@kensio/yulin 0.31.0 → 0.33.0

package/dist/service/s3/command/list-buckets/list-buckets-authorizer.js

@@ -0,0 +1,44 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an S3 ListBuckets request.
+ *
+ * AWS maps the ListBuckets API operation to the S3:ListAllMyBuckets IAM
+ * action. Despite the action name, this permission does not use individual
+ * Bucket ARNs. AWS documents it as an account-level listing permission whose
+ * resource is "*".
+ *
+ * Authorization therefore applies to the complete operation. An allowed caller
+ * receives the account's Bucket listing, subject to request pagination and
+ * prefix filtering. A denied caller receives AccessDenied rather than a
+ * filtered or empty result.
+ */
+export class ListBucketsAuthorizer {
+    static action = "s3:ListAllMyBuckets";
+    static resource = "*";
+    iam;
+    constructor(props) {
+        this.iam = props.iam;
+    }
+    /**
+     * Ensure the caller may list the simulated Account's S3 Buckets.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit anonymous
+     * caller, which has no identity policy permissions.
+     */
+    authorize(caller) {
+        const decision = this.iam.authorize({
+            action: ListBucketsAuthorizer.action,
+            resource: ListBucketsAuthorizer.resource,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: ListBucketsAuthorizer.action,
+                resource: ListBucketsAuthorizer.resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=list-buckets-authorizer.js.map

package/dist/service/s3/command/list-buckets/list-buckets-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-buckets-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-buckets/list-buckets-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAMzE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAU,MAAM,GAAG,qBAAqB,CAAC;IAC/C,MAAM,CAAU,QAAQ,GAAG,GAAG,CAAC;IAEtB,GAAG,CAA0B;IAE9C,YAAY,KAAiC;QAC3C,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAqB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,qBAAqB,CAAC,MAAM;YACpC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;YACxC,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,qBAAqB,CAAC,MAAM;gBACpC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/command/list-buckets/list-buckets-page-builder.d.ts

@@ -0,0 +1,65 @@
+import type { SimListBucketsCommandInput, SimListBucketsCommandOutput } from "./list-buckets.cmd.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+interface ListBucketsPageBuilderProps {
+    readonly buckets: ReadonlyMap<SimS3BucketName, SimS3Bucket>;
+}
+type ListBucketsPage = Omit<SimListBucketsCommandOutput, "$metadata">;
+/**
+ * Builds one page of an S3 ListBuckets response.
+ *
+ * IAM authorization remains in the command handler because it controls whether
+ * Bucket state may be read at all. This class handles the data operations that
+ * happen after authorization: stable ordering, prefix filtering, continuation
+ * token interpretation, page selection, and generation of the next token.
+ *
+ * Continuation tokens encode the final Bucket name from the previous page. Since
+ * Bucket names are globally unique and the collection is sorted by name, that
+ * name provides a stable position from which to continue. If the referenced
+ * Bucket is absent, listing restarts at the beginning rather than producing a
+ * negative array index.
+ */
+export declare class ListBucketsPageBuilder {
+    private readonly buckets;
+    constructor(props: ListBucketsPageBuilderProps);
+    /**
+     * Build the response fields for one ListBuckets page.
+     *
+     * Response metadata is owned by the command handler, so it is not included in
+     * this result. Keeping protocol metadata outside this class lets the pagination
+     * logic remain focused on Bucket collection state and request parameters.
+     */
+    build(input: SimListBucketsCommandInput): ListBucketsPage;
+    /**
+     * Return Buckets in the name order used by continuation tokens.
+     *
+     * A new array is sorted so listing cannot change insertion order in the
+     * service's Bucket map. Prefix filtering happens after sorting, preserving the
+     * same relative order for filtered and unfiltered requests.
+     */
+    private matchingBuckets;
+    /**
+     * Find the first Bucket to include after a continuation token.
+     *
+     * The token identifies the last Bucket returned by the preceding page, so the
+     * next page starts one position later. A missing or unknown token position maps
+     * to index zero, matching the previous handler behavior.
+     */
+    private startIndex;
+    /**
+     * Create a token only when another Bucket remains after this page.
+     *
+     * Empty pages have no final Bucket from which to form a token. A final page
+     * also omits the token so callers can detect completion.
+     */
+    private nextContinuationToken;
+    /**
+     * Encode a Bucket name as an opaque URL-safe continuation token.
+     */
+    private makeContinuationToken;
+    /**
+     * Recover the Bucket name represented by a continuation token.
+     */
+    private parseContinuationToken;
+}
+export {};
+//# sourceMappingURL=list-buckets-page-builder.d.ts.map

