@actsecurity/iam-simulate 0.1.173

package/dist/esm/core_engine/CoreSimulatorEngine.d.ts

@@ -0,0 +1,134 @@
+import { type Policy } from '@actsecurity/iam-policy';
+import { DiscoveryContextKeyConstraints } from '../context_keys/discoveryContextKeyConstraints.js';
+import { type IdentityAnalysis, type RcpAnalysis, type RequestAnalysis, type ResourceAnalysis, type ScpAnalysis } from '../evaluate.js';
+import { type PolicyType } from '../policyType.js';
+import { type AwsRequest } from '../request/request.js';
+import { type ServiceAuthorizer, type ServiceSettings } from '../services/ServiceAuthorizer.js';
+export declare const validSimulationModes: readonly ["Strict", "Discovery"];
+export type PolicyWithName = Policy<{
+    name: string;
+}>;
+/**
+ * The mode of simulation for the core engine.
+ * - Strict: Simulates the request as if it were being made in a real AWS environment.
+ * - Discovery: Simulates the request but discovers under what conditions it would be allowed.
+ */
+export type SimulationMode = (typeof validSimulationModes)[number];
+/**
+ * Meta parameters for the simulation engine.
+ */
+export interface SimulationParameters {
+    /**
+     * The simulation mode to use for the request.
+     */
+    simulationMode: SimulationMode;
+    /**
+     * Discovery-only knowledge constraints for context keys. In Strict mode,
+     * all condition keys are evaluated against the concrete request context.
+     */
+    discoveryContextKeyConstraints: DiscoveryContextKeyConstraints;
+}
+/**
+ * A set of service or resource control policies for each level of an organization tree
+ */
+export interface ControlPolicies {
+    /**
+     * The organization identifier for the organizational unit these policies apply to.
+     */
+    orgIdentifier: string;
+    /**
+     * The policies that apply to this organizational unit.
+     */
+    policies: PolicyWithName[];
+}
+/**
+ * A request to authorize a service action.
+ */
+export interface AuthorizationRequest {
+    /**
+     * The request to authorize.
+     */
+    request: AwsRequest;
+    /**
+     * A session policy, if any, for the current Role or Federated User session.
+     */
+    sessionPolicy: PolicyWithName | undefined;
+    /**
+     * The identity policies that are applicable to the principal making the request.
+     */
+    identityPolicies: PolicyWithName[];
+    /**
+     * The service control policies that apply to the principal making the request. In
+     * order of the organization hierarchy. So the root ou SCPs should be first.
+     */
+    serviceControlPolicies: ControlPolicies[];
+    /**
+     * The resource control policies that apply to the resource being accessed. In
+     * order of the organization hierarchy. So the root ou RCPs should be first.
+     */
+    resourceControlPolicies: ControlPolicies[];
+    /**
+     * The resource policy that applies to the resource being accessed.
+     */
+    resourcePolicy: PolicyWithName | undefined;
+    /**
+     * The permission boundaries that apply to the principal making the request.
+     */
+    permissionBoundaries: PolicyWithName[] | undefined;
+    /**
+     * The VPC endpoint policies that apply to the request, if any.
+     */
+    vpcEndpointPolicies: PolicyWithName[] | undefined;
+    /**
+     * The simulation parameters for the request.
+     */
+    simulationParameters: SimulationParameters;
+    /**
+     * Caller-supplied service-specific settings that affect authorization.
+     */
+    serviceSettings?: ServiceSettings;
+}
+/**
+ * Authorizes a request.
+ *
+ * This assumes all policies have been validated and the request is fully complete and valid.
+ *
+ * @param request the request to authorize
+ * @returns the result of the authorization
+ */
+export declare function authorize(request: AuthorizationRequest): RequestAnalysis;
+/**
+ * Get the appropriate service authorizer for the request. Some services have specific authorization logic in
+ * them. If there is no service specific authorizer, a default one will be used.
+ *
+ * @param request the request to get the authorizer for
+ * @returns the service authorizer for the request
+ */
+export declare function getServiceAuthorizer(request: AuthorizationRequest): ServiceAuthorizer;
+/**
+ * Analyzes a set of identity policies
+ *
+ * @param identityPolicies the identity policies to analyze
+ * @param request the request to analyze against
+ * @returns an array of statement analysis results
+ */
+export declare function analyzeIdentityPolicies(identityPolicies: PolicyWithName[], request: AwsRequest, simulationParameters: SimulationParameters, policyType: PolicyType): IdentityAnalysis;
+/**
+ * Analyzes a set of service or resource control policies and the statements within them.
