@actsecurity/iam-simulate 0.1.173

package/dist/cjs/analysis/analyzeResults.js

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAllowedByIdentityPolicies = isAllowedByIdentityPolicies;
+exports.getDenialReasons = getDenialReasons;
+exports.getGrantReasons = getGrantReasons;
+/**
+ * Analyze a RequestAnalysis to see if the request was allowed by identity policies.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns true if the request was allowed by identity policies, false otherwise
+ */
+function isAllowedByIdentityPolicies(requestAnalysis) {
+    const identityAnalysis = requestAnalysis.identityAnalysis;
+    if (!identityAnalysis) {
+        return false;
+    }
+    return identityAnalysis.result === 'Allowed';
+}
+/**
+ * Find the policy statements that caused a request to be denied.
+ * Analyzes the RequestAnalysis and returns the specific reasons why the request was denied.
+ *
+ * For an implicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the identifier, if applicable for an Organizational Unit identifier for SCPs.
+ *
+ * For an explicit denial, it returns:
+ * - the policy type (identity, resource, scp, rcp, permission boundary, endpoint policy)
+ * - the policy identifier, if applicable for a managed policy or an SCP
+ * - the statement ID (Sid), if the denying statement has one
+ * - the statement index (1-based) of the denying statement
+ *
+ * @param requestAnalysis the request analysis
+ * @returns a list of RequestDenial objects describing the reasons for denial
+ */
+function getDenialReasons(requestAnalysis) {
+    const denials = [];
+    const overallResult = requestAnalysis.result;
+    const blockedBy = new Set(requestAnalysis.blockedBy ?? []);
+    addSimplePolicyDenials(requestAnalysis.identityAnalysis, 'identity', overallResult, blockedBy, denials);
+    addSimplePolicyDenials(requestAnalysis.resourceAnalysis, 'resource', overallResult, blockedBy, denials);
+    addOuPolicyDenials(requestAnalysis.scpAnalysis, 'scp', overallResult, blockedBy, denials);
+    addOuPolicyDenials(requestAnalysis.rcpAnalysis, 'rcp', overallResult, blockedBy, denials);
+    addSimplePolicyDenials(requestAnalysis.permissionBoundaryAnalysis, 'pb', overallResult, blockedBy, denials);
+    addSimplePolicyDenials(requestAnalysis.endpointAnalysis, 'vpce', overallResult, blockedBy, denials);
+    return denials;
+}
+/**
+ * Helper for identity-style policies (identity, resource, permissionBoundary, endpoint).
+ * Adds denial reasons from a simple policy analysis.
+ */
+function addSimplePolicyDenials(analysis, policyType, overallResult, blockedBy, denials) {
+    if (!analysis)
+        return;
+    const isBlocking = blockedBy.has(policyType);
+    const blocking = isBlocking ? { blocking: true } : {};
+    if (analysis.result === 'ImplicitlyDenied' &&
+        (isBlocking || overallResult === 'ImplicitlyDenied')) {
+        denials.push({
+            policyType,
+            denialType: 'Implicit',
+            ...blocking
+        });
+    }
+    else if (analysis.result === 'ExplicitlyDenied' &&
+        (isBlocking || overallResult === 'ExplicitlyDenied')) {
+        for (const stmt of analysis.denyStatements) {
+            const sid = stmt.statement.sid();
+            denials.push({
+                policyType,
+                ...blocking,
+                policyIdentifier: stmt.policyId,
+                ...(sid ? { statementId: sid } : {}),
+                statementIndex: stmt.statement.index(),
+                denialType: 'Explicit'
+            });
+        }
+    }
+}
+/**
+ * Helper for OU-based policies (scp, rcp).
+ * Adds denial reasons from an organizational policy analysis.
+ */
+function addOuPolicyDenials(analysis, policyType, overallResult, blockedBy, denials) {
+    if (!analysis)
+        return;
+    const isBlocking = blockedBy.has(policyType);
