@kensio/yulin 0.31.0 → 0.32.0

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -0,0 +1,66 @@
+import { SimIamAuthZIdentityPolicySourceBuilder } from "./identity-policy-source/sim-iam-auth-z-id-pol-src-builder.js";
+import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context-builder.js";
+/**
+ * Builds the authorization context consumed by SimIamAuthorizer.
+ *
+ * This class keeps the final context assembly in one place: action, resource,
+ * caller principal, identity policy sources, and resource policy sources are
+ * combined into the shape expected by the authorizer.
+ *
+ * Role identity-policy resolution is delegated to
+ * SimIamAuthZIdentityPolicySourceBuilder. That helper owns the details of
+ * finding a principal role, reading inline policies from the role, resolving
+ * attached managed policy ARNs, and parsing stored policy documents.
+ *
+ * Resource policies are supplied by the service that owns the target resource.
+ * They are passed through the authorization input rather than loaded from the
+ * IAM role or managed-policy stores.
+ *
+ * Permissions boundaries, session policies, SCPs, and role trust-policy
+ * assume-role semantics are not part of this context assembly path yet. Add
+ * those concerns through separate policy-source builders so this class stays
+ * focused on composing the authorization request.
+ */
+export class SimIamAuthZContextBuilder {
+    callerContextBuilder;
+    identityPolicySourceBuilder;
+    constructor(policies, roles, defaultCallerPrincipal) {
+        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(defaultCallerPrincipal);
+        this.identityPolicySourceBuilder =
+            new SimIamAuthZIdentityPolicySourceBuilder({ policies, roles });
+    }
+    /**
+     * Build the context consumed by SimIamAuthorizer.
+     */
+    build(input) {
+        const callerContext = this.callerContextBuilder.build(input.caller);
+        return {
+            identityPolicies: [
+                ...this.identityPolicySourceBuilder.build(callerContext.callerPrincipal?.arn),
+                ...callerContext.rootPolicySources,
+            ],
+            resourcePolicies: this.resourcePolicySources(input),
+            action: input.action,
+            resource: input.resource,
+            callerPrincipal: callerContext.callerPrincipal,
+        };
+    }
+    /**
+     * Convert resource policies supplied by the resource-owning service into
+     * authorization policy sources.
+     *
+     * Resource policies are not stored in the IAM role or managed-policy maps.
+     * They arrive with the authorization request because ownership depends on the
+     * target service, such as S3 bucket policies or other service-level policy
+     * documents.
+     */
+    resourcePolicySources(input) {
+        return (input.resourcePolicies ?? []).map((policy) => ({
+            sourceType: "resource",
+            document: policy.document,
+            policyName: policy.policyName,
+            resourceArn: policy.resourceArn,
+        }));
+    }
+}
+//# sourceMappingURL=sim-iam-auth-z-context-builder.js.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,sCAAsC,EAAE,MAAM,+DAA+D,CAAC;AACvH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAkC7F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,2BAA2B,CAAyC;IAErF,YACE,QAA2C,EAC3C,KAA8C,EAC9C,sBAAwC;QAExC,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,sBAAsB,CACvB,CAAC;QACF,IAAI,CAAC,2BAA2B;YAC9B,IAAI,sCAAsC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,2BAA2B,CAAC,KAAK,CACvC,aAAa,CAAC,eAAe,EAAE,GAAG,CACnC;gBACD,GAAG,aAAa,CAAC,iBAAiB;aACnC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,eAAe,EAAE,aAAa,CAAC,eAAe;SAC/C,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts

@@ -0,0 +1,32 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session";
+export interface SimIamAuthZPolicySource {
+    readonly sourceType: SimIamAuthZPolicySourceType;
+    readonly document: SimIamPolicyDocument;
+    readonly policyName?: string | undefined;
+    readonly policyArn?: SimArn | undefined;
+    readonly resourceArn?: string | undefined;
+}
+export interface SimIamAuthZContext {
+    /**
+     * Identity-based policies that grant permissions to the principal.
+     *
+     * This includes inline identity policies and attached managed policies.
+     */
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * Resource-based policies owned by the target resource or service.
+     *
+     * Resource policies are not gathered from IAM's managed policy store.
+     */
+    readonly resourcePolicies: readonly SimIamAuthZPolicySource[];
+    readonly action: string;
+    readonly resource: string;
+    /**
+     * Resolved caller principal, if the simulated request has one.
+     */
+    readonly callerPrincipal?: SimAwsPrincipal | undefined;
+}
+//# sourceMappingURL=sim-iam-auth-z-context.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GACnC,iBAAiB,GACjB,kBAAkB,GAClB,UAAU,GACV,OAAO,GACP,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACxD"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.d.ts

@@ -0,0 +1,11 @@
+import { StaticFactory } from "@kensio/part-factory";
+import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
+/**
+ * Generates simulated IAM authorization contexts for tests.
+ */
+export declare const simIamAuthZContextFactory: StaticFactory<SimIamAuthZContext>;
+/**
+ * Generates simulated IAM resource-policy sources for tests.
+ */
+export declare const simIamAuthZResourcePolicySourceFactory: StaticFactory<SimIamAuthZPolicySource>;
+//# sourceMappingURL=sim-iam-auth-z-context.factory.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-context.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,yBAAyB,mCAQpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sCAAsC,wCAU/C,CAAC"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js

@@ -0,0 +1,27 @@
+import { StaticFactory } from "@kensio/part-factory";
+/**
+ * Generates simulated IAM authorization contexts for tests.
+ */
+export const simIamAuthZContextFactory = new StaticFactory({
+    identityPolicies: [],
+    resourcePolicies: [],
+    action: "s3:GetObject",
+    resource: "arn:aws:s3:::test-bucket/test-key",
+    callerPrincipal: {
+        arn: "arn:aws:iam::123456789012:role/TestRole",
+    },
+});
+/**
+ * Generates simulated IAM resource-policy sources for tests.
+ */
+export const simIamAuthZResourcePolicySourceFactory = new StaticFactory({
+    sourceType: "resource",
+    document: {
+        Statement: {
+            Effect: "Allow",
+            Action: "s3:GetObject",
+            Resource: "arn:aws:s3:::test-bucket/test-key",
+        },
+    },
+});
+//# sourceMappingURL=sim-iam-auth-z-context.factory.js.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-context.factory.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAMrD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,aAAa,CAAqB;IAC7E,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,mCAAmC;IAC7C,eAAe,EAAE;QACf,GAAG,EAAE,yCAAyC;KAC/C;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,aAAa,CAA0B;IACzC,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE;QACR,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,mCAAmC;SAC9C;KACF;CACF,CAAC,CAAC"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-auth-z-context.js.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-context.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.ts"],"names":[],"mappings":""}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts

@@ -0,0 +1,68 @@
+import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-doc-parser.js";
+/**
+ * Matches one parsed IAM policy statement against one authorization request.
+ *
+ * This class owns the statement-level matching rules so
+ * `SimIamPolicyDecision` can stay focused on policy iteration and final
+ * Deny/Allow/ImplicitDeny aggregation.
+ *
+ * The matcher currently covers the IAM dimensions supported by the simulator:
+ *
+ * - Principal and NotPrincipal for resource policies;
+ * - Action and NotAction;
+ * - Resource and NotResource.
+ *
+ * Conditions are not evaluated yet. A statement with a Condition is treated as
+ * non-matching so the simulator does not grant access from a statement whose
+ * condition semantics it cannot prove.
+ */
+export declare class SimIamPolicyStatementMatcher {
+    private readonly context;
+    constructor(context: SimIamAuthZContext);
+    /**
+     * Check whether a parsed statement applies to the current request.
+     */
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    /**
+     * Check the principal part of a statement.
+     *
+     * Identity policies do not carry Principal or NotPrincipal because they are
+     * already attached to the caller identity. Resource policies must name the
+     * caller with Principal, or exclude the caller with NotPrincipal.
+     */
+    private principalMatches;
+    /**
+     * Check every Principal shape supported by the parsed policy model.
+     *
+     * IAM allows Principal to be a string, an array, or an object keyed by
+     * principal type. The simulator currently recognizes AWS and Service
+     * principal objects because those are the forms used by supported services.
+     */
+    private principalValueMatches;
+    /**
+     * Match a single principal pattern against the caller ARN.
+     *
+     * The wildcard principal `*` matches anonymous and signed requests. Any other
+     * principal pattern requires a caller ARN because there is no stable value to
+     * compare when the request has no caller principal.
+     */
+    private principalPatternMatches;
+    /**
+     * Check Action or NotAction against the requested IAM action.
+     *
+     * AWS action names are case-insensitive, so wildcard matching follows that
+     * behavior. The parser guarantees one of Action or NotAction exists; the final
+     * throw protects future parser changes from producing invalid statements.
+     */
+    private actionMatches;
+    /**
+     * Check Resource or NotResource against the requested resource ARN.
+     *
+     * Resource ARNs are matched case-sensitively. This mirrors IAM's ARN matching
+     * behavior and prevents policies from matching resources that differ only by
+     * case.
+     */
+    private resourceMatches;
+}
+//# sourceMappingURL=sim-iam-policy-statement-matcher.d.ts.map

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAG5F;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;OAEG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAWT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAsBxB;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IA0B7B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAuBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAsBxB"}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js

