@actsecurity/iam-simulate 0.1.173

package/dist/cjs/util/resourceStrings.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceArnsOverlap = resourceArnsOverlap;
+exports.expandShortArn = expandShortArn;
+/**
+ * Determines if two AWS ARN patterns have any overlap in the resources they could match.
+ * Handles wildcards (*) and single-character patterns (?) in both ARN strings.
+ *
+ * @param arn1 First ARN pattern to compare
+ * @param arn2 Second ARN pattern to compare
+ * @returns true if the patterns could match some of the same resources, false if they are completely disjoint
+ */
+function resourceArnsOverlap(arn1, arn2) {
+    // Fast-path
+    if (arn1 === arn2)
+        return true;
+    if (arn1 === '*' || arn2 === '*')
+        return true;
+    // Short ARN expansion: ARNs with fewer than 6 colon-separated segments
+    // have missing trailing segments treated as implicit wildcards.
+    const expanded1 = expandShortArn(arn1);
+    const expanded2 = expandShortArn(arn2);
+    const A = [...expanded1];
+    const B = [...expanded2];
+    const n = A.length;
+    const m = B.length;
+    // BFS over states (i, j) meaning:
+    // we've consumed up to i in A and up to j in B
+    const visited = new Set();
+    const queue = [[0, 0]];
+    const key = (i, j) => `${i},${j}`;
+    while (queue.length > 0) {
+        const [i, j] = queue.shift();
+        const k = key(i, j);
+        if (visited.has(k))
+            continue;
+        visited.add(k);
+        // Accept if both ended
+        if (i === n && j === m)
+            return true;
+        const aTok = tokAt(A, i);
+        const bTok = tokAt(B, j);
+        // Epsilon transitions: '*' can match empty
+        if (aTok === '*')
+            queue.push([i + 1, j]);
+        if (bTok === '*')
+            queue.push([i, j + 1]);
+        // Consume-one-character transitions:
+        // if both can consume the same next character, advance appropriately
+        if (canConsumeSameChar(aTok, bTok)) {
+            const nextIs = nextIdxAfterOneChar(A, i);
+            const nextJs = nextIdxAfterOneChar(B, j);
+            for (const ni of nextIs) {
+                for (const nj of nextJs) {
+                    queue.push([ni, nj]);
+                }
+            }
+        }
+    }
+    return false;
+}
+function tokAt(p, idx) {
+    return idx < p.length ? p[idx] : null; // null = end
+}
+// Whether both patterns can consume at least one *same* next character
+function canConsumeSameChar(a, b) {
+    if (a === null || b === null)
+        return false;
+    const aAny = a === '*' || a === '?';
+    const bAny = b === '*' || b === '?';
+    // both literals
+    if (!aAny && !bAny)
+        return a === b;
+    // at least one side can match any char
+    return true;
+}
+// Next indices after consuming exactly one character from pattern p at idx
+function nextIdxAfterOneChar(p, idx) {
+    const t = tokAt(p, idx);
+    if (t === null)
+        return [];
+    if (t === '*')
+        return [idx]; // '*' stays and can keep consuming
+    return [idx + 1]; // literal or '?' consumes one and advances
+}
+/**
+ * Expands a short ARN (fewer than 6 colon-separated segments) by padding
+ * missing trailing segments with `*`. Non-ARN strings and full ARNs are
+ * returned unchanged.
