@actsecurity/iam-simulate 0.1.173

package/dist/esm/StatementAnalysis.js

@@ -0,0 +1,46 @@
+import {} from '@actsecurity/iam-policy';
+import {} from './condition/condition.js';
+import {} from './explain/statementExplain.js';
+import {} from './principal/principal.js';
+/**
+ * Checks if a statement is an identity statement that allows the request.
+ *
+ * @param statement The statement to check.
+ * @returns Whether the statement is an identity statement that allows the request.
+ */
+export function identityStatementAllows(statement) {
+    if (statement.resourceMatch &&
+        statement.actionMatch &&
+        statement.conditionMatch === 'Match' &&
+        statement.statement.effect() === 'Allow') {
+        return true;
+    }
+    return false;
+}
+export function identityStatementExplicitDeny(statement) {
+    if (statement.resourceMatch &&
+        statement.actionMatch &&
+        statement.conditionMatch === 'Match' &&
+        statement.statement.effect() === 'Deny') {
+        return true;
+    }
+    return false;
+}
+export function statementMatches(analysis) {
+    return (analysis.resourceMatch &&
+        analysis.actionMatch &&
+        analysis.conditionMatch === 'Match' &&
+        ['Match', 'AccountLevelMatch', 'SessionRoleMatch', 'SessionUserMatch'].includes(analysis.principalMatch));
+}
+/**
+ * Determines whether ignored conditions are decisive for a statement and should be reported.
+ *
+ * @param analysis the analysis of the statement
+ * @returns true if the ignored conditions are decisive, false otherwise
+ */
+export function reportIgnoredConditions(analysis) {
+    return (analysis.resourceMatch &&
+        analysis.actionMatch &&
+        ['Match', 'AccountLevelMatch', 'SessionRoleMatch', 'SessionUserMatch'].includes(analysis.principalMatch));
+}
+//# sourceMappingURL=StatementAnalysis.js.map

package/dist/esm/StatementAnalysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatementAnalysis.js","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAA6B,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAyB,MAAM,+BAA+B,CAAA;AACrE,OAAO,EAA6B,MAAM,0BAA0B,CAAA;AAqDpE;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA4B;IAClE,IACE,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,OAAO,EACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,SAA4B;IACxE,IACE,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,MAAM,EACvC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAGC;IAED,OAAO,CACL,QAAQ,CAAC,aAAa;QACtB,QAAQ,CAAC,WAAW;QACpB,QAAQ,CAAC,cAAc,KAAK,OAAO;QACnC,CAAC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAC7E,QAAQ,CAAC,cAAc,CACxB,CACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAqF;IAErF,OAAO,CACL,QAAQ,CAAC,aAAa;QACtB,QAAQ,CAAC,WAAW;QACpB,CAAC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAC7E,QAAQ,CAAC,cAAc,CACxB,CACF,CAAA;AACH,CAAC"}

package/dist/esm/action/action.d.ts

@@ -0,0 +1,37 @@
+import { type Action, type Statement } from '@actsecurity/iam-policy';
+import { type ActionExplain, type StatementExplain } from '../explain/statementExplain.js';
+import { type AwsRequest } from '../request/request.js';
+/**
+ * Check if a request matches the Action or NotAction elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @returns true if the request matches the Action or NotAction in the statement, false otherwise
+ */
+export declare function requestMatchesStatementActions(request: AwsRequest, statement: Statement): {
+    matches: boolean;
+    details: Pick<StatementExplain, 'actions' | 'notActions'>;
+};
+/**
+ * Check if a request matches a set of actions.
+ *
+ * @param request the request to check
+ * @param actions the actions to check against
+ * @returns true if the request matches any of the actions, false otherwise
+ */
+export declare function requestMatchesActions(request: AwsRequest, actions: Action[]): {
+    matches: boolean;
+    explains: ActionExplain[];
+};
+/**
+ * Check if a request does not match a set of actions.
+ *
+ * @param request the request to check
+ * @param actions the actions to check against
+ * @returns true if the request does not match any of the actions, false if the request matches any of the actions
+ */
+export declare function requestMatchesNotActions(request: AwsRequest, actions: Action[]): {
+    matches: boolean;
+    explains: ActionExplain[];
+};
+//# sourceMappingURL=action.d.ts.map

