@actsecurity/iam-policy 0.1.109

package/README.md

@@ -0,0 +1,244 @@
+# IAM Policy Syntax Validator and Parser
+
+[![NPM Version](https://img.shields.io/npm/v/@cloud-copilot/iam-policy.svg?logo=nodedotjs)](https://www.npmjs.com/package/@cloud-copilot/iam-policy) [![License: AGPL v3](https://img.shields.io/github/license/cloud-copilot/iam-policy)](LICENSE.txt) [![GuardDog](https://github.com/cloud-copilot/iam-policy/actions/workflows/guarddog.yml/badge.svg)](https://github.com/cloud-copilot/iam-policy/actions/workflows/guarddog.yml) [![Known Vulnerabilities](https://snyk.io/test/github/cloud-copilot/iam-policy/badge.svg?targetFile=package.json&style=flat-square)](https://snyk.io/test/github/cloud-copilot/iam-policy?targetFile=package.json)
+
+This is a simple IAM policy library that allows you to safely parse and navigate IAM policies without worrying about the more difficult details of parsing policies or validating syntax.
+
+This may be updated in the future to allow modifying policies, right now it's read-only.
+
+## Validate Policy Syntax with `validatePolicySyntax`
+
+`validatePolicySyntax` is a syntax linter and will not validate the the policy is logical, secure, or correct.
+
+This will take any object and return back an array of findings. If the array is empty then the policy is valid.
+
+```typescript
+import { validatePolicySyntax } from '@cloud-copilot/iam-policy'
+
+validatePolicySyntax({
+  Version: '2012-10-17',
+  Statement: [
+    {
+      Sid: 'VisualEditor0',
+      Effect: 'Allow',
+      Action: 's3:GetObject',
+      Resource: 'arn:aws:s3:::mybucket/*'
+    }
+  ]
+}) // []
+
+validatePolicySyntax({
+  Version: '2012-10-17',
+  Statement: [
+    {
+      Sid: 7,
+      Effect: 'Allow',
+      Action: 's3:GetObject',
+      Resource: 'arn:aws:s3:::mybucket/*'
+    }
+  ]
+}) // [{ message: 'Found data type number allowed type(s) are string', path: 'Statement[0].Sid'}]
+
+/* It will attempt to find as many issues as possible in one pass */
+validatePolicySyntax({
+  Version: '2012-10-17',
+  Comment: 'Jacob is kewl',
+  Statement: [
+    {
+      Sid: 'SomeStatement',
+      Effect: 7,
+      Action: 's3:GetObject',
+      Resource: 'arn:aws:s3:::mybucket/*'
+    },
+    {
+      Sid: 'SomeStatement',
+      Effect: ['Allow'],
+      Action: 's3:GetObject',
+      Resource: 'arn:aws:s3:::mybucket/*',
+      Condition: {
+        NumericLessThan: {
+          's3:max-keys': 7
+        },
+        StringLike: {
+          's3:authType': new RegExp(/REST.*/),
+          'aws:TagKeys/Foo': ['Bar*', 'Baz*']
+        }
+      }
+    }
+  ]
+}) /*
+[
+  { message: 'Invalid key Comment', path: 'Comment' },
+  { message: 'Effect must be present and exactly "Allow" or "Deny"', path: 'Statement[0].Effect' },
+  { message: 'Effect must be present and exactly "Allow" or "Deny"', path: 'Statement[1].Effect' },
+  { message: 'Found data type object allowed type(s) are string, boolean, number', path: 'Statement[1].Condition.StringLike.s3:authType' }
+]
+*/
+```
+
+### Validate Specific Policy Types
+
+There are functions to validate specific policy types, these do all of the general policy validation and additional checks for the specific policy type. For instance Service Control Policies only allow the Condition element when the Effect is Deny.
+
+- `validateIdentityPolicy(policy: any): ValidationError[]`
+- `validateServiceControlPolicy(policy: any): ValidationError[]`
+- `validateResourcePolicy(policy: any): ValidationError[]`
+- `validateTrustPolicy(policy: any): ValidationError[]`
+- `validateResourceControlPolicy(policy: any): ValidationError[]`
+- `validateEndpointPolicy(policy: any): ValidationError[]`
+- `validateSessionPolicy(policy: any): ValidationError[]`
+
+## IAM Policy Parsing and Processing with `loadPolicy`
+
+`loadPolicy` _**does not validate policies**_, if you want validation ahead of time use `validatePolicySyntax`.
+
+### Normalizes Policy Elements that are Objects/Array of Objects or String/Array of Strings
+
+```typescript
+import { loadPolicy } from '@cloud-copilot/iam-policy'
+
+//Statement can be an array of objects
+const policyOne = {
+  Version: '2012-10-17',
+  Statement: [
+    {
+      Sid: 'ArrayStatement',
+      Effect: 'Allow',
+      Action: ['s3:GetObject'],
+      Resource: 'arn:aws:s3:::government-secrets/*'
+    }
+  ]
+}
+
+//Statement can also be a single object
+const policyTwo = {
+  Version: '2012-10-17',