+    const blocking = isBlocking ? { blocking: true } : {};
+    if (analysis.result === 'ImplicitlyDenied' &&
+        (isBlocking || overallResult === 'ImplicitlyDenied')) {
+        for (const ou of analysis.ouAnalysis) {
+            if (ou.result === 'ImplicitlyDenied') {
+                denials.push({
+                    policyType,
+                    identifier: ou.orgIdentifier,
+                    denialType: 'Implicit',
+                    ...blocking
+                });
+            }
+        }
+    }
+    else if (analysis.result === 'ExplicitlyDenied' &&
+        (isBlocking || overallResult === 'ExplicitlyDenied')) {
+        for (const ou of analysis.ouAnalysis) {
+            if (ou.result === 'ExplicitlyDenied') {
+                for (const stmt of ou.denyStatements) {
+                    const sid = stmt.statement.sid();
+                    denials.push({
+                        policyType,
+                        policyIdentifier: stmt.policyId,
+                        ...(sid ? { statementId: sid } : {}),
+                        statementIndex: stmt.statement.index(),
+                        ...blocking,
+                        denialType: 'Explicit'
+                    });
+                }
+            }
+        }
+    }
+}
+/**
+ * Find the policy statements that granted access for an allowed request.
+ * Analyzes the RequestAnalysis and returns the specific grants that allowed the request.
+ *
+ * @param requestAnalysis the request analysis
+ * @returns a list of RequestGrant objects describing which policies granted access
+ */
+function getGrantReasons(requestAnalysis) {
+    if (requestAnalysis.result !== 'Allowed') {
+        return [];
+    }
+    const grantDetails = [];
+    addSimplePolicyGrants(requestAnalysis.identityAnalysis, 'identity', grantDetails);
+    addSimplePolicyGrants(requestAnalysis.resourceAnalysis, 'resource', grantDetails);
+    addSimplePolicyGrants(requestAnalysis.permissionBoundaryAnalysis, 'pb', grantDetails);
+    addSimplePolicyGrants(requestAnalysis.endpointAnalysis, 'vpce', grantDetails);
+    addOuPolicyGrants(requestAnalysis.scpAnalysis, 'scp', grantDetails);
+    addOuPolicyGrants(requestAnalysis.rcpAnalysis, 'rcp', grantDetails);
+    return grantDetails;
+}
+/**
+ * Helper for simple policy grants (identity, resource, pb, vpce).
+ */
+function addSimplePolicyGrants(analysis, policyType, grants) {
+    if (analysis?.result !== 'Allowed' && analysis?.result !== 'AllowedForAccount')
+        return;
+    for (const stmt of analysis.allowStatements) {
+        const sid = stmt.statement.sid();
+        if (policyType === 'resource') {
+            grants.push({
+                policyType: 'resource',
+                ...(sid ? { statementId: sid } : {}),
+                statementIndex: stmt.statement.index()
+            });
+        }
+        else {
+            grants.push({
+                policyType,
+                policyIdentifier: stmt.policyId,
+                ...(sid ? { statementId: sid } : {}),
+                statementIndex: stmt.statement.index()
+            });
+        }
+    }
+}
+/**
+ * Helper for OU-based policy grants (scp, rcp).
+ */
+function addOuPolicyGrants(analysis, policyType, grants) {
+    if (!analysis)
+        return;
+    for (const ou of analysis.ouAnalysis) {
+        if (ou.result !== 'Allowed')
+            continue;
+        for (const stmt of ou.allowStatements) {
+            const sid = stmt.statement.sid();
+            grants.push({
+                policyType,
+                orgIdentifier: ou.orgIdentifier,
+                policyIdentifier: stmt.policyId,
+                ...(sid ? { statementId: sid } : {}),
+                statementIndex: stmt.statement.index()
+            });
+        }
+    }
+}
+//# sourceMappingURL=analyzeResults.js.map