+ *
+ * @param arn the ARN string to expand
+ * @returns the expanded ARN string with missing segments filled with `*`
+ */
+function expandShortArn(arn) {
+    if (!arn.startsWith('arn:')) {
+        return arn;
+    }
+    const segments = arn.split(':');
+    if (segments.length >= 6) {
+        return arn;
+    }
+    while (segments.length < 6) {
+        segments.push('*');
+    }
+    return segments.join(':');
+}
+//# sourceMappingURL=resourceStrings.js.map

package/dist/cjs/util/resourceStrings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceStrings.js","sourceRoot":"","sources":["../../../src/util/resourceStrings.ts"],"names":[],"mappings":";;AAQA,kDAqDC;AAoCD,wCAYC;AA7GD;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC5D,YAAY;IACZ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAE7C,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IAEtC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAA;IACxB,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAA;IAExB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAElB,kCAAkC;IAClC,+CAA+C;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,KAAK,GAA4B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAE/C,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAA;IAEjD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;QAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACnB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAQ;QAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAEd,uBAAuB;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAEnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAExB,2CAA2C;QAC3C,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAExC,qCAAqC;QACrC,qEAAqE;QACrE,IAAI,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACxC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;gBACxB,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;oBACxB,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,KAAK,CAAC,CAAW,EAAE,GAAW;IACrC,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA,CAAC,aAAa;AACrD,CAAC;AAED,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,CAAgB,EAAE,CAAgB;IAC5D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAE1C,MAAM,IAAI,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAA;IACnC,MAAM,IAAI,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAA;IAEnC,gBAAgB;IAChB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAElC,uCAAuC;IACvC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,2EAA2E;AAC3E,SAAS,mBAAmB,CAAC,CAAW,EAAE,GAAW;IACnD,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACvB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IACzB,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,CAAA,CAAC,mCAAmC;IAC/D,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA,CAAC,2CAA2C;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC"}

package/dist/cjs/util.d.ts

@@ -0,0 +1,90 @@
+import { type Resource } from '@actsecurity/iam-policy';
+import { type AwsRequest } from './request/request.js';
+export interface StringReplaceOptions {
+    replaceWildcards: boolean;
+    convertToRegex: boolean;
+}
+/**
+ * This will convert a string to a regex that can be used to match against a string.
+ * This will replace any variables in the string with the value of the variable in the request context.
+ *
+ * @param value the string to convert to a regex
+ * @param requestContext the request context to get the variable values from
+ * @returns a regex that can be used to match against a string
+ */
+export declare function convertIamString(value: string, request: AwsRequest, replaceOptions: {
+    replaceWildcards?: boolean;
+    convertToRegex: false;
+}): string;
+export declare function convertIamString(value: string, request: AwsRequest, replaceOptions?: Partial<StringReplaceOptions>): {
+    pattern: RegExp;
+    errors?: string[];
+};
+export interface ArnParts {
+    partition: string | undefined;
+    service: string | undefined;
+    region: string | undefined;
+    accountId: string | undefined;
+    resource: string | undefined;
+}
+/**
+ * Split an ARN into its parts
+ *
+ * @param arn the arn to split
+ * @returns the parts of the ARN
+ */
+export declare function splitArnParts(arn: string): ArnParts;
+/**
+ * Get the product/id segments of the resource portion of an ARN.
+ * The first segment is the product segment and the second segment is the resource id segment.
+ * This could be split by a colon or a slash, so it checks for both. It also checks for S3 buckets/objects.
+ *
+ * @param resource The resource to get the resource segments. Must be an ARN resource.
+ * @returns a tuple with the first segment being the product segment (including the separator) and the second segment being the resource id.
