@cloud-copilot/iam-simulate 0.1.0

package/dist/esm/action.js

@@ -0,0 +1,18 @@
+function convertActionToRegex(action) {
+    return action.replace(/\?/g, '.').replace(/\*/g, '.*');
+}
+export function requestMatchesAction(request, actions) {
+    for (const action of actions) {
+        if (action.isWildcardAction()) {
+            return true;
+        }
+        else if (action.isServiceAction()) {
+            const actionRegex = new RegExp(convertActionToRegex(action.value()));
+            if (actionRegex.test(request.action)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=action.js.map

package/dist/esm/action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../../src/action.ts"],"names":[],"mappings":"AAGA,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB,EAAE,OAAiB;IACtE,KAAI,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,IAAG,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC;YACnC,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrE,IAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IAEH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/condition/BaseConditionOperator.d.ts

@@ -0,0 +1,8 @@
+import { AwsRequest } from "../request/request.js";
+export interface BaseConditionOperator {
+    name: string;
+    matches: (request: AwsRequest, keyValue: string, policyValues: string[]) => boolean;
+    allowsVariables: boolean;
+    allowsWildcards: boolean;
+}
+//# sourceMappingURL=BaseConditionOperator.d.ts.map

package/dist/esm/condition/BaseConditionOperator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseConditionOperator.d.ts","sourceRoot":"","sources":["../../../src/condition/BaseConditionOperator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,OAAO,CAAA;IACnF,eAAe,EAAE,OAAO,CAAA;IACxB,eAAe,EAAE,OAAO,CAAA;CACzB"}

package/dist/esm/condition/BaseConditionOperator.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=BaseConditionOperator.js.map

package/dist/esm/condition/BaseConditionOperator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseConditionOperator.js","sourceRoot":"","sources":["../../../src/condition/BaseConditionOperator.ts"],"names":[],"mappings":""}

package/dist/esm/condition/condition.d.ts

@@ -0,0 +1,5 @@
+import { Condition } from '@cloud-copilot/iam-policy';
+import { AwsRequest } from '../request/request';
+export type ConditionMatchResult = 'Match' | 'NoMatch' | 'Unknown';
+export declare function singleConditionMatchesRequest(request: AwsRequest, condition: Condition): ConditionMatchResult;
+//# sourceMappingURL=condition.d.ts.map

package/dist/esm/condition/condition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;AAelE,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,oBAAoB,CA6D7G"}

package/dist/esm/condition/condition.js

@@ -0,0 +1,70 @@
+import { convertIamStringToRegex } from '../util.js';
+const baseOperations = {
+    'stringequals': (request, keyValue, policyValues) => {
+        const patterns = policyValues.map(value => convertIamStringToRegex(value, request, { replaceWildcards: false }));
+        return patterns.some(pattern => pattern.test(keyValue));
+    },
+    'stringnotequals': (request, keyValue, policyValues) => {
+        const patterns = policyValues.map(value => convertIamStringToRegex(value, request, { replaceWildcards: false }));
+        return !patterns.some(pattern => pattern.test(keyValue));
+    }
+};
+export function singleConditionMatchesRequest(request, condition) {
+    const key = condition.conditionKey();
+    const policyValues = condition.conditionValues();
+    const baseOperation = baseOperations[condition.operation().baseOperator().toLowerCase()];
+    const keyExists = request.contextKeyExists(key);
+    const keyValue = keyExists ? request.getContextKeyValue(key) : undefined;
+    if (condition.operation().setOperator()) {
+        const setOperator = condition.operation().setOperator();
+        if (setOperator === 'ForAnyValue') {
+            if (!keyExists || !keyValue || !keyValue.isArrayValue()) {
+                return 'NoMatch';
+            }
+            if (!baseOperation) {
+                return 'Unknown';
+            }
+            //Do the loop
+            const anyMatch = keyValue.values.some(value => {
+                return baseOperation(request, value, policyValues);
+            });
+            return anyMatch ? 'Match' : 'NoMatch';
+        }
+        else if (setOperator === 'ForAllValues') {
+            if (!keyExists) {
+                return 'Match';
+            }
+            if (!keyValue || !keyValue.isArrayValue()) {
+                return 'NoMatch';
+            }
+            if (!baseOperation) {
+                return 'Unknown';
+            }
+            //Do the loop
+            const anyNotMatch = keyValue.values.some(value => {
+                return !baseOperation(request, value, policyValues);
+            });
+            return anyNotMatch ? 'NoMatch' : 'Match';
+        }
+        else {
+            throw new Error(`Unknown set operator: ${setOperator}`);
+        }
+    }
+    if (condition.operation().isIfExists() || condition.operation().baseOperator().toLowerCase().includes('not')) {
+        //Check if it exists, return true if it doesn't
+        //Double check what happens here if the key is not a valid key or is of the wrong type
+        if (!keyExists) {
+            return 'Match';
+        }
+    }
+    if (!keyValue || !keyValue.isStringValue()) {
+        //Set operator is required for a multi-value key
+        return 'NoMatch';
+    }
+    if (!baseOperation) {
+        return 'Unknown';
+    }
+    const matches = baseOperation(request, keyValue.value, policyValues);
+    return matches ? 'Match' : 'NoMatch';
+}
+//# sourceMappingURL=condition.js.map