package/dist/cjs/analysis/analyzeResults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzeResults.js","sourceRoot":"","sources":["../../../src/analysis/analyzeResults.ts"],"names":[],"mappings":";;AAgBA,kEAOC;AAmGD,4CAqCC;AAwGD,0CAeC;AA5QD;;;;;GAKG;AACH,SAAgB,2BAA2B,CAAC,eAAgC;IAC1E,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAA;IACzD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,gBAAgB,CAAC,MAAM,KAAK,SAAS,CAAA;AAC9C,CAAC;AAkFD;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,gBAAgB,CAAC,eAAgC;IAC/D,MAAM,OAAO,GAAoB,EAAE,CAAA;IACnC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAA;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAE1D,sBAAsB,CACpB,eAAe,CAAC,gBAAgB,EAChC,UAAU,EACV,aAAa,EACb,SAAS,EACT,OAAO,CACR,CAAA;IACD,sBAAsB,CACpB,eAAe,CAAC,gBAAgB,EAChC,UAAU,EACV,aAAa,EACb,SAAS,EACT,OAAO,CACR,CAAA;IACD,kBAAkB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACzF,kBAAkB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACzF,sBAAsB,CACpB,eAAe,CAAC,0BAA0B,EAC1C,IAAI,EACJ,aAAa,EACb,SAAS,EACT,OAAO,CACR,CAAA;IACD,sBAAsB,CACpB,eAAe,CAAC,gBAAgB,EAChC,MAAM,EACN,aAAa,EACb,SAAS,EACT,OAAO,CACR,CAAA;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,QAAyD,EACzD,UAA4B,EAC5B,aAA+B,EAC/B,SAA6B,EAC7B,OAAwB;IAExB,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAE9D,IACE,QAAQ,CAAC,MAAM,KAAK,kBAAkB;QACtC,CAAC,UAAU,IAAI,aAAa,KAAK,kBAAkB,CAAC,EACpD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,UAAU;YACV,UAAU,EAAE,UAAU;YACtB,GAAG,QAAQ;SACZ,CAAC,CAAA;IACJ,CAAC;SAAM,IACL,QAAQ,CAAC,MAAM,KAAK,kBAAkB;QACtC,CAAC,UAAU,IAAI,aAAa,KAAK,kBAAkB,CAAC,EACpD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAA;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU;gBACV,GAAG,QAAQ;gBACX,gBAAgB,EAAE,IAAI,CAAC,QAAQ;gBAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;gBACtC,UAAU,EAAE,UAAU;aACvB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,QAA+C,EAC/C,UAA4B,EAC5B,aAA+B,EAC/B,SAA6B,EAC7B,OAAwB;IAExB,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAE9D,IACE,QAAQ,CAAC,MAAM,KAAK,kBAAkB;QACtC,CAAC,UAAU,IAAI,aAAa,KAAK,kBAAkB,CAAC,EACpD,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,EAAE,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC;oBACX,UAAU;oBACV,UAAU,EAAE,EAAE,CAAC,aAAa;oBAC5B,UAAU,EAAE,UAAU;oBACtB,GAAG,QAAQ;iBACZ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IACL,QAAQ,CAAC,MAAM,KAAK,kBAAkB;QACtC,CAAC,UAAU,IAAI,aAAa,KAAK,kBAAkB,CAAC,EACpD,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,EAAE,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;oBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAA;oBAChC,OAAO,CAAC,IAAI,CAAC;wBACX,UAAU;wBACV,gBAAgB,EAAE,IAAI,CAAC,QAAQ;wBAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;wBACtC,GAAG,QAAQ;wBACX,UAAU,EAAE,UAAU;qBACvB,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,eAAgC;IAC9D,IAAI,eAAe,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAmB,EAAE,CAAA;IAEvC,qBAAqB,CAAC,eAAe,CAAC,gBAAgB,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;IACjF,qBAAqB,CAAC,eAAe,CAAC,gBAAgB,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;IACjF,qBAAqB,CAAC,eAAe,CAAC,0BAA0B,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;IACrF,qBAAqB,CAAC,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;IAC7E,iBAAiB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;IACnE,iBAAiB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;IAEnE,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,QAAyD,EACzD,UAAmD,EACnD,MAAsB;IAEtB,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,QAAQ,EAAE,MAAM,KAAK,mBAAmB;QAAE,OAAM;IACtF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAA;QAChC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU,EAAE,UAAU;gBACtB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;aACvC,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU;gBACV,gBAAgB,EAAE,IAAI,CAAC,QAAQ;gBAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;aACvC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,QAA+C,EAC/C,UAAyB,EACzB,MAAsB;IAEtB,IAAI,CAAC,QAAQ;QAAE,OAAM;IACrB,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS;YAAE,SAAQ;QACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAA;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU;gBACV,aAAa,EAAE,EAAE,CAAC,aAAa;gBAC/B,gBAAgB,EAAE,IAAI,CAAC,QAAQ;gBAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;aACvC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cjs/condition/BaseConditionOperator.d.ts