+ *
+ * @param controlPolicies the control policies to analyze
+ * @param request the request to analyze against
+ * @returns an array of SCP or RCP analysis results
+ */
+export declare function analyzeControlPolicies(controlPolicies: ControlPolicies[], request: AwsRequest, simulationParameters: SimulationParameters, policyType: PolicyType): ScpAnalysis | RcpAnalysis;
+/**
+ * Analyze a resource policy and return the results
+ *
+ * @param resourcePolicy the resource policy to analyze
+ * @param request the request to analyze against
+ * @returns an array of statement analysis results
+ */
+export declare function analyzeResourcePolicy(resourcePolicy: PolicyWithName | undefined, request: AwsRequest, principalHasPermissionBoundary: boolean, simulationParameters: SimulationParameters): ResourceAnalysis;
+export declare function analyzePermissionBoundaryPolicies(permissionBoundaries: PolicyWithName[] | undefined, request: AwsRequest, simulationParameters: SimulationParameters): IdentityAnalysis | undefined;
+export declare function analyzeVpcEndpointPolicies(vpcEndPointPolicies: PolicyWithName[] | undefined, request: AwsRequest, simulationParameters: SimulationParameters): IdentityAnalysis | undefined;
+//# sourceMappingURL=CoreSimulatorEngine.d.ts.map

package/dist/esm/core_engine/CoreSimulatorEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CoreSimulatorEngine.d.ts","sourceRoot":"","sources":["../../../src/core_engine/CoreSimulatorEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAkB,MAAM,yBAAyB,CAAA;AAIrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAA;AAClG,OAAO,EAEL,KAAK,gBAAgB,EAIrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAA;AAMvB,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAKvD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAW/F,eAAO,MAAM,oBAAoB,kCAAmC,CAAA;AAEpE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AAElE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;;OAGG;IACH,8BAA8B,EAAE,8BAA8B,CAAA;CAC/D;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAA;IAEnB;;OAEG;IACH,aAAa,EAAE,cAAc,GAAG,SAAS,CAAA;IAEzC;;OAEG;IACH,gBAAgB,EAAE,cAAc,EAAE,CAAA;IAElC;;;OAGG;IACH,sBAAsB,EAAE,eAAe,EAAE,CAAA;IAEzC;;;OAGG;IACH,uBAAuB,EAAE,eAAe,EAAE,CAAA;IAE1C;;OAEG;IACH,cAAc,EAAE,cAAc,GAAG,SAAS,CAAA;IAE1C;;OAEG;IACH,oBAAoB,EAAE,cAAc,EAAE,GAAG,SAAS,CAAA;IAElD;;OAEG;IACH,mBAAmB,EAAE,cAAc,EAAE,GAAG,SAAS,CAAA;IAEjD;;OAEG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;IAE1C;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AASD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CA0FxE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,CAMrF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,cAAc,EAAE,EAClC,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,EAC1C,UAAU,EAAE,UAAU,GACrB,gBAAgB,CAgFlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,eAAe,EAAE,EAClC,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,EAC1C,UAAU,EAAE,UAAU,GACrB,WAAW,GAAG,WAAW,CAgH3B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,OAAO,EAAE,UAAU,EACnB,8BAA8B,EAAE,OAAO,EACvC,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,CAkIlB;AAED,wBAAgB,iCAAiC,CAC/C,oBAAoB,EAAE,cAAc,EAAE,GAAG,SAAS,EAClD,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,GAAG,SAAS,CAM9B;AAED,wBAAgB,0BAA0B,CACxC,mBAAmB,EAAE,cAAc,EAAE,GAAG,SAAS,EACjD,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,GAAG,SAAS,CAK9B"}

package/dist/esm/core_engine/CoreSimulatorEngine.js

@@ -0,0 +1,441 @@
+import {} from '@actsecurity/iam-policy';
+import { requestMatchesStatementActions } from '../action/action.js';
+import { requestMatchesConditions } from '../condition/condition.js';
+import { allowStatementExpression, always, and, never, or } from '../analysis/allowedConditions.js';
+import { DiscoveryContextKeyConstraints } from '../context_keys/discoveryContextKeyConstraints.js';
+import {} from '../evaluate.js';
+import {} from '../explain/statementExplain.js';
+import { requestMatchesStatementPrincipals } from '../principal/principal.js';
+import {} from '../policyType.js';
+import {} from '../request/request.js';
+import { requestMatchesStatementResources } from '../resource/resource.js';
+import { DefaultServiceAuthorizer } from '../services/DefaultServiceAuthorizer.js';
+import { IamServiceAuthorizer } from '../services/IamServiceAuthorizer.js';
+import { KmsServiceAuthorizer } from '../services/KmsServiceAuthorizer.js';
+import {} from '../services/ServiceAuthorizer.js';
+import { S3ServiceAuthorizer } from '../services/s3/S3ServiceAuthorizer.js';
+import { StsServiceAuthorizer } from '../services/StsServiceAuthorizer.js';
+import { identityStatementAllows, identityStatementExplicitDeny, reportIgnoredConditions, statementMatches } from '../StatementAnalysis.js';
+export const validSimulationModes = ['Strict', 'Discovery'];
+const serviceEngines = {
+    kms: KmsServiceAuthorizer,
+    sts: StsServiceAuthorizer,
+    iam: IamServiceAuthorizer,
+    s3: S3ServiceAuthorizer
+};
+/**
+ * Authorizes a request.
+ *
+ * This assumes all policies have been validated and the request is fully complete and valid.
