@kensio/yulin 0.31.0 → 0.33.0

package/dist/service/iam/sim-iam.d.ts

@@ -0,0 +1,104 @@
+import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimCreatePolicyCommand, SimCreatePolicyCommandOutput } from "./command/policy/create-policy/create-policy.cmd.js";
+import type { SimGetPolicyCommand, SimGetPolicyCommandOutput } from "./command/policy/get-policy/get-policy.cmd.js";
+import type { SimListPoliciesCommand, SimListPoliciesCommandOutput } from "./command/policy/list-policies/list-policies.cmd.js";
+import { type BackgroundScheduler } from "../../util/background/background.js";
+import type { SimCreateRoleCommand, SimCreateRoleCommandOutput } from "./command/role/create-role/create-role.cmd.js";
+import type { SimGetRoleCommand, SimGetRoleCommandOutput } from "./command/role/get-role/get-role.cmd.js";
+import type { SimListRolesCommand, SimListRolesCommandOutput } from "./command/role/list-roles/list-roles.cmd.js";
+import type { SimIamAuthorizationInput } from "./authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamPolicyDecision } from "./authorize/sim-iam-decision.js";
+import type { SimPutRolePolicyCommand, SimPutRolePolicyCommandOutput } from "./command/policy/put-role-policy/put-role-policy.cmd.js";
+import { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
+import type { SimAwsCredentials, SimIamCredentialIdentity } from "./credential/sim-aws-credentials.js";
+import { type SimIamSessionCredentialGenerator } from "./credential/session/sim-iam-session-cred-gen.js";
+import { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
+import { type SimIamUserCredentialGenerator } from "./credential/user/sim-iam-user-credential-generator.js";
+import type { SimCreateUserCommand, SimCreateUserCommandOutput } from "./command/user/create-user/create-user.cmd.js";
+import type { SimCreateAccessKeyCommand, SimCreateAccessKeyCommandOutput } from "./command/user/create-access-key/create-access-key.cmd.js";
+import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
+import type { SimPutUserPolicyCommand, SimPutUserPolicyCommandOutput } from "./command/policy/put-user-policy/put-user-policy.cmd.js";
+interface SimIamProps {
+    readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly background?: BackgroundScheduler;
+    readonly credentialRegistry?: SimIamCredentialRegistry;
+    readonly sessionCredentialGenerator?: SimIamSessionCredentialGenerator;
+    readonly userCredentialGenerator?: SimIamUserCredentialGenerator;
+}
+/**
+ * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
+ * and state.
+ *
+ * IAM is account-scoped in AWS. Yulin constructs it from an Account/Region
+ * scope for consistency with the other service factories, but memoises one
+ * service facade per Account.
+ */
+export declare class SimIam implements SimIamInterServiceAuthZ {
+    /**
+     * Manage temporary sessions belonging to this simulated IAM Account.
+     */
+    readonly sessionManager: SimIamSessionManager;
+    private readonly policies;
+    private readonly roles;
+    private readonly users;
+    private readonly accountRegionScope;
+    private readonly background;
+    private readonly credentialRegistry;
+    private readonly userCredentialGenerator;
+    constructor(props?: SimIamProps);
+    /**
+     * Authenticate simulated AWS credentials.
+     */
+    resolveCredentials(credentials: SimAwsCredentials, now?: Date): SimIamCredentialIdentity;
+    /**
+     * Evaluate an IAM authorization attempt against policies relevant to the
+     * request caller.
+     *
+     * If the caller is omitted, authorization defaults to the root principal of
+     * the sim Account owning this sim IAM instance. An explicit anonymous caller
+     * suppresses that fallback and is evaluated without identity policies.
+     */
+    authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
+    /**
+     * Handle a Create Policy Command from the SDK.
+     */
+    createPolicy(cmd: SimCreatePolicyCommand): Promise<SimCreatePolicyCommandOutput>;
+    /**
+     * Handle a Get Policy Command from the SDK.
+     */
+    getPolicy(cmd: SimGetPolicyCommand): Promise<SimGetPolicyCommandOutput>;
+    /**
+     * Handle a List Policies Command from the SDK.
+     */
+    listPolicies(cmd: SimListPoliciesCommand): Promise<SimListPoliciesCommandOutput>;
+    /**
+     * Handle a Put Role Policy Command from the SDK.
+     */
+    putRolePolicy(cmd: SimPutRolePolicyCommand): Promise<SimPutRolePolicyCommandOutput>;
+    /**
+     * Handle an IAM PutUserPolicy command.
+     */
+    putUserPolicy(cmd: SimPutUserPolicyCommand): Promise<SimPutUserPolicyCommandOutput>;
+    /**
+     * Handle a Create Role Command from the SDK.
+     */
+    createRole(cmd: SimCreateRoleCommand): Promise<SimCreateRoleCommandOutput>;
+    /**
+     * Handle a Get Role Command from the SDK.
+     */
+    getRole(cmd: SimGetRoleCommand): Promise<SimGetRoleCommandOutput>;
+    /**
+     * Handle a List Roles Command from the SDK.
+     */
+    listRoles(cmd: SimListRolesCommand): Promise<SimListRolesCommandOutput>;
+    /**
+     * Handle an IAM CreateUser command.
+     */
+    createUser(cmd: SimCreateUserCommand): Promise<SimCreateUserCommandOutput>;
+    /**
+     * Handle an IAM CreateAccessKey command.
+     */
+    createAccessKey(cmd: SimCreateAccessKeyCommand): Promise<SimCreateAccessKeyCommandOutput>;
+}
+export {};
+//# sourceMappingURL=sim-iam.d.ts.map

