@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js

@@ -1,4 +1,5 @@
 import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
 /**
  * Matches the principal portion of an IAM policy statement.
  *
@@ -30,16 +31,18 @@ export class SimIamPolicyPrincipalMatcher {
      */
     matches(policy, statement) {
         if (policy.sourceType !== "resource" && policy.sourceType !== "trust") {
-            return (statement.principal === undefined &&
+            return SimIamPrincipalMatch.direct().when(statement.principal === undefined &&
                 statement.notPrincipal === undefined);
         }
         if (statement.principal !== undefined) {
             return this.valueMatches(statement.principal);
         }
         if (statement.notPrincipal !== undefined) {
-            return !this.valueMatches(statement.notPrincipal);
+            // Excluding the caller says nothing about the Account delegating, so a
+            // NotPrincipal that leaves the caller in is a direct grant.
+            return SimIamPrincipalMatch.direct().when(!this.valueMatches(statement.notPrincipal).matched);
         }
-        return false;
+        return SimIamPrincipalMatch.none();
     }
     /**
      * Check each Principal representation supported by the parsed policy model.
@@ -53,20 +56,26 @@ export class SimIamPolicyPrincipalMatcher {
             return this.awsPatternMatches(principal);
         }
         if (Array.isArray(principal)) {
-            return principal.some((value) => this.awsPatternMatches(value));
+            return this.firstMatch(principal, (value) => this.awsPatternMatches(value));
         }
-        return Object.entries(principal).some(([principalType, values]) => {
+        return this.firstMatch(Object.entries(principal), ([type, values]) => {
             const patterns = typeof values === "string" ? [values] : values;
-            if (principalType === "AWS") {
-                return patterns.some((pattern) => this.awsPatternMatches(pattern));
+            if (type === "AWS") {
+                return this.firstMatch(patterns, (pattern) => this.awsPatternMatches(pattern));
             }
             /* v8 ignore if -- service principals not yet fully supported */
-            if (principalType === "Service") {
-                return patterns.some((pattern) => this.servicePatternMatches(pattern));
+            if (type === "Service") {
+                return this.firstMatch(patterns, (pattern) => this.servicePatternMatches(pattern));
             }
-            return false;
+            return SimIamPrincipalMatch.none();
         });
     }
+    /**
+     * The winning match among alternatives, since Principal lists are an OR.
+     */
+    firstMatch(values, match) {
+        return SimIamPrincipalMatch.first(values.map((value) => match(value)));
+    }
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *
@@ -76,19 +85,19 @@ export class SimIamPolicyPrincipalMatcher {
      */
     awsPatternMatches(pattern) {
         if (pattern === "*") {
-            return true;
+            return SimIamPrincipalMatch.direct();
         }
         const caller = this.context.caller;
         if (caller.arn === undefined) {
-            return false;
+            return SimIamPrincipalMatch.none();
         }
         const delegatedAccountId = this.delegatedAccountId(pattern);
         if (delegatedAccountId !== undefined) {
-            return caller.accountId === delegatedAccountId;
+            return SimIamPrincipalMatch.accountDelegation().when(caller.accountId === delegatedAccountId);
         }
-        return simIamWildcardMatch(pattern, caller.arn, {
+        return SimIamPrincipalMatch.direct().when(simIamWildcardMatch(pattern, caller.arn, {
             caseSensitive: true,
-        });
+        }));
     }
     /**
      * Compare a service principal pattern with the resolved caller.
@@ -97,7 +106,7 @@ export class SimIamPolicyPrincipalMatcher {
         /* v8 ignore next -- service principals not yet fully supported */
         const service = this.context.caller.service;
         /* v8 ignore next -- service principals not yet fully supported */
-        return (service !== undefined &&
+        return SimIamPrincipalMatch.direct().when(service !== undefined &&
             simIamWildcardMatch(pattern, service, {
                 caseSensitive: true,
             }));