+  Statement: {
+    Sid: 'ObjectStatement',
+    Effect: 'Allow',
+    Action: ['s3:GetObject'],
+    Resource: 'arn:aws:s3:::government-secrets/*'
+  }
+}
+
+//In both cases you can use the `statements` function to get an array of statements
+const p1 = loadPolicy(policyOne)
+const p2 = loadPolicy(policyTwo)
+console.log(p1.statements()[0].sid()) //ArrayStatement
+console.log(p2.statements()[0].sid()) //ObjectStatement
+```
+
+There is similar support for condition values, principals, and resources.
+
+### Mutually Exclusive or Optional Policy Elements
+
+In IAM policies there are some elements that are mutually exclusive. For example, you can't have a `Principal` and a `NotPrincipal` in the same statement. Some elements are completely optional. We leverage the Typescript type system to make sure you only access data that is confirmed to exist in the policy.
+
+```typescript
+import{ loadPolicy } from '@cloud-copilot/iam-policy'
+
+const actionPolicy = {
+  "Version": "2012-10-17",
+  "Statement": {
+    "Effect": "Allow",
+    "Action": [
+      "s3:GetObject",
+    ],
+    "Resource": "arn:aws:s3:::government-secrets/*"
+  }
+};
+
+const p = loadPolicy(actionPolicy);
+const statement = p.statements()[0]; // Get the first statement out
+
+statement.actions() // Compile time error because Statement does not the `actions` function
+
+if(statement.isActionStatement()) {
+  // Type is narrowed to ActionStatement so `actions` is now available
+  statement.actions() /
+}
+
+if(statement.isNotActionStatement()) {
+  // Will not exectue because the statement does not have a NotAction element
+}
+```
+
+`isNotActionStatement` checks for the presence of the NotAction element and is not the inverse of `isActionStatement`. It's possible for a statement to return false for both `isActionStatement` and `isNotActionStatement` if both elements are absent in the statement.
+
+There is similar support for `Action`, `NotAction`, `Principal`, `NotPrincipal`, `Resource`, and `NotResource` elements.
+
+### Flatten Complex Structures
+
+Simplifies complex elements by flattening them into an array of homogenous objects. For example the Principal value can be a string or an object; the object values can be strings or arrays of strings. We flatten those into an array of objects similar to what you would define in a terraform policy.
+
+```typescript
+import { loadPolicy } from '@cloud-copilot/iam-policy'
+
+const principalPolicy = {
+  Version: '2012-10-17',
+  Statement: {
+    Effect: 'Allow',
+    Principal: {
+      AWS: ['arn:aws:iam::123456789012:root', 'arn:aws:iam::123456789013:user/FoxMulder'],
+      CanonicalUser: '79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be',
+      Federated: 'cognito-identity.amazonaws.com'
+    },
+    Action: ['s3:GetObject'],
+    Resource: 'arn:aws:s3:::government-secrets/*'
+  }
+}
+
+const p = loadPolicy(principalPolicy)
+
+const statement = p.statements()[0] // Get the first statement out
+if (statement.isPrincipalStatement()) {
+  //Get an array of 4 Principal objects with a type and value
+  const principals = statement.principals()
+  principals[0].type() //AWS
+  principals[0].value() //arn:aws:iam::123456789012:root
+  //and so on
+  principals[3].type() //Federated
+  principals[3].value() //cognito-identity.amazonaws.com
+}
+```
+
+There is similar flattening for the `Condition` element.
+
+```typescript
+import { loadPolicy } from '@cloud-copilot/iam-policy'
+
+const principalPolicy = {
+  Version: '2012-10-17',
+  Statement: {
+    Effect: 'Allow',
+    Principal: {
+      AWS: 'arn:aws:iam::123456789012:root'
+    },
+    Action: ['s3:GetObject'],
+    Resource: 'arn:aws:s3:::government-secrets/*',
+    Condition: {
+      StringEquals: {
+        's3:prefix': 'home/${aws:username}',
+        'aws:PrincipalOrgID': 'o-1234567890'
+      },
+      StringLike: {
+        's3:authType': 'REST*',
+        'aws:TagKeys/Foo': ['Bar*', 'Baz*']
+      }
+    }
+  }
+}
+
+const p = loadPolicy(principalPolicy)
+
+const statement = p.statements()[0] // Get the first statement out
+
+const conditions = statement.conditions()
+conditions[0].operation().value() //StringEquals
+conditions[0].conditionKey() //s3:prefix
+conditions[0].conditionValues() //[ home/${aws:username} ]
+//and so on
+conditions[3].operation().value() //StringLike
+conditions[3].conditionKey() //aws:TagKeys/Foo
+conditions[3].conditionValues() // [Bar*, Baz*]
+```

