@actsecurity/iam-simulate 0.1.185 → 0.1.187

package/dist/cjs/services/StsServiceAuthorizer.d.ts

@@ -3,9 +3,15 @@ import { type RequestResource } from '../request/requestResource.js';
 import { DefaultServiceAuthorizer, type PrincipalAccountTrust } from './DefaultServiceAuthorizer.js';
 import { type ServiceAuthorizationRequest } from './ServiceAuthorizer.js';
 /**
- * The default authorizer for services.
+ * Service authorizer for AWS Security Token Service requests.
  */
 export declare class StsServiceAuthorizer extends DefaultServiceAuthorizer {
+    /**
+     * Authorizes an STS request, accounting for STS actions that cannot be called anonymously.
+     *
+     * @param request the service authorization request containing the principal and policy analyses.
+     * @returns the final STS authorization analysis.
+     */
     authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
     /**
      * Determines if the service trusts the principal's Account's IAM policies

package/dist/cjs/services/StsServiceAuthorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAEzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChD,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IAchF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}
+{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA8BhF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}

package/dist/cjs/services/StsServiceAuthorizer.js

@@ -2,20 +2,42 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StsServiceAuthorizer = void 0;
 const DefaultServiceAuthorizer_js_1 = require("./DefaultServiceAuthorizer.js");
+const actionsRequiringAuthenticatedPrincipal = new Set([
+    'sts:assumerole',
+    'sts:getcalleridentity',
+    'sts:getsessiontoken'
+]);
 /**
- * The default authorizer for services.
+ * Service authorizer for AWS Security Token Service requests.
  */
 class StsServiceAuthorizer extends DefaultServiceAuthorizer_js_1.DefaultServiceAuthorizer {
+    /**
+     * Authorizes an STS request, accounting for STS actions that cannot be called anonymously.
+     *
+     * @param request the service authorization request containing the principal and policy analyses.
+     * @returns the final STS authorization analysis.
+     */
     authorize(request) {
-        if (request.request.action.value().toLowerCase() === 'sts:getcalleridentity' &&
-            request.request.principal.isAuthenticated()) {
+        const action = request.request.action.value();
+        const principal = request.request.principal;
+        if (action.localeCompare('sts:getcalleridentity', undefined, { sensitivity: 'accent' }) === 0 &&
+            principal.isAuthenticated()) {
             return {
                 result: 'Allowed',
                 sameAccount: true,
                 conditions: undefined
             };
         }
-        return super.authorize(request);
+        const baseResult = super.authorize(request);
+        if (principal.isAnonymous() &&
+            actionsRequiringAuthenticatedPrincipal.has(action.toLowerCase())) {
+            return {
+                ...baseResult,
+                result: 'ImplicitlyDenied',
+                conditions: undefined
+            };
+        }
+        return baseResult;
     }
     /**
      * Determines if the service trusts the principal's Account's IAM policies

package/dist/cjs/services/StsServiceAuthorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":";;;AAEA,+EAAoG;AAGpG;;GAEG;AACH,MAAa,oBAAqB,SAAQ,sDAAwB;IAChD,SAAS,CAAC,OAAoC;QAC5D,IACE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,uBAAuB;YACxE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,EAC3C,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF;AA5CD,oDA4CC"}
+{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":";;;AAEA,+EAAoG;AAGpG,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAC;IACrD,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;CACtB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAa,oBAAqB,SAAQ,sDAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAoC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAE3C,IACE,MAAM,CAAC,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC;YACzF,SAAS,CAAC,eAAe,EAAE,EAC3B,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3C,IACE,SAAS,CAAC,WAAW,EAAE;YACvB,sCAAsC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAChE,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF;AAlED,oDAkEC"}

