@actsecurity/iam-simulate 0.1.173

package/dist/cjs/analysis/allowedConditions.js

@@ -0,0 +1,395 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowStatementExpression = allowStatementExpression;
+exports.denyStatementEscapeExpression = denyStatementEscapeExpression;
+exports.invertCondition = invertCondition;
+exports.and = and;
+exports.or = or;
+exports.allowedConditionOutput = allowedConditionOutput;
+exports.sessionPolicyExpression = sessionPolicyExpression;
+exports.identityPolicyExpression = identityPolicyExpression;
+exports.permissionBoundaryExpression = permissionBoundaryExpression;
+exports.endpointPolicyExpression = endpointPolicyExpression;
+exports.resourceAllowStatementsExpression = resourceAllowStatementsExpression;
+exports.allDenyEscapeExpressions = allDenyEscapeExpressions;
+exports.always = always;
+exports.never = never;
+/**
+ * Convert a statement's ignored allow-side conditions to an expression.
+ *
+ * @param statement the statement analysis to convert
+ * @param policyType the policy family containing the statement
+ * @param orgIdentifier the organization identifier for control-policy statements
+ * @returns an expression for the statement's ignored conditions
+ */
+function allowStatementExpression(statement, policyType, orgIdentifier) {
+    return statementConditionExpression(statement, policyType, false, orgIdentifier);
+}
+/**
+ * Convert a statement's ignored deny-side conditions to an expression that avoids the deny.
+ *
+ * @param statement the statement analysis to convert
+ * @param policyType the policy family containing the statement
+ * @param orgIdentifier the organization identifier for control-policy statements
+ * @returns an expression that must hold to avoid the deny
+ */
+function denyStatementEscapeExpression(statement, policyType, orgIdentifier) {
+    if (!statement.ignoredConditions || statement.ignoredConditions.length === 0) {
+        return never('explicitDenyWithoutConditions');
+    }
+    const source = sourceForStatement(statement, policyType, orgIdentifier);
+    return or(statement.ignoredConditions.map((condition) => invertCondition(condition, source)));
+}
+/**
+ * Invert a single IAM condition into an allowed-condition expression.
+ *
+ * @param condition the condition to invert
+ * @param source source metadata for the condition
+ * @returns the expression that satisfies the logical complement of the condition
+ */
+function invertCondition(condition, source) {
+    const op = condition.operation().value();
+    const key = condition.conditionKey();
+    const values = condition.conditionValues();
+    return invertConditionParts(op, key, values, source);
+}
+/**
+ * Combine condition expressions with AND semantics and simplify identity/absorbing values.
+ *
+ * @param expressions the expressions to combine
+ * @returns a simplified expression
+ */
+function and(expressions) {
+    const children = expressions.map((expr) => simplify(expr));
+    if (children.some((expr) => expr.conditionType === 'never')) {
+        return children.find((expr) => expr.conditionType === 'never');
+    }
+    const withoutAlways = dedupe(children
+        .filter((expr) => expr.conditionType !== 'always')
+        .flatMap((expr) => expr.conditionType === 'group' && expr.operator === 'and' ? expr.conditions : [expr]));
+    if (withoutAlways.length === 0) {
+        return always();
+    }
+    if (withoutAlways.length === 1) {
+        return withoutAlways[0];
+    }
+    return { conditionType: 'group', operator: 'and', conditions: withoutAlways };
+}
+/**
+ * Combine condition expressions with OR semantics and simplify identity/absorbing values.