package/dist/cjs/actions/action.d.ts

@@ -0,0 +1,68 @@
+export type ActionType = 'service' | 'wildcard';
+/**
+ * An Action string in an IAM policy
+ */
+export interface Action {
+    /**
+     * The type of actions
+     */
+    type(): ActionType;
+    /**
+     * The raw string of the action
+     */
+    value(): string;
+    /**
+     * Whether the action is a wildcard action: `"*"`
+     */
+    isWildcardAction(): this is WildcardAction;
+    /**
+     * Whether the action is a service action: `"service:Action"`
+     */
+    isServiceAction(): this is ServiceAction;
+    /**
+     * The path to the action string in the policy
+     */
+    path(): string;
+}
+/**
+ * A wildcard action: `"*"`
+ */
+export interface WildcardAction extends Action {
+    /**
+     * The wildcard character `"*"`
+     *
+     * This mainly exists to differentiate between this interface and the Action interface
+     */
+    wildcardValue(): '*';
+}
+/**
+ * A service action: `"service:Action"`
+ */
+export interface ServiceAction extends Action {
+    /**
+     * The service of the action
+     *
+     * Guaranteed to be lowercase
+     */
+    service(): string;
+    /**
+     * The action within the service
+     */
+    action(): string;
+}
+export declare class ActionImpl implements Action, WildcardAction, ServiceAction {
+    private readonly rawValue;
+    private readonly otherProps;
+    constructor(rawValue: string, otherProps: {
+        path: string;
+    });
+    path(): string;
+    type(): ActionType;
+    wildcardValue(): '*';
+    value(): string;
+    isWildcardAction(): this is WildcardAction;
+    isServiceAction(): this is ServiceAction;
+    service(): string;
+    action(): string;
+}
+//# sourceMappingURL=action.d.ts.map

package/dist/cjs/actions/action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/actions/action.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,CAAA;AAE/C;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,IAAI,IAAI,UAAU,CAAA;IAElB;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;OAEG;IACH,gBAAgB,IAAI,IAAI,IAAI,cAAc,CAAA;IAE1C;;OAEG;IACH,eAAe,IAAI,IAAI,IAAI,aAAa,CAAA;IAExC;;OAEG;IACH,IAAI,IAAI,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,MAAM;IAC5C;;;;OAIG;IACH,aAAa,IAAI,GAAG,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC3C;;;;OAIG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;CACjB;AAED,qBAAa,UAAW,YAAW,MAAM,EAAE,cAAc,EAAE,aAAa;IAEpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAA;KACb;IAGI,IAAI,IAAI,MAAM;IAId,IAAI,IAAI,UAAU;IAOlB,aAAa,IAAI,GAAG;IAIpB,KAAK,IAAI,MAAM;IAIf,gBAAgB,IAAI,IAAI,IAAI,cAAc;IAI1C,eAAe,IAAI,IAAI,IAAI,aAAa;IAIxC,OAAO,IAAI,MAAM;IAIjB,MAAM,IAAI,MAAM;CAGxB"}

