@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -0,0 +1,58 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies simulated IAM authorization to KMS requests.
+ *
+ * KMS splits into two kinds of request, and they authorize differently:
+ *
+ * - operations on an existing key, where the key policy is mandatory and must
+ *   allow the request, so an identity policy alone never reaches the key;
+ * - operations with no key to speak of, such as CreateKey and ListKeys, which
+ *   real KMS gives no resource-level permissions and so are authorized against
+ *   `*` with identity policies alone.
+ */
+export class SimKmsAuthorizer {
+    iam;
+    accountRegionScope;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Ensure the caller may perform an action on a key.
+     *
+     * The key's policy is supplied as the resource side and is required to
+     * allow: this is the rule that makes a KMS key policy the root of trust for
+     * its key rather than one more input to the decision.
+     */
+    authorizeKey(action, key, caller) {
+        const decision = this.iam.authorize({
+            action,
+            resource: key.arn,
+            caller,
+            resourcePolicies: [key.policy.asResourcePolicy()],
+            requiresResourcePolicyAllow: true,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource: key.arn,
+            });
+        }
+    }
+    /**
+     * Ensure the caller may perform an action that names no particular key.
+     */
+    authorizeAccount(action, caller) {
+        const resource = `arn:aws:kms:${this.accountRegionScope.regionName}:${this.accountRegionScope.accountId}:key/*`;
+        const decision = this.iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-authorizer.js.map

package/dist/service/kms/command/authorize/sim-kms-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAQzE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAA0B;IAC7B,kBAAkB,CAA2B;IAE9D,YAAY,UAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAc,EAAE,GAAc,EAAE,MAAqB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,MAAM;YACN,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjD,2BAA2B,EAAE,IAAI;SAClC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,GAAG;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAc,EAAE,MAAqB;QACpD,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,CAAC;QAEhH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/crypto/crypto.command.d.ts

@@ -0,0 +1,68 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimKmsEncryptionContext } from "../../key/sim-kms-encryption-context.js";
+/**
+ * Minimal structural sim KMS Encrypt command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/EncryptCommand/
+ */
+export interface SimEncryptCommand {
+    readonly input: SimEncryptCommandInput;
+}
+export interface SimEncryptCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+}
+export interface SimEncryptCommandOutput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS Decrypt command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/DecryptCommand/
+ */
+export interface SimDecryptCommand {
+    readonly input: SimDecryptCommandInput;
+}
+export interface SimDecryptCommandInput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    /**
+     * Optional for a symmetric key, because the ciphertext names the key that
+     * produced it. Supplying it asks KMS to check that expectation, and the
+     * request fails if the ciphertext came from a different key.
+     */
+    readonly KeyId?: string | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+}
+export interface SimDecryptCommandOutput {
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS GenerateDataKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/GenerateDataKeyCommand/
+ */
+export interface SimGenerateDataKeyCommand {
+    readonly input: SimGenerateDataKeyCommandInput;
+}
+export interface SimGenerateDataKeyCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly KeySpec?: string | undefined;
+    readonly NumberOfBytes?: number | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+}
+export interface SimGenerateDataKeyCommandOutput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=crypto.command.d.ts.map

package/dist/service/kms/command/crypto/crypto.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/crypto.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAEvF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAEjD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CAClE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/crypto/crypto.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=crypto.command.js.map

package/dist/service/kms/command/crypto/crypto.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/crypto.command.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/crypto/sim-kms-ciphertext-key.d.ts