package/dist/service/s3/command/list-buckets/list-buckets-page-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-buckets-page-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-buckets/list-buckets-page-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,UAAU,2BAA2B;IACnC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;CAC7D;AAED,KAAK,eAAe,GAAG,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4C;IAEpE,YAAY,KAAK,EAAE,2BAA2B,EAE7C;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,0BAA0B,GAAG,eAAe,CAoBxD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IASvB;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAgBlB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,sBAAsB;CAG/B"}

package/dist/service/s3/command/list-buckets/list-buckets-page-builder.js

@@ -0,0 +1,94 @@
+/**
+ * Builds one page of an S3 ListBuckets response.
+ *
+ * IAM authorization remains in the command handler because it controls whether
+ * Bucket state may be read at all. This class handles the data operations that
+ * happen after authorization: stable ordering, prefix filtering, continuation
+ * token interpretation, page selection, and generation of the next token.
+ *
+ * Continuation tokens encode the final Bucket name from the previous page. Since
+ * Bucket names are globally unique and the collection is sorted by name, that
+ * name provides a stable position from which to continue. If the referenced
+ * Bucket is absent, listing restarts at the beginning rather than producing a
+ * negative array index.
+ */
+export class ListBucketsPageBuilder {
+    buckets;
+    constructor(props) {
+        this.buckets = props.buckets;
+    }
+    /**
+     * Build the response fields for one ListBuckets page.
+     *
+     * Response metadata is owned by the command handler, so it is not included in
+     * this result. Keeping protocol metadata outside this class lets the pagination
+     * logic remain focused on Bucket collection state and request parameters.
+     */
+    build(input) {
+        const matchingBuckets = this.matchingBuckets(input.Prefix);
+        const startIndex = this.startIndex(matchingBuckets, input.ContinuationToken);
+        const maxBuckets = input.MaxBuckets ?? 10_000;
+        const page = matchingBuckets.slice(startIndex, startIndex + maxBuckets);
+        return {
+            Buckets: page.map((bucket) => ({
+                Name: bucket.bucketName,
+            })),
+            ContinuationToken: this.nextContinuationToken(page, startIndex, matchingBuckets.length),
+            Prefix: input.Prefix,
+        };
+    }
+    /**
+     * Return Buckets in the name order used by continuation tokens.
+     *
+     * A new array is sorted so listing cannot change insertion order in the
+     * service's Bucket map. Prefix filtering happens after sorting, preserving the
+     * same relative order for filtered and unfiltered requests.
+     */
+    matchingBuckets(prefix) {
+        const buckets = this.buckets.values().toArray();
+        buckets.sort((a, b) => a.bucketName.localeCompare(b.bucketName));
+        return prefix === undefined
+            ? buckets
+            : buckets.filter((bucket) => bucket.bucketName.startsWith(prefix));
+    }
+    /**
+     * Find the first Bucket to include after a continuation token.
+     *
+     * The token identifies the last Bucket returned by the preceding page, so the
+     * next page starts one position later. A missing or unknown token position maps
+     * to index zero, matching the previous handler behavior.
+     */
+    startIndex(buckets, continuationToken) {
+        if (continuationToken === undefined) {
+            return 0;
+        }
+        const startBucketName = this.parseContinuationToken(continuationToken);
+        return Math.max(0, buckets.findIndex((bucket) => bucket.bucketName === startBucketName) + 1);
+    }
+    /**
+     * Create a token only when another Bucket remains after this page.
+     *
+     * Empty pages have no final Bucket from which to form a token. A final page
+     * also omits the token so callers can detect completion.
+     */
+    nextContinuationToken(page, startIndex, matchingBucketCount) {
+        const lastBucket = page.at(-1);
+        const hasMoreBuckets = startIndex + page.length < matchingBucketCount;
+        return hasMoreBuckets && lastBucket !== undefined
+            ? this.makeContinuationToken(lastBucket.bucketName)
+            : undefined;
+    }
+    /**
+     * Encode a Bucket name as an opaque URL-safe continuation token.
+     */
+    makeContinuationToken(bucketName) {
+        return Buffer.from(bucketName, "utf8").toString("base64url");
+    }
+    /**
+     * Recover the Bucket name represented by a continuation token.
+     */
+    parseContinuationToken(token) {
+        return Buffer.from(token, "base64url").toString("utf8");
+    }
+}
+//# sourceMappingURL=list-buckets-page-builder.js.map