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-principal-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,CACL,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,CACrC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,SAAwC;QAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAC/C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEhE,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;YACrE,CAAC;YAED,gEAAgE;YAChE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,OAAe;QACvC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAC;QACjD,CAAC;QAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE;YAC9C,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,OAAe;QAC3C,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAE5C,kEAAkE;QAClE,OAAO,CACL,OAAO,KAAK,SAAS;YACrB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;gBACpC,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,OAAe;QACxC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"sim-iam-policy-principal-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,SAAS,CAAC,SAAS,KAAK,SAAS;gBAC/B,SAAS,CAAC,YAAY,KAAK,SAAS,CACvC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,uEAAuE;YACvE,4DAA4D;YAC5D,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CACnD,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAClB,SAAwC;QAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAClD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YACnE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEhE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAChC,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CACpC,CAAC;YACJ,CAAC;YAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,MAAoB,EACpB,KAAyC;QAEzC,OAAO,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,OAAe;QACvC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAClD,MAAM,CAAC,SAAS,KAAK,kBAAkB,CACxC,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE;YACvC,aAAa,EAAE,IAAI;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,OAAe;QAC3C,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAE5C,kEAAkE;QAClE,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,OAAO,KAAK,SAAS;YACnB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;gBACpC,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,OAAe;QACxC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts

@@ -1,5 +1,6 @@
 import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
 import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
 /**
  * Matches one parsed IAM policy statement against one authorization request.
  *
@@ -30,7 +31,7 @@ export declare class SimIamPolicyStatementMatcher {
      * evaluating later sections after an earlier constraint has rejected the
      * statement.
      */
-    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): SimIamPrincipalMatch;
     /**
      * Check Action or NotAction against the requested IAM action.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAKjG;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA4B;IAI3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAEhE,YAA6B,OAAO,EAAE,kBAAkB,EAKvD;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAOT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAwBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAuBxB"}
+{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAIjG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA4B;IAI3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAEhE,YAA6B,OAAO,EAAE,kBAAkB,EAKvD;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,oBAAoB,CAStB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAwBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAuBxB"}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js

@@ -36,7 +36,8 @@ export class SimIamPolicyStatementMatcher {
      * statement.
      */
     matches(policy, statement) {
-        return (this.principalMatcher.matches(policy, statement) &&
+        const principal = this.principalMatcher.matches(policy, statement);
+        return principal.when(principal.matched &&
             this.actionMatches(statement) &&
             this.resourceMatches(policy, statement) &&
             this.conditionMatcher.matches(statement.condition));

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-statement-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,4BAA4B;IAIV,OAAO;IAHnB,gBAAgB,CAA+B;IAC/C,gBAAgB,CAA+B;IAEhE,YAA6B,OAA2B;uBAA3B,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CACtD,OAAO,CAAC,gBAAgB,CACzB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,OAAO,CACL,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CACnD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAsC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,CAC/B,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACjD,aAAa,EAAE,KAAK;aACrB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CACrB,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CACjC,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACnD,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-iam-policy-statement-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAGrF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,4BAA4B;IAIV,OAAO;IAHnB,gBAAgB,CAA+B;IAC/C,gBAAgB,CAA+B;IAEhE,YAA6B,OAA2B;uBAA3B,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CACtD,OAAO,CAAC,gBAAgB,CACzB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAEnE,OAAO,SAAS,CAAC,IAAI,CACnB,SAAS,CAAC,OAAO;YACf,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CACrD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAsC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,CAC/B,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACjD,aAAa,EAAE,KAAK;aACrB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CACrB,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CACjC,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACnD,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IACvC,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-principal-match.d.ts

@@ -0,0 +1,39 @@
+/**
+ * How a resource-policy statement came to apply to the caller.
+ *
+ * AWS treats these two differently. A statement naming the caller's own ARN is
+ * a grant to that principal. A statement naming the Account, as a bare account
+ * ID or a root ARN, delegates the decision to that Account's IAM rather than
+ * granting anything by itself. Most of this simulator does not yet act on the
+ * difference; a KMS key policy does, because it is the whole reason the
+ * default key policy does not make a key usable by everyone in the Account.
+ */
+export declare class SimIamPrincipalMatch {
+    readonly matched: boolean;
+    readonly isAccountDelegation: boolean;
+    private constructor();
+    /**
+     * The statement does not apply to this caller.
+     */
+    static none(): SimIamPrincipalMatch;
+    /**
+     * The statement names this caller, or applies without naming an Account.
+     */
+    static direct(): SimIamPrincipalMatch;
+    /**
+     * The statement applies by way of the caller's Account.
+     */
+    static accountDelegation(): SimIamPrincipalMatch;
+    /**
+     * The first match among alternatives, since Principal lists are an OR.
+     *
+     * A direct match wins over a delegated one where both apply, because a
+     * statement naming the caller grants to the caller whatever else it says.
+     */
+    static first(matches: readonly SimIamPrincipalMatch[]): SimIamPrincipalMatch;
+    /**
+     * A match of the same kind, or none, according to a condition.
+     */
+    when(matched: boolean): SimIamPrincipalMatch;
+}
+//# sourceMappingURL=sim-iam-principal-match.d.ts.map

