@actsecurity/iam-lens 0.1.156

package/dist/esm/principalCan/permissionSet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionSet.js","sourceRoot":"","sources":["../../../src/principalCan/permissionSet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAA+B,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,UAAU,EAAoD,MAAM,iBAAiB,CAAA;AAC9F,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,2BAA2B,CAAA;AAElC;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAGxB,YAA4B,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;QAF5C,gBAAW,GAAiD,EAAE,CAAA;IAEf,CAAC;IAExD;;;;;OAKG;IACI,aAAa,CAAC,aAAyB;QAC5C,IAAI,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,qBAAqB,aAAa,CAAC,MAAM,wCAAwC,IAAI,CAAC,MAAM,EAAE,CAC/F,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAA;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAChC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;QACxC,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;QAC7D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACvC,OAAM;QACR,CAAC;QAED,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,IAAI,kBAAkB,GAAG,KAAK,CAAA;QAC9B,IAAI,KAAK,GAA2B,mBAAmB,CAAC,CAAC,CAAC,CAAA;QAC1D,IAAI,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YAC9C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;gBACxC,IAAI,iBAAiB,IAAI,KAAK,EAAE,CAAC;oBAC/B,wFAAwF;oBACxF,OAAM;gBACR,CAAC;gBACD,IAAI,iBAAiB,IAAI,aAAa,EAAE,CAAC;oBACvC,gBAAgB,GAAG,IAAI,CAAA;oBACvB,kFAAkF;gBACpF,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;oBACtC,kBAAkB,GAAG,IAAI,CAAA;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC5B,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;QAED,IAAI,gBAAgB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5C,2FAA2F;YAC3F,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC;aAAM,IAAI,CAAC,gBAAgB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACpD,2FAA2F;YAC3F,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,cAAc,CAAA;IACpD,CAAC;IAED;;;;;;OAMG;IACI,cAAc,CAAC,OAAe,EAAE,MAAc;QACnD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,OAAe;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,OAAe,EAAE,MAAc;QAC9C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3E,CAAC;IAED;;;OAGG;IACI,OAAO;QACZ,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;IACnD,CAAC;IAED;;;;OAIG;IACI,iBAAiB;QACtB,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAoB;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAExC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;oBAAE,SAAQ;gBAE/C,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC5D,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAE9D,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;oBAC7C,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;wBAC/C,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,CAAC,eAAe,CAAC,CAAA;wBACnE,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;4BAC/B,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;wBAC1B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;OAQG;IACI,QAAQ,CAAC,IAAmB;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;QAEzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,4DAA4D;gBAC5D,0EAA0E;gBAC1E,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;gBACnE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;gBACnF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;oBACrC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;wBACnC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;oBACpC,CAAC;oBACD,yEAAyE;oBACzE,sEAAsE;oBACtE,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;oBACjF,SAAQ;gBACV,CAAC;gBAED,IAAI,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAE5D,+HAA+H;gBAC/H,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;oBAC7C,MAAM,cAAc,GAAiB,EAAE,CAAA;oBACvC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;wBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;wBAC1D,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;4BAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gCAC5B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;4BAC3B,CAAC;iCAAM,CAAC;gCACN,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;4BAC7B,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,eAAe,GAAG,cAAc,CAAA;gBAClC,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAuC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;YAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAoCD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAwB,EACxB,QAAkB,EAClB,UAA8C,EAAE;IAEhD,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC1E,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,aAA4B,EAC5B,MAAwB,EACxB,QAAkB,EAClB,UAA8C,EAAE;IAEhD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,qEAAqE;QACrE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1C,SAAQ,CAAC,0CAA0C;YACrD,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/C,SAAQ,CAAC,qDAAqD;YAChE,CAAC;YACD,MAAM,2BAA2B,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAoB,EACpB,aAA4B,EAC5B,UAA8C,EAAE;IAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAsB,CAAA;IACrD,IAAI,gBAA0B,CAAA;IAC9B,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC5D,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5C,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACzF,CAAC;SAAM,CAAC;QACN,OAAM;IACR,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnD,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