+ */
+export declare function getResourceSegments(resource: Resource): [string, string];
+/**
+ * Checks if a value is defined and not null and narrows the type to the defined type
+ *
+ * @param value the value to check if it is defined
+ * @returns if the value is defined and not null
+ */
+export declare function isDefined<T>(value: T | undefined): value is T;
+/**
+ * Checks if a value is not defined or null
+ *
+ * @param value the value to check if it is not defined
+ * @returns if the value is not defined or null
+ */
+export declare function isNotDefined<T>(value: T | undefined): value is undefined;
+/**
+ * Checks if an action is a wildcard only action
+ *
+ * @param service the service the action belongs to
+ * @param action the action to check if it is a wildcard only action
+ * @returns if the action is a wildcard only action
+ * @throws an error if the service or action does not exist
+ */
+export declare function isWildcardOnlyAction(service: string, action: string): Promise<boolean>;
+/**
+ * Lowercase all strings in an array
+ *
+ * @param strings the strings to lowercase
+ * @returns the lowercased strings
+ */
+export declare function lowerCaseAll(strings: string[]): string[];
+/**
+ * Gets the IAM variables from a string
+ *
+ * @param value the string to get the variables from
+ * @returns the variables in the string, if any
+ */
+export declare function getVariablesFromString(value: string): string[];
+/**
+ * Checks to see if an ARN is an S3 bucket or object ARN
+ *
+ * @param arn the ARN to check
+ * @returns whether the ARN is an S3 bucket or object ARN
+ */
+export declare function isS3BucketOrObjectArn(arn: string): boolean;
+//# sourceMappingURL=util.d.ts.map

package/dist/cjs/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../src/util.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAItD,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,OAAO,CAAA;IACzB,cAAc,EAAE,OAAO,CAAA;CACxB;AAOD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,KAAK,CAAA;CAAE,GACpE,MAAM,CAAA;AACT,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EACnB,cAAc,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAC7C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAyPzC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAG7B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAenD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BxE;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,GAAG,KAAK,IAAI,CAAC,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,GAAG,KAAK,IAAI,SAAS,CAExE;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG5F;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAY9D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAa1D"}

package/dist/cjs/util.js

@@ -0,0 +1,350 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.convertIamString = convertIamString;
+exports.splitArnParts = splitArnParts;
+exports.getResourceSegments = getResourceSegments;
+exports.isDefined = isDefined;
+exports.isNotDefined = isNotDefined;
+exports.isWildcardOnlyAction = isWildcardOnlyAction;
+exports.lowerCaseAll = lowerCaseAll;
+exports.getVariablesFromString = getVariablesFromString;
+exports.isS3BucketOrObjectArn = isS3BucketOrObjectArn;
+const iam_data_1 = require("@actsecurity/iam-data");
+const matchesNothing = new RegExp('a^');
+const defaultStringReplaceOptions = {
+    replaceWildcards: true,
+    convertToRegex: true
+};
+function convertIamString(value, request, replaceOptions) {
+    const options = { ...defaultStringReplaceOptions, ...replaceOptions };
+    const errors = [];
+    const newValue = replaceIamStringTokens(value, request, options, errors);
+    if (!options.convertToRegex) {
+        return newValue;
+    }
+    if (errors.length > 0) {
+        return { pattern: matchesNothing, errors };
+    }
+    return { pattern: new RegExp('^' + newValue + '$') };
+}
+/**
+ * Replace IAM wildcard and variable tokens while escaping literal spans for regex conversion.
+ *
+ * @param value the IAM string value to convert
+ * @param request the request context used to resolve policy variables
+ * @param options controls wildcard replacement and regex conversion behavior
+ * @param errors collects variable resolution errors that make the value unable to match
+ * @returns the converted IAM string or regex source fragment
+ */
+function replaceIamStringTokens(value, request, options, errors) {
+    let newValue = '';
+    let literalStart = 0;
+    let index = 0;
+    while (index < value.length) {
+        const character = value[index];
+        if (character == '*' || character == '?') {
+            newValue += replaceLiteralSpan(value.slice(literalStart, index), options);
+            newValue += replaceIamStringToken(character, request, options, errors);
+            index++;
+            literalStart = index;
+        }
+        else if (character == '$' && value[index + 1] == '{') {
+            const variableEndIndex = value.indexOf('}', index + 2);
+            if (variableEndIndex == -1) {
+                index++;
+            }
+            else {
+                newValue += replaceLiteralSpan(value.slice(literalStart, index), options);
+                newValue += replaceIamStringToken(value.slice(index, variableEndIndex + 1), request, options, errors);
+                index = variableEndIndex + 1;
+                literalStart = index;
+            }
+        }
+        else {
+            index++;
+        }
+    }
+    newValue += replaceLiteralSpan(value.slice(literalStart), options);
+    return newValue;
+}
+/**
+ * Escape a literal IAM string span when producing a regular expression.
+ *
+ * @param literal the literal IAM string span outside wildcard and variable tokens
+ * @param options controls whether regex conversion is enabled
+ * @returns the literal span escaped for regex conversion, or unchanged for raw string conversion
+ */
+function replaceLiteralSpan(literal, options) {
+    return options.convertToRegex ? escapeRegexCharacters(literal) : literal;
+}
+/**
+ * Replace a single IAM string token with its regex or raw string representation.
