@cloud-copilot/iam-lens 0.1.74 → 0.1.76

package/dist/cjs/principalCan/permission.d.ts

@@ -38,15 +38,41 @@ export declare class Permission {
     intersection(other: Permission): Permission | undefined;
     /**
      * Subtract a Deny permission from this Allow permission.
-     * Returns an array of resulting Allow permissions (may be empty if fully denied).
+     *
+     * Returns the resulting permissions, this can be:
+     * - An empty array if the Allow is fully denied by the Deny
+     * - A modified Allow permission or multiple Allow permissions
+     * - It could also return the original Allow and Deny permission if subtraction cannot be expressed purely in Allow statements
+     *
+     * @param other the Deny permission to subtract
      */
     subtract(other: Permission): Permission[];
-    /**
-     * Handle subtraction when the Deny permission has multiple conditions.
-     * Creates separate Allow permissions for each inverted condition.
-     */
-    private subtractWithMultipleConditions;
 }
+/**
+ * Attempt to union two sets of permission conditions.
+ *
+ * If the conditions can be merged into a single block that allows all cases allowed by either,
+ * returns the merged conditions. If they cannot be merged cleanly (e.g., differing operators
+ * or incompatible numeric boundaries), returns null.
+ *
+ * @param a First set of conditions
+ * @param b Second set of conditions
+ * @returns Merged conditions or null if they cannot be merged
+ */
+export declare function unionConditions(a: Record<string, Record<string, string[]>>, b: Record<string, Record<string, string[]>>): Record<string, Record<string, string[]>> | null;
+/**
+ * Intersect two sets of permission conditions.
+ *
+ * Attempt to find the intersection of two sets of IAM condition clauses. This will
+ * combine condition operators and context keys, retaining only values that satisfy
+ * both sets of conditions. If the intersection is empty or cannot be expressed
+ * cleanly, returns null.
+ *
+ * @param conditionsA First set of conditions
+ * @param conditionsB Second set of conditions
+ * @returns Intersected conditions or null if intersection is empty or cannot be expressed
+ */
+export declare function intersectConditions(a: Record<string, Record<string, string[]>>, b: Record<string, Record<string, string[]>>): Record<string, Record<string, string[]>> | null;
 /**
  * Returns a new PermissionConditions object with all operator and context keys lowercased.
  */
@@ -59,4 +85,22 @@ export declare function normalizeConditionKeys(conds: PermissionConditions): Per
  * @return a new set of inverted conditions
  */
 export declare function invertConditions(conds: Record<string, Record<string, string[]>>): Record<string, Record<string, string[]>>;
+/**
+ * Apply Deny conditions to an Allow permission.
+ *
+ * A Deny permission with conditions (whether multiple operators or multiple keys under one
+ * operator) acts as an AND, meaning the Allow needs to escape ANY one of them (OR when inverted).
+ * Each condition key-value pair is inverted and creates a separate Allow permission.
+ *
+ * It is possible for any given condition to fully deny the Allow, in which case
+ * that condition will produce no resulting Allow permission. The result is an array
+ * of Allow permissions that apply after each Deny condition is applied.
+ *
+ * This may result in multiple Allow permission or an empty array if all are denied.
+ *
+ * @param allow the Allow permission
+ * @param deny the Deny permission
+ * @returns an array of resulting Allow permissions after applying Deny conditions
+ */
+export declare function applyDenyConditionsToAllow(allow: Permission, deny: Permission): Permission[];
 //# sourceMappingURL=permission.d.ts.map

package/dist/cjs/principalCan/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../../src/principalCan/permission.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAA;AAE/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;AAU3E;;;;;;GAMG;AACH,qBAAa,UAAU;aAEH,MAAM,EAAE,gBAAgB;aACxB,OAAO,EAAE,MAAM;aACf,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS;aAC9B,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS;aACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS;gBALhE,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,EACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS;IASlF;;;OAGG;IACI,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;IAyH3C;;;;;OAKG;IACI,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE;IAiE7C;;;;;;;OAOG;IACI,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS;IAkL9D;;;OAGG;IACI,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE;IA+YhD;;;OAGG;IACH,OAAO,CAAC,8BAA8B;CAqFvC;AAmKD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAWxF;AA+BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAqB1C"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../../src/principalCan/permission.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAA;AAE/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;AAU3E;;;;;;GAMG;AACH,qBAAa,UAAU;aAEH,MAAM,EAAE,gBAAgB;aACxB,OAAO,EAAE,MAAM;aACf,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS;aAC9B,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS;aACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS;gBALhE,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,EACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS;IASlF;;;OAGG;IACI,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;IAyH3C;;;;;OAKG;IACI,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE;IAiE7C;;;;;;;OAOG;IACI,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS;IAkL9D;;;;;;;;;OASG;IACI,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE;CAyZjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAC3C,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAmHjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAC3C,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CA0DjD;AAkID;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAWxF;AA+BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAqB1C;AAqCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,EAAE,CAiC5F"}