@actsecurity/iam-simulate 0.1.173

package/dist/esm/explain/statementExplain.js

@@ -0,0 +1,30 @@
+/**
+ * Known reasons that a policy resource can fail to match a request resource.
+ *
+ * The `invertible` flag records whether the mismatch definitively proves that
+ * the request is outside a `NotResource` set. Non-invertible reasons indicate
+ * invalid policy syntax or unavailable input rather than a definitive mismatch.
+ */
+export const resourceMismatchReasons = {
+    invalidPolicyResourceArn: { invertible: false },
+    requestMissingResource: { invertible: false },
+    unresolvablePolicyVariable: { invertible: false },
+    shortArnNoMatch: { invertible: true },
+    // Expanded short ARN mismatches preserve existing conservative behavior and are not inverted.
+    shortArnExpandedMismatch: { invertible: false },
+    wildcardOnlyActionSpecificResource: { invertible: true },
+    requestAllResourcesSpecificNotResource: { invertible: true },
+    requestAllResourcesDenySpecificResource: { invertible: true },
+    resourcePatternMismatch: { invertible: true },
+    partitionMismatch: { invertible: true },
+    serviceMismatch: { invertible: true },
+    regionMismatch: { invertible: true },
+    accountMismatch: { invertible: true },
+    productMismatch: { invertible: true },
+    resourceIdMismatch: { invertible: true }
+};
+/*
+I want to emit the policy object exactly as it was written. How do I get a structure
+that matches the policy object exactly? Should I just embed the values in the explain?
+*/
+//# sourceMappingURL=statementExplain.js.map

package/dist/esm/explain/statementExplain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statementExplain.js","sourceRoot":"","sources":["../../../src/explain/statementExplain.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,wBAAwB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IAC/C,sBAAsB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7C,0BAA0B,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IACjD,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACrC,8FAA8F;IAC9F,wBAAwB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IAC/C,kCAAkC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACxD,sCAAsC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5D,uCAAuC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7D,uBAAuB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7C,iBAAiB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACvC,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACrC,cAAc,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACpC,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACrC,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACrC,kBAAkB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;CAChC,CAAA;AAwHV;;;EAGE"}

package/dist/esm/global_conditions/globalConditionKeys.d.ts

@@ -0,0 +1,3 @@
+import { type ConditionKey } from '@actsecurity/iam-data';
+export declare function getGlobalConditionKeyWithOrWithoutPrefix(key: string): ConditionKey | undefined;
+//# sourceMappingURL=globalConditionKeys.d.ts.map

package/dist/esm/global_conditions/globalConditionKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalConditionKeys.d.ts","sourceRoot":"","sources":["../../../src/global_conditions/globalConditionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,uBAAuB,CAAA;AAE9B,wBAAgB,wCAAwC,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM9F"}

package/dist/esm/global_conditions/globalConditionKeys.js

@@ -0,0 +1,9 @@
+import { getGlobalConditionKeyByName, getGlobalConditionKeyByPrefix } from '@actsecurity/iam-data';
+export function getGlobalConditionKeyWithOrWithoutPrefix(key) {
+    const slashIndex = key.indexOf('/');
+    if (slashIndex !== -1) {
+        return getGlobalConditionKeyByPrefix(key.slice(0, slashIndex));
+    }
+    return getGlobalConditionKeyByName(key);
+}
+//# sourceMappingURL=globalConditionKeys.js.map

package/dist/esm/global_conditions/globalConditionKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalConditionKeys.js","sourceRoot":"","sources":["../../../src/global_conditions/globalConditionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,2BAA2B,EAC3B,6BAA6B,EAC9B,MAAM,uBAAuB,CAAA;AAE9B,MAAM,UAAU,wCAAwC,CAAC,GAAW;IAClE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAA;AACzC,CAAC"}

package/dist/esm/index.d.ts

@@ -0,0 +1,16 @@
+export { getDenialReasons, getGrantReasons, type DenialPolicyType, type RequestGrant, type RequestDenial } from './analysis/analyzeResults.js';
+export { typeForContextKey } from './context_keys/contextKeys.js';
+export { isConditionKeyArray, type BaseConditionKeyType, type ConditionKeyType } from './context_keys/contextKeyTypes.js';
+export type { DiscoveryContextKeyConstraint } from './context_keys/discoveryContextKeyConstraints.js';
+export { findContextKeys } from './context_keys/findContextKeys.js';
+export type { SimulationMode } from './core_engine/CoreSimulatorEngine.js';
+export type { AllowedConditionExpression, AllowedConditionGroup, AllowedConditionLeaf, AllowedConditionSource, AllowedSessionNameCondition, AlwaysAllowedCondition, BlockedReason, EvaluationResult, IgnoredCondition, IgnoredConditions, NeverAllowedCondition, RequestAnalysis } from './evaluate.js';
+export type { ActionExplain, ConditionExplain, ConditionValueExplain, ExplainPrincipalMatch, PrincipalExplain, ResourceExplain, StatementExplain } from './explain/statementExplain.js';
+export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
+export { anonymousPrincipal, isAnonymousRequestPrincipal, isSimulationRequestPrincipal, type AnonymousRequestPrincipal, type Simulation, type SimulationIdentityPolicy, type SimulationOrgPolicies, type SimulationRequestPrincipal } from './simulation_engine/simulation.js';
+export { runSimulation } from './simulation_engine/simulationEngine.js';
+export type { ErrorSimulationResult, RunSimulationResults, SimulationErrors, SimulationResourceResult, SimulationResultType, SingleResourceSimulationResult, SuccessfulRunSimulationResults, WildcardResourceSimulationResults, WildcardSimulationResourceResult } from './simulation_engine/simulationEngine.js';
+export type { SimulationOptions } from './simulation_engine/simulationOptions.js';
+export { runUnsafeSimulation } from './simulation_engine/unsafeSimulationEngine.js';
+export { isWildcardOnlyAction } from './util.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,YAAY,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAA;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,UAAU,EACf,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AACvE,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EACjC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}

package/dist/esm/index.js

@@ -0,0 +1,10 @@
+export { getDenialReasons, getGrantReasons } from './analysis/analyzeResults.js';
+export { typeForContextKey } from './context_keys/contextKeys.js';
+export { isConditionKeyArray } from './context_keys/contextKeyTypes.js';
+export { findContextKeys } from './context_keys/findContextKeys.js';
+export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
+export { anonymousPrincipal, isAnonymousRequestPrincipal, isSimulationRequestPrincipal } from './simulation_engine/simulation.js';
+export { runSimulation } from './simulation_engine/simulationEngine.js';
+export { runUnsafeSimulation } from './simulation_engine/unsafeSimulationEngine.js';
+export { isWildcardOnlyAction } from './util.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,eAAe,EAIhB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,mBAAmB,EAGpB,MAAM,mCAAmC,CAAA;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AAyBnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,EAM7B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAavE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+    "type": "module"
+}

package/dist/esm/policyType.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The type of IAM policy being evaluated during authorization.
+ *
+ * - `'identity'` — identity-based policies attached to the principal
+ * - `'resource'` — resource-based policies attached to the target resource
+ * - `'scp'` — service control policies from AWS Organizations
+ * - `'rcp'` — resource control policies from AWS Organizations
+ * - `'pb'` — permission boundary policies
+ * - `'vpce'` — VPC endpoint policies
+ * - `'session'` — session policies for assumed role or federated sessions
+ */
+export type PolicyType = 'scp' | 'rcp' | 'vpce' | 'identity' | 'resource' | 'pb' | 'session';
+//# sourceMappingURL=policyType.d.ts.map

package/dist/esm/policyType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyType.d.ts","sourceRoot":"","sources":["../../src/policyType.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,CAAA"}

package/dist/esm/policyType.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policyType.js.map

package/dist/esm/policyType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyType.js","sourceRoot":"","sources":["../../src/policyType.ts"],"names":[],"mappings":""}

package/dist/esm/principal/principal.d.ts

@@ -0,0 +1,61 @@
+import { type Principal, type Statement } from '@actsecurity/iam-policy';
+import { type SimulationParameters } from '../core_engine/CoreSimulatorEngine.js';
+import { type PrincipalExplain, type StatementExplain } from '../explain/statementExplain.js';
+import { type AwsRequest } from '../request/request.js';
+interface PrincipalAnalysis {
+    explain: PrincipalExplain;
+    ignoredRoleSessionName?: boolean;
+}
+export type PrincipalMatchResult = 'Match' | 'NoMatch' | 'AccountLevelMatch' | 'SessionRoleMatch' | 'SessionUserMatch';
+/**
+ * Check to see if a request matches a Principal element in an IAM policy statement
+ *
+ * @param request the request to check
+ * @param principal the list of principals in the Principal element of the Statement
+ * @returns if the request matches the Principal element, and if so, how it matches
+ */
+export declare function requestMatchesPrincipal(request: AwsRequest, principal: Principal[], simulationParameters: SimulationParameters, allowOrDeny: 'Allow' | 'Deny'): {
+    matches: PrincipalMatchResult;
+    explains: PrincipalExplain[];
+    ignoredRoleSessionName?: boolean;
+};
+/**
+ * Check to see if a request matches a NotPrincipal element in an IAM policy statement
+ *
+ * @param request the request to check
+ * @param notPrincipal the list of principals in the NotPrincipal element of the Statement
+ * @returns
+ */
+export declare function requestMatchesNotPrincipal(request: AwsRequest, notPrincipal: Principal[], simulationParameters: SimulationParameters, allowOrDeny: 'Allow' | 'Deny'): {
+    matches: PrincipalMatchResult;
+    explains: PrincipalExplain[];
+};
+/**
+ * Check to see if a request matches a principal statement
+ *
+ * @param request the request to check
+ * @param principalStatement the principal statement to check the request against
+ * @returns if the request matches the principal statement, and if so, how it matches
+ */
+export declare function requestMatchesPrincipalStatement(request: AwsRequest, principalStatement: Principal, simulationParameters: SimulationParameters, allowOrDeny: 'Allow' | 'Deny'): PrincipalAnalysis;
+/**
+ * Get a user ARN from a federated user ARN
+ *
+ * @param federatedUserArn the federated user ARN
+ * @returns the user ARN for the federated user ARN
+ */
+export declare function userArnFromFederatedUserArn(federatedUserArn: string): string;
+/**
+ * Check if a request matches the Resource or NotResource elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @returns true if the request matches the resources in the statement, false otherwise
+ */
+export declare function requestMatchesStatementPrincipals(request: AwsRequest, statement: Statement, simulationParameters: SimulationParameters): {
+    matches: PrincipalMatchResult;
+    details: Pick<StatementExplain, 'principals' | 'notPrincipals' | 'noPrincipalElement'>;
+    ignoredRoleSessionName?: boolean;
+};
+export {};
+//# sourceMappingURL=principal.d.ts.map

package/dist/esm/principal/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAQxE,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AACjF,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAGvD,UAAU,iBAAiB;IACzB,OAAO,EAAE,gBAAgB,CAAA;IACzB,sBAAsB,CAAC,EAAE,OAAO,CAAA;CACjC;AAcD,MAAM,MAAM,oBAAoB,GAC9B,OAAO,GAAG,SAAS,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,kBAAkB,CAAA;AAErF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EAAE,EACtB,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,OAAO,GAAG,MAAM,GAC5B;IACD,OAAO,EAAE,oBAAoB,CAAA;IAC7B,QAAQ,EAAE,gBAAgB,EAAE,CAAA;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAA;CACjC,CA6DA;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,SAAS,EAAE,EACzB,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,OAAO,GAAG,MAAM,GAC5B;IAAE,OAAO,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAyCjE;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,UAAU,EACnB,kBAAkB,EAAE,SAAS,EAC7B,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,OAAO,GAAG,MAAM,GAC5B,iBAAiB,CAyKnB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAK5E;AAoED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,oBAAoB,EAAE,oBAAoB,GACzC;IACD,OAAO,EAAE,oBAAoB,CAAA;IAC7B,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,eAAe,GAAG,oBAAoB,CAAC,CAAA;IACtF,sBAAsB,CAAC,EAAE,OAAO,CAAA;CACjC,CAmBA"}

package/dist/esm/principal/principal.js

@@ -0,0 +1,354 @@
+import {} from '@actsecurity/iam-policy';
+import { convertAssumedRoleArnToRoleArn, isAssumedRoleArn, isFederatedUserArn, isIamRoleArn, splitArnParts } from '@actsecurity/iam-utils';
+import {} from '../core_engine/CoreSimulatorEngine.js';
+import {} from '../explain/statementExplain.js';
+import {} from '../request/request.js';
+import { assertAuthenticatedRequestPrincipal } from '../request/requestPrincipal.js';
+/**
+ * Check to see if a request matches a Principal element in an IAM policy statement
+ *
+ * @param request the request to check
+ * @param principal the list of principals in the Principal element of the Statement
+ * @returns if the request matches the Principal element, and if so, how it matches
+ */
+export function requestMatchesPrincipal(request, principal, simulationParameters, allowOrDeny) {
+    const analyses = principal.map((principalStatement) => requestMatchesPrincipalStatement(request, principalStatement, simulationParameters, allowOrDeny));
+    const explains = analyses.map((a) => a.explain);
+    const anyIgnore = analyses.some((any) => any.ignoredRoleSessionName);
+    const ignoredRoleSessionName = anyIgnore ? true : undefined;
+    // First check if any principal match without ignoring the role session name
+    if (analyses.some((anys) => anys.explain.matches === 'Match' && !anys.ignoredRoleSessionName)) {
+        return {
+            matches: 'Match',
+            explains,
+            ignoredRoleSessionName
+        };
+    }
+    if (explains.some((exp) => exp.matches === 'SessionUserMatch')) {
+        return {
+            matches: 'SessionUserMatch',
+            explains,
+            ignoredRoleSessionName
+        };
+    }
+    if (explains.some((exp) => exp.matches === 'SessionRoleMatch')) {
+        return {
+            matches: 'SessionRoleMatch',
+            explains,
+            ignoredRoleSessionName
+        };
+    }
+    // If there was a match, in Discovery mode, return a match and check for ignoredRoleSessionName
+    if (simulationParameters.simulationMode === 'Discovery' &&
+        analyses.some((any) => any.explain.matches === 'Match')) {
+        // The session role name could have been ignored in any statement
+        return {
+            matches: 'Match',
+            explains,
+            ignoredRoleSessionName
+        };
+    }
+    if (explains.some((exp) => exp.matches === 'AccountLevelMatch')) {
+        return {
+            matches: 'AccountLevelMatch',
+            explains,
+            ignoredRoleSessionName
+        };
+    }
+    return {
+        matches: 'NoMatch',
+        explains,
+        ignoredRoleSessionName
+    };
+}
+/**
+ * Check to see if a request matches a NotPrincipal element in an IAM policy statement
+ *
+ * @param request the request to check
+ * @param notPrincipal the list of principals in the NotPrincipal element of the Statement
+ * @returns
+ */
+export function requestMatchesNotPrincipal(request, notPrincipal, simulationParameters, allowOrDeny) {
+    // const matches = notPrincipal.map(principalStatement => requestMatchesPrincipalStatement(request, principalStatement))
+    const analyses = notPrincipal.map((principalStatement) => {
+        const analysis = requestMatchesPrincipalStatement(request, principalStatement, simulationParameters, allowOrDeny);
+        /**
+         * Need to do research on this. If there is an account level match on a NotPrincipal, does that
+         * mean it tentatively matches the NotPrincipal, or does it mean it does not match the NotPrincipal?
+         *
+         * We need to test this.
+         */
+        // Invert the match result for NotPrincipal
+        if (analysis.explain.matches === 'Match' ||
+            analysis.explain.matches === 'AccountLevelMatch' ||
+            analysis.explain.matches === 'SessionRoleMatch' ||
+            analysis.explain.matches === 'SessionUserMatch') {
+            analysis.explain.matches = 'NoMatch';
+        }
+        else {
+            analysis.explain.matches = 'Match';
+        }
+        return analysis;
+    });
+    if (analyses.some((exp) => exp.explain.matches === 'NoMatch')) {
+        return {
+            matches: 'NoMatch',
+            explains: analyses.map((a) => a.explain)
+        };
+    }
+    return {
+        matches: 'Match',
+        explains: analyses.map((a) => a.explain)
+    };
+}
+/**
+ * Check to see if a request matches a principal statement
+ *
+ * @param request the request to check
+ * @param principalStatement the principal statement to check the request against
+ * @returns if the request matches the principal statement, and if so, how it matches
+ */
+export function requestMatchesPrincipalStatement(request, principalStatement, simulationParameters, allowOrDeny) {
+    const requestPrincipal = request.principal;
+    if (requestPrincipal.isAnonymous()) {
+        return {
+            explain: {
+                matches: principalStatement.isWildcardPrincipal() ? 'Match' : 'NoMatch',
+                principal: principalStatement.value()
+            }
+        };
+    }
+    assertAuthenticatedRequestPrincipal(requestPrincipal);
+    if (principalStatement.isServicePrincipal()) {
+        if (principalStatement.service() === requestPrincipal.value()) {
+            return {
+                explain: {
+                    matches: 'Match',
+                    principal: principalStatement.value()
+                }
+            };
+        }
+        return {
+            explain: {
+                matches: 'NoMatch',
+                principal: principalStatement.value()
+            }
+        };
+    }
+    if (principalStatement.isCanonicalUserPrincipal()) {
+        if (principalStatement.canonicalUser() === requestPrincipal.value()) {
+            return {
+                explain: {
+                    matches: 'Match',
+                    principal: principalStatement.value()
+                }
+            };
+        }
+        return {
+            explain: {
+                matches: 'NoMatch',
+                principal: principalStatement.value()
+            }
+        };
+    }
+    if (principalStatement.isFederatedPrincipal()) {
+        if (principalStatement.federated() === requestPrincipal.value()) {
+            return {
+                explain: {
+                    matches: 'Match',
+                    principal: principalStatement.value()
+                }
+            };
+        }
+        return {
+            explain: {
+                matches: 'NoMatch',
+                principal: principalStatement.value()
+            }
+        };
+    }
+    if (principalStatement.isWildcardPrincipal()) {
+        return {
+            explain: {
+                matches: 'Match',
+                principal: principalStatement.value()
+            }
+        };
+    }
+    if (principalStatement.isAccountPrincipal()) {
+        if (principalStatement.accountId() === requestPrincipal.accountId()) {
+            return {
+                explain: {
+                    matches: 'AccountLevelMatch',
+                    principal: principalStatement.value()
+                }
+            };
+        }
+        return {
+            explain: {
+                matches: 'NoMatch',
+                principal: principalStatement.value()
+            }
+        };
+    }
+    if (principalStatement.isAwsPrincipal()) {
+        if (isAssumedRoleArn(requestPrincipal.value())) {
+            const sessionArn = requestPrincipal.value();
+            if (roleArnMatchesAssumedRoleSession(principalStatement.arn(), sessionArn)) {
+                return {
+                    explain: {
+                        matches: 'SessionRoleMatch',
+                        principal: principalStatement.value(),
+                        roleForSessionArn: principalStatement.arn()
+                    }
+                };
+            }
+        }
+        else if (isFederatedUserArn(requestPrincipal.value())) {
+            const sessionArn = requestPrincipal.value();
+            const userArn = userArnFromFederatedUserArn(sessionArn);
+            if (principalStatement.arn() === userArn) {
+                return {
+                    explain: {
+                        matches: 'SessionUserMatch',
+                        principal: principalStatement.value(),
+                        userForSessionArn: userArn
+                    }
+                };
+            }
+        }
+        if (principalStatement.arn() === requestPrincipal.value()) {
+            return {
+                explain: {
+                    matches: 'Match',
+                    principal: principalStatement.value()
+                }
+            };
+        }
+        /*
+          If:
+            - The simulation mode is Discovery
+            - The principal in the statement is an assumed role ARN
+            - The principal in the request is a Role or assumed role ARN
+            - The base role ARN of the principal in the request matches the base role ARN in the statement
+          Then:
+            - Return a Match for the principal if Allow, or NoMatch if Deny
+            - Indicate that the role session name was ignored for evaluation purposes
+        */
+        if (simulationParameters.simulationMode === 'Discovery' &&
+            isAssumedRoleArn(principalStatement.arn())) {
+            const requestRoleArn = requestPrincipal.value();
+            let roleMatchesSession = false;
+            if (isIamRoleArn(requestRoleArn)) {
+                roleMatchesSession = roleArnMatchesAssumedRoleSession(requestRoleArn, principalStatement.arn());
+            }
+            else if (isAssumedRoleArn(requestRoleArn)) {
+                const principalRoleArn = convertAssumedRoleArnToRoleArn(principalStatement.arn());
+                roleMatchesSession = principalRoleArn === convertAssumedRoleArnToRoleArn(requestRoleArn);
+            }
+            if (roleMatchesSession) {
+                const discoveryMatch = allowOrDeny === 'Allow' ? 'Match' : 'NoMatch';
+                return {
+                    explain: {
+                        matches: discoveryMatch,
+                        principal: principalStatement.value()
+                    },
+                    ignoredRoleSessionName: true // This is a role session match with the session name ignored
+                };
+            }
+        }
+    }
+    return {
+        explain: {
+            matches: 'NoMatch',
+            principal: principalStatement.value()
+        }
+    };
+}
+/**
+ * Get a user ARN from a federated user ARN
+ *
+ * @param federatedUserArn the federated user ARN
+ * @returns the user ARN for the federated user ARN
+ */
+export function userArnFromFederatedUserArn(federatedUserArn) {
+    const stsParts = federatedUserArn.split(':');
+    const resource = stsParts.at(-1);
+    const username = resource.slice(resource.indexOf('/') + 1);
+    return `arn:${stsParts[1]}:iam::${stsParts[4]}:user/${username}`;
+}
+/**
+ * Get the final segment from a slash-delimited path.
+ *
+ * @param path the slash-delimited path to inspect
+ * @returns the final path segment, or undefined if the path is undefined or empty
+ */
+function lastPathSegment(path) {
+    if (!path) {
+        return undefined;
+    }
+    const lastSlashIndex = path.lastIndexOf('/');
+    if (lastSlashIndex === -1) {
+        return path;
+    }
+    return path.slice(lastSlashIndex + 1);
+}
+/**
+ * Get the first segment from a slash-delimited path.
+ *
+ * @param path the slash-delimited path to inspect
+ * @returns the first path segment, or undefined if the path is undefined, empty, or has no slash
+ */
+function firstPathSegment(path) {
+    if (!path) {
+        return undefined;
+    }
+    const firstSlashIndex = path.indexOf('/');
+    if (firstSlashIndex === -1) {
+        return undefined;
+    }
+    return path.slice(0, firstSlashIndex);
+}
+/**
+ * Check whether an IAM role ARN represents the role for an assumed-role session ARN.
+ *
+ * @param roleArn the IAM role ARN to compare
+ * @param sessionArn the assumed-role session ARN to compare
+ * @returns true if the role ARN and session ARN have the same partition, account, and role name
+ */
+function roleArnMatchesAssumedRoleSession(roleArn, sessionArn) {
+    if (!isIamRoleArn(roleArn) || !isAssumedRoleArn(sessionArn)) {
+        return false;
+    }
+    const roleArnParts = splitArnParts(roleArn);
+    const sessionArnParts = splitArnParts(sessionArn);
+    if (roleArnParts.partition !== sessionArnParts.partition ||
+        roleArnParts.accountId !== sessionArnParts.accountId) {
+        return false;
+    }
+    const roleName = lastPathSegment(roleArnParts.resourcePath);
+    const sessionRoleName = firstPathSegment(sessionArnParts.resourcePath);
+    if (!roleName || !sessionRoleName) {
+        return false;
+    }
+    return roleName.localeCompare(sessionRoleName, 'en', { sensitivity: 'base' }) === 0;
+}
+/**
+ * Check if a request matches the Resource or NotResource elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @returns true if the request matches the resources in the statement, false otherwise
+ */
+export function requestMatchesStatementPrincipals(request, statement, simulationParameters) {
+    if (statement.isPrincipalStatement()) {
+        const { matches, explains, ignoredRoleSessionName } = requestMatchesPrincipal(request, statement.principals(), simulationParameters, statement.effect());
+        return { matches, details: { principals: explains }, ignoredRoleSessionName };
+    }
+    else if (statement.isNotPrincipalStatement()) {
+        const { matches, explains } = requestMatchesNotPrincipal(request, statement.notPrincipals(), simulationParameters, statement.effect());
+        return { matches, details: { notPrincipals: explains } };
+    }
+    return { matches: 'NoMatch', details: { noPrincipalElement: true } };
+}
+//# sourceMappingURL=principal.js.map

package/dist/esm/principal/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,MAAM,yBAAyB,CAAA;AACxE,OAAO,EACL,8BAA8B,EAC9B,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACd,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAA6B,MAAM,uCAAuC,CAAA;AACjF,OAAO,EAAgD,MAAM,gCAAgC,CAAA;AAC7F,OAAO,EAAmB,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,mCAAmC,EAAE,MAAM,gCAAgC,CAAA;AAsBpF;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAmB,EACnB,SAAsB,EACtB,oBAA0C,EAC1C,WAA6B;IAM7B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE,CACpD,gCAAgC,CAAC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,WAAW,CAAC,CACjG,CAAA;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IACpE,MAAM,sBAAsB,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAE3D,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC9F,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,QAAQ;YACR,sBAAsB;SACvB,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,kBAAkB,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,OAAO,EAAE,kBAAkB;YAC3B,QAAQ;YACR,sBAAsB;SACvB,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,kBAAkB,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,OAAO,EAAE,kBAAkB;YAC3B,QAAQ;YACR,sBAAsB;SACvB,CAAA;IACH,CAAC;IAED,+FAA+F;IAC/F,IACE,oBAAoB,CAAC,cAAc,KAAK,WAAW;QACnD,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,EACvD,CAAC;QACD,iEAAiE;QAEjE,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,QAAQ;YACR,sBAAsB;SACvB,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,mBAAmB,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,mBAAmB;YAC5B,QAAQ;YACR,sBAAsB;SACvB,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,QAAQ;QACR,sBAAsB;KACvB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAmB,EACnB,YAAyB,EACzB,oBAA0C,EAC1C,WAA6B;IAE7B,wHAAwH;IACxH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE;QACvD,MAAM,QAAQ,GAAG,gCAAgC,CAC/C,OAAO,EACP,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,CACZ,CAAA;QACD;;;;;WAKG;QAEH,2CAA2C;QAC3C,IACE,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO;YACpC,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,mBAAmB;YAChD,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,kBAAkB;YAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,kBAAkB,EAC/C,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAA;QACpC,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACzC,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;KACzC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAmB,EACnB,kBAA6B,EAC7B,oBAA0C,EAC1C,WAA6B;IAE7B,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAA;IAC1C,IAAI,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE;gBACP,OAAO,EAAE,kBAAkB,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvE,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;aACtC;SACF,CAAA;IACH,CAAC;IACD,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;IAErD,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC5C,IAAI,kBAAkB,CAAC,OAAO,EAAE,KAAK,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE;oBACP,OAAO,EAAE,OAAO;oBAChB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;iBACtC;aACF,CAAA;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;aACtC;SACF,CAAA;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAClD,IAAI,kBAAkB,CAAC,aAAa,EAAE,KAAK,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,OAAO,EAAE,OAAO;oBAChB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;iBACtC;aACF,CAAA;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;aACtC;SACF,CAAA;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC9C,IAAI,kBAAkB,CAAC,SAAS,EAAE,KAAK,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC;YAChE,OAAO;gBACL,OAAO,EAAE;oBACP,OAAO,EAAE,OAAO;oBAChB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;iBACtC;aACF,CAAA;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;aACtC;SACF,CAAA;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE;gBACP,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;aACtC;SACF,CAAA;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC5C,IAAI,kBAAkB,CAAC,SAAS,EAAE,KAAK,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;iBACtC;aACF,CAAA;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;aACtC;SACF,CAAA;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,cAAc,EAAE,EAAE,CAAC;QACxC,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAA;YAC3C,IAAI,gCAAgC,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC3E,OAAO;oBACL,OAAO,EAAE;wBACP,OAAO,EAAE,kBAAkB;wBAC3B,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;wBACrC,iBAAiB,EAAE,kBAAkB,CAAC,GAAG,EAAE;qBAC5C;iBACF,CAAA;YACH,CAAC;QACH,CAAC;aAAM,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAA;YAC3C,MAAM,OAAO,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAA;YACvD,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,OAAO,EAAE,CAAC;gBACzC,OAAO;oBACL,OAAO,EAAE;wBACP,OAAO,EAAE,kBAAkB;wBAC3B,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;wBACrC,iBAAiB,EAAE,OAAO;qBAC3B;iBACF,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE;oBACP,OAAO,EAAE,OAAO;oBAChB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;iBACtC;aACF,CAAA;QACH,CAAC;QAED;;;;;;;;;UASE;QACF,IACE,oBAAoB,CAAC,cAAc,KAAK,WAAW;YACnD,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,EAC1C,CAAC;YACD,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAA;YAC/C,IAAI,kBAAkB,GAAG,KAAK,CAAA;YAC9B,IAAI,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjC,kBAAkB,GAAG,gCAAgC,CACnD,cAAc,EACd,kBAAkB,CAAC,GAAG,EAAE,CACzB,CAAA;YACH,CAAC;iBAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5C,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAA;gBACjF,kBAAkB,GAAG,gBAAgB,KAAK,8BAA8B,CAAC,cAAc,CAAC,CAAA;YAC1F,CAAC;YAED,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,cAAc,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;gBACpE,OAAO;oBACL,OAAO,EAAE;wBACP,OAAO,EAAE,cAAc;wBACvB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;qBACtC;oBACD,sBAAsB,EAAE,IAAI,CAAC,6DAA6D;iBAC3F,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE;SACtC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,gBAAwB;IAClE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,OAAO,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAwB;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5C,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAwB;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,eAAe,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gCAAgC,CAAC,OAAe,EAAE,UAAkB;IAC3E,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACjD,IACE,YAAY,CAAC,SAAS,KAAK,eAAe,CAAC,SAAS;QACpD,YAAY,CAAC,SAAS,KAAK,eAAe,CAAC,SAAS,EACpD,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IAC3D,MAAM,eAAe,GAAG,gBAAgB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,QAAQ,CAAC,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAAmB,EACnB,SAAoB,EACpB,oBAA0C;IAM1C,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,uBAAuB,CAC3E,OAAO,EACP,SAAS,CAAC,UAAU,EAAE,EACtB,oBAAoB,EACpB,SAAS,CAAC,MAAM,EAAsB,CACvC,CAAA;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,sBAAsB,EAAE,CAAA;IAC/E,CAAC;SAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,0BAA0B,CACtD,OAAO,EACP,SAAS,CAAC,aAAa,EAAE,EACzB,oBAAoB,EACpB,SAAS,CAAC,MAAM,EAAsB,CACvC,CAAA;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAA;IAC1D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAA;AACtE,CAAC"}

package/dist/esm/request/request.d.ts

@@ -0,0 +1,66 @@
+import { type ContextKey, type RequestContext } from '../requestContext.js';
+import { type SimulationRequestPrincipal } from '../simulation_engine/simulation.js';
+import { type RequestAction } from './requestAction.js';
+import { type RequestPrincipal } from './requestPrincipal.js';
+import { type RequestResource } from './requestResource.js';
+/**
+ * A request to be evaluated by the policy engine
+ */
+export interface AwsRequest {
+    principal: RequestPrincipal;
+    /**
+     * The action to be performed
+     */
+    action: RequestAction;
+    /**
+     * The resource to be acted upon
+     */
+    resource: RequestResource;
+    /**
+     * Whether the action is a wildcard-only action, meaning it does not support
+     * resource-level permissions and must use "*" as the resource. When true,
+     * only a literal "*" policy resource will match a "*" request resource;
+     * specific ARNs in the policy will not match.
+     */
+    wildcardOnlyAction: boolean;
+    /**
+     * The context of the request
+     */
+    context: RequestContext;
+    /**
+     * Checks to see if a context key is valid for the request and
+     * exists in the context
+     *
+     * @param key the key to check for existence
+     * @returns true if the key is valid for the request and exists in the request context.
+     */
+    contextKeyExists(key: string): boolean;
+    /**
+     * Gets the value of a context key, if it is valid for the request and exist, otherwise throws an error
+     * @param key the key to get the value of
+     *
+     * @returns the value of the context key
+     */
+    getContextKeyValue(key: string): ContextKey;
+}
+export declare class AwsRequestImpl implements AwsRequest {
+    readonly principalInput: SimulationRequestPrincipal;
+    readonly resourceIdentifier: {
+        resource: string;
+        accountId: string;
+    };
+    readonly actionString: string;
+    readonly context: RequestContext;
+    readonly wildcardOnlyAction: boolean;
+    private readonly requestPrincipal;
+    constructor(principalInput: SimulationRequestPrincipal, resourceIdentifier: {
+        resource: string;
+        accountId: string;
+    }, actionString: string, context: RequestContext, wildcardOnlyAction?: boolean);
+    get action(): RequestAction;
+    get resource(): RequestResource;
+    get principal(): RequestPrincipal;
+    contextKeyExists(key: string): boolean;
+    getContextKeyValue(key: string): ContextKey;
+}
+//# sourceMappingURL=request.d.ts.map

package/dist/esm/request/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/request/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,KAAK,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpF,OAAO,EAAE,KAAK,aAAa,EAAqB,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxF,OAAO,EAAE,KAAK,eAAe,EAAuB,MAAM,sBAAsB,CAAA;AAEhF;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,gBAAgB,CAAA;IAE3B;;OAEG;IACH,MAAM,EAAE,aAAa,CAAA;IAErB;;OAEG;IACH,QAAQ,EAAE,eAAe,CAAA;IAEzB;;;;;OAKG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAE3B;;OAEG;IACH,OAAO,EAAE,cAAc,CAAA;IAEvB;;;;;;OAMG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAEtC;;;;;OAKG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAC5C;AAED,qBAAa,cAAe,YAAW,UAAU;aAK7B,cAAc,EAAE,0BAA0B;aAC1C,kBAAkB,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;aAC3D,YAAY,EAAE,MAAM;aACpB,OAAO,EAAE,cAAc;IAPzC,SAAgB,kBAAkB,EAAE,OAAO,CAAA;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;gBAGjC,cAAc,EAAE,0BAA0B,EAC1C,kBAAkB,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAC3D,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,EACvC,kBAAkB,CAAC,EAAE,OAAO;IAM9B,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,IAAI,QAAQ,IAAI,eAAe,CAK9B;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAEM,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAItC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;CAMnD"}