@kensio/yulin 0.31.0 → 0.33.0

package/dist/service/s3/command/list-objects/list-objects.handler.js

@@ -1,6 +1,9 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { SimS3NoSuchBucket } from "../../error/sim-s3.error.js";
 import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { ListObjectsAuthorizer } from "./list-objects-authorizer.js";
+import { ListObjectsPageBuilder } from "./list-objects-page-builder.js";
 /**
  * Simulated S3 ListObjectsCommand handler.
  *
@@ -8,48 +11,44 @@ import { BackgroundTasks, } from "../../../../util/background/background.js";
  */
 export class ListObjectsCommandHandler {
     buckets;
+    authorizer;
+    pageBuilder = new ListObjectsPageBuilder();
     background;
     constructor(props) {
-        const { buckets, background = new BackgroundTasks() } = props;
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = props;
         this.buckets = buckets;
+        this.authorizer = new ListObjectsAuthorizer({ iam });
         this.background = background;
     }
     /**
-     * Simulate listing Objects in an S3 Bucket.
+     * Coordinate validation, Bucket resolution, authorization, and pagination.
+     *
+     * Bucket lookup occurs before authorization so missing Buckets retain their
+     * existing S3 error behavior. Authorization occurs before storage listing so
+     * a denied caller cannot inspect Object keys or sizes.
      */
-    async handle(cmd) {
+    async handle(cmd, opts) {
         assertDefined(cmd.input.Bucket, "ListObjectsCommand.input.Bucket");
         const bucketName = cmd.input.Bucket;
         const bucket = this.buckets.get(bucketName);
         if (bucket === undefined) {
             throw new SimS3NoSuchBucket(`No S3 Bucket named ${bucketName}`);
         }
-        // Allow for potential non-deterministic sequencing of async events.
+        // Complete request sequencing before authorization and storage access.
         await this.background.sequence();
-        const prefix = cmd.input.Prefix;
-        const marker = cmd.input.Marker;
         const maxKeys = cmd.input.MaxKeys ?? 1000;
-        const objects = await bucket.listObjects(prefix);
-        objects.sort((a, b) => a.key.localeCompare(b.key));
-        const startIndex = marker === undefined
-            ? 0
-            : Math.max(0, objects.findIndex((object) => object.key === marker) + 1);
-        const page = objects.slice(startIndex, startIndex + maxKeys);
-        const lastObject = page.at(-1);
-        const isTruncated = startIndex + page.length < objects.length;
-        return {
-            Contents: page.map((object) => ({
-                Key: object.key,
-                Size: object.body.length,
-            })),
-            Name: bucket.bucketName,
-            Prefix: prefix,
-            Marker: marker,
-            MaxKeys: maxKeys,
-            IsTruncated: isTruncated,
-            NextMarker: isTruncated && lastObject !== undefined ? lastObject.key : undefined,
-            $metadata: {},
-        };
+        this.authorizer.authorize({
+            bucket,
+            prefix: cmd.input.Prefix,
+            maxKeys,
+            caller: opts?.caller,
+        });
+        return await this.pageBuilder.build({
+            bucket,
+            prefix: cmd.input.Prefix,
+            marker: cmd.input.Marker,
+            maxKeys,
+        });
     }
 }
 //# sourceMappingURL=list-objects.handler.js.map

package/dist/service/s3/command/list-objects/list-objects.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-objects.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-objects/list-objects.handler.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAOnD;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAInB,OAAO,CAAoC;IAC3C,UAAU,CAAsB;IAEjD,YAAY,KAAqC;QAC/C,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,KAAK,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAA0B;QAE1B,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;QAEnE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAyB,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;QAE1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnD,MAAM,UAAU,GACd,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9D,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;aACzB,CAAC,CAAC;YACH,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,WAAW;YACxB,UAAU,EACR,WAAW,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YACtE,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"list-objects.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/list-objects/list-objects.handler.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAInB,OAAO,CAAoC;IAC3C,UAAU,CAAwB;IAClC,WAAW,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC3C,UAAU,CAAsB;IAEjD,YAAY,KAAqC;QAC/C,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,GAA0B,EAC1B,IAAuC;QAEvC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;QAEnE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAyB,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,uEAAuE;QACvE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YACxB,MAAM;YACN,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;YACxB,OAAO;YACP,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAC;QAEH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAClC,MAAM;YACN,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;YACxB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;YACxB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy-authorizer.d.ts