+ *
+ * @param expressions the expressions to combine
+ * @returns a simplified expression
+ */
+function or(expressions) {
+    const children = expressions.map((expr) => simplify(expr));
+    if (children.some((expr) => expr.conditionType === 'always')) {
+        return always();
+    }
+    const withoutNever = dedupe(children
+        .filter((expr) => expr.conditionType !== 'never')
+        .flatMap((expr) => expr.conditionType === 'group' && expr.operator === 'or' ? expr.conditions : [expr]));
+    if (withoutNever.length === 0) {
+        return never('noApplicableAllow');
+    }
+    if (withoutNever.length === 1) {
+        return withoutNever[0];
+    }
+    return { conditionType: 'group', operator: 'or', conditions: withoutNever };
+}
+function allowedConditionOutput(expression, simulationMode, result) {
+    if (simulationMode !== 'Discovery' || result !== 'Allowed') {
+        return undefined;
+    }
+    return publicExpression(expression);
+}
+function sessionPolicyExpression(analysis, sessionPolicyPresent) {
+    return sessionPolicyPresent ? identityAllowExpression(analysis, 'session') : always();
+}
+function identityPolicyExpression(analysis) {
+    return identityAllowExpression(analysis, 'identity');
+}
+function permissionBoundaryExpression(analysis) {
+    return identityAllowExpression(analysis, 'permissionBoundary');
+}
+function endpointPolicyExpression(analysis) {
+    return identityAllowExpression(analysis, 'endpointPolicy');
+}
+function resourceAllowStatementsExpression(statements) {
+    return allowStatementsExpression(statements, 'resource');
+}
+function allDenyEscapeExpressions(input) {
+    return [
+        ...denyEscapeExpressions(input.sessionAnalysis, 'session'),
+        ...controlPolicyDenyEscapeExpressions(input.scpAnalysis, 'scp'),
+        ...controlPolicyDenyEscapeExpressions(input.rcpAnalysis, 'rcp'),
+        ...denyEscapeExpressions(input.identityAnalysis, 'identity'),
+        ...resourceDenyEscapeExpressions(input.resourceAnalysis),
+        ...denyEscapeExpressions(input.permissionBoundaryAnalysis, 'permissionBoundary'),
+        ...denyEscapeExpressions(input.endpointAnalysis, 'endpointPolicy')
+    ];
+}
+function identityAllowExpression(analysis, policyType) {
+    if (!analysis || analysis.result !== 'Allowed') {
+        return never('noApplicableAllow');
+    }
+    return allowStatementsExpression(analysis.allowStatements, policyType);
+}
+function allowStatementsExpression(statements, policyType) {
+    if (statements.length === 0) {
+        return never('noApplicableAllow');
+    }
+    return or(statements.map((statement) => allowStatementExpression(statement, policyType)));
+}
+function denyEscapeExpressions(analysis, policyType) {
+    return denyStatementsThatNeedEscapes(analysis).map((statement) => denyStatementEscapeExpression(statement, policyType));
+}
+function resourceDenyEscapeExpressions(analysis) {
+    return denyStatementsThatNeedEscapes(analysis).map((statement) => denyStatementEscapeExpression(statement, 'resource'));
+}
+function controlPolicyDenyEscapeExpressions(analysis, policyType) {
+    return (analysis?.ouAnalysis ?? []).flatMap((ou) => denyStatementsThatNeedEscapes(ou).map((statement) => denyStatementEscapeExpression(statement, policyType, ou.orgIdentifier)));
+}
+function denyStatementsThatNeedEscapes(analysis) {
+    return [...(analysis?.denyStatements ?? []), ...(analysis?.unmatchedStatements ?? [])].filter((statement) => statement.statement.isDeny() && (statement.ignoredConditions?.length ?? 0) > 0);
+}
+function statementConditionExpression(statement, policyType, inverted, orgIdentifier) {
+    const source = sourceForStatement(statement, policyType, orgIdentifier);
+    const conditions = statement.ignoredConditions ?? [];
