@kensio/yulin 0.35.0 → 0.37.0

package/dist/service/iam/request/sim-aws-request-caller-resolver.d.ts

@@ -0,0 +1,49 @@
+import type { SimIamSigV4ExpectedScope } from "../sigv4/sim-iam-sigv4-expected-scope.js";
+import type { SimIamSigV4SignedRequest } from "../sigv4/sim-iam-sigv4-signed-request.js";
+import type { SimIamSigV4Verifier } from "../sigv4/sim-iam-sigv4-verifier.js";
+import { SimAwsRequestCaller } from "./sim-aws-request-caller.js";
+interface SimAwsRequestCallerResolverProperties {
+    readonly signedRequests: SimIamSigV4Verifier;
+}
+/**
+ * The one place an HTTP request into simulated AWS becomes a principal.
+ *
+ * Resolution runs in a fixed order:
+ *
+ * 1. an `x-sim-aws-caller` header naming the principal directly;
+ * 2. an `Authorization: AWS4-HMAC-SHA256` header, verified as a signature;
+ * 3. neither, giving anonymous.
+ *
+ * The header wins over a signature so that a developer can override the
+ * identity of a request their tooling already signs, without having to stop it
+ * signing. Nothing else is worth resolving after an explicit statement of who
+ * the caller is.
+ *
+ * Anonymous is the floor, and deliberately not the Account root. Simulated IAM
+ * treats an omitted in-process caller as the root principal with unrestricted
+ * access, which is convenient inside a test and would be a serious mistake over
+ * HTTP: every unauthenticated request would arrive as an administrator.
+ */
+export declare class SimAwsRequestCallerResolver {
+    private readonly signedRequests;
+    constructor(properties: SimAwsRequestCallerResolverProperties);
+    /**
+     * Resolve the principal behind a request as received.
+     *
+     * Throws a SimAwsRequestAuthFailure when the request states an identity that
+     * cannot be accepted. Stating none is not a failure; it is anonymous.
+     */
+    resolve(request: SimIamSigV4SignedRequest, expectedScope?: SimIamSigV4ExpectedScope): SimAwsRequestCaller;
+    /**
+     * Whether the request offers a SigV4 signature to verify.
+     *
+     * Only an AWS4-HMAC-SHA256 header counts. An Authorization header of any
+     * other scheme belongs to the application: a bearer token sent to a Function
+     * URL with NONE auth is the handler's business, and treating it as a broken
+     * signature would refuse a request real AWS delivers.
+     */
+    private carriesSignature;
+    private signedCaller;
+}
+export {};
+//# sourceMappingURL=sim-aws-request-caller-resolver.d.ts.map

package/dist/service/iam/request/sim-aws-request-caller-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAK9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAO,EAAE,wBAAwB,EACjC,aAAa,CAAC,EAAE,wBAAwB,GACvC,mBAAmB,CAerB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,YAAY;CAYrB"}

