@actsecurity/iam-simulate 0.1.173

package/dist/cjs/services/DefaultServiceAuthorizer.js

@@ -0,0 +1,625 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultServiceAuthorizer = void 0;
+const allowedConditions_js_1 = require("../analysis/allowedConditions.js");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const requestPrincipal_js_1 = require("../request/requestPrincipal.js");
+/**
+ * This helper class keeps track of which factors are blocking a request and what the overall result is
+ * based on those blocks.
+ */
+class BlockedByLog {
+    coreResult;
+    blockedBy = new Set();
+    result;
+    /**
+     * Create the BlockedByLog
+     *
+     * @param coreResult the core result of the authorization. Is the request allowed or denied based on the core policies (identity, resource, session).
+     */
+    constructor(coreResult) {
+        this.coreResult = coreResult;
+        this.result = coreResult;
+    }
+    /**
+     * Add a blocking factor to the log and update the overall result accordingly.
+     *
+     * @param reason the reason for the block.
+     * @param result the result of the block (ImplicitlyDenied, ExplicitlyDenied)
+     */
+    add(reason, result) {
+        if (this.coreResult === 'Allowed' && result !== 'Allowed') {
+            this.blockedBy.add(reason);
+        }
+        this.setResult(result);
+    }
+    /**
+     * Calculates and sets the new overall result based on the new block reason and the previous result.
+     *
+     * The result can only be modified down so Allowed -> ImplicitlyDenied -> ExplicitlyDenied.
+     *
+     * @param newResult the result of the new block reason being added.
+     */
+    setResult(newResult) {
+        // Explicit denies override everything
+        if (this.result === 'ExplicitlyDenied') {
+            return;
+        }
+        if (newResult === 'ExplicitlyDenied') {
+            this.result = 'ExplicitlyDenied';
+        }
+        else if (newResult === 'ImplicitlyDenied') {
+            this.result = 'ImplicitlyDenied';
+        }
+    }
+    /**
+     * Get the overall result after all blocks (if any) have been added.
+     *
+     * @returns the overall result after all blocks (if any) have been added.
+     */
+    getResult() {
+        return this.result;
+    }
+    /**
+     * Get the list of reasons that are blocking the request after the core result.
+     *
+     * @returns an array of reasons that are blocking the request after the core result.
+     */
+    getBlockedBy() {
+        return Array.from(this.blockedBy);
+    }
+}
+/**
+ * The default authorizer for services.
+ */
+class DefaultServiceAuthorizer {
+    /**
+     * Authorize a service request after all policy analysis has been completed.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns the result of the authorization
+     */
+    authorize(request) {
+        const scpResult = request.scpAnalysis.result;
+        const rcpResult = request.rcpAnalysis.result;
+        const identityStatementResult = request.identityAnalysis.result;
+        const resourcePolicyResult = request.resourceAnalysis?.result;
+        const endpointPolicyResult = request.endpointAnalysis?.result;
+        const requestPrincipal = request.request.principal;
+        const principalAccount = requestPrincipal.isAuthenticated()
+            ? requestPrincipal.accountId()
+            : undefined;
+        const resourceAccount = request.request.resource?.accountId();
+        const sameAccount = principalAccount !== undefined && principalAccount === resourceAccount;
+        const baseResult = {
+            sameAccount,
+            sessionAnalysis: request.sessionAnalysis,
+            identityAnalysis: request.identityAnalysis,
+            scpAnalysis: request.scpAnalysis,
+            rcpAnalysis: request.rcpAnalysis,
+            resourceAnalysis: request.resourceAnalysis,
+            permissionBoundaryAnalysis: request.permissionBoundaryAnalysis,
+            endpointAnalysis: request.endpointAnalysis
+        };
+        if (requestPrincipal.isAnonymous()) {
+            return this.authorizeAnonymousRequest(request, baseResult);
+        }
+        (0, requestPrincipal_js_1.assertAuthenticatedRequestPrincipal)(requestPrincipal);
+        const initialEvaluation = this.initialEvaluationResult(request);
+        let coreConditions = initialEvaluation.conditions;
+        const blockedByLog = new BlockedByLog(initialEvaluation.result);
+        blockedByLog.add('scp', scpResult);
+        blockedByLog.add('rcp', rcpResult);
+        if (endpointPolicyResult === 'ExplicitlyDenied' ||
+            endpointPolicyResult === 'ImplicitlyDenied') {
+            blockedByLog.add('vpce', endpointPolicyResult);
+        }
+        if (resourcePolicyResult === 'ExplicitlyDenied' ||
+            resourcePolicyResult === 'DeniedForAccount') {
+            blockedByLog.add('resource', 'ExplicitlyDenied');
+        }
+        if (identityStatementResult === 'ExplicitlyDenied') {
+            blockedByLog.add('identity', 'ExplicitlyDenied');
+        }
+        const permissionBoundaryMutation = this.applyPermissionBoundaryToCoreConditions(request, sameAccount, coreConditions);
+        coreConditions = permissionBoundaryMutation.conditions;
+        if (permissionBoundaryMutation.result) {
+            blockedByLog.add('pb', permissionBoundaryMutation.result);
+        }
+        const blockedReasons = blockedByLog.getBlockedBy();
+        if (blockedReasons.length !== 0) {
+            baseResult.blockedBy = blockedReasons;
+        }
+        const finalResult = blockedByLog.getResult();
+        return {
+            result: finalResult,
+            ...baseResult,
+            conditions: this.conditionsForAllowedResult(request, coreConditions, finalResult)
+        };
+        /**
+         * Add checks for:
+         * * root user - can override resource policies for most resource types
+         * * organization APIs and delegated admin policy
+         */
+    }
+    /**
+     * Authorize an anonymous request after all policy analysis has been completed.
