feat(cognito): implement remaining 20 operations for 100% conformance

[vieiralucas]

Summary

Implements all remaining Cognito User Pools operations to achieve 100% conformance:

• UI Customization: Get/SetUICustomization, Get/SetLogDeliveryConfiguration, Describe/SetRiskConfiguration (6 ops)
• Managed Login Branding: Create/Delete/Describe/DescribeByClient/Update (5 ops)
• Terms of Service: Create/Delete/Describe/List/Update (5 ops)
• WebAuthn: Start/CompleteRegistration, Delete/ListCredentials (4 ops)

Cognito conformance: 122/122 operations (100%), 4479/4479 variants (100%)

Test plan

• All 94 handwritten conformance tests pass
• Conformance probes: 4479/4479 variants pass (100%)
• Zero clippy warnings

---

Summary by cubic

Implements the remaining Cognito User Pools operations in fakecloud-cognito, completing feature coverage. Conformance is now 122/122 operations and 4479/4479 variants (100%).

• New Features
  • UI Customization: GetUICustomization, SetUICustomization
  • Log Delivery: GetLogDeliveryConfiguration, SetLogDeliveryConfiguration
  • Risk Configuration: DescribeRiskConfiguration, SetRiskConfiguration
  • Managed Login Branding: Create/Delete/Describe/DescribeByClient/Update
  • Terms of Service: Create/Delete/Describe/List/Update
  • WebAuthn: Start/CompleteRegistration, Delete/ListCredentials

^{Written for commit 986ba68. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-cognito/src/service/config.rs">

<violation number="1" location="crates/fakecloud-cognito/src/service/config.rs:100">
P2: Normalize pool-level `ClientId` (`"ALL"`) before storing UI customizations; otherwise writes and reads use different keys and default `GetUICustomization` can miss updates.</violation>
</file>

<file name="crates/fakecloud-cognito/src/service/branding.rs">

<violation number="1" location="crates/fakecloud-cognito/src/service/branding.rs:33">
P2: Validate that the provided ClientId belongs to UserPoolId before creating branding; currently cross-pool client IDs are accepted.</violation>

<violation number="2" location="crates/fakecloud-cognito/src/service/branding.rs:570">
P2: Do not generate a random CredentialId when `Credential.id` is missing; reject the request as invalid.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Normalize pool-level ClientId ("ALL") before storing UI customizations; otherwise writes and reads use different keys and default GetUICustomization can miss updates.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-cognito/src/service/config.rs, line 100:

<comment>Normalize pool-level `ClientId` (`"ALL"`) before storing UI customizations; otherwise writes and reads use different keys and default `GetUICustomization` can miss updates.</comment>

<file context>
@@ -0,0 +1,269 @@
+            customization["ImageFile"] = json!(img);
+        }
+
+        state.ui_customizations.insert(key, customization.clone());
+
+        Ok(AwsResponse::ok_json(json!({
</file context>

[cubic-dev-ai]

P2: Do not generate a random CredentialId when Credential.id is missing; reject the request as invalid.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-cognito/src/service/branding.rs, line 570:

<comment>Do not generate a random CredentialId when `Credential.id` is missing; reject the request as invalid.</comment>

<file context>
@@ -0,0 +1,726 @@
+            ));
+        }
+
+        let credential_id = credential["id"]
+            .as_str()
+            .unwrap_or(&Uuid::new_v4().to_string())
</file context>

Suggested change

	let credential_id = credential["id"]
	.as_str()
	.unwrap_or(&Uuid::new_v4().to_string())
	.to_string();
	let credential_id = credential["id"].as_str().ok_or_else(|| {
	AwsServiceError::aws_error(
	StatusCode::BAD_REQUEST,
	"InvalidParameterException",
	"Credential.id is required",
	)
	})?
	.to_string();

[cubic-dev-ai]

P2: Validate that the provided ClientId belongs to UserPoolId before creating branding; currently cross-pool client IDs are accepted.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-cognito/src/service/branding.rs, line 33:

<comment>Validate that the provided ClientId belongs to UserPoolId before creating branding; currently cross-pool client IDs are accepted.</comment>

<file context>
@@ -0,0 +1,726 @@
+            ));
+        }
+
+        if !state.user_pool_clients.contains_key(client_id) {
+            return Err(AwsServiceError::aws_error(
+                StatusCode::BAD_REQUEST,
</file context>