package/dist/esm/condition/condition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.js","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAMrD,MAAM,cAAc,GAAiC;IACnD,cAAc,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAW,EAAE;QAC3D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAC,gBAAgB,EAAE,KAAK,EAAC,CAAC,CAAC,CAAA;QAC9G,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,iBAAiB,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAW,EAAE;QAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAC,gBAAgB,EAAE,KAAK,EAAC,CAAC,CAAC,CAAA;QAC9G,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1D,CAAC;CACF,CAAA;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAmB,EAAE,SAAoB;IACrF,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,EAAE,CAAA;IACpC,MAAM,YAAY,GAAG,SAAS,CAAC,eAAe,EAAE,CAAA;IAChD,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAExE,IAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAA;QACvD,IAAG,WAAW,KAAK,aAAa,EAAE,CAAC;YACjC,IAAG,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;gBACvD,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,IAAG,CAAC,aAAa,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,aAAa;YACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC5C,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;YACpD,CAAC,CAAC,CAAA;YACF,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QACvC,CAAC;aAAM,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YAC1C,IAAG,CAAC,SAAS,EAAE,CAAC;gBACd,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,IAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,IAAG,CAAC,aAAa,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,aAAa;YACb,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC/C,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;YACrD,CAAC,CAAC,CAAA;YAEF,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,IAAG,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5G,+CAA+C;QAC/C,sFAAsF;QACtF,IAAG,CAAC,SAAS,EAAE,CAAC;YACd,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,IAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC1C,gDAAgD;QAChD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,CAAC,aAAa,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IACpE,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACtC,CAAC"}

package/dist/esm/condition/strings/StringEquals.d.ts

@@ -0,0 +1,3 @@
+import { BaseConditionOperator } from "../BaseConditionOperator.js";
+export declare const StringEquals: BaseConditionOperator;
+//# sourceMappingURL=StringEquals.d.ts.map

package/dist/esm/condition/strings/StringEquals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringEquals.d.ts","sourceRoot":"","sources":["../../../../src/condition/strings/StringEquals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,eAAO,MAAM,YAAY,EAAE,qBAQ1B,CAAA"}

package/dist/esm/condition/strings/StringEquals.js

@@ -0,0 +1,11 @@
+import { convertIamStringToRegex } from "../../util.js";
+export const StringEquals = {
+    name: 'StringEquals',
+    matches: (request, keyValue, policyValues) => {
+        const patterns = policyValues.map(value => convertIamStringToRegex(value, request, { replaceWildcards: false }));
+        return patterns.some(pattern => pattern.test(keyValue));
+    },
+    allowsVariables: true,
+    allowsWildcards: false
+};
+//# sourceMappingURL=StringEquals.js.map

package/dist/esm/condition/strings/StringEquals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringEquals.js","sourceRoot":"","sources":["../../../../src/condition/strings/StringEquals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGxD,MAAM,CAAC,MAAM,YAAY,GAA0B;IACjD,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAC,gBAAgB,EAAE,KAAK,EAAC,CAAC,CAAC,CAAA;QAC9G,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;CACvB,CAAA"}

