@cloud-copilot/iam-simulate 0.1.12 → 0.1.13-1

package/dist/cjs/core_engine/coreSimulatorEngine.js

@@ -10,6 +10,7 @@ const condition_js_1 = require("../condition/condition.js");
 const principal_js_1 = require("../principal/principal.js");
 const resource_js_1 = require("../resource/resource.js");
 const DefaultServiceAuthorizer_js_1 = require("../services/DefaultServiceAuthorizer.js");
+const StatementAnalysis_js_1 = require("../StatementAnalysis.js");
 const serviceEngines = {};
 /**
  * Authorizes a request.
@@ -22,11 +23,11 @@ const serviceEngines = {};
 function authorize(request) {
     const identityAnalysis = analyzeIdentityPolicies(request.identityPolicies, request.request);
     const scpAnalysis = analyzeServiceControlPolicies(request.serviceControlPolicies, request.request);
+    const resourceAnalysis = analyzeResourcePolicy(request.resourcePolicy, request.request);
     const serviceAuthorizer = getServiceAuthorizer(request);
-    const resourceAnalysis = request.resourcePolicy ? analyzeResourcePolicy(request.resourcePolicy, request.request) : [];
     return serviceAuthorizer.authorize({
         request: request.request,
-        identityStatements: identityAnalysis,
+        identityAnalysis,
         scpAnalysis,
         resourceAnalysis
     });
@@ -53,19 +54,45 @@ function getServiceAuthorizer(request) {
  * @returns an array of statement analysis results
  */
 function analyzeIdentityPolicies(identityPolicies, request) {
-    const analysis = [];
+    const identityAnalysis = {
+        result: 'ImplicitlyDenied',
+        allowStatements: [],
+        denyStatements: [],
+        unmatchedStatements: [],
+    };
     for (const policy of identityPolicies) {
         for (const statement of policy.statements()) {
-            analysis.push({
+            const { matches: resourceMatch, details: resourceDetails } = (0, resource_js_1.requestMatchesStatementResources)(request, statement);
+            const { matches: actionMatch, details: actionDetails } = (0, action_js_1.requestMatchesStatementActions)(request, statement);
+            const { matches: conditionMatch, details: conditionDetails } = (0, condition_js_1.requestMatchesConditions)(request, statement.conditions());
+            const principalMatch = 'Match';
+            const overallMatch = (0, StatementAnalysis_js_1.statementMatches)({ actionMatch, conditionMatch, principalMatch, resourceMatch });
+            const statementAnalysis = {
                 statement,
-                resourceMatch: (0, resource_js_1.requestMatchesStatementResources)(request, statement),
-                actionMatch: (0, action_js_1.requestMatchesStatementActions)(request, statement),
-                conditionMatch: (0, condition_js_1.requestMatchesConditions)(request, statement.conditions()),
-                principalMatch: 'Match',
-            });
+                resourceMatch,
+                actionMatch,
+                conditionMatch,
+                principalMatch,
+                explain: makeStatementExplain(statement, overallMatch, { ...resourceDetails, ...actionDetails, ...conditionDetails })
+            };
+            if ((0, StatementAnalysis_js_1.identityStatementExplicitDeny)(statementAnalysis)) {
+                identityAnalysis.denyStatements.push(statementAnalysis);
+            }
+            else if ((0, StatementAnalysis_js_1.identityStatementAllows)(statementAnalysis)) {
+                identityAnalysis.allowStatements.push(statementAnalysis);
+            }
+            else {
+                identityAnalysis.unmatchedStatements.push(statementAnalysis);
+            }
         }
     }
-    return analysis;
+    if (identityAnalysis.denyStatements.length > 0) {
+        identityAnalysis.result = 'ExplicitlyDenied';
+    }
+    else if (identityAnalysis.allowStatements.length > 0) {
+        identityAnalysis.result = 'Allowed';
+    }
+    return identityAnalysis;
 }
 /**
  * Analyzes a set of service control policies and the statements within them.
@@ -79,22 +106,59 @@ function analyzeServiceControlPolicies(serviceControlPolicies, request) {
     for (const controlPolicy of serviceControlPolicies) {
         const ouAnalysis = {
             orgIdentifier: controlPolicy.orgIdentifier,
-            statementAnalysis: [],
+            result: 'ImplicitlyDenied',
+            allowStatements: [],
+            denyStatements: [],
+            unmatchedStatements: [],
         };
         for (const policy of controlPolicy.policies) {
             for (const statement of policy.statements()) {
-                ouAnalysis.statementAnalysis.push({
+                const { matches: resourceMatch, details: resourceDetails } = (0, resource_js_1.requestMatchesStatementResources)(request, statement);
+                const { matches: actionMatch, details: actionDetails } = (0, action_js_1.requestMatchesStatementActions)(request, statement);
+                const { matches: conditionMatch, details: conditionDetails } = (0, condition_js_1.requestMatchesConditions)(request, statement.conditions());
+                const principalMatch = 'Match';
+                const overallMatch = (0, StatementAnalysis_js_1.statementMatches)({ actionMatch, conditionMatch, principalMatch, resourceMatch });
+                const statementAnalysis = {
                     statement,
-                    resourceMatch: (0, resource_js_1.requestMatchesStatementResources)(request, statement),