package/dist/cjs/actions/action.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionImpl = void 0;
+const utils_js_1 = require("../utils.js");
+class ActionImpl {
+    rawValue;
+    otherProps;
+    constructor(rawValue, otherProps) {
+        this.rawValue = rawValue;
+        this.otherProps = otherProps;
+    }
+    path() {
+        return this.otherProps.path;
+    }
+    type() {
+        if ((0, utils_js_1.isAllWildcards)(this.rawValue)) {
+            return 'wildcard';
+        }
+        return 'service';
+    }
+    wildcardValue() {
+        return '*';
+    }
+    value() {
+        return this.rawValue;
+    }
+    isWildcardAction() {
+        return this.type() === 'wildcard';
+    }
+    isServiceAction() {
+        return this.type() === 'service';
+    }
+    service() {
+        return (0, utils_js_1.delimitedSegmentAt)(this.rawValue, ':', 0).toLowerCase();
+    }
+    action() {
+        return (0, utils_js_1.delimitedSegmentAt)(this.rawValue, ':', 1);
+    }
+}
+exports.ActionImpl = ActionImpl;
+//# sourceMappingURL=action.js.map

package/dist/cjs/actions/action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../../../src/actions/action.ts"],"names":[],"mappings":";;;AAAA,0CAAgE;AA+DhE,MAAa,UAAU;IAEF;IACA;IAFnB,YACmB,QAAgB,EAChB,UAEhB;QAHgB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,eAAU,GAAV,UAAU,CAE1B;IACA,CAAC;IAEG,IAAI;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;IAC7B,CAAC;IAEM,IAAI;QACT,IAAI,IAAA,yBAAc,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,aAAa;QAClB,OAAO,GAAG,CAAA;IACZ,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAEM,gBAAgB;QACrB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,UAAU,CAAA;IACnC,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,CAAA;IAClC,CAAC;IAEM,OAAO;QACZ,OAAO,IAAA,6BAAkB,EAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAE,CAAC,WAAW,EAAE,CAAA;IACjE,CAAC;IAEM,MAAM;QACX,OAAO,IAAA,6BAAkB,EAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAE,CAAA;IACnD,CAAC;CACF;AA1CD,gCA0CC"}

package/dist/cjs/conditions/condition.d.ts

@@ -0,0 +1,62 @@
+import { type ConditionOperation } from './conditionOperation.js';
+export interface Condition {
+    /**
+     * Returns the operation of the condition. For example "StringEquals" or "StringLike".
+     *
+     * @returns the operation of the condition.
+     */
+    operation(): ConditionOperation;
+    /**
+     * Returns the key of the condition. For example "aws:PrincipalOrgID".
+     *
+     * @returns the condition key of the action
+     */
+    conditionKey(): string;
+    /**
+     * Returns the values of the condition. For example ["o-1234567890abcdef0"].
+     * Boolean literals in the policy are converted to their string equivalents.
+     *
+     * @returns the values of the condition.
+     */
+    conditionValues(): string[];
+    /**
+     * Checks if the the condition values are an array.
+     *
+     * @returns true if the condition values are an array, false otherwise.
+     */
+    valueIsArray(): boolean;
+    /**
+     * Returns the path to the operator key in the policy.
+     */
+    operatorKeyPath(): string;
+    /**
+     * Returns the path to the operator value in the policy.
+     */
+    operatorValuePath(): string;
+    /**
+     * Returns the path to the condition key for the policy.
+     */
+    keyPath(): string;
+    /**
+     * Returns the path to the condition values in the policy.
+     */
+    valuesPath(): string;
+}
+export declare class ConditionImpl implements Condition {
+    private readonly op;
+    private readonly key;
+    private readonly values;
+    private readonly otherProps;
+    constructor(op: string, key: string, values: string | boolean | (string | boolean)[], otherProps: {
+        conditionPath: string;
+    });
+    operation(): ConditionOperation;
+    conditionKey(): string;
+    conditionValues(): string[];
+    valueIsArray(): boolean;
+    operatorKeyPath(): string;
+    operatorValuePath(): string;
+    keyPath(): string;
+    valuesPath(): string;
+}
+//# sourceMappingURL=condition.d.ts.map

