@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/s3/command/delete-public-access-block/delete-public-access-block.handler.js

@@ -0,0 +1,35 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3PublicAccessBlockAuthorizer } from "../public-access-block/sim-s3-public-access-block-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 DeletePublicAccessBlockCommand handler.
+ */
+export class DeletePublicAccessBlockCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3PublicAccessBlockAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and remove a Bucket's Block Public Access settings, returning
+     * the Bucket to the all-enabled state a new Bucket starts in.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "DeletePublicAccessBlockCommand.input.Bucket");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeWrite(bucket, options?.caller);
+        bucket.deletePublicAccessBlock();
+        return {
+            $metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=delete-public-access-block.handler.js.map

package/dist/service/s3/command/delete-public-access-block/delete-public-access-block.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-public-access-block.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/delete-public-access-block/delete-public-access-block.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAK5F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAgBjE;;GAEG;AACH,MAAM,OAAO,qCAAqC;IAI/B,OAAO,CAAoC;IAC3C,UAAU,CAAmC;IAC7C,UAAU,CAAsB;IAEjD,YAAY,UAA2D;QACrE,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,OAA0C,EAC1C,OAAsD;QAEtD,aAAa,CACX,OAAO,CAAC,KAAK,CAAC,MAAM,EACpB,6CAA6C,CAC9C,CAAC;QAEF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAExD,MAAM,CAAC,uBAAuB,EAAE,CAAC;QAEjC,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy-authorizer.d.ts

@@ -0,0 +1,20 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+interface GetBucketPolicyAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to an S3 GetBucketPolicy request.
+ */
+export declare class GetBucketPolicyAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(properties: GetBucketPolicyAuthorizerProperties);
+    /**
+     * Ensure the caller may read the Bucket policy.
+     */
+    authorize(bucket: SimS3Bucket, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=get-bucket-policy-authorizer.d.ts.map

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-bucket-policy-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-bucket-policy/get-bucket-policy-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAEtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAgB1D;CACF"}

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy-authorizer.js

@@ -0,0 +1,33 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+import { simS3BucketResourcePolicies } from "../authorize/sim-s3-bucket-resource-policies.js";
+/**
+ * Applies IAM authorization to an S3 GetBucketPolicy request.
+ */
+export class GetBucketPolicyAuthorizer {
+    static action = "s3:GetBucketPolicy";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may read the Bucket policy.
+     */
+    authorize(bucket, caller) {
+        const resource = simS3BucketArn(bucket.bucketName);
+        const decision = this.iam.authorize({
+            action: GetBucketPolicyAuthorizer.action,
+            resource,
+            caller,
+            resourcePolicies: simS3BucketResourcePolicies(bucket),
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: GetBucketPolicyAuthorizer.action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=get-bucket-policy-authorizer.js.map

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-bucket-policy-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-bucket-policy/get-bucket-policy-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAM9F;;GAEG;AACH,MAAM,OAAO,yBAAyB;IAC5B,MAAM,CAAU,MAAM,GAAG,oBAAoB,CAAC;IAErC,GAAG,CAA0B;IAE9C,YAAY,UAA+C;QACzD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAmB,EAAE,MAAqB;QAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,yBAAyB,CAAC,MAAM;YACxC,QAAQ;YACR,MAAM;YACN,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,yBAAyB,CAAC,MAAM;gBACxC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.command.d.ts

@@ -0,0 +1,24 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim S3 GetBucketPolicy command.
+ */
+export interface SimGetBucketPolicyCommand {
+    readonly input: SimGetBucketPolicyCommandInput;
+}
+/**
+ * Minimal structural sim S3 GetBucketPolicy input.
+ */
+export interface SimGetBucketPolicyCommandInput {
+    readonly Bucket?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 GetBucketPolicy output.
+ *
+ * Real S3 answers with the policy document as a JSON string, so the simulator
+ * serializes its stored document rather than returning the parsed shape.
+ */
+export interface SimGetBucketPolicyCommandOutput {
+    readonly Policy: string;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=get-bucket-policy.command.d.ts.map

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-bucket-policy.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-bucket-policy/get-bucket-policy.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=get-bucket-policy.command.js.map

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-bucket-policy.command.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-bucket-policy/get-bucket-policy.command.ts"],"names":[],"mappings":""}

