@cloud-copilot/iam-simulate 0.1.11 → 0.1.13-1

package/dist/cjs/SCPAnalysis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SCPAnalysis.d.ts","sourceRoot":"","sources":["../../src/SCPAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;CACxC"}
+{"version":3,"file":"SCPAnalysis.d.ts","sourceRoot":"","sources":["../../src/SCPAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAI3D,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;CACxC"}

package/dist/cjs/StatementAnalysis.d.ts

@@ -1,5 +1,6 @@
 import { Statement } from "@cloud-copilot/iam-policy";
 import { ConditionMatchResult } from "./condition/condition.js";
+import { StatementExplain } from "./explain/statementExplain.js";
 import { PrincipalMatchResult } from "./principal/principal.js";
 /**
  * The result of analyzing a statement against a request.
@@ -22,6 +23,19 @@ export interface StatementAnalysis {
      * Whether the Principal or NotPrincipal – if any – matches the request.
      */
     principalMatch: PrincipalMatchResult;
+    /**
+     * Whether the Conditions matches the request.
+     */
     conditionMatch: ConditionMatchResult;
+    explain?: StatementExplain;
 }
+/**
+ * Checks if a statement is an identity statement that allows the request.
+ *
+ * @param statement The statement to check.
+ * @returns Whether the statement is an identity statement that allows the request.
+ */
+export declare function identityStatementAllows(statement: StatementAnalysis): boolean;
+export declare function identityStatementExplicitDeny(statement: StatementAnalysis): boolean;
+export declare function statementMatches(analysis: Pick<StatementAnalysis, 'actionMatch' | 'conditionMatch' | 'principalMatch' | 'resourceMatch'>): boolean;
 //# sourceMappingURL=StatementAnalysis.d.ts.map

package/dist/cjs/StatementAnalysis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StatementAnalysis.d.ts","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,SAAS,EAAE,SAAS,CAAC;IAErB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IACpC,cAAc,EAAE,oBAAoB,CAAA;CACrC"}
+{"version":3,"file":"StatementAnalysis.d.ts","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,SAAS,EAAE,SAAS,CAAC;IAErB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAQ7E;AAsBD,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAQnF;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAC,GAAG,OAAO,CAKlJ"}

package/dist/cjs/StatementAnalysis.js

@@ -1,3 +1,54 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityStatementAllows = identityStatementAllows;
+exports.identityStatementExplicitDeny = identityStatementExplicitDeny;
+exports.statementMatches = statementMatches;
+/**
+ * Checks if a statement is an identity statement that allows the request.
+ *
+ * @param statement The statement to check.
+ * @returns Whether the statement is an identity statement that allows the request.
+ */
+function identityStatementAllows(statement) {
+    if (statement.resourceMatch &&
+        statement.actionMatch &&
+        statement.conditionMatch === 'Match' &&
+        statement.statement.effect() === 'Allow') {
+        return true;
+    }
+    return false;
+}
+// export function identityStatementUknownAllow(statement: StatementAnalysis): boolean {
+//   if(statement.resourceMatch &&
+//     statement.actionMatch &&
+//     statement.conditionMatch === 'Unknown' &&
+//     statement.statement.effect() === 'Allow') {
+//       return true;
+//   }
+//   return false
+// }
+// export function identityStatementUknownDeny(statement: StatementAnalysis): boolean {
+//   if(statement.resourceMatch &&
+//     statement.actionMatch &&
+//     statement.conditionMatch === 'Unknown' &&
+//     statement.statement.effect() === 'Deny') {
+//       return true;
+//   }
+//   return false
+// }
+function identityStatementExplicitDeny(statement) {
+    if (statement.resourceMatch &&
+        statement.actionMatch &&
+        statement.conditionMatch === 'Match' &&
+        statement.statement.effect() === 'Deny') {
+        return true;
+    }
+    return false;
+}
+function statementMatches(analysis) {
+    return analysis.resourceMatch &&
+        analysis.actionMatch &&
+        analysis.conditionMatch === 'Match' &&
+        (analysis.principalMatch === 'Match' || analysis.principalMatch === 'AccountLevelMatch');
+}
 //# sourceMappingURL=StatementAnalysis.js.map