@@ -0,0 +1,40 @@
+import type { SimKmsKey } from "../../key/sim-kms-key.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+/**
+ * The only encryption algorithm a symmetric KMS key supports.
+ */
+export declare const simKmsSymmetricAlgorithm = "SYMMETRIC_DEFAULT";
+/**
+ * Resolves the key behind a ciphertext, and checks the caller's expectations.
+ *
+ * Decrypt is the one KMS operation whose target key comes from the ciphertext
+ * rather than the request, so working out which key that is, and what to say
+ * when it is not the one the caller expected, is its own small job.
+ */
+export declare class SimKmsCiphertextKey {
+    private readonly keys;
+    constructor(keys: SimKmsKeyStore);
+    /**
+     * Find the key a ciphertext was produced under.
+     *
+     * A blob naming a key this scope does not have is an unreadable ciphertext
+     * rather than a missing key, because the caller never named the key and so
+     * cannot be told which one is missing.
+     */
+    behind(keyArn: string): SimKmsKey;
+    /**
+     * Check a supplied KeyId against the key the ciphertext actually names.
+     *
+     * A KeyId naming no key at all is a missing key rather than the wrong one,
+     * so it is resolved the same way every other operation resolves its target.
+     */
+    requireExpected(keyId: string | undefined, key: SimKmsKey): void;
+    /**
+     * Refuse an encryption algorithm this simulation does not model.
+     *
+     * Only symmetric keys are simulated, so an asymmetric algorithm is refused
+     * rather than quietly treated as the symmetric one.
+     */
+    requireSymmetricAlgorithm(algorithm: string | undefined): void;
+}
+//# sourceMappingURL=sim-kms-ciphertext-key.d.ts.map

package/dist/service/kms/command/crypto/sim-kms-ciphertext-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-ciphertext-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-ciphertext-key.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE;;GAEG;AACH,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IAEtC,YAAY,IAAI,EAAE,cAAc,EAE/B;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAQhC;IAED;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,CAU/D;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAM7D;CACF"}

package/dist/service/kms/command/crypto/sim-kms-ciphertext-key.js

@@ -0,0 +1,58 @@
+import { SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, } from "../../error/sim-kms.error.js";
+/**
+ * The only encryption algorithm a symmetric KMS key supports.
+ */
+export const simKmsSymmetricAlgorithm = "SYMMETRIC_DEFAULT";
+/**
+ * Resolves the key behind a ciphertext, and checks the caller's expectations.
+ *
+ * Decrypt is the one KMS operation whose target key comes from the ciphertext
+ * rather than the request, so working out which key that is, and what to say
+ * when it is not the one the caller expected, is its own small job.
+ */
+export class SimKmsCiphertextKey {
+    keys;
+    constructor(keys) {
+        this.keys = keys;
+    }
+    /**
+     * Find the key a ciphertext was produced under.
+     *
+     * A blob naming a key this scope does not have is an unreadable ciphertext
+     * rather than a missing key, because the caller never named the key and so
+     * cannot be told which one is missing.
+     */
+    behind(keyArn) {
+        const key = this.keys.find(keyArn);
+        if (key === undefined) {
+            throw new SimKmsInvalidCiphertextException();
+        }
+        return key;
+    }
+    /**
+     * Check a supplied KeyId against the key the ciphertext actually names.
+     *
+     * A KeyId naming no key at all is a missing key rather than the wrong one,
+     * so it is resolved the same way every other operation resolves its target.
+     */
+    requireExpected(keyId, key) {
+        if (keyId === undefined) {
+            return;
+        }
+        if (this.keys.require(keyId).keyId !== key.keyId) {
+            throw new SimKmsIncorrectKeyException(`The ciphertext was not encrypted under the key '${keyId}'`);
+        }
+    }
+    /**
+     * Refuse an encryption algorithm this simulation does not model.
+     *
+     * Only symmetric keys are simulated, so an asymmetric algorithm is refused
+     * rather than quietly treated as the symmetric one.
+     */
+    requireSymmetricAlgorithm(algorithm) {
+        if (algorithm !== undefined && algorithm !== simKmsSymmetricAlgorithm) {
+            throw new SimKmsInvalidKeyUsageException(`Encryption algorithm '${algorithm}' is not supported: simulated KMS keys are symmetric, which supports only ${simKmsSymmetricAlgorithm}`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-ciphertext-key.js.map

package/dist/service/kms/command/crypto/sim-kms-ciphertext-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-ciphertext-key.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-ciphertext-key.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AAItC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAiB;IAEtC,YAAY,IAAoB;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAAc;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,gCAAgC,EAAE,CAAC;QAC/C,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,KAAyB,EAAE,GAAc;QACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,2BAA2B,CACnC,mDAAmD,KAAK,GAAG,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,SAA6B;QACrD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,wBAAwB,EAAE,CAAC;YACtE,MAAM,IAAI,8BAA8B,CACtC,yBAAyB,SAAS,6EAA6E,wBAAwB,EAAE,CAC1I,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/crypto/sim-kms-crypto-commands.d.ts