@@ -0,0 +1,13 @@
+import { type ConditionValueExplain } from '../explain/statementExplain.js';
+import { type AwsRequest } from '../request/request.js';
+export interface BaseConditionOperator {
+    name: string;
+    matches: (request: AwsRequest, keyValue: string, policyValues: string[]) => {
+        matches: boolean;
+        explains: ConditionValueExplain[];
+    };
+    allowsVariables: boolean;
+    allowsWildcards: boolean;
+    isNegative: boolean;
+}
+//# sourceMappingURL=BaseConditionOperator.d.ts.map

package/dist/cjs/condition/BaseConditionOperator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseConditionOperator.d.ts","sourceRoot":"","sources":["../../../src/condition/BaseConditionOperator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC3E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEvD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,CACP,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EAAE,KACnB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAA;KAAE,CAAA;IAC5D,eAAe,EAAE,OAAO,CAAA;IACxB,eAAe,EAAE,OAAO,CAAA;IACxB,UAAU,EAAE,OAAO,CAAA;CACpB"}

package/dist/cjs/condition/BaseConditionOperator.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=BaseConditionOperator.js.map

package/dist/cjs/condition/BaseConditionOperator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseConditionOperator.js","sourceRoot":"","sources":["../../../src/condition/BaseConditionOperator.ts"],"names":[],"mappings":""}

package/dist/cjs/condition/arn/ArnEquals.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const ArnEquals: BaseConditionOperator;
+//# sourceMappingURL=ArnEquals.d.ts.map

package/dist/cjs/condition/arn/ArnEquals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArnEquals.d.ts","sourceRoot":"","sources":["../../../../src/condition/arn/ArnEquals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,SAAS,EAAE,qBAMvB,CAAA"}

package/dist/cjs/condition/arn/ArnEquals.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArnEquals = void 0;
+const ArnLike_js_1 = require("./ArnLike.js");
+exports.ArnEquals = {
+    name: 'ArnEquals',
+    matches: ArnLike_js_1.ArnLike.matches,
+    allowsVariables: ArnLike_js_1.ArnLike.allowsVariables,
+    allowsWildcards: ArnLike_js_1.ArnLike.allowsWildcards,
+    isNegative: ArnLike_js_1.ArnLike.isNegative
+};
+//# sourceMappingURL=ArnEquals.js.map

package/dist/cjs/condition/arn/ArnEquals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArnEquals.js","sourceRoot":"","sources":["../../../../src/condition/arn/ArnEquals.ts"],"names":[],"mappings":";;;AACA,6CAAsC;AAEzB,QAAA,SAAS,GAA0B;IAC9C,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,oBAAO,CAAC,OAAO;IACxB,eAAe,EAAE,oBAAO,CAAC,eAAe;IACxC,eAAe,EAAE,oBAAO,CAAC,eAAe;IACxC,UAAU,EAAE,oBAAO,CAAC,UAAU;CAC/B,CAAA"}

package/dist/cjs/condition/arn/ArnLike.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const ArnLike: BaseConditionOperator;
+//# sourceMappingURL=ArnLike.d.ts.map

package/dist/cjs/condition/arn/ArnLike.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArnLike.d.ts","sourceRoot":"","sources":["../../../../src/condition/arn/ArnLike.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,OAAO,EAAE,qBAarB,CAAA"}

package/dist/cjs/condition/arn/ArnLike.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArnLike = void 0;
+const arn_js_1 = require("./arn.js");
+exports.ArnLike = {
+    name: 'ArnLike',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((policyArn) => (0, arn_js_1.arnMatches)(policyArn, keyValue, request, true));
+        return {
+            matches: explains.some((explain) => explain.matches),
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: true,
+    isNegative: false
+};
+//# sourceMappingURL=ArnLike.js.map

package/dist/cjs/condition/arn/ArnLike.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArnLike.js","sourceRoot":"","sources":["../../../../src/condition/arn/ArnLike.ts"],"names":[],"mappings":";;;AACA,qCAAqC;AAExB,QAAA,OAAO,GAA0B;IAC5C,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,mBAAU,EAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;QAEhG,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YACpD,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,KAAK;CAClB,CAAA"}

package/dist/cjs/condition/arn/ArnNotEquals.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const ArnNotEquals: BaseConditionOperator;
+//# sourceMappingURL=ArnNotEquals.d.ts.map