package/dist/cjs/StatementAnalysis.js.map

@@ -1 +1 @@
-{"version":3,"file":"StatementAnalysis.js","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":""}
+{"version":3,"file":"StatementAnalysis.js","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":";;AA4CA,0DAQC;AAsBD,sEAQC;AAED,4CAKC;AAnDD;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,SAA4B;IAClE,IAAG,SAAS,CAAC,aAAa;QACxB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,kCAAkC;AAClC,+BAA+B;AAC/B,gDAAgD;AAChD,kDAAkD;AAClD,qBAAqB;AACrB,MAAM;AACN,iBAAiB;AACjB,IAAI;AAEJ,uFAAuF;AACvF,kCAAkC;AAClC,+BAA+B;AAC/B,gDAAgD;AAChD,iDAAiD;AACjD,qBAAqB;AACrB,MAAM;AACN,iBAAiB;AACjB,IAAI;AAEJ,SAAgB,6BAA6B,CAAC,SAA4B;IACxE,IAAG,SAAS,CAAC,aAAa;QACxB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gBAAgB,CAAC,QAAwG;IACvI,OAAO,QAAQ,CAAC,aAAa;QAC3B,QAAQ,CAAC,WAAW;QACpB,QAAQ,CAAC,cAAc,KAAK,OAAO;QACnC,CAAC,QAAQ,CAAC,cAAc,KAAK,OAAO,IAAI,QAAQ,CAAC,cAAc,KAAK,mBAAmB,CAAC,CAAC;AAC7F,CAAC"}

package/dist/cjs/action/action.d.ts

@@ -1,4 +1,5 @@
 import { Action, Statement } from "@cloud-copilot/iam-policy";
+import { ActionExplain, StatementExplain } from "../explain/statementExplain.js";
 import { AwsRequest } from "../request/request.js";
 /**
  * Check if a request matches the Action or NotAction elements of a statement.
@@ -7,7 +8,10 @@ import { AwsRequest } from "../request/request.js";
  * @param statement the statement to check against
  * @returns true if the request matches the Action or NotAction in the statement, false otherwise
  */
-export declare function requestMatchesStatementActions(request: AwsRequest, statement: Statement): boolean;
+export declare function requestMatchesStatementActions(request: AwsRequest, statement: Statement): {
+    matches: boolean;
+    details: Pick<StatementExplain, 'actions' | 'notActions'>;
+};
 /**
  * Check if a request matches a set of actions.
  *
@@ -15,7 +19,10 @@ export declare function requestMatchesStatementActions(request: AwsRequest, stat
  * @param actions the actions to check against
  * @returns true if the request matches any of the actions, false otherwise
  */
-export declare function requestMatchesActions(request: AwsRequest, actions: Action[]): boolean;
+export declare function requestMatchesActions(request: AwsRequest, actions: Action[]): {
+    matches: boolean;
+    explains: ActionExplain[];
+};
 /**
  * Check if a request does not match a set of actions.
  *
@@ -23,5 +30,8 @@ export declare function requestMatchesActions(request: AwsRequest, actions: Acti
  * @param actions the actions to check against
  * @returns true if the request does not match any of the actions, false if the request matches any of the actions
  */
-export declare function requestMatchesNotActions(request: AwsRequest, actions: Action[]): boolean;
+export declare function requestMatchesNotActions(request: AwsRequest, actions: Action[]): {
+    matches: boolean;
+    explains: ActionExplain[];
+};
 //# sourceMappingURL=action.d.ts.map

package/dist/cjs/action/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/action/action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAOjG;AAiBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAiBrF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAExF"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/action/action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,YAAY,CAAC,CAAA;CAAC,CAevK;AAiBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAC,CAI3H;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAC,CAS9H"}