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.handler.d.ts

@@ -0,0 +1,29 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimGetBucketPolicyCommand, SimGetBucketPolicyCommandOutput } from "./get-bucket-policy.command.js";
+interface GetBucketPolicyCommandHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+interface GetBucketPolicyCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Simulated S3 GetBucketPolicyCommand handler.
+ */
+export declare class GetBucketPolicyCommandHandler implements CommandHandler<SimGetBucketPolicyCommand, SimGetBucketPolicyCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: GetBucketPolicyCommandHandlerProperties);
+    /**
+     * Authorize and return a Bucket's resource policy.
+     */
+    handle(command: SimGetBucketPolicyCommand, options?: GetBucketPolicyCommandHandlerOptions): Promise<SimGetBucketPolicyCommandOutput>;
+}
+export {};
+//# sourceMappingURL=get-bucket-policy.handler.d.ts.map

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-bucket-policy.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-bucket-policy/get-bucket-policy.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,gCAAgC,CAAC;AAExC,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,6BAA8B,YAAW,cAAc,CAClE,yBAAyB,EACzB,+BAA+B,CAChC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,uCAAuC,EAU9D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,OAAO,CAAC,+BAA+B,CAAC,CAqB1C;CACF"}

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.handler.js

@@ -0,0 +1,40 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { jsonStringify } from "../../../../util/type-guard/json.js";
+import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3NoSuchBucketPolicy } from "../../error/sim-s3.error.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+import { GetBucketPolicyAuthorizer } from "./get-bucket-policy-authorizer.js";
+/**
+ * Simulated S3 GetBucketPolicyCommand handler.
+ */
+export class GetBucketPolicyCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new GetBucketPolicyAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and return a Bucket's resource policy.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "GetBucketPolicyCommand.input.Bucket");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorize(bucket, options?.caller);
+        const policy = bucket.getPolicy();
+        if (policy === undefined) {
+            throw new SimS3NoSuchBucketPolicy(`No Bucket policy on S3 Bucket ${bucketName}`);
+        }
+        return {
+            Policy: jsonStringify(policy),
+            $metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=get-bucket-policy.handler.js.map

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-bucket-policy.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-bucket-policy/get-bucket-policy.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAK5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;GAEG;AACH,MAAM,OAAO,6BAA6B;IAIvB,OAAO,CAAoC;IAC3C,UAAU,CAA4B;IACtC,UAAU,CAAsB;IAEjD,YAAY,UAAmD;QAC7D,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAkC,EAClC,OAA8C;QAE9C,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAE3E,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAC/B,iCAAiC,UAAU,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;YAC7B,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/get-public-access-block/get-public-access-block.command.d.ts

@@ -0,0 +1,22 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3PublicAccessBlockSettings } from "../../bucket/public-access/sim-s3-public-access-block.js";
+/**
+ * Minimal structural sim S3 GetPublicAccessBlock command.
+ */
+export interface SimGetPublicAccessBlockCommand {
+    readonly input: SimGetPublicAccessBlockCommandInput;
+}
+/**
+ * Minimal structural sim S3 GetPublicAccessBlock input.
+ */
+export interface SimGetPublicAccessBlockCommandInput {
+    readonly Bucket?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 GetPublicAccessBlock output.
+ */
+export interface SimGetPublicAccessBlockCommandOutput {
+    readonly PublicAccessBlockConfiguration: SimS3PublicAccessBlockSettings;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=get-public-access-block.command.d.ts.map

package/dist/service/s3/command/get-public-access-block/get-public-access-block.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-public-access-block.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-public-access-block/get-public-access-block.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0DAA0D,CAAC;AAE/G;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,8BAA8B,EAAE,8BAA8B,CAAC;IACxE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/s3/command/get-public-access-block/get-public-access-block.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=get-public-access-block.command.js.map

package/dist/service/s3/command/get-public-access-block/get-public-access-block.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-public-access-block.command.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-public-access-block/get-public-access-block.command.ts"],"names":[],"mappings":""}

package/dist/service/s3/command/get-public-access-block/get-public-access-block.handler.d.ts

@@ -0,0 +1,32 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimGetPublicAccessBlockCommand, SimGetPublicAccessBlockCommandOutput } from "./get-public-access-block.command.js";
+interface GetPublicAccessBlockCommandHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+interface GetPublicAccessBlockCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Simulated S3 GetPublicAccessBlockCommand handler.
+ */
+export declare class GetPublicAccessBlockCommandHandler implements CommandHandler<SimGetPublicAccessBlockCommand, SimGetPublicAccessBlockCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: GetPublicAccessBlockCommandHandlerProperties);
+    /**
+     * Authorize and return a Bucket's Block Public Access settings.
+     *
+     * Every simulated Bucket has settings, so unlike the Bucket policy there is
+     * no missing-configuration case to report.
+     */
+    handle(command: SimGetPublicAccessBlockCommand, options?: GetPublicAccessBlockCommandHandlerOptions): Promise<SimGetPublicAccessBlockCommandOutput>;
+}
+export {};
+//# sourceMappingURL=get-public-access-block.handler.d.ts.map