+     *
+     * @param request the service authorization request containing all analyses.
+     * @param baseResult the common request-analysis fields to include in the result.
+     * @returns the anonymous request authorization result.
+     */
+    authorizeAnonymousRequest(request, baseResult) {
+        const endpointPolicyResult = request.endpointAnalysis?.result;
+        const initialEvaluation = this.anonymousInitialEvaluationResult(request);
+        const blockedByLog = new BlockedByLog(initialEvaluation.result);
+        if (request.rcpAnalysis.ouAnalysis.length > 0) {
+            blockedByLog.add('rcp', request.rcpAnalysis.result);
+        }
+        if (endpointPolicyResult === 'ExplicitlyDenied' ||
+            endpointPolicyResult === 'ImplicitlyDenied') {
+            blockedByLog.add('vpce', endpointPolicyResult);
+        }
+        const blockedReasons = blockedByLog.getBlockedBy();
+        if (blockedReasons.length !== 0) {
+            baseResult.blockedBy = blockedReasons;
+        }
+        const finalResult = blockedByLog.getResult();
+        return {
+            result: finalResult,
+            ...baseResult,
+            sameAccount: false,
+            conditions: this.conditionsForAllowedResult(request, initialEvaluation.conditions, finalResult)
+        };
+    }
+    /**
+     * Evaluates whether an anonymous request has the resource-side grant required to be allowed.
+     *
+     * @param request the service authorization request containing all analyses.
+     * @returns the core anonymous result before applicable resource-side guardrails are applied.
+     */
+    anonymousInitialEvaluationResult(request) {
+        const resourcePolicyResult = request.resourceAnalysis?.result;
+        if (resourcePolicyResult === 'Allowed') {
+            return {
+                result: 'Allowed',
+                conditions: (0, allowedConditions_js_1.resourceAllowStatementsExpression)(request.resourceAnalysis.allowStatements)
+            };
+        }
+        if (resourcePolicyResult === 'ExplicitlyDenied' ||
+            resourcePolicyResult === 'DeniedForAccount') {
+            return {
+                result: 'ExplicitlyDenied',
+                conditions: { conditionType: 'never', reason: 'noApplicableAllow' }
+            };
+        }
+        return {
+            result: 'ImplicitlyDenied',
+            conditions: { conditionType: 'never', reason: 'noApplicableAllow' }
+        };
+    }
+    /**
+     * Determines if the service trusts the principal's Account's IAM policies
+     *
+     * @param sameAccount - If the principal and resource are in the same account
+     * @param resourceAnalysis - The resource policy analysis
+     * @returns true if the service trusts the principal's account IAM policies
+     */
+    serviceTrustsPrincipalAccount(sameAccount, resourceAnalysis, resource) {
+        if (sameAccount) {
+            return { trustType: 'Implicit' };
+        }
+        const accountLevelStatements = this.accountLevelResourceAllowStatements(resourceAnalysis);
+        if (accountLevelStatements.length > 0) {
+            return { trustType: 'Explicit', statements: accountLevelStatements };
+        }
+        return { trustType: 'None' };
+    }
+    /**
+     * Combine core authorization conditions with guardrail conditions for a final allowed result.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param coreConditions the conditions for the core service authorization decision after permission-boundary mutation
+     * @param finalResult the final authorization result after guardrails
+     * @returns the public conditions expression, or undefined when none should be emitted
+     */
+    conditionsForAllowedResult(request, coreConditions, finalResult) {
+        const expressions = [
+            (0, allowedConditions_js_1.sessionPolicyExpression)(request.sessionAnalysis, request.sessionAnalysis !== undefined),
+            coreConditions,
+            request.scpAnalysis.conditions,
+            request.rcpAnalysis.conditions
+        ];
+        if (request.endpointAnalysis?.result === 'Allowed') {
+            expressions.push((0, allowedConditions_js_1.endpointPolicyExpression)(request.endpointAnalysis));
+        }
+        expressions.push(...(0, allowedConditions_js_1.allDenyEscapeExpressions)({
+            sessionAnalysis: request.sessionAnalysis,
+            scpAnalysis: request.scpAnalysis,
+            rcpAnalysis: request.rcpAnalysis,
+            identityAnalysis: request.identityAnalysis,
+            resourceAnalysis: request.resourceAnalysis,
+            permissionBoundaryAnalysis: request.permissionBoundaryAnalysis,
+            endpointAnalysis: request.endpointAnalysis
+        }));
+        return (0, allowedConditions_js_1.allowedConditionOutput)((0, allowedConditions_js_1.and)(expressions), request.simulationParameters.simulationMode, finalResult);
+    }
+    /**
+     * Apply permission-boundary effects to the core authorization conditions.
