSendingAccount string `json:"EmailSendingAccount,omitempty"`

	// SourceArn is the SES verified email ARN (used when EmailSendingAccount=DEVELOPER).
	SourceArn string `json:"SourceArn,omitempty"`

	// From is the sender email address.
	From string `json:"From,omitempty"`

	// ReplyToEmailAddress is the reply-to address.
	ReplyToEmailAddress string `json:"ReplyToEmailAddress,omitempty"`
}

EmailConfiguration controls the email delivery method.

type ForgotPasswordResp 

type ForgotPasswordResp struct {
	CodeDeliveryDetails codeDeliveryDetails `json:"CodeDeliveryDetails" cbor:"CodeDeliveryDetails"`
}

type GetDeviceResp 

type GetDeviceResp struct {
	Device deviceWire `json:"Device"`
}

type GetGroupResp 

type GetGroupResp struct {
	Group groupWire `json:"Group" cbor:"Group"`
}

type GetUserAttributeVerificationCodeReq 

type GetUserAttributeVerificationCodeReq struct {
	AccessToken   string `json:"AccessToken" cbor:"AccessToken"`
	AttributeName string `json:"AttributeName" cbor:"AttributeName"`
}

type GetUserAttributeVerificationCodeResp 

type GetUserAttributeVerificationCodeResp struct {
	CodeDeliveryDetails codeDeliveryDetails `json:"CodeDeliveryDetails" cbor:"CodeDeliveryDetails"`
}

type GetUserResp 

type GetUserResp struct {
	Username             string          `json:"Username" cbor:"Username"`
	UserAttributes       []UserAttribute `json:"UserAttributes" cbor:"UserAttributes"`
	UserCreateDate       float64         `json:"UserCreateDate" cbor:"UserCreateDate"`
	UserLastModifiedDate float64         `json:"UserLastModifiedDate" cbor:"UserLastModifiedDate"`
}

type Group 

type Group struct {
	GroupName   string    `json:"GroupName"`
	UserPoolID  string    `json:"UserPoolId"`
	Description string    `json:"Description,omitempty"`
	Precedence  int       `json:"Precedence"`
	RoleARN     string    `json:"RoleArn,omitempty"`
	CreatedAt   time.Time `json:"CreationDate"`
}

Group is a user pool group used to organise users and assign IAM roles.

type InitiateAuthReq 

type InitiateAuthReq struct {
	ClientID       string            `json:"ClientId" cbor:"ClientId"`
	AuthFlow       string            `json:"AuthFlow" cbor:"AuthFlow"`
	AuthParameters map[string]string `json:"AuthParameters" cbor:"AuthParameters"`
	Session        string            `json:"Session" cbor:"Session"`
}

type InitiateAuthResp 

type InitiateAuthResp struct {
	AuthenticationResult *authResultWire   `json:"AuthenticationResult,omitempty" cbor:"AuthenticationResult,omitempty"`
	AvailableChallenges  []string          `json:"AvailableChallenges,omitempty" cbor:"AvailableChallenges,omitempty"`
	ChallengeName        string            `json:"ChallengeName,omitempty" cbor:"ChallengeName,omitempty"`
	Session              string            `json:"Session,omitempty" cbor:"Session,omitempty"`
	ChallengeParameters  map[string]string `json:"ChallengeParameters,omitempty" cbor:"ChallengeParameters,omitempty"`
}

type InviteMessageTemplate 

type InviteMessageTemplate struct {
	// EmailMessage is the email body. Must contain {username} and {####}.
	EmailMessage string `json:"EmailMessage,omitempty"`

	// EmailSubject is the email subject line.
	EmailSubject string `json:"EmailSubject,omitempty"`

	// SMSMessage is the SMS body. Must contain {username} and {####}.
	SMSMessage string `json:"SMSMessage,omitempty"`
}

InviteMessageTemplate configures the invitation email/SMS for admin-created users.

type ListDevicesReq 

type ListDevicesReq struct {
	AccessToken     string `json:"AccessToken" cbor:"AccessToken"`
	Limit           int    `json:"Limit" cbor:"Limit"`
	PaginationToken string `json:"PaginationToken" cbor:"PaginationToken"`
}

type ListDevicesResp 

type ListDevicesResp struct {
	Devices         []deviceWire `json:"Devices"`
	PaginationToken string       `json:"PaginationToken,omitempty"`
}

type ListGroupsResp 

type ListGroupsResp struct {
	Groups    []groupWire `json:"Groups" cbor:"Groups"`
	NextToken string      `json:"NextToken,omitempty" cbor:"NextToken,omitempty"`
}

type ListUserPoolClientsResp 

type ListUserPoolClientsResp struct {
	UserPoolClients []clientDesc `json:"UserPoolClients" cbor:"UserPoolClients"`
}

type ListUserPoolsResp 

type ListUserPoolsResp struct {
	UserPools []poolDesc `json:"UserPools" cbor:"UserPools"`
}

type ListUsersInGroupResp 

type ListUsersInGroupResp struct {
	Users     []userWire `json:"Users" cbor:"Users"`
	NextToken string     `json:"NextToken,omitempty" cbor:"NextToken,omitempty"`
}

type ListUsersReq 

type ListUsersReq struct {
	UserPoolID      string   `json:"UserPoolId" cbor:"UserPoolId"`
	AttributesToGet []string `json:"AttributesToGet" cbor:"AttributesToGet"`
	Filter          string   `json:"Filter" cbor:"Filter"`
	Limit           int      `json:"Limit" cbor:"Limit"`
	PaginationToken string   `json:"PaginationToken" cbor:"PaginationToken"`
}

type ListUsersResp 

type ListUsersResp struct {
	Users           []userWire `json:"Users" cbor:"Users"`
	PaginationToken string     `json:"PaginationToken,omitempty" cbor:"PaginationToken,omitempty"`
}

type LoginSession 

type LoginSession struct {
	SessionID  string    `json:"SessionId"`
	UserPoolID string    `json:"UserPoolId"`
	Username   string    `json:"Username"`
	CreatedAt  time.Time `json:"CreatedAt"`
	ExpiresAt  time.Time `json:"ExpiresAt"`
}

LoginSession tracks a logged-in user during the managed login flow.