package/dist/esm/action/action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/action/action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAC1F,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAIvD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,GACnB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,YAAY,CAAC,CAAA;CAAE,CAejF;AAgBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,CAIjD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,CASjD"}

package/dist/esm/action/action.js

@@ -0,0 +1,100 @@
+import {} from '@actsecurity/iam-policy';
+import {} from '../explain/statementExplain.js';
+import {} from '../request/request.js';
+const whitespaceRegex = /\s/;
+/**
+ * Check if a request matches the Action or NotAction elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @returns true if the request matches the Action or NotAction in the statement, false otherwise
+ */
+export function requestMatchesStatementActions(request, statement) {
+    if (statement.isActionStatement()) {
+        const { matches, explains } = requestMatchesActions(request, statement.actions());
+        if (!statement.actionIsArray()) {
+            return { matches, details: { actions: explains[0] } };
+        }
+        return { matches, details: { actions: explains } };
+    }
+    else if (statement.isNotActionStatement()) {
+        const { matches, explains } = requestMatchesNotActions(request, statement.notActions());
+        if (!statement.notActionIsArray()) {
+            return { matches, details: { notActions: explains[0] } };
+        }
+        return { matches, details: { notActions: explains } };
+    }
+    throw new Error('Statement has neither Actions nor NotActions');
+}
+/**
+ * Convert an action action (the part after the colon) to a regular expression.
+ *
+ * @param action the action to convert to a regular expression
+ * @returns a regular that replaces any wildcards in the action with the appropriate regular expression.
+ */
+function convertActionToRegex(action) {
+    if (action.indexOf(':') != -1) {
+        throw new Error('Action should not contain a colon');
+    }
+    const pattern = '^' + action.replace(/\?/g, '.').replace(/\*/g, '.*?') + '$';
+    return new RegExp(pattern, 'i');
+}
+/**
+ * Check if a request matches a set of actions.
+ *
+ * @param request the request to check
+ * @param actions the actions to check against
+ * @returns true if the request matches any of the actions, false otherwise
+ */
+export function requestMatchesActions(request, actions) {
+    const explains = actions.map((action) => requestMatchesSingleAction(request, action));
+    const matches = explains.some((explain) => explain.matches);
+    return { matches, explains };
+}
+/**
+ * Check if a request does not match a set of actions.
+ *
+ * @param request the request to check
+ * @param actions the actions to check against
+ * @returns true if the request does not match any of the actions, false if the request matches any of the actions
+ */
+export function requestMatchesNotActions(request, actions) {
+    const explains = actions.map((action) => {
+        const explain = requestMatchesSingleAction(request, action);
+        explain.matches = !explain.matches;
+        return explain;
+    });
+    const matches = !explains.some((explain) => !explain.matches);
+    return { matches, explains };
+}
+function requestMatchesSingleAction(request, action) {
+    if (action.isWildcardAction()) {
+        return {
+            action: action.value(),
+            matches: true
+        };
+    }
+    else if (action.isServiceAction()) {
+        const actionPart = action.action();
+        if (actionPart.length === 0 || whitespaceRegex.test(actionPart)) {
+            return {
+                action: action.value(),
+                matches: false
+            };
+        }
+        if (request.action.service() != action.service()) {
+            return {
+                action: action.value(),
+                matches: false
+            };
+        }
+        const actionRegex = convertActionToRegex(actionPart);
+        const matches = actionRegex.test(request.action.action());
+        return {
+            action: action.value(),
+            matches
+        };
+    }
+    throw new Error('Unknown action type');
+}
+//# sourceMappingURL=action.js.map

package/dist/esm/action/action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../../../src/action/action.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAA6C,MAAM,gCAAgC,CAAA;AAC1F,OAAO,EAAmB,MAAM,uBAAuB,CAAA;AAEvD,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAmB,EACnB,SAAoB;IAEpB,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACvD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAA;IACpD,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;QACvF,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAC1D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAC5E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAmB,EACnB,OAAiB;IAEjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IACrF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAmB,EACnB,OAAiB;IAEjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3D,OAAO,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAA;QAClC,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAmB,EAAE,MAAc;IACrE,IAAI,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;YACtB,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;QAClC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;gBACtB,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;gBACtB,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACzD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;YACtB,OAAO;SACR,CAAA;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;AACxC,CAAC"}

