@cloud-copilot/iam-simulate 0.1.0

package/dist/esm/request/requestSupplementalData.js

@@ -0,0 +1,30 @@
+export class RequestSupplementalDataImpl {
+    constructor(contextKeysForAction, contextKeysForResource, contextKeysForPrincipal) {
+        this.contextKeysForAction = contextKeysForAction;
+        this.contextKeysForResource = contextKeysForResource;
+        this.contextKeysForPrincipal = contextKeysForPrincipal;
+        this.allActions = new Set();
+        for (const action of contextKeysForAction) {
+            this.allActions.add(action);
+        }
+        for (const resource of contextKeysForResource) {
+            this.allActions.add(resource);
+        }
+        for (const principal of contextKeysForPrincipal) {
+            this.allActions.add(...[principal]);
+        }
+    }
+    contextKeyValidForRequest(key) {
+        /*
+        Todo: Add a way to check if the key has a slash in it such as aws:RequestKeys or aws:ResourceTagKeys
+        */
+        return this.allActions.has(key);
+    }
+}
+export const MockRequestSupplementalData = {
+    contextKeysForAction: [],
+    contextKeysForResource: [],
+    contextKeysForPrincipal: [],
+    contextKeyValidForRequest: (key) => true
+};
+//# sourceMappingURL=requestSupplementalData.js.map

package/dist/esm/request/requestSupplementalData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestSupplementalData.js","sourceRoot":"","sources":["../../../src/request/requestSupplementalData.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,2BAA2B;IAItC,YAA4B,oBAA8B,EAC9B,sBAAgC,EAChC,uBAAiC;QAFjC,yBAAoB,GAApB,oBAAoB,CAAU;QAC9B,2BAAsB,GAAtB,sBAAsB,CAAU;QAChC,4BAAuB,GAAvB,uBAAuB,CAAU;QAJrD,eAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAK1C,KAAI,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QACD,KAAI,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/B,CAAC;QACD,KAAI,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,yBAAyB,CAAC,GAAW;QACnC;;UAEE;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,2BAA2B,GAA4B;IAClE,oBAAoB,EAAE,EAAE;IACxB,sBAAsB,EAAE,EAAE;IAC1B,uBAAuB,EAAE,EAAE;IAC3B,yBAAyB,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI;CACjD,CAAA"}

package/dist/esm/request.d.ts

@@ -0,0 +1,15 @@
+import { RequestContext } from "./requestContext.js";
+export interface Request {
+    principal: string;
+    action: string;
+    resource: string;
+    context: RequestContext;
+}
+export declare class RequestImpl implements Request {
+    readonly principal: string;
+    readonly resource: string;
+    readonly action: string;
+    readonly context: RequestContext;
+    constructor(principal: string, resource: string, action: string, context: RequestContext);
+}
+//# sourceMappingURL=request.d.ts.map

package/dist/esm/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAA;CACxB;AAED,qBAAa,WAAY,YAAW,OAAO;aAEb,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;aACd,OAAO,EAAE,cAAc;gBAHvB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,cAAc;CAGpD"}

package/dist/esm/request.js

@@ -0,0 +1,9 @@
+export class RequestImpl {
+    constructor(principal, resource, action, context) {
+        this.principal = principal;
+        this.resource = resource;
+        this.action = action;
+        this.context = context;
+    }
+}
+//# sourceMappingURL=request.js.map

package/dist/esm/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/request.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,WAAW;IAEtB,YAA4B,SAAiB,EACjB,QAAgB,EAChB,MAAc,EACd,OAAuB;QAHvB,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAgB;IAEnD,CAAC;CACF"}

