@gugananuvem/aws-local-simulator 1.0.35 → 1.0.39

package/src/services/eventbridge/simulator.js

@@ -364,7 +364,15 @@ class EventBridgeSimulator {
         InputTransformer: target.InputTransformer || null,
         RoleArn: target.RoleArn || null,
         RetryPolicy: target.RetryPolicy || { MaximumRetryAttempts: 185, MaximumEventAgeInSeconds: 86400 },
-        DeadLetterConfig: target.DeadLetterConfig || null
+        DeadLetterConfig: target.DeadLetterConfig || null,
+        MessageGroupId: target.MessageGroupId || null,
+        KinesisParameters: target.KinesisParameters || null,
+        EcsParameters: target.EcsParameters || null,
+        BatchParameters: target.BatchParameters || null,
+        HttpParameters: target.HttpParameters || null,
+        RedshiftDataParameters: target.RedshiftDataParameters || null,
+        SageMakerPipelineParameters: target.SageMakerPipelineParameters || null,
+        AppSyncParameters: target.AppSyncParameters || null
       });
     }
 
@@ -497,9 +505,15 @@ class EventBridgeSimulator {
         const targets = this.targets.get(rule.Arn) || [];
         for (const target of targets) {
           try {
-            await this._deliverToTarget(target, event);
+            await this._deliverToTarget(target, event, { ruleArn: rule.Arn, ruleName: rule.Name, eventBusName: busName });
           } catch (err) {
             this.logger.warn('EventBridge', `Target delivery failed: ${err.message}`);
+            // DeadLetterConfig: AWS moves failed events to the DLQ SQS ARN
+            const dlqArn = target.DeadLetterConfig && target.DeadLetterConfig.Arn;
+            if (dlqArn && this.sqsService) {
+              try { await this._deliverToSQS(dlqArn, JSON.stringify(event), { _eventbridge_dlq_original_target: target.Arn }); }
+              catch (dlqErr) { this.logger.warn('EventBridge DLQ', `DLQ delivery also failed: ${dlqErr.message}`); }
+            }
           }
         }
       }
@@ -513,38 +527,83 @@ class EventBridgeSimulator {
    * @returns {boolean}
    */
   _matchesPattern(event, pattern) {
+    // AWS EventBridge $or (array of pattern objects, match any)
+    if (Array.isArray(pattern)) {
+      return pattern.some(subPattern => this._matchesPattern(event, subPattern));
+    }
+
     for (const [key, matchers] of Object.entries(pattern)) {
-      const eventValue = key === 'detail' ? event.detail : event[key];
+      if (key === '$or') {
+        if (!Array.isArray(matchers)) continue;
+        const orMatch = matchers.some(sub => this._matchesPattern(event, sub));
+        if (!orMatch) return false;
+        continue;
+      }
 
       if (key === 'detail' && typeof matchers === 'object' && !Array.isArray(matchers)) {
-        // Recursive detail matching
         if (!this._matchesPattern(event.detail || {}, matchers)) return false;
         continue;
       }
 
-      if (!Array.isArray(matchers)) continue;
+      const eventValue = key === 'detail' ? event.detail : event[key];
 
-      const matches = matchers.some(matcher => {
-        if (matcher === null) return eventValue === null;
-        if (typeof matcher === 'string') return eventValue === matcher;
-        if (typeof matcher === 'object') {
-          if (matcher.prefix) return String(eventValue).startsWith(matcher.prefix);
-          if (matcher['anything-but']) {
-            return !matcher['anything-but'].includes(eventValue);
-          }
-          if (matcher.exists !== undefined) {
-            return matcher.exists ? eventValue !== undefined : eventValue === undefined;
-          }
-          if (matcher.numeric) return this._checkNumeric(parseFloat(eventValue), matcher.numeric);
-        }
-        return false;
-      });
+      // AWS: if matcher is array and field value is also array → any element matches any matcher
+      if (Array.isArray(matchers) && Array.isArray(eventValue)) {
+        const arrMatch = eventValue.some(v => matchers.some(m => this._singleMatcherMatches(v, m)));
+        if (!arrMatch) return false;
+        continue;
+      }
 
+      if (!Array.isArray(matchers)) continue;
+
+      const matches = matchers.some(matcher => this._singleMatcherMatches(eventValue, matcher));
       if (!matches) return false;
     }
     return true;
   }
 