package/dist/esm/evaluate.d.ts

@@ -0,0 +1,2 @@
+export type EvaluationResult = 'Allowed' | 'Denied' | 'AllowedWithConditions' | 'ImplicitlyDenied';
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/esm/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/evaluate.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,uBAAuB,GAAG,kBAAkB,CAAC"}

package/dist/esm/evaluate.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=evaluate.js.map

package/dist/esm/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/evaluate.ts"],"names":[],"mappings":""}

package/dist/esm/index.d.ts

@@ -0,0 +1 @@
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":""}

package/dist/esm/index.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":""}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+    "type": "module"
+}

package/dist/esm/principal/principal.d.ts

@@ -0,0 +1,31 @@
+import { Principal } from "@cloud-copilot/iam-policy";
+import { AwsRequest } from "../request/request.js";
+type PrincipalMatchResult = 'Match' | 'NoMatch' | 'AccountLevelMatch';
+/**
+ * Check to see if a request matches a Principal element in an IAM policy statement
+ *
+ * @param request the request to check
+ * @param principal the list of principals in the Principal element of the Statement
+ * @returns if the request matches the Principal element, and if so, how it matches
+ */
+export declare function requestMatchesPrincipal(request: AwsRequest, principal: Principal[]): PrincipalMatchResult;
+/**
+ * Check to see if a request matches a NotPrincipal element in an IAM policy statement
+ *
+ * @param request the request to check
+ * @param notPrincipal the list of principals in the NotPrincipal element of the Statement
+ * @returns
+ */
+export declare function requestMatchesNotPrincipal(request: AwsRequest, notPrincipal: Principal[]): PrincipalMatchResult;
+/**
+ * Check to see if a request matches a principal statement
+ *
+ * @param request the request to check
+ * @param principalStatement the principal statement to check the request against
+ * @returns if the request matches the principal statement, and if so, how it matches
+ */
+export declare function requestMatchesPrincipalStatement(request: AwsRequest, principalStatement: Principal): PrincipalMatchResult;
+export declare function isAssumedRoleArn(principal: string): boolean;
+export declare function roleArnFromAssumedRoleArn(assumedRoleArn: string): string;
+export {};
+//# sourceMappingURL=principal.d.ts.map

package/dist/esm/principal/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AA4CnD,KAAK,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAErE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAWzG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAiB/G;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,GAAG,oBAAoB,CAgDzH;AAID,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAKxE"}