;YAAE,SAAQ;QAErC,IAAI,QAAQ,GAAyB,SAAS,CAAA;QAC9C,IAAI,WAAW,GAAyB,SAAS,CAAA;QACjD,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACpC,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACxD,CAAC;aAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;YAC9C,WAAW,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC/C,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAA;QACtC,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,4BAA4B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAEpF,aAAa,CAAC,aAAa,CACzB,IAAI,UAAU,CACZ,MAAM,EACN,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,CAAC,YAAY,EAAE,EACxB,SAAS,EACT,YAAY,CACb,CACF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CACnC,SAAoB,EACpB,OAA2C;IAE3C,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,CAAA;IACvC,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,SAAS,CAAC,0BAA0B,EAAE;gBAC/C,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,4BAA4B,CAAC,YAAY,CAAC,SAAS,CAAC;YACxD,YAAY,EAAE,SAAS;SACxB,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,SAAS,CAAC,6BAA6B,EAAE;gBACrD,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,4BAA4B,CAAC,YAAY,CAAC,YAAY,CAAC;SAC5D,CAAA;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAa;IACjC,iDAAiD;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IACpD,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IAEzD,4DAA4D;IAC5D,0EAA0E;IAC1E,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU;QAChC,CAAC,CAAC,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;aACzB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACjB,EAAE;YACF,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;iBACf,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACvC;SACF,CAAC,CACL,CACF;QACH,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACjD,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAEvD,yEAAyE;IACzE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAUpB,CAAA;IAEH,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;YACjC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACpD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACnD,OAAO,EAAE,EAAE;SACZ,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,mDAAmD;IACnD,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,KAAK,GAAQ;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;SAC/E,CAAA;QAED,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,KAAK,CAAC,WAAW,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;aAAM,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACX,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;QAC7B,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;QAC3B,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACjC,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/esm/principalCan/principalCan.d.ts

@@ -0,0 +1,26 @@
+import { IamCollectClient } from '../collect/client.js';
+/**
+ * Input for the can-what command.
+ */
+export interface PrincipalCanInput {
+    /**
+     * The ARN of the principal to check permissions for.
+     */
+    principal: string;
+    /**
+     * Whether to shrink action lists in the resulting policy document.
+     */
+    shrinkActionLists: boolean;
+}
+/**
+ * Get what actions a principal can perform based on their policies.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies.
+ * @param input the input containing the principal and options.
+ * @returns A promise that resolves to the permissions the principal can perform, or void if the implementation is incomplete.
+ */
+export declare function principalCan(collectClient: IamCollectClient, input: PrincipalCanInput): Promise<{
+    Version: string;
+    Statement: any[];
+}>;
+//# sourceMappingURL=principalCan.d.ts.map

package/dist/esm/principalCan/principalCan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalCan.d.ts","sourceRoot":"","sources":["../../../src/principalCan/principalCan.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAmBvD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;OAEG;IACH,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,aAAa,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB;;;GAwO3F"}

package/dist/esm/principalCan/principalCan.js

@@ -0,0 +1,193 @@
+import { loadPolicy } from '@actsecurity/iam-policy';
+import { shrinkJsonDocument } from '@actsecurity/iam-shrink';
+import { splitArnParts } from '@actsecurity/iam-utils';
+import { IamCollectClient } from '../collect/client.js';
+import { getAllPoliciesForPrincipal } from '../principals.js';
+import { addStatementToPermissionSet, buildPermissionSetFromPolicies, PermissionSet, toPolicyStatements } from './permissionSet.js';
+import { allIamRolesAssumeRolePermissionSets, iamRolesSameAccount } from './resources/resourceTypes/iamRoles.js';
+import { allKmsKeysAllActionsPermissionSets, kmsKeysSameAccount } from './resources/resourceTypes/kmsKeys.js';
+import { s3BucketsCrossAccount, s3BucketsSameAccount } from './resources/resourceTypes/s3Buckets.js';
+import { statementAppliesToPrincipal } from './resources/statements.js';
+/**
+ * Get what actions a principal can perform based on their policies.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies.
+ * @param input the input containing the principal and options.
+ * @returns A promise that resolves to the permissions the principal can perform, or void if the implementation is incomplete.
