@cloud-copilot/iam-simulate 0.1.102 → 0.1.104

package/README.md

@@ -147,16 +147,24 @@ const simulation: Simulation = {
   }
 }
 
-const result = await runSimulation(simulation, {})
-//Check for validation errors:
-if (result.errors) {
-  console.log(result.errors.message)
-  console.log(JSON.stringify(result.errors, null, 2))
+`runSimulation` returns a discriminated union with `resultType`:
+
+- `resultType: 'error'` includes `errors` and no simulation results.
+- `resultType: 'single'` includes `overallResult` and a single `result`.
+- `resultType: 'wildcard'` includes `overallResult` and `results` for each matching pattern.
+
+const response = await runSimulation(simulation, {})
+//Check for validation errors (errors are returned at the response level):
+if (response.resultType === 'error') {
+  console.log(response.errors.message)
+  console.log(JSON.stringify(response.errors, null, 2))
 }
 
 //The simulation ran successfully
-if (result.analysis) {
-  console.log(result.analysis.result) // 'Allowed', 'ExplicityDenied', or 'ImplicitlyDenied'
+if (response.resultType === 'single') {
+  const result = response.result
+  console.log(response.overallResult) // 'Allowed', 'ExplicitlyDenied', or 'ImplicitlyDenied'
+  console.log(result.analysis?.result)
 
   //Output the identity statements that allowed the request
   const identityAllowExplains =
@@ -166,6 +174,13 @@ if (result.analysis) {
     console.log(explain)
   }
 }
+
+if (response.resultType === 'wildcard') {
+  console.log(response.overallResult)
+  for (const result of response.results) {
+    console.log(result.resourcePattern, result.analysis?.result)
+  }
+}
 ```
 
 This would output an explain that shows how the identity statement was evaluated:

package/dist/cjs/index.d.ts

@@ -8,7 +8,7 @@ export type { ActionExplain, ConditionExplain, ConditionValueExplain, ExplainPri
 export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
 export type { Simulation, SimulationIdentityPolicy, SimulationOrgPolicies } from './simulation_engine/simulation.js';
 export { runSimulation } from './simulation_engine/simulationEngine.js';
-export type { SimulationErrors, SimulationResult } from './simulation_engine/simulationEngine.js';
+export type { ErrorSimulationResult, RunSimulationResults, SimulationErrors, SimulationResourceResult, SimulationResultType, SingleResourceSimulationResult, SuccessfulRunSimulationResults, WildcardResourceSimulationResults, WildcardSimulationResourceResult } from './simulation_engine/simulationEngine.js';
 export type { SimulationOptions } from './simulation_engine/simulationOptions.js';
 export { runUnsafeSimulation } from './simulation_engine/unsafeSimulationEngine.js';
 export { isWildcardOnlyAction } from './util.js';

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,YAAY,EACV,UAAU,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AACvE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AACjG,YAAY,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,YAAY,EACV,UAAU,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AACvE,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EACjC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,kEAIqC;AAHnC,qHAAA,gBAAgB,OAAA;AAIlB,gEAAiE;AAAxD,mHAAA,iBAAiB,OAAA;AAC1B,wEAI0C;AAFxC,yHAAA,mBAAmB,OAAA;AAGrB,wEAAmE;AAA1D,qHAAA,eAAe,OAAA;AAiBxB,qEAAiF;AAAxE,8HAAA,4BAA4B,OAAA;AAMrC,+EAAuE;AAA9D,oHAAA,aAAa,OAAA;AAGtB,2FAAmF;AAA1E,gIAAA,mBAAmB,OAAA;AAC5B,qCAAgD;AAAvC,+GAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,kEAIqC;AAHnC,qHAAA,gBAAgB,OAAA;AAIlB,gEAAiE;AAAxD,mHAAA,iBAAiB,OAAA;AAC1B,wEAI0C;AAFxC,yHAAA,mBAAmB,OAAA;AAGrB,wEAAmE;AAA1D,qHAAA,eAAe,OAAA;AAiBxB,qEAAiF;AAAxE,8HAAA,4BAA4B,OAAA;AAMrC,+EAAuE;AAA9D,oHAAA,aAAa,OAAA;AAatB,2FAAmF;AAA1E,gIAAA,mBAAmB,OAAA;AAC5B,qCAAgD;AAAvC,+GAAA,oBAAoB,OAAA"}

package/dist/cjs/request/requestResource.d.ts

@@ -27,6 +27,16 @@ export interface RequestResource {
      * The account ID of the resource, independent of what is in the ARN
      */
     accountId(): string;
+    /**
+     * Checks if this resource represents all resources (i.e., the wildcard "*")
+     * @returns true if the resource is "*", false otherwise
+     */
+    isAllResources(): boolean;
+    /**
+     * Checks if this resource contains any wildcard characters
+     * @returns true if the resource contains "*", false otherwise
+     */
+    hasWildcards(): boolean;
 }
 export declare class ResourceRequestImpl implements RequestResource {
     private readonly rawValue;