package/dist/esm/requestContext.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The context metadata available in a request
+ */
+export interface RequestContext {
+    /**
+     * Check if a context key exists in a request
+     * @param name the name of the context key to check for, case insensitive
+     * @returns true if the context key exists, false otherwise
+     */
+    contextKeyExists: (name: string) => boolean;
+    /**
+     * Get the value of a context key in a request
+     *
+     * @param name the name of the context key to get the value of, case insensitive
+     * @returns the value of the context key
+     */
+    contextKeyValue: (name: string) => ContextKey;
+}
+/**
+ * A context key in a request
+ */
+export interface ContextKey {
+    /**
+     * The name of the context key
+     */
+    name: string;
+    /**
+     * Check if the context key is a string value
+     */
+    isStringValue(): this is StringContextKey;
+    /**
+     * Check if the context key is an array value
+     */
+    isArrayValue(): this is ArrayContextKey;
+}
+export interface StringContextKey extends ContextKey {
+    /**
+     * The value of the context key if it is a string
+     */
+    value: string;
+}
+export interface ArrayContextKey extends ContextKey {
+    /**
+     * The array of values of the context key if it is an array
+     */
+    values: string[];
+}
+export declare class RequestContextImpl implements RequestContext {
+    private context;
+    constructor(values: Record<string, string | string[]>);
+    contextKeyExists(name: string): boolean;
+    contextKeyValue(name: string): ContextKey;
+}
+export declare class ContextKeyImpl implements ContextKey, StringContextKey, ArrayContextKey {
+    name: string;
+    private _val;
+    constructor(name: string, _val: string | string[]);
+    isStringValue(): this is StringContextKey;
+    isArrayValue(): this is ArrayContextKey;
+    get values(): string[];
+    get value(): string;
+}
+//# sourceMappingURL=requestContext.d.ts.map

package/dist/esm/requestContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.d.ts","sourceRoot":"","sources":["../../src/requestContext.ts"],"names":[],"mappings":"AACA;;GAEG;AACH,MAAM,WAAW,cAAc;IAE7B;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAE5C;;;;;OAKG;IACH,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,aAAa,IAAI,IAAI,IAAI,gBAAgB,CAAC;IAE1C;;OAEG;IACH,YAAY,IAAI,IAAI,IAAI,eAAe,CAAC;CACzC;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAElD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IAEjD;;OAEG;IAEH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,OAAO,CAAsC;gBAEzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAO9C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIvC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU;CAIjD;AAED,qBAAa,cAAe,YAAW,UAAU,EAAE,gBAAgB,EAAE,eAAe;IAC/D,IAAI,EAAE,MAAM;IAAE,OAAO,CAAC,IAAI;gBAA1B,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAEhE,aAAa,IAAI,IAAI,IAAI,gBAAgB;IAGzC,YAAY,IAAI,IAAI,IAAI,eAAe;IAIvC,IAAI,MAAM,IAAI,MAAM,EAAE,CAKrB;IAED,IAAI,KAAK,IAAI,MAAM,CAKlB;CACF"}

package/dist/esm/requestContext.js

@@ -0,0 +1,39 @@
+export class RequestContextImpl {
+    constructor(values) {
+        this.context = new Map();
+        for (const key in values) {
+            this.context.set(key.toLowerCase(), new ContextKeyImpl(key, values[key]));
+        }
+    }
+    contextKeyExists(name) {
+        return this.context.has(name.toLowerCase());
+    }
+    contextKeyValue(name) {
+        return this.context.get(name.toLowerCase());
+    }
+}
+export class ContextKeyImpl {
+    constructor(name, _val) {
+        this.name = name;
+        this._val = _val;
+    }
+    isStringValue() {
+        return typeof this._val === 'string';
+    }
+    isArrayValue() {
+        return Array.isArray(this._val);
+    }
+    get values() {
+        if (Array.isArray(this._val)) {
+            return this._val;
+        }
+        throw new Error(`ContextKey ${this.name} is not an array`);
+    }
+    get value() {
+        if (typeof this._val === 'string') {
+            return this._val;
+        }
+        throw new Error(`ContextKey ${this.name} is not a string`);
+    }
+}
+//# sourceMappingURL=requestContext.js.map

package/dist/esm/requestContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.js","sourceRoot":"","sources":["../../src/requestContext.ts"],"names":[],"mappings":"AA2DA,MAAM,OAAO,kBAAkB;IAG7B,YAAY,MAAyC;QAF7C,YAAO,GAA4B,IAAI,GAAG,EAAE,CAAC;QAGnD,KAAI,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAGM,gBAAgB,CAAC,IAAY;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEM,eAAe,CAAC,IAAY;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAe,CAAC;IAE5D,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACzB,YAAmB,IAAY,EAAU,IAAuB;QAA7C,SAAI,GAAJ,IAAI,CAAQ;QAAU,SAAI,GAAJ,IAAI,CAAmB;IAAG,CAAC;IAEpE,aAAa;QACX,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;IACvC,CAAC;IACD,YAAY;QACV,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,MAAM;QACR,IAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,KAAK;QACP,IAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/esm/resource/resource.d.ts

