fix(bb-auth-cognito): admin createUser attr-prefix + getUser groups (AWS parity)

Live sandbox e2e for the new admin runtime paths surfaced two mock-vs-AWS
parity bugs the unit tests couldn't:

- AWS admin.createUser passed custom attributes unprefixed, so Cognito rejected
  them ('attribute department is not defined in schema'). Now runs them through
  prefixCustomAttrs like signUp and the mock do.
- AWS admin.getUser never populated AdminUser.groups (AdminGetUser doesn't return
  memberships), so the typed groups field was always empty on AWS. Now fetches
  them via AdminListGroupsForUser, matching the mock.

Adds sandbox e2e coverage for the new surface: getUser attribute+group round-trip
(Gap 1) and scan() with a Cognito ListUsers Filter (Gap 4), plus the backend
routes they drive. Verified live (us-west-2): all 7 admin e2e tests pass.

Author: harsh62

packages/bb-auth-cognito/src/index.aws.ts

@@ -774,7 +774,10 @@ export class AuthCognito<const O extends AuthCognitoOptions = AuthCognitoOptions
 			createUser: async (username, init) => {
 				this.assertAdminAction('lifecycle');
 				try {
-					const attrs: AttributeType[] = Object.entries(init?.attributes ?? {}).map(
+					// Prefix declared custom attributes with `custom:` (matching signUp
+					// and the mock) — Cognito rejects an unprefixed custom attr name as
+					// "not defined in schema".
+					const attrs: AttributeType[] = Object.entries(this.prefixCustomAttrs(init?.attributes ?? {})).map(
 						([Name, Value]) => ({ Name, Value }),
 					);
 					const resp = await this.client.send(new AdminCreateUserCommand({
@@ -837,11 +840,24 @@ export class AuthCognito<const O extends AuthCognitoOptions = AuthCognitoOptions
 					for (const a of (resp.UserAttributes ?? []) as AttributeType[]) {
 						if (a.Name) attributes[a.Name] = a.Value ?? '';
 					}
+					// AdminGetUser does not return group memberships, so fetch them
+					// separately to populate AdminUser.groups (matches the mock,
+					// which reads groups from its in-memory state).
+					const groups: string[] = [];
+					let nextToken: string | undefined;
+					do {
+						const g = await this.client.send(new AdminListGroupsForUserCommand({
+							UserPoolId: this.adminUserPoolId(), Username: username, NextToken: nextToken,
+						}));
+						for (const grp of g.Groups ?? []) if (grp.GroupName) groups.push(grp.GroupName);
+						nextToken = g.NextToken;
+					} while (nextToken);
 					return {
 						username: resp.Username ?? username,
 						userSub: attributes['sub'] ?? '',
 						enabled: resp.Enabled ?? true,
 						attributes,
+						groups: groups as GroupOf<AuthCognitoOptions>[],
 					};
 				} catch (e) {
 					if (e instanceof Error && e.name === AuthCognitoErrors.UserNotFound) return null;

test-apps/comprehensive/aws-blocks/index.ts

@@ -969,6 +969,31 @@ export const api = new ApiNamespace(scope, 'api', (context) => ({
     const u = await authC.admin.createUser(username, { temporaryPassword });
     return { username: u.username, enabled: u.enabled };
   },
+  async authCAdminCreateUserWithDept(username: string, temporaryPassword: string, department: string) {
+    // Seeds a declared custom attribute so authCAdminGetUser can round-trip it.
+    const u = await authC.admin.createUser(username, {
+      temporaryPassword,
+      attributes: { department, email: `${username}@example.com` },
+    });
+    return { username: u.username, enabled: u.enabled };
+  },
+  async authCAdminGetUser(username: string) {
+    const u = await authC.admin.getUser(username);
+    if (!u) return null;
+    // Return the typed reads so the e2e can assert the attribute/group round-trip.
+    return {
+      username: u.username,
+      userSub: u.userSub,
+      enabled: u.enabled,
+      department: u.attributes['custom:department'] ?? null,
+      groups: u.groups ?? [],
+    };
+  },
+  async authCAdminScan(filter?: { attribute: string; match: 'startsWith' | 'equals'; value: string }) {
+    const usernames: string[] = [];
+    for await (const u of authC.admin.scan(filter)) usernames.push(u.username);
+    return usernames;
+  },
   async authCAdminSetPassword(username: string, password: string) {
     await authC.admin.setUserPassword(username, password, { permanent: true });
     return { success: true };

test-apps/comprehensive/test/auth-cognito-admin-sandbox.test.ts

@@ -110,5 +110,44 @@ export function authCognitoAdminTests(getApi: () => typeof apiType) {
 
 			await assert.rejects(() => api.authCSignIn(u, PW));
 		});
+
+		// ── Gap 1: typed reads round-trip real Cognito data ──────────────────
+		test('admin.getUser round-trips custom attribute + group membership', async () => {
+			const api = getApi();
+			const u = uniqueUser();
+			await api.authCAdminCreateUserWithDept(u, PW, 'engineering');
+			await api.authCAdminAddToGroup(u, 'admins');
+
+			const got = await api.authCAdminGetUser(u);
+			assert.ok(got, 'expected a user');
+			assert.strictEqual(got.username, u);
+			assert.strictEqual(got.department, 'engineering');
+			assert.ok(got.groups.includes('admins'), `expected admins in ${JSON.stringify(got.groups)}`);
+			assert.strictEqual(await api.authCAdminGetUser(`${u}-missing`), null);
+
+			await api.authCAdminDeleteUser(u);
+		});
+
+		// ── Gap 4: scan filter is executed by Cognito (ListUsers Filter) ─────
+		test('admin.scan with a startsWith filter narrows to matching users', async () => {
+			const api = getApi();
+			const prefix = `scanflt-${uniqueUser()}`;
+			const a = `${prefix}-alpha`;
+			const b = `${prefix}-beta`;
+			await api.authCAdminCreateUser(a, PW);
+			await api.authCAdminCreateUser(b, PW);
+
+			// Cognito validates this Filter expression server-side — the whole point
+			// of exercising it live rather than in the in-memory mock.
+			const matched = await api.authCAdminScan({ attribute: 'username', match: 'startsWith', value: prefix });
+			assert.ok(matched.includes(a) && matched.includes(b), `expected both seeded users, got ${JSON.stringify(matched)}`);
+
+			// A prefix that matches neither returns an empty (or non-matching) set.
+			const none = await api.authCAdminScan({ attribute: 'username', match: 'startsWith', value: `${prefix}-zzz` });
+			assert.ok(!none.includes(a) && !none.includes(b), 'non-matching filter should exclude seeded users');
+
+			await api.authCAdminDeleteUser(a);
+			await api.authCAdminDeleteUser(b);
+		});
 	});
 }