package/dist/service/s3/command/get-public-access-block/get-public-access-block.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-public-access-block.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-public-access-block/get-public-access-block.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,EACrC,MAAM,sCAAsC,CAAC;AAE9C,UAAU,4CAA4C;IACpD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,kCAAmC,YAAW,cAAc,CACvE,8BAA8B,EAC9B,oCAAoC,CACrC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,4CAA4C,EAUnE;IAED;;;;;OAKG;IACG,MAAM,CACV,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,yCAAyC,GAClD,OAAO,CAAC,oCAAoC,CAAC,CAmB/C;CACF"}

package/dist/service/s3/command/get-public-access-block/get-public-access-block.handler.js

@@ -0,0 +1,39 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3PublicAccessBlockAuthorizer } from "../public-access-block/sim-s3-public-access-block-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 GetPublicAccessBlockCommand handler.
+ */
+export class GetPublicAccessBlockCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3PublicAccessBlockAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and return a Bucket's Block Public Access settings.
+     *
+     * Every simulated Bucket has settings, so unlike the Bucket policy there is
+     * no missing-configuration case to report.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "GetPublicAccessBlockCommand.input.Bucket");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeRead(bucket, options?.caller);
+        return {
+            PublicAccessBlockConfiguration: bucket
+                .getPublicAccessBlock()
+                .toConfiguration(),
+            $metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=get-public-access-block.handler.js.map

package/dist/service/s3/command/get-public-access-block/get-public-access-block.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-public-access-block.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-public-access-block/get-public-access-block.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAK5F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAgBjE;;GAEG;AACH,MAAM,OAAO,kCAAkC;IAI5B,OAAO,CAAoC;IAC3C,UAAU,CAAmC;IAC7C,UAAU,CAAsB;IAEjD,YAAY,UAAwD;QAClE,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACV,OAAuC,EACvC,OAAmD;QAEnD,aAAa,CACX,OAAO,CAAC,KAAK,CAAC,MAAM,EACpB,0CAA0C,CAC3C,CAAC;QAEF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvD,OAAO;YACL,8BAA8B,EAAE,MAAM;iBACnC,oBAAoB,EAAE;iBACtB,eAAe,EAAE;YACpB,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+interface SimS3PublicAccessBlockAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to the S3 Block Public Access commands.
+ *
+ * Reading the configuration is governed by s3:GetBucketPublicAccessBlock.
+ * Both writing and removing it are governed by s3:PutBucketPublicAccessBlock:
+ * real S3 has no separate delete permission, so removing the configuration
+ * needs exactly what setting it needs.
+ */
+export declare class SimS3PublicAccessBlockAuthorizer {
+    private static readonly readAction;
+    private static readonly writeAction;
+    private readonly iam;
+    constructor(properties: SimS3PublicAccessBlockAuthorizerProperties);
+    /**
+     * Ensure the caller may read the Bucket's Block Public Access settings.
+     */
+    authorizeRead(bucket: SimS3Bucket, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may replace or remove the Block Public Access settings.
+     */
+    authorizeWrite(bucket: SimS3Bucket, caller?: SimAwsCaller): void;
+    private authorize;
+}
+export {};
+//# sourceMappingURL=sim-s3-public-access-block-authorizer.d.ts.map

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-access-block-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,UAAU,0CAA0C;IAClD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAmC;IACrE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAmC;IAEtE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,0CAA0C,EAEjE;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAE9D;IAED;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAM/D;IAED,OAAO,CAAC,SAAS;CAqBlB"}

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.js

@@ -0,0 +1,48 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+import { simS3BucketResourcePolicies } from "../authorize/sim-s3-bucket-resource-policies.js";
+/**
+ * Applies IAM authorization to the S3 Block Public Access commands.
+ *
+ * Reading the configuration is governed by s3:GetBucketPublicAccessBlock.
+ * Both writing and removing it are governed by s3:PutBucketPublicAccessBlock:
+ * real S3 has no separate delete permission, so removing the configuration
+ * needs exactly what setting it needs.
+ */
+export class SimS3PublicAccessBlockAuthorizer {
+    static readAction = "s3:GetBucketPublicAccessBlock";
+    static writeAction = "s3:PutBucketPublicAccessBlock";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may read the Bucket's Block Public Access settings.
+     */
+    authorizeRead(bucket, caller) {
+        this.authorize(SimS3PublicAccessBlockAuthorizer.readAction, bucket, caller);
+    }
+    /**
+     * Ensure the caller may replace or remove the Block Public Access settings.
+     */
+    authorizeWrite(bucket, caller) {
+        this.authorize(SimS3PublicAccessBlockAuthorizer.writeAction, bucket, caller);
+    }
+    authorize(action, bucket, caller) {
+        const resource = simS3BucketArn(bucket.bucketName);
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller,
+            resourcePolicies: simS3BucketResourcePolicies(bucket),
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-s3-public-access-block-authorizer.js.map

