@cloud-copilot/iam-lens 0.1.76 → 0.1.78

package/dist/cjs/utils/workerScript.d.ts

@@ -2,7 +2,7 @@
  * Get the path to a worker script, adjusted for the build output location.
  *
  * @param path the relative path to the worker script from the project src directory and with a .js extension
- * @returns the absolute path to the worker script
+ * @returns the absolute path to the worker script, or undefined if the worker script path does not exist
  */
-export declare function getWorkerScriptPath(path: string): string;
+export declare function getWorkerScriptPath(path: string): string | undefined;
 //# sourceMappingURL=workerScript.d.ts.map

package/dist/cjs/utils/workerScript.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workerScript.d.ts","sourceRoot":"","sources":["../../../src/utils/workerScript.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD"}
+{"version":3,"file":"workerScript.d.ts","sourceRoot":"","sources":["../../../src/utils/workerScript.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMpE"}

package/dist/cjs/utils/workerScript.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getWorkerScriptPath = getWorkerScriptPath;
+const fs_1 = require("fs");
 const path_1 = require("path");
 let root = (0, path_1.resolve)(__dirname, '../');
 if (process.env.NODE_ENV === 'test') {
@@ -10,9 +11,13 @@ if (process.env.NODE_ENV === 'test') {
  * Get the path to a worker script, adjusted for the build output location.
  *
  * @param path the relative path to the worker script from the project src directory and with a .js extension
- * @returns the absolute path to the worker script
+ * @returns the absolute path to the worker script, or undefined if the worker script path does not exist
  */
 function getWorkerScriptPath(path) {
-    return (0, path_1.join)(root, path);
+    const fullPath = (0, path_1.join)(root, path);
+    if (!(0, fs_1.existsSync)(fullPath)) {
+        return undefined;
+    }
+    return fullPath;
 }
 //# sourceMappingURL=workerScript.js.map

package/dist/cjs/utils/workerScript.js.map

@@ -1 +1 @@
-{"version":3,"file":"workerScript.js","sourceRoot":"","sources":["../../../src/utils/workerScript.ts"],"names":[],"mappings":";;AAaA,kDAEC;AAfD,+BAAoC;AAEpC,IAAI,IAAI,GAAG,IAAA,cAAO,EAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IACpC,IAAI,GAAG,IAAA,cAAO,EAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAA,WAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACzB,CAAC"}
+{"version":3,"file":"workerScript.js","sourceRoot":"","sources":["../../../src/utils/workerScript.ts"],"names":[],"mappings":";;AAcA,kDAMC;AApBD,2BAA+B;AAC/B,+BAAoC;AAEpC,IAAI,IAAI,GAAG,IAAA,cAAO,EAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IACpC,IAAI,GAAG,IAAA,cAAO,EAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/cjs/whoCan/WhoCanMainThreadWorker.d.ts

@@ -4,7 +4,8 @@ import { S3AbacOverride } from '../utils/s3Abac.js';
 import { ArrayStreamingWorkQueue } from '../workers/ArrayStreamingWorkQueue.js';
 import { PullBasedJobRunner } from '../workers/JobRunner.js';
 import { StreamingWorkQueue } from '../workers/StreamingWorkQueue.js';
-import { WhoCanAllowed } from './whoCan.js';
-import { WhoCanWorkItem } from './WhoCanWorker.js';
-export declare function createMainThreadStreamingWorkQueue(queue: StreamingWorkQueue<WhoCanWorkItem> | ArrayStreamingWorkQueue<WhoCanWorkItem>, collectClient: IamCollectClient, s3AbacOverride: S3AbacOverride | undefined, onComplete: (result: JobResult<WhoCanAllowed | undefined, Record<string, unknown>>) => void): PullBasedJobRunner<WhoCanAllowed | undefined, Record<string, unknown>, WhoCanWorkItem>;
+import { LightRequestAnalysis } from './requestAnalysis.js';
+import { WhoCanAllowed, WhoCanDenyDetail } from './whoCan.js';
+import { WhoCanExecutionResult, WhoCanWorkItem } from './WhoCanWorker.js';
+export declare function createMainThreadStreamingWorkQueue(queue: StreamingWorkQueue<WhoCanWorkItem> | ArrayStreamingWorkQueue<WhoCanWorkItem>, collectClient: IamCollectClient, s3AbacOverride: S3AbacOverride | undefined, onComplete: (result: JobResult<WhoCanAllowed | undefined, Record<string, unknown>>) => void, denyDetailsCallback?: (details: LightRequestAnalysis) => boolean, onDenyDetail?: (detail: WhoCanDenyDetail) => void): PullBasedJobRunner<WhoCanExecutionResult, Record<string, unknown>, WhoCanWorkItem>;
 //# sourceMappingURL=WhoCanMainThreadWorker.d.ts.map

