@kensio/yulin 0.35.0 → 0.36.0

package/dist/service/iam/credential/sim-iam-credential-registry.d.ts

@@ -1,5 +1,19 @@
 import type { SimAwsCredentials, SimIamCredentialIdentity } from "./sim-aws-credentials.js";
 import type { SimIamAccessKey } from "./sim-iam-access-key.js";
+import { type SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimIamAccessKeyIndex } from "./sim-iam-signing-credential.js";
+interface SimIamCredentialRegistryProperties {
+    /**
+     * Clock deciding whether a temporary session has expired. Session expiry is
+     * simulated state, so it is judged in simulated time rather than host time.
+     */
+    readonly clock?: SimClock;
+    /**
+     * Simulation-wide index told about every key registered here, so a signed
+     * request naming only an access key id can be traced back to this Account.
+     */
+    readonly accessKeyIndex?: SimIamAccessKeyIndex | undefined;
+}
 /**
  * Stores and authenticates simulated IAM access keys.
  *
@@ -9,6 +23,10 @@ import type { SimIamAccessKey } from "./sim-iam-access-key.js";
  */
 export declare class SimIamCredentialRegistry {
     private readonly accessKeys;
+    private readonly clock;
+    private readonly accessKeyIndex?;
+    private readonly checks;
+    constructor(properties?: SimIamCredentialRegistryProperties);
     /**
      * Register a new simulated access key.
      */
@@ -17,5 +35,15 @@ export declare class SimIamCredentialRegistry {
      * Authenticate credentials and resolve their simulated AWS identity.
      */
     resolveCredentials(credentials: SimAwsCredentials, now?: Date): SimIamCredentialIdentity;
+    /**
+     * Authenticate an access key without a secret to compare.
+     *
+     * A signed request proves possession of the secret by its signature rather
+     * than by presenting it, so everything except the secret is checked here and
+     * the signature settles the rest.
+     */
+    authenticateAccessKey(accessKeyId: string, sessionToken: string | undefined, now?: Date): SimIamAccessKey;
+    private activeAccessKey;
 }
+export {};
 //# sourceMappingURL=sim-iam-credential-registry.d.ts.map

package/dist/service/iam/credential/sim-iam-credential-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-credential-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM/D;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IAEjE;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAMlD;IAED;;OAEG;IACH,kBAAkB,CAChB,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACrB,wBAAwB,CAgE1B;CACF"}
+{"version":3,"file":"sim-iam-credential-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM/D,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,UAAU,kCAAkC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CAC5D;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,YAAY,UAAU,GAAE,kCAAuC,EAG9D;IAED;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAOlD;IAED;;OAEG;IACH,kBAAkB,CAChB,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAuB,GAC3B,wBAAwB,CAc1B;IAED;;;;;;OAMG;IACH,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,GAAE,IAAuB,GAC3B,eAAe,CAOjB;IAED,OAAO,CAAC,eAAe;CAKxB"}

