@kensio/yulin 0.37.0 → 0.39.0

package/dist/service/s3/serve/sim-s3-get-object-controller.js

@@ -1,73 +1,104 @@
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+import { SimS3WebsiteObjectLoader } from "./website/sim-s3-website-object-loader.js";
+import { SimS3WebsiteResponses } from "./website/sim-s3-website-responses.js";
 /**
- * Serves a simulated S3 Object over HTTP.
+ * Serves a simulated S3 Object over the static website endpoint.
+ *
+ * Real S3 serves a website endpoint only what the Bucket policy makes readable,
+ * answering 403 for an Object that is not publicly readable. Objects are
+ * therefore read through the ordinary GetObject command, so a Bucket with no
+ * policy serves nothing to the browser that asks for a page.
+ *
+ * The reading is done as whoever the boundary resolved rather than always as
+ * anonymous, which is a deliberate divergence: a real website endpoint
+ * authenticates nothing, so an identity policy could never reach it there. It
+ * keeps the simulator's served services consistent with each other, at the cost
+ * of being looser than S3 for a request that names a principal.
  */
 export class SimS3GetObjectController {
+    simAws;
+    responses = new SimS3WebsiteResponses();
+    constructor(properties) {
+        this.simAws = properties.simAws;
+    }
     /**
-     * Handle a GET request for an S3 Object via simulated S3.
+     * Handle a GET or HEAD request for an S3 Object via the website endpoint.
      */
-    async handleRequest(bucket, objectKey, request) {
+    async handleRequest(route, serviceRequest) {
+        const { bucket } = route;
         const website = bucket.getWebsite();
+        const { request } = serviceRequest;
         if (!website.websiteEnabled()) {
-            return new Response(`Static website hosting is not enabled for bucket ${bucket.bucketName}\n`, {
-                status: 403,
-                headers: {
-                    "content-type": "text/plain; charset=utf-8",
-                },
-            });
+            return this.responses.websiteNotEnabled(bucket.bucketName);
         }
         if (website.redirectsAllRequests()) {
             return website.redirectForRequestResponse(request, new Response(undefined));
         }
-        const response = await this.websiteResponse(bucket, objectKey, request);
-        return website.redirectForRequestResponse(request, response);
+        const loader = SimS3WebsiteObjectLoader.forRoute(this.simAws, route, serviceRequest);
+        return website.redirectForRequestResponse(request, await this.websiteResponse(route, request, loader));
     }
-    async websiteResponse(bucket, objectKey, request) {
-        const website = bucket.getWebsite();
-        const websiteObjectKey = website.objectKeyForRequest(objectKey);
-        const object = await bucket.getObject(websiteObjectKey);
+    async websiteResponse(route, request, loader) {
+        const { bucket, objectKey } = route;
+        const websiteObjectKey = bucket.getWebsite().objectKeyForRequest(objectKey);
+        const object = await this.loadRequested(loader, websiteObjectKey);
+        if (object instanceof SimIamAccessDenied) {
+            return await this.deniedResponse(bucket, request, loader);
+        }
         if (object !== undefined) {
-            return this.foundObjectResponse(object, request);
+            return this.responses.foundObject(object, request);
         }
+        return await this.missingResponse(route, request, loader, websiteObjectKey);
+    }
+    /**
+     * Answer a request for an Object the Bucket does not hold, which is either a
