@actsecurity/iam-simulate 0.1.173

package/dist/cjs/context_keys/discoveryContextKeyConstraints.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DiscoveryContextKeyConstraints = void 0;
+const unconstrained = {
+    presenceIsKnown: false,
+    valueIsKnown: false,
+    explicitlyConfigured: false
+};
+/**
+ * Discovery-only context key knowledge constraints.
+ *
+ * The request context still determines whether a key is present. These constraints
+ * describe whether Discovery mode can trust that presence and/or concrete value.
+ */
+class DiscoveryContextKeyConstraints {
+    literalConstraints = new Map();
+    prefixConstraintsByService = new Map();
+    regexConstraints = [];
+    resolvedCache = new Map();
+    /**
+     * Create Discovery context key constraints.
+     *
+     * @param constraints the constraint definitions to index
+     */
+    constructor(constraints = []) {
+        for (const constraint of constraints) {
+            const runtimeConstraint = constraint;
+            if (!runtimeConstraint.presenceIsKnown && runtimeConstraint.valueIsKnown) {
+                throw new Error(`Invalid discovery context key constraint for ${runtimeConstraint.keyName}: valueIsKnown requires presenceIsKnown`);
+            }
+            this.addConstraint(constraint);
+        }
+    }
+    /**
+     * Get the effective Discovery constraint for a context key.
+     *
+     * @param key the context key to look up
+     * @returns the merged matching constraint, or an unconstrained result
+     */
+    constraintFor(key) {
+        const lowerKey = key.toLowerCase();
+        const cached = this.resolvedCache.get(lowerKey);
+        if (cached) {
+            return cached;
+        }
+        let result = { ...unconstrained };
+        const merge = (constraint) => {
+            result = effectiveConstraint(result.presenceIsKnown || constraint.presenceIsKnown, result.valueIsKnown || constraint.valueIsKnown, true);
+        };
+        const literal = this.literalConstraints.get(lowerKey);
+        if (literal) {
+            merge(literal);
+        }
+        const service = lowerKey.split(':')[0];
+        const prefixConstraints = this.prefixConstraintsByService.get(service) ?? [];
+        for (const constraint of prefixConstraints) {
+            if (lowerKey.startsWith(constraint.prefixLower)) {
+                merge(constraint);
+            }
+        }
+        for (const constraint of this.regexConstraints) {
+            if (constraint.pattern.test(key)) {
+                merge(constraint);
+            }
+        }
+        this.resolvedCache.set(lowerKey, result);
+        return result;
+    }
+    /**
+     * Adds a caller-provided constraint to the appropriate lookup index.
+     *
+     * Literal keys are stored in a case-insensitive map. Simple prefix-like regex
+     * patterns are stored in prefix buckets, and complex regex patterns fall back
+     * to the regex list.
+     *
+     * @param constraint the caller-provided constraint to index
+     */
+    addConstraint(constraint) {
+        const stored = storedConstraint(constraint.presenceIsKnown, constraint.valueIsKnown);
+        if (constraint.keyName.startsWith('/') && constraint.keyName.endsWith('/')) {
+            const patternText = constraint.keyName.slice(1, -1);
+            const prefix = regexPrefix(patternText);
+            if (prefix) {
+                const service = prefix.split(':')[0];
+                const constraints = this.prefixConstraintsByService.get(service) ?? [];
+                constraints.push({ ...stored, prefixLower: prefix });
+                this.prefixConstraintsByService.set(service, constraints);
+            }
+            else {
+                this.regexConstraints.push({ ...stored, pattern: new RegExp(patternText, 'i') });
+            }
+        }
+        else {
+            const key = constraint.keyName.toLowerCase();
+            const existing = this.literalConstraints.get(key);
+            this.literalConstraints.set(key, existing ? mergeStored(existing, stored) : stored);
+        }
+    }
+}
+exports.DiscoveryContextKeyConstraints = DiscoveryContextKeyConstraints;
+/**
+ * Merges two stored constraints with true-winning OR semantics.
+ *
+ * @param a the first stored constraint
+ * @param b the second stored constraint
+ * @returns the merged constraint
+ */
+function mergeStored(a, b) {
+    return storedConstraint(a.presenceIsKnown || b.presenceIsKnown, a.valueIsKnown || b.valueIsKnown);
+}
+/**
+ * Builds a stored constraint while preserving the valid-state union.
+ *
+ * @param presenceIsKnown whether presence/absence is authoritative
+ * @param valueIsKnown whether the concrete value is authoritative
+ * @returns a stored constraint in one of the valid knowledge states
+ */
+function storedConstraint(presenceIsKnown, valueIsKnown) {
+    if (valueIsKnown) {
+        return { presenceIsKnown: true, valueIsKnown: true };
+    }
+    return presenceIsKnown
+        ? { presenceIsKnown: true, valueIsKnown: false }
+        : { presenceIsKnown: false, valueIsKnown: false };
+}
+/**
+ * Builds an effective constraint while preserving the valid-state union.
+ *
+ * @param presenceIsKnown whether presence/absence is authoritative
+ * @param valueIsKnown whether the concrete value is authoritative
+ * @param explicitlyConfigured whether any configured constraint matched
+ * @returns an effective constraint in one of the valid knowledge states
+ */
+function effectiveConstraint(presenceIsKnown, valueIsKnown, explicitlyConfigured) {
+    return { ...storedConstraint(presenceIsKnown, valueIsKnown), explicitlyConfigured };
+}
+/**
+ * Extracts a lower-case literal prefix from simple anchored regex patterns.
+ *
+ * Only simple patterns such as `^aws:ResourceTag/.*` are converted. More
+ * complex patterns return undefined and are evaluated with RegExp directly.
+ *
+ * @param patternText the regex source without surrounding slashes
+ * @returns a lower-case prefix if the pattern is reducible to startsWith
+ */
+function regexPrefix(patternText) {
+    const match = patternText.match(/^\^([A-Za-z0-9:_/-]+)(?:\.\*|\.\*\?)?\/?$/);
+    if (!match) {
+        return undefined;
+    }
+    return match[1].toLowerCase();
+}
+//# sourceMappingURL=discoveryContextKeyConstraints.js.map

