@kensio/yulin 0.47.0 → 1.0.0

package/dist/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.js

@@ -0,0 +1,57 @@
+import { SimHttpApiAdmitted, SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
+/**
+ * The IAM action a request to an `AWS_IAM` route is authorized against.
+ *
+ * It is the only `execute-api` action evaluated here. The others AWS defines
+ * are WebSocket management and REST API cache invalidation, and nothing
+ * constrains the action string a policy may name, so a policy is free to grant
+ * one of them and nothing will ask about it.
+ */
+export const simExecuteApiInvokeAction = "execute-api:Invoke";
+/**
+ * Decides whether a caller may have an `AWS_IAM` route.
+ *
+ * This is the client's own authorization, evaluated against the identity
+ * policies of the caller the serving boundary resolved. An HTTP API has no
+ * resource policy, so no resource policies are supplied, and the caller's
+ * identity policies are the whole decision. That is also why a caller from
+ * another Account is always refused: a cross-Account request needs an Allow
+ * from each side, and there is nowhere on an HTTP API to put the resource side.
+ * The way through, here as on AWS, is to assume a Role in the API's Account.
+ */
+export class SimHttpApiIamRouteAuthorizer {
+    /**
+     * Evaluate `execute-api:Invoke` for the caller against the route being
+     * called.
+     */
+    authorize(input) {
+        const decision = input.iam.authorize({
+            action: simExecuteApiInvokeAction,
+            resource: this.routeArn(input).toString(),
+            caller: input.caller.toCaller(),
+        });
+        if (decision.isDenied) {
+            return SimHttpApiRefused.forbidden();
+        }
+        return new SimHttpApiAdmitted({ caller: input.caller });
+    }
+    /**
+     * The `execute-api` ARN of the request being authorized.
+     *
+     * An identity policy is written by hand against the request a caller is
+     * making, so this names the concrete method and the concrete path, unlike
+     * the ARN the integration's invoke permission is matched against. The method
+     * is upper-cased because AWS puts a verb there and a policy names one, while
+     * a Fetch request may carry a method in any case.
+     */
+    routeArn(input) {
+        const { api, match, request } = input;
+        return new SimHttpApiExecuteApiArn({
+            api,
+            stageName: match.stage.stageName,
+            methodAndPath: `${request.method.toUpperCase()}/${match.pathAfterStage}`,
+        });
+    }
+}
+//# sourceMappingURL=sim-http-api-iam-route-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-iam-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAGpF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,4BAA4B;IACvC;;;OAGG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YACnC,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CACd,KAAoC;QAEpC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAEtC,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG;YACH,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-integration-authorizer.d.ts

@@ -0,0 +1,42 @@
+import type { SimIamAuthorizationDecision, SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimLambdaFunction } from "../../../lambda/function/sim-lambda-function.js";
+import type { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
+/**
+ * The service principal API Gateway invokes a Lambda integration as.
+ */
+export declare const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+interface SimHttpApiIntegrationAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface SimHttpApiIntegrationAuthorizationInput {
+    readonly simFunction: SimLambdaFunction;
+    readonly sourceArn: SimHttpApiExecuteApiArn;
+}
+/**
+ * Decides whether an API Gateway integration may invoke its Lambda function.
+ *
+ * A Lambda proxy integration created through CloudFormation, the CLI or an SDK
+ * does not work until the function's resource policy allows
+ * `apigateway.amazonaws.com` to invoke it. API Gateway is the caller, so the
+ * caller's own identity policies are not what admits the call: a service
+ * principal owns none, and the function's resource policy is the whole
+ * decision.
+ *
+ * The answer is a decision rather than a thrown error, because a refusal is an
+ * ordinary HTTP outcome: the endpoint answers 500 the way real API Gateway
+ * does, with nothing to propagate to a caller in process.
+ */
+export declare class SimHttpApiIntegrationAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(properties: SimHttpApiIntegrationAuthorizerProperties);
+    /**
+     * Evaluate `lambda:InvokeFunction` for the API against the function.
+     *
+     * The route the request matched is supplied as `AWS:SourceArn`, so a
+     * permission granted for one route does not open another.
+     */
+    authorize(input: SimHttpApiIntegrationAuthorizationInput): SimIamAuthorizationDecision;
+}
+export {};
+//# sourceMappingURL=sim-http-api-integration-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-integration-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-integration-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAEzF;;GAEG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAQxE,UAAU,yCAAyC;IACjD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAEzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,yCAAyC,EAEhE;IAED;;;;;OAKG;IACH,SAAS,CACP,KAAK,EAAE,uCAAuC,GAC7C,2BAA2B,CAU7B;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-integration-authorizer.js

