@kensio/yulin 0.32.0 → 0.33.0

package/dist/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.d.ts

@@ -0,0 +1,16 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
+/**
+ * Base for unqualified IAM string operators.
+ *
+ * Unqualified operators require a scalar request value. Policy values may be a
+ * scalar or an array, with multiple policy values using OR semantics.
+ */
+export declare abstract class SimIamScalarStringConditionOperator implements SimIamConditionOperator {
+    /**
+     * Check whether a given value matches the expected value.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+    protected abstract valueMatches(actual: string, expected: string): boolean;
+}
+//# sourceMappingURL=sim-iam-scalar-string-condition-operator.d.ts.map

package/dist/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-scalar-string-condition-operator.d.ts","sourceRoot":"","sources":["../../../../../../../src/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAGhF;;;;;GAKG;AACH,8BAAsB,mCAAoC,YAAW,uBAAuB;IAC1F;;OAEG;IACH,OAAO,CACL,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAYT;IAED,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5E"}

package/dist/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.js

@@ -0,0 +1,20 @@
+import { simIamStringValues } from "./sim-iam-string-values.js";
+/**
+ * Base for unqualified IAM string operators.
+ *
+ * Unqualified operators require a scalar request value. Policy values may be a
+ * scalar or an array, with multiple policy values using OR semantics.
+ */
+export class SimIamScalarStringConditionOperator {
+    /**
+     * Check whether a given value matches the expected value.
+     */
+    matches(actual, expected) {
+        if (typeof actual !== "string") {
+            return false;
+        }
+        const expectedValues = simIamStringValues(expected);
+        return Boolean(expectedValues?.some((expectedValue) => this.valueMatches(actual, expectedValue)));
+    }
+}
+//# sourceMappingURL=sim-iam-scalar-string-condition-operator.js.map

package/dist/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-scalar-string-condition-operator.js","sourceRoot":"","sources":["../../../../../../../src/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,OAAgB,mCAAmC;IACvD;;OAEG;IACH,OAAO,CACL,MAA4B,EAC5B,QAA8B;QAE9B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAEpD,OAAO,OAAO,CACZ,cAAc,EAAE,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CACrC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CACzC,CACF,CAAC;IACJ,CAAC;CAGF"}

package/dist/service/iam/authorize/match/condition/string/sim-iam-string-values.d.ts

@@ -0,0 +1,8 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+/**
+ * Return a condition value as a string array.
+ *
+ * Non-string values fail validation instead of being coerced.
+ */
+export declare function simIamStringValues(value: SimIamConditionValue): readonly string[] | undefined;
+//# sourceMappingURL=sim-iam-string-values.d.ts.map

package/dist/service/iam/authorize/match/condition/string/sim-iam-string-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-string-values.d.ts","sourceRoot":"","sources":["../../../../../../../src/service/iam/authorize/match/condition/string/sim-iam-string-values.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,GAC1B,SAAS,MAAM,EAAE,GAAG,SAAS,CAY/B"}

package/dist/service/iam/authorize/match/condition/string/sim-iam-string-values.js

@@ -0,0 +1,17 @@
+/**
+ * Return a condition value as a string array.
+ *
+ * Non-string values fail validation instead of being coerced.
+ */
+export function simIamStringValues(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    return value.every((item) => typeof item === "string")
+        ? value
+        : undefined;
+}
+//# sourceMappingURL=sim-iam-string-values.js.map

package/dist/service/iam/authorize/match/condition/string/sim-iam-string-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-string-values.js","sourceRoot":"","sources":["../../../../../../../src/service/iam/authorize/match/condition/string/sim-iam-string-values.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAA2B;IAE3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QACpE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -0,0 +1,59 @@
+import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-doc-parser.js";
+import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+/**
+ * Matches the principal portion of an IAM policy statement.
+ *
+ * Principal matching has different rules depending on the policy source:
+ *
+ * - identity policies must not contain Principal or NotPrincipal;
+ * - resource and trust policies must identify the caller through Principal, or
+ *   exclude the caller through NotPrincipal;
+ * - Principal may be a string, an array, or an object grouped by principal type;
+ * - AWS account IDs and account-root ARNs grant access to authenticated
+ *   principals belonging to the referenced account.
+ *
+ * Keeping these rules in one collaborator prevents statement matching from
+ * mixing principal parsing concerns with Action, Resource, and Condition logic.
+ */
+export declare class SimIamPolicyPrincipalMatcher {
+    private readonly context;
+    constructor(context: SimIamAuthZContext);
+    /**
+     * Check whether the statement's principal constraint applies to the caller.
+     *
+     * Identity policies are associated with their identity by the surrounding
+     * authorization flow, so Principal and NotPrincipal are rejected.
+     *
+     * Resource and trust policies require Principal or NotPrincipal because the
+     * policy must state which callers it applies to.
+     */
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    /**
+     * Check each Principal representation supported by the parsed policy model.
+     *
+     * Arrays use logical OR semantics. Principal objects are evaluated according
+     * to their principal category so AWS values match caller ARNs and account
+     * delegation, while Service values match service principals.
+     */
+    private valueMatches;
+    /**
+     * Compare an AWS principal pattern with the resolved caller.
+     *
+     * The wildcard matches both authenticated and anonymous requests. Other AWS
+     * forms require an ARN-based caller. Account delegation forms compare against
+     * the account ID derived by the caller resolver.
+     */
+    private awsPatternMatches;
+    /**
+     * Compare a service principal pattern with the resolved caller.
+     */
+    private servicePatternMatches;
+    /**
+     * Return the account ID represented by an account delegation principal.
+     *
+     * IAM supports both a bare 12-digit account ID and the corresponding account
+     * root ARN.
+     */
+    private delegatedAccountId;
+}
+//# sourceMappingURL=sim-iam-policy-principal-matcher.d.ts.map

