fix: logs get log events pagination (#37)

* fix(cognito): auto-generate sub, fix JWT sub claim, add AdminUserGlobalSignOut (#68)
* fix: return stable cursor tokens in GetLogEvents to fix SDK pagination loop

Author: hectorvent

sdk-test-java/src/main/java/com/floci/test/tests/CloudWatchLogsTests.java

@@ -34,6 +34,7 @@ public void run(TestContext ctx) {
             testCreateLogStream(ctx, cw);
             testPutAndGetLogEvents(ctx, cw);
             testGetLogEventsTimeFilter(ctx, cw);
+            testGetLogEventsPagination(ctx, cw);
             testFilterLogEvents(ctx, cw);
             testDeleteLogStream(ctx, cw);
             testDeleteLogGroup(ctx, cw);
@@ -140,6 +141,55 @@ private void testGetLogEventsTimeFilter(TestContext ctx, CloudWatchLogsClient cw
         }
     }
 
+    private void testGetLogEventsPagination(TestContext ctx, CloudWatchLogsClient cw) {
+        String stream = "stream-pagination";
+        try {
+            cw.createLogStream(b -> b.logGroupName(GROUP_NAME).logStreamName(stream));
+
+            long base = System.currentTimeMillis() - 10000;
+            List<InputLogEvent> events = new java.util.ArrayList<>();
+            for (int i = 0; i < 7; i++) {
+                final int idx = i;
+                events.add(InputLogEvent.builder().timestamp(base + idx).message("page-msg-" + idx).build());
+            }
+            cw.putLogEvents(b -> b.logGroupName(GROUP_NAME).logStreamName(stream).logEvents(events));
+
+            // Page 1: limit=3, startFromHead
+            GetLogEventsResponse page1 = cw.getLogEvents(b -> b
+                    .logGroupName(GROUP_NAME).logStreamName(stream)
+                    .limit(3).startFromHead(true));
+            ctx.check("CWL GetLogEvents pagination page1 count=3", page1.events().size() == 3);
+            ctx.check("CWL GetLogEvents pagination page1 first message",
+                    "page-msg-0".equals(page1.events().get(0).message()));
+
+            // Page 2: use nextForwardToken
+            GetLogEventsResponse page2 = cw.getLogEvents(b -> b
+                    .logGroupName(GROUP_NAME).logStreamName(stream)
+                    .limit(3).nextToken(page1.nextForwardToken()));
+            ctx.check("CWL GetLogEvents pagination page2 count=3", page2.events().size() == 3);
+            ctx.check("CWL GetLogEvents pagination page2 first message",
+                    "page-msg-3".equals(page2.events().get(0).message()));
+
+            // Page 3 (last): remaining 1 event
+            GetLogEventsResponse page3 = cw.getLogEvents(b -> b
+                    .logGroupName(GROUP_NAME).logStreamName(stream)
+                    .limit(3).nextToken(page2.nextForwardToken()));
+            ctx.check("CWL GetLogEvents pagination page3 count=1", page3.events().size() == 1);
+            ctx.check("CWL GetLogEvents pagination page3 message",
+                    "page-msg-6".equals(page3.events().get(0).message()));
+
+            // End-of-stream: token must echo back (SDK uses this to stop)
+            GetLogEventsResponse atEnd = cw.getLogEvents(b -> b
+                    .logGroupName(GROUP_NAME).logStreamName(stream)
+                    .limit(3).nextToken(page3.nextForwardToken()));
+            ctx.check("CWL GetLogEvents end-of-stream token echoed",
+                    page3.nextForwardToken().equals(atEnd.nextForwardToken()));
+
+        } catch (Exception e) {
+            ctx.check("CWL GetLogEvents pagination", false, e);
+        }
+    }
+
     private void testFilterLogEvents(TestContext ctx, CloudWatchLogsClient cw) {
         try {
             String stream3 = "stream-filter-test";

sdk-test-java/src/main/java/com/floci/test/tests/CognitoTests.java

@@ -60,6 +60,9 @@ public void run(TestContext ctx) {
                         .username(fUsername)
                         .userAttributes(AttributeType.builder().name("email").value("test@example.com").build()));
                 ctx.check("Cognito AdminCreateUser", resp.user().username().equals(fUsername));
+                
+                boolean hasSub = resp.user().attributes().stream().anyMatch(a -> "sub".equals(a.name()));
+                ctx.check("Cognito AdminCreateUser contains sub", hasSub);
             } catch (Exception e) {
                 ctx.check("Cognito AdminCreateUser", false, e);
             }
@@ -87,6 +90,13 @@ public void run(TestContext ctx) {
                     final String token = accessToken;
                     GetUserResponse resp = cognito.getUser(b -> b.accessToken(token));
                     ctx.check("Cognito GetUser", resp.username().equals(fUsername));
+
+                    try {
+                        cognito.adminUserGlobalSignOut(b -> b.userPoolId(fPoolId).username(fUsername));
+                        ctx.check("Cognito AdminUserGlobalSignOut", true);
+                    } catch (Exception e) {
+                        ctx.check("Cognito AdminUserGlobalSignOut", false, e);
+                    }
                 } catch (Exception e) {
                     ctx.check("Cognito GetUser", false, e);
                 }
@@ -170,6 +180,18 @@ public void run(TestContext ctx) {
                     String payload = new String(Base64.getUrlDecoder().decode(parts[1]), StandardCharsets.UTF_8);
                     ctx.check("Cognito JWT cognito:groups claim",
                             payload.contains("\"cognito:groups\"") && payload.contains("\"test-group\""));
+                    
+                    // Verify consistent sub in JWT
+                    String subAttr = null;
+                    AdminGetUserResponse userResp = cognito.adminGetUser(b -> b.userPoolId(fPoolId).username(fUsername));
+                    for (AttributeType attr : userResp.userAttributes()) {
+                        if ("sub".equals(attr.name())) {
+                            subAttr = attr.value();
+                        }
+                    }
+                    ctx.check("Cognito JWT sub claim match", 
+                        payload.contains("\"sub\":\"" + subAttr + "\""));
+
                 } catch (Exception e) {
                     ctx.check("Cognito JWT cognito:groups claim", false, e);
                 }