@@ -0,0 +1,49 @@
+import { simLambdaResourcePolicies } from "../../../lambda/command/authorize/sim-lambda-resource-policies.js";
+/**
+ * The service principal API Gateway invokes a Lambda integration as.
+ */
+export const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+/**
+ * The condition key the invoking API is supplied under, which is what an
+ * `AddPermission` `SourceArn` is written against.
+ */
+const sourceArnConditionKey = "AWS:SourceArn";
+/**
+ * Decides whether an API Gateway integration may invoke its Lambda function.
+ *
+ * A Lambda proxy integration created through CloudFormation, the CLI or an SDK
+ * does not work until the function's resource policy allows
+ * `apigateway.amazonaws.com` to invoke it. API Gateway is the caller, so the
+ * caller's own identity policies are not what admits the call: a service
+ * principal owns none, and the function's resource policy is the whole
+ * decision.
+ *
+ * The answer is a decision rather than a thrown error, because a refusal is an
+ * ordinary HTTP outcome: the endpoint answers 500 the way real API Gateway
+ * does, with nothing to propagate to a caller in process.
+ */
+export class SimHttpApiIntegrationAuthorizer {
+    static action = "lambda:InvokeFunction";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Evaluate `lambda:InvokeFunction` for the API against the function.
+     *
+     * The route the request matched is supplied as `AWS:SourceArn`, so a
+     * permission granted for one route does not open another.
+     */
+    authorize(input) {
+        return this.iam.authorize({
+            action: SimHttpApiIntegrationAuthorizer.action,
+            resource: input.simFunction.arn,
+            caller: { kind: "service", service: simApiGatewayServicePrincipal },
+            resourcePolicies: simLambdaResourcePolicies(input.simFunction),
+            conditionContext: {
+                [sourceArnConditionKey]: input.sourceArn.toString(),
+            },
+        });
+    }
+}
+//# sourceMappingURL=sim-http-api-integration-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-integration-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-integration-authorizer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mEAAmE,CAAC;AAI9G;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAExE;;;GAGG;AACH,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAW9C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,+BAA+B;IAClC,MAAM,CAAU,MAAM,GAAG,uBAAuB,CAAC;IAExC,GAAG,CAA0B;IAE9C,YAAY,UAAqD;QAC/D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,SAAS,CACP,KAA8C;QAE9C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,+BAA+B,CAAC,MAAM;YAC9C,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,EAAE;YACnE,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC;YAC9D,gBAAgB,EAAE;gBAChB,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE;aACpD;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.d.ts

@@ -0,0 +1,27 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+interface SimHttpApiJwtRouteAuthorizerProperties {
+    /**
+     * Clock the token's time claims are checked against, so advancing simulated
+     * time expires a token that was accepted before it.
+     */
+    readonly clock: SimClock;
+}
+/**
+ * Decides whether one request may have a `JWT` route.
+ *
+ * The token has to verify against the keys its issuer publishes, and the
+ * route's scopes have to be met. Every refusal up to and including claim
+ * validation is one 401; an unmet scope is the one 403.
+ */
+export declare class SimHttpApiJwtRouteAuthorizer {
+    private readonly clock;
+    constructor(properties: SimHttpApiJwtRouteAuthorizerProperties);
+    /**
+     * Authorize one request against the `JWT` route that matched it.
+     */
+    authorize(input: SimHttpApiRouteAuthorizeInput): SimHttpApiAuthorization;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-route-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAE5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,sCAAsC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,sCAAsC,EAE7D;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CAqCvE;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.js