+     *
+     * Permission boundaries are not part of the core service authorization result. This function lives
+     * with the permission-boundary authorization checks and recalculates the affected condition paths
+     * only when permission-boundary behavior changes which core path can be used.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param sameAccount whether the principal and resource are in the same account
+     * @param coreConditions the unmodified core authorization conditions
+     * @returns the permission-boundary block result, if any, and updated core conditions
+     */
+    applyPermissionBoundaryToCoreConditions(request, sameAccount, coreConditions) {
+        const permissionBoundaryResult = request.permissionBoundaryAnalysis?.result;
+        if (!permissionBoundaryResult) {
+            return { conditions: coreConditions };
+        }
+        if (permissionBoundaryResult === 'ExplicitlyDenied') {
+            return { result: 'ExplicitlyDenied', conditions: coreConditions };
+        }
+        if (permissionBoundaryResult === 'Allowed') {
+            return {
+                conditions: this.coreConditionsWithAllowedPermissionBoundary(request, sameAccount)
+            };
+        }
+        if (permissionBoundaryResult === 'ImplicitlyDenied') {
+            if (!sameAccount) {
+                return { result: 'ImplicitlyDenied', conditions: coreConditions };
+            }
+            const bypassStatements = this.permissionBoundaryBypassResourceAllowStatements(request);
+            if (bypassStatements.length === 0) {
+                return { result: 'ImplicitlyDenied', conditions: coreConditions };
+            }
+            return { conditions: (0, allowedConditions_js_1.resourceAllowStatementsExpression)(bypassStatements) };
+        }
+        return { conditions: coreConditions };
+    }
+    /**
+     * Recalculate core conditions when an allowed permission boundary constrains identity-policy paths.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param sameAccount whether the principal and resource are in the same account
+     * @returns core conditions with permission-boundary allow conditions applied to identity paths
+     */
+    coreConditionsWithAllowedPermissionBoundary(request, sameAccount) {
+        const principal = request.request.principal;
+        if (principal.isAnonymous()) {
+            return (0, allowedConditions_js_1.resourceAllowStatementsExpression)(request.resourceAnalysis.allowStatements);
+        }
+        (0, requestPrincipal_js_1.assertAuthenticatedRequestPrincipal)(principal);
+        if ((0, iam_utils_1.isServicePrincipal)(principal.value())) {
+            return (0, allowedConditions_js_1.resourceAllowStatementsExpression)(request.resourceAnalysis.allowStatements);
+        }
+        if (sameAccount) {
+            const trustedAccount = this.serviceTrustsPrincipalAccount(sameAccount, request.resourceAnalysis, request.request.resource);
+            return this.sameAccountConditionsWithAllowedPermissionBoundary(request, trustedAccount);
+        }
+        if ((request.resourceAnalysis.result === 'Allowed' ||
+            request.resourceAnalysis.result === 'AllowedForAccount') &&
+            request.identityAnalysis.result === 'Allowed') {
+            return (0, allowedConditions_js_1.and)([
+                this.crossAccountResourcePolicyConditions(request),
+                (0, allowedConditions_js_1.identityPolicyExpression)(request.identityAnalysis),
+                (0, allowedConditions_js_1.permissionBoundaryExpression)(request.permissionBoundaryAnalysis)
+            ]);
+        }
+        return { conditionType: 'never', reason: 'noApplicableAllow' };
+    }
+    /**
+     * Recalculate same-account conditions when an allowed permission boundary constrains identity paths.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param trustedAccount how the service trusts the principal account for this request
+     * @returns same-account core conditions with permission-boundary allow conditions applied to identity paths
+     */
+    sameAccountConditionsWithAllowedPermissionBoundary(request, trustedAccount) {
+        switch (trustedAccount.trustType) {
+            case 'Implicit':
+                return this.sameAccountImplicitTrustConditionsWithAllowedPermissionBoundary(request);
+            case 'Explicit':
+                return this.sameAccountExplicitTrustConditionsWithAllowedPermissionBoundary(request, trustedAccount);
+            case 'None':
+                return request.resourceAnalysis.result === 'Allowed'
+                    ? this.sameAccountResourcePolicyConditions(request)
+                    : { conditionType: 'never', reason: 'noApplicableAllow' };
+            default:
+                throw new Error(`Unrecognized principal account trust type: ${String(trustedAccount.trustType)}`);
+        }
+    }
+    /**
+     * Recalculate same-account implicit trust conditions when permission-boundary allow constrains identity paths.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns same-account implicit trust conditions with permission-boundary allow conditions applied to identity paths
+     */
+    sameAccountImplicitTrustConditionsWithAllowedPermissionBoundary(request) {
+        const resourceConditions = request.resourceAnalysis.result === 'Allowed'
+            ? this.sameAccountResourcePolicyConditions(request)
+            : { conditionType: 'never', reason: 'noApplicableAllow' };
+        const identityConditions = request.identityAnalysis.result === 'Allowed'
+            ? (0, allowedConditions_js_1.and)([
+                (0, allowedConditions_js_1.identityPolicyExpression)(request.identityAnalysis),
+                (0, allowedConditions_js_1.permissionBoundaryExpression)(request.permissionBoundaryAnalysis)
+            ])
+            : { conditionType: 'never', reason: 'noApplicableAllow' };
+        return (0, allowedConditions_js_1.or)([resourceConditions, identityConditions]);
+    }
+    /**
+     * Recalculate same-account explicit trust conditions when permission-boundary allow constrains identity paths.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param trustedAccount explicit account-trust statements selected by the service authorizer
+     * @returns same-account explicit trust conditions with permission-boundary allow conditions applied to identity paths
+     */
+    sameAccountExplicitTrustConditionsWithAllowedPermissionBoundary(request, trustedAccount) {
+        const resourceConditions = request.resourceAnalysis.result === 'Allowed'
+            ? this.sameAccountResourcePolicyConditions(request)
+            : { conditionType: 'never', reason: 'noApplicableAllow' };
+        const identityConditions = request.identityAnalysis.result === 'Allowed'
+            ? (0, allowedConditions_js_1.and)([
+                (0, allowedConditions_js_1.resourceAllowStatementsExpression)(trustedAccount.statements),
+                (0, allowedConditions_js_1.identityPolicyExpression)(request.identityAnalysis),
+                (0, allowedConditions_js_1.permissionBoundaryExpression)(request.permissionBoundaryAnalysis)
+            ])
+            : { conditionType: 'never', reason: 'noApplicableAllow' };
+        return (0, allowedConditions_js_1.or)([resourceConditions, identityConditions]);
+    }
+    /**
+     * Get resource-policy allow statements that matched the principal directly.