package/dist/cjs/condition/arn/ArnNotEquals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArnNotEquals.d.ts","sourceRoot":"","sources":["../../../../src/condition/arn/ArnNotEquals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,YAAY,EAAE,qBAM1B,CAAA"}

package/dist/cjs/condition/arn/ArnNotEquals.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArnNotEquals = void 0;
+const ArnNotLike_js_1 = require("./ArnNotLike.js");
+exports.ArnNotEquals = {
+    name: 'ArnNotEquals',
+    matches: ArnNotLike_js_1.ArnNotLike.matches,
+    allowsVariables: ArnNotLike_js_1.ArnNotLike.allowsVariables,
+    allowsWildcards: ArnNotLike_js_1.ArnNotLike.allowsWildcards,
+    isNegative: ArnNotLike_js_1.ArnNotLike.isNegative
+};
+//# sourceMappingURL=ArnNotEquals.js.map

package/dist/cjs/condition/arn/ArnNotEquals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArnNotEquals.js","sourceRoot":"","sources":["../../../../src/condition/arn/ArnNotEquals.ts"],"names":[],"mappings":";;;AACA,mDAA4C;AAE/B,QAAA,YAAY,GAA0B;IACjD,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,0BAAU,CAAC,OAAO;IAC3B,eAAe,EAAE,0BAAU,CAAC,eAAe;IAC3C,eAAe,EAAE,0BAAU,CAAC,eAAe;IAC3C,UAAU,EAAE,0BAAU,CAAC,UAAU;CAClC,CAAA"}

package/dist/cjs/condition/arn/ArnNotLike.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const ArnNotLike: BaseConditionOperator;
+//# sourceMappingURL=ArnNotLike.d.ts.map

package/dist/cjs/condition/arn/ArnNotLike.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArnNotLike.d.ts","sourceRoot":"","sources":["../../../../src/condition/arn/ArnNotLike.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,UAAU,EAAE,qBAexB,CAAA"}

package/dist/cjs/condition/arn/ArnNotLike.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArnNotLike = void 0;
+const arn_js_1 = require("./arn.js");
+exports.ArnNotLike = {
+    name: 'ArnNotLike',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((policyArn) => (0, arn_js_1.arnMatches)(policyArn, keyValue, request, false));
+        return {
+            matches: !explains.some((explain) => !explain.matches),
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: true,
+    isNegative: true
+};
+//# sourceMappingURL=ArnNotLike.js.map

package/dist/cjs/condition/arn/ArnNotLike.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArnNotLike.js","sourceRoot":"","sources":["../../../../src/condition/arn/ArnNotLike.ts"],"names":[],"mappings":";;;AACA,qCAAqC;AAExB,QAAA,UAAU,GAA0B;IAC/C,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC9C,IAAA,mBAAU,EAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAChD,CAAA;QAED,OAAO;YACL,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YACtD,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,IAAI;CACjB,CAAA"}

package/dist/cjs/condition/arn/arn.d.ts

@@ -0,0 +1,12 @@
+import { type ConditionValueExplain } from '../../explain/statementExplain.js';
+import { type AwsRequest } from '../../request/request.js';
+/**
+ * Checks to see if a single ARN matches in ArnLike format
+ *
+ * @param policyArn the ARN to check against
+ * @param requestArn the ARN to check
+ * @param request the request to check
+ * @returns if the ARN matches
+ */
+export declare function arnMatches(policyArn: string, requestArn: string, request: AwsRequest, expectMatch: boolean): ConditionValueExplain;
+//# sourceMappingURL=arn.d.ts.map

package/dist/cjs/condition/arn/arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../../../src/condition/arn/arn.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAG1D;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,OAAO,GACnB,qBAAqB,CAqEvB"}

