npm - @cloud-copilot/iam-simulate - Versions diffs - 0.1.49 → 0.1.50 - Mend

@cloud-copilot/iam-simulate 0.1.49 → 0.1.50

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (75) hide show

package/dist/cjs/simulation_engine/simulationOptions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"simulationOptions.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/simulationOptions.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,~~qBAAqB~~,EAAE,~~OAAO~~,CAAA;CAC/B"}
1	+ {"version":3,"file":"simulationOptions.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/simulationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEtE,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC/B"}

package/dist/cjs/simulation_engine/unsafeSimulationEngine.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"unsafeSimulationEngine.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/unsafeSimulationEngine.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE1D;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAC5C,gBAAgB,~~CAkDlB~~"}
1	+ {"version":3,"file":"unsafeSimulationEngine.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/unsafeSimulationEngine.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE1D;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAC5C,gBAAgB,CAsDlB"}

package/dist/cjs/simulation_engine/unsafeSimulationEngine.js CHANGED Viewed

@@ -43,7 +43,11 @@ function runUnsafeSimulation(simulation, simulationOptions) {
         serviceControlPolicies,
         resourceControlPolicies,
         resourcePolicy: simulation.resourcePolicy ? (0, iam_policy_1.loadPolicy)(simulation.resourcePolicy) : undefined,
-        permissionBoundaries
+        permissionBoundaries,
+        simulationParameters: {
+            simulationMode: 'Strict',
+            strictConditionKeys: new Set()
+        }
     });
     return analysis.result;
 }

package/dist/cjs/simulation_engine/unsafeSimulationEngine.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"unsafeSimulationEngine.js","sourceRoot":"","sources":["../../../src/simulation_engine/unsafeSimulationEngine.ts"],"names":[],"mappings":";;AAgBA,~~kDAqDC~~;~~AArED~~,0DAAsD;AACtD,kFAAkF;AAElF,sDAAsD;AACtD,4DAAyD;AAIzD;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,UAAsB,EACtB,iBAA6C;IAE7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5E,IAAA,uBAAU,EAAC,CAAC,CAAC,MAAM,CAAC,CACrB,CAAA;IACD,MAAM,sBAAsB,GAAsB,UAAU,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAA;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAElE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,QAAQ;SACnB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,uBAAuB,GAAsB,UAAU,CAAC,uBAAuB,CAAC,GAAG,CACvF,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAA;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAElE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,QAAQ;SACnB,CAAA;IACH,CAAC,CACF,CAAA;IAED,MAAM,oBAAoB,GACxB,UAAU,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAA;IAE1F,MAAM,cAAc,GAAG,IAAI,sCAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,2BAAc,CAChC,UAAU,CAAC,OAAO,CAAC,SAAS,EAC5B;QACE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ;QAC9C,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS;KACjD,EACD,UAAU,CAAC,OAAO,CAAC,MAAM,EACzB,cAAc,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,IAAA,kCAAS,EAAC;QACzB,OAAO;QACP,gBAAgB;QAChB,sBAAsB;QACtB,uBAAuB;QACvB,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,uBAAU,EAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7F,oBAAoB;~~KACrB~~,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAA;AACxB,CAAC"}
1	+ {"version":3,"file":"unsafeSimulationEngine.js","sourceRoot":"","sources":["../../../src/simulation_engine/unsafeSimulationEngine.ts"],"names":[],"mappings":";;AAgBA,kDAyDC;AAzED,0DAAsD;AACtD,kFAAkF;AAElF,sDAAsD;AACtD,4DAAyD;AAIzD;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,UAAsB,EACtB,iBAA6C;IAE7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5E,IAAA,uBAAU,EAAC,CAAC,CAAC,MAAM,CAAC,CACrB,CAAA;IACD,MAAM,sBAAsB,GAAsB,UAAU,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAA;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAElE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,QAAQ;SACnB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,uBAAuB,GAAsB,UAAU,CAAC,uBAAuB,CAAC,GAAG,CACvF,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAA;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAElE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,QAAQ;SACnB,CAAA;IACH,CAAC,CACF,CAAA;IAED,MAAM,oBAAoB,GACxB,UAAU,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,uBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAA;IAE1F,MAAM,cAAc,GAAG,IAAI,sCAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,2BAAc,CAChC,UAAU,CAAC,OAAO,CAAC,SAAS,EAC5B;QACE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ;QAC9C,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS;KACjD,EACD,UAAU,CAAC,OAAO,CAAC,MAAM,EACzB,cAAc,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,IAAA,kCAAS,EAAC;QACzB,OAAO;QACP,gBAAgB;QAChB,sBAAsB;QACtB,uBAAuB;QACvB,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,uBAAU,EAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7F,oBAAoB;QACpB,oBAAoB,EAAE;YACpB,cAAc,EAAE,QAAQ;YACxB,mBAAmB,EAAE,IAAI,GAAG,EAAE;SAC/B;KACF,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAA;AACxB,CAAC"}

package/dist/esm/StatementAnalysis.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { Statement } from '@cloud-copilot/iam-policy';
+import { Condition, Statement } from '@cloud-copilot/iam-policy';
 import { ConditionMatchResult } from './condition/condition.js';
 import { StatementExplain } from './explain/statementExplain.js';
 import { PrincipalMatchResult } from './principal/principal.js';
@@ -27,7 +27,18 @@ export interface StatementAnalysis {
      * Whether the Conditions matches the request.
      */
     conditionMatch: ConditionMatchResult;
+    /**
+     * The explain of evaluating the statement.
+     */
     explain: StatementExplain;
+    /**
+     * Any conditions that were ignored during discovery mode.
+     */
+    ignoredConditions?: Condition[];
+    /**
+     * Role Session Name ignored during discovery mode.
+     */
+    ignoredRoleSessionName?: boolean;
 }
 /**
  * Checks if a statement is an identity statement that allows the request.