+     * folder needing a trailing slash, the error document, or a plain 404.
+     */
+    async missingResponse(route, request, loader, websiteObjectKey) {
+        const { bucket, objectKey } = route;
+        const website = bucket.getWebsite();
         const folderIndexDocumentKey = website.folderIndexDocumentKeyForRequest(objectKey);
-        if (folderIndexDocumentKey !== undefined) {
-            const folderIndexDocumentObject = await bucket.getObject(folderIndexDocumentKey);
-            if (folderIndexDocumentObject !== undefined) {
-                return website.trailingSlashRedirect(request);
-            }
+        if (folderIndexDocumentKey !== undefined &&
+            (await loader.loadIfPermitted(folderIndexDocumentKey)) !== undefined) {
+            return website.trailingSlashRedirect(request);
         }
-        const errorDocumentKey = website.errorDocumentKey();
-        if (errorDocumentKey !== undefined) {
-            const errorDocumentObject = await bucket.getObject(errorDocumentKey);
-            if (errorDocumentObject !== undefined) {
-                return this.foundObjectResponse(errorDocumentObject, request, 404);
+        const errorDocumentObject = await this.errorDocument(bucket, loader);
+        if (errorDocumentObject !== undefined) {
+            return this.responses.foundObject(errorDocumentObject, request, 404);
+        }
+        return this.responses.notFound(bucket.bucketName, websiteObjectKey);
+    }
+    /**
+     * Load the Object the visitor asked for, reporting a denial as a value so
+     * the caller can answer 403 rather than falling through to the 404 path.
+     */
+    async loadRequested(loader, objectKey) {
+        try {
+            return await loader.load(objectKey);
+        }
+        catch (error) {
+            if (error instanceof SimIamAccessDenied) {
+                return error;
             }
+            throw error;
         }
-        return this.notFoundResponse(bucket, websiteObjectKey);
     }
-    foundObjectResponse(object, request, status = 200) {
-        const contentType = object.metadata.values["content-type"];
-        const headers = {
-            "content-length": String(object.body.length),
-            ...(contentType !== undefined && { "content-type": contentType }),
-        };
-        if (request.method === "HEAD") {
-            return new Response(undefined, {
-                status,
-                headers,
-            });
+    /**
+     * Real S3 serves the custom error document for the whole 4XX class, so a
+     * denied request gets it too, provided the visitor may read it.
+     */
+    async deniedResponse(bucket, request, loader) {
+        const errorDocumentObject = await this.errorDocument(bucket, loader);
+        if (errorDocumentObject !== undefined) {
+            return this.responses.foundObject(errorDocumentObject, request, 403);
         }
-        return new Response(object.body, {
-            status,
-            headers,
-        });
+        return this.responses.accessDenied(bucket.bucketName);
     }
-    notFoundResponse(bucket, objectKey) {
-        return new Response(`Object ${objectKey} not found in bucket ${bucket.bucketName}`, {
-            status: 404,
-            headers: {
-                "content-type": "text/plain; charset=utf-8",
-            },
-        });
+    async errorDocument(bucket, loader) {
+        const errorDocumentKey = bucket.getWebsite().errorDocumentKey();
+        if (errorDocumentKey === undefined) {
+            return undefined;
+        }
+        return await loader.loadIfPermitted(errorDocumentKey);
     }
 }
 //# sourceMappingURL=sim-s3-get-object-controller.js.map