package/dist/service/iam/credential/sim-iam-credential-registry.js

@@ -1,4 +1,6 @@
+import { SimIamAccessKeyChecks } from "./sim-iam-access-key-checks.js";
 import { SimIamDuplicateAccessKey, SimIamInvalidCredentials, } from "./error/sim-iam-credential.error.js";
+import { SimRealClock } from "../../../util/clock/sim-clock.js";
 /**
  * Stores and authenticates simulated IAM access keys.
  *
@@ -8,6 +10,13 @@ import { SimIamDuplicateAccessKey, SimIamInvalidCredentials, } from "./error/sim
  */
 export class SimIamCredentialRegistry {
     accessKeys = new Map();
+    clock;
+    accessKeyIndex;
+    checks = new SimIamAccessKeyChecks();
+    constructor(properties = {}) {
+        this.clock = properties.clock ?? new SimRealClock();
+        this.accessKeyIndex = properties.accessKeyIndex;
+    }
     /**
      * Register a new simulated access key.
      */
@@ -16,60 +25,40 @@ export class SimIamCredentialRegistry {
             throw new SimIamDuplicateAccessKey(accessKey.accessKeyId);
         }
         this.accessKeys.set(accessKey.accessKeyId, accessKey);
+        this.accessKeyIndex?.registerAccessKey(accessKey.accessKeyId);
     }
     /**
      * Authenticate credentials and resolve their simulated AWS identity.
      */
-    resolveCredentials(credentials, now = new Date()) {
-        const accessKey = this.accessKeys.get(credentials.accessKeyId);
-        if (accessKey === undefined) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "unknown-access-key",
-            });
-        }
-        if (accessKey.status !== "Active") {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "inactive-access-key",
-                accessKeyStatus: accessKey.status,
-            });
-        }
+    resolveCredentials(credentials, now = this.clock.now()) {
+        const accessKey = this.activeAccessKey(credentials.accessKeyId);
         if (!accessKey.matchesSecretAccessKey(credentials.secretAccessKey)) {
             throw new SimIamInvalidCredentials({
                 accessKeyId: credentials.accessKeyId,
                 reason: "secret-access-key-mismatch",
             });
         }
-        if (accessKey.session !== undefined &&
-            credentials.sessionToken === undefined) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "session-token-missing",
-            });
-        }
-        if (accessKey.session === undefined &&
-            credentials.sessionToken !== undefined) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "session-token-unexpected",
-            });
-        }
-        if (accessKey.session !== undefined &&
-            !accessKey.matchesSessionToken(credentials.sessionToken)) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "session-token-mismatch",
-            });
-        }
-        if (accessKey.session?.isExpired(now) === true) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "expired-session",
-                expiration: accessKey.session.expiration,
-            });
-        }
+        this.checks.checkSessionToken(accessKey, credentials.sessionToken);
+        this.checks.checkNotExpired(accessKey, now);
         return accessKey.identity();
     }
+    /**
+     * Authenticate an access key without a secret to compare.
+     *
+     * A signed request proves possession of the secret by its signature rather
+     * than by presenting it, so everything except the secret is checked here and
+     * the signature settles the rest.
+     */
+    authenticateAccessKey(accessKeyId, sessionToken, now = this.clock.now()) {
+        const accessKey = this.activeAccessKey(accessKeyId);
+        this.checks.checkSessionToken(accessKey, sessionToken);
+        this.checks.checkNotExpired(accessKey, now);
+        return accessKey;
+    }
+    activeAccessKey(accessKeyId) {
+        return this.checks.activeAccessKey(this.accessKeys.get(accessKeyId), {
+            accessKeyId,
+        });
+    }
 }
 //# sourceMappingURL=sim-iam-credential-registry.js.map

package/dist/service/iam/credential/sim-iam-credential-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-credential-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjE;;OAEG;IACH,iBAAiB,CAAC,SAA0B;QAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,WAA8B,EAC9B,GAAG,GAAS,IAAI,IAAI,EAAE;QAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,qBAAqB;gBAC7B,eAAe,EAAE,SAAS,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,4BAA4B;aACrC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,WAAW,CAAC,YAAY,KAAK,SAAS,EACtC,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,uBAAuB;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,WAAW,CAAC,YAAY,KAAK,SAAS,EACtC,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,0BAA0B;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,CAAC,SAAS,CAAC,mBAAmB,CAAC,WAAW,CAAC,YAAY,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,iBAAiB;gBACzB,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU;aACzC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"sim-iam-credential-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAiB,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAgB/E;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,KAAK,CAAW;IAChB,cAAc,CAAoC;IAClD,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEtD,YAAY,UAAU,GAAuC,EAAE;QAC7D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,SAA0B;QAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,WAA8B,EAC9B,GAAG,GAAS,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,4BAA4B;aACrC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE5C,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB,CACnB,WAAmB,EACnB,YAAgC,EAChC,GAAG,GAAS,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,eAAe,CAAC,WAAmB;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;YACnE,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/credential/sim-iam-signing-credential.d.ts