@@ -0,0 +1,38 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimDecryptCommand, SimDecryptCommandOutput, SimEncryptCommand, SimEncryptCommandOutput } from "./crypto.command.js";
+interface SimKmsCryptoCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsCryptoCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The Encrypt and Decrypt commands of one simulated KMS scope.
+ *
+ * They share the key store, the authorizer and the ciphertext blob format, so
+ * they are grouped rather than wired separately on the facade.
+ */
+export declare class SimKmsCryptoCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly blob;
+    private readonly ciphertextKey;
+    constructor(properties: SimKmsCryptoCommandsProperties);
+    /**
+     * Encrypt plaintext under a key.
+     */
+    encrypt(command: SimEncryptCommand, options?: SimKmsCryptoCommandOptions): SimEncryptCommandOutput;
+    /**
+     * Decrypt a ciphertext produced by this simulation.
+     *
+     * The key comes from the ciphertext rather than the request, which is why
+     * KeyId is optional for a symmetric key. Authorization therefore happens
+     * against the key the blob names, once it is known.
+     */
+    decrypt(command: SimDecryptCommand, options?: SimKmsCryptoCommandOptions): SimDecryptCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-crypto-commands.d.ts.map

package/dist/service/kms/command/crypto/sim-kms-crypto-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-crypto-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-crypto-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAKrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAW7B,UAAU,8BAA8B;IACtC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,0BAA0B;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IAEpD,YAAY,UAAU,EAAE,8BAA8B,EAIrD;IAED;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,0BAA0B,GACnC,uBAAuB,CA0BzB;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,0BAA0B,GACnC,uBAAuB,CAuBzB;CACF"}

package/dist/service/kms/command/crypto/sim-kms-crypto-commands.js

@@ -0,0 +1,74 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+import { SimKmsCiphertextBlob } from "../../key/sim-kms-ciphertext-blob.js";
+import { SimKmsCiphertextKey, simKmsSymmetricAlgorithm, } from "./sim-kms-ciphertext-key.js";
+/**
+ * The largest plaintext Encrypt accepts for a symmetric key.
+ *
+ * This limit is the whole reason envelope encryption exists, so enforcing it
+ * is what makes a test that outgrows Encrypt fail here rather than in
+ * production.
+ */
+const maxPlaintextBytes = 4096;
+/**
+ * The Encrypt and Decrypt commands of one simulated KMS scope.
+ *
+ * They share the key store, the authorizer and the ciphertext blob format, so
+ * they are grouped rather than wired separately on the facade.
+ */
+export class SimKmsCryptoCommands {
+    keys;
+    authorizer;
+    blob = new SimKmsCiphertextBlob();
+    ciphertextKey;
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+        this.ciphertextKey = new SimKmsCiphertextKey(properties.keys);
+    }
+    /**
+     * Encrypt plaintext under a key.
+     */
+    encrypt(command, options) {
+        const plaintext = command.input.Plaintext;
+        this.ciphertextKey.requireSymmetricAlgorithm(command.input.EncryptionAlgorithm);
+        if (plaintext === undefined || plaintext.length === 0) {
+            throw new SimKmsValidationException("Plaintext is required");
+        }
+        if (plaintext.length > maxPlaintextBytes) {
+            throw new SimKmsValidationException(`Plaintext of ${String(plaintext.length)} bytes exceeds the ${String(maxPlaintextBytes)} byte limit for a symmetric key; encrypt a data key from GenerateDataKey instead`);
+        }
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:Encrypt", key, options?.caller);
+        return {
+            $metadata: {},
+            CiphertextBlob: key.encrypt(plaintext, command.input.EncryptionContext),
+            KeyId: key.arn,
+            EncryptionAlgorithm: simKmsSymmetricAlgorithm,
+        };
+    }
+    /**
+     * Decrypt a ciphertext produced by this simulation.
+     *
+     * The key comes from the ciphertext rather than the request, which is why
+     * KeyId is optional for a symmetric key. Authorization therefore happens
+     * against the key the blob names, once it is known.
+     */
+    decrypt(command, options) {
+        const ciphertextBlob = command.input.CiphertextBlob;
+        this.ciphertextKey.requireSymmetricAlgorithm(command.input.EncryptionAlgorithm);
+        if (ciphertextBlob === undefined) {
+            throw new SimKmsValidationException("CiphertextBlob is required");
+        }
+        const parts = this.blob.decode(ciphertextBlob);
+        const key = this.ciphertextKey.behind(parts.keyArn);
+        this.authorizer.authorizeKey("kms:Decrypt", key, options?.caller);
+        this.ciphertextKey.requireExpected(command.input.KeyId, key);
+        return {
+            $metadata: {},
+            Plaintext: key.decrypt(parts, command.input.EncryptionContext),
+            KeyId: key.arn,
+            EncryptionAlgorithm: simKmsSymmetricAlgorithm,
+        };
+    }
+}
+//# sourceMappingURL=sim-kms-crypto-commands.js.map