package/dist/service/iam/sim-iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGvF,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,qDAAqD,CAAC;AAE7D,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,yDAAyD,CAAC;AAGjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,2DAA2D,CAAC;AAEnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,yDAAyD,CAAC;AAGjE,UAAU,WAAW;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;CAClE;AAED;;;;;;;GAOG;AACH,qBAAa,MAAO,YAAW,uBAAuB;IACpD;;OAEG;IACH,SAAgB,cAAc,EAAE,oBAAoB,CAAC;IAErD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IAExE,YAAY,KAAK,GAAE,WAAgB,EAmBlC;IAED;;OAEG;IACH,kBAAkB,CAChB,WAAW,EAAE,iBAAiB,EAC9B,GAAG,CAAC,EAAE,IAAI,GACT,wBAAwB,CAE1B;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAW/D;IAED;;OAEG;IACG,YAAY,CAChB,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,4BAA4B,CAAC,CAOvC;IAED;;OAEG;IACG,SAAS,CACb,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAMpC;IAED;;OAEG;IACG,YAAY,CAChB,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,4BAA4B,CAAC,CAMvC;IAED;;OAEG;IACG,aAAa,CACjB,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,6BAA6B,CAAC,CAMxC;IAED;;OAEG;IACG,aAAa,CACjB,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,6BAA6B,CAAC,CAMxC;IAED;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,0BAA0B,CAAC,CAOrC;IAED;;OAEG;IACG,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAMtE;IAED;;OAEG;IACG,SAAS,CACb,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAMpC;IAED;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,0BAA0B,CAAC,CAQrC;IAED;;OAEG;IACG,eAAe,CACnB,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAS1C;CACF"}

