@kensio/yulin 0.37.0 → 0.39.0

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts

@@ -1,6 +1,7 @@
 import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
 import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
 import { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+import type { SimIamPrincipalMatch } from "../match/sim-iam-principal-match.js";
 /**
  * The matching Allow statements found for one authorization, kept per side.
  *
@@ -14,10 +15,15 @@ export declare class SimIamAllowStatements {
     private readonly identityStatements;
     private readonly resourceStatements;
     private readonly trustStatements;
+    private readonly delegatedStatements;
     /**
      * Record a matching Allow against the policy side it came from.
+     *
+     * A resource-policy Allow that matched by way of the caller's Account rather
+     * than the caller itself is kept apart as well, so a rule that cares about
+     * the difference can ask for it.
      */
-    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement): void;
+    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement, principal: SimIamPrincipalMatch): void;
     /**
      * Every matching Allow statement, identity side first.
      */

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-allow-statements.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAEvE;;OAEG;IACH,MAAM,CACJ,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,6BAA6B,GACvC,IAAI,CAMN;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,6BAA6B,EAAE,CAElD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,6BAA6B,EAAE,CAEpD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,gBAAgB,CAK5B;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;CASvB"}
+{"version":3,"file":"sim-iam-allow-statements.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAEhF;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IACvE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAuC;IAE3E;;;;;;OAMG;IACH,MAAM,CACJ,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,6BAA6B,EACxC,SAAS,EAAE,oBAAoB,GAC9B,IAAI,CAUN;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,6BAA6B,EAAE,CAElD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,6BAA6B,EAAE,CAEpD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,gBAAgB,CAU5B;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js

@@ -12,13 +12,21 @@ export class SimIamAllowStatements {
     identityStatements = [];
     resourceStatements = [];
     trustStatements = [];
+    delegatedStatements = [];
     /**
      * Record a matching Allow against the policy side it came from.
+     *
+     * A resource-policy Allow that matched by way of the caller's Account rather
+     * than the caller itself is kept apart as well, so a rule that cares about
+     * the difference can ask for it.
      */
-    record(policy, statement) {
+    record(policy, statement, principal) {
         if (policy.sourceType === "trust") {
             this.trustStatements.push(statement);
         }
+        if (principal.isAccountDelegation) {
+            this.delegatedStatements.push(statement);
+        }
         this.sideStatements(policy).push(statement);
     }
     /**
@@ -49,9 +57,11 @@ export class SimIamAllowStatements {
      * Which sides produced a matching Allow.
      */
     get sides() {
+        const delegated = new Set(this.delegatedStatements);
         return new SimIamAllowSides({
             identity: this.identityStatements.length > 0,
             resource: this.resourceStatements.length > 0,
+            resourceDirect: this.resourceStatements.some((statement) => !delegated.has(statement)),
         });
     }
     /**

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-allow-statements.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACf,kBAAkB,GAAoC,EAAE,CAAC;IACzD,kBAAkB,GAAoC,EAAE,CAAC;IACzD,eAAe,GAAoC,EAAE,CAAC;IAEvE;;OAEG;IACH,MAAM,CACJ,MAA+B,EAC/B,SAAwC;QAExC,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"sim-iam-allow-statements.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACf,kBAAkB,GAAoC,EAAE,CAAC;IACzD,kBAAkB,GAAoC,EAAE,CAAC;IACzD,eAAe,GAAoC,EAAE,CAAC;IACtD,mBAAmB,GAAoC,EAAE,CAAC;IAE3E;;;;;;OAMG;IACH,MAAM,CACJ,MAA+B,EAC/B,SAAwC,EACxC,SAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,SAAS,CAAC,mBAAmB,EAAE,CAAC;YAClC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpD,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CACzC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts

@@ -0,0 +1,17 @@
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamCallerAccount } from "../caller-account/sim-iam-caller-account.js";
+/**
+ * Works out which allow rules apply to one authorization request.
+ *
+ * Two things decide it, and both have to hold. The caller's Account says whose
+ * Allow counts: either side within one Account, both sides across Accounts.
+ * The resource-owning service says whether its resource insists on allowing,
+ * which is true of a KMS key and of nothing else so far.
+ */
+export declare class SimIamAuthZAllowRequirement {
+    /**
+     * The rule a request is subject to.
+     */
+    resolve(callerAccount: SimIamCallerAccount, requiresResourcePolicyAllow: boolean | undefined): SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-auth-z-allow-requirement.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sBAAsB,EAG5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAEvF;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC;;OAEG;IACH,OAAO,CACL,aAAa,EAAE,mBAAmB,EAClC,2BAA2B,EAAE,OAAO,GAAG,SAAS,GAC/C,sBAAsB,CASxB;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js

@@ -0,0 +1,24 @@
+import { SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * Works out which allow rules apply to one authorization request.
+ *
+ * Two things decide it, and both have to hold. The caller's Account says whose
+ * Allow counts: either side within one Account, both sides across Accounts.
+ * The resource-owning service says whether its resource insists on allowing,
+ * which is true of a KMS key and of nothing else so far.
+ */
+export class SimIamAuthZAllowRequirement {
+    /**
+     * The rule a request is subject to.
+     */
+    resolve(callerAccount, requiresResourcePolicyAllow) {
+        if (requiresResourcePolicyAllow !== true) {
+            return callerAccount.allowRequirement;
+        }
+        return new SimIamEveryAllowRequirement([
+            callerAccount.allowRequirement,
+            new SimIamMandatoryResourcePolicyRequirement(),
+        ]);
+    }
+}
+//# sourceMappingURL=sim-iam-auth-z-allow-requirement.js.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,2BAA2B,EAC3B,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAG/C;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACH,OAAO,CACL,aAAkC,EAClC,2BAAgD;QAEhD,IAAI,2BAA2B,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,aAAa,CAAC,gBAAgB,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC;YACrC,aAAa,CAAC,gBAAgB;YAC9B,IAAI,wCAAwC,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -44,6 +44,15 @@ export interface SimIamAuthorizationInput {
      * service-level resource policy.
      */
     readonly resourcePolicies?: readonly SimIamResourcePolicyInput[] | undefined;
+    /**
+     * Whether the resource's own policy must allow the request.
+     *
+     * Off by default, which is the ordinary AWS rule: a resource with no policy
+     * leaves the decision to the caller's identity policies. A service sets it
+     * for a resource whose policy is mandatory and is the root of trust for
+     * reaching it, which in AWS means a KMS key policy.
+     */
+    readonly requiresResourcePolicyAllow?: boolean | undefined;
 }
 interface SimIamAuthZContextBuilderProperties {
     /**
@@ -90,6 +99,7 @@ export declare class SimIamAuthZContextBuilder {
     private readonly callerContextBuilder;
     private readonly identityPolicyCoordinator;
     private readonly callerAccountResolver;
+    private readonly allowRequirement;
     constructor(properties: SimIamAuthZContextBuilderProperties);
     /**
      * Build the context consumed by SimIamAuthorizer.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;CAC9E;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IAEpE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAkBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -1,5 +1,6 @@
 import { makeSimAwsAccountRootPrincipal } from "../../../aws/caller/sim-aws-account-root-principal.js";
 import { SimIamCallerAccountResolver } from "../caller-account/sim-iam-caller-account-resolver.js";
+import { SimIamAuthZAllowRequirement } from "./sim-iam-auth-z-allow-requirement.js";
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
 import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
 /**
@@ -32,6 +33,7 @@ export class SimIamAuthZContextBuilder {
     callerContextBuilder;
     identityPolicyCoordinator;
     callerAccountResolver;
+    allowRequirement = new SimIamAuthZAllowRequirement();
     constructor(properties) {
         this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
@@ -56,7 +58,7 @@ export class SimIamAuthZContextBuilder {
                 ...callerAccount.identityPolicies,
             ],
             resourcePolicies: this.resourcePolicySources(input),
-            allowRequirement: callerAccount.allowRequirement,
+            allowRequirement: this.allowRequirement.resolve(callerAccount, input.requiresResourcePolicyAllow),
             action: input.action,
             resource: input.resource,
             conditionContext: this.conditionContext(input, callerContext.caller),

