@actsecurity/iam-lens 0.1.156

package/dist/cjs/principalCan/permissionSet.js

@@ -0,0 +1,437 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionSet = void 0;
+exports.buildPermissionSetFromPolicies = buildPermissionSetFromPolicies;
+exports.addPoliciesToPermissionSet = addPoliciesToPermissionSet;
+exports.addStatementToPermissionSet = addStatementToPermissionSet;
+exports.toPolicyStatements = toPolicyStatements;
+const iam_expand_1 = require("@actsecurity/iam-expand");
+const permission_js_1 = require("./permission.js");
+const principalConstraints_js_1 = require("./principalConstraints.js");
+/**
+ * A permission set will be a collection of permissions for a specific effect (Allow or Deny).
+ * So this will be used to represent things like "all the allowed permissions in a set of SCPs"
+ * and "all the deny's that apply to a principal"
+ */
+class PermissionSet {
+    effect;
+    permissions = {};
+    constructor(effect) {
+        this.effect = effect;
+    }
+    /**
+     * Add a new permission to the set.  If the new permission overlaps with an existing one,
+     * they will be unioned together to avoid redundancy.
+     *
+     * @param newPermission the permission to add
+     */
+    addPermission(newPermission) {
+        if (newPermission.effect !== this.effect) {
+            throw new Error(`Permission effect ${newPermission.effect} does not match PermissionSet effect ${this.effect}`);
+        }
+        const service = newPermission.service;
+        const action = newPermission.action;
+        if (!this.permissions[service]) {
+            this.permissions[service] = {};
+        }
+        if (!this.permissions[service][action]) {
+            this.permissions[service][action] = [];
+        }
+        const existingPermissions = this.permissions[service][action];
+        if (existingPermissions.length === 0) {
+            existingPermissions.push(newPermission);
+            return;
+        }
+        let replacesExisting = false;
+        let mergedWithExisting = false;
+        let first = existingPermissions[0];
+        let rest = existingPermissions.slice(1);
+        const newPermissions = [];
+        while (first) {
+            const unionResult = first.union(newPermission);
+            if (unionResult.length === 1) {
+                const unionedPermission = unionResult[0];
+                if (unionedPermission == first) {
+                    // The new permission is included in the existing permission, so we don't need to add it
+                    return;
+                }
+                if (unionedPermission == newPermission) {
+                    replacesExisting = true;
+                    // The existing permission is included in the new permission, so we can replace it
+                }
+                else {
+                    // The unioned permission is a net new permission, so we can add it
+                    newPermissions.push(unionedPermission);
+                    mergedWithExisting = true;
+                }
+            }
+            else {
+                newPermissions.push(first);
+            }
+            first = rest.shift();
+        }
+        if (replacesExisting && !mergedWithExisting) {
+            // If we didn't replace or merge with any existing permissions, just add the new permission
+            newPermissions.push(newPermission);
+        }
+        else if (!replacesExisting && !mergedWithExisting) {
+            // If we didn't replace or merge with any existing permissions, just add the new permission
+            newPermissions.push(newPermission);
+        }
+        this.permissions[service][action] = newPermissions;
+    }
+    /**
+     * Get the permissions for a specific service and action.
+     *
+     * @param service the service to get permissions for
+     * @param action the action to get permissions for
+     * @returns the permissions that match the service and action
+     */
+    getPermissions(service, action) {
+        if (!this.permissions[service] || !this.permissions[service][action]) {
+            return [];
+        }
+        return this.permissions[service][action];
+    }
+    /**
+     * Check if the permission set has any permissions for a specific service
+     *
+     * @param service the service to check permissions for
+     * @returns true if the permission set has permissions for the service, false otherwise
+     */
+    hasService(service) {
+        return !!this.permissions[service];
+    }
+    /**
+     * Check if the permission set has any permissions for a specific action
+     *
+     * @param service the service the action belongs to
+     * @param action the action to check permissions for
+     * @returns true if the permission set has permissions for the action, false otherwise
+     */
+    hasAction(service, action) {
+        return !!(this.permissions[service] && this.permissions[service][action]);
+    }
+    /**
+     * Check if the permission set is empty (has no permissions)
+     * @returns true if the permission set is empty, false otherwise
+     */
+    isEmpty() {
+        return Object.keys(this.permissions).length === 0;
+    }
+    /**
+     * Get all the permissions in the permission set
+     *
+     * @returns a copy of all the permissions in the permission set
+     */
+    getAllPermissions() {
+        const allPermissions = [];
+        for (const service in this.permissions) {
+            for (const action in this.permissions[service]) {
+                allPermissions.push(...this.permissions[service][action]);
+            }
+        }
+        return allPermissions;
+    }
+    /**
+     * Return a new PermissionSet containing the intersection of this set and another.
