@kensio/yulin 0.32.0 → 0.34.0

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sts-assume-role-session-creator.js","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-session-creator.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,8BAA8B;IACxB,WAAW,CAAwB;IAEpD,YAAY,KAAoC;QAC9C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAmC;QACxC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAC9C,KAAK,CAAC,YAAY,CAAC,SAAS,CAC7B,CAAC;QAEF,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC,iBAAiB,CAAC;YAChE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,WAAW,EAAE,KAAK,CAAC,eAAe;YAClC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU;YACV,UAAU;SACX,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE;gBACX,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,WAAW;gBACnD,eAAe,EAAE,cAAc,CAAC,WAAW,CAAC,eAAe;gBAC3D,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,YAAY;gBACrD,UAAU,EAAE,UAAU;aACvB;YACD,eAAe,EAAE;gBACf,aAAa,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE;gBAC9D,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG;aAC1C;YACD,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,UAAgB,EAAE,eAAuB;QAC1D,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts

@@ -0,0 +1,57 @@
+import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
+import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
+import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
+import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
+interface AssumeRoleAuthorizationCoordinatorProps {
+    readonly sourceAccountId: SimAwsAccountId;
+    readonly iamResolver: SimIamAccountResolver;
+}
+interface AssumeRoleAuthorizationInput {
+    readonly roleArn: string;
+    readonly roleArnParts: IamRoleArnParts;
+    readonly caller: SimArnPrincipal;
+    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+}
+type AssumeRoleAuthorizedRole = SimGetRoleCommandOutput["Role"];
+/**
+ * Coordinates source identity authorization and target Role trust authorization
+ * for an STS AssumeRole request.
+ *
+ * AssumeRole normally requires both an identity-policy Allow in the caller's
+ * Account and a matching trust-policy Allow in the target Role's Account.
+ * A directly trusted IAM User in the same Account is an exception: the Role
+ * trust policy can grant that User access without a separate identity-policy
+ * Allow. Matching explicit identity-policy Deny statements still reject the
+ * request.
+ *
+ * The target trust policy is evaluated first because its matching grant must be
+ * classified before the source authorization requirement can be selected.
+ */
+export declare class AssumeRoleAuthorizationCoordinator {
+    private readonly sourceAccountId;
+    private readonly sourcePrincipalAuthorizer;
+    private readonly targetRoleAuthorizer;
+    constructor(props: AssumeRoleAuthorizationCoordinatorProps);
+    /**
+     * Require the applicable source identity and target trust permissions.
+     *
+     * The returned Role has passed target lookup and trust authorization and can
+     * therefore be used to create the assumed-role session.
+     */
+    authorize(input: AssumeRoleAuthorizationInput): Promise<AssumeRoleAuthorizedRole>;
+    /**
+     * Whether the target trust policy is sufficient without an identity Allow.
+     *
+     * All three conditions are required:
+     *
+     * - the caller and target Role belong to the same Account;
+     * - the caller is an IAM User rather than a Role, session, or root principal;
+     * - a matching trust statement grants access directly rather than delegating
+     *   authorization to the caller's Account.
+     */
+    private hasDirectSameAccountUserGrant;
+}
+export {};
+//# sourceMappingURL=assume-role-auth-z-coordinator.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-auth-z-coordinator.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-auth-z-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAIrF,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,KAAK,wBAAwB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,qBAAa,kCAAkC;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAsC;IAChF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IAEtE,YAAY,KAAK,EAAE,uCAAuC,EASzD;IAED;;;;;OAKG;IACG,SAAS,CACb,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAmBnC;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,6BAA6B;CAYtC"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.js

@@ -0,0 +1,68 @@
+import { AssumeRoleSourcePrincipalAuthorizer } from "./assume-role-src-acc-auth-z.js";
+import { AssumeRoleTargetRoleAuthorizer } from "./assume-role-target-auth-z.js";
+/**
+ * Coordinates source identity authorization and target Role trust authorization
+ * for an STS AssumeRole request.
+ *
+ * AssumeRole normally requires both an identity-policy Allow in the caller's
+ * Account and a matching trust-policy Allow in the target Role's Account.
+ * A directly trusted IAM User in the same Account is an exception: the Role
+ * trust policy can grant that User access without a separate identity-policy
+ * Allow. Matching explicit identity-policy Deny statements still reject the
+ * request.