package/dist/cjs/whoCan/WhoCanMainThreadWorker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanMainThreadWorker.d.ts","sourceRoot":"","sources":["../../../src/whoCan/WhoCanMainThreadWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAA8B,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAE9E,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,kBAAkB,CAAC,cAAc,CAAC,GAAG,uBAAuB,CAAC,cAAc,CAAC,EACnF,aAAa,EAAE,gBAAgB,EAC/B,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,aAAa,GAAG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,0FAiB5F"}
+{"version":3,"file":"WhoCanMainThreadWorker.d.ts","sourceRoot":"","sources":["../../../src/whoCan/WhoCanMainThreadWorker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,oBAAoB,EAA0B,MAAM,sBAAsB,CAAA;AACnF,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAE1B,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,kBAAkB,CAAC,cAAc,CAAC,GAAG,uBAAuB,CAAC,cAAc,CAAC,EACnF,aAAa,EAAE,gBAAgB,EAC/B,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,aAAa,GAAG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,EAC3F,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,EAChE,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,sFA6DlD"}

package/dist/cjs/whoCan/WhoCanMainThreadWorker.js

@@ -1,18 +1,63 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMainThreadStreamingWorkQueue = createMainThreadStreamingWorkQueue;
+const iam_simulate_1 = require("@cloud-copilot/iam-simulate");
 const JobRunner_js_1 = require("../workers/JobRunner.js");
+const requestAnalysis_js_1 = require("./requestAnalysis.js");
 const WhoCanWorker_js_1 = require("./WhoCanWorker.js");
-function createMainThreadStreamingWorkQueue(queue, collectClient, s3AbacOverride, onComplete) {
+function createMainThreadStreamingWorkQueue(queue, collectClient, s3AbacOverride, onComplete, denyDetailsCallback, onDenyDetail) {
+    const collectDenyDetails = !!denyDetailsCallback;
     return new JobRunner_js_1.PullBasedJobRunner(50, async () => {
         return queue.dequeue();
     }, (workItem) => {
         return (0, WhoCanWorker_js_1.createJobForWhoCanWorkItem)(workItem, collectClient, {
-            s3AbacOverride
+            s3AbacOverride,
+            collectDenyDetails
         });
     }, async (result) => {
-        // no-op for now, results are handled by the caller of execute
-        return onComplete(result);
+        if (result.status === 'fulfilled') {
+            const executionResult = result.value;
+            if (executionResult.allowed) {
+                // Simulation was allowed - pass through to onComplete
+                onComplete({
+                    status: 'fulfilled',
+                    value: executionResult.allowed,
+                    properties: result.properties
+                });
+            }
+            else {
+                // Simulation was denied
+                onComplete({
+                    status: 'fulfilled',
+                    value: undefined,
+                    properties: result.properties
+                });
+                // Check if we should include deny details
+                if (denyDetailsCallback && onDenyDetail && executionResult.denyAnalysis) {
+                    const lightAnalysis = (0, requestAnalysis_js_1.toLightRequestAnalysis)(executionResult.denyAnalysis);
+                    const shouldInclude = denyDetailsCallback(lightAnalysis);
+                    if (shouldInclude) {
+                        const denialReasons = (0, iam_simulate_1.getDenialReasons)(executionResult.denyAnalysis);
+                        const { workItem } = executionResult;
+                        const [service, action] = workItem.action.split(':');
+                        onDenyDetail({
+                            principal: workItem.principal,
+                            service,
+                            action,
+                            details: denialReasons
+                        });
+                    }
+                }
+            }
+        }
+        else {
+            // Error case - pass through as rejected
+            onComplete({
+                status: 'rejected',
+                reason: result.reason,
+                properties: result.properties
+            });
+        }
     });
 }
 //# sourceMappingURL=WhoCanMainThreadWorker.js.map

package/dist/cjs/whoCan/WhoCanMainThreadWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanMainThreadWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanMainThreadWorker.ts"],"names":[],"mappings":";;AASA,gFAqBC;AA1BD,0DAA4D;AAG5D,uDAA8E;AAE9E,SAAgB,kCAAkC,CAChD,KAAmF,EACnF,aAA+B,EAC/B,cAA0C,EAC1C,UAA2F;IAE3F,OAAO,IAAI,iCAAkB,CAC3B,EAAE,EACF,KAAK,IAAI,EAAE;QACT,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC,EACD,CAAC,QAAQ,EAAE,EAAE;QACX,OAAO,IAAA,4CAA0B,EAAC,QAAQ,EAAE,aAAa,EAAE;YACzD,cAAc;SACf,CAAC,CAAA;IACJ,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,8DAA8D;QAC9D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC,CACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"WhoCanMainThreadWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanMainThreadWorker.ts"],"names":[],"mappings":";;AAeA,gFAmEC;AAlFD,8DAA8D;AAK9D,0DAA4D;AAE5D,6DAAmF;AAEnF,uDAI0B;AAE1B,SAAgB,kCAAkC,CAChD,KAAmF,EACnF,aAA+B,EAC/B,cAA0C,EAC1C,UAA2F,EAC3F,mBAAgE,EAChE,YAAiD;IAEjD,MAAM,kBAAkB,GAAG,CAAC,CAAC,mBAAmB,CAAA;IAEhD,OAAO,IAAI,iCAAkB,CAC3B,EAAE,EACF,KAAK,IAAI,EAAE;QACT,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC,EACD,CAAC,QAAQ,EAAE,EAAE;QACX,OAAO,IAAA,4CAA0B,EAAC,QAAQ,EAAE,aAAa,EAAE;YACzD,cAAc;YACd,kBAAkB;SACnB,CAAC,CAAA;IACJ,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAA;YACpC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC5B,sDAAsD;gBACtD,UAAU,CAAC;oBACT,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,eAAe,CAAC,OAAO;oBAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,wBAAwB;gBACxB,UAAU,CAAC;oBACT,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,SAAS;oBAChB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAA;gBAEF,0CAA0C;gBAC1C,IAAI,mBAAmB,IAAI,YAAY,IAAI,eAAe,CAAC,YAAY,EAAE,CAAC;oBACxE,MAAM,aAAa,GAAG,IAAA,2CAAsB,EAAC,eAAe,CAAC,YAAY,CAAC,CAAA;oBAC1E,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAA;oBAExD,IAAI,aAAa,EAAE,CAAC;wBAClB,MAAM,aAAa,GAAG,IAAA,+BAAgB,EAAC,eAAe,CAAC,YAAY,CAAC,CAAA;wBACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAA;wBACpC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;wBACpD,YAAY,CAAC;4BACX,SAAS,EAAE,QAAQ,CAAC,SAAS;4BAC7B,OAAO;4BACP,MAAM;4BACN,OAAO,EAAE,aAAa;yBACvB,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,UAAU,CAAC;gBACT,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/cjs/whoCan/WhoCanWorker.d.ts

