@kensio/yulin 0.32.0 → 0.34.0

package/dist/service/iam/command/user/create-user/create-user.handler.d.ts

@@ -0,0 +1,26 @@
+import type { CommandHandler } from "../../../../../command/command-handler.js";
+import type { BackgroundScheduler } from "../../../../../util/background/background.js";
+import type { SimAwsAccountId } from "../../../../aws/sim-aws-account.js";
+import type { SimIamUser, SimIamUsername } from "../../../user/sim-iam-user.js";
+import type { SimCreateUserCommand, SimCreateUserCommandOutput } from "./create-user.cmd.js";
+interface CreateUserCommandHandlerProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly users: Map<SimIamUsername, SimIamUser>;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * IAM CreateUser command handler.
+ */
+export declare class CreateUserCommandHandler implements CommandHandler<SimCreateUserCommand, SimCreateUserCommandOutput> {
+    private readonly accountId;
+    private readonly users;
+    private readonly background;
+    private readonly userFactory;
+    constructor(properties: CreateUserCommandHandlerProperties);
+    /**
+     * Handle a Create User Command from the SDK.
+     */
+    handle(command: SimCreateUserCommand): Promise<SimCreateUserCommandOutput>;
+}
+export {};
+//# sourceMappingURL=create-user.handler.d.ts.map

package/dist/service/iam/command/user/create-user/create-user.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-user.handler.d.ts","sourceRoot":"","sources":["../../../../../../src/service/iam/command/user/create-user/create-user.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAG1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAC;AAG9B,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;GAEG;AACH,qBAAa,wBAAyB,YAAW,cAAc,CAC7D,oBAAoB,EACpB,0BAA0B,CAC3B;IACC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D,YAAY,UAAU,EAAE,kCAAkC,EAIzD;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,0BAA0B,CAAC,CAgCrC;CACF"}

package/dist/service/iam/command/user/create-user/create-user.handler.js

@@ -0,0 +1,47 @@
+import { BackgroundTasks } from "../../../../../util/background/background.js";
+import { SimIamEntityAlreadyExists } from "../../../error/sim-iam.error.js";
+import { makeSimUserArn } from "../../../user/arn/sim-iam-user-arn.js";
+import { normaliseUserPath } from "../../../user/sim-iam-user-path.js";
+import { CreateUserRecordFactory } from "./create-user-record-factory.js";
+/**
+ * IAM CreateUser command handler.
+ */
+export class CreateUserCommandHandler {
+    accountId;
+    users;
+    background;
+    userFactory = new CreateUserRecordFactory();
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.users = properties.users;
+        this.background = properties.background ?? new BackgroundTasks();
+    }
+    /**
+     * Handle a Create User Command from the SDK.
+     */
+    async handle(command) {
+        const username = command.input.UserName;
+        if (username === undefined || username.length === 0) {
+            throw new Error("UserName is required");
+        }
+        const path = normaliseUserPath(command.input.Path);
+        const arn = makeSimUserArn({
+            accountId: this.accountId,
+            path,
+            userName: username,
+        });
+        await this.background.sequence();
+        if (this.users.has(username)) {
+            throw new SimIamEntityAlreadyExists(`Sim IAM User already exists: ${username}`);
+        }
+        const user = this.userFactory.makeUser({
+            accountId: this.accountId,
+            arn,
+            path,
+            userName: username,
+        });
+        this.users.set(username, user);
+        return this.userFactory.makeOutput(user);
+    }
+}
+//# sourceMappingURL=create-user.handler.js.map

package/dist/service/iam/command/user/create-user/create-user.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-user.handler.js","sourceRoot":"","sources":["../../../../../../src/service/iam/command/user/create-user/create-user.handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAE/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAKvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ1E;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAIlB,SAAS,CAAkB;IAC3B,KAAK,CAAkC;IACvC,UAAU,CAAsB;IAChC,WAAW,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE7D,YAAY,UAA8C;QACxD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,IAAI,eAAe,EAAE,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA6B;QAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAsC,CAAC;QAEtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI;YACJ,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yBAAyB,CACjC,gCAAgC,QAAQ,EAAE,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG;YACH,IAAI;YACJ,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/B,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/iam/command/user/sim-iam-user-command-handlers.d.ts