@@ -0,0 +1,32 @@
+import type { SimIamSigV4CredentialScope } from "../sigv4/sim-iam-sigv4-credential-scope.js";
+import type { SimIamCredentialIdentity } from "./sim-aws-credentials.js";
+/**
+ * Records access keys somewhere beyond one Account's own registry.
+ */
+export interface SimIamAccessKeyIndex {
+    registerAccessKey(accessKeyId: string): void;
+}
+export interface SimIamSigningCredentialInput {
+    readonly accessKeyId: string;
+    readonly sessionToken?: string | undefined;
+    readonly scope: SimIamSigV4CredentialScope;
+    readonly now?: Date | undefined;
+}
+/**
+ * A signing key scoped to one date, Region and service, with the identity it
+ * belongs to.
+ */
+export interface SimIamSigningCredential {
+    readonly signingKey: Buffer;
+    readonly identity: SimIamCredentialIdentity;
+}
+/**
+ * Resolves the signing key an access key would have signed with.
+ *
+ * Implemented by the Account-scoped credential registry, and by the
+ * simulation-wide resolver that finds which Account owns an access key first.
+ */
+export interface SimIamSigningCredentialResolver {
+    signingCredentialFor(input: SimIamSigningCredentialInput): SimIamSigningCredential;
+}
+//# sourceMappingURL=sim-iam-signing-credential.d.ts.map

package/dist/service/iam/credential/sim-iam-signing-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-signing-credential.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-signing-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,oBAAoB,CAClB,KAAK,EAAE,4BAA4B,GAClC,uBAAuB,CAAC;CAC5B"}

package/dist/service/iam/credential/sim-iam-signing-credential.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-signing-credential.js.map

package/dist/service/iam/credential/sim-iam-signing-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-signing-credential.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-signing-credential.ts"],"names":[],"mappings":""}

package/dist/service/iam/index.d.ts

@@ -1,3 +1,9 @@
 export { SimIam } from "./sim-iam.js";
 export type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
+export type { SimIamCredentialIdentity } from "./credential/sim-aws-credentials.js";
+export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, type SimIamSigV4ErrorCode, } from "./sigv4/error/sim-iam-sigv4.error.js";
+export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-scope.js";
+export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
+export { type SimAwsRequestAuthMethod, SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
+export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, type SimAwsRequestAuthFailure, } from "./request/error/sim-aws-request-auth.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/index.js

@@ -1,2 +1,6 @@
 export { SimIam } from "./sim-iam.js";
+export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, } from "./sigv4/error/sim-iam-sigv4.error.js";
+export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
+export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
+export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, } from "./request/error/sim-aws-request-auth.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/registry/sim-iam-access-key-registry.d.ts

@@ -0,0 +1,39 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+/**
+ * Simulation-wide index of which Account owns an access key.
+ *
+ * IAM state is Account-scoped, but a signed request names only an access key
+ * id: nothing in a signature says which Account to ask. This index supplies
+ * that missing hop, as the Function URL registry does for URL ids.
+ *
+ * It indexes access keys but does not own them. The owning Account's credential
+ * registry remains the only thing that can authenticate one.
+ */
+export declare class SimIamAccessKeyRegistry {
+    private readonly accountIdByAccessKeyId;
+    /**
+     * Record which Account an access key belongs to.
+     */
+    registerAccessKey(accessKeyId: string, accountId: SimAwsAccountId): void;
+    /**
+     * Find the Account that owns an access key, if any Account does.
+     */
+    accountIdForAccessKey(accessKeyId: string): SimAwsAccountId | undefined;
+}
+/**
+ * Records access keys registered by one Account's credential registry.
+ *
+ * The credential registry knows nothing about Accounts, so the Account it
+ * belongs to is bound here instead of being threaded through every caller that
+ * registers a key.
+ */
+export declare class SimIamAccountAccessKeyIndex {
+    private readonly registry;
+    private readonly accountId;
+    constructor(registry: SimIamAccessKeyRegistry, accountId: SimAwsAccountId);
+    /**
+     * Record an access key as belonging to this index's Account.
+     */
+    registerAccessKey(accessKeyId: string): void;
+}
+//# sourceMappingURL=sim-iam-access-key-registry.d.ts.map