package/dist/service/iam/sim-iam.js

@@ -0,0 +1,182 @@
+import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { CreatePolicyCommandHandler } from "./command/policy/create-policy/create-policy.handler.js";
+import { GetPolicyCommandHandler } from "./command/policy/get-policy/get-policy.handler.js";
+import { ListPoliciesCommandHandler } from "./command/policy/list-policies/list-policies.handler.js";
+import { BackgroundTasks, } from "../../util/background/background.js";
+import { CreateRoleCommandHandler } from "./command/role/create-role/create-role.handler.js";
+import { GetRoleCommandHandler } from "./command/role/get-role/get-role.handler.js";
+import { ListRolesCommandHandler } from "./command/role/list-roles/list-roles.handler.js";
+import { SimIamAuthorizer } from "./authorize/sim-iam-authorizer.js";
+import { PutRolePolicyCommandHandler } from "./command/policy/put-role-policy/put-role-policy.handler.js";
+import { makeSimAwsAccountRootPrincipal } from "../aws/caller/sim-aws-account-root-principal.js";
+import { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
+import { SimIamRandomSessionCredentialGenerator, } from "./credential/session/sim-iam-session-cred-gen.js";
+import { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
+import { SimIamRandomUserCredentialGenerator, } from "./credential/user/sim-iam-user-credential-generator.js";
+import { CreateUserCommandHandler } from "./command/user/create-user/create-user.handler.js";
+import { CreateAccessKeyCommandHandler } from "./command/user/create-access-key/create-access-key.handler.js";
+import { PutUserPolicyCommandHandler } from "./command/policy/put-user-policy/put-user-policy.handler.js";
+/**
+ * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
+ * and state.
+ *
+ * IAM is account-scoped in AWS. Yulin constructs it from an Account/Region
+ * scope for consistency with the other service factories, but memoises one
+ * service facade per Account.
+ */
+export class SimIam {
+    /**
+     * Manage temporary sessions belonging to this simulated IAM Account.
+     */
+    sessionManager;
+    policies = new Map();
+    roles = new Map();
+    users = new Map();
+    accountRegionScope;
+    background;
+    credentialRegistry;
+    userCredentialGenerator;
+    constructor(props = {}) {
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), credentialRegistry = new SimIamCredentialRegistry(), sessionCredentialGenerator = new SimIamRandomSessionCredentialGenerator(), userCredentialGenerator = new SimIamRandomUserCredentialGenerator(), } = props;
+        this.accountRegionScope = accountRegionScope;
+        this.background = background;
+        this.credentialRegistry = credentialRegistry;
+        this.userCredentialGenerator = userCredentialGenerator;
+        this.sessionManager = new SimIamSessionManager({
+            accountId: accountRegionScope.accountId,
+            roles: this.roles,
+            credentialRegistry,
+            credentialGenerator: sessionCredentialGenerator,
+        });
+    }
+    /**
+     * Authenticate simulated AWS credentials.
+     */
+    resolveCredentials(credentials, now) {
+        return this.credentialRegistry.resolve(credentials, now);
+    }
+    /**
+     * Evaluate an IAM authorization attempt against policies relevant to the
+     * request caller.
+     *
+     * If the caller is omitted, authorization defaults to the root principal of
+     * the sim Account owning this sim IAM instance. An explicit anonymous caller
+     * suppresses that fallback and is evaluated without identity policies.
+     */
+    authorize(input) {
+        const simIamAuthorizer = new SimIamAuthorizer({
+            policies: this.policies,
+            roles: this.roles,
+            users: this.users,
+            defaultCallerPrincipal: makeSimAwsAccountRootPrincipal(this.accountRegionScope.accountId),
+            credentialIdentityResolver: this,
+        });
+        return simIamAuthorizer.authorize(input);
+    }
+    /**
+     * Handle a Create Policy Command from the SDK.
+     */
+    async createPolicy(cmd) {
+        const handler = new CreatePolicyCommandHandler({
+            accountId: this.accountRegionScope.accountId,
+            policies: this.policies,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle a Get Policy Command from the SDK.
+     */
+    async getPolicy(cmd) {
+        const handler = new GetPolicyCommandHandler({
+            policies: this.policies,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle a List Policies Command from the SDK.
+     */
+    async listPolicies(cmd) {
+        const handler = new ListPoliciesCommandHandler({
+            policies: this.policies,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle a Put Role Policy Command from the SDK.
+     */
+    async putRolePolicy(cmd) {
+        const handler = new PutRolePolicyCommandHandler({
+            roles: this.roles,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle an IAM PutUserPolicy command.
+     */
+    async putUserPolicy(cmd) {
+        const handler = new PutUserPolicyCommandHandler({
+            users: this.users,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle a Create Role Command from the SDK.
+     */
+    async createRole(cmd) {
+        const handler = new CreateRoleCommandHandler({
+            accountId: this.accountRegionScope.accountId,
+            roles: this.roles,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle a Get Role Command from the SDK.
+     */
+    async getRole(cmd) {
+        const handler = new GetRoleCommandHandler({
+            roles: this.roles,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle a List Roles Command from the SDK.
+     */
+    async listRoles(cmd) {
+        const handler = new ListRolesCommandHandler({
+            roles: this.roles,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle an IAM CreateUser command.
+     */
+    async createUser(cmd) {
+        const handler = new CreateUserCommandHandler({
+            accountId: this.accountRegionScope.accountId,
+            users: this.users,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+    /**
+     * Handle an IAM CreateAccessKey command.
+     */
+    async createAccessKey(cmd) {
+        const handler = new CreateAccessKeyCommandHandler({
+            users: this.users,
+            credentialRegistry: this.credentialRegistry,
+            credentialGenerator: this.userCredentialGenerator,
+            background: this.background,
+        });
+        return await handler.handle(cmd);
+    }
+}
+//# sourceMappingURL=sim-iam.js.map