+    const conditionExpressions = conditions.map((condition) => conditionLeaf(condition, source, inverted));
+    const sessionExpression = sessionNameExpression(statement, source);
+    if (sessionExpression) {
+        conditionExpressions.push(sessionExpression);
+    }
+    return and(conditionExpressions);
+}
+function sourceForStatement(statement, policyType, orgIdentifier) {
+    const sid = statement.statement.sid();
+    return {
+        policyType,
+        effect: statement.statement.effect(),
+        policyIdentifier: statement.policyId,
+        ...(orgIdentifier ? { orgIdentifier } : {}),
+        ...(sid ? { statementId: sid } : {}),
+        statementIndex: statement.statement.index()
+    };
+}
+function conditionLeaf(condition, source, inverted) {
+    return {
+        conditionType: 'condition',
+        op: condition.operation().value(),
+        key: condition.conditionKey(),
+        values: condition.conditionValues(),
+        sources: [source],
+        ...(inverted ? { inverted: true } : {})
+    };
+}
+function sessionNameExpression(statement, source) {
+    if (!statement.ignoredRoleSessionName) {
+        return undefined;
+    }
+    const names = principalExplains(statement)
+        .map((explain) => sessionNameFromAssumedRoleArn(explain.principal))
+        .filter((name) => name !== undefined);
+    if (names.length === 0) {
+        return undefined;
+    }
+    return {
+        conditionType: 'sessionName',
+        sessionName: Array.from(new Set(names)),
+        sources: [source]
+    };
+}
+function principalExplains(statement) {
+    const principals = statement.explain.principals ?? statement.explain.notPrincipals;
+    if (!principals) {
+        return [];
+    }
+    return Array.isArray(principals) ? principals : [principals];
+}
+function sessionNameFromAssumedRoleArn(arn) {
+    const resource = arn.split(':').at(-1);
+    if (!resource?.startsWith('assumed-role/')) {
+        return undefined;
+    }
+    return resource.split('/').at(2);
+}
+function invertConditionParts(op, key, values, source) {
+    const setOperator = conditionSetOperator(op);
+    const hasIfExists = isIfExists(op);
+    const base = conditionBaseOperator(op);
+    if (hasIfExists) {
+        const withoutIfExists = operatorName(base, setOperator, false);
+        const invertedBase = invertConditionParts(withoutIfExists, key, values, source);
+        if (negativeConditionOperatorsMatchMissingKeys(base)) {
+            return invertedBase;
+        }
+        return and([leaf('Null', key, ['false'], source), invertedBase]);
+    }
+    if (base.toLowerCase() === 'null' || base.toLowerCase() === 'bool') {
+        return leaf(invertedOperatorName(op, base, setOperator, hasIfExists), key, flipBooleanValues(values), source);
+    }
+    if (setOperator === 'ForAllValues') {
+        return and([
+            leaf('Null', key, ['false'], source),
+            leaf(operatorName(invertBaseOperator(base), 'ForAnyValue', false), key, values, source)
+        ]);
+    }
+    if (setOperator === 'ForAnyValue') {
+        return or([
+            leaf('Null', key, ['true'], source),
+            leaf(operatorName(invertBaseOperator(base), 'ForAllValues', false), key, values, source)
+        ]);
+    }
+    return leaf(invertBaseOperator(base), key, values, source);
+}
+function leaf(op, key, values, source) {
+    return {
+        conditionType: 'condition',
+        op,
+        key,
+        values,
+        sources: [source],
+        inverted: true
+    };
+}
+function conditionSetOperator(op) {
+    const prefix = op.includes(':') ? op.split(':')[0].toLowerCase() : undefined;
+    if (prefix === 'forallvalues') {
+        return 'ForAllValues';
+    }
+    if (prefix === 'foranyvalue') {
+        return 'ForAnyValue';
+    }