+     *
+     * @param resourceAnalysis resource-policy analysis containing already-matched allow statements
+     * @returns direct principal-match resource allow statements
+     */
+    directResourceAllowStatements(resourceAnalysis) {
+        return resourceAnalysis.allowStatements.filter((statement) => ['Match', 'SessionRoleMatch', 'SessionUserMatch'].includes(statement.principalMatch));
+    }
+    /**
+     * Get resource-policy allow statements that matched at the principal-account level.
+     *
+     * @param resourceAnalysis resource-policy analysis containing already-matched allow statements
+     * @returns account-level resource allow statements
+     */
+    accountLevelResourceAllowStatements(resourceAnalysis) {
+        return resourceAnalysis.allowStatements.filter((statement) => statement.principalMatch === 'AccountLevelMatch');
+    }
+    /**
+     * Get same-account resource-policy conditions for paths that can satisfy core authorization.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns resource-policy conditions for the allowed same-account branch
+     */
+    sameAccountResourcePolicyConditions(request) {
+        return (0, allowedConditions_js_1.resourceAllowStatementsExpression)(this.directResourceAllowStatements(request.resourceAnalysis));
+    }
+    /**
+     * Evaluate same-account core authorization and conditions based on principal-account trust.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param trustedAccount how the service trusts the principal account for this request
+     * @returns the same-account core authorization result and conditions
+     */
+    sameAccountInitialEvaluation(request, trustedAccount) {
+        switch (trustedAccount.trustType) {
+            case 'Implicit':
+                return this.sameAccountImplicitTrustEvaluation(request);
+            case 'Explicit':
+                return this.sameAccountExplicitTrustEvaluation(request, trustedAccount);
+            case 'None':
+                return this.sameAccountNoTrustEvaluation(request);
+            default:
+                throw new Error(`Unrecognized principal account trust type: ${String(trustedAccount.trustType)}`);
+        }
+    }
+    /**
+     * Evaluate same-account authorization when the service implicitly trusts identity policies.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns the same-account authorization result and conditions
+     */
+    sameAccountImplicitTrustEvaluation(request) {
+        const resourcePolicyResult = request.resourceAnalysis.result;
+        const identityStatementResult = request.identityAnalysis.result;
+        if (resourcePolicyResult === 'Allowed' && identityStatementResult === 'Allowed') {
+            return {
+                result: 'Allowed',
+                conditions: (0, allowedConditions_js_1.or)([
+                    this.sameAccountResourcePolicyConditions(request),
+                    (0, allowedConditions_js_1.identityPolicyExpression)(request.identityAnalysis)
+                ])
+            };
+        }
+        if (resourcePolicyResult === 'Allowed') {
+            return {
+                result: 'Allowed',
+                conditions: this.sameAccountResourcePolicyConditions(request)
+            };
+        }
+        if (identityStatementResult === 'Allowed') {
+            return {
+                result: 'Allowed',
+                conditions: (0, allowedConditions_js_1.identityPolicyExpression)(request.identityAnalysis)
+            };
+        }
+        return {
+            result: 'ImplicitlyDenied',
+            conditions: { conditionType: 'never', reason: 'noApplicableAllow' }
+        };
+    }
+    /**
+     * Evaluate same-account authorization when the service requires explicit resource-policy account trust.