package/dist/cjs/condition/arn/arn.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.arnMatches = arnMatches;
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const util_js_1 = require("../../util.js");
+/**
+ * Checks to see if a single ARN matches in ArnLike format
+ *
+ * @param policyArn the ARN to check against
+ * @param requestArn the ARN to check
+ * @param request the request to check
+ * @returns if the ARN matches
+ */
+function arnMatches(policyArn, requestArn, request, expectMatch) {
+    const policyParts = (0, iam_utils_1.splitArnParts)(policyArn);
+    const requestParts = (0, iam_utils_1.splitArnParts)(requestArn);
+    // If any of the parts are missing, return false
+    if ((0, util_js_1.isNotDefined)(policyParts.partition) ||
+        (0, util_js_1.isNotDefined)(policyParts.service) ||
+        (0, util_js_1.isNotDefined)(policyParts.region) ||
+        (0, util_js_1.isNotDefined)(policyParts.accountId) ||
+        (0, util_js_1.isNotDefined)(policyParts.resource)) {
+        return {
+            matches: false,
+            value: policyArn,
+            errors: ['Invalid ARN']
+        };
+    }
+    const resolvedPolicyArn = [
+        'arn',
+        policyParts.partition,
+        policyParts.service,
+        policyParts.region,
+        policyParts.accountId,
+        policyParts.resource
+    ]
+        .map((part) => (0, util_js_1.convertIamString)(part, request, { convertToRegex: false, replaceWildcards: false }))
+        .join(':');
+    const resolvedValue = resolvedPolicyArn == policyArn ? undefined : resolvedPolicyArn;
+    // If any of the parts are missing, return false
+    if ((0, util_js_1.isNotDefined)(requestParts.partition) ||
+        (0, util_js_1.isNotDefined)(requestParts.service) ||
+        (0, util_js_1.isNotDefined)(requestParts.region) ||
+        (0, util_js_1.isNotDefined)(requestParts.accountId) ||
+        (0, util_js_1.isNotDefined)(requestParts.resource)) {
+        return {
+            matches: false,
+            value: policyArn,
+            resolvedValue,
+            errors: [`request ARN '${requestArn}' is not a valid ARN`]
+        };
+    }
+    const allErrors = [];
+    const replaceAndMatch = (policyPart, requestPart) => {
+        const { pattern, errors } = (0, util_js_1.convertIamString)(policyPart, request, { replaceWildcards: true });
+        allErrors.push(...(errors || []));
+        return pattern.test(requestPart);
+    };
+    const matches = replaceAndMatch(policyParts.partition, requestParts.partition) &&
+        replaceAndMatch(policyParts.service, requestParts.service) &&
+        replaceAndMatch(policyParts.region, requestParts.region) &&
+        replaceAndMatch(policyParts.accountId, requestParts.accountId) &&
+        replaceAndMatch(policyParts.resource, requestParts.resource);
+    return {
+        matches: matches == expectMatch && allErrors.length == 0,
+        value: policyArn,
+        resolvedValue,
+        errors: allErrors.length > 0 ? allErrors : undefined
+    };
+}
+//# sourceMappingURL=arn.js.map

package/dist/cjs/condition/arn/arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.js","sourceRoot":"","sources":["../../../../src/condition/arn/arn.ts"],"names":[],"mappings":";;AAaA,gCA0EC;AAvFD,sDAAsD;AAGtD,2CAA8D;AAE9D;;;;;;;GAOG;AACH,SAAgB,UAAU,CACxB,SAAiB,EACjB,UAAkB,EAClB,OAAmB,EACnB,WAAoB;IAEpB,MAAM,WAAW,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;IAC5C,MAAM,YAAY,GAAG,IAAA,yBAAa,EAAC,UAAU,CAAC,CAAA;IAC9C,gDAAgD;IAChD,IACE,IAAA,sBAAY,EAAC,WAAW,CAAC,SAAS,CAAC;QACnC,IAAA,sBAAY,EAAC,WAAW,CAAC,OAAO,CAAC;QACjC,IAAA,sBAAY,EAAC,WAAW,CAAC,MAAM,CAAC;QAChC,IAAA,sBAAY,EAAC,WAAW,CAAC,SAAS,CAAC;QACnC,IAAA,sBAAY,EAAC,WAAW,CAAC,QAAQ,CAAC,EAClC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,CAAC,aAAa,CAAC;SACxB,CAAA;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG;QACxB,KAAK;QACL,WAAW,CAAC,SAAS;QACrB,WAAW,CAAC,OAAO;QACnB,WAAW,CAAC,MAAM;QAClB,WAAW,CAAC,SAAS;QACrB,WAAW,CAAC,QAAQ;KACrB;SACE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAA,0BAAgB,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CACpF;SACA,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,MAAM,aAAa,GAAG,iBAAiB,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAA;IAEpF,gDAAgD;IAChD,IACE,IAAA,sBAAY,EAAC,YAAY,CAAC,SAAS,CAAC;QACpC,IAAA,sBAAY,EAAC,YAAY,CAAC,OAAO,CAAC;QAClC,IAAA,sBAAY,EAAC,YAAY,CAAC,MAAM,CAAC;QACjC,IAAA,sBAAY,EAAC,YAAY,CAAC,SAAS,CAAC;QACpC,IAAA,sBAAY,EAAC,YAAY,CAAC,QAAQ,CAAC,EACnC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,SAAS;YAChB,aAAa;YACb,MAAM,EAAE,CAAC,gBAAgB,UAAU,sBAAsB,CAAC;SAC3D,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAE,WAAmB,EAAW,EAAE;QAC3E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,0BAAgB,EAAC,UAAU,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7F,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAA;QACjC,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClC,CAAC,CAAA;IAED,MAAM,OAAO,GACX,eAAe,CAAC,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;QAC9D,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;QAC1D,eAAe,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;QACxD,eAAe,CAAC,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;QAC9D,eAAe,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IAE9D,OAAO;QACL,OAAO,EAAE,OAAO,IAAI,WAAW,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC;QACxD,KAAK,EAAE,SAAS;QAChB,aAAa;QACb,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACrD,CAAA;AACH,CAAC"}

