@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.js

@@ -0,0 +1,33 @@
+import { SimIamCrossAccountCaller } from "./sim-iam-cross-account-caller.js";
+import { SimIamSameAccountCaller } from "./sim-iam-same-account-caller.js";
+/**
+ * Works out which Account owns the caller of an authorization request.
+ *
+ * The answer decides how the request is evaluated, so it is made once, here,
+ * from the resolved caller. A caller with no Account in its ARN — a service
+ * principal or an anonymous request — has no identity side and is treated as
+ * belonging to the evaluating Account, which leaves it to be allowed by a
+ * resource policy alone.
+ */
+export class SimIamCallerAccountResolver {
+    accountId;
+    iamResolver;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.iamResolver = properties.iamResolver;
+    }
+    /**
+     * Resolve the caller's Account relative to the Account owning the resource.
+     */
+    resolve(caller) {
+        const callerAccountId = caller.accountId;
+        if (callerAccountId === undefined || callerAccountId === this.accountId) {
+            return new SimIamSameAccountCaller();
+        }
+        return new SimIamCrossAccountCaller({
+            principal: caller.identityPolicyPrincipal,
+            callerAccountIam: this.iamResolver?.findIamForAccount(callerAccountId),
+        });
+    }
+}
+//# sourceMappingURL=sim-iam-caller-account-resolver.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account-resolver.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAiB3E;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,SAAS,CAAkB;IAC3B,WAAW,CAAqC;IAEjE,YAAY,UAAiD;QAC3D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAA4B;QAClC,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;QAEzC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACxE,OAAO,IAAI,uBAAuB,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,wBAAwB,CAAC;YAClC,SAAS,EAAE,MAAM,CAAC,uBAAuB;YACzC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CACnD,eAAkC,CACnC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.d.ts

@@ -0,0 +1,21 @@
+import type { SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+/**
+ * What the Account owning the caller contributes to an authorization request.
+ *
+ * The Account evaluating a request owns the resource. Whether the caller
+ * belongs to that same Account decides two things at once: which identity
+ * policies are in scope, and how an Allow from each side is combined. Both
+ * answers come from here so they cannot disagree.
+ */
+export interface SimIamCallerAccount {
+    /**
+     * Identity policies contributed by the caller's own Account.
+     */
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * How identity and resource Allows combine for this caller.
+     */
+    readonly allowRequirement: SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-caller-account.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;CACnD"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-caller-account.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account.ts"],"names":[],"mappings":""}

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamAccountIdentityPolicies } from "../identity/sim-iam-account-identity-policies.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+interface SimIamCrossAccountCallerProperties {
+    /**
+     * The identity whose policies apply to the request, in the caller's Account.
+     */
+    readonly principal: SimAwsPrincipal;
+    /**
+     * Simulated IAM of the Account owning the caller, when the simulation has it.
+     */
+    readonly callerAccountIam?: SimIamAccountIdentityPolicies | undefined;
+}
+/**
+ * A caller belonging to a different Account from the resource.
+ *
+ * AWS decides such a request in both Accounts, so the identity policies of the
+ * caller's own Account are pulled in and both sides are then required to allow.
+ * A resource policy naming another Account's principal delegates to that
+ * Account rather than granting on its own behalf.
+ *
+ * An Account the simulation knows nothing about contributes no identity
+ * policies, which denies the request. That matches AWS for the case it
+ * represents: a principal ARN that was never given any permissions.
+ */
+export declare class SimIamCrossAccountCaller implements SimIamCallerAccount {
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    readonly allowRequirement: SimIamAllowRequirement;
+    constructor(properties: SimIamCrossAccountCallerProperties);
+}
+export {};
+//# sourceMappingURL=sim-iam-cross-account-caller.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-cross-account-caller.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-cross-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,UAAU,kCAAkC;IAC1C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CACvE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CACT;IAExC,YAAY,UAAU,EAAE,kCAAkC,EAKzD;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.js