+ *
+ * The target trust policy is evaluated first because its matching grant must be
+ * classified before the source authorization requirement can be selected.
+ */
+export class AssumeRoleAuthorizationCoordinator {
+    sourceAccountId;
+    sourcePrincipalAuthorizer;
+    targetRoleAuthorizer;
+    constructor(props) {
+        this.sourceAccountId = props.sourceAccountId;
+        this.sourcePrincipalAuthorizer = new AssumeRoleSourcePrincipalAuthorizer({
+            sourceAccountId: props.sourceAccountId,
+            iamResolver: props.iamResolver,
+        });
+        this.targetRoleAuthorizer = new AssumeRoleTargetRoleAuthorizer({
+            iamResolver: props.iamResolver,
+        });
+    }
+    /**
+     * Require the applicable source identity and target trust permissions.
+     *
+     * The returned Role has passed target lookup and trust authorization and can
+     * therefore be used to create the assumed-role session.
+     */
+    async authorize(input) {
+        const targetAuthorization = await this.targetRoleAuthorizer.authorize({
+            roleArn: input.roleArn,
+            target: input.roleArnParts,
+            caller: input.caller,
+            conditionContext: input.conditionContext,
+        });
+        this.sourcePrincipalAuthorizer.authorize({
+            roleArn: input.roleArn,
+            callerPrincipal: input.caller,
+            identityPolicyAllowRequired: !this.hasDirectSameAccountUserGrant(input.caller, input.roleArnParts.accountId, targetAuthorization.trust.isDirectPrincipalGrant),
+        });
+        return targetAuthorization.role;
+    }
+    /**
+     * Whether the target trust policy is sufficient without an identity Allow.
+     *
+     * All three conditions are required:
+     *
+     * - the caller and target Role belong to the same Account;
+     * - the caller is an IAM User rather than a Role, session, or root principal;
+     * - a matching trust statement grants access directly rather than delegating
+     *   authorization to the caller's Account.
+     */
+    hasDirectSameAccountUserGrant(caller, targetAccountId, isDirectPrincipalGrant) {
+        return (targetAccountId === this.sourceAccountId &&
+            caller.kind === "arn" &&
+            caller.arn.startsWith(`arn:aws:iam::${this.sourceAccountId}:user/`) &&
+            isDirectPrincipalGrant);
+    }
+}
+//# sourceMappingURL=assume-role-auth-z-coordinator.js.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-auth-z-coordinator.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-auth-z-coordinator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAiBhF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kCAAkC;IAC5B,eAAe,CAAkB;IACjC,yBAAyB,CAAsC;IAC/D,oBAAoB,CAAiC;IAEtE,YAAY,KAA8C;QACxD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,yBAAyB,GAAG,IAAI,mCAAmC,CAAC;YACvE,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,GAAG,IAAI,8BAA8B,CAAC;YAC7D,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACb,KAAmC;QAEnC,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;YACpE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;QAEH,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,MAAM;YAC7B,2BAA2B,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAC9D,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,YAAY,CAAC,SAAS,EAC5B,mBAAmB,CAAC,KAAK,CAAC,sBAAsB,CACjD;SACF,CAAC,CAAC;QAEH,OAAO,mBAAmB,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;;;;;;;;OASG;IACK,6BAA6B,CACnC,MAAuB,EACvB,eAAgC,EAChC,sBAA+B;QAE/B,OAAO,CACL,eAAe,KAAK,IAAI,CAAC,eAAe;YACxC,MAAM,CAAC,IAAI,KAAK,KAAK;YACrB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,IAAI,CAAC,eAAe,QAAQ,CAAC;YACnE,sBAAsB,CACvB,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-src-acc-auth-z.d.ts

@@ -0,0 +1,45 @@
+import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+interface AssumeRoleSourceAccountAuthorizerProps {
+    readonly sourceAccountId: SimAwsAccountId;
+    readonly iamResolver: SimIamAccountResolver;
+}
+export interface AssumeRoleSourceAuthorizationInput {
+    readonly roleArn: string;
+    readonly callerPrincipal?: SimAwsPrincipal | undefined;
+    /**
+     * Whether the caller must have an identity-policy Allow for sts:AssumeRole.
+     *
+     * This is false when a same-account Role trust policy grants permission
+     * directly to an IAM User. Explicit identity-policy denies always apply.