package/dist/esm/StatementAnalysis.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"StatementAnalysis.d.ts","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;~~AACrD~~,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE/D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,SAAS,EAAE,SAAS,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC,OAAO,EAAE,gBAAgB,CAAA;~~CAC1B~~;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAU7E;AAsBD,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAUnF;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,IAAI,CACZ,iBAAiB,EACjB,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CACtE,GACA,OAAO,CAST"}
1	+ {"version":3,"file":"StatementAnalysis.d.ts","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE/D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,SAAS,EAAE,SAAS,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC;;OAEG;IACH,cAAc,EAAE,oBAAoB,CAAA;IAEpC;;OAEG;IACH,OAAO,EAAE,gBAAgB,CAAA;IAEzB;;OAEG;IACH,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAA;IAE/B;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAU7E;AAsBD,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAUnF;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,IAAI,CACZ,iBAAiB,EACjB,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CACtE,GACA,OAAO,CAST"}

package/dist/esm/StatementAnalysis.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"StatementAnalysis.js","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"~~AAsCA~~;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA4B;IAClE,IACE,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,OAAO,EACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wFAAwF;AACxF,kCAAkC;AAClC,+BAA+B;AAC/B,gDAAgD;AAChD,kDAAkD;AAClD,qBAAqB;AACrB,MAAM;AACN,iBAAiB;AACjB,IAAI;AAEJ,uFAAuF;AACvF,kCAAkC;AAClC,+BAA+B;AAC/B,gDAAgD;AAChD,iDAAiD;AACjD,qBAAqB;AACrB,MAAM;AACN,iBAAiB;AACjB,IAAI;AAEJ,MAAM,UAAU,6BAA6B,CAAC,SAA4B;IACxE,IACE,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,MAAM,EACvC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAGC;IAED,OAAO,CACL,QAAQ,CAAC,aAAa;QACtB,QAAQ,CAAC,WAAW;QACpB,QAAQ,CAAC,cAAc,KAAK,OAAO;QACnC,CAAC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAC7E,QAAQ,CAAC,cAAc,CACxB,CACF,CAAA;AACH,CAAC"}
1	+ {"version":3,"file":"StatementAnalysis.js","sourceRoot":"","sources":["../../src/StatementAnalysis.ts"],"names":[],"mappings":"AAmDA;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA4B;IAClE,IACE,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,OAAO,EACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wFAAwF;AACxF,kCAAkC;AAClC,+BAA+B;AAC/B,gDAAgD;AAChD,kDAAkD;AAClD,qBAAqB;AACrB,MAAM;AACN,iBAAiB;AACjB,IAAI;AAEJ,uFAAuF;AACvF,kCAAkC;AAClC,+BAA+B;AAC/B,gDAAgD;AAChD,iDAAiD;AACjD,qBAAqB;AACrB,MAAM;AACN,iBAAiB;AACjB,IAAI;AAEJ,MAAM,UAAU,6BAA6B,CAAC,SAA4B;IACxE,IACE,SAAS,CAAC,aAAa;QACvB,SAAS,CAAC,WAAW;QACrB,SAAS,CAAC,cAAc,KAAK,OAAO;QACpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,MAAM,EACvC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAGC;IAED,OAAO,CACL,QAAQ,CAAC,aAAa;QACtB,QAAQ,CAAC,WAAW;QACpB,QAAQ,CAAC,cAAc,KAAK,OAAO;QACnC,CAAC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAC7E,QAAQ,CAAC,cAAc,CACxB,CACF,CAAA;AACH,CAAC"}

package/dist/esm/condition/condition.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 import { Condition } from '@cloud-copilot/iam-policy';
+import { SimulationParameters } from '../core_engine/CoreSimulatorEngine.js';
 import { ConditionExplain, StatementExplain } from '../explain/statementExplain.js';
 import { AwsRequest } from '../request/request';
 import { ContextKey } from '../requestContext.js';
@@ -11,9 +12,10 @@ export type ConditionMatchResult = 'Match' | 'NoMatch';
  * @param conditions the conditions to test
  * @returns Match if all conditions match, NoMatch if any do not. Also returns all the details of the evaluation
  */
-export declare function requestMatchesConditions(request: AwsRequest, conditions: Condition[]): {
+export declare function requestMatchesConditions(request: AwsRequest, conditions: Condition[], statementType: 'Allow' | 'Deny', simulationParameters: SimulationParameters): {
     matches: ConditionMatchResult;
     details: Pick<StatementExplain, 'conditions'>;
+    ignoredConditions?: Condition[];
 };
 /**
  * Checks to see if a single condition matches a request
@@ -22,7 +24,7 @@ export declare function requestMatchesConditions(request: AwsRequest, conditions
  * @param condition the condition to test
  * @returns the result of evaluating the condition
  */
-export declare function singleConditionMatchesRequest(request: AwsRequest, condition: Condition): ConditionExplain;
+export declare function singleConditionMatchesRequest(request: AwsRequest, condition: Condition, simulationParameters: SimulationParameters): ConditionExplain;
 export declare function singleValueMatch(request: AwsRequest, condition: Condition, baseOperation: BaseConditionOperator, keyValue: ContextKey | undefined): ConditionExplain;
 /**
  * Tests a condition with a ForAllValues set operator

package/dist/esm/condition/condition.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EACL,gBAAgB,EAEhB,gBAAgB,EACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAkB,MAAM,sBAAsB,CAAA;AAKjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAuBlE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAA;~~AAoCtD~~;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,SAAS,EAAE,~~GACtB~~;~~IAAE~~,OAAO,EAAE,oBAAoB,~~CAAC~~;~~IAAC~~,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAA;~~CAAE~~,~~CAUlF~~;~~AAED~~;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,~~GACnB~~,gBAAgB,CAyBlB;AA0BD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,qBAAqB,EACpC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAC/B,gBAAgB,CAkElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,aAAa,EAAE,qBAAqB,GACnC,gBAAgB,CAyFlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,aAAa,EAAE,qBAAqB,GACnC,gBAAgB,CAiFlB"}
1	+ {"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EACL,gBAAgB,EAEhB,gBAAgB,EACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAkB,MAAM,sBAAsB,CAAA;AAKjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAuBlE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAA;AAyCtD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,SAAS,EAAE,EACvB,aAAa,EAAE,OAAO,GAAG,MAAM,EAC/B,oBAAoB,EAAE,oBAAoB,GACzC;IACD,OAAO,EAAE,oBAAoB,CAAA;IAC7B,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAA;CAChC,CAsCA;AAsBD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,CAyBlB;AA0BD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,qBAAqB,EACpC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAC/B,gBAAgB,CAkElB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,aAAa,EAAE,qBAAqB,GACnC,gBAAgB,CAyFlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,aAAa,EAAE,qBAAqB,GACnC,gBAAgB,CAiFlB"}