@@ -0,0 +1,22 @@
+import { SimIamBothSidesAllowRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * A caller belonging to a different Account from the resource.
+ *
+ * AWS decides such a request in both Accounts, so the identity policies of the
+ * caller's own Account are pulled in and both sides are then required to allow.
+ * A resource policy naming another Account's principal delegates to that
+ * Account rather than granting on its own behalf.
+ *
+ * An Account the simulation knows nothing about contributes no identity
+ * policies, which denies the request. That matches AWS for the case it
+ * represents: a principal ARN that was never given any permissions.
+ */
+export class SimIamCrossAccountCaller {
+    identityPolicies;
+    allowRequirement = new SimIamBothSidesAllowRequirement();
+    constructor(properties) {
+        this.identityPolicies =
+            properties.callerAccountIam?.identityPolicySourcesFor(properties.principal) ?? [];
+    }
+}
+//# sourceMappingURL=sim-iam-cross-account-caller.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-cross-account-caller.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-cross-account-caller.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAiB/C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAC1B,gBAAgB,CAAqC;IAErD,gBAAgB,GACvB,IAAI,+BAA+B,EAAE,CAAC;IAExC,YAAY,UAA8C;QACxD,IAAI,CAAC,gBAAgB;YACnB,UAAU,CAAC,gBAAgB,EAAE,wBAAwB,CACnD,UAAU,CAAC,SAAS,CACrB,IAAI,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.d.ts

@@ -0,0 +1,18 @@
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+/**
+ * A caller decided entirely within the Account that owns the resource.
+ *
+ * This covers a principal belonging to that Account, and callers with no
+ * identity side at all: a service principal or an anonymous request, which AWS
+ * allows on a resource policy alone.
+ *
+ * The Account's own IAM state already holds every identity policy in scope, so
+ * nothing is contributed here.
+ */
+export declare class SimIamSameAccountCaller implements SimIamCallerAccount {
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    readonly allowRequirement: SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-same-account-caller.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-same-account-caller.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-same-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAM;IAEnE,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CACR;CAC1C"}

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.js

@@ -0,0 +1,16 @@
+import { SimIamEitherSideAllowRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * A caller decided entirely within the Account that owns the resource.
+ *
+ * This covers a principal belonging to that Account, and callers with no
+ * identity side at all: a service principal or an anonymous request, which AWS
+ * allows on a resource policy alone.
+ *
+ * The Account's own IAM state already holds every identity policy in scope, so
+ * nothing is contributed here.
+ */
+export class SimIamSameAccountCaller {
+    identityPolicies = [];
+    allowRequirement = new SimIamEitherSideAllowRequirement();
+}
+//# sourceMappingURL=sim-iam-same-account-caller.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-same-account-caller.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-same-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gCAAgC,GACjC,MAAM,uCAAuC,CAAC;AAI/C;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACzB,gBAAgB,GAAuC,EAAE,CAAC;IAE1D,gBAAgB,GACvB,IAAI,gCAAgC,EAAE,CAAC;CAC1C"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts

@@ -0,0 +1,17 @@
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamCallerAccount } from "../caller-account/sim-iam-caller-account.js";
+/**
+ * Works out which allow rules apply to one authorization request.
+ *
+ * Two things decide it, and both have to hold. The caller's Account says whose
+ * Allow counts: either side within one Account, both sides across Accounts.
+ * The resource-owning service says whether its resource insists on allowing,
+ * which is true of a KMS key and of nothing else so far.
+ */
+export declare class SimIamAuthZAllowRequirement {
+    /**
+     * The rule a request is subject to.
+     */
+    resolve(callerAccount: SimIamCallerAccount, requiresResourcePolicyAllow: boolean | undefined): SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-auth-z-allow-requirement.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sBAAsB,EAG5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAEvF;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC;;OAEG;IACH,OAAO,CACL,aAAa,EAAE,mBAAmB,EAClC,2BAA2B,EAAE,OAAO,GAAG,SAAS,GAC/C,sBAAsB,CASxB;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js