package/dist/service/iam/authorize/match/sim-iam-principal-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-principal-match.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-principal-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,mBAAmB,EAAE,OAAO,CAAC;IAE7C,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,IAAI,oBAAoB,CAElC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAEpC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,IAAI,oBAAoB,CAE/C;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,GAAG,oBAAoB,CAQ3E;IAED;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAE3C;CACF"}

package/dist/service/iam/authorize/match/sim-iam-principal-match.js

@@ -0,0 +1,55 @@
+/**
+ * How a resource-policy statement came to apply to the caller.
+ *
+ * AWS treats these two differently. A statement naming the caller's own ARN is
+ * a grant to that principal. A statement naming the Account, as a bare account
+ * ID or a root ARN, delegates the decision to that Account's IAM rather than
+ * granting anything by itself. Most of this simulator does not yet act on the
+ * difference; a KMS key policy does, because it is the whole reason the
+ * default key policy does not make a key usable by everyone in the Account.
+ */
+export class SimIamPrincipalMatch {
+    matched;
+    isAccountDelegation;
+    constructor(matched, isAccountDelegation) {
+        this.matched = matched;
+        this.isAccountDelegation = isAccountDelegation;
+    }
+    /**
+     * The statement does not apply to this caller.
+     */
+    static none() {
+        return new SimIamPrincipalMatch(false, false);
+    }
+    /**
+     * The statement names this caller, or applies without naming an Account.
+     */
+    static direct() {
+        return new SimIamPrincipalMatch(true, false);
+    }
+    /**
+     * The statement applies by way of the caller's Account.
+     */
+    static accountDelegation() {
+        return new SimIamPrincipalMatch(true, true);
+    }
+    /**
+     * The first match among alternatives, since Principal lists are an OR.
+     *
+     * A direct match wins over a delegated one where both apply, because a
+     * statement naming the caller grants to the caller whatever else it says.
+     */
+    static first(matches) {
+        const matched = matches.filter((result) => result.matched);
+        return (matched.find((result) => !result.isAccountDelegation) ??
+            matched[0] ??
+            this.none());
+    }
+    /**
+     * A match of the same kind, or none, according to a condition.
+     */
+    when(matched) {
+        return matched ? this : SimIamPrincipalMatch.none();
+    }
+}
+//# sourceMappingURL=sim-iam-principal-match.js.map