package/dist/esm/analysis/allowedConditions.d.ts

@@ -0,0 +1,61 @@
+import { type Condition } from '@actsecurity/iam-policy';
+import { type AllowedConditionExpression, type AllowedConditionSource, type IdentityAnalysis, type RcpAnalysis, type ResourceAnalysis, type ScpAnalysis } from '../evaluate.js';
+import { type StatementAnalysis } from '../StatementAnalysis.js';
+/**
+ * Convert a statement's ignored allow-side conditions to an expression.
+ *
+ * @param statement the statement analysis to convert
+ * @param policyType the policy family containing the statement
+ * @param orgIdentifier the organization identifier for control-policy statements
+ * @returns an expression for the statement's ignored conditions
+ */
+export declare function allowStatementExpression(statement: StatementAnalysis, policyType: AllowedConditionSource['policyType'], orgIdentifier?: string): AllowedConditionExpression;
+/**
+ * Convert a statement's ignored deny-side conditions to an expression that avoids the deny.
+ *
+ * @param statement the statement analysis to convert
+ * @param policyType the policy family containing the statement
+ * @param orgIdentifier the organization identifier for control-policy statements
+ * @returns an expression that must hold to avoid the deny
+ */
+export declare function denyStatementEscapeExpression(statement: StatementAnalysis, policyType: AllowedConditionSource['policyType'], orgIdentifier?: string): AllowedConditionExpression;
+/**
+ * Invert a single IAM condition into an allowed-condition expression.
+ *
+ * @param condition the condition to invert
+ * @param source source metadata for the condition
+ * @returns the expression that satisfies the logical complement of the condition
+ */
+export declare function invertCondition(condition: Condition, source: AllowedConditionSource): AllowedConditionExpression;
+/**
+ * Combine condition expressions with AND semantics and simplify identity/absorbing values.
+ *
+ * @param expressions the expressions to combine
+ * @returns a simplified expression
+ */
+export declare function and(expressions: AllowedConditionExpression[]): AllowedConditionExpression;
+/**
+ * Combine condition expressions with OR semantics and simplify identity/absorbing values.
+ *
+ * @param expressions the expressions to combine
+ * @returns a simplified expression
+ */
+export declare function or(expressions: AllowedConditionExpression[]): AllowedConditionExpression;
+export declare function allowedConditionOutput(expression: AllowedConditionExpression, simulationMode: string, result: string): AllowedConditionExpression | undefined;
+export declare function sessionPolicyExpression(analysis: IdentityAnalysis | undefined, sessionPolicyPresent: boolean): AllowedConditionExpression;
+export declare function identityPolicyExpression(analysis: IdentityAnalysis | undefined): AllowedConditionExpression;
+export declare function permissionBoundaryExpression(analysis: IdentityAnalysis | undefined): AllowedConditionExpression;
+export declare function endpointPolicyExpression(analysis: IdentityAnalysis | undefined): AllowedConditionExpression;
+export declare function resourceAllowStatementsExpression(statements: StatementAnalysis[]): AllowedConditionExpression;
+export declare function allDenyEscapeExpressions(input: {
+    sessionAnalysis?: IdentityAnalysis;
+    scpAnalysis?: ScpAnalysis;
+    rcpAnalysis?: RcpAnalysis;
+    identityAnalysis?: IdentityAnalysis;
+    resourceAnalysis?: ResourceAnalysis;
+    permissionBoundaryAnalysis?: IdentityAnalysis;
+    endpointAnalysis?: IdentityAnalysis;
+}): AllowedConditionExpression[];
+export declare function always(): AllowedConditionExpression;
+export declare function never(reason: 'explicitDenyWithoutConditions' | 'noApplicableAllow'): AllowedConditionExpression;
+//# sourceMappingURL=allowedConditions.d.ts.map