package/dist/cjs/context_keys/discoveryContextKeyConstraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discoveryContextKeyConstraints.js","sourceRoot":"","sources":["../../../src/context_keys/discoveryContextKeyConstraints.ts"],"names":[],"mappings":";;;AAoFA,MAAM,aAAa,GAA2C;IAC5D,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,KAAK;IACnB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAiCD;;;;;GAKG;AACH,MAAa,8BAA8B;IACjC,kBAAkB,GAAkC,IAAI,GAAG,EAAE,CAAA;IAC7D,0BAA0B,GAAoC,IAAI,GAAG,EAAE,CAAA;IACvE,gBAAgB,GAAsB,EAAE,CAAA;IACxC,aAAa,GAAwD,IAAI,GAAG,EAAE,CAAA;IAEtF;;;;OAIG;IACH,YAAY,cAA+C,EAAE;QAC3D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,iBAAiB,GAAG,UAIzB,CAAA;YACD,IAAI,CAAC,iBAAiB,CAAC,eAAe,IAAI,iBAAiB,CAAC,YAAY,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CACb,gDAAgD,iBAAiB,CAAC,OAAO,yCAAyC,CACnH,CAAA;YACH,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,GAAW;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAA;QACf,CAAC;QAED,IAAI,MAAM,GAA2C,EAAE,GAAG,aAAa,EAAE,CAAA;QACzE,MAAM,KAAK,GAAG,CAAC,UAA4B,EAAE,EAAE;YAC7C,MAAM,GAAG,mBAAmB,CAC1B,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,eAAe,EACpD,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,EAC9C,IAAI,CACL,CAAA;QACH,CAAC,CAAA;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,OAAO,CAAC,CAAA;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QAC5E,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,UAAU,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,UAAU,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACxC,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;OAQG;IACK,aAAa,CAAC,UAAyC;QAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,CAAC,CAAA;QAEpF,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;YACvC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpC,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;gBACtE,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;gBACpD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;YAC3D,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACjD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;CACF;AArGD,wEAqGC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,CAAmB,EAAE,CAAmB;IAC3D,OAAO,gBAAgB,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;AACnG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,eAAwB,EAAE,YAAqB;IACvE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IACtD,CAAC;IACD,OAAO,eAAe;QACpB,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;QAChD,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,eAAwB,EACxB,YAAqB,EACrB,oBAA6B;IAE7B,OAAO,EAAE,GAAG,gBAAgB,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AAC/B,CAAC"}