package/dist/service/iam/authorize/match/sim-iam-principal-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-principal-match.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-principal-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAoB;IACf,OAAO,CAAU;IACjB,mBAAmB,CAAU;IAE7C,YAAoB,OAAgB,EAAE,mBAA4B;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI;QACT,OAAO,IAAI,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB;QACtB,OAAO,IAAI,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,OAAwC;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3D,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACrD,OAAO,CAAC,CAAC,CAAC;YACV,IAAI,CAAC,IAAI,EAAE,CACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAgB;QACnB,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -1,10 +1,14 @@
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimArn } from "../../aws/arn.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
+import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
 import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
+import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
+import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 import type { SimIamPolicyDecision } from "./sim-iam-decision.js";
 interface SimIamAccountAuthZProperties {
     readonly accountId: SimAwsAccountId;
@@ -12,6 +16,14 @@ interface SimIamAccountAuthZProperties {
     readonly roles: Map<SimIamRoleName, SimIamRole>;
     readonly users: Map<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * Resolves other Accounts' IAM in the same simulation.
+     *
+     * A cross-Account request is decided in both Accounts, so the caller's own
+     * Account has to be reachable for its identity policies to count. A
+     * standalone SimIam has no simulation around it and so no resolver.
+     */
+    readonly iamResolver?: SimIamAccountResolver | undefined;
 }
 /**
  * Evaluates IAM authorization attempts against one simulated Account's IAM
@@ -21,7 +33,7 @@ interface SimIamAccountAuthZProperties {
  * the owning sim Account. An explicit anonymous caller suppresses that
  * fallback and is evaluated without identity policies.
  */
-export declare class SimIamAccountAuthZ {
+export declare class SimIamAccountAuthZ implements SimIamAccountIdentityPolicies {
     private readonly properties;
     constructor(properties: SimIamAccountAuthZProperties);
     /**
@@ -29,6 +41,17 @@ export declare class SimIamAccountAuthZ {
      * request caller.
      */
     authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
+    /**
+     * Identity policies this Account applies to one of its own principals.
+     */
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
+    /**
+     * Make an authorizer over this Account's current IAM state.
+     *
+     * The state maps are shared by reference, so a fresh authorizer sees every
+     * Role, User, and Policy created since the last request.
+     */
+    private authorizer;
 }
 export {};
 //# sourceMappingURL=sim-iam-account-auth-z.d.ts.map

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-account-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,UAAU,4BAA4B;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D,YAAY,UAAU,EAAE,4BAA4B,EAEnD;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAW/D;CACF"}
+{"version":3,"file":"sim-iam-account-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,UAAU,4BAA4B;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,6BAA6B;IACtE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D,YAAY,UAAU,EAAE,4BAA4B,EAEnD;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAEpC;IAED;;;;;OAKG;IACH,OAAO,CAAC,UAAU;CAUnB"}

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -1,4 +1,3 @@
-import { makeSimAwsAccountRootPrincipal } from "../../aws/caller/sim-aws-account-root-principal.js";
 import { SimIamAuthorizer } from "./sim-iam-authorizer.js";
 /**
  * Evaluates IAM authorization attempts against one simulated Account's IAM
@@ -18,14 +17,29 @@ export class SimIamAccountAuthZ {
      * request caller.
      */
     authorize(input) {
-        const simIamAuthorizer = new SimIamAuthorizer({
+        return this.authorizer().authorize(input);
+    }
+    /**
+     * Identity policies this Account applies to one of its own principals.
+     */
+    identityPolicySourcesFor(principal) {
+        return this.authorizer().identityPolicySourcesFor(principal);
+    }
+    /**
+     * Make an authorizer over this Account's current IAM state.
+     *
+     * The state maps are shared by reference, so a fresh authorizer sees every
+     * Role, User, and Policy created since the last request.
+     */
+    authorizer() {
+        return new SimIamAuthorizer({
+            accountId: this.properties.accountId,
             policies: this.properties.policies,
             roles: this.properties.roles,
             users: this.properties.users,
-            defaultCallerPrincipal: makeSimAwsAccountRootPrincipal(this.properties.accountId),
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
+            iamResolver: this.properties.iamResolver,
         });
-        return simIamAuthorizer.authorize(input);
     }
 }
 //# sourceMappingURL=sim-iam-account-auth-z.js.map