@@ -39,5 +49,7 @@ export declare class ResourceRequestImpl implements RequestResource {
     resource(): string;
     value(): string;
     accountId(): string;
+    isAllResources(): boolean;
+    hasWildcards(): boolean;
 }
 //# sourceMappingURL=requestResource.d.ts.map

package/dist/cjs/request/requestResource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestResource.d.ts","sourceRoot":"","sources":["../../../src/request/requestResource.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;IAEnB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;IAEhB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,QAAQ,IAAI,MAAM,CAAA;IAElB;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;CACpB;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAEvD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,eAAe;gBADf,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM;IAG1C,SAAS,IAAI,MAAM;IAInB,OAAO,IAAI,MAAM;IAIjB,MAAM,IAAI,MAAM;IAIhB,OAAO,IAAI,MAAM;IAIjB,QAAQ,IAAI,MAAM;IAIlB,KAAK,IAAI,MAAM;IAIf,SAAS,IAAI,MAAM;CAGpB"}
+{"version":3,"file":"requestResource.d.ts","sourceRoot":"","sources":["../../../src/request/requestResource.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;IAEnB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;IAEhB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,QAAQ,IAAI,MAAM,CAAA;IAElB;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;IAEnB;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAA;IAEzB;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAA;CACxB;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAEvD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,eAAe;gBADf,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM;IAG1C,SAAS,IAAI,MAAM;IAInB,OAAO,IAAI,MAAM;IAIjB,MAAM,IAAI,MAAM;IAIhB,OAAO,IAAI,MAAM;IAIjB,QAAQ,IAAI,MAAM;IAIlB,KAAK,IAAI,MAAM;IAIf,SAAS,IAAI,MAAM;IAInB,cAAc,IAAI,OAAO;IAIzB,YAAY,IAAI,OAAO;CAGxB"}

package/dist/cjs/request/requestResource.js

@@ -29,6 +29,12 @@ class ResourceRequestImpl {
     accountId() {
         return this.accountIdString;
     }
+    isAllResources() {
+        return this.value() === '*';
+    }
+    hasWildcards() {
+        return this.value().includes('*');
+    }
 }
 exports.ResourceRequestImpl = ResourceRequestImpl;
 //# sourceMappingURL=requestResource.js.map

package/dist/cjs/request/requestResource.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestResource.js","sourceRoot":"","sources":["../../../src/request/requestResource.ts"],"names":[],"mappings":";;;AAqCA,MAAa,mBAAmB;IAEX;IACA;IAFnB,YACmB,QAAgB,EAChB,eAAuB;QADvB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,oBAAe,GAAf,eAAe,CAAQ;IACvC,CAAC;IAEJ,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;CACF;AAjCD,kDAiCC"}
+{"version":3,"file":"requestResource.js","sourceRoot":"","sources":["../../../src/request/requestResource.ts"],"names":[],"mappings":";;;AAiDA,MAAa,mBAAmB;IAEX;IACA;IAFnB,YACmB,QAAgB,EAChB,eAAuB;QADvB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,oBAAe,GAAf,eAAe,CAAQ;IACvC,CAAC;IAEJ,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IACvC,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAA;IAC7B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;CACF;AAzCD,kDAyCC"}

package/dist/cjs/resource/resource.d.ts

@@ -19,7 +19,7 @@ export declare function requestMatchesStatementResources(request: AwsRequest, st
  * @param policyResources the resources to check against
  * @returns true if the request matches any of the resources, false otherwise
  */
-export declare function requestMatchesResources(request: AwsRequest, policyResources: Resource[]): {
+export declare function requestMatchesResources(request: AwsRequest, policyResources: Resource[], resourceType: 'Resource' | 'NotResource', effect: 'Allow' | 'Deny'): {
     matches: boolean;
     explains: ResourceExplain[];
 };
@@ -30,8 +30,17 @@ export declare function requestMatchesResources(request: AwsRequest, policyResou
  * @param policyResources the resources to check against
  * @returns true if the request does not match any of the resources, false otherwise
  */
-export declare function requestMatchesNotResources(request: AwsRequest, policyResources: Resource[]): {
+export declare function requestMatchesNotResources(request: AwsRequest, policyResources: Resource[], resourceType: 'Resource' | 'NotResource', effect: 'Allow' | 'Deny'): {
     matches: boolean;
     explains: ResourceExplain[];
 };
+/**
+ * Determines if the policy string is equal to, a subset of, a superset of,
+ * or has no overlap with the request string.