package/dist/cjs/context_keys/findContextKeys.d.ts

@@ -0,0 +1,19 @@
+import { type Policy } from '@actsecurity/iam-policy';
+/**
+ * Find all the context keys in a list of policies
+ *
+ * @param policies - The list of policies to search
+ * @returns The list of valid and invalid context keys found in the policies
+ */
+export declare function findContextKeys(policies: Policy[]): Promise<{
+    validKeys: string[];
+    invalidKeys: string[];
+}>;
+/**
+ * Get the context variables used in a policy
+ *
+ * @param policy - The policy to extract variables from
+ * @returns The list of variables used in the policy
+ */
+export declare function getContextKeysFromPolicy(policy: Policy): string[];
+//# sourceMappingURL=findContextKeys.d.ts.map

package/dist/cjs/context_keys/findContextKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findContextKeys.d.ts","sourceRoot":"","sources":["../../../src/context_keys/findContextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAIrD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAqBzD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBjE"}

package/dist/cjs/context_keys/findContextKeys.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findContextKeys = findContextKeys;
+exports.getContextKeysFromPolicy = getContextKeysFromPolicy;
+const util_js_1 = require("../util.js");
+const contextKeys_js_1 = require("./contextKeys.js");
+/**
+ * Find all the context keys in a list of policies
+ *
+ * @param policies - The list of policies to search
+ * @returns The list of valid and invalid context keys found in the policies
+ */
+async function findContextKeys(policies) {
+    const rawKeys = new Set();
+    for (const policy of policies) {
+        getContextKeysFromPolicy(policy).forEach((v) => rawKeys.add(v));
+    }
+    const validKeys = new Set();
+    const invalidKeys = new Set();
+    for (const key of rawKeys) {
+        const valid = await (0, contextKeys_js_1.isActualContextKey)(key);
+        if (valid) {
+            const normalizedKey = await (0, contextKeys_js_1.normalizeContextKeyCase)(key);
+            validKeys.add(normalizedKey);
+        }
+        else {
+            invalidKeys.add(key);
+        }
+    }
+    return {
+        validKeys: Array.from(validKeys),
+        invalidKeys: Array.from(invalidKeys)
+    };
+}
+/**
+ * Get the context variables used in a policy
+ *
+ * @param policy - The policy to extract variables from
+ * @returns The list of variables used in the policy
+ */
+function getContextKeysFromPolicy(policy) {
+    const variables = [];
+    for (const statement of policy.statements()) {
+        if (statement.isResourceStatement()) {
+            statement.resources().forEach((r) => {
+                variables.push(...(0, util_js_1.getVariablesFromString)(r.value()));
+            });
+            for (const condition of statement.conditions()) {
+                variables.push(condition.conditionKey());
+                condition.conditionValues().forEach((v) => {
+                    variables.push(...(0, util_js_1.getVariablesFromString)(v));
+                });
+            }
+        }
+    }
+    return variables;
+}
+//# sourceMappingURL=findContextKeys.js.map

package/dist/cjs/context_keys/findContextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findContextKeys.js","sourceRoot":"","sources":["../../../src/context_keys/findContextKeys.ts"],"names":[],"mappings":";;AAUA,0CAuBC;AAQD,4DAiBC;AAzDD,wCAAmD;AACnD,qDAA8E;AAE9E;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CACnC,QAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,wBAAwB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,MAAM,IAAA,wCAAuB,EAAC,GAAG,CAAC,CAAA;YACxD,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,MAAc;IACrD,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACpC,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAA,gCAAsB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YACF,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC/C,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAA;gBACxC,SAAS,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;oBACxC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAA,gCAAsB,EAAC,CAAC,CAAC,CAAC,CAAA;gBAC9C,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/cjs/core_engine/CoreSimulatorEngine.d.ts