@@ -0,0 +1,47 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamActionAuthorizer } from "../../authorize/sim-iam-action-authorizer.js";
+import type { SimIamRequestOptions } from "../sim-iam-request-options.js";
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimIamCredentialRegistry } from "../../credential/sim-iam-credential-registry.js";
+import type { SimIamUserCredentialGenerator } from "../../credential/user/sim-iam-user-credential-generator.js";
+import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
+import type { SimCreateAccessKeyCommand, SimCreateAccessKeyCommandOutput } from "./create-access-key/create-access-key.cmd.js";
+import type { SimCreateUserCommand, SimCreateUserCommandOutput } from "./create-user/create-user.cmd.js";
+interface SimIamUserCommandHandlersProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly users: Map<SimIamUsername, SimIamUser>;
+    readonly credentialRegistry: SimIamCredentialRegistry;
+    readonly credentialGenerator: SimIamUserCredentialGenerator;
+    readonly background: BackgroundScheduler;
+    readonly authorizer: SimIamActionAuthorizer;
+}
+/**
+ * Wires and runs the SDK command handlers that operate on IAM Users.
+ *
+ * Grouping the user command wiring here keeps the SimIam facade a thin
+ * delegator while keeping all user-keyed command handlers in one cohesive
+ * place, mirroring the role command handlers.
+ */
+export declare class SimIamUserCommandHandlers {
+    private readonly accountId;
+    private readonly users;
+    private readonly credentialRegistry;
+    private readonly credentialGenerator;
+    private readonly background;
+    private readonly authorizer;
+    constructor(properties: SimIamUserCommandHandlersProperties);
+    /**
+     * Handle a CreateUser command from the SDK.
+     */
+    createUser(command: SimCreateUserCommand, options?: SimIamRequestOptions): Promise<SimCreateUserCommandOutput>;
+    /**
+     * Handle a CreateAccessKey command from the SDK.
+     */
+    createAccessKey(command: SimCreateAccessKeyCommand, options?: SimIamRequestOptions): Promise<SimCreateAccessKeyCommandOutput>;
+    /**
+     * The User ARN a command operates on, for authorization.
+     */
+    private userArn;
+}
+export {};
+//# sourceMappingURL=sim-iam-user-command-handlers.d.ts.map

package/dist/service/iam/command/user/sim-iam-user-command-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-command-handlers.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/command/user/sim-iam-user-command-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAChH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,kCAAkC,CAAC;AAE1C,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,mBAAmB,EAAE,6BAA6B,CAAC;IAC5D,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IAEpD,YAAY,UAAU,EAAE,mCAAmC,EAgB1D;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAYrC;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAa1C;IAED;;OAEG;IACH,OAAO,CAAC,OAAO;CAGhB"}