+ *
+ * @param request the request to authorize
+ * @returns the result of the authorization
+ */
+export function authorize(request) {
+    const principalHasPermissionBoundary = !!request.permissionBoundaries && request.permissionBoundaries.length > 0;
+    const simulationParameters = request.simulationParameters;
+    const sessionAnalysis = request.sessionPolicy
+        ? analyzeIdentityPolicies([request.sessionPolicy], request.request, simulationParameters, 'session')
+        : undefined;
+    const identityAnalysis = analyzeIdentityPolicies(request.identityPolicies, request.request, simulationParameters, 'identity');
+    const permissionBoundaryAnalysis = analyzePermissionBoundaryPolicies(request.permissionBoundaries, request.request, simulationParameters);
+    const scpAnalysis = analyzeControlPolicies(request.serviceControlPolicies, request.request, simulationParameters, 'scp');
+    const rcpAnalysis = analyzeControlPolicies(request.resourceControlPolicies, request.request, simulationParameters, 'rcp');
+    const resourceAnalysis = analyzeResourcePolicy(request.resourcePolicy, request.request, principalHasPermissionBoundary, simulationParameters);
+    const endpointAnalysis = analyzeVpcEndpointPolicies(request.vpcEndpointPolicies, request.request, simulationParameters);
+    const serviceAuthorizer = getServiceAuthorizer(request);
+    const result = serviceAuthorizer.authorize({
+        request: request.request,
+        sessionAnalysis,
+        identityAnalysis,
+        scpAnalysis,
+        rcpAnalysis,
+        resourceAnalysis,
+        resourcePolicy: request.resourcePolicy,
+        permissionBoundaryAnalysis,
+        endpointAnalysis,
+        simulationParameters,
+        serviceSettings: request.serviceSettings
+    });
+    if (simulationParameters.simulationMode === 'Discovery') {
+        result.ignoredConditions = ignoredConditionsAnalysis(sessionAnalysis, scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis, endpointAnalysis);
+        result.ignoredRoleSessionName = roleSessionNameIgnored(sessionAnalysis, scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis);
+    }
+    return result;
+}
+/**
+ * Get the appropriate service authorizer for the request. Some services have specific authorization logic in
+ * them. If there is no service specific authorizer, a default one will be used.
+ *
+ * @param request the request to get the authorizer for
+ * @returns the service authorizer for the request
+ */
+export function getServiceAuthorizer(request) {
+    const serviceName = request.request.action.service().toLowerCase();
+    if (serviceEngines[serviceName]) {
+        return new serviceEngines[serviceName]();
+    }
+    return new DefaultServiceAuthorizer();
+}
+/**
+ * Analyzes a set of identity policies
+ *
+ * @param identityPolicies the identity policies to analyze
+ * @param request the request to analyze against
+ * @returns an array of statement analysis results
+ */
+export function analyzeIdentityPolicies(identityPolicies, request, simulationParameters, policyType) {
+    const identityAnalysis = {
+        result: 'ImplicitlyDenied',
+        allowStatements: [],
+        denyStatements: [],
+        unmatchedStatements: []
+    };
+    for (const policy of identityPolicies) {
+        for (const statement of policy.statements()) {
+            const { matches: resourceMatch, details: resourceDetails } = requestMatchesStatementResources(request, statement, policyType);
+            const { matches: actionMatch, details: actionDetails } = requestMatchesStatementActions(request, statement);
+            const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = requestMatchesConditions(request, statement.conditions(), statement.effect(), simulationParameters);
+            const principalMatch = 'Match';
+            const overallMatch = statementMatches({
+                actionMatch,
+                conditionMatch,
+                principalMatch,
+                resourceMatch
+            });
+            const shouldReportIgnoredConditions = reportIgnoredConditions({
+                actionMatch,
+                principalMatch,
+                resourceMatch
+            });
+            const statementAnalysis = {
+                policyId: policy.metadata().name,
+                statement,
+                resourceMatch,
+                actionMatch,
+                conditionMatch,
+                principalMatch,
+                ignoredConditions: shouldReportIgnoredConditions ? ignoredConditions : undefined,
+                explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...conditionDetails })
+            };
+            if (identityStatementExplicitDeny(statementAnalysis)) {
+                identityAnalysis.denyStatements.push(statementAnalysis);
+            }
+            else if (identityStatementAllows(statementAnalysis)) {
+                identityAnalysis.allowStatements.push(statementAnalysis);
+            }
+            else {
+                identityAnalysis.unmatchedStatements.push(statementAnalysis);
+            }
+        }
+    }
+    if (identityAnalysis.denyStatements.length > 0) {
+        identityAnalysis.result = 'ExplicitlyDenied';
+    }
+    else if (identityAnalysis.allowStatements.length > 0) {
+        identityAnalysis.result = 'Allowed';
+    }
+    return identityAnalysis;
+}
+/**
+ * Analyzes a set of service or resource control policies and the statements within them.