package/dist/service/s3/command/list-buckets/list-buckets-page-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-buckets-page-builder.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-buckets/list-buckets-page-builder.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,sBAAsB;IAChB,OAAO,CAA4C;IAEpE,YAAY,KAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAiC;QACrC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAChC,eAAe,EACf,KAAK,CAAC,iBAAiB,CACxB,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;QAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC;QAExE,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,MAAM,CAAC,UAAU;aACxB,CAAC,CAAC;YACH,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAC3C,IAAI,EACJ,UAAU,EACV,eAAe,CAAC,MAAM,CACvB;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,MAAe;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAEjE,OAAO,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAChB,OAA+B,EAC/B,iBAA0B;QAE1B,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EACD,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,eAAe,CAAC,GAAG,CAAC,CACzE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAC3B,IAA4B,EAC5B,UAAkB,EAClB,mBAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC;QAEtE,OAAO,cAAc,IAAI,UAAU,KAAK,SAAS;YAC/C,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,UAAU,CAAC;YACnD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,UAAkB;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,KAAa;QAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/service/s3/command/list-buckets/list-buckets.handler.d.ts

@@ -2,25 +2,37 @@ import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { SimListBucketsCommand, SimListBucketsCommandOutput } from "./list-buckets.cmd.js";
 import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface ListBucketsCommandHandlerProps {
     readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
+interface ListBucketsCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Simulated S3 ListBucketsCommand handler.
  *
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/ListBucketsCommand/
  */
 export declare class ListBucketsCommandHandler implements CommandHandler<SimListBucketsCommand, SimListBucketsCommandOutput> {
-    private readonly buckets;
+    private readonly authorizer;
+    private readonly pageBuilder;
     private readonly background;
     constructor(props: ListBucketsCommandHandlerProps);
     /**
      * Simulate listing S3 Buckets.
+     *
+     * Authorization happens before the page builder reads Bucket state. AWS treats
+     * ListBuckets as one account-level operation and does not return a partial
+     * result containing only Bucket ARNs matched by the caller's policies.
+     *
+     * Once authorized, page construction is delegated so this handler remains
+     * focused on coordinating request-level concerns.
      */
-    handle(cmd: SimListBucketsCommand): Promise<SimListBucketsCommandOutput>;
-    private static makeContinuationToken;
-    private static parseContinuationToken;
+    handle(cmd: SimListBucketsCommand, opts?: ListBucketsCommandHandlerOptions): Promise<SimListBucketsCommandOutput>;
 }
 export {};
 //# sourceMappingURL=list-buckets.handler.d.ts.map