+ *
+ * @param match the IAM token to replace
+ * @param request the request context used to resolve policy variables
+ * @param options controls wildcard replacement and regex conversion behavior
+ * @param errors collects variable resolution errors that make the value unable to match
+ * @returns the token replacement value
+ */
+function replaceIamStringToken(match, request, options, errors) {
+    if (match == '?') {
+        return replacementValue(match, '\\?', '.', options);
+    }
+    else if (match == '*') {
+        return replacementValue(match, '\\*', '.*?', options);
+    }
+    else if (match == '${*}') {
+        return replacementValue(match, '\\$\\{\\*\\}', '\\*', options);
+    }
+    else if (match == '${?}') {
+        return replacementValue(match, '\\$\\{\\?\\}', '\\?', options);
+    }
+    else if (match == '${$}') {
+        return replacementValue(match, '\\$\\{\\$\\}', '\\$', options);
+    }
+    //This means it's a variable
+    const inTheBrackets = match.slice(2, -1);
+    let defaultValue = undefined;
+    const defaultParts = inTheBrackets.split(', ');
+    if (defaultParts.length == 2) {
+        const segmentAfterComma = defaultParts.at(1);
+        if (segmentAfterComma?.startsWith("'") && segmentAfterComma.endsWith("'")) {
+            defaultValue = segmentAfterComma.slice(1, -1);
+        }
+    }
+    const variableName = defaultParts.at(0).trim();
+    const { value: requestValue, error: requestValueError } = getContextSingleValue(request, variableName);
+    if (requestValue) {
+        //TODO: Maybe escape the * in the resolved value to ${*}
+        return options.convertToRegex ? escapeRegexCharacters(requestValue) : requestValue;
+    }
+    else if (defaultValue) {
+        /*
+          TODO: What happens in a request if a multi value context key is used in a string and there
+          is a default value? Will it use the default value or will it fail the condition test?
+        */
+        //TODO: Maybe escape the * in the resolved value to ${*}
+        return options.convertToRegex ? escapeRegexCharacters(defaultValue) : defaultValue;
+    }
+    else {
+        if (requestValueError == 'missing') {
+            errors.push(`{${variableName}} not found in request context, and no default value provided. This will never match`);
+        }
+        else if (requestValueError == 'multivalue') {
+            errors.push(`{${variableName}} is a multi value context key, and cannot be used for replacement. This will never match`);
+        }
+        /*
+        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#policy-vars-no-value
+        */
+        return match;
+    }
+}
+/**
+ * Replace regex characters in a string with their escaped versions
+ *
+ * @param str the string to escape regex characters in
+ * @returns the string with regex characters escaped
+ */
+function escapeRegexCharacters(str) {
+    let escaped = '';
+    for (const character of str) {
+        if (isRegexMetacharacter(character)) {
+            escaped += '\\';
+        }
+        escaped += character;
+    }
+    return escaped;
+}
+/**
+ * Check if a character has special meaning in a regular expression pattern.