+ *
+ * @param controlPolicies the control policies to analyze
+ * @param request the request to analyze against
+ * @returns an array of SCP or RCP analysis results
+ */
+export function analyzeControlPolicies(controlPolicies, request, simulationParameters, policyType) {
+    const analysis = [];
+    for (const controlPolicy of controlPolicies) {
+        const ouAnalysis = {
+            orgIdentifier: controlPolicy.orgIdentifier,
+            result: 'ImplicitlyDenied',
+            allowStatements: [],
+            denyStatements: [],
+            unmatchedStatements: [],
+            conditions: never('noApplicableAllow')
+        };
+        for (const policy of controlPolicy.policies) {
+            for (const statement of policy.statements()) {
+                const { matches: resourceMatch, details: resourceDetails } = requestMatchesStatementResources(request, statement, policyType);
+                const { matches: actionMatch, details: actionDetails } = requestMatchesStatementActions(request, statement);
+                const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = requestMatchesConditions(request, statement.conditions(), statement.effect(), simulationParameters);
+                const principalMatch = 'Match';
+                const overallMatch = statementMatches({
+                    actionMatch,
+                    conditionMatch,
+                    principalMatch,
+                    resourceMatch
+                });
+                const shouldReportIgnoredConditions = reportIgnoredConditions({
+                    actionMatch,
+                    principalMatch,
+                    resourceMatch
+                });
+                const statementAnalysis = {
+                    policyId: policy.metadata().name,
+                    statement,
+                    resourceMatch,
+                    actionMatch,
+                    conditionMatch,
+                    principalMatch,
+                    ignoredConditions: shouldReportIgnoredConditions ? ignoredConditions : [],
+                    explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...conditionDetails })
+                };
+                if (identityStatementAllows(statementAnalysis)) {
+                    ouAnalysis.allowStatements.push(statementAnalysis);
+                }
+                else if (identityStatementExplicitDeny(statementAnalysis)) {
+                    ouAnalysis.denyStatements.push(statementAnalysis);
+                }
+                else {
+                    ouAnalysis.unmatchedStatements.push(statementAnalysis);
+                }
+            }
+        }
+        if (ouAnalysis.denyStatements.length > 0) {
+            ouAnalysis.result = 'ExplicitlyDenied';
+        }
+        else if (ouAnalysis.allowStatements.length > 0) {
+            ouAnalysis.result = 'Allowed';
+        }
+        if (ouAnalysis.result === 'Allowed') {
+            ouAnalysis.conditions = or(ouAnalysis.allowStatements.map((statement) => allowStatementExpression(statement, policyType, controlPolicy.orgIdentifier)));
+        }
+        analysis.push(ouAnalysis);
+    }
+    let overallResult = 'ImplicitlyDenied';
+    if (analysis.some((ou) => ou.result === 'ExplicitlyDenied')) {
+        overallResult = 'ExplicitlyDenied';
+    }
+    else if (analysis.some((ou) => ou.allowStatements.length === 0)) {
+        overallResult = 'ImplicitlyDenied';
+    }
+    else if (analysis.every((ou) => ou.result === 'Allowed')) {
+        overallResult = 'Allowed';
+    }
+    return {
+        result: overallResult,
+        ouAnalysis: analysis,
+        conditions: analysis.length === 0
+            ? always()
+            : overallResult === 'Allowed'
+                ? and(analysis.map((ou) => ou.conditions))
+                : never('noApplicableAllow')
+    };
+}
+/**
+ * Analyze a resource policy and return the results
+ *
+ * @param resourcePolicy the resource policy to analyze
+ * @param request the request to analyze against
+ * @returns an array of statement analysis results
+ */
+export function analyzeResourcePolicy(resourcePolicy, request, principalHasPermissionBoundary, simulationParameters) {
+    const resourceAnalysis = {
+        result: 'NotApplicable',
+        allowStatements: [],
+        denyStatements: [],
+        unmatchedStatements: []
+    };
+    if (!resourcePolicy) {
+        return resourceAnalysis;
+    }
+    const principalMatchOptions = [
+        'Match',
+        'SessionRoleMatch',
+        'SessionUserMatch'
+    ];
+    for (const statement of resourcePolicy.statements()) {
+        const { matches: resourceMatch, details: resourceDetails } = requestMatchesStatementResources(request, statement, 'resource');
+        const { matches: actionMatch, details: actionDetails } = requestMatchesStatementActions(request, statement);
+        let { matches: principalMatch, details: principalDetails, ignoredRoleSessionName } = requestMatchesStatementPrincipals(request, statement, simulationParameters);
+        const permissionBoundaryDetails = {};
+        /**
+         * "Don't use resource-based policy statements that include a NotPrincipal policy element with a
+         * Deny effect for IAM users or roles that have a permissions boundary policy attached.
+         * The NotPrincipal element with a Deny effect will always deny any IAM principal that
+         * has a permissions boundary policy attached, regardless of the values specified in the
+         * NotPrincipal element. This causes some IAM users or roles that would otherwise have access
+         * to the resource to lose access. We recommend changing your resource-based policy statements
+         * to use the condition operator ArnNotEquals with the aws:PrincipalArn context key to limit
+         * access instead of the NotPrincipal element. For information about permissions boundaries, see
+         * Permissions boundaries for IAM entities."
