@actsecurity/iam-simulate 0.1.173

package/dist/cjs/services/DefaultServiceAuthorizer.d.ts

@@ -0,0 +1,182 @@
+import { type AllowedConditionExpression, type EvaluationResult, type RequestAnalysis, type ResourceAnalysis } from '../evaluate.js';
+import { type RequestResource } from '../request/requestResource.js';
+import { type StatementAnalysis } from '../StatementAnalysis.js';
+import { type ServiceAuthorizationRequest, type ServiceAuthorizer } from './ServiceAuthorizer.js';
+export type PrincipalAccountTrust = {
+    trustType: 'Implicit';
+} | {
+    trustType: 'Explicit';
+    statements: StatementAnalysis[];
+} | {
+    trustType: 'None';
+};
+/**
+ * The default authorizer for services.
+ */
+export declare class DefaultServiceAuthorizer implements ServiceAuthorizer {
+    /**
+     * Authorize a service request after all policy analysis has been completed.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns the result of the authorization
+     */
+    authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
+    /**
+     * Authorize an anonymous request after all policy analysis has been completed.
+     *
+     * @param request the service authorization request containing all analyses.
+     * @param baseResult the common request-analysis fields to include in the result.
+     * @returns the anonymous request authorization result.
+     */
+    private authorizeAnonymousRequest;
+    /**
+     * Evaluates whether an anonymous request has the resource-side grant required to be allowed.
+     *
+     * @param request the service authorization request containing all analyses.
+     * @returns the core anonymous result before applicable resource-side guardrails are applied.
+     */
+    private anonymousInitialEvaluationResult;
+    /**
+     * Determines if the service trusts the principal's Account's IAM policies
+     *
+     * @param sameAccount - If the principal and resource are in the same account
+     * @param resourceAnalysis - The resource policy analysis
+     * @returns true if the service trusts the principal's account IAM policies
+     */
+    serviceTrustsPrincipalAccount(sameAccount: boolean, resourceAnalysis: ResourceAnalysis, resource: RequestResource): PrincipalAccountTrust;
+    /**
+     * Combine core authorization conditions with guardrail conditions for a final allowed result.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param coreConditions the conditions for the core service authorization decision after permission-boundary mutation
+     * @param finalResult the final authorization result after guardrails
+     * @returns the public conditions expression, or undefined when none should be emitted
+     */
+    protected conditionsForAllowedResult(request: ServiceAuthorizationRequest, coreConditions: AllowedConditionExpression, finalResult: EvaluationResult): AllowedConditionExpression | undefined;
+    /**
+     * Apply permission-boundary effects to the core authorization conditions.
+     *
+     * Permission boundaries are not part of the core service authorization result. This function lives
+     * with the permission-boundary authorization checks and recalculates the affected condition paths
+     * only when permission-boundary behavior changes which core path can be used.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param sameAccount whether the principal and resource are in the same account
+     * @param coreConditions the unmodified core authorization conditions
+     * @returns the permission-boundary block result, if any, and updated core conditions
+     */
+    private applyPermissionBoundaryToCoreConditions;
+    /**
+     * Recalculate core conditions when an allowed permission boundary constrains identity-policy paths.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param sameAccount whether the principal and resource are in the same account
+     * @returns core conditions with permission-boundary allow conditions applied to identity paths
+     */
+    private coreConditionsWithAllowedPermissionBoundary;
+    /**
+     * Recalculate same-account conditions when an allowed permission boundary constrains identity paths.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param trustedAccount how the service trusts the principal account for this request
+     * @returns same-account core conditions with permission-boundary allow conditions applied to identity paths
+     */
+    private sameAccountConditionsWithAllowedPermissionBoundary;
+    /**
+     * Recalculate same-account implicit trust conditions when permission-boundary allow constrains identity paths.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns same-account implicit trust conditions with permission-boundary allow conditions applied to identity paths
+     */
+    private sameAccountImplicitTrustConditionsWithAllowedPermissionBoundary;
+    /**
+     * Recalculate same-account explicit trust conditions when permission-boundary allow constrains identity paths.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param trustedAccount explicit account-trust statements selected by the service authorizer
+     * @returns same-account explicit trust conditions with permission-boundary allow conditions applied to identity paths
+     */
+    private sameAccountExplicitTrustConditionsWithAllowedPermissionBoundary;
+    /**
+     * Get resource-policy allow statements that matched the principal directly.
+     *
+     * @param resourceAnalysis resource-policy analysis containing already-matched allow statements
+     * @returns direct principal-match resource allow statements
+     */
+    private directResourceAllowStatements;
+    /**
+     * Get resource-policy allow statements that matched at the principal-account level.
+     *
+     * @param resourceAnalysis resource-policy analysis containing already-matched allow statements
+     * @returns account-level resource allow statements
+     */
+    protected accountLevelResourceAllowStatements(resourceAnalysis: ResourceAnalysis): StatementAnalysis[];
+    /**
+     * Get same-account resource-policy conditions for paths that can satisfy core authorization.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns resource-policy conditions for the allowed same-account branch
+     */
+    private sameAccountResourcePolicyConditions;
+    /**
+     * Evaluate same-account core authorization and conditions based on principal-account trust.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param trustedAccount how the service trusts the principal account for this request
+     * @returns the same-account core authorization result and conditions
+     */
+    private sameAccountInitialEvaluation;
+    /**
+     * Evaluate same-account authorization when the service implicitly trusts identity policies.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns the same-account authorization result and conditions
+     */
+    private sameAccountImplicitTrustEvaluation;
+    /**
+     * Evaluate same-account authorization when the service requires explicit resource-policy account trust.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param trustedAccount explicit account-trust statements selected by the service authorizer
+     * @returns the same-account authorization result and conditions
+     */
+    private sameAccountExplicitTrustEvaluation;
+    /**
+     * Evaluate same-account authorization when the service does not trust identity policies.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns the same-account authorization result and conditions
+     */
+    private sameAccountNoTrustEvaluation;
+    /**
+     * Get resource-policy conditions for a cross-account request's resource-policy side.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns resource-policy conditions for the matching cross-account resource-policy statements
+     */
+    private crossAccountResourcePolicyConditions;
+    /**
+     * Get same-account resource-policy allow statements that bypass an implicit permission-boundary deny.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns resource-policy allow statements that bypass the implicit permission-boundary deny
+     */
+    private permissionBoundaryBypassResourceAllowStatements;
+    /**
+     * Evaluations whether the minimum requirements for the request to be allowed are met based on the core policies
+     *   - Identity
+     *   - Resource
+     *   - Session
+     *
+     * Depending on the service, and whether the principal and resources are in the same account, the requirements may differ.
+     * For same account requests, for most services an Allow in the resource policy or the identity policy is sufficient to
+     * allow the request, so this function will return 'Allowed'. If there is an explicit deny elsewhere, that is not considered.
+     * This function only determines if there are enough core policies to allow the request, and final determination of the
+     * request is done elsewhere.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns 'Allowed' if the core policies allow the request, otherwise may return 'ImplicitlyDenied' or 'ExplicitlyDenied' depending on the analyses
+     */
+    private initialEvaluationResult;
+}
+//# sourceMappingURL=DefaultServiceAuthorizer.d.ts.map

