@cloud-copilot/iam-lens 0.1.11 → 0.1.13

package/dist/cjs/canWhat/canWhat.d.ts

@@ -0,0 +1,10 @@
+import { IamCollectClient } from '../collect/client.js';
+export interface CanWhatInput {
+    principal: string;
+    shrinkActionLists: boolean;
+}
+export declare function canWhat(collectClient: IamCollectClient, input: CanWhatInput): Promise<{
+    Version: string;
+    Statement: any[];
+}>;
+//# sourceMappingURL=canWhat.d.ts.map

package/dist/cjs/canWhat/canWhat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canWhat.d.ts","sourceRoot":"","sources":["../../../src/canWhat/canWhat.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AASvD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,wBAAsB,OAAO,CAAC,aAAa,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY;;;GAoEjF"}

package/dist/cjs/canWhat/canWhat.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canWhat = canWhat;
+const iam_policy_1 = require("@cloud-copilot/iam-policy");
+const iam_shrink_1 = require("@cloud-copilot/iam-shrink");
+const principals_js_1 = require("../principals.js");
+const permissionSet_js_1 = require("./permissionSet.js");
+async function canWhat(collectClient, input) {
+    const { principal } = input;
+    if (!principal) {
+        throw new Error('Principal must be provided for can-what command');
+    }
+    const principalPolicies = await (0, principals_js_1.getAllPoliciesForPrincipal)(collectClient, principal);
+    const identityPolicies = [
+        ...principalPolicies.managedPolicies,
+        ...principalPolicies.inlinePolicies,
+        ...(principalPolicies.groupPolicies?.map((group) => group.managedPolicies).flat() || []),
+        ...(principalPolicies.groupPolicies?.map((group) => group.inlinePolicies).flat() || [])
+    ].map((policy) => (0, iam_policy_1.loadPolicy)(policy.policy));
+    const allowedPermissions = await (0, permissionSet_js_1.buildPermissionSetFromPolicies)('Allow', identityPolicies);
+    const identityDenyPermissions = await (0, permissionSet_js_1.buildPermissionSetFromPolicies)('Deny', identityPolicies);
+    let finalPermissions = allowedPermissions;
+    if (principalPolicies.permissionBoundary) {
+        const boundaryPolicy = (0, iam_policy_1.loadPolicy)(principalPolicies.permissionBoundary.policy);
+        const boundaryPermissions = await (0, permissionSet_js_1.buildPermissionSetFromPolicies)('Allow', [boundaryPolicy]);
+        finalPermissions = allowedPermissions.intersection(boundaryPermissions);
+    }
+    const scpAllowsByLevel = [];
+    const rcpAllowsByLevel = [];
+    for (const level of principalPolicies.scps) {
+        const scpPolicies = level.policies.map((scp) => (0, iam_policy_1.loadPolicy)(scp.policy));
+        scpAllowsByLevel.push(await (0, permissionSet_js_1.buildPermissionSetFromPolicies)('Allow', scpPolicies));
+        await (0, permissionSet_js_1.addPoliciesToPermissionSet)(identityDenyPermissions, 'Deny', scpPolicies);
+    }
+    const principalAccountDenyPermissions = identityDenyPermissions.clone();
+    for (const level of principalPolicies.rcps) {
+        const rcpPolicies = level.policies.map((rcp) => (0, iam_policy_1.loadPolicy)(rcp.policy));
+        rcpAllowsByLevel.push(await (0, permissionSet_js_1.buildPermissionSetFromPolicies)('Allow', rcpPolicies));
+        await (0, permissionSet_js_1.addPoliciesToPermissionSet)(principalAccountDenyPermissions, 'Deny', rcpPolicies);
+    }
+    for (const scpAllow of scpAllowsByLevel) {
+        finalPermissions = finalPermissions.intersection(scpAllow);
+    }
+    for (const rcpAllow of rcpAllowsByLevel) {
+        finalPermissions = finalPermissions.intersection(rcpAllow);
+    }
+    const permissionsAfterDeny = finalPermissions.subtract(principalAccountDenyPermissions);
+    finalPermissions = permissionsAfterDeny.allow;
+    const deniedPermissions = permissionsAfterDeny.deny;
+    const allowStatements = (0, permissionSet_js_1.toPolicyStatements)(finalPermissions);
+    const denyStatements = (0, permissionSet_js_1.toPolicyStatements)(deniedPermissions);
+    const policyDocument = {
+        Version: '2012-10-17',
+        Statement: [...allowStatements, ...denyStatements]
+    };
+    if (input.shrinkActionLists) {
+        await (0, iam_shrink_1.shrinkJsonDocument)({ iterations: 0 }, policyDocument);
+    }
+    return policyDocument;
+}
+//# sourceMappingURL=canWhat.js.map