+    return undefined;
+}
+function conditionBaseOperator(op) {
+    return op
+        .split(':')
+        .at(-1)
+        .replace(/IfExists$/i, '');
+}
+function isIfExists(op) {
+    return /IfExists$/i.test(op);
+}
+function invertedOperatorName(originalOp, base, setOperator, hasIfExists) {
+    if (base.toLowerCase() === 'bool' || base.toLowerCase() === 'null') {
+        return operatorName(base, setOperator, hasIfExists);
+    }
+    return originalOp;
+}
+function negativeConditionOperatorsMatchMissingKeys(base) {
+    return new Set([
+        'stringnotequals',
+        'stringnotequalsignorecase',
+        'stringnotlike',
+        'arnnotequals',
+        'arnnotlike',
+        'numericnotequals',
+        'datenotequals',
+        'notipaddress',
+        'binarynotequals'
+    ]).has(base.toLowerCase());
+}
+function operatorName(base, setOperator, ifExists) {
+    const op = canonicalBaseOperator(base) + (ifExists ? 'IfExists' : '');
+    return setOperator ? `${setOperator}:${op}` : op;
+}
+function invertBaseOperator(base) {
+    const map = {
+        stringequals: 'StringNotEquals',
+        stringnotequals: 'StringEquals',
+        stringequalsignorecase: 'StringNotEqualsIgnoreCase',
+        stringnotequalsignorecase: 'StringEqualsIgnoreCase',
+        stringlike: 'StringNotLike',
+        stringnotlike: 'StringLike',
+        arnequals: 'ArnNotEquals',
+        arnnotequals: 'ArnEquals',
+        arnlike: 'ArnNotLike',
+        arnnotlike: 'ArnLike',
+        numericequals: 'NumericNotEquals',
+        numericnotequals: 'NumericEquals',
+        numericlessthan: 'NumericGreaterThanEquals',
+        numericlessthanequals: 'NumericGreaterThan',
+        numericgreaterthan: 'NumericLessThanEquals',
+        numericgreaterthanequals: 'NumericLessThan',
+        dateequals: 'DateNotEquals',
+        datenotequals: 'DateEquals',
+        datelessthan: 'DateGreaterThanEquals',
+        datelessthanequals: 'DateGreaterThan',
+        dategreaterthan: 'DateLessThanEquals',
+        dategreaterthanequals: 'DateLessThan',
+        ipaddress: 'NotIpAddress',
+        notipaddress: 'IpAddress',
+        binaryequals: 'BinaryNotEquals',
+        binarynotequals: 'BinaryEquals'
+    };
+    return map[base.toLowerCase()] ?? `Not:${base}`;
+}
+function canonicalBaseOperator(base) {
+    const canonical = {
+        stringequals: 'StringEquals',
+        stringnotequals: 'StringNotEquals',
+        stringequalsignorecase: 'StringEqualsIgnoreCase',
+        stringnotequalsignorecase: 'StringNotEqualsIgnoreCase',
+        stringlike: 'StringLike',
+        stringnotlike: 'StringNotLike',
+        arnequals: 'ArnEquals',
+        arnnotequals: 'ArnNotEquals',
+        arnlike: 'ArnLike',
+        arnnotlike: 'ArnNotLike',
+        numericequals: 'NumericEquals',
+        numericnotequals: 'NumericNotEquals',
+        numericlessthan: 'NumericLessThan',
+        numericlessthanequals: 'NumericLessThanEquals',
+        numericgreaterthan: 'NumericGreaterThan',
+        numericgreaterthanequals: 'NumericGreaterThanEquals',
+        dateequals: 'DateEquals',
+        datenotequals: 'DateNotEquals',
+        datelessthan: 'DateLessThan',
+        datelessthanequals: 'DateLessThanEquals',
+        dategreaterthan: 'DateGreaterThan',
+        dategreaterthanequals: 'DateGreaterThanEquals',
+        bool: 'Bool',
+        null: 'Null',
+        ipaddress: 'IpAddress',
+        notipaddress: 'NotIpAddress',
+        binaryequals: 'BinaryEquals',
+        binarynotequals: 'BinaryNotEquals'
+    };
+    return canonical[base.toLowerCase()] ?? base;
+}
+function flipBooleanValues(values) {
+    return values.map((value) => (value.toLowerCase() === 'true' ? 'false' : 'true'));
+}
+function publicExpression(expression) {
+    const simplified = simplify(expression);