package/dist/service/iam/sim-iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam.js","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yDAAyD,CAAC;AAMrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAS5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,yDAAyD,CAAC;AACrG,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAK7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AAMpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAG1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAKrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAC1G,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAKvF,OAAO,EACL,sCAAsC,GAEvC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EACL,mCAAmC,GAEpC,MAAM,wDAAwD,CAAC;AAMhE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAK7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,+DAA+D,CAAC;AAM9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAU1G;;;;;;;GAOG;AACH,MAAM,OAAO,MAAM;IACjB;;OAEG;IACa,cAAc,CAAuB;IAEpC,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE9C,kBAAkB,CAA2B;IAC7C,UAAU,CAAsB;IAChC,kBAAkB,CAA2B;IAC7C,uBAAuB,CAAgC;IAExE,YAAY,KAAK,GAAgB,EAAE;QACjC,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,kBAAkB,GAAG,IAAI,wBAAwB,EAAE,EACnD,0BAA0B,GAAG,IAAI,sCAAsC,EAAE,EACzE,uBAAuB,GAAG,IAAI,mCAAmC,EAAE,GACpE,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;QACvD,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB;YAClB,mBAAmB,EAAE,0BAA0B;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,WAA8B,EAC9B,GAAU;QAEV,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAA+B;QACvC,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,sBAAsB,EAAE,8BAA8B,CACpD,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAClC;YACD,0BAA0B,EAAE,IAAI;SACjC,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,GAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,0BAA0B,CAAC;YAC7C,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,SAAS;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,GAAwB;QAExB,MAAM,OAAO,GAAG,IAAI,uBAAuB,CAAC;YAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,GAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,0BAA0B,CAAC;YAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,GAA4B;QAE5B,MAAM,OAAO,GAAG,IAAI,2BAA2B,CAAC;YAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,GAA4B;QAE5B,MAAM,OAAO,GAAG,IAAI,2BAA2B,CAAC;YAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,GAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;YAC3C,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,SAAS;YAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,GAAsB;QAClC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,GAAwB;QAExB,MAAM,OAAO,GAAG,IAAI,uBAAuB,CAAC;YAC1C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,GAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;YAC3C,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,SAAS;YAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QAEH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,GAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,6BAA6B,CAAC;YAChD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,IAAI,CAAC,uBAAuB;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QAEH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/iam/user/arn/sim-iam-user-arn.d.ts