@@ -0,0 +1,12 @@
+import { Resource } from "@cloud-copilot/iam-policy";
+import { AwsRequest } from "../request/request.js";
+/**
+ * Check if a request matches a set of resources.
+ *
+ * @param request the request to check
+ * @param policyResources the resources to check against
+ * @returns true if the request matches any of the resources, false otherwise
+ */
+export declare function requestMatchesResources(request: AwsRequest, policyResources: Resource[]): boolean;
+export declare function requestMatchesNotResources(request: AwsRequest, policyResources: Resource[]): boolean;
+//# sourceMappingURL=resource.d.ts.map

package/dist/esm/resource/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../src/resource/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAmBnD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,OAAO,CAEjG;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,OAAO,CAEpG"}

package/dist/esm/resource/resource.js

@@ -0,0 +1,97 @@
+import { convertIamStringToRegex } from "../util.js";
+//TODO: Make a check to see if the action is a wildcard only action. This will have to happen outside of these functions.
+/**
+ * Convert a resource segment to a regular expression. This is without variables.
+ *
+ * @param segment the segment to convert to a regular expression
+ * @returns a regular that replaces any wildcards in the segment with the appropriate regular expression.
+ */
+function convertResourceSegmentToRegex(segment) {
+    if (segment.indexOf(':') != -1) {
+        throw new Error('Segment should not contain a colon');
+    }
+    const pattern = "^" + segment.replace(/\?/g, '.').replace(/\*/g, '.*?') + "$";
+    return new RegExp(pattern, 'i');
+}
+/**
+ * Check if a request matches a set of resources.
+ *
+ * @param request the request to check
+ * @param policyResources the resources to check against
+ * @returns true if the request matches any of the resources, false otherwise
+ */
+export function requestMatchesResources(request, policyResources) {
+    return policyResources.some(policyResource => singleResourceMatchesRequest(request, policyResource));
+}
+export function requestMatchesNotResources(request, policyResources) {
+    return !requestMatchesResources(request, policyResources);
+}
+/**
+ * Check if a single resource matches a request.
+ *
+ * @param request the request to check against
+ * @param policyResource the resource to check against
+ * @returns true if the request matches the resource, false otherwise
+ */
+function singleResourceMatchesRequest(request, policyResource) {
+    if (policyResource.isAllResources()) {
+        return true;
+    }
+    else if (policyResource.isArnResource()) {
+        if (!request.resource) {
+            return false;
+        }
+        const resource = request.resource;
+        if (!convertResourceSegmentToRegex(policyResource.partition()).test(resource.partition())) {
+            return false;
+        }
+        if (!convertResourceSegmentToRegex(policyResource.service()).test(resource.service())) {
+            return false;
+        }
+        if (!convertResourceSegmentToRegex(policyResource.region()).test(resource.region())) {
+            return false;
+        }
+        if (!convertResourceSegmentToRegex(policyResource.account()).test(resource.account())) {
+            return false;
+        }
+        //Wildcards and variables are not allowed in the product segment https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html "Incorrect wildcard usage"
+        const [policyProduct, policyResourceId] = getResourceSegments(policyResource.resource());
+        if (!resource.resource().startsWith(policyProduct)) {
+            return false;
+        }
+        const requestResourceId = resource.resource().slice(policyProduct.length);
+        if (!convertIamStringToRegex(policyResourceId, request).test(requestResourceId)) {
+            return false;
+        }
+        return true;
+    }
+    else {
+        throw new Error('Unknown resource type');
+    }
+}
+/**
+ * Splits a resource into two segments. The first segment is the product segment and the second segment is the resource id segment.
+ * This could be split by a colon or a slash, so it checks for both.
+ *
+ * @param resource The resource to split
+ * @returns a tuple with the first segment being the product segment (including the separator) and the second segment being the resource id.
+ */
+function getResourceSegments(resource) {
+    const slashIndex = resource.indexOf('/');
+    const colonIndex = resource.indexOf(':');
+    let splitIndex = slashIndex;
+    if (slashIndex != -1 && colonIndex != -1) {
+        splitIndex = Math.min(slashIndex, colonIndex) + 1;
+    }
+    else if (colonIndex == -1) {
+        splitIndex = slashIndex + 1;
+    }
+    else if (slashIndex == -1) {
+        splitIndex = colonIndex + 1;
+    }
+    else {
+        throw new Error(`Unable to split resource ${resource}`);
+    }
+    return [resource.slice(0, splitIndex), resource.slice(splitIndex)];
+}
+//# sourceMappingURL=resource.js.map