package/dist/cjs/action/action.js

@@ -12,10 +12,18 @@ exports.requestMatchesNotActions = requestMatchesNotActions;
  */
 function requestMatchesStatementActions(request, statement) {
     if (statement.isActionStatement()) {
-        return requestMatchesActions(request, statement.actions());
+        const { matches, explains } = requestMatchesActions(request, statement.actions());
+        if (!statement.actionIsArray()) {
+            return { matches, details: { actions: explains[0] } };
+        }
+        return { matches, details: { actions: explains } };
     }
     else if (statement.isNotActionStatement()) {
-        return requestMatchesNotActions(request, statement.notActions());
+        const { matches, explains } = requestMatchesNotActions(request, statement.notActions());
+        if (!statement.notActionIsArray()) {
+            return { matches, details: { notActions: explains[0] } };
+        }
+        return { matches, details: { notActions: explains } };
     }
     throw new Error('Statement has neither Actions nor NotActions');
 }
@@ -40,24 +48,9 @@ function convertActionToRegex(action) {
  * @returns true if the request matches any of the actions, false otherwise
  */
 function requestMatchesActions(request, actions) {
-    for (const action of actions) {
-        if (action.isWildcardAction()) {
-            return true;
-        }
-        else if (action.isServiceAction()) {
-            if (request.action.service() != action.service()) {
-                continue;
-            }
-            const actionRegex = convertActionToRegex(action.action());
-            if (actionRegex.test(request.action.action())) {
-                return true;
-            }
-        }
-        else {
-            throw new Error('Unknown action type');
-        }
-    }
-    return false;
+    const explains = actions.map(action => requestMatchesSingleAction(request, action));
+    const matches = explains.some(explain => explain.matches);
+    return { matches, explains };
 }
 /**
  * Check if a request does not match a set of actions.
@@ -67,6 +60,35 @@ function requestMatchesActions(request, actions) {
  * @returns true if the request does not match any of the actions, false if the request matches any of the actions
  */
 function requestMatchesNotActions(request, actions) {
-    return !requestMatchesActions(request, actions);
+    const explains = actions.map(action => {
+        const explain = requestMatchesSingleAction(request, action);
+        explain.matches = !explain.matches;
+        return explain;
+    });
+    const matches = explains.some(explain => explain.matches);
+    return { matches, explains };
+}
+function requestMatchesSingleAction(request, action) {
+    if (action.isWildcardAction()) {
+        return {
+            action: action.value(),
+            matches: true,
+        };
+    }
+    else if (action.isServiceAction()) {
+        if (request.action.service() != action.service()) {
+            return {
+                action: action.value(),
+                matches: false,
+            };
+        }
+        const actionRegex = convertActionToRegex(action.action());
+        const matches = actionRegex.test(request.action.action());
+        return {
+            action: action.value(),
+            matches
+        };
+    }
+    throw new Error('Unknown action type');
 }
 //# sourceMappingURL=action.js.map

package/dist/cjs/action/action.js.map

@@ -1 +1 @@
-{"version":3,"file":"action.js","sourceRoot":"","sources":["../../../src/action/action.ts"],"names":[],"mappings":";;AAWA,wEAOC;AAwBD,sDAiBC;AASD,4DAEC;AAlED;;;;;;GAMG;AACH,SAAgB,8BAA8B,CAAC,OAAmB,EAAE,SAAoB;IACtF,IAAG,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACjC,OAAO,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5C,OAAO,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAC5E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAGD;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,OAAmB,EAAE,OAAiB;IAC1E,KAAI,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,IAAG,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC;YACnC,IAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;gBAChD,SAAQ;YACV,CAAC;YACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,IAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,OAAmB,EAAE,OAAiB;IAC7E,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../../../src/action/action.ts"],"names":[],"mappings":";;AAWA,wEAeC;AAwBD,sDAIC;AASD,4DASC;AApED;;;;;;GAMG;AACH,SAAgB,8BAA8B,CAAC,OAAmB,EAAE,SAAoB;IACtF,IAAG,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACjC,MAAM,EAAC,OAAO,EAAE,QAAQ,EAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,IAAG,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC;YAC9B,OAAO,EAAC,OAAO,EAAE,OAAO,EAAE,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAC,EAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAC,OAAO,EAAE,OAAO,EAAE,EAAC,OAAO,EAAE,QAAQ,EAAC,EAAC,CAAC;IACjD,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAC,OAAO,EAAE,QAAQ,EAAC,GAAG,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,IAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACjC,OAAO,EAAC,OAAO,EAAE,OAAO,EAAE,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAC,EAAC,CAAC;QACvD,CAAC;QACD,OAAO,EAAC,OAAO,EAAE,OAAO,EAAE,EAAC,UAAU,EAAE,QAAQ,EAAC,EAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAC5E,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAGD;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,OAAmB,EAAE,OAAiB;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,OAAmB,EAAE,OAAiB;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACpC,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3D,OAAO,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAA;QAClC,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,CAAC;AAC7B,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAmB,EAAE,MAAc;IACrE,IAAI,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;YACtB,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;SAAM,IAAG,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC;QACnC,IAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;gBACtB,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACzD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;YACtB,OAAO;SACR,CAAA;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC"}

package/dist/cjs/condition/condition.d.ts

@@ -1,6 +1,10 @@
 import { Condition } from '@cloud-copilot/iam-policy';
+import { ConditionExplain, StatementExplain } from '../explain/statementExplain.js';
 import { AwsRequest } from '../request/request';
-export type ConditionMatchResult = 'Match' | 'NoMatch' | 'Unknown';
-export declare function requestMatchesConditions(request: AwsRequest, conditions: Condition[]): ConditionMatchResult;
-export declare function singleConditionMatchesRequest(request: AwsRequest, condition: Condition): ConditionMatchResult;
+export type ConditionMatchResult = 'Match' | 'NoMatch';
+export declare function requestMatchesConditions(request: AwsRequest, conditions: Condition[]): {
+    matches: ConditionMatchResult;
+    details: Pick<StatementExplain, 'conditions'>;
+};
+export declare function singleConditionMatchesRequest(request: AwsRequest, condition: Condition): ConditionExplain;
 //# sourceMappingURL=condition.d.ts.map

