@actsecurity/iam-simulate 0.1.200 → 0.1.202

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/cjs/simulation_engine/resourceTypes.d.ts.map +1 -1
  2. package/dist/cjs/simulation_engine/resourceTypes.js +29 -1
  3. package/dist/cjs/simulation_engine/resourceTypes.js.map +1 -1
  4. package/dist/esm/simulation_engine/resourceTypes.d.ts.map +1 -1
  5. package/dist/esm/simulation_engine/resourceTypes.js +29 -1
  6. package/dist/esm/simulation_engine/resourceTypes.js.map +1 -1
  7. package/package.json +1 -1
package/dist/cjs/simulation_engine/resourceTypes.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAGnG;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAiBzB"}
1
+ {"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAOnG;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAoBzB"}
package/dist/cjs/simulation_engine/resourceTypes.js CHANGED
@@ -3,6 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.getResourceTypesForAction = getResourceTypesForAction;
4
4
  const iam_data_1 = require("@actsecurity/iam-data");
5
5
  const iam_utils_1 = require("@actsecurity/iam-utils");
6
+ const resourceWildcardPattern = /[*?]/;
7
+ const qualifiedLambdaFunctionArnPattern = /^arn:[^:]+:lambda:[^:]+:[^:]+:function:[^:]+:([^:]+)$/i;
8
+ const numericQualifierPattern = /^\d+$/;
6
9
  /**
7
10
  * Get the the possible resource types for an action and resource
8
11
  *
@@ -21,6 +24,31 @@ async function getResourceTypesForAction(service, action, resource) {
21
24
  actionResourceTypes.push(await (0, iam_data_1.iamResourceTypeDetails)(service, rt.name));
22
25
  }
23
26
  const matchingPatterns = (0, iam_utils_1.mostSpecificMatchingResourceTypePatterns)(resource, actionResourceTypes.map((resourceType) => resourceType.arn));
24
- return actionResourceTypes.filter((resourceType) => matchingPatterns.includes(resourceType.arn));
27
+ const matchingTypes = actionResourceTypes.filter((resourceType) => matchingPatterns.includes(resourceType.arn));
28
+ return disambiguateLambdaQualifier(service, resource, matchingTypes);
29
+ }
30
+ /**
31
+ * Select the Lambda version or alias for a concrete qualified function ARN.
32
+ * Patterns retain all matching types so each can be evaluated independently.
33
+ *
34
+ * @param service IAM service name
35
+ * @param resource requested resource ARN or pattern
36
+ * @param matchingTypes resource types matched by the action and ARN
37
+ * @returns the matching types, narrowed only for a concrete Lambda qualifier
38
+ */
39
+ function disambiguateLambdaQualifier(service, resource, matchingTypes) {
40
+ if (matchingTypes.length !== 2 ||
41
+ service.toLowerCase() !== 'lambda' ||
42
+ resourceWildcardPattern.test(resource)) {
43
+ return matchingTypes;
44
+ }
45
+ const match = qualifiedLambdaFunctionArnPattern.exec(resource);
46
+ if (!match ||
47
+ !matchingTypes.some((type) => type.key === 'function alias') ||
48
+ !matchingTypes.some((type) => type.key === 'function version')) {
49
+ return matchingTypes;
50
+ }
51
+ const selected = numericQualifierPattern.test(match[1]) ? 'function version' : 'function alias';
52
+ return matchingTypes.filter((type) => type.key !== 'function alias' && type.key !== 'function version' ? true : type.key === selected);
25
53
  }
26
54
  //# sourceMappingURL=resourceTypes.js.map
package/dist/cjs/simulation_engine/resourceTypes.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":";;AAWA,8DAqBC;AAhCD,oDAAmG;AACnG,sDAAiF;AAEjF;;;;;;;GAOG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,MAAc,EACd,QAAgB;IAEhB,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,IAAI,MAAM,mCAAmC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,mBAAmB,GAAmB,EAAE,CAAA;IAC9C,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;QAC7C,mBAAmB,CAAC,IAAI,CAAC,MAAM,IAAA,iCAAsB,EAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAA,oDAAwC,EAC/D,QAAQ,EACR,mBAAmB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAC5D,CAAA;IAED,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;AAClG,CAAC"}
1
+ {"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":";;AAeA,8DAwBC;AAvCD,oDAAmG;AACnG,sDAAiF;AAEjF,MAAM,uBAAuB,GAAG,MAAM,CAAA;AACtC,MAAM,iCAAiC,GAAG,wDAAwD,CAAA;AAClG,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC;;;;;;;GAOG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,MAAc,EACd,QAAgB;IAEhB,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,IAAI,MAAM,mCAAmC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,mBAAmB,GAAmB,EAAE,CAAA;IAC9C,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;QAC7C,mBAAmB,CAAC,IAAI,CAAC,MAAM,IAAA,iCAAsB,EAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAA,oDAAwC,EAC/D,QAAQ,EACR,mBAAmB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAC5D,CAAA;IAED,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAChE,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAC5C,CAAA;IACD,OAAO,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAClC,OAAe,EACf,QAAgB,EAChB,aAA6B;IAE7B,IACE,aAAa,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ;QAClC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACtC,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9D,IACE,CAAC,KAAK;QACN,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,gBAAgB,CAAC;QAC5D,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,kBAAkB,CAAC,EAC9D,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAA;IAC/F,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,IAAI,CAAC,GAAG,KAAK,gBAAgB,IAAI,IAAI,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAChG,CAAA;AACH,CAAC"}