@@ -0,0 +1,14 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamUsername } from "../sim-iam-user.js";
+interface MakeSimUserArnProps {
+    readonly accountId: SimAwsAccountId;
+    readonly path: string;
+    readonly userName: SimIamUsername;
+}
+/**
+ * Make an IAM user ARN.
+ */
+export declare function makeSimUserArn(props: MakeSimUserArnProps): SimArn;
+export {};
+//# sourceMappingURL=sim-iam-user-arn.d.ts.map

package/dist/service/iam/user/arn/sim-iam-user-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-arn.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/user/arn/sim-iam-user-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAIjE"}

package/dist/service/iam/user/arn/sim-iam-user-arn.js

@@ -0,0 +1,8 @@
+/**
+ * Make an IAM user ARN.
+ */
+export function makeSimUserArn(props) {
+    const pathPart = props.path === "/" ? "" : props.path.slice(1);
+    return `arn:aws:iam::${props.accountId}:user/${pathPart}${props.userName}`;
+}
+//# sourceMappingURL=sim-iam-user-arn.js.map

package/dist/service/iam/user/arn/sim-iam-user-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-arn.js","sourceRoot":"","sources":["../../../../../src/service/iam/user/arn/sim-iam-user-arn.ts"],"names":[],"mappings":"AAUA;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO,gBAAgB,KAAK,CAAC,SAAS,SAAS,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAY,CAAC;AACvF,CAAC"}

package/dist/service/iam/user/sim-iam-user-id.d.ts

@@ -0,0 +1,6 @@
+import type { SimIamUserId } from "./sim-iam-user.js";
+/**
+ * Generate an AWS-shaped IAM user ID.
+ */
+export declare function makeSimIamUserId(): SimIamUserId;
+//# sourceMappingURL=sim-iam-user-id.d.ts.map

package/dist/service/iam/user/sim-iam-user-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-id.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/user/sim-iam-user-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAI/C"}

package/dist/service/iam/user/sim-iam-user-id.js

@@ -0,0 +1,10 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Generate an AWS-shaped IAM user ID.
+ */
+export function makeSimIamUserId() {
+    return `AIDA${faker.string
+        .alphanumeric({ length: 16 })
+        .toUpperCase()}`;
+}
+//# sourceMappingURL=sim-iam-user-id.js.map

package/dist/service/iam/user/sim-iam-user-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-id.js","sourceRoot":"","sources":["../../../../src/service/iam/user/sim-iam-user-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAIxC;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,KAAK,CAAC,MAAM;SACvB,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SAC5B,WAAW,EAAE,EAAkB,CAAC;AACrC,CAAC"}

package/dist/service/iam/user/sim-iam-user-path.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Normalize an IAM user path to slash-delimited AWS form.
+ */
+export declare function normaliseUserPath(path?: string): string;
+//# sourceMappingURL=sim-iam-user-path.d.ts.map

package/dist/service/iam/user/sim-iam-user-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-path.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/user/sim-iam-user-path.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAUvD"}

package/dist/service/iam/user/sim-iam-user-path.js

@@ -0,0 +1,13 @@
+/**
+ * Normalize an IAM user path to slash-delimited AWS form.
+ */
+export function normaliseUserPath(path) {
+    if (path === undefined || path.length === 0) {
+        return "/";
+    }
+    const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
+    return withLeadingSlash.endsWith("/")
+        ? withLeadingSlash
+        : `${withLeadingSlash}/`;
+}
+//# sourceMappingURL=sim-iam-user-path.js.map

package/dist/service/iam/user/sim-iam-user-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-path.js","sourceRoot":"","sources":["../../../../src/service/iam/user/sim-iam-user-path.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAElE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,GAAG,gBAAgB,GAAG,CAAC;AAC7B,CAAC"}