package/dist/service/iam/request/sim-aws-request-caller-resolver.js

@@ -0,0 +1,68 @@
+import { simIamSigV4Algorithm } from "../sigv4/sim-iam-sigv4-authorization.js";
+import { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, } from "./sim-aws-caller-header.js";
+import { SimAwsRequestCaller } from "./sim-aws-request-caller.js";
+/**
+ * The one place an HTTP request into simulated AWS becomes a principal.
+ *
+ * Resolution runs in a fixed order:
+ *
+ * 1. an `x-sim-aws-caller` header naming the principal directly;
+ * 2. an `Authorization: AWS4-HMAC-SHA256` header, verified as a signature;
+ * 3. neither, giving anonymous.
+ *
+ * The header wins over a signature so that a developer can override the
+ * identity of a request their tooling already signs, without having to stop it
+ * signing. Nothing else is worth resolving after an explicit statement of who
+ * the caller is.
+ *
+ * Anonymous is the floor, and deliberately not the Account root. Simulated IAM
+ * treats an omitted in-process caller as the root principal with unrestricted
+ * access, which is convenient inside a test and would be a serious mistake over
+ * HTTP: every unauthenticated request would arrive as an administrator.
+ */
+export class SimAwsRequestCallerResolver {
+    signedRequests;
+    constructor(properties) {
+        this.signedRequests = properties.signedRequests;
+    }
+    /**
+     * Resolve the principal behind a request as received.
+     *
+     * Throws a SimAwsRequestAuthFailure when the request states an identity that
+     * cannot be accepted. Stating none is not a failure; it is anonymous.
+     */
+    resolve(request, expectedScope) {
+        const named = request.headers.get(simAwsCallerHeaderName);
+        if (named !== null) {
+            return new SimAwsRequestCaller({
+                principal: simAwsCallerHeaderPrincipal(named),
+                authMethod: "caller-header",
+            });
+        }
+        if (!this.carriesSignature(request)) {
+            return SimAwsRequestCaller.anonymous();
+        }
+        return this.signedCaller(request, expectedScope);
+    }
+    /**
+     * Whether the request offers a SigV4 signature to verify.
+     *
+     * Only an AWS4-HMAC-SHA256 header counts. An Authorization header of any
+     * other scheme belongs to the application: a bearer token sent to a Function
+     * URL with NONE auth is the handler's business, and treating it as a broken
+     * signature would refuse a request real AWS delivers.
+     */
+    carriesSignature(request) {
+        return (request.headers.get("authorization")?.startsWith(simIamSigV4Algorithm) ===
+            true);
+    }
+    signedCaller(request, expectedScope) {
+        const identity = this.signedRequests.verify(request, { expectedScope });
+        return new SimAwsRequestCaller({
+            principal: identity.principal,
+            identityPolicyPrincipal: identity.identityPolicyPrincipal,
+            authMethod: "sigv4",
+        });
+    }
+}
+//# sourceMappingURL=sim-aws-request-caller-resolver.js.map

package/dist/service/iam/request/sim-aws-request-caller-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller-resolver.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAI/E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,2BAA2B;IACrB,cAAc,CAAsB;IAErD,YAAY,UAAiD;QAC3D,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAiC,EACjC,aAAwC;QAExC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAE1D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,mBAAmB,CAAC;gBAC7B,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC;gBAC7C,UAAU,EAAE,eAAe;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,mBAAmB,CAAC,SAAS,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,OAAiC;QACxD,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC;YACtE,IAAI,CACL,CAAC;IACJ,CAAC;IAEO,YAAY,CAClB,OAAiC,EACjC,aAAmD;QAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAExE,OAAO,IAAI,mBAAmB,CAAC;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/request/sim-aws-request-caller.d.ts

@@ -0,0 +1,50 @@
+import type { SimAwsCaller, SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * How a request's principal was established.
+ *
+ * This is reported back to the client, because "who does the simulator think
+ * you are" is much less useful without "and why".
+ */
+export type SimAwsRequestAuthMethod = "caller-header" | "sigv4" | "none";
+interface SimAwsRequestCallerProperties {
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal?: SimAwsPrincipal | undefined;
+    readonly authMethod: SimAwsRequestAuthMethod;
+}
+/**
+ * The principal a request into simulated AWS is attributed to.
+ *
+ * An unauthenticated request is anonymous and never the Account root. In
+ * process an omitted caller means "whoever owns this simulation", which is a
+ * convenience; over HTTP the same default would hand administrator rights to
+ * anyone who could reach the port, so the boundary refuses to make that
+ * assumption.
+ *
+ * For an assumed-role session the effective principal is the session while
+ * `identityPolicyPrincipal` is the Role whose policies apply, exactly as
+ * `SimIamCredentialIdentity` distinguishes them.
+ */
+export declare class SimAwsRequestCaller {
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal: SimAwsPrincipal;
+    readonly authMethod: SimAwsRequestAuthMethod;
+    constructor(properties: SimAwsRequestCallerProperties);
+    /**
+     * The caller of a request that carried no identity at all.
+     */
+    static anonymous(): SimAwsRequestCaller;
+    /**
+     * The principal in the form the `x-sim-aws-caller` header accepts.
+     */
+    toHeaderValue(): string;
+    /**
+     * This caller in the form simulated services pass to IAM authorization.
+     *
+     * The identity-policy principal travels with it, so an assumed-role session
+     * is authorized against the Role behind it rather than against a session ARN
+     * that owns no policies.
+     */
+    toCaller(): SimAwsCaller;
+}
+export {};
+//# sourceMappingURL=sim-aws-request-caller.d.ts.map