+    return simplified.conditionType === 'always' || simplified.conditionType === 'never'
+        ? undefined
+        : simplified;
+}
+function simplify(expression) {
+    if (expression.conditionType !== 'group') {
+        return expression;
+    }
+    return expression.operator === 'and' ? and(expression.conditions) : or(expression.conditions);
+}
+function always() {
+    return { conditionType: 'always' };
+}
+function never(reason) {
+    return { conditionType: 'never', reason };
+}
+function dedupe(expressions) {
+    const seen = new Set();
+    const result = [];
+    for (const expression of expressions) {
+        const key = JSON.stringify(expression);
+        if (!seen.has(key)) {
+            seen.add(key);
+            result.push(expression);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=allowedConditions.js.map

package/dist/cjs/analysis/allowedConditions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedConditions.js","sourceRoot":"","sources":["../../../src/analysis/allowedConditions.ts"],"names":[],"mappings":";;AAqBA,4DAMC;AAUD,sEAWC;AASD,0CAQC;AAQD,kBAmBC;AAQD,gBAmBC;AAED,wDASC;AAED,0DAKC;AAED,4DAIC;AAED,oEAIC;AAED,4DAIC;AAED,8EAIC;AAED,4DAkBC;AA+VD,wBAEC;AAED,sBAIC;AA/gBD;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CACtC,SAA4B,EAC5B,UAAgD,EAChD,aAAsB;IAEtB,OAAO,4BAA4B,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,6BAA6B,CAC3C,SAA4B,EAC5B,UAAgD,EAChD,aAAsB;IAEtB,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAA;IACvE,OAAO,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;AAC/F,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAC7B,SAAoB,EACpB,MAA8B;IAE9B,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAA;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,EAAE,CAAA;IAC1C,OAAO,oBAAoB,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,GAAG,CAAC,WAAyC;IAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAE,CAAA;IACjE,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAC1B,QAAQ;SACL,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC;SACjD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACrF,CACJ,CAAA;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,EAAE,CAAA;IACjB,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,EAAE,CAAC,WAAyC;IAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,MAAM,EAAE,CAAA;IACjB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CACzB,QAAQ;SACL,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC;SAChD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACpF,CACJ,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAA;AAC7E,CAAC;AAED,SAAgB,sBAAsB,CACpC,UAAsC,EACtC,cAAsB,EACtB,MAAc;IAEd,IAAI,cAAc,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAA;AACrC,CAAC;AAED,SAAgB,uBAAuB,CACrC,QAAsC,EACtC,oBAA6B;IAE7B,OAAO,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACvF,CAAC;AAED,SAAgB,wBAAwB,CACtC,QAAsC;IAEtC,OAAO,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;AACtD,CAAC;AAED,SAAgB,4BAA4B,CAC1C,QAAsC;IAEtC,OAAO,uBAAuB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAA;AAChE,CAAC;AAED,SAAgB,wBAAwB,CACtC,QAAsC;IAEtC,OAAO,uBAAuB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;AAC5D,CAAC;AAED,SAAgB,iCAAiC,CAC/C,UAA+B;IAE/B,OAAO,yBAAyB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;AAC1D,CAAC;AAED,SAAgB,wBAAwB,CAAC,KAQxC;IACC,OAAO;QACL,GAAG,qBAAqB,CAAC,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC;QAC1D,GAAG,kCAAkC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;QAC/D,GAAG,kCAAkC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;QAC/D,GAAG,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,EAAE,UAAU,CAAC;QAC5D,GAAG,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACxD,GAAG,qBAAqB,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;QAChF,GAAG,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;KACnE,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAAsC,EACtC,UAAgD;IAEhD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,yBAAyB,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,yBAAyB,CAChC,UAA+B,EAC/B,UAAgD;IAEhD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAsC,EACtC,UAAgD;IAEhD,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,6BAA6B,CAAC,SAAS,EAAE,UAAU,CAAC,CACrD,CAAA;AACH,CAAC;AAED,SAAS,6BAA6B,CACpC,QAAsC;IAEtC,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,6BAA6B,CAAC,SAAS,EAAE,UAAU,CAAC,CACrD,CAAA;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,QAA+C,EAC/C,UAAyB;IAEzB,OAAO,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACjD,6BAA6B,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClD,6BAA6B,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,CACvE,CACF,CAAA;AACH,CAAC;AAED,SAAS,6BAA6B,CACpC,QAC+F;IAE/F,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAC3F,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC9F,CAAA;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,SAA4B,EAC5B,UAAgD,EAChD,QAAiB,EACjB,aAAsB;IAEtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAA;IACvE,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,IAAI,EAAE,CAAA;IACpD,MAAM,oBAAoB,GAAiC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACtF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC3C,CAAA;IACD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAClE,IAAI,iBAAiB,EAAE,CAAC;QACtB,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,oBAAoB,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,kBAAkB,CACzB,SAA4B,EAC5B,UAAgD,EAChD,aAAsB;IAEtB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAA;IACrC,OAAO;QACL,UAAU;QACV,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAsB;QACxD,gBAAgB,EAAE,SAAS,CAAC,QAAQ;QACpC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAoB,EACpB,MAA8B,EAC9B,QAAiB;IAEjB,OAAO;QACL,aAAa,EAAE,WAAW;QAC1B,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACjC,GAAG,EAAE,SAAS,CAAC,YAAY,EAAE;QAC7B,MAAM,EAAE,SAAS,CAAC,eAAe,EAAE;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAA4B,EAC5B,MAA8B;IAE9B,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC;SACvC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,6BAA6B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IAEvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,aAAa,EAAE,aAAa;QAC5B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,SAA4B;IACrD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,CAAA;IAClF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAW;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,oBAAoB,CAC3B,EAAU,EACV,GAAW,EACX,MAAgB,EAChB,MAA8B;IAE9B,MAAM,WAAW,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;IAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAA;IAEtC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;QAC9D,MAAM,YAAY,GAAG,oBAAoB,CAAC,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/E,IAAI,0CAA0C,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,YAAY,CAAA;QACrB,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,IAAI,CACT,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,EACxD,GAAG,EACH,iBAAiB,CAAC,MAAM,CAAC,EACzB,MAAM,CACP,CAAA;IACH,CAAC;IAED,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;SACxF,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;SACzF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,IAAI,CACX,EAAU,EACV,GAAW,EACX,MAAgB,EAChB,MAA8B;IAE9B,OAAO;QACL,aAAa,EAAE,WAAW;QAC1B,EAAE;QACF,GAAG;QACH,MAAM;QACN,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,QAAQ,EAAE,IAAI;KACf,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAU;IACtC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5E,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,EAAU;IACvC,OAAO,EAAE;SACN,KAAK,CAAC,GAAG,CAAC;SACV,EAAE,CAAC,CAAC,CAAC,CAAE;SACP,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAAkB,EAClB,IAAY,EACZ,WAAuD,EACvD,WAAoB;IAEpB,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,0CAA0C,CAAC,IAAY;IAC9D,OAAO,IAAI,GAAG,CAAC;QACb,iBAAiB;QACjB,2BAA2B;QAC3B,eAAe;QACf,cAAc;QACd,YAAY;QACZ,kBAAkB;QAClB,eAAe;QACf,cAAc;QACd,iBAAiB;KAClB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,WAAuD,EACvD,QAAiB;IAEjB,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACrE,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,GAAG,GAA2B;QAClC,YAAY,EAAE,iBAAiB;QAC/B,eAAe,EAAE,cAAc;QAC/B,sBAAsB,EAAE,2BAA2B;QACnD,yBAAyB,EAAE,wBAAwB;QACnD,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,cAAc;QACzB,YAAY,EAAE,WAAW;QACzB,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,SAAS;QACrB,aAAa,EAAE,kBAAkB;QACjC,gBAAgB,EAAE,eAAe;QACjC,eAAe,EAAE,0BAA0B;QAC3C,qBAAqB,EAAE,oBAAoB;QAC3C,kBAAkB,EAAE,uBAAuB;QAC3C,wBAAwB,EAAE,iBAAiB;QAC3C,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,uBAAuB;QACrC,kBAAkB,EAAE,iBAAiB;QACrC,eAAe,EAAE,oBAAoB;QACrC,qBAAqB,EAAE,cAAc;QACrC,SAAS,EAAE,cAAc;QACzB,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,iBAAiB;QAC/B,eAAe,EAAE,cAAc;KAChC,CAAA;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,IAAI,EAAE,CAAA;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,SAAS,GAA2B;QACxC,YAAY,EAAE,cAAc;QAC5B,eAAe,EAAE,iBAAiB;QAClC,sBAAsB,EAAE,wBAAwB;QAChD,yBAAyB,EAAE,2BAA2B;QACtD,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,eAAe;QAC9B,SAAS,EAAE,WAAW;QACtB,YAAY,EAAE,cAAc;QAC5B,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,eAAe;QAC9B,gBAAgB,EAAE,kBAAkB;QACpC,eAAe,EAAE,iBAAiB;QAClC,qBAAqB,EAAE,uBAAuB;QAC9C,kBAAkB,EAAE,oBAAoB;QACxC,wBAAwB,EAAE,0BAA0B;QACpD,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,eAAe;QAC9B,YAAY,EAAE,cAAc;QAC5B,kBAAkB,EAAE,oBAAoB;QACxC,eAAe,EAAE,iBAAiB;QAClC,qBAAqB,EAAE,uBAAuB;QAC9C,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,WAAW;QACtB,YAAY,EAAE,cAAc;QAC5B,YAAY,EAAE,cAAc;QAC5B,eAAe,EAAE,iBAAiB;KACnC,CAAA;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAsC;IAEtC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IACvC,OAAO,UAAU,CAAC,aAAa,KAAK,QAAQ,IAAI,UAAU,CAAC,aAAa,KAAK,OAAO;QAClF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,UAAsC;IACtD,IAAI,UAAU,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAC/F,CAAC;AAED,SAAgB,MAAM;IACpB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAA;AACpC,CAAC;AAED,SAAgB,KAAK,CACnB,MAA6D;IAE7D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC3C,CAAC;AAED,SAAS,MAAM,CAAC,WAAyC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,MAAM,GAAiC,EAAE,CAAA;IAC/C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/cjs/analysis/analyzeResults.d.ts

@@ -0,0 +1,99 @@
+import { type BlockedReason, type RequestAnalysis } from '../evaluate.js';
+/**
+ * Analyze a RequestAnalysis to see if the request was allowed by identity policies.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns true if the request was allowed by identity policies, false otherwise
+ */
+export declare function isAllowedByIdentityPolicies(requestAnalysis: RequestAnalysis): boolean;
+export type DenialPolicyType = BlockedReason;
+export type RequestDenial = {
+    /**
+     * The type of policy that caused the denial.
+     */
+    policyType: DenialPolicyType;
+    /**
+     * This denial blocks a request that otherwise could have been allowed.
+     */
+    blocking?: true;
+    /**
+     * The identifier of the policy that caused the denial, if applicable. This could be a
+     * policy identifier or an organizational unit identifier for SCPs and RCPs.
+     */
+    identifier?: string;
+    /**
+     * The type of denial.
+     */
+    denialType: 'Implicit';
+} | {
+    /**
+     * The type of policy that caused the denial.