@@ -1,3 +1,4 @@
+import { RequestAnalysis } from '@cloud-copilot/iam-simulate';
 import { Job } from '@cloud-copilot/job';
 import { IamCollectClient } from '../collect/client.js';
 import { S3AbacOverride } from '../utils/s3Abac.js';
@@ -8,9 +9,29 @@ export interface WhoCanWorkItem {
     action: string;
     principal: string;
 }
-export declare function createJobForWhoCanWorkItem(workItem: WhoCanWorkItem, collectClient: IamCollectClient, whoCanOptions: WhoCanOptions): Job<WhoCanAllowed | undefined, Record<string, unknown>>;
+/**
+ * The result of executing a whoCan work item.
+ * Contains either the allowed result or the deny analysis (but not both).
+ */
+export interface WhoCanExecutionResult {
+    /**
+     * The allowed result if the simulation was successful
+     */
+    allowed?: WhoCanAllowed;
+    /**
+     * The deny analysis if the simulation was not allowed.
+     * Only populated when collectDenyDetails is true.
+     */
+    denyAnalysis?: RequestAnalysis;
+    /**
+     * The work item that was executed, for context in deny details
+     */
+    workItem: WhoCanWorkItem;
+}
+export declare function createJobForWhoCanWorkItem(workItem: WhoCanWorkItem, collectClient: IamCollectClient, whoCanOptions: WhoCanOptions): Job<WhoCanExecutionResult, Record<string, unknown>>;
 export interface WhoCanOptions {
     s3AbacOverride?: S3AbacOverride;
+    collectDenyDetails?: boolean;
 }
-export declare function executeWhoCan(workItem: WhoCanWorkItem, collectClient: IamCollectClient, whoCanOptions: WhoCanOptions): Promise<WhoCanAllowed | undefined>;
+export declare function executeWhoCan(workItem: WhoCanWorkItem, collectClient: IamCollectClient, whoCanOptions: WhoCanOptions): Promise<WhoCanExecutionResult>;
 //# sourceMappingURL=WhoCanWorker.d.ts.map

package/dist/cjs/whoCan/WhoCanWorker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanWorker.d.ts","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAC/B,aAAa,EAAE,aAAa,GAC3B,GAAG,CAAC,aAAa,GAAG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOzD;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAC/B,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAqDpC"}
+{"version":3,"file":"WhoCanWorker.d.ts","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IAEvB;;;OAGG;IACH,YAAY,CAAC,EAAE,eAAe,CAAA;IAE9B;;OAEG;IACH,QAAQ,EAAE,cAAc,CAAA;CACzB;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAC/B,aAAa,EAAE,aAAa,GAC3B,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOrD;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAC/B,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CA+DhC"}

package/dist/cjs/whoCan/WhoCanWorker.js

@@ -37,27 +37,37 @@ async function executeWhoCan(workItem, collectClient, whoCanOptions) {
         if (result?.result.analysis?.result === 'Allowed') {
             const actionType = await getActionLevel(service, serviceAction);
             return {
-                principal,
-                service,
-                action: serviceAction,
-                level: actionType.toLowerCase()
+                workItem,
+                allowed: {
+                    principal,
+                    service,
+                    action: serviceAction,
+                    level: actionType.toLowerCase()
+                }
             };
         }
         else {
             const actionType = await getActionLevel(service, serviceAction);
             return {
-                principal,
-                service: service,
-                action: serviceAction,
-                level: actionType.toLowerCase(),
-                conditions: discoveryResult?.result.analysis.ignoredConditions,
-                dependsOnSessionName: discoveryResult?.result.analysis.ignoredRoleSessionName
-                    ? true
-                    : undefined
+                workItem,
+                allowed: {
+                    principal,
+                    service: service,
+                    action: serviceAction,
+                    level: actionType.toLowerCase(),
+                    conditions: discoveryResult?.result.analysis.ignoredConditions,
+                    dependsOnSessionName: discoveryResult?.result.analysis.ignoredRoleSessionName
+                        ? true
+                        : undefined
+                }
             };
         }
     }
-    return undefined;
+    // Not allowed - return deny analysis if requested
+    return {
+        workItem,
+        denyAnalysis: whoCanOptions.collectDenyDetails ? discoveryResult?.result.analysis : undefined
+    };
 }
 /**
  * Get the action level for a specific service action, will fail if the service or action does not exist.