+     */
+    readonly identityPolicyAllowRequired?: boolean | undefined;
+}
+/**
+ * Authorizes the caller's request to assume a role against IAM in the source
+ * Account.
+ *
+ * This class owns only the identity-side authorization performed by the
+ * caller's Account. It resolves that Account's simulated IAM facade and
+ * evaluates `sts:AssumeRole` against the target role ARN. Target-account role
+ * trust authorization is a separate responsibility and must be performed even
+ * when the source and target Account are the same.
+ *
+ * When no caller principal is supplied, Sim IAM applies its normal default
+ * caller behavior for the source Account.
+ */
+export declare class AssumeRoleSourcePrincipalAuthorizer {
+    private readonly sourceAccountId;
+    private readonly iamResolver;
+    constructor(props: AssumeRoleSourceAccountAuthorizerProps);
+    /**
+     * Require the source Account to allow the caller to assume the target role.
+     *
+     * Throws when source IAM is unavailable or its policy decision denies the
+     * request.
+     */
+    authorize(input: AssumeRoleSourceAuthorizationInput): void;
+}
+export {};
+//# sourceMappingURL=assume-role-src-acc-auth-z.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-src-acc-auth-z.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-src-acc-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-src-acc-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAI1E,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAEvD;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,KAAK,EAAE,sCAAsC,EAGxD;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,kCAAkC,GAAG,IAAI,CAsBzD;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-src-acc-auth-z.js

@@ -0,0 +1,48 @@
+import { makeSimAwsAccountRootPrincipal } from "../../aws/caller/sim-aws-account-root-principal.js";
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+/**
+ * Authorizes the caller's request to assume a role against IAM in the source
+ * Account.
+ *
+ * This class owns only the identity-side authorization performed by the
+ * caller's Account. It resolves that Account's simulated IAM facade and
+ * evaluates `sts:AssumeRole` against the target role ARN. Target-account role
+ * trust authorization is a separate responsibility and must be performed even
+ * when the source and target Account are the same.
+ *
+ * When no caller principal is supplied, Sim IAM applies its normal default
+ * caller behavior for the source Account.
+ */
+export class AssumeRoleSourcePrincipalAuthorizer {
+    sourceAccountId;
+    iamResolver;
+    constructor(props) {
+        this.sourceAccountId = props.sourceAccountId;
+        this.iamResolver = props.iamResolver;
+    }
+    /**
+     * Require the source Account to allow the caller to assume the target role.
+     *
+     * Throws when source IAM is unavailable or its policy decision denies the
+     * request.
+     */
+    authorize(input) {
+        const sourceIam = this.iamResolver.iamForAccount(this.sourceAccountId);
+        const callerPrincipal = input.callerPrincipal ??
+            makeSimAwsAccountRootPrincipal(this.sourceAccountId);
+        const decision = sourceIam.authorize({
+            action: "sts:AssumeRole",
+            resource: input.roleArn,
+            caller: callerPrincipal,
+        });
+        if (decision.isExplicitDeny ||
+            (decision.isImplicitDeny && Boolean(input.identityPolicyAllowRequired))) {
+            throw new SimIamAccessDenied({
+                principal: callerPrincipal,
+                action: "sts:AssumeRole",
+                resource: input.roleArn,
+            });
+        }
+    }
+}
+//# sourceMappingURL=assume-role-src-acc-auth-z.js.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-src-acc-auth-z.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-src-acc-auth-z.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-src-acc-auth-z.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAoBtE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mCAAmC;IAC7B,eAAe,CAAkB;IACjC,WAAW,CAAwB;IAEpD,YAAY,KAA6C;QACvD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAyC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACvE,MAAM,eAAe,GACnB,KAAK,CAAC,eAAe;YACrB,8BAA8B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;YACnC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;QAEH,IACE,QAAQ,CAAC,cAAc;YACvB,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-target-auth-z.d.ts

@@ -0,0 +1,48 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
+import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
+import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
+import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
+import { type AssumeRoleTrustPolicyAuthorization } from "./assume-role-trust-policy-authorizer.js";
+interface AssumeRoleTargetRoleAuthorizerProps {
+    readonly iamResolver: SimIamAccountResolver;
+}
+type AssumeRoleTargetRole = SimGetRoleCommandOutput["Role"];
+interface AssumeRoleTargetAuthorizationInput {
+    readonly roleArn: string;
+    readonly target: IamRoleArnParts | SimAwsAccountId;
+    readonly caller: SimAwsPrincipal;
+    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+}
+interface AssumeRoleTargetAuthorization {
+    readonly role: AssumeRoleTargetRole;
+    readonly trust: AssumeRoleTrustPolicyAuthorization;
+}
+/**
+ * Resolves the target of an AssumeRole request and coordinates authorization.