-                    actionMatch: (0, action_js_1.requestMatchesStatementActions)(request, statement),
-                    conditionMatch: (0, condition_js_1.requestMatchesConditions)(request, statement.conditions()),
-                    principalMatch: 'Match',
-                });
+                    resourceMatch,
+                    actionMatch,
+                    conditionMatch,
+                    principalMatch,
+                    explain: makeStatementExplain(statement, overallMatch, { ...resourceDetails, ...actionDetails, ...conditionDetails })
+                };
+                if ((0, StatementAnalysis_js_1.identityStatementAllows)(statementAnalysis)) {
+                    ouAnalysis.allowStatements.push(statementAnalysis);
+                }
+                else if ((0, StatementAnalysis_js_1.identityStatementExplicitDeny)(statementAnalysis)) {
+                    ouAnalysis.denyStatements.push(statementAnalysis);
+                }
+                else {
+                    ouAnalysis.unmatchedStatements.push(statementAnalysis);
+                }
             }
         }
+        if (ouAnalysis.denyStatements.length > 0) {
+            ouAnalysis.result = 'ExplicitlyDenied';
+        }
+        else if (ouAnalysis.allowStatements.length > 0) {
+            ouAnalysis.result = 'Allowed';
+        }
         analysis.push(ouAnalysis);
     }
-    return analysis;
+    let overallResult = 'ImplicitlyDenied';
+    if (analysis.some(ou => ou.result === 'ExplicitlyDenied')) {
+        overallResult = 'ExplicitlyDenied';
+    }
+    else if (analysis.some(ou => ou.allowStatements.length === 0)) {
+        overallResult = 'ImplicitlyDenied';
+    }
+    else if (analysis.every(ou => ou.result === 'Allowed')) {
+        overallResult = 'Allowed';
+    }
+    return {
+        result: overallResult,
+        ouAnalysis: analysis
+    };
 }
 /**
  * Analyze a resource policy and return the results
@@ -104,16 +168,62 @@ function analyzeServiceControlPolicies(serviceControlPolicies, request) {
  * @returns an array of statement analysis results
  */
 function analyzeResourcePolicy(resourcePolicy, request) {
-    const analysis = [];
+    const resourceAnalysis = {
+        result: 'NotApplicable',
+        allowStatements: [],
+        denyStatements: [],
+        unmatchedStatements: [],
+    };
+    if (!resourcePolicy) {
+        return resourceAnalysis;
+    }
     for (const statement of resourcePolicy.statements()) {
-        analysis.push({
+        const { matches: resourceMatch, details: resourceDetails } = (0, resource_js_1.requestMatchesStatementResources)(request, statement);
+        const { matches: actionMatch, details: actionDetails } = (0, action_js_1.requestMatchesStatementActions)(request, statement);
+        const { matches: principalMatch, details: principalDetails } = (0, principal_js_1.requestMatchesStatementPrincipals)(request, statement);
+        const { matches: conditionMatch, details: conditionDetails } = (0, condition_js_1.requestMatchesConditions)(request, statement.conditions());
+        const overallMatch = (0, StatementAnalysis_js_1.statementMatches)({ actionMatch, conditionMatch, principalMatch, resourceMatch });
+        const analysis = {
             statement,
-            resourceMatch: (0, resource_js_1.requestMatchesStatementResources)(request, statement),
-            actionMatch: (0, action_js_1.requestMatchesStatementActions)(request, statement),
-            conditionMatch: (0, condition_js_1.requestMatchesConditions)(request, statement.conditions()),
-            principalMatch: (0, principal_js_1.requestMatchesStatementPrincipals)(request, statement),
-        });
+            resourceMatch: resourceMatch,
+            actionMatch,
+            conditionMatch,
+            principalMatch,
+            explain: makeStatementExplain(statement, overallMatch, { ...resourceDetails, ...actionDetails, ...principalDetails, ...conditionDetails })
+        };
+        if ((0, StatementAnalysis_js_1.identityStatementExplicitDeny)(analysis) && analysis.principalMatch !== 'NoMatch') {
+            resourceAnalysis.denyStatements.push(analysis);
+        }
+        else if ((0, StatementAnalysis_js_1.identityStatementAllows)(analysis) && analysis.principalMatch !== 'NoMatch') {
+            resourceAnalysis.allowStatements.push(analysis);
+        }
+        else {
+            resourceAnalysis.unmatchedStatements.push(analysis);
+        }
+    }
+    if (resourceAnalysis.denyStatements.some(s => s.principalMatch === 'Match')) {
+        resourceAnalysis.result = 'ExplicitlyDenied';
     }
-    return analysis;
+    else if (resourceAnalysis.denyStatements.some(s => s.principalMatch === 'AccountLevelMatch')) {
+        resourceAnalysis.result = 'DeniedForAccount';
+    }
+    else if (resourceAnalysis.allowStatements.some(s => s.principalMatch === 'Match')) {
+        resourceAnalysis.result = 'Allowed';
+    }
+    else if (resourceAnalysis.allowStatements.some(s => s.principalMatch === 'AccountLevelMatch')) {
+        resourceAnalysis.result = 'AllowedForAccount';
+    }
+    else {
+        resourceAnalysis.result = 'NotApplicable';
+    }
+    return resourceAnalysis;
+}
+function makeStatementExplain(statement, overallMatch, details) {
+    return {
+        effect: statement.effect(),
+        identifier: statement.sid() || statement.index().toString(),
+        matches: overallMatch,
+        ...details
+    };
 }
 //# sourceMappingURL=coreSimulatorEngine.js.map