@@ -0,0 +1,20 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+interface PutBucketPolicyAuthorizerProps {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to an S3 PutBucketPolicy request.
+ */
+export declare class PutBucketPolicyAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(props: PutBucketPolicyAuthorizerProps);
+    /**
+     * Ensure the caller may replace the Bucket policy.
+     */
+    authorize(bucketName: SimS3BucketName, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=put-bucket-policy-authorizer.d.ts.map

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-bucket-policy-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,UAAU,8BAA8B;IACtC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAEtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,KAAK,EAAE,8BAA8B,EAEhD;IAED;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAelE;CACF"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy-authorizer.js

@@ -0,0 +1,30 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an S3 PutBucketPolicy request.
+ */
+export class PutBucketPolicyAuthorizer {
+    static action = "s3:PutBucketPolicy";
+    iam;
+    constructor(props) {
+        this.iam = props.iam;
+    }
+    /**
+     * Ensure the caller may replace the Bucket policy.
+     */
+    authorize(bucketName, caller) {
+        const resource = `arn:aws:s3:::${bucketName}`;
+        const decision = this.iam.authorize({
+            action: PutBucketPolicyAuthorizer.action,
+            resource,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: PutBucketPolicyAuthorizer.action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=put-bucket-policy-authorizer.js.map

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-bucket-policy-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAOzE;;GAEG;AACH,MAAM,OAAO,yBAAyB;IAC5B,MAAM,CAAU,MAAM,GAAG,oBAAoB,CAAC;IAErC,GAAG,CAA0B;IAE9C,YAAY,KAAqC;QAC/C,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,UAA2B,EAAE,MAAqB;QAC1D,MAAM,QAAQ,GAAG,gBAAgB,UAAU,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,yBAAyB,CAAC,MAAM;YACxC,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,yBAAyB,CAAC,MAAM;gBACxC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.cmd.d.ts

@@ -0,0 +1,21 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim S3 PutBucketPolicy command.
+ */
+export interface SimPutBucketPolicyCommand {
+    readonly input: SimPutBucketPolicyCommandInput;
+}
+/**
+ * Minimal structural sim S3 PutBucketPolicy input.
+ */
+export interface SimPutBucketPolicyCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly Policy?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 PutBucketPolicy output.
+ */
+export interface SimPutBucketPolicyCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=put-bucket-policy.cmd.d.ts.map

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-bucket-policy.cmd.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.cmd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.cmd.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=put-bucket-policy.cmd.js.map

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-bucket-policy.cmd.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.cmd.ts"],"names":[],"mappings":""}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.d.ts

@@ -0,0 +1,30 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimPutBucketPolicyCommand, SimPutBucketPolicyCommandOutput } from "./put-bucket-policy.cmd.js";
+interface PutBucketPolicyCommandHandlerProps {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+interface PutBucketPolicyCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Simulated S3 PutBucketPolicyCommand handler.
+ */
+export declare class PutBucketPolicyCommandHandler implements CommandHandler<SimPutBucketPolicyCommand, SimPutBucketPolicyCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    private readonly policyValidator;
+    constructor(props: PutBucketPolicyCommandHandlerProps);
+    /**
+     * Validate, authorize, and replace a Bucket's resource policy.
+     */
+    handle(cmd: SimPutBucketPolicyCommand, opts?: PutBucketPolicyCommandHandlerOptions): Promise<SimPutBucketPolicyCommandOutput>;
+}
+export {};
+//# sourceMappingURL=put-bucket-policy.handler.d.ts.map

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-bucket-policy.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,4BAA4B,CAAC;AAEpC,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,6BAA8B,YAAW,cAAc,CAClE,yBAAyB,EACzB,+BAA+B,CAChC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;IAEhE,YAAY,KAAK,EAAE,kCAAkC,EAWpD;IAED;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,yBAAyB,EAC9B,IAAI,CAAC,EAAE,oCAAoC,GAC1C,OAAO,CAAC,+BAA+B,CAAC,CAoB1C;CACF"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.js