+ *
+ * @param character the character to check
+ * @returns whether the character must be escaped for literal regex matching
+ */
+function isRegexMetacharacter(character) {
+    return (character == '.' ||
+        character == '*' ||
+        character == '+' ||
+        character == '?' ||
+        character == '^' ||
+        character == '$' ||
+        character == '{' ||
+        character == '}' ||
+        character == '(' ||
+        character == ')' ||
+        character == '|' ||
+        character == '[' ||
+        character == ']' ||
+        character == '\\');
+}
+/**
+ * Get the string value of a context key only if it is a single value key
+ *
+ * @param requestContext the request context to get the value from
+ * @param contextKeyName the name of the context key to get the value of
+ * @returns the value of the context key if it is a single value key, undefined otherwise
+ */
+function getContextSingleValue(request, contextKeyName) {
+    if (!request.contextKeyExists(contextKeyName)) {
+        return {
+            error: 'missing'
+        };
+    }
+    const keyValue = request.getContextKeyValue(contextKeyName);
+    if (keyValue.isStringValue()) {
+        return { value: keyValue.value };
+    }
+    return { error: 'multivalue' };
+}
+/**
+ * Get the replacement value for a string
+ *
+ * @param original the original IAM token text
+ * @param escaped the regex-escaped literal representation of the token
+ * @param regex the regex wildcard representation of the token
+ * @param options controls wildcard replacement and regex conversion behavior
+ * @returns the token replacement value
+ */
+function replacementValue(original, escaped, regex, options) {
+    if (!options.convertToRegex) {
+        return original;
+    }
+    if (options.replaceWildcards) {
+        return regex;
+    }
+    return escaped;
+}
+/**
+ * Split an ARN into its parts
+ *
+ * @param arn the arn to split
+ * @returns the parts of the ARN
+ */
+function splitArnParts(arn) {
+    const parts = arn.split(':');
+    const partition = parts.at(1);
+    const service = parts.at(2);
+    const region = parts.at(3);
+    const accountId = parts.at(4);
+    const resource = parts.slice(5).join(':');
+    return {
+        partition,
+        service,
+        region,
+        accountId,
+        resource
+    };
+}
+/**
+ * Get the product/id segments of the resource portion of an ARN.
+ * The first segment is the product segment and the second segment is the resource id segment.
+ * This could be split by a colon or a slash, so it checks for both. It also checks for S3 buckets/objects.
+ *
+ * @param resource The resource to get the resource segments. Must be an ARN resource.
+ * @returns a tuple with the first segment being the product segment (including the separator) and the second segment being the resource id.
+ */
+function getResourceSegments(resource) {
+    if (!resource.isArnResource()) {
+        throw new Error(`Resource ${resource.value()} is not an ARN resource`);
+    }
+    const resourceString = resource.resource();
+    // This is terrible, and I hate it
+    if (resource.service() === 's3' && resource.account() === '' && resource.region() === '') {
+        return ['', resourceString];
+    }
+    const slashIndex = resourceString.indexOf('/');
+    const colonIndex = resourceString.indexOf(':');
+    let splitIndex = slashIndex;
+    if (slashIndex != -1 && colonIndex != -1) {
+        splitIndex = Math.min(slashIndex, colonIndex) + 1;
+    }
+    else if (colonIndex == -1) {
+        splitIndex = slashIndex + 1;
+    }
+    else if (slashIndex == -1) {
+        splitIndex = colonIndex + 1;
+    }
+    else {
+        throw new Error(`Unable to split resource ${resource}`);
+    }
+    return [resourceString.slice(0, splitIndex), resourceString.slice(splitIndex)];
+}
+/**
+ * Checks if a value is defined and not null and narrows the type to the defined type
+ *
+ * @param value the value to check if it is defined
+ * @returns if the value is defined and not null
+ */
+function isDefined(value) {
+    return value !== undefined && value !== null;
+}
+/**
+ * Checks if a value is not defined or null
+ *
+ * @param value the value to check if it is not defined
+ * @returns if the value is not defined or null
+ */
+function isNotDefined(value) {
+    return !isDefined(value);
+}
+/**
+ * Checks if an action is a wildcard only action
+ *
+ * @param service the service the action belongs to
+ * @param action the action to check if it is a wildcard only action
+ * @returns if the action is a wildcard only action
+ * @throws an error if the service or action does not exist
+ */
+async function isWildcardOnlyAction(service, action) {
+    const actionDetails = await (0, iam_data_1.iamActionDetails)(service, action);
