@kensio/yulin 0.36.0 → 0.37.0

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -1,5 +1,7 @@
+import { makeSimAwsAccountRootPrincipal } from "../../../aws/caller/sim-aws-account-root-principal.js";
+import { SimIamCallerAccountResolver } from "../caller-account/sim-iam-caller-account-resolver.js";
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
-import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context-builder.js";
+import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
  *
@@ -12,6 +14,11 @@ import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context
  * finding a principal role, reading inline policies from the role, resolving
  * attached managed policy ARNs, and parsing stored policy documents.
  *
+ * Whose identity policies are in scope depends on which Account owns the
+ * caller, which SimIamCallerAccountResolver decides. A caller from another
+ * Account brings that Account's identity policies with it, along with the rule
+ * that both sides must then allow the request.
+ *
  * Resource policies are supplied by the service that owns the target resource.
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
@@ -24,12 +31,17 @@ import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context
 export class SimIamAuthZContextBuilder {
     callerContextBuilder;
     identityPolicyCoordinator;
-    constructor(policies, roles, users, defaultCallerPrincipal, credentialIdentityResolver) {
-        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(defaultCallerPrincipal, credentialIdentityResolver);
+    callerAccountResolver;
+    constructor(properties) {
+        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
-            policies,
-            roles,
-            users,
+            policies: properties.policies,
+            roles: properties.roles,
+            users: properties.users,
+        });
+        this.callerAccountResolver = new SimIamCallerAccountResolver({
+            accountId: properties.accountId,
+            iamResolver: properties.iamResolver,
         });
     }
     /**
@@ -37,18 +49,40 @@ export class SimIamAuthZContextBuilder {
      */
     build(input) {
         const callerContext = this.callerContextBuilder.build(input.caller);
+        const callerAccount = this.callerAccountResolver.resolve(callerContext.caller);
         return {
             identityPolicies: [
-                ...this.identityPolicyCoordinator.build(callerContext.caller.identityPolicyArn),
-                ...callerContext.rootPolicySources,
+                ...this.ownIdentityPolicySources(callerContext),
+                ...callerAccount.identityPolicies,
             ],
             resourcePolicies: this.resourcePolicySources(input),
+            allowRequirement: callerAccount.allowRequirement,
             action: input.action,
             resource: input.resource,
             conditionContext: this.conditionContext(input, callerContext.caller),
             caller: callerContext.caller,
         };
     }
+    /**
+     * Identity policy sources this Account applies to one of its own principals.
+     *
+     * This is the identity side of a request within one Account, and is also what
+     * another Account's IAM asks for when it is deciding a cross-Account request
+     * against a principal belonging to this one.
+     */
+    identityPolicySourcesFor(principal) {
+        return this.ownIdentityPolicySources(this.callerContextBuilder.build(principal));
+    }
+    /**
+     * Combine stored identity policies with any implied by the caller itself,
+     * such as the unrestricted access held by this Account's root principal.
+     */
+    ownIdentityPolicySources(callerContext) {
+        return [
+            ...this.identityPolicyCoordinator.build(callerContext.caller.identityPolicyArn),
+            ...callerContext.rootPolicySources,
+        ];
+    }
     /**
      * Combine service-provided condition values with global values that IAM can
      * derive from the resolved caller. AWS:PrincipalArn identifies the IAM

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAsD7F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAEjF,YACE,QAA2C,EAC3C,KAA8C,EAC9C,KAA8C,EAC9C,sBAAuC,EACvC,0BAA4D;QAE5D,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,sBAAsB,EACtB,0BAA0B,CAC3B,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ;YACR,KAAK;YACL,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;gBACD,GAAG,aAAa,CAAC,iBAAiB;aACnC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAanG,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AAwEpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IAEpE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts

@@ -1,6 +1,7 @@
 import type { SimArn } from "../../../aws/arn.js";
 import type { SimIamConditionValue, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
 export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session";
 export interface SimIamAuthZPolicySource {
     readonly sourceType: SimIamAuthZPolicySourceType;
@@ -28,6 +29,14 @@ export interface SimIamAuthZContext {
      * Resource policies are not gathered from IAM's managed policy store.
      */
     readonly resourcePolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * How an Allow from each policy side combines into the final decision.
+     *
+     * Within one Account either side is enough. A cross-Account request needs
+     * both, because each Account only speaks for its own principals and
+     * resources.
+     */
+    readonly allowRequirement: SimIamAllowRequirement;
     readonly action: string;
     readonly resource: string;
     readonly conditionContext: Readonly<Record<string, SimIamConditionValue>>;

