feat(api): Cognito user actions, groups and test sign-in

Adds enable, disable, confirm, sign-out, password reset and set-password
for one user; user group membership; group list, create and delete; and a
test sign-in that returns decoded token claims. A refused test sign-in is
an outcome rather than a 401, which would end the console session.

Also adds a generic GET for one flat item and a schema deleteImpact so
delete confirmations can say what else goes with a resource.

packages/api/src/cloud-spi/userPoolsSchema.ts

@@ -4,6 +4,8 @@ import type {CloudProvider, FieldSchema, ServiceSchema, TableColumnSchema} from
 export const USER_POOL_NAME_PATTERN = '^[\\w\\s+=,.@-]{1,128}$'
 export const USER_POOL_SIGN_IN = ['email', 'username'] as const
 export const USER_POOL_PASSWORD_POLICIES = ['default', 'relaxed'] as const
+/** Cognito's group name rule: 1–128 letters, marks, symbols, digits or punctuation (no whitespace). Needs the `u` flag. */
+export const USER_POOL_GROUP_NAME_PATTERN = '^[\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]{1,128}$'
 
 const userPoolColumns: TableColumnSchema[] = [
     {name: 'name', label: 'Name'},
@@ -72,9 +74,21 @@ export function awsUserPoolsSchema(): ServiceSchema {
                 {name: 'put', label: 'Create user', enabled: true, status: 'available', runtimeRequired: true},
                 {name: 'delete', label: 'Delete user', enabled: true, status: 'available', runtimeRequired: true},
             ],
+            userPoolActions: [
+                {name: 'updateUser', label: 'Enable, disable, confirm, sign out or reset a user', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'setUserGroups', label: 'Change a user\'s groups', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'listGroups', label: 'List groups', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'createGroup', label: 'Create group', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'deleteGroup', label: 'Delete group', enabled: true, status: 'available', runtimeRequired: true},
+                {name: 'testSignIn', label: 'Test sign-in', enabled: true, status: 'available', runtimeRequired: true},
+            ],
         },
         filters: userPoolFilters,
         columns: userPoolColumns,
+        deleteImpact: [
+            {path: 'metadata.estimatedNumberOfUsers', singular: 'user', plural: 'users'},
+            {path: 'metadata.appClients', singular: 'app client', plural: 'app clients'},
+        ],
     }
 }