@actsecurity/iam-simulate 0.1.173

package/README.md

@@ -0,0 +1,257 @@
+# IAM Simulate
+
+[![NPM Version](https://img.shields.io/npm/v/@cloud-copilot/iam-simulate.svg?logo=nodedotjs)](https://www.npmjs.com/package/@cloud-copilot/iam-simulate) [![License: AGPL v3](https://img.shields.io/github/license/cloud-copilot/iam-simulate)](LICENSE.txt) [![GuardDog](https://github.com/cloud-copilot/iam-simulate/actions/workflows/guarddog.yml/badge.svg)](https://github.com/cloud-copilot/iam-simulate/actions/workflows/guarddog.yml) [![Known Vulnerabilities](https://snyk.io/test/github/cloud-copilot/iam-simulate/badge.svg?targetFile=package.json&style=flat-square)](https://snyk.io/test/github/cloud-copilot/iam-simulate?targetFile=package.json)
+
+An AWS IAM Simulator and Policy Tester built as a Node/Typescript library.
+
+The simulator currently supports these features of AWS IAM
+
+### IAM Feature Support
+
+- Identity Policies
+- Resource Policies
+- Service Control Policies
+- Resource Control Policies
+- Permission Boundaries
+- All [AWS Condition Operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html)
+- Same Account and Cross Account Requests
+- Custom trust behavior for IAM Trust Policies and KMS Key Policies
+
+### Request Validation
+
+iam-simulate will automatically validate inputs including
+
+- IAM policies using [iam-policy](https://github.com/cloud-copilot/iam-policy)
+- IAM Actions using [iam-data](https://github.com/cloud-copilot/iam-data)
+- The resource ARN against allowed resource types for the action
+- The context keys allowed for the action/resource and their types.
+
+Currently all [global condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) are allowed for all requests which is not strictly true. More validation will be added in the future.
+
+### Explanation
+
+iam-simulate will detail which statements were decisive in the final decision to allow or deny a request.
+
+It will also return "explains" for each statement that was evaluated, detailing why that statement applied to the request or not.
+
+### Features Coming Soon
+
+- Session Policies
+- Validation of Global Condition Keys for each action
+- Automatically populating context keys from the request such as `aws:PrincipalServiceName`
+
+### Anonymous Requests
+
+Use `anonymousPrincipal` to simulate unsigned requests, such as public S3 object access granted by a bucket policy. Anonymous requests do not have identity policies, session policies, permission boundaries, or SCPs; those principal-side policy inputs are rejected by `runSimulation`.
+
+```typescript
+import { anonymousPrincipal, runSimulation, type Simulation } from '@cloud-copilot/iam-simulate'
+
+const simulation: Simulation = {
+  request: {
+    principal: anonymousPrincipal,
+    action: 's3:GetObject',
+    resource: {
+      resource: 'arn:aws:s3:::public-bucket/file.txt',
+      accountId: '123456789012'
+    },
+    contextVariables: {}
+  },
+  identityPolicies: [],
+  serviceControlPolicies: [],
+  resourceControlPolicies: [],
+  resourcePolicy: {
+    Version: '2012-10-17',
+    Statement: [
+      {
+        Effect: 'Allow',
+        Principal: '*',
+        Action: 's3:GetObject',
+        Resource: 'arn:aws:s3:::public-bucket/*'
+      }
+    ]
+  }
+}
+
+const response = await runSimulation(simulation, {})
+```
+
+### S3 Block Public Access
+
+For S3 requests, callers can provide the effective `RestrictPublicBuckets` setting with `additionalSettings.s3.blockPublicAccess`. iam-simulate does not fetch or determine this setting; provide `true` only when S3 Block Public Access should apply for the bucket/account being simulated.
+
+```typescript
+const simulation: Simulation = {
+  // request and policies...
+  additionalSettings: {
+    s3: {
+      blockPublicAccess: true
+    }
+  }
+}
+```
+
+When enabled, public S3 bucket policies can block anonymous and cross-account access with `blockedBy: ['s3-bpa']`.
+
+## Installation
+
+```bash
+npm install @cloud-copilot/iam-simulate
+```
+
+## Usage
+
+```typescript