package/dist/cjs/services/DefaultServiceAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DefaultServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/DefaultServiceAuthorizer.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,KAAK,2BAA2B,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAiFjG,MAAM,MAAM,qBAAqB,GAC7B;IAAE,SAAS,EAAE,UAAU,CAAA;CAAE,GACzB;IAAE,SAAS,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,iBAAiB,EAAE,CAAA;CAAE,GAC1D;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzB;;GAEG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IAChE;;;;;OAKG;IACI,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA+FvE;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAgDjC;;;;;OAKG;IACH,OAAO,CAAC,gCAAgC;IAyBxC;;;;;;OAMG;IACH,6BAA6B,CAC3B,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;IAaxB;;;;;;;OAOG;IACH,SAAS,CAAC,0BAA0B,CAClC,OAAO,EAAE,2BAA2B,EACpC,cAAc,EAAE,0BAA0B,EAC1C,WAAW,EAAE,gBAAgB,GAC5B,0BAA0B,GAAG,SAAS;IA+BzC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uCAAuC;IAoC/C;;;;;;OAMG;IACH,OAAO,CAAC,2CAA2C;IAsCnD;;;;;;OAMG;IACH,OAAO,CAAC,kDAAkD;IAuB1D;;;;;OAKG;IACH,OAAO,CAAC,+DAA+D;IAkBvE;;;;;;OAMG;IACH,OAAO,CAAC,+DAA+D;IAoBvE;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAMrC;;;;;OAKG;IACH,SAAS,CAAC,mCAAmC,CAC3C,gBAAgB,EAAE,gBAAgB,GACjC,iBAAiB,EAAE;IAMtB;;;;;OAKG;IACH,OAAO,CAAC,mCAAmC;IAQ3C;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IAkBpC;;;;;OAKG;IACH,OAAO,CAAC,kCAAkC;IAoC1C;;;;;;OAMG;IACH,OAAO,CAAC,kCAAkC;IAmC1C;;;;;OAKG;IACH,OAAO,CAAC,4BAA4B;IAcpC;;;;;OAKG;IACH,OAAO,CAAC,oCAAoC;IAgB5C;;;;;OAKG;IACH,OAAO,CAAC,+CAA+C;IAoCvD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,uBAAuB;CAmEhC"}