+     *
+     * @param request the service authorization request containing all analyses
+     * @param trustedAccount explicit account-trust statements selected by the service authorizer
+     * @returns the same-account authorization result and conditions
+     */
+    sameAccountExplicitTrustEvaluation(request, trustedAccount) {
+        const resourcePolicyResult = request.resourceAnalysis.result;
+        const identityStatementResult = request.identityAnalysis.result;
+        const resourceConditions = resourcePolicyResult === 'Allowed'
+            ? this.sameAccountResourcePolicyConditions(request)
+            : { conditionType: 'never', reason: 'noApplicableAllow' };
+        if (identityStatementResult === 'Allowed') {
+            const identityConditions = (0, allowedConditions_js_1.and)([
+                (0, allowedConditions_js_1.resourceAllowStatementsExpression)(trustedAccount.statements),
+                (0, allowedConditions_js_1.identityPolicyExpression)(request.identityAnalysis)
+            ]);
+            return {
+                result: 'Allowed',
+                conditions: (0, allowedConditions_js_1.or)([resourceConditions, identityConditions])
+            };
+        }
+        if (resourcePolicyResult === 'Allowed') {
+            return {
+                result: 'Allowed',
+                conditions: resourceConditions
+            };
+        }
+        return {
+            result: 'ImplicitlyDenied',
+            conditions: { conditionType: 'never', reason: 'noApplicableAllow' }
+        };
+    }
+    /**
+     * Evaluate same-account authorization when the service does not trust identity policies.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns the same-account authorization result and conditions
+     */
+    sameAccountNoTrustEvaluation(request) {
+        if (request.resourceAnalysis.result === 'Allowed') {
+            return {
+                result: 'Allowed',
+                conditions: this.sameAccountResourcePolicyConditions(request)
+            };
+        }
+        return {
+            result: 'ImplicitlyDenied',
+            conditions: { conditionType: 'never', reason: 'noApplicableAllow' }
+        };
+    }
+    /**
+     * Get resource-policy conditions for a cross-account request's resource-policy side.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns resource-policy conditions for the matching cross-account resource-policy statements
+     */
+    crossAccountResourcePolicyConditions(request) {
+        if (request.resourceAnalysis.result !== 'Allowed' &&
+            request.resourceAnalysis.result !== 'AllowedForAccount') {
+            return { conditionType: 'never', reason: 'noApplicableAllow' };
+        }
+        return (0, allowedConditions_js_1.resourceAllowStatementsExpression)([
+            ...this.directResourceAllowStatements(request.resourceAnalysis),
+            ...this.accountLevelResourceAllowStatements(request.resourceAnalysis)
+        ]);
+    }
+    /**
+     * Get same-account resource-policy allow statements that bypass an implicit permission-boundary deny.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns resource-policy allow statements that bypass the implicit permission-boundary deny
+     */
+    permissionBoundaryBypassResourceAllowStatements(request) {
+        if (request.resourceAnalysis.result !== 'Allowed') {
+            return [];
+        }
+        const principal = request.request.principal;
+        if (!principal.isAuthenticated()) {
+            return [];
+        }
+        const principalValue = principal.value();
+        if ((0, iam_utils_1.isAssumedRoleArn)(principalValue) ||
+            (0, iam_utils_1.isIamUserArn)(principalValue) ||
+            (0, iam_utils_1.isFederatedUserArn)(principalValue)) {
+            return request.resourceAnalysis.allowStatements.filter((statement) => statement.principalMatch === 'Match');
+        }
+        if ((0, iam_utils_1.isIamRoleArn)(principalValue)) {
+            return request.resourceAnalysis.allowStatements.filter((statement) => statement.principalMatch === 'Match' &&
+                (statement.ignoredRoleSessionName ||
+                    (statement.statement.isPrincipalStatement() &&
+                        statement.statement.principals().some((p) => p.isWildcardPrincipal()))));
+        }
+        return [];
+    }
+    /**
+     * Evaluations whether the minimum requirements for the request to be allowed are met based on the core policies
+     *   - Identity
+     *   - Resource
+     *   - Session
+     *
+     * Depending on the service, and whether the principal and resources are in the same account, the requirements may differ.
+     * For same account requests, for most services an Allow in the resource policy or the identity policy is sufficient to
+     * allow the request, so this function will return 'Allowed'. If there is an explicit deny elsewhere, that is not considered.
+     * This function only determines if there are enough core policies to allow the request, and final determination of the
+     * request is done elsewhere.
+     *
+     * @param request the service authorization request containing all analyses
+     * @returns 'Allowed' if the core policies allow the request, otherwise may return 'ImplicitlyDenied' or 'ExplicitlyDenied' depending on the analyses
+     */
+    initialEvaluationResult(request) {
+        const sessionResult = request.sessionAnalysis?.result;
+        const identityStatementResult = request.identityAnalysis.result;
+        const resourcePolicyResult = request.resourceAnalysis?.result;
+        const requestPrincipal = request.request.principal;
+        const principalAccount = requestPrincipal.isAuthenticated()
+            ? requestPrincipal.accountId()
+            : undefined;
+        const resourceAccount = request.request.resource?.accountId();
+        const sameAccount = principalAccount !== undefined && principalAccount === resourceAccount;