package/dist/esm/resource/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../src/resource/resource.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErD,yHAAyH;AAEzH;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,OAAe;IACpD,IAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAC7E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAmB,EAAE,eAA2B;IACtF,OAAO,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,4BAA4B,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAA;AACtG,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAmB,EAAE,eAA2B;IACzF,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CAAC,OAAmB,EAAE,cAAwB;IACjF,IAAG,cAAc,CAAC,cAAc,EAAE,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;SAAM,IAAG,cAAc,CAAC,aAAa,EAAE,EAAE,CAAC;QACzC,IAAG,CAAC,OAAO,CAAC,QAAQ,EAAG,CAAC;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,IAAG,CAAC,6BAA6B,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACzF,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAG,CAAC,6BAA6B,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACrF,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAG,CAAC,6BAA6B,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACnF,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAG,CAAC,6BAA6B,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACrF,OAAO,KAAK,CAAA;QACd,CAAC;QAED,gKAAgK;QAChK,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,mBAAmB,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAA;QAExF,IAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAEzE,IAAG,CAAC,uBAAuB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,UAAU,GAAG,UAAU,CAAA;IAC3B,IAAG,UAAU,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QACxC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;IAC7B,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;AACpE,CAAC"}

package/dist/esm/util.d.ts

@@ -0,0 +1,15 @@
+import { AwsRequest } from './request/request.js';
+interface StringReplaceOptions {
+    replaceWildcards: boolean;
+}
+/**
+ * This will convert a string to a regex that can be used to match against a string.
+ * This will replace any variables in the string with the value of the variable in the request context.
+ *
+ * @param value the string to convert to a regex
+ * @param requestContext the request context to get the variable values from
+ * @returns a regex that can be used to match against a string
+ */
+export declare function convertIamStringToRegex(value: string, request: AwsRequest, replaceOptions?: Partial<StringReplaceOptions>): RegExp;
+export {};
+//# sourceMappingURL=util.d.ts.map

package/dist/esm/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../src/util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAIjD,UAAU,oBAAoB;IAC5B,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAMD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,CA2DlI"}

package/dist/esm/util.js

@@ -0,0 +1,97 @@
+const matchesNothing = new RegExp('a^');
+const defaultStringReplaceOptions = {
+    replaceWildcards: true
+};
+/**
+ * This will convert a string to a regex that can be used to match against a string.
+ * This will replace any variables in the string with the value of the variable in the request context.
+ *
+ * @param value the string to convert to a regex
+ * @param requestContext the request context to get the variable values from
+ * @returns a regex that can be used to match against a string
+ */
+export function convertIamStringToRegex(value, request, replaceOptions) {
+    const options = { ...defaultStringReplaceOptions, ...replaceOptions };
+    let invalidVariableFound = false;
+    const newValue = value.replaceAll(/(\$\{.*?\})|(\*)|(\?)/ig, (match, args) => {
+        if (match == "?") {
+            return replacementValue('\\?', '.', options.replaceWildcards);
+            // return '.'
+        }
+        else if (match == "*") {
+            return replacementValue('\\*', ".*?", options.replaceWildcards);
+            // return ".*?"
+        }
+        else if (match == "${*}") {
+            return replacementValue("\\$\\{\\*\\}", "\\*", options.replaceWildcards);
+            // return "\\*"
+        }
+        else if (match == "${?}") {
+            return replacementValue("\\$\\{\\?\\}", "\\?", options.replaceWildcards);
+            // return "\\?"
+        }
+        else if (match == "${$}") {
+            return replacementValue("\\$\\{\\$\\}", "\\$", options.replaceWildcards);
+            // return "\\$"
+        }
+        //
+        //This means it'a a variable
+        const inTheBrackets = match.slice(2, -1);
+        let defaultValue = undefined;
+        const defaultParts = inTheBrackets.split(', ');
+        if (defaultParts.length == 2) {
+            const segmentAfterComma = defaultParts.at(1);
+            if (segmentAfterComma?.startsWith("'") && segmentAfterComma.endsWith("'")) {
+                defaultValue = segmentAfterComma.slice(1, -1);
+            }
+        }
+        const variableName = defaultParts.at(0).trim();
+        const requestValue = getContextSingleValue(request, variableName);
+        if (requestValue) {
+            return requestValue;
+        }
+        else if (defaultValue) {
+            /*
+              TODO: What happens in a request if a multi value context key is used in a string and there
+              is a default value? Will it use the default value or will it fail the condition test?
+            */
+            return defaultValue;
+        }
+        else {
+            invalidVariableFound = true;
+            /*
+            https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#policy-vars-no-value
+            */
+            return "--undefined---";
+        }
+        throw new Error('This should never happen');
+    });
+    if (invalidVariableFound) {
+        return matchesNothing;
+    }
+    return new RegExp('^' + newValue + '$');
+}
+/**
+ * Get the string value of a context key only if it is a single value key
+ *
+ * @param requestContext the request context to get the value from
+ * @param contextKeyName the name of the context key to get the value of
+ * @returns the value of the context key if it is a single value key, undefined otherwise
+ */
+function getContextSingleValue(request, contextKeyName) {
+    if (!request.contextKeyExists(contextKeyName)) {
+        return undefined;
+    }
+    const keyValue = request.getContextKeyValue(contextKeyName);
+    if (keyValue.isStringValue()) {
+        return keyValue.value;
+    }
+    return undefined;
+}
+function replacementValue(rawString, wildcard, replaceWildcards) {
+    if (replaceWildcards) {
+        return wildcard;
+    }
+    return rawString;
+}
+//# sourceMappingURL=util.js.map