package/dist/cjs/condition/binary/BinaryEquals.d.ts

@@ -0,0 +1,7 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+/**
+ * For Binary we don't really have the ability to accept binary
+ * values right now, so just do a string match.
+ */
+export declare const BinaryEquals: BaseConditionOperator;
+//# sourceMappingURL=BinaryEquals.d.ts.map

package/dist/cjs/condition/binary/BinaryEquals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BinaryEquals.d.ts","sourceRoot":"","sources":["../../../../src/condition/binary/BinaryEquals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,qBAmB1B,CAAA"}

package/dist/cjs/condition/binary/BinaryEquals.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BinaryEquals = void 0;
+const conditionUtil_js_1 = require("../conditionUtil.js");
+/**
+ * For Binary we don't really have the ability to accept binary
+ * values right now, so just do a string match.
+ */
+exports.BinaryEquals = {
+    name: 'BinaryEquals',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((policyValue) => {
+            return {
+                value: policyValue,
+                matches: policyValue === keyValue,
+                resolvedValue: (0, conditionUtil_js_1.resolvedValue)(policyValue, request)
+            };
+        });
+        return {
+            matches: explains.some((explain) => explain.matches),
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: false,
+    isNegative: false
+};
+//# sourceMappingURL=BinaryEquals.js.map

package/dist/cjs/condition/binary/BinaryEquals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BinaryEquals.js","sourceRoot":"","sources":["../../../../src/condition/binary/BinaryEquals.ts"],"names":[],"mappings":";;;AAEA,0DAAmD;AAEnD;;;GAGG;AACU,QAAA,YAAY,GAA0B;IACjD,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;YACzE,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,WAAW,KAAK,QAAQ;gBACjC,aAAa,EAAE,IAAA,gCAAa,EAAC,WAAW,EAAE,OAAO,CAAC;aACnD,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YACpD,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,KAAK;CAClB,CAAA"}

package/dist/cjs/condition/boolean/Bool.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const Bool: BaseConditionOperator;
+//# sourceMappingURL=Bool.d.ts.map

package/dist/cjs/condition/boolean/Bool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bool.d.ts","sourceRoot":"","sources":["../../../../src/condition/boolean/Bool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAExE,eAAO,MAAM,IAAI,EAAE,qBAqDlB,CAAA"}