package/dist/service/iam/request/sim-aws-request-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,oCAAoC,CAAC;AAG5C;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAEzE,UAAU,6BAA6B;IACrC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,uBAAuB,EAAE,eAAe,CAAC;IACzD,SAAgB,UAAU,EAAE,uBAAuB,CAAC;IAEpD,YAAY,UAAU,EAAE,6BAA6B,EAKpD;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,IAAI,mBAAmB,CAKtC;IAED;;OAEG;IACH,aAAa,IAAI,MAAM,CAEtB;IAED;;;;;;OAMG;IACH,QAAQ,IAAI,YAAY,CAMvB;CACF"}

package/dist/service/iam/request/sim-aws-request-caller.js

@@ -0,0 +1,55 @@
+import { simAwsCallerHeaderValue } from "./sim-aws-caller-header.js";
+/**
+ * The principal a request into simulated AWS is attributed to.
+ *
+ * An unauthenticated request is anonymous and never the Account root. In
+ * process an omitted caller means "whoever owns this simulation", which is a
+ * convenience; over HTTP the same default would hand administrator rights to
+ * anyone who could reach the port, so the boundary refuses to make that
+ * assumption.
+ *
+ * For an assumed-role session the effective principal is the session while
+ * `identityPolicyPrincipal` is the Role whose policies apply, exactly as
+ * `SimIamCredentialIdentity` distinguishes them.
+ */
+export class SimAwsRequestCaller {
+    principal;
+    identityPolicyPrincipal;
+    authMethod;
+    constructor(properties) {
+        this.principal = properties.principal;
+        this.identityPolicyPrincipal =
+            properties.identityPolicyPrincipal ?? properties.principal;
+        this.authMethod = properties.authMethod;
+    }
+    /**
+     * The caller of a request that carried no identity at all.
+     */
+    static anonymous() {
+        return new SimAwsRequestCaller({
+            principal: { kind: "anonymous" },
+            authMethod: "none",
+        });
+    }
+    /**
+     * The principal in the form the `x-sim-aws-caller` header accepts.
+     */
+    toHeaderValue() {
+        return simAwsCallerHeaderValue(this.principal);
+    }
+    /**
+     * This caller in the form simulated services pass to IAM authorization.
+     *
+     * The identity-policy principal travels with it, so an assumed-role session
+     * is authorized against the Role behind it rather than against a session ARN
+     * that owns no policies.
+     */
+    toCaller() {
+        return {
+            kind: "resolved",
+            principal: this.principal,
+            identityPolicyPrincipal: this.identityPolicyPrincipal,
+        };
+    }
+}
+//# sourceMappingURL=sim-aws-request-caller.js.map

