refactor(cognito): split 9,058-line service.rs into sub-modules

[vieiralucas]

Summary

• Splits the monolithic 9,058-line service.rs into 8 focused sub-modules following the established SSM pattern
• mod.rs (3,487 lines): struct, dispatch match, helper functions, tests
• auth.rs (2,060 lines): all authentication flows
• users.rs (1,056 lines): admin + self-service user operations
• user_pools.rs (732 lines): pool + client CRUD
• misc.rs (621 lines): domains, devices, tags, import jobs
• groups.rs (507 lines): group operations
• identity_providers.rs (482 lines): IdP + resource servers
• mfa.rs (394 lines): MFA config + TOTP

Test plan

• cargo clippy --workspace --all-targets -- -D warnings passes clean
• All 72 Cognito unit tests pass
• CI passes
• Cubic review passes

---

Summary by cubic

Split the 9,058-line fakecloud-cognito service.rs into 8 focused sub-modules that follow the SSM layout for easier navigation and testing. No behavior changes.

• Refactors

  • Core: mod.rs — service struct, request dispatch, helpers, tests.
  • Auth & users: auth.rs (auth flows), users.rs (admin/self-service).
  • Pools & org: user_pools.rs (pools/clients), groups.rs (groups), identity_providers.rs (IdPs/resource servers).
  • Security & misc: mfa.rs (MFA/TOTP), misc.rs (domains, devices, tags, import jobs).

• Migration

  • No API changes; no action required.

^{Written for commit 742e816. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-cognito/src/service/mfa.rs">

<violation number="1" location="crates/fakecloud-cognito/src/service/mfa.rs:310">
P1: `associate_software_token` returns a `Session` token that is never stored in `state.sessions`, so session-based `verify_software_token` calls fail with `Invalid session`.</violation>
</file>

<file name="crates/fakecloud-cognito/src/service/user_pools.rs">

<violation number="1" location="crates/fakecloud-cognito/src/service/user_pools.rs:307">
P2: `NextToken` fallback to index 0 silently restarts pagination when the token is invalid.</violation>

<violation number="2" location="crates/fakecloud-cognito/src/service/user_pools.rs:704">
P2: `list_user_pool_clients` also resets to page 1 on unknown `NextToken` instead of rejecting it.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: associate_software_token returns a Session token that is never stored in state.sessions, so session-based verify_software_token calls fail with Invalid session.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-cognito/src/service/mfa.rs, line 310:

<comment>`associate_software_token` returns a `Session` token that is never stored in `state.sessions`, so session-based `verify_software_token` calls fail with `Invalid session`.</comment>

<file context>
@@ -0,0 +1,394 @@
+        user.totp_verified = false;
+        user.user_last_modified_date = Utc::now();
+
+        let new_session = Uuid::new_v4().to_string();
+
+        Ok(AwsResponse::ok_json(json!({
</file context>

[cubic-dev-ai]

P2: list_user_pool_clients also resets to page 1 on unknown NextToken instead of rejecting it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-cognito/src/service/user_pools.rs, line 704:

<comment>`list_user_pool_clients` also resets to page 1 on unknown `NextToken` instead of rejecting it.</comment>

<file context>
@@ -0,0 +1,732 @@
+            clients
+                .iter()
+                .position(|c| c.client_id == token)
+                .unwrap_or(0)
+        } else {
+            0
</file context>

Suggested change

	.unwrap_or(0)
	.ok_or_else(|| {
	AwsServiceError::aws_error(
	StatusCode::BAD_REQUEST,
	"InvalidParameterException",
	"Invalid NextToken",
	)
	})?

[cubic-dev-ai]

P2: NextToken fallback to index 0 silently restarts pagination when the token is invalid.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-cognito/src/service/user_pools.rs, line 307:

<comment>`NextToken` fallback to index 0 silently restarts pagination when the token is invalid.</comment>

<file context>
@@ -0,0 +1,732 @@
+
+        // Find start index from NextToken
+        let start_idx = if let Some(token) = next_token {
+            pools.iter().position(|p| p.id == token).unwrap_or(0)
+        } else {
+            0
</file context>