package/dist/cjs/condition/condition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AA4BhD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;AAiBlE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAW3G;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,oBAAoB,CAiE7G"}
+{"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAyB,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AA4BhD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAA;AAiBtD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG;IAAE,OAAO,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAA;CAAE,CAiBvK;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAuKzG"}

package/dist/cjs/condition/condition.js

@@ -42,15 +42,21 @@ for (const operator of allOperators) {
 }
 function requestMatchesConditions(request, conditions) {
     const results = conditions.map(condition => singleConditionMatchesRequest(request, condition));
-    const unknowns = results.filter(result => result === 'Unknown');
-    if (unknowns.length > 0) {
-        return 'Unknown';
-    }
-    const noMatches = results.filter(result => result === 'NoMatch');
-    if (noMatches.length > 0) {
-        return 'NoMatch';
-    }
-    return 'Match';
+    // const unknowns = results.filter(result => result === 'Unknown')
+    // if(unknowns.length > 0) {
+    //   return 'Unknown'
+    // }
+    const nonMatch = results.some(result => !result.matches);
+    return {
+        matches: nonMatch ? 'NoMatch' : 'Match',
+        details: {
+            conditions: results
+        }
+    };
+    // if(noMatches.length > 0 ) {
+    //   return
+    // }
+    // return 'Match'
 }
 function singleConditionMatchesRequest(request, condition) {
     const key = condition.conditionKey();
@@ -65,59 +71,164 @@ function singleConditionMatchesRequest(request, condition) {
         const setOperator = condition.operation().setOperator();
         if (setOperator === 'ForAnyValue') {
             if (!keyExists || !keyValue || !keyValue.isArrayValue()) {
-                return 'NoMatch';
+                return {
+                    operator: condition.operation().value(),
+                    conditionKeyValue: condition.conditionKey(),
+                    values: [],
+                    matches: false,
+                    failedBecauseMissing: !keyExists || !keyValue,
+                    failedBecauseNotArray: keyValue && !keyValue.isArrayValue()
+                };
+                // return 'NoMatch'
             }
             if (!baseOperation) {
-                return 'Unknown';
+                //TODO: This should return a nomatch rather than throw an error
+                // throw new Error(`Unknown base operation: ${condition.operation().baseOperator()}`)
+                return {
+                    operator: condition.operation().value(),
+                    conditionKeyValue: condition.conditionKey(),
+                    values: [],
+                    matches: false,
+                    missingOperator: true
+                };
             }
             //Do the loop
             const anyMatch = keyValue.values.some(value => {
                 return baseOperation(request, value, policyValues);
             });
-            return anyMatch ? 'Match' : 'NoMatch';
+            return {
+                operator: condition.operation().value(),
+                conditionKeyValue: condition.conditionKey(),
+                values: [],
+                matches: anyMatch
+            };
+            // return anyMatch ? 'Match' : 'NoMatch'
         }
         else if (setOperator === 'ForAllValues') {
             if (!keyExists) {
-                return 'Match';
+                return {
+                    operator: condition.operation().value(),
+                    conditionKeyValue: condition.conditionKey(),
+                    values: [],
+                    matches: true,
+                    matchedBecauseMissing: true
+                };
+                // return 'Match'
             }
             if (!keyValue || !keyValue.isArrayValue()) {
-                return 'NoMatch';
+                return {
+                    operator: condition.operation().value(),
+                    conditionKeyValue: condition.conditionKey(),
+                    values: [],
+                    matches: false,
+                    failedBecauseMissing: !keyValue,
+                    failedBecauseNotArray: !!keyValue && !keyValue.isArrayValue()
+                };
+                // return 'NoMatch'
             }