@@ -0,0 +1,134 @@
+import { type Policy } from '@actsecurity/iam-policy';
+import { DiscoveryContextKeyConstraints } from '../context_keys/discoveryContextKeyConstraints.js';
+import { type IdentityAnalysis, type RcpAnalysis, type RequestAnalysis, type ResourceAnalysis, type ScpAnalysis } from '../evaluate.js';
+import { type PolicyType } from '../policyType.js';
+import { type AwsRequest } from '../request/request.js';
+import { type ServiceAuthorizer, type ServiceSettings } from '../services/ServiceAuthorizer.js';
+export declare const validSimulationModes: readonly ["Strict", "Discovery"];
+export type PolicyWithName = Policy<{
+    name: string;
+}>;
+/**
+ * The mode of simulation for the core engine.
+ * - Strict: Simulates the request as if it were being made in a real AWS environment.
+ * - Discovery: Simulates the request but discovers under what conditions it would be allowed.
+ */
+export type SimulationMode = (typeof validSimulationModes)[number];
+/**
+ * Meta parameters for the simulation engine.
+ */
+export interface SimulationParameters {
+    /**
+     * The simulation mode to use for the request.
+     */
+    simulationMode: SimulationMode;
+    /**
+     * Discovery-only knowledge constraints for context keys. In Strict mode,
+     * all condition keys are evaluated against the concrete request context.
+     */
+    discoveryContextKeyConstraints: DiscoveryContextKeyConstraints;
+}
+/**
+ * A set of service or resource control policies for each level of an organization tree
+ */
+export interface ControlPolicies {
+    /**
+     * The organization identifier for the organizational unit these policies apply to.
+     */
+    orgIdentifier: string;
+    /**
+     * The policies that apply to this organizational unit.
+     */
+    policies: PolicyWithName[];
+}
+/**
+ * A request to authorize a service action.
+ */
+export interface AuthorizationRequest {
+    /**
+     * The request to authorize.
+     */
+    request: AwsRequest;
+    /**
+     * A session policy, if any, for the current Role or Federated User session.
+     */
+    sessionPolicy: PolicyWithName | undefined;
+    /**
+     * The identity policies that are applicable to the principal making the request.
+     */
+    identityPolicies: PolicyWithName[];
+    /**
+     * The service control policies that apply to the principal making the request. In
+     * order of the organization hierarchy. So the root ou SCPs should be first.
+     */
+    serviceControlPolicies: ControlPolicies[];
+    /**
+     * The resource control policies that apply to the resource being accessed. In
+     * order of the organization hierarchy. So the root ou RCPs should be first.
+     */
+    resourceControlPolicies: ControlPolicies[];
+    /**
+     * The resource policy that applies to the resource being accessed.
+     */
+    resourcePolicy: PolicyWithName | undefined;
+    /**
+     * The permission boundaries that apply to the principal making the request.
+     */
+    permissionBoundaries: PolicyWithName[] | undefined;
+    /**
+     * The VPC endpoint policies that apply to the request, if any.
+     */
+    vpcEndpointPolicies: PolicyWithName[] | undefined;
+    /**
+     * The simulation parameters for the request.
+     */
+    simulationParameters: SimulationParameters;
+    /**
+     * Caller-supplied service-specific settings that affect authorization.
+     */
+    serviceSettings?: ServiceSettings;
+}
+/**
+ * Authorizes a request.
+ *
+ * This assumes all policies have been validated and the request is fully complete and valid.
+ *
+ * @param request the request to authorize
+ * @returns the result of the authorization
+ */
+export declare function authorize(request: AuthorizationRequest): RequestAnalysis;
+/**
+ * Get the appropriate service authorizer for the request. Some services have specific authorization logic in
+ * them. If there is no service specific authorizer, a default one will be used.
+ *
+ * @param request the request to get the authorizer for
+ * @returns the service authorizer for the request
+ */
+export declare function getServiceAuthorizer(request: AuthorizationRequest): ServiceAuthorizer;
+/**
+ * Analyzes a set of identity policies
+ *
+ * @param identityPolicies the identity policies to analyze
+ * @param request the request to analyze against
+ * @returns an array of statement analysis results
+ */
+export declare function analyzeIdentityPolicies(identityPolicies: PolicyWithName[], request: AwsRequest, simulationParameters: SimulationParameters, policyType: PolicyType): IdentityAnalysis;
+/**
+ * Analyzes a set of service or resource control policies and the statements within them.
+ *
+ * @param controlPolicies the control policies to analyze
+ * @param request the request to analyze against
+ * @returns an array of SCP or RCP analysis results
+ */
+export declare function analyzeControlPolicies(controlPolicies: ControlPolicies[], request: AwsRequest, simulationParameters: SimulationParameters, policyType: PolicyType): ScpAnalysis | RcpAnalysis;
+/**
+ * Analyze a resource policy and return the results
+ *
+ * @param resourcePolicy the resource policy to analyze
+ * @param request the request to analyze against
+ * @returns an array of statement analysis results
+ */
+export declare function analyzeResourcePolicy(resourcePolicy: PolicyWithName | undefined, request: AwsRequest, principalHasPermissionBoundary: boolean, simulationParameters: SimulationParameters): ResourceAnalysis;
+export declare function analyzePermissionBoundaryPolicies(permissionBoundaries: PolicyWithName[] | undefined, request: AwsRequest, simulationParameters: SimulationParameters): IdentityAnalysis | undefined;
+export declare function analyzeVpcEndpointPolicies(vpcEndPointPolicies: PolicyWithName[] | undefined, request: AwsRequest, simulationParameters: SimulationParameters): IdentityAnalysis | undefined;
+//# sourceMappingURL=CoreSimulatorEngine.d.ts.map