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAE3F,MAAM,MAAM,2BAA2B,GACnC,iBAAiB,GACjB,kBAAkB,GAClB,UAAU,GACV,OAAO,GACP,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,uBAAuB,EACvB,YAAY,CACb,GAAG;IACF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAE1E;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC"}
+{"version":3,"file":"sim-iam-auth-z-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAEpF,MAAM,MAAM,2BAA2B,GACnC,iBAAiB,GACjB,kBAAkB,GAClB,UAAU,GACV,OAAO,GACP,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,uBAAuB,EACvB,YAAY,CACb,GAAG;IACF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;IAElD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAE1E;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EACV,kBAAkB,EAClB,+BAA+B,EAChC,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,yBAAyB,mCAkBpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sCAAsC,gDAW/C,CAAC"}
+{"version":3,"file":"sim-iam-auth-z-context.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EACV,kBAAkB,EAClB,+BAA+B,EAChC,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,yBAAyB,mCAmBpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sCAAsC,gDAW/C,CAAC"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js

@@ -1,10 +1,12 @@
 import { StaticFactory } from "@kensio/part-factory";
+import { SimIamEitherSideAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
 /**
  * Generates simulated IAM authorization contexts for tests.
  */
 export const simIamAuthZContextFactory = new StaticFactory({
     identityPolicies: [],
     resourcePolicies: [],
+    allowRequirement: new SimIamEitherSideAllowRequirement(),
     action: "s3:GetObject",
     resource: "arn:aws:s3:::test-bucket/test-key",
     conditionContext: {},

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context.factory.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAMrD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,aAAa,CAAqB;IAC7E,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,mCAAmC;IAC7C,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE;QACN,uBAAuB,EAAE;YACvB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,SAAS,EAAE;YACT,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,GAAG,EAAE,yCAAyC;QAC9C,SAAS,EAAE,cAAc;KAC1B;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,aAAa,CAAkC;IACjD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE;QACR,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,mCAAmC;SAC9C;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"sim-iam-auth-z-context.factory.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAMzF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,aAAa,CAAqB;IAC7E,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,IAAI,gCAAgC,EAAE;IACxD,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,mCAAmC;IAC7C,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE;QACN,uBAAuB,EAAE;YACvB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,SAAS,EAAE;YACT,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,GAAG,EAAE,yCAAyC;QAC9C,SAAS,EAAE,cAAc;KAC1B;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,aAAa,CAAkC;IACjD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE;QACR,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,mCAAmC;SAC9C;KACF;CACF,CAAC,CAAC"}

package/dist/service/iam/authorize/identity/sim-iam-account-identity-policies.d.ts

@@ -0,0 +1,14 @@
+import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+/**
+ * Identity-based policy discovery for principals belonging to one Account.
+ *
+ * This is the capability one Account's IAM needs from another Account's IAM to
+ * decide a cross-Account request: the policies the caller's own Account applies
+ * to its own principal. SimIam implements it, so a resource-owning Account can
+ * ask the caller's Account without depending on the whole service facade.
+ */
+export interface SimIamAccountIdentityPolicies {
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
+}
+//# sourceMappingURL=sim-iam-account-identity-policies.d.ts.map

package/dist/service/iam/authorize/identity/sim-iam-account-identity-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-identity-policies.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/identity/sim-iam-account-identity-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAAC;CACvC"}

package/dist/service/iam/authorize/identity/sim-iam-account-identity-policies.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-account-identity-policies.js.map

package/dist/service/iam/authorize/identity/sim-iam-account-identity-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-identity-policies.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/identity/sim-iam-account-identity-policies.ts"],"names":[],"mappings":""}

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -1,10 +1,14 @@
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimArn } from "../../aws/arn.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
+import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
 import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
+import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 import type { SimIamPolicyDecision } from "./sim-iam-decision.js";
 interface SimIamAccountAuthZProperties {
     readonly accountId: SimAwsAccountId;
@@ -12,6 +16,14 @@ interface SimIamAccountAuthZProperties {
     readonly roles: Map<SimIamRoleName, SimIamRole>;
     readonly users: Map<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * Resolves other Accounts' IAM in the same simulation.
+     *
+     * A cross-Account request is decided in both Accounts, so the caller's own
+     * Account has to be reachable for its identity policies to count. A
+     * standalone SimIam has no simulation around it and so no resolver.
+     */
+    readonly iamResolver?: SimIamAccountResolver | undefined;
 }
 /**
  * Evaluates IAM authorization attempts against one simulated Account's IAM
@@ -21,7 +33,7 @@ interface SimIamAccountAuthZProperties {
  * the owning sim Account. An explicit anonymous caller suppresses that
  * fallback and is evaluated without identity policies.
  */
-export declare class SimIamAccountAuthZ {
+export declare class SimIamAccountAuthZ implements SimIamAccountIdentityPolicies {
     private readonly properties;
     constructor(properties: SimIamAccountAuthZProperties);
     /**
@@ -29,6 +41,17 @@ export declare class SimIamAccountAuthZ {
      * request caller.
      */
     authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
+    /**
+     * Identity policies this Account applies to one of its own principals.
+     */
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
+    /**
+     * Make an authorizer over this Account's current IAM state.
+     *
+     * The state maps are shared by reference, so a fresh authorizer sees every
+     * Role, User, and Policy created since the last request.
+     */
+    private authorizer;
 }
 export {};
 //# sourceMappingURL=sim-iam-account-auth-z.d.ts.map