+        if (requestPrincipal.isAnonymous()) {
+            return this.anonymousInitialEvaluationResult(request);
+        }
+        (0, requestPrincipal_js_1.assertAuthenticatedRequestPrincipal)(requestPrincipal);
+        if (sessionResult && sessionResult !== 'Allowed') {
+            return {
+                result: sessionResult,
+                conditions: (0, allowedConditions_js_1.sessionPolicyExpression)(request.sessionAnalysis, true)
+            };
+        }
+        // Service Principals
+        if ((0, iam_utils_1.isServicePrincipal)(requestPrincipal.value())) {
+            // Service principals are allowed if the resource policy allows them
+            if (resourcePolicyResult === 'Allowed') {
+                return {
+                    result: 'Allowed',
+                    conditions: (0, allowedConditions_js_1.resourceAllowStatementsExpression)(request.resourceAnalysis.allowStatements)
+                };
+            }
+            return {
+                result: 'ImplicitlyDenied',
+                conditions: { conditionType: 'never', reason: 'noApplicableAllow' }
+            };
+        }
+        //Same Account
+        if (sameAccount) {
+            const trustedAccount = this.serviceTrustsPrincipalAccount(sameAccount, request.resourceAnalysis, request.request.resource);
+            return this.sameAccountInitialEvaluation(request, trustedAccount);
+        }
+        //Cross Account
+        if (resourcePolicyResult === 'Allowed' || resourcePolicyResult === 'AllowedForAccount') {
+            if (identityStatementResult === 'Allowed') {
+                const coreConditions = (0, allowedConditions_js_1.and)([
+                    this.crossAccountResourcePolicyConditions(request),
+                    (0, allowedConditions_js_1.identityPolicyExpression)(request.identityAnalysis)
+                ]);
+                return {
+                    result: 'Allowed',
+                    conditions: coreConditions
+                };
+            }
+        }
+        return {
+            result: 'ImplicitlyDenied',
+            conditions: { conditionType: 'never', reason: 'noApplicableAllow' }
+        };
+    }
+}
+exports.DefaultServiceAuthorizer = DefaultServiceAuthorizer;
+//# sourceMappingURL=DefaultServiceAuthorizer.js.map

package/dist/cjs/services/DefaultServiceAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DefaultServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/DefaultServiceAuthorizer.ts"],"names":[],"mappings":";;;AAAA,2EAUyC;AACzC,sDAM+B;AAQ/B,wEAAoF;AAKpF;;;GAGG;AACH,MAAM,YAAY;IASa;IARrB,SAAS,GAAuB,IAAI,GAAG,EAAE,CAAA;IACzC,MAAM,CAAkB;IAEhC;;;;OAIG;IACH,YAA6B,UAA4B;QAA5B,eAAU,GAAV,UAAU,CAAkB;QACvD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAA;IAC1B,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,MAAqB,EAAE,MAAwB;QACjD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxB,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CAAC,SAA2B;QAC3C,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACvC,OAAM;QACR,CAAC;QACD,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAA;QAClC,CAAC;aAAM,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAA;QAClC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;CACF;AAiBD;;GAEG;AACH,MAAa,wBAAwB;IACnC;;;;;OAKG;IACI,SAAS,CAAC,OAAoC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QAC5C,MAAM,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAC/D,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAC7D,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAE7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAClD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,eAAe,EAAE;YACzD,CAAC,CAAC,gBAAgB,CAAC,SAAS,EAAE;YAC9B,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAA;QAC7D,MAAM,WAAW,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,eAAe,CAAA;QAE1F,MAAM,UAAU,GAWZ;YACF,WAAW;YACX,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAA;QAED,IAAI,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC5D,CAAC;QACD,IAAA,yDAAmC,EAAC,gBAAgB,CAAC,CAAA;QAErD,MAAM,iBAAiB,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAA;QAC/D,IAAI,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAA;QACjD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAE/D,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAClC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAElC,IACE,oBAAoB,KAAK,kBAAkB;YAC3C,oBAAoB,KAAK,kBAAkB,EAC3C,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAChD,CAAC;QAED,IACE,oBAAoB,KAAK,kBAAkB;YAC3C,oBAAoB,KAAK,kBAAkB,EAC3C,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,uBAAuB,KAAK,kBAAkB,EAAE,CAAC;YACnD,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAClD,CAAC;QAED,MAAM,0BAA0B,GAAG,IAAI,CAAC,uCAAuC,CAC7E,OAAO,EACP,WAAW,EACX,cAAc,CACf,CAAA;QACD,cAAc,GAAG,0BAA0B,CAAC,UAAU,CAAA;QACtD,IAAI,0BAA0B,CAAC,MAAM,EAAE,CAAC;YACtC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,EAAE,CAAA;QAClD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,SAAS,GAAG,cAAc,CAAA;QACvC,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,EAAE,CAAA;QAC5C,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,GAAG,UAAU;YACb,UAAU,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC;SAClF,CAAA;QAED;;;;WAIG;IACL,CAAC;IAED;;;;;;OAMG;IACK,yBAAyB,CAC/B,OAAoC,EACpC,UAWC;QAED,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,CAAA;QACxE,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAE/D,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,IACE,oBAAoB,KAAK,kBAAkB;YAC3C,oBAAoB,KAAK,kBAAkB,EAC3C,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,EAAE,CAAA;QAClD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,SAAS,GAAG,cAAc,CAAA;QACvC,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,EAAE,CAAA;QAC5C,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,GAAG,UAAU;YACb,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,IAAI,CAAC,0BAA0B,CACzC,OAAO,EACP,iBAAiB,CAAC,UAAU,EAC5B,WAAW,CACZ;SACF,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACK,gCAAgC,CACtC,OAAoC;QAEpC,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAC7D,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,IAAA,wDAAiC,EAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC;aACxF,CAAA;QACH,CAAC;QACD,IACE,oBAAoB,KAAK,kBAAkB;YAC3C,oBAAoB,KAAK,kBAAkB,EAC3C,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE;aACpE,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE;SACpE,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,6BAA6B,CAC3B,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;IAED;;;;;;;OAOG;IACO,0BAA0B,CAClC,OAAoC,EACpC,cAA0C,EAC1C,WAA6B;QAE7B,MAAM,WAAW,GAAG;YAClB,IAAA,8CAAuB,EAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC;YACvF,cAAc;YACd,OAAO,CAAC,WAAW,CAAC,UAAU;YAC9B,OAAO,CAAC,WAAW,CAAC,UAAU;SAC/B,CAAA;QAED,IAAI,OAAO,CAAC,gBAAgB,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,WAAW,CAAC,IAAI,CAAC,IAAA,+CAAwB,EAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAA;QACtE,CAAC;QAED,WAAW,CAAC,IAAI,CACd,GAAG,IAAA,+CAAwB,EAAC;YAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CACH,CAAA;QAED,OAAO,IAAA,6CAAsB,EAC3B,IAAA,0BAAG,EAAC,WAAW,CAAC,EAChB,OAAO,CAAC,oBAAoB,CAAC,cAAc,EAC3C,WAAW,CACZ,CAAA;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uCAAuC,CAC7C,OAAoC,EACpC,WAAoB,EACpB,cAA0C;QAE1C,MAAM,wBAAwB,GAAG,OAAO,CAAC,0BAA0B,EAAE,MAAM,CAAA;QAC3E,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;QACvC,CAAC;QAED,IAAI,wBAAwB,KAAK,kBAAkB,EAAE,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;QACnE,CAAC;QAED,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;YAC3C,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,2CAA2C,CAAC,OAAO,EAAE,WAAW,CAAC;aACnF,CAAA;QACH,CAAC;QAED,IAAI,wBAAwB,KAAK,kBAAkB,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;YACnE,CAAC;YAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,+CAA+C,CAAC,OAAO,CAAC,CAAA;YACtF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;YACnE,CAAC;YAED,OAAO,EAAE,UAAU,EAAE,IAAA,wDAAiC,EAAC,gBAAgB,CAAC,EAAE,CAAA;QAC5E,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;OAMG;IACK,2CAA2C,CACjD,OAAoC,EACpC,WAAoB;QAEpB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAC3C,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAA,wDAAiC,EAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAA;QACpF,CAAC;QACD,IAAA,yDAAmC,EAAC,SAAS,CAAC,CAAA;QAE9C,IAAI,IAAA,8BAAkB,EAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAA,wDAAiC,EAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAA;QACpF,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CACvD,WAAW,EACX,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,OAAO,CAAC,QAAQ,CACzB,CAAA;YACD,OAAO,IAAI,CAAC,kDAAkD,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QACzF,CAAC;QAED,IACE,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS;YAC5C,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,mBAAmB,CAAC;YAC1D,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAC7C,CAAC;YACD,OAAO,IAAA,0BAAG,EAAC;gBACT,IAAI,CAAC,oCAAoC,CAAC,OAAO,CAAC;gBAClD,IAAA,+CAAwB,EAAC,OAAO,CAAC,gBAAgB,CAAC;gBAClD,IAAA,mDAA4B,EAAC,OAAO,CAAC,0BAA0B,CAAC;aACjE,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAChE,CAAC;IAED;;;;;;OAMG;IACK,kDAAkD,CACxD,OAAoC,EACpC,cAAqC;QAErC,QAAQ,cAAc,CAAC,SAAS,EAAE,CAAC;YACjC,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,+DAA+D,CAAC,OAAO,CAAC,CAAA;YACtF,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,+DAA+D,CACzE,OAAO,EACP,cAAc,CACf,CAAA;YACH,KAAK,MAAM;gBACT,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS;oBAClD,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,OAAO,CAAC;oBACnD,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;YAC7D;gBACE,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAE,cAAyC,CAAC,SAAS,CAAC,EAAE,CAC7G,CAAA;QACL,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,+DAA+D,CACrE,OAAoC;QAEpC,MAAM,kBAAkB,GACtB,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS;YAC3C,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,EAAE,aAAa,EAAE,OAAgB,EAAE,MAAM,EAAE,mBAA4B,EAAE,CAAA;QAC/E,MAAM,kBAAkB,GACtB,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS;YAC3C,CAAC,CAAC,IAAA,0BAAG,EAAC;gBACF,IAAA,+CAAwB,EAAC,OAAO,CAAC,gBAAgB,CAAC;gBAClD,IAAA,mDAA4B,EAAC,OAAO,CAAC,0BAA0B,CAAC;aACjE,CAAC;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAgB,EAAE,MAAM,EAAE,mBAA4B,EAAE,CAAA;QAE/E,OAAO,IAAA,yBAAE,EAAC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;OAMG;IACK,+DAA+D,CACrE,OAAoC,EACpC,cAAyE;QAEzE,MAAM,kBAAkB,GACtB,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS;YAC3C,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,EAAE,aAAa,EAAE,OAAgB,EAAE,MAAM,EAAE,mBAA4B,EAAE,CAAA;QAC/E,MAAM,kBAAkB,GACtB,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS;YAC3C,CAAC,CAAC,IAAA,0BAAG,EAAC;gBACF,IAAA,wDAAiC,EAAC,cAAc,CAAC,UAAU,CAAC;gBAC5D,IAAA,+CAAwB,EAAC,OAAO,CAAC,gBAAgB,CAAC;gBAClD,IAAA,mDAA4B,EAAC,OAAO,CAAC,0BAA0B,CAAC;aACjE,CAAC;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAgB,EAAE,MAAM,EAAE,mBAA4B,EAAE,CAAA;QAE/E,OAAO,IAAA,yBAAE,EAAC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACrD,CAAC;IAED;;;;;OAKG;IACK,6BAA6B,CAAC,gBAAkC;QACtE,OAAO,gBAAgB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3D,CAAC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,CACrF,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACO,mCAAmC,CAC3C,gBAAkC;QAElC,OAAO,gBAAgB,CAAC,eAAe,CAAC,MAAM,CAC5C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,KAAK,mBAAmB,CAChE,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACK,mCAAmC,CACzC,OAAoC;QAEpC,OAAO,IAAA,wDAAiC,EACtC,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAC7D,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACK,4BAA4B,CAClC,OAAoC,EACpC,cAAqC;QAErC,QAAQ,cAAc,CAAC,SAAS,EAAE,CAAC;YACjC,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,CAAC,CAAA;YACzD,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YACzE,