@@ -0,0 +1,49 @@
+import { SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiJwtVerification } from "../../api/authorizer/sim-http-api-jwt-verification.js";
+/**
+ * Decides whether one request may have a `JWT` route.
+ *
+ * The token has to verify against the keys its issuer publishes, and the
+ * route's scopes have to be met. Every refusal up to and including claim
+ * validation is one 401; an unmet scope is the one 403.
+ */
+export class SimHttpApiJwtRouteAuthorizer {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Authorize one request against the `JWT` route that matched it.
+     */
+    authorize(input) {
+        const { api, match, request } = input;
+        const { route } = match;
+        // A JWT route always names an authorizer, and that authorizer can still be
+        // deleted out from under it, so the two come to the same thing here: with
+        // no authorizer to ask, the route stays closed.
+        const authorizer = api.authorizers.find(route.authorizerId ?? "");
+        if (authorizer === undefined) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        const presented = authorizer.identitySource.token(request);
+        if (presented === undefined) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        const authorization = new SimHttpApiJwtVerification({
+            issuerKeys: api.jwtIssuerKeys,
+            clock: this.clock,
+        }).verify(authorizer, presented);
+        if (!authorization.admitted) {
+            return authorization;
+        }
+        // The scopes are the route's own rather than the authorizer's, so one
+        // authorizer covers routes asking for different scopes. An unmet scope is
+        // the one refusal that is a 403: the token was accepted, and it does not
+        // allow this route.
+        if (!route.authorizationScopes.permits(authorization.jwt?.scopes ?? null)) {
+            return SimHttpApiRefused.forbidden();
+        }
+        return authorization;
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-route-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAWlG;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,KAAK,CAAW;IAEjC,YAAY,UAAkD;QAC5D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAExB,2EAA2E;QAC3E,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAElE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAyB,CAAC;YAClD,UAAU,EAAE,GAAG,CAAC,aAAa;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,oBAAoB;QACpB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YAC1E,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.d.ts

@@ -0,0 +1,28 @@
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
+import type { SimHttpApiMatch } from "../../api/sim-http-api-match.js";
+import type { SimHttpApi } from "../../api/sim-http-api.js";
+/**
+ * Everything a route authorization decision is made from.
+ *
+ * The whole match is carried rather than only the route, because an `AWS_IAM`
+ * route is authorized against an ARN naming the stage that served the request
+ * and the path it asked for, both of which the match settled.
+ */
+export interface SimHttpApiRouteAuthorizeInput {
+    readonly api: SimHttpApi;
+    readonly match: SimHttpApiMatch;
+    readonly request: Request;
+    /**
+     * The principal the serving boundary attributed the request to, from a
+     * signature or from a named caller, and anonymous when it carried neither.
+     */
+    readonly caller: SimAwsRequestCaller;
+    /**
+     * IAM of the Account that owns the API, which is what decides an `AWS_IAM`
+     * route. It is the API's own rather than the caller's, and rather than the
+     * integrated function's.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+//# sourceMappingURL=sim-http-api-route-authorize-input.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-authorize-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-http-api-route-authorize-input.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-authorize-input.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.ts"],"names":[],"mappings":""}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.d.ts

@@ -0,0 +1,32 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+interface SimHttpApiRouteAuthorizerProperties {
+    /**
+     * Clock a JWT route's time claims are checked against, so advancing
+     * simulated time expires a token that was accepted before it.
+     */
+    readonly clock: SimClock;
+}
+/**
+ * Decides whether one request may have the route that matched it.
+ *
+ * This is the client's side of the question, and it runs before the API asks
+ * whether it may invoke the integration: a request presenting no credentials
+ * is refused whether or not the integration behind the route would have
+ * worked.
+ *
+ * Which kind of authorization the route asks for is settled here, and each
+ * kind decides on its own terms.
+ */
+export declare class SimHttpApiRouteAuthorizer {
+    private readonly jwtAuthorizer;
+    private readonly iamAuthorizer;
+    constructor(properties: SimHttpApiRouteAuthorizerProperties);
+    /**
+     * Authorize one request against the route that matched it.
+     */
+    authorize(input: SimHttpApiRouteAuthorizeInput): SimHttpApiAuthorization;
+}
+export {};
+//# sourceMappingURL=sim-http-api-route-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,mCAAmC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CAcvE;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.js