+     */
+    policyType: DenialPolicyType;
+    /**
+     * This denial blocks a request that otherwise could have been allowed.
+     */
+    blocking?: true;
+    /**
+     * The identifier of the policy that caused the denial. May be undefined, for example
+     * in a resource policy.
+     */
+    policyIdentifier?: string;
+    /**
+     * The statement ID (Sid) of the denying policy statement, if present. This corresponds
+     * to the Sid field in the AWS IAM policy statement and may be absent if the statement
+     * does not define a Sid.
+     */
+    statementId?: string | undefined;
+    /**
+     * The 1-based index of the denying statement within the policy, if applicable. This is useful when the statement does not have a Sid.
+     */
+    statementIndex: number;
+    /**
+     * The type of denial.
+     */
+    denialType: 'Explicit';
+};
+export type RequestGrant = {
+    policyType: 'identity' | 'pb' | 'vpce';
+    policyIdentifier: string;
+    statementId?: string | undefined;
+    statementIndex: number;
+} | {
+    policyType: 'resource';
+    statementId?: string | undefined;
+    statementIndex: number;
+} | {
+    policyType: 'scp' | 'rcp';
+    orgIdentifier: string;
+    policyIdentifier: string;
+    statementId?: string | undefined;
+    statementIndex: number;
+};
+/**
+ * Find the policy statements that caused a request to be denied.
+ * Analyzes the RequestAnalysis and returns the specific reasons why the request was denied.
+ *
+ * For an implicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the identifier, if applicable for an Organizational Unit identifier for SCPs.
+ *
+ * For an explicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the policy identifier, if applicable for a managed policy or an SCP
+ * - the statement ID (Sid), if the denying statement has one
+ * - the statement index (1-based) of the denying statement
+ *
+ * @param requestAnalysis the request analysis
+ * @returns a list of RequestDenial objects describing the reasons for denial
+ */
+export declare function getDenialReasons(requestAnalysis: RequestAnalysis): RequestDenial[];
+/**
+ * Find the policy statements that granted access for an allowed request.
+ * Analyzes the RequestAnalysis and returns the specific grants that allowed the request.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns a list of RequestGrant objects describing which policies granted access
+ */
+export declare function getGrantReasons(requestAnalysis: RequestAnalysis): RequestGrant[];
+//# sourceMappingURL=analyzeResults.d.ts.map

package/dist/cjs/analysis/analyzeResults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzeResults.d.ts","sourceRoot":"","sources":["../../../src/analysis/analyzeResults.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAIlB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAA;AAEvB;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,eAAe,GAAG,OAAO,CAOrF;AAED,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAE5C,MAAM,MAAM,aAAa,GACrB;IACE;;OAEG;IACH,UAAU,EAAE,gBAAgB,CAAA;IAE5B;;OAEG;IACH,QAAQ,CAAC,EAAE,IAAI,CAAA;IAEf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;OAEG;IACH,UAAU,EAAE,UAAU,CAAA;CACvB,GACD;IACE;;OAEG;IACH,UAAU,EAAE,gBAAgB,CAAA;IAE5B;;OAEG;IACH,QAAQ,CAAC,EAAE,IAAI,CAAA;IAEf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,UAAU,EAAE,UAAU,CAAA;CACvB,CAAA;AAEL,MAAM,MAAM,YAAY,GACpB;IACE,UAAU,EAAE,UAAU,GAAG,IAAI,GAAG,MAAM,CAAA;IACtC,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,MAAM,CAAA;CACvB,GACD;IACE,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,MAAM,CAAA;CACvB,GACD;IACE,UAAU,EAAE,KAAK,GAAG,KAAK,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAEL;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,eAAe,GAAG,aAAa,EAAE,CAqClF;AAiGD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,eAAe,EAAE,eAAe,GAAG,YAAY,EAAE,CAehF"}