+         * https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
+         */
+        if (principalHasPermissionBoundary &&
+            statement.isNotPrincipalStatement() &&
+            statement.effect() === 'Deny') {
+            principalMatch = 'Match';
+            permissionBoundaryDetails.denyBecauseNpInRpAndPb = true;
+        }
+        const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = requestMatchesConditions(request, statement.conditions(), statement.effect(), simulationParameters);
+        const overallMatch = statementMatches({
+            actionMatch,
+            conditionMatch,
+            principalMatch,
+            resourceMatch
+        });
+        const shouldReportIgnoredConditions = reportIgnoredConditions({
+            actionMatch,
+            principalMatch,
+            resourceMatch
+        });
+        const analysis = {
+            policyId: resourcePolicy.metadata().name,
+            statement,
+            resourceMatch: resourceMatch,
+            actionMatch,
+            conditionMatch,
+            principalMatch,
+            ignoredConditions: shouldReportIgnoredConditions ? ignoredConditions : undefined,
+            ignoredRoleSessionName,
+            explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...principalDetails, ...conditionDetails })
+        };
+        if (identityStatementExplicitDeny(analysis) && analysis.principalMatch !== 'NoMatch') {
+            resourceAnalysis.denyStatements.push(analysis);
+        }
+        else if (identityStatementAllows(analysis) && analysis.principalMatch !== 'NoMatch') {
+            resourceAnalysis.allowStatements.push(analysis);
+        }
+        else {
+            resourceAnalysis.unmatchedStatements.push(analysis);
+        }
+    }
+    if (resourceAnalysis.denyStatements.some((s) => principalMatchOptions.includes(s.principalMatch))) {
+        resourceAnalysis.result = 'ExplicitlyDenied';
+    }
+    else if (resourceAnalysis.denyStatements.some((s) => s.principalMatch === 'AccountLevelMatch')) {
+        resourceAnalysis.result = 'DeniedForAccount';
+    }
+    else if (resourceAnalysis.allowStatements.some((s) => principalMatchOptions.includes(s.principalMatch))) {
+        resourceAnalysis.result = 'Allowed';
+    }
+    else if (resourceAnalysis.allowStatements.some((s) => s.principalMatch === 'AccountLevelMatch')) {
+        resourceAnalysis.result = 'AllowedForAccount';
+    }
+    else {
+        resourceAnalysis.result = 'ImplicitlyDenied';
+    }
+    return resourceAnalysis;
+}
+export function analyzePermissionBoundaryPolicies(permissionBoundaries, request, simulationParameters) {
+    if (!permissionBoundaries || permissionBoundaries.length === 0) {
+        return undefined;
+    }
+    return analyzeIdentityPolicies(permissionBoundaries, request, simulationParameters, 'pb');
+}
+export function analyzeVpcEndpointPolicies(vpcEndPointPolicies, request, simulationParameters) {
+    if (!vpcEndPointPolicies || vpcEndPointPolicies.length === 0) {
+        return undefined;
+    }
+    return analyzeIdentityPolicies(vpcEndPointPolicies, request, simulationParameters, 'vpce');
+}
+function makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, details) {
+    return {
+        effect: statement.effect(),
+        identifier: statement.sid() || statement.index().toString(),
+        matches: overallMatch,
+        actionMatch,
+        principalMatch,
+        resourceMatch,
+        conditionMatch: conditionMatch === 'Match',
+        ...details
+    };
+}
+/**
+ * Create an analysis of the ignored conditions in all statements.
+ *
+ * @param scpAnalysis the SCP analysis
+ * @param rcpAnalysis the RCP analysis
+ * @param identityAnalysis the identity analysis
+ * @param resourceAnalysis the resource analysis
+ * @param permissionBoundaryAnalysis the permission boundary analysis (optional)
+ * @returns an object containing the ignored conditions for each analysis
+ */
+function ignoredConditionsAnalysis(sessionAnalysis, scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis, endpointAnalysis) {
+    const ignoredConditions = {};
+    if (sessionAnalysis) {
+        addIgnoredConditionsToAnalysis(ignoredConditions, 'session', [sessionAnalysis]);
+    }
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'scp', scpAnalysis.ouAnalysis);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'rcp', rcpAnalysis.ouAnalysis);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'identity', [identityAnalysis]);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'resource', [resourceAnalysis]);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'permissionBoundary', permissionBoundaryAnalysis ? [permissionBoundaryAnalysis] : []);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'endpointPolicy', endpointAnalysis ? [endpointAnalysis] : []);
+    if (Object.keys(ignoredConditions).length > 0) {
+        return ignoredConditions;
+    }
+    return undefined;
+}
+/**
+ * Adds the specified ignored conditions to the analysis.
+ *
+ * @param analyses the analyses to map ignored conditions from
+ * @returns the ignored conditions for allow and deny statements
+ */
+function addIgnoredConditionsToAnalysis(ignoredConditions, key, analyses) {
+    const allow = [];
+    const deny = [];
+    const allStatements = analyses.flatMap((analysis) => [
+        ...analysis.allowStatements,
+        ...analysis.denyStatements,
+        ...analysis.unmatchedStatements
+    ]);
+    for (const statement of allStatements) {
+        if (statement.ignoredConditions && statement.ignoredConditions.length > 0) {
+            if (statement.statement.isAllow()) {
+                allow.push(...statement.ignoredConditions.map((c) => ({
+                    op: c.operation().value(),
+                    key: c.conditionKey(),
+                    values: c.conditionValues()
+                })));
+            }
+            else {
+                deny.push(...statement.ignoredConditions.map((c) => ({
+                    op: c.operation().value(),
+                    key: c.conditionKey(),
+                    values: c.conditionValues()
+                })));
+            }
+        }
+    }
+    if (allow.length === 0 && deny.length === 0) {
+        return;
+    }
+    const newValue = {};
+    if (allow.length > 0) {
+        newValue.allow = allow;
+    }
+    if (deny.length > 0) {
+        newValue.deny = deny;
+    }
+    ignoredConditions[key] = newValue;
+}
+/**
+ * Checks all analyses to see if any of them have statements that ignore the role session name.