package/dist/cjs/whoCan/WhoCanWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorker.ts"],"names":[],"mappings":";;AAcA,gEAWC;AAMD,sCAyDC;AAxFD,sDAA0D;AAG1D,yDAAyD;AAWzD,SAAgB,0BAA0B,CACxC,QAAwB,EACxB,aAA+B,EAC/B,aAA4B;IAE5B,OAAO;QACL,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,OAAO,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;QAC9D,CAAC;KACF,CAAA;AACH,CAAC;AAMM,KAAK,UAAU,aAAa,CACjC,QAAwB,EACxB,aAA+B,EAC/B,aAA4B;IAE5B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;IACjE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClD,MAAM,eAAe,GAAG,MAAM,IAAA,6BAAe,EAC3C;QACE,SAAS;QACT,WAAW,EAAE,QAAQ;QACrB,eAAe,EAAE,eAAe;QAChC,MAAM;QACN,iBAAiB,EAAE,EAAE;QACrB,cAAc,EAAE,WAAW;QAC3B,cAAc,EAAE,aAAa,CAAC,cAAc;KAC7C,EACD,aAAa,CACd,CAAA;IAED,IAAI,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAClC;YACE,SAAS;YACT,WAAW,EAAE,QAAQ;YACrB,eAAe;YACf,MAAM;YACN,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,aAAa,CAAC,cAAc;SAC7C,EACD,aAAa,CACd,CAAA;QACD,IAAI,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC/D,OAAO;gBACL,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;aAChC,CAAA;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC/D,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;gBAC/B,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB;gBAC9D,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB;oBAC3E,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;aACd,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,OAAO,CAAC,WAAW,CAAA;AAC5B,CAAC"}
+{"version":3,"file":"WhoCanWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorker.ts"],"names":[],"mappings":";;AAqCA,gEAWC;AAOD,sCAmEC;AA1HD,sDAA0D;AAI1D,yDAAyD;AAiCzD,SAAgB,0BAA0B,CACxC,QAAwB,EACxB,aAA+B,EAC/B,aAA4B;IAE5B,OAAO;QACL,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,OAAO,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;QAC9D,CAAC;KACF,CAAA;AACH,CAAC;AAOM,KAAK,UAAU,aAAa,CACjC,QAAwB,EACxB,aAA+B,EAC/B,aAA4B;IAE5B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;IACjE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClD,MAAM,eAAe,GAAG,MAAM,IAAA,6BAAe,EAC3C;QACE,SAAS;QACT,WAAW,EAAE,QAAQ;QACrB,eAAe,EAAE,eAAe;QAChC,MAAM;QACN,iBAAiB,EAAE,EAAE;QACrB,cAAc,EAAE,WAAW;QAC3B,cAAc,EAAE,aAAa,CAAC,cAAc;KAC7C,EACD,aAAa,CACd,CAAA;IAED,IAAI,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAClC;YACE,SAAS;YACT,WAAW,EAAE,QAAQ;YACrB,eAAe;YACf,MAAM;YACN,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,aAAa,CAAC,cAAc;SAC7C,EACD,aAAa,CACd,CAAA;QACD,IAAI,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC/D,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE;oBACP,SAAS;oBACT,OAAO;oBACP,MAAM,EAAE,aAAa;oBACrB,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;iBAChC;aACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC/D,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE;oBACP,SAAS;oBACT,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,aAAa;oBACrB,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;oBAC/B,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB;oBAC9D,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB;wBAC3E,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,SAAS;iBACd;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAC9F,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,OAAO,CAAC,WAAW,CAAA;AAC5B,CAAC"}

