@kensio/yulin 0.34.2 → 0.36.0

package/dist/service/iam/request/sim-aws-request-caller.d.ts

@@ -0,0 +1,50 @@
+import type { SimAwsCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * How a request's principal was established.
+ *
+ * This is reported back to the client, because "who does the simulator think
+ * you are" is much less useful without "and why".
+ */
+export type SimAwsRequestAuthMethod = "caller-header" | "sigv4" | "none";
+interface SimAwsRequestCallerProperties {
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal?: SimAwsPrincipal | undefined;
+    readonly authMethod: SimAwsRequestAuthMethod;
+}
+/**
+ * The principal a request into simulated AWS is attributed to.
+ *
+ * An unauthenticated request is anonymous and never the Account root. In
+ * process an omitted caller means "whoever owns this simulation", which is a
+ * convenience; over HTTP the same default would hand administrator rights to
+ * anyone who could reach the port, so the boundary refuses to make that
+ * assumption.
+ *
+ * For an assumed-role session the effective principal is the session while
+ * `identityPolicyPrincipal` is the Role whose policies apply, exactly as
+ * `SimIamCredentialIdentity` distinguishes them.
+ */
+export declare class SimAwsRequestCaller {
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal: SimAwsPrincipal;
+    readonly authMethod: SimAwsRequestAuthMethod;
+    constructor(properties: SimAwsRequestCallerProperties);
+    /**
+     * The caller of a request that carried no identity at all.
+     */
+    static anonymous(): SimAwsRequestCaller;
+    /**
+     * The principal in the form the `x-sim-aws-caller` header accepts.
+     */
+    toHeaderValue(): string;
+    /**
+     * This caller in the form simulated services pass to IAM authorization.
+     *
+     * The identity-policy principal travels with it, so an assumed-role session
+     * is authorized against the Role behind it rather than against a session ARN
+     * that owns no policies.
+     */
+    toCaller(): SimAwsCaller;
+}
+export {};
+//# sourceMappingURL=sim-aws-request-caller.d.ts.map

package/dist/service/iam/request/sim-aws-request-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,oCAAoC,CAAC;AAG5C;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAEzE,UAAU,6BAA6B;IACrC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,uBAAuB,EAAE,eAAe,CAAC;IACzD,SAAgB,UAAU,EAAE,uBAAuB,CAAC;IAEpD,YAAY,UAAU,EAAE,6BAA6B,EAKpD;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,IAAI,mBAAmB,CAKtC;IAED;;OAEG;IACH,aAAa,IAAI,MAAM,CAEtB;IAED;;;;;;OAMG;IACH,QAAQ,IAAI,YAAY,CAMvB;CACF"}

package/dist/service/iam/request/sim-aws-request-caller.js

@@ -0,0 +1,55 @@
+import { simAwsCallerHeaderValue } from "./sim-aws-caller-header.js";
+/**
+ * The principal a request into simulated AWS is attributed to.
+ *
+ * An unauthenticated request is anonymous and never the Account root. In
+ * process an omitted caller means "whoever owns this simulation", which is a
+ * convenience; over HTTP the same default would hand administrator rights to
+ * anyone who could reach the port, so the boundary refuses to make that
+ * assumption.
+ *
+ * For an assumed-role session the effective principal is the session while
+ * `identityPolicyPrincipal` is the Role whose policies apply, exactly as
+ * `SimIamCredentialIdentity` distinguishes them.
+ */
+export class SimAwsRequestCaller {
+    principal;
+    identityPolicyPrincipal;
+    authMethod;
+    constructor(properties) {
+        this.principal = properties.principal;
+        this.identityPolicyPrincipal =
+            properties.identityPolicyPrincipal ?? properties.principal;
+        this.authMethod = properties.authMethod;
+    }
+    /**
+     * The caller of a request that carried no identity at all.
+     */
+    static anonymous() {
+        return new SimAwsRequestCaller({
+            principal: { kind: "anonymous" },
+            authMethod: "none",
+        });
+    }
+    /**
+     * The principal in the form the `x-sim-aws-caller` header accepts.
+     */
+    toHeaderValue() {
+        return simAwsCallerHeaderValue(this.principal);
+    }
+    /**
+     * This caller in the form simulated services pass to IAM authorization.
+     *
+     * The identity-policy principal travels with it, so an assumed-role session
+     * is authorized against the Role behind it rather than against a session ARN
+     * that owns no policies.
+     */
+    toCaller() {
+        return {
+            kind: "resolved",
+            principal: this.principal,
+            identityPolicyPrincipal: this.identityPolicyPrincipal,
+        };
+    }
+}
+//# sourceMappingURL=sim-aws-request-caller.js.map