package/dist/cjs/conditions/condition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../../src/conditions/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,kBAAkB,EAA0B,MAAM,yBAAyB,CAAA;AAEzF,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,SAAS,IAAI,kBAAkB,CAAA;IAE/B;;;;OAIG;IACH,YAAY,IAAI,MAAM,CAAA;IAEtB;;;;;OAKG;IACH,eAAe,IAAI,MAAM,EAAE,CAAA;IAE3B;;;;OAIG;IACH,YAAY,IAAI,OAAO,CAAA;IAEvB;;OAEG;IACH,eAAe,IAAI,MAAM,CAAA;IAEzB;;OAEG;IACH,iBAAiB,IAAI,MAAM,CAAA;IAE3B;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,UAAU,IAAI,MAAM,CAAA;CACrB;AAED,qBAAa,aAAc,YAAW,SAAS;IAE3C,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAHV,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,EAC/C,UAAU,EAAE;QAC3B,aAAa,EAAE,MAAM,CAAA;KACtB;IAGI,SAAS,IAAI,kBAAkB;IAI/B,YAAY,IAAI,MAAM;IAItB,eAAe,IAAI,MAAM,EAAE;IAK3B,YAAY,IAAI,OAAO;IAIvB,eAAe,IAAI,MAAM;IAIzB,iBAAiB,IAAI,MAAM;IAI3B,OAAO,IAAI,MAAM;IAIjB,UAAU,IAAI,MAAM;CAG5B"}

package/dist/cjs/conditions/condition.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConditionImpl = void 0;
+const conditionOperation_js_1 = require("./conditionOperation.js");
+class ConditionImpl {
+    op;
+    key;
+    values;
+    otherProps;
+    constructor(op, key, values, otherProps) {
+        this.op = op;
+        this.key = key;
+        this.values = values;
+        this.otherProps = otherProps;
+    }
+    operation() {
+        return new conditionOperation_js_1.ConditionOperationImpl(this.op);
+    }
+    conditionKey() {
+        return this.key;
+    }
+    conditionValues() {
+        const values = Array.isArray(this.values) ? this.values : [this.values];
+        return values.map((v) => String(v));
+    }
+    valueIsArray() {
+        return Array.isArray(this.values);
+    }
+    operatorKeyPath() {
+        return `${this.otherProps.conditionPath}.#${this.op}`;
+    }
+    operatorValuePath() {
+        return `${this.otherProps.conditionPath}.${this.op}`;
+    }
+    keyPath() {
+        return `${this.otherProps.conditionPath}.${this.op}.#${this.key}`;
+    }
+    valuesPath() {
+        return `${this.otherProps.conditionPath}.${this.op}.${this.key}`;
+    }
+}
+exports.ConditionImpl = ConditionImpl;
+//# sourceMappingURL=condition.js.map

package/dist/cjs/conditions/condition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.js","sourceRoot":"","sources":["../../../src/conditions/condition.ts"],"names":[],"mappings":";;;AAAA,mEAAyF;AAqDzF,MAAa,aAAa;IAEL;IACA;IACA;IACA;IAJnB,YACmB,EAAU,EACV,GAAW,EACX,MAA+C,EAC/C,UAEhB;QALgB,OAAE,GAAF,EAAE,CAAQ;QACV,QAAG,GAAH,GAAG,CAAQ;QACX,WAAM,GAAN,MAAM,CAAyC;QAC/C,eAAU,GAAV,UAAU,CAE1B;IACA,CAAC;IAEG,SAAS;QACd,OAAO,IAAI,8CAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5C,CAAC;IAEM,YAAY;QACjB,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAEM,eAAe;QACpB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,CAAC;IAEM,YAAY;QACjB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAEM,eAAe;QACpB,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,EAAE,EAAE,CAAA;IACvD,CAAC;IAEM,iBAAiB;QACtB,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,EAAE,CAAA;IACtD,CAAC;IAEM,OAAO;QACZ,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAA;IACnE,CAAC;IAEM,UAAU;QACf,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IAClE,CAAC;CACF;AA1CD,sCA0CC"}