@@ -0,0 +1,43 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { jsonParse } from "../../../../util/type-guard/json.js";
+import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimIamPolicyDocumentValidator } from "../../../iam/validate/sim-iam-policy-doc-validator.js";
+import { SimS3NoSuchBucket } from "../../error/sim-s3.error.js";
+import { PutBucketPolicyAuthorizer } from "./put-bucket-policy-authorizer.js";
+/**
+ * Simulated S3 PutBucketPolicyCommand handler.
+ */
+export class PutBucketPolicyCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    policyValidator;
+    constructor(props) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = props;
+        this.buckets = buckets;
+        this.authorizer = new PutBucketPolicyAuthorizer({ iam });
+        this.background = background;
+        this.policyValidator = new SimIamPolicyDocumentValidator();
+    }
+    /**
+     * Validate, authorize, and replace a Bucket's resource policy.
+     */
+    async handle(cmd, opts) {
+        assertDefined(cmd.input.Bucket, "PutBucketPolicyCommand.input.Bucket");
+        assertDefined(cmd.input.Policy, "PutBucketPolicyCommand.input.Policy");
+        this.policyValidator.validateRequired(cmd.input.Policy);
+        const bucketName = cmd.input.Bucket;
+        const bucket = this.buckets.get(bucketName);
+        if (bucket === undefined) {
+            throw new SimS3NoSuchBucket(`No S3 Bucket named ${bucketName}`);
+        }
+        await this.background.sequence();
+        this.authorizer.authorize(bucketName, opts?.caller);
+        bucket.configurePolicy(jsonParse(cmd.input.Policy));
+        return {
+            $metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=put-bucket-policy.handler.js.map

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-bucket-policy.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAKtG,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;GAEG;AACH,MAAM,OAAO,6BAA6B;IAIvB,OAAO,CAAoC;IAC3C,UAAU,CAA4B;IACtC,UAAU,CAAsB;IAChC,eAAe,CAAgC;IAEhE,YAAY,KAAyC;QACnD,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAA8B,EAC9B,IAA2C;QAE3C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QACvE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAyB,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpD,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/put-bucket-website/put-bucket-website-authorizer.d.ts

@@ -0,0 +1,37 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+interface PutBucketWebsiteAuthorizerProps {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to an S3 PutBucketWebsite request.
+ *
+ * The command handler owns request validation, Bucket lookup, and website state
+ * changes. This class owns the IAM-specific translation from an S3 Bucket name
+ * to the action and resource IAM evaluates.
+ *
+ * Keeping that translation here prevents authorization details from becoming
+ * mixed with command orchestration. It also provides one place to maintain the
+ * action name, S3 Bucket ARN format, and access-denied error construction.
+ */
+export declare class PutBucketWebsiteAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(props: PutBucketWebsiteAuthorizerProps);
+    /**
+     * Ensure the caller may replace the Bucket's website configuration.
+     *
+     * PutBucketWebsite is authorized against the Bucket ARN rather than an object
+     * ARN because website configuration belongs to the Bucket itself. An omitted
+     * caller is passed through to sim IAM, which applies its Account root fallback.
+     * An explicit anonymous caller remains anonymous and receives the normal
+     * implicit-deny result.
+     *
+     * This method returns only for an allowed decision. A denied decision becomes
+     * the service-shaped access error expected by callers of the S3 simulation.
+     */
+    authorize(bucketName: SimS3BucketName, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=put-bucket-website-authorizer.d.ts.map

package/dist/service/s3/command/put-bucket-website/put-bucket-website-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-bucket-website-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-website/put-bucket-website-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAEvD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,KAAK,EAAE,+BAA+B,EAEjD;IAED;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAelE;CACF"}

package/dist/service/s3/command/put-bucket-website/put-bucket-website-authorizer.js