+     * Only permissions that overlap (same effect, service, action, and intersecting resources/conditions)
+     * will be included.
+     *
+     * @param other The other PermissionSet to intersect with.
+     * @returns A new PermissionSet containing the intersecting permissions.
+     * @throws Error if the effects of the two PermissionSets do not match.
+     */
+    intersection(other) {
+        if (this.effect !== other.effect) {
+            throw new Error('Cannot intersect PermissionSets with different effects');
+        }
+        const result = new PermissionSet(this.effect);
+        for (const service of Object.keys(this.permissions)) {
+            if (!other.hasService(service))
+                continue;
+            for (const action of Object.keys(this.permissions[service])) {
+                if (!other.hasAction(service, action))
+                    continue;
+                const thisPermissions = this.getPermissions(service, action);
+                const otherPermissions = other.getPermissions(service, action);
+                for (const thisPermission of thisPermissions) {
+                    for (const otherPermission of otherPermissions) {
+                        const intersections = thisPermission.intersections(otherPermission);
+                        for (const ix of intersections) {
+                            result.addPermission(ix);
+                        }
+                    }
+                }
+            }
+        }
+        return result;
+    }
+    /**
+     * Subtract a Deny PermissionSet from this Allow PermissionSet.
+     *
+     * Returns two PermissionSets: one with the remaining Allow permissions,
+     * and one with any Deny permissions that were created as a result of the subtraction.
+     *
+     * @param deny the Deny PermissionSet to subtract
+     * @returns an object containing the resulting Allow and Deny PermissionSets
+     */
+    subtract(deny) {
+        if (this.effect !== 'Allow' || deny.effect !== 'Deny') {
+            throw new Error('Can only subtract a Deny PermissionSet from an Allow PermissionSet');
+        }
+        const allowSet = new PermissionSet('Allow');
+        const denySet = new PermissionSet('Deny');
+        for (const service of Object.keys(this.permissions)) {
+            if (!deny.hasService(service)) {
+                // allowSet.permissions[service] = this.permissions[service]
+                // If the other set doesn't have this service, we can keep all permissions
+                allowSet.permissions[service] = allowSet.permissions[service] || {};
+                for (const action of Object.keys(this.permissions[service])) {
+                    allowSet.permissions[service][action] = [...this.getPermissions(service, action)];
+                }
+                continue;
+            }
+            for (const action of Object.keys(this.permissions[service])) {
+                if (!deny.hasAction(service, action)) {
+                    if (!allowSet.permissions[service]) {
+                        allowSet.permissions[service] = {};
+                    }
+                    // If the other set doesn't have this action, we can keep all permissions
+                    // allowSet.permissions[service] = allowSet.permissions[service] || {}
+                    allowSet.permissions[service][action] = [...this.getPermissions(service, action)];
+                    continue;
+                }
+                let thisPermissions = this.getPermissions(service, action);
+                const denyPermissions = deny.getPermissions(service, action);
+                // We need to iteratively from each set of permissions, taking the result of each subtraction and feeding it into the next one.
+                for (const denyPermission of denyPermissions) {
+                    const newPermissions = [];
+                    for (const thisPermission of thisPermissions) {
+                        const difference = thisPermission.subtract(denyPermission);
+                        for (const diff of difference) {
+                            if (diff.effect === 'Allow') {
+                                newPermissions.push(diff);
+                            }
+                            else {
+                                denySet.addPermission(diff);
+                            }
+                        }
+                    }
+                    thisPermissions = newPermissions;
+                }
+                for (const perm of thisPermissions) {
+                    allowSet.addPermission(perm);
+                }
+            }
+        }
+        return { allow: allowSet, deny: denySet };
+    }
+    /**
+     * Add all permissions from another PermissionSet to this one.