+  _singleMatcherMatches(eventValue, matcher) {
+    if (matcher === null) return eventValue === null;
+    if (typeof matcher === 'string') {
+      if (matcher.endsWith('*')) {
+        const prefix = matcher.slice(0, -1);
+        return eventValue != null && String(eventValue).startsWith(prefix);
+      }
+      if (matcher.startsWith('*')) {
+        const suffix = matcher.slice(1);
+        return eventValue != null && String(eventValue).endsWith(suffix);
+      }
+      return eventValue === matcher;
+    }
+    if (typeof matcher === 'object') {
+      if (matcher.prefix) return String(eventValue).startsWith(matcher.prefix);
+      if (matcher.suffix) return String(eventValue).endsWith(matcher.suffix);
+      if (matcher.wildcard) {
+        const wc = matcher.wildcard;
+        let regex = '^';
+        for (let i = 0; i < wc.length; i++) {
+          const c = wc[i];
+          if (c === '*') regex += '.*';
+          else if (c === '?') regex += '.';
+          else regex += c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        }
+        regex += '$';
+        try { return new RegExp(regex).test(String(eventValue)); } catch (_e) { return false; }
+      }
+      if (matcher['anything-but']) {
+        const forbidden = matcher['anything-but'];
+        if (Array.isArray(forbidden)) return !forbidden.includes(eventValue);
+        return eventValue !== forbidden;
+      }
+      if (matcher.exists !== undefined) {
+        return matcher.exists ? eventValue !== undefined : eventValue === undefined;
+      }
+      if (matcher.numeric) return this._checkNumeric(parseFloat(eventValue), matcher.numeric);
+      if (matcher.ctype === 'string') return typeof eventValue === 'string';
+    }
+    return false;
+  }
+
   /**
    * Check numeric conditions
    * @param {number} value
@@ -564,57 +623,137 @@ class EventBridgeSimulator {
     return true;
   }
 
+  /**
+   * Resolve SQS ARN or URL → SQS QueueUrl (formato aceito pelo SQS simulator)
+   */
+  _resolveSqsQueueUrl(arnOrUrlOrName) {
+    if (!arnOrUrlOrName) return null;
+    const sqs = this.sqsService && this.sqsService.simulator;
+    if (!sqs) return null;
+
+    if (typeof arnOrUrlOrName !== 'string') return null;
+    if (/^https?:\/\//i.test(arnOrUrlOrName) || arnOrUrlOrName.includes('/queue/')) {
+      return arnOrUrlOrName;
+    }
+    let name = arnOrUrlOrName;
+    const arnMatch = arnOrUrlOrName.match(/:queue:([^:]+)$|:sqs:[^:]*:[^:]*:([^:/]+)/);
+    if (arnMatch) name = arnMatch[1] || arnMatch[2];
+
+    const q = sqs.queues && sqs.queues.get(name);
+    return (q && q.url) || (sqs.endpoint ? `${sqs.endpoint}/queue/${name}` : null);
+  }
+
+  /**
+   * Deliver directly to SQS with ARN/URL resolution + AWS-style MessageAttributes
+   */
+  async _deliverToSQS(queueArnOrUrl, messageBody, extraAttributes = {}) {
+    if (!this.sqsService) throw new Error('SQS service not available');
+    const sqs = this.sqsService.simulator;
+    const queueUrl = this._resolveSqsQueueUrl(queueArnOrUrl);
+    if (!queueUrl) throw new Error(`Unable to resolve SQS queue: ${queueArnOrUrl}`);
+
+    const traceId = crypto.randomUUID();
+    const MessageAttributes = {
+      AWSTraceHeader: {
+        DataType: 'String',
+        StringValue: `Root=1-${Date.now().toString(16)}-${traceId.replace(/-/g, '')}`
+      },
+      ...Object.fromEntries(Object.entries(extraAttributes || {}).map(([k, v]) => [
+        k,
+        typeof v === 'string' ? { DataType: 'String', StringValue: v } : { DataType: 'String', StringValue: JSON.stringify(v) }
+      ]))
+    };
+
+    const result = sqs.sendMessage({
+      QueueUrl: queueUrl,
+      MessageBody: messageBody,
+      MessageAttributes
+    });
+
+    if (!result || result.error) throw new Error((result && result.error && result.error.message) || 'SQS sendMessage failed');
+    return result;
+  }
+
   /**
    * Deliver event to target
    * @param {Object} target
    * @param {Object} event
+   * @param {Object} [ruleInfo]
    */
-  async _deliverToTarget(target, event) {
-    // Transform input
+  async _deliverToTarget(target, event, ruleInfo) {
+    // Apply Input / InputPath / InputTransformer (AWS precedence)
     let inputEvent = event;
     if (target.Input) {
       try { inputEvent = JSON.parse(target.Input); } catch { inputEvent = target.Input; }
     } else if (target.InputPath) {
       inputEvent = this._extractPath(event, target.InputPath);
     } else if (target.InputTransformer) {
-      inputEvent = this._transformInput(event, target.InputTransformer);
+      inputEvent = this._transformInput(event, target.InputTransformer, ruleInfo);
     }
 