@@ -0,0 +1,47 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an S3 PutBucketWebsite request.
+ *
+ * The command handler owns request validation, Bucket lookup, and website state
+ * changes. This class owns the IAM-specific translation from an S3 Bucket name
+ * to the action and resource IAM evaluates.
+ *
+ * Keeping that translation here prevents authorization details from becoming
+ * mixed with command orchestration. It also provides one place to maintain the
+ * action name, S3 Bucket ARN format, and access-denied error construction.
+ */
+export class PutBucketWebsiteAuthorizer {
+    static action = "s3:PutBucketWebsite";
+    iam;
+    constructor(props) {
+        this.iam = props.iam;
+    }
+    /**
+     * Ensure the caller may replace the Bucket's website configuration.
+     *
+     * PutBucketWebsite is authorized against the Bucket ARN rather than an object
+     * ARN because website configuration belongs to the Bucket itself. An omitted
+     * caller is passed through to sim IAM, which applies its Account root fallback.
+     * An explicit anonymous caller remains anonymous and receives the normal
+     * implicit-deny result.
+     *
+     * This method returns only for an allowed decision. A denied decision becomes
+     * the service-shaped access error expected by callers of the S3 simulation.
+     */
+    authorize(bucketName, caller) {
+        const resource = `arn:aws:s3:::${bucketName}`;
+        const decision = this.iam.authorize({
+            action: PutBucketWebsiteAuthorizer.action,
+            resource,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: PutBucketWebsiteAuthorizer.action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=put-bucket-website-authorizer.js.map

package/dist/service/s3/command/put-bucket-website/put-bucket-website-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-bucket-website-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-website/put-bucket-website-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAOzE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,0BAA0B;IAC7B,MAAM,CAAU,MAAM,GAAG,qBAAqB,CAAC;IAEtC,GAAG,CAA0B;IAE9C,YAAY,KAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,UAA2B,EAAE,MAAqB;QAC1D,MAAM,QAAQ,GAAG,gBAAgB,UAAU,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,0BAA0B,CAAC,MAAM;YACzC,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,0BAA0B,CAAC,MAAM;gBACzC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/command/put-bucket-website/put-bucket-website.handler.d.ts

@@ -2,10 +2,16 @@ import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { SimPutBucketWebsiteCommand, SimPutBucketWebsiteCommandOutput } from "./put-bucket-website.cmd.js";
 import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface PutBucketWebsiteCommandHandlerProps {
     readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
+interface PutBucketWebsiteCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Simulated S3 PutBucketWebsiteCommand handler.
  *
@@ -13,12 +19,18 @@ interface PutBucketWebsiteCommandHandlerProps {
  */
 export declare class PutBucketWebsiteCommandHandler implements CommandHandler<SimPutBucketWebsiteCommand, SimPutBucketWebsiteCommandOutput> {
     private readonly buckets;
+    private readonly authorizer;
     private readonly background;
     constructor(props: PutBucketWebsiteCommandHandlerProps);
     /**
      * Configure static website hosting for an S3 Bucket.
+     *
+     * Validation and Bucket lookup happen before authorization so malformed
+     * commands and missing Buckets retain their existing S3 error behavior.
+     * Authorization happens before configureWebsite so denied requests cannot
+     * create or replace website state.
      */
-    handle(cmd: SimPutBucketWebsiteCommand): Promise<SimPutBucketWebsiteCommandOutput>;
+    handle(cmd: SimPutBucketWebsiteCommand, opts?: PutBucketWebsiteCommandHandlerOptions): Promise<SimPutBucketWebsiteCommandOutput>;
 }
 export {};
 //# sourceMappingURL=put-bucket-website.handler.d.ts.map

package/dist/service/s3/command/put-bucket-website/put-bucket-website.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"put-bucket-website.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-website/put-bucket-website.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAEnD,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,cAAc,CACnE,0BAA0B,EAC1B,gCAAgC,CACjC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;gBAErC,KAAK,EAAE,mCAAmC;IAMtD;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,0BAA0B,GAC9B,OAAO,CAAC,gCAAgC,CAAC;CA4B7C"}
+{"version":3,"file":"put-bucket-website.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-website/put-bucket-website.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAI1E,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,cAAc,CACnE,0BAA0B,EAC1B,gCAAgC,CACjC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,KAAK,EAAE,mCAAmC,EASrD;IAED;;;;;;;OAOG;IACG,MAAM,CACV,GAAG,EAAE,0BAA0B,EAC/B,IAAI,CAAC,EAAE,qCAAqC,GAC3C,OAAO,CAAC,gCAAgC,CAAC,CA6B3C;CACF"}