package/dist/cjs/conditions/conditionOperation.d.ts

@@ -0,0 +1,31 @@
+export type SetOperator = 'ForAllValues' | 'ForAnyValue';
+/**
+ * ConditionOperation is a string that represents the operation of a condition.
+ */
+export interface ConditionOperation {
+    /**
+     * Returns the set modifier if present.
+     */
+    setOperator(): SetOperator | undefined;
+    /**
+     * Returns the base operator of the condition without the set modifier or IfExists.
+     */
+    baseOperator(): string;
+    /**
+     * Returns true if the condition operation ends with IfExists.
+     */
+    isIfExists(): boolean;
+    /**
+     * Returns the raw string of the condition operation.
+     */
+    value(): string;
+}
+export declare class ConditionOperationImpl implements ConditionOperation {
+    private readonly op;
+    constructor(op: string);
+    setOperator(): SetOperator | undefined;
+    isIfExists(): boolean;
+    baseOperator(): string;
+    value(): string;
+}
+//# sourceMappingURL=conditionOperation.d.ts.map

package/dist/cjs/conditions/conditionOperation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditionOperation.d.ts","sourceRoot":"","sources":["../../../src/conditions/conditionOperation.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,aAAa,CAAA;AAExD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,WAAW,IAAI,WAAW,GAAG,SAAS,CAAA;IAEtC;;OAEG;IACH,YAAY,IAAI,MAAM,CAAA;IAEtB;;OAEG;IACH,UAAU,IAAI,OAAO,CAAA;IAErB;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;CAChB;AAID,qBAAa,sBAAuB,YAAW,kBAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,MAAM;IAEhC,WAAW,IAAI,WAAW,GAAG,SAAS;IAatC,UAAU,IAAI,OAAO;IAIrB,YAAY,IAAI,MAAM;IAQtB,KAAK,IAAI,MAAM;CAGvB"}

package/dist/cjs/conditions/conditionOperation.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConditionOperationImpl = void 0;
+const utils_js_1 = require("../utils.js");
+const ifExistsSlice = 'IfExists'.length * -1;
+class ConditionOperationImpl {
+    op;
+    constructor(op) {
+        this.op = op;
+    }
+    setOperator() {
+        if (!this.op.includes(':')) {
+            return undefined;
+        }
+        const setOp = (0, utils_js_1.delimitedSegmentAt)(this.op, ':', 0);
+        if ((0, utils_js_1.caseInsensitiveEquals)(setOp, 'ForAllValues')) {
+            return 'ForAllValues';
+        }
+        else if ((0, utils_js_1.caseInsensitiveEquals)(setOp, 'ForAnyValue')) {
+            return 'ForAnyValue';
+        }
+        throw new Error(`Unknown set operator: ${setOp}`);
+    }
+    isIfExists() {
+        return (0, utils_js_1.caseInsensitiveEndsWith)(this.op, 'IfExists');
+    }
+    baseOperator() {
+        const base = (0, utils_js_1.lastDelimitedSegment)(this.op, ':');
+        if ((0, utils_js_1.caseInsensitiveEndsWith)(base, 'IfExists')) {
+            return base.slice(0, ifExistsSlice);
+        }
+        return base;
+    }
+    value() {
+        return this.op;
+    }
+}
+exports.ConditionOperationImpl = ConditionOperationImpl;
+//# sourceMappingURL=conditionOperation.js.map