package/dist/esm/condition/condition.js CHANGED Viewed

@@ -63,16 +63,55 @@ for (const operator of allOperators) {
  * @param conditions the conditions to test
  * @returns Match if all conditions match, NoMatch if any do not. Also returns all the details of the evaluation
  */
-export function requestMatchesConditions(request, conditions) {
-    const results = conditions.map((condition) => singleConditionMatchesRequest(request, condition));
-    const nonMatch = results.some((result) => !result.matches);
+export function requestMatchesConditions(request, conditions, statementType, simulationParameters) {
+    const results = conditions.map((condition) => ({
+        condition,
+        explain: singleConditionMatchesRequest(request, condition, simulationParameters)
+    }));
+    const isIgnored = (c) => {
+        if (simulationParameters.simulationMode !== 'Discovery') {
+            return false;
+        }
+        if (simulationParameters.strictConditionKeys.has(c.condition.conditionKey().toLowerCase())) {
+            return false;
+        }
+        // In Allows we ignore conditions that do not match
+        if (statementType.toLowerCase() === 'allow') {
+            return !c.explain.matches;
+        }
+        // In Denies we ignore conditions that do match
+        if (statementType.toLowerCase() === 'deny') {
+            return c.explain.matches;
+        }
+        throw new Error(`Unexpected condition explain result in discovery mode, statementType: ${statementType}`);
+    };
+    const nonMatch = results.filter((r) => !isIgnored(r)).some((result) => !result.explain.matches);
+    const ignoredMatches = results
+        .filter((r) => isIgnored(r))
+        .some((result) => result.explain.matches);
     return {
-        matches: nonMatch ? 'NoMatch' : 'Match',
+        matches: nonMatch || ignoredMatches ? 'NoMatch' : 'Match',
         details: {
-            conditions: results.length == 0 ? undefined : results
-        }
+            conditions: results.length == 0 ? undefined : results.map((r) => r.explain)
+        },
+        ignoredConditions: ignoredConditions(results, isIgnored)
     };
 }
+/**
+ * Get the list of conditions that were ignored during discovery mode, if any
+ *
+ * @param conditions the conditions that were evaluated with their explains
+ * @param statementType whether the statement is an allow or deny statement
+ * @param simulationParameters the general parameters for the simulation
+ * @returns an array of ignored conditions, or undefined if there are none
+ */
+function ignoredConditions(conditions, isIgnored) {
+    const ignoredConditions = conditions.filter(isIgnored);
+    if (ignoredConditions.length > 0) {
+        return ignoredConditions.map((r) => r.condition);
+    }
+    return undefined;
+}
 /**
  * Checks to see if a single condition matches a request
  *
@@ -80,7 +119,7 @@ export function requestMatchesConditions(request, conditions) {
  * @param condition the condition to test
  * @returns the result of evaluating the condition
  */
-export function singleConditionMatchesRequest(request, condition) {
+export function singleConditionMatchesRequest(request, condition, simulationParameters) {
     const key = condition.conditionKey();
     const baseOperation = baseOperations[condition.operation().baseOperator().toLowerCase()];
     const keyExists = request.contextKeyExists(key);