@@ -0,0 +1,24 @@
+import { SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * Works out which allow rules apply to one authorization request.
+ *
+ * Two things decide it, and both have to hold. The caller's Account says whose
+ * Allow counts: either side within one Account, both sides across Accounts.
+ * The resource-owning service says whether its resource insists on allowing,
+ * which is true of a KMS key and of nothing else so far.
+ */
+export class SimIamAuthZAllowRequirement {
+    /**
+     * The rule a request is subject to.
+     */
+    resolve(callerAccount, requiresResourcePolicyAllow) {
+        if (requiresResourcePolicyAllow !== true) {
+            return callerAccount.allowRequirement;
+        }
+        return new SimIamEveryAllowRequirement([
+            callerAccount.allowRequirement,
+            new SimIamMandatoryResourcePolicyRequirement(),
+        ]);
+    }
+}
+//# sourceMappingURL=sim-iam-auth-z-allow-requirement.js.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,2BAA2B,EAC3B,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAG/C;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACH,OAAO,CACL,aAAkC,EAClC,2BAAgD;QAEhD,IAAI,2BAA2B,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,aAAa,CAAC,gBAAgB,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC;YACrC,aAAa,CAAC,gBAAgB;YAC9B,IAAI,wCAAwC,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,7 +1,7 @@
 import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
-interface SimIamAuthZCallerContext {
+export interface SimIamAuthZCallerContext {
     readonly caller: SimAwsResolvedCaller;
     readonly rootPolicySources: readonly SimIamAuthZPolicySource[];
 }
@@ -26,5 +26,4 @@ export declare class SimIamAuthZCallerContextBuilder {
      */
     private rootPolicySources;
 }
-export {};
 //# sourceMappingURL=sim-iam-auth-z-caller-context-builder.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-caller-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,EAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAChE;AAED;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAEzD,YACE,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAI7D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,wBAAwB,CAUhE;IAED;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA2B1B"}
+{"version":3,"file":"sim-iam-auth-z-caller-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,EAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAChE;AAED;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAEzD,YACE,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAI7D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,wBAAwB,CAUhE;IAED;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA2B1B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,8 +1,10 @@
 import type { SimArn } from "../../../aws/arn.js";
 import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
 import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
-import type { SimIamAuthZContext, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
+import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
 export interface SimIamResourcePolicyInput {
@@ -42,6 +44,30 @@ export interface SimIamAuthorizationInput {
      * service-level resource policy.
      */
     readonly resourcePolicies?: readonly SimIamResourcePolicyInput[] | undefined;
+    /**
+     * Whether the resource's own policy must allow the request.
+     *
+     * Off by default, which is the ordinary AWS rule: a resource with no policy
+     * leaves the decision to the caller's identity policies. A service sets it
+     * for a resource whose policy is mandatory and is the root of trust for
+     * reaching it, which in AWS means a KMS key policy.
+     */
+    readonly requiresResourcePolicyAllow?: boolean | undefined;
+}
+interface SimIamAuthZContextBuilderProperties {
+    /**
+     * The Account whose IAM is evaluating the request.
+     */
+    readonly accountId: SimAwsAccountId;
+    readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
+    readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
+    readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
+    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * Resolves other Accounts' IAM in the same simulation, for the identity side
+     * of a cross-Account request.
+     */
+    readonly iamResolver?: SimIamAccountResolver | undefined;
 }
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
@@ -55,6 +81,11 @@ export interface SimIamAuthorizationInput {
  * finding a principal role, reading inline policies from the role, resolving
  * attached managed policy ARNs, and parsing stored policy documents.
  *
+ * Whose identity policies are in scope depends on which Account owns the
+ * caller, which SimIamCallerAccountResolver decides. A caller from another
+ * Account brings that Account's identity policies with it, along with the rule
+ * that both sides must then allow the request.
+ *
  * Resource policies are supplied by the service that owns the target resource.
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
@@ -67,11 +98,26 @@ export interface SimIamAuthorizationInput {
 export declare class SimIamAuthZContextBuilder {
     private readonly callerContextBuilder;
     private readonly identityPolicyCoordinator;
-    constructor(policies: ReadonlyMap<SimArn, SimIamPolicy>, roles: ReadonlyMap<SimIamRoleName, SimIamRole>, users: ReadonlyMap<SimIamUsername, SimIamUser>, defaultCallerPrincipal: SimAwsPrincipal, credentialIdentityResolver: SimAwsCredentialIdentityResolver);
+    private readonly callerAccountResolver;
+    private readonly allowRequirement;
+    constructor(properties: SimIamAuthZContextBuilderProperties);
     /**
      * Build the context consumed by SimIamAuthorizer.
      */
     build(input: SimIamAuthorizationInput): SimIamAuthZContext;
+    /**
+     * Identity policy sources this Account applies to one of its own principals.
+     *
+     * This is the identity side of a request within one Account, and is also what
+     * another Account's IAM asks for when it is deciding a cross-Account request
+     * against a principal belonging to this one.
+     */
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
+    /**
+     * Combine stored identity policies with any implied by the caller itself,
+     * such as the unrestricted access held by this Account's root principal.
+     */
+    private ownIdentityPolicySources;
     /**
      * Combine service-provided condition values with global values that IAM can
      * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
@@ -91,4 +137,5 @@ export declare class SimIamAuthZContextBuilder {
      */
     private resourcePolicySources;
 }
+export {};
 //# sourceMappingURL=sim-iam-auth-z-context-builder.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAElB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;CAC9E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IAEjF,YACE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAC3C,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,EAC9C,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,EAC9C,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAW7D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAgBzD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -1,5 +1,8 @@
+import { makeSimAwsAccountRootPrincipal } from "../../../aws/caller/sim-aws-account-root-principal.js";
+import { SimIamCallerAccountResolver } from "../caller-account/sim-iam-caller-account-resolver.js";
+import { SimIamAuthZAllowRequirement } from "./sim-iam-auth-z-allow-requirement.js";
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
-import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context-builder.js";
+import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
  *
@@ -12,6 +15,11 @@ import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context
  * finding a principal role, reading inline policies from the role, resolving
  * attached managed policy ARNs, and parsing stored policy documents.
  *
+ * Whose identity policies are in scope depends on which Account owns the
+ * caller, which SimIamCallerAccountResolver decides. A caller from another
+ * Account brings that Account's identity policies with it, along with the rule
+ * that both sides must then allow the request.
+ *
  * Resource policies are supplied by the service that owns the target resource.
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
@@ -24,12 +32,18 @@ import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context
 export class SimIamAuthZContextBuilder {
     callerContextBuilder;
     identityPolicyCoordinator;
-    constructor(policies, roles, users, defaultCallerPrincipal, credentialIdentityResolver) {
-        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(defaultCallerPrincipal, credentialIdentityResolver);
+    callerAccountResolver;
+    allowRequirement = new SimIamAuthZAllowRequirement();
+    constructor(properties) {
+        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
-            policies,
-            roles,
-            users,
+            policies: properties.policies,
+            roles: properties.roles,
+            users: properties.users,
+        });
+        this.callerAccountResolver = new SimIamCallerAccountResolver({
+            accountId: properties.accountId,
+            iamResolver: properties.iamResolver,
         });
     }
     /**
@@ -37,18 +51,40 @@ export class SimIamAuthZContextBuilder {
      */
     build(input) {
         const callerContext = this.callerContextBuilder.build(input.caller);
+        const callerAccount = this.callerAccountResolver.resolve(callerContext.caller);
         return {
             identityPolicies: [
-                ...this.identityPolicyCoordinator.build(callerContext.caller.identityPolicyArn),
-                ...callerContext.rootPolicySources,
+                ...this.ownIdentityPolicySources(callerContext),
+                ...callerAccount.identityPolicies,
             ],
             resourcePolicies: this.resourcePolicySources(input),
+            allowRequirement: this.allowRequirement.resolve(callerAccount, input.requiresResourcePolicyAllow),
             action: input.action,
             resource: input.resource,
             conditionContext: this.conditionContext(input, callerContext.caller),
             caller: callerContext.caller,
         };
     }
+    /**
+     * Identity policy sources this Account applies to one of its own principals.
+     *
+     * This is the identity side of a request within one Account, and is also what
+     * another Account's IAM asks for when it is deciding a cross-Account request
+     * against a principal belonging to this one.
+     */
+    identityPolicySourcesFor(principal) {
+        return this.ownIdentityPolicySources(this.callerContextBuilder.build(principal));
+    }
+    /**
+     * Combine stored identity policies with any implied by the caller itself,
+     * such as the unrestricted access held by this Account's root principal.
+     */
+    ownIdentityPolicySources(callerContext) {
+        return [
+            ...this.identityPolicyCoordinator.build(callerContext.caller.identityPolicyArn),
+            ...callerContext.rootPolicySources,
+        ];
+    }
     /**
      * Combine service-provided condition values with global values that IAM can
      * derive from the resolved caller. AWS:PrincipalArn identifies the IAM