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-account-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,UAAU,4BAA4B;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D,YAAY,UAAU,EAAE,4BAA4B,EAEnD;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAW/D;CACF"}
+{"version":3,"file":"sim-iam-account-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,UAAU,4BAA4B;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,6BAA6B;IACtE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D,YAAY,UAAU,EAAE,4BAA4B,EAEnD;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAEpC;IAED;;;;;OAKG;IACH,OAAO,CAAC,UAAU;CAUnB"}

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -1,4 +1,3 @@
-import { makeSimAwsAccountRootPrincipal } from "../../aws/caller/sim-aws-account-root-principal.js";
 import { SimIamAuthorizer } from "./sim-iam-authorizer.js";
 /**
  * Evaluates IAM authorization attempts against one simulated Account's IAM
@@ -18,14 +17,29 @@ export class SimIamAccountAuthZ {
      * request caller.
      */
     authorize(input) {
-        const simIamAuthorizer = new SimIamAuthorizer({
+        return this.authorizer().authorize(input);
+    }
+    /**
+     * Identity policies this Account applies to one of its own principals.
+     */
+    identityPolicySourcesFor(principal) {
+        return this.authorizer().identityPolicySourcesFor(principal);
+    }
+    /**
+     * Make an authorizer over this Account's current IAM state.
+     *
+     * The state maps are shared by reference, so a fresh authorizer sees every
+     * Role, User, and Policy created since the last request.
+     */
+    authorizer() {
+        return new SimIamAuthorizer({
+            accountId: this.properties.accountId,
             policies: this.properties.policies,
             roles: this.properties.roles,
             users: this.properties.users,
-            defaultCallerPrincipal: makeSimAwsAccountRootPrincipal(this.properties.accountId),
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
+            iamResolver: this.properties.iamResolver,
         });
-        return simIamAuthorizer.authorize(input);
     }
 }
 //# sourceMappingURL=sim-iam-account-auth-z.js.map

package/dist/service/iam/authorize/sim-iam-account-auth-z.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-account-auth-z.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AAOpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAY3D;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,UAAU,CAA+B;IAE1D,YAAY,UAAwC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,sBAAsB,EAAE,8BAA8B,CACpD,IAAI,CAAC,UAAU,CAAC,SAAS,CAC1B;YACD,0BAA0B,EAAE,IAAI,CAAC,UAAU,CAAC,0BAA0B;SACvE,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-iam-account-auth-z.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAuB3D;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,UAAU,CAA+B;IAE1D,YAAY,UAAwC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACK,UAAU;QAChB,OAAO,IAAI,gBAAgB,CAAC;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;YACpC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,0BAA0B,EAAE,IAAI,CAAC,UAAU,CAAC,0BAA0B;YACtE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;SACzC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -6,12 +6,17 @@ import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
+import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
+import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 interface SimIamAuthorizerProperties {
+    readonly accountId: SimAwsAccountId;
     readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
     readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
-    readonly defaultCallerPrincipal: SimAwsPrincipal;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    readonly iamResolver?: SimIamAccountResolver | undefined;
 }
 /**
  * Facade for simulated IAM authorization decisions.
@@ -21,13 +26,17 @@ interface SimIamAuthorizerProperties {
  * each SimIamPolicyDecision instance keeps the state and diagnostics for one
  * evaluated authorization attempt.
  */
-export declare class SimIamAuthorizer {
+export declare class SimIamAuthorizer implements SimIamAccountIdentityPolicies {
     private readonly contextBuilder;
     constructor(properties: SimIamAuthorizerProperties);
     /**
      * Evaluate an IAM authorization request.
      */
     authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
+    /**
+     * Identity policies this Account applies to one of its own principals.
+     */
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
 }
 export {};
 //# sourceMappingURL=sim-iam-authorizer.d.ts.map

