fix(cognito): validate AdminCreateUser TemporaryPassword against pool policy

[vieiralucas]

Summary

SignUp and AdminSetUserPassword run validate_password against the pool's password policy, but AdminCreateUser stored the supplied TemporaryPassword unchecked. A pool requiring e.g. MinimumLength=8 + uppercase accepted AdminCreateUser(TemporaryPassword="weak"), bypassing the policy for admin-provisioned users — AWS returns InvalidPasswordException.

Fix: validate a supplied TemporaryPassword against the pool's password policy before creating the user. Omitting it stays valid (Cognito generates one).

Found by the 2026-06-20 bug-hunt audit (finding 1.12).

Test plan

• admin_create_user_validates_temporary_password_against_policy — a pool with MinimumLength=8/RequireUppercase rejects a weak TemporaryPassword with InvalidPasswordException and accepts a conforming one.
• cargo clippy -p fakecloud-cognito --all-targets -- -D warnings clean.

---

Summary by cubic

Validate AdminCreateUser TemporaryPassword against the user pool password policy to prevent bypassing requirements and match AWS behavior (returns InvalidPasswordException on weak passwords).

• Bug Fixes
  • Enforce password policy when a TemporaryPassword is provided; omission still allowed (Cognito generates one).
  • Added test to reject weak passwords and accept compliant ones in fakecloud-cognito.

^{Written for commit bd3a285. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-cognito/src/service/users.rs	88.88%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!