package/dist/service/iam/command/user/sim-iam-user-command-handlers.js

@@ -0,0 +1,58 @@
+import { CreateAccessKeyCommandHandler } from "./create-access-key/create-access-key.handler.js";
+import { CreateUserCommandHandler } from "./create-user/create-user.handler.js";
+/**
+ * Wires and runs the SDK command handlers that operate on IAM Users.
+ *
+ * Grouping the user command wiring here keeps the SimIam facade a thin
+ * delegator while keeping all user-keyed command handlers in one cohesive
+ * place, mirroring the role command handlers.
+ */
+export class SimIamUserCommandHandlers {
+    accountId;
+    users;
+    credentialRegistry;
+    credentialGenerator;
+    background;
+    authorizer;
+    constructor(properties) {
+        const { accountId, users, credentialRegistry, credentialGenerator, background, authorizer, } = properties;
+        this.accountId = accountId;
+        this.users = users;
+        this.credentialRegistry = credentialRegistry;
+        this.credentialGenerator = credentialGenerator;
+        this.background = background;
+        this.authorizer = authorizer;
+    }
+    /**
+     * Handle a CreateUser command from the SDK.
+     */
+    async createUser(command, options) {
+        this.authorizer.authorize("iam:CreateUser", this.userArn(command.input.UserName), options?.caller);
+        const handler = new CreateUserCommandHandler({
+            accountId: this.accountId,
+            users: this.users,
+            background: this.background,
+        });
+        return await handler.handle(command);
+    }
+    /**
+     * Handle a CreateAccessKey command from the SDK.
+     */
+    async createAccessKey(command, options) {
+        this.authorizer.authorize("iam:CreateAccessKey", this.userArn(command.input.UserName), options?.caller);
+        const handler = new CreateAccessKeyCommandHandler({
+            users: this.users,
+            credentialRegistry: this.credentialRegistry,
+            credentialGenerator: this.credentialGenerator,
+            background: this.background,
+        });
+        return await handler.handle(command);
+    }
+    /**
+     * The User ARN a command operates on, for authorization.
+     */
+    userArn(username) {
+        return `arn:aws:iam::${this.accountId}:user/${username ?? "*"}`;
+    }
+}
+//# sourceMappingURL=sim-iam-user-command-handlers.js.map

package/dist/service/iam/command/user/sim-iam-user-command-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-command-handlers.js","sourceRoot":"","sources":["../../../../../src/service/iam/command/user/sim-iam-user-command-handlers.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAKjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAehF;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,SAAS,CAAkB;IAC3B,KAAK,CAAkC;IACvC,kBAAkB,CAA2B;IAC7C,mBAAmB,CAAgC;IACnD,UAAU,CAAsB;IAChC,UAAU,CAAyB;IAEpD,YAAY,UAA+C;QACzD,MAAM,EACJ,SAAS,EACT,KAAK,EACL,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,UAAU,GACX,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,IAAI,CAAC,UAAU,CAAC,SAAS,CACvB,gBAAgB,EAChB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EACpC,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;YAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAkC,EAClC,OAA8B;QAE9B,IAAI,CAAC,UAAU,CAAC,SAAS,CACvB,qBAAqB,EACrB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EACpC,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,6BAA6B,CAAC;YAChD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,QAA4B;QAC1C,OAAO,gBAAgB,IAAI,CAAC,SAAS,SAAS,QAAQ,IAAI,GAAG,EAAE,CAAC;IAClE,CAAC;CACF"}

package/dist/service/iam/credential/error/sim-iam-credential.error.d.ts

@@ -0,0 +1,36 @@
+import type { SimIamAccessKeyStatus } from "../sim-iam-access-key.js";
+/**
+ * Base error for simulated IAM credential operations.
+ */
+export declare class SimIamCredentialError extends Error {
+    constructor(message: string);
+}
+export type SimIamInvalidCredentialsReason = "unknown-access-key" | "inactive-access-key" | "secret-access-key-mismatch" | "session-token-missing" | "session-token-unexpected" | "session-token-mismatch" | "expired-session";
+interface SimIamInvalidCredentialsProperties {
+    readonly accessKeyId: string;
+    readonly reason: SimIamInvalidCredentialsReason;
+    readonly accessKeyStatus?: SimIamAccessKeyStatus | undefined;
+    readonly expiration?: Date | undefined;
+}
+/**
+ * Raised when supplied simulated credentials cannot be authenticated.
+ *
+ * Diagnostic details identify the failed credential component without exposing
+ * secret access keys or session tokens.
+ */
+export declare class SimIamInvalidCredentials extends SimIamCredentialError {
+    readonly accessKeyId: string;
+    readonly reason: SimIamInvalidCredentialsReason;
+    readonly accessKeyStatus?: SimIamAccessKeyStatus | undefined;
+    readonly expiration?: Date | undefined;
+    constructor(properties: SimIamInvalidCredentialsProperties);
+    private static message;
+}
+/**
+ * Raised when an access key ID is already registered.
+ */
+export declare class SimIamDuplicateAccessKey extends SimIamCredentialError {
+    constructor(accessKeyId: string);
+}
+export {};
+//# sourceMappingURL=sim-iam-credential.error.d.ts.map