+ */
+export async function principalCan(collectClient, input) {
+    const { principal } = input;
+    if (!principal) {
+        throw new Error('Principal must be provided for principal-can command');
+    }
+    const principalAccountId = splitArnParts(principal).accountId;
+    const principalPolicies = await getAllPoliciesForPrincipal(collectClient, principal);
+    const identityPolicies = [
+        ...principalPolicies.managedPolicies,
+        ...principalPolicies.inlinePolicies,
+        ...(principalPolicies.groupPolicies?.map((group) => group.managedPolicies).flat() || []),
+        ...(principalPolicies.groupPolicies?.map((group) => group.inlinePolicies).flat() || [])
+    ].map((policy) => loadPolicy(policy.policy));
+    const allowedPermissions = await buildPermissionSetFromPolicies('Allow', identityPolicies);
+    const identityDenyPermissions = await buildPermissionSetFromPolicies('Deny', identityPolicies);
+    let finalPermissions = allowedPermissions;
+    const resourceDenyPermissions = new PermissionSet('Deny');
+    /*********** Start KMS Keys *************/
+    //📋 Get all current permissions
+    const { keyAllows: allKeysAllow, keyDenies: allKeysDeny } = await allKmsKeysAllActionsPermissionSets();
+    //📋 Capture what is currently allowed by identity policies
+    const identityKeyPermissions = allKeysAllow.intersection(allowedPermissions);
+    //📋 Do any subtractions first
+    // Remove all the KMS permissions from the identityAllows, add them back later
+    finalPermissions = finalPermissions.subtract(allKeysDeny).allow;
+    //📋 Get the permissions for the account
+    // Get all the KMS permission for the same account
+    const { accountAllows: keyAccountAllows, principalAllows: keyPrincipalAllows, denies: keyDenies } = await kmsKeysSameAccount(collectClient, principal);
+    //📋 Add direct permissions for the principal
+    // Add in the principal allows
+    finalPermissions.addAll(keyPrincipalAllows);
+    //📋 Intersect account allows with identity allows
+    // Add the account allows intersected with the identity allows
+    for (const keyAcctAllow of keyAccountAllows) {
+        finalPermissions.addAll(keyAcctAllow.intersection(identityKeyPermissions));
+    }
+    //📋 Add the denies.
+    // Add the denies for later
+    resourceDenyPermissions.addAll(keyDenies);
+    /*********** End KMS Keys *************/
+    /*********** Start Role Trust Policies *************/
+    const { roleAllows: allRolesAllow, roleDenies: allRolesDeny } = await allIamRolesAssumeRolePermissionSets();
+    const identityAssumeRolePermissions = allRolesAllow.intersection(allowedPermissions);
+    // Remove all the IAM role permissions from the identityAllows, add them back later
+    finalPermissions = finalPermissions.subtract(allRolesDeny).allow;
+    // Get all the KMS permission for the same account
+    const { accountAllows: roleAccountAllows, principalAllows: rolePrincipalAllows, denies: roleDenies } = await iamRolesSameAccount(collectClient, principal);
+    // Add in the principal allows
+    finalPermissions.addAll(rolePrincipalAllows);
+    // Add the account allows intersected with the identity allows
+    for (const roleAcctAllow of roleAccountAllows) {
+        finalPermissions.addAll(roleAcctAllow.intersection(identityAssumeRolePermissions));
+    }
+    // Add the denies for later
+    resourceDenyPermissions.addAll(roleDenies);
+    /*********** End Role Trust Policies *************/
+    /*********** Start Buckets *************/
+    const { allows: bucketAllows, denies: bucketDenies } = await s3BucketsSameAccount(collectClient, principal);
+    finalPermissions.addAll(bucketAllows);
+    resourceDenyPermissions.addAll(bucketDenies);
+    /*********** End Buckets *************/
+    // TODO: There is a slight wrinkle where same account resource policies can override implicit denies from Permission Boundaries.