type ManagedLoginBranding 

type ManagedLoginBranding struct {
	LogoURL         string `json:"LogoURL,omitempty"`
	BackgroundColor string `json:"BackgroundColor,omitempty"`
	PrimaryColor    string `json:"PrimaryColor,omitempty"`
	FontFamily      string `json:"FontFamily,omitempty"`
	CustomCSS       string `json:"CustomCSS,omitempty"`
}

ManagedLoginBranding controls the visual appearance of the managed login pages.

type MfaSettings 

type MfaSettings struct {
	Enabled      bool `json:"Enabled" cbor:"Enabled"`
	PreferredMfa bool `json:"PreferredMfa" cbor:"PreferredMfa"`
}

type NewDeviceMetadata 

type NewDeviceMetadata struct {
	DeviceKey      string `json:"DeviceKey"`
	DeviceGroupKey string `json:"DeviceGroupKey"`
}

type PasswordPolicy 

type PasswordPolicy struct {
	// MinimumLength is the minimum password length. Default: 8.
	MinimumLength int `json:"MinimumLength,omitempty"`

	// RequireUppercase requires at least one uppercase letter.
	RequireUppercase bool `json:"RequireUppercase,omitempty"`

	// RequireLowercase requires at least one lowercase letter.
	RequireLowercase bool `json:"RequireLowercase,omitempty"`

	// RequireNumbers requires at least one digit.
	RequireNumbers bool `json:"RequireNumbers,omitempty"`

	// RequireSymbols requires at least one symbol character.
	RequireSymbols bool `json:"RequireSymbols,omitempty"`

	// TemporaryPasswordValidityDays controls how long a temporary password
	// issued by AdminCreateUser remains valid. Default: 7.
	TemporaryPasswordValidityDays int `json:"TemporaryPasswordValidityDays,omitempty"`
}

PasswordPolicy enforces password strength requirements on user password flows, including AdminCreateUser temporary passwords.

type PendingAttributeUpdate 

type PendingAttributeUpdate struct {
	Name      string    `json:"Name"`
	Value     string    `json:"Value"`
	Code      string    `json:"Code"`
	ExpiresAt time.Time `json:"ExpiresAt,omitempty"`
}

type PoolAndClientReq 

type PoolAndClientReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	ClientID   string `json:"ClientId" cbor:"ClientId"`
}

PoolAndClientReq is shared by DescribeUserPoolClient, DeleteUserPoolClient.

type PoolAndGroupLimitReq 

type PoolAndGroupLimitReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	GroupName  string `json:"GroupName" cbor:"GroupName"`
	Limit      int    `json:"Limit" cbor:"Limit"`
	NextToken  string `json:"NextToken" cbor:"NextToken"`
}

type PoolAndGroupReq 

type PoolAndGroupReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	GroupName  string `json:"GroupName" cbor:"GroupName"`
}

PoolAndGroupReq is shared by GetGroup, DeleteGroup.

type PoolAndUserGroupReq 

type PoolAndUserGroupReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	Username   string `json:"Username" cbor:"Username"`
	GroupName  string `json:"GroupName" cbor:"GroupName"`
}

type PoolAndUserLimitReq 

type PoolAndUserLimitReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	Username   string `json:"Username" cbor:"Username"`
	Limit      int    `json:"Limit" cbor:"Limit"`
	NextToken  string `json:"NextToken" cbor:"NextToken"`
}

type PoolAndUserReq 

type PoolAndUserReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	Username   string `json:"Username" cbor:"Username"`
}

PoolAndUserReq is shared by AdminDeleteUser, AdminGetUser, AdminConfirmSignUp, AdminDisableUser, AdminEnableUser.

type PoolLimitReq 

type PoolLimitReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
	Limit      int    `json:"Limit" cbor:"Limit"`
	NextToken  string `json:"NextToken" cbor:"NextToken"`
}

type RespondToAuthChallengeReq 

type RespondToAuthChallengeReq struct {
	ClientID           string            `json:"ClientId" cbor:"ClientId"`
	ChallengeName      string            `json:"ChallengeName" cbor:"ChallengeName"`
	Session            string            `json:"Session" cbor:"Session"`
	ChallengeResponses map[string]string `json:"ChallengeResponses" cbor:"ChallengeResponses"`
}

type RespondToAuthChallengeResp 

type RespondToAuthChallengeResp struct {
	AuthenticationResult *authResultWire   `json:"AuthenticationResult,omitempty" cbor:"AuthenticationResult,omitempty"`
	ChallengeName        string            `json:"ChallengeName,omitempty" cbor:"ChallengeName,omitempty"`
	ChallengeParameters  map[string]string `json:"ChallengeParameters,omitempty" cbor:"ChallengeParameters,omitempty"`
	Session              string            `json:"Session,omitempty" cbor:"Session,omitempty"`
}

type RevokeTokenReq 

type RevokeTokenReq struct {
	ClientID string `json:"ClientId" cbor:"ClientId"`
	Token    string `json:"Token" cbor:"Token"`
}

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service implements router.Service and router.TargetDispatcher for Cognito User Pools.

func New 

func New(cfg *config.Config, store state.Store, logger *zap.Logger, clk clock.Clock) *Service

New returns a configured Cognito Service.

func (*Service) AdminAddUserToGroupTyped 

func (s *Service) AdminAddUserToGroupTyped(ctx context.Context, req *PoolAndUserGroupReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminConfirmSignUpTyped 

func (s *Service) AdminConfirmSignUpTyped(ctx context.Context, req *PoolAndUserReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminCreateUserTyped 

func (s *Service) AdminCreateUserTyped(ctx context.Context, req *AdminCreateUserReq) (*AdminCreateUserResp, *protocol.AWSError)

func (*Service) AdminDeleteUserAttributesTyped 

func (s *Service) AdminDeleteUserAttributesTyped(ctx context.Context, req *AdminDeleteUserAttributesReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminDeleteUserTyped 

func (s *Service) AdminDeleteUserTyped(ctx context.Context, req *PoolAndUserReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminDisableUserTyped 

func (s *Service) AdminDisableUserTyped(ctx context.Context, req *PoolAndUserReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminEnableUserTyped 

func (s *Service) AdminEnableUserTyped(ctx context.Context, req *PoolAndUserReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminForgetDeviceTyped 

func (s *Service) AdminForgetDeviceTyped(ctx context.Context, req *AdminDeviceReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminGetDeviceTyped 

func (s *Service) AdminGetDeviceTyped(ctx context.Context, req *AdminDeviceReq) (*GetDeviceResp, *protocol.AWSError)