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAanG,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AAwEpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IAEpE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAapF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AAkFpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IACnD,gBAAgB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEtE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAC7C,aAAa,EACb,KAAK,CAAC,2BAA2B,CAClC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -1,5 +1,6 @@
 import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
 import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
 /**
  * Matches the principal portion of an IAM policy statement.
  *
@@ -27,7 +28,7 @@ export declare class SimIamPolicyPrincipalMatcher {
      * Resource and trust policies require Principal or NotPrincipal because the
      * policy must state which callers it applies to.
      */
-    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): SimIamPrincipalMatch;
     /**
      * Check each Principal representation supported by the parsed policy model.
      *
@@ -36,6 +37,10 @@ export declare class SimIamPolicyPrincipalMatcher {
      * delegation, while Service values match service principals.
      */
     private valueMatches;
+    /**
+     * The winning match among alternatives, since Principal lists are an OR.
+     */
+    private firstMatch;
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAiBT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA2BpB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}
+{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,oBAAoB,CAqBtB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAiCpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAyBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js

@@ -1,4 +1,5 @@
 import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
 /**
  * Matches the principal portion of an IAM policy statement.
  *
@@ -30,16 +31,18 @@ export class SimIamPolicyPrincipalMatcher {
      */
     matches(policy, statement) {
         if (policy.sourceType !== "resource" && policy.sourceType !== "trust") {
-            return (statement.principal === undefined &&
+            return SimIamPrincipalMatch.direct().when(statement.principal === undefined &&
                 statement.notPrincipal === undefined);
         }
         if (statement.principal !== undefined) {
             return this.valueMatches(statement.principal);
         }
         if (statement.notPrincipal !== undefined) {
-            return !this.valueMatches(statement.notPrincipal);
+            // Excluding the caller says nothing about the Account delegating, so a
+            // NotPrincipal that leaves the caller in is a direct grant.
+            return SimIamPrincipalMatch.direct().when(!this.valueMatches(statement.notPrincipal).matched);
         }
-        return false;
+        return SimIamPrincipalMatch.none();
     }
     /**
      * Check each Principal representation supported by the parsed policy model.
@@ -53,20 +56,26 @@ export class SimIamPolicyPrincipalMatcher {
             return this.awsPatternMatches(principal);
         }
         if (Array.isArray(principal)) {
-            return principal.some((value) => this.awsPatternMatches(value));
+            return this.firstMatch(principal, (value) => this.awsPatternMatches(value));
         }
-        return Object.entries(principal).some(([principalType, values]) => {
+        return this.firstMatch(Object.entries(principal), ([type, values]) => {
             const patterns = typeof values === "string" ? [values] : values;
-            if (principalType === "AWS") {
-                return patterns.some((pattern) => this.awsPatternMatches(pattern));
+            if (type === "AWS") {
+                return this.firstMatch(patterns, (pattern) => this.awsPatternMatches(pattern));
             }
             /* v8 ignore if -- service principals not yet fully supported */
-            if (principalType === "Service") {
-                return patterns.some((pattern) => this.servicePatternMatches(pattern));
+            if (type === "Service") {
+                return this.firstMatch(patterns, (pattern) => this.servicePatternMatches(pattern));
             }
-            return false;
+            return SimIamPrincipalMatch.none();
         });
     }
+    /**
+     * The winning match among alternatives, since Principal lists are an OR.
+     */
+    firstMatch(values, match) {
+        return SimIamPrincipalMatch.first(values.map((value) => match(value)));
+    }
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *
@@ -76,19 +85,19 @@ export class SimIamPolicyPrincipalMatcher {
      */
     awsPatternMatches(pattern) {
         if (pattern === "*") {
-            return true;
+            return SimIamPrincipalMatch.direct();
         }
         const caller = this.context.caller;
         if (caller.arn === undefined) {
-            return false;
+            return SimIamPrincipalMatch.none();
         }
         const delegatedAccountId = this.delegatedAccountId(pattern);
         if (delegatedAccountId !== undefined) {
-            return caller.accountId === delegatedAccountId;
+            return SimIamPrincipalMatch.accountDelegation().when(caller.accountId === delegatedAccountId);
         }
-        return simIamWildcardMatch(pattern, caller.arn, {
+        return SimIamPrincipalMatch.direct().when(simIamWildcardMatch(pattern, caller.arn, {
             caseSensitive: true,
-        });
+        }));
     }
     /**
      * Compare a service principal pattern with the resolved caller.
@@ -97,7 +106,7 @@ export class SimIamPolicyPrincipalMatcher {
         /* v8 ignore next -- service principals not yet fully supported */
         const service = this.context.caller.service;
         /* v8 ignore next -- service principals not yet fully supported */
-        return (service !== undefined &&
+        return SimIamPrincipalMatch.direct().when(service !== undefined &&
             simIamWildcardMatch(pattern, service, {
                 caseSensitive: true,
             }));