package/dist/service/iam/authorize/sim-iam-account-auth-z.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-account-auth-z.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AAOpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAY3D;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,UAAU,CAA+B;IAE1D,YAAY,UAAwC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,sBAAsB,EAAE,8BAA8B,CACpD,IAAI,CAAC,UAAU,CAAC,SAAS,CAC1B;YACD,0BAA0B,EAAE,IAAI,CAAC,UAAU,CAAC,0BAA0B;SACvE,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-iam-account-auth-z.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-account-auth-z.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAuB3D;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,UAAU,CAA+B;IAE1D,YAAY,UAAwC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACK,UAAU;QAChB,OAAO,IAAI,gBAAgB,CAAC;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;YACpC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,0BAA0B,EAAE,IAAI,CAAC,UAAU,CAAC,0BAA0B;YACtE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;SACzC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -6,12 +6,17 @@ import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
 import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
+import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
+import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 interface SimIamAuthorizerProperties {
+    readonly accountId: SimAwsAccountId;
     readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
     readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
-    readonly defaultCallerPrincipal: SimAwsPrincipal;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    readonly iamResolver?: SimIamAccountResolver | undefined;
 }
 /**
  * Facade for simulated IAM authorization decisions.
@@ -21,13 +26,17 @@ interface SimIamAuthorizerProperties {
  * each SimIamPolicyDecision instance keeps the state and diagnostics for one
  * evaluated authorization attempt.
  */
-export declare class SimIamAuthorizer {
+export declare class SimIamAuthorizer implements SimIamAccountIdentityPolicies {
     private readonly contextBuilder;
     constructor(properties: SimIamAuthorizerProperties);
     /**
      * Evaluate an IAM authorization request.
      */
     authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
+    /**
+     * Identity policies this Account applies to one of its own principals.
+     */
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
 }
 export {};
 //# sourceMappingURL=sim-iam-authorizer.d.ts.map

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAEpG,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,EAAE,eAAe,CAAC;IACjD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,UAAU,EAAE,0BAA0B,EAQjD;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;CACF"}
+{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAErG,UAAU,0BAA0B;IAClC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAiB,YAAW,6BAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,UAAU,EAAE,0BAA0B,EASjD;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAEpC;CACF"}

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -11,7 +11,14 @@ import { SimIamPolicyDecision } from "./sim-iam-decision.js";
 export class SimIamAuthorizer {
     contextBuilder;
     constructor(properties) {
-        this.contextBuilder = new SimIamAuthZContextBuilder(properties.policies, properties.roles, properties.users, properties.defaultCallerPrincipal, properties.credentialIdentityResolver);
+        this.contextBuilder = new SimIamAuthZContextBuilder({
+            accountId: properties.accountId,
+            policies: properties.policies,
+            roles: properties.roles,
+            users: properties.users,
+            credentialIdentityResolver: properties.credentialIdentityResolver,
+            iamResolver: properties.iamResolver,
+        });
     }
     /**
      * Evaluate an IAM authorization request.
@@ -19,5 +26,11 @@ export class SimIamAuthorizer {
     authorize(input) {
         return new SimIamPolicyDecision(this.contextBuilder.build(input));
     }
+    /**
+     * Identity policies this Account applies to one of its own principals.
+     */
+    identityPolicySourcesFor(principal) {
+        return this.contextBuilder.identityPolicySourcesFor(principal);
+    }
 }
 //# sourceMappingURL=sim-iam-authorizer.js.map

package/dist/service/iam/authorize/sim-iam-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAa7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,UAAsC;QAChD,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CACjD,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,KAAK,EAChB,UAAU,CAAC,KAAK,EAChB,UAAU,CAAC,sBAAsB,EACjC,UAAU,CAAC,0BAA0B,CACtC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAkB7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,UAAsC;QAChD,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CAAC;YAClD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;YACjE,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -16,10 +16,11 @@ export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof
  * evaluate permissions boundaries, evaluate SCPs, or enforce service command
  * access.
  *
- * The simulator currently models the common IAM authorization union:
+ * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
- * - an Allow in an identity policy or resource policy allows the request;
+ * - the Allows found must satisfy the request's allow requirement, which is
+ *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
  * Resource policies are expected to be supplied by the service that owns the
@@ -30,8 +31,7 @@ export declare class SimIamPolicyDecision {
     private readonly policyDocumentParser;
     private readonly statementMatcher;
     private readonly explicitDenyStatementRecords;
-    private readonly allowStatementRecords;
-    private readonly trustAllowStatementRecords;
+    private readonly allows;
     constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -71,9 +71,21 @@ export declare class SimIamPolicyDecision {
      */
     get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
     /**
-     * Matching Allow statements.
+     * Matching Allow statements, from both policy sides.
+     *
+     * A statement appearing here did match the request. It does not follow that
+     * the request was allowed: a cross-Account request needs a matching Allow
+     * from each side.
      */
     get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identityAllowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resourceAllowStatements(): readonly SimIamPolicyDocumentStatement[];
     /**
      * Matching Allow statements originating from trust policies.
      */

package/dist/service/iam/authorize/sim-iam-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAExF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAC7E,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CACtC;IAEL,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAoBvB"}
+{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAGxF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;;;;;OAMG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,uBAAuB,IAAI,SAAS,6BAA6B,EAAE,CAEtE;IAED;;OAEG;IACH,IAAI,uBAAuB,IAAI,SAAS,6BAA6B,EAAE,CAEtE;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAkBvB"}