+ *
+ * This class owns the account and Role lookup workflow. Target ARN parsing and
+ * consistency checks belong to `AssumeRoleTargetResolver`, while trust-policy
+ * parsing and evaluation belong to `AssumeRoleTrustPolicyAuthorizer`.
+ *
+ * Separating these steps prevents target lookup rules from becoming coupled to
+ * IAM policy evaluation rules.
+ */
+export declare class AssumeRoleTargetRoleAuthorizer {
+    private readonly iamResolver;
+    private readonly targetResolver;
+    private readonly trustPolicyAuthorizer;
+    constructor(props: AssumeRoleTargetRoleAuthorizerProps);
+    /**
+     * Resolve the requested Role, load it from the target account, and require its
+     * trust policy to allow the caller.
+     *
+     * Resolution happens before IAM lookup so the account and Role name used to load
+     * the resource are guaranteed to agree with the ARN being authorized. The loaded
+     * Role is returned for the session-creation stage after authorization succeeds.
+     */
+    authorize(input: AssumeRoleTargetAuthorizationInput): Promise<AssumeRoleTargetAuthorization>;
+}
+export {};
+//# sourceMappingURL=assume-role-target-auth-z.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-target-auth-z.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-target-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-target-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AACrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EACL,KAAK,kCAAkC,EAExC,MAAM,0CAA0C,CAAC;AAElD,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,KAAK,oBAAoB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAE5D,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,kCAAkC,CAAC;CACpD;AAED;;;;;;;;;GASG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IACjE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CACE;IAExC,YAAY,KAAK,EAAE,mCAAmC,EAErD;IAED;;;;;;;OAOG;IACG,SAAS,CACb,KAAK,EAAE,kCAAkC,GACxC,OAAO,CAAC,6BAA6B,CAAC,CAyBxC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-target-auth-z.js

@@ -0,0 +1,50 @@
+import { AssumeRoleTargetResolver } from "./resolve/assume-role-target-resolver.js";
+import { AssumeRoleTrustPolicyAuthorizer, } from "./assume-role-trust-policy-authorizer.js";
+/**
+ * Resolves the target of an AssumeRole request and coordinates authorization.
+ *
+ * This class owns the account and Role lookup workflow. Target ARN parsing and
+ * consistency checks belong to `AssumeRoleTargetResolver`, while trust-policy
+ * parsing and evaluation belong to `AssumeRoleTrustPolicyAuthorizer`.
+ *
+ * Separating these steps prevents target lookup rules from becoming coupled to
+ * IAM policy evaluation rules.
+ */
+export class AssumeRoleTargetRoleAuthorizer {
+    iamResolver;
+    targetResolver = new AssumeRoleTargetResolver();
+    trustPolicyAuthorizer = new AssumeRoleTrustPolicyAuthorizer();
+    constructor(props) {
+        this.iamResolver = props.iamResolver;
+    }
+    /**
+     * Resolve the requested Role, load it from the target account, and require its
+     * trust policy to allow the caller.
+     *
+     * Resolution happens before IAM lookup so the account and Role name used to load
+     * the resource are guaranteed to agree with the ARN being authorized. The loaded
+     * Role is returned for the session-creation stage after authorization succeeds.
+     */
+    async authorize(input) {
+        const roleArnParts = this.targetResolver.resolve(input.roleArn, input.target);
+        const targetIam = this.iamResolver.iamForAccount(roleArnParts.accountId);
+        const getRoleOutput = await targetIam.getRole({
+            input: {
+                RoleName: roleArnParts.roleName,
+            },
+        });
+        const role = getRoleOutput.Role;
+        const trust = this.trustPolicyAuthorizer.authorize({
+            roleArn: input.roleArn,
+            role,
+            targetIam,
+            caller: input.caller,
+            conditionContext: input.conditionContext,
+        });
+        return {
+            role,
+            trust,
+        };
+    }
+}
+//# sourceMappingURL=assume-role-target-auth-z.js.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-target-auth-z.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-target-auth-z.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-target-auth-z.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAEL,+BAA+B,GAChC,MAAM,0CAA0C,CAAC;AAqBlD;;;;;;;;;GASG;AACH,MAAM,OAAO,8BAA8B;IACxB,WAAW,CAAwB;IACnC,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAChD,qBAAqB,GACpC,IAAI,+BAA+B,EAAE,CAAC;IAExC,YAAY,KAA0C;QACpD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,KAAyC;QAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAC9C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CACb,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE;gBACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;YACjD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI;YACJ,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-trust-grant-classifier.d.ts

@@ -0,0 +1,57 @@
+import type { SimIamPolicyDocumentStatement } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * Classifies matching Role trust-policy grants as direct principal grants or
+ * AWS Account delegation.