package/dist/service/s3/command/list-buckets/list-buckets.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-buckets.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-buckets/list-buckets.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAEnD,UAAU,8BAA8B;IACtC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,cAAc,CAC9D,qBAAqB,EACrB,2BAA2B,CAC5B;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;gBAErC,KAAK,EAAE,8BAA8B;IAMjD;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,2BAA2B,CAAC;IAkDvC,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAIpC,OAAO,CAAC,MAAM,CAAC,sBAAsB;CAGtC"}
+{"version":3,"file":"list-buckets.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-buckets/list-buckets.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAI1E,UAAU,8BAA8B;IACtC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,cAAc,CAC9D,qBAAqB,EACrB,2BAA2B,CAC5B;IACC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,KAAK,EAAE,8BAA8B,EAShD;IAED;;;;;;;;;OASG;IACG,MAAM,CACV,GAAG,EAAE,qBAAqB,EAC1B,IAAI,CAAC,EAAE,gCAAgC,GACtC,OAAO,CAAC,2BAA2B,CAAC,CAUtC;CACF"}

package/dist/service/s3/command/list-buckets/list-buckets.handler.js

@@ -1,56 +1,40 @@
 import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { ListBucketsAuthorizer } from "./list-buckets-authorizer.js";
+import { ListBucketsPageBuilder } from "./list-buckets-page-builder.js";
 /**
  * Simulated S3 ListBucketsCommand handler.
  *
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/ListBucketsCommand/
  */
 export class ListBucketsCommandHandler {
-    buckets;
+    authorizer;
+    pageBuilder;
     background;
     constructor(props) {
-        const { buckets, background = new BackgroundTasks() } = props;
-        this.buckets = buckets;
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = props;
+        this.authorizer = new ListBucketsAuthorizer({ iam });
+        this.pageBuilder = new ListBucketsPageBuilder({ buckets });
         this.background = background;
     }
     /**
      * Simulate listing S3 Buckets.
+     *
+     * Authorization happens before the page builder reads Bucket state. AWS treats
+     * ListBuckets as one account-level operation and does not return a partial
+     * result containing only Bucket ARNs matched by the caller's policies.
+     *
+     * Once authorized, page construction is delegated so this handler remains
+     * focused on coordinating request-level concerns.
      */
-    async handle(cmd) {
+    async handle(cmd, opts) {
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
-        const buckets = [...this.buckets.values()];
-        buckets.sort((a, b) => a.bucketName.localeCompare(b.bucketName));
-        const prefix = cmd.input.Prefix;
-        const continuationToken = cmd.input.ContinuationToken;
-        const maxBuckets = cmd.input.MaxBuckets ?? 10_000;
-        const matchingBuckets = prefix === undefined
-            ? buckets
-            : buckets.filter((bucket) => bucket.bucketName.startsWith(prefix));
-        const startBucketName = continuationToken === undefined
-            ? undefined
-            : ListBucketsCommandHandler.parseContinuationToken(continuationToken);
-        const startIndex = startBucketName === undefined
-            ? 0
-            : Math.max(0, matchingBuckets.findIndex((bucket) => bucket.bucketName === startBucketName) + 1);
-        const page = matchingBuckets.slice(startIndex, startIndex + maxBuckets);
-        const lastBucket = page.at(-1);
-        const hasMoreBuckets = startIndex + page.length < matchingBuckets.length;
+        this.authorizer.authorize(opts?.caller);
         return {
-            Buckets: page.map((bucket) => ({
-                Name: bucket.bucketName,
-            })),
-            ContinuationToken: hasMoreBuckets && lastBucket !== undefined
-                ? ListBucketsCommandHandler.makeContinuationToken(lastBucket.bucketName)
-                : undefined,
-            Prefix: prefix,
+            ...this.pageBuilder.build(cmd.input),
             $metadata: {},
         };
     }
-    static makeContinuationToken(bucketName) {
-        return Buffer.from(bucketName, "utf8").toString("base64url");
-    }
-    static parseContinuationToken(token) {
-        return Buffer.from(token, "base64url").toString("utf8");
-    }
 }
 //# sourceMappingURL=list-buckets.handler.js.map