+     *
+     * @param others the other PermissionSet (or array of PermissionSets) to add permissions from
+     * @throws Error if the effects of the two PermissionSets do not match
+     */
+    addAll(others) {
+        if (!Array.isArray(others)) {
+            others = [others];
+        }
+        for (const other of others) {
+            if (other.effect !== this.effect) {
+                throw new Error('Cannot add PermissionSets with different effects');
+            }
+        }
+        for (const other of others) {
+            for (const perm of other.getAllPermissions()) {
+                this.addPermission(perm);
+            }
+        }
+    }
+    /**
+     * Deep clones the PermissionSet.
+     *
+     * @returns a new PermissionSet instance with the same permissions.
+     */
+    clone() {
+        const clone = new PermissionSet(this.effect);
+        for (const service in this.permissions) {
+            clone.permissions[service] = {};
+            for (const action in this.permissions[service]) {
+                clone.permissions[service][action] = [...this.permissions[service][action]];
+            }
+        }
+        return clone;
+    }
+}
+exports.PermissionSet = PermissionSet;
+async function buildPermissionSetFromPolicies(effect, policies, options = {}) {
+    // We'll collect all "Allow" statements across all policies
+    const permissionSet = new PermissionSet(effect);
+    await addPoliciesToPermissionSet(permissionSet, effect, policies, options);
+    return permissionSet;
+}
+async function addPoliciesToPermissionSet(permissionSet, effect, policies, options = {}) {
+    for (const policy of policies) {
+        // Each Policy object has a `.statements` array of raw Statement JSON
+        for (const stmt of policy.statements()) {
+            if (effect === 'Allow' && !stmt.isAllow()) {
+                continue; // skip Deny or any other non-Allow effect
+            }
+            else if (effect === 'Deny' && !stmt.isDeny()) {
+                continue; // skip Allow statements if we're building a Deny set
+            }
+            await addStatementToPermissionSet(stmt, permissionSet, options);
+        }
+    }
+}
+/**
+ * Add a single Statement to a PermissionSet, expanding it into one or more Permissions as needed.
+ *
+ * @param statement the IAM policy statement to add
+ * @param permissionSet the PermissionSet to add the statement to
+ * @param options conversion options controlling principal and implicit resource handling
+ * @returns nothing; the PermissionSet is modified in place
+ */
+async function addStatementToPermissionSet(statement, permissionSet, options = {}) {
+    const effect = statement.effect();
+    let statementActions;
+    if (statement.isActionStatement()) {
+        const allActions = statement.actions().map((a) => a.value());
+        statementActions = await (0, iam_expand_1.expandIamActions)(allActions, { expandAsterisk: true });
+    }
+    else if (statement.isNotActionStatement()) {
+        statementActions = await (0, iam_expand_1.invertIamActions)(statement.notActions().map((a) => a.value()));
+    }
+    else {
+        return;
+    }
+    for (const fullAction of statementActions) {
+        const [service, actionName] = fullAction.split(':');
+        if (!service || !actionName)
+            continue;
+        let resource = undefined;
+        let notResource = undefined;
+        if (statement.isResourceStatement()) {
+            resource = statement.resources().map((r) => r.value());
+        }
+        else if (statement.isNotResourceStatement()) {
+            notResource = statement.notResources().map((r) => r.value());
+        }
+        else if (!!options.implicitResources?.length) {
+            resource = options.implicitResources;
+        }
+        const { principal, notPrincipal } = principalFieldsFromStatement(statement, options);
+        permissionSet.addPermission(new permission_js_1.Permission(effect, service, actionName, resource, notResource, statement.conditionMap(), principal, notPrincipal));
+    }
+}
+/**
+ * Extract opt-in Principal or NotPrincipal fields from a statement.