+    if (principalPolicies.permissionBoundary) {
+        const boundaryPolicy = loadPolicy(principalPolicies.permissionBoundary.policy);
+        const boundaryPermissions = await buildPermissionSetFromPolicies('Allow', [boundaryPolicy]);
+        const boundaryDenies = await buildPermissionSetFromPolicies('Deny', [boundaryPolicy]);
+        identityDenyPermissions.addAll(boundaryDenies);
+        finalPermissions = finalPermissions.intersection(boundaryPermissions);
+    }
+    /*********** Start Cross Account Checks *************/
+    // 📋 List the accounts
+    // 📋 Get the RCPs, if any
+    // 📋 Get the bucket permission sets for the account
+    // 📋 Intersect with identity permissions and Permission boundary by using `finalPermissions`
+    // 📋 Subtract denies from identity permissions, SCPs, and Permission Boundary
+    const allAccounts = await collectClient.allAccounts();
+    const otherAccountAllows = new PermissionSet('Allow');
+    const otherAccountDenies = new PermissionSet('Deny');
+    for (const otherAccountId of allAccounts) {
+        if (otherAccountId === principalAccountId) {
+            continue;
+        }
+        const rcpPolicies = await collectClient.getRcpHierarchyForAccount(otherAccountId);
+        const otherAccountRcpDenies = new PermissionSet('Deny');
+        for (const level of rcpPolicies) {
+            const rcpPolicies = level.policies.map((rcp) => loadPolicy(rcp.policy));
+            for (const policy of rcpPolicies) {
+                for (const statement of policy.statements()) {
+                    if (statement.isDeny()) {
+                        // Only Add RCP denies that apply to the principal
+                        const applies = await statementAppliesToPrincipal(statement, principal, collectClient);
+                        if (applies === 'PrincipalMatch' || applies === 'AccountMatch') {
+                            await addStatementToPermissionSet(statement, otherAccountRcpDenies);
+                        }
+                    }
+                }
+            }
+        }
+        const { allows: otherAccountBucketAllows, denies: otherAccountBucketDenies } = await s3BucketsCrossAccount(collectClient, otherAccountId, otherAccountRcpDenies, principal);
+        otherAccountAllows.addAll(otherAccountBucketAllows);
+        otherAccountDenies.addAll(otherAccountBucketDenies);
+    }
+    let effectiveOtherAccountAllows = otherAccountAllows.intersection(finalPermissions);
+    /*********** End Cross Account Checks *************/
+    const scpAllowsByLevel = [];
+    const rcpAllowsByLevel = [];
+    for (const level of principalPolicies.scps) {
+        const scpPolicies = level.policies.map((scp) => loadPolicy(scp.policy));
+        scpAllowsByLevel.push(await buildPermissionSetFromPolicies('Allow', scpPolicies));
+        for (const policy of scpPolicies) {
+            for (const statement of policy.statements()) {
+                if (statement.isDeny()) {
+                    // Only Add SCP denies that apply to the principal
+                    const applies = await statementAppliesToPrincipal(statement, principal, collectClient);
+                    if (applies === 'PrincipalMatch' || applies === 'AccountMatch') {
+                        await addStatementToPermissionSet(statement, identityDenyPermissions);
+                    }
+                }
+            }
+        }
+    }
+    const principalAccountDenyPermissions = identityDenyPermissions.clone();
+    for (const level of principalPolicies.rcps) {
+        const rcpPolicies = level.policies.map((rcp) => loadPolicy(rcp.policy));
+        rcpAllowsByLevel.push(await buildPermissionSetFromPolicies('Allow', rcpPolicies));
+        for (const policy of rcpPolicies) {
+            for (const statement of policy.statements()) {
+                if (statement.isDeny()) {
+                    // Only Add RCPs denies that apply to the principal
+                    const applies = await statementAppliesToPrincipal(statement, principal, collectClient);
+                    if (applies === 'PrincipalMatch' || applies === 'AccountMatch') {
+                        await addStatementToPermissionSet(statement, principalAccountDenyPermissions);
+                    }
+                }
+            }
+        }
+    }
+    for (const scpAllow of scpAllowsByLevel) {
+        finalPermissions = finalPermissions.intersection(scpAllow);
+        effectiveOtherAccountAllows = effectiveOtherAccountAllows.intersection(scpAllow);
+    }
+    for (const rcpAllow of rcpAllowsByLevel) {
+        finalPermissions = finalPermissions.intersection(rcpAllow);