package/dist/cjs/core_engine/coreSimulatorEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"coreSimulatorEngine.js","sourceRoot":"","sources":["../../../src/core_engine/coreSimulatorEngine.ts"],"names":[],"mappings":";;AA+DA,8BAYC;AASD,oDAMC;AASD,0DAeC;AASD,sEAsBC;AASD,sDAaC;AAtKD,mDAAqE;AACrE,4DAAqE;AAErE,4DAA8E;AAE9E,yDAA2E;AAE3E,yFAAmF;AA6CnF,MAAM,cAAc,GAAgD,EAAE,CAAC;AAEvE;;;;;;;GAOG;AACH,SAAgB,SAAS,CAAC,OAA6B;IACrD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG,6BAA6B,CAAC,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACnG,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtH,OAAO,iBAAiB,CAAC,SAAS,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,kBAAkB,EAAE,gBAAgB;QACpC,WAAW;QACX,gBAAgB;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAA6B;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,IAAG,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,sDAAwB,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,gBAA0B,EAAE,OAAmB;IACrF,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAI,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAI,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS;gBACT,aAAa,EAAE,IAAA,8CAAgC,EAAC,OAAO,EAAE,SAAS,CAAC;gBACnE,WAAW,EAAE,IAAA,0CAA8B,EAAC,OAAO,EAAE,SAAS,CAAC;gBAC/D,cAAc,EAAE,IAAA,uCAAwB,EAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;gBACzE,cAAc,EAAE,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAAC,sBAAgD,EAAE,OAAmB;IACjH,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAI,MAAM,aAAa,IAAI,sBAAsB,EAAE,CAAC;QAClD,MAAM,UAAU,GAAgB;YAC9B,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,iBAAiB,EAAE,EAAE;SACtB,CAAA;QACD,KAAI,MAAM,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3C,KAAI,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC3C,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAChC,SAAS;oBACT,aAAa,EAAE,IAAA,8CAAgC,EAAC,OAAO,EAAE,SAAS,CAAC;oBACnE,WAAW,EAAE,IAAA,0CAA8B,EAAC,OAAO,EAAE,SAAS,CAAC;oBAC/D,cAAc,EAAE,IAAA,uCAAwB,EAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;oBACzE,cAAc,EAAE,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,cAAsB,EAAE,OAAmB;IAC/E,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAI,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS;YACT,aAAa,EAAE,IAAA,8CAAgC,EAAC,OAAO,EAAE,SAAS,CAAC;YACnE,WAAW,EAAE,IAAA,0CAA8B,EAAC,OAAO,EAAE,SAAS,CAAC;YAC/D,cAAc,EAAE,IAAA,uCAAwB,EAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;YACzE,cAAc,EAAE,IAAA,gDAAiC,EAAC,OAAO,EAAE,SAAS,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"coreSimulatorEngine.js","sourceRoot":"","sources":["../../../src/core_engine/coreSimulatorEngine.ts"],"names":[],"mappings":";;AA+DA,8BAYC;AASD,oDAMC;AASD,0DA0CC;AASD,sEAyDC;AASD,sDAgDC;AAvQD,mDAAqE;AACrE,4DAAqE;AAGrE,4DAAoG;AAEpG,yDAA2E;AAC3E,yFAAmF;AAEnF,kEAAsI;AA2CtI,MAAM,cAAc,GAAgD,EAAE,CAAC;AAEvE;;;;;;;GAOG;AACH,SAAgB,SAAS,CAAC,OAA6B;IACrD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG,6BAA6B,CAAC,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACnG,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,iBAAiB,CAAC,SAAS,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,gBAAgB;QAChB,WAAW;QACX,gBAAgB;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAA6B;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,IAAG,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,sDAAwB,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,gBAAmC,EAAE,OAAmB;IAE9F,MAAM,gBAAgB,GAAqB;QACzC,MAAM,EAAE,kBAAkB;QAC1B,eAAe,EAAE,EAAE;QACnB,cAAc,EAAE,EAAE;QAClB,mBAAmB,EAAE,EAAE;KACxB,CAAA;IAED,KAAI,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAI,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YAC3C,MAAM,EAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAC,GAAG,IAAA,8CAAgC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChH,MAAM,EAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAC,GAAG,IAAA,0CAA8B,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC1G,MAAM,EAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAC,GAAG,IAAA,uCAAwB,EAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;YACvH,MAAM,cAAc,GAAyB,OAAO,CAAC;YACrD,MAAM,YAAY,GAAG,IAAA,uCAAgB,EAAC,EAAC,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAC,CAAC,CAAC;YACpG,MAAM,iBAAiB,GAAsB;gBAC3C,SAAS;gBACT,aAAa;gBACb,WAAW;gBACX,cAAc;gBACd,cAAc;gBACd,OAAO,EAAE,oBAAoB,CAAC,SAAS,EAAE,YAAY,EAAE,EAAC,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAC,CAAC;aACpH,CAAA;YAED,IAAG,IAAA,oDAA6B,EAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpD,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAG,IAAA,8CAAuB,EAAC,iBAAiB,CAAC,EAAE,CAAC;gBACrD,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAG,gBAAgB,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IAAG,gBAAgB,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAA;IACrC,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAAC,sBAAgD,EAAE,OAAmB;IACjH,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAI,MAAM,aAAa,IAAI,sBAAsB,EAAE,CAAC;QAClD,MAAM,UAAU,GAAkB;YAChC,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,MAAM,EAAE,kBAAkB;YAC1B,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;YAClB,mBAAmB,EAAE,EAAE;SACxB,CAAA;QACD,KAAI,MAAM,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3C,KAAI,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC3C,MAAM,EAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAC,GAAG,IAAA,8CAAgC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAChH,MAAM,EAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAC,GAAG,IAAA,0CAA8B,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC1G,MAAM,EAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAC,GAAG,IAAA,uCAAwB,EAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;gBACvH,MAAM,cAAc,GAAyB,OAAO,CAAA;gBACpD,MAAM,YAAY,GAAG,IAAA,uCAAgB,EAAC,EAAC,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAC,CAAC,CAAC;gBACpG,MAAM,iBAAiB,GAAsB;oBAC3C,SAAS;oBACT,aAAa;oBACb,WAAW;oBACX,cAAc;oBACd,cAAc;oBACd,OAAO,EAAE,oBAAoB,CAAC,SAAS,EAAE,YAAY,EAAE,EAAC,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAC,CAAC;iBACpH,CAAA;gBAED,IAAG,IAAA,8CAAuB,EAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC9C,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACrD,CAAC;qBAAM,IAAI,IAAA,oDAA6B,EAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC5D,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAG,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,MAAM,GAAG,kBAAkB,CAAA;QACxC,CAAC;aAAM,IAAG,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,UAAU,CAAC,MAAM,GAAG,SAAS,CAAA;QAC/B,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,aAAa,GAAqB,kBAAkB,CAAA;IACxD,IAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,kBAAkB,CAAC,EAAE,CAAC;QACzD,aAAa,GAAG,kBAAkB,CAAA;IACpC,CAAC;SAAM,IAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/D,aAAa,GAAG,kBAAkB,CAAA;IACpC,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACzD,aAAa,GAAG,SAAS,CAAA;IAC3B,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,QAAQ;KACrB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,cAA2C,EAAE,OAAmB;IACpG,MAAM,gBAAgB,GAAqB;QACzC,MAAM,EAAE,eAAe;QACvB,eAAe,EAAE,EAAE;QACnB,cAAc,EAAE,EAAE;QAClB,mBAAmB,EAAE,EAAE;KACxB,CAAA;IAED,IAAG,CAAC,cAAc,EAAE,CAAC;QACnB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAI,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC;QACnD,MAAM,EAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAC,GAAG,IAAA,8CAAgC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChH,MAAM,EAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAC,GAAG,IAAA,0CAA8B,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1G,MAAM,EAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAC,GAAG,IAAA,gDAAiC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnH,MAAM,EAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAC,GAAG,IAAA,uCAAwB,EAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QACvH,MAAM,YAAY,GAAG,IAAA,uCAAgB,EAAC,EAAC,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAC,CAAC,CAAC;QACpG,MAAM,QAAQ,GAAsB;YAClC,SAAS;YACT,aAAa,EAAE,aAAa;YAC5B,WAAW;YACX,cAAc;YACd,cAAc;YACd,OAAO,EAAE,oBAAoB,CAAC,SAAS,EAAE,YAAY,EAAE,EAAC,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,GAAG,gBAAgB,EAAC,CAAC;SACzI,CAAA;QACD,IAAG,IAAA,oDAA6B,EAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACpF,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;aAAM,IAAG,IAAA,8CAAuB,EAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACrF,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAG,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,EAAE,CAAC;QAC3E,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IAAG,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,mBAAmB,CAAC,EAAE,CAAC;QAC9F,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,EAAE,CAAC;QACnF,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAA;IACrC,CAAC;SAAM,IAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,mBAAmB,CAAC,EAAE,CAAC;QAC/F,gBAAgB,CAAC,MAAM,GAAG,mBAAmB,CAAA;IAC/C,CAAC;SAAM,CAAC;QACN,gBAAgB,CAAC,MAAM,GAAG,eAAe,CAAA;IAC3C,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAoB,EAAE,YAAqB,EAAE,OAAkC;IAC3G,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QAC1B,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QAC3D,OAAO,EAAE,YAAY;QACrB,GAAG,OAAO;KACX,CAAA;AACH,CAAC"}