@@ -0,0 +1,42 @@
+import { SimHttpApiAdmitted, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiIamRouteAuthorizer } from "./sim-http-api-iam-route-authorizer.js";
+import { SimHttpApiJwtRouteAuthorizer } from "./sim-http-api-jwt-route-authorizer.js";
+/**
+ * Decides whether one request may have the route that matched it.
+ *
+ * This is the client's side of the question, and it runs before the API asks
+ * whether it may invoke the integration: a request presenting no credentials
+ * is refused whether or not the integration behind the route would have
+ * worked.
+ *
+ * Which kind of authorization the route asks for is settled here, and each
+ * kind decides on its own terms.
+ */
+export class SimHttpApiRouteAuthorizer {
+    jwtAuthorizer;
+    iamAuthorizer = new SimHttpApiIamRouteAuthorizer();
+    constructor(properties) {
+        this.jwtAuthorizer = new SimHttpApiJwtRouteAuthorizer({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Authorize one request against the route that matched it.
+     */
+    authorize(input) {
+        switch (input.match.route.authorizationType) {
+            case "NONE": {
+                // Nobody was authorized, so there is no caller to describe, which is
+                // what leaves requestContext.authorizer out of the event entirely.
+                return new SimHttpApiAdmitted();
+            }
+            case "JWT": {
+                return this.jwtAuthorizer.authorize(input);
+            }
+            case "AWS_IAM": {
+                return this.iamAuthorizer.authorize(input);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-http-api-route-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,GAEnB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAWtF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yBAAyB;IACnB,aAAa,CAA+B;IAC5C,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAA+C;QACzD,IAAI,CAAC,aAAa,GAAG,IAAI,4BAA4B,CAAC;YACpD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,QAAQ,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5C,KAAK,MAAM,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,mEAAmE;gBACnE,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.d.ts

@@ -0,0 +1,44 @@
+import type { SimAwsServiceController, SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import { SimAws } from "../../aws/sim-aws.js";
+import { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
+interface SimApiGatewayV2ServiceControllerProperties {
+    readonly simAws?: SimAws;
+    readonly router?: SimApiGatewayV2Router;
+}
+/**
+ * Localhost HTTP controller for simulated API Gateway HTTP APIs.
+ *
+ * A request reaching the generated endpoint is matched to a route, and the
+ * route's integration invokes a simulated Lambda function with a payload
+ * format 2.0 event. The function runs as its execution Role, as it does for
+ * any other invocation.
+ *
+ * A route that authorizes anybody is checked before any of that: a JWT route's
+ * token has to verify and meet the route's scopes, and an `AWS_IAM` route's
+ * caller has to be allowed `execute-api:Invoke` on the route, or the request is
+ * refused and the function is never invoked. Whether the API may invoke the
+ * function is a separate question, and the API's own rather than the client's.
+ */
+export declare class SimApiGatewayV2ServiceController implements SimAwsServiceController {
+    private readonly router;
+    private readonly eventBuilder;
+    private readonly routeAuthorizer;
+    private readonly responseBuilder;
+    private readonly errorResponse;
+    constructor(properties?: SimApiGatewayV2ServiceControllerProperties);
+    /**
+     * Handle an HTTP request routed to a simulated HTTP API.
+     */
+    handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
+    private invoke;
+    /**
+     * The response a refused request gets back.
+     *
+     * A 403 is an unmet route scope, where the token was accepted and does not
+     * allow this route, or an `AWS_IAM` route IAM did not allow the caller.
+     * Everything else is one 401.
+     */
+    private refusalResponse;
+}
+export {};
+//# sourceMappingURL=sim-api-gateway-v2-controller.d.ts.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAQ9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAGvE,UAAU,0CAA0C;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gCAAiC,YAAW,uBAAuB;IAC9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,GAAE,0CAA+C,EAYtE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E;YAEa,MAAM;IA4EpB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAOxB"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.js