+    }
+    //Put together all the denies
+    principalAccountDenyPermissions.addAll(resourceDenyPermissions);
+    /* Same account final permissions after denies */
+    const sameAccountPermissionsAfterDeny = finalPermissions.subtract(principalAccountDenyPermissions);
+    finalPermissions = sameAccountPermissionsAfterDeny.allow;
+    const deniedPermissions = sameAccountPermissionsAfterDeny.deny;
+    const allowStatements = toPolicyStatements(finalPermissions);
+    const denyStatements = toPolicyStatements(deniedPermissions);
+    /* Cross account final permissions */
+    // Combine all the denies that apply to cross account
+    const allCrossAccountDenies = principalAccountDenyPermissions.clone();
+    allCrossAccountDenies.addAll(otherAccountDenies);
+    // Subtract the denies from the cross account allows
+    const crossAccountPermissionsAfterDeny = effectiveOtherAccountAllows.subtract(allCrossAccountDenies);
+    const crossAccountAllowStatements = toPolicyStatements(crossAccountPermissionsAfterDeny.allow);
+    const crossAccountDenyStatements = toPolicyStatements(crossAccountPermissionsAfterDeny.deny);
+    /* Create a policy document for everything */
+    const policyDocument = {
+        Version: '2012-10-17',
+        Statement: [
+            ...allowStatements,
+            ...denyStatements,
+            ...crossAccountAllowStatements,
+            ...crossAccountDenyStatements
+        ]
+    };
+    if (input.shrinkActionLists) {
+        await shrinkJsonDocument({ iterations: 0 }, policyDocument);
+    }
+    return policyDocument;
+}
+//# sourceMappingURL=principalCan.js.map

package/dist/esm/principalCan/principalCan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalCan.js","sourceRoot":"","sources":["../../../src/principalCan/principalCan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,aAAa,EACb,kBAAkB,EACnB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,mCAAmC,EACnC,mBAAmB,EACpB,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,kCAAkC,EAClC,kBAAkB,EACnB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAA;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAA;AAiBvE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,aAA+B,EAAE,KAAwB;IAC1F,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAE3B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,kBAAkB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,SAAU,CAAA;IAE9D,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAEpF,MAAM,gBAAgB,GAAG;QACvB,GAAG,iBAAiB,CAAC,eAAe;QACpC,GAAG,iBAAiB,CAAC,cAAc;QACnC,GAAG,CAAC,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACxF,GAAG,CAAC,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;KACxF,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAE5C,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAC1F,MAAM,uBAAuB,GAAG,MAAM,8BAA8B,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;IAE9F,IAAI,gBAAgB,GAAG,kBAAkB,CAAA;IAEzC,MAAM,uBAAuB,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IAEzD,0CAA0C;IAC1C,gCAAgC;IAChC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,GACvD,MAAM,kCAAkC,EAAE,CAAA;IAE5C,2DAA2D;IAC3D,MAAM,sBAAsB,GAAG,YAAY,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAA;IAE5E,8BAA8B;IAC9B,8EAA8E;IAC9E,gBAAgB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAA;IAE/D,wCAAwC;IACxC,kDAAkD;IAClD,MAAM,EACJ,aAAa,EAAE,gBAAgB,EAC/B,eAAe,EAAE,kBAAkB,EACnC,MAAM,EAAE,SAAS,EAClB,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAEtD,6CAA6C;IAC7C,8BAA8B;IAC9B,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAE3C,kDAAkD;IAClD,8DAA8D;IAC9D,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;QAC5C,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAA;IAC5E,CAAC;IAED,oBAAoB;IACpB,2BAA2B;IAC3B,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACzC,wCAAwC;IAExC,qDAAqD;IACrD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,GAC3D,MAAM,mCAAmC,EAAE,CAAA;IAE7C,MAAM,6BAA6B,GAAG,aAAa,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAA;IAEpF,mFAAmF;IACnF,gBAAgB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,CAAA;IAEhE,kDAAkD;IAClD,MAAM,EACJ,aAAa,EAAE,iBAAiB,EAChC,eAAe,EAAE,mBAAmB,EACpC,MAAM,EAAE,UAAU,EACnB,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAEvD,8BAA8B;IAC9B,gBAAgB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAE5C,8DAA8D;IAC9D,KAAK,MAAM,aAAa,IAAI,iBAAiB,EAAE,CAAC;QAC9C,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,2BAA2B;IAC3B,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC1C,mDAAmD;IAEnD,yCAAyC;IACzC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,CAC/E,aAAa,EACb,SAAS,CACV,CAAA;IAED,