package/dist/cjs/whoCan/WhoCanWorkerThreadWorker.js

@@ -1,16 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const iam_simulate_1 = require("@cloud-copilot/iam-simulate");
 const worker_threads_1 = require("worker_threads");
 const collect_js_1 = require("../collect/collect.js");
 const JobRunner_js_1 = require("../workers/JobRunner.js");
 const SharedArrayBufferWorkerCache_js_1 = require("../workers/SharedArrayBufferWorkerCache.js");
+const requestAnalysis_js_1 = require("./requestAnalysis.js");
 const WhoCanWorker_js_1 = require("./WhoCanWorker.js");
 if (!worker_threads_1.parentPort) {
     throw new Error('Must be run as a worker thread');
 }
 // Get config from the main thread
-const { concurrency, collectConfigs, partition, s3AbacOverride } = worker_threads_1.workerData;
+const { concurrency, collectConfigs, partition, s3AbacOverride, collectDenyDetails } = worker_threads_1.workerData;
 const taskPromises = {};
+// Pending deny details checks - keyed by a unique id for each check
+let denyDetailsCheckId = 0;
+const pendingDenyDetailsChecks = {};
 worker_threads_1.parentPort.on('message', (msg) => {
     if (msg.type === 'task' && msg.workerId in taskPromises) {
         taskPromises[msg.workerId](msg.task);
@@ -24,6 +29,15 @@ worker_threads_1.parentPort.on('message', (msg) => {
             worker_threads_1.parentPort.postMessage({ type: 'finished' });
         });
     }
+    else if (msg.type === 'denyDetailsCheckResult') {
+        // Handle response from main thread about whether to include deny details
+        const checkId = msg.checkId;
+        const resolveFn = pendingDenyDetailsChecks[checkId];
+        if (resolveFn) {
+            resolveFn(msg.shouldInclude);
+            delete pendingDenyDetailsChecks[checkId];
+        }
+    }
 });
 const collectClient = (0, collect_js_1.getCollectClient)(collectConfigs, partition, {
     cacheProvider: new SharedArrayBufferWorkerCache_js_1.SharedArrayBufferWorkerCache(worker_threads_1.parentPort)
@@ -38,11 +52,62 @@ const jobRunner = new JobRunner_js_1.PullBasedJobRunner(concurrency, async (work
         properties: {},
         execute: async (context) => {
             return (0, WhoCanWorker_js_1.executeWhoCan)(taskDetails, collectClient, {
-                s3AbacOverride
+                s3AbacOverride,
+                collectDenyDetails
             });
         }
     };
 }, async (result) => {
-    worker_threads_1.parentPort.postMessage({ type: 'result', result });
+    if (result.status === 'fulfilled') {
+        const executionResult = result.value;
+        if (executionResult.allowed) {
+            // Allowed - send result back to main thread
+            worker_threads_1.parentPort.postMessage({
+                type: 'result',
+                result: {
+                    status: 'fulfilled',
+                    value: executionResult.allowed,
+                    properties: result.properties
+                }
+            });
+        }
+        else {
+            // If we have deny analysis and collectDenyDetails is enabled, check with main thread
+            if (collectDenyDetails && executionResult.denyAnalysis) {
+                const lightAnalysis = (0, requestAnalysis_js_1.toLightRequestAnalysis)(executionResult.denyAnalysis);
+                const checkId = denyDetailsCheckId++;
+                // Send check request to main thread
+                worker_threads_1.parentPort.postMessage({
+                    type: 'checkDenyDetails',
+                    checkId,
+                    workItem: executionResult.workItem,
+                    lightAnalysis
+                });
+                // Wait for response from main thread
+                const shouldInclude = await new Promise((resolve) => {
+                    pendingDenyDetailsChecks[checkId] = resolve;
+                });
+                if (shouldInclude) {
+                    // Get full denial reasons and send to main thread
+                    const denialReasons = (0, iam_simulate_1.getDenialReasons)(executionResult.denyAnalysis);
+                    const { workItem } = executionResult;
+                    const [service, action] = workItem.action.split(':');
+                    worker_threads_1.parentPort.postMessage({
+                        type: 'denyDetailsResult',
+                        denyDetail: {
+                            principal: workItem.principal,
+                            service,
+                            action,
+                            details: denialReasons
+                        }
+                    });
+                }
+            }
+        }
+    }
+    else {
+        // Error case - pass through
+        worker_threads_1.parentPort.postMessage({ type: 'result', result });
+    }
 });
 //# sourceMappingURL=WhoCanWorkerThreadWorker.js.map