+ *
+ * This distinction affects whether an IAM User needs a separate identity-policy
+ * Allow for sts:AssumeRole:
+ *
+ * - a trust statement naming a principal directly grants that principal access;
+ * - a bare Account ID or Account root ARN delegates authorization to that Account,
+ *   so the caller must also have an identity-policy Allow.
+ *
+ * Statements supplied to this class have already matched the caller, action,
+ * resource, and conditions during IAM policy evaluation. This class therefore
+ * examines only the Principal representation that produced the matching grant.
+ */
+export declare class AssumeRoleTrustGrantClassifier {
+    /**
+     * Whether any matching trust-policy statement grants access directly.
+     *
+     * Multiple statements use union semantics. One direct grant is sufficient even
+     * when another matching statement delegates authorization to an Account.
+     */
+    hasDirectPrincipalGrant(statements: readonly SimIamPolicyDocumentStatement[]): boolean;
+    /**
+     * Classify one matching trust-policy Allow statement.
+     *
+     * A matching NotPrincipal statement applies directly to every principal it did
+     * not exclude. A Principal statement is direct when at least one matching AWS
+     * principal value is not an Account delegation form.
+     */
+    private statementGrantsPrincipalDirectly;
+    /**
+     * Normalize the AWS values from each supported Principal representation.
+     *
+     * String and array forms represent AWS principals directly. Principal objects
+     * group values by principal type, so only their AWS entry is relevant when
+     * classifying an ARN-based caller.
+     */
+    private awsPrincipalValues;
+    /**
+     * Distinguish a principal-type object from a readonly principal array.
+     *
+     * Array.isArray alone does not narrow readonly arrays correctly in this union,
+     * so this predicate records the object branch explicitly for TypeScript.
+     */
+    private isPrincipalObject;
+    /**
+     * Recognize the two Principal forms that delegate trust to an AWS Account.
+     *
+     * A bare 12-digit Account ID and its Account root ARN have equivalent
+     * delegation semantics. Other values, including a specific IAM User ARN and
+     * the wildcard principal, are classified as direct grants.
+     */
+    private isAccountDelegation;
+}
+//# sourceMappingURL=assume-role-trust-grant-classifier.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-trust-grant-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-trust-grant-classifier.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-trust-grant-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,6BAA6B,EAC9B,MAAM,oCAAoC,CAAC;AAE5C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,8BAA8B;IACzC;;;;;OAKG;IACH,uBAAuB,CACrB,UAAU,EAAE,SAAS,6BAA6B,EAAE,GACnD,OAAO,CAIT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gCAAgC;IAgBxC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAqB1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-trust-grant-classifier.js

@@ -0,0 +1,85 @@
+/**
+ * Classifies matching Role trust-policy grants as direct principal grants or
+ * AWS Account delegation.
+ *
+ * This distinction affects whether an IAM User needs a separate identity-policy
+ * Allow for sts:AssumeRole:
+ *
+ * - a trust statement naming a principal directly grants that principal access;
+ * - a bare Account ID or Account root ARN delegates authorization to that Account,
+ *   so the caller must also have an identity-policy Allow.
+ *
+ * Statements supplied to this class have already matched the caller, action,
+ * resource, and conditions during IAM policy evaluation. This class therefore
+ * examines only the Principal representation that produced the matching grant.
+ */
+export class AssumeRoleTrustGrantClassifier {
+    /**
+     * Whether any matching trust-policy statement grants access directly.
+     *
+     * Multiple statements use union semantics. One direct grant is sufficient even
+     * when another matching statement delegates authorization to an Account.