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAiBT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA2BpB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js

@@ -0,0 +1,119 @@
+import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
+/**
+ * Matches the principal portion of an IAM policy statement.
+ *
+ * Principal matching has different rules depending on the policy source:
+ *
+ * - identity policies must not contain Principal or NotPrincipal;
+ * - resource and trust policies must identify the caller through Principal, or
+ *   exclude the caller through NotPrincipal;
+ * - Principal may be a string, an array, or an object grouped by principal type;
+ * - AWS account IDs and account-root ARNs grant access to authenticated
+ *   principals belonging to the referenced account.
+ *
+ * Keeping these rules in one collaborator prevents statement matching from
+ * mixing principal parsing concerns with Action, Resource, and Condition logic.
+ */
+export class SimIamPolicyPrincipalMatcher {
+    context;
+    constructor(context) {
+        this.context = context;
+    }
+    /**
+     * Check whether the statement's principal constraint applies to the caller.
+     *
+     * Identity policies are associated with their identity by the surrounding
+     * authorization flow, so Principal and NotPrincipal are rejected.
+     *
+     * Resource and trust policies require Principal or NotPrincipal because the
+     * policy must state which callers it applies to.
+     */
+    matches(policy, statement) {
+        if (policy.sourceType !== "resource" && policy.sourceType !== "trust") {
+            return (statement.principal === undefined &&
+                statement.notPrincipal === undefined);
+        }
+        if (statement.principal !== undefined) {
+            return this.valueMatches(statement.principal);
+        }
+        if (statement.notPrincipal !== undefined) {
+            return !this.valueMatches(statement.notPrincipal);
+        }
+        return false;
+    }
+    /**
+     * Check each Principal representation supported by the parsed policy model.
+     *
+     * Arrays use logical OR semantics. Principal objects are evaluated according
+     * to their principal category so AWS values match caller ARNs and account
+     * delegation, while Service values match service principals.
+     */
+    valueMatches(principal) {
+        if (typeof principal === "string") {
+            return this.awsPatternMatches(principal);
+        }
+        if (Array.isArray(principal)) {
+            return principal.some((value) => this.awsPatternMatches(value));
+        }
+        return Object.entries(principal).some(([principalType, values]) => {
+            const patterns = typeof values === "string" ? [values] : values;
+            if (principalType === "AWS") {
+                return patterns.some((pattern) => this.awsPatternMatches(pattern));
+            }
+            /* v8 ignore if -- service principals not yet fully supported */
+            if (principalType === "Service") {
+                return patterns.some((pattern) => this.servicePatternMatches(pattern));
+            }
+            return false;
+        });
+    }
+    /**
+     * Compare an AWS principal pattern with the resolved caller.
+     *
+     * The wildcard matches both authenticated and anonymous requests. Other AWS
+     * forms require an ARN-based caller. Account delegation forms compare against
+     * the account ID derived by the caller resolver.
+     */
+    awsPatternMatches(pattern) {
+        if (pattern === "*") {
+            return true;
+        }
+        const caller = this.context.caller;
+        if (caller.arn === undefined) {
+            return false;
+        }
+        const delegatedAccountId = this.delegatedAccountId(pattern);
+        if (delegatedAccountId !== undefined) {
+            return caller.accountId === delegatedAccountId;
+        }
+        return simIamWildcardMatch(pattern, caller.arn, {
+            caseSensitive: true,
+        });
+    }
+    /**
+     * Compare a service principal pattern with the resolved caller.
+     */
+    servicePatternMatches(pattern) {
+        /* v8 ignore next -- service principals not yet fully supported */
+        const service = this.context.caller.service;
+        /* v8 ignore next -- service principals not yet fully supported */
+        return (service !== undefined &&
+            simIamWildcardMatch(pattern, service, {
+                caseSensitive: true,
+            }));
+    }
+    /**
+     * Return the account ID represented by an account delegation principal.
+     *
+     * IAM supports both a bare 12-digit account ID and the corresponding account
+     * root ARN.
+     */
+    delegatedAccountId(pattern) {
+        if (/^\d{12}$/u.test(pattern)) {
+            return pattern;
+        }
+        const match = /^arn:aws:iam::(\d{12}):root$/u.exec(pattern);
+        return match?.[1];
+    }
+}
+//# sourceMappingURL=sim-iam-policy-principal-matcher.js.map