@@ -0,0 +1,141 @@
+import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
+/**
+ * Matches one parsed IAM policy statement against one authorization request.
+ *
+ * This class owns the statement-level matching rules so
+ * `SimIamPolicyDecision` can stay focused on policy iteration and final
+ * Deny/Allow/ImplicitDeny aggregation.
+ *
+ * The matcher currently covers the IAM dimensions supported by the simulator:
+ *
+ * - Principal and NotPrincipal for resource policies;
+ * - Action and NotAction;
+ * - Resource and NotResource.
+ *
+ * Conditions are not evaluated yet. A statement with a Condition is treated as
+ * non-matching so the simulator does not grant access from a statement whose
+ * condition semantics it cannot prove.
+ */
+export class SimIamPolicyStatementMatcher {
+    context;
+    constructor(context) {
+        this.context = context;
+    }
+    /**
+     * Check whether a parsed statement applies to the current request.
+     */
+    matches(policy, statement) {
+        /* v8 ignore if -- policy conditions are TODO */
+        if (statement.condition !== undefined) {
+            return false;
+        }
+        return (this.principalMatches(policy, statement) &&
+            this.actionMatches(statement) &&
+            this.resourceMatches(statement));
+    }
+    /**
+     * Check the principal part of a statement.
+     *
+     * Identity policies do not carry Principal or NotPrincipal because they are
+     * already attached to the caller identity. Resource policies must name the
+     * caller with Principal, or exclude the caller with NotPrincipal.
+     */
+    principalMatches(policy, statement) {
+        if (policy.sourceType !== "resource") {
+            return (statement.principal === undefined &&
+                statement.notPrincipal === undefined);
+        }
+        if (statement.principal !== undefined) {
+            return this.principalValueMatches(statement.principal);
+        }
+        if (statement.notPrincipal !== undefined) {
+            return !this.principalValueMatches(statement.notPrincipal);
+        }
+        return false;
+    }
+    /**
+     * Check every Principal shape supported by the parsed policy model.
+     *
+     * IAM allows Principal to be a string, an array, or an object keyed by
+     * principal type. The simulator currently recognizes AWS and Service
+     * principal objects because those are the forms used by supported services.
+     */
+    principalValueMatches(principal) {
+        if (typeof principal === "string") {
+            return this.principalPatternMatches(principal);
+        }
+        if (Array.isArray(principal)) {
+            return principal.some((value) => this.principalPatternMatches(value));
+        }
+        return Object.entries(principal).some(([principalType, values]) => {
+            if (principalType !== "AWS" && principalType !== "Service") {
+                return false;
+            }
+            if (typeof values === "string") {
+                return this.principalPatternMatches(values);
+            }
+            return values.some((value) => this.principalPatternMatches(value));
+        });
+    }
+    /**
+     * Match a single principal pattern against the caller ARN.
+     *
+     * The wildcard principal `*` matches anonymous and signed requests. Any other
+     * principal pattern requires a caller ARN because there is no stable value to
+     * compare when the request has no caller principal.
+     */
+    principalPatternMatches(pattern) {
+        if (pattern === "*") {
+            return true;
+        }
+        if (this.context.callerPrincipal?.arn === undefined) {
+            return false;
+        }
+        return simIamWildcardMatch(pattern, this.context.callerPrincipal.arn, {
+            caseSensitive: true,
+        });
+    }
+    /**
+     * Check Action or NotAction against the requested IAM action.
+     *
+     * AWS action names are case-insensitive, so wildcard matching follows that
+     * behavior. The parser guarantees one of Action or NotAction exists; the final
+     * throw protects future parser changes from producing invalid statements.
+     */
+    actionMatches(statement) {
+        if (statement.actions !== undefined) {
+            return statement.actions.some((pattern) => simIamWildcardMatch(pattern, this.context.action, {
+                caseSensitive: false,
+            }));
+        }
+        if (statement.notActions !== undefined) {
+            return !statement.notActions.some((pattern) => simIamWildcardMatch(pattern, this.context.action, {
+                caseSensitive: false,
+            }));
+        }
+        /* v8 ignore next -- defensive diagnostic error */
+        throw new TypeError("IAM policy statement must define either Action or NotAction");
+    }
+    /**
+     * Check Resource or NotResource against the requested resource ARN.
+     *
+     * Resource ARNs are matched case-sensitively. This mirrors IAM's ARN matching
+     * behavior and prevents policies from matching resources that differ only by
+     * case.
+     */
+    resourceMatches(statement) {
+        if (statement.resources !== undefined) {
+            return statement.resources.some((pattern) => simIamWildcardMatch(pattern, this.context.resource, {
+                caseSensitive: true,
+            }));
+        }
+        if (statement.notResources !== undefined) {
+            return !statement.notResources.some((pattern) => simIamWildcardMatch(pattern, this.context.resource, {
+                caseSensitive: true,
+            }));
+        }
+        /* v8 ignore next -- defensive diagnostic error */
+        throw new TypeError("IAM policy statement must define either Resource or NotResource");
+    }
+}
+//# sourceMappingURL=sim-iam-policy-statement-matcher.js.map

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-statement-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;OAEG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,gDAAgD;QAChD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CACL,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC;YACxC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,CACL,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,CACrC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAC3B,SAAwC;QAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAC/C,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CACpC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE;YAChE,IAAI,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAAC,OAAe;QAC7C,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;YACpE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAsC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,SAAsC;QAC5D,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -0,0 +1,29 @@
+import type { SimArn } from "../../aws/arn.js";
+import type { SimIamPolicy } from "../policy/sim-iam-policy.js";
+import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
+import { type SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import { SimIamPolicyDecision } from "./sim-iam-decision.js";
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+interface SimIamAuthorizerProps {
+    readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
+    readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
+    readonly defaultCallerPrincipal?: SimAwsPrincipal | undefined;
+}
+/**
+ * Facade for simulated IAM authorization decisions.
+ *
+ * This class represents the service-facing entry point for IAM authorization.
+ * It assembles the authorization context from IAM state and request input, while
+ * each SimIamPolicyDecision instance keeps the state and diagnostics for one
+ * evaluated authorization attempt.
+ */
+export declare class SimIamAuthorizer {
+    private readonly contextBuilder;
+    constructor(props: SimIamAuthorizerProps);
+    /**
+     * Evaluate an IAM authorization request.
+     */
+    authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
+}
+export {};
+//# sourceMappingURL=sim-iam-authorizer.d.ts.map