package/dist/service/s3/serve/sim-s3-get-object-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-get-object-controller.js","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-get-object-controller.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,OAAO,wBAAwB;IACnC;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,MAAmB,EACnB,SAAiB,EACjB,OAAgB;QAEhB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CACjB,oDAAoD,MAAM,CAAC,UAAU,IAAI,EACzE;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,2BAA2B;iBAC5C;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACnC,OAAO,OAAO,CAAC,0BAA0B,CACvC,OAAO,EACP,IAAI,QAAQ,CAAC,SAAS,CAAC,CACxB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAExE,OAAO,OAAO,CAAC,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,MAAmB,EACnB,SAAiB,EACjB,OAAgB;QAEhB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAExD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,sBAAsB,GAC1B,OAAO,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAEtD,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,yBAAyB,GAAG,MAAM,MAAM,CAAC,SAAS,CACtD,sBAAsB,CACvB,CAAC;YAEF,IAAI,yBAAyB,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAEpD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAErE,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAEO,mBAAmB,CACzB,MAAmB,EACnB,OAAgB,EAChB,MAAM,GAAG,GAAG;QAEZ,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG;YACd,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5C,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;SAClE,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;gBAC7B,MAAM;gBACN,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC/B,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAAmB,EAAE,SAAiB;QAC7D,OAAO,IAAI,QAAQ,CACjB,UAAU,SAAS,wBAAwB,MAAM,CAAC,UAAU,EAAE,EAC9D;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,2BAA2B;aAC5C;SACF,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-s3-get-object-controller.js","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-get-object-controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAGtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAM9E;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,wBAAwB;IAClB,MAAM,CAAS;IACf,SAAS,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEzD,YAAY,UAA8C;QACxD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAwB,EACxB,cAAoC;QAEpC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QAEnC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACnC,OAAO,OAAO,CAAC,0BAA0B,CACvC,OAAO,EACP,IAAI,QAAQ,CAAC,SAAS,CAAC,CACxB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAC9C,IAAI,CAAC,MAAM,EACX,KAAK,EACL,cAAc,CACf,CAAC;QAEF,OAAO,OAAO,CAAC,0BAA0B,CACvC,OAAO,EACP,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CACnD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,KAAwB,EACxB,OAAgB,EAChB,MAAgC;QAEhC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAElE,IAAI,MAAM,YAAY,kBAAkB,EAAE,CAAC;YACzC,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,KAAwB,EACxB,OAAgB,EAChB,MAAgC,EAChC,gBAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,sBAAsB,GAC1B,OAAO,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAEtD,IACE,sBAAsB,KAAK,SAAS;YACpC,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,KAAK,SAAS,EACpE,CAAC;YACD,OAAO,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAErE,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACtE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CACzB,MAAgC,EAChC,SAAiB;QAEjB,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,MAAmB,EACnB,OAAgB,EAChB,MAAgC;QAEhC,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAErE,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAmB,EACnB,MAAgC;QAEhC,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,gBAAgB,EAAE,CAAC;QAEhE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/service/s3/serve/sim-s3-object-address.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsServiceTarget } from "../../../serve/controller/sim-service-controller.js";
+import type { SimS3BucketName } from "../bucket/sim-s3-bucket.js";
+/**
+ * A request path that is not valid percent-encoding, so names no Object.
+ *
+ * Real S3 answers this as a client error, and so does the simulator: a path
+ * such as `/reports/%zz` is the caller's mistake, not the simulator's, and
+ * letting the decoding failure escape as an internal error would say the
+ * opposite.
+ */
+export declare class SimS3UndecodableUri {
+    readonly pathname: string;
+    constructor(pathname: string);
+}
+/**
+ * Decode a request path into its Object key segments.
+ *
+ * Segments are decoded one at a time, because a key may itself contain an
+ * encoded slash and decoding the whole path first would split the key at a
+ * separator that was never there.
+ */
+export declare function simS3PathSegments(pathname: string): string[] | SimS3UndecodableUri;
+/**
+ * Which Bucket and Object key an S3 REST request names.
+ *
+ * S3 has two ways of addressing the same Object. A virtual-hosted style request
+ * carries the Bucket in the hostname and nothing but the key in the path; a
+ * path style request carries both in the path. The AWS SDK picks between them
+ * for itself, so both have to be understood, and the request cannot be served
+ * until this is settled.
+ */
+export declare class SimS3ObjectAddress {
+    readonly bucketName: SimS3BucketName;
+    readonly objectKey: string;
+    private constructor();
+    /**
+     * Read the address out of a REST request, or undefined when it names no
+     * Bucket at all.
+     */
+    static fromRestRequest(target: SimAwsServiceTarget, url: URL): SimS3ObjectAddress | SimS3UndecodableUri | undefined;
+}
+//# sourceMappingURL=sim-s3-object-address.d.ts.map