+ *
+ * @param policyString the policy string to use
+ * @param requestString the request string to compare to the policy string
+ * @returns 'equal' if the strings are equal, 'subset' if the policy string is a subset of the request string, 'superset' if the policy string is a superset of the request string, or 'none' if there is no overlap
+ */
+export declare function resourcePatternOverlap(policyString: string, requestString: string): 'equal' | 'policy_is_subset' | 'policy_is_superset' | 'none';
 //# sourceMappingURL=resource.d.ts.map

package/dist/cjs/resource/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../src/resource/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAiBlD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,GACnB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,cAAc,CAAC,CAAA;CAAE,CAerF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,QAAQ,EAAE,GAC1B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE,CAMnD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,QAAQ,EAAE,GAC1B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE,CAUnD"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../src/resource/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAiBlD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,GACnB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,cAAc,CAAC,CAAA;CAAE,CAyBrF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,QAAQ,EAAE,EAC3B,YAAY,EAAE,UAAU,GAAG,aAAa,EACxC,MAAM,EAAE,OAAO,GAAG,MAAM,GACvB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE,CAMnD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,QAAQ,EAAE,EAC3B,YAAY,EAAE,UAAU,GAAG,aAAa,EACxC,MAAM,EAAE,OAAO,GAAG,MAAM,GACvB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE,CAUnD;AA8OD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,GAAG,kBAAkB,GAAG,oBAAoB,GAAG,MAAM,CAe9D"}

package/dist/cjs/resource/resource.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestMatchesStatementResources = requestMatchesStatementResources;
 exports.requestMatchesResources = requestMatchesResources;
 exports.requestMatchesNotResources = requestMatchesNotResources;
+exports.resourcePatternOverlap = resourcePatternOverlap;
 const util_js_1 = require("../util.js");
 /**
  * Convert a resource segment to a regular expression. This is without variables.
@@ -26,14 +27,14 @@ function convertResourceSegmentToRegex(segment) {
  */
 function requestMatchesStatementResources(request, statement) {
     if (statement.isResourceStatement()) {
-        const { matches, explains } = requestMatchesResources(request, statement.resources());
+        const { matches, explains } = requestMatchesResources(request, statement.resources(), 'Resource', statement.effect());
         if (!statement.resourceIsArray()) {
             return { matches, details: { resources: explains[0] } };
         }
         return { matches, details: { resources: explains } };
     }
     else if (statement.isNotResourceStatement()) {
-        const { matches, explains } = requestMatchesNotResources(request, statement.notResources());
+        const { matches, explains } = requestMatchesNotResources(request, statement.notResources(), 'NotResource', statement.effect());
         if (!statement.notResourceIsArray()) {
             return { matches, details: { notResources: explains[0] } };
         }
@@ -48,8 +49,8 @@ function requestMatchesStatementResources(request, statement) {
  * @param policyResources the resources to check against
  * @returns true if the request matches any of the resources, false otherwise
  */
-function requestMatchesResources(request, policyResources) {
-    const explains = policyResources.map((policyResource) => singleResourceMatchesRequest(request, policyResource));
+function requestMatchesResources(request, policyResources, resourceType, effect) {
+    const explains = policyResources.map((policyResource) => singleResourceMatchesRequest(request, policyResource, resourceType, effect));
     const matches = explains.some((explain) => explain.matches);
     return { matches, explains };
 }
@@ -60,9 +61,9 @@ function requestMatchesResources(request, policyResources) {
  * @param policyResources the resources to check against
  * @returns true if the request does not match any of the resources, false otherwise
  */
-function requestMatchesNotResources(request, policyResources) {
+function requestMatchesNotResources(request, policyResources, resourceType, effect) {
     const explains = policyResources.map((policyResource) => {
-        const explain = singleResourceMatchesRequest(request, policyResource);
+        const explain = singleResourceMatchesRequest(request, policyResource, resourceType, effect);
         if (!explain.errors) {
             explain.matches = !explain.matches;
         }
@@ -71,6 +72,40 @@ function requestMatchesNotResources(request, policyResources) {
     const matches = !explains.some((explain) => !explain.matches);
     return { matches, explains };
 }
+/*
+Specifications for **request resource** wildcards:
+- Asterisks (*) can be used to match any sequence of characters (including an empty sequence)
+- Asterisks can appear in any segment of the ARN (partition, service, region, account, resource)
+- Asterisks are not greedy, and can be followed or preceded by other characters in the same segment
+- Existing rules of matching wildcard segments in ARNs still apply
+- Question marks (?) are not supported in the request resource ARN
+
+If the string in the policy is the same as the resolved string after variable substitution, it is a match
+
+For an Allow/Resource Statement:
+- If the resolved string matches the request resource, it is a match
+- If the resolved string is a superset of the request resource, it is a match
+- If the resolved string is a subset of the request resource, it is a match
+- If there is no overlap at all between the resolved string and the request resource, it is not a match
+
+For a Deny/Resource Statement:
+- If the resolved string matches the request resource, it is a match
+- If the resolved string is a superset of the request resource, it is a match
+- If the resolved string is a subset of the request resource, it is not a match
+- If there is no overlap at all between the resolved string and the request resource, it is not a match
+
+For an Allow/NotResource Statement:
+- If the resolved string matches the request resource, it is not a match
+- If the resolved string is a superset of the request resource, it is not a match
+- If the resolved string is a subset of the request resource, it is a match
+- If there is no overlap at all between the resolved string and the request resource, it is a match
+
+For a Deny/NotResource Statement:
+- If the resolved string matches the request resource, it is not a match
+- If the resolved string is a superset of the request resource, it is not a match
+- If the resolved string is a subset of the request resource, it is not a match
+- If there is no overlap at all between the resolved string and the request resource, it is a match
+*/
 /**
  * Check if a single resource matches a request.