package/dist/service/iam/registry/sim-iam-access-key-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-access-key-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAsC;IAE7E;;OAEG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,IAAI,CAEvE;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEtE;CACF;AAED;;;;;;GAMG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAE5C,YAAY,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,eAAe,EAGxE;IAED;;OAEG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAE3C;CACF"}

package/dist/service/iam/registry/sim-iam-access-key-registry.js

@@ -0,0 +1,47 @@
+/**
+ * Simulation-wide index of which Account owns an access key.
+ *
+ * IAM state is Account-scoped, but a signed request names only an access key
+ * id: nothing in a signature says which Account to ask. This index supplies
+ * that missing hop, as the Function URL registry does for URL ids.
+ *
+ * It indexes access keys but does not own them. The owning Account's credential
+ * registry remains the only thing that can authenticate one.
+ */
+export class SimIamAccessKeyRegistry {
+    accountIdByAccessKeyId = new Map();
+    /**
+     * Record which Account an access key belongs to.
+     */
+    registerAccessKey(accessKeyId, accountId) {
+        this.accountIdByAccessKeyId.set(accessKeyId, accountId);
+    }
+    /**
+     * Find the Account that owns an access key, if any Account does.
+     */
+    accountIdForAccessKey(accessKeyId) {
+        return this.accountIdByAccessKeyId.get(accessKeyId);
+    }
+}
+/**
+ * Records access keys registered by one Account's credential registry.
+ *
+ * The credential registry knows nothing about Accounts, so the Account it
+ * belongs to is bound here instead of being threaded through every caller that
+ * registers a key.
+ */
+export class SimIamAccountAccessKeyIndex {
+    registry;
+    accountId;
+    constructor(registry, accountId) {
+        this.registry = registry;
+        this.accountId = accountId;
+    }
+    /**
+     * Record an access key as belonging to this index's Account.
+     */
+    registerAccessKey(accessKeyId) {
+        this.registry.registerAccessKey(accessKeyId, this.accountId);
+    }
+}
+//# sourceMappingURL=sim-iam-access-key-registry.js.map

package/dist/service/iam/registry/sim-iam-access-key-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-access-key-registry.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7E;;OAEG;IACH,iBAAiB,CAAC,WAAmB,EAAE,SAA0B;QAC/D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAmB;QACvC,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACrB,QAAQ,CAA0B;IAClC,SAAS,CAAkB;IAE5C,YAAY,QAAiC,EAAE,SAA0B;QACvE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,WAAmB;QACnC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/dist/service/iam/registry/sim-iam-global-credential-resolver.d.ts

@@ -0,0 +1,25 @@
+import type { SimIamSigningCredential, SimIamSigningCredentialInput, SimIamSigningCredentialResolver } from "../credential/sim-iam-signing-credential.js";
+import type { SimIamAccessKeyRegistry } from "./sim-iam-access-key-registry.js";
+import type { SimIamAccountResolver } from "./sim-iam-account-resolver.js";
+interface SimIamGlobalCredentialResolverProperties {
+    readonly accessKeys: SimIamAccessKeyRegistry;
+    readonly iam: SimIamAccountResolver;
+}
+/**
+ * Resolves signing credentials across every Account in one simulation.
+ *
+ * A signed request identifies an access key but not an Account, so the owning
+ * Account is looked up first and its own credential registry does the
+ * authenticating. Authority stays with the Account that issued the key.
+ */
+export declare class SimIamGlobalCredentialResolver implements SimIamSigningCredentialResolver {
+    private readonly accessKeys;
+    private readonly iam;
+    constructor(properties: SimIamGlobalCredentialResolverProperties);
+    /**
+     * Authenticate an access key belonging to any Account in this simulation.
+     */
+    signingCredentialFor(input: SimIamSigningCredentialInput): SimIamSigningCredential;
+}
+export {};
+//# sourceMappingURL=sim-iam-global-credential-resolver.d.ts.map

package/dist/service/iam/registry/sim-iam-global-credential-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-global-credential-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-global-credential-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,UAAU,wCAAwC;IAChD,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,qBAAa,8BAA+B,YAAW,+BAA+B;IACpF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAE5C,YAAY,UAAU,EAAE,wCAAwC,EAG/D;IAED;;OAEG;IACH,oBAAoB,CAClB,KAAK,EAAE,4BAA4B,GAClC,uBAAuB,CAazB;CACF"}