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CAC/D;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,KAAK,EAAE,qBAAqB,EAMvC;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -0,0 +1,23 @@
+import { SimIamAuthZContextBuilder, } from "./context/sim-iam-auth-z-context-builder.js";
+import { SimIamPolicyDecision } from "./sim-iam-decision.js";
+/**
+ * Facade for simulated IAM authorization decisions.
+ *
+ * This class represents the service-facing entry point for IAM authorization.
+ * It assembles the authorization context from IAM state and request input, while
+ * each SimIamPolicyDecision instance keeps the state and diagnostics for one
+ * evaluated authorization attempt.
+ */
+export class SimIamAuthorizer {
+    contextBuilder;
+    constructor(props) {
+        this.contextBuilder = new SimIamAuthZContextBuilder(props.policies, props.roles, props.defaultCallerPrincipal);
+    }
+    /**
+     * Evaluate an IAM authorization request.
+     */
+    authorize(input) {
+        return new SimIamPolicyDecision(this.contextBuilder.build(input));
+    }
+}
+//# sourceMappingURL=sim-iam-authorizer.js.map

package/dist/service/iam/authorize/sim-iam-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAS7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,KAA4B;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CACjD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -0,0 +1,65 @@
+import type { SimIamPolicyDocumentStatement } from "../policy/sim-iam-policy.js";
+import type { SimIamAuthZContext } from "./context/sim-iam-auth-z-context.js";
+import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-doc-parser.js";
+export declare const SimIamPolicyDecisionValue: {
+    readonly ExplicitDeny: "ExplicitDeny";
+    readonly Allow: "Allow";
+    readonly ImplicitDeny: "ImplicitDeny";
+};
+export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];
+/**
+ * Decision for one simulated IAM policy authorization attempt.
+ *
+ * This evaluates already-discovered identity and resource policy documents. It
+ * does not fetch attached policies itself, apply trust policy semantics,
+ * evaluate permissions boundaries, evaluate SCPs, or enforce service command
+ * access.
+ *
+ * The simulator currently models the common IAM authorization union:
+ *
+ * - an explicit Deny in any evaluated policy wins;
+ * - an Allow in an identity policy or resource policy allows the request;
+ * - otherwise the request is implicitly denied.
+ *
+ * Resource policies are expected to be supplied by the service that owns the
+ * target resource.
+ */
+export declare class SimIamPolicyDecision {
+    private readonly request;
+    private readonly policyDocumentParser;
+    private readonly statementMatcher;
+    private readonly explicitDenyStatementRecords;
+    private readonly allowStatementRecords;
+    constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
+    /**
+     * Final IAM decision value.
+     */
+    get value(): SimIamPolicyDecisionValue;
+    /**
+     * Whether the request is allowed.
+     */
+    get isAllowed(): boolean;
+    /**
+     * Whether the request is denied either explicitly or implicitly.
+     */
+    get isDenied(): boolean;
+    /**
+     * Whether the request is denied by a matching Deny statement.
+     */
+    get isExplicitDeny(): boolean;
+    /**
+     * Whether the request is denied because no Allow statement matched.
+     */
+    get isImplicitDeny(): boolean;
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements.
+     */
+    get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    private evaluate;
+    private evaluatePolicy;
+}
+//# sourceMappingURL=sim-iam-decision.d.ts.map

package/dist/service/iam/authorize/sim-iam-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAGnF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAE7E,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAgBvB"}