  *
@@ -78,14 +113,119 @@ function requestMatchesNotResources(request, policyResources) {
  * @param policyResource the resource to check against
  * @returns true if the request matches the resource, false otherwise
  */
-function singleResourceMatchesRequest(request, policyResource) {
+function singleResourceMatchesRequest(request, policyResource, resourceType, effect) {
+    // Policy is all resources
     if (policyResource.isAllResources()) {
         return {
             resource: policyResource.value(),
             matches: true
         };
     }
-    else if (policyResource.isArnResource()) {
+    // Request is all resources
+    if (request.resource?.isAllResources()) {
+        if (effect === 'Allow' && resourceType === 'Resource') {
+            return {
+                resource: policyResource.value(),
+                matches: true
+            };
+        }
+        else if (effect === 'Allow' && resourceType === 'NotResource') {
+            return {
+                resource: policyResource.value(),
+                matches: false // This gets inverted in the caller
+            };
+        }
+        else if (effect === 'Deny' && resourceType === 'Resource') {
+            // This is a Deny statement that is not all resources, so it's not a match
+            return {
+                resource: policyResource.value(),
+                matches: false
+            };
+        }
+        else if (effect === 'Deny' && resourceType === 'NotResource') {
+            return {
+                resource: policyResource.value(),
+                matches: true // This gets inverted in the caller
+            };
+        }
+        throw new Error(`Unknown Resource Type and Effect Combination: ${resourceType} ${effect}`);
+    }
+    // Request contains wildcards but neither is a full *
+    if (request.resource.hasWildcards() && policyResource.isArnResource()) {
+        const overlaps = [
+            resourcePatternOverlap(policyResource.partition(), request.resource.partition()),
+            resourcePatternOverlap(policyResource.service(), request.resource.service()),
+            resourcePatternOverlap(policyResource.region(), request.resource.region()),
+            resourcePatternOverlap(policyResource.account(), request.resource.account()),
+            resourcePatternOverlap(policyResource.resource(), request.resource.resource())
+        ];
+        if (resourceType === 'Resource' && effect === 'Allow') {
+            if (overlaps.every((o) => o !== 'none')) {
+                return {
+                    resource: policyResource.value(),
+                    matches: true
+                };
+            }
+        }
+        else if (resourceType === 'Resource' && effect === 'Deny') {
+            if (overlaps.some((o) => o === 'none' || o === 'policy_is_subset')) {
+                return {
+                    resource: policyResource.value(),
+                    matches: false
+                };
+            }
+        }
+        else if (resourceType === 'NotResource' && effect === 'Allow') {
+            /*
+             * For an Allow/NotResource Statement:
+                - If the resolved string matches the request resource, it is not a match
+                - If the resolved string is a superset of the request resource, it is not a match
+                - If the resolved string is a subset of the request resource, it is a match
+                - If there is no overlap at all between the resolved string and the request resource, it is a match
+             */
+            if (overlaps.every((o) => o === 'equal' || o === 'policy_is_superset')) {
+                return {
+                    resource: policyResource.value(),
+                    // This gets inverted in the caller
+                    matches: true
+                };
+            }
+            else {
+                return {
+                    resource: policyResource.value(),
+                    // This gets inverted in the caller
+                    matches: false
+                };
+            }
+        }
+        else if (resourceType === 'NotResource' && effect === 'Deny') {
+            /*
+              For a Deny/NotResource Statement:
+              - If the resolved string matches the request resource, it is not a match
+              - If the resolved string is a superset of the request resource, it is not a match
+              - If the resolved string is a subset of the request resource, it is not a match
+              - If there is no overlap at all between the resolved string and the request resource, it is a match
+            */
+            if (overlaps.some((o) => o === 'none')) {
+                return {
+                    resource: policyResource.value(),
+                    // This gets inverted in the caller
+                    matches: false
+                };
+            }
+            else {
+                return {
+                    resource: policyResource.value(),
+                    // This gets inverted in the caller
+                    matches: true
+                };
+            }
+        }
+        else {
+            throw new Error(`Unknown Resource Type and Effect Combination: ${resourceType} ${effect}`);
+        }
+    }
+    if (policyResource.isArnResource()) {
         if (!request.resource) {
             return {
                 resource: policyResource.value(),
@@ -158,4 +298,26 @@ function singleResourceMatchesRequest(request, policyResource) {
         throw new Error('Unknown resource type');
     }
 }
+/**
+ * Determines if the policy string is equal to, a subset of, a superset of,
+ * or has no overlap with the request string.