func (*Service) AdminGetUserTyped 

func (s *Service) AdminGetUserTyped(ctx context.Context, req *PoolAndUserReq) (*AdminGetUserResp, *protocol.AWSError)

func (*Service) AdminInitiateAuthTyped 

func (s *Service) AdminInitiateAuthTyped(ctx context.Context, req *AdminInitiateAuthReq) (*InitiateAuthResp, *protocol.AWSError)

func (*Service) AdminListDevicesTyped 

func (s *Service) AdminListDevicesTyped(ctx context.Context, req *AdminListDevicesReq) (*ListDevicesResp, *protocol.AWSError)

func (*Service) AdminListGroupsForUserTyped 

func (s *Service) AdminListGroupsForUserTyped(ctx context.Context, req *PoolAndUserLimitReq) (*ListGroupsResp, *protocol.AWSError)

func (*Service) AdminRemoveUserFromGroupTyped 

func (s *Service) AdminRemoveUserFromGroupTyped(ctx context.Context, req *PoolAndUserGroupReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminRespondToAuthChallengeTyped 

func (s *Service) AdminRespondToAuthChallengeTyped(ctx context.Context, req *AdminRespondToAuthChallengeReq) (*RespondToAuthChallengeResp, *protocol.AWSError)

func (*Service) AdminSetUserMFAPreferenceTyped 

func (s *Service) AdminSetUserMFAPreferenceTyped(ctx context.Context, req *AdminSetUserMFAPreferenceReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminSetUserPasswordTyped 

func (s *Service) AdminSetUserPasswordTyped(ctx context.Context, req *AdminSetUserPasswordReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminUpdateDeviceStatusTyped 

func (s *Service) AdminUpdateDeviceStatusTyped(ctx context.Context, req *AdminUpdateDeviceStatusReq) (*struct{}, *protocol.AWSError)

func (*Service) AdminUpdateUserAttributesTyped 

func (s *Service) AdminUpdateUserAttributesTyped(ctx context.Context, req *AdminUpdateUserAttributesReq) (*struct{}, *protocol.AWSError)

func (*Service) AssociateSoftwareTokenTyped 

func (s *Service) AssociateSoftwareTokenTyped(ctx context.Context, req *AccessTokenReq) (*AssociateSoftwareTokenResp, *protocol.AWSError)

func (*Service) ChangePasswordTyped 

func (s *Service) ChangePasswordTyped(ctx context.Context, req *ChangePasswordReq) (*struct{}, *protocol.AWSError)

func (*Service) CompleteWebAuthnRegistrationTyped 

func (s *Service) CompleteWebAuthnRegistrationTyped(ctx context.Context, req *CompleteWebAuthnRegistrationReq) (*struct{}, *protocol.AWSError)

func (*Service) ConfirmDeviceTyped 

func (s *Service) ConfirmDeviceTyped(ctx context.Context, req *ConfirmDeviceReq) (*ConfirmDeviceResp, *protocol.AWSError)

func (*Service) ConfirmForgotPasswordTyped 

func (s *Service) ConfirmForgotPasswordTyped(ctx context.Context, req *ConfirmForgotPasswordReq) (*struct{}, *protocol.AWSError)

func (*Service) ConfirmSignUpTyped 

func (s *Service) ConfirmSignUpTyped(ctx context.Context, req *ConfirmSignUpReq) (*ConfirmSignUpResp, *protocol.AWSError)

func (*Service) CreateGroupTyped 

func (s *Service) CreateGroupTyped(ctx context.Context, req *CreateGroupReq) (*CreateGroupResp, *protocol.AWSError)

func (*Service) CreateUserPoolClientTyped 

func (s *Service) CreateUserPoolClientTyped(ctx context.Context, req *CreateUserPoolClientReq) (*CreateUserPoolClientResp, *protocol.AWSError)

func (*Service) CreateUserPoolDomainTyped 

func (s *Service) CreateUserPoolDomainTyped(ctx context.Context, req *DomainAndPoolReq) (*struct{}, *protocol.AWSError)

func (*Service) CreateUserPoolTyped 

func (s *Service) CreateUserPoolTyped(ctx context.Context, req *CreateUserPoolReq) (*CreateUserPoolResp, *protocol.AWSError)

func (*Service) DeleteGroupTyped 

func (s *Service) DeleteGroupTyped(ctx context.Context, req *PoolAndGroupReq) (*struct{}, *protocol.AWSError)

func (*Service) DeleteUserAttributesTyped 

func (s *Service) DeleteUserAttributesTyped(ctx context.Context, req *DeleteUserAttributesReq) (*struct{}, *protocol.AWSError)

func (*Service) DeleteUserPoolClientTyped 

func (s *Service) DeleteUserPoolClientTyped(ctx context.Context, req *PoolAndClientReq) (*struct{}, *protocol.AWSError)

func (*Service) DeleteUserPoolDomainTyped 

func (s *Service) DeleteUserPoolDomainTyped(ctx context.Context, req *DomainAndPoolReq) (*struct{}, *protocol.AWSError)

func (*Service) DeleteUserPoolTyped 

func (s *Service) DeleteUserPoolTyped(ctx context.Context, req *UserPoolIDReq) (*struct{}, *protocol.AWSError)

func (*Service) DescribeUserPoolClientTyped 

func (s *Service) DescribeUserPoolClientTyped(ctx context.Context, req *PoolAndClientReq) (*DescribeUserPoolClientResp, *protocol.AWSError)

func (*Service) DescribeUserPoolDomainTyped 

func (s *Service) DescribeUserPoolDomainTyped(ctx context.Context, req *DescribeUserPoolDomainReq) (*DescribeUserPoolDomainResp, *protocol.AWSError)

func (*Service) DescribeUserPoolTyped 

func (s *Service) DescribeUserPoolTyped(ctx context.Context, req *UserPoolIDReq) (*DescribeUserPoolResp, *protocol.AWSError)

func (*Service) Dispatch 

func (s *Service) Dispatch(w http.ResponseWriter, r *http.Request)

Dispatch satisfies router.TargetDispatcher.