package/dist/service/iam/user/sim-iam-user.d.ts

@@ -0,0 +1,31 @@
+import type { JSONString } from "../../../util/type-guard/json.js";
+import type { Brand } from "../../../util/brand.type.js";
+import type { SimArn } from "../../aws/arn.js";
+import type { SimIamAccessKey } from "../credential/sim-iam-access-key.js";
+import type { SimIamPolicyDocument } from "../policy/sim-iam-policy.js";
+import type { SimIamPrincipal } from "../principal/sim-iam-principal.js";
+export type SimIamUsername = Brand<string, "SimIamUsername">;
+export type SimIamUserId = Brand<string, "SimIamUserId">;
+/**
+ * Account-scoped simulated IAM user.
+ */
+export interface SimIamUser extends SimIamPrincipal {
+    readonly principalType: "user";
+    readonly userId: SimIamUserId;
+    readonly userName: SimIamUsername;
+    readonly path: string;
+    readonly createDate: Date;
+    /**
+     * Long-lived access keys owned by this user.
+     */
+    readonly accessKeys: Map<string, SimIamAccessKey>;
+    /**
+     * Inline identity policies stored directly on the user.
+     */
+    readonly inlinePolicies: Map<string, JSONString<SimIamPolicyDocument>>;
+    /**
+     * Managed identity policies attached to the user.
+     */
+    readonly attachedPolicyArns: Set<SimArn>;
+}
+//# sourceMappingURL=sim-iam-user.d.ts.map

package/dist/service/iam/user/sim-iam-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/user/sim-iam-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAC7D,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAW,SAAQ,eAAe;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAElD;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEvE;;OAEG;IACH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1C"}

package/dist/service/iam/user/sim-iam-user.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-user.js.map

package/dist/service/iam/user/sim-iam-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user.js","sourceRoot":"","sources":["../../../../src/service/iam/user/sim-iam-user.ts"],"names":[],"mappings":""}

package/dist/service/iam/validate/sim-iam-policy-doc-validator.d.ts

@@ -0,0 +1,18 @@
+import { type JSONString } from "../../../util/type-guard/json.js";
+import type { SimIamPolicyDocument } from "../policy/sim-iam-policy.js";
+/**
+ * Performs basic IAM policy document validation shared by IAM policy commands.
+ */
+export declare class SimIamPolicyDocumentValidator {
+    /**
+     * Validate a required JSON IAM policy document string.
+     */
+    validateRequired(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument>;
+    /**
+     * Validate an optional JSON IAM policy document string when present.
+     */
+    validateOptional(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument> | undefined;
+    private validate;
+    private validateParsed;
+}
+//# sourceMappingURL=sim-iam-policy-doc-validator.d.ts.map

package/dist/service/iam/validate/sim-iam-policy-doc-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-doc-validator.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/validate/sim-iam-policy-doc-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAG9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;GAEG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,gBAAgB,CACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAM5D;IAED;;OAEG;IACH,gBAAgB,CACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAMxE;IAED,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,cAAc;CAyBvB"}

package/dist/service/iam/validate/sim-iam-policy-doc-validator.js

@@ -0,0 +1,46 @@
+import { jsonParse } from "../../../util/type-guard/json.js";
+import { SimIamMalformedPolicyDocument } from "../error/sim-iam.error.js";
+import { simIamPolicyDocumentStatements } from "../policy/sim-iam-pol-doc-statements.js";
+/**
+ * Performs basic IAM policy document validation shared by IAM policy commands.
+ */
+export class SimIamPolicyDocumentValidator {
+    /**
+     * Validate a required JSON IAM policy document string.
+     */
+    validateRequired(policyDocument) {
+        if (policyDocument === undefined || policyDocument.length === 0) {
+            throw new Error("PolicyDocument is required");
+        }
+        this.validate(policyDocument);
+    }
+    /**
+     * Validate an optional JSON IAM policy document string when present.
+     */
+    validateOptional(policyDocument) {
+        if (policyDocument === undefined || policyDocument.length === 0) {
+            return;
+        }
+        this.validate(policyDocument);
+    }
+    validate(policyDocument) {
+        const parsedPolicyDocument = jsonParse(policyDocument);
+        this.validateParsed(parsedPolicyDocument);
+    }
+    validateParsed(policyDocument) {
+        for (const statement of simIamPolicyDocumentStatements(policyDocument)) {
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+            if (statement.Effect !== "Allow" && statement.Effect !== "Deny") {
+                throw new SimIamMalformedPolicyDocument('IAM policy statement Effect must be either "Allow" or "Deny"');
+            }
+            if (statement.Action === undefined && statement.NotAction === undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM policy statement must define either Action or NotAction");
+            }
+            if (statement.Resource === undefined &&
+                statement.NotResource === undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM policy statement must define either Resource or NotResource");
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-iam-policy-doc-validator.js.map