package/dist/cjs/evaluate.d.ts

@@ -1,3 +1,49 @@
+import { StatementAnalysis } from "./StatementAnalysis.js";
 export type EvaluationResult = 'Allowed' | 'ExplicitlyDenied' | 'AllowedWithConditions' | 'ImplicitlyDenied' | 'Unknown';
 export type ResourceEvaluationResult = 'NotApplicable' | 'Allowed' | 'ExplicitlyDenied' | 'AllowedForAccount' | 'DeniedForAccount' | 'ImplicityDenied';
+export interface IdentityAnalysis {
+    result: EvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+}
+export interface ResourceAnalysis {
+    result: ResourceEvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+}
+export interface OuScpAnalysis {
+    orgIdentifier: string;
+    result: EvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+}
+export interface ScpAnalysis {
+    /**
+     * OU Result
+     */
+    result: EvaluationResult;
+    ouAnalysis: OuScpAnalysis[];
+}
+/**
+ * The analysis of a request.
+ */
+export interface RequestAnalysis {
+    /**
+     * The result of the evaluation.
+     */
+    result: EvaluationResult;
+    sameAccount: boolean;
+    /**
+     * The result of the evaluation of the resource policy.
+     */
+    identityAnalysis?: IdentityAnalysis;
+    /**
+     * The result of the evaluation of the resource policy.
+     */
+    resourceAnalysis?: ResourceAnalysis;
+    scpAnalysis?: ScpAnalysis;
+}
 //# sourceMappingURL=evaluate.d.ts.map

package/dist/cjs/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/evaluate.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,uBAAuB,GAAG,kBAAkB,GAAG,SAAS,CAAC;AACzH,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG,SAAS,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,uBAAuB,GAAG,kBAAkB,GAAG,SAAS,CAAC;AACzH,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG,SAAS,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;AAEvJ,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB,CAAA;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,wBAAwB,CAAA;IAChC,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,aAAa,EAAE,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAC;IAEzB,WAAW,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B"}

package/dist/cjs/explain/displayExplainCli.d.ts

@@ -0,0 +1,3 @@
+import { StatementExplain } from "./statementExplain.js";
+export declare function printExplain(explain: StatementExplain): void;
+//# sourceMappingURL=displayExplainCli.d.ts.map

package/dist/cjs/explain/displayExplainCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"displayExplainCli.d.ts","sourceRoot":"","sources":["../../../src/explain/displayExplainCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAyFzD,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,QAmErD"}