package/dist/esm/analysis/allowedConditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedConditions.d.ts","sourceRoot":"","sources":["../../../src/analysis/allowedConditions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EACL,KAAK,0BAA0B,EAE/B,KAAK,sBAAsB,EAE3B,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAEhE;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,iBAAiB,EAC5B,UAAU,EAAE,sBAAsB,CAAC,YAAY,CAAC,EAChD,aAAa,CAAC,EAAE,MAAM,GACrB,0BAA0B,CAE5B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,iBAAiB,EAC5B,UAAU,EAAE,sBAAsB,CAAC,YAAY,CAAC,EAChD,aAAa,CAAC,EAAE,MAAM,GACrB,0BAA0B,CAO5B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,sBAAsB,GAC7B,0BAA0B,CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,GAAG,CAAC,WAAW,EAAE,0BAA0B,EAAE,GAAG,0BAA0B,CAmBzF;AAED;;;;;GAKG;AACH,wBAAgB,EAAE,CAAC,WAAW,EAAE,0BAA0B,EAAE,GAAG,0BAA0B,CAmBxF;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,0BAA0B,EACtC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,GACb,0BAA0B,GAAG,SAAS,CAKxC;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,oBAAoB,EAAE,OAAO,GAC5B,0BAA0B,CAE5B;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,0BAA0B,CAE5B;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,0BAA0B,CAE5B;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,0BAA0B,CAE5B;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,iBAAiB,EAAE,GAC9B,0BAA0B,CAE5B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,eAAe,CAAC,EAAE,gBAAgB,CAAA;IAClC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,0BAA0B,CAAC,EAAE,gBAAgB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CACpC,GAAG,0BAA0B,EAAE,CAU/B;AA+VD,wBAAgB,MAAM,IAAI,0BAA0B,CAEnD;AAED,wBAAgB,KAAK,CACnB,MAAM,EAAE,+BAA+B,GAAG,mBAAmB,GAC5D,0BAA0B,CAE5B"}