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACrC,uBAAuB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC5C,uCAAuC;IAEvC,gIAAgI;IAChI,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC9E,MAAM,mBAAmB,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAA;QAC3F,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,CAAC,CAAA;QACrF,uBAAuB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QAC9C,gBAAgB,GAAG,gBAAgB,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAA;IACvE,CAAC;IAED,sDAAsD;IACtD,uBAAuB;IACvB,0BAA0B;IAC1B,oDAAoD;IACpD,6FAA6F;IAC7F,8EAA8E;IAE9E,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAA;IACrD,MAAM,kBAAkB,GAAkB,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACpE,MAAM,kBAAkB,GAAkB,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IAEnE,KAAK,MAAM,cAAc,IAAI,WAAW,EAAE,CAAC;QACzC,IAAI,cAAc,KAAK,kBAAkB,EAAE,CAAC;YAC1C,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAA;QACjF,MAAM,qBAAqB,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;QAEvD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;gBACjC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;oBAC5C,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;wBACvB,kDAAkD;wBAClD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;wBACtF,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;4BAC/D,MAAM,2BAA2B,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAA;wBACrE,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAC1E,MAAM,qBAAqB,CAAC,aAAa,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAA;QAC9F,kBAAkB,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAA;QACnD,kBAAkB,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAA;IACrD,CAAC;IAED,IAAI,2BAA2B,GAAG,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAA;IACnF,oDAAoD;IAEpD,MAAM,gBAAgB,GAAoB,EAAE,CAAA;IAC5C,MAAM,gBAAgB,GAAoB,EAAE,CAAA;IAE5C,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,gBAAgB,CAAC,IAAI,CAAC,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA;QACjF,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC5C,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;oBACvB,kDAAkD;oBAClD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;oBACtF,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;wBAC/D,MAAM,2BAA2B,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAA;oBACvE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,+BAA+B,GAAG,uBAAuB,CAAC,KAAK,EAAE,CAAA;IACvE,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,gBAAgB,CAAC,IAAI,CAAC,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA;QACjF,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC5C,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;oBACvB,mDAAmD;oBACnD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;oBACtF,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;wBAC/D,MAAM,2BAA2B,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAA;oBAC/E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,gBAAgB,GAAG,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC1D,2BAA2B,GAAG,2BAA2B,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IAClF,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,gBAAgB,GAAG,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC5D,CAAC;IAED,6BAA6B;IAC7B,+BAA+B,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAA;IAE/D,iDAAiD;IACjD,MAAM,+BAA+B,GAAG,gBAAgB,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAA;IAClG,gBAAgB,GAAG,+BAA+B,CAAC,KAAK,CAAA;IACxD,MAAM,iBAAiB,GAAG,+BAA+B,CAAC,IAAI,CAAA;IAE9D,MAAM,eAAe,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC5D,MAAM,cAAc,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5D,qCAAqC;IACrC,qDAAqD;IACrD,MAAM,qBAAqB,GAAG,+BAA+B,CAAC,KAAK,EAAE,CAAA;IACrE,qBAAqB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAChD,oDAAoD;IACpD,MAAM,gCAAgC,GACpC,2BAA2B,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAA;IAC7D,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAA;IAC9F,MAAM,0BAA0B,GAAG,kBAAkB,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAA;IAE5F,6CAA6C;IAC7C,MAAM,cAAc,GAAG;QACrB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,GAAG,eAAe;YAClB,GAAG,cAAc;YACjB,GAAG,2BAA2B;YAC9B,GAAG,0BAA0B;SAC9B;KACF,CAAA;IAED,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,cAAc,CAAA;AACvB,CAAC"}

package/dist/esm/principalCan/principalConstraints.d.ts

@@ -0,0 +1,147 @@
+/** IAM principal type keys supported in Principal and NotPrincipal policy elements. */
+export type PermissionPrincipalType = 'AWS' | 'Service' | 'Federated' | 'CanonicalUser';
+/** Principal values grouped by IAM principal type for Permission algebra and policy output. */
+export type PermissionPrincipals = Partial<Record<PermissionPrincipalType, string[]>> & {