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -1,5 +1,6 @@
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
 import { SimIamPolicyStatementMatcher } from "./match/sim-iam-policy-statement-matcher.js";
+import { SimIamAllowStatements } from "./allow/sim-iam-allow-statements.js";
 export const SimIamPolicyDecisionValue = {
     ExplicitDeny: "ExplicitDeny",
     Allow: "Allow",
@@ -13,10 +14,11 @@ export const SimIamPolicyDecisionValue = {
  * evaluate permissions boundaries, evaluate SCPs, or enforce service command
  * access.
  *
- * The simulator currently models the common IAM authorization union:
+ * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
- * - an Allow in an identity policy or resource policy allows the request;
+ * - the Allows found must satisfy the request's allow requirement, which is
+ *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
  * Resource policies are expected to be supplied by the service that owns the
@@ -27,8 +29,7 @@ export class SimIamPolicyDecision {
     policyDocumentParser;
     statementMatcher;
     explicitDenyStatementRecords = [];
-    allowStatementRecords = [];
-    trustAllowStatementRecords = [];
+    allows = new SimIamAllowStatements();
     constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
         this.request = request;
         this.policyDocumentParser = policyDocumentParser;
@@ -51,7 +52,7 @@ export class SimIamPolicyDecision {
         if (this.explicitDenyStatementRecords.length > 0) {
             return SimIamPolicyDecisionValue.ExplicitDeny;
         }
-        if (this.allowStatementRecords.length > 0) {
+        if (this.request.allowRequirement.isSatisfiedBy(this.allows.sides)) {
             return SimIamPolicyDecisionValue.Allow;
         }
         return SimIamPolicyDecisionValue.ImplicitDeny;
@@ -86,7 +87,7 @@ export class SimIamPolicyDecision {
      * An identity-policy Allow cannot substitute for the target role's trust.
      */
     get isAllowedByTrustPolicy() {
-        return this.trustAllowStatementRecords.length > 0;
+        return this.allows.trust.length > 0;
     }
     /**
      * Matching explicit Deny statements.
@@ -95,16 +96,32 @@ export class SimIamPolicyDecision {
         return this.explicitDenyStatementRecords;
     }
     /**
-     * Matching Allow statements.
+     * Matching Allow statements, from both policy sides.
+     *
+     * A statement appearing here did match the request. It does not follow that
+     * the request was allowed: a cross-Account request needs a matching Allow
+     * from each side.
      */
     get allowStatements() {
-        return this.allowStatementRecords;
+        return this.allows.all;
+    }
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identityAllowStatements() {
+        return this.allows.identity;
+    }
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resourceAllowStatements() {
+        return this.allows.resource;
     }
     /**
      * Matching Allow statements originating from trust policies.
      */
     get trustAllowStatements() {
-        return this.trustAllowStatementRecords;
+        return this.allows.trust;
     }
     evaluate() {
         for (const policy of [
@@ -117,17 +134,15 @@ export class SimIamPolicyDecision {
     evaluatePolicy(policy) {
         const parsedPolicy = this.policyDocumentParser.parse(policy.document);
         for (const statement of parsedPolicy.statements) {
-            if (!this.statementMatcher.matches(policy, statement)) {
+            const principal = this.statementMatcher.matches(policy, statement);
+            if (!principal.matched) {
                 continue;
             }
             if (statement.effect === "Deny") {
                 this.explicitDenyStatementRecords.push(statement.source);
                 continue;
             }
-            this.allowStatementRecords.push(statement.source);
-            if (policy.sourceType === "trust") {
-                this.trustAllowStatementRecords.push(statement.source);
-            }
+            this.allows.record(policy, statement.source, principal);
         }
     }
 }