             if (!baseOperation) {
-                return 'Unknown';
+                //TODO: This should return a nomatch rather than throw an error
+                return {
+                    operator: condition.operation().value(),
+                    conditionKeyValue: condition.conditionKey(),
+                    values: [],
+                    matches: false,
+                    missingOperator: true
+                };
             }
             //Do the loop
             const anyNotMatch = keyValue.values.some(value => {
+                //TODO: Need to add explains for each value
                 return !baseOperation(request, value, policyValues);
             });
-            return anyNotMatch ? 'NoMatch' : 'Match';
+            return {
+                operator: condition.operation().value(),
+                conditionKeyValue: condition.conditionKey(),
+                values: [],
+                matches: !anyNotMatch
+            };
+            //return anyNotMatch ? 'NoMatch' : 'Match'
         }
         else {
             throw new Error(`Unknown set operator: ${setOperator}`);
         }
     }
-    if (condition.operation().isIfExists() || condition.operation().baseOperator().toLowerCase().includes('not')) {
+    const isNotOperator = condition.operation().baseOperator().toLowerCase().includes('not');
+    if (condition.operation().isIfExists() || isNotOperator) {
         //Check if it exists, return true if it doesn't
         //Double check what happens here if the key is not a valid key or is of the wrong type
         if (!keyExists) {
-            return 'Match';
+            return {
+                operator: condition.operation().value(),
+                conditionKeyValue: condition.conditionKey(),
+                values: [],
+                matches: true,
+                matchedBecauseMissing: true
+            };
+            // return 'Match'
         }
     }
     if (!keyValue || !keyValue.isStringValue()) {
         //Set operator is required for a multi-value key
-        return 'NoMatch';
+        return {
+            operator: condition.operation().value(),
+            conditionKeyValue: condition.conditionKey(),
+            values: [],
+            matches: false,
+            failedBecauseMissing: !keyValue,
+            failedBecauseArray: keyValue?.isArrayValue(),
+        };
+        // return 'NoMatch'
     }
     if (!baseOperation) {
-        return 'Unknown';
+        //TODO: This should return a nomatch rather than throw an error
+        // throw new Error(`Unknown base operation: ${condition.operation().baseOperator()}`)
+        return {
+            operator: condition.operation().value(),
+            conditionKeyValue: condition.conditionKey(),
+            values: [],
+            matches: false,
+            missingOperator: true
+        };
+    }
+    const valueExplains = policyValues.map(value => {
+        const valueMatch = baseOperation(request, keyValue.value, [value]);
+        const explain = {
+            value,
+            matches: valueMatch
+        };
+        if (isNotOperator) {
+            explain.negativeMatchingValues = [value];
+        }
+        else {
+            explain.matchingValues = [value];
+        }
+        return explain;
+    });
+    let matches = valueExplains.some(explain => explain.matches);
+    if (isNotOperator) {
+        matches = valueExplains.every(explain => explain.matches);
     }
-    const matches = baseOperation(request, keyValue.value, policyValues);
-    return matches ? 'Match' : 'NoMatch';
+    return {
+        operator: condition.operation().value(),
+        conditionKeyValue: condition.conditionKey(),
+        values: valueExplains,
+        matches
+    };
 }
 function testNull(condition, keyExists) {
-    const lowerCaseValues = condition.conditionValues().map(value => value.toLowerCase());
-    if (keyExists) {
-        return lowerCaseValues.includes('false') ? 'Match' : 'NoMatch';
-    }
-    return lowerCaseValues.includes('true') ? 'Match' : 'NoMatch';
+    const goalValue = keyExists ? 'false' : 'true';
+    const conditionValues = condition.conditionValues().map(value => {
+        return {
+            value,
+            matches: value.toLowerCase() === goalValue
+        };
+    });
+    return {
+        operator: condition.operation().value(),
+        conditionKeyValue: condition.conditionKey(),
+        values: conditionValues,
+        matches: conditionValues.some(value => value.matches)
+    };
 }
 //# sourceMappingURL=condition.js.map