package/dist/esm/simulation_engine/resourceTypes.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAGnG;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAiBzB"}
1
+ {"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAOnG;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAoBzB"}
package/dist/esm/simulation_engine/resourceTypes.js CHANGED
@@ -1,5 +1,8 @@
1
1
  import { iamActionDetails, iamResourceTypeDetails } from '@actsecurity/iam-data';
2
2
  import { mostSpecificMatchingResourceTypePatterns } from '@actsecurity/iam-utils';
3
+ const resourceWildcardPattern = /[*?]/;
4
+ const qualifiedLambdaFunctionArnPattern = /^arn:[^:]+:lambda:[^:]+:[^:]+:function:[^:]+:([^:]+)$/i;
5
+ const numericQualifierPattern = /^\d+$/;
3
6
  /**
4
7
  * Get the the possible resource types for an action and resource
5
8
  *
@@ -18,6 +21,31 @@ export async function getResourceTypesForAction(service, action, resource) {
18
21
  actionResourceTypes.push(await iamResourceTypeDetails(service, rt.name));
19
22
  }
20
23
  const matchingPatterns = mostSpecificMatchingResourceTypePatterns(resource, actionResourceTypes.map((resourceType) => resourceType.arn));
21
- return actionResourceTypes.filter((resourceType) => matchingPatterns.includes(resourceType.arn));
24
+ const matchingTypes = actionResourceTypes.filter((resourceType) => matchingPatterns.includes(resourceType.arn));
25
+ return disambiguateLambdaQualifier(service, resource, matchingTypes);
26
+ }
27
+ /**
28
+ * Select the Lambda version or alias for a concrete qualified function ARN.
29
+ * Patterns retain all matching types so each can be evaluated independently.
30
+ *
31
+ * @param service IAM service name
32
+ * @param resource requested resource ARN or pattern
33
+ * @param matchingTypes resource types matched by the action and ARN
34
+ * @returns the matching types, narrowed only for a concrete Lambda qualifier
35
+ */
36
+ function disambiguateLambdaQualifier(service, resource, matchingTypes) {
37
+ if (matchingTypes.length !== 2 ||
38
+ service.toLowerCase() !== 'lambda' ||
39
+ resourceWildcardPattern.test(resource)) {
40
+ return matchingTypes;
41
+ }
42
+ const match = qualifiedLambdaFunctionArnPattern.exec(resource);
43
+ if (!match ||
44
+ !matchingTypes.some((type) => type.key === 'function alias') ||
45
+ !matchingTypes.some((type) => type.key === 'function version')) {
46
+ return matchingTypes;
47
+ }
48
+ const selected = numericQualifierPattern.test(match[1]) ? 'function version' : 'function alias';
49
+ return matchingTypes.filter((type) => type.key !== 'function alias' && type.key !== 'function version' ? true : type.key === selected);
22
50
  }
23
51
  //# sourceMappingURL=resourceTypes.js.map
package/dist/esm/simulation_engine/resourceTypes.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAqB,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wBAAwB,CAAA;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,MAAc,EACd,QAAgB;IAEhB,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,IAAI,MAAM,mCAAmC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,mBAAmB,GAAmB,EAAE,CAAA;IAC9C,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;QAC7C,mBAAmB,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,gBAAgB,GAAG,wCAAwC,CAC/D,QAAQ,EACR,mBAAmB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAC5D,CAAA;IAED,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;AAClG,CAAC"}
1
+ {"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../../src/simulation_engine/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAqB,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,wCAAwC,EAAE,MAAM,wBAAwB,CAAA;AAEjF,MAAM,uBAAuB,GAAG,MAAM,CAAA;AACtC,MAAM,iCAAiC,GAAG,wDAAwD,CAAA;AAClG,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,MAAc,EACd,QAAgB;IAEhB,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,IAAI,MAAM,mCAAmC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,mBAAmB,GAAmB,EAAE,CAAA;IAC9C,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;QAC7C,mBAAmB,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,gBAAgB,GAAG,wCAAwC,CAC/D,QAAQ,EACR,mBAAmB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAC5D,CAAA;IAED,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAChE,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAC5C,CAAA;IACD,OAAO,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAClC,OAAe,EACf,QAAgB,EAChB,aAA6B;IAE7B,IACE,aAAa,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ;QAClC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACtC,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9D,IACE,CAAC,KAAK;QACN,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,gBAAgB,CAAC;QAC5D,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,kBAAkB,CAAC,EAC9D,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAA;IAC/F,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,IAAI,CAAC,GAAG,KAAK,gBAAgB,IAAI,IAAI,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAChG,CAAA;AACH,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@actsecurity/iam-simulate",
3
- "version": "0.1.200",
3
+ "version": "0.1.202",
4
4
  "description": "Simulate evaluation of AWS IAM policies",
5
5
  "repository": {
6
6
  "type": "git",