package/dist/service/iam/credential/error/sim-iam-credential.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-credential.error.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/credential/error/sim-iam-credential.error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,MAAM,8BAA8B,GACtC,oBAAoB,GACpB,qBAAqB,GACrB,4BAA4B,GAC5B,uBAAuB,GACvB,0BAA0B,GAC1B,wBAAwB,GACxB,iBAAiB,CAAC;AAEtB,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,qBAAqB;IACjE,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,MAAM,EAAE,8BAA8B,CAAC;IACvD,SAAgB,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpE,SAAgB,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAE9C,YAAY,UAAU,EAAE,kCAAkC,EAUzD;IAED,OAAO,CAAC,MAAM,CAAC,OAAO;CAyCvB;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,qBAAqB;IACjE,YAAY,WAAW,EAAE,MAAM,EAE9B;CACF"}

package/dist/service/iam/credential/error/sim-iam-credential.error.js

@@ -0,0 +1,68 @@
+/**
+ * Base error for simulated IAM credential operations.
+ */
+export class SimIamCredentialError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = new.target.name;
+    }
+}
+/**
+ * Raised when supplied simulated credentials cannot be authenticated.
+ *
+ * Diagnostic details identify the failed credential component without exposing
+ * secret access keys or session tokens.
+ */
+export class SimIamInvalidCredentials extends SimIamCredentialError {
+    accessKeyId;
+    reason;
+    accessKeyStatus;
+    expiration;
+    constructor(properties) {
+        super(SimIamInvalidCredentials.message(properties));
+        this.accessKeyId = properties.accessKeyId;
+        this.reason = properties.reason;
+        this.accessKeyStatus = properties.accessKeyStatus;
+        this.expiration =
+            properties.expiration === undefined
+                ? undefined
+                : new Date(properties.expiration);
+    }
+    static message(properties) {
+        const prefix = `Sim IAM could not authenticate access key ${properties.accessKeyId}`;
+        switch (properties.reason) {
+            case "unknown-access-key": {
+                return `${prefix}: the access key is not registered`;
+            }
+            case "inactive-access-key": {
+                return `${prefix}: the access key is ${properties.accessKeyStatus ?? "inactive"}`;
+            }
+            case "secret-access-key-mismatch": {
+                return `${prefix}: the secret access key does not match`;
+            }
+            case "session-token-missing": {
+                return `${prefix}: a session token is required`;
+            }
+            case "session-token-unexpected": {
+                return `${prefix}: a session token was supplied for a long-lived access key`;
+            }
+            case "session-token-mismatch": {
+                return `${prefix}: the session token does not match`;
+            }
+            case "expired-session": {
+                return `${prefix}: the session expired${properties.expiration === undefined
+                    ? ""
+                    : ` at ${properties.expiration.toISOString()}`}`;
+            }
+        }
+    }
+}
+/**
+ * Raised when an access key ID is already registered.
+ */
+export class SimIamDuplicateAccessKey extends SimIamCredentialError {
+    constructor(accessKeyId) {
+        super(`Sim IAM access key ${accessKeyId} is already registered`);
+    }
+}
+//# sourceMappingURL=sim-iam-credential.error.js.map