package/dist/cjs/conditions/conditionOperation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditionOperation.js","sourceRoot":"","sources":["../../../src/conditions/conditionOperation.ts"],"names":[],"mappings":";;;AAAA,0CAKoB;AA6BpB,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAE5C,MAAa,sBAAsB;IACJ;IAA7B,YAA6B,EAAU;QAAV,OAAE,GAAF,EAAE,CAAQ;IAAG,CAAC;IAEpC,WAAW;QAChB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAE,CAAA;QAClD,IAAI,IAAA,gCAAqB,EAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;YACjD,OAAO,cAAc,CAAA;QACvB,CAAC;aAAM,IAAI,IAAA,gCAAqB,EAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;YACvD,OAAO,aAAa,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;IAEM,UAAU;QACf,OAAO,IAAA,kCAAuB,EAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAEM,YAAY;QACjB,MAAM,IAAI,GAAG,IAAA,+BAAoB,EAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/C,IAAI,IAAA,kCAAuB,EAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;CACF;AA/BD,wDA+BC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,13 @@
+export type { Action, ActionType, ServiceAction, WildcardAction } from './actions/action.js';
+export type { Condition } from './conditions/condition.js';
+export type { ConditionOperation, SetOperator } from './conditions/conditionOperation.js';
+export { loadPolicy } from './parser.js';
+export type { Policy } from './policies/policy.js';
+export type { AccountPrincipal, AwsPrincipal, CanonicalUserPrincipal, FederatedPrincipal, Principal, PrincipalType, ServicePrincipal, WildcardPrincipal } from './principals/principal.js';
+export type { Resource, ArnResource } from './resources/resource.js';
+export type { ActionStatement, NotActionStatement, NotPrincipalStatement, NotResourceStatement, PrincipalStatement, ResourceStatement, Statement } from './statements/statement.js';
+export { lintPolicy, lintResourcePolicy } from './lint/lint.js';
+export { createValidatedPolicy, isValidatedPolicy, type ValidatedPolicy } from './validatedPolicy.js';
+export { validatePolicySyntax, type ValidationError } from './validate/validate.js';
+export { validateEndpointPolicy, validateIdentityPolicy, validateResourceControlPolicy, validateResourcePolicy, validateServiceControlPolicy, validateSessionPolicy, validateTrustPolicy } from './validate/validateTypes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC5F,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAA;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACpE,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACV,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACnF,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,6BAA6B,CAAA"}

package/dist/cjs/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateTrustPolicy = exports.validateSessionPolicy = exports.validateServiceControlPolicy = exports.validateResourcePolicy = exports.validateResourceControlPolicy = exports.validateIdentityPolicy = exports.validateEndpointPolicy = exports.validatePolicySyntax = exports.isValidatedPolicy = exports.createValidatedPolicy = exports.lintResourcePolicy = exports.lintPolicy = exports.loadPolicy = void 0;
+var parser_js_1 = require("./parser.js");
+Object.defineProperty(exports, "loadPolicy", { enumerable: true, get: function () { return parser_js_1.loadPolicy; } });
+var lint_js_1 = require("./lint/lint.js");
+Object.defineProperty(exports, "lintPolicy", { enumerable: true, get: function () { return lint_js_1.lintPolicy; } });
+Object.defineProperty(exports, "lintResourcePolicy", { enumerable: true, get: function () { return lint_js_1.lintResourcePolicy; } });
+var validatedPolicy_js_1 = require("./validatedPolicy.js");
+Object.defineProperty(exports, "createValidatedPolicy", { enumerable: true, get: function () { return validatedPolicy_js_1.createValidatedPolicy; } });
+Object.defineProperty(exports, "isValidatedPolicy", { enumerable: true, get: function () { return validatedPolicy_js_1.isValidatedPolicy; } });
+var validate_js_1 = require("./validate/validate.js");
+Object.defineProperty(exports, "validatePolicySyntax", { enumerable: true, get: function () { return validate_js_1.validatePolicySyntax; } });
+var validateTypes_js_1 = require("./validate/validateTypes.js");
+Object.defineProperty(exports, "validateEndpointPolicy", { enumerable: true, get: function () { return validateTypes_js_1.validateEndpointPolicy; } });
+Object.defineProperty(exports, "validateIdentityPolicy", { enumerable: true, get: function () { return validateTypes_js_1.validateIdentityPolicy; } });
+Object.defineProperty(exports, "validateResourceControlPolicy", { enumerable: true, get: function () { return validateTypes_js_1.validateResourceControlPolicy; } });
+Object.defineProperty(exports, "validateResourcePolicy", { enumerable: true, get: function () { return validateTypes_js_1.validateResourcePolicy; } });
+Object.defineProperty(exports, "validateServiceControlPolicy", { enumerable: true, get: function () { return validateTypes_js_1.validateServiceControlPolicy; } });
+Object.defineProperty(exports, "validateSessionPolicy", { enumerable: true, get: function () { return validateTypes_js_1.validateSessionPolicy; } });
+Object.defineProperty(exports, "validateTrustPolicy", { enumerable: true, get: function () { return validateTypes_js_1.validateTrustPolicy; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAGA,yCAAwC;AAA/B,uGAAA,UAAU,OAAA;AAsBnB,0CAA+D;AAAtD,qGAAA,UAAU,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AACvC,2DAI6B;AAH3B,2HAAA,qBAAqB,OAAA;AACrB,uHAAA,iBAAiB,OAAA;AAGnB,sDAAmF;AAA1E,mHAAA,oBAAoB,OAAA;AAC7B,gEAQoC;AAPlC,0HAAA,sBAAsB,OAAA;AACtB,0HAAA,sBAAsB,OAAA;AACtB,iIAAA,6BAA6B,OAAA;AAC7B,0HAAA,sBAAsB,OAAA;AACtB,gIAAA,4BAA4B,OAAA;AAC5B,yHAAA,qBAAqB,OAAA;AACrB,uHAAA,mBAAmB,OAAA"}