package/dist/esm/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/util.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAA;AAMvC,MAAM,2BAA2B,GAAyB;IACxD,gBAAgB,EAAE,IAAI;CACvB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,OAAmB,EAAE,cAA8C;IACxH,MAAM,OAAO,GAAG,EAAC,GAAG,2BAA2B,EAAE,GAAG,cAAc,EAAC,CAAA;IAEnE,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3E,IAAG,KAAK,IAAI,GAAG,EAAE,CAAC;YAChB,OAAO,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;YAC7D,aAAa;QACf,CAAC;aAAM,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;YAC/D,eAAe;QACjB,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,gBAAgB,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;YACxE,eAAe;QACjB,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,gBAAgB,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;YACxE,eAAe;QACjB,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,gBAAgB,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;YACxE,eAAe;QACjB,CAAC;QACD,EAAE;QACF,4BAA4B;QAC5B,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAExC,IAAI,YAAY,GAAG,SAAS,CAAA;QAC5B,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAG,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,iBAAiB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5C,IAAG,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzE,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;QAE/C,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAEjE,IAAG,YAAY,EAAE,CAAC;YAChB,OAAO,YAAY,CAAA;QACrB,CAAC;aAAM,IAAG,YAAY,EAAE,CAAC;YACvB;;;cAGE;YACF,OAAO,YAAY,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,oBAAoB,GAAG,IAAI,CAAA;YAC3B;;cAEE;YACF,OAAO,gBAAgB,CAAA;QACzB,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IACF,IAAG,oBAAoB,EAAE,CAAC;QACxB,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAA;AACzC,CAAC;AAGD;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,OAAmB,EAAE,cAAsB;IACxE,IAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAC3D,IAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,KAAK,CAAA;IACvB,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,QAAgB,EAAE,gBAAyB;IACtF,IAAG,gBAAgB,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@cloud-copilot/iam-simulate",
+  "version": "0.1.0",
+  "description": "Simulate evaluation of AWS IAM policies",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cloud-copilot/iam-simulate.git"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    }
+  },
+  "files": [
+    "dist/**/*"
+  ],
+  "types": "dist/cjs/index.d.ts",
+  "scripts": {
+    "build": "npx tsc -p tsconfig.cjs.json && npx tsc -p tsconfig.esm.json && ./postbuild.sh",
+    "clean": "rm -rf dist",
+    "test": "npx vitest --run --coverage",
+    "release": "npm run clean && npm run build && npm run test && npm publish"
+  },
+  "keywords": [
+    "AWS",
+    "IAM"
+  ],
+  "author": "David Kerber <dave@cloudcopilot.io>",
+  "license": "AGPL-3.0-or-later",
+  "bugs": {
+    "url": "https://github.com/cloud-copilot/iam-simulate/issues"
+  },
+  "homepage": "https://github.com/cloud-copilot/iam-simulate#readme",
+  "devDependencies": {
+    "@types/node": "^22.5.0",
+    "@vitest/coverage-v8": "^2.0.5",
+    "typescript": "^5.5.4",
+    "vitest": "^2.0.5"
+  },
+  "dependencies": {
+    "@cloud-copilot/iam-data": ">=0.8.0 <1.0.0",
+    "@cloud-copilot/iam-policy": "0.0.9"
+  }
+}