+import { runSimulation, type Simulation } from '@cloud-copilot/iam-simulate'
+
+const simulation: Simulation = {
+  identityPolicies: [
+    {
+      name: 'userpolicy',
+      policy: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['s3:GetObject'],
+            Resource: ['arn:aws:s3:::mybucket/*']
+          }
+        ]
+      }
+    }
+  ],
+  serviceControlPolicies: [
+    {
+      orgIdentifier: 'ou-12345',
+      policies: [
+        {
+          name: 'AllowAll',
+          policy: {
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Effect: 'Allow',
+                Action: '*',
+                Resource: '*'
+              }
+            ]
+          }
+        }
+      ]
+    }
+  ],
+  /*
+    The default RCP `RCPFullAWSAccess` is always applied implicitly and you do not need to include it here. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps_examples.html#example-rcp-full-aws-access
+  */
+  resourceControlPolicies: [
+    {
+      orgIdentifier: 'o-123456789012',
+      policies: [
+        {
+          name: 'EnforceSecureTransport',
+          policy: {
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Sid: 'EnforceSecureTransport',
+                Effect: 'Deny',
+                Principal: '*',
+                Action: ['sts:*', 's3:*', 'sqs:*', 'secretsmanager:*', 'kms:*'],
+                Resource: '*',
+                Condition: {
+                  BoolIfExists: {
+                    'aws:SecureTransport': 'false'
+                  }
+                }
+              }
+            ]
+          }
+        }
+      ]
+    }
+  ],
+  resourcePolicy: {
+    Version: '2012-10-17',
+    Statement: [
+      {
+        Effect: 'Allow',
+        Action: ['s3:GetObject'],
+        Resource: ['arn:aws:s3:::mybucket/*'],
+        Principal: 'aws:arn:iam::123456789012:root',
+        Condition: {
+          StringEquals: {
+            'aws:PrincipalOrgID': 'o-123456789012'
+          }
+        }
+      }
+    ]
+  },
+  request: {
+    action: 's3:GetObject',
+    principal: 'arn:aws:iam::123456789012:user/username',
+    resource: {
+      accountId: '123456789012',
+      resource: 'arn:aws:s3:::mybucket/file.txt'
+    },
+    contextVariables: {
+      'aws:PrincipalOrgID': 'o-123456789012'
+    }
+  }
+}
+
+`runSimulation` returns a discriminated union with `resultType`:
+
+- `resultType: 'error'` includes `errors` and no simulation results.
+- `resultType: 'single'` includes `overallResult` and a single `result`.
+- `resultType: 'wildcard'` includes `overallResult` and `results` for each matching pattern.
+
+const response = await runSimulation(simulation, {})
+//Check for validation errors (errors are returned at the response level):
+if (response.resultType === 'error') {
+  console.log(response.errors.message)
+  console.log(JSON.stringify(response.errors, null, 2))
+}
+
+//The simulation ran successfully
+if (response.resultType === 'single') {
+  const result = response.result
+  console.log(response.overallResult) // 'Allowed', 'ExplicitlyDenied', or 'ImplicitlyDenied'
+  console.log(result.analysis?.result)
+
+  //Output the identity statements that allowed the request
+  const identityAllowExplains =
+    result?.analysis?.identityAnalysis?.allowStatements.map((s) => s.explain) || []
+  //Show which statements applied and exactly how.
+  for (const explain of identityAllowExplains) {
+    console.log(explain)
+  }
+}
+
+if (response.resultType === 'wildcard') {
+  console.log(response.overallResult)
+  for (const result of response.results) {
+    console.log(result.resourcePattern, result.analysis?.result)
+  }
+}
+```
+
+This would output an explain that shows how the identity statement was evaluated:
+
+```javascript
+{
+  effect: 'Allow',
+  identifier: '1',
+  matches: true,
+  actionMatch: true,
+  principalMatch: 'Match',
+  resourceMatch: true,
+  conditionMatch: true,
+  resources: [
+    {
+      resource: 'arn:aws:s3:::mybucket/*',
+      matches: true,
+    }
+  ],
+  actions: [ { action: 's3:GetObject', matches: true } ],
+}
+```