@@ -0,0 +1,131 @@
+import { SimPayload2EventBuilder } from "../../../serve/payload-2/sim-payload-2-event-builder.js";
+import { SimPayload2ResponseBuilder } from "../../../serve/payload-2/sim-payload-2-response-builder.js";
+import { SimAws } from "../../aws/sim-aws.js";
+import { SimHttpApiExecuteApiArn } from "../api/sim-http-api-execute-api-arn.js";
+import { SimHttpApiRequest } from "../api/sim-http-api-request.js";
+import { SimHttpApiIntegrationAuthorizer } from "./auth/sim-http-api-integration-authorizer.js";
+import { SimHttpApiRouteAuthorizer } from "./auth/sim-http-api-route-authorizer.js";
+import { SimApiGatewayV2ErrorResponse } from "./sim-api-gateway-v2-error-response.js";
+import { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
+import { simHttpApiEndpoint } from "./sim-http-api-endpoint.js";
+/**
+ * Localhost HTTP controller for simulated API Gateway HTTP APIs.
+ *
+ * A request reaching the generated endpoint is matched to a route, and the
+ * route's integration invokes a simulated Lambda function with a payload
+ * format 2.0 event. The function runs as its execution Role, as it does for
+ * any other invocation.
+ *
+ * A route that authorizes anybody is checked before any of that: a JWT route's
+ * token has to verify and meet the route's scopes, and an `AWS_IAM` route's
+ * caller has to be allowed `execute-api:Invoke` on the route, or the request is
+ * refused and the function is never invoked. Whether the API may invoke the
+ * function is a separate question, and the API's own rather than the client's.
+ */
+export class SimApiGatewayV2ServiceController {
+    router;
+    eventBuilder;
+    routeAuthorizer;
+    responseBuilder = new SimPayload2ResponseBuilder();
+    errorResponse = new SimApiGatewayV2ErrorResponse();
+    constructor(properties = {}) {
+        const { simAws = new SimAws() } = properties;
+        this.router = properties.router ?? new SimApiGatewayV2Router({ simAws });
+        // Taken from the router rather than from properties, so a supplied router,
+        // the event timestamps and the token expiry checks all belong to the same
+        // simulation.
+        this.eventBuilder = new SimPayload2EventBuilder({
+            clock: this.router.simAws,
+        });
+        this.routeAuthorizer = new SimHttpApiRouteAuthorizer({
+            clock: this.router.simAws,
+        });
+    }
+    /**
+     * Handle an HTTP request routed to a simulated HTTP API.
+     */
+    async handleRequest(serviceRequest) {
+        const httpApi = this.router.route(serviceRequest.target);
+        if (httpApi === undefined) {
+            return this.errorResponse.notFound();
+        }
+        if (httpApi.disableExecuteApiEndpoint) {
+            // The API exists but has switched its generated endpoint off, which is
+            // how an API reachable only through a custom domain is configured.
+            return this.errorResponse.forbidden();
+        }
+        return await this.invoke(httpApi, serviceRequest);
+    }
+    async invoke(api, serviceRequest) {
+        const { request } = serviceRequest;
+        // The whole request path, stage segment and all: the stage takes its own
+        // segment off, and `rawPath` reports the path as the client sent it.
+        const match = api.match(new SimHttpApiRequest({
+            method: request.method,
+            path: new URL(request.url).pathname,
+        }));
+        if (match === undefined) {
+            return this.errorResponse.notFound();
+        }
+        // The client's own authorization comes first: a request with no
+        // credentials is refused whether or not the integration behind the route
+        // would work.
+        const authorization = this.routeAuthorizer.authorize({
+            api,
+            match,
+            request,
+            caller: serviceRequest.caller,
+            iam: this.router.iamFor(api),
+        });
+        if (!authorization.admitted) {
+            return this.refusalResponse(authorization);
+        }
+        const target = this.router.targetFor(match.integration);
+        if (target === undefined) {
+            // The integration names a function that is not there, which real API
+            // Gateway discovers the same way: only when it tries to invoke it.
+            return this.errorResponse.internalServerError();
+        }
+        const decision = new SimHttpApiIntegrationAuthorizer({
+            iam: target.iam,
+        }).authorize({
+            simFunction: target.simFunction,
+            sourceArn: new SimHttpApiExecuteApiArn({
+                api,
+                stageName: match.stage.stageName,
+                methodAndPath: match.route.key.methodAndPath(request.method),
+            }),
+        });
+        if (decision.isDenied) {
+            // Real API Gateway answers a missing invoke permission with a 500 and
+            // never invokes the function, which is the same answer as an integration
+            // that failed. The refusal is only visible in the API's own logs.
+            return this.errorResponse.internalServerError();
+        }
+        try {
+            const event = await this.eventBuilder.build(request, simHttpApiEndpoint(api, match), { jwt: authorization.jwt, caller: authorization.caller });
+            return this.responseBuilder.build(await target.simFunction.invoke(event));