+ *
+ * @param policyString the policy string to use
+ * @param requestString the request string to compare to the policy string
+ * @returns 'equal' if the strings are equal, 'subset' if the policy string is a subset of the request string, 'superset' if the policy string is a superset of the request string, or 'none' if there is no overlap
+ */
+function resourcePatternOverlap(policyString, requestString) {
+    if (policyString === requestString) {
+        return 'equal';
+    }
+    const requestPattern = '^' + requestString.replace(/\*/g, '.*?') + '$';
+    if (policyString.match(requestPattern)) {
+        return 'policy_is_subset';
+    }
+    const policyPattern = '^' + policyString.replace(/\?/g, '.').replace(/\*/g, '.*?') + '$';
+    if (requestString.match(policyPattern)) {
+        return 'policy_is_superset';
+    }
+    return 'none';
+}
 //# sourceMappingURL=resource.js.map

package/dist/cjs/resource/resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../src/resource/resource.ts"],"names":[],"mappings":";;AA0BA,4EAkBC;AASD,0DASC;AASD,gEAaC;AAjFD,wCAAkE;AAElE;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,OAAe;IACpD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAC7E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gCAAgC,CAC9C,OAAmB,EACnB,SAAoB;IAEpB,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;QACrF,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAA;IACtD,CAAC;SAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAA;QAC3F,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAC5D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,OAAmB,EACnB,eAA2B;IAE3B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CACtD,4BAA4B,CAAC,OAAO,EAAE,cAAc,CAAC,CACtD,CAAA;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,0BAA0B,CACxC,OAAmB,EACnB,eAA2B;IAE3B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QACrE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAA;QACpC,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CACnC,OAAmB,EACnB,cAAwB;IAExB,IAAI,cAAc,CAAC,cAAc,EAAE,EAAE,CAAC;QACpC,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;SAAM,IAAI,cAAc,CAAC,aAAa,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,kCAAkC,CAAC;aAC7C,CAAA;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,0BAA0B,CAAC;aACrC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,wBAAwB,CAAC;aACnC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACpF,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,uBAAuB,CAAC;aAClC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,wBAAwB,CAAC;aACnC,CAAA;QACH,CAAC;QAED,gKAAgK;QAChK,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,IAAA,6BAAmB,EAAC,cAAc,CAAC,CAAA;QAC7E,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,wBAAwB,CAAC;aACnC,CAAA;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QACzE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,0BAAgB,EAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QACvE,MAAM,kBAAkB,GAAG,IAAA,0BAAgB,EAAC,gBAAgB,EAAE,OAAO,EAAE;YACrE,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QACF,MAAM,gBAAgB,GACpB,cAAc,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACxF,kBAAkB,CAAA;QACpB,MAAM,aAAa,GAAG,gBAAgB,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;QAEhG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,aAAa;aACd,CAAA;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,IAAI;YACb,aAAa;SACd,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC1C,CAAC;AACH,CAAC"}
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../src/resource/resource.ts"],"names":[],"mappings":";;AA0BA,4EA4BC;AASD,0DAWC;AASD,gEAeC;AAsPD,wDAkBC;AAvWD,wCAAkE;AAElE;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,OAAe;IACpD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAC7E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gCAAgC,CAC9C,OAAmB,EACnB,SAAoB;IAEpB,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,uBAAuB,CACnD,OAAO,EACP,SAAS,CAAC,SAAS,EAAE,EACrB,UAAU,EACV,SAAS,CAAC,MAAM,EAAsB,CACvC,CAAA;QACD,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACzD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAA;IACtD,CAAC;SAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,0BAA0B,CACtD,OAAO,EACP,SAAS,CAAC,YAAY,EAAE,EACxB,aAAa,EACb,SAAS,CAAC,MAAM,EAAsB,CACvC,CAAA;QACD,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAC5D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,OAAmB,EACnB,eAA2B,EAC3B,YAAwC,EACxC,MAAwB;IAExB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CACtD,4BAA4B,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,CAC5E,CAAA;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,0BAA0B,CACxC,OAAmB,EACnB,eAA2B,EAC3B,YAAwC,EACxC,MAAwB;IAExB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;QAC3F,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAA;QACpC,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiCE;AAEF;;;;;;GAMG;AACH,SAAS,4BAA4B,CACnC,OAAmB,EACnB,cAAwB,EACxB,YAAwC,EACxC,MAAwB;IAExB,0BAA0B;IAC1B,IAAI,cAAc,CAAC,cAAc,EAAE,EAAE,CAAC;QACpC,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,KAAK,OAAO,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;YACtD,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,IAAI;aACd,CAAA;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;YAChE,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK,CAAC