     const arn = target.Arn;
 
     // Lambda target
-    if (arn.includes(':lambda:') || arn.includes('function:')) {
-      if (!this.lambdaService) return;
-      const match = arn.match(/function:([^:]+)/);
-      if (!match) return;
-      await this.lambdaService.simulator.invokeFunction(match[1], inputEvent);
-      this.logger.debug('EventBridge', `Delivered to Lambda: ${match[1]}`);
+    if (arn.includes(':lambda:') || arn.includes(':function:') || (arn.startsWith('arn:aws:lambda') || arn.startsWith('arn:aws-cn:lambda') || arn.startsWith('arn:aws-us-gov:lambda'))) {
+      if (!this.lambdaService) throw new Error('Lambda service not available');
+      let functionName = null;
+      const match = arn.match(/:function:([^:/]+)/);
+      if (match) {
+        functionName = match[1];
+      } else {
+        functionName = arn;
+      }
+      if (!functionName) throw new Error(`Could not resolve Lambda function from ARN: ${arn}`);
+      // AWS EventBridge invokes Lambda asynchronously with invocation-type=Event
+      await this.lambdaService.simulator.invokeFunction(functionName, inputEvent);
+      this.logger.debug('EventBridge', `Delivered to Lambda: ${functionName}`);
       return;
     }
 
     // SQS target
     if (arn.includes(':sqs:') || arn.includes(':queue:')) {
-      if (!this.sqsService) return;
-      await this.sqsService.simulator.sendMessage({
-        QueueUrl: arn,
-        MessageBody: JSON.stringify(inputEvent)
-      });
+      const isFifo = arn.endsWith('.fifo');
+      const msgBody = typeof inputEvent === 'string' ? inputEvent : JSON.stringify(inputEvent);
+      const extraAttrs = {};
+      if (ruleInfo && ruleInfo.ruleArn) extraAttrs['EventBridgeRuleArn'] = ruleInfo.ruleArn;
+      const sendParams = {
+        QueueUrl: this._resolveSqsQueueUrl(arn) || arn,
+        MessageBody: msgBody
+      };
+      if (isFifo) {
+        sendParams.MessageGroupId = target.MessageGroupId || `${ruleInfo ? ruleInfo.ruleArn : 'eventbridge'}-${target.Id || 'tgt'}`;
+        if (target.Id) extraAttrs['TargetId'] = target.Id;
+      }
+      const result = await this._deliverToSQS(sendParams.QueueUrl, sendParams.MessageBody, extraAttrs);
       this.logger.debug('EventBridge', `Delivered to SQS: ${arn}`);
       return;
     }
 
     // SNS target
     if (arn.includes(':sns:')) {
-      if (!this.snsService) return;
-      await this.snsService.simulator.publish({
+      if (!this.snsService) throw new Error('SNS service not available');
+      const message = typeof inputEvent === 'string' ? inputEvent : JSON.stringify(inputEvent);
+      const traceId = crypto.randomUUID();
+      const attrs = {
+        AWSTraceHeader: { DataType: 'String', StringValue: traceId }
+      };
+      if (ruleInfo && ruleInfo.ruleArn) {
+        attrs['EventBridgeRuleArn'] = { DataType: 'String', StringValue: ruleInfo.ruleArn };
+      }
+      const result = await this.snsService.simulator.publish({
         TopicArn: arn,
-        Message: JSON.stringify(inputEvent)
+        Message: message,
+        MessageAttributes: attrs
       });
+      if (!result || (result && result.error)) {
+        throw new Error((result && result.error && result.error.message) || 'SNS publish failed');
+      }
       this.logger.debug('EventBridge', `Delivered to SNS: ${arn}`);
       return;
     }
 
     this.logger.warn('EventBridge', `Unsupported target ARN: ${arn}`);
+    throw new Error(`Unsupported target type for ARN: ${arn}`);
   }
 