func (*Service) ForgetDeviceTyped 

func (s *Service) ForgetDeviceTyped(ctx context.Context, req *DeviceKeyAccessReq) (*struct{}, *protocol.AWSError)

func (*Service) ForgotPasswordTyped 

func (s *Service) ForgotPasswordTyped(ctx context.Context, req *ClientUserSecretReq) (*ForgotPasswordResp, *protocol.AWSError)

func (*Service) GetDeviceTyped 

func (s *Service) GetDeviceTyped(ctx context.Context, req *DeviceKeyAccessReq) (*GetDeviceResp, *protocol.AWSError)

func (*Service) GetGroupTyped 

func (s *Service) GetGroupTyped(ctx context.Context, req *PoolAndGroupReq) (*GetGroupResp, *protocol.AWSError)

func (*Service) GetUserAttributeVerificationCodeTyped 

func (s *Service) GetUserAttributeVerificationCodeTyped(ctx context.Context, req *GetUserAttributeVerificationCodeReq) (*GetUserAttributeVerificationCodeResp, *protocol.AWSError)

func (*Service) GetUserPoolMfaConfigTyped 

func (s *Service) GetUserPoolMfaConfigTyped(ctx context.Context, req *UserPoolIDReq) (*UserPoolMfaConfigResp, *protocol.AWSError)

func (*Service) GetUserTyped 

func (s *Service) GetUserTyped(ctx context.Context, req *AccessTokenReq) (*GetUserResp, *protocol.AWSError)

func (*Service) GlobalSignOutTyped 

func (s *Service) GlobalSignOutTyped(ctx context.Context, req *AccessTokenReq) (*struct{}, *protocol.AWSError)

func (*Service) HandleAuthorize 

func (s *Service) HandleAuthorize(w http.ResponseWriter, r *http.Request)

HandleAuthorize handles GET /_cognito/{poolId}/oauth2/authorize. Validates the request and redirects to the login page.

func (*Service) HandleConfirmPage 

func (s *Service) HandleConfirmPage(w http.ResponseWriter, r *http.Request)

HandleConfirmPage renders the confirmation code entry form.

func (*Service) HandleConfirmSubmit 

func (s *Service) HandleConfirmSubmit(w http.ResponseWriter, r *http.Request)

HandleConfirmSubmit processes the confirmation code POST.

func (*Service) HandleDebugToken 

func (s *Service) HandleDebugToken(w http.ResponseWriter, r *http.Request)

HandleDebugToken serves GET /_cognito/{poolId}/debug/token. After the authorization code flow completes with the debug redirect URI, the browser lands here with ?code=.... This handler exchanges the code for tokens server-side and renders an interactive JWT inspector page.

func (*Service) HandleForgotPasswordPage 

func (s *Service) HandleForgotPasswordPage(w http.ResponseWriter, r *http.Request)

HandleForgotPasswordPage renders the forgot-password form.

func (*Service) HandleForgotPasswordSubmit 

func (s *Service) HandleForgotPasswordSubmit(w http.ResponseWriter, r *http.Request)

HandleForgotPasswordSubmit processes the forgot-password form POST.

func (*Service) HandleGetBranding 

func (s *Service) HandleGetBranding(w http.ResponseWriter, r *http.Request)

HandleGetBranding serves GET /_cognito/{poolId}/branding. Emulator-only: returns the managed login branding for the pool.

func (*Service) HandleGetPassword 

func (s *Service) HandleGetPassword(w http.ResponseWriter, r *http.Request)

HandleGetPassword serves GET /_cognito/{poolId}/users/{username}/password. Emulator-only endpoint for dev convenience — returns the user's plaintext password.

func (*Service) HandleLoginPage 

func (s *Service) HandleLoginPage(w http.ResponseWriter, r *http.Request)

HandleLoginPage renders the managed login form.

func (*Service) HandleLoginSubmit 

func (s *Service) HandleLoginSubmit(w http.ResponseWriter, r *http.Request)

HandleLoginSubmit processes the login form POST.

func (*Service) HandleLogout 

func (s *Service) HandleLogout(w http.ResponseWriter, r *http.Request)

HandleLogout handles GET /_cognito/{poolId}/logout.

func (*Service) HandleMFAPage 

func (s *Service) HandleMFAPage(w http.ResponseWriter, r *http.Request)

HandleMFAPage renders the MFA code entry form.

func (*Service) HandleMFASubmit 

func (s *Service) HandleMFASubmit(w http.ResponseWriter, r *http.Request)

HandleMFASubmit processes the MFA verification POST.

func (*Service) HandleNewPasswordPage 

func (s *Service) HandleNewPasswordPage(w http.ResponseWriter, r *http.Request)

HandleNewPasswordPage renders the change-password form.

func (*Service) HandleNewPasswordSubmit 

func (s *Service) HandleNewPasswordSubmit(w http.ResponseWriter, r *http.Request)

HandleNewPasswordSubmit processes the new password POST.

func (*Service) HandleOIDCDiscovery 

func (s *Service) HandleOIDCDiscovery(w http.ResponseWriter, r *http.Request)

HandleOIDCDiscovery serves GET /{region}/{poolId}/.well-known/openid-configuration.

func (*Service) HandleResetPasswordPage 

func (s *Service) HandleResetPasswordPage(w http.ResponseWriter, r *http.Request)

HandleResetPasswordPage renders the reset-password form (code + new password).

func (*Service) HandleResetPasswordSubmit 

func (s *Service) HandleResetPasswordSubmit(w http.ResponseWriter, r *http.Request)

HandleResetPasswordSubmit processes the reset-password form POST.

func (*Service) HandleRevoke 

func (s *Service) HandleRevoke(w http.ResponseWriter, r *http.Request)

HandleRevoke handles POST /_cognito/{poolId}/oauth2/revoke.

func (*Service) HandleSetBranding 

func (s *Service) HandleSetBranding(w http.ResponseWriter, r *http.Request)

HandleSetBranding serves PUT /_cognito/{poolId}/branding. Emulator-only: replaces the managed login branding for the pool.

func (*Service) HandleSignUpPage 

func (s *Service) HandleSignUpPage(w http.ResponseWriter, r *http.Request)

HandleSignUpPage renders the sign-up form.

func (*Service) HandleSignUpSubmit 

func (s *Service) HandleSignUpSubmit(w http.ResponseWriter, r *http.Request)

HandleSignUpSubmit processes the sign-up form POST.

func (*Service) HandleToken 

func (s *Service) HandleToken(w http.ResponseWriter, r *http.Request)

HandleToken handles POST /_cognito/{poolId}/oauth2/token.

func (*Service) HandleUserInfo 

func (s *Service) HandleUserInfo(w http.ResponseWriter, r *http.Request)