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-principal-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,CACL,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,CACrC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,SAAwC;QAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAC/C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEhE,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;YACrE,CAAC;YAED,gEAAgE;YAChE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,OAAe;QACvC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAC;QACjD,CAAC;QAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE;YAC9C,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,OAAe;QAC3C,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAE5C,kEAAkE;QAClE,OAAO,CACL,OAAO,KAAK,SAAS;YACrB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;gBACpC,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,OAAe;QACxC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"sim-iam-policy-principal-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,SAAS,CAAC,SAAS,KAAK,SAAS;gBAC/B,SAAS,CAAC,YAAY,KAAK,SAAS,CACvC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,uEAAuE;YACvE,4DAA4D;YAC5D,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CACnD,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAClB,SAAwC;QAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAClD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YACnE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEhE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAChC,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CACpC,CAAC;YACJ,CAAC;YAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,MAAoB,EACpB,KAAyC;QAEzC,OAAO,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,OAAe;QACvC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAClD,MAAM,CAAC,SAAS,KAAK,kBAAkB,CACxC,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE;YACvC,aAAa,EAAE,IAAI;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,OAAe;QAC3C,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAE5C,kEAAkE;QAClE,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,OAAO,KAAK,SAAS;YACnB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;gBACpC,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,OAAe;QACxC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts

@@ -1,5 +1,6 @@
 import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
 import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
 /**
  * Matches one parsed IAM policy statement against one authorization request.
  *
@@ -30,7 +31,7 @@ export declare class SimIamPolicyStatementMatcher {
      * evaluating later sections after an earlier constraint has rejected the
      * statement.
      */
-    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): SimIamPrincipalMatch;
     /**
      * Check Action or NotAction against the requested IAM action.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAKjG;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA4B;IAI3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAEhE,YAA6B,OAAO,EAAE,kBAAkB,EAKvD;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAOT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAwBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAuBxB"}
+{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAIjG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA4B;IAI3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAEhE,YAA6B,OAAO,EAAE,kBAAkB,EAKvD;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,oBAAoB,CAStB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAwBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAuBxB"}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js

@@ -36,7 +36,8 @@ export class SimIamPolicyStatementMatcher {
      * statement.
      */
     matches(policy, statement) {
-        return (this.principalMatcher.matches(policy, statement) &&
+        const principal = this.principalMatcher.matches(policy, statement);
+        return principal.when(principal.matched &&
             this.actionMatches(statement) &&
             this.resourceMatches(policy, statement) &&
             this.conditionMatcher.matches(statement.condition));