   /**
@@ -624,30 +763,76 @@ class EventBridgeSimulator {
    * @returns {*}
    */
   _extractPath(obj, path) {
+    if (!path) return obj;
     if (path === '$') return obj;
-    const parts = path.replace(/^\$\./, '').split('.');
+    const cleaned = path.replace(/^\$\.?/, '');
+    if (!cleaned) return obj;
+
+    // Tokenize: suporta dotted keys e bracket array notation como resources[0], [0]
+    const tokens = [];
+    let buf = '';
+    for (let i = 0; i < cleaned.length; i++) {
+      const c = cleaned[i];
+      if (c === '.') {
+        if (buf) tokens.push({ type: 'key', value: buf });
+        buf = '';
+      } else if (c === '[') {
+        if (buf) tokens.push({ type: 'key', value: buf });
+        buf = '';
+      } else if (c === ']') {
+        if (buf.length > 0) {
+          const n = Number(buf);
+          tokens.push({ type: Number.isNaN(n) ? 'key' : 'index', value: Number.isNaN(n) ? buf : n });
+        }
+        buf = '';
+      } else {
+        buf += c;
+      }
+    }
+    if (buf) tokens.push({ type: 'key', value: buf });
+
     let current = obj;
-    for (const part of parts) {
+    for (const t of tokens) {
       if (current === null || current === undefined) return null;
-      current = current[part];
+      if (t.type === 'index') {
+        if (!Array.isArray(current)) return null;
+        current = current[t.value];
+      } else {
+        current = current[t.value];
+      }
     }
     return current;
   }
 
   /**
-   * Transform input using InputTransformer
+   * Transform input using InputTransformer (AWS style)
    * @param {Object} event
    * @param {Object} transformer
+   * @param {Object} [ruleInfo] optional rule info for <aws.events.rule-arn>, etc.
    * @returns {*}
    */
-  _transformInput(event, transformer) {
+  _transformInput(event, transformer, ruleInfo) {
     const { InputPathsMap, InputTemplate } = transformer;
-    let result = InputTemplate;
+    if (!InputTemplate) return event;
+    let result = String(InputTemplate);
+
+    // AWS reserved placeholders
+    const reserved = {
+      'aws.events.event': JSON.stringify(event),
+      'aws.events.event.json': JSON.stringify(event),
+      'aws.events.rule-arn': (ruleInfo && ruleInfo.ruleArn) || '',
+      'aws.events.rule-name': (ruleInfo && ruleInfo.ruleName) || '',
+      'aws.events.eventbus-name': (ruleInfo && ruleInfo.eventBusName) || ''
+    };
+    for (const [k, v] of Object.entries(reserved)) {
+      result = result.split(`<${k}>`).join(typeof v === 'string' ? v : JSON.stringify(v));
+    }
 
-    if (InputPathsMap && InputTemplate) {
+    if (InputPathsMap && typeof InputPathsMap === 'object') {
       for (const [key, path] of Object.entries(InputPathsMap)) {
         const value = this._extractPath(event, path);
-        result = result.replace(new RegExp(`<${key}>`, 'g'), JSON.stringify(value));
+        const safeValue = typeof value === 'string' ? value : JSON.stringify(value);
+        result = result.split(`<${key}>`).join(safeValue);
       }
     }
 

package/src/services/iam/index.js

@@ -0,0 +1,65 @@
+const IAMSimulator = require('./simulator');
+const logger = require('../../utils/logger');
+
+class IAMService {
+  constructor(config, dependencies) {
+    this.config = config;
+    this.dependencies = dependencies || {};
+    this.name = 'iam';
+    this.port = config?.ports?.iam || 4003;
+    this.simulator = null;
+    this.server = null;
+    this.httpServer = null;
+    this.isRunning = false;
+  }
+
+  async initialize() {
+    this.simulator = new IAMSimulator(this.config);
+    await this.simulator.initialize();
+
+    const IAMServer = require('./server');
+    this.server = new IAMServer(this.simulator, logger, this.config);
+  }
+
+  async start() {
+    if (this.isRunning) return;
+
+    this.httpServer = this.server.getApp().listen(this.port);
+    logger.info(`🔐 IAM rodando em http://localhost:${this.port}`);
+    this.isRunning = true;
+  }
+
+  async stop() {
+    if (!this.isRunning) return;
+
+    await new Promise((resolve, reject) => {
+      this.httpServer.close((err) => {
+        if (err) reject(err);
+        else resolve();
+      });
+    });
+    this.isRunning = false;
+  }
+
+  async reset() {
+    await this.simulator.reset();
+  }
+
+  getStatus() {
+    return {
+      running: this.isRunning,
+      port: this.port,
+      endpoint: `http://localhost:${this.port}`
+    };
+  }
+
+  getSimulator() {
+    return this.simulator;
+  }
+
+  injectDependencies(server) {
+    this.stsService = server.getService('sts');
+  }
+}
+
+module.exports = IAMService;