package/dist/cjs/lint/lint.d.ts

@@ -0,0 +1,41 @@
+import { type ValidationCallbacks, type ValidationError } from '../validate/validate.js';
+/**
+ * Lints an IAM policy document by running all syntax validation checks from
+ * {@link validatePolicySyntax} plus additional best-practice checks that AWS
+ * technically allows but that may indicate authoring mistakes.
+ *
+ * @param policyDocument - the raw policy document object to lint
+ * @param validationCallbacks - optional callbacks to customize validation behavior per policy type
+ * @returns an array of validation errors including both syntax errors and lint warnings
+ */
+export declare function lintPolicy(policyDocument: any, validationCallbacks?: ValidationCallbacks): ValidationError[];
+/**
+ * Lints a resource policy document. Runs the resource-policy syntax validation
+ * plus the generic lint rules and the resource-policy-specific check for
+ * statements missing both `Principal` and `NotPrincipal`. AWS accepts such
+ * statements syntactically, but they can never match a request.
+ *
+ * @param policyDocument - the raw resource policy document to lint
+ * @returns an array of validation errors including syntax errors and lint warnings
+ */
+export declare function lintResourcePolicy(policyDocument: any): ValidationError[];
+/**
+ * Finds actions in a policy document that have the format "service:" — a
+ * service prefix followed by a colon but no action name. AWS allows this
+ * but it likely indicates an authoring mistake.
+ *
+ * @param policyDocument - the raw policy document object to check
+ * @returns an array of validation errors, one for each action that has an empty action part
+ */
+export declare function findEmptyActions(policyDocument: any): ValidationError[];
+/**
+ * Finds duplicate Statement Ids (Sid) within a policy document.
+ *
+ * AWS allows duplicate Sids in resource policies, but they can indicate
+ * copy-paste mistakes or authoring errors.
+ *
+ * @param policyDocument - the raw policy document object to check
+ * @returns an array of validation errors, one for each statement that shares a duplicate Sid
+ */
+export declare function findDuplicateSids(policyDocument: any): ValidationError[];
+//# sourceMappingURL=lint.d.ts.map

package/dist/cjs/lint/lint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/lint/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAA;AAGhC;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,cAAc,EAAE,GAAG,EACnB,mBAAmB,GAAE,mBAAwB,GAC5C,eAAe,EAAE,CAKnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,GAAG,GAAG,eAAe,EAAE,CAMzE;AAiFD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,GAAG,GAAG,eAAe,EAAE,CAoCvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,GAAG,GAAG,eAAe,EAAE,CA8BxE"}