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-statement-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,4BAA4B;IAIV,OAAO;IAHnB,gBAAgB,CAA+B;IAC/C,gBAAgB,CAA+B;IAEhE,YAA6B,OAA2B;uBAA3B,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CACtD,OAAO,CAAC,gBAAgB,CACzB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,OAAO,CACL,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CACnD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAsC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,CAC/B,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACjD,aAAa,EAAE,KAAK;aACrB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CACrB,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CACjC,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACnD,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-iam-policy-statement-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAGrF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,4BAA4B;IAIV,OAAO;IAHnB,gBAAgB,CAA+B;IAC/C,gBAAgB,CAA+B;IAEhE,YAA6B,OAA2B;uBAA3B,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CACtD,OAAO,CAAC,gBAAgB,CACzB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAEnE,OAAO,SAAS,CAAC,IAAI,CACnB,SAAS,CAAC,OAAO;YACf,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CACrD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAsC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,CAC/B,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACjD,aAAa,EAAE,KAAK;aACrB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CACrB,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CACjC,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACnD,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IACvC,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-principal-match.d.ts

@@ -0,0 +1,39 @@
+/**
+ * How a resource-policy statement came to apply to the caller.
+ *
+ * AWS treats these two differently. A statement naming the caller's own ARN is
+ * a grant to that principal. A statement naming the Account, as a bare account
+ * ID or a root ARN, delegates the decision to that Account's IAM rather than
+ * granting anything by itself. Most of this simulator does not yet act on the
+ * difference; a KMS key policy does, because it is the whole reason the
+ * default key policy does not make a key usable by everyone in the Account.
+ */
+export declare class SimIamPrincipalMatch {
+    readonly matched: boolean;
+    readonly isAccountDelegation: boolean;
+    private constructor();
+    /**
+     * The statement does not apply to this caller.
+     */
+    static none(): SimIamPrincipalMatch;
+    /**
+     * The statement names this caller, or applies without naming an Account.
+     */
+    static direct(): SimIamPrincipalMatch;
+    /**
+     * The statement applies by way of the caller's Account.
+     */
+    static accountDelegation(): SimIamPrincipalMatch;
+    /**
+     * The first match among alternatives, since Principal lists are an OR.
+     *
+     * A direct match wins over a delegated one where both apply, because a
+     * statement naming the caller grants to the caller whatever else it says.
+     */
+    static first(matches: readonly SimIamPrincipalMatch[]): SimIamPrincipalMatch;
+    /**
+     * A match of the same kind, or none, according to a condition.
+     */
+    when(matched: boolean): SimIamPrincipalMatch;
+}
+//# sourceMappingURL=sim-iam-principal-match.d.ts.map

package/dist/service/iam/authorize/match/sim-iam-principal-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-principal-match.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-principal-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,mBAAmB,EAAE,OAAO,CAAC;IAE7C,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,IAAI,oBAAoB,CAElC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAEpC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,IAAI,oBAAoB,CAE/C;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,GAAG,oBAAoB,CAQ3E;IAED;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAE3C;CACF"}