package/dist/service/s3/serve/sim-s3-object-address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-object-address.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-object-address.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAElE;;;;;;;GAOG;AACH,qBAAa,mBAAmB;aACF,QAAQ,EAAE,MAAM;IAA5C,YAA4B,QAAQ,EAAE,MAAM,EAAI;CACjD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,EAAE,GAAG,mBAAmB,CAQhC;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,UAAU,EAAE,eAAe,CAAC;IAC5C,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC,OAAO,eAGN;IAED;;;OAGG;IACH,MAAM,CAAC,eAAe,CACpB,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,GAAG,GACP,kBAAkB,GAAG,mBAAmB,GAAG,SAAS,CAwBtD;CACF"}

package/dist/service/s3/serve/sim-s3-object-address.js

@@ -0,0 +1,66 @@
+/**
+ * A request path that is not valid percent-encoding, so names no Object.
+ *
+ * Real S3 answers this as a client error, and so does the simulator: a path
+ * such as `/reports/%zz` is the caller's mistake, not the simulator's, and
+ * letting the decoding failure escape as an internal error would say the
+ * opposite.
+ */
+export class SimS3UndecodableUri {
+    pathname;
+    constructor(pathname) {
+        this.pathname = pathname;
+    }
+}
+/**
+ * Decode a request path into its Object key segments.
+ *
+ * Segments are decoded one at a time, because a key may itself contain an
+ * encoded slash and decoding the whole path first would split the key at a
+ * separator that was never there.
+ */
+export function simS3PathSegments(pathname) {
+    const encoded = pathname.replace(/^\/+/u, "").split("/");
+    try {
+        return encoded.map((segment) => decodeURIComponent(segment));
+    }
+    catch {
+        return new SimS3UndecodableUri(pathname);
+    }
+}
+/**
+ * Which Bucket and Object key an S3 REST request names.
+ *
+ * S3 has two ways of addressing the same Object. A virtual-hosted style request
+ * carries the Bucket in the hostname and nothing but the key in the path; a
+ * path style request carries both in the path. The AWS SDK picks between them
+ * for itself, so both have to be understood, and the request cannot be served
+ * until this is settled.
+ */
+export class SimS3ObjectAddress {
+    bucketName;
+    objectKey;
+    constructor(bucketName, objectKey) {
+        this.bucketName = bucketName;
+        this.objectKey = objectKey;
+    }
+    /**
+     * Read the address out of a REST request, or undefined when it names no
+     * Bucket at all.
+     */
+    static fromRestRequest(target, url) {
+        const segments = simS3PathSegments(url.pathname);
+        if (segments instanceof SimS3UndecodableUri) {
+            return segments;
+        }
+        if (target.resourceName.length > 0) {
+            return new SimS3ObjectAddress(target.resourceName, segments.join("/"));
+        }
+        const bucketName = segments[0];
+        if (bucketName === undefined || bucketName.length === 0) {
+            return undefined;
+        }
+        return new SimS3ObjectAddress(bucketName, segments.slice(1).join("/"));
+    }
+}
+//# sourceMappingURL=sim-s3-object-address.js.map

package/dist/service/s3/serve/sim-s3-object-address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-object-address.js","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-object-address.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACF,QAAQ;IAApC,YAA4B,QAAgB;wBAAhB,QAAQ;IAAW,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB;IAEhB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACb,UAAU,CAAkB;IAC5B,SAAS,CAAS;IAElC,YAAoB,UAA2B,EAAE,SAAiB;QAChE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,eAAe,CACpB,MAA2B,EAC3B,GAAQ;QAER,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEjD,IAAI,QAAQ,YAAY,mBAAmB,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,kBAAkB,CAC3B,MAAM,CAAC,YAA+B,EACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CACnB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE/B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,kBAAkB,CAC3B,UAA6B,EAC7B,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/serve/sim-s3-request-router.d.ts