package/dist/esm/services/StsServiceAuthorizer.d.ts

@@ -3,9 +3,15 @@ import { type RequestResource } from '../request/requestResource.js';
 import { DefaultServiceAuthorizer, type PrincipalAccountTrust } from './DefaultServiceAuthorizer.js';
 import { type ServiceAuthorizationRequest } from './ServiceAuthorizer.js';
 /**
- * The default authorizer for services.
+ * Service authorizer for AWS Security Token Service requests.
  */
 export declare class StsServiceAuthorizer extends DefaultServiceAuthorizer {
+    /**
+     * Authorizes an STS request, accounting for STS actions that cannot be called anonymously.
+     *
+     * @param request the service authorization request containing the principal and policy analyses.
+     * @returns the final STS authorization analysis.
+     */
     authorize(request: ServiceAuthorizationRequest): RequestAnalysis;
     /**
      * Determines if the service trusts the principal's Account's IAM policies

package/dist/esm/services/StsServiceAuthorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAEzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChD,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IAchF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}
+{"version":3,"file":"StsServiceAuthorizer.d.ts","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAQzE;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,wBAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe;IA8BhF;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAW,EAAE,OAAO,EACpB,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,eAAe,GACxB,qBAAqB;CAkBzB"}

package/dist/esm/services/StsServiceAuthorizer.js

@@ -2,20 +2,42 @@ import {} from '../evaluate.js';
 import {} from '../request/requestResource.js';
 import { DefaultServiceAuthorizer } from './DefaultServiceAuthorizer.js';
 import {} from './ServiceAuthorizer.js';
+const actionsRequiringAuthenticatedPrincipal = new Set([
+    'sts:assumerole',
+    'sts:getcalleridentity',
+    'sts:getsessiontoken'
+]);
 /**
- * The default authorizer for services.
+ * Service authorizer for AWS Security Token Service requests.
  */
 export class StsServiceAuthorizer extends DefaultServiceAuthorizer {
+    /**
+     * Authorizes an STS request, accounting for STS actions that cannot be called anonymously.
+     *
+     * @param request the service authorization request containing the principal and policy analyses.
+     * @returns the final STS authorization analysis.
+     */
     authorize(request) {
-        if (request.request.action.value().toLowerCase() === 'sts:getcalleridentity' &&
-            request.request.principal.isAuthenticated()) {
+        const action = request.request.action.value();
+        const principal = request.request.principal;
+        if (action.localeCompare('sts:getcalleridentity', undefined, { sensitivity: 'accent' }) === 0 &&
+            principal.isAuthenticated()) {
             return {
                 result: 'Allowed',
                 sameAccount: true,
                 conditions: undefined
             };
         }
-        return super.authorize(request);
+        const baseResult = super.authorize(request);
+        if (principal.isAnonymous() &&
+            actionsRequiringAuthenticatedPrincipal.has(action.toLowerCase())) {
+            return {
+                ...baseResult,
+                result: 'ImplicitlyDenied',
+                conditions: undefined
+            };
+        }
+        return baseResult;
     }
     /**
      * Determines if the service trusts the principal's Account's IAM policies

package/dist/esm/services/StsServiceAuthorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAA8B,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAoC,MAAM,wBAAwB,CAAA;AAEzE;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAChD,SAAS,CAAC,OAAoC;QAC5D,IACE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,uBAAuB;YACxE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,EAC3C,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF"}
+{"version":3,"file":"StsServiceAuthorizer.js","sourceRoot":"","sources":["../../../src/services/StsServiceAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAwB,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAA8B,MAAM,+BAA+B,CAAA;AACpG,OAAO,EAAoC,MAAM,wBAAwB,CAAA;AAEzE,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAC;IACrD,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;CACtB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,wBAAwB;IAChE;;;;;OAKG;IACa,SAAS,CAAC,OAAoC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;QAE3C,IACE,MAAM,CAAC,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC;YACzF,SAAS,CAAC,eAAe,EAAE,EAC3B,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3C,IACE,SAAS,CAAC,WAAW,EAAE;YACvB,sCAAsC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAChE,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;;;;OAMG;IACM,6BAA6B,CACpC,WAAoB,EACpB,gBAAkC,EAClC,QAAyB;QAEzB,yFAAyF;QACzF,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAClC,CAAC;QAED;;;;UAIE;QACF,MAAM,sBAAsB,GAAG,IAAI,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAA;QACzF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;QACtE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actsecurity/iam-simulate",
-  "version": "0.1.185",
+  "version": "0.1.187",
   "description": "Simulate evaluation of AWS IAM policies",
   "repository": {
     "type": "git",