+ *
+ * @param statement the statement to inspect
+ * @param options conversion options controlling principal preservation
+ * @returns principal fields for a Permission constructor
+ */
+function principalFieldsFromStatement(statement, options) {
+    if (!options.includePrincipals) {
+        return { principal: undefined, notPrincipal: undefined };
+    }
+    const rawStatement = statement.toJSON();
+    if (statement.isPrincipalStatement()) {
+        return {
+            principal: statement.hasSingleWildcardPrincipal()
+                ? { wildcard: true }
+                : (0, principalConstraints_js_1.principalsFromRawPolicyValue)(rawStatement.Principal),
+            notPrincipal: undefined
+        };
+    }
+    if (statement.isNotPrincipalStatement()) {
+        return {
+            principal: undefined,
+            notPrincipal: statement.hasSingleWildcardNotPrincipal()
+                ? { wildcard: true }
+                : (0, principalConstraints_js_1.principalsFromRawPolicyValue)(rawStatement.NotPrincipal)
+        };
+    }
+    return { principal: undefined, notPrincipal: undefined };
+}
+/**
+ * Create a consistent key for any permission
+ *
+ * @param p the permission to create a key for
+ * @returns a string key that uniquely identifies the permission's resources and conditions
+ */
+function canonicalKey(p) {
+    // Sort resource arrays so ["B","A"] == ["A","B"]
+    const resources = p.resource?.slice().sort() ?? null;
+    const notResource = p.notResource?.slice().sort() ?? null;
+    // Canonicalize the condition map (lower-case keys already).
+    // We stringify with sorted keys so structurally-equal maps hash the same.
+    const canonicalCond = p.conditions
+        ? JSON.stringify(Object.fromEntries(Object.entries(p.conditions)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([op, kv]) => [
+            op,
+            Object.fromEntries(Object.entries(kv)
+                .sort(([a], [b]) => a.localeCompare(b))
+                .map(([k, v]) => [k, [...v].sort()]))
+        ])))
+        : null;
+    const principal = (0, principalConstraints_js_1.canonicalPrincipal)(p.principal);
+    const notPrincipal = (0, principalConstraints_js_1.canonicalPrincipal)(p.notPrincipal);
+    // Effect is fixed for the whole PermissionSet, so not needed in the key.
+    return JSON.stringify({ resources, notResource, principal, notPrincipal, canonicalCond });
+}
+/**
+ * Convert a PermissionSet into an array of IAM policy statements.
+ *
+ * @param set the PermissionSet to convert
+ * @returns an array of IAM policy statements
+ */
+function toPolicyStatements(set) {
+    const buckets = new Map();
+    for (const perm of set.getAllPermissions()) {
+        const key = canonicalKey(perm);
+        const bucket = buckets.get(key) ?? {
+            res: perm.resource ? [...perm.resource] : undefined,
+            notRes: perm.notResource ? [...perm.notResource] : undefined,
+            principal: perm.principal,
+            notPrincipal: perm.notPrincipal,
+            cond: perm.conditions ? perm.conditions : undefined,
+            actions: []
+        };
+        bucket.actions.push(`${perm.service}:${perm.action}`);
+        buckets.set(key, bucket);
+    }
+    // De-duplicate and sort Actions inside each bucket
+    const statements = [...buckets.values()].map((b) => {
+        const value = {
+            Effect: set.effect,
+            Action: b.actions.length === 1 ? b.actions[0] : [...new Set(b.actions)].sort()
+        };
+        if (b.principal && b.notPrincipal) {
+            throw new Error('Permission cannot have both Principal and NotPrincipal defined');
+        }
+        if (b.principal) {
+            value['Principal'] = (0, principalConstraints_js_1.principalsToPolicyValue)(b.principal);
+        }
+        else if (b.notPrincipal) {
+            value['NotPrincipal'] = (0, principalConstraints_js_1.principalsToPolicyValue)(b.notPrincipal);
+        }
+        if (b.cond) {
+            value['Condition'] = b.cond;
+        }
+        if (b.res && b.notRes) {
+            throw new Error('Permission cannot have both Resource and NotResource defined');
+        }
+        if (b.res) {
+            value['Resource'] = b.res;
+        }
+        else if (b.notRes) {
+            value['NotResource'] = b.notRes;
+        }
+        return value;
+    });
+    return statements;
+}
+//# sourceMappingURL=permissionSet.js.map