package/dist/cjs/StatementAnalysis.d.ts

@@ -0,0 +1,63 @@
+import { type Condition, type Statement } from '@actsecurity/iam-policy';
+import { type ConditionMatchResult } from './condition/condition.js';
+import { type StatementExplain } from './explain/statementExplain.js';
+import { type PrincipalMatchResult } from './principal/principal.js';
+/**
+ * The result of analyzing a statement against a request.
+ *
+ */
+export interface StatementAnalysis {
+    /**
+     * The identifier of the policy that contains the statement.
+     */
+    policyId: string;
+    /**
+     * The statement being analyzed.
+     */
+    statement: Statement;
+    /**
+     * Whether the Resource or NotResource – if any – matches the request.
+     */
+    resourceMatch: boolean;
+    /**
+     * Whether the Action or NotAction matches the request.
+     */
+    actionMatch: boolean;
+    /**
+     * Whether the Principal or NotPrincipal – if any – matches the request.
+     */
+    principalMatch: PrincipalMatchResult;
+    /**
+     * Whether the Conditions matches the request.
+     */
+    conditionMatch: ConditionMatchResult;
+    /**
+     * The explain of evaluating the statement.
+     */
+    explain: StatementExplain;
+    /**
+     * Any conditions that were ignored during discovery mode.
+     */
+    ignoredConditions?: Condition[];
+    /**
+     * Role Session Name ignored during discovery mode.
+     */
+    ignoredRoleSessionName?: boolean;
+}
+/**
+ * Checks if a statement is an identity statement that allows the request.
+ *
+ * @param statement The statement to check.
+ * @returns Whether the statement is an identity statement that allows the request.
+ */
+export declare function identityStatementAllows(statement: StatementAnalysis): boolean;
+export declare function identityStatementExplicitDeny(statement: StatementAnalysis): boolean;
+export declare function statementMatches(analysis: Pick<StatementAnalysis, 'actionMatch' | 'conditionMatch' | 'principalMatch' | 'resourceMatch'>): boolean;
+/**
+ * Determines whether ignored conditions are decisive for a statement and should be reported.
+ *
+ * @param analysis the analysis of the statement
+ * @returns true if the ignored conditions are decisive, false otherwise
+ */
+export declare function reportIgnoredConditions(analysis: Pick<StatementAnalysis, 'actionMatch' | 'principalMatch' | 'resourceMatch'>): boolean;
+//# sourceMappingURL=StatementAnalysis.d.ts.map

package/dist/cjs/StatementAnalysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatementAnalysis.d.ts","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEpE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,SAAS,EAAE,SAAS,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC;;OAEG;IACH,OAAO,EAAE,gBAAgB,CAAA;IAEzB;;OAEG;IACH,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAA;IAE/B;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAU7E;AAED,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAUnF;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,IAAI,CACZ,iBAAiB,EACjB,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CACtE,GACA,OAAO,CAST;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,gBAAgB,GAAG,eAAe,CAAC,GACpF,OAAO,CAQT"}

package/dist/cjs/StatementAnalysis.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityStatementAllows = identityStatementAllows;
+exports.identityStatementExplicitDeny = identityStatementExplicitDeny;
+exports.statementMatches = statementMatches;
+exports.reportIgnoredConditions = reportIgnoredConditions;
+/**
+ * Checks if a statement is an identity statement that allows the request.
+ *
+ * @param statement The statement to check.
+ * @returns Whether the statement is an identity statement that allows the request.
+ */
+function identityStatementAllows(statement) {
+    if (statement.resourceMatch &&
+        statement.actionMatch &&
+        statement.conditionMatch === 'Match' &&
+        statement.statement.effect() === 'Allow') {
+        return true;
+    }
+    return false;
+}
+function identityStatementExplicitDeny(statement) {
+    if (statement.resourceMatch &&
+        statement.actionMatch &&
+        statement.conditionMatch === 'Match' &&
+        statement.statement.effect() === 'Deny') {
+        return true;
+    }
+    return false;
+}
+function statementMatches(analysis) {
+    return (analysis.resourceMatch &&
+        analysis.actionMatch &&
+        analysis.conditionMatch === 'Match' &&
+        ['Match', 'AccountLevelMatch', 'SessionRoleMatch', 'SessionUserMatch'].includes(analysis.principalMatch));
+}
+/**
+ * Determines whether ignored conditions are decisive for a statement and should be reported.
+ *
+ * @param analysis the analysis of the statement
+ * @returns true if the ignored conditions are decisive, false otherwise
+ */
+function reportIgnoredConditions(analysis) {
+    return (analysis.resourceMatch &&
+        analysis.actionMatch &&
+        ['Match', 'AccountLevelMatch', 'SessionRoleMatch', 'SessionUserMatch'].includes(analysis.principalMatch));
+}
+//# sourceMappingURL=StatementAnalysis.js.map