package/dist/cjs/explain/displayExplainCli.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printExplain = printExplain;
+const explain1 = {
+    // request: {
+    //   action: 's3:GetObject',
+    //   principal: 'arn:aws:iam::123456789012:user/Bob',
+    //   resource: 'arn:aws:s3:::examplebucket/123.txt',
+    //   context: {
+    //     'aws:SecureTransport': 'true',
+    //     's3:ExistingObjectTag/Department': 'Engineering',
+    //     'aws:PrincipalTag/Department': 'Engineering'
+    //   }
+    // },
+    identifier: 'Statement1',
+    matches: true,
+    effect: 'Allow',
+    actions: [
+        {
+            action: 's3:Get*',
+            matches: true
+        },
+        {
+            action: 's3:PutObject',
+            matches: false
+        }
+    ],
+    resources: [
+        {
+            resource: 'arn:aws:s3:::examplebucket/*',
+            errors: [],
+            matches: true
+        },
+        {
+            resource: 'arn:aws:s3:::examplebucket/${aws:PrincipalTag/Department}/*',
+            resolvedValue: 'arn:aws:s3:::examplebucket/Engineering/*',
+            errors: [],
+            matches: true
+        },
+        {
+            resource: 'arn:aws:s3:::examplebucket/abc/*',
+            errors: [],
+            matches: false
+        }
+    ],
+    conditions: [
+        {
+            conditionKeyValue: 'aws:SecureTransport',
+            resolvedConditionKeyValue: 'true',
+            operator: 'Bool',
+            matches: true,
+            values: {
+                value: 'true',
+                resolvedValue: 'true',
+                matches: true,
+                errors: []
+            },
+        }, {
+            conditionKeyValue: 's3:PrincipalTag/Department',
+            resolvedConditionKeyValue: 'Engineering',
+            operator: 'StringEquals',
+            matches: true,
+            values: [
+                {
+                    value: 'Engineering',
+                    resolvedValue: 'Engineering',
+                    matches: true,
+                    errors: []
+                },
+                {
+                    value: 'Quality',
+                    resolvedValue: 'Engineering',
+                    matches: false,
+                    errors: []
+                }
+            ]
+        }
+    ]
+};
+function buffers(n) {
+    return '  '.repeat(n);
+}
+function printExplain(explain) {
+    const buffer = '  ';
+    console.log(`{`);
+    if (explain.matches) {
+        console.log(`${buffer}// Statement ${explain.identifier} Matches`);
+    }
+    else {
+        console.log(`${buffer}// Statement ${explain.identifier} Does NOT Match`);
+    }
+    if (explain.actions && !Array.isArray(explain.actions)) {
+        const actionString = `${buffer}"Action": "${explain.actions.action}", // ${explain.actions.matches ? 'Match' : 'No Match'}`;
+    }
+    else if (explain.actions && Array.isArray(explain.actions)) {
+        console.log(`${buffer}"Action": [`);
+        for (const action of explain.actions) {
+            console.log(`${buffers(2)}"${action.action}", // ${action.matches ? 'Match' : 'No Match'}`);
+        }
+        console.log(`${buffer}]`);
+    }
+    if (explain.resources && !Array.isArray(explain.resources)) {
+        if (explain.resources.resolvedValue) {
+            console.log(`${buffer}        //${explain.resources.resolvedValue} // Resolved Value`);
+        }
+        console.log(`${buffer}"Resource": "${explain.resources.resource}", // ${explain.resources.matches ? 'Match' : 'No Match'}`);
+    }
+    else if (explain.resources && Array.isArray(explain.resources)) {
+        console.log(`${buffer}"Resource": [`);
+        for (const resource of explain.resources) {
+            let resourceLine = `${buffers(2)}"${resource.resource}", // ${resource.matches ? 'Match' : 'No Match'}`;
+            if (resource.resolvedValue) {
+                resourceLine += ` Resolved to "${resource.resolvedValue}"`;
+            }
+            console.log(resourceLine);
+        }
+        console.log(`${buffer}]`);
+    }
+    if (explain.conditions) {
+        const operators = explain.conditions.map(c => c.operator);
+        console.log(`${buffer}"Condition": {`);
+        for (const op of operators) {
+            const opConditions = explain.conditions.filter(c => c.operator === op);
+            console.log(`${buffers(2)}"${op}": {`);
+            for (const c of opConditions) {
+                if (c.values && !Array.isArray(c.values)) {
+                    console.log(`${buffers(3)}"${c.conditionKeyValue}": "${c.values.value}", // ${c.matches ? 'Match' : 'No Match'}`);
+                    // console.log(`${buffers(3)}"Value": "${c.values.value}", // ${c.values.matches ? 'Match' : 'No Match'}`)
+                }
+                else if (c.values && Array.isArray(c.values)) {
+                    console.log(`${buffers(3)}"${c.conditionKeyValue}": [`);
+                    for (const v of c.values) {
+                        console.log(`${buffers(4)}"${v.value}", // ${v.matches ? 'Match' : 'No Match'}`);
+                    }
+                    console.log(`${buffers(3)}]`);
+                }
+            }
+            console.log(`${buffers(2)}}`);
+        }
+        console.log(`${buffer}}`);
+    }
+    console.log(`}`);
+}
+printExplain(explain1);
+//# sourceMappingURL=displayExplainCli.js.map

package/dist/cjs/explain/displayExplainCli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"displayExplainCli.js","sourceRoot":"","sources":["../../../src/explain/displayExplainCli.ts"],"names":[],"mappings":";;AAyFA,oCAmEC;AA1JD,MAAM,QAAQ,GAAqB;IACjC,aAAa;IACb,4BAA4B;IAC5B,qDAAqD;IACrD,oDAAoD;IACpD,eAAe;IACf,qCAAqC;IACrC,wDAAwD;IACxD,mDAAmD;IACnD,MAAM;IACN,KAAK;IAEL,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,IAAI;IAEb,MAAM,EAAE,OAAO;IACf,OAAO,EAAE;QACP;YACE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;SACd;QACD;YACE,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,KAAK;SACf;KACF;IAED,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,8BAA8B;YACxC,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd;QACD;YACE,QAAQ,EAAE,6DAA6D;YACvE,aAAa,EAAE,0CAA0C;YACzD,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd;QACD;YACE,QAAQ,EAAE,kCAAkC;YAC5C,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,KAAK;SACf;KACF;IAID,UAAU,EAAE;QACV;YACE,iBAAiB,EAAE,qBAAqB;YACxC,yBAAyB,EAAE,MAAM;YACjC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,MAAM,EAAC;gBACH,KAAK,EAAE,MAAM;gBACb,aAAa,EAAE,MAAM;gBACrB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;aACb;SACF,EAAE;YACD,iBAAiB,EAAE,4BAA4B;YAC/C,yBAAyB,EAAE,aAAa;YACxC,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,EAAE;iBACX;gBACD;oBACE,KAAK,EAAE,SAAS;oBAChB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,EAAE;iBACX;aACF;SACF;KACF;CACF,CAAA;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACvB,CAAC;AAED,SAAgB,YAAY,CAAC,OAAyB;IACpD,MAAM,MAAM,GAAG,IAAI,CAAA;IAEnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhB,IAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,OAAO,CAAC,UAAU,UAAU,CAAC,CAAA;IACpE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,OAAO,CAAC,UAAU,iBAAiB,CAAC,CAAA;IAC3E,CAAC;IAED,IAAG,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,GAAG,MAAM,cAAc,OAAO,CAAC,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;IAC7H,CAAC;SAAM,IAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,CAAC,CAAA;QACnC,KAAI,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,IAAG,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,IAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,OAAO,CAAC,SAAS,CAAC,aAAa,oBAAoB,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,OAAO,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;IAC7H,CAAC;SAAM,IAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,eAAe,CAAC,CAAA;QACrC,KAAI,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,SAAS,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;YACvG,IAAG,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC1B,YAAY,IAAI,iBAAiB,QAAQ,CAAC,aAAa,GAAG,CAAA;YAC5D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,IAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACzD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAA;QACtC,KAAI,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAA;YACtE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACtC,KAAI,MAAM,CAAC,IAAI,YAAY,EAAG,CAAC;gBAC7B,IAAG,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;oBACjH,0GAA0G;gBAC5G,CAAC;qBAAM,IAAG,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,MAAM,CAAC,CAAA;oBACvD,KAAI,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;wBACxB,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;oBAClF,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC/B,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IAE3B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAGlB,CAAC;AAED,YAAY,CAAC,QAAQ,CAAC,CAAA"}