package/dist/service/iam/validate/sim-iam-policy-doc-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-doc-validator.js","sourceRoot":"","sources":["../../../../src/service/iam/validate/sim-iam-policy-doc-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAmB,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAGzF;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAEO,QAAQ,CACd,cAAsB;QAEtB,MAAM,oBAAoB,GAAG,SAAS,CACpC,cAAkD,CACnD,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAEO,cAAc,CAAC,cAAoC;QACzD,KAAK,MAAM,SAAS,IAAI,8BAA8B,CAAC,cAAc,CAAC,EAAE,CAAC;YACvE,uEAAuE;YACvE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChE,MAAM,IAAI,6BAA6B,CACrC,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,IAAI,6BAA6B,CACrC,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YAED,IACE,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAChC,SAAS,CAAC,WAAW,KAAK,SAAS,EACnC,CAAC;gBACD,MAAM,IAAI,6BAA6B,CACrC,iEAAiE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/validate/trust/sim-iam-trust-policy-doc-validator.d.ts

@@ -0,0 +1,22 @@
+import type { JSONString } from "../../../../util/type-guard/json.js";
+import type { SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+/**
+ * Validates an IAM Role trust policy.
+ *
+ * Trust policies differ from identity policies:
+ *
+ * - they require Principal or NotPrincipal;
+ * - they require Action or NotAction;
+ * - Resource and NotResource are not valid because the policy is implicitly
+ *   attached to its owning Role.
+ */
+export declare class SimIamTrustPolicyDocumentValidator {
+    /**
+     * Validate a required JSON Role trust-policy document.
+     */
+    validateRequired(policyDocument: string | undefined): asserts policyDocument is JSONString<SimIamPolicyDocument>;
+    private validateParsed;
+    private validatePrincipal;
+    private validatePrincipalValue;
+}
+//# sourceMappingURL=sim-iam-trust-policy-doc-validator.d.ts.map

package/dist/service/iam/validate/trust/sim-iam-trust-policy-doc-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-trust-policy-doc-validator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/validate/trust/sim-iam-trust-policy-doc-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAGtE,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,gCAAgC,CAAC;AAGxC;;;;;;;;;GASG;AACH,qBAAa,kCAAkC;IAC7C;;OAEG;IACH,gBAAgB,CACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAU5D;IAED,OAAO,CAAC,cAAc;IAqDtB,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,sBAAsB;CAO/B"}