HandleUserInfo handles GET/POST /_cognito/{poolId}/oauth2/userInfo.

func (*Service) InitBus 

func (s *Service) InitBus(bus *events.Bus)

InitBus wires the event bus for resource lifecycle events.

func (*Service) InitEmailDelivery 

func (s *Service) InitEmailDelivery(m smtp.Mailer)

InitEmailDelivery wires the SMTP mailer for verification and temp-password emails. Call this after the router has constructed the mailer.

func (*Service) InitSMSDelivery 

func (s *Service) InitSMSDelivery(ss smtp.SMSSender)

InitSMSDelivery wires the SMS sender so verification and MFA codes sent via SMS are captured in the inbox. Call this after the router builds the SMS sender.

func (*Service) InitiateAuthTyped 

func (s *Service) InitiateAuthTyped(ctx context.Context, req *InitiateAuthReq) (*InitiateAuthResp, *protocol.AWSError)

func (*Service) ListDevicesTyped 

func (s *Service) ListDevicesTyped(ctx context.Context, req *ListDevicesReq) (*ListDevicesResp, *protocol.AWSError)

func (*Service) ListGroupsTyped 

func (s *Service) ListGroupsTyped(ctx context.Context, req *PoolLimitReq) (*ListGroupsResp, *protocol.AWSError)

func (*Service) ListUserPoolClientsTyped 

func (s *Service) ListUserPoolClientsTyped(ctx context.Context, req *UserPoolIDReq) (*ListUserPoolClientsResp, *protocol.AWSError)

func (*Service) ListUserPoolsTyped 

func (s *Service) ListUserPoolsTyped(ctx context.Context, req *struct{}) (*ListUserPoolsResp, *protocol.AWSError)

func (*Service) ListUsersInGroupTyped 

func (s *Service) ListUsersInGroupTyped(ctx context.Context, req *PoolAndGroupLimitReq) (*ListUsersInGroupResp, *protocol.AWSError)

func (*Service) ListUsersTyped 

func (s *Service) ListUsersTyped(ctx context.Context, req *ListUsersReq) (*ListUsersResp, *protocol.AWSError)

func (*Service) Name 

func (s *Service) Name() string

Name satisfies router.Service.

func (*Service) Operations 

func (s *Service) Operations() []op.Operation

Operations implements router.ProtocolService.

func (*Service) RegisterRoutes 

func (s *Service) RegisterRoutes(r chi.Router)

RegisterRoutes satisfies router.Service. Registers the JWKS discovery endpoint, OIDC discovery, and managed login (OAuth2) routes.

func (*Service) ResendConfirmationCodeTyped 

func (s *Service) ResendConfirmationCodeTyped(ctx context.Context, req *ClientUserSecretReq) (*struct{}, *protocol.AWSError)

func (*Service) RespondToAuthChallengeTyped 

func (s *Service) RespondToAuthChallengeTyped(ctx context.Context, req *RespondToAuthChallengeReq) (*RespondToAuthChallengeResp, *protocol.AWSError)

func (*Service) RevokeTokenTyped 

func (s *Service) RevokeTokenTyped(ctx context.Context, req *RevokeTokenReq) (*struct{}, *protocol.AWSError)

func (*Service) SetUserMFAPreferenceTyped 

func (s *Service) SetUserMFAPreferenceTyped(ctx context.Context, req *SetUserMFAPreferenceReq) (*struct{}, *protocol.AWSError)

func (*Service) SetUserPoolMfaConfigTyped 

func (s *Service) SetUserPoolMfaConfigTyped(ctx context.Context, req *UserPoolMfaConfigReq) (*UserPoolMfaConfigResp, *protocol.AWSError)

func (*Service) Shutdown 

func (s *Service) Shutdown()

Shutdown waits for any in-flight async email goroutines to finish.

func (*Service) SignUpTyped 

func (s *Service) SignUpTyped(ctx context.Context, req *SignUpReq) (*SignUpResp, *protocol.AWSError)

func (*Service) StartWebAuthnRegistrationTyped 

func (s *Service) StartWebAuthnRegistrationTyped(ctx context.Context, req *AccessTokenReq) (*StartWebAuthnRegistrationResp, *protocol.AWSError)

func (*Service) SupportedProtocols 

func (s *Service) SupportedProtocols() []codec.Codec

SupportedProtocols implements router.ProtocolService.

func (*Service) TargetPrefix 

func (s *Service) TargetPrefix() string

TargetPrefix satisfies router.TargetDispatcher.

func (*Service) UpdateDeviceStatusTyped 

func (s *Service) UpdateDeviceStatusTyped(ctx context.Context, req *UpdateDeviceStatusReq) (*struct{}, *protocol.AWSError)

func (*Service) UpdateGroupTyped 

func (s *Service) UpdateGroupTyped(ctx context.Context, req *UpdateGroupReq) (*struct{}, *protocol.AWSError)

func (*Service) UpdateUserAttributesTyped 

func (s *Service) UpdateUserAttributesTyped(ctx context.Context, req *UpdateUserAttributesReq) (*UpdateUserAttributesResp, *protocol.AWSError)

func (*Service) UpdateUserPoolClientTyped 

func (s *Service) UpdateUserPoolClientTyped(ctx context.Context, req *UpdateUserPoolClientReq) (*UpdateUserPoolClientResp, *protocol.AWSError)

func (*Service) UpdateUserPoolDomainTyped 

func (s *Service) UpdateUserPoolDomainTyped(ctx context.Context, req *DomainAndPoolReq) (*struct{}, *protocol.AWSError)

func (*Service) UpdateUserPoolTyped 

func (s *Service) UpdateUserPoolTyped(ctx context.Context, req *UpdateUserPoolReq) (*struct{}, *protocol.AWSError)

func (*Service) ValidateCognitoToken 

func (s *Service) ValidateCognitoToken(ctx context.Context, tokenStr string) (map[string]any, error)

ValidateCognitoToken satisfies events.CognitoTokenValidator. It parses the JWT, derives the user pool ID from the issuer claim, fetches the pool's RSA signing key, verifies the RS256 signature, and checks that the token has not expired. Returns the decoded claims on success.

tokenStr must be the raw JWT without a "Bearer " prefix.