package/dist/service/iam/request/sim-aws-request-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAgBrE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mBAAmB;IACd,SAAS,CAAkB;IAC3B,uBAAuB,CAAkB;IACzC,UAAU,CAA0B;IAEpD,YAAY,UAAyC;QACnD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,uBAAuB;YAC1B,UAAU,CAAC,uBAAuB,IAAI,UAAU,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAS;QACd,OAAO,IAAI,mBAAmB,CAAC;YAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAChC,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,QAAQ;QACN,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACtD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/sigv4/canonical/sigv4-byte-order.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Order strings by their code units, which is what SigV4 means by sorted.
+ *
+ * A locale-aware comparison is not interchangeable here: it treats punctuation
+ * and case as secondary, so it can order `a-b` and `a` the other way round from
+ * the signer and produce a canonical form that never matches.
+ */
+export declare function compareSigV4ByteOrder(a: string, b: string): number;
+//# sourceMappingURL=sigv4-byte-order.d.ts.map

package/dist/service/iam/sigv4/canonical/sigv4-byte-order.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-byte-order.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sigv4-byte-order.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlE"}

package/dist/service/iam/sigv4/canonical/sigv4-byte-order.js

@@ -0,0 +1,14 @@
+/**
+ * Order strings by their code units, which is what SigV4 means by sorted.
+ *
+ * A locale-aware comparison is not interchangeable here: it treats punctuation
+ * and case as secondary, so it can order `a-b` and `a` the other way round from
+ * the signer and produce a canonical form that never matches.
+ */
+export function compareSigV4ByteOrder(a, b) {
+    if (a === b) {
+        return 0;
+    }
+    return a < b ? -1 : 1;
+}
+//# sourceMappingURL=sigv4-byte-order.js.map

package/dist/service/iam/sigv4/canonical/sigv4-byte-order.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-byte-order.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sigv4-byte-order.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Build the canonical headers and signed header list of a signed request.
+ *
+ * Only the headers the signer listed are canonicalized, whatever else the
+ * request carries. Each value is trimmed and its runs of whitespace collapsed,
+ * which is what makes a signature survive the whitespace normalization a proxy
+ * or HTTP client is entitled to apply.
+ */
+export declare class SimIamSigV4CanonicalHeaders {
+    private readonly names;
+    private readonly lines;
+    constructor(headers: Headers, signedHeaderNames: readonly string[], url: URL);
+    /**
+     * The canonical headers block, one `name:value` line per signed header.
+     */
+    toString(): string;
+    /**
+     * The signed header names, in the order they are canonicalized.
+     */
+    signedHeaderList(): string;
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-headers.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-headers.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAE1C,YACE,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,SAAS,MAAM,EAAE,EACpC,GAAG,EAAE,GAAG,EAMT;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,gBAAgB,IAAI,MAAM,CAEzB;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.js

@@ -0,0 +1,48 @@
+import { SimIamSignatureDoesNotMatch } from "../error/sim-iam-sigv4.error.js";
+import { compareSigV4ByteOrder } from "./sigv4-byte-order.js";
+/**
+ * Build the canonical headers and signed header list of a signed request.
+ *
+ * Only the headers the signer listed are canonicalized, whatever else the
+ * request carries. Each value is trimmed and its runs of whitespace collapsed,
+ * which is what makes a signature survive the whitespace normalization a proxy
+ * or HTTP client is entitled to apply.
+ */
+export class SimIamSigV4CanonicalHeaders {
+    names;
+    lines;
+    constructor(headers, signedHeaderNames, url) {
+        this.names = signedHeaderNames.toSorted(compareSigV4ByteOrder);
+        this.lines = this.names.map((name) => `${name}:${canonicalValue(headers, name, url)}`);
+    }
+    /**
+     * The canonical headers block, one `name:value` line per signed header.
+     */
+    toString() {
+        return this.lines.join("\n");
+    }
+    /**
+     * The signed header names, in the order they are canonicalized.
+     */
+    signedHeaderList() {
+        return this.names.join(";");
+    }
+}
+function canonicalValue(headers, name, url) {
+    const value = headers.get(name) ?? impliedValue(name, url);
+    if (value === undefined) {
+        throw new SimIamSignatureDoesNotMatch(`Request does not carry signed header ${name}, so the signature ` +
+            `cannot be reproduced`);
+    }
+    return value.trim().replaceAll(/\s+/g, " ");
+}
+/**
+ * Supply a signed header the request implies rather than carries.
+ *
+ * Host is always signed but is not always readable as a header, since some HTTP
+ * clients own it. The URL the request was made to says the same thing.
+ */
+function impliedValue(name, url) {
+    return name === "host" ? url.host : undefined;
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-headers.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-headers.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACrB,KAAK,CAAoB;IACzB,KAAK,CAAoB;IAE1C,YACE,OAAgB,EAChB,iBAAoC,EACpC,GAAQ;QAER,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CACzB,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,cAAc,CAAC,OAAgB,EAAE,IAAY,EAAE,GAAQ;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAE3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,wCAAwC,IAAI,qBAAqB;YAC/D,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,GAAQ;IAC1C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Build the canonical URI of a signed request.
+ *
+ * The path is normalized, dropping empty and `.` segments and resolving `..`,
+ * and then encoded a second time. The already-encoded path arriving in the
+ * request is the first encoding, which is why a literal `/` in a path segment
+ * and a separator are still distinguishable here.
+ *
+ * S3 is the exception on real AWS: it signs the path singly encoded. Only
+ * doubly encoded services are supported for now, which is every service the
+ * simulator serves.
+ */
+export declare function simIamSigV4CanonicalPath(path: string): string;
+//# sourceMappingURL=sim-iam-sigv4-canonical-path.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-path.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB7D"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.js