,mCAAmC;aACnD,CAAA;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;YAC5D,0EAA0E;YAC1E,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;YAC/D,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,IAAI,CAAC,mCAAmC;aAClD,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,YAAY,IAAI,MAAM,EAAE,CAAC,CAAA;IAC5F,CAAC;IAED,qDAAqD;IACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,cAAc,CAAC,aAAa,EAAE,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG;YACf,sBAAsB,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAChF,sBAAsB,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5E,sBAAsB,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC1E,sBAAsB,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5E,sBAAsB,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;SAC/E,CAAA;QAED,IAAI,YAAY,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACtD,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxC,OAAO;oBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;oBAChC,OAAO,EAAE,IAAI;iBACd,CAAA;YACH,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,KAAK,UAAU,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,kBAAkB,CAAC,EAAE,CAAC;gBACnE,OAAO;oBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;oBAChC,OAAO,EAAE,KAAK;iBACf,CAAA;YACH,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,KAAK,aAAa,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAChE;;;;;;eAMG;YACH,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,oBAAoB,CAAC,EAAE,CAAC;gBACvE,OAAO;oBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;oBAChC,mCAAmC;oBACnC,OAAO,EAAE,IAAI;iBACd,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;oBAChC,mCAAmC;oBACnC,OAAO,EAAE,KAAK;iBACf,CAAA;YACH,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/D;;;;;;cAME;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO;oBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;oBAChC,mCAAmC;oBACnC,OAAO,EAAE,KAAK;iBACf,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;oBAChC,mCAAmC;oBACnC,OAAO,EAAE,IAAI;iBACd,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,iDAAiD,YAAY,IAAI,MAAM,EAAE,CAAC,CAAA;QAC5F,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,aAAa,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,kCAAkC,CAAC;aAC7C,CAAA;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,0BAA0B,CAAC;aACrC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,wBAAwB,CAAC;aACnC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACpF,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,uBAAuB,CAAC;aAClC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,wBAAwB,CAAC;aACnC,CAAA;QACH,CAAC;QAED,gKAAgK;QAChK,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,IAAA,6BAAmB,EAAC,cAAc,CAAC,CAAA;QAC7E,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,wBAAwB,CAAC;aACnC,CAAA;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QACzE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,0BAAgB,EAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QACvE,MAAM,kBAAkB,GAAG,IAAA,0BAAgB,EAAC,gBAAgB,EAAE,OAAO,EAAE;YACrE,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QACF,MAAM,gBAAgB,GACpB,cAAc,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACxF,kBAAkB,CAAA;QACpB,MAAM,aAAa,GAAG,gBAAgB,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;QAEhG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBAChC,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,aAAa;aACd,CAAA;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,IAAI;YACb,aAAa;SACd,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CACpC,YAAoB,EACpB,aAAqB;IAErB,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IACtE,IAAI,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IACxF,IAAI,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,OAAO,oBAAoB,CAAA;IAC7B,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/cjs/simulation_engine/contextKeys.d.ts

@@ -1,3 +1,4 @@
+import { ResourceType } from '@cloud-copilot/iam-data';
 /**
  * Get the allowed context keys for a request.
  *
@@ -8,5 +9,5 @@
  * @returns The allowed context keys for the request as lower case strings
  * @throws error if the service or action does not exist
  */
-export declare function allowedContextKeysForRequest(service: string, action: string, resource: string, bucketAbacEnabled?: boolean): Promise<string[]>;
+export declare function allowedContextKeysForRequest(service: string, action: string, resource: string, bucketAbacEnabled: boolean, suggestedResourceType: ResourceType | undefined): Promise<string[]>;
 //# sourceMappingURL=contextKeys.d.ts.map

package/dist/cjs/simulation_engine/contextKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/contextKeys.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,MAAM,EAAE,CAAC,CAiCnB"}
+{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAInG;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,iBAAiB,EAAE,OAAO,EAC1B,qBAAqB,EAAE,YAAY,GAAG,SAAS,GAC9C,OAAO,CAAC,MAAM,EAAE,CAAC,CAsCnB"}

package/dist/cjs/simulation_engine/contextKeys.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.allowedContextKeysForRequest = allowedContextKeysForRequest;
 const iam_data_1 = require("@cloud-copilot/iam-data");
 const util_js_1 = require("../util.js");
+const resourceTypes_js_1 = require("./resourceTypes.js");
 /**
  * Get the allowed context keys for a request.