package/dist/cjs/core_engine/CoreSimulatorEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CoreSimulatorEngine.d.ts","sourceRoot":"","sources":["../../../src/core_engine/CoreSimulatorEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAkB,MAAM,yBAAyB,CAAA;AAIrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAA;AAClG,OAAO,EAEL,KAAK,gBAAgB,EAIrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAA;AAMvB,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAKvD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAW/F,eAAO,MAAM,oBAAoB,kCAAmC,CAAA;AAEpE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AAElE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;;OAGG;IACH,8BAA8B,EAAE,8BAA8B,CAAA;CAC/D;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAA;IAEnB;;OAEG;IACH,aAAa,EAAE,cAAc,GAAG,SAAS,CAAA;IAEzC;;OAEG;IACH,gBAAgB,EAAE,cAAc,EAAE,CAAA;IAElC;;;OAGG;IACH,sBAAsB,EAAE,eAAe,EAAE,CAAA;IAEzC;;;OAGG;IACH,uBAAuB,EAAE,eAAe,EAAE,CAAA;IAE1C;;OAEG;IACH,cAAc,EAAE,cAAc,GAAG,SAAS,CAAA;IAE1C;;OAEG;IACH,oBAAoB,EAAE,cAAc,EAAE,GAAG,SAAS,CAAA;IAElD;;OAEG;IACH,mBAAmB,EAAE,cAAc,EAAE,GAAG,SAAS,CAAA;IAEjD;;OAEG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;IAE1C;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AASD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CA0FxE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,CAMrF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,cAAc,EAAE,EAClC,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,EAC1C,UAAU,EAAE,UAAU,GACrB,gBAAgB,CAgFlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,eAAe,EAAE,EAClC,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,EAC1C,UAAU,EAAE,UAAU,GACrB,WAAW,GAAG,WAAW,CAgH3B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,OAAO,EAAE,UAAU,EACnB,8BAA8B,EAAE,OAAO,EACvC,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,CAkIlB;AAED,wBAAgB,iCAAiC,CAC/C,oBAAoB,EAAE,cAAc,EAAE,GAAG,SAAS,EAClD,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,GAAG,SAAS,CAM9B;AAED,wBAAgB,0BAA0B,CACxC,mBAAmB,EAAE,cAAc,EAAE,GAAG,SAAS,EACjD,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,GAAG,SAAS,CAK9B"}