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-principal-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,CACL,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,CACrC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,SAAwC;QAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAC/C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEhE,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;YACrE,CAAC;YAED,gEAAgE;YAChE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,OAAe;QACvC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAC;QACjD,CAAC;QAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE;YAC9C,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,OAAe;QAC3C,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAE5C,kEAAkE;QAClE,OAAO,CACL,OAAO,KAAK,SAAS;YACrB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;gBACpC,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,OAAe;QACxC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts

@@ -7,47 +7,30 @@ import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-doc
  * `SimIamPolicyDecision` can stay focused on policy iteration and final
  * Deny/Allow/ImplicitDeny aggregation.
  *
- * The matcher currently covers the IAM dimensions supported by the simulator:
+ * Principal and NotPrincipal evaluation is delegated to
+ * `SimIamPolicyPrincipalMatcher`, which owns the policy-source rules, supported
+ * Principal shapes, and AWS account delegation forms.
  *
- * - Principal and NotPrincipal for resource policies;
- * - Action and NotAction;
- * - Resource and NotResource.
+ * The matcher coordinates:
  *
- * Conditions are not evaluated yet. A statement with a Condition is treated as
- * non-matching so the simulator does not grant access from a statement whose
- * condition semantics it cannot prove.
+ * - Principal and NotPrincipal;
+ * - Action and NotAction;
+ * - Resource and NotResource;
+ * - supported IAM string conditions.
  */
 export declare class SimIamPolicyStatementMatcher {
     private readonly context;
+    private readonly conditionMatcher;
+    private readonly principalMatcher;
     constructor(context: SimIamAuthZContext);
     /**
      * Check whether a parsed statement applies to the current request.
-     */
-    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
-    /**
-     * Check the principal part of a statement.
-     *
-     * Identity policies do not carry Principal or NotPrincipal because they are
-     * already attached to the caller identity. Resource policies must name the
-     * caller with Principal, or exclude the caller with NotPrincipal.
-     */
-    private principalMatches;
-    /**
-     * Check every Principal shape supported by the parsed policy model.
-     *
-     * IAM allows Principal to be a string, an array, or an object keyed by
-     * principal type. The simulator currently recognizes AWS and Service
-     * principal objects because those are the forms used by supported services.
-     */
-    private principalValueMatches;
-    /**
-     * Match a single principal pattern against the caller ARN.
      *
-     * The wildcard principal `*` matches anonymous and signed requests. Any other
-     * principal pattern requires a caller ARN because there is no stable value to
-     * compare when the request has no caller principal.
+     * Each statement section must match. The short-circuit evaluation also avoids
+     * evaluating later sections after an earlier constraint has rejected the
+     * statement.
      */
-    private principalPatternMatches;
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
     /**
      * Check Action or NotAction against the requested IAM action.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAG5F;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;OAEG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAWT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAsBxB;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IA0B7B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAuBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAsBxB"}
+{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAK5F;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA4B;IAI3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAEhE,YAA6B,OAAO,EAAE,kBAAkB,EAKvD;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAOT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAwBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAuBxB"}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js