+ *
+ * @param scpAnalysis the SCP analysis
+ * @param rcpAnalysis the RCP analysis
+ * @param identityAnalysis the identity analysis
+ * @param resourceAnalysis the resource analysis
+ * @param permissionBoundaryAnalysis the permission boundary analysis (optional)
+ * @returns true if any analysis has statements that ignore the role session name, false otherwise
+ */
+function roleSessionNameIgnored(sessionAnalysis, scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis) {
+    return (sessionAnalysis?.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        sessionAnalysis?.unmatchedStatements.some((s) => s.ignoredRoleSessionName) ||
+        scpAnalysis.ouAnalysis.some((ou) => ou.allowStatements.some((s) => s.ignoredRoleSessionName)) ||
+        scpAnalysis.ouAnalysis.some((ou) => ou.unmatchedStatements.some((s) => s.ignoredRoleSessionName)) ||
+        rcpAnalysis.ouAnalysis.some((ou) => ou.allowStatements.some((s) => s.ignoredRoleSessionName)) ||
+        rcpAnalysis.ouAnalysis.some((ou) => ou.unmatchedStatements.some((s) => s.ignoredRoleSessionName)) ||
+        identityAnalysis.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        identityAnalysis.unmatchedStatements.some((s) => s.ignoredRoleSessionName) ||
+        resourceAnalysis.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        resourceAnalysis.unmatchedStatements.some((s) => s.ignoredRoleSessionName) ||
+        permissionBoundaryAnalysis?.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        permissionBoundaryAnalysis?.unmatchedStatements.some((s) => s.ignoredRoleSessionName) ||
+        false);
+}
+//# sourceMappingURL=CoreSimulatorEngine.js.map

package/dist/esm/core_engine/CoreSimulatorEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CoreSimulatorEngine.js","sourceRoot":"","sources":["../../../src/core_engine/CoreSimulatorEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAA6B,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AAC/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kCAAkC,CAAA;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAA;AAClG,OAAO,EAUN,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAqD,MAAM,gCAAgC,CAAA;AAClG,OAAO,EAEL,iCAAiC,EAClC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAmB,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAmB,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAA;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAgD,MAAM,kCAAkC,CAAA;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,EAEvB,gBAAgB,EACjB,MAAM,yBAAyB,CAAA;AAEhC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAA;AAmGpE,MAAM,cAAc,GAAgD;IAClE,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,oBAAoB;IACzB,EAAE,EAAE,mBAAmB;CACxB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,OAA6B;IACrD,MAAM,8BAA8B,GAClC,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3E,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAA;IAEzD,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa;QAC3C,CAAC,CAAC,uBAAuB,CACrB,CAAC,OAAO,CAAC,aAAa,CAAC,EACvB,OAAO,CAAC,OAAO,EACf,oBAAoB,EACpB,SAAS,CACV;QACH,CAAC,CAAC,SAAS,CAAA;IAEb,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,OAAO,EACf,oBAAoB,EACpB,UAAU,CACX,CAAA;IAED,MAAM,0BAA0B,GAAG,iCAAiC,CAClE,OAAO,CAAC,oBAAoB,EAC5B,OAAO,CAAC,OAAO,EACf,oBAAoB,CACrB,CAAA;IAED,MAAM,WAAW,GAAG,sBAAsB,CACxC,OAAO,CAAC,sBAAsB,EAC9B,OAAO,CAAC,OAAO,EACf,oBAAoB,EACpB,KAAK,CACS,CAAA;IAEhB,MAAM,WAAW,GAAG,sBAAsB,CACxC,OAAO,CAAC,uBAAuB,EAC/B,OAAO,CAAC,OAAO,EACf,oBAAoB,EACpB,KAAK,CACS,CAAA;IAEhB,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,OAAO,EACf,8BAA8B,EAC9B,oBAAoB,CACrB,CAAA;IAED,MAAM,gBAAgB,GAAG,0BAA0B,CACjD,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,OAAO,EACf,oBAAoB,CACrB,CAAA;IAED,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;QACf,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,gBAAgB;QAChB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,0BAA0B;QAC1B,gBAAgB;QAChB,oBAAoB;QACpB,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAA;IAEF,IAAI,oBAAoB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;QACxD,MAAM,CAAC,iBAAiB,GAAG,yBAAyB,CAClD,eAAe,EACf,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,CACjB,CAAA;QACD,MAAM,CAAC,sBAAsB,GAAG,sBAAsB,CACpD,eAAe,EACf,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,0BAA0B,CAC3B,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA6B;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAA;IAClE,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAA;IAC1C,CAAC;IACD,OAAO,IAAI,wBAAwB,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,gBAAkC,EAClC,OAAmB,EACnB,oBAA0C,EAC1C,UAAsB;IAEtB,MAAM,gBAAgB,GAAqB;QACzC,MAAM,EAAE,kBAAkB;QAC1B,eAAe,EAAE,EAAE;QACnB,cAAc,EAAE,EAAE;QAClB,mBAAmB,EAAE,EAAE;KACxB,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5C,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,gCAAgC,CAC3F,OAAO,EACP,SAAS,EACT,UAAU,CACX,CAAA;YACD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