+    return actionDetails.resourceTypes.length === 0;
+}
+/**
+ * Lowercase all strings in an array
+ *
+ * @param strings the strings to lowercase
+ * @returns the lowercased strings
+ */
+function lowerCaseAll(strings) {
+    return strings.map((s) => s.toLowerCase());
+}
+/**
+ * Gets the IAM variables from a string
+ *
+ * @param value the string to get the variables from
+ * @returns the variables in the string, if any
+ */
+function getVariablesFromString(value) {
+    const matches = value.match(/\$\{.*?\}/g);
+    if (matches) {
+        return matches.map((m) => {
+            const inBrackets = m.slice(2, -1);
+            if (inBrackets.includes(',')) {
+                return inBrackets.split(',')[0].trim();
+            }
+            return inBrackets;
+        });
+    }
+    return [];
+}
+/**
+ * Checks to see if an ARN is an S3 bucket or object ARN
+ *
+ * @param arn the ARN to check
+ * @returns whether the ARN is an S3 bucket or object ARN
+ */
+function isS3BucketOrObjectArn(arn) {
+    const arnParts = splitArnParts(arn);
+    if (arnParts.service !== 's3') {
+        return false;
+    }
+    if (!arnParts.resource) {
+        return false;
+    }
+    // S3 bucket or object ARNs have no account ID or region
+    if (arnParts.accountId || arnParts.region) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=util.js.map

package/dist/cjs/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/util.ts"],"names":[],"mappings":";;AAkCA,4CAmBC;AAqPD,sCAeC;AAUD,kDA2BC;AAQD,8BAEC;AAQD,oCAEC;AAUD,oDAGC;AAQD,oCAEC;AAQD,wDAYC;AAQD,sDAaC;AAlbD,oDAAwD;AAIxD,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAA;AAOvC,MAAM,2BAA2B,GAAyB;IACxD,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;CACrB,CAAA;AAoBD,SAAgB,gBAAgB,CAC9B,KAAa,EACb,OAAmB,EACnB,cAA8C;IAE9C,MAAM,OAAO,GAAG,EAAE,GAAG,2BAA2B,EAAE,GAAG,cAAc,EAAE,CAAA;IAErE,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAExE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAC7B,KAAa,EACb,OAAmB,EACnB,OAA6B,EAC7B,MAAgB;IAEhB,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QAE9B,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACzC,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;YACzE,QAAQ,IAAI,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YACtE,KAAK,EAAE,CAAA;YACP,YAAY,GAAG,KAAK,CAAA;QACtB,CAAC;aAAM,IAAI,SAAS,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;YACvD,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAEtD,IAAI,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC3B,KAAK,EAAE,CAAA;YACT,CAAC;iBAAM,CAAC;gBACN,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;gBACzE,QAAQ,IAAI,qBAAqB,CAC/B,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,GAAG,CAAC,CAAC,EACxC,OAAO,EACP,OAAO,EACP,MAAM,CACP,CAAA;gBACD,KAAK,GAAG,gBAAgB,GAAG,CAAC,CAAA;gBAC5B,YAAY,GAAG,KAAK,CAAA;YACtB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,EAAE,CAAA;QACT,CAAC;IACH,CAAC;IAED,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAA;IAClE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,OAA6B;IACxE,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAC5B,KAAa,EACb,OAAmB,EACnB,OAA6B,EAC7B,MAAgB;IAEhB,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;SAAM,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;SAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,gBAAgB,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;SAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,gBAAgB,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;SAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,gBAAgB,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAExC,IAAI,YAAY,GAAG,SAAS,CAAA;IAC5B,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,iBAAiB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;IAE/C,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,qBAAqB,CAC7E,OAAO,EACP,YAAY,CACb,CAAA;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,wDAAwD;QACxD,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;IACpF,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB;;;UAGE;QACF,wDAAwD;QACxD,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;IACpF,CAAC;SAAM,CAAC;QACN,IAAI,iBAAiB,IAAI,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACT,IAAI,YAAY,sFAAsF,CACvG,CAAA;QACH,CAAC;aAAM,IAAI,iBAAiB,IAAI,YAAY,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CACT,IAAI,YAAY,2FAA2F,CAC5G,CAAA;QACH,CAAC;QACD;;UAEE;QACF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,OAAO,GAAG,EAAE,CAAA;IAEhB,KAAK,MAAM,SAAS,IAAI,GAAG,EAAE,CAAC;QAC5B,IAAI,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,IAAI,CAAA;QACjB,CAAC;QACD,OAAO,IAAI,SAAS,CAAA;IACtB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,OAAO,CACL,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,IAAI,CAClB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,OAAmB,EACnB,cAAsB;IAEtB