package/dist/cjs/StatementAnalysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatementAnalysis.js","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":";;AA8DA,0DAUC;AAED,sEAUC;AAED,4CAcC;AAQD,0DAUC;AA9DD;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,SAA4B;IAClE,IACE,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,OAAO,EACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,6BAA6B,CAAC,SAA4B;IACxE,IACE,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,MAAM,EACvC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,gBAAgB,CAC9B,QAGC;IAED,OAAO,CACL,QAAQ,CAAC,aAAa;QACtB,QAAQ,CAAC,WAAW;QACpB,QAAQ,CAAC,cAAc,KAAK,OAAO;QACnC,CAAC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAC7E,QAAQ,CAAC,cAAc,CACxB,CACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,QAAqF;IAErF,OAAO,CACL,QAAQ,CAAC,aAAa;QACtB,QAAQ,CAAC,WAAW;QACpB,CAAC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAC7E,QAAQ,CAAC,cAAc,CACxB,CACF,CAAA;AACH,CAAC"}

package/dist/cjs/action/action.d.ts

@@ -0,0 +1,37 @@
+import { type Action, type Statement } from '@actsecurity/iam-policy';
+import { type ActionExplain, type StatementExplain } from '../explain/statementExplain.js';
+import { type AwsRequest } from '../request/request.js';
+/**
+ * Check if a request matches the Action or NotAction elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @returns true if the request matches the Action or NotAction in the statement, false otherwise
+ */
+export declare function requestMatchesStatementActions(request: AwsRequest, statement: Statement): {
+    matches: boolean;
+    details: Pick<StatementExplain, 'actions' | 'notActions'>;
+};
+/**
+ * Check if a request matches a set of actions.
+ *
+ * @param request the request to check
+ * @param actions the actions to check against
+ * @returns true if the request matches any of the actions, false otherwise
+ */
+export declare function requestMatchesActions(request: AwsRequest, actions: Action[]): {
+    matches: boolean;
+    explains: ActionExplain[];
+};
+/**
+ * Check if a request does not match a set of actions.
+ *
+ * @param request the request to check
+ * @param actions the actions to check against
+ * @returns true if the request does not match any of the actions, false if the request matches any of the actions
+ */
+export declare function requestMatchesNotActions(request: AwsRequest, actions: Action[]): {
+    matches: boolean;
+    explains: ActionExplain[];
+};
+//# sourceMappingURL=action.d.ts.map

package/dist/cjs/action/action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/action/action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAC1F,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAIvD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,GACnB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,YAAY,CAAC,CAAA;CAAE,CAejF;AAgBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,CAIjD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,CASjD"}