package/dist/esm/condition/condition.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"condition.js","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAOA,OAAO,EAAc,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAA;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAA;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAIzD,MAAM,YAAY,GAAG;IACnB,YAAY;IACZ,eAAe;IACf,sBAAsB;IACtB,yBAAyB;IACzB,UAAU;IACV,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,wBAAwB;IACxB,UAAU;IACV,aAAa;IACb,YAAY;IACZ,kBAAkB;IAClB,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,OAAO;IACP,SAAS;IACT,UAAU;IACV,YAAY;CACb,CAAA;AAED,MAAM,cAAc,GAA6C,EAAE,CAAA;AACnE,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;IACpC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAmB,EACnB,UAAuB;IAEvB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;IAChG,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAE1D,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACvC,OAAO,EAAE;YACP,UAAU,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;SACtD;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAmB,EACnB,SAAoB;IAEpB,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,EAAE,CAAA;IACpC,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAExE,IACE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,IAAI,MAAM;QACrD,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,MAAM,EAC7D,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAA;QACvD,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;YAClC,OAAO,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;QACtE,CAAC;aAAM,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,SAAoB,EAAE,SAAkB;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9C,MAAM,eAAe,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzF,OAAO;YACL,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS;SAC3C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QACvE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;KACxD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAmB,EACnB,SAAoB,EACpB,aAAoC,EACpC,QAAgC;IAEhC,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACxF,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,IAAI,aAAa,EAAE,CAAC;QACxD,+CAA+C;QAC/C,sFAAsF;QACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,aAAa,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACzF,KAAK;gBACL,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,CAAA;YACH,OAAO;gBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;gBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;gBACnE,OAAO,EAAE,IAAI;gBACb,qBAAqB,EAAE,IAAI;gBAC3B,yBAAyB,EAAE,QAAQ;aACpC,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC3C,gDAAgD;QAChD,2CAA2C;QAC3C,MAAM,aAAa,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzF,KAAK;YACL,OAAO,EAAE,KAAK;SACf,CAAC,CAAC,CAAA;QACH,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,KAAK;YACd,oBAAoB,EAAE,CAAC,QAAQ;YAC/B,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC7C,CAAA;IACH,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,aAAa,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzF,KAAK;YACL,OAAO,EAAE,KAAK;SACf,CAAC,CAAC,CAAA;QAEH,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;SACtB,CAAA;IACH,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CACjD,OAAO,EACP,QAAQ,CAAC,KAAK,EACd,SAAS,CAAC,eAAe,EAAE,CAC5B,CAAA;IAED,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,yBAAyB,EAAE,QAAQ,CAAC,KAAK;KAC1C,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAmB,EACnB,SAAoB,EACpB,QAAgC,EAChC,aAAoC;IAEpC,MAAM,qBAAqB,GAA4B,SAAS;SAC7D,eAAe,EAAE;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,KAAK;QACL,OAAO,EAAE,IAAI;KACd,CAAC,CAAC,CAAA;IACL,MAAM,wBAAwB,GAA4B,SAAS;SAChE,eAAe,EAAE;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,KAAK;QACL,OAAO,EAAE,KAAK;KACf,CAAC,CAAC,CAAA;IAEL,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,IAAI;YACb,qBAAqB,EAAE,IAAI;SAC5B,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;SACtB,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAA;QAChG,OAAO;YACL,YAAY,EAAE,KAAK;YACnB,OAAO;YACP,QAAQ;SACT,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACjF,MAAM,YAAY,GAAG,CAAC,aAAa,CAAA;IACnC,MAAM,eAAe,GAAa,EAAE,CAAA;IAEpC,MAAM,QAAQ,GAA0C,EAAE,CAAA;IAC1D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YACvD,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,aAAa,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5D,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACxC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAA;gBACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;gBACjD,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,IAAI,EAAE,CAAA;gBAC3D,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;YAC3D,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;gBACxD,UAAU,CAAC,sBAAsB,GAAG,UAAU,CAAC,sBAAsB,IAAI,EAAE,CAAA;gBAC3E,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,OAAO,EAAE,YAAY;QACrB,eAAe;KAChB,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmB,EACnB,SAAoB,EACpB,QAAgC,EAChC,aAAoC;IAEpC,MAAM,mBAAmB,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAClF,CAAC,KAAK,EAAE,EAAE,CACR,CAAC;QACC,KAAK;QACL,OAAO,EAAE,KAAK;KACf,CAA0B,CAC9B,CAAA;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,oBAAoB,EAAE,IAAI;SAC3B,CAAA;QACD,mBAAmB;IACrB,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;SACtB,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAA;QAChG,OAAO;YACL,YAAY,EAAE,KAAK;YACnB,OAAO;YACP,QAAQ;SACT,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC/E,MAAM,eAAe,GAAa,EAAE,CAAA;IAEpC,MAAM,QAAQ,GAA0C,EAAE,CAAA;IAC1D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YACvD,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,aAAa,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5D,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACxC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAA;gBACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,IAAI,EAAE,CAAA;gBAC3D,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,OAAO,EAAE,YAAY;QACrB,eAAe;KAChB,CAAA;AACH,CAAC"}