package/dist/service/iam/credential/error/sim-iam-credential.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-credential.error.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/error/sim-iam-credential.error.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAkBD;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IACjD,WAAW,CAAS;IACpB,MAAM,CAAiC;IACvC,eAAe,CAAqC;IACpD,UAAU,CAAoB;IAE9C,YAAY,UAA8C;QACxD,KAAK,CAAC,wBAAwB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAEpD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,UAAU;YACb,UAAU,CAAC,UAAU,KAAK,SAAS;gBACjC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAEO,MAAM,CAAC,OAAO,CACpB,UAA8C;QAE9C,MAAM,MAAM,GAAG,6CAA6C,UAAU,CAAC,WAAW,EAAE,CAAC;QAErF,QAAQ,UAAU,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,GAAG,MAAM,oCAAoC,CAAC;YACvD,CAAC;YAED,KAAK,qBAAqB,EAAE,CAAC;gBAC3B,OAAO,GAAG,MAAM,uBACd,UAAU,CAAC,eAAe,IAAI,UAChC,EAAE,CAAC;YACL,CAAC;YAED,KAAK,4BAA4B,EAAE,CAAC;gBAClC,OAAO,GAAG,MAAM,wCAAwC,CAAC;YAC3D,CAAC;YAED,KAAK,uBAAuB,EAAE,CAAC;gBAC7B,OAAO,GAAG,MAAM,+BAA+B,CAAC;YAClD,CAAC;YAED,KAAK,0BAA0B,EAAE,CAAC;gBAChC,OAAO,GAAG,MAAM,4DAA4D,CAAC;YAC/E,CAAC;YAED,KAAK,wBAAwB,EAAE,CAAC;gBAC9B,OAAO,GAAG,MAAM,oCAAoC,CAAC;YACvD,CAAC;YAED,KAAK,iBAAiB,EAAE,CAAC;gBACvB,OAAO,GAAG,MAAM,wBACd,UAAU,CAAC,UAAU,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,EAChD,EAAE,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IACjE,YAAY,WAAmB;QAC7B,KAAK,CAAC,sBAAsB,WAAW,wBAAwB,CAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/service/iam/credential/session/sim-iam-session-manager.d.ts

@@ -0,0 +1,44 @@
+import { SimIamSession } from "./sim-iam-session.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
+import type { SimIamCredentialRegistry } from "../sim-iam-credential-registry.js";
+import type { SimIamSessionCredentialGenerator } from "./sim-iam-session-cred-gen.js";
+import type { SimArnPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCredentials } from "../sim-aws-credentials.js";
+interface SimIamSessionManagerProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
+    readonly credentialRegistry: SimIamCredentialRegistry;
+    readonly credentialGenerator: SimIamSessionCredentialGenerator;
+}
+export interface SimIamCreateRoleSessionInput {
+    readonly roleName: SimIamRoleName;
+    readonly sessionName: string;
+    readonly sourcePrincipal: SimArnPrincipal;
+    readonly createDate: Date;
+    readonly expiration: Date;
+}
+export interface SimIamCreatedRoleSession {
+    readonly credentials: SimAwsCredentials;
+    readonly session: SimIamSession;
+}
+/**
+ * Creates and registers temporary simulated IAM sessions.
+ *
+ * This manager owns the coordination between IAM Roles, temporary credentials,
+ * sessions, and the credential registry.
+ */
+export declare class SimIamSessionManager {
+    private readonly roles;
+    private readonly credentialRegistry;
+    private readonly credentialGenerator;
+    private readonly principalFactory;
+    constructor(properties: SimIamSessionManagerProperties);
+    /**
+     * Create and register a temporary session for an IAM Role.
+     */
+    createRoleSession(input: SimIamCreateRoleSessionInput): SimIamCreatedRoleSession;
+    private role;
+}
+export {};
+//# sourceMappingURL=sim-iam-session-manager.d.ts.map