package/dist/esm/analysis/allowedConditions.js

@@ -0,0 +1,382 @@
+import {} from '@actsecurity/iam-policy';
+import {} from '../evaluate.js';
+import {} from '../StatementAnalysis.js';
+/**
+ * Convert a statement's ignored allow-side conditions to an expression.
+ *
+ * @param statement the statement analysis to convert
+ * @param policyType the policy family containing the statement
+ * @param orgIdentifier the organization identifier for control-policy statements
+ * @returns an expression for the statement's ignored conditions
+ */
+export function allowStatementExpression(statement, policyType, orgIdentifier) {
+    return statementConditionExpression(statement, policyType, false, orgIdentifier);
+}
+/**
+ * Convert a statement's ignored deny-side conditions to an expression that avoids the deny.
+ *
+ * @param statement the statement analysis to convert
+ * @param policyType the policy family containing the statement
+ * @param orgIdentifier the organization identifier for control-policy statements
+ * @returns an expression that must hold to avoid the deny
+ */
+export function denyStatementEscapeExpression(statement, policyType, orgIdentifier) {
+    if (!statement.ignoredConditions || statement.ignoredConditions.length === 0) {
+        return never('explicitDenyWithoutConditions');
+    }
+    const source = sourceForStatement(statement, policyType, orgIdentifier);
+    return or(statement.ignoredConditions.map((condition) => invertCondition(condition, source)));
+}
+/**
+ * Invert a single IAM condition into an allowed-condition expression.
+ *
+ * @param condition the condition to invert
+ * @param source source metadata for the condition
+ * @returns the expression that satisfies the logical complement of the condition
+ */
+export function invertCondition(condition, source) {
+    const op = condition.operation().value();
+    const key = condition.conditionKey();
+    const values = condition.conditionValues();
+    return invertConditionParts(op, key, values, source);
+}
+/**
+ * Combine condition expressions with AND semantics and simplify identity/absorbing values.
+ *
+ * @param expressions the expressions to combine
+ * @returns a simplified expression
+ */
+export function and(expressions) {
+    const children = expressions.map((expr) => simplify(expr));
+    if (children.some((expr) => expr.conditionType === 'never')) {
+        return children.find((expr) => expr.conditionType === 'never');
+    }
+    const withoutAlways = dedupe(children
+        .filter((expr) => expr.conditionType !== 'always')
+        .flatMap((expr) => expr.conditionType === 'group' && expr.operator === 'and' ? expr.conditions : [expr]));
+    if (withoutAlways.length === 0) {
+        return always();
+    }
+    if (withoutAlways.length === 1) {
+        return withoutAlways[0];
+    }
+    return { conditionType: 'group', operator: 'and', conditions: withoutAlways };
+}
+/**
+ * Combine condition expressions with OR semantics and simplify identity/absorbing values.
+ *
+ * @param expressions the expressions to combine
+ * @returns a simplified expression
+ */
+export function or(expressions) {
+    const children = expressions.map((expr) => simplify(expr));
+    if (children.some((expr) => expr.conditionType === 'always')) {
+        return always();
+    }
+    const withoutNever = dedupe(children
+        .filter((expr) => expr.conditionType !== 'never')
+        .flatMap((expr) => expr.conditionType === 'group' && expr.operator === 'or' ? expr.conditions : [expr]));
+    if (withoutNever.length === 0) {
+        return never('noApplicableAllow');
+    }
+    if (withoutNever.length === 1) {
+        return withoutNever[0];
+    }
+    return { conditionType: 'group', operator: 'or', conditions: withoutNever };
+}
+export function allowedConditionOutput(expression, simulationMode, result) {
+    if (simulationMode !== 'Discovery' || result !== 'Allowed') {
+        return undefined;
+    }
+    return publicExpression(expression);
+}
+export function sessionPolicyExpression(analysis, sessionPolicyPresent) {
+    return sessionPolicyPresent ? identityAllowExpression(analysis, 'session') : always();
+}
+export function identityPolicyExpression(analysis) {
+    return identityAllowExpression(analysis, 'identity');
+}
+export function permissionBoundaryExpression(analysis) {
+    return identityAllowExpression(analysis, 'permissionBoundary');
+}
+export function endpointPolicyExpression(analysis) {
+    return identityAllowExpression(analysis, 'endpointPolicy');
+}
+export function resourceAllowStatementsExpression(statements) {
+    return allowStatementsExpression(statements, 'resource');
+}
+export function allDenyEscapeExpressions(input) {
+    return [
+        ...denyEscapeExpressions(input.sessionAnalysis, 'session'),
+        ...controlPolicyDenyEscapeExpressions(input.scpAnalysis, 'scp'),
+        ...controlPolicyDenyEscapeExpressions(input.rcpAnalysis, 'rcp'),
+        ...denyEscapeExpressions(input.identityAnalysis, 'identity'),
+        ...resourceDenyEscapeExpressions(input.resourceAnalysis),