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-access-block-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAM9F;;;;;;;GAOG;AACH,MAAM,OAAO,gCAAgC;IACnC,MAAM,CAAU,UAAU,GAAG,+BAA+B,CAAC;IAC7D,MAAM,CAAU,WAAW,GAAG,+BAA+B,CAAC;IAErD,GAAG,CAA0B;IAE9C,YAAY,UAAsD;QAChE,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAmB,EAAE,MAAqB;QACtD,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAmB,EAAE,MAAqB;QACvD,IAAI,CAAC,SAAS,CACZ,gCAAgC,CAAC,WAAW,EAC5C,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,MAAc,EACd,MAAmB,EACnB,MAAqB;QAErB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM;YACN,QAAQ;YACR,MAAM;YACN,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.d.ts

@@ -20,6 +20,7 @@ export declare class PutBucketPolicyCommandHandler implements CommandHandler<Sim
     private readonly authorizer;
     private readonly background;
     private readonly policyValidator;
+    private readonly publicPolicyGuard;
     constructor(properties: PutBucketPolicyCommandHandlerProperties);
     /**
      * Validate, authorize, and replace a Bucket's resource policy.

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"put-bucket-policy.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,gCAAgC,CAAC;AAExC,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,6BAA8B,YAAW,cAAc,CAClE,yBAAyB,EACzB,+BAA+B,CAChC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;IAEhE,YAAY,UAAU,EAAE,uCAAuC,EAW9D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,OAAO,CAAC,+BAA+B,CAAC,CAoB1C;CACF"}
+{"version":3,"file":"put-bucket-policy.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,gCAAgC,CAAC;AAExC,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,6BAA8B,YAAW,cAAc,CAClE,yBAAyB,EACzB,+BAA+B,CAChC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;IAChE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgC;IAElE,YAAY,UAAU,EAAE,uCAAuC,EAW9D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,OAAO,CAAC,+BAA+B,CAAC,CAqB1C;CACF"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.js

@@ -3,7 +3,8 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { jsonParse } from "../../../../util/type-guard/json.js";
 import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamPolicyDocumentValidator } from "../../../iam/validate/sim-iam-policy-document-validator.js";
-import { SimS3NoSuchBucket } from "../../error/sim-s3.error.js";
+import { SimS3PublicPolicyGuard } from "../../bucket/public-access/sim-s3-public-policy-guard.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
 import { PutBucketPolicyAuthorizer } from "./put-bucket-policy-authorizer.js";
 /**
  * Simulated S3 PutBucketPolicyCommand handler.
@@ -13,6 +14,7 @@ export class PutBucketPolicyCommandHandler {
     authorizer;
     background;
     policyValidator;
+    publicPolicyGuard = new SimS3PublicPolicyGuard();
     constructor(properties) {
         const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
         this.buckets = buckets;
@@ -28,13 +30,12 @@ export class PutBucketPolicyCommandHandler {
         assertDefined(command.input.Policy, "PutBucketPolicyCommand.input.Policy");
         this.policyValidator.validateRequired(command.input.Policy);
         const bucketName = command.input.Bucket;
-        const bucket = this.buckets.get(bucketName);
-        if (bucket === undefined) {
-            throw new SimS3NoSuchBucket(`No S3 Bucket named ${bucketName}`);
-        }
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
         await this.background.sequence();
         this.authorizer.authorize(bucketName, options?.caller);
-        bucket.configurePolicy(jsonParse(command.input.Policy));
+        const document = jsonParse(command.input.Policy);
+        this.publicPolicyGuard.guard(bucket, document);
+        bucket.configurePolicy(document);
         return {
             $metadata: {},
         };

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"put-bucket-policy.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;GAEG;AACH,MAAM,OAAO,6BAA6B;IAIvB,OAAO,CAAoC;IAC3C,UAAU,CAA4B;IACtC,UAAU,CAAsB;IAChC,eAAe,CAAgC;IAEhE,YAAY,UAAmD;QAC7D,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAkC,EAClC,OAA8C;QAE9C,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAC3E,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE5D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"put-bucket-policy.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;GAEG;AACH,MAAM,OAAO,6BAA6B;IAIvB,OAAO,CAAoC;IAC3C,UAAU,CAA4B;IACtC,UAAU,CAAsB;IAChC,eAAe,CAAgC;IAC/C,iBAAiB,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAElE,YAAY,UAAmD;QAC7D,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAkC,EAClC,OAA8C;QAE9C,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAC3E,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE5D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE/C,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEjC,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/put-public-access-block/put-public-access-block.command.d.ts