package/dist/cjs/explain/statementExplain.d.ts

@@ -0,0 +1,50 @@
+export interface ActionExplain {
+    action: string;
+    matches: boolean;
+}
+export interface ResourceExplain {
+    resource: string;
+    resolvedValue?: string;
+    errors?: string[];
+    matches: boolean;
+}
+export interface PrincipalExplain {
+    principal: string;
+    matches: 'Match' | 'NoMatch' | 'AccountLevelMatch';
+    roleForSessionArn?: string;
+    errors?: string[];
+}
+export interface ConditionValueExplain {
+    value: string;
+    resolvedValue?: string;
+    matches: boolean;
+    matchingValues?: string[];
+    negativeMatchingValues?: string[];
+    errors?: string[];
+}
+export interface ConditionExplain {
+    operator: string;
+    conditionKeyValue: string;
+    resolvedConditionKeyValue?: string;
+    values: ConditionValueExplain | ConditionValueExplain[];
+    unmatchedValues?: string[];
+    matches: boolean;
+    matchedBecauseMissing?: boolean;
+    failedBecauseMissing?: boolean;
+    failedBecauseArray?: boolean;
+    failedBecauseNotArray?: boolean;
+    missingOperator?: boolean;
+}
+export interface StatementExplain {
+    matches: boolean;
+    identifier: string;
+    effect: string;
+    actions?: ActionExplain | ActionExplain[];
+    notActions?: ActionExplain | ActionExplain[];
+    resources?: ResourceExplain | ResourceExplain[];
+    notResources?: ResourceExplain | ResourceExplain[];
+    principals?: PrincipalExplain | PrincipalExplain[];
+    notPrincipals?: PrincipalExplain | PrincipalExplain[];
+    conditions?: ConditionExplain[];
+}
+//# sourceMappingURL=statementExplain.d.ts.map

package/dist/cjs/explain/statementExplain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statementExplain.d.ts","sourceRoot":"","sources":["../../../src/explain/statementExplain.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAA;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,MAAM,EAAE,qBAAqB,GAAG,qBAAqB,EAAE,CAAA;IACvD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAQ/B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,aAAa,GAAG,aAAa,EAAE,CAAA;IACzC,UAAU,CAAC,EAAE,aAAa,GAAG,aAAa,EAAE,CAAA;IAC5C,SAAS,CAAC,EAAE,eAAe,GAAG,eAAe,EAAE,CAAA;IAC/C,YAAY,CAAC,EAAE,eAAe,GAAG,eAAe,EAAE,CAAA;IAClD,UAAU,CAAC,EAAG,gBAAgB,GAAG,gBAAgB,EAAE,CAAA;IACnD,aAAa,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAA;IACrD,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAChC"}

package/dist/cjs/explain/statementExplain.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/*
+I want to emit the policy object exactly as it was written. How do I get a structure
+that matches the policy object exactly? Should I just embed the values in the explain?
+*/
+//# sourceMappingURL=statementExplain.js.map

package/dist/cjs/explain/statementExplain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statementExplain.js","sourceRoot":"","sources":["../../../src/explain/statementExplain.ts"],"names":[],"mappings":";;AA8DA;;;EAGE"}

package/dist/cjs/index.d.ts

@@ -2,6 +2,7 @@ export { typeForContextKey } from './context_keys/contextKeys.js';
 export { BaseConditionKeyType, isConditionKeyArray, type ConditionKeyType } from './context_keys/contextKeyTypes.js';
 export { findContextKeys } from './context_keys/findContextKeys.js';
 export { type EvaluationResult } from './evaluate.js';
+export type { ActionExplain, ConditionExplain, ConditionValueExplain, PrincipalExplain, ResourceExplain, StatementExplain } from './explain/statementExplain.js';
 export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
 export { type Simulation } from './simulation_engine/simulation.js';
 export { runSimulation } from './simulation_engine/simulationEngine.js';

