@kensio/yulin 0.47.0 → 1.0.0

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Minimal structural view of a JWT authorizer's configuration, as the Create
+ * and Get commands carry it.
+ */
+export interface SimHttpApiJwtConfigurationView {
+    Issuer: string;
+    Audience: string[];
+}
+interface SimHttpApiJwtConfigurationProperties {
+    readonly issuer: string;
+    readonly audience: readonly string[];
+}
+/**
+ * Which issuer a JWT authorizer trusts, and which audiences it accepts.
+ *
+ * The issuer is compared to the token's `iss` exactly. Real API Gateway
+ * compares them as strings too, which is why a configured issuer with a
+ * trailing slash rejects tokens from the same issuer without one.
+ */
+export declare class SimHttpApiJwtConfiguration {
+    readonly issuer: string;
+    readonly audience: readonly string[];
+    constructor(properties: SimHttpApiJwtConfigurationProperties);
+    /**
+     * Whether a token's `iss` names the issuer this authorizer trusts.
+     */
+    trustsIssuer(issuer: string | undefined): boolean;
+    /**
+     * Whether any audience the token claims is one this authorizer accepts.
+     */
+    acceptsAudience(claimed: readonly string[]): boolean;
+    /**
+     * The AWS-like view of this configuration.
+     */
+    view(): SimHttpApiJwtConfigurationView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-configuration.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-configuration.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAE5C,YAAY,UAAU,EAAE,oCAAoC,EAG3D;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEhD;IAED;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEnD;IAED;;OAEG;IACH,IAAI,IAAI,8BAA8B,CAErC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.js

@@ -0,0 +1,34 @@
+/**
+ * Which issuer a JWT authorizer trusts, and which audiences it accepts.
+ *
+ * The issuer is compared to the token's `iss` exactly. Real API Gateway
+ * compares them as strings too, which is why a configured issuer with a
+ * trailing slash rejects tokens from the same issuer without one.
+ */
+export class SimHttpApiJwtConfiguration {
+    issuer;
+    audience;
+    constructor(properties) {
+        this.issuer = properties.issuer;
+        this.audience = properties.audience;
+    }
+    /**
+     * Whether a token's `iss` names the issuer this authorizer trusts.
+     */
+    trustsIssuer(issuer) {
+        return issuer === this.issuer;
+    }
+    /**
+     * Whether any audience the token claims is one this authorizer accepts.
+     */
+    acceptsAudience(claimed) {
+        return claimed.some((audience) => this.audience.includes(audience));
+    }
+    /**
+     * The AWS-like view of this configuration.
+     */
+    view() {
+        return { Issuer: this.issuer, Audience: [...this.audience] };
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-configuration.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-configuration.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.ts"],"names":[],"mappings":"AAcA;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACrB,MAAM,CAAS;IACf,QAAQ,CAAoB;IAE5C,YAAY,UAAgD;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAA0B;QACrC,OAAO,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAA0B;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/D,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.d.ts

@@ -0,0 +1,37 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * The signing keys an issuer publishes, as a JWT authorizer sees them.
+ *
+ * A JWT authorizer accepts any OIDC issuer, so this port is how it reaches one
+ * without depending on whatever simulated service happens to be that issuer.
+ * A standalone SimApiGatewayV2 has the refusing implementation below, which is
+ * what makes an authorizer with nothing behind its issuer refuse every token
+ * rather than admit one it could not check.
+ *
+ * Nothing is fetched over HTTP. A pool's published OpenID configuration names
+ * the localhost origin it is served from, while its tokens name the real AWS
+ * URL, so a discovery client would reject its own issuer's tokens. Resolving
+ * in process compares the two strings that both come from the same getter.
+ */
+export interface SimHttpApiJwtIssuerKeys {
+    /**
+     * The keys published by the issuer this URL names, which is an empty set
+     * when nothing in the simulation issues for it.
+     */
+    publishedBy(issuerUrl: string): SimJwtKeys;
+}
+/**
+ * The keys available to an API Gateway that has no issuer to ask.
+ *
+ * Every issuer publishes nothing, so every token fails key selection and every
+ * request to a JWT route is refused. That is the safe answer for a simulated
+ * API Gateway standing on its own: a route configured to be closed stays
+ * closed.
+ */
+export declare class SimHttpApiNoJwtIssuerKeys implements SimHttpApiJwtIssuerKeys {
+    /**
+     * No issuer publishes anything here.
+     */
+    publishedBy(): SimJwtKeys;
+}
+//# sourceMappingURL=sim-http-api-jwt-issuer-keys.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-issuer-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,qBAAa,yBAA0B,YAAW,uBAAuB;IACvE;;OAEG;IACH,WAAW,IAAI,UAAU,CAExB;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.js