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAEpG,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,EAAE,eAAe,CAAC;IACjD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,UAAU,EAAE,0BAA0B,EAQjD;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;CACF"}
+{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAErG,UAAU,0BAA0B;IAClC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAiB,YAAW,6BAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,UAAU,EAAE,0BAA0B,EASjD;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAEpC;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -11,7 +11,14 @@ import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 export class SimIamAuthorizer {
     contextBuilder;
     constructor(properties) {
-        this.contextBuilder = new SimIamAuthZContextBuilder(properties.policies, properties.roles, properties.users, properties.defaultCallerPrincipal, properties.credentialIdentityResolver);
+        this.contextBuilder = new SimIamAuthZContextBuilder({
+            accountId: properties.accountId,
+            policies: properties.policies,
+            roles: properties.roles,
+            users: properties.users,
+            credentialIdentityResolver: properties.credentialIdentityResolver,
+            iamResolver: properties.iamResolver,
+        });
     }
     /**
      * Evaluate an IAM authorization request.
@@ -19,5 +26,11 @@ export class SimIamAuthorizer {
     authorize(input) {
         return new SimIamPolicyDecision(this.contextBuilder.build(input));
     }
+    /**
+     * Identity policies this Account applies to one of its own principals.
+     */
+    identityPolicySourcesFor(principal) {
+        return this.contextBuilder.identityPolicySourcesFor(principal);
+    }
 }
 //# sourceMappingURL=sim-iam-authorizer.js.map

package/dist/service/iam/authorize/sim-iam-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAa7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,UAAsC;QAChD,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CACjD,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,KAAK,EAChB,UAAU,CAAC,KAAK,EAChB,UAAU,CAAC,sBAAsB,EACjC,UAAU,CAAC,0BAA0B,CACtC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAkB7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,UAAsC;QAChD,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CAAC;YAClD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;YACjE,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -16,10 +16,11 @@ export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof
  * evaluate permissions boundaries, evaluate SCPs, or enforce service command
  * access.
  *
- * The simulator currently models the common IAM authorization union:
+ * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
- * - an Allow in an identity policy or resource policy allows the request;
+ * - the Allows found must satisfy the request's allow requirement, which is
+ *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
  * Resource policies are expected to be supplied by the service that owns the
@@ -30,8 +31,7 @@ export declare class SimIamPolicyDecision {
     private readonly policyDocumentParser;
     private readonly statementMatcher;
     private readonly explicitDenyStatementRecords;
-    private readonly allowStatementRecords;
-    private readonly trustAllowStatementRecords;
+    private readonly allows;
     constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -71,9 +71,21 @@ export declare class SimIamPolicyDecision {
      */
     get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
     /**
-     * Matching Allow statements.
+     * Matching Allow statements, from both policy sides.
+     *
+     * A statement appearing here did match the request. It does not follow that
+     * the request was allowed: a cross-Account request needs a matching Allow
+     * from each side.
      */
     get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identityAllowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resourceAllowStatements(): readonly SimIamPolicyDocumentStatement[];
     /**
      * Matching Allow statements originating from trust policies.
      */

package/dist/service/iam/authorize/sim-iam-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAExF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAC7E,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CACtC;IAEL,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAoBvB"}
+{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAGxF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;;;;;OAMG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,uBAAuB,IAAI,SAAS,6BAA6B,EAAE,CAEtE;IAED;;OAEG;IACH,IAAI,uBAAuB,IAAI,SAAS,6BAA6B,EAAE,CAEtE;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAgBvB"}