package/dist/cjs/whoCan/WhoCanWorkerThreadWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanWorkerThreadWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorkerThreadWorker.ts"],"names":[],"mappings":";;AAEA,mDAAuD;AACvD,sDAAwD;AAExD,0DAA4D;AAC5D,gGAAyF;AACzF,uDAAiE;AAGjE,IAAI,CAAC,2BAAU,EAAE,CAAC;IAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;AACnD,CAAC;AAED,kCAAkC;AAClC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,2BAKlE,CAAA;AAED,MAAM,YAAY,GAAuC,EAAE,CAAA;AAE3D,2BAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;IAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;QACxD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACxC,SAAS,CAAC,mBAAmB,EAAE,CAAA;IACjC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrC,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAClC,2BAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,IAAA,6BAAgB,EAAC,cAAc,EAAE,SAAS,EAAE;IAChE,aAAa,EAAE,IAAI,8DAA4B,CAAC,2BAAU,CAAC;CAC5D,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,IAAI,iCAAkB,CAKtC,WAAW,EACX,KAAK,EAAE,QAAQ,EAAE,EAAE;IACjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,2BAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1D,YAAY,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,EACD,CAAC,WAAW,EAAE,EAAE;IACd,OAAO;QACL,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,OAAO,IAAA,+BAAa,EAAC,WAAW,EAAE,aAAa,EAAE;gBAC/C,cAAc;aACf,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;IACf,2BAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;AACrD,CAAC,CACF,CAAA"}
+{"version":3,"file":"WhoCanWorkerThreadWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorkerThreadWorker.ts"],"names":[],"mappings":";;AAEA,8DAA8D;AAC9D,mDAAuD;AACvD,sDAAwD;AAExD,0DAA4D;AAC5D,gGAAyF;AACzF,6DAA6D;AAC7D,uDAAwF;AAExF,IAAI,CAAC,2BAAU,EAAE,CAAC;IAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;AACnD,CAAC;AAED,kCAAkC;AAClC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAClF,2BAMC,CAAA;AAEH,MAAM,YAAY,GAAuC,EAAE,CAAA;AAE3D,oEAAoE;AACpE,IAAI,kBAAkB,GAAG,CAAC,CAAA;AAC1B,MAAM,wBAAwB,GAAqD,EAAE,CAAA;AAErF,2BAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;IAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;QACxD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACxC,SAAS,CAAC,mBAAmB,EAAE,CAAA;IACjC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrC,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAClC,2BAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;QACjD,yEAAyE;QACzE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAiB,CAAA;QACrC,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YAC5B,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,IAAA,6BAAgB,EAAC,cAAc,EAAE,SAAS,EAAE;IAChE,aAAa,EAAE,IAAI,8DAA4B,CAAC,2BAAU,CAAC;CAC5D,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,IAAI,iCAAkB,CAKtC,WAAW,EACX,KAAK,EAAE,QAAQ,EAAE,EAAE;IACjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,2BAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1D,YAAY,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,EACD,CAAC,WAAW,EAAE,EAAE;IACd,OAAO;QACL,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,OAAO,IAAA,+BAAa,EAAC,WAAW,EAAE,aAAa,EAAE;gBAC/C,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;IACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAA;QAEpC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,4CAA4C;YAC5C,2BAAW,CAAC,WAAW,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,eAAe,CAAC,OAAO;oBAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,qFAAqF;YACrF,IAAI,kBAAkB,IAAI,eAAe,CAAC,YAAY,EAAE,CAAC;gBACvD,MAAM,aAAa,GAAG,IAAA,2CAAsB,EAAC,eAAe,CAAC,YAAY,CAAC,CAAA;gBAC1E,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAA;gBAEpC,oCAAoC;gBACpC,2BAAW,CAAC,WAAW,CAAC;oBACtB,IAAI,EAAE,kBAAkB;oBACxB,OAAO;oBACP,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,aAAa;iBACd,CAAC,CAAA;gBAEF,qCAAqC;gBACrC,MAAM,aAAa,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;oBAC3D,wBAAwB,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;gBAC7C,CAAC,CAAC,CAAA;gBAEF,IAAI,aAAa,EAAE,CAAC;oBAClB,kDAAkD;oBAClD,MAAM,aAAa,GAAG,IAAA,+BAAgB,EAAC,eAAe,CAAC,YAAY,CAAC,CAAA;oBACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAA;oBACpC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACpD,2BAAW,CAAC,WAAW,CAAC;wBACtB,IAAI,EAAE,mBAAmB;wBACzB,UAAU,EAAE;4BACV,SAAS,EAAE,QAAQ,CAAC,SAAS;4BAC7B,OAAO;4BACP,MAAM;4BACN,OAAO,EAAE,aAAa;yBACvB;qBACF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,4BAA4B;QAC5B,2BAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CACF,CAAA"}

package/dist/cjs/whoCan/requestAnalysis.d.ts

@@ -0,0 +1,22 @@
+import { RequestAnalysis } from '@cloud-copilot/iam-simulate';
+/**
+ * A light version of RequestAnalysis containing only the result and sameAccount fields,
+ * along with the result fields of the various analyses.
+ */
+export interface LightRequestAnalysis {
+    result: RequestAnalysis['result'];
+    sameAccount: RequestAnalysis['sameAccount'];
+    identityAnalysis?: Pick<NonNullable<RequestAnalysis['identityAnalysis']>, 'result'>;
+    resourceAnalysis?: Pick<NonNullable<RequestAnalysis['resourceAnalysis']>, 'result'>;
+    scpAnalysis?: Pick<NonNullable<RequestAnalysis['scpAnalysis']>, 'result'>;
+    rcpAnalysis?: Pick<NonNullable<RequestAnalysis['rcpAnalysis']>, 'result'>;
+    permissionBoundaryAnalysis?: Pick<NonNullable<RequestAnalysis['permissionBoundaryAnalysis']>, 'result'>;
+}
+/**
+ * Convert a full RequestAnalysis to a LightRequestAnalysis
+ *
+ * @param analysis the full RequestAnalysis to convert
+ * @returns a LightRequestAnalysis with only the essential fields
+ */
+export declare function toLightRequestAnalysis(analysis: RequestAnalysis): LightRequestAnalysis;
+//# sourceMappingURL=requestAnalysis.d.ts.map

package/dist/cjs/whoCan/requestAnalysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAnalysis.d.ts","sourceRoot":"","sources":["../../../src/whoCan/requestAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE7D;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACjC,WAAW,EAAE,eAAe,CAAC,aAAa,CAAC,CAAA;IAC3C,gBAAgB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,gBAAgB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzE,0BAA0B,CAAC,EAAE,IAAI,CAC/B,WAAW,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,EAC1D,QAAQ,CACT,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,GAAG,oBAAoB,CAgBtF"}

package/dist/cjs/whoCan/requestAnalysis.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toLightRequestAnalysis = toLightRequestAnalysis;
+/**
+ * Convert a full RequestAnalysis to a LightRequestAnalysis
+ *
+ * @param analysis the full RequestAnalysis to convert
+ * @returns a LightRequestAnalysis with only the essential fields
+ */
+function toLightRequestAnalysis(analysis) {
+    return {
+        result: analysis.result,
+        sameAccount: analysis.sameAccount,
+        identityAnalysis: analysis.identityAnalysis
+            ? { result: analysis.identityAnalysis.result }
+            : undefined,
+        resourceAnalysis: analysis.resourceAnalysis
+            ? { result: analysis.resourceAnalysis.result }
+            : undefined,
+        scpAnalysis: analysis.scpAnalysis ? { result: analysis.scpAnalysis.result } : undefined,
+        rcpAnalysis: analysis.rcpAnalysis ? { result: analysis.rcpAnalysis.result } : undefined,
+        permissionBoundaryAnalysis: analysis.permissionBoundaryAnalysis
+            ? { result: analysis.permissionBoundaryAnalysis.result }
+            : undefined
+    };
+}
+//# sourceMappingURL=requestAnalysis.js.map