package/dist/esm/principal/principal.js

@@ -0,0 +1,100 @@
+/**
+ * Check to see if a request matches a Principal element in an IAM policy statement
+ *
+ * @param request the request to check
+ * @param principal the list of principals in the Principal element of the Statement
+ * @returns if the request matches the Principal element, and if so, how it matches
+ */
+export function requestMatchesPrincipal(request, principal) {
+    const matches = principal.map(principalStatement => requestMatchesPrincipalStatement(request, principalStatement));
+    if (matches.includes('Match')) {
+        return 'Match';
+    }
+    if (matches.includes('AccountLevelMatch')) {
+        return 'AccountLevelMatch';
+    }
+    return 'NoMatch';
+}
+/**
+ * Check to see if a request matches a NotPrincipal element in an IAM policy statement
+ *
+ * @param request the request to check
+ * @param notPrincipal the list of principals in the NotPrincipal element of the Statement
+ * @returns
+ */
+export function requestMatchesNotPrincipal(request, notPrincipal) {
+    const matches = notPrincipal.map(principalStatement => requestMatchesPrincipalStatement(request, principalStatement));
+    if (matches.includes('Match')) {
+        return 'NoMatch';
+    }
+    /**
+     * Need to do research on this. If there is an account level match on a NotPrincipal, does that
+     * mean it tentatively matches the NotPrincipal, or does it mean it does not match the NotPrincipal?
+     *
+     * We need to test this.
+     */
+    if (matches.includes('AccountLevelMatch')) {
+        return 'NoMatch';
+    }
+    return 'Match';
+}
+/**
+ * Check to see if a request matches a principal statement
+ *
+ * @param request the request to check
+ * @param principalStatement the principal statement to check the request against
+ * @returns if the request matches the principal statement, and if so, how it matches
+ */
+export function requestMatchesPrincipalStatement(request, principalStatement) {
+    if (principalStatement.isServicePrincipal()) {
+        if (principalStatement.service() === request.principal.value()) {
+            return 'Match';
+        }
+        return 'NoMatch';
+    }
+    if (principalStatement.isCanonicalUserPrincipal()) {
+        if (principalStatement.canonicalUser() === request.principal.value()) {
+            return 'Match';
+        }
+        return 'NoMatch';
+    }
+    if (principalStatement.isFederatedPrincipal()) {
+        if (principalStatement.federated() === request.principal.value()) {
+            return 'Match';
+        }
+        return 'NoMatch';
+    }
+    if (principalStatement.isWildcardPrincipal()) {
+        return 'Match';
+    }
+    if (principalStatement.isAccountPrincipal()) {
+        if (principalStatement.accountId() === request.principal.accountId()) {
+            return 'AccountLevelMatch';
+        }
+        return 'NoMatch';
+    }
+    if (principalStatement.isAwsPrincipal()) {
+        if (isAssumedRoleArn(request.principal.value())) {
+            const sessionArn = request.principal.value();
+            const roleArn = roleArnFromAssumedRoleArn(sessionArn);
+            if (principalStatement.arn() === roleArn || principalStatement.arn() === sessionArn) {
+                return 'Match';
+            }
+        }
+        if (principalStatement.arn() === request.principal.value()) {
+            return 'Match';
+        }
+    }
+    return 'NoMatch';
+}
+const assumedRoleArnRegex = /^arn:aws:sts::\d{12}:assumed-role\/.*$/;
+export function isAssumedRoleArn(principal) {
+    return assumedRoleArnRegex.test(principal);
+}
+export function roleArnFromAssumedRoleArn(assumedRoleArn) {
+    const stsParts = assumedRoleArn.split(':');
+    const resourceParts = stsParts.at(-1).split('/');
+    const rolePathAndName = resourceParts.slice(1, -1).join('/');
+    return `arn:aws:iam::${stsParts[4]}:role/${rolePathAndName}`;
+}
+//# sourceMappingURL=principal.js.map

package/dist/esm/principal/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AA+CA;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAmB,EAAE,SAAsB;IACjF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAClH,IAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO,mBAAmB,CAAA;IAC5B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAmB,EAAE,YAAyB;IACvF,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,gCAAgC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACrH,IAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAmB,EAAE,kBAA6B;IACjG,IAAG,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC3C,IAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,wBAAwB,EAAE,EAAE,CAAC;QACjD,IAAG,kBAAkB,CAAC,aAAa,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YACpE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC7C,IAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAChE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAG,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC3C,IAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YACpE,OAAO,mBAAmB,CAAA;QAC5B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,kBAAkB,CAAC,cAAc,EAAE,EAAE,CAAC;QACvC,IAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAA;YACrD,IAAG,kBAAkB,CAAC,GAAG,EAAE,KAAM,OAAO,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,UAAU,EAAE,CAAC;gBACpF,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;QAED,IAAG,kBAAkB,CAAC,GAAG,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,mBAAmB,GAAG,wCAAwC,CAAA;AAEpE,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5D,OAAO,gBAAgB,QAAQ,CAAC,CAAC,CAAC,SAAS,eAAe,EAAE,CAAA;AAC9D,CAAC"}