package/dist/service/kms/command/crypto/sim-kms-crypto-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-crypto-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-crypto-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AASrC;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAW/B;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAClC,aAAa,CAAsB;IAEpD,YAAY,UAA0C;QACpD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,OAAO,CACL,OAA0B,EAC1B,OAAoC;QAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAC1C,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAClC,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CACjC,gBAAgB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,iBAAiB,CAAC,kFAAkF,CAC1K,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElE,OAAO;YACL,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,mBAAmB,EAAE,wBAAwB;SAC9C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAA0B,EAC1B,OAAoC;QAEpC,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAC1C,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAClC,CAAC;QAEF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE7D,OAAO;YACL,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC9D,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,mBAAmB,EAAE,wBAAwB;SAC9C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/crypto/sim-kms-data-key-spec.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Works out how many bytes of data key GenerateDataKey should produce.
+ *
+ * Real KMS insists on exactly one of KeySpec and NumberOfBytes, and refuses
+ * the request otherwise rather than picking a default. Following that keeps a
+ * request that AWS would reject from quietly succeeding here.
+ */
+export declare class SimKmsDataKeySpec {
+    /**
+     * The data key length a request asks for.
+     */
+    lengthFor(keySpec: string | undefined, numberOfBytes: number | undefined): number;
+    private specLength;
+    private byteCount;
+}
+//# sourceMappingURL=sim-kms-data-key-spec.d.ts.map

package/dist/service/kms/command/crypto/sim-kms-data-key-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-data-key-spec.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-data-key-spec.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;IACH,SAAS,CACP,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,CAkBR;IAED,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,SAAS;CAalB"}

package/dist/service/kms/command/crypto/sim-kms-data-key-spec.js

@@ -0,0 +1,50 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+/**
+ * The data key lengths the named KeySpec values stand for.
+ */
+const specLengths = new Map([
+    ["AES_256", 32],
+    ["AES_128", 16],
+]);
+const minBytes = 1;
+const maxBytes = 1024;
+/**
+ * Works out how many bytes of data key GenerateDataKey should produce.
+ *
+ * Real KMS insists on exactly one of KeySpec and NumberOfBytes, and refuses
+ * the request otherwise rather than picking a default. Following that keeps a
+ * request that AWS would reject from quietly succeeding here.
+ */
+export class SimKmsDataKeySpec {
+    /**
+     * The data key length a request asks for.
+     */
+    lengthFor(keySpec, numberOfBytes) {
+        if (keySpec !== undefined && numberOfBytes !== undefined) {
+            throw new SimKmsValidationException("Specify either KeySpec or NumberOfBytes, but not both");
+        }
+        if (keySpec !== undefined) {
+            return this.specLength(keySpec);
+        }
+        if (numberOfBytes !== undefined) {
+            return this.byteCount(numberOfBytes);
+        }
+        throw new SimKmsValidationException("Specify either KeySpec or NumberOfBytes");
+    }
+    specLength(keySpec) {
+        const length = specLengths.get(keySpec);
+        if (length === undefined) {
+            throw new SimKmsValidationException(`Unsupported KeySpec '${keySpec}': simulated KMS supports ${specLengths.keys().toArray().join(" and ")}`);
+        }
+        return length;
+    }
+    byteCount(numberOfBytes) {
+        if (!Number.isSafeInteger(numberOfBytes) ||
+            numberOfBytes < minBytes ||
+            numberOfBytes > maxBytes) {
+            throw new SimKmsValidationException(`NumberOfBytes must be a whole number between ${String(minBytes)} and ${String(maxBytes)}`);
+        }
+        return numberOfBytes;
+    }
+}
+//# sourceMappingURL=sim-kms-data-key-spec.js.map