package/dist/cjs/action/action.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestMatchesStatementActions = requestMatchesStatementActions;
+exports.requestMatchesActions = requestMatchesActions;
+exports.requestMatchesNotActions = requestMatchesNotActions;
+const whitespaceRegex = /\s/;
+/**
+ * Check if a request matches the Action or NotAction elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @returns true if the request matches the Action or NotAction in the statement, false otherwise
+ */
+function requestMatchesStatementActions(request, statement) {
+    if (statement.isActionStatement()) {
+        const { matches, explains } = requestMatchesActions(request, statement.actions());
+        if (!statement.actionIsArray()) {
+            return { matches, details: { actions: explains[0] } };
+        }
+        return { matches, details: { actions: explains } };
+    }
+    else if (statement.isNotActionStatement()) {
+        const { matches, explains } = requestMatchesNotActions(request, statement.notActions());
+        if (!statement.notActionIsArray()) {
+            return { matches, details: { notActions: explains[0] } };
+        }
+        return { matches, details: { notActions: explains } };
+    }
+    throw new Error('Statement has neither Actions nor NotActions');
+}
+/**
+ * Convert an action action (the part after the colon) to a regular expression.
+ *
+ * @param action the action to convert to a regular expression
+ * @returns a regular that replaces any wildcards in the action with the appropriate regular expression.
+ */
+function convertActionToRegex(action) {
+    if (action.indexOf(':') != -1) {
+        throw new Error('Action should not contain a colon');
+    }
+    const pattern = '^' + action.replace(/\?/g, '.').replace(/\*/g, '.*?') + '$';
+    return new RegExp(pattern, 'i');
+}
+/**
+ * Check if a request matches a set of actions.
+ *
+ * @param request the request to check
+ * @param actions the actions to check against
+ * @returns true if the request matches any of the actions, false otherwise
+ */
+function requestMatchesActions(request, actions) {
+    const explains = actions.map((action) => requestMatchesSingleAction(request, action));
+    const matches = explains.some((explain) => explain.matches);
+    return { matches, explains };
+}
+/**
+ * Check if a request does not match a set of actions.
+ *
+ * @param request the request to check
+ * @param actions the actions to check against
+ * @returns true if the request does not match any of the actions, false if the request matches any of the actions
+ */
+function requestMatchesNotActions(request, actions) {
+    const explains = actions.map((action) => {
+        const explain = requestMatchesSingleAction(request, action);
+        explain.matches = !explain.matches;
+        return explain;
+    });
+    const matches = !explains.some((explain) => !explain.matches);
+    return { matches, explains };
+}
+function requestMatchesSingleAction(request, action) {
+    if (action.isWildcardAction()) {
+        return {
+            action: action.value(),
+            matches: true
+        };
+    }
+    else if (action.isServiceAction()) {
+        const actionPart = action.action();
+        if (actionPart.length === 0 || whitespaceRegex.test(actionPart)) {
+            return {
+                action: action.value(),
+                matches: false
+            };
+        }
+        if (request.action.service() != action.service()) {
+            return {
+                action: action.value(),
+                matches: false
+            };
+        }
+        const actionRegex = convertActionToRegex(actionPart);
+        const matches = actionRegex.test(request.action.action());
+        return {
+            action: action.value(),
+            matches
+        };
+    }
+    throw new Error('Unknown action type');
+}
+//# sourceMappingURL=action.js.map

package/dist/cjs/action/action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../../../src/action/action.ts"],"names":[],"mappings":";;AAaA,wEAkBC;AAuBD,sDAOC;AASD,4DAYC;AA9ED,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B;;;;;;GAMG;AACH,SAAgB,8BAA8B,CAC5C,OAAmB,EACnB,SAAoB;IAEpB,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACvD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAA;IACpD,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;QACvF,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAC1D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAC5E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,OAAmB,EACnB,OAAiB;IAEjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IACrF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CACtC,OAAmB,EACnB,OAAiB;IAEjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3D,OAAO,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAA;QAClC,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAmB,EAAE,MAAc;IACrE,IAAI,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;YACtB,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;QAClC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;gBACtB,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;gBACtB,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACzD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;YACtB,OAAO;SACR,CAAA;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;AACxC,CAAC"}