func (*Service) VerifySoftwareTokenTyped 

func (s *Service) VerifySoftwareTokenTyped(ctx context.Context, req *VerifySoftwareTokenReq) (*VerifySoftwareTokenResp, *protocol.AWSError)

func (*Service) VerifyUserAttributeTyped 

func (s *Service) VerifyUserAttributeTyped(ctx context.Context, req *VerifyUserAttributeReq) (*struct{}, *protocol.AWSError)

type SetUserMFAPreferenceReq 

type SetUserMFAPreferenceReq struct {
	AccessToken              string       `json:"AccessToken" cbor:"AccessToken"`
	SoftwareTokenMfaSettings *MfaSettings `json:"SoftwareTokenMfaSettings" cbor:"SoftwareTokenMfaSettings"`
}

type SignInPolicy 

type SignInPolicy struct {
	AllowedFirstAuthFactors []string `json:"AllowedFirstAuthFactors,omitempty"`
}

type SignUpReq 

type SignUpReq struct {
	ClientID       string          `json:"ClientId" cbor:"ClientId"`
	Username       string          `json:"Username" cbor:"Username"`
	Password       string          `json:"Password" cbor:"Password"`
	SecretHash     string          `json:"SecretHash" cbor:"SecretHash"`
	UserAttributes []UserAttribute `json:"UserAttributes" cbor:"UserAttributes"`
}

type SignUpResp 

type SignUpResp struct {
	UserConfirmed bool   `json:"UserConfirmed" cbor:"UserConfirmed"`
	UserSub       string `json:"UserSub" cbor:"UserSub"`
}

type StartWebAuthnRegistrationResp 

type StartWebAuthnRegistrationResp struct {
	CredentialCreationOptions map[string]any `json:"CredentialCreationOptions" cbor:"CredentialCreationOptions"`
}

type Token 

type Token struct {
	Value      string    `json:"Value"` // JTI for JWTs, hex value for opaque tokens
	Type       string    `json:"Type"`  // "access", "id", "refresh", "session", "mfa"
	Username   string    `json:"Username"`
	UserPoolID string    `json:"UserPoolId"`
	DeviceKey  string    `json:"DeviceKey,omitempty"`
	CreatedAt  time.Time `json:"CreatedAt"`
	ExpiresAt  time.Time `json:"ExpiresAt"`
	OriginJTI  string    `json:"OriginJTI,omitempty"` // access token JTI from the original auth event
}

Token is a persisted token record used for revocation tracking. For access/id tokens this is keyed by JTI; for refresh/session tokens by the opaque hex value itself.

type TokenValidityUnitsType 

type TokenValidityUnitsType struct {
	AccessToken  string `json:"AccessToken"`
	IdToken      string `json:"IdToken"`
	RefreshToken string `json:"RefreshToken"`
}

TokenValidityUnitsType specifies the time unit for each token type.

type UpdateDeviceStatusReq 

type UpdateDeviceStatusReq struct {
	AccessToken            string `json:"AccessToken" cbor:"AccessToken"`
	DeviceKey              string `json:"DeviceKey" cbor:"DeviceKey"`
	DeviceRememberedStatus string `json:"DeviceRememberedStatus" cbor:"DeviceRememberedStatus"`
}

type UpdateGroupReq 

type UpdateGroupReq struct {
	UserPoolID  string `json:"UserPoolId" cbor:"UserPoolId"`
	GroupName   string `json:"GroupName" cbor:"GroupName"`
	Description string `json:"Description" cbor:"Description"`
	Precedence  int    `json:"Precedence" cbor:"Precedence"`
	RoleARN     string `json:"RoleArn" cbor:"RoleArn"`
}

type UpdateUserAttributesReq 

type UpdateUserAttributesReq struct {
	AccessToken    string          `json:"AccessToken" cbor:"AccessToken"`
	UserAttributes []UserAttribute `json:"UserAttributes" cbor:"UserAttributes"`
}

type UpdateUserAttributesResp 

type UpdateUserAttributesResp struct {
	CodeDeliveryDetailsList []codeDeliveryDetails `json:"CodeDeliveryDetailsList,omitempty" cbor:"CodeDeliveryDetailsList,omitempty"`
}

type UpdateUserPoolClientReq 

type UpdateUserPoolClientReq struct {
	UserPoolID                      string                  `json:"UserPoolId" cbor:"UserPoolId"`
	ClientID                        string                  `json:"ClientId" cbor:"ClientId"`
	AccessTokenValidity             int                     `json:"AccessTokenValidity" cbor:"AccessTokenValidity"`
	IdTokenValidity                 int                     `json:"IdTokenValidity" cbor:"IdTokenValidity"`
	RefreshTokenValidity            int                     `json:"RefreshTokenValidity" cbor:"RefreshTokenValidity"`
	TokenValidityUnits              *TokenValidityUnitsType `json:"TokenValidityUnits" cbor:"TokenValidityUnits"`
	CallbackURLs                    *[]string               `json:"CallbackURLs" cbor:"CallbackURLs"`
	LogoutURLs                      *[]string               `json:"LogoutURLs" cbor:"LogoutURLs"`
	AllowedOAuthFlows               *[]string               `json:"AllowedOAuthFlows" cbor:"AllowedOAuthFlows"`
	AllowedOAuthScopes              *[]string               `json:"AllowedOAuthScopes" cbor:"AllowedOAuthScopes"`
	AllowedOAuthFlowsUserPoolClient *bool                   `json:"AllowedOAuthFlowsUserPoolClient" cbor:"AllowedOAuthFlowsUserPoolClient"`
	ExplicitAuthFlows               *[]string               `json:"ExplicitAuthFlows" cbor:"ExplicitAuthFlows"`
	SupportedIdentityProviders      *[]string               `json:"SupportedIdentityProviders" cbor:"SupportedIdentityProviders"`
}

type UpdateUserPoolClientResp 

type UpdateUserPoolClientResp struct {
	UserPoolClient clientWire `json:"UserPoolClient" cbor:"UserPoolClient"`
}