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,SAAS;SACjB,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAC3D,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;IAClC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CACvB,QAAgB,EAChB,OAAe,EACf,KAAa,EACb,OAA6B;IAE7B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAYD;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAEzC,OAAO;QACL,SAAS;QACT,OAAO;QACP,MAAM;QACN,SAAS;QACT,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,QAAkB;IACpD,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;IAE1C,kCAAkC;IAClC,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACzF,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;IAC7B,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9C,IAAI,UAAU,GAAG,UAAU,CAAA;IAC3B,IAAI,UAAU,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;IAC7B,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAI,KAAoB;IAC/C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAA;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAI,KAAoB;IAClD,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,MAAc;IACxE,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,OAAO,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,OAAiB;IAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,KAAa;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACvB,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACjC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,CAAC;YACD,OAAO,UAAU,CAAA;QACnB,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,wDAAwD;IACxD,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/esm/StatementAnalysis.d.ts

@@ -0,0 +1,63 @@
+import { type Condition, type Statement } from '@actsecurity/iam-policy';
+import { type ConditionMatchResult } from './condition/condition.js';
+import { type StatementExplain } from './explain/statementExplain.js';
+import { type PrincipalMatchResult } from './principal/principal.js';
+/**
+ * The result of analyzing a statement against a request.
+ *
+ */
+export interface StatementAnalysis {
+    /**
+     * The identifier of the policy that contains the statement.
+     */
+    policyId: string;
+    /**
+     * The statement being analyzed.
+     */
+    statement: Statement;
+    /**
+     * Whether the Resource or NotResource – if any – matches the request.
+     */
+    resourceMatch: boolean;
+    /**
+     * Whether the Action or NotAction matches the request.
+     */
+    actionMatch: boolean;
+    /**
+     * Whether the Principal or NotPrincipal – if any – matches the request.
+     */
+    principalMatch: PrincipalMatchResult;
+    /**
+     * Whether the Conditions matches the request.
+     */
+    conditionMatch: ConditionMatchResult;
+    /**
+     * The explain of evaluating the statement.
+     */
+    explain: StatementExplain;
+    /**
+     * Any conditions that were ignored during discovery mode.
+     */
+    ignoredConditions?: Condition[];
+    /**
+     * Role Session Name ignored during discovery mode.
+     */
+    ignoredRoleSessionName?: boolean;
+}
+/**
+ * Checks if a statement is an identity statement that allows the request.
+ *
+ * @param statement The statement to check.
+ * @returns Whether the statement is an identity statement that allows the request.
+ */
+export declare function identityStatementAllows(statement: StatementAnalysis): boolean;
+export declare function identityStatementExplicitDeny(statement: StatementAnalysis): boolean;
+export declare function statementMatches(analysis: Pick<StatementAnalysis, 'actionMatch' | 'conditionMatch' | 'principalMatch' | 'resourceMatch'>): boolean;
+/**
+ * Determines whether ignored conditions are decisive for a statement and should be reported.
+ *
+ * @param analysis the analysis of the statement
+ * @returns true if the ignored conditions are decisive, false otherwise
+ */
+export declare function reportIgnoredConditions(analysis: Pick<StatementAnalysis, 'actionMatch' | 'principalMatch' | 'resourceMatch'>): boolean;
+//# sourceMappingURL=StatementAnalysis.d.ts.map

package/dist/esm/StatementAnalysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatementAnalysis.d.ts","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEpE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,SAAS,EAAE,SAAS,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC;;OAEG;IACH,OAAO,EAAE,gBAAgB,CAAA;IAEzB;;OAEG;IACH,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAA;IAE/B;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAU7E;AAED,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAUnF;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,IAAI,CACZ,iBAAiB,EACjB,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CACtE,GACA,OAAO,CAST;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,gBAAgB,GAAG,eAAe,CAAC,GACpF,OAAO,CAQT"}