+        }
+        catch {
+            // Real API Gateway reports an unhandled integration error as a 500, with
+            // the error itself only visible in the function's logs. Reading the
+            // request body can fail the same way, so building the event is inside
+            // this too.
+            return this.errorResponse.internalServerError();
+        }
+    }
+    /**
+     * The response a refused request gets back.
+     *
+     * A 403 is an unmet route scope, where the token was accepted and does not
+     * allow this route, or an `AWS_IAM` route IAM did not allow the caller.
+     * Everything else is one 401.
+     */
+    refusalResponse(refused) {
+        if (refused.kind === "forbidden") {
+            return this.errorResponse.forbidden();
+        }
+        return this.errorResponse.unauthorized(refused.errorDescription);
+    }
+}
+//# sourceMappingURL=sim-api-gateway-v2-controller.js.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-controller.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AACxG,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAOhE;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,gCAAgC;IAC1B,MAAM,CAAwB;IAC9B,YAAY,CAA0B;IACtC,eAAe,CAA4B;IAC3C,eAAe,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACnD,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAAU,GAA+C,EAAE;QACrE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,cAAc;QACd,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,IAAI,yBAAyB,CAAC;YACnD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACtC,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,GAAe,EACf,cAAoC;QAEpC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CACrB,IAAI,iBAAiB,CAAC;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;SACpC,CAAC,CACH,CAAC;QAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QAED,gEAAgE;QAChE,yEAAyE;QACzE,cAAc;QACd,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;YACnD,GAAG;YACH,KAAK;YACL,OAAO;YACP,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAExD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,+BAA+B,CAAC;YACnD,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB,CAAC,CAAC,SAAS,CAAC;YACX,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,IAAI,uBAAuB,CAAC;gBACrC,GAAG;gBACH,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;aAC7D,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CACzC,OAAO,EACP,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAC9B,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CACzD,CAAC;YAEF,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,sEAAsE;YACtE,YAAY;YACZ,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,OAA0B;QAChD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The error responses an HTTP API endpoint returns itself, before or instead
+ * of an integration producing one.
+ *
+ * Real API Gateway answers these with a small JSON document rather than the
+ * handler's output. The field is lower-case `message`, which is what an HTTP
+ * API uses; a Lambda Function URL uses `Message` for the same thing, so the
+ * two are not interchangeable and client code reading one of them sees here
+ * what it would see on AWS.
+ */
+export declare class SimApiGatewayV2ErrorResponse {
+    /**
+     * The route's authorizer did not accept the request.
+     *
+     * Everything from a missing token to a claim that does not hold answers this
+     * one status and body, so a client learns that its token was not accepted
+     * and nothing about which check it failed. The `www-authenticate` header
+     * names the scheme, and carries a description only for the one case AWS
+     * publishes one for.
+     */
+    unauthorized(errorDescription?: string): Response;
+    /**
+     * Nothing at this API serves the request: no such API, or no route, or no
+     * stage to serve it from.
+     */
+    notFound(): Response;
+    /**
+     * The API's generated endpoint is switched off, the route asks for a scope
+     * the accepted token does not claim, or IAM denied the caller
+     * `execute-api:Invoke` on the `AWS_IAM` route being called.
+     *
+     * AWS publishes neither the status nor the body for any of these, so both
+     * are what the endpoint was observed to answer rather than something
+     * documented.
+     */
+    forbidden(): Response;
+    /**
+     * The integration failed to handle the request.
+     */
+    internalServerError(): Response;
+    /**
+     * The `www-authenticate` value a refused token gets back.
+     *
+     * Only the description AWS publishes is ever sent, and every other refusal
+     * names the scheme and nothing else, rather than inventing wording. AWS does
+     * not publish how it lays the parameters out around that description, so
+     * they are comma-separated as RFC 6750 writes them.
+     */
+    private bearerChallenge;
+    private jsonResponse;
+}
+//# sourceMappingURL=sim-api-gateway-v2-error-response.d.ts.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-error-response.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,4BAA4B;IACvC;;;;;;;;OAQG;IACH,YAAY,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAIhD;IAED;;;OAGG;IACH,QAAQ,IAAI,QAAQ,CAEnB;IAED;;;;;;;;OAQG;IACH,SAAS,IAAI,QAAQ,CAEpB;IAED;;OAEG;IACH,mBAAmB,IAAI,QAAQ,CAE9B;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,YAAY;CAarB"}