@@ -0,0 +1,18 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * The keys available to an API Gateway that has no issuer to ask.
+ *
+ * Every issuer publishes nothing, so every token fails key selection and every
+ * request to a JWT route is refused. That is the safe answer for a simulated
+ * API Gateway standing on its own: a route configured to be closed stays
+ * closed.
+ */
+export class SimHttpApiNoJwtIssuerKeys {
+    /**
+     * No issuer publishes anything here.
+     */
+    publishedBy() {
+        return new SimJwtKeys([]);
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-issuer-keys.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-issuer-keys.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAwBlE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.d.ts

@@ -0,0 +1,43 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimHttpApiAuthorizer } from "./sim-http-api-authorizer.js";
+import { type SimHttpApiAuthorization } from "./sim-http-api-authorization.js";
+import type { SimHttpApiJwtIssuerKeys } from "./sim-http-api-jwt-issuer-keys.js";
+interface SimHttpApiJwtVerificationProperties {
+    readonly issuerKeys: SimHttpApiJwtIssuerKeys;
+    readonly clock: SimClock;
+}
+/**
+ * Verifies one token against one JWT authorizer.
+ *
+ * The checks run in the order AWS documents: decode the token, check its
+ * algorithm, find the key its `kid` names, verify the signature, then validate
+ * the claims. AWS lists the signature above the key id; the key has to be
+ * chosen before a signature can be checked, and every one of these answers the
+ * same 401, so the two are not distinguishable from outside.
+ *
+ * `token_use` is not checked, which is what real API Gateway does. An id token
+ * therefore passes an authorizer configured only with an audience, because its
+ * `aud` is the app client id. Route scopes are the only thing that tells the
+ * two token types apart, and they are the route's business rather than this
+ * one's.
+ */
+export declare class SimHttpApiJwtVerification {
+    private readonly issuerKeys;
+    private readonly claimChecks;
+    private readonly rs256;
+    constructor(properties: SimHttpApiJwtVerificationProperties);
+    /**
+     * Verify a token, answering what the endpoint should do with the request
+     * that carried it.
+     */
+    verify(authorizer: SimHttpApiAuthorizer, token: string): SimHttpApiAuthorization;
+    /**
+     * Read the token, or answer undefined for one that is not a JWT at all.
+     *
+     * The refusal for an unreadable token and for one that fails verification is
+     * the same, so nothing is gained by carrying the parse error further.
+     */
+    private decode;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-verification.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-verification.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,YAAY,UAAU,EAAE,mCAAmC,EAK1D;IAED;;;OAGG;IACH,MAAM,CACJ,UAAU,EAAE,oBAAoB,EAChC,KAAK,EAAE,MAAM,GACZ,uBAAuB,CA0BzB;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAM;CAOf"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.js

@@ -0,0 +1,70 @@
+import { SimJwtRs256 } from "../../../../util/jwt/sim-jwt-rs256.js";
+import { SimJwt } from "../../../../util/jwt/sim-jwt.js";
+import { SimHttpApiAdmitted, SimHttpApiRefused, } from "./sim-http-api-authorization.js";
+import { SimHttpApiJwtClaimChecks } from "./sim-http-api-jwt-claim-checks.js";
+import { SimHttpApiJwtClaims } from "./sim-http-api-jwt-claims.js";
+/**
+ * Verifies one token against one JWT authorizer.
+ *
+ * The checks run in the order AWS documents: decode the token, check its
+ * algorithm, find the key its `kid` names, verify the signature, then validate
+ * the claims. AWS lists the signature above the key id; the key has to be
+ * chosen before a signature can be checked, and every one of these answers the
+ * same 401, so the two are not distinguishable from outside.
+ *
+ * `token_use` is not checked, which is what real API Gateway does. An id token
+ * therefore passes an authorizer configured only with an audience, because its
+ * `aud` is the app client id. Route scopes are the only thing that tells the
+ * two token types apart, and they are the route's business rather than this
+ * one's.
+ */
+export class SimHttpApiJwtVerification {
+    issuerKeys;
+    claimChecks;
+    rs256 = new SimJwtRs256();
+    constructor(properties) {
+        this.issuerKeys = properties.issuerKeys;
+        this.claimChecks = new SimHttpApiJwtClaimChecks({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Verify a token, answering what the endpoint should do with the request
+     * that carried it.
+     */
+    verify(authorizer, token) {
+        const jwt = this.decode(token);
+        if (jwt === undefined) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (!this.rs256.isSupportedAlgorithm(jwt)) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        const { jwtConfiguration } = authorizer;
+        const key = this.issuerKeys
+            .publishedBy(jwtConfiguration.issuer)
+            .find(jwt.header.kid);
+        if (key === undefined || !this.rs256.verify(jwt, key)) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        return (this.claimChecks.check(jwt.claims, jwtConfiguration) ??
+            new SimHttpApiAdmitted({
+                jwt: new SimHttpApiJwtClaims(jwt.claims).toAuthorizerContext(),
+            }));
+    }
+    /**
+     * Read the token, or answer undefined for one that is not a JWT at all.
+     *
+     * The refusal for an unreadable token and for one that fails verification is
+     * the same, so nothing is gained by carrying the parse error further.
+     */
+    decode(token) {
+        try {
+            return SimJwt.parse(token);
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-verification.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-verification.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,UAAU,CAA0B;IACpC,WAAW,CAA2B;IACtC,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAE3C,YAAY,UAA+C;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,wBAAwB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,UAAgC,EAChC,KAAa;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU;aACxB,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC;aACpC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,CACL,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;YACpD,IAAI,kBAAkB,CAAC;gBACrB,GAAG,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE;aAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration-store.d.ts