+     */
+    hasDirectPrincipalGrant(statements) {
+        return statements.some((statement) => this.statementGrantsPrincipalDirectly(statement));
+    }
+    /**
+     * Classify one matching trust-policy Allow statement.
+     *
+     * A matching NotPrincipal statement applies directly to every principal it did
+     * not exclude. A Principal statement is direct when at least one matching AWS
+     * principal value is not an Account delegation form.
+     */
+    statementGrantsPrincipalDirectly(statement) {
+        if (statement.NotPrincipal !== undefined) {
+            return true;
+        }
+        if (statement.Principal === undefined) {
+            return false;
+        }
+        return this.awsPrincipalValues(statement.Principal).some((principal) => !this.isAccountDelegation(principal));
+    }
+    /**
+     * Normalize the AWS values from each supported Principal representation.
+     *
+     * String and array forms represent AWS principals directly. Principal objects
+     * group values by principal type, so only their AWS entry is relevant when
+     * classifying an ARN-based caller.
+     */
+    awsPrincipalValues(principal) {
+        if (typeof principal === "string") {
+            return [principal];
+        }
+        /* v8 ignore if */
+        if (!this.isPrincipalObject(principal)) {
+            return principal;
+        }
+        const awsPrincipal = principal["AWS"];
+        /* v8 ignore if */
+        if (awsPrincipal === undefined) {
+            return [];
+        }
+        return typeof awsPrincipal === "string" ? [awsPrincipal] : awsPrincipal;
+    }
+    /**
+     * Distinguish a principal-type object from a readonly principal array.
+     *
+     * Array.isArray alone does not narrow readonly arrays correctly in this union,
+     * so this predicate records the object branch explicitly for TypeScript.
+     */
+    isPrincipalObject(principal) {
+        return typeof principal === "object" && !Array.isArray(principal);
+    }
+    /**
+     * Recognize the two Principal forms that delegate trust to an AWS Account.
+     *
+     * A bare 12-digit Account ID and its Account root ARN have equivalent
+     * delegation semantics. Other values, including a specific IAM User ARN and
+     * the wildcard principal, are classified as direct grants.
+     */
+    isAccountDelegation(principal) {
+        return (/^\d{12}$/u.test(principal) ||
+            /^arn:aws:iam::\d{12}:root$/u.test(principal));
+    }
+}
+//# sourceMappingURL=assume-role-trust-grant-classifier.js.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-trust-grant-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-trust-grant-classifier.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-trust-grant-classifier.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,8BAA8B;IACzC;;;;;OAKG;IACH,uBAAuB,CACrB,UAAoD;QAEpD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnC,IAAI,CAAC,gCAAgC,CAAC,SAAS,CAAC,CACjD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gCAAgC,CACtC,SAAwC;QAExC,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CACtD,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CACpD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CACxB,SAAwC;QAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,kBAAkB;QAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CACvB,SAAwC;QAExC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,SAAiB;QAC3C,OAAO,CACL,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC,CAC9C,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-trust-policy-authorizer.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
+import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
+import type { SimIam } from "../../iam/sim-iam.js";
+import type { SimIamPolicyDecision } from "../../iam/authorize/sim-iam-decision.js";
+type AssumeRoleTargetRole = SimGetRoleCommandOutput["Role"];
+interface AssumeRoleTrustPolicyAuthorizationInput {
+    readonly roleArn: string;
+    readonly role: AssumeRoleTargetRole;
+    readonly targetIam: SimIam;
+    readonly caller: SimAwsPrincipal;
+    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+}
+export interface AssumeRoleTrustPolicyAuthorization {
+    readonly decision: SimIamPolicyDecision;
+    readonly isDirectPrincipalGrant: boolean;
+}
+/**
+ * Evaluates an AssumeRole request against a target Role's trust policy.
+ *
+ * Trust policies are resource policies attached to IAM Roles. An AssumeRole
+ * request succeeds only when the policy evaluation produces a trust-policy Allow
+ * and does not produce an explicit Deny.
+ *
+ * Keeping this evaluation separate from target resolution and Role loading makes
+ * the authorization boundary easier to maintain. This class receives an already
+ * loaded Role and the IAM facade for its account, then owns all processing of the
+ * Role's AssumeRolePolicyDocument.
+ */
+export declare class AssumeRoleTrustPolicyAuthorizer {
+    private readonly trustGrantClassifier;
+    /**
+     * Require the target Role's trust policy to allow the supplied caller.