+    /** True when the policy used Principal: "*" rather than a typed principal map. */
+    wildcard?: true;
+};
+/** Internal normalized representation of a Principal or NotPrincipal dimension. */
+export type PrincipalConstraint = {
+    kind: 'any';
+    explicit: boolean;
+} | {
+    kind: 'principal';
+    principals: PermissionPrincipals;
+} | {
+    kind: 'notPrincipal';
+    principals: PermissionPrincipals;
+};
+/** A normalized principal entry with semantic scope metadata used for comparisons. */
+export interface NormalizedPrincipalEntry {
+    /** The IAM principal type or Any for Principal: "*". */
+    type: PermissionPrincipalType | 'Any';
+    /** The normalized string value retained for round-tripping and debugging. */
+    value: string;
+    /** The semantic category used for containment and overlap comparisons. */
+    semanticKind: 'wildcard' | 'account' | 'arn' | 'service' | 'federated' | 'canonicalUser' | 'organization' | 'network';
+    /** Account IDs covered by this principal or derived principal-related condition scope. */
+    accountIds?: string[];
+    /** Organization IDs covered by this principal-related condition scope. */
+    organizationIds?: string[];
+    /** AWS service principal names covered by this entry. */
+    servicePrincipals?: string[];
+    /** VPC IDs covered by this principal-related condition scope. */
+    vpcIds?: string[];
+    /** CIDR blocks covered by this principal-related condition scope. */
+    cidrBlocks?: string[];
+}
+/** The relationship between two normalized principal sets. */
+export type PrincipalSetRelation = 'equal' | 'subset' | 'superset' | 'overlap' | 'disjoint' | 'unknown';
+/**
+ * Build an unconstrained principal dimension.
+ *
+ * @param explicit - True when the source policy explicitly used Principal: "*".
+ * @returns The unconstrained principal constraint.
+ */
+export declare function anyPrincipalConstraint(explicit: boolean): PrincipalConstraint;
+/**
+ * Build a positive principal constraint.
+ *
+ * @param principals - The positive principal values.
+ * @returns A normalized principal constraint.
+ */
+export declare function principalConstraint(principals: PermissionPrincipals | undefined): PrincipalConstraint;
+/**
+ * Build a negative principal constraint.
+ *
+ * @param notPrincipals - The excluded principal values.
+ * @returns A normalized not-principal constraint.
+ */
+export declare function notPrincipalConstraint(notPrincipals: PermissionPrincipals | undefined): PrincipalConstraint;
+/**
+ * Normalize optional Principal and NotPrincipal values into an internal constraint.
+ *
+ * @param principal - Positive principals, if present.
+ * @param notPrincipal - Negative principals, if present.
+ * @returns The normalized principal constraint.
+ */
+export declare function normalizePrincipalConstraint(principal: PermissionPrincipals | undefined, notPrincipal: PermissionPrincipals | undefined): PrincipalConstraint;
+/**
+ * Normalize principal values by validating wildcard usage, de-duplicating values, and normalizing STS sessions.
+ *
+ * @param principals - Principal values to normalize.
+ * @returns Normalized principal values.
+ */
+export declare function normalizePermissionPrincipals(principals: PermissionPrincipals): PermissionPrincipals;
+/**
+ * Determine whether one principal constraint fully includes another.
+ *
+ * @param a - Candidate including constraint.
+ * @param b - Candidate included constraint.
+ * @returns True when every principal in b is also in a.
+ */
+export declare function principalIncludes(a: PrincipalConstraint, b: PrincipalConstraint): boolean;
+/**
+ * Determine whether two principal constraints have any possible overlap.
+ *
+ * @param a - First principal constraint.
+ * @param b - Second principal constraint.
+ * @returns True when at least one principal can satisfy both constraints.
+ */
+export declare function principalConstraintsOverlap(a: PrincipalConstraint, b: PrincipalConstraint): boolean;
+/**
+ * Return compact principal constraints representing a union.
+ *
+ * @param a - First principal constraint.
+ * @param b - Second principal constraint.
+ * @returns One or more constraints representing the union.
+ */
+export declare function unionPrincipalConstraints(a: PrincipalConstraint, b: PrincipalConstraint): PrincipalConstraint[];
+/**
+ * Return constraints representing the intersection of two principal constraints.
+ *
+ * @param a - First principal constraint.
+ * @param b - Second principal constraint.
+ * @returns Constraints for the overlap, or an empty array when disjoint.