,8BAA8B,CACrF,OAAO,EACP,SAAS,CACV,CAAA;YACD,MAAM,EACJ,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,EAClB,GAAG,wBAAwB,CAC1B,OAAO,EACP,SAAS,CAAC,UAAU,EAAE,EACtB,SAAS,CAAC,MAAM,EAAsB,EACtC,oBAAoB,CACrB,CAAA;YAED,MAAM,cAAc,GAAyB,OAAO,CAAA;YACpD,MAAM,YAAY,GAAG,gBAAgB,CAAC;gBACpC,WAAW;gBACX,cAAc;gBACd,cAAc;gBACd,aAAa;aACd,CAAC,CAAA;YAEF,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;gBAC5D,WAAW;gBACX,cAAc;gBACd,aAAa;aACd,CAAC,CAAA;YAEF,MAAM,iBAAiB,GAAsB;gBAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI;gBAChC,SAAS;gBACT,aAAa;gBACb,WAAW;gBACX,cAAc;gBACd,cAAc;gBACd,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;gBAChF,OAAO,EAAE,oBAAoB,CAC3B,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,CAC9D;aACF,CAAA;YAED,IAAI,6BAA6B,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACrD,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YACzD,CAAC;iBAAM,IAAI,uBAAuB,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACtD,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC1D,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAA;IACrC,CAAC;IAED,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAkC,EAClC,OAAmB,EACnB,oBAA0C,EAC1C,UAAsB;IAEtB,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,KAAK,MAAM,aAAa,IAAI,eAAe,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAkB;YAChC,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,MAAM,EAAE,kBAAkB;YAC1B,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;YAClB,mBAAmB,EAAE,EAAE;YACvB,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC;SACvC,CAAA;QACD,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC5C,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,GACxD,gCAAgC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;gBAClE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,8BAA8B,CACrF,OAAO,EACP,SAAS,CACV,CAAA;gBACD,MAAM,EACJ,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,EAClB,GAAG,wBAAwB,CAC1B,OAAO,EACP,SAAS,CAAC,UAAU,EAAE,EACtB,SAAS,CAAC,MAAM,EAAsB,EACtC,oBAAoB,CACrB,CAAA;gBAED,MAAM,cAAc,GAAyB,OAAO,CAAA;gBACpD,MAAM,YAAY,GAAG,gBAAgB,CAAC;oBACpC,WAAW;oBACX,cAAc;oBACd,cAAc;oBACd,aAAa;iBACd,CAAC,CAAA;gBAEF,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;oBAC5D,WAAW;oBACX,cAAc;oBACd,aAAa;iBACd,CAAC,CAAA;gBAEF,MAAM,iBAAiB,GAAsB;oBAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI;oBAChC,SAAS;oBACT,aAAa;oBACb,WAAW;oBACX,cAAc;oBACd,cAAc;oBACd,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;oBACzE,OAAO,EAAE,oBAAoB,CAC3B,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,CAC9D;iBACF,CAAA;gBAED,IAAI,uBAAuB,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC/C,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBACpD,CAAC;qBAAM,IAAI,6BAA6B,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC5D,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBACnD,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,UAAU,CAAC,MAAM,GAAG,kBAAkB,CAAA;QACxC,CAAC;aAAM,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,MAAM,GAAG,SAAS,CAAA;QAC/B,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,UAAU,CAAC,UAAU,GAAG,EAAE,CACxB,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3C,wBAAwB,CACtB,SAAS,EACT,UAA2B,EAC3B,aAAa,CAAC,aAAa,CAC5B,CACF,CACF,CAAA;QACH,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC;IAED,IAAI,aAAa,GAAqB,kBAAkB,CAAA;IACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,kBAAkB,CAAC,EAAE,CAAC;QAC5D,aAAa,GAAG,kBAAkB,CAAA;IACpC,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAClE,aAAa,GAAG,kBAAkB,CAAA;IACpC,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAC3D,aAAa,GAAG,SAAS,CAAA;IAC3B,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,QAAQ;QACpB,UAAU,EACR,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,MAAM,EAAE;YACV,CAAC,CAAC,aAAa,KAAK,SAAS;gBAC3B,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;KACnC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,cAA0C,EAC1C,OAAmB,EACnB,8BAAuC,EACvC,oBAA0C;IAE1C,MAAM,gBAAgB,GAAqB;QACzC,MAAM,EAAE,eAAe;QACvB,eAAe,EAAE,EAAE;QACnB,cAAc,EAAE,EAAE;QAClB,mBAAmB,EAAE,EAAE;KACxB,CAAA;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,MAAM,qBAAqB,GAA2B;QACpD,OAAO;QACP,kBAAkB;QAClB,kBAAkB;KACnB,CAAA;IAED,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,gCAAgC,CAC3F,OAAO,EACP,SAAS,EACT,UAAU,CACX,CAAA;QACD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,8BAA8B,CACrF,OAAO,EACP,SAAS,CACV,CAAA;QACD,IAAI,EACF,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,EACzB,sBAAsB,EACvB,GAAG,iCAAiC,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAA;QAE/E,MAAM,yBAAyB,GAAqD,EAAE,CAAA;QAEtF;;;;;;;;;;;WAWG;QACH,IACE,8BAA8B;YAC9B,SAAS,CAAC,uBAAuB,EAAE;YACnC,SAAS,CAAC,MAAM,EAAE,KAAK,MAAM,EAC7B,CAAC;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,yBAAyB,CAAC,sBAAsB,GAAG,IAAI,CAAA;QACzD,CAAC;QAED,MAAM,EACJ,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,EAClB,GAAG,wBAAwB,CAC1B,OAAO,EACP,SAAS,CAAC,UAAU,EAAE,EACtB,SAAS,CAAC,MAAM,EAAsB,EACtC,oBAAoB,CACrB,CAAA;QAED,MAAM,YAAY,GAAG,gBAAgB,CAAC;YACpC,WAAW;YACX,cAAc;YACd,cAAc;YACd,aAAa;SACd,CAAC,CAAA;QAEF,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;YAC5D,WAAW;YACX,cAAc;YACd,aAAa;SACd,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAsB;YAClC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI;YACxC,SAAS;YACT,aAAa,EAAE,aAAa;YAC5B,WAAW;YACX,cAAc;YACd,cAAc;YACd,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAChF,sBAAsB;YACtB,OAAO,EAAE,oBAAoB,CAC3B,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,GAAG,gBAAgB,EAAE,CACnF;SACF,CAAA;QACD,IAAI,6BAA6B,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACrF,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtF,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,IACE,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAC7F,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IACL,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,mBAAmB,CAAC,EACrF,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IACL,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAC9F,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAA;IACrC,CAAC;SAAM,IACL,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,mBAAmB,CAAC,EACtF,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,mBAAmB,CAAA;IAC/C,CAAC;SAAM,CAAC;QACN,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;IAED,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,oBAAkD,EAClD,OAAmB,EACnB,oBAA0C;IAE1C,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,uBAAuB,CAAC,oBAAoB,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAA;AAC3F,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,mBAAiD,EACjD,OAAmB,EACnB,oBAA0C;IAE1C,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,uBAAuB,CAAC,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAA;AAC5F,CAAC;AAED,SAAS,oBAAoB,CAC3B,SAAoB,EACpB,YAAqB,EACrB,WAAoB,EACpB,cAAqC,EACrC,aAAsB,EACtB,cAAoC,EACpC,OAAkC;IAElC,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QAC1B,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QAC3D,OAAO,EAAE,YAAY;QACrB,WAAW;QACX,cAAc;QACd,aAAa;QACb,cAAc,EAAE,cAAc,KAAK,OAAO;QAC1C,GAAG,OAAO;KACX,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAChC,eAA6C,EAC7C,WAAwB,EACxB,WAAwB,EACxB,gBAAkC,EAClC,gBAAkC,EAClC,0BAA6C,EAC7C,gBAAmC;IAEnC,MAAM,iBAAiB,GAAsB,EAAE,CAAA;IAC/C,IAAI,eAAe,EAAE,CAAC;QACpB,8BAA8B,CAAC,iBAAiB,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,CAAC,CAAA;IACjF,CAAC;IACD,8BAA8B,CAAC,iBAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAChF,8BAA8B,CAAC,iBAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAChF,8BAA8B,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAA;IACjF,8BAA8B,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAA;IACjF,8BAA8B,CAC5B,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAA;IACD,8BAA8B,CAC5B,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAA;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,8BAA8B,CACrC,iBAA6C,EAC7C,GAA4B,EAC5B,QAIG;IAEH,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAuB,EAAE,CAAA;IACnC,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnD,GAAG,QAAQ,CAAC,eAAe;QAC3B,GAAG,QAAQ,CAAC,cAAc;QAC1B,GAAG,QAAQ,CAAC,mBAAmB;KAChC,CAAC,CAAA;IAEF,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,IAAI,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CACR,GAAG,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACzB,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE;oBACrB,MAAM,EAAE,CAAC,CAAC,eAAe,EAAE;iBAC5B,CAAC,CAAC,CACJ,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CACP,GAAG,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACzB,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE;oBACrB,MAAM,EAAE,CAAC,CAAC,eAAe,EAAE;iBAC5B,CAAC,CAAC,CACJ,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAA+C,EAAE,CAAA;IAC/D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAA;IACxB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAA;IACtB,CAAC;IACD,iBAAiB,CAAC,GAAG,CAAC,GAAG,QAAsD,CAAA;AACjF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,eAA6C,EAC7C,WAAwB,EACxB,WAAwB,EACxB,gBAAkC,EAClC,gBAAkC,EAClC,0BAA6C;IAE7C,OAAO,CACL,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACtE,eAAe,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1E,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC7F,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACjC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAC7D;QACD,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC7F,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACjC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAC7D;QACD,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACtE,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1E,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACtE,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1E,0BAA0B,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACjF,0BAA0B,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACrF,KAAK,CACN,CAAA;AACH,CAAC"}