@@ -1,30 +1,35 @@
 import { SimAws } from "../../aws/sim-aws.js";
-import type { SimS3Bucket } from "../bucket/sim-s3-bucket.js";
 import type { SimAwsServiceTarget } from "../../../serve/controller/sim-service-controller.js";
-export interface SimS3GetObjectRoute {
-    readonly action: "getObject";
-    readonly bucket: SimS3Bucket;
-    readonly objectKey: string;
-}
-export interface SimS3RouteFailure {
-    readonly action: "failure";
-    readonly statusCode: number;
-    readonly message: string;
-}
-export type SimS3Route = SimS3GetObjectRoute | SimS3RouteFailure;
+import { type SimS3Route } from "./sim-s3-route.js";
 interface SimS3RequestRouterProperties {
     readonly simAws?: SimAws;
 }
 /**
  * Resolves HTTP requests into simulated S3 actions.
+ *
+ * Which endpoint the request arrived at decides what it can be: the website
+ * endpoint serves static sites and reads nothing but GET and HEAD, while the
+ * REST endpoint is the API, and only it accepts an upload or authenticates a
+ * caller. Real S3 draws the same line, and a test that could reach the API
+ * through a website hostname would prove something about a deployment that
+ * cannot happen.
  */
 export declare class SimS3RequestRouter {
-    private readonly simAws;
+    private readonly buckets;
     constructor(properties?: SimS3RequestRouterProperties);
     /**
      * Route an incoming service target and HTTP request to a simulated S3 action.
      */
     route(target: SimAwsServiceTarget, request: Request): SimS3Route;
+    private websiteRoute;
+    /**
+     * Route a request that arrived at the REST API endpoint.
+     *
+     * Only the Object operations simulated S3 has are accepted. Anything else is
+     * refused as unsupported rather than answered with something plausible, so a
+     * gap in the simulation shows up in the test that found it.
+     */
+    private restRoute;
 }
 export {};
 //# sourceMappingURL=sim-s3-request-router.d.ts.map

package/dist/service/s3/serve/sim-s3-request-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-request-router.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-request-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE/F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;AAEjE,UAAU,4BAA4B;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,UAAU,GAAE,4BAAiC,EAGxD;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,CAkE/D;CACF"}
+{"version":3,"file":"sim-s3-request-router.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-request-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EACL,KAAK,UAAU,EAGhB,MAAM,mBAAmB,CAAC;AAY3B,UAAU,4BAA4B;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,YAAY,UAAU,GAAE,4BAAiC,EAGxD;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,CAY/D;IAED,OAAO,CAAC,YAAY;IAsCpB;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;CAoClB"}