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAsD7F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAEjF,YACE,QAA2C,EAC3C,KAA8C,EAC9C,KAA8C,EAC9C,sBAAuC,EACvC,0BAA4D;QAE5D,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,sBAAsB,EACtB,0BAA0B,CAC3B,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ;YACR,KAAK;YACL,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;gBACD,GAAG,aAAa,CAAC,iBAAiB;aACnC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAapF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AAkFpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IACnD,gBAAgB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEtE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAC7C,aAAa,EACb,KAAK,CAAC,2BAA2B,CAClC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts

@@ -1,6 +1,7 @@
 import type { SimArn } from "../../../aws/arn.js";
 import type { SimIamConditionValue, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
 export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session";
 export interface SimIamAuthZPolicySource {
     readonly sourceType: SimIamAuthZPolicySourceType;
@@ -28,6 +29,14 @@ export interface SimIamAuthZContext {
      * Resource policies are not gathered from IAM's managed policy store.
      */
     readonly resourcePolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * How an Allow from each policy side combines into the final decision.
+     *
+     * Within one Account either side is enough. A cross-Account request needs
+     * both, because each Account only speaks for its own principals and
+     * resources.
+     */
+    readonly allowRequirement: SimIamAllowRequirement;
     readonly action: string;
     readonly resource: string;
     readonly conditionContext: Readonly<Record<string, SimIamConditionValue>>;

