feat(api): Cognito user actions, groups and test sign-in

Adds enable, disable, confirm, sign-out, password reset and set-password
for one user; user group membership; group list, create and delete; and a
test sign-in that returns decoded token claims. A refused test sign-in is
an outcome rather than a 401, which would end the console session.

Also adds a generic GET for one flat item and a schema deleteImpact so
delete confirmations can say what else goes with a resource.

packages/api/src/cloud-spi/types.ts

@@ -171,6 +171,13 @@ export type KubernetesActionName =
     | 'listFargateProfiles'
     | 'createFargateProfile'
     | 'deleteFargateProfile'
+export type UserPoolActionName =
+    | 'updateUser'
+    | 'setUserGroups'
+    | 'listGroups'
+    | 'createGroup'
+    | 'deleteGroup'
+    | 'testSignIn'
 export type CapabilityStatus = 'available' | 'blocked' | 'partial' | 'coming_soon'
 
 export interface CapabilitySchema<TAction extends string> {
@@ -214,6 +221,7 @@ export interface ServiceSchema {
         objectActions?: CapabilitySchema<ObjectActionName>[]
         databaseActions?: CapabilitySchema<DatabaseActionName>[]
         kubernetesActions?: CapabilitySchema<KubernetesActionName>[]
+        userPoolActions?: CapabilitySchema<UserPoolActionName>[]
         // Child levels advertise separately from the resource level because a
         // store can be readable at the leaf and writable at the collection —
         // CloudWatch Logs creates streams but cannot delete an event.
@@ -223,6 +231,11 @@ export interface ServiceSchema {
     filters: FieldSchema[]
     columns: TableColumnSchema[]
     updateFields?: FieldSchema[]
+    /**
+     * Counts read from the resource (`path` as in columns) that the delete
+     * confirmation names, so deleting a pool says it also deletes its users.
+     */
+    deleteImpact?: {path: string; singular: string; plural: string}[]
 }
 
 export type KnownResourceType =
@@ -411,6 +424,40 @@ export interface SqsMoveTaskResult {
     taskHandle: string
 }
 
+/** What an admin can do to one user pool user, each a single Admin* call. */
+export type UserPoolUserAction =
+    | {action: 'enable'}
+    | {action: 'disable'}
+    | {action: 'confirm'}
+    | {action: 'resetPassword'}
+    | {action: 'signOut'}
+    | {action: 'setPassword'; password: string; permanent?: boolean}
+
+export interface UserPoolGroup {
+    name: string
+    description: string | null
+    precedence: number | null
+    createdAt: string | null
+}
+
+export interface CreateUserPoolGroupInput {
+    name: string
+    description?: string
+    precedence?: number
+}
+
+export interface UserPoolSignInTestInput {
+    clientId: string
+    username: string
+    password: string
+}
+
+/** Decoded claims only: the console shows what a sign-in yields without handing out tokens. */
+export type UserPoolSignInTestResult =
+    | {outcome: 'signed-in'; expiresIn: number | null; idToken: Record<string, unknown>; accessToken: Record<string, unknown>}
+    | {outcome: 'challenge'; challengeName: string}
+    | {outcome: 'rejected'; code: string; message: string}
+
 /** Provider-neutral representation of a managed Kubernetes node pool. */
 export interface KubernetesNodegroup {
     id: string
@@ -917,6 +964,12 @@ export interface CloudServiceAdapter {
     listKubernetesFargateProfiles?(clusterId: string): Promise<KubernetesFargateProfile[]>
     createKubernetesFargateProfile?(clusterId: string, input: CreateKubernetesFargateProfileInput): Promise<KubernetesFargateProfile>
     deleteKubernetesFargateProfile?(clusterId: string, profileId: string): Promise<void>
+    updateUserPoolUser?(poolId: string, username: string, input: UserPoolUserAction): Promise<void>
+    setUserPoolUserGroups?(poolId: string, username: string, groups: string[]): Promise<void>
+    listUserPoolGroups?(poolId: string): Promise<UserPoolGroup[]>
+    createUserPoolGroup?(poolId: string, input: CreateUserPoolGroupInput): Promise<UserPoolGroup>
+    deleteUserPoolGroup?(poolId: string, groupName: string): Promise<void>
+    testUserPoolSignIn?(poolId: string, input: UserPoolSignInTestInput): Promise<UserPoolSignInTestResult>
     /** Clears the provider's locally captured email inbox, if it exposes one. */
     clearEmailInbox?(): Promise<void>
     // AppConfig nested resources, keyed by the ids the provider needs. Inspect

packages/api/src/cloud-spi/userPoolsSchema.ts

@@ -4,6 +4,8 @@ import type {CloudProvider, FieldSchema, ServiceSchema, TableColumnSchema} from
 export const USER_POOL_NAME_PATTERN = '^[\\w\\s+=,.@-]{1,128}$'
 export const USER_POOL_SIGN_IN = ['email', 'username'] as const
 export const USER_POOL_PASSWORD_POLICIES = ['default', 'relaxed'] as const
+/** Cognito's group name rule: 1–128 letters, marks, symbols, digits or punctuation (no whitespace). Needs the `u` flag. */
+export const USER_POOL_GROUP_NAME_PATTERN = '^[\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]{1,128}$'
 
 const userPoolColumns: TableColumnSchema[] = [
     {name: 'name', label: 'Name'},
@@ -72,9 +74,21 @@ export function awsUserPoolsSchema(): ServiceSchema {
                 {name: 'put', label: 'Create user', enabled: true, status: 'available', runtimeRequired: true},
                 {name: 'delete', label: 'Delete user', enabled: true, status: 'available', runtimeRequired: true},
             ],
+            userPoolActions: [
+                {name: 'updateUser', label: 'Enable, disable, confirm, sign out or reset a user', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'setUserGroups', label: 'Change a user\'s groups', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'listGroups', label: 'List groups', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'createGroup', label: 'Create group', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'deleteGroup', label: 'Delete group', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'testSignIn', label: 'Test sign-in', enabled: true, status: 'available', runtimeRequired: true},
+            ],
         },
         filters: userPoolFilters,
         columns: userPoolColumns,
+        deleteImpact: [
+            {path: 'metadata.estimatedNumberOfUsers', singular: 'user', plural: 'users'},
+            {path: 'metadata.appClients', singular: 'app client', plural: 'app clients'},
+        ],
     }
 }