package/dist/service/iam/authorize/match/sim-iam-principal-match.js

@@ -0,0 +1,55 @@
+/**
+ * How a resource-policy statement came to apply to the caller.
+ *
+ * AWS treats these two differently. A statement naming the caller's own ARN is
+ * a grant to that principal. A statement naming the Account, as a bare account
+ * ID or a root ARN, delegates the decision to that Account's IAM rather than
+ * granting anything by itself. Most of this simulator does not yet act on the
+ * difference; a KMS key policy does, because it is the whole reason the
+ * default key policy does not make a key usable by everyone in the Account.
+ */
+export class SimIamPrincipalMatch {
+    matched;
+    isAccountDelegation;
+    constructor(matched, isAccountDelegation) {
+        this.matched = matched;
+        this.isAccountDelegation = isAccountDelegation;
+    }
+    /**
+     * The statement does not apply to this caller.
+     */
+    static none() {
+        return new SimIamPrincipalMatch(false, false);
+    }
+    /**
+     * The statement names this caller, or applies without naming an Account.
+     */
+    static direct() {
+        return new SimIamPrincipalMatch(true, false);
+    }
+    /**
+     * The statement applies by way of the caller's Account.
+     */
+    static accountDelegation() {
+        return new SimIamPrincipalMatch(true, true);
+    }
+    /**
+     * The first match among alternatives, since Principal lists are an OR.
+     *
+     * A direct match wins over a delegated one where both apply, because a
+     * statement naming the caller grants to the caller whatever else it says.
+     */
+    static first(matches) {
+        const matched = matches.filter((result) => result.matched);
+        return (matched.find((result) => !result.isAccountDelegation) ??
+            matched[0] ??
+            this.none());
+    }
+    /**
+     * A match of the same kind, or none, according to a condition.
+     */
+    when(matched) {
+        return matched ? this : SimIamPrincipalMatch.none();
+    }
+}
+//# sourceMappingURL=sim-iam-principal-match.js.map

package/dist/service/iam/authorize/match/sim-iam-principal-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-principal-match.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-principal-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAoB;IACf,OAAO,CAAU;IACjB,mBAAmB,CAAU;IAE7C,YAAoB,OAAgB,EAAE,mBAA4B;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI;QACT,OAAO,IAAI,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB;QACtB,OAAO,IAAI,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,OAAwC;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3D,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACrD,OAAO,CAAC,CAAC,CAAC;YACV,IAAI,CAAC,IAAI,EAAE,CACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAgB;QACnB,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAGxF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;;;;;OAMG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,uBAAuB,IAAI,SAAS,6BAA6B,EAAE,CAEtE;IAED;;OAEG;IACH,IAAI,uBAAuB,IAAI,SAAS,6BAA6B,EAAE,CAEtE;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAgBvB"}
+{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAGxF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;;;;;OAMG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,uBAAuB,IAAI,SAAS,6BAA6B,EAAE,CAEtE;IAED;;OAEG;IACH,IAAI,uBAAuB,IAAI,SAAS,6BAA6B,EAAE,CAEtE;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAkBvB"}

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -134,14 +134,15 @@ export class SimIamPolicyDecision {
     evaluatePolicy(policy) {
         const parsedPolicy = this.policyDocumentParser.parse(policy.document);
         for (const statement of parsedPolicy.statements) {
-            if (!this.statementMatcher.matches(policy, statement)) {
+            const principal = this.statementMatcher.matches(policy, statement);
+            if (!principal.matched) {
                 continue;
             }
             if (statement.effect === "Deny") {
                 this.explicitDenyStatementRecords.push(statement.source);
                 continue;
             }
-            this.allows.record(policy, statement.source);
+            this.allows.record(policy, statement.source, principal);
         }
     }
 }

package/dist/service/iam/authorize/sim-iam-decision.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEtD,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEtD,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEnE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/index.d.ts

@@ -1,4 +1,5 @@
 export { SimIam } from "./sim-iam.js";
+export { SimIamAccessDenied, SimIamError } from "./error/sim-iam.error.js";
 export type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
 export type { SimIamCredentialIdentity } from "./credential/sim-aws-credentials.js";
 export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, type SimIamSigV4ErrorCode, } from "./sigv4/error/sim-iam-sigv4.error.js";

package/dist/service/iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/index.js

@@ -1,4 +1,5 @@
 export { SimIam } from "./sim-iam.js";
+export { SimIamAccessDenied, SimIamError } from "./error/sim-iam.error.js";
 export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, } from "./sigv4/error/sim-iam-sigv4.error.js";
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";

package/dist/service/iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}