1	+ {"version":3,"file":"condition.js","sourceRoot":"","sources":["../../../src/condition/condition.ts"],"names":[],"mappings":"AAQA,OAAO,EAAc,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAA;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAA;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAIzD,MAAM,YAAY,GAAG;IACnB,YAAY;IACZ,eAAe;IACf,sBAAsB;IACtB,yBAAyB;IACzB,UAAU;IACV,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,wBAAwB;IACxB,UAAU;IACV,aAAa;IACb,YAAY;IACZ,kBAAkB;IAClB,eAAe;IACf,qBAAqB;IACrB,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,OAAO;IACP,SAAS;IACT,UAAU;IACV,YAAY;CACb,CAAA;AAED,MAAM,cAAc,GAA6C,EAAE,CAAA;AACnE,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;IACpC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAA;AACxD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAmB,EACnB,UAAuB,EACvB,aAA+B,EAC/B,oBAA0C;IAM1C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7C,SAAS;QACT,OAAO,EAAE,6BAA6B,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,CAAC;KACjF,CAAC,CAAC,CAAA;IAEH,MAAM,SAAS,GAAG,CAAC,CAAsB,EAAW,EAAE;QACpD,IAAI,oBAAoB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;YACxD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAA;QACd,CAAC;QACD,mDAAmD;QACnD,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;QAC3B,CAAC;QACD,+CAA+C;QAC/C,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;QAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yEAAyE,aAAa,EAAE,CACzF,CAAA;IACH,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/F,MAAM,cAAc,GAAG,OAAO;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SAC3B,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE3C,OAAO;QACL,OAAO,EAAE,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,OAAgC;QACnF,OAAO,EAAE;YACP,UAAU,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SAC5E;QACD,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC;KACzD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,UAAiC,EACjC,SAA8C;IAE9C,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACtD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAmB,EACnB,SAAoB,EACpB,oBAA0C;IAE1C,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,EAAE,CAAA;IACpC,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAExE,IACE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,IAAI,MAAM;QACrD,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,MAAM,EAC7D,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAA;QACvD,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;YAClC,OAAO,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;QACtE,CAAC;aAAM,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,SAAoB,EAAE,SAAkB;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9C,MAAM,eAAe,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzF,OAAO;YACL,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS;SAC3C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QACvE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;KACxD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAmB,EACnB,SAAoB,EACpB,aAAoC,EACpC,QAAgC;IAEhC,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACxF,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,IAAI,aAAa,EAAE,CAAC;QACxD,+CAA+C;QAC/C,sFAAsF;QACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,aAAa,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACzF,KAAK;gBACL,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,CAAA;YACH,OAAO;gBACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;gBACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;gBACnE,OAAO,EAAE,IAAI;gBACb,qBAAqB,EAAE,IAAI;gBAC3B,yBAAyB,EAAE,QAAQ;aACpC,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC3C,gDAAgD;QAChD,2CAA2C;QAC3C,MAAM,aAAa,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzF,KAAK;YACL,OAAO,EAAE,KAAK;SACf,CAAC,CAAC,CAAA;QACH,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,KAAK;YACd,oBAAoB,EAAE,CAAC,QAAQ;YAC/B,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC7C,CAAA;IACH,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,aAAa,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzF,KAAK;YACL,OAAO,EAAE,KAAK;SACf,CAAC,CAAC,CAAA;QAEH,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;SACtB,CAAA;IACH,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CACjD,OAAO,EACP,QAAQ,CAAC,KAAK,EACd,SAAS,CAAC,eAAe,EAAE,CAC5B,CAAA;IAED,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,yBAAyB,EAAE,QAAQ,CAAC,KAAK;KAC1C,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAmB,EACnB,SAAoB,EACpB,QAAgC,EAChC,aAAoC;IAEpC,MAAM,qBAAqB,GAA4B,SAAS;SAC7D,eAAe,EAAE;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,KAAK;QACL,OAAO,EAAE,IAAI;KACd,CAAC,CAAC,CAAA;IACL,MAAM,wBAAwB,GAA4B,SAAS;SAChE,eAAe,EAAE;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,KAAK;QACL,OAAO,EAAE,KAAK;KACf,CAAC,CAAC,CAAA;IAEL,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,IAAI;YACb,qBAAqB,EAAE,IAAI;SAC5B,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;SACtB,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAA;QAChG,OAAO;YACL,YAAY,EAAE,KAAK;YACnB,OAAO;YACP,QAAQ;SACT,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACjF,MAAM,YAAY,GAAG,CAAC,aAAa,CAAA;IACnC,MAAM,eAAe,GAAa,EAAE,CAAA;IAEpC,MAAM,QAAQ,GAA0C,EAAE,CAAA;IAC1D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YACvD,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,aAAa,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5D,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACxC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAA;gBACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;gBACjD,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,IAAI,EAAE,CAAA;gBAC3D,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;YAC3D,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;gBACxD,UAAU,CAAC,sBAAsB,GAAG,UAAU,CAAC,sBAAsB,IAAI,EAAE,CAAA;gBAC3E,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,OAAO,EAAE,YAAY;QACrB,eAAe;KAChB,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmB,EACnB,SAAoB,EACpB,QAAgC,EAChC,aAAoC;IAEpC,MAAM,mBAAmB,GAA4B,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAClF,CAAC,KAAK,EAAE,EAAE,CACR,CAAC;QACC,KAAK;QACL,OAAO,EAAE,KAAK;KACf,CAA0B,CAC9B,CAAA;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,oBAAoB,EAAE,IAAI;SAC3B,CAAA;QACD,mBAAmB;IACrB,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;YACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,IAAI;SACtB,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAA;QAChG,OAAO;YACL,YAAY,EAAE,KAAK;YACnB,OAAO;YACP,QAAQ;SACT,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC/E,MAAM,eAAe,GAAa,EAAE,CAAA;IAEpC,MAAM,QAAQ,GAA0C,EAAE,CAAA;IAC1D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YACvD,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,aAAa,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5D,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACxC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAA;gBACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,IAAI,EAAE,CAAA;gBAC3D,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;QACvC,iBAAiB,EAAE,SAAS,CAAC,YAAY,EAAE;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,OAAO,EAAE,YAAY;QACrB,eAAe;KAChB,CAAA;AACH,CAAC"}