package/dist/service/iam/credential/session/sim-iam-session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-session-manager.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE,UAAU,8BAA8B;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,mBAAmB,EAAE,gCAAgC,CAAC;CAChE;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAmC;IACvE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoC;IAErE,YAAY,UAAU,EAAE,8BAA8B,EAOrD;IAED;;OAEG;IACH,iBAAiB,CACf,KAAK,EAAE,4BAA4B,GAClC,wBAAwB,CAgC1B;IAED,OAAO,CAAC,IAAI;CAUb"}

package/dist/service/iam/credential/session/sim-iam-session-manager.js

@@ -0,0 +1,62 @@
+import { SimIamSession } from "./sim-iam-session.js";
+import { SimIamAccessKey } from "../sim-iam-access-key.js";
+import { SimIamAssumedRolePrincipalFactory } from "./sim-iam-assumed-role-principal-factory.js";
+/**
+ * Creates and registers temporary simulated IAM sessions.
+ *
+ * This manager owns the coordination between IAM Roles, temporary credentials,
+ * sessions, and the credential registry.
+ */
+export class SimIamSessionManager {
+    roles;
+    credentialRegistry;
+    credentialGenerator;
+    principalFactory;
+    constructor(properties) {
+        this.roles = properties.roles;
+        this.credentialRegistry = properties.credentialRegistry;
+        this.credentialGenerator = properties.credentialGenerator;
+        this.principalFactory = new SimIamAssumedRolePrincipalFactory(properties.accountId);
+    }
+    /**
+     * Create and register a temporary session for an IAM Role.
+     */
+    createRoleSession(input) {
+        const role = this.role(input.roleName);
+        const credentials = this.credentialGenerator.generate();
+        const principal = this.principalFactory.make(role, input.sessionName);
+        const session = new SimIamSession({
+            principal,
+            sourcePrincipal: input.sourcePrincipal,
+            role,
+            sessionName: input.sessionName,
+            sessionToken: credentials.sessionToken,
+            createDate: input.createDate,
+            expiration: input.expiration,
+        });
+        this.credentialRegistry.registerAccessKey(new SimIamAccessKey({
+            accessKeyId: credentials.accessKeyId,
+            secretAccessKey: credentials.secretAccessKey,
+            principal,
+            identityPolicyPrincipal: {
+                kind: "arn",
+                arn: role.arn,
+            },
+            session,
+            createDate: input.createDate,
+        }));
+        return {
+            credentials,
+            session,
+        };
+    }
+    role(roleName) {
+        const role = this.roles.get(roleName);
+        /* v8 ignore if */
+        if (role === undefined) {
+            throw new Error(`Sim IAM Role ${roleName} does not exist`);
+        }
+        return role;
+    }
+}
+//# sourceMappingURL=sim-iam-session-manager.js.map

package/dist/service/iam/credential/session/sim-iam-session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-session-manager.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAOrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAsBhG;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,KAAK,CAA0C;IAC/C,kBAAkB,CAA2B;IAC7C,mBAAmB,CAAmC;IACtD,gBAAgB,CAAoC;IAErE,YAAY,UAA0C;QACpD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,iCAAiC,CAC3D,UAAU,CAAC,SAAS,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,KAAmC;QAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,SAAS;YACT,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,IAAI;YACJ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CACvC,IAAI,eAAe,CAAC;YAClB,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,SAAS;YACT,uBAAuB,EAAE;gBACvB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;aACd;YACD,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CACH,CAAC;QAEF,OAAO;YACL,WAAW;YACX,OAAO;SACR,CAAC;IACJ,CAAC;IAEO,IAAI,CAAC,QAAwB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,kBAAkB;QAClB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,iBAAiB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/iam/credential/session/sim-iam-session.d.ts