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAA;YACnD;gBACE,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAE,cAAyC,CAAC,SAAS,CAAC,EAAE,CAC7G,CAAA;QACL,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,kCAAkC,CACxC,OAAoC;QAEpC,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAC5D,MAAM,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAE/D,IAAI,oBAAoB,KAAK,SAAS,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAChF,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,IAAA,yBAAE,EAAC;oBACb,IAAI,CAAC,mCAAmC,CAAC,OAAO,CAAC;oBACjD,IAAA,+CAAwB,EAAC,OAAO,CAAC,gBAAgB,CAAC;iBACnD,CAAC;aACH,CAAA;QACH,CAAC;QAED,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,IAAI,CAAC,mCAAmC,CAAC,OAAO,CAAC;aAC9D,CAAA;QACH,CAAC;QAED,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,IAAA,+CAAwB,EAAC,OAAO,CAAC,gBAAgB,CAAC;aAC/D,CAAA;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE;SACpE,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACK,kCAAkC,CACxC,OAAoC,EACpC,cAAyE;QAEzE,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAC5D,MAAM,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAC/D,MAAM,kBAAkB,GACtB,oBAAoB,KAAK,SAAS;YAChC,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,EAAE,aAAa,EAAE,OAAgB,EAAE,MAAM,EAAE,mBAA4B,EAAE,CAAA;QAE/E,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,kBAAkB,GAAG,IAAA,0BAAG,EAAC;gBAC7B,IAAA,wDAAiC,EAAC,cAAc,CAAC,UAAU,CAAC;gBAC5D,IAAA,+CAAwB,EAAC,OAAO,CAAC,gBAAgB,CAAC;aACnD,CAAC,CAAA;YACF,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,IAAA,yBAAE,EAAC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;aACzD,CAAA;QACH,CAAC;QAED,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,kBAAkB;aAC/B,CAAA;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE;SACpE,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACK,4BAA4B,CAAC,OAAoC;QACvE,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,IAAI,CAAC,mCAAmC,CAAC,OAAO,CAAC;aAC9D,CAAA;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE;SACpE,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACK,oCAAoC,CAC1C,OAAoC;QAEpC,IACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS;YAC7C,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,mBAAmB,EACvD,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAChE,CAAC;QAED,OAAO,IAAA,wDAAiC,EAAC;YACvC,GAAG,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC/D,GAAG,IAAI,CAAC,mCAAmC,CAAC,OAAO,CAAC,gBAAgB,CAAC;SACtE,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACK,+CAA+C,CACrD,OAAoC;QAEpC,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAC3C,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;YACjC,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,EAAE,CAAA;QAExC,IACE,IAAA,4BAAgB,EAAC,cAAc,CAAC;YAChC,IAAA,wBAAY,EAAC,cAAc,CAAC;YAC5B,IAAA,8BAAkB,EAAC,cAAc,CAAC,EAClC,CAAC;YACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,MAAM,CACpD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,KAAK,OAAO,CACpD,CAAA;QACH,CAAC;QAED,IAAI,IAAA,wBAAY,EAAC,cAAc,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,MAAM,CACpD,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,cAAc,KAAK,OAAO;gBACpC,CAAC,SAAS,CAAC,sBAAsB;oBAC/B,CAAC,SAAS,CAAC,SAAS,CAAC,oBAAoB,EAAE;wBACzC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAC9E,CAAA;QACH,CAAC;QAED,OAAO,EAAE,CAAA;IACX,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,uBAAuB,CAAC,OAAoC;QAClE,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAA;QACrD,MAAM,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAA;QAC/D,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAA;QAE7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAClD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,eAAe,EAAE;YACzD,CAAC,CAAC,gBAAgB,CAAC,SAAS,EAAE;YAC9B,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAA;QAC7D,MAAM,WAAW,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,eAAe,CAAA;QAC1F,IAAI,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,CAAA;QACvD,CAAC;QACD,IAAA,yDAAmC,EAAC,gBAAgB,CAAC,CAAA;QAErD,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,IAAA,8CAAuB,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC;aACnE,CAAA;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,IAAA,8BAAkB,EAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YACjD,oEAAoE;YACpE,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,IAAA,wDAAiC,EAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC;iBACxF,CAAA;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE;aACpE,CAAA;QACH,CAAC;QAED,cAAc;QACd,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CACvD,WAAW,EACX,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,OAAO,CAAC,QAAQ,CACzB,CAAA;YACD,OAAO,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QACnE,CAAC;QAED,eAAe;QACf,IAAI,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,KAAK,mBAAmB,EAAE,CAAC;YACvF,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,cAAc,GAAG,IAAA,0BAAG,EAAC;oBACzB,IAAI,CAAC,oCAAoC,CAAC,OAAO,CAAC;oBAClD,IAAA,+CAAwB,EAAC,OAAO,CAAC,gBAAgB,CAAC;iBACnD,CAAC,CAAA;gBACF,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,cAAc;iBAC3B,CAAA;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE;SACpE,CAAA;IACH,CAAC;CACF;AAxuBD,4DAwuBC"}

package/dist/cjs/services/IamServiceAuthorizer.d.ts

@@ -0,0 +1,10 @@
+import { type RequestAnalysis } from '../evaluate.js';
+import { DefaultServiceAuthorizer } from './DefaultServiceAuthorizer.js';
+import { type ServiceAuthorizationRequest } from './ServiceAuthorizer.js';
+/**
+ * Service authorizer for IAM service requests.
+ */
+export declare class IamServiceAuthorizer extends DefaultServiceAuthorizer {
+    authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
+}
+//# sourceMappingURL=IamServiceAuthorizer.d.ts.map

package/dist/cjs/services/IamServiceAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/IamServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AA8BzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChD,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;CAiCjF"}