@@ -0,0 +1,22 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3PublicAccessBlockConfiguration } from "../../bucket/public-access/sim-s3-public-access-block.js";
+/**
+ * Minimal structural sim S3 PutPublicAccessBlock command.
+ */
+export interface SimPutPublicAccessBlockCommand {
+    readonly input: SimPutPublicAccessBlockCommandInput;
+}
+/**
+ * Minimal structural sim S3 PutPublicAccessBlock input.
+ */
+export interface SimPutPublicAccessBlockCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly PublicAccessBlockConfiguration?: SimS3PublicAccessBlockConfiguration | undefined;
+}
+/**
+ * Minimal structural sim S3 PutPublicAccessBlock output.
+ */
+export interface SimPutPublicAccessBlockCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=put-public-access-block.command.d.ts.map

package/dist/service/s3/command/put-public-access-block/put-public-access-block.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-public-access-block.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-public-access-block/put-public-access-block.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,0DAA0D,CAAC;AAEpH;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,8BAA8B,CAAC,EACtC,mCAAmC,GAAG,SAAS,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/s3/command/put-public-access-block/put-public-access-block.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=put-public-access-block.command.js.map

package/dist/service/s3/command/put-public-access-block/put-public-access-block.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-public-access-block.command.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-public-access-block/put-public-access-block.command.ts"],"names":[],"mappings":""}

package/dist/service/s3/command/put-public-access-block/put-public-access-block.handler.d.ts

@@ -0,0 +1,33 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimPutPublicAccessBlockCommand, SimPutPublicAccessBlockCommandOutput } from "./put-public-access-block.command.js";
+interface PutPublicAccessBlockCommandHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+interface PutPublicAccessBlockCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Simulated S3 PutPublicAccessBlockCommand handler.
+ */
+export declare class PutPublicAccessBlockCommandHandler implements CommandHandler<SimPutPublicAccessBlockCommand, SimPutPublicAccessBlockCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: PutPublicAccessBlockCommandHandlerProperties);
+    /**
+     * Authorize and replace a Bucket's Block Public Access settings.
+     *
+     * The supplied configuration replaces the previous one wholesale, so a
+     * setting it leaves out is turned off rather than kept from whatever the
+     * Bucket had before.
+     */
+    handle(command: SimPutPublicAccessBlockCommand, options?: PutPublicAccessBlockCommandHandlerOptions): Promise<SimPutPublicAccessBlockCommandOutput>;
+}
+export {};
+//# sourceMappingURL=put-public-access-block.handler.d.ts.map

package/dist/service/s3/command/put-public-access-block/put-public-access-block.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-public-access-block.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-public-access-block/put-public-access-block.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,EACrC,MAAM,sCAAsC,CAAC;AAE9C,UAAU,4CAA4C;IACpD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,kCAAmC,YAAW,cAAc,CACvE,8BAA8B,EAC9B,oCAAoC,CACrC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,4CAA4C,EAUnE;IAED;;;;;;OAMG;IACG,MAAM,CACV,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,yCAAyC,GAClD,OAAO,CAAC,oCAAoC,CAAC,CA0B/C;CACF"}

package/dist/service/s3/command/put-public-access-block/put-public-access-block.handler.js

@@ -0,0 +1,40 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3PublicAccessBlock } from "../../bucket/public-access/sim-s3-public-access-block.js";
+import { SimS3PublicAccessBlockAuthorizer } from "../public-access-block/sim-s3-public-access-block-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 PutPublicAccessBlockCommand handler.
+ */
+export class PutPublicAccessBlockCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3PublicAccessBlockAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and replace a Bucket's Block Public Access settings.
+     *
+     * The supplied configuration replaces the previous one wholesale, so a
+     * setting it leaves out is turned off rather than kept from whatever the
+     * Bucket had before.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "PutPublicAccessBlockCommand.input.Bucket");
+        assertDefined(command.input.PublicAccessBlockConfiguration, "PutPublicAccessBlockCommand.input.PublicAccessBlockConfiguration");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeWrite(bucket, options?.caller);
+        bucket.configurePublicAccessBlock(SimS3PublicAccessBlock.fromConfiguration(command.input.PublicAccessBlockConfiguration));
+        return {
+            $metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=put-public-access-block.handler.js.map