package/dist/cjs/canWhat/canWhat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canWhat.js","sourceRoot":"","sources":["../../../src/canWhat/canWhat.ts"],"names":[],"mappings":";;AAgBA,0BAoEC;AApFD,0DAAsD;AACtD,0DAA8D;AAE9D,oDAA6D;AAC7D,yDAK2B;AAOpB,KAAK,UAAU,OAAO,CAAC,aAA+B,EAAE,KAAmB;IAChF,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAE3B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,IAAA,0CAA0B,EAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAEpF,MAAM,gBAAgB,GAAG;QACvB,GAAG,iBAAiB,CAAC,eAAe;QACpC,GAAG,iBAAiB,CAAC,cAAc;QACnC,GAAG,CAAC,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACxF,GAAG,CAAC,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;KACxF,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAE5C,MAAM,kBAAkB,GAAG,MAAM,IAAA,iDAA8B,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAC1F,MAAM,uBAAuB,GAAG,MAAM,IAAA,iDAA8B,EAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;IAE9F,IAAI,gBAAgB,GAAG,kBAAkB,CAAA;IAEzC,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,IAAA,uBAAU,EAAC,iBAAiB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC9E,MAAM,mBAAmB,GAAG,MAAM,IAAA,iDAA8B,EAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAA;QAC3F,gBAAgB,GAAG,kBAAkB,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,gBAAgB,GAAoB,EAAE,CAAA;IAC5C,MAAM,gBAAgB,GAAoB,EAAE,CAAA;IAE5C,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAA,iDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA;QACjF,MAAM,IAAA,6CAA0B,EAAC,uBAAuB,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,+BAA+B,GAAG,uBAAuB,CAAC,KAAK,EAAE,CAAA;IACvE,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAA,iDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA;QACjF,MAAM,IAAA,6CAA0B,EAAC,+BAA+B,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;IACxF,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,gBAAgB,GAAG,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC5D,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,gBAAgB,GAAG,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAA;IACvF,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAA;IAC7C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,IAAI,CAAA;IAEnD,MAAM,eAAe,GAAG,IAAA,qCAAkB,EAAC,gBAAgB,CAAC,CAAA;IAC5D,MAAM,cAAc,GAAG,IAAA,qCAAkB,EAAC,iBAAiB,CAAC,CAAA;IAE5D,MAAM,cAAc,GAAG;QACrB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC;KACnD,CAAA;IAED,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,IAAA,+BAAkB,EAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,cAAc,CAAA;AACvB,CAAC"}

package/dist/cjs/canWhat/permission.d.ts

@@ -0,0 +1,54 @@
+export type PermissionEffect = 'Allow' | 'Deny';
+export type PermissionConditions = Record<string, Record<string, string[]>>;
+/**
+ * An immutable representation of a single permission for a specific action.
+ *
+ * This will eventually have methods like "merge with another permission",
+ * "check if overlaps with another permission", "subtract a deny permission",
+ * etc and those will all return a new Permission instance.
+ */
+export declare class Permission {
+    readonly effect: PermissionEffect;
+    readonly service: string;
+    readonly action: string;
+    readonly resource: string[] | undefined;
+    readonly notResource: string[] | undefined;
+    readonly conditions: Record<string, Record<string, string[]>> | undefined;
+    constructor(effect: PermissionEffect, service: string, action: string, resource: string[] | undefined, notResource: string[] | undefined, conditions: Record<string, Record<string, string[]>> | undefined);
+    /**
+     * Returns true if this Permission completely includes the other Permission.
+     * Only supports merging of "Allow" permissions (same effect, service, action).
+     */
+    includes(other: Permission): boolean;
+    /**
+     * Returns the union of this Permission with another.
+     * If one includes the other, return the including Permission.
+     * Otherwise, attempt to merge conditions and resource/notResource.
+     * If merge yields a single Permission, return it; else return both.
+     */
+    union(other: Permission): Permission[];
+    /**
+     * Returns the intersection of this Permission with another.
+     * Always returns exactly one Permission. If there is no overlap,
+     * returns undefined.
+     */
+    intersection(other: Permission): Permission | undefined;
+    /**
+     * Subtract a Deny permission from this Allow permission.
+     * Returns an array of resulting Allow permissions (may be empty if fully denied).
+     */
+    subtract(other: Permission): Permission[];
+}
+/**
+ * Returns a new PermissionConditions object with all operator and context keys lowercased.
+ */
+export declare function normalizeConditionKeys(conds: PermissionConditions): PermissionConditions;
+/**
+ * Invert a set of IAM condition clauses for Deny → allow inversion.
+ * Preserves ForAllValues:/ForAnyValue: prefixes and IfExists suffixes.
+ *
+ * @param conds the condition clauses to invert
+ * @return a new set of inverted conditions
+ */
+export declare function invertConditions(conds: Record<string, Record<string, string[]>>): Record<string, Record<string, string[]>>;
+//# sourceMappingURL=permission.d.ts.map

package/dist/cjs/canWhat/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../../src/canWhat/permission.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAA;AAE/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;AAU3E;;;;;;GAMG;AACH,qBAAa,UAAU;aAEH,MAAM,EAAE,gBAAgB;aACxB,OAAO,EAAE,MAAM;aACf,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS;aAC9B,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS;aACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS;gBALhE,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,EACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS;IASlF;;;OAGG;IACI,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;IAyH3C;;;;;OAKG;IACI,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE;IAiE7C;;;;OAIG;IACI,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS;IAkL9D;;;OAGG;IACI,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE;CA6HjD;AAmKD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAWxF;AA+BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAqB1C"}