package/dist/service/s3/command/put-bucket-website/put-bucket-website.handler.js

@@ -2,6 +2,8 @@ import { SimS3BucketWebsite } from "../../bucket/website/sim-s3-bucket-website.j
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { SimS3NoSuchBucket } from "../../error/sim-s3.error.js";
 import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { SimIam } from "../../../iam/index.js";
+import { PutBucketWebsiteAuthorizer } from "./put-bucket-website-authorizer.js";
 /**
  * Simulated S3 PutBucketWebsiteCommand handler.
  *
@@ -9,16 +11,23 @@ import { BackgroundTasks, } from "../../../../util/background/background.js";
  */
 export class PutBucketWebsiteCommandHandler {
     buckets;
+    authorizer;
     background;
     constructor(props) {
-        const { buckets, background = new BackgroundTasks() } = props;
+        const { buckets, iam = new SimIam(), background = new BackgroundTasks(), } = props;
         this.buckets = buckets;
+        this.authorizer = new PutBucketWebsiteAuthorizer({ iam });
         this.background = background;
     }
     /**
      * Configure static website hosting for an S3 Bucket.
+     *
+     * Validation and Bucket lookup happen before authorization so malformed
+     * commands and missing Buckets retain their existing S3 error behavior.
+     * Authorization happens before configureWebsite so denied requests cannot
+     * create or replace website state.
      */
-    async handle(cmd) {
+    async handle(cmd, opts) {
         assertDefined(cmd.input.Bucket, "PutBucketWebsiteCommand.input.Bucket required");
         assertDefined(cmd.input.WebsiteConfiguration, "PutBucketWebsiteCommand.input.WebsiteConfiguration required");
         const bucketName = cmd.input.Bucket;
@@ -28,6 +37,7 @@ export class PutBucketWebsiteCommandHandler {
         }
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
+        this.authorizer.authorize(bucketName, opts?.caller);
         bucket.configureWebsite(new SimS3BucketWebsite(cmd.input.WebsiteConfiguration));
         return {
             $metadata: {},

package/dist/service/s3/command/put-bucket-website/put-bucket-website.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"put-bucket-website.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-website/put-bucket-website.handler.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAOnD;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAIxB,OAAO,CAAoC;IAC3C,UAAU,CAAsB;IAEjD,YAAY,KAA0C;QACpD,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,KAAK,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAA+B;QAE/B,aAAa,CACX,GAAG,CAAC,KAAK,CAAC,MAAM,EAChB,+CAA+C,CAChD,CAAC;QACF,aAAa,CACX,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAC9B,6DAA6D,CAC9D,CAAC;QAEF,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAyB,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,CAAC,gBAAgB,CACrB,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CACvD,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"put-bucket-website.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-website/put-bucket-website.handler.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAYhF;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAIxB,OAAO,CAAoC;IAC3C,UAAU,CAA6B;IACvC,UAAU,CAAsB;IAEjD,YAAY,KAA0C;QACpD,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,MAAM,EAAE,EAClB,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QACV,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,GAA+B,EAC/B,IAA4C;QAE5C,aAAa,CACX,GAAG,CAAC,KAAK,CAAC,MAAM,EAChB,+CAA+C,CAChD,CAAC;QACF,aAAa,CACX,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAC9B,6DAA6D,CAC9D,CAAC;QAEF,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAyB,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,gBAAgB,CACrB,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CACvD,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/put-object/put-object-authorizer.d.ts

@@ -0,0 +1,24 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+interface PutObjectAuthorizerProps {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to an S3 PutObject request.
+ *
+ * PutObject is authorized against the target Object ARN rather than the Bucket
+ * ARN. An omitted caller is passed through to sim IAM so Account root fallback
+ * behavior remains owned by IAM.
+ */
+export declare class PutObjectAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(props: PutObjectAuthorizerProps);
+    /**
+     * Ensure the caller may create or replace the requested S3 Object.
+     */
+    authorize(bucket: SimS3Bucket, key: string, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=put-object-authorizer.d.ts.map

package/dist/service/s3/command/put-object/put-object-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-object-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-object/put-object-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAkB;IAEhD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,KAAK,EAAE,wBAAwB,EAE1C;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CA0BvE;CACF"}