+        ...denyEscapeExpressions(input.permissionBoundaryAnalysis, 'permissionBoundary'),
+        ...denyEscapeExpressions(input.endpointAnalysis, 'endpointPolicy')
+    ];
+}
+function identityAllowExpression(analysis, policyType) {
+    if (!analysis || analysis.result !== 'Allowed') {
+        return never('noApplicableAllow');
+    }
+    return allowStatementsExpression(analysis.allowStatements, policyType);
+}
+function allowStatementsExpression(statements, policyType) {
+    if (statements.length === 0) {
+        return never('noApplicableAllow');
+    }
+    return or(statements.map((statement) => allowStatementExpression(statement, policyType)));
+}
+function denyEscapeExpressions(analysis, policyType) {
+    return denyStatementsThatNeedEscapes(analysis).map((statement) => denyStatementEscapeExpression(statement, policyType));
+}
+function resourceDenyEscapeExpressions(analysis) {
+    return denyStatementsThatNeedEscapes(analysis).map((statement) => denyStatementEscapeExpression(statement, 'resource'));
+}
+function controlPolicyDenyEscapeExpressions(analysis, policyType) {
+    return (analysis?.ouAnalysis ?? []).flatMap((ou) => denyStatementsThatNeedEscapes(ou).map((statement) => denyStatementEscapeExpression(statement, policyType, ou.orgIdentifier)));
+}
+function denyStatementsThatNeedEscapes(analysis) {
+    return [...(analysis?.denyStatements ?? []), ...(analysis?.unmatchedStatements ?? [])].filter((statement) => statement.statement.isDeny() && (statement.ignoredConditions?.length ?? 0) > 0);
+}
+function statementConditionExpression(statement, policyType, inverted, orgIdentifier) {
+    const source = sourceForStatement(statement, policyType, orgIdentifier);
+    const conditions = statement.ignoredConditions ?? [];
+    const conditionExpressions = conditions.map((condition) => conditionLeaf(condition, source, inverted));
+    const sessionExpression = sessionNameExpression(statement, source);
+    if (sessionExpression) {
+        conditionExpressions.push(sessionExpression);
+    }
+    return and(conditionExpressions);
+}
+function sourceForStatement(statement, policyType, orgIdentifier) {
+    const sid = statement.statement.sid();
+    return {
+        policyType,
+        effect: statement.statement.effect(),
+        policyIdentifier: statement.policyId,
+        ...(orgIdentifier ? { orgIdentifier } : {}),
+        ...(sid ? { statementId: sid } : {}),
+        statementIndex: statement.statement.index()
+    };
+}
+function conditionLeaf(condition, source, inverted) {
+    return {
+        conditionType: 'condition',
+        op: condition.operation().value(),
+        key: condition.conditionKey(),
+        values: condition.conditionValues(),
+        sources: [source],
+        ...(inverted ? { inverted: true } : {})
+    };
+}
+function sessionNameExpression(statement, source) {
+    if (!statement.ignoredRoleSessionName) {
+        return undefined;
+    }
+    const names = principalExplains(statement)
+        .map((explain) => sessionNameFromAssumedRoleArn(explain.principal))
+        .filter((name) => name !== undefined);
+    if (names.length === 0) {
+        return undefined;
+    }
+    return {
+        conditionType: 'sessionName',
+        sessionName: Array.from(new Set(names)),
+        sources: [source]
+    };
+}
+function principalExplains(statement) {
+    const principals = statement.explain.principals ?? statement.explain.notPrincipals;
+    if (!principals) {
+        return [];
+    }
+    return Array.isArray(principals) ? principals : [principals];
+}
+function sessionNameFromAssumedRoleArn(arn) {
+    const resource = arn.split(':').at(-1);
+    if (!resource?.startsWith('assumed-role/')) {
+        return undefined;
+    }
+    return resource.split('/').at(2);
+}
+function invertConditionParts(op, key, values, source) {
+    const setOperator = conditionSetOperator(op);
+    const hasIfExists = isIfExists(op);
+    const base = conditionBaseOperator(op);
+    if (hasIfExists) {
+        const withoutIfExists = operatorName(base, setOperator, false);
+        const invertedBase = invertConditionParts(withoutIfExists, key, values, source);
+        if (negativeConditionOperatorsMatchMissingKeys(base)) {
+            return invertedBase;
+        }
+        return and([leaf('Null', key, ['false'], source), invertedBase]);
+    }
+    if (base.toLowerCase() === 'null' || base.toLowerCase() === 'bool') {
+        return leaf(invertedOperatorName(op, base, setOperator, hasIfExists), key, flipBooleanValues(values), source);
+    }
+    if (setOperator === 'ForAllValues') {
+        return and([
+            leaf('Null', key, ['false'], source),
+            leaf(operatorName(invertBaseOperator(base), 'ForAnyValue', false), key, values, source)
+        ]);
+    }
+    if (setOperator === 'ForAnyValue') {
+        return or([
+            leaf('Null', key, ['true'], source),
+            leaf(operatorName(invertBaseOperator(base), 'ForAllValues', false), key, values, source)
+        ]);
+    }
+    return leaf(invertBaseOperator(base), key, values, source);
+}
+function leaf(op, key, values, source) {