  *
@@ -13,21 +14,25 @@ const util_js_1 = require("../util.js");
  * @returns The allowed context keys for the request as lower case strings
  * @throws error if the service or action does not exist
  */
-async function allowedContextKeysForRequest(service, action, resource, bucketAbacEnabled) {
+async function allowedContextKeysForRequest(service, action, resource, bucketAbacEnabled, suggestedResourceType) {
     const actionDetails = await (0, iam_data_1.iamActionDetails)(service, action);
     const actionConditionKeys = (0, util_js_1.lowerCaseAll)(actionDetails.conditionKeys);
     const isWildCardOnly = await (0, util_js_1.isWildcardOnlyAction)(service, action);
     if (isWildCardOnly) {
         return [...actionConditionKeys, ...lowerCaseGlobalConditionKeys()];
     }
-    const resourceTypes = await (0, util_js_1.getResourceTypesForAction)(service, action, resource);
-    if (resourceTypes.length === 0) {
-        throw new Error(`No resource types found for action ${action} on service ${service}`);
+    let resourceType = suggestedResourceType;
+    if (!resourceType) {
+        const resourceTypes = await (0, resourceTypes_js_1.getResourceTypesForAction)(service, action, resource);
+        if (resourceTypes.length === 0) {
+            throw new Error(`No resource types found for action ${action} on service ${service}`);
+        }
+        else if (resourceTypes.length > 1) {
+            throw new Error(`Multiple resource types found for action ${action} on service ${service}`);
+        }
+        resourceType = resourceTypes[0];
     }
-    else if (resourceTypes.length > 1) {
-        throw new Error(`Multiple resource types found for action ${action} on service ${service}`);
-    }
-    const resourceTypeConditions = actionDetails.resourceTypes.find((rt) => rt.name === resourceTypes[0].key).conditionKeys;
+    const resourceTypeConditions = actionDetails.resourceTypes.find((rt) => rt.name === resourceType.key).conditionKeys;
     const allKeys = [
         ...(0, util_js_1.lowerCaseAll)(resourceTypeConditions),
         ...actionConditionKeys,

package/dist/cjs/simulation_engine/contextKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulation_engine/contextKeys.ts"],"names":[],"mappings":";;AAkBA,oEAsCC;AAxDD,sDAAqF;AACrF,wCAKmB;AAEnB;;;;;;;;;GASG;AACI,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,MAAc,EACd,QAAgB,EAChB,iBAA2B;IAE3B,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,MAAM,mBAAmB,GAAG,IAAA,sBAAY,EAAC,aAAa,CAAC,aAAa,CAAC,CAAA;IAErE,MAAM,cAAc,GAAG,MAAM,IAAA,8BAAoB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,mBAAmB,EAAE,GAAG,4BAA4B,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,IAAA,mCAAyB,EAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAChF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,eAAe,OAAO,EAAE,CAAC,CAAA;IACvF,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,eAAe,OAAO,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,sBAAsB,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAC7D,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CACxC,CAAC,aAAa,CAAA;IAEhB,MAAM,OAAO,GAAG;QACd,GAAG,IAAA,sBAAY,EAAC,sBAAsB,CAAC;QACvC,GAAG,mBAAmB;QACtB,GAAG,4BAA4B,EAAE;KAClC,CAAA;IAED,IAAI,CAAC,IAAA,+BAAqB,EAAC,QAAQ,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,wDAAwD;IACxD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CACjF,CAAA;AACH,CAAC;AAED,IAAI,sBAA4C,CAAA;AAChD,SAAS,4BAA4B;IACnC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,sBAAsB,GAAG,IAAA,oCAAyB,GAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,sBAAsB,CAAA;AAC/B,CAAC"}
+{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulation_engine/contextKeys.ts"],"names":[],"mappings":";;AAcA,oEA4CC;AA1DD,sDAAmG;AACnG,wCAAsF;AACtF,yDAA8D;AAE9D;;;;;;;;;GASG;AACI,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,MAAc,EACd,QAAgB,EAChB,iBAA0B,EAC1B,qBAA+C;IAE/C,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7D,MAAM,mBAAmB,GAAG,IAAA,sBAAY,EAAC,aAAa,CAAC,aAAa,CAAC,CAAA;IAErE,MAAM,cAAc,GAAG,MAAM,IAAA,8BAAoB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,mBAAmB,EAAE,GAAG,4BAA4B,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,IAAI,YAAY,GAAG,qBAAqB,CAAA;IACxC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,IAAA,4CAAyB,EAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAChF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,eAAe,OAAO,EAAE,CAAC,CAAA;QACvF,CAAC;aAAM,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,eAAe,OAAO,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,sBAAsB,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAC7D,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,YAAa,CAAC,GAAG,CACrC,CAAC,aAAa,CAAA;IAEhB,MAAM,OAAO,GAAG;QACd,GAAG,IAAA,sBAAY,EAAC,sBAAsB,CAAC;QACvC,GAAG,mBAAmB;QACtB,GAAG,4BAA4B,EAAE;KAClC,CAAA;IAED,IAAI,CAAC,IAAA,+BAAqB,EAAC,QAAQ,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,wDAAwD;IACxD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CACjF,CAAA;AACH,CAAC;AAED,IAAI,sBAA4C,CAAA;AAChD,SAAS,4BAA4B;IACnC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,sBAAsB,GAAG,IAAA,oCAAyB,GAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,sBAAsB,CAAA;AAC/B,CAAC"}

package/dist/cjs/simulation_engine/overallResult.d.ts

@@ -0,0 +1,13 @@
+import type { EvaluationResult } from '../evaluate.js';
+import type { SimulationResourceResult } from './simulationEngine.js';
+/**
+ * Calculates the overall evaluation result from multiple simulation resource results.
+ *
+ * @param results Array of simulation resource results to evaluate
+ * @returns The overall evaluation result following AWS IAM evaluation logic:
+ *   - 'Allowed' if any result is allowed
+ *   - 'ExplicitlyDenied' if all results are explicitly denied
+ *   - 'ImplicitlyDenied' for all other cases (including empty results)
+ */
+export declare function calculateOverallResult(results: SimulationResourceResult[]): EvaluationResult;
+//# sourceMappingURL=overallResult.d.ts.map

package/dist/cjs/simulation_engine/overallResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overallResult.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/overallResult.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAErE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,EAAE,GAAG,gBAAgB,CAyB5F"}

package/dist/cjs/simulation_engine/overallResult.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.calculateOverallResult = calculateOverallResult;
+/**
+ * Calculates the overall evaluation result from multiple simulation resource results.