+ */
+export declare function intersectPrincipalConstraints(a: PrincipalConstraint, b: PrincipalConstraint): PrincipalConstraint[];
+/**
+ * Return constraints for allow minus deny on the principal dimension.
+ *
+ * @param allow - Allow principal constraint.
+ * @param deny - Deny principal constraint.
+ * @returns Principal constraints that remain allowed.
+ */
+export declare function subtractPrincipalConstraint(allow: PrincipalConstraint, deny: PrincipalConstraint): PrincipalConstraint[];
+/**
+ * Convert a constraint into Permission constructor principal arguments.
+ *
+ * @param constraint - The principal constraint to convert.
+ * @returns Principal and NotPrincipal fields for a Permission.
+ */
+export declare function principalArgsForConstraint(constraint: PrincipalConstraint): {
+    principal: PermissionPrincipals | undefined;
+    notPrincipal: PermissionPrincipals | undefined;
+};
+/**
+ * Convert principal values to a stable JSON value for bucketing policy statements.
+ *
+ * @param principal - Principal values to canonicalize.
+ * @returns A JSON-compatible canonical representation.
+ */
+export declare function canonicalPrincipal(principal: PermissionPrincipals | undefined): unknown;
+/**
+ * Convert a Principal/NotPrincipal raw policy value into PermissionPrincipals.
+ *
+ * @param value - The raw Principal or NotPrincipal value.
+ * @returns Permission principal values.
+ */
+export declare function principalsFromRawPolicyValue(value: unknown): PermissionPrincipals | undefined;
+/**
+ * Convert PermissionPrincipals into a raw policy Principal or NotPrincipal value.
+ *
+ * @param principals - Principal values to convert.
+ * @returns A raw policy value.
+ */
+export declare function principalsToPolicyValue(principals: PermissionPrincipals): unknown;
+//# sourceMappingURL=principalConstraints.d.ts.map

package/dist/esm/principalCan/principalConstraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalConstraints.d.ts","sourceRoot":"","sources":["../../../src/principalCan/principalConstraints.ts"],"names":[],"mappings":"AAEA,uFAAuF;AACvF,MAAM,MAAM,uBAAuB,GAAG,KAAK,GAAG,SAAS,GAAG,WAAW,GAAG,eAAe,CAAA;AAEvF,+FAA+F;AAC/F,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG;IACtF,kFAAkF;IAClF,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,CAAA;AAE9D,sFAAsF;AACtF,MAAM,WAAW,wBAAwB;IACvC,wDAAwD;IACxD,IAAI,EAAE,uBAAuB,GAAG,KAAK,CAAA;IACrC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,YAAY,EACR,UAAU,GACV,SAAS,GACT,KAAK,GACL,SAAS,GACT,WAAW,GACX,eAAe,GACf,cAAc,GACd,SAAS,CAAA;IACb,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,8DAA8D;AAC9D,MAAM,MAAM,oBAAoB,GAC9B,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;AAItE;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG,mBAAmB,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oBAAoB,GAAG,SAAS,GAC3C,mBAAmB,CAErB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,oBAAoB,GAAG,SAAS,GAC9C,mBAAmB,CAErB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,oBAAoB,GAAG,SAAS,EAC3C,YAAY,EAAE,oBAAoB,GAAG,SAAS,GAC7C,mBAAmB,CAerB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,oBAAoB,GAC/B,oBAAoB,CAwBtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAuBzF;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,CAAC,EAAE,mBAAmB,EACtB,CAAC,EAAE,mBAAmB,GACrB,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,mBAAmB,EACtB,CAAC,EAAE,mBAAmB,GACrB,mBAAmB,EAAE,CA2BvB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,mBAAmB,EACtB,CAAC,EAAE,mBAAmB,GACrB,mBAAmB,EAAE,CAqBvB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,mBAAmB,GACxB,mBAAmB,EAAE,CAyBvB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,mBAAmB,GAAG;IAC3E,SAAS,EAAE,oBAAoB,GAAG,SAAS,CAAA;IAC3C,YAAY,EAAE,oBAAoB,GAAG,SAAS,CAAA;CAC/C,CAWA;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,oBAAoB,GAAG,SAAS,GAAG,OAAO,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,GAAG,SAAS,CAa7F;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAUjF"}