+     *
+     * IAM stores AssumeRolePolicyDocument as JSON text. The document is parsed here,
+     * after checking that it exists, because policy evaluation requires a structured
+     * policy document.
+     *
+     * An explicit Deny always rejects the request. The request is also rejected when
+     * no trust-policy statement grants access, even if no explicit Deny matched.
+     */
+    authorize(input: AssumeRoleTrustPolicyAuthorizationInput): AssumeRoleTrustPolicyAuthorization;
+}
+export {};
+//# sourceMappingURL=assume-role-trust-policy-authorizer.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-trust-policy-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-trust-policy-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-trust-policy-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAE/F,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAGpF,KAAK,oBAAoB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAE5D,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAwC;IAE7E;;;;;;;;;OASG;IACH,SAAS,CACP,KAAK,EAAE,uCAAuC,GAC7C,kCAAkC,CA0CpC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-trust-policy-authorizer.js

@@ -0,0 +1,64 @@
+import { jsonParse } from "../../../util/type-guard/json.js";
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+import { AssumeRoleTrustGrantClassifier } from "./assume-role-trust-grant-classifier.js";
+/**
+ * Evaluates an AssumeRole request against a target Role's trust policy.
+ *
+ * Trust policies are resource policies attached to IAM Roles. An AssumeRole
+ * request succeeds only when the policy evaluation produces a trust-policy Allow
+ * and does not produce an explicit Deny.
+ *
+ * Keeping this evaluation separate from target resolution and Role loading makes
+ * the authorization boundary easier to maintain. This class receives an already
+ * loaded Role and the IAM facade for its account, then owns all processing of the
+ * Role's AssumeRolePolicyDocument.
+ */
+export class AssumeRoleTrustPolicyAuthorizer {
+    trustGrantClassifier = new AssumeRoleTrustGrantClassifier();
+    /**
+     * Require the target Role's trust policy to allow the supplied caller.
+     *
+     * IAM stores AssumeRolePolicyDocument as JSON text. The document is parsed here,
+     * after checking that it exists, because policy evaluation requires a structured
+     * policy document.
+     *
+     * An explicit Deny always rejects the request. The request is also rejected when
+     * no trust-policy statement grants access, even if no explicit Deny matched.
+     */
+    authorize(input) {
+        if (input.role.AssumeRolePolicyDocument === undefined) {
+            throw new SimIamAccessDenied({
+                principal: input.caller,
+                action: "sts:AssumeRole",
+                resource: input.roleArn,
+            });
+        }
+        const trustPolicy = jsonParse(input.role.AssumeRolePolicyDocument);
+        const decision = input.targetIam.authorize({
+            action: "sts:AssumeRole",
+            resource: input.roleArn,
+            caller: input.caller,
+            conditionContext: input.conditionContext,
+            resourcePolicies: [
+                {
+                    sourceType: "trust",
+                    policyName: "AssumeRolePolicyDocument",
+                    resourceArn: input.roleArn,
+                    document: trustPolicy,
+                },
+            ],
+        });
+        if (decision.isDenied || !decision.isAllowedByTrustPolicy) {
+            throw new SimIamAccessDenied({
+                principal: input.caller,
+                action: "sts:AssumeRole",
+                resource: input.roleArn,
+            });
+        }
+        return {
+            decision,
+            isDirectPrincipalGrant: this.trustGrantClassifier.hasDirectPrincipalGrant(decision.trustAllowStatements),
+        };
+    }
+}
+//# sourceMappingURL=assume-role-trust-policy-authorizer.js.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-trust-policy-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-trust-policy-authorizer.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-trust-policy-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAG7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAOtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAkBzF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,+BAA+B;IACzB,oBAAoB,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE7E;;;;;;;;;OASG;IACH,SAAS,CACP,KAA8C;QAE9C,IAAI,KAAK,CAAC,IAAI,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAC3B,KAAK,CAAC,IAAI,CAAC,wBAA4D,CACxE,CAAC;QAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE;gBAChB;oBACE,UAAU,EAAE,OAAO;oBACnB,UAAU,EAAE,0BAA0B;oBACtC,WAAW,EAAE,KAAK,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YAC1D,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,QAAQ;YACR,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CACvE,QAAQ,CAAC,oBAAoB,CAC9B;SACF,CAAC;IACJ,CAAC;CACF"}