package/dist/cjs/whoCan/requestAnalysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAnalysis.js","sourceRoot":"","sources":["../../../src/whoCan/requestAnalysis.ts"],"names":[],"mappings":";;AAyBA,wDAgBC;AAtBD;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,QAAyB;IAC9D,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC9C,CAAC,CAAC,SAAS;QACb,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC9C,CAAC,CAAC,SAAS;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvF,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvF,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;YAC7D,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,0BAA0B,CAAC,MAAM,EAAE;YACxD,CAAC,CAAC,SAAS;KACd,CAAA;AACH,CAAC"}

package/dist/cjs/whoCan/whoCan.d.ts

@@ -1,13 +1,41 @@
 import { TopLevelConfig } from '@cloud-copilot/iam-collect';
 import { ResourceType } from '@cloud-copilot/iam-data';
+import { RequestDenial } from '@cloud-copilot/iam-simulate';
 import { IamCollectClient } from '../collect/client.js';
 import { S3AbacOverride } from '../utils/s3Abac.js';
+import { LightRequestAnalysis } from './requestAnalysis.js';
 export interface ResourceAccessRequest {
+    /**
+     * The ARN of the resource to check access for. If not provided, actions must be specified.
+     */
     resource?: string;
+    /**
+     * The account ID the resource belongs to.
+     * By default this will be looked up based on the resource ARN, but that may
+     * not be possible for all actions, such as wildcard actions like `s3:ListAllMyBuckets`.
+     */
     resourceAccount?: string;
+    /**
+     * The actions to check access for. If not provided, actions will be looked up based on the resource ARN.
+     */
     actions: string[];
+    /**
+     * Whether to sort the results for consistent output.
+     */
     sort?: boolean;
+    /**
+     * An override for S3 ABAC being enabled when checking access to S3 Bucket resources.
+     */
     s3AbacOverride?: S3AbacOverride;
+    /**
+     * The number of worker threads to use for simulations beyond the main thread.
+     * If not provided, defaults to number of CPUs - 1.
+     */
+    workerThreads?: number;
+    /**
+     * Deny details callback for simulations. If the callback returns true, deny details will be included for that simulation.
+     */
+    denyDetailsCallback?: (details: LightRequestAnalysis) => boolean;
 }
 export interface WhoCanAllowed {
     principal: string;
@@ -17,6 +45,12 @@ export interface WhoCanAllowed {
     conditions?: any;
     dependsOnSessionName?: boolean;
 }
+export interface WhoCanDenyDetail {
+    principal: string;
+    service: string;
+    action: string;
+    details: RequestDenial[];
+}
 export interface WhoCanResponse {
     simulationCount: number;
     allowed: WhoCanAllowed[];
@@ -25,6 +59,7 @@ export interface WhoCanResponse {
     organizationsNotFound: string[];
     organizationalUnitsNotFound: string[];
     principalsNotFound: string[];
+    denyDetails?: WhoCanDenyDetail[] | undefined;
 }
 export declare function whoCan(collectConfigs: TopLevelConfig[], partition: string, request: ResourceAccessRequest): Promise<WhoCanResponse>;
 export declare function uniqueAccountsToCheck(collectClient: IamCollectClient, accountsToCheck: AccountsToCheck): Promise<{

package/dist/cjs/whoCan/whoCan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"whoCan.d.ts","sourceRoot":"","sources":["../../../src/whoCan/whoCan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAOL,YAAY,EACb,MAAM,yBAAyB,CAAA;AAWhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAIvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AASnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,GAAG,CAAA;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAC7B;AASD,wBAAsB,MAAM,CAC1B,cAAc,EAAE,cAAc,EAAE,EAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAuOzB;AAoBD,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC;IACT,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,CAAC,CAiDD;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;CACtC;AAED,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,GAAG,EACnB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA4BxF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsBxF;AAED,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAqBjG;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOrE;AAcD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,cAAc,QAe/D"}
+{"version":3,"file":"whoCan.d.ts","sourceRoot":"","sources":["../../../src/whoCan/whoCan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAOL,YAAY,EACb,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAU3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAIvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAQnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IAEd;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAA;CACjE;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,GAAG,CAAA;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,aAAa,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,gBAAgB,EAAE,GAAG,SAAS,CAAA;CAC7C;AAeD,wBAAsB,MAAM,CAC1B,cAAc,EAAE,cAAc,EAAE,EAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CA6PzB;AAoBD,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC;IACT,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,CAAC,CAiDD;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;CACtC;AAED,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,GAAG,EACnB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA4BxF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsBxF;AAED,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAqBjG;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOrE;AAcD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,cAAc,QAyB/D"}