package/dist/service/iam/registry/sim-iam-global-credential-resolver.js

@@ -0,0 +1,31 @@
+import { SimIamInvalidCredentials } from "../credential/error/sim-iam-credential.error.js";
+import { SimIamAccountSigningCredentials } from "../credential/sim-iam-account-signing-credentials.js";
+/**
+ * Resolves signing credentials across every Account in one simulation.
+ *
+ * A signed request identifies an access key but not an Account, so the owning
+ * Account is looked up first and its own credential registry does the
+ * authenticating. Authority stays with the Account that issued the key.
+ */
+export class SimIamGlobalCredentialResolver {
+    accessKeys;
+    iam;
+    constructor(properties) {
+        this.accessKeys = properties.accessKeys;
+        this.iam = properties.iam;
+    }
+    /**
+     * Authenticate an access key belonging to any Account in this simulation.
+     */
+    signingCredentialFor(input) {
+        const accountId = this.accessKeys.accountIdForAccessKey(input.accessKeyId);
+        if (accountId === undefined) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: input.accessKeyId,
+                reason: "unknown-access-key",
+            });
+        }
+        return new SimIamAccountSigningCredentials(this.iam.iamForAccount(accountId).credentials).signingCredentialFor(input);
+    }
+}
+//# sourceMappingURL=sim-iam-global-credential-resolver.js.map

package/dist/service/iam/registry/sim-iam-global-credential-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-global-credential-resolver.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-global-credential-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AAcvG;;;;;;GAMG;AACH,MAAM,OAAO,8BAA8B;IACxB,UAAU,CAA0B;IACpC,GAAG,CAAwB;IAE5C,YAAY,UAAoD;QAC9D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAClB,KAAmC;QAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAE3E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,+BAA+B,CACxC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,WAAW,CAC9C,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/service/iam/request/error/sim-aws-request-auth.error.d.ts

@@ -0,0 +1,27 @@
+import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
+/**
+ * Raised when the `x-sim-aws-caller` header does not name a principal the
+ * simulator understands.
+ *
+ * This is a simulator control header rather than anything real AWS defines, so
+ * a bad value is the caller's mistake in using Yulin, not a failed AWS
+ * authentication. Saying exactly what the grammar is beats silently falling
+ * back to anonymous and leaving a test wondering why its principal vanished.
+ */
+export declare class SimAwsInvalidCallerHeader extends Error {
+    readonly code = "InvalidRequestCaller";
+    constructor(message: string);
+}
+/**
+ * Every way a request can fail to be attributed to a principal.
+ *
+ * A rejected signature and an unusable caller header are both authentication
+ * failures at the same boundary, so whoever turns one into an HTTP response
+ * handles them together.
+ */
+export type SimAwsRequestAuthFailure = SimIamSigV4Error | SimAwsInvalidCallerHeader;
+/**
+ * Whether an error is a request authentication failure.
+ */
+export declare function isSimAwsRequestAuthFailure(error: unknown): error is SimAwsRequestAuthFailure;
+//# sourceMappingURL=sim-aws-request-auth.error.d.ts.map

package/dist/service/iam/request/error/sim-aws-request-auth.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-auth.error.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/request/error/sim-aws-request-auth.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE5E;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAgB,IAAI,0BAA0B;IAE9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAClC,gBAAgB,GAAG,yBAAyB,CAAC;AAE/C;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,wBAAwB,CAKnC"}