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -1,5 +1,6 @@
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
 import { SimIamPolicyStatementMatcher } from "./match/sim-iam-policy-statement-matcher.js";
+import { SimIamAllowStatements } from "./allow/sim-iam-allow-statements.js";
 export const SimIamPolicyDecisionValue = {
     ExplicitDeny: "ExplicitDeny",
     Allow: "Allow",
@@ -13,10 +14,11 @@ export const SimIamPolicyDecisionValue = {
  * evaluate permissions boundaries, evaluate SCPs, or enforce service command
  * access.
  *
- * The simulator currently models the common IAM authorization union:
+ * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
- * - an Allow in an identity policy or resource policy allows the request;
+ * - the Allows found must satisfy the request's allow requirement, which is
+ *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
  * Resource policies are expected to be supplied by the service that owns the
@@ -27,8 +29,7 @@ export class SimIamPolicyDecision {
     policyDocumentParser;
     statementMatcher;
     explicitDenyStatementRecords = [];
-    allowStatementRecords = [];
-    trustAllowStatementRecords = [];
+    allows = new SimIamAllowStatements();
     constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
         this.request = request;
         this.policyDocumentParser = policyDocumentParser;
@@ -51,7 +52,7 @@ export class SimIamPolicyDecision {
         if (this.explicitDenyStatementRecords.length > 0) {
             return SimIamPolicyDecisionValue.ExplicitDeny;
         }
-        if (this.allowStatementRecords.length > 0) {
+        if (this.request.allowRequirement.isSatisfiedBy(this.allows.sides)) {
             return SimIamPolicyDecisionValue.Allow;
         }
         return SimIamPolicyDecisionValue.ImplicitDeny;
@@ -86,7 +87,7 @@ export class SimIamPolicyDecision {
      * An identity-policy Allow cannot substitute for the target role's trust.
      */
     get isAllowedByTrustPolicy() {
-        return this.trustAllowStatementRecords.length > 0;
+        return this.allows.trust.length > 0;
     }
     /**
      * Matching explicit Deny statements.
@@ -95,16 +96,32 @@ export class SimIamPolicyDecision {
         return this.explicitDenyStatementRecords;
     }
     /**
-     * Matching Allow statements.
+     * Matching Allow statements, from both policy sides.
+     *
+     * A statement appearing here did match the request. It does not follow that
+     * the request was allowed: a cross-Account request needs a matching Allow
+     * from each side.
      */
     get allowStatements() {
-        return this.allowStatementRecords;
+        return this.allows.all;
+    }
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identityAllowStatements() {
+        return this.allows.identity;
+    }
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resourceAllowStatements() {
+        return this.allows.resource;
     }
     /**
      * Matching Allow statements originating from trust policies.
      */
     get trustAllowStatements() {
-        return this.trustAllowStatementRecords;
+        return this.allows.trust;
     }
     evaluate() {
         for (const policy of [
@@ -124,10 +141,7 @@ export class SimIamPolicyDecision {
                 this.explicitDenyStatementRecords.push(statement.source);
                 continue;
             }
-            this.allowStatementRecords.push(statement.source);
-            if (policy.sourceType === "trust") {
-                this.trustAllowStatementRecords.push(statement.source);
-            }
+            this.allows.record(policy, statement.source);
         }
     }
 }

package/dist/service/iam/authorize/sim-iam-decision.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAG3F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,qBAAqB,GAAoC,EAAE,CAAC;IAC5D,0BAA0B,GACzC,EAAE,CAAC;IAEL,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAElD,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEtD,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/command/sim-iam-command-handlers.d.ts

@@ -0,0 +1,41 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimArn } from "../../aws/arn.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamInterServiceAuthZ } from "../authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamCredentialRegistry } from "../credential/sim-iam-credential-registry.js";
+import type { SimIamUserCredentialGenerator } from "../credential/user/sim-iam-user-credential-generator.js";
+import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
+import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
+import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
+import { SimIamPolicyCommandHandlers } from "./policy/sim-iam-policy-command-handlers.js";
+import { SimIamRoleCommandHandlers } from "./role/sim-iam-role-command-handlers.js";
+import { SimIamUserCommandHandlers } from "./user/sim-iam-user-command-handlers.js";
+interface SimIamCommandHandlersProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly policies: Map<SimArn, SimIamManagedPolicy>;
+    readonly roles: Map<SimIamRoleName, SimIamRole>;
+    readonly users: Map<SimIamUsername, SimIamUser>;
+    readonly credentialRegistry: SimIamCredentialRegistry;
+    readonly userCredentialGenerator: SimIamUserCredentialGenerator;
+    readonly background: BackgroundScheduler;
+    /**
+     * IAM itself, which authorizes its own control-plane commands.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * The command handlers of one simulated IAM Account, grouped by resource.
+ *
+ * Every group authorizes against the same IAM and mutates the same Account
+ * state, so they are wired together here rather than one at a time in the
+ * service facade. That keeps SimIam what it should be: state maps plus
+ * delegation.
+ */
+export declare class SimIamCommandHandlers {
+    readonly roles: SimIamRoleCommandHandlers;
+    readonly users: SimIamUserCommandHandlers;
+    readonly policies: SimIamPolicyCommandHandlers;
+    constructor(properties: SimIamCommandHandlersProperties);
+}
+export {};
+//# sourceMappingURL=sim-iam-command-handlers.d.ts.map

package/dist/service/iam/command/sim-iam-command-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-command-handlers.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/command/sim-iam-command-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,UAAU,+BAA+B;IACvC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;IAChE,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAEzC;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAE/C,YAAY,UAAU,EAAE,+BAA+B,EAwBtD;CACF"}