package/dist/cjs/condition/condition.js.map

@@ -1 +1 @@
-{"version":3,"file":"condition.js","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":";;AA8CA,4DAWC;AAED,sEAiEC;AA1HD,qDAA+C;AAC/C,iDAA2C;AAC3C,2DAAqD;AACrD,uDAAiD;AAEjD,8DAAwD;AACxD,+CAAyC;AACzC,wDAAkD;AAClD,kEAA4D;AAC5D,8EAAwE;AACxE,4DAAsD;AACtD,wEAAkE;AAClE,8DAAwD;AACxD,2DAAqD;AACrD,iEAA2D;AAC3D,iEAA2D;AAC3D,2EAAqE;AACrE,uFAAiF;AACjF,qEAA+D;AAC/D,uEAAiE;AACjE,8DAAwD;AACxD,kFAA4E;AAC5E,0DAAoD;AACpD,oEAA8D;AAC9D,wFAAkF;AAClF,gEAA0D;AAI1D,MAAM,YAAY,GAAG;IACnB,8BAAY,EAAE,oCAAe,EAAE,kDAAsB,EAAE,wDAAyB,EAAE,0BAAU,EAAE,gCAAa;IAC3G,gCAAa,EAAE,sCAAgB,EAAE,oCAAe,EAAE,sCAAgB,EAAE,0CAAkB,EAAE,sDAAwB;IAChH,0BAAU,EAAE,gCAAa,EAAE,8BAAY,EAAE,0CAAkB,EAAE,oCAAe,EAAE,gDAAqB;IACnG,cAAI;IACJ,8BAAY;IACZ,wBAAS,EAAE,8BAAY;IACvB,oBAAO,EAAE,wBAAS,EAAE,0BAAU,EAAE,8BAAY;CAC7C,CAAA;AAED,MAAM,cAAc,GAA6C,EAAE,CAAA;AACnE,KAAI,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;IACnC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAA;AACxD,CAAC;AAED,SAAgB,wBAAwB,CAAC,OAAmB,EAAE,UAAuB;IACnF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;IAC/D,IAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;IAChE,IAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAG,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAgB,6BAA6B,CAAC,OAAmB,EAAE,SAAoB;IACrF,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,EAAE,CAAA;IACpC,MAAM,YAAY,GAAG,SAAS,CAAC,eAAe,EAAE,CAAA;IAChD,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAA;IACjG,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAExE,IAAG,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,IAAI,MAAM,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC;QAC1H,OAAO,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,IAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAA;QACvD,IAAG,WAAW,KAAK,aAAa,EAAE,CAAC;YACjC,IAAG,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;gBACvD,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,IAAG,CAAC,aAAa,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,aAAa;YACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC5C,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;YACpD,CAAC,CAAC,CAAA;YACF,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QACvC,CAAC;aAAM,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YAC1C,IAAG,CAAC,SAAS,EAAE,CAAC;gBACd,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,IAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,IAAG,CAAC,aAAa,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,aAAa;YACb,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC/C,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;YACrD,CAAC,CAAC,CAAA;YAEF,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,IAAG,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5G,+CAA+C;QAC/C,sFAAsF;QACtF,IAAG,CAAC,SAAS,EAAE,CAAC;YACd,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,IAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC1C,gDAAgD;QAChD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAG,CAAC,aAAa,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IACpE,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,SAAoB,EAAE,SAAkB;IACxD,MAAM,eAAe,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IACrF,IAAG,SAAS,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"condition.js","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":";;AA+CA,4DAiBC;AAED,sEAuKC;AAtOD,qDAA+C;AAC/C,iDAA2C;AAC3C,2DAAqD;AACrD,uDAAiD;AAEjD,8DAAwD;AACxD,+CAAyC;AACzC,wDAAkD;AAClD,kEAA4D;AAC5D,8EAAwE;AACxE,4DAAsD;AACtD,wEAAkE;AAClE,8DAAwD;AACxD,2DAAqD;AACrD,iEAA2D;AAC3D,iEAA2D;AAC3D,2EAAqE;AACrE,uFAAiF;AACjF,qEAA+D;AAC/D,uEAAiE;AACjE,8DAAwD;AACxD,kFAA4E;AAC5E,0DAAoD;AACpD,oEAA8D;AAC9D,wFAAkF;AAClF,gEAA0D;AAI1D,MAAM,YAAY,GAAG;IACnB,8BAAY,EAAE,oCAAe,EAAE,kDAAsB,EAAE,wDAAyB,EAAE,0BAAU,EAAE,gCAAa;IAC3G,gCAAa,EAAE,sCAAgB,EAAE,oCAAe,EAAE,sCAAgB,EAAE,0CAAkB,EAAE,sDAAwB;IAChH,0BAAU,EAAE,gCAAa,EAAE,8BAAY,EAAE,0CAAkB,EAAE,oCAAe,EAAE,gDAAqB;IACnG,cAAI;IACJ,8BAAY;IACZ,wBAAS,EAAE,8BAAY;IACvB,oBAAO,EAAE,wBAAS,EAAE,0BAAU,EAAE,8BAAY;CAC7C,CAAA;AAED,MAAM,cAAc,GAA6C,EAAE,CAAA;AACnE,KAAI,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;IACnC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAA;AACxD,CAAC;AAED,SAAgB,wBAAwB,CAAC,OAAmB,EAAE,UAAuB;IACnF