feat(api): Cognito user actions, groups and test sign-in

Adds enable, disable, confirm, sign-out, password reset and set-password
for one user; user group membership; group list, create and delete; and a
test sign-in that returns decoded token claims. A refused test sign-in is
an outcome rather than a 401, which would end the console session.

Also adds a generic GET for one flat item and a schema deleteImpact so
delete confirmations can say what else goes with a resource.

packages/api/src/service/CloudProxyService.ts

@@ -77,6 +77,11 @@ import type {
     StorageObjectDownload,
     StorageObjectList,
     UpdateResourceInput,
+    CreateUserPoolGroupInput,
+    UserPoolGroup,
+    UserPoolSignInTestInput,
+    UserPoolSignInTestResult,
+    UserPoolUserAction,
 } from '../cloud-spi/types'
 import type {
     ChildCollection,
@@ -664,6 +669,12 @@ export class CloudProxyService {
         return this.requireItems(cloud, service).listItems(resourceId, page)
     }
 
+    async getFlatItem(cloud: CloudProvider, service: CloudServiceType, resourceId: string, itemId: string): Promise<ChildItem | null> {
+        const items = this.requireItems(cloud, service)
+        if (!items.getItem) throw new NotSupportedError(`Reading one item is not supported for ${cloud}/${service}`)
+        return items.getItem(resourceId, itemId)
+    }
+
     async putFlatItem(cloud: CloudProvider, service: CloudServiceType, resourceId: string, body: Record<string, unknown>): Promise<ChildItem> {
         const items = this.requireItems(cloud, service)
         if (!items.putItem) throw new NotSupportedError(`Writing items is not supported for ${cloud}/${service}`)
@@ -784,6 +795,42 @@ export class CloudProxyService {
         return adapter.filterLogEvents(logGroupName, input, page)
     }
 
+    async updateUserPoolUser(cloud: CloudProvider, poolId: string, username: string, input: UserPoolUserAction): Promise<void> {
+        const adapter = this.requireAdapter(cloud, 'userpools')
+        if (!adapter.updateUserPoolUser) throw new NotSupportedError(`User actions are not supported for ${cloud}/userpools`)
+        await adapter.updateUserPoolUser(poolId, username, input)
+    }
+
+    async setUserPoolUserGroups(cloud: CloudProvider, poolId: string, username: string, groups: string[]): Promise<void> {
+        const adapter = this.requireAdapter(cloud, 'userpools')
+        if (!adapter.setUserPoolUserGroups) throw new NotSupportedError(`User groups are not supported for ${cloud}/userpools`)
+        await adapter.setUserPoolUserGroups(poolId, username, groups)
+    }
+
+    async listUserPoolGroups(cloud: CloudProvider, poolId: string): Promise<UserPoolGroup[]> {
+        const adapter = this.requireAdapter(cloud, 'userpools')
+        if (!adapter.listUserPoolGroups) throw new NotSupportedError(`Groups are not supported for ${cloud}/userpools`)
+        return adapter.listUserPoolGroups(poolId)
+    }
+
+    async createUserPoolGroup(cloud: CloudProvider, poolId: string, input: CreateUserPoolGroupInput): Promise<UserPoolGroup> {
+        const adapter = this.requireAdapter(cloud, 'userpools')
+        if (!adapter.createUserPoolGroup) throw new NotSupportedError(`Group creation is not supported for ${cloud}/userpools`)
+        return adapter.createUserPoolGroup(poolId, input)
+    }
+
+    async deleteUserPoolGroup(cloud: CloudProvider, poolId: string, groupName: string): Promise<void> {
+        const adapter = this.requireAdapter(cloud, 'userpools')
+        if (!adapter.deleteUserPoolGroup) throw new NotSupportedError(`Group deletion is not supported for ${cloud}/userpools`)
+        await adapter.deleteUserPoolGroup(poolId, groupName)
+    }
+
+    async testUserPoolSignIn(cloud: CloudProvider, poolId: string, input: UserPoolSignInTestInput): Promise<UserPoolSignInTestResult> {
+        const adapter = this.requireAdapter(cloud, 'userpools')
+        if (!adapter.testUserPoolSignIn) throw new NotSupportedError(`Test sign-in is not supported for ${cloud}/userpools`)
+        return adapter.testUserPoolSignIn(poolId, input)
+    }
+
     async listKubernetesNodegroups(cloud: CloudProvider, clusterId: string): Promise<KubernetesNodegroup[]> {
         const adapter = this.requireAdapter(cloud, 'k8s')
         if (!adapter.listKubernetesNodegroups) throw new NotSupportedError(`Nodegroups are not supported for ${cloud}/k8s`)