@@ -0,0 +1,33 @@
+import type { SimArnPrincipal, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamRole } from "../../role/sim-iam-role.js";
+interface SimIamSessionProperties {
+    readonly principal: SimArnPrincipal;
+    readonly sourcePrincipal: SimAwsPrincipal;
+    readonly role: SimIamRole;
+    readonly sessionName: string;
+    readonly sessionToken: string;
+    readonly createDate: Date;
+    readonly expiration: Date;
+}
+/**
+ * A temporary simulated AWS session.
+ *
+ * A session retains both the assumed-role request principal and the underlying
+ * IAM Role whose identity policies apply to requests made with the session.
+ */
+export declare class SimIamSession {
+    readonly principal: SimArnPrincipal;
+    readonly sourcePrincipal: SimAwsPrincipal;
+    readonly role: SimIamRole;
+    readonly sessionName: string;
+    readonly sessionToken: string;
+    readonly createDate: Date;
+    readonly expiration: Date;
+    constructor(properties: SimIamSessionProperties);
+    /**
+     * Whether this session has expired at the supplied time.
+     */
+    isExpired(now: Date): boolean;
+}
+export {};
+//# sourceMappingURL=sim-iam-session.d.ts.map

package/dist/service/iam/credential/session/sim-iam-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,eAAe,EAAE,eAAe,CAAC;IACjD,SAAgB,IAAI,EAAE,UAAU,CAAC;IACjC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,UAAU,EAAE,IAAI,CAAC;IACjC,SAAgB,UAAU,EAAE,IAAI,CAAC;IAEjC,YAAY,UAAU,EAAE,uBAAuB,EAoB9C;IAED;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE5B;CACF"}

package/dist/service/iam/credential/session/sim-iam-session.js

@@ -0,0 +1,40 @@
+/**
+ * A temporary simulated AWS session.
+ *
+ * A session retains both the assumed-role request principal and the underlying
+ * IAM Role whose identity policies apply to requests made with the session.
+ */
+export class SimIamSession {
+    principal;
+    sourcePrincipal;
+    role;
+    sessionName;
+    sessionToken;
+    createDate;
+    expiration;
+    constructor(properties) {
+        if (properties.sessionName.length === 0) {
+            throw new Error("Sim IAM session name must not be empty");
+        }
+        if (properties.sessionToken.length === 0) {
+            throw new Error("Sim IAM session token must not be empty");
+        }
+        if (properties.expiration.getTime() <= properties.createDate.getTime()) {
+            throw new Error("Sim IAM session expiration must follow its creation");
+        }
+        this.principal = properties.principal;
+        this.sourcePrincipal = properties.sourcePrincipal;
+        this.role = properties.role;
+        this.sessionName = properties.sessionName;
+        this.sessionToken = properties.sessionToken;
+        this.createDate = new Date(properties.createDate);
+        this.expiration = new Date(properties.expiration);
+    }
+    /**
+     * Whether this session has expired at the supplied time.
+     */
+    isExpired(now) {
+        return now.getTime() >= this.expiration.getTime();
+    }
+}
+//# sourceMappingURL=sim-iam-session.js.map

package/dist/service/iam/credential/session/sim-iam-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-session.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACR,SAAS,CAAkB;IAC3B,eAAe,CAAkB;IACjC,IAAI,CAAa;IACjB,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,UAAU,CAAO;IACjB,UAAU,CAAO;IAEjC,YAAY,UAAmC;QAC7C,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAS;QACjB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/service/iam/credential/sim-iam-access-key.d.ts