package/dist/esm/request/request.d.ts

@@ -0,0 +1,52 @@
+import { ContextKey, RequestContext } from "../requestContext.js";
+import { RequestAction } from "./requestAction.js";
+import { RequestPrincipal } from "./requestPrincipal.js";
+import { RequestResource } from "./requestResource.js";
+import { RequestSupplementalData } from "./requestSupplementalData.js";
+/**
+ * A request to be evaluated by the policy engine
+ */
+export interface AwsRequest {
+    principal: RequestPrincipal;
+    /**
+     * The action to be performed
+     */
+    action: RequestAction;
+    /**
+     * The resource to be acted upon
+     */
+    resource?: RequestResource;
+    /**
+     * The context of the request
+     */
+    context: RequestContext;
+    /**
+     * Checks to see if a context key is valid for the request and
+     * exists in the context
+     *
+     * @param key the key to check for existence
+     * @returns true if the key is valid for the request and exists in the request context.
+     */
+    contextKeyExists(key: string): boolean;
+    /**
+     * Gets the value of a context key, if it is valid for the request and exist, otherwise throws an error
+     * @param key the key to get the value of
+     *
+     * @returns the value of the context key
+     */
+    getContextKeyValue(key: string): ContextKey;
+}
+export declare class AwsRequestImpl implements AwsRequest {
+    readonly principalString: string;
+    readonly resourceString: string | undefined;
+    readonly actionString: string;
+    readonly context: RequestContext;
+    readonly supplementalData: RequestSupplementalData;
+    constructor(principalString: string, resourceString: string | undefined, actionString: string, context: RequestContext, supplementalData: RequestSupplementalData);
+    get action(): RequestAction;
+    get resource(): RequestResource;
+    get principal(): RequestPrincipal;
+    contextKeyExists(key: string): boolean;
+    getContextKeyValue(key: string): ContextKey;
+}
+//# sourceMappingURL=request.d.ts.map

package/dist/esm/request/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/request/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAuB,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,gBAAgB,CAAC;IAE5B;;OAEG;IACH,MAAM,EAAE,aAAa,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAE3B;;OAEG;IACH,OAAO,EAAE,cAAc,CAAA;IAEvB;;;;;;OAMG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAEvC;;;;;OAKG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;CAC7C;AAED,qBAAa,cAAe,YAAW,UAAU;aAEnB,eAAe,EAAE,MAAM;aACvB,cAAc,EAAE,MAAM,GAAG,SAAS;aAClC,YAAY,EAAE,MAAM;aACpB,OAAO,EAAE,cAAc;aACvB,gBAAgB,EAAE,uBAAuB;gBAJzC,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,EACvB,gBAAgB,EAAE,uBAAuB;IAIrE,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,IAAI,QAAQ,IAAI,eAAe,CAK9B;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAGM,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKtC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;CAMnD"}

package/dist/esm/request/request.js

@@ -0,0 +1,34 @@
+import { RequestActionImpl } from "./requestAction.js";
+import { RequestPrincipalImpl } from "./requestPrincipal.js";
+import { ResourceRequestImpl } from "./requestResource.js";
+export class AwsRequestImpl {
+    constructor(principalString, resourceString, actionString, context, supplementalData) {
+        this.principalString = principalString;
+        this.resourceString = resourceString;
+        this.actionString = actionString;
+        this.context = context;
+        this.supplementalData = supplementalData;
+    }
+    get action() {
+        return new RequestActionImpl(this.actionString);
+    }
+    get resource() {
+        if (this.resourceString === undefined) {
+            throw new Error('Resource is undefined');
+        }
+        return new ResourceRequestImpl(this.resourceString);
+    }
+    get principal() {
+        return new RequestPrincipalImpl(this.principalString);
+    }
+    contextKeyExists(key) {
+        return this.supplementalData.contextKeyValidForRequest(key) && this.context.contextKeyExists(key);
+    }
+    getContextKeyValue(key) {
+        if (!this.contextKeyExists(key)) {
+            throw new Error(`Invalid context key: ${key}`);
+        }
+        return this.context.contextKeyValue(key);
+    }
+}
+//# sourceMappingURL=request.js.map