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;IAC9F,kEAAkE;IAClE,4BAA4B;IAC5B,qBAAqB;IACrB,IAAI;IACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACvC,OAAO,EAAE;YACP,UAAU,EAAE,OAAO;SACpB;KACF,CAAA;IACD,8BAA8B;IAC9B,WAAW;IACX,IAAI;IACJ,iBAAiB;AACnB,CAAC;AAED,SAAgB,6BAA6B,CAAC,OAAmB,EAAE,SAAoB;IACrF,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,EAAE,CAAA;IACpC,MAAM,YAAY,GAAG,SAAS,CAAC,eAAe,EAAE,CAAA;IAChD,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAA;IACjG,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAExE,IAAG,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,IAAI,MAAM,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC;QAC1H,OAAO,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,IAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAA;QACvD,IAAG,WAAW,KAAK,aAAa,EAAE,CAAC;YACjC,IAAG,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;gBACvD,OAAO;oBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;oBAC3C,MAAM,EAAE,EAAE;oBACV,OAAO,EAAE,KAAK;oBACd,oBAAoB,EAAE,CAAC,SAAS,IAAI,CAAC,QAAQ;oBAC7C,qBAAqB,EAAE,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;iBAC5D,CAAA;gBACD,mBAAmB;YACrB,CAAC;YAED,IAAG,CAAC,aAAa,EAAE,CAAC;gBAClB,+DAA+D;gBAC/D,qFAAqF;gBACrF,OAAO;oBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;oBAC3C,MAAM,EAAE,EAAE;oBACV,OAAO,EAAE,KAAK;oBACd,eAAe,EAAE,IAAI;iBACtB,CAAA;YACH,CAAC;YACD,aAAa;YACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC5C,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;YACpD,CAAC,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;gBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAA;YACD,wCAAwC;QAC1C,CAAC;aAAM,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YAC1C,IAAG,CAAC,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;oBAC3C,MAAM,EAAE,EAAE;oBACV,OAAO,EAAE,IAAI;oBACb,qBAAqB,EAAE,IAAI;iBAC5B,CAAA;gBACD,iBAAiB;YACnB,CAAC;YACD,IAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;gBACzC,OAAO;oBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;oBAC3C,MAAM,EAAE,EAAE;oBACV,OAAO,EAAE,KAAK;oBACd,oBAAoB,EAAE,CAAC,QAAQ;oBAC/B,qBAAqB,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;iBAC9D,CAAA;gBACD,mBAAmB;YACrB,CAAC;YACD,IAAG,CAAC,aAAa,EAAE,CAAC;gBAClB,+DAA+D;gBAC/D,OAAO;oBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;oBAC3C,MAAM,EAAE,EAAE;oBACV,OAAO,EAAE,KAAK;oBACd,eAAe,EAAE,IAAI;iBACtB,CAAA;YACH,CAAC;YACD,aAAa;YACb,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC/C,2CAA2C;gBAC3C,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;YACrD,CAAC,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;gBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,CAAC,WAAW;aACtB,CAAA;YACD,0CAA0C;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAGD,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACxF,IAAG,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,IAAI,aAAa,EAAE,CAAC;QACvD,+CAA+C;QAC/C,sFAAsF;QACtF,IAAG,CAAC,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;gBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,IAAI;gBACb,qBAAqB,EAAE,IAAI;aAC5B,CAAA;YACD,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,IAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC1C,gDAAgD;QAChD,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,KAAK;YACd,oBAAoB,EAAE,CAAC,QAAQ;YAC/B,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC7C,CAAA;QACD,mBAAmB;IACrB,CAAC;IAED,IAAG,CAAC,aAAa,EAAE,CAAC;QAClB,+DAA+D;QAC/D,qFAAqF;QACrF,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;SACtB,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC7C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;QAClE,MAAM,OAAO,GAAyB;YACpC,KAAK;YACL,OAAO,EAAE,UAAU;SACpB,CAAA;QACD,IAAG,aAAa,EAAE,CAAC;YACjB,OAAO,CAAC,sBAAsB,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,IAAI,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE5D,IAAG,aAAa,EAAE,CAAC;QACjB,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,aAAa;QACrB,OAAO;KACR,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,SAAoB,EAAE,SAAkB;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9C,MAAM,eAAe,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACvF,OAAO;YACL,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS;SAC3C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;KACtD,CAAA;AACH,CAAC"}