+ *
+ * @param results Array of simulation resource results to evaluate
+ * @returns The overall evaluation result following AWS IAM evaluation logic:
+ *   - 'Allowed' if any result is allowed
+ *   - 'ExplicitlyDenied' if all results are explicitly denied
+ *   - 'ImplicitlyDenied' for all other cases (including empty results)
+ */
+function calculateOverallResult(results) {
+    if (results.length === 0) {
+        return 'ImplicitlyDenied';
+    }
+    let hasExplicitlyDenied = false;
+    let hasImplicitlyDenied = false;
+    for (const result of results) {
+        const evaluationResult = result.analysis?.result;
+        if (evaluationResult === 'Allowed') {
+            return 'Allowed';
+        }
+        if (evaluationResult === 'ExplicitlyDenied') {
+            hasExplicitlyDenied = true;
+            continue;
+        }
+        hasImplicitlyDenied = true;
+    }
+    if (hasExplicitlyDenied && !hasImplicitlyDenied) {
+        return 'ExplicitlyDenied';
+    }
+    return 'ImplicitlyDenied';
+}
+//# sourceMappingURL=overallResult.js.map

package/dist/cjs/simulation_engine/overallResult.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overallResult.js","sourceRoot":"","sources":["../../../src/simulation_engine/overallResult.ts"],"names":[],"mappings":";;AAYA,wDAyBC;AAlCD;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CAAC,OAAmC;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IAED,IAAI,mBAAmB,GAAG,KAAK,CAAA;IAC/B,IAAI,mBAAmB,GAAG,KAAK,CAAA;IAE/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAA;QAChD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,gBAAgB,KAAK,kBAAkB,EAAE,CAAC;YAC5C,mBAAmB,GAAG,IAAI,CAAA;YAC1B,SAAQ;QACV,CAAC;QACD,mBAAmB,GAAG,IAAI,CAAA;IAC5B,CAAC;IAED,IAAI,mBAAmB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IAED,OAAO,kBAAkB,CAAA;AAC3B,CAAC"}

package/dist/cjs/simulation_engine/policyResources.d.ts

@@ -0,0 +1,41 @@
+import { ResourceType } from '@cloud-copilot/iam-data';
+import { Statement } from '@cloud-copilot/iam-policy';
+import { PolicyWithName } from '../core_engine/CoreSimulatorEngine.js';
+/**
+ * Extracts matching resource strings from a set of policies for a given action and resource pattern.
+ *
+ * @param policies Array of policies to search through (undefined entries are skipped)
+ * @param action The action to match against policy statements
+ * @param resourceType The resource type to filter resource strings by
+ * @param resourceArnPattern The resource ARN pattern to match against
+ * @returns Array of unique resource strings that match the criteria
+ */
+export declare function getMatchingResourceStringsForPolicies(policies: (PolicyWithName | undefined)[], action: string, resourceType: ResourceType, resourceArnPattern: string): string[];
+/**
+ * Extracts resource strings from a single policy statement that allows the specified action.
+ *
+ * @param statement The policy statement to analyze
+ * @param action The action to check if the statement allows
+ * @param resourceType The resource type to filter by
+ * @param resourceArnPattern The resource ARN pattern to match
+ * @returns Array of resource strings from the statement, or empty array if statement doesn't allow the action
+ */
+export declare function getResourceStringsFromStatement(statement: Statement, action: string, resourceType: ResourceType, resourceArnPattern: string): string[];
+/**
+ * Extracts resource strings from a statement's Resource or NotResource elements that match the given criteria.
+ *
+ * @param statement The policy statement to analyze
+ * @param resourceType The resource type to filter by
+ * @param resourceArnPattern The resource ARN pattern to check for overlap
+ * @returns Array of matching resource strings, or ['*'] for certain NotResource cases
+ */
+export declare function statementResourceStringsForResourceTypeAndPattern(statement: Statement, resourceType: ResourceType, resourceArnPattern: string): string[];
+/**
+ * Determines if a policy statement allows the specified action.
+ *
+ * @param statement The policy statement to check
+ * @param action The action to test against the statement
+ * @returns true if the statement allows the action, false otherwise
+ */
+export declare function statementAllowsAction(statement: Statement, action: string): boolean;
+//# sourceMappingURL=policyResources.d.ts.map

package/dist/cjs/simulation_engine/policyResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyResources.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/policyResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAItE;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,CAAC,cAAc,GAAG,SAAS,CAAC,EAAE,EACxC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,MAAM,GACzB,MAAM,EAAE,CAmBV;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,MAAM,GACzB,MAAM,EAAE,CASV;AAED;;;;;;;GAOG;AACH,wBAAgB,iDAAiD,CAC/D,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,MAAM,GACzB,MAAM,EAAE,CA4BV;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBnF"}