package/dist/esm/request/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/request/request.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAoB,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAmB,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AA0C5E,MAAM,OAAO,cAAc;IAEzB,YAA4B,eAAuB,EACvB,cAAkC,EAClC,YAAoB,EACpB,OAAuB,EACvB,gBAAyC;QAJzC,oBAAe,GAAf,eAAe,CAAQ;QACvB,mBAAc,GAAd,cAAc,CAAoB;QAClC,iBAAY,GAAZ,YAAY,CAAQ;QACpB,YAAO,GAAP,OAAO,CAAgB;QACvB,qBAAgB,GAAhB,gBAAgB,CAAyB;IAErE,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,QAAQ;QACV,IAAG,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAGM,gBAAgB,CAAC,GAAW;QACjC,OAAO,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpG,CAAC;IAGM,kBAAkB,CAAC,GAAW;QACnC,IAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/esm/request/requestAction.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A service action: `"service:Action"`
+ */
+export interface RequestAction {
+    /**
+     * The raw string value of the action
+     */
+    value(): string;
+    /**
+     * The service of the action
+     *
+     * Guaranteed to be lowercase
+     */
+    service(): string;
+    /**
+     * The action within the service
+     */
+    action(): string;
+}
+export declare class RequestActionImpl implements RequestAction {
+    private readonly rawValue;
+    constructor(rawValue: string);
+    value(): string;
+    service(): string;
+    action(): string;
+}
+//# sourceMappingURL=requestAction.d.ts.map

package/dist/esm/request/requestAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAction.d.ts","sourceRoot":"","sources":["../../../src/request/requestAction.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;;;OAIG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;CACjB;AAED,qBAAa,iBAAkB,YAAW,aAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEtC,KAAK,IAAI,MAAM;IAIf,OAAO,IAAI,MAAM;IAIjB,MAAM,IAAI,MAAM;CAGxB"}

package/dist/esm/request/requestAction.js

@@ -0,0 +1,15 @@
+export class RequestActionImpl {
+    constructor(rawValue) {
+        this.rawValue = rawValue;
+    }
+    value() {
+        return this.rawValue;
+    }
+    service() {
+        return this.rawValue.split(':')[0].toLowerCase();
+    }
+    action() {
+        return this.rawValue.split(':')[1];
+    }
+}
+//# sourceMappingURL=requestAction.js.map

package/dist/esm/request/requestAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAction.js","sourceRoot":"","sources":["../../../src/request/requestAction.ts"],"names":[],"mappings":"AAsBA,MAAM,OAAO,iBAAiB;IAC5B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAE1C,KAAK;QACV,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAEM,OAAO;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAA;IACnD,CAAC;IAEM,MAAM;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACpC,CAAC;CACF"}

package/dist/esm/request/requestPrincipal.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A principal in a request
+ */
+export interface RequestPrincipal {
+    /**
+     * The raw string of the principal
+     */
+    value(): string;
+    /**
+     * The account id of the principal, if the principal is an ARN that has an account ID, otherwise undefined
+     */
+    accountId(): string | undefined;
+}
+export declare class RequestPrincipalImpl implements RequestPrincipal {
+    private readonly rawValue;
+    constructor(rawValue: string);
+    accountId(): string | undefined;
+    value(): string;
+}
+//# sourceMappingURL=requestPrincipal.d.ts.map

package/dist/esm/request/requestPrincipal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestPrincipal.d.ts","sourceRoot":"","sources":["../../../src/request/requestPrincipal.ts"],"names":[],"mappings":"AACA;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAE/B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAC;IAEhB;;OAEG;IACH,SAAS,IAAI,MAAM,GAAG,SAAS,CAAC;CAEjC;AAED,qBAAa,oBAAqB,YAAW,gBAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAE7C,SAAS,IAAI,MAAM,GAAG,SAAS;IAIxB,KAAK,IAAI,MAAM;CAGvB"}

package/dist/esm/request/requestPrincipal.js

@@ -0,0 +1,12 @@
+export class RequestPrincipalImpl {
+    constructor(rawValue) {
+        this.rawValue = rawValue;
+    }
+    accountId() {
+        return this.value().split(":").at(4);
+    }
+    value() {
+        return this.rawValue;
+    }
+}
+//# sourceMappingURL=requestPrincipal.js.map

package/dist/esm/request/requestPrincipal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestPrincipal.js","sourceRoot":"","sources":["../../../src/request/requestPrincipal.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,oBAAoB;IAC/B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF"}