package/dist/cjs/analysis/allowedConditions.d.ts

@@ -0,0 +1,61 @@
+import { type Condition } from '@actsecurity/iam-policy';
+import { type AllowedConditionExpression, type AllowedConditionSource, type IdentityAnalysis, type RcpAnalysis, type ResourceAnalysis, type ScpAnalysis } from '../evaluate.js';
+import { type StatementAnalysis } from '../StatementAnalysis.js';
+/**
+ * Convert a statement's ignored allow-side conditions to an expression.
+ *
+ * @param statement the statement analysis to convert
+ * @param policyType the policy family containing the statement
+ * @param orgIdentifier the organization identifier for control-policy statements
+ * @returns an expression for the statement's ignored conditions
+ */
+export declare function allowStatementExpression(statement: StatementAnalysis, policyType: AllowedConditionSource['policyType'], orgIdentifier?: string): AllowedConditionExpression;
+/**
+ * Convert a statement's ignored deny-side conditions to an expression that avoids the deny.
+ *
+ * @param statement the statement analysis to convert
+ * @param policyType the policy family containing the statement
+ * @param orgIdentifier the organization identifier for control-policy statements
+ * @returns an expression that must hold to avoid the deny
+ */
+export declare function denyStatementEscapeExpression(statement: StatementAnalysis, policyType: AllowedConditionSource['policyType'], orgIdentifier?: string): AllowedConditionExpression;
+/**
+ * Invert a single IAM condition into an allowed-condition expression.
+ *
+ * @param condition the condition to invert
+ * @param source source metadata for the condition
+ * @returns the expression that satisfies the logical complement of the condition
+ */
+export declare function invertCondition(condition: Condition, source: AllowedConditionSource): AllowedConditionExpression;
+/**
+ * Combine condition expressions with AND semantics and simplify identity/absorbing values.
+ *
+ * @param expressions the expressions to combine
+ * @returns a simplified expression
+ */
+export declare function and(expressions: AllowedConditionExpression[]): AllowedConditionExpression;
+/**
+ * Combine condition expressions with OR semantics and simplify identity/absorbing values.
+ *
+ * @param expressions the expressions to combine
+ * @returns a simplified expression
+ */
+export declare function or(expressions: AllowedConditionExpression[]): AllowedConditionExpression;
+export declare function allowedConditionOutput(expression: AllowedConditionExpression, simulationMode: string, result: string): AllowedConditionExpression | undefined;
+export declare function sessionPolicyExpression(analysis: IdentityAnalysis | undefined, sessionPolicyPresent: boolean): AllowedConditionExpression;
+export declare function identityPolicyExpression(analysis: IdentityAnalysis | undefined): AllowedConditionExpression;
+export declare function permissionBoundaryExpression(analysis: IdentityAnalysis | undefined): AllowedConditionExpression;
+export declare function endpointPolicyExpression(analysis: IdentityAnalysis | undefined): AllowedConditionExpression;
+export declare function resourceAllowStatementsExpression(statements: StatementAnalysis[]): AllowedConditionExpression;
+export declare function allDenyEscapeExpressions(input: {
+    sessionAnalysis?: IdentityAnalysis;
+    scpAnalysis?: ScpAnalysis;
+    rcpAnalysis?: RcpAnalysis;
+    identityAnalysis?: IdentityAnalysis;
+    resourceAnalysis?: ResourceAnalysis;
+    permissionBoundaryAnalysis?: IdentityAnalysis;
+    endpointAnalysis?: IdentityAnalysis;
+}): AllowedConditionExpression[];
+export declare function always(): AllowedConditionExpression;
+export declare function never(reason: 'explicitDenyWithoutConditions' | 'noApplicableAllow'): AllowedConditionExpression;
+//# sourceMappingURL=allowedConditions.d.ts.map

package/dist/cjs/analysis/allowedConditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedConditions.d.ts","sourceRoot":"","sources":["../../../src/analysis/allowedConditions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EACL,KAAK,0BAA0B,EAE/B,KAAK,sBAAsB,EAE3B,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAEhE;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,iBAAiB,EAC5B,UAAU,EAAE,sBAAsB,CAAC,YAAY,CAAC,EAChD,aAAa,CAAC,EAAE,MAAM,GACrB,0BAA0B,CAE5B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,iBAAiB,EAC5B,UAAU,EAAE,sBAAsB,CAAC,YAAY,CAAC,EAChD,aAAa,CAAC,EAAE,MAAM,GACrB,0BAA0B,CAO5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,sBAAsB,GAC7B,0BAA0B,CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,GAAG,CAAC,WAAW,EAAE,0BAA0B,EAAE,GAAG,0BAA0B,CAmBzF;AAED;;;;;GAKG;AACH,wBAAgB,EAAE,CAAC,WAAW,EAAE,0BAA0B,EAAE,GAAG,0BAA0B,CAmBxF;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,0BAA0B,EACtC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,GACb,0BAA0B,GAAG,SAAS,CAKxC;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,oBAAoB,EAAE,OAAO,GAC5B,0BAA0B,CAE5B;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,0BAA0B,CAE5B;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,0BAA0B,CAE5B;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,0BAA0B,CAE5B;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,iBAAiB,EAAE,GAC9B,0BAA0B,CAE5B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,eAAe,CAAC,EAAE,gBAAgB,CAAA;IAClC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,0BAA0B,CAAC,EAAE,gBAAgB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CACpC,GAAG,0BAA0B,EAAE,CAU/B;AA+VD,wBAAgB,MAAM,IAAI,0BAA0B,CAEnD;AAED,wBAAgB,KAAK,CACnB,MAAM,EAAE,+BAA+B,GAAG,mBAAmB,GAC5D,0BAA0B,CAE5B"}