package/dist/service/iam/request/error/sim-aws-request-auth.error.js

@@ -0,0 +1,25 @@
+import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
+/**
+ * Raised when the `x-sim-aws-caller` header does not name a principal the
+ * simulator understands.
+ *
+ * This is a simulator control header rather than anything real AWS defines, so
+ * a bad value is the caller's mistake in using Yulin, not a failed AWS
+ * authentication. Saying exactly what the grammar is beats silently falling
+ * back to anonymous and leaving a test wondering why its principal vanished.
+ */
+export class SimAwsInvalidCallerHeader extends Error {
+    code = "InvalidRequestCaller";
+    constructor(message) {
+        super(message);
+        this.name = new.target.name;
+    }
+}
+/**
+ * Whether an error is a request authentication failure.
+ */
+export function isSimAwsRequestAuthFailure(error) {
+    return (error instanceof SimIamSigV4Error ||
+        error instanceof SimAwsInvalidCallerHeader);
+}
+//# sourceMappingURL=sim-aws-request-auth.error.js.map

package/dist/service/iam/request/error/sim-aws-request-auth.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-auth.error.js","sourceRoot":"","sources":["../../../../../src/service/iam/request/error/sim-aws-request-auth.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClC,IAAI,GAAG,sBAAsB,CAAC;IAE9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAYD;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,gBAAgB;QACjC,KAAK,YAAY,yBAAyB,CAC3C,CAAC;AACJ,CAAC"}

package/dist/service/iam/request/sim-aws-caller-header.d.ts

@@ -0,0 +1,28 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * The header naming the principal a request into simulated AWS is made by.
+ *
+ * The same name is used on the way back out, as the simulator's own statement
+ * of who it decided the caller was.
+ *
+ * This is the convenience path for local development and for tooling that will
+ * not sign requests: a curl one-liner can be a Role without holding any
+ * credentials. It is deliberately always enabled and not configurable, because
+ * a simulator whose auth boundary can be half-configured is a simulator whose
+ * tests do not mean what they look like.
+ */
+export declare const simAwsCallerHeaderName = "x-sim-aws-caller";
+/**
+ * Read a caller header value as the principal it names.
+ *
+ * No existence check is made on an ARN, matching how `runAs` already behaves:
+ * naming a principal is not the same as proving it exists, and IAM
+ * authorization will simply find no policies for a principal nothing created.
+ */
+export declare function simAwsCallerHeaderPrincipal(value: string): SimAwsPrincipal;
+/**
+ * Write a principal in the form this header accepts, so what the simulator
+ * reports back can be sent straight back in.
+ */
+export declare function simAwsCallerHeaderValue(principal: SimAwsPrincipal): string;
+//# sourceMappingURL=sim-aws-caller-header.d.ts.map

package/dist/service/iam/request/sim-aws-caller-header.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-caller-header.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-caller-header.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAG1E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAMzD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAmB1E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAY1E"}

package/dist/service/iam/request/sim-aws-caller-header.js

@@ -0,0 +1,62 @@
+import { SimAwsInvalidCallerHeader } from "./error/sim-aws-request-auth.error.js";
+/**
+ * The header naming the principal a request into simulated AWS is made by.
+ *
+ * The same name is used on the way back out, as the simulator's own statement
+ * of who it decided the caller was.
+ *
+ * This is the convenience path for local development and for tooling that will
+ * not sign requests: a curl one-liner can be a Role without holding any
+ * credentials. It is deliberately always enabled and not configurable, because
+ * a simulator whose auth boundary can be half-configured is a simulator whose
+ * tests do not mean what they look like.
+ */
+export const simAwsCallerHeaderName = "x-sim-aws-caller";
+const anonymousValue = "anonymous";
+const servicePrefix = "service:";
+const arnPrefix = "arn:";
+/**
+ * Read a caller header value as the principal it names.
+ *
+ * No existence check is made on an ARN, matching how `runAs` already behaves:
+ * naming a principal is not the same as proving it exists, and IAM
+ * authorization will simply find no policies for a principal nothing created.
+ */
+export function simAwsCallerHeaderPrincipal(value) {
+    const trimmed = value.trim();
+    if (trimmed === anonymousValue) {
+        return { kind: "anonymous" };
+    }
+    if (trimmed.startsWith(servicePrefix)) {
+        return servicePrincipal(trimmed.slice(servicePrefix.length));
+    }
+    if (trimmed.startsWith(arnPrefix)) {
+        return { kind: "arn", arn: trimmed };
+    }
+    throw new SimAwsInvalidCallerHeader(`${simAwsCallerHeaderName} value ${value} must be an ARN, ` +
+        `${anonymousValue}, or ${servicePrefix}<name>`);
+}
+/**
+ * Write a principal in the form this header accepts, so what the simulator
+ * reports back can be sent straight back in.
+ */
+export function simAwsCallerHeaderValue(principal) {
+    switch (principal.kind) {
+        case "arn": {
+            return principal.arn;
+        }
+        case "service": {
+            return `${servicePrefix}${principal.service}`;
+        }
+        case "anonymous": {
+            return anonymousValue;
+        }
+    }
+}
+function servicePrincipal(service) {
+    if (service.length === 0) {
+        throw new SimAwsInvalidCallerHeader(`${simAwsCallerHeaderName} value ${servicePrefix} names no service`);
+    }
+    return { kind: "service", service };
+}
+//# sourceMappingURL=sim-aws-caller-header.js.map