package/src/services/iam/middleware.js

@@ -0,0 +1,99 @@
+'use strict';
+
+/**
+ * Extracts AWS AccessKeyId from the request.
+ * Checks Authorization header (AWS Signature V4) and fallback to query params.
+ *
+ * @param {object} req - Express request object
+ * @returns {string|null} The extracted AccessKeyId or null if not found
+ */
+function extractCredentials(req) {
+  // Check Authorization header: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request, ...
+  const authHeader = req.headers['authorization'] || req.headers['Authorization'];
+  if (authHeader && authHeader.startsWith('AWS4-HMAC-SHA256')) {
+    const credMatch = authHeader.match(/Credential=([A-Z0-9]+)\//);
+    if (credMatch) return credMatch[1];
+  }
+
+  // Fallback: X-Amz-Credential query parameter (presigned URLs)
+  const xAmzCredential = req.query && req.query['X-Amz-Credential'];
+  if (xAmzCredential) {
+    const parts = xAmzCredential.split('/');
+    if (parts.length > 0) return parts[0];
+  }
+
+  // Fallback: AWSAccessKeyId query parameter (older signature versions)
+  if (req.query && req.query['AWSAccessKeyId']) {
+    return req.query['AWSAccessKeyId'];
+  }
+
+  return null;
+}
+
+/**
+ * Creates an IAM enforcement middleware for a specific AWS service.
+ *
+ * @param {object} options
+ * @param {object} options.iamSimulator - Reference to IAM simulator instance
+ * @param {string} options.servicePrefix - IAM action prefix (e.g., 'sqs', 'sns', 'lambda', 's3')
+ * @param {function} options.extractAction - (req) => string - extracts AWS action name from request
+ * @param {function} options.extractResource - (req) => string - builds resource ARN from request
+ * @param {function} [options.extractConditionContext] - (req) => object - additional condition context keys
+ * @param {function} options.formatError - (res, code, message) => void - formats service-specific error response
+ * @returns {function} Express middleware function
+ */
+function createIAMEnforcementMiddleware(options) {
+  const {
+    iamSimulator,
+    servicePrefix,
+    extractAction,
+    extractResource,
+    extractConditionContext,
+    formatError
+  } = options;
+
+  return (req, res, next) => {
+    // 1. Extract credentials from Authorization header or query parameters
+    const accessKeyId = extractCredentials(req);
+
+    // 2. If no credentials present → 403 AccessDenied
+    if (!accessKeyId) {
+      return formatError(res, 'AccessDenied', 'Missing authentication token');
+    }
+
+    // 3. Resolve identity via IAM service
+    const identity = iamSimulator.resolveIdentity(accessKeyId);
+    if (!identity) {
+      return formatError(res, 'AccessDenied', 'The security token included in the request is invalid');
+    }
+
+    // 4. Build evaluation context
+    const action = `${servicePrefix}:${extractAction(req)}`;
+    const resource = extractResource(req);
+    const context = {
+      'aws:SourceIp': req.ip || req.connection?.remoteAddress || '127.0.0.1',
+      'aws:CurrentTime': new Date().toISOString(),
+      'aws:EpochTime': Math.floor(Date.now() / 1000).toString(),
+      ...(extractConditionContext ? extractConditionContext(req) : {})
+    };
+
+    // 5. Evaluate access using the policy engine
+    const decision = iamSimulator.evaluateAccess({
+      accessKeyId,
+      action,
+      resource,
+      context
+    });
+
+    // 6. Deny → 403, Allow → set identity and call next()
+    if (decision === 'Deny') {
+      return formatError(res, 'AccessDenied',
+        `User is not authorized to perform: ${action} on resource: ${resource}`);
+    }
+
+    req.iamIdentity = identity;
+    next();
+  };
+}
+
+module.exports = { createIAMEnforcementMiddleware, extractCredentials };