package/dist/service/iam/request/sim-aws-request-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAgBrE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mBAAmB;IACd,SAAS,CAAkB;IAC3B,uBAAuB,CAAkB;IACzC,UAAU,CAA0B;IAEpD,YAAY,UAAyC;QACnD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,uBAAuB;YAC1B,UAAU,CAAC,uBAAuB,IAAI,UAAU,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAS;QACd,OAAO,IAAI,mBAAmB,CAAC;YAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAChC,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,QAAQ;QACN,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACtD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/role/sim-iam-role.d.ts

@@ -18,7 +18,7 @@ export interface SimIamRole extends SimIamPrincipal {
      */
     readonly assumeRolePolicyDocument?: JSONString<SimIamPolicyDocument> | undefined;
     readonly description?: string | undefined;
-    readonly createDate: Date;
+    readonly creationDate: Date;
     /**
      * Inline identity-based permissions policies stored directly on this role.
      */

package/dist/service/iam/role/sim-iam-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-role.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE7D,MAAM,WAAW,UAAW,SAAQ,eAAe;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAChC,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAE/C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEvE;;OAEG;IACH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1C"}
+{"version":3,"file":"sim-iam-role.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE7D,MAAM,WAAW,UAAW,SAAQ,eAAe;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAChC,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAE/C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEvE;;OAEG;IACH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1C"}

package/dist/service/iam/role/sim-iam-role.factory.js

@@ -21,7 +21,7 @@ export const simIamRoleFactory = new DynamicFactory(() => {
         roleId: makeSimIamRoleId(),
         roleName,
         path,
-        createDate: new Date(),
+        creationDate: new Date(),
         inlinePolicies: new Map(),
         attachedPolicyArns: new Set(),
     };

package/dist/service/iam/role/sim-iam-role.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-role.factory.js","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,cAAc,CAAa,GAAG,EAAE;IACnE,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,iBAAmC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC;IAEjB,OAAO;QACL,GAAG,EAAE,cAAc,CAAC;YAClB,SAAS;YACT,IAAI;YACJ,QAAQ;SACT,CAAC;QACF,SAAS;QACT,aAAa,EAAE,MAAM;QACrB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,gBAAgB,EAAE;QAC1B,QAAQ;QACR,IAAI;QACJ,UAAU,EAAE,IAAI,IAAI,EAAE;QACtB,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,kBAAkB,EAAE,IAAI,GAAG,EAAE;KAC9B,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"sim-iam-role.factory.js","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,cAAc,CAAa,GAAG,EAAE;IACnE,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,iBAAmC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC;IAEjB,OAAO;QACL,GAAG,EAAE,cAAc,CAAC;YAClB,SAAS;YACT,IAAI;YACJ,QAAQ;SACT,CAAC;QACF,SAAS;QACT,aAAa,EAAE,MAAM;QACrB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,gBAAgB,EAAE;QAC1B,QAAQ;QACR,IAAI;QACJ,YAAY,EAAE,IAAI,IAAI,EAAE;QACxB,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,kBAAkB,EAAE,IAAI,GAAG,EAAE;KAC9B,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/service/iam/sigv4/canonical/sigv4-byte-order.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Order strings by their code units, which is what SigV4 means by sorted.
+ *
+ * A locale-aware comparison is not interchangeable here: it treats punctuation
+ * and case as secondary, so it can order `a-b` and `a` the other way round from
+ * the signer and produce a canonical form that never matches.
+ */
+export declare function compareSigV4ByteOrder(a: string, b: string): number;
+//# sourceMappingURL=sigv4-byte-order.d.ts.map

package/dist/service/iam/sigv4/canonical/sigv4-byte-order.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-byte-order.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sigv4-byte-order.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlE"}

package/dist/service/iam/sigv4/canonical/sigv4-byte-order.js

@@ -0,0 +1,14 @@
+/**
+ * Order strings by their code units, which is what SigV4 means by sorted.
+ *
+ * A locale-aware comparison is not interchangeable here: it treats punctuation
+ * and case as secondary, so it can order `a-b` and `a` the other way round from
+ * the signer and produce a canonical form that never matches.
+ */
+export function compareSigV4ByteOrder(a, b) {
+    if (a === b) {
+        return 0;
+    }
+    return a < b ? -1 : 1;
+}
+//# sourceMappingURL=sigv4-byte-order.js.map