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -0,0 +1,107 @@
+import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-doc-parser.js";
+import { SimIamPolicyStatementMatcher } from "./match/sim-iam-policy-statement-matcher.js";
+export const SimIamPolicyDecisionValue = {
+    ExplicitDeny: "ExplicitDeny",
+    Allow: "Allow",
+    ImplicitDeny: "ImplicitDeny",
+};
+/**
+ * Decision for one simulated IAM policy authorization attempt.
+ *
+ * This evaluates already-discovered identity and resource policy documents. It
+ * does not fetch attached policies itself, apply trust policy semantics,
+ * evaluate permissions boundaries, evaluate SCPs, or enforce service command
+ * access.
+ *
+ * The simulator currently models the common IAM authorization union:
+ *
+ * - an explicit Deny in any evaluated policy wins;
+ * - an Allow in an identity policy or resource policy allows the request;
+ * - otherwise the request is implicitly denied.
+ *
+ * Resource policies are expected to be supplied by the service that owns the
+ * target resource.
+ */
+export class SimIamPolicyDecision {
+    request;
+    policyDocumentParser;
+    statementMatcher;
+    explicitDenyStatementRecords = [];
+    allowStatementRecords = [];
+    constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
+        this.request = request;
+        this.policyDocumentParser = policyDocumentParser;
+        this.statementMatcher = new SimIamPolicyStatementMatcher(request);
+        this.evaluate();
+    }
+    /**
+     * Final IAM decision value.
+     */
+    get value() {
+        if (this.explicitDenyStatementRecords.length > 0) {
+            return SimIamPolicyDecisionValue.ExplicitDeny;
+        }
+        if (this.allowStatementRecords.length > 0) {
+            return SimIamPolicyDecisionValue.Allow;
+        }
+        return SimIamPolicyDecisionValue.ImplicitDeny;
+    }
+    /**
+     * Whether the request is allowed.
+     */
+    get isAllowed() {
+        return this.value === SimIamPolicyDecisionValue.Allow;
+    }
+    /**
+     * Whether the request is denied either explicitly or implicitly.
+     */
+    get isDenied() {
+        return this.value !== SimIamPolicyDecisionValue.Allow;
+    }
+    /**
+     * Whether the request is denied by a matching Deny statement.
+     */
+    get isExplicitDeny() {
+        return this.value === SimIamPolicyDecisionValue.ExplicitDeny;
+    }
+    /**
+     * Whether the request is denied because no Allow statement matched.
+     */
+    get isImplicitDeny() {
+        return this.value === SimIamPolicyDecisionValue.ImplicitDeny;
+    }
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements() {
+        return this.explicitDenyStatementRecords;
+    }
+    /**
+     * Matching Allow statements.
+     */
+    get allowStatements() {
+        return this.allowStatementRecords;
+    }
+    evaluate() {
+        for (const policy of [
+            ...this.request.identityPolicies,
+            ...this.request.resourcePolicies,
+        ]) {
+            this.evaluatePolicy(policy);
+        }
+    }
+    evaluatePolicy(policy) {
+        const parsedPolicy = this.policyDocumentParser.parse(policy.document);
+        for (const statement of parsedPolicy.statements) {
+            if (!this.statementMatcher.matches(policy, statement)) {
+                continue;
+            }
+            if (statement.effect === "Deny") {
+                this.explicitDenyStatementRecords.push(statement.source);
+                continue;
+            }
+            this.allowStatementRecords.push(statement.source);
+        }
+    }
+}
+//# sourceMappingURL=sim-iam-decision.js.map

package/dist/service/iam/authorize/sim-iam-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAE3F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,qBAAqB,GAAoC,EAAE,CAAC;IAE7E,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-wildcard.d.ts

@@ -0,0 +1,11 @@
+interface SimIamWildcardMatchOptions {
+    readonly caseSensitive: boolean;
+}
+/**
+ * Match an IAM-style wildcard pattern.
+ *
+ * Initial support is small: "*" means zero or more characters.
+ */
+export declare function simIamWildcardMatch(pattern: string, value: string, options: SimIamWildcardMatchOptions): boolean;
+export {};
+//# sourceMappingURL=sim-iam-wildcard.d.ts.map

package/dist/service/iam/authorize/sim-iam-wildcard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-wildcard.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-wildcard.ts"],"names":[],"mappings":"AAAA,UAAU,0BAA0B;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAET"}