@@ -1,4 +1,6 @@
 import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
+import { SimIamPolicyConditionMatcher } from "./condition/sim-iam-policy-condition-matcher.js";
+import { SimIamPolicyPrincipalMatcher } from "./sim-iam-policy-principal-matcher.js";
 /**
  * Matches one parsed IAM policy statement against one authorization request.
  *
@@ -6,94 +8,38 @@ import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
  * `SimIamPolicyDecision` can stay focused on policy iteration and final
  * Deny/Allow/ImplicitDeny aggregation.
  *
- * The matcher currently covers the IAM dimensions supported by the simulator:
+ * Principal and NotPrincipal evaluation is delegated to
+ * `SimIamPolicyPrincipalMatcher`, which owns the policy-source rules, supported
+ * Principal shapes, and AWS account delegation forms.
  *
- * - Principal and NotPrincipal for resource policies;
- * - Action and NotAction;
- * - Resource and NotResource.
+ * The matcher coordinates:
  *
- * Conditions are not evaluated yet. A statement with a Condition is treated as
- * non-matching so the simulator does not grant access from a statement whose
- * condition semantics it cannot prove.
+ * - Principal and NotPrincipal;
+ * - Action and NotAction;
+ * - Resource and NotResource;
+ * - supported IAM string conditions.
  */
 export class SimIamPolicyStatementMatcher {
     context;
+    conditionMatcher;
+    principalMatcher;
     constructor(context) {
         this.context = context;
+        this.conditionMatcher = new SimIamPolicyConditionMatcher(context.conditionContext);
+        this.principalMatcher = new SimIamPolicyPrincipalMatcher(context);
     }
     /**
      * Check whether a parsed statement applies to the current request.
+     *
+     * Each statement section must match. The short-circuit evaluation also avoids
+     * evaluating later sections after an earlier constraint has rejected the
+     * statement.
      */
     matches(policy, statement) {
-        /* v8 ignore if -- policy conditions are TODO */
-        if (statement.condition !== undefined) {
-            return false;
-        }
-        return (this.principalMatches(policy, statement) &&
+        return (this.principalMatcher.matches(policy, statement) &&
             this.actionMatches(statement) &&
-            this.resourceMatches(statement));
-    }
-    /**
-     * Check the principal part of a statement.
-     *
-     * Identity policies do not carry Principal or NotPrincipal because they are
-     * already attached to the caller identity. Resource policies must name the
-     * caller with Principal, or exclude the caller with NotPrincipal.
-     */
-    principalMatches(policy, statement) {
-        if (policy.sourceType !== "resource") {
-            return (statement.principal === undefined &&
-                statement.notPrincipal === undefined);
-        }
-        if (statement.principal !== undefined) {
-            return this.principalValueMatches(statement.principal);
-        }
-        if (statement.notPrincipal !== undefined) {
-            return !this.principalValueMatches(statement.notPrincipal);
-        }
-        return false;
-    }
-    /**
-     * Check every Principal shape supported by the parsed policy model.
-     *
-     * IAM allows Principal to be a string, an array, or an object keyed by
-     * principal type. The simulator currently recognizes AWS and Service
-     * principal objects because those are the forms used by supported services.
-     */
-    principalValueMatches(principal) {
-        if (typeof principal === "string") {
-            return this.principalPatternMatches(principal);
-        }
-        if (Array.isArray(principal)) {
-            return principal.some((value) => this.principalPatternMatches(value));
-        }
-        return Object.entries(principal).some(([principalType, values]) => {
-            if (principalType !== "AWS" && principalType !== "Service") {
-                return false;
-            }
-            if (typeof values === "string") {
-                return this.principalPatternMatches(values);
-            }
-            return values.some((value) => this.principalPatternMatches(value));
-        });
-    }
-    /**
-     * Match a single principal pattern against the caller ARN.
-     *
-     * The wildcard principal `*` matches anonymous and signed requests. Any other
-     * principal pattern requires a caller ARN because there is no stable value to
-     * compare when the request has no caller principal.
-     */
-    principalPatternMatches(pattern) {
-        if (pattern === "*") {
-            return true;
-        }
-        if (this.context.callerPrincipal?.arn === undefined) {
-            return false;
-        }
-        return simIamWildcardMatch(pattern, this.context.callerPrincipal.arn, {
-            caseSensitive: true,
-        });
+            this.resourceMatches(policy, statement) &&
+            this.conditionMatcher.matches(statement.condition));
     }
     /**
      * Check Action or NotAction against the requested IAM action.
@@ -109,7 +55,7 @@ export class SimIamPolicyStatementMatcher {
             }));
         }
         if (statement.notActions !== undefined) {
-            return !statement.notActions.some((pattern) => simIamWildcardMatch(pattern, this.context.action, {
+            return statement.notActions.every((pattern) => !simIamWildcardMatch(pattern, this.context.action, {
                 caseSensitive: false,
             }));
         }
@@ -123,19 +69,18 @@ export class SimIamPolicyStatementMatcher {
      * behavior and prevents policies from matching resources that differ only by
      * case.
      */
-    resourceMatches(statement) {
+    resourceMatches(policy, statement) {
         if (statement.resources !== undefined) {
             return statement.resources.some((pattern) => simIamWildcardMatch(pattern, this.context.resource, {
                 caseSensitive: true,
             }));
         }
         if (statement.notResources !== undefined) {
-            return !statement.notResources.some((pattern) => simIamWildcardMatch(pattern, this.context.resource, {
+            return statement.notResources.every((pattern) => !simIamWildcardMatch(pattern, this.context.resource, {
                 caseSensitive: true,
             }));
         }
-        /* v8 ignore next -- defensive diagnostic error */
-        throw new TypeError("IAM policy statement must define either Resource or NotResource");
+        return policy.sourceType === "trust";
     }
 }
 //# sourceMappingURL=sim-iam-policy-statement-matcher.js.map