+    return {
+        conditionType: 'condition',
+        op,
+        key,
+        values,
+        sources: [source],
+        inverted: true
+    };
+}
+function conditionSetOperator(op) {
+    const prefix = op.includes(':') ? op.split(':')[0].toLowerCase() : undefined;
+    if (prefix === 'forallvalues') {
+        return 'ForAllValues';
+    }
+    if (prefix === 'foranyvalue') {
+        return 'ForAnyValue';
+    }
+    return undefined;
+}
+function conditionBaseOperator(op) {
+    return op
+        .split(':')
+        .at(-1)
+        .replace(/IfExists$/i, '');
+}
+function isIfExists(op) {
+    return /IfExists$/i.test(op);
+}
+function invertedOperatorName(originalOp, base, setOperator, hasIfExists) {
+    if (base.toLowerCase() === 'bool' || base.toLowerCase() === 'null') {
+        return operatorName(base, setOperator, hasIfExists);
+    }
+    return originalOp;
+}
+function negativeConditionOperatorsMatchMissingKeys(base) {
+    return new Set([
+        'stringnotequals',
+        'stringnotequalsignorecase',
+        'stringnotlike',
+        'arnnotequals',
+        'arnnotlike',
+        'numericnotequals',
+        'datenotequals',
+        'notipaddress',
+        'binarynotequals'
+    ]).has(base.toLowerCase());
+}
+function operatorName(base, setOperator, ifExists) {
+    const op = canonicalBaseOperator(base) + (ifExists ? 'IfExists' : '');
+    return setOperator ? `${setOperator}:${op}` : op;
+}
+function invertBaseOperator(base) {
+    const map = {
+        stringequals: 'StringNotEquals',
+        stringnotequals: 'StringEquals',
+        stringequalsignorecase: 'StringNotEqualsIgnoreCase',
+        stringnotequalsignorecase: 'StringEqualsIgnoreCase',
+        stringlike: 'StringNotLike',
+        stringnotlike: 'StringLike',
+        arnequals: 'ArnNotEquals',
+        arnnotequals: 'ArnEquals',
+        arnlike: 'ArnNotLike',
+        arnnotlike: 'ArnLike',
+        numericequals: 'NumericNotEquals',
+        numericnotequals: 'NumericEquals',
+        numericlessthan: 'NumericGreaterThanEquals',
+        numericlessthanequals: 'NumericGreaterThan',
+        numericgreaterthan: 'NumericLessThanEquals',
+        numericgreaterthanequals: 'NumericLessThan',
+        dateequals: 'DateNotEquals',
+        datenotequals: 'DateEquals',
+        datelessthan: 'DateGreaterThanEquals',
+        datelessthanequals: 'DateGreaterThan',
+        dategreaterthan: 'DateLessThanEquals',
+        dategreaterthanequals: 'DateLessThan',
+        ipaddress: 'NotIpAddress',
+        notipaddress: 'IpAddress',
+        binaryequals: 'BinaryNotEquals',
+        binarynotequals: 'BinaryEquals'
+    };
+    return map[base.toLowerCase()] ?? `Not:${base}`;
+}
+function canonicalBaseOperator(base) {
+    const canonical = {
+        stringequals: 'StringEquals',
+        stringnotequals: 'StringNotEquals',
+        stringequalsignorecase: 'StringEqualsIgnoreCase',
+        stringnotequalsignorecase: 'StringNotEqualsIgnoreCase',
+        stringlike: 'StringLike',
+        stringnotlike: 'StringNotLike',
+        arnequals: 'ArnEquals',
+        arnnotequals: 'ArnNotEquals',
+        arnlike: 'ArnLike',
+        arnnotlike: 'ArnNotLike',
+        numericequals: 'NumericEquals',
+        numericnotequals: 'NumericNotEquals',
+        numericlessthan: 'NumericLessThan',
+        numericlessthanequals: 'NumericLessThanEquals',
+        numericgreaterthan: 'NumericGreaterThan',
+        numericgreaterthanequals: 'NumericGreaterThanEquals',
+        dateequals: 'DateEquals',
+        datenotequals: 'DateNotEquals',
+        datelessthan: 'DateLessThan',
+        datelessthanequals: 'DateLessThanEquals',
+        dategreaterthan: 'DateGreaterThan',
+        dategreaterthanequals: 'DateGreaterThanEquals',
+        bool: 'Bool',
+        null: 'Null',
+        ipaddress: 'IpAddress',
+        notipaddress: 'NotIpAddress',
+        binaryequals: 'BinaryEquals',
+        binarynotequals: 'BinaryNotEquals'
+    };
+    return canonical[base.toLowerCase()] ?? base;
+}
+function flipBooleanValues(values) {
+    return values.map((value) => (value.toLowerCase() === 'true' ? 'false' : 'true'));
+}
+function publicExpression(expression) {
+    const simplified = simplify(expression);
+    return simplified.conditionType === 'always' || simplified.conditionType === 'never'
+        ? undefined
+        : simplified;
+}
+function simplify(expression) {
+    if (expression.conditionType !== 'group') {
+        return expression;
+    }
+    return expression.operator === 'and' ? and(expression.conditions) : or(expression.conditions);
+}
+export function always() {
+    return { conditionType: 'always' };
+}
+export function never(reason) {
+    return { conditionType: 'never', reason };
+}
+function dedupe(expressions) {
+    const seen = new Set();
+    const result = [];
+    for (const expression of expressions) {
+        const key = JSON.stringify(expression);
+        if (!seen.has(key)) {
+            seen.add(key);
+            result.push(expression);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=allowedConditions.js.map