feat(frontend): manage Cognito users and groups, and test sign-in

The Cognito panel gains a test sign-in that shows the decoded ID and
access token claims, a groups section, and a per-user panel to enable or
disable, confirm, sign out everywhere, reset or set a password and change
group membership.

Delete confirmations (row and bulk) now say what else goes, driven by
the schema's deleteImpact, and the inspector follows list refreshes
instead of the click-time snapshot.

packages/frontend/src/api/api.ts

@@ -130,6 +130,16 @@ export const apiEndpointKeys = {
       messages: {send: "clouds.services.messaging.messages.send", receive: "clouds.services.messaging.messages.receive", delete: "clouds.services.messaging.messages.delete", purge: "clouds.services.messaging.messages.purge"},
       moveTasks: "clouds.services.messaging.move-tasks",
     },
+    userpools: {
+      userAction: "clouds.services.userpools.users.action",
+      userGroups: "clouds.services.userpools.users.groups",
+      groups: {
+        list: "clouds.services.userpools.groups.list",
+        create: "clouds.services.userpools.groups.create",
+        delete: "clouds.services.userpools.groups.delete",
+      },
+      signInTest: "clouds.services.userpools.sign-in-test",
+    },
     k8s: {
       nodegroups: {
         list: "clouds.services.k8s.nodegroups.list",
@@ -154,6 +164,7 @@ export const apiEndpointKeys = {
       },
     },
     flatItems: {
+      get: "clouds.services.flatItems.get",
       list: "clouds.services.flatItems.list",
       query: "clouds.services.flatItems.query",
       create: "clouds.services.flatItems.create",
@@ -829,6 +840,48 @@ export const endpointRegistry: EndpointRegistry = new Map([
       method: "GET",
     },
   ],
+  [
+    apiEndpointKeys.clouds.userpools.userAction,
+    {
+      path: "/clouds/:cloud/services/userpools/resources/:id/users/:username/actions",
+      method: "POST",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.userpools.userGroups,
+    {
+      path: "/clouds/:cloud/services/userpools/resources/:id/users/:username/groups",
+      method: "PUT",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.userpools.groups.list,
+    {
+      path: "/clouds/:cloud/services/userpools/resources/:id/groups",
+      method: "GET",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.userpools.groups.create,
+    {
+      path: "/clouds/:cloud/services/userpools/resources/:id/groups",
+      method: "POST",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.userpools.groups.delete,
+    {
+      path: "/clouds/:cloud/services/userpools/resources/:id/groups/:groupName",
+      method: "DELETE",
+    },
+  ],
+  [
+    apiEndpointKeys.clouds.userpools.signInTest,
+    {
+      path: "/clouds/:cloud/services/userpools/resources/:id/sign-in-test",
+      method: "POST",
+    },
+  ],
   [
     apiEndpointKeys.clouds.k8s.nodegroups.list,
     {
@@ -998,6 +1051,13 @@ export const endpointRegistry: EndpointRegistry = new Map([
       method: "GET",
     },
   ],
+  [
+    apiEndpointKeys.clouds.flatItems.get,
+    {
+      path: "/clouds/:cloud/services/:service/resources/:id/items/:itemId",
+      method: "GET",
+    },
+  ],
   [
     apiEndpointKeys.clouds.flatItems.list,
     {

packages/frontend/src/api/cloudProxyClient.ts

@@ -27,6 +27,11 @@ import type {
   DatabaseSnapshot,
   KubernetesFargateProfile,
   KubernetesNodegroup,
+  CreateUserPoolGroupInput,
+  UserPoolGroup,
+  UserPoolSignInTestInput,
+  UserPoolSignInTestResult,
+  UserPoolUserAction,
   LogsInsightsQueryInput,
   LogsInsightsQueryResult,
   LogsFilterInput,
@@ -1377,6 +1382,98 @@ export async function deleteFlatItem(
   );
 }
 
+export async function getFlatItem(
+  cloud: CloudProvider,
+  service: CloudServiceType,
+  resourceId: string,
+  itemId: string,
+  signal?: AbortSignal,
+): Promise<ChildItem> {
+  const res = await apiClient.call<ChildItem>(
+    apiEndpointKeys.clouds.flatItems.get,
+    requestOptions(cloud, service, { signal }),
+    { cloud, service, id: resourceId, itemId },
+  );
+  return res.data;
+}
+
+export async function updateUserPoolUser(
+  cloud: CloudProvider,
+  poolId: string,
+  username: string,
+  input: UserPoolUserAction,
+): Promise<void> {
+  await apiClient.call<void, UserPoolUserAction>(
+    apiEndpointKeys.clouds.userpools.userAction,
+    requestOptions(cloud, "userpools", { body: input }),
+    { cloud, id: poolId, username },
+  );
+}
+
+export async function setUserPoolUserGroups(
+  cloud: CloudProvider,
+  poolId: string,
+  username: string,
+  groups: string[],
+): Promise<void> {
+  await apiClient.call<void, { groups: string[] }>(
+    apiEndpointKeys.clouds.userpools.userGroups,
+    requestOptions(cloud, "userpools", { body: { groups } }),
+    { cloud, id: poolId, username },
+  );
+}
+
+export async function listUserPoolGroups(
+  cloud: CloudProvider,
+  poolId: string,
+  signal?: AbortSignal,
+): Promise<UserPoolGroup[]> {
+  const res = await apiClient.call<UserPoolGroup[]>(
+    apiEndpointKeys.clouds.userpools.groups.list,
+    requestOptions(cloud, "userpools", { signal }),
+    { cloud, id: poolId },
+  );
+  return res.data;
+}
+
+export async function createUserPoolGroup(
+  cloud: CloudProvider,
+  poolId: string,
+  input: CreateUserPoolGroupInput,
+): Promise<UserPoolGroup> {
+  const res = await apiClient.call<UserPoolGroup, CreateUserPoolGroupInput>(
+    apiEndpointKeys.clouds.userpools.groups.create,
+    requestOptions(cloud, "userpools", { body: input }),
+    { cloud, id: poolId },
+  );
+  return res.data;
+}
+
+export async function deleteUserPoolGroup(
+  cloud: CloudProvider,
+  poolId: string,
+  groupName: string,
+): Promise<void> {
+  await apiClient.call<void>(
+    apiEndpointKeys.clouds.userpools.groups.delete,
+    requestOptions(cloud, "userpools"),
+    { cloud, id: poolId, groupName },
+  );
+}
+
+export async function testUserPoolSignIn(
+  cloud: CloudProvider,
+  poolId: string,
+  input: UserPoolSignInTestInput,
+): Promise<UserPoolSignInTestResult> {
+  const res = await apiClient.call<UserPoolSignInTestResult, UserPoolSignInTestInput>(
+    apiEndpointKeys.clouds.userpools.signInTest,
+    requestOptions(cloud, "userpools", { body: input }),
+    { cloud, id: poolId },
+  );
+  return res.data;
+}
+
 export async function putFlatItem(
   cloud: CloudProvider,
   service: CloudServiceType,