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAE3F,MAAM,MAAM,2BAA2B,GACnC,iBAAiB,GACjB,kBAAkB,GAClB,UAAU,GACV,OAAO,GACP,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,uBAAuB,EACvB,YAAY,CACb,GAAG;IACF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAE1E;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC"}
+{"version":3,"file":"sim-iam-auth-z-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAEpF,MAAM,MAAM,2BAA2B,GACnC,iBAAiB,GACjB,kBAAkB,GAClB,UAAU,GACV,OAAO,GACP,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,uBAAuB,EACvB,YAAY,CACb,GAAG;IACF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;IAElD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAE1E;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EACV,kBAAkB,EAClB,+BAA+B,EAChC,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,yBAAyB,mCAkBpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sCAAsC,gDAW/C,CAAC"}
+{"version":3,"file":"sim-iam-auth-z-context.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EACV,kBAAkB,EAClB,+BAA+B,EAChC,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,yBAAyB,mCAmBpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sCAAsC,gDAW/C,CAAC"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js

@@ -1,10 +1,12 @@
 import { StaticFactory } from "@kensio/part-factory";
+import { SimIamEitherSideAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
 /**
  * Generates simulated IAM authorization contexts for tests.
  */
 export const simIamAuthZContextFactory = new StaticFactory({
     identityPolicies: [],
     resourcePolicies: [],
+    allowRequirement: new SimIamEitherSideAllowRequirement(),
     action: "s3:GetObject",
     resource: "arn:aws:s3:::test-bucket/test-key",
     conditionContext: {},

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context.factory.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAMrD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,aAAa,CAAqB;IAC7E,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,mCAAmC;IAC7C,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE;QACN,uBAAuB,EAAE;YACvB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,SAAS,EAAE;YACT,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,GAAG,EAAE,yCAAyC;QAC9C,SAAS,EAAE,cAAc;KAC1B;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,aAAa,CAAkC;IACjD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE;QACR,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,mCAAmC;SAC9C;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"sim-iam-auth-z-context.factory.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAMzF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,aAAa,CAAqB;IAC7E,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,IAAI,gCAAgC,EAAE;IACxD,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,mCAAmC;IAC7C,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE;QACN,uBAAuB,EAAE;YACvB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,SAAS,EAAE;YACT,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,GAAG,EAAE,yCAAyC;QAC9C,SAAS,EAAE,cAAc;KAC1B;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,aAAa,CAAkC;IACjD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE;QACR,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,mCAAmC;SAC9C;KACF;CACF,CAAC,CAAC"}

package/dist/service/iam/authorize/identity/sim-iam-account-identity-policies.d.ts

@@ -0,0 +1,14 @@
+import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+/**
+ * Identity-based policy discovery for principals belonging to one Account.
+ *
+ * This is the capability one Account's IAM needs from another Account's IAM to
+ * decide a cross-Account request: the policies the caller's own Account applies
+ * to its own principal. SimIam implements it, so a resource-owning Account can
+ * ask the caller's Account without depending on the whole service facade.
+ */
+export interface SimIamAccountIdentityPolicies {
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
+}
+//# sourceMappingURL=sim-iam-account-identity-policies.d.ts.map

package/dist/service/iam/authorize/identity/sim-iam-account-identity-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-identity-policies.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/identity/sim-iam-account-identity-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAAC;CACvC"}

package/dist/service/iam/authorize/identity/sim-iam-account-identity-policies.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-account-identity-policies.js.map

package/dist/service/iam/authorize/identity/sim-iam-account-identity-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-identity-policies.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/identity/sim-iam-account-identity-policies.ts"],"names":[],"mappings":""}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -1,5 +1,6 @@
 import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
 import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
 /**
  * Matches the principal portion of an IAM policy statement.
  *
@@ -27,7 +28,7 @@ export declare class SimIamPolicyPrincipalMatcher {
      * Resource and trust policies require Principal or NotPrincipal because the
      * policy must state which callers it applies to.
      */
-    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): SimIamPrincipalMatch;
     /**
      * Check each Principal representation supported by the parsed policy model.
      *
@@ -36,6 +37,10 @@ export declare class SimIamPolicyPrincipalMatcher {
      * delegation, while Service values match service principals.
      */
     private valueMatches;
+    /**
+     * The winning match among alternatives, since Principal lists are an OR.
+     */
+    private firstMatch;
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAiBT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA2BpB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}
+{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,oBAAoB,CAqBtB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAiCpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAyBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}