package/dist/service/s3/command/put-object/put-object-authorizer.js

@@ -0,0 +1,44 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an S3 PutObject request.
+ *
+ * PutObject is authorized against the target Object ARN rather than the Bucket
+ * ARN. An omitted caller is passed through to sim IAM so Account root fallback
+ * behavior remains owned by IAM.
+ */
+export class PutObjectAuthorizer {
+    static action = "s3:PutObject";
+    iam;
+    constructor(props) {
+        this.iam = props.iam;
+    }
+    /**
+     * Ensure the caller may create or replace the requested S3 Object.
+     */
+    authorize(bucket, key, caller) {
+        const resource = `arn:aws:s3:::${bucket.bucketName}/${key}`;
+        const policy = bucket.getPolicy();
+        const decision = this.iam.authorize({
+            action: PutObjectAuthorizer.action,
+            resource,
+            caller,
+            resourcePolicies: policy === undefined
+                ? []
+                : [
+                    {
+                        document: policy,
+                        policyName: "BucketPolicy",
+                        resourceArn: `arn:aws:s3:::${bucket.bucketName}`,
+                    },
+                ],
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: PutObjectAuthorizer.action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=put-object-authorizer.js.map

package/dist/service/s3/command/put-object/put-object-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-object-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-object/put-object-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAOzE;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAU,MAAM,GAAG,cAAc,CAAC;IAE/B,GAAG,CAA0B;IAE9C,YAAY,KAA+B;QACzC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAmB,EAAE,GAAW,EAAE,MAAqB;QAC/D,MAAM,QAAQ,GAAG,gBAAgB,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,mBAAmB,CAAC,MAAM;YAClC,QAAQ;YACR,MAAM;YACN,gBAAgB,EACd,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,QAAQ,EAAE,MAAM;wBAChB,UAAU,EAAE,cAAc;wBAC1B,WAAW,EAAE,gBAAgB,MAAM,CAAC,UAAU,EAAE;qBACjD;iBACF;SACR,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,mBAAmB,CAAC,MAAM;gBAClC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/command/put-object/put-object-builder.d.ts

@@ -0,0 +1,45 @@
+import { SimS3Object } from "../../object/s3-object.js";
+import type { SimPutObjectCommand } from "./put-object.cmd.js";
+/**
+ * Converts the supported PutObject request fields into a stored sim S3 Object.
+ *
+ * The command handler coordinates validation, Bucket lookup, authorization, and
+ * storage. This builder owns the separate translation between the AWS SDK request
+ * representation and the simulation's storage representation. Keeping that
+ * translation here prevents body-format and metadata-normalization rules from
+ * increasing the command handler's control-flow complexity.
+ *
+ * The simulation currently supports the request body forms used by its S3
+ * boundary: strings and Uint8Array values. Node.js Buffer values are also covered
+ * because Buffer extends Uint8Array. Other SDK streaming body forms should be
+ * added here when the simulation gains support for them.
+ */
+export declare class PutObjectBuilder {
+    /**
+     * Build the Object that will be written to Bucket storage.
+     *
+     * This method performs conversion only. Callers must complete request
+     * validation and authorization before invoking it so failed authorization
+     * cannot trigger body processing or lead to storage mutation.
+     */
+    build(cmd: SimPutObjectCommand): SimS3Object;
+    /**
+     * Convert SDK metadata fields to the string map stored by SimS3ObjectMetadata.
+     *
+     * User-defined metadata is retained as supplied. ContentType is represented by
+     * the standard lowercase metadata key used by the existing GetObject response
+     * path. Omitting ContentType leaves that key absent rather than assigning an
+     * undefined value.
+     */
+    private toMetadata;
+    /**
+     * Materialize a supported SDK request body as a Buffer for Bucket storage.
+     *
+     * An omitted body represents an empty S3 Object. Strings use Node.js's default
+     * UTF-8 encoding. Uint8Array input is copied into a Buffer so storage receives
+     * one consistent binary representation and does not depend on the caller's
+     * mutable typed-array instance.
+     */
+    private toBuffer;
+}
+//# sourceMappingURL=put-object-builder.d.ts.map

package/dist/service/s3/command/put-object/put-object-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-object-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-object/put-object-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAuB,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAgB;IAC3B;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,mBAAmB,GAAG,WAAW,CAO3C;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IASlB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ;CAiBjB"}