The audience dashboard's app client, for its Forgot password and sign-up resend.
On the audience's own pool.
Signs them out everywhere, then disables the login. Disabling revokes
access tokens only, so the sign-out runs first, while the login still
takes it, to revoke the refresh tokens too. LOGIN_DISABLE_INCOMPLETE
when the sign-out landed and the disable failed.
Lets a disabled login sign in again.
Null for no such dashboard user. A Cognito fault throws.
Emails an UNCONFIRMED login a new sign-up code, as the sign-in page's resend does. The user confirms it themselves, which proves the address is theirs; an operator never confirms a sign-up for them.
Deletes their authenticator app, then signs them out everywhere. The
required-MFA pool asks a login left with no factor to set one up at its
next sign-in. UNANSWERABLE_FACTOR_HELD for a login that also holds a
text message or email factor: the dashboard sign-in answers only
authenticator codes, so that factor would lock them out.
AUTHENTICATOR_RESET_INCOMPLETE when the delete landed and the sign-out
failed.
The user's rejected authenticator codes, newest first, for their History without a login read; none for no such user.
Emails the sign-in page's password code, as Forgot password does; a backfilled login gets a password the code then replaces. Refused for a login an IdP signs in, which would be sent nothing.
Revokes every refresh token the login holds, in every browser.
A dashboard user's sign-in security, read from Cognito and their activity, and the support actions on it, for CFX operators. Records no admin activity: admin-dashboard records it.