@@ -0,0 +1,31 @@
+import { escapeSigV4Uri } from "../sigv4-uri-escape.js";
+/**
+ * Build the canonical URI of a signed request.
+ *
+ * The path is normalized, dropping empty and `.` segments and resolving `..`,
+ * and then encoded a second time. The already-encoded path arriving in the
+ * request is the first encoding, which is why a literal `/` in a path segment
+ * and a separator are still distinguishable here.
+ *
+ * S3 is the exception on real AWS: it signs the path singly encoded. Only
+ * doubly encoded services are supported for now, which is every service the
+ * simulator serves.
+ */
+export function simIamSigV4CanonicalPath(path) {
+    const segments = [];
+    for (const segment of path.split("/")) {
+        if (segment.length === 0 || segment === ".") {
+            continue;
+        }
+        if (segment === "..") {
+            segments.pop();
+            continue;
+        }
+        segments.push(segment);
+    }
+    const leadingSlash = path.startsWith("/") ? "/" : "";
+    const trailingSlash = segments.length > 0 && path.endsWith("/") ? "/" : "";
+    const normalized = `${leadingSlash}${segments.join("/")}${trailingSlash}`;
+    return escapeSigV4Uri(normalized).replaceAll("%2F", "/");
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-path.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-path.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,GAAG,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,EAAE,CAAC;IAE1E,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Build the canonical query string of a signed request.
+ *
+ * Parameters are ordered by their encoded key, and a repeated key's values are
+ * ordered among themselves. Sorting whole `key=value` pairs instead would not
+ * be the same thing: `-` sorts before `=`, so a key such as `a-b` would
+ * overtake a shorter key `a` that it must follow.
+ *
+ * The raw search string is parsed here rather than being handed to
+ * URLSearchParams, which applies form decoding and would read a literal `+` as
+ * a space. A query string is not a form: SigV4 signs `+` as the character it
+ * is, so decoding it to a space would canonicalize a different request from the
+ * one the client signed.
+ *
+ * The signature parameter itself is left out, as it cannot be part of what it
+ * signs. Header-signed requests never carry it, but presigned URLs do.
+ */
+export declare function simIamSigV4CanonicalQuery(search: string): string;
+//# sourceMappingURL=sim-iam-sigv4-canonical-query.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-query.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA6BhE"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.js