package/dist/service/s3/command/list-buckets/list-buckets.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-buckets.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-buckets/list-buckets.handler.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAOnD;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAInB,OAAO,CAAoC;IAC3C,UAAU,CAAsB;IAEjD,YAAY,KAAqC;QAC/C,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,KAAK,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAA0B;QAE1B,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACtD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;QAElD,MAAM,eAAe,GACnB,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAEvE,MAAM,eAAe,GACnB,iBAAiB,KAAK,SAAS;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QAE1E,MAAM,UAAU,GACd,eAAe,KAAK,SAAS;YAC3B,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CACN,CAAC,EACD,eAAe,CAAC,SAAS,CACvB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,eAAe,CAClD,GAAG,CAAC,CACN,CAAC;QAER,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QAEzE,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,MAAM,CAAC,UAAU;aACxB,CAAC,CAAC;YACH,iBAAiB,EACf,cAAc,IAAI,UAAU,KAAK,SAAS;gBACxC,CAAC,CAAC,yBAAyB,CAAC,qBAAqB,CAC7C,UAAU,CAAC,UAAU,CACtB;gBACH,CAAC,CAAC,SAAS;YACf,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,UAAkB;QACrD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IAEO,MAAM,CAAC,sBAAsB,CAAC,KAAa;QACjD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF"}
+{"version":3,"file":"list-buckets.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-buckets/list-buckets.handler.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAInB,UAAU,CAAwB;IAClC,WAAW,CAAyB;IACpC,UAAU,CAAsB;IAEjD,YAAY,KAAqC;QAC/C,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QACV,IAAI,CAAC,UAAU,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CACV,GAA0B,EAC1B,IAAuC;QAEvC,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAExC,OAAO;YACL,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;YACpC,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/list-objects/list-objects-authorizer.d.ts

@@ -0,0 +1,35 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+interface ListObjectsAuthorizerProps {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface ListObjectsAuthorizationInput {
+    readonly bucket: SimS3Bucket;
+    readonly prefix?: string | undefined;
+    readonly maxKeys: number;
+    readonly caller?: SimAwsCaller | undefined;
+}
+/**
+ * Applies IAM authorization to an S3 ListObjects request.
+ *
+ * AWS authorizes both ListObjects and ListObjectsV2 with the `s3:ListBucket`
+ * action. The resource is the Bucket ARN because listing examines a Bucket's
+ * key namespace rather than reading any individual Object.
+ *
+ * Prefix and maximum-result constraints are request attributes used by IAM
+ * policies to limit which listings a principal may perform. They are supplied
+ * as S3 condition keys so policy evaluation can distinguish, for example, a
+ * permitted app prefix from a restricted private prefix.
+ */
+export declare class ListObjectsAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(props: ListObjectsAuthorizerProps);
+    /**
+     * Ensure the caller may list the requested portion of the Bucket namespace.
+     */
+    authorize(input: ListObjectsAuthorizationInput): void;
+}
+export {};
+//# sourceMappingURL=list-objects-authorizer.d.ts.map

package/dist/service/s3/command/list-objects/list-objects-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-objects-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-objects/list-objects-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,UAAU,0BAA0B;IAClC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAEjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,KAAK,EAAE,0BAA0B,EAE5C;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,IAAI,CA8BpD;CACF"}