package/dist/cjs/core_engine/coreSimulatorEngine.d.ts

@@ -1,9 +1,7 @@
-import { Policy } from "@cloud-copilot/iam-policy";
-import { EvaluationResult } from "../evaluate.js";
+import { AnnotatedPolicy } from "@cloud-copilot/iam-policy";
+import { IdentityAnalysis, RequestAnalysis, ResourceAnalysis, ScpAnalysis } from "../evaluate.js";
 import { AwsRequest } from "../request/request.js";
-import { SCPAnalysis } from "../SCPAnalysis.js";
 import { ServiceAuthorizer } from "../services/ServiceAuthorizer.js";
-import { StatementAnalysis } from "../StatementAnalysis.js";
 /**
  * A set of service control policies for each level of an organization tree
  */
@@ -15,7 +13,7 @@ export interface ServiceControlPolicies {
     /**
      * The policies that apply to this organizational unit.
      */
-    policies: Policy[];
+    policies: AnnotatedPolicy[];
 }
 /**
  * A reqest to authorize a service action.
@@ -28,7 +26,7 @@ export interface AuthorizationRequest {
     /**
      * The identity policies that are applicable to the principal making the request.
      */
-    identityPolicies: Policy[];
+    identityPolicies: AnnotatedPolicy[];
     /**
      * The service control policies that apply to the principal making the request. In
      * order of the orgnaization hierarchy. So the root ou SCPS should be first.
@@ -37,7 +35,7 @@ export interface AuthorizationRequest {
     /**
      * The resource policy that applies to the resource being accessed.
      */
-    resourcePolicy: Policy | undefined;
+    resourcePolicy: AnnotatedPolicy | undefined;
 }
 /**
  * Authorizes a request.
@@ -47,7 +45,7 @@ export interface AuthorizationRequest {
  * @param request the request to authorize
  * @returns the result of the authorization
  */
-export declare function authorize(request: AuthorizationRequest): EvaluationResult;
+export declare function authorize(request: AuthorizationRequest): RequestAnalysis;
 /**
  * Get the appropriate service authorizer for the request. Some services have specific authorization logic in
  * them. If there is no service specific authorizer, a default one will be used.
@@ -63,7 +61,7 @@ export declare function getServiceAuthorizer(request: AuthorizationRequest): Ser
  * @param request the request to analyze against
  * @returns an array of statement analysis results
  */
-export declare function analyzeIdentityPolicies(identityPolicies: Policy[], request: AwsRequest): StatementAnalysis[];
+export declare function analyzeIdentityPolicies(identityPolicies: AnnotatedPolicy[], request: AwsRequest): IdentityAnalysis;
 /**
  * Analyzes a set of service control policies and the statements within them.
  *
@@ -71,7 +69,7 @@ export declare function analyzeIdentityPolicies(identityPolicies: Policy[], requ
  * @param request the request to analyze against
  * @returns an array of SCP analysis results
  */
-export declare function analyzeServiceControlPolicies(serviceControlPolicies: ServiceControlPolicies[], request: AwsRequest): SCPAnalysis[];
+export declare function analyzeServiceControlPolicies(serviceControlPolicies: ServiceControlPolicies[], request: AwsRequest): ScpAnalysis;
 /**
  * Analyze a resource policy and return the results
  *
@@ -79,5 +77,5 @@ export declare function analyzeServiceControlPolicies(serviceControlPolicies: Se
  * @param request the request to analyze against
  * @returns an array of statement analysis results
  */
-export declare function analyzeResourcePolicy(resourcePolicy: Policy, request: AwsRequest): StatementAnalysis[];
+export declare function analyzeResourcePolicy(resourcePolicy: AnnotatedPolicy | undefined, request: AwsRequest): ResourceAnalysis;
 //# sourceMappingURL=coreSimulatorEngine.d.ts.map

package/dist/cjs/core_engine/coreSimulatorEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coreSimulatorEngine.d.ts","sourceRoot":"","sources":["../../../src/core_engine/coreSimulatorEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAGnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC;IAEpB;;OAEG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,sBAAsB,EAAE,CAAA;IAEhD;;OAEG;IACH,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAID;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,gBAAgB,CAYzE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,CAMrF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,gBAAgB,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,GAAG,iBAAiB,EAAE,CAe5G;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,UAAU,GAAG,WAAW,EAAE,CAsBlI;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,iBAAiB,EAAE,CAatG"}
+{"version":3,"file":"coreSimulatorEngine.d.ts","sourceRoot":"","sources":["../../../src/core_engine/coreSimulatorEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAa,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAoB,gBAAgB,EAAiB,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGnI,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC;IAEpB;;OAEG;IACH,gBAAgB,EAAE,eAAe,EAAE,CAAA;IAEnC;;;OAGG;IACH,sBAAsB,EAAE,sBAAsB,EAAE,CAAA;IAEhD;;OAEG;IACH,cAAc,EAAE,eAAe,GAAG,SAAS,CAAC;CAC7C;AAID;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CAYxE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,CAMrF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,gBAAgB,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,UAAU,GAAG,gBAAgB,CA0ClH;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,UAAU,GAAG,WAAW,CAyDhI;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,eAAe,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,GAAG,gBAAgB,CAgDxH"}