@@ -0,0 +1,78 @@
+import { escapeSigV4Uri } from "../sigv4-uri-escape.js";
+import { compareSigV4ByteOrder } from "./sigv4-byte-order.js";
+const signatureParameter = "x-amz-signature";
+/**
+ * Build the canonical query string of a signed request.
+ *
+ * Parameters are ordered by their encoded key, and a repeated key's values are
+ * ordered among themselves. Sorting whole `key=value` pairs instead would not
+ * be the same thing: `-` sorts before `=`, so a key such as `a-b` would
+ * overtake a shorter key `a` that it must follow.
+ *
+ * The raw search string is parsed here rather than being handed to
+ * URLSearchParams, which applies form decoding and would read a literal `+` as
+ * a space. A query string is not a form: SigV4 signs `+` as the character it
+ * is, so decoding it to a space would canonicalize a different request from the
+ * one the client signed.
+ *
+ * The signature parameter itself is left out, as it cannot be part of what it
+ * signs. Header-signed requests never carry it, but presigned URLs do.
+ */
+export function simIamSigV4CanonicalQuery(search) {
+    const pairsByKey = new Map();
+    for (const pair of searchPairs(search)) {
+        const key = decodeQueryPart(pair.key);
+        if (key.toLowerCase() === signatureParameter) {
+            continue;
+        }
+        const encodedKey = escapeSigV4Uri(key);
+        const encoded = `${encodedKey}=${escapeSigV4Uri(decodeQueryPart(pair.value))}`;
+        pairsByKey.set(encodedKey, [
+            ...(pairsByKey.get(encodedKey) ?? []),
+            encoded,
+        ]);
+    }
+    return pairsByKey
+        .keys()
+        .toArray()
+        .toSorted(compareSigV4ByteOrder)
+        .map((encodedKey) => (pairsByKey.get(encodedKey) ?? [])
+        .toSorted(compareSigV4ByteOrder)
+        .join("&"))
+        .join("&");
+}
+/**
+ * Split a raw search string into its key and value parts, still encoded.
+ *
+ * A parameter with no `=` has an empty value, which is how it is canonicalized
+ * too.
+ */
+function searchPairs(search) {
+    const query = search.startsWith("?") ? search.slice(1) : search;
+    const pairs = [];
+    for (const pair of query.split("&")) {
+        if (pair.length === 0) {
+            continue;
+        }
+        const separator = pair.indexOf("=");
+        pairs.push(separator === -1
+            ? { key: pair, value: "" }
+            : { key: pair.slice(0, separator), value: pair.slice(separator + 1) });
+    }
+    return pairs;
+}
+/**
+ * Percent-decode one part of a query string.
+ *
+ * A part that is not validly encoded is used as it arrived: it cannot be
+ * decoded, and the client signed those characters as they are.
+ */
+function decodeQueryPart(part) {
+    try {
+        return decodeURIComponent(part);
+    }
+    catch {
+        return part;
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-query.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-query.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,kBAAkB,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAE/E,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;YACzB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrC,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU;SACd,IAAI,EAAE;SACN,OAAO,EAAE;SACT,QAAQ,CAAC,qBAAqB,CAAC;SAC/B,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAClB,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;SAC/B,QAAQ,CAAC,qBAAqB,CAAC;SAC/B,IAAI,CAAC,GAAG,CAAC,CACb;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAOD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,KAAK,GAAiB,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEpC,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,CAAC,CAAC;YACd,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YAC1B,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts

@@ -0,0 +1,20 @@
+import type { SimIamSigV4SignedRequest } from "../sim-iam-sigv4-signed-request.js";
+/**
+ * The canonical form of a signed request: the exact bytes a signature is made
+ * over.
+ *
+ * Rebuilding this from the request as received, and getting the same signature
+ * out, is the whole of SigV4 verification. Anything the canonical form covers
+ * cannot be altered in transit without detection, and anything it leaves out
+ * can be.
+ */
+export declare class SimIamSigV4CanonicalRequest {
+    private readonly canonicalHeaders;
+    private readonly signedRequest;
+    constructor(signedRequest: SimIamSigV4SignedRequest, signedHeaderNames: readonly string[]);
+    /**
+     * The canonical request string, ready to be hashed into a string to sign.
+     */
+    toString(): string;
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-request.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAMnF;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IAEzD,YACE,aAAa,EAAE,wBAAwB,EACvC,iBAAiB,EAAE,SAAS,MAAM,EAAE,EAQrC;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAWjB;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js