package/dist/service/s3/command/list-objects/list-objects-authorizer.js

@@ -0,0 +1,53 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an S3 ListObjects request.
+ *
+ * AWS authorizes both ListObjects and ListObjectsV2 with the `s3:ListBucket`
+ * action. The resource is the Bucket ARN because listing examines a Bucket's
+ * key namespace rather than reading any individual Object.
+ *
+ * Prefix and maximum-result constraints are request attributes used by IAM
+ * policies to limit which listings a principal may perform. They are supplied
+ * as S3 condition keys so policy evaluation can distinguish, for example, a
+ * permitted app prefix from a restricted private prefix.
+ */
+export class ListObjectsAuthorizer {
+    static action = "s3:ListBucket";
+    iam;
+    constructor(props) {
+        this.iam = props.iam;
+    }
+    /**
+     * Ensure the caller may list the requested portion of the Bucket namespace.
+     */
+    authorize(input) {
+        const resource = `arn:aws:s3:::${input.bucket.bucketName}`;
+        const policy = input.bucket.getPolicy();
+        const decision = this.iam.authorize({
+            action: ListObjectsAuthorizer.action,
+            resource,
+            caller: input.caller,
+            conditionContext: {
+                "s3:prefix": input.prefix ?? "",
+                "s3:max-keys": input.maxKeys,
+            },
+            resourcePolicies: policy === undefined
+                ? []
+                : [
+                    {
+                        document: policy,
+                        policyName: "BucketPolicy",
+                        resourceArn: resource,
+                    },
+                ],
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: ListObjectsAuthorizer.action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=list-objects-authorizer.js.map

package/dist/service/s3/command/list-objects/list-objects-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-objects-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-objects/list-objects-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAczE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAU,MAAM,GAAG,eAAe,CAAC;IAEhC,GAAG,CAA0B;IAE9C,YAAY,KAAiC;QAC3C,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,QAAQ,GAAG,gBAAgB,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,qBAAqB,CAAC,MAAM;YACpC,QAAQ;YACR,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE;gBAChB,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;gBAC/B,aAAa,EAAE,KAAK,CAAC,OAAO;aAC7B;YACD,gBAAgB,EACd,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,QAAQ,EAAE,MAAM;wBAChB,UAAU,EAAE,cAAc;wBAC1B,WAAW,EAAE,QAAQ;qBACtB;iBACF;SACR,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,qBAAqB,CAAC,MAAM;gBACpC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/command/list-objects/list-objects-page-builder.d.ts

@@ -0,0 +1,30 @@
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimListObjectsCommandOutput } from "./list-objects.cmd.js";
+interface ListObjectsPageInput {
+    readonly bucket: SimS3Bucket;
+    readonly prefix?: string | undefined;
+    readonly marker?: string | undefined;
+    readonly maxKeys: number;
+}
+/**
+ * Reads, orders, and paginates Objects for a ListObjects response.
+ *
+ * Authorization is completed by the command handler before this class is
+ * called. Keeping storage access here, behind that boundary, prevents a denied
+ * request from examining Object keys or sizes.
+ *
+ * S3 returns keys in lexicographical order. The marker is exclusive, so a page
+ * begins after the matching key. If the marker does not identify a stored key,
+ * this simulation retains its existing behavior and starts from the beginning.
+ *
+ * NextMarker is returned only when another page exists and identifies the final
+ * key in the current page.
+ */
+export declare class ListObjectsPageBuilder {
+    /**
+     * Build one response page from the authorized Bucket listing.
+     */
+    build(input: ListObjectsPageInput): Promise<SimListObjectsCommandOutput>;
+}
+export {};
+//# sourceMappingURL=list-objects-page-builder.d.ts.map

package/dist/service/s3/command/list-objects/list-objects-page-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-objects-page-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-objects/list-objects-page-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEzE,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,sBAAsB;IACjC;;OAEG;IACG,KAAK,CACT,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,2BAA2B,CAAC,CA8BtC;CACF"}