package/dist/service/s3/serve/sim-s3-request-router.js

@@ -1,73 +1,97 @@
 import { SimAws } from "../../aws/sim-aws.js";
+import { simS3RouteFailure as failure, } from "./sim-s3-route.js";
+import { SimS3BucketLocator, SimS3BucketNotFound, } from "./sim-s3-bucket-locator.js";
+import { SimS3ObjectAddress, simS3PathSegments, SimS3UndecodableUri, } from "./sim-s3-object-address.js";
+import { simS3RestRefusal } from "./sim-s3-rest-refusal.js";
 /**
  * Resolves HTTP requests into simulated S3 actions.
+ *
+ * Which endpoint the request arrived at decides what it can be: the website
+ * endpoint serves static sites and reads nothing but GET and HEAD, while the
+ * REST endpoint is the API, and only it accepts an upload or authenticates a
+ * caller. Real S3 draws the same line, and a test that could reach the API
+ * through a website hostname would prove something about a deployment that
+ * cannot happen.
  */
 export class SimS3RequestRouter {
-    simAws;
+    buckets;
     constructor(properties = {}) {
         const { simAws = new SimAws() } = properties;
-        this.simAws = simAws;
+        this.buckets = new SimS3BucketLocator({ simAws });
     }
     /**
      * Route an incoming service target and HTTP request to a simulated S3 action.
      */
     route(target, request) {
+        const regionName = target.regionName;
+        if (regionName === undefined) {
+            return failure(400, "Missing S3 Bucket region\n");
+        }
+        if (target.endpoint === "rest") {
+            return this.restRoute(target, request, regionName);
+        }
+        return this.websiteRoute(target, request, regionName);
+    }
+    websiteRoute(target, request, regionName) {
         if (request.method !== "GET" && request.method !== "HEAD") {
-            return {
-                action: "failure",
-                statusCode: 405,
-                message: "Method not allowed\n",
-            };
+            return failure(405, "Method not allowed\n");
         }
         if (target.resourceName.length === 0) {
-            return {
-                action: "failure",
-                statusCode: 400,
-                message: "Missing S3 Bucket name\n",
-            };
+            return failure(400, "Missing S3 Bucket name\n");
         }
-        if (target.regionName === undefined) {
-            return {
-                action: "failure",
-                statusCode: 400,
-                message: "Missing S3 Bucket region\n",
-            };
+        // Read before the Bucket is looked up, as the REST endpoint reads its
+        // address: a path that is not a path names nothing in any Bucket.
+        const segments = simS3PathSegments(new URL(request.url).pathname);
+        if (segments instanceof SimS3UndecodableUri) {
+            return undecodableFailure(segments);
         }
-        const url = new URL(request.url);
-        const objectKey = decodeURIComponent(url.pathname.replace(/^\/+/u, ""));
-        const bucketName = target.resourceName;
-        const bucketScope = this.simAws.s3().findBucketScope(bucketName);
-        if (bucketScope === undefined) {
-            return {
-                action: "failure",
-                statusCode: 404,
-                message: `S3 bucket named ${bucketName} not found`,
-            };
+        const found = this.buckets.locate(target.resourceName, regionName);
+        if (found instanceof SimS3BucketNotFound) {
+            return failure(found.statusCode, found.message);
         }
-        if (bucketScope.regionName !== target.regionName) {
-            return {
-                action: "failure",
-                statusCode: 404,
-                message: `S3 bucket named ${bucketName} is in region ${bucketScope.regionName}, not requested ${target.regionName}`,
-            };
+        return {
+            action: "website",
+            bucket: found.bucket,
+            bucketScope: found.bucketScope,
+            objectKey: segments.join("/"),
+        };
+    }
+    /**
+     * Route a request that arrived at the REST API endpoint.
+     *
+     * Only the Object operations simulated S3 has are accepted. Anything else is
+     * refused as unsupported rather than answered with something plausible, so a
+     * gap in the simulation shows up in the test that found it.
+     */
+    restRoute(target, request, regionName) {
+        const address = SimS3ObjectAddress.fromRestRequest(target, new URL(request.url));
+        if (address instanceof SimS3UndecodableUri) {
+            return undecodableFailure(address);
+        }
+        if (address === undefined) {
+            return failure(400, "Missing S3 Bucket name\n");
+        }
+        const refusal = simS3RestRefusal(request.method, address);
+        if (refusal !== undefined) {
+            return refusal;
         }
-        const bucket = this.simAws
-            .accountRegionScope(bucketScope.accountId, bucketScope.regionName)
-            .s3()
-            .getSimBucketByName(bucketName);
-        /* v8 ignore if -- does not happen in practice */
-        if (bucket === undefined) {
-            return {
-                action: "failure",
-                statusCode: 404,
-                message: `S3 bucket named ${bucketName} not found`,
-            };
+        const found = this.buckets.locate(address.bucketName, regionName);
+        if (found instanceof SimS3BucketNotFound) {
+            return failure(found.statusCode, found.message);
         }
         return {
-            action: "getObject",
-            bucket,
-            objectKey,
+            action: "restObject",
+            bucket: found.bucket,
+            bucketScope: found.bucketScope,
+            objectKey: address.objectKey,
         };
     }
 }
+/**
+ * Refuse a path the simulator cannot read as an Object key.
+ */
+function undecodableFailure(undecodable) {
+    return failure(400, `Could not parse the request path ${undecodable.pathname} as an S3 ` +
+        `Object key: it is not valid percent-encoding.\n`);
+}
 //# sourceMappingURL=sim-s3-request-router.js.map