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrH,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrH,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjK,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC"}

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAkE;AAAzD,mHAAA,iBAAiB,OAAA;AAC1B,wEAAqH;AAAtF,yHAAA,mBAAmB,OAAA;AAClD,wEAAoE;AAA3D,qHAAA,eAAe,OAAA;AAExB,qEAAkF;AAAzE,8HAAA,4BAA4B,OAAA;AAErC,+EAAwE;AAA/D,oHAAA,aAAa,OAAA;AAEtB,2FAAoF;AAA3E,gIAAA,mBAAmB,OAAA;AAC5B,qCAAiD;AAAxC,+GAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAkE;AAAzD,mHAAA,iBAAiB,OAAA;AAC1B,wEAAqH;AAAtF,yHAAA,mBAAmB,OAAA;AAClD,wEAAoE;AAA3D,qHAAA,eAAe,OAAA;AAGxB,qEAAkF;AAAzE,8HAAA,4BAA4B,OAAA;AAErC,+EAAwE;AAA/D,oHAAA,aAAa,OAAA;AAEtB,2FAAoF;AAA3E,gIAAA,mBAAmB,OAAA;AAC5B,qCAAiD;AAAxC,+GAAA,oBAAoB,OAAA"}

package/dist/cjs/principal/principal.d.ts

@@ -1,4 +1,5 @@
 import { Principal, Statement } from "@cloud-copilot/iam-policy";
+import { PrincipalExplain, StatementExplain } from "../explain/statementExplain.js";
 import { AwsRequest } from "../request/request.js";
 export type PrincipalMatchResult = 'Match' | 'NoMatch' | 'AccountLevelMatch';
 /**
@@ -8,7 +9,10 @@ export type PrincipalMatchResult = 'Match' | 'NoMatch' | 'AccountLevelMatch';
  * @param principal the list of principals in the Principal element of the Statement
  * @returns if the request matches the Principal element, and if so, how it matches
  */
-export declare function requestMatchesPrincipal(request: AwsRequest, principal: Principal[]): PrincipalMatchResult;
+export declare function requestMatchesPrincipal(request: AwsRequest, principal: Principal[]): {
+    matches: PrincipalMatchResult;
+    explains: PrincipalExplain[];
+};
 /**
  * Check to see if a request matches a NotPrincipal element in an IAM policy statement
  *
@@ -16,7 +20,10 @@ export declare function requestMatchesPrincipal(request: AwsRequest, principal:
  * @param notPrincipal the list of principals in the NotPrincipal element of the Statement
  * @returns
  */
-export declare function requestMatchesNotPrincipal(request: AwsRequest, notPrincipal: Principal[]): PrincipalMatchResult;
+export declare function requestMatchesNotPrincipal(request: AwsRequest, notPrincipal: Principal[]): {
+    matches: PrincipalMatchResult;
+    explains: PrincipalExplain[];
+};
 /**
  * Check to see if a request matches a principal statement
  *
@@ -24,7 +31,7 @@ export declare function requestMatchesNotPrincipal(request: AwsRequest, notPrinc
  * @param principalStatement the principal statement to check the request against
  * @returns if the request matches the principal statement, and if so, how it matches
  */
-export declare function requestMatchesPrincipalStatement(request: AwsRequest, principalStatement: Principal): PrincipalMatchResult;
+export declare function requestMatchesPrincipalStatement(request: AwsRequest, principalStatement: Principal): PrincipalExplain;
 export declare function isAssumedRoleArn(principal: string): boolean;
 export declare function roleArnFromAssumedRoleArn(assumedRoleArn: string): string;
 /**
@@ -34,5 +41,8 @@ export declare function roleArnFromAssumedRoleArn(assumedRoleArn: string): strin
  * @param statement the statement to check against
  * @returns true if the request matches the resources in the statement, false otherwise
  */
-export declare function requestMatchesStatementPrincipals(request: AwsRequest, statement: Statement): PrincipalMatchResult;
+export declare function requestMatchesStatementPrincipals(request: AwsRequest, statement: Statement): {
+    matches: PrincipalMatchResult;
+    details: Pick<StatementExplain, 'principals' | 'notPrincipals'>;
+};
 //# sourceMappingURL=principal.d.ts.map

package/dist/cjs/principal/principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AA4CnD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAE5E;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAWzG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAiB/G;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,GAAG,oBAAoB,CAgDzH;AAID,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAKxE;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,oBAAoB,CAOjH"}
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AA4CnD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAE5E;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG;IAAC,OAAO,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAAC,CAoBlJ;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG;IAAC,OAAO,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAAC,CAyCxJ;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,GAAG,gBAAgB,CAqFrH;AAID,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAKxE;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG;IAAC,OAAO,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,eAAe,CAAC,CAAA;CAAC,CAS7L"}