package/dist/service/iam/request/sim-aws-caller-header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-caller-header.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-caller-header.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACtC,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,yBAAyB,CACjC,GAAG,sBAAsB,UAAU,KAAK,mBAAmB;QACzD,GAAG,cAAc,QAAQ,aAAa,QAAQ,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA0B;IAChE,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QAChD,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,GAAG,sBAAsB,UAAU,aAAa,mBAAmB,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/service/iam/request/sim-aws-request-caller-resolver.d.ts

@@ -0,0 +1,49 @@
+import type { SimIamSigV4ExpectedScope } from "../sigv4/sim-iam-sigv4-expected-scope.js";
+import type { SimIamSigV4SignedRequest } from "../sigv4/sim-iam-sigv4-signed-request.js";
+import type { SimIamSigV4Verifier } from "../sigv4/sim-iam-sigv4-verifier.js";
+import { SimAwsRequestCaller } from "./sim-aws-request-caller.js";
+interface SimAwsRequestCallerResolverProperties {
+    readonly signedRequests: SimIamSigV4Verifier;
+}
+/**
+ * The one place an HTTP request into simulated AWS becomes a principal.
+ *
+ * Resolution runs in a fixed order:
+ *
+ * 1. an `x-sim-aws-caller` header naming the principal directly;
+ * 2. an `Authorization: AWS4-HMAC-SHA256` header, verified as a signature;
+ * 3. neither, giving anonymous.
+ *
+ * The header wins over a signature so that a developer can override the
+ * identity of a request their tooling already signs, without having to stop it
+ * signing. Nothing else is worth resolving after an explicit statement of who
+ * the caller is.
+ *
+ * Anonymous is the floor, and deliberately not the Account root. Simulated IAM
+ * treats an omitted in-process caller as the root principal with unrestricted
+ * access, which is convenient inside a test and would be a serious mistake over
+ * HTTP: every unauthenticated request would arrive as an administrator.
+ */
+export declare class SimAwsRequestCallerResolver {
+    private readonly signedRequests;
+    constructor(properties: SimAwsRequestCallerResolverProperties);
+    /**
+     * Resolve the principal behind a request as received.
+     *
+     * Throws a SimAwsRequestAuthFailure when the request states an identity that
+     * cannot be accepted. Stating none is not a failure; it is anonymous.
+     */
+    resolve(request: SimIamSigV4SignedRequest, expectedScope?: SimIamSigV4ExpectedScope): SimAwsRequestCaller;
+    /**
+     * Whether the request offers a SigV4 signature to verify.
+     *
+     * Only an AWS4-HMAC-SHA256 header counts. An Authorization header of any
+     * other scheme belongs to the application: a bearer token sent to a Function
+     * URL with NONE auth is the handler's business, and treating it as a broken
+     * signature would refuse a request real AWS delivers.
+     */
+    private carriesSignature;
+    private signedCaller;
+}
+export {};
+//# sourceMappingURL=sim-aws-request-caller-resolver.d.ts.map

package/dist/service/iam/request/sim-aws-request-caller-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAK9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAO,EAAE,wBAAwB,EACjC,aAAa,CAAC,EAAE,wBAAwB,GACvC,mBAAmB,CAerB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,YAAY;CAYrB"}