package/dist/cjs/condition/boolean/Bool.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Bool = void 0;
+const util_js_1 = require("../../util.js");
+exports.Bool = {
+    name: 'Bool',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((policyValue) => {
+            const { pattern, errors } = (0, util_js_1.convertIamString)(policyValue, request, {
+                replaceWildcards: false
+            });
+            if (errors && errors.length > 0) {
+                return {
+                    value: policyValue,
+                    matches: false,
+                    errors
+                };
+            }
+            const resolvedValue = (0, util_js_1.convertIamString)(policyValue, request, {
+                replaceWildcards: false,
+                convertToRegex: false
+            });
+            const lowercaseResolvedValue = resolvedValue.toLowerCase();
+            if (lowercaseResolvedValue != 'true' && lowercaseResolvedValue != 'false') {
+                return {
+                    matches: false,
+                    value: policyValue,
+                    errors: ['Invalid boolean pattern'],
+                    resolvedValue: resolvedValue == policyValue ? undefined : resolvedValue
+                };
+            }
+            if (keyValue.toLowerCase() != 'true' && keyValue.toLowerCase() != 'false') {
+                return {
+                    matches: false,
+                    value: policyValue,
+                    errors: [`request value '${keyValue}' is not a boolean`]
+                };
+            }
+            return {
+                matches: new RegExp(pattern, 'i').test(keyValue),
+                value: policyValue,
+                resolvedValue: resolvedValue == policyValue ? undefined : resolvedValue
+            };
+        });
+        return {
+            matches: explains.some((explain) => explain.matches),
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: false,
+    isNegative: false
+};
+//# sourceMappingURL=Bool.js.map

package/dist/cjs/condition/boolean/Bool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bool.js","sourceRoot":"","sources":["../../../../src/condition/boolean/Bool.ts"],"names":[],"mappings":";;;AACA,2CAAgD;AAGnC,QAAA,IAAI,GAA0B;IACzC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;YACzE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,0BAAgB,EAAC,WAAW,EAAE,OAAO,EAAE;gBACjE,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAA;YACF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,KAAK;oBACd,MAAM;iBACP,CAAA;YACH,CAAC;YAED,MAAM,aAAa,GAAG,IAAA,0BAAgB,EAAC,WAAW,EAAE,OAAO,EAAE;gBAC3D,gBAAgB,EAAE,KAAK;gBACvB,cAAc,EAAE,KAAK;aACtB,CAAC,CAAA;YACF,MAAM,sBAAsB,GAAG,aAAa,CAAC,WAAW,EAAE,CAAA;YAE1D,IAAI,sBAAsB,IAAI,MAAM,IAAI,sBAAsB,IAAI,OAAO,EAAE,CAAC;gBAC1E,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,CAAC,yBAAyB,CAAC;oBACnC,aAAa,EAAE,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;iBACxE,CAAA;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,WAAW,EAAE,IAAI,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC1E,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,CAAC,kBAAkB,QAAQ,oBAAoB,CAAC;iBACzD,CAAA;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAChD,KAAK,EAAE,WAAW;gBAClB,aAAa,EAAE,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;aACxE,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YACpD,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,KAAK;CAClB,CAAA"}

package/dist/cjs/condition/condition.d.ts

@@ -0,0 +1,26 @@
+import { type Condition } from '@actsecurity/iam-policy';
+import { type SimulationParameters } from '../core_engine/CoreSimulatorEngine.js';
+import { type ConditionExplain, type StatementExplain } from '../explain/statementExplain.js';
+import { type AwsRequest } from '../request/request.js';
+export type ConditionMatchResult = 'Match' | 'NoMatch';
+/**
+ * Evaluate a set of conditions against a request
+ *
+ * @param request the request to test
+ * @param conditions the conditions to test
+ * @returns Match if all conditions match, NoMatch if any do not. Also returns all the details of the evaluation
+ */
+export declare function requestMatchesConditions(request: AwsRequest, conditions: Condition[], statementType: 'Allow' | 'Deny', simulationParameters: SimulationParameters): {
+    matches: ConditionMatchResult;
+    details: Pick<StatementExplain, 'conditions'>;
+    ignoredConditions?: Condition[];
+};
+/**
+ * Checks to see if a single condition matches a request
+ *
+ * @param request the request to test
+ * @param condition the condition to test
+ * @returns the result of evaluating the condition
+ */
+export declare function singleConditionMatchesRequest(request: AwsRequest, condition: Condition, simulationParameters: SimulationParameters): ConditionExplain;
+//# sourceMappingURL=condition.d.ts.map

package/dist/cjs/condition/condition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AACjF,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,gBAAgB,EACtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AA8BvD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAA;AA8FtD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,SAAS,EAAE,EACvB,aAAa,EAAE,OAAO,GAAG,MAAM,EAC/B,oBAAoB,EAAE,oBAAoB,GACzC;IACD,OAAO,EAAE,oBAAoB,CAAA;IAC7B,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAA;CAChC,CAgEA;AAsBD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,CAElB"}