@@ -0,0 +1,36 @@
+import { SimIamSigV4CanonicalHeaders } from "./sim-iam-sigv4-canonical-headers.js";
+import { simIamSigV4CanonicalPath } from "./sim-iam-sigv4-canonical-path.js";
+import { simIamSigV4CanonicalQuery } from "./sim-iam-sigv4-canonical-query.js";
+import { simIamSigV4PayloadHash } from "./sim-iam-sigv4-payload-hash.js";
+/**
+ * The canonical form of a signed request: the exact bytes a signature is made
+ * over.
+ *
+ * Rebuilding this from the request as received, and getting the same signature
+ * out, is the whole of SigV4 verification. Anything the canonical form covers
+ * cannot be altered in transit without detection, and anything it leaves out
+ * can be.
+ */
+export class SimIamSigV4CanonicalRequest {
+    canonicalHeaders;
+    signedRequest;
+    constructor(signedRequest, signedHeaderNames) {
+        this.signedRequest = signedRequest;
+        this.canonicalHeaders = new SimIamSigV4CanonicalHeaders(signedRequest.headers, signedHeaderNames, signedRequest.url);
+    }
+    /**
+     * The canonical request string, ready to be hashed into a string to sign.
+     */
+    toString() {
+        const { method, url, headers, body } = this.signedRequest;
+        return [
+            method.toUpperCase(),
+            simIamSigV4CanonicalPath(url.pathname),
+            simIamSigV4CanonicalQuery(url.search),
+            `${this.canonicalHeaders.toString()}\n`,
+            this.canonicalHeaders.signedHeaderList(),
+            simIamSigV4PayloadHash(headers, body),
+        ].join("\n");
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-canonical-request.js.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-canonical-request.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,gBAAgB,CAA8B;IAC9C,aAAa,CAA2B;IAEzD,YACE,aAAuC,EACvC,iBAAoC;QAEpC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,2BAA2B,CACrD,aAAa,CAAC,OAAO,EACrB,iBAAiB,EACjB,aAAa,CAAC,GAAG,CAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAE1D,OAAO;YACL,MAAM,CAAC,WAAW,EAAE;YACpB,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI;YACvC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACxC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.d.ts

@@ -0,0 +1,19 @@
+export declare const simIamSigV4UnsignedPayload = "UNSIGNED-PAYLOAD";
+/**
+ * Work out the payload hash a signed request was signed with, and check the
+ * body it arrived with is the body it claims.
+ *
+ * A signer states the payload hash in `x-amz-content-sha256`, and that header
+ * is itself signed, so the claim cannot be altered without breaking the
+ * signature. The claim still has to be checked against the bytes received:
+ * without that, a signature would cover only the client's assertion about the
+ * body, and the body could be replaced freely.
+ *
+ * `UNSIGNED-PAYLOAD` is the one declaration that deliberately leaves the body
+ * uncovered, and is honoured. Any other non-digest value, including the
+ * streaming markers that chunked uploads use, is refused rather than passed
+ * through: accepting one would mean serving a request whose body nothing had
+ * checked, which is worse than saying the simulator does not support it.
+ */
+export declare function simIamSigV4PayloadHash(headers: Headers, body: Uint8Array | undefined): string;
+//# sourceMappingURL=sim-iam-sigv4-payload-hash.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-payload-hash.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAW7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,UAAU,GAAG,SAAS,GAC3B,MAAM,CA6BR"}