@@ -0,0 +1,44 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamCredentialIdentity } from "./sim-aws-credentials.js";
+import type { SimIamSession } from "./session/sim-iam-session.js";
+export type SimIamAccessKeyStatus = "Active" | "Inactive";
+interface SimIamAccessKeyProperties {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal?: SimAwsPrincipal | undefined;
+    readonly session?: SimIamSession | undefined;
+    readonly createDate?: Date | undefined;
+    readonly status?: SimIamAccessKeyStatus | undefined;
+}
+/**
+ * A simulated AWS access key associated with an authenticated principal.
+ *
+ * Access keys can represent either long-lived credentials or temporary
+ * credentials backed by a session.
+ */
+export declare class SimIamAccessKey {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal: SimAwsPrincipal;
+    readonly session?: SimIamSession | undefined;
+    readonly createDate: Date;
+    status: SimIamAccessKeyStatus;
+    constructor(properties: SimIamAccessKeyProperties);
+    /**
+     * Whether a secret access key matches this access key.
+     */
+    matchesSecretAccessKey(secretAccessKey: string): boolean;
+    /**
+     * Whether a session token matches this access key's temporary session.
+     */
+    matchesSessionToken(sessionToken: string | undefined): boolean;
+    /**
+     * Return the authenticated identity represented by this access key.
+     */
+    identity(): SimIamCredentialIdentity;
+    private secretsMatch;
+}
+export {};
+//# sourceMappingURL=sim-iam-access-key.d.ts.map

package/dist/service/iam/credential/sim-iam-access-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE1D,UAAU,yBAAyB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,eAAe,EAAE,MAAM,CAAC;IACxC,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,uBAAuB,EAAE,eAAe,CAAC;IACzD,SAAgB,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpD,SAAgB,UAAU,EAAE,IAAI,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAErC,YAAY,UAAU,EAAE,yBAAyB,EAShD;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAEvD;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAM7D;IAED;;OAEG;IACH,QAAQ,IAAI,wBAAwB,CAOnC;IAED,OAAO,CAAC,YAAY;CAMrB"}

package/dist/service/iam/credential/sim-iam-access-key.js

@@ -0,0 +1,57 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+/**
+ * A simulated AWS access key associated with an authenticated principal.
+ *
+ * Access keys can represent either long-lived credentials or temporary
+ * credentials backed by a session.
+ */
+export class SimIamAccessKey {
+    accessKeyId;
+    secretAccessKey;
+    principal;
+    identityPolicyPrincipal;
+    session;
+    createDate;
+    status;
+    constructor(properties) {
+        this.accessKeyId = properties.accessKeyId;
+        this.secretAccessKey = properties.secretAccessKey;
+        this.principal = properties.principal;
+        this.identityPolicyPrincipal =
+            properties.identityPolicyPrincipal ?? properties.principal;
+        this.session = properties.session;
+        this.createDate = new Date(properties.createDate ?? Date.now());
+        this.status = properties.status ?? "Active";
+    }
+    /**
+     * Whether a secret access key matches this access key.
+     */
+    matchesSecretAccessKey(secretAccessKey) {
+        return this.secretsMatch(secretAccessKey, this.secretAccessKey);
+    }
+    /**
+     * Whether a session token matches this access key's temporary session.
+     */
+    matchesSessionToken(sessionToken) {
+        return (this.session !== undefined &&
+            sessionToken !== undefined &&
+            this.secretsMatch(sessionToken, this.session.sessionToken));
+    }
+    /**
+     * Return the authenticated identity represented by this access key.
+     */
+    identity() {
+        return {
+            principal: this.principal,
+            identityPolicyPrincipal: this.identityPolicyPrincipal,
+            role: this.session?.role,
+            session: this.session,
+        };
+    }
+    secretsMatch(actual, expected) {
+        const actualHash = createHash("sha256").update(actual).digest();
+        const expectedHash = createHash("sha256").update(expected).digest();
+        return timingSafeEqual(actualHash, expectedHash);
+    }
+}
+//# sourceMappingURL=sim-iam-access-key.js.map

package/dist/service/iam/credential/sim-iam-access-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB1D;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACV,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,SAAS,CAAkB;IAC3B,uBAAuB,CAAkB;IACzC,OAAO,CAA6B;IACpC,UAAU,CAAO;IAC1B,MAAM,CAAwB;IAErC,YAAY,UAAqC;QAC/C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,uBAAuB;YAC1B,UAAU,CAAC,uBAAuB,IAAI,UAAU,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAuB;QAC5C,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI;YACxB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,QAAgB;QACnD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QAEpE,OAAO,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;CACF"}