package/dist/service/iam/validate/trust/sim-iam-trust-policy-doc-validator.js

@@ -0,0 +1,85 @@
+import { jsonParse } from "../../../../util/type-guard/json.js";
+import { SimIamMalformedPolicyDocument } from "../../error/sim-iam.error.js";
+import { simIamPolicyDocumentStatements } from "../../policy/sim-iam-pol-doc-statements.js";
+/**
+ * Validates an IAM Role trust policy.
+ *
+ * Trust policies differ from identity policies:
+ *
+ * - they require Principal or NotPrincipal;
+ * - they require Action or NotAction;
+ * - Resource and NotResource are not valid because the policy is implicitly
+ *   attached to its owning Role.
+ */
+export class SimIamTrustPolicyDocumentValidator {
+    /**
+     * Validate a required JSON Role trust-policy document.
+     */
+    validateRequired(policyDocument) {
+        if (policyDocument === undefined || policyDocument.length === 0) {
+            throw new Error("AssumeRolePolicyDocument is required");
+        }
+        const parsedPolicyDocument = jsonParse(policyDocument);
+        this.validateParsed(parsedPolicyDocument);
+    }
+    validateParsed(policyDocument) {
+        for (const statement of simIamPolicyDocumentStatements(policyDocument)) {
+            // JSON parsing could produce any value so we have to runtime validate.
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+            if (statement.Effect !== "Allow" && statement.Effect !== "Deny") {
+                throw new SimIamMalformedPolicyDocument('IAM trust policy statement Effect must be either "Allow" or "Deny"');
+            }
+            if (statement.Action === undefined && statement.NotAction === undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM trust policy statement must define either Action or NotAction");
+            }
+            if (statement.Principal === undefined &&
+                statement.NotPrincipal === undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM trust policy statement must define either Principal or NotPrincipal");
+            }
+            if (statement.Principal !== undefined &&
+                statement.NotPrincipal !== undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM trust policy statement cannot define both Principal and NotPrincipal");
+            }
+            if (statement.Resource !== undefined ||
+                statement.NotResource !== undefined) {
+                throw new SimIamMalformedPolicyDocument("IAM trust policy statement cannot define Resource or NotResource");
+            }
+            if (statement.Principal !== undefined) {
+                this.validatePrincipal(statement.Principal);
+            }
+            if (statement.NotPrincipal !== undefined) {
+                this.validatePrincipal(statement.NotPrincipal);
+            }
+        }
+    }
+    validatePrincipal(principal) {
+        if (typeof principal === "string") {
+            this.validatePrincipalValue(principal);
+            return;
+        }
+        if (Array.isArray(principal)) {
+            for (const value of principal) {
+                this.validatePrincipalValue(value);
+            }
+            return;
+        }
+        for (const [principalType, values] of Object.entries(principal)) {
+            if (principalType !== "AWS" && principalType !== "Service") {
+                throw new SimIamMalformedPolicyDocument(`Unsupported IAM trust policy principal type: ${principalType}`);
+            }
+            if (typeof values === "string") {
+                this.validatePrincipalValue(values);
+                continue;
+            }
+            for (const value of values) {
+                this.validatePrincipalValue(value);
+            }
+        }
+    }
+    validatePrincipalValue(value) {
+        if (value.length === 0) {
+            throw new SimIamMalformedPolicyDocument("IAM trust policy principal cannot be empty");
+        }
+    }
+}
+//# sourceMappingURL=sim-iam-trust-policy-doc-validator.js.map

package/dist/service/iam/validate/trust/sim-iam-trust-policy-doc-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-trust-policy-doc-validator.js","sourceRoot":"","sources":["../../../../../src/service/iam/validate/trust/sim-iam-trust-policy-doc-validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAK7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAE5F;;;;;;;;;GASG;AACH,MAAM,OAAO,kCAAkC;IAC7C;;OAEG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,oBAAoB,GAAG,SAAS,CACpC,cAAkD,CACnD,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAEO,cAAc,CAAC,cAAoC;QACzD,KAAK,MAAM,SAAS,IAAI,8BAA8B,CAAC,cAAc,CAAC,EAAE,CAAC;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChE,MAAM,IAAI,6BAA6B,CACrC,oEAAoE,CACrE,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,IAAI,6BAA6B,CACrC,mEAAmE,CACpE,CAAC;YACJ,CAAC;YAED,IACE,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,EACpC,CAAC;gBACD,MAAM,IAAI,6BAA6B,CACrC,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,IACE,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,EACpC,CAAC;gBACD,MAAM,IAAI,6BAA6B,CACrC,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YAED,IACE,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAChC,SAAS,CAAC,WAAW,KAAK,SAAS,EACnC,CAAC;gBACD,MAAM,IAAI,6BAA6B,CACrC,kEAAkE,CACnE,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACzC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,SAAwC;QAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,sBAAsB,CAAC,KAAe,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,IAAI,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,IAAI,6BAA6B,CACrC,gDAAgD,aAAa,EAAE,CAChE,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,KAAa;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,6BAA6B,CACrC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}