type UpdateUserPoolReq 

type UpdateUserPoolReq struct {
	UserPoolID                  string                           `json:"UserPoolId" cbor:"UserPoolId"`
	UserPoolTier                string                           `json:"UserPoolTier" cbor:"UserPoolTier"`
	VerificationMessageTemplate *verificationMessageTemplateWire `json:"VerificationMessageTemplate" cbor:"VerificationMessageTemplate"`
	AdminCreateUserConfig       *adminCreateUserConfigWire       `json:"AdminCreateUserConfig" cbor:"AdminCreateUserConfig"`
	EmailConfiguration          *emailConfigurationWire          `json:"EmailConfiguration" cbor:"EmailConfiguration"`
	UserAttributeUpdateSettings *userAttributeUpdateSettingsWire `json:"UserAttributeUpdateSettings" cbor:"UserAttributeUpdateSettings"`
	DeviceConfiguration         *DeviceConfiguration             `json:"DeviceConfiguration" cbor:"DeviceConfiguration"`
	UsernameAttributes          []string                         `json:"UsernameAttributes" cbor:"UsernameAttributes"`
	AliasAttributes             []string                         `json:"AliasAttributes" cbor:"AliasAttributes"`
	Policies                    *userPoolPoliciesWire            `json:"Policies" cbor:"Policies"`
}

type User 

type User struct {
	Username                string                   `json:"Username"`
	Sub                     string                   `json:"Sub"`
	UserPoolID              string                   `json:"UserPoolId"`
	CreatedAt               time.Time                `json:"UserCreateDate"`
	ModifiedAt              time.Time                `json:"UserLastModifiedDate"`
	Status                  UserStatus               `json:"UserStatus"`
	Enabled                 bool                     `json:"Enabled"`
	PasswordHash            string                   `json:"PasswordHash,omitempty"`
	TempPassword            string                   `json:"TempPassword,omitempty"`
	Attributes              []UserAttribute          `json:"Attributes"`
	ConfirmationCode        string                   `json:"ConfirmationCode,omitempty"`
	PasswordResetCode       string                   `json:"PasswordResetCode,omitempty"`
	PendingAttributeUpdates []PendingAttributeUpdate `json:"PendingAttributeUpdates,omitempty"`
	AuthChallengeCodes      []AuthChallengeCode      `json:"AuthChallengeCodes,omitempty"`
	WebAuthnCredentials     []WebAuthnCredential     `json:"WebAuthnCredentials,omitempty"`
	Devices                 []UserDevice             `json:"Devices,omitempty"`

	// Groups is the list of group names this user belongs to.
	Groups []string `json:"Groups,omitempty"`

	// PlaintextPassword stores the password in cleartext alongside the bcrypt
	// hash. This is an emulator-only convenience — it lets the web UI display
	// and copy user passwords for testing managed login flows.
	PlaintextPassword string `json:"PlaintextPassword,omitempty"`

	// TOTP / MFA fields
	TOTPSecret   string `json:"TOTPSecret,omitempty"`
	TOTPVerified bool   `json:"TOTPVerified,omitempty"`
	MFAEnabled   bool   `json:"MFAEnabled,omitempty"`

	// GlobalSignOutAt is set when GlobalSignOut is called; any token with
	// iat before this time is considered revoked.
	GlobalSignOutAt *time.Time `json:"GlobalSignOutAt,omitempty"`
}

User is the stored representation of a Cognito user within a pool.

type UserAttribute 

type UserAttribute struct {
	Name  string `json:"Name"`
	Value string `json:"Value"`
}

UserAttribute is a name/value pair attached to a Cognito user.

type UserAttributeUpdateSettings 

type UserAttributeUpdateSettings struct {
	AttributesRequireVerificationBeforeUpdate []string `json:"AttributesRequireVerificationBeforeUpdate,omitempty"`
}

type UserDevice 

type UserDevice struct {
	DeviceKey                   string    `json:"DeviceKey"`
	DeviceGroupKey              string    `json:"DeviceGroupKey,omitempty"`
	DeviceName                  string    `json:"DeviceName,omitempty"`
	PasswordVerifier            string    `json:"PasswordVerifier,omitempty"`
	Salt                        string    `json:"Salt,omitempty"`
	DeviceRememberedStatus      string    `json:"DeviceRememberedStatus,omitempty"`
	DeviceCreateDate            time.Time `json:"DeviceCreateDate,omitempty"`
	DeviceLastModifiedDate      time.Time `json:"DeviceLastModifiedDate,omitempty"`
	DeviceLastAuthenticatedDate time.Time `json:"DeviceLastAuthenticatedDate,omitempty"`
}

type UserPool 

type UserPool struct {
	ID        string    `json:"Id"`
	Name      string    `json:"Name"`
	ARN       string    `json:"Arn"`
	CreatedAt time.Time `json:"CreatedAt"`

	// Domain is the prefix used for the managed login / hosted UI endpoints.
	// In real AWS this becomes {domain}.auth.{region}.amazoncognito.com;
	// in the emulator it maps to a path prefix on the same host.
	Domain string `json:"Domain,omitempty"`

	// UserPoolTier is the AWS feature plan. AWS defaults omitted values to ESSENTIALS.
	UserPoolTier string `json:"UserPoolTier,omitempty"`

	// VerificationMessageTemplate controls the email/SMS content sent to users
	// during sign-up confirmation and attribute verification.
	VerificationMessageTemplate *VerificationMessageTemplate `json:"VerificationMessageTemplate,omitempty"`

	// AdminCreateUserConfig controls admin-created user invitation
	// messages and related settings.
	AdminCreateUserConfig *AdminCreateUserConfig `json:"AdminCreateUserConfig,omitempty"`

	// EmailConfiguration controls the email sending method and SES settings.
	EmailConfiguration *EmailConfiguration `json:"EmailConfiguration,omitempty"`

	// ManagedLoginBranding controls the managed login page appearance.
	ManagedLoginBranding *ManagedLoginBranding `json:"ManagedLoginBranding,omitempty"`

	// UserAttributeUpdateSettings controls whether email/phone changes remain
	// pending until the user verifies the new value.
	UserAttributeUpdateSettings *UserAttributeUpdateSettings `json:"UserAttributeUpdateSettings,omitempty"`

	// MFA and WebAuthn configuration configured through SetUserPoolMfaConfig.
	MfaConfiguration      string                 `json:"MfaConfiguration,omitempty"`
	WebAuthnConfiguration *WebAuthnConfiguration `json:"WebAuthnConfiguration,omitempty"`
	DeviceConfiguration   *DeviceConfiguration   `json:"DeviceConfiguration,omitempty"`

	// UsernameAttributes lists the user pool attributes that can be used as
	// the username when signing in. Valid values: "email", "phone_number".
	// When empty, users sign in with their literal username string.
	UsernameAttributes []string `json:"UsernameAttributes,omitempty"`

	// AliasAttributes lists verified attributes that can be used as aliases for
	// a stable username. Valid values: "email", "phone_number", "preferred_username".
	AliasAttributes []string `json:"AliasAttributes,omitempty"`