package/dist/esm/condition/ipaddress/ip.d.ts CHANGED Viewed

@@ -4,6 +4,7 @@ import { ConditionValueExplain } from '../../explain/statementExplain.js';
  *
  * @param policyValue - The CIDR block to check against.
  * @param requestValue - The IP address to check.
+ * @param expectInCidr - If true, the function checks if the request value is within the CIDR block; if false, it checks if it is outside.
  * @returns An object explaining the result.
  */
 export declare function checkIfIpAddress(policyValue: string, requestValue: string, expectInCidr: boolean): ConditionValueExplain;

package/dist/esm/condition/ipaddress/ip.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ip.d.ts","sourceRoot":"","sources":["../../../../src/condition/ipaddress/ip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AAIzE~~;;;;;;GAMG~~;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,OAAO,GACpB,qBAAqB,~~CA8CvB~~"}
1	+ {"version":3,"file":"ip.d.ts","sourceRoot":"","sources":["../../../../src/condition/ipaddress/ip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AAIzE;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,OAAO,GACpB,qBAAqB,CA6DvB"}

package/dist/esm/condition/ipaddress/ip.js CHANGED Viewed

@@ -5,6 +5,7 @@ import { isIpInCidrV6, isValidIpCidrV6, isValidIpV6 } from './ipv6.js';
  *
  * @param policyValue - The CIDR block to check against.
  * @param requestValue - The IP address to check.
+ * @param expectInCidr - If true, the function checks if the request value is within the CIDR block; if false, it checks if it is outside.
  * @returns An object explaining the result.
  */
 export function checkIfIpAddress(policyValue, requestValue, expectInCidr) {
@@ -26,6 +27,12 @@ export function checkIfIpAddress(policyValue, requestValue, expectInCidr) {
             value: policyValue
         };
     }
+    if (isValidIpV4(policyValue)) {
+        return {
+            matches: isValidIpV4(requestValue) && (policyValue === requestValue) == expectInCidr,
+            value: policyValue
+        };
+    }
     if (isValidIpCidrV6(policyValue)) {
         if (isValidIpV4(requestValue)) {
             return {
@@ -45,6 +52,12 @@ export function checkIfIpAddress(policyValue, requestValue, expectInCidr) {
             value: policyValue
         };
     }
+    if (isValidIpV6(policyValue)) {
+        return {
+            matches: isValidIpV6(requestValue) && (policyValue === requestValue) == expectInCidr,
+            value: policyValue
+        };
+    }
     return {
         matches: false,
         value: policyValue,

package/dist/esm/condition/ipaddress/ip.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ip.js","sourceRoot":"","sources":["../../../../src/condition/ipaddress/ip.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEtE~~;;;;;;GAMG~~;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,YAAoB,EACpB,YAAqB;IAErB,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK,IAAI,YAAY;gBAC9B,KAAK,EAAE,WAAW;aACnB,CAAA;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;aACnB,CAAA;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,YAAY;YAChE,KAAK,EAAE,WAAW;SACnB,CAAA;IACH,CAAC;~~IACD~~,IAAI,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK,IAAI,YAAY;gBAC9B,KAAK,EAAE,WAAW;aACnB,CAAA;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,CAAC,kBAAkB,YAAY,4BAA4B,CAAC;aACrE,CAAA;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,YAAY;YAChE,KAAK,EAAE,WAAW;SACnB,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,CAAC,GAAG,WAAW,4BAA4B,CAAC;KACrD,CAAA;AACH,CAAC"}
1	+ {"version":3,"file":"ip.js","sourceRoot":"","sources":["../../../../src/condition/ipaddress/ip.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEtE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,YAAoB,EACpB,YAAqB;IAErB,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK,IAAI,YAAY;gBAC9B,KAAK,EAAE,WAAW;aACnB,CAAA;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;aACnB,CAAA;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,YAAY;YAChE,KAAK,EAAE,WAAW;SACnB,CAAA;IACH,CAAC;IAED,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,KAAK,YAAY,CAAC,IAAI,YAAY;YACpF,KAAK,EAAE,WAAW;SACnB,CAAA;IACH,CAAC;IAED,IAAI,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK,IAAI,YAAY;gBAC9B,KAAK,EAAE,WAAW;aACnB,CAAA;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,CAAC,kBAAkB,YAAY,4BAA4B,CAAC;aACrE,CAAA;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,YAAY;YAChE,KAAK,EAAE,WAAW;SACnB,CAAA;IACH,CAAC;IAED,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,KAAK,YAAY,CAAC,IAAI,YAAY;YACpF,KAAK,EAAE,WAAW;SACnB,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,CAAC,GAAG,WAAW,4BAA4B,CAAC;KACrD,CAAA;AACH,CAAC"}