package/dist/service/kms/command/crypto/sim-kms-data-key-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-data-key-spec.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-data-key-spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAiB;IAC1C,CAAC,SAAS,EAAE,EAAE,CAAC;IACf,CAAC,SAAS,EAAE,EAAE,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;OAEG;IACH,SAAS,CACP,OAA2B,EAC3B,aAAiC;QAEjC,IAAI,OAAO,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACzD,MAAM,IAAI,yBAAyB,CACjC,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,OAAe;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAExC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CACjC,wBAAwB,OAAO,6BAA6B,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACzG,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,aAAqB;QACrC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;YACpC,aAAa,GAAG,QAAQ;YACxB,aAAa,GAAG,QAAQ,EACxB,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,gDAAgD,MAAM,CAAC,QAAQ,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/service/kms/command/crypto/sim-kms-generate-data-key.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimGenerateDataKeyCommand, SimGenerateDataKeyCommandOutput } from "./crypto.command.js";
+interface SimKmsGenerateDataKeyProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsGenerateDataKeyOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The GenerateDataKey command of one simulated KMS scope.
+ *
+ * This is the envelope encryption primitive, and the answer to Encrypt's
+ * 4096 byte limit: the plaintext copy of the data key encrypts the data and is
+ * then discarded, while the encrypted copy is stored alongside it so the data
+ * key can be recovered through Decrypt later.
+ */
+export declare class SimKmsGenerateDataKey {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly dataKeySpec;
+    constructor(properties: SimKmsGenerateDataKeyProperties);
+    /**
+     * Generate a data key, returned both in the clear and encrypted.
+     */
+    handle(command: SimGenerateDataKeyCommand, options?: SimKmsGenerateDataKeyOptions): SimGenerateDataKeyCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-generate-data-key.d.ts.map

package/dist/service/kms/command/crypto/sim-kms-generate-data-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-generate-data-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-generate-data-key.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,qBAAqB,CAAC;AAG7B,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IAEvD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,4BAA4B,GACrC,+BAA+B,CAiBjC;CACF"}

package/dist/service/kms/command/crypto/sim-kms-generate-data-key.js

@@ -0,0 +1,35 @@
+import { randomBytes } from "node:crypto";
+import { SimKmsDataKeySpec } from "./sim-kms-data-key-spec.js";
+/**
+ * The GenerateDataKey command of one simulated KMS scope.
+ *
+ * This is the envelope encryption primitive, and the answer to Encrypt's
+ * 4096 byte limit: the plaintext copy of the data key encrypts the data and is
+ * then discarded, while the encrypted copy is stored alongside it so the data
+ * key can be recovered through Decrypt later.
+ */
+export class SimKmsGenerateDataKey {
+    keys;
+    authorizer;
+    dataKeySpec = new SimKmsDataKeySpec();
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * Generate a data key, returned both in the clear and encrypted.
+     */
+    handle(command, options) {
+        const length = this.dataKeySpec.lengthFor(command.input.KeySpec, command.input.NumberOfBytes);
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:GenerateDataKey", key, options?.caller);
+        const dataKey = Uint8Array.from(randomBytes(length));
+        return {
+            $metadata: {},
+            Plaintext: dataKey,
+            CiphertextBlob: key.encrypt(dataKey, command.input.EncryptionContext),
+            KeyId: key.arn,
+        };
+    }
+}
+//# sourceMappingURL=sim-kms-generate-data-key.js.map

package/dist/service/kms/command/crypto/sim-kms-generate-data-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-generate-data-key.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-generate-data-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAW/D;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACf,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,WAAW,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAEvD,YAAY,UAA2C;QACrD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAAkC,EAClC,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CACvC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,aAAa,CAC5B,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAErD,OAAO;YACL,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACrE,KAAK,EAAE,GAAG,CAAC,GAAG;SACf,CAAC;IACJ,CAAC;CACF"}