package/dist/cjs/whoCan/whoCan.js

@@ -21,26 +21,38 @@ const workerScript_js_1 = require("../utils/workerScript.js");
 const SharedArrayBufferMainCache_js_1 = require("../workers/SharedArrayBufferMainCache.js");
 const StreamingWorkQueue_js_1 = require("../workers/StreamingWorkQueue.js");
 const WhoCanMainThreadWorker_js_1 = require("./WhoCanMainThreadWorker.js");
-function getCpuCount() {
-    if (process.env.NODE_ENV === 'test') {
-        return 2;
+/**
+ * Get the number of worker threads to use, defaulting to number of CPUs - 1
+ *
+ * @param overrideValue the override value, if any
+ * @returns the override value if provided, otherwise number of CPUs - 1
+ */
+function getNumberOfWorkers(overrideValue) {
+    if (typeof overrideValue === 'number' && overrideValue >= 0) {
+        return Math.floor(overrideValue);
     }
-    return (0, job_1.numberOfCpus)();
+    return Math.max(0, (0, job_1.numberOfCpus)() - 1);
 }
 async function whoCan(collectConfigs, partition, request) {
-    const cpus = getCpuCount();
     const { resource } = request;
+    // Get the number of workers and the worker script path.
+    // It's possible in bundled environments that the worker script path may not be found, so handle that gracefully.
+    const numWorkers = getNumberOfWorkers(request.workerThreads);
     const workerPath = (0, workerScript_js_1.getWorkerScriptPath)('whoCan/WhoCanWorkerThreadWorker.js');
-    const workers = new Array(cpus - 1).fill(undefined).map((val) => {
-        return new worker_threads_1.Worker(workerPath, {
-            workerData: {
-                collectConfigs: collectConfigs,
-                partition,
-                concurrency: 50,
-                s3AbacOverride: request.s3AbacOverride
-            }
+    const collectDenyDetails = !!request.denyDetailsCallback;
+    const workers = !workerPath
+        ? []
+        : new Array(numWorkers).fill(undefined).map((val) => {
+            return new worker_threads_1.Worker(workerPath, {
+                workerData: {
+                    collectConfigs: collectConfigs,
+                    partition,
+                    concurrency: 50,
+                    s3AbacOverride: request.s3AbacOverride,
+                    collectDenyDetails
+                }
+            });
         });
-    });
     const collectClient = (0, collect_js_1.getCollectClient)(collectConfigs, partition, {
         cacheProvider: new SharedArrayBufferMainCache_js_1.SharedArrayBufferMainCache(workers)
     });
@@ -75,6 +87,7 @@ async function whoCan(collectConfigs, partition, request) {
     let simulationCount = 0;
     const simulateQueue = new StreamingWorkQueue_js_1.StreamingWorkQueue();
     const simulationErrors = [];
+    const denyDetails = [];
     const onComplete = (result) => {
         simulationCount++;
         if (result.status === 'fulfilled' && result.value) {
@@ -85,7 +98,7 @@ async function whoCan(collectConfigs, partition, request) {
             simulationErrors.push(result);
         }
     };
-    const mainThreadWorker = (0, WhoCanMainThreadWorker_js_1.createMainThreadStreamingWorkQueue)(simulateQueue, collectClient, request.s3AbacOverride, onComplete);
+    const mainThreadWorker = (0, WhoCanMainThreadWorker_js_1.createMainThreadStreamingWorkQueue)(simulateQueue, collectClient, request.s3AbacOverride, onComplete, request.denyDetailsCallback, (detail) => denyDetails.push(detail));
     workers.forEach((worker) => {
         worker.on('message', (msg) => {
             if (msg.type === 'requestTask') {
@@ -95,6 +108,18 @@ async function whoCan(collectConfigs, partition, request) {
             if (msg.type === 'result') {
                 onComplete(msg.result);
             }
+            if (msg.type === 'checkDenyDetails') {
+                // Run the callback on main thread to check if we should include deny details
+                const shouldInclude = request.denyDetailsCallback?.(msg.lightAnalysis) ?? false;
+                worker.postMessage({
+                    type: 'denyDetailsCheckResult',
+                    checkId: msg.checkId,
+                    shouldInclude
+                });
+            }
+            if (msg.type === 'denyDetailsResult') {
+                denyDetails.push(msg.denyDetail);
+            }
         });
     });
     simulateQueue.setWorkAvailableCallback(() => {
@@ -183,7 +208,8 @@ async function whoCan(collectConfigs, partition, request) {
         accountsNotFound: uniqueAccounts.accountsNotFound,
         organizationsNotFound: uniqueAccounts.organizationsNotFound,
         organizationalUnitsNotFound: uniqueAccounts.organizationalUnitsNotFound,
-        principalsNotFound: principalsNotFound
+        principalsNotFound: principalsNotFound,
+        denyDetails: request.denyDetailsCallback ? denyDetails : undefined
     };
     if (request.sort) {
         sortWhoCanResults(results);
@@ -438,6 +464,21 @@ function sortWhoCanResults(whoCanResponse) {
             return 1;
         return 0;
     });
+    whoCanResponse.denyDetails?.sort((a, b) => {
+        if (a.principal < b.principal)
+            return -1;
+        if (a.principal > b.principal)
+            return 1;
+        if (a.service < b.service)
+            return -1;
+        if (a.service > b.service)
+            return 1;
+        if (a.action < b.action)
+            return -1;
+        if (a.action > b.action)
+            return 1;
+        return 0;
+    });
     whoCanResponse.accountsNotFound.sort();
     whoCanResponse.organizationsNotFound.sort();
     whoCanResponse.organizationalUnitsNotFound.sort();