feat(cognito): route verification email -> SES, SMS -> SNS; add CustomEmailSender/CustomSMSSender triggers

[vieiralucas]

Summary

Closes the Cognito-side gap from the integrations audit. Verification codes generated by Cognito now actually go somewhere instead of being silently swallowed:

• Email: SignUp / ResendConfirmationCode / ForgotPassword / GetUserAttributeVerificationCode (email attr) dispatch through SES, observable at GET /_fakecloud/ses/emails.
• SMS: GetUserAttributeVerificationCode (phone attr) dispatches through SNS, observable at the new GET /_fakecloud/sns/sms.
• CustomEmailSender / CustomSMSSender precedence: when configured on the pool, these Lambdas are invoked instead of going through SES/SNS — matching AWS behavior. Both triggers are also added to the TriggerSource enum (full set of 12 now wired).

Architecture: two new tiny traits in fakecloud-core (EmailDispatcher, SmsDispatcher) keep the Cognito crate from taking direct deps on SES/SNS. The server crate provides the impls that write into the SES sent_emails table and the SNS sms_messages list.

Test plan

• Unit tests for dispatch_verification_email / dispatch_verification_sms paths
• E2E cognito_signup_dispatches_verification_email_via_ses — round-trips the verification code from /_fakecloud/cognito/confirmation-codes to the SES sent-emails body
• E2E cognito_get_user_attribute_phone_dispatches_sms_via_sns — phone-attribute verification produces an SNS SMS entry with the 6-digit code
• E2E cognito_custom_email_sender_lambda_takes_precedence_over_ses — pool with LambdaConfig.CustomEmailSender set suppresses the SES path
• All 61 existing cognito E2E tests still green (one was updated to reflect the new SignUp-generates-code behavior)
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo fmt --check clean

---

Summary by cubic

Routes Cognito verification emails through SES and SMS through SNS, with CustomEmailSender/CustomSMSSender triggers taking precedence to match AWS. Invokes CustomMessage to allow subject/body overrides and adds an SMS introspection endpoint; completes coverage of all 12 Cognito trigger sources.

• New Features

  • Email verification for SignUp, ResendConfirmationCode, ForgotPassword, and GetUserAttributeVerificationCode (email) now dispatches via SES; visible at GET /_fakecloud/ses/emails.
  • Phone verification via GetUserAttributeVerificationCode (phone) now dispatches via SNS; new GET /_fakecloud/sns/sms endpoint.
  • CustomEmailSender/CustomSMSSender Lambdas take precedence; all 12 trigger sources supported. SignUp now generates a verification code.

• Bug Fixes

  • Use customSMSSenderRequestV1 for CustomSMSSender events (was incorrectly using the email request type).
  • Invoke CustomMessage for SignUp, ResendConfirmationCode, ForgotPassword, and VerifyUserAttribute so its response can override email subject/body before SES send.

^{Written for commit 692b20c. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 34.31818% with 289 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-cognito/src/service/mod.rs	20.91%	121 Missing ⚠️
crates/fakecloud-cognito/src/triggers.rs	8.84%	103 Missing ⚠️
crates/fakecloud-server/src/main.rs	0.00%	63 Missing ⚠️
crates/fakecloud-cognito/src/service/auth.rs	97.82%	1 Missing ⚠️
crates/fakecloud-cognito/src/service/users.rs	98.46%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

2 issues found across 12 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-cognito/src/triggers.rs">

<violation number="1" location="crates/fakecloud-cognito/src/triggers.rs:483">
P2: Custom SMS sender events are emitted with the email request type (`customEmailSenderRequestV1`) instead of `customSMSSenderRequestV1`.</violation>
</file>

<file name="crates/fakecloud-cognito/src/service/auth.rs">

<violation number="1" location="crates/fakecloud-cognito/src/service/auth.rs:1712">
P2: The new SignUp verification path does not invoke `CustomMessage_SignUp`, so pools that rely on that trigger won't run their sign-up message customization logic.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: The new SignUp verification path does not invoke CustomMessage_SignUp, so pools that rely on that trigger won't run their sign-up message customization logic.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-cognito/src/service/auth.rs, line 1712:

<comment>The new SignUp verification path does not invoke `CustomMessage_SignUp`, so pools that rely on that trigger won't run their sign-up message customization logic.</comment>

<file context>
@@ -1685,6 +1685,43 @@ impl CognitoService {
+                .find(|a| a.name == "email")
+                .map(|a| a.value.clone())
+            {
+                self.dispatch_verification_email(
+                    &pool_id,
+                    Some(client_id),
</file context>