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-statement-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;OAEG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,gDAAgD;QAChD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CACL,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC;YACxC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,CACL,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,CACrC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAC3B,SAAwC;QAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAC/C,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CACpC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE;YAChE,IAAI,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAAC,OAAe;QAC7C,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;YACpE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAsC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,SAAsC;QAC5D,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-iam-policy-statement-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,4BAA4B;IAIV,OAAO;IAHnB,gBAAgB,CAA+B;IAC/C,gBAAgB,CAA+B;IAEhE,YAA6B,OAA2B;uBAA3B,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CACtD,OAAO,CAAC,gBAAgB,CACzB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,OAAO,CACL,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CACnD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAsC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,CAC/B,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACjD,aAAa,EAAE,KAAK;aACrB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CACrB,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CACjC,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACnD,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IACvC,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -4,10 +4,14 @@ import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import { type SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
 import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
+import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
 interface SimIamAuthorizerProps {
     readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
     readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
-    readonly defaultCallerPrincipal?: SimAwsPrincipal | undefined;
+    readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
+    readonly defaultCallerPrincipal: SimAwsPrincipal;
+    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
 }
 /**
  * Facade for simulated IAM authorization decisions.

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CAC/D;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,KAAK,EAAE,qBAAqB,EAMvC;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;CACF"}
+{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAEpG,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,EAAE,eAAe,CAAC;IACjD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,KAAK,EAAE,qBAAqB,EAQvC;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -11,7 +11,7 @@ import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 export class SimIamAuthorizer {
     contextBuilder;
     constructor(props) {
-        this.contextBuilder = new SimIamAuthZContextBuilder(props.policies, props.roles, props.defaultCallerPrincipal);
+        this.contextBuilder = new SimIamAuthZContextBuilder(props.policies, props.roles, props.users, props.defaultCallerPrincipal, props.credentialIdentityResolver);
     }
     /**
      * Evaluate an IAM authorization request.

package/dist/service/iam/authorize/sim-iam-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAS7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,KAA4B;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CACjD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAa7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,KAA4B;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CACjD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -1,6 +1,7 @@
 import type { SimIamPolicyDocumentStatement } from "../policy/sim-iam-policy.js";
 import type { SimIamAuthZContext } from "./context/sim-iam-auth-z-context.js";
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-doc-parser.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
 export declare const SimIamPolicyDecisionValue: {
     readonly ExplicitDeny: "ExplicitDeny";
     readonly Allow: "Allow";
@@ -30,7 +31,15 @@ export declare class SimIamPolicyDecision {
     private readonly statementMatcher;
     private readonly explicitDenyStatementRecords;
     private readonly allowStatementRecords;
+    private readonly trustAllowStatementRecords;
     constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
+    /**
+     * Resolved caller against which this authorization decision was evaluated.
+     *
+     * This includes IAM's default account-root caller when the authorization input
+     * omitted a caller.
+     */
+    get caller(): SimAwsResolvedCaller;
     /**
      * Final IAM decision value.
      */
@@ -51,6 +60,12 @@ export declare class SimIamPolicyDecision {
      * Whether the request is denied because no Allow statement matched.
      */
     get isImplicitDeny(): boolean;
+    /**
+     * Whether a matching trust-policy statement explicitly allows the request.
+     *
+     * An identity-policy Allow cannot substitute for the target role's trust.
+     */
+    get isAllowedByTrustPolicy(): boolean;
     /**
      * Matching explicit Deny statements.
      */
@@ -59,6 +74,10 @@ export declare class SimIamPolicyDecision {
      * Matching Allow statements.
      */
     get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements originating from trust policies.
+     */
+    get trustAllowStatements(): readonly SimIamPolicyDocumentStatement[];
     private evaluate;
     private evaluatePolicy;
 }

package/dist/service/iam/authorize/sim-iam-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAGnF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAE7E,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAgBvB"}
+{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAEnF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAExF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAC7E,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CACtC;IAEL,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAoBvB"}