	// Policies holds pool-level policy settings, including PasswordPolicy.
	Policies *UserPoolPolicies `json:"Policies,omitempty"`
}

UserPool is the stored representation of a Cognito User Pool.

type UserPoolClient 

type UserPoolClient struct {
	ClientID   string    `json:"ClientId"`
	ClientName string    `json:"ClientName"`
	UserPoolID string    `json:"UserPoolId"`
	CreatedAt  time.Time `json:"CreatedAt"`
	// ClientSecret is non-empty only when the client was created with GenerateSecret=true.
	// It is used to validate the SECRET_HASH parameter on auth calls.
	ClientSecret string `json:"ClientSecret,omitempty"`

	// Token validity configuration — matches AWS Cognito per-client settings.
	AccessTokenValidity  int                     `json:"AccessTokenValidity"`
	IdTokenValidity      int                     `json:"IdTokenValidity"`
	RefreshTokenValidity int                     `json:"RefreshTokenValidity"`
	TokenValidityUnits   *TokenValidityUnitsType `json:"TokenValidityUnits,omitempty"`

	// OAuth / managed login configuration — matches AWS Cognito app client settings.
	CallbackURLs                    []string `json:"CallbackURLs,omitempty"`
	LogoutURLs                      []string `json:"LogoutURLs,omitempty"`
	AllowedOAuthFlows               []string `json:"AllowedOAuthFlows,omitempty"`
	AllowedOAuthScopes              []string `json:"AllowedOAuthScopes,omitempty"`
	AllowedOAuthFlowsUserPoolClient bool     `json:"AllowedOAuthFlowsUserPoolClient"`
	ExplicitAuthFlows               []string `json:"ExplicitAuthFlows,omitempty"`
	SupportedIdentityProviders      []string `json:"SupportedIdentityProviders,omitempty"`
}

UserPoolClient is an app client registered to a user pool.

type UserPoolDomain 

type UserPoolDomain struct {
	Domain     string    `json:"Domain"`
	UserPoolID string    `json:"UserPoolId"`
	CreatedAt  time.Time `json:"CreatedAt"`
}

UserPoolDomain associates a domain prefix with a user pool for managed login.

type UserPoolIDReq 

type UserPoolIDReq struct {
	UserPoolID string `json:"UserPoolId" cbor:"UserPoolId"`
}

UserPoolIDReq is shared by DescribeUserPool and DeleteUserPool.

type UserPoolMfaConfigReq 

type UserPoolMfaConfigReq struct {
	UserPoolID            string                     `json:"UserPoolId" cbor:"UserPoolId"`
	MfaConfiguration      string                     `json:"MfaConfiguration" cbor:"MfaConfiguration"`
	WebAuthnConfiguration *webAuthnConfigurationWire `json:"WebAuthnConfiguration" cbor:"WebAuthnConfiguration"`
}

type UserPoolMfaConfigResp 

type UserPoolMfaConfigResp struct {
	MfaConfiguration      string                     `json:"MfaConfiguration,omitempty" cbor:"MfaConfiguration,omitempty"`
	WebAuthnConfiguration *webAuthnConfigurationWire `json:"WebAuthnConfiguration,omitempty" cbor:"WebAuthnConfiguration,omitempty"`
}

type UserPoolPolicies 

type UserPoolPolicies struct {
	PasswordPolicy *PasswordPolicy `json:"PasswordPolicy,omitempty"`
	SignInPolicy   *SignInPolicy   `json:"SignInPolicy,omitempty"`
}

UserPoolPolicies holds the password and other policy settings for a user pool.

type UserStatus 

type UserStatus string

UserStatus represents the account lifecycle state of a Cognito user. 

const (
	StatusUnconfirmed         UserStatus = "UNCONFIRMED"
	StatusConfirmed           UserStatus = "CONFIRMED"
	StatusForceChangePassword UserStatus = "FORCE_CHANGE_PASSWORD"
	StatusDisabled            UserStatus = "DISABLED"
)

type VerificationMessageTemplate 

type VerificationMessageTemplate struct {
	// DefaultEmailOption is "CONFIRM_WITH_CODE" (default) or "CONFIRM_WITH_LINK".
	DefaultEmailOption string `json:"DefaultEmailOption,omitempty"`

	// EmailMessage is the email body template for code-based verification.
	// Must contain {####}. Plain text.
	EmailMessage string `json:"EmailMessage,omitempty"`

	// EmailMessageByLink is the email body template for link-based verification.
	// Must contain {##Verify Email##}.
	EmailMessageByLink string `json:"EmailMessageByLink,omitempty"`

	// EmailSubject is the subject line for code-based verification emails.
	EmailSubject string `json:"EmailSubject,omitempty"`

	// EmailSubjectByLink is the subject line for link-based verification emails.
	EmailSubjectByLink string `json:"EmailSubjectByLink,omitempty"`

	// SmsMessage is the SMS body template. Must contain {####}.
	SmsMessage string `json:"SmsMessage,omitempty"`
}

VerificationMessageTemplate configures the verification messages sent during sign-up. Template variables: {username}, {####} (code), {##Verify Email##} (link).

type VerifySoftwareTokenReq 

type VerifySoftwareTokenReq struct {
	AccessToken  string `json:"AccessToken" cbor:"AccessToken"`
	UserCode     string `json:"UserCode" cbor:"UserCode"`
	FriendlyName string `json:"FriendlyDeviceName" cbor:"FriendlyDeviceName"`
}

type VerifySoftwareTokenResp 

type VerifySoftwareTokenResp struct {
	Status string `json:"Status" cbor:"Status"`
}

type VerifyUserAttributeReq 

type VerifyUserAttributeReq struct {
	AccessToken   string `json:"AccessToken" cbor:"AccessToken"`
	AttributeName string `json:"AttributeName" cbor:"AttributeName"`
	Code          string `json:"Code" cbor:"Code"`
}

type WebAuthnConfiguration 

type WebAuthnConfiguration struct {
	FactorConfiguration string `json:"FactorConfiguration,omitempty"`
	RelyingPartyID      string `json:"RelyingPartyId,omitempty"`
	UserVerification    string `json:"UserVerification,omitempty"`
}

type WebAuthnCredential 

type WebAuthnCredential struct {
	ID        string    `json:"Id"`
	CreatedAt time.Time `json:"CreatedAt"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.