package/dist/esm/core_engine/CoreSimulatorEngine.d.ts CHANGED Viewed

@@ -2,6 +2,27 @@ import { Policy } from '@cloud-copilot/iam-policy';
 import { IdentityAnalysis, RcpAnalysis, RequestAnalysis, ResourceAnalysis, ScpAnalysis } from '../evaluate.js';
 import { AwsRequest } from '../request/request.js';
 import { ServiceAuthorizer } from '../services/ServiceAuthorizer.js';
+export declare const validSimulationModes: readonly ["Strict", "Discovery"];
+/**
+ * The mode of simulation for the core engine.
+ * - Strict: Simulates the request as if it were being made in a real AWS environment.
+ * - Discovery: Simulates the request but discovers under what conditions it would be allowed.
+ */
+export type SimulationMode = (typeof validSimulationModes)[number];
+/**
+ * Meta parameters for the simulation engine.
+ */
+export interface SimulationParameters {
+    /**
+     * The simulation mode to use for the request.
+     */
+    simulationMode: SimulationMode;
+    /**
+     * Condition keys that should be evaluated strictly in the simulation. Used only in Discovery mode.
+     * In Strict mode, all condition keys are evaluated strictly
+     */
+    strictConditionKeys: Set<string>;
+}
 /**
  * A set of service or resource control policies for each level of an organization tree
  */
@@ -45,6 +66,10 @@ export interface AuthorizationRequest {
      * The permission boundaries that apply to the principal making the request.
      */
     permissionBoundaries: Policy[] | undefined;
+    /**
+     * The simulation parameters for the request.
+     */
+    simulationParameters: SimulationParameters;
 }
 /**
  * Authorizes a request.
@@ -70,7 +95,7 @@ export declare function getServiceAuthorizer(request: AuthorizationRequest): Ser
  * @param request the request to analyze against
  * @returns an array of statement analysis results
  */
-export declare function analyzeIdentityPolicies(identityPolicies: Policy[], request: AwsRequest): IdentityAnalysis;
+export declare function analyzeIdentityPolicies(identityPolicies: Policy[], request: AwsRequest, simulationParameters: SimulationParameters): IdentityAnalysis;
 /**
  * Analyzes a set of service or resource control policies and the statements within them.
  *
@@ -78,7 +103,7 @@ export declare function analyzeIdentityPolicies(identityPolicies: Policy[], requ
  * @param request the request to analyze against
  * @returns an array of SCP or RCP analysis results
  */
-export declare function analyzeControlPolicies(controlPolicies: ControlPolicies[], request: AwsRequest): ScpAnalysis | RcpAnalysis;
+export declare function analyzeControlPolicies(controlPolicies: ControlPolicies[], request: AwsRequest, simulationParameters: SimulationParameters): ScpAnalysis | RcpAnalysis;
 /**
  * Analyze a resource policy and return the results
  *
@@ -86,6 +111,6 @@ export declare function analyzeControlPolicies(controlPolicies: ControlPolicies[
  * @param request the request to analyze against
  * @returns an array of statement analysis results
  */
-export declare function analyzeResourcePolicy(resourcePolicy: Policy | undefined, request: AwsRequest, principalHasPermissionBoundary: boolean): ResourceAnalysis;
-export declare function analyzePermissionBoundaryPolicies(permissionBoundaries: Policy[] | undefined, request: AwsRequest): IdentityAnalysis | undefined;
+export declare function analyzeResourcePolicy(resourcePolicy: Policy | undefined, request: AwsRequest, principalHasPermissionBoundary: boolean, simulationParameters: SimulationParameters): ResourceAnalysis;
+export declare function analyzePermissionBoundaryPolicies(permissionBoundaries: Policy[] | undefined, request: AwsRequest, simulationParameters: SimulationParameters): IdentityAnalysis | undefined;
 //# sourceMappingURL=CoreSimulatorEngine.d.ts.map

package/dist/esm/core_engine/CoreSimulatorEngine.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"CoreSimulatorEngine.d.ts","sourceRoot":"","sources":["../../../src/core_engine/CoreSimulatorEngine.ts"],"names":[],"mappings":"AAAA,OAAO,~~EAAE~~,MAAM,EAAa,MAAM,2BAA2B,CAAA;~~AAG7D~~,OAAO,EAEL,gBAAgB,~~EAEhB~~,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,WAAW,EACZ,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAKlD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AASpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAA;IAEnB;;OAEG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,eAAe,EAAE,CAAA;IAEzC;;;OAGG;IACH,uBAAuB,EAAE,eAAe,EAAE,CAAA;IAE1C;;OAEG;IACH,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAElC;;OAEG;IACH,oBAAoB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CAC3C;AAQD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,~~CA+BxE~~;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,CAMrF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,EAAE,UAAU,~~GAClB~~,gBAAgB,~~CA+DlB~~;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,eAAe,EAAE,EAClC,OAAO,EAAE,UAAU,~~GAClB~~,WAAW,GAAG,WAAW,~~CA6E3B~~;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,OAAO,EAAE,UAAU,EACnB,8BAA8B,EAAE,OAAO,~~GACtC~~,gBAAgB,~~CA+GlB~~;AAED,wBAAgB,iCAAiC,CAC/C,oBAAoB,EAAE,MAAM,EAAE,GAAG,SAAS,EAC1C,OAAO,EAAE,UAAU,~~GAClB~~,gBAAgB,GAAG,SAAS,CAM9B"}
1	+ {"version":3,"file":"CoreSimulatorEngine.d.ts","sourceRoot":"","sources":["../../../src/core_engine/CoreSimulatorEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,MAAM,EAAa,MAAM,2BAA2B,CAAA;AAGxE,OAAO,EAEL,gBAAgB,EAGhB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,WAAW,EACZ,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAKlD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AASpE,eAAO,MAAM,oBAAoB,kCAAmC,CAAA;AAEpE;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AAElE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;;OAGG;IACH,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAA;IAEnB;;OAEG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,eAAe,EAAE,CAAA;IAEzC;;;OAGG;IACH,uBAAuB,EAAE,eAAe,EAAE,CAAA;IAE1C;;OAEG;IACH,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAElC;;OAEG;IACH,oBAAoB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAE1C;;OAEG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;CAC3C;AAQD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CAiExE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,CAMrF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,CAuElB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,eAAe,EAAE,EAClC,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,GACzC,WAAW,GAAG,WAAW,CAsF3B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,OAAO,EAAE,UAAU,EACnB,8BAA8B,EAAE,OAAO,EACvC,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,CAyHlB;AAED,wBAAgB,iCAAiC,CAC/C,oBAAoB,EAAE,MAAM,EAAE,GAAG,SAAS,EAC1C,OAAO,EAAE,UAAU,EACnB,oBAAoB,EAAE,oBAAoB,GACzC,gBAAgB,GAAG,SAAS,CAM9B"}