package/dist/cjs/principalCan/permissionSet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionSet.js","sourceRoot":"","sources":["../../../src/principalCan/permissionSet.ts"],"names":[],"mappings":";;;AAiUA,wEASC;AAED,gEAiBC;AAUD,kEA6CC;AAgFD,gDA8DC;AAliBD,wDAA4E;AAE5E,mDAA8F;AAC9F,uEAIkC;AAElC;;;;GAIG;AACH,MAAa,aAAa;IAGI;IAFpB,WAAW,GAAiD,EAAE,CAAA;IAEtE,YAA4B,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IAAG,CAAC;IAExD;;;;;OAKG;IACI,aAAa,CAAC,aAAyB;QAC5C,IAAI,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,qBAAqB,aAAa,CAAC,MAAM,wCAAwC,IAAI,CAAC,MAAM,EAAE,CAC/F,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAA;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAChC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;QACxC,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;QAC7D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACvC,OAAM;QACR,CAAC;QAED,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,IAAI,kBAAkB,GAAG,KAAK,CAAA;QAC9B,IAAI,KAAK,GAA2B,mBAAmB,CAAC,CAAC,CAAC,CAAA;QAC1D,IAAI,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YAC9C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;gBACxC,IAAI,iBAAiB,IAAI,KAAK,EAAE,CAAC;oBAC/B,wFAAwF;oBACxF,OAAM;gBACR,CAAC;gBACD,IAAI,iBAAiB,IAAI,aAAa,EAAE,CAAC;oBACvC,gBAAgB,GAAG,IAAI,CAAA;oBACvB,kFAAkF;gBACpF,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;oBACtC,kBAAkB,GAAG,IAAI,CAAA;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC5B,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;QAED,IAAI,gBAAgB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5C,2FAA2F;YAC3F,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC;aAAM,IAAI,CAAC,gBAAgB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACpD,2FAA2F;YAC3F,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,cAAc,CAAA;IACpD,CAAC;IAED;;;;;;OAMG;IACI,cAAc,CAAC,OAAe,EAAE,MAAc;QACnD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,OAAe;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,OAAe,EAAE,MAAc;QAC9C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3E,CAAC;IAED;;;OAGG;IACI,OAAO;QACZ,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;IACnD,CAAC;IAED;;;;OAIG;IACI,iBAAiB;QACtB,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAoB;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAExC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;oBAAE,SAAQ;gBAE/C,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC5D,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAE9D,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;oBAC7C,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;wBAC/C,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,CAAC,eAAe,CAAC,CAAA;wBACnE,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;4BAC/B,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;wBAC1B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;OAQG;IACI,QAAQ,CAAC,IAAmB;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;QAEzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,4DAA4D;gBAC5D,0EAA0E;gBAC1E,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;gBACnE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;gBACnF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;oBACrC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;wBACnC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;oBACpC,CAAC;oBACD,yEAAyE;oBACzE,sEAAsE;oBACtE,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;oBACjF,SAAQ;gBACV,CAAC;gBAED,IAAI,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAE5D,+HAA+H;gBAC/H,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;oBAC7C,MAAM,cAAc,GAAiB,EAAE,CAAA;oBACvC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;wBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;wBAC1D,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;4BAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gCAC5B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;4BAC3B,CAAC;iCAAM,CAAC;gCACN,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;4BAC7B,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,eAAe,GAAG,cAAc,CAAA;gBAClC,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAuC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;YAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AA/QD,sCA+QC;AAoCM,KAAK,UAAU,8BAA8B,CAClD,MAAwB,EACxB,QAAkB,EAClB,UAA8C,EAAE;IAEhD,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC1E,OAAO,aAAa,CAAA;AACtB,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAC9C,aAA4B,EAC5B,MAAwB,EACxB,QAAkB,EAClB,UAA8C,EAAE;IAEhD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,qEAAqE;QACrE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1C,SAAQ,CAAC,0CAA0C;YACrD,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/C,SAAQ,CAAC,qDAAqD;YAChE,CAAC;YACD,MAAM,2BAA2B,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,2BAA2B,CAC/C,SAAoB,EACpB,aAA4B,EAC5B,UAA8C,EAAE;IAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAsB,CAAA;IACrD,IAAI,gBAA0B,CAAA;IAC9B,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC5D,gBAAgB,GAAG,MAAM,IAAA,6BAAgB,EAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5C,gBAAgB,GAAG,MAAM,IAAA,6BAAgB,EAAC,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACzF,CAAC;SAAM,CAAC;QACN,OAAM;IACR,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnD,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;YAAE,SAAQ;QAErC,IAAI,QAAQ,GAAyB,SAAS,CAAA;QAC9C,IAAI,WAAW,GAAyB,SAAS,CAAA;QACjD,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACpC,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACxD,CAAC;aAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;YAC9C,WAAW,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC/C,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAA;QACtC,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,4BAA4B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAEpF,aAAa,CAAC,aAAa,CACzB,IAAI,0BAAU,CACZ,MAAM,EACN,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,CAAC,YAAY,EAAE,EACxB,SAAS,EACT,YAAY,CACb,CACF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CACnC,SAAoB,EACpB,OAA2C;IAE3C,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,CAAA;IACvC,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,SAAS,CAAC,0BAA0B,EAAE;gBAC/C,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,IAAA,sDAA4B,EAAC,YAAY,CAAC,SAAS,CAAC;YACxD,YAAY,EAAE,SAAS;SACxB,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,SAAS,CAAC,6BAA6B,EAAE;gBACrD,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,IAAA,sDAA4B,EAAC,YAAY,CAAC,YAAY,CAAC;SAC5D,CAAA;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAa;IACjC,iDAAiD;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IACpD,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IAEzD,4DAA4D;IAC5D,0EAA0E;IAC1E,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU;QAChC,CAAC,CAAC,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;aACzB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACjB,EAAE;YACF,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;iBACf,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACvC;SACF,CAAC,CACL,CACF;QACH,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,SAAS,GAAG,IAAA,4CAAkB,EAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACjD,MAAM,YAAY,GAAG,IAAA,4CAAkB,EAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAEvD,yEAAyE;IACzE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,GAAkB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAUpB,CAAA;IAEH,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;YACjC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACpD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACnD,OAAO,EAAE,EAAE;SACZ,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,mDAAmD;IACnD,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,KAAK,GAAQ;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;SAC/E,CAAA;QAED,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,KAAK,CAAC,WAAW,CAAC,GAAG,IAAA,iDAAuB,EAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;aAAM,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,CAAC,GAAG,IAAA,iDAAuB,EAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACX,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;QAC7B,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;QAC3B,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACjC,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/cjs/principalCan/principalCan.d.ts

@@ -0,0 +1,26 @@
+import { IamCollectClient } from '../collect/client.js';
+/**
+ * Input for the can-what command.
+ */
+export interface PrincipalCanInput {
+    /**
+     * The ARN of the principal to check permissions for.
+     */
+    principal: string;
+    /**
+     * Whether to shrink action lists in the resulting policy document.
+     */
+    shrinkActionLists: boolean;
+}
+/**
+ * Get what actions a principal can perform based on their policies.
+ *
+ * @param collectClient the IAM collect client to use for retrieving policies.
+ * @param input the input containing the principal and options.
+ * @returns A promise that resolves to the permissions the principal can perform, or void if the implementation is incomplete.
+ */
+export declare function principalCan(collectClient: IamCollectClient, input: PrincipalCanInput): Promise<{
+    Version: string;
+    Statement: any[];
+}>;
+//# sourceMappingURL=principalCan.d.ts.map

package/dist/cjs/principalCan/principalCan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalCan.d.ts","sourceRoot":"","sources":["../../../src/principalCan/principalCan.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAmBvD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;OAEG;IACH,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,aAAa,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB;;;GAwO3F"}