package/dist/service/s3/serve/sim-s3-request-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-request-router.js","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-request-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAsB9C;;GAEG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAS;IAEhC,YAAY,UAAU,GAAiC,EAAE;QACvD,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B,EAAE,OAAgB;QACjD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sBAAsB;aAChC,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0BAA0B;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,4BAA4B;aACtC,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,UAAU,GAAG,MAAM,CAAC,YAA+B,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,mBAAmB,UAAU,YAAY;aACnD,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,mBAAmB,UAAU,iBAAiB,WAAW,CAAC,UAAU,mBAAmB,MAAM,CAAC,UAAU,EAAE;aACpH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;aACvB,kBAAkB,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,UAAU,CAAC;aACjE,EAAE,EAAE;aACJ,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAElC,iDAAiD;QACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,mBAAmB,UAAU,YAAY;aACnD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,MAAM;YACN,SAAS;SACV,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-s3-request-router.js","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-request-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C,OAAO,EAGL,iBAAiB,IAAI,OAAO,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAM5D;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAqB;IAE7C,YAAY,UAAU,GAAiC,EAAE;QACvD,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B,EAAE,OAAgB;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAErC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAEO,YAAY,CAClB,MAA2B,EAC3B,OAAgB,EAChB,UAAkB;QAElB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAClD,CAAC;QAED,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAElE,IAAI,QAAQ,YAAY,mBAAmB,EAAE,CAAC;YAC5C,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAC/B,MAAM,CAAC,YAA+B,EACtC,UAAU,CACX,CAAC;QAEF,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CACf,MAA2B,EAC3B,OAAgB,EAChB,UAAkB;QAElB,MAAM,OAAO,GAAG,kBAAkB,CAAC,eAAe,CAChD,MAAM,EACN,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CACrB,CAAC;QACF,IAAI,OAAO,YAAY,mBAAmB,EAAE,CAAC;YAC3C,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE1D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAElE,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,WAAgC;IAEhC,OAAO,OAAO,CACZ,GAAG,EACH,oCAAoC,WAAW,CAAC,QAAQ,YAAY;QAClE,iDAAiD,CACpD,CAAC;AACJ,CAAC"}

package/dist/service/s3/serve/sim-s3-rest-controller.d.ts

@@ -0,0 +1,36 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import type { SimS3RestObjectRoute } from "./sim-s3-route.js";
+interface SimS3RestControllerProperties {
+    readonly simAws: SimAws;
+}
+/**
+ * Serves Object requests that arrived at the simulated S3 REST endpoint.
+ *
+ * Everything goes through the ordinary command handlers rather than reaching
+ * into Bucket storage, so an HTTP request is authorized exactly as the same
+ * operation is when an SDK client makes it in process. That is the point of
+ * this endpoint: a presigned URL grants no more than the principal who signed
+ * it has, and it is IAM that decides what that is.
+ */
+export declare class SimS3RestController {
+    private readonly simAws;
+    constructor(properties: SimS3RestControllerProperties);
+    /**
+     * Serve a REST Object request as the principal the boundary resolved.
+     */
+    handleRequest(route: SimS3RestObjectRoute, serviceRequest: SimAwsServiceRequest): Promise<Response>;
+    private serve;
+    private getObject;
+    /**
+     * Store an uploaded Object.
+     *
+     * The stated checksum is checked before anything is stored, as real S3 does,
+     * so an upload that would be refused there is refused here rather than
+     * quietly landing in the Bucket.
+     */
+    private putObject;
+    private s3For;
+}
+export {};
+//# sourceMappingURL=sim-s3-rest-controller.d.ts.map

package/dist/service/s3/serve/sim-s3-rest-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-rest-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/serve/sim-s3-rest-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAK9D,UAAU,6BAA6B;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;OAEG;IACG,aAAa,CACjB,KAAK,EAAE,oBAAoB,EAC3B,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC,QAAQ,CAAC,CAWnB;YAEa,KAAK;YAWL,SAAS;IAuBvB;;;;;;OAMG;YACW,SAAS;IA2BvB,OAAO,CAAC,KAAK;CAQd"}