package/dist/esm/request/requestResource.d.ts

@@ -0,0 +1,37 @@
+export interface RequestResource {
+    /**
+     * The raw string of the resource
+     */
+    value(): string;
+    /**
+     * The partition of the ARN
+     */
+    partition(): string;
+    /**
+     * The service of the ARN
+     */
+    service(): string;
+    /**
+     * The region of the ARN
+     */
+    region(): string;
+    /**
+     * The account of the ARN
+     */
+    account(): string;
+    /**
+     * The resource of the ARN
+     */
+    resource(): string;
+}
+export declare class ResourceRequestImpl implements RequestResource {
+    private readonly rawValue;
+    constructor(rawValue: string);
+    partition(): string;
+    service(): string;
+    region(): string;
+    account(): string;
+    resource(): string;
+    value(): string;
+}
+//# sourceMappingURL=requestResource.d.ts.map

package/dist/esm/request/requestResource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestResource.d.ts","sourceRoot":"","sources":["../../../src/request/requestResource.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;IAEnB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;IAEhB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,QAAQ,IAAI,MAAM,CAAA;CACnB;AAGD,qBAAa,mBAAoB,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAE7C,SAAS,IAAI,MAAM;IAInB,OAAO,IAAI,MAAM;IAIjB,MAAM,IAAI,MAAM;IAIhB,OAAO,IAAI,MAAM;IAIjB,QAAQ,IAAI,MAAM;IAIlB,KAAK,IAAI,MAAM;CAGhB"}

package/dist/esm/request/requestResource.js

@@ -0,0 +1,24 @@
+export class ResourceRequestImpl {
+    constructor(rawValue) {
+        this.rawValue = rawValue;
+    }
+    partition() {
+        return this.value().split(":").at(1);
+    }
+    service() {
+        return this.value().split(":").at(2);
+    }
+    region() {
+        return this.value().split(":").at(3);
+    }
+    account() {
+        return this.value().split(":").at(4);
+    }
+    resource() {
+        return this.value().split(":").slice(5).join(":");
+    }
+    value() {
+        return this.rawValue;
+    }
+}
+//# sourceMappingURL=requestResource.js.map

package/dist/esm/request/requestResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestResource.js","sourceRoot":"","sources":["../../../src/request/requestResource.ts"],"names":[],"mappings":"AAkCA,MAAM,OAAO,mBAAmB;IAC9B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF"}

package/dist/esm/request/requestSupplementalData.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Supplemental data for the request
+ */
+export interface RequestSupplementalData {
+    contextKeysForAction: string[];
+    contextKeysForResource: string[];
+    contextKeysForPrincipal: string[];
+    contextKeyValidForRequest: (key: string) => boolean;
+}
+export declare class RequestSupplementalDataImpl implements RequestSupplementalData {
+    readonly contextKeysForAction: string[];
+    readonly contextKeysForResource: string[];
+    readonly contextKeysForPrincipal: string[];
+    private allActions;
+    constructor(contextKeysForAction: string[], contextKeysForResource: string[], contextKeysForPrincipal: string[]);
+    contextKeyValidForRequest(key: string): boolean;
+}
+export declare const MockRequestSupplementalData: RequestSupplementalData;
+//# sourceMappingURL=requestSupplementalData.d.ts.map

package/dist/esm/request/requestSupplementalData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestSupplementalData.d.ts","sourceRoot":"","sources":["../../../src/request/requestSupplementalData.ts"],"names":[],"mappings":"AACA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,yBAAyB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACrD;AAED,qBAAa,2BAA4B,YAAW,uBAAuB;aAI7C,oBAAoB,EAAE,MAAM,EAAE;aAC9B,sBAAsB,EAAE,MAAM,EAAE;aAChC,uBAAuB,EAAE,MAAM,EAAE;IAJ7D,OAAO,CAAC,UAAU,CAA0B;gBAEhB,oBAAoB,EAAE,MAAM,EAAE,EAC9B,sBAAsB,EAAE,MAAM,EAAE,EAChC,uBAAuB,EAAE,MAAM,EAAE;IAY7D,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAMhD;AAED,eAAO,MAAM,2BAA2B,EAAE,uBAKzC,CAAA"}