@@ -0,0 +1,27 @@
+import { type SimHttpApiIntegration, type SimHttpApiIntegrationId } from "./sim-http-api-integration.js";
+/**
+ * The integrations of one API, keyed by the id the API allocated for them.
+ *
+ * Integrations belong to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export declare class SimHttpApiIntegrationStore {
+    private readonly integrations;
+    /**
+     * Allocate an integration id this API is not already using.
+     */
+    allocateId(): SimHttpApiIntegrationId;
+    /**
+     * Add an integration to this API.
+     */
+    add(integration: SimHttpApiIntegration): void;
+    /**
+     * Find an integration by id.
+     */
+    find(integrationId: string): SimHttpApiIntegration | undefined;
+    /**
+     * List every integration of this API, in the order they were created.
+     */
+    list(): SimHttpApiIntegration[];
+}
+//# sourceMappingURL=sim-http-api-integration-store.d.ts.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-integration-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAE7B,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IAEJ;;OAEG;IACH,UAAU,IAAI,uBAAuB,CASpC;IAED;;OAEG;IACH,GAAG,CAAC,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAE5C;IAED;;OAEG;IACH,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAE7D;IAED;;OAEG;IACH,IAAI,IAAI,qBAAqB,EAAE,CAE9B;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration-store.js

@@ -0,0 +1,40 @@
+import { makeSimHttpApiIntegrationId, } from "./sim-http-api-integration.js";
+/**
+ * The integrations of one API, keyed by the id the API allocated for them.
+ *
+ * Integrations belong to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export class SimHttpApiIntegrationStore {
+    integrations = new Map();
+    /**
+     * Allocate an integration id this API is not already using.
+     */
+    allocateId() {
+        let integrationId = makeSimHttpApiIntegrationId();
+        while (this.integrations.has(integrationId)) {
+            /* v8 ignore next -- does not happen in practice */
+            integrationId = makeSimHttpApiIntegrationId();
+        }
+        return integrationId;
+    }
+    /**
+     * Add an integration to this API.
+     */
+    add(integration) {
+        this.integrations.set(integration.integrationId, integration);
+    }
+    /**
+     * Find an integration by id.
+     */
+    find(integrationId) {
+        return this.integrations.get(integrationId);
+    }
+    /**
+     * List every integration of this API, in the order they were created.
+     */
+    list() {
+        return this.integrations.values().toArray();
+    }
+}
+//# sourceMappingURL=sim-http-api-integration-store.js.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration-store.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-integration-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IACpB,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ;;OAEG;IACH,UAAU;QACR,IAAI,aAAa,GAAG,2BAA2B,EAAE,CAAC;QAElD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5C,mDAAmD;YACnD,aAAa,GAAG,2BAA2B,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,WAAkC;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,aAAqB;QACxB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAwC,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration.d.ts

@@ -0,0 +1,66 @@
+import type { Brand } from "../../../../util/brand.type.js";
+import type { SimHttpApiLambdaUri } from "./sim-http-api-lambda-uri.js";
+/**
+ * The id API Gateway allocates for one integration.
+ */
+export type SimHttpApiIntegrationId = Brand<string, "SimHttpApiIntegrationId">;
+/**
+ * The only integration type simulated: a Lambda proxy integration.
+ */
+export type SimHttpApiIntegrationType = "AWS_PROXY";
+/**
+ * The only payload format simulated. Format 1.0 is refused rather than quietly
+ * treated as 2.0, because a handler written for 1.0 reads event fields a 2.0
+ * event does not have.
+ */
+export type SimHttpApiPayloadFormatVersion = "2.0";
+/**
+ * Allocate an integration id.
+ *
+ * Real API Gateway ids are opaque short lowercase alphanumeric strings; the
+ * exact length is not part of the API contract, so only the shape is matched.
+ */
+export declare function makeSimHttpApiIntegrationId(): SimHttpApiIntegrationId;
+interface SimHttpApiIntegrationProperties {
+    readonly integrationId: SimHttpApiIntegrationId;
+    readonly integrationType: SimHttpApiIntegrationType;
+    readonly lambdaUri: SimHttpApiLambdaUri;
+    readonly payloadFormatVersion: SimHttpApiPayloadFormatVersion;
+    readonly description?: string | undefined;
+}
+/**
+ * Minimal structural integration view, as the Create and Get commands return.
+ */
+export interface SimHttpApiIntegrationView {
+    IntegrationId: string;
+    IntegrationType: SimHttpApiIntegrationType;
+    IntegrationUri: string;
+    PayloadFormