@actsecurity/iam-simulate 0.1.173

package/dist/esm/request/request.js

@@ -0,0 +1,34 @@
+import {} from '../requestContext.js';
+import {} from '../simulation_engine/simulation.js';
+import { RequestActionImpl } from './requestAction.js';
+import { requestPrincipalFromInput } from './requestPrincipal.js';
+import { ResourceRequestImpl } from './requestResource.js';
+export class AwsRequestImpl {
+    constructor(principalInput, resourceIdentifier, actionString, context, wildcardOnlyAction) {
+        this.principalInput = principalInput;
+        this.resourceIdentifier = resourceIdentifier;
+        this.actionString = actionString;
+        this.context = context;
+        this.wildcardOnlyAction = wildcardOnlyAction ?? false;
+        this.requestPrincipal = requestPrincipalFromInput(this.principalInput);
+    }
+    get action() {
+        return new RequestActionImpl(this.actionString);
+    }
+    get resource() {
+        return new ResourceRequestImpl(this.resourceIdentifier.resource, this.resourceIdentifier.accountId);
+    }
+    get principal() {
+        return this.requestPrincipal;
+    }
+    contextKeyExists(key) {
+        return this.context.contextKeyExists(key);
+    }
+    getContextKeyValue(key) {
+        if (!this.contextKeyExists(key)) {
+            throw new Error(`Invalid context key: ${key}`);
+        }
+        return this.context.contextKeyValue(key);
+    }
+}
+//# sourceMappingURL=request.js.map

package/dist/esm/request/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/request/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAmC,MAAM,oCAAoC,CAAA;AACpF,OAAO,EAAsB,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAAE,yBAAyB,EAAyB,MAAM,uBAAuB,CAAA;AACxF,OAAO,EAAwB,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAiDhF,MAAM,OAAO,cAAc;IAIzB,YACkB,cAA0C,EAC1C,kBAA2D,EAC3D,YAAoB,EACpB,OAAuB,EACvC,kBAA4B;QAJZ,mBAAc,GAAd,cAAc,CAA4B;QAC1C,uBAAkB,GAAlB,kBAAkB,CAAyC;QAC3D,iBAAY,GAAZ,YAAY,CAAQ;QACpB,YAAO,GAAP,OAAO,CAAgB;QAGvC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,IAAI,KAAK,CAAA;QACrD,IAAI,CAAC,gBAAgB,GAAG,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACjD,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,mBAAmB,CAC5B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAChC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAClC,CAAA;IACH,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAEM,gBAAgB,CAAC,GAAW;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC3C,CAAC;IAEM,kBAAkB,CAAC,GAAW;QACnC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;IAC1C,CAAC;CACF"}

package/dist/esm/request/requestAction.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A service action: `"service:Action"`
+ */
+export interface RequestAction {
+    /**
+     * The raw string value of the action
+     */
+    value(): string;
+    /**
+     * The service of the action
+     *
+     * Guaranteed to be lowercase
+     */
+    service(): string;
+    /**
+     * The action within the service
+     */
+    action(): string;
+}
+export declare class RequestActionImpl implements RequestAction {
+    private readonly rawValue;
+    constructor(rawValue: string);
+    value(): string;
+    service(): string;
+    action(): string;
+}
+//# sourceMappingURL=requestAction.d.ts.map

package/dist/esm/request/requestAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAction.d.ts","sourceRoot":"","sources":["../../../src/request/requestAction.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;;;OAIG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;CACjB;AAED,qBAAa,iBAAkB,YAAW,aAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEtC,KAAK,IAAI,MAAM;IAIf,OAAO,IAAI,MAAM;IAIjB,MAAM,IAAI,MAAM;CAGxB"}

package/dist/esm/request/requestAction.js

@@ -0,0 +1,15 @@
+export class RequestActionImpl {
+    constructor(rawValue) {
+        this.rawValue = rawValue;
+    }
+    value() {
+        return this.rawValue;
+    }
+    service() {
+        return this.rawValue.split(':')[0].toLowerCase();
+    }
+    action() {
+        return this.rawValue.split(':')[1];
+    }
+}
+//# sourceMappingURL=requestAction.js.map

package/dist/esm/request/requestAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAction.js","sourceRoot":"","sources":["../../../src/request/requestAction.ts"],"names":[],"mappings":"AAsBA,MAAM,OAAO,iBAAiB;IAC5B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAE1C,KAAK;QACV,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAEM,OAAO;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAA;IACnD,CAAC;IAEM,MAAM;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACpC,CAAC;CACF"}

package/dist/esm/request/requestPrincipal.d.ts

@@ -0,0 +1,92 @@
+import { type SimulationRequestPrincipal } from '../simulation_engine/simulation.js';
+export type RequestPrincipalKind = 'Authenticated' | 'Anonymous';
+/**
+ * Common request-principal behavior shared by anonymous and authenticated requests.
+ */
+export interface RequestPrincipal {
+    /**
+     * The kind of request principal being simulated.
+     *
+     * @returns the request principal kind.
+     */
+    kind(): RequestPrincipalKind;
+    /**
+     * Whether the request principal represents an unsigned anonymous request.
+     *
+     * @returns true if this is an anonymous request principal.
+     */
+    isAnonymous(): this is AnonymousRequestPrincipal;
+    /**
+     * Whether the request principal is an authenticated principal request
+     */
+    isAuthenticated(): this is AuthenticatedRequestPrincipal;
+}
+/**
+ * An unsigned anonymous request principal.
+ */
+export interface AnonymousRequestPrincipal extends RequestPrincipal {
+    kind(): 'Anonymous';
+}
+/**
+ * An authenticated request principal represented by a concrete principal string.
+ */
+export interface AuthenticatedRequestPrincipal extends RequestPrincipal {
+    kind(): 'Authenticated';
+    /**
+     * The raw string of the authenticated principal.
+     *
+     * @returns the principal string.
+     */
+    value(): string;
+    /**
+     * The account id of the principal, if the principal is an ARN that has an account ID, otherwise undefined.
+     *
+     * @returns the principal account ID, if available.
+     */
+    accountId(): string | undefined;
+}
+/**
+ * Checks whether a request principal is authenticated.
+ *
+ * @param principal the request principal to check.
+ * @returns true if the principal is authenticated and can expose an account ID and value.
+ */
+/**
+ * Asserts that a request principal is authenticated.
+ *
+ * @param principal the request principal to assert.
+ */
+export declare function assertAuthenticatedRequestPrincipal(principal: RequestPrincipal): asserts principal is AuthenticatedRequestPrincipal;
+/**
+ * Creates a request-principal implementation from public simulation input.
+ *
+ * @param input the principal input from a simulation request.
+ * @returns a request-principal implementation for the input.
+ */
+export declare function requestPrincipalFromInput(input: SimulationRequestPrincipal): RequestPrincipal;
+/**
+ * A string-valued authenticated request principal.
+ */
+export declare class AuthenticatedRequestPrincipalImpl implements AuthenticatedRequestPrincipal {
+    private readonly rawValue;
+    /**
+     * Create an authenticated request principal.
+     *
+     * @param rawValue the raw principal string.
+     */
+    constructor(rawValue: string);
+    kind(): 'Authenticated';
+    isAnonymous(): this is AnonymousRequestPrincipal;
+    isAuthenticated(): this is AuthenticatedRequestPrincipal;
+    value(): string;
+    accountId(): string | undefined;
+}
+/**
+ * An unsigned anonymous request principal.
+ */
+export declare class AnonymousRequestPrincipalImpl implements AnonymousRequestPrincipal {
+    kind(): 'Anonymous';
+    isAnonymous(): this is AnonymousRequestPrincipal;
+    isAuthenticated(): this is AuthenticatedRequestPrincipal;
+}
+//# sourceMappingURL=requestPrincipal.d.ts.map

package/dist/esm/request/requestPrincipal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestPrincipal.d.ts","sourceRoot":"","sources":["../../../src/request/requestPrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,oCAAoC,CAAA;AAE3C,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,WAAW,CAAA;AAEhE;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,IAAI,IAAI,oBAAoB,CAAA;IAE5B;;;;OAIG;IACH,WAAW,IAAI,IAAI,IAAI,yBAAyB,CAAA;IAEhD;;OAEG;IACH,eAAe,IAAI,IAAI,IAAI,6BAA6B,CAAA;CACzD;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,IAAI,IAAI,WAAW,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,6BAA8B,SAAQ,gBAAgB;IACrE,IAAI,IAAI,eAAe,CAAA;IAEvB;;;;OAIG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;;;OAIG;IACH,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;CAChC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,gBAAgB,GAC1B,OAAO,CAAC,SAAS,IAAI,6BAA6B,CAKpD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,0BAA0B,GAAG,gBAAgB,CAQ7F;AAED;;GAEG;AACH,qBAAa,iCAAkC,YAAW,6BAA6B;IAMzE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IALrC;;;;OAIG;gBAC0B,QAAQ,EAAE,MAAM;IAE7C,IAAI,IAAI,eAAe;IAIvB,WAAW,IAAI,IAAI,IAAI,yBAAyB;IAIhD,eAAe,IAAI,IAAI,IAAI,6BAA6B;IAIjD,KAAK,IAAI,MAAM;IAItB,SAAS,IAAI,MAAM,GAAG,SAAS;CAShC;AAED;;GAEG;AACH,qBAAa,6BAA8B,YAAW,yBAAyB;IAC7E,IAAI,IAAI,WAAW;IAInB,WAAW,IAAI,IAAI,IAAI,yBAAyB;IAIhD,eAAe,IAAI,IAAI,IAAI,6BAA6B;CAGzD"}

package/dist/esm/request/requestPrincipal.js

@@ -0,0 +1,80 @@
+import { isAnonymousRequestPrincipal, isSimulationRequestPrincipal } from '../simulation_engine/simulation.js';
+/**
+ * Checks whether a request principal is authenticated.
+ *
+ * @param principal the request principal to check.
+ * @returns true if the principal is authenticated and can expose an account ID and value.
+ */
+/**
+ * Asserts that a request principal is authenticated.
+ *
+ * @param principal the request principal to assert.
+ */
+export function assertAuthenticatedRequestPrincipal(principal) {
+    if (principal.isAuthenticated()) {
+        return;
+    }
+    throw new Error('invalid.principal');
+}
+/**
+ * Creates a request-principal implementation from public simulation input.
+ *
+ * @param input the principal input from a simulation request.
+ * @returns a request-principal implementation for the input.
+ */
+export function requestPrincipalFromInput(input) {
+    if (!isSimulationRequestPrincipal(input)) {
+        throw new Error('invalid.principal');
+    }
+    if (isAnonymousRequestPrincipal(input)) {
+        return new AnonymousRequestPrincipalImpl();
+    }
+    return new AuthenticatedRequestPrincipalImpl(input);
+}
+/**
+ * A string-valued authenticated request principal.
+ */
+export class AuthenticatedRequestPrincipalImpl {
+    /**
+     * Create an authenticated request principal.
+     *
+     * @param rawValue the raw principal string.
+     */
+    constructor(rawValue) {
+        this.rawValue = rawValue;
+    }
+    kind() {
+        return 'Authenticated';
+    }
+    isAnonymous() {
+        return false;
+    }
+    isAuthenticated() {
+        return true;
+    }
+    value() {
+        return this.rawValue;
+    }
+    accountId() {
+        const arnParts = this.value().split(':');
+        if (arnParts.length < 6 || arnParts[0] !== 'arn') {
+            return undefined;
+        }
+        return arnParts[4] || undefined;
+    }
+}
+/**
+ * An unsigned anonymous request principal.
+ */
+export class AnonymousRequestPrincipalImpl {
+    kind() {
+        return 'Anonymous';
+    }
+    isAnonymous() {
+        return true;
+    }
+    isAuthenticated() {
+        return false;
+    }
+}
+//# sourceMappingURL=requestPrincipal.js.map

package/dist/esm/request/requestPrincipal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestPrincipal.js","sourceRoot":"","sources":["../../../src/request/requestPrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAE7B,MAAM,oCAAoC,CAAA;AAwD3C;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CACjD,SAA2B;IAE3B,IAAI,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;QAChC,OAAM;IACR,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAiC;IACzE,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,6BAA6B,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,IAAI,iCAAiC,CAAC,KAAK,CAAC,CAAA;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,iCAAiC;IAC5C;;;;OAIG;IACH,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,IAAI;QACF,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,WAAW;QACT,OAAO,KAAK,CAAA;IACd,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,SAAS;QACP,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YACjD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;IACjC,CAAC;CAGF;AAED;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACxC,IAAI;QACF,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAA;IACb,CAAC;IAED,eAAe;QACb,OAAO,KAAK,CAAA;IACd,CAAC;CACF"}

package/dist/esm/request/requestResource.d.ts

@@ -0,0 +1,55 @@
+export interface RequestResource {
+    /**
+     * The raw string of the resource
+     */
+    value(): string;
+    /**
+     * The partition of the ARN
+     */
+    partition(): string;
+    /**
+     * The service of the ARN
+     */
+    service(): string;
+    /**
+     * The region of the ARN
+     */
+    region(): string;
+    /**
+     * The account of the ARN
+     */
+    account(): string;
+    /**
+     * The resource of the ARN
+     */
+    resource(): string;
+    /**
+     * The account ID of the resource, independent of what is in the ARN
+     */
+    accountId(): string;
+    /**
+     * Checks if this resource represents all resources (i.e., the wildcard "*")
+     * @returns true if the resource is "*", false otherwise
+     */
+    isAllResources(): boolean;
+    /**
+     * Checks if this resource contains any wildcard characters
+     * @returns true if the resource contains "*", false otherwise
+     */
+    hasWildcards(): boolean;
+}
+export declare class ResourceRequestImpl implements RequestResource {
+    private readonly rawValue;
+    private readonly accountIdString;
+    constructor(rawValue: string, accountIdString: string);
+    partition(): string;
+    service(): string;
+    region(): string;
+    account(): string;
+    resource(): string;
+    value(): string;
+    accountId(): string;
+    isAllResources(): boolean;
+    hasWildcards(): boolean;
+}
+//# sourceMappingURL=requestResource.d.ts.map

package/dist/esm/request/requestResource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestResource.d.ts","sourceRoot":"","sources":["../../../src/request/requestResource.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;IAEnB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;IAEhB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,QAAQ,IAAI,MAAM,CAAA;IAElB;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;IAEnB;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAA;IAEzB;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAA;CACxB;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAEvD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,eAAe;gBADf,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM;IAG1C,SAAS,IAAI,MAAM;IAInB,OAAO,IAAI,MAAM;IAIjB,MAAM,IAAI,MAAM;IAIhB,OAAO,IAAI,MAAM;IAIjB,QAAQ,IAAI,MAAM;IAIlB,KAAK,IAAI,MAAM;IAIf,SAAS,IAAI,MAAM;IAInB,cAAc,IAAI,OAAO;IAIzB,YAAY,IAAI,OAAO;CAGxB"}

package/dist/esm/request/requestResource.js

@@ -0,0 +1,34 @@
+export class ResourceRequestImpl {
+    constructor(rawValue, accountIdString) {
+        this.rawValue = rawValue;
+        this.accountIdString = accountIdString;
+    }
+    partition() {
+        return this.value().split(':').at(1);
+    }
+    service() {
+        return this.value().split(':').at(2);
+    }
+    region() {
+        return this.value().split(':').at(3);
+    }
+    account() {
+        return this.value().split(':').at(4);
+    }
+    resource() {
+        return this.value().split(':').slice(5).join(':');
+    }
+    value() {
+        return this.rawValue;
+    }
+    accountId() {
+        return this.accountIdString;
+    }
+    isAllResources() {
+        return this.value() === '*';
+    }
+    hasWildcards() {
+        return this.value().includes('*');
+    }
+}
+//# sourceMappingURL=requestResource.js.map

package/dist/esm/request/requestResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestResource.js","sourceRoot":"","sources":["../../../src/request/requestResource.ts"],"names":[],"mappings":"AAiDA,MAAM,OAAO,mBAAmB;IAC9B,YACmB,QAAgB,EAChB,eAAuB;QADvB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,oBAAe,GAAf,eAAe,CAAQ;IACvC,CAAC;IAEJ,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAA;IAC7B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;CACF"}

package/dist/esm/requestContext.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The context metadata available in a request
+ */
+export interface RequestContext {
+    /**
+     * Check if a context key exists in a request
+     * @param name the name of the context key to check for, case insensitive
+     * @returns true if the context key exists, false otherwise
+     */
+    contextKeyExists: (name: string) => boolean;
+    /**
+     * Get the value of a context key in a request
+     *
+     * @param name the name of the context key to get the value of, case insensitive
+     * @returns the value of the context key
+     */
+    contextKeyValue: (name: string) => ContextKey;
+}
+/**
+ * A context key in a request
+ */
+export interface ContextKey {
+    /**
+     * The name of the context key
+     */
+    name: string;
+    /**
+     * Check if the context key is a string value
+     */
+    isStringValue(): this is StringContextKey;
+    /**
+     * Check if the context key is an array value
+     */
+    isArrayValue(): this is ArrayContextKey;
+}
+export interface StringContextKey extends ContextKey {
+    /**
+     * The value of the context key if it is a string
+     */
+    value: string;
+}
+export interface ArrayContextKey extends ContextKey {
+    /**
+     * The array of values of the context key if it is an array
+     */
+    values: string[];
+}
+export declare class RequestContextImpl implements RequestContext {
+    private context;
+    constructor(values: Record<string, string | string[]>);
+    contextKeyExists(name: string): boolean;
+    contextKeyValue(name: string): ContextKey;
+}
+export declare class ContextKeyImpl implements ContextKey, StringContextKey, ArrayContextKey {
+    name: string;
+    private _val;
+    constructor(name: string, _val: string | string[]);
+    isStringValue(): this is StringContextKey;
+    isArrayValue(): this is ArrayContextKey;
+    get values(): string[];
+    get value(): string;
+}
+//# sourceMappingURL=requestContext.d.ts.map

package/dist/esm/requestContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.d.ts","sourceRoot":"","sources":["../../src/requestContext.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAE3C;;;;;OAKG;IACH,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,CAAA;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IAEZ;;OAEG;IACH,aAAa,IAAI,IAAI,IAAI,gBAAgB,CAAA;IAEzC;;OAEG;IACH,YAAY,IAAI,IAAI,IAAI,eAAe,CAAA;CACxC;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD;;OAEG;IAEH,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,OAAO,CAAqC;gBAExC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAM9C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIvC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU;CAGjD;AAED,qBAAa,cAAe,YAAW,UAAU,EAAE,gBAAgB,EAAE,eAAe;IAEzE,IAAI,EAAE,MAAM;IACnB,OAAO,CAAC,IAAI;gBADL,IAAI,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAGjC,aAAa,IAAI,IAAI,IAAI,gBAAgB;IAGzC,YAAY,IAAI,IAAI,IAAI,eAAe;IAIvC,IAAI,MAAM,IAAI,MAAM,EAAE,CAKrB;IAED,IAAI,KAAK,IAAI,MAAM,CAKlB;CACF"}

package/dist/esm/requestContext.js

@@ -0,0 +1,39 @@
+export class RequestContextImpl {
+    constructor(values) {
+        this.context = new Map();
+        for (const key in values) {
+            this.context.set(key.toLowerCase(), new ContextKeyImpl(key, values[key]));
+        }
+    }
+    contextKeyExists(name) {
+        return this.context.has(name.toLowerCase());
+    }
+    contextKeyValue(name) {
+        return this.context.get(name.toLowerCase());
+    }
+}
+export class ContextKeyImpl {
+    constructor(name, _val) {
+        this.name = name;
+        this._val = _val;
+    }
+    isStringValue() {
+        return typeof this._val === 'string';
+    }
+    isArrayValue() {
+        return Array.isArray(this._val);
+    }
+    get values() {
+        if (Array.isArray(this._val)) {
+            return this._val;
+        }
+        throw new Error(`ContextKey ${this.name} is not an array`);
+    }
+    get value() {
+        if (typeof this._val === 'string') {
+            return this._val;
+        }
+        throw new Error(`ContextKey ${this.name} is not a string`);
+    }
+}
+//# sourceMappingURL=requestContext.js.map

package/dist/esm/requestContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.js","sourceRoot":"","sources":["../../src/requestContext.ts"],"names":[],"mappings":"AAuDA,MAAM,OAAO,kBAAkB;IAG7B,YAAY,MAAyC;QAF7C,YAAO,GAA4B,IAAI,GAAG,EAAE,CAAA;QAGlD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAEM,gBAAgB,CAAC,IAAY;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7C,CAAC;IAEM,eAAe,CAAC,IAAY;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAe,CAAA;IAC3D,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACzB,YACS,IAAY,EACX,IAAuB;QADxB,SAAI,GAAJ,IAAI,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAmB;IAC9B,CAAC;IAEJ,aAAa;QACX,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAA;IACtC,CAAC;IACD,YAAY;QACV,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IAED,IAAI,MAAM;QACR,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,KAAK;QACP,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAA;IAC5D,CAAC;CACF"}

package/dist/esm/resource/resource.d.ts

@@ -0,0 +1,54 @@
+import { type Resource, type Statement } from '@actsecurity/iam-policy';
+import { type ResourceExplain, type StatementExplain } from '../explain/statementExplain.js';
+import { type PolicyType } from '../policyType.js';
+import { type AwsRequest } from '../request/request.js';
+/**
+ * Check if a request matches the Resource or NotResource elements of a statement.
+ *
+ * @param request the request to check
+ * @param statement the statement to check against
+ * @param policyType the type of policy being evaluated
+ * @returns true if the request matches the resources in the statement, false otherwise
+ */
+export declare function requestMatchesStatementResources(request: AwsRequest, statement: Statement, policyType: PolicyType): {
+    matches: boolean;
+    details: Pick<StatementExplain, 'resources' | 'notResources'>;
+};
+/**
+ * Check if a request matches a set of resources.
+ *
+ * @param request the request to check
+ * @param policyResources the resources to check against
+ * @param resourceType whether this is a Resource or NotResource element
+ * @param effect the effect of the statement
+ * @param policyType the type of policy being evaluated
+ * @returns true if the request matches any of the resources, false otherwise
+ */
+export declare function requestMatchesResources(request: AwsRequest, policyResources: Resource[], resourceType: 'Resource' | 'NotResource', effect: 'Allow' | 'Deny', policyType: PolicyType): {
+    matches: boolean;
+    explains: ResourceExplain[];
+};
+/**
+ * Check if a request matches a NotResource element in a policy.
+ *
+ * @param request the request to check
+ * @param policyResources the resources to check against
+ * @param resourceType whether this is a Resource or NotResource element
+ * @param effect the effect of the statement
+ * @param policyType the type of policy being evaluated
+ * @returns true if the request does not match any of the resources, false otherwise
+ */
+export declare function requestMatchesNotResources(request: AwsRequest, policyResources: Resource[], resourceType: 'Resource' | 'NotResource', effect: 'Allow' | 'Deny', policyType: PolicyType): {
+    matches: boolean;
+    explains: ResourceExplain[];
+};
+/**
+ * Determines if the policy string is equal to, a subset of, a superset of,
+ * or has no overlap with the request string.
+ *
+ * @param policyString the policy string to use
+ * @param requestString the request string to compare to the policy string
+ * @returns 'equal' if the strings are equal, 'subset' if the policy string is a subset of the request string, 'superset' if the policy string is a superset of the request string, 'overlap' if the strings have a non-empty intersection but neither contains the other, or 'none' if there is no overlap
+ */
+export declare function resourcePatternOverlap(policyString: string, requestString: string): 'equal' | 'policy_is_subset' | 'policy_is_superset' | 'overlap' | 'none';
+//# sourceMappingURL=resource.d.ts.map

package/dist/esm/resource/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../src/resource/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACvE,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,gBAAgB,EACtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AA2GvD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,UAAU,GACrB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,cAAc,CAAC,CAAA;CAAE,CA2BrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,QAAQ,EAAE,EAC3B,YAAY,EAAE,UAAU,GAAG,aAAa,EACxC,MAAM,EAAE,OAAO,GAAG,MAAM,EACxB,UAAU,EAAE,UAAU,GACrB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE,CAMnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,QAAQ,EAAE,EAC3B,YAAY,EAAE,UAAU,GAAG,aAAa,EACxC,MAAM,EAAE,OAAO,GAAG,MAAM,EACxB,UAAU,EAAE,UAAU,GACrB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE,CAkBnD;AA+UD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,GAAG,kBAAkB,GAAG,oBAAoB,GAAG,SAAS,GAAG,MAAM,CAmB1E"}