package/dist/esm/core_engine/CoreSimulatorEngine.js CHANGED Viewed

@@ -7,6 +7,7 @@ import { IamServiceAuthorizer } from '../services/IamServiceAuthorizer.js';
 import { KmsServiceAuthorizer } from '../services/KmsServiceAuthorizer.js';
 import { StsServiceAuthorizer } from '../services/StsServiceAuthorizer.js';
 import { identityStatementAllows, identityStatementExplicitDeny, statementMatches } from '../StatementAnalysis.js';
+export const validSimulationModes = ['Strict', 'Discovery'];
 const serviceEngines = {
     kms: KmsServiceAuthorizer,
     sts: StsServiceAuthorizer,
@@ -22,20 +23,27 @@ const serviceEngines = {
  */
 export function authorize(request) {
     const principalHasPermissionBoundary = !!request.permissionBoundaries && request.permissionBoundaries.length > 0;
-    const identityAnalysis = analyzeIdentityPolicies(request.identityPolicies, request.request);
-    const permissionBoundaryAnalysis = analyzePermissionBoundaryPolicies(request.permissionBoundaries, request.request);
-    const scpAnalysis = analyzeControlPolicies(request.serviceControlPolicies, request.request);
-    const rcpAnalysis = analyzeControlPolicies(request.resourceControlPolicies, request.request);
-    const resourceAnalysis = analyzeResourcePolicy(request.resourcePolicy, request.request, principalHasPermissionBoundary);
+    const simulationParameters = request.simulationParameters;
+    const identityAnalysis = analyzeIdentityPolicies(request.identityPolicies, request.request, simulationParameters);
+    const permissionBoundaryAnalysis = analyzePermissionBoundaryPolicies(request.permissionBoundaries, request.request, simulationParameters);
+    const scpAnalysis = analyzeControlPolicies(request.serviceControlPolicies, request.request, simulationParameters);
+    const rcpAnalysis = analyzeControlPolicies(request.resourceControlPolicies, request.request, simulationParameters);
+    const resourceAnalysis = analyzeResourcePolicy(request.resourcePolicy, request.request, principalHasPermissionBoundary, simulationParameters);
     const serviceAuthorizer = getServiceAuthorizer(request);
-    return serviceAuthorizer.authorize({
+    const result = serviceAuthorizer.authorize({
         request: request.request,
         identityAnalysis,
         scpAnalysis,
         rcpAnalysis,
         resourceAnalysis,
-        permissionBoundaryAnalysis
+        permissionBoundaryAnalysis,
+        simulationParameters
     });
+    if (simulationParameters.simulationMode === 'Discovery') {
+        result.ignoredConditions = ignoredConditionsAnalysis(scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis);
+        result.ignoredRoleSessionName = roleSessionNameIgnored(scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis);
+    }
+    return result;
 }
 /**
  * Get the appropriate service authorizer for the request. Some services have specific authorization logic in
@@ -58,7 +66,7 @@ export function getServiceAuthorizer(request) {
  * @param request the request to analyze against
  * @returns an array of statement analysis results
  */
-export function analyzeIdentityPolicies(identityPolicies, request) {
+export function analyzeIdentityPolicies(identityPolicies, request, simulationParameters) {
     const identityAnalysis = {
         result: 'ImplicitlyDenied',
         allowStatements: [],
@@ -69,7 +77,7 @@ export function analyzeIdentityPolicies(identityPolicies, request) {
         for (const statement of policy.statements()) {
             const { matches: resourceMatch, details: resourceDetails } = requestMatchesStatementResources(request, statement);
             const { matches: actionMatch, details: actionDetails } = requestMatchesStatementActions(request, statement);
-            const { matches: conditionMatch, details: conditionDetails } = requestMatchesConditions(request, statement.conditions());
+            const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = requestMatchesConditions(request, statement.conditions(), statement.effect(), simulationParameters);
             const principalMatch = 'Match';
             const overallMatch = statementMatches({
                 actionMatch,
@@ -83,6 +91,7 @@ export function analyzeIdentityPolicies(identityPolicies, request) {
                 actionMatch,
                 conditionMatch,
                 principalMatch,
+                ignoredConditions,
                 explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...conditionDetails })
             };
             if (identityStatementExplicitDeny(statementAnalysis)) {
@@ -111,7 +120,7 @@ export function analyzeIdentityPolicies(identityPolicies, request) {
  * @param request the request to analyze against
  * @returns an array of SCP or RCP analysis results
  */
-export function analyzeControlPolicies(controlPolicies, request) {
+export function analyzeControlPolicies(controlPolicies, request, simulationParameters) {
     const analysis = [];
     for (const controlPolicy of controlPolicies) {
         const ouAnalysis = {
@@ -125,7 +134,7 @@ export function analyzeControlPolicies(controlPolicies, request) {
             for (const statement of policy.statements()) {
                 const { matches: resourceMatch, details: resourceDetails } = requestMatchesStatementResources(request, statement);
                 const { matches: actionMatch, details: actionDetails } = requestMatchesStatementActions(request, statement);
-                const { matches: conditionMatch, details: conditionDetails } = requestMatchesConditions(request, statement.conditions());
+                const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = requestMatchesConditions(request, statement.conditions(), statement.effect(), simulationParameters);
                 const principalMatch = 'Match';
                 const overallMatch = statementMatches({
                     actionMatch,
@@ -139,6 +148,7 @@ export function analyzeControlPolicies(controlPolicies, request) {
                     actionMatch,
                     conditionMatch,
                     principalMatch,
+                    ignoredConditions,
                     explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...conditionDetails })
                 };
                 if (identityStatementAllows(statementAnalysis)) {
@@ -182,7 +192,7 @@ export function analyzeControlPolicies(controlPolicies, request) {
  * @param request the request to analyze against
  * @returns an array of statement analysis results
  */
-export function analyzeResourcePolicy(resourcePolicy, request, principalHasPermissionBoundary) {
+export function analyzeResourcePolicy(resourcePolicy, request, principalHasPermissionBoundary, simulationParameters) {
     const resourceAnalysis = {
         result: 'NotApplicable',
         allowStatements: [],
@@ -200,7 +210,7 @@ export function analyzeResourcePolicy(resourcePolicy, request, principalHasPermi
     for (const statement of resourcePolicy.statements()) {
         const { matches: resourceMatch, details: resourceDetails } = requestMatchesStatementResources(request, statement);
         const { matches: actionMatch, details: actionDetails } = requestMatchesStatementActions(request, statement);
-        let { matches: principalMatch, details: principalDetails } = requestMatchesStatementPrincipals(request, statement);
+        let { matches: principalMatch, details: principalDetails, ignoredRoleSessionName } = requestMatchesStatementPrincipals(request, statement, simulationParameters);
         const permissionBoundaryDetails = {};
         /**
          * "Don't use resource-based policy statements that include a NotPrincipal policy element with a
@@ -220,7 +230,7 @@ export function analyzeResourcePolicy(resourcePolicy, request, principalHasPermi
             principalMatch = 'Match';
             permissionBoundaryDetails.denyBecauseNpInRpAndPb = true;
         }
-        const { matches: conditionMatch, details: conditionDetails } = requestMatchesConditions(request, statement.conditions());
+        const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = requestMatchesConditions(request, statement.conditions(), statement.effect(), simulationParameters);
         const overallMatch = statementMatches({
             actionMatch,
             conditionMatch,
@@ -233,6 +243,8 @@ export function analyzeResourcePolicy(resourcePolicy, request, principalHasPermi
             actionMatch,
             conditionMatch,
             principalMatch,
+            ignoredConditions,
+            ignoredRoleSessionName,
             explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...principalDetails, ...conditionDetails })
         };
         if (identityStatementExplicitDeny(analysis) && analysis.principalMatch !== 'NoMatch') {
@@ -262,11 +274,11 @@ export function analyzeResourcePolicy(resourcePolicy, request, principalHasPermi
     }
     return resourceAnalysis;
 }
-export function analyzePermissionBoundaryPolicies(permissionBoundaries, request) {
+export function analyzePermissionBoundaryPolicies(permissionBoundaries, request, simulationParameters) {
     if (!permissionBoundaries || permissionBoundaries.length === 0) {
         return undefined;
     }
-    return analyzeIdentityPolicies(permissionBoundaries, request);
+    return analyzeIdentityPolicies(permissionBoundaries, request, simulationParameters);
 }
 function makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, details) {
     return {
@@ -280,4 +292,67 @@ function makeStatementExplain(statement, overallMatch, actionMatch, principalMat
         ...details
     };
 }
+/**
+ * Create an analysis of the ignored conditions in all statements.
+ *
+ * @param scpAnalysis the SCP analysis
+ * @param rcpAnalysis the RCP analysis
+ * @param identityAnalysis the identity analysis
+ * @param resourceAnalysis the resource analysis
+ * @param permissionBoundaryAnalysis the permission boundary analysis (optional)
+ * @returns an object containing the ignored conditions for each analysis
+ */
+function ignoredConditionsAnalysis(scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis) {
+    return {
+        scp: mapIgnoredConditions(scpAnalysis.ouAnalysis),
+        rcp: mapIgnoredConditions(rcpAnalysis.ouAnalysis),
+        identity: mapIgnoredConditions([identityAnalysis]),
+        resource: mapIgnoredConditions([resourceAnalysis]),
+        permissionBoundary: mapIgnoredConditions(permissionBoundaryAnalysis ? [permissionBoundaryAnalysis] : [])
+    };
+}
+/**
+ * Get all of the ignored conditions from a set of analyses.
+ *
+ * @param analyses the analyses to map ignored conditions from
+ * @returns the ignored conditions for allow and deny statements
+ */
+function mapIgnoredConditions(analyses) {
+    const allow = [];
+    const deny = [];
+    const allStatements = analyses.flatMap((analysis) => [
+        ...analysis.allowStatements,
+        ...analysis.denyStatements,
+        ...analysis.unmatchedStatements
+    ]);
+    for (const statement of allStatements) {
+        if (statement.ignoredConditions && statement.ignoredConditions.length > 0) {
+            if (statement.statement.isAllow()) {
+                allow.push(...statement.ignoredConditions);
+            }
+            else {
+                deny.push(...statement.ignoredConditions);
+            }
+        }
+    }
+    return { allow, deny };
+}
+/**
+ * Checks all analyses to see if any of them have statements that ignore the role session name.
+ *
+ * @param scpAnalysis the SCP analysis
+ * @param rcpAnalysis the RCP analysis
+ * @param identityAnalysis the identity analysis
+ * @param resourceAnalysis the resource analysis
+ * @param permissionBoundaryAnalysis the permission boundary analysis (optional)
+ * @returns true if any analysis has statements that ignore the role session name, false otherwise
+ */
+function roleSessionNameIgnored(scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis) {
+    return (scpAnalysis.ouAnalysis.some((ou) => ou.allowStatements.some((s) => s.ignoredRoleSessionName)) ||
+        rcpAnalysis.ouAnalysis.some((ou) => ou.allowStatements.some((s) => s.ignoredRoleSessionName)) ||
+        identityAnalysis.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        resourceAnalysis.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        permissionBoundaryAnalysis?.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        false);
+}
 //# sourceMappingURL=CoreSimulatorEngine.js.map