package/dist/service/s3/command/list-objects/list-objects-page-builder.js

@@ -0,0 +1,43 @@
+/**
+ * Reads, orders, and paginates Objects for a ListObjects response.
+ *
+ * Authorization is completed by the command handler before this class is
+ * called. Keeping storage access here, behind that boundary, prevents a denied
+ * request from examining Object keys or sizes.
+ *
+ * S3 returns keys in lexicographical order. The marker is exclusive, so a page
+ * begins after the matching key. If the marker does not identify a stored key,
+ * this simulation retains its existing behavior and starts from the beginning.
+ *
+ * NextMarker is returned only when another page exists and identifies the final
+ * key in the current page.
+ */
+export class ListObjectsPageBuilder {
+    /**
+     * Build one response page from the authorized Bucket listing.
+     */
+    async build(input) {
+        const objects = await input.bucket.listObjects(input.prefix);
+        objects.sort((a, b) => a.key.localeCompare(b.key));
+        const startIndex = input.marker === undefined
+            ? 0
+            : Math.max(0, objects.findIndex((object) => object.key === input.marker) + 1);
+        const page = objects.slice(startIndex, startIndex + input.maxKeys);
+        const lastObject = page.at(-1);
+        const isTruncated = startIndex + page.length < objects.length;
+        return {
+            Contents: page.map((object) => ({
+                Key: object.key,
+                Size: object.body.length,
+            })),
+            Name: input.bucket.bucketName,
+            Prefix: input.prefix,
+            Marker: input.marker,
+            MaxKeys: input.maxKeys,
+            IsTruncated: isTruncated,
+            NextMarker: isTruncated && lastObject !== undefined ? lastObject.key : undefined,
+            $metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=list-objects-page-builder.js.map

package/dist/service/s3/command/list-objects/list-objects-page-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-objects-page-builder.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-objects/list-objects-page-builder.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,sBAAsB;IACjC;;OAEG;IACH,KAAK,CAAC,KAAK,CACT,KAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnD,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CACN,CAAC,EACD,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAC/D,CAAC;QAER,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9D,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;aACzB,CAAC,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,WAAW;YACxB,UAAU,EACR,WAAW,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YACtE,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/list-objects/list-objects.handler.d.ts

@@ -2,10 +2,16 @@ import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { SimListObjectsCommand, SimListObjectsCommandOutput } from "./list-objects.cmd.js";
 import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface ListObjectsCommandHandlerProps {
     readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
+interface ListObjectsCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Simulated S3 ListObjectsCommand handler.
  *
@@ -13,12 +19,18 @@ interface ListObjectsCommandHandlerProps {
  */
 export declare class ListObjectsCommandHandler implements CommandHandler<SimListObjectsCommand, SimListObjectsCommandOutput> {
     private readonly buckets;
+    private readonly authorizer;
+    private readonly pageBuilder;
     private readonly background;
     constructor(props: ListObjectsCommandHandlerProps);
     /**
-     * Simulate listing Objects in an S3 Bucket.
+     * Coordinate validation, Bucket resolution, authorization, and pagination.
+     *
+     * Bucket lookup occurs before authorization so missing Buckets retain their
+     * existing S3 error behavior. Authorization occurs before storage listing so
+     * a denied caller cannot inspect Object keys or sizes.
      */
-    handle(cmd: SimListObjectsCommand): Promise<SimListObjectsCommandOutput>;
+    handle(cmd: SimListObjectsCommand, opts?: ListObjectsCommandHandlerOptions): Promise<SimListObjectsCommandOutput>;
 }
 export {};
 //# sourceMappingURL=list-objects.handler.d.ts.map

package/dist/service/s3/command/list-objects/list-objects.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-objects.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-objects/list-objects.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAEnD,UAAU,8BAA8B;IACtC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,cAAc,CAC9D,qBAAqB,EACrB,2BAA2B,CAC5B;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;gBAErC,KAAK,EAAE,8BAA8B;IAMjD;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,2BAA2B,CAAC;CA2CxC"}
+{"version":3,"file":"list-objects.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-objects/list-objects.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAI1E,UAAU,8BAA8B;IACtC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,cAAc,CAC9D,qBAAqB,EACrB,2BAA2B,CAC5B;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,KAAK,EAAE,8BAA8B,EAUhD;IAED;;;;;;OAMG;IACG,MAAM,CACV,GAAG,EAAE,qBAAqB,EAC1B,IAAI,CAAC,EAAE,gCAAgC,GACtC,OAAO,CAAC,2BAA2B,CAAC,CA0BtC;CACF"}