package/dist/service/iam/sigv4/canonical/sigv4-byte-order.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-byte-order.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sigv4-byte-order.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Build the canonical headers and signed header list of a signed request.
+ *
+ * Only the headers the signer listed are canonicalized, whatever else the
+ * request carries. Each value is trimmed and its runs of whitespace collapsed,
+ * which is what makes a signature survive the whitespace normalization a proxy
+ * or HTTP client is entitled to apply.
+ */
+export declare class SimIamSigV4CanonicalHeaders {
+    private readonly names;
+    private readonly lines;
+    constructor(headers: Headers, signedHeaderNames: readonly string[], url: URL);
+    /**
+     * The canonical headers block, one `name:value` line per signed header.
+     */
+    toString(): string;
+    /**
+     * The signed header names, in the order they are canonicalized.
+     */
+    signedHeaderList(): string;
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-headers.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-headers.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAE1C,YACE,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,SAAS,MAAM,EAAE,EACpC,GAAG,EAAE,GAAG,EAMT;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,gBAAgB,IAAI,MAAM,CAEzB;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.js

@@ -0,0 +1,48 @@
+import { SimIamSignatureDoesNotMatch } from "../error/sim-iam-sigv4.error.js";
+import { compareSigV4ByteOrder } from "./sigv4-byte-order.js";
+/**
+ * Build the canonical headers and signed header list of a signed request.
+ *
+ * Only the headers the signer listed are canonicalized, whatever else the
+ * request carries. Each value is trimmed and its runs of whitespace collapsed,
+ * which is what makes a signature survive the whitespace normalization a proxy
+ * or HTTP client is entitled to apply.
+ */
+export class SimIamSigV4CanonicalHeaders {
+    names;
+    lines;
+    constructor(headers, signedHeaderNames, url) {
+        this.names = signedHeaderNames.toSorted(compareSigV4ByteOrder);
+        this.lines = this.names.map((name) => `${name}:${canonicalValue(headers, name, url)}`);
+    }
+    /**
+     * The canonical headers block, one `name:value` line per signed header.
+     */
+    toString() {
+        return this.lines.join("\n");
+    }
+    /**
+     * The signed header names, in the order they are canonicalized.
+     */
+    signedHeaderList() {
+        return this.names.join(";");
+    }
+}
+function canonicalValue(headers, name, url) {
+    const value = headers.get(name) ?? impliedValue(name, url);
+    if (value === undefined) {
+        throw new SimIamSignatureDoesNotMatch(`Request does not carry signed header ${name}, so the signature ` +
+            `cannot be reproduced`);
+    }
+    return value.trim().replaceAll(/\s+/g, " ");
+}
+/**
+ * Supply a signed header the request implies rather than carries.
+ *
+ * Host is always signed but is not always readable as a header, since some HTTP
+ * clients own it. The URL the request was made to says the same thing.
+ */
+function impliedValue(name, url) {
+    return name === "host" ? url.host : undefined;
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-headers.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-headers.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACrB,KAAK,CAAoB;IACzB,KAAK,CAAoB;IAE1C,YACE,OAAgB,EAChB,iBAAoC,EACpC,GAAQ;QAER,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CACzB,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,cAAc,CAAC,OAAgB,EAAE,IAAY,EAAE,GAAQ;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAE3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,wCAAwC,IAAI,qBAAqB;YAC/D,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,GAAQ;IAC1C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Build the canonical URI of a signed request.
+ *
+ * The path is normalized, dropping empty and `.` segments and resolving `..`,
+ * and then encoded a second time. The already-encoded path arriving in the
+ * request is the first encoding, which is why a literal `/` in a path segment
+ * and a separator are still distinguishable here.
+ *
+ * S3 is the exception on real AWS: it signs the path singly encoded. Only
+ * doubly encoded services are supported for now, which is every service the
+ * simulator serves.
+ */
+export declare function simIamSigV4CanonicalPath(path: string): string;
+//# sourceMappingURL=sim-iam-sigv4-canonical-path.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-path.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB7D"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.js

@@ -0,0 +1,31 @@
+import { escapeSigV4Uri } from "../sigv4-uri-escape.js";
+/**
+ * Build the canonical URI of a signed request.
+ *
+ * The path is normalized, dropping empty and `.` segments and resolving `..`,
+ * and then encoded a second time. The already-encoded path arriving in the
+ * request is the first encoding, which is why a literal `/` in a path segment
+ * and a separator are still distinguishable here.
+ *
+ * S3 is the exception on real AWS: it signs the path singly encoded. Only
+ * doubly encoded services are supported for now, which is every service the
+ * simulator serves.
+ */
+export function simIamSigV4CanonicalPath(path) {
+    const segments = [];
+    for (const segment of path.split("/")) {
+        if (segment.length === 0 || segment === ".") {
+            continue;
+        }
+        if (segment === "..") {
+            segments.pop();
+            continue;
+        }
+        segments.push(segment);
+    }
+    const leadingSlash = path.startsWith("/") ? "/" : "";
+    const trailingSlash = segments.length > 0 && path.endsWith("/") ? "/" : "";
+    const normalized = `${leadingSlash}${segments.join("/")}${trailingSlash}`;
+    return escapeSigV4Uri(normalized).replaceAll("%2F", "/");
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-path.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-path.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,GAAG,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,EAAE,CAAC;IAE1E,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Build the canonical query string of a signed request.
+ *
+ * Parameters are ordered by their encoded key, and a repeated key's values are
+ * ordered among themselves. Sorting whole `key=value` pairs instead would not
+ * be the same thing: `-` sorts before `=`, so a key such as `a-b` would
+ * overtake a shorter key `a` that it must follow.
+ *
+ * The raw search string is parsed here rather than being handed to
+ * URLSearchParams, which applies form decoding and would read a literal `+` as
+ * a space. A query string is not a form: SigV4 signs `+` as the character it
+ * is, so decoding it to a space would canonicalize a different request from the
+ * one the client signed.
+ *
+ * The signature parameter itself is left out, as it cannot be part of what it
+ * signs. Header-signed requests never carry it, but presigned URLs do.
+ */
+export declare function simIamSigV4CanonicalQuery(search: string): string;
+//# sourceMappingURL=sim-iam-sigv4-canonical-query.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-query.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA6BhE"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.js

@@ -0,0 +1,78 @@
+import { escapeSigV4Uri } from "../sigv4-uri-escape.js";
+import { compareSigV4ByteOrder } from "./sigv4-byte-order.js";
+const signatureParameter = "x-amz-signature";
+/**
+ * Build the canonical query string of a signed request.
+ *
+ * Parameters are ordered by their encoded key, and a repeated key's values are
+ * ordered among themselves. Sorting whole `key=value` pairs instead would not
+ * be the same thing: `-` sorts before `=`, so a key such as `a-b` would
+ * overtake a shorter key `a` that it must follow.
+ *
+ * The raw search string is parsed here rather than being handed to
+ * URLSearchParams, which applies form decoding and would read a literal `+` as
+ * a space. A query string is not a form: SigV4 signs `+` as the character it
+ * is, so decoding it to a space would canonicalize a different request from the
+ * one the client signed.
+ *
+ * The signature parameter itself is left out, as it cannot be part of what it
+ * signs. Header-signed requests never carry it, but presigned URLs do.
+ */
+export function simIamSigV4CanonicalQuery(search) {
+    const pairsByKey = new Map();
+    for (const pair of searchPairs(search)) {
+        const key = decodeQueryPart(pair.key);
+        if (key.toLowerCase() === signatureParameter) {
+            continue;
+        }
+        const encodedKey = escapeSigV4Uri(key);
+        const encoded = `${encodedKey}=${escapeSigV4Uri(decodeQueryPart(pair.value))}`;
+        pairsByKey.set(encodedKey, [
+            ...(pairsByKey.get(encodedKey) ?? []),
+            encoded,
+        ]);
+    }
+    return pairsByKey
+        .keys()
+        .toArray()
+        .toSorted(compareSigV4ByteOrder)
+        .map((encodedKey) => (pairsByKey.get(encodedKey) ?? [])
+        .toSorted(compareSigV4ByteOrder)
+        .join("&"))
+        .join("&");
+}
+/**
+ * Split a raw search string into its key and value parts, still encoded.
+ *
+ * A parameter with no `=` has an empty value, which is how it is canonicalized
+ * too.
+ */
+function searchPairs(search) {
+    const query = search.startsWith("?") ? search.slice(1) : search;
+    const pairs = [];
+    for (const pair of query.split("&")) {
+        if (pair.length === 0) {
+            continue;
+        }
+        const separator = pair.indexOf("=");
+        pairs.push(separator === -1
+            ? { key: pair, value: "" }
+            : { key: pair.slice(0, separator), value: pair.slice(separator + 1) });
+    }
+    return pairs;
+}
+/**
+ * Percent-decode one part of a query string.
+ *
+ * A part that is not validly encoded is used as it arrived: it cannot be
+ * decoded, and the client signed those characters as they are.
+ */
+function decodeQueryPart(part) {
+    try {
+        return decodeURIComponent(part);
+    }
+    catch {
+        return part;
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-query.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-query.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,kBAAkB,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAE/E,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;YACzB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrC,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU;SACd,IAAI,EAAE;SACN,OAAO,EAAE;SACT,QAAQ,CAAC,qBAAqB,CAAC;SAC/B,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAClB,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;SAC/B,QAAQ,CAAC,qBAAqB,CAAC;SAC/B,IAAI,CAAC,GAAG,CAAC,CACb;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAOD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,KAAK,GAAiB,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEpC,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,CAAC,CAAC;YACd,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YAC1B,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts

@@ -0,0 +1,20 @@
+import type { SimIamSigV4SignedRequest } from "../sim-iam-sigv4-signed-request.js";
+/**
+ * The canonical form of a signed request: the exact bytes a signature is made
+ * over.
+ *
+ * Rebuilding this from the request as received, and getting the same signature
+ * out, is the whole of SigV4 verification. Anything the canonical form covers
+ * cannot be altered in transit without detection, and anything it leaves out
+ * can be.
+ */
+export declare class SimIamSigV4CanonicalRequest {
+    private readonly canonicalHeaders;
+    private readonly signedRequest;
+    constructor(signedRequest: SimIamSigV4SignedRequest, signedHeaderNames: readonly string[]);
+    /**
+     * The canonical request string, ready to be hashed into a string to sign.
+     */
+    toString(): string;
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-request.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAMnF;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IAEzD,YACE,aAAa,EAAE,wBAAwB,EACvC,iBAAiB,EAAE,SAAS,MAAM,EAAE,EAQrC;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAWjB;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js

@@ -0,0 +1,36 @@
+import { SimIamSigV4CanonicalHeaders } from "./sim-iam-sigv4-canonical-headers.js";
+import { simIamSigV4CanonicalPath } from "./sim-iam-sigv4-canonical-path.js";
+import { simIamSigV4CanonicalQuery } from "./sim-iam-sigv4-canonical-query.js";
+import { simIamSigV4PayloadHash } from "./sim-iam-sigv4-payload-hash.js";
+/**
+ * The canonical form of a signed request: the exact bytes a signature is made
+ * over.
+ *
+ * Rebuilding this from the request as received, and getting the same signature
+ * out, is the whole of SigV4 verification. Anything the canonical form covers
+ * cannot be altered in transit without detection, and anything it leaves out
+ * can be.
+ */
+export class SimIamSigV4CanonicalRequest {
+    canonicalHeaders;
+    signedRequest;
+    constructor(signedRequest, signedHeaderNames) {
+        this.signedRequest = signedRequest;
+        this.canonicalHeaders = new SimIamSigV4CanonicalHeaders(signedRequest.headers, signedHeaderNames, signedRequest.url);
+    }
+    /**
+     * The canonical request string, ready to be hashed into a string to sign.
+     */
+    toString() {
+        const { method, url, headers, body } = this.signedRequest;
+        return [
+            method.toUpperCase(),
+            simIamSigV4CanonicalPath(url.pathname),
+            simIamSigV4CanonicalQuery(url.search),
+            `${this.canonicalHeaders.toString()}\n`,
+            this.canonicalHeaders.signedHeaderList(),
+            simIamSigV4PayloadHash(headers, body),
+        ].join("\n");
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-request.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-request.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,gBAAgB,CAA8B;IAC9C,aAAa,CAA2B;IAEzD,YACE,aAAuC,EACvC,iBAAoC;QAEpC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,2BAA2B,CACrD,aAAa,CAAC,OAAO,EACrB,iBAAiB,EACjB,aAAa,CAAC,GAAG,CAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAE1D,OAAO;YACL,MAAM,CAAC,WAAW,EAAE;YACpB,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI;YACvC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACxC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.d.ts

@@ -0,0 +1,19 @@
+export declare const simIamSigV4UnsignedPayload = "UNSIGNED-PAYLOAD";
+/**
+ * Work out the payload hash a signed request was signed with, and check the
+ * body it arrived with is the body it claims.
+ *
+ * A signer states the payload hash in `x-amz-content-sha256`, and that header
+ * is itself signed, so the claim cannot be altered without breaking the
+ * signature. The claim still has to be checked against the bytes received:
+ * without that, a signature would cover only the client's assertion about the
+ * body, and the body could be replaced freely.
+ *
+ * `UNSIGNED-PAYLOAD` is the one declaration that deliberately leaves the body
+ * uncovered, and is honoured. Any other non-digest value, including the
+ * streaming markers that chunked uploads use, is refused rather than passed
+ * through: accepting one would mean serving a request whose body nothing had
+ * checked, which is worse than saying the simulator does not support it.
+ */
+export declare function simIamSigV4PayloadHash(headers: Headers, body: Uint8Array | undefined): string;
+//# sourceMappingURL=sim-iam-sigv4-payload-hash.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-payload-hash.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAW7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,UAAU,GAAG,SAAS,GAC3B,MAAM,CA6BR"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.js

@@ -0,0 +1,52 @@
+import { createHash } from "node:crypto";
+import { SimIamSignatureDoesNotMatch } from "../error/sim-iam-sigv4.error.js";
+export const simIamSigV4UnsignedPayload = "UNSIGNED-PAYLOAD";
+const sha256HeaderName = "x-amz-content-sha256";
+const sha256DigestPattern = /^[\da-f]{64}$/i;
+/**
+ * The SHA-256 of an empty body, which SigV4 uses when a request has no body.
+ */
+const emptyBodyHash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/**
+ * Work out the payload hash a signed request was signed with, and check the
+ * body it arrived with is the body it claims.
+ *
+ * A signer states the payload hash in `x-amz-content-sha256`, and that header
+ * is itself signed, so the claim cannot be altered without breaking the
+ * signature. The claim still has to be checked against the bytes received:
+ * without that, a signature would cover only the client's assertion about the
+ * body, and the body could be replaced freely.
+ *
+ * `UNSIGNED-PAYLOAD` is the one declaration that deliberately leaves the body
+ * uncovered, and is honoured. Any other non-digest value, including the
+ * streaming markers that chunked uploads use, is refused rather than passed
+ * through: accepting one would mean serving a request whose body nothing had
+ * checked, which is worse than saying the simulator does not support it.
+ */
+export function simIamSigV4PayloadHash(headers, body) {
+    const declared = headers.get(sha256HeaderName);
+    if (declared === null || declared.length === 0) {
+        return hashOfBody(body);
+    }
+    if (declared === simIamSigV4UnsignedPayload) {
+        return declared;
+    }
+    if (!sha256DigestPattern.test(declared)) {
+        throw new SimIamSignatureDoesNotMatch(`Signed ${sha256HeaderName} header declares ${declared}, which is ` +
+            `neither a SHA-256 digest nor ${simIamSigV4UnsignedPayload}. ` +
+            `Chunked and streaming payload signing is not simulated.`);
+    }
+    const received = hashOfBody(body);
+    if (received !== declared.toLowerCase()) {
+        throw new SimIamSignatureDoesNotMatch(`Request body hashes to ${received}, not the ${declared} its signed ` +
+            `${sha256HeaderName} header declares`);
+    }
+    return declared;
+}
+function hashOfBody(body) {
+    if (body === undefined || body.byteLength === 0) {
+        return emptyBodyHash;
+    }
+    return createHash("sha256").update(body).digest("hex");
+}
+//# sourceMappingURL=sim-iam-sigv4-payload-hash.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-payload-hash.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAE9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;GAEG;AACH,MAAM,aAAa,GACjB,kEAAkE,CAAC;AAErE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,IAA4B;IAE5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE/C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,QAAQ,KAAK,0BAA0B,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,UAAU,gBAAgB,oBAAoB,QAAQ,aAAa;YACjE,gCAAgC,0BAA0B,IAAI;YAC9D,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,0BAA0B,QAAQ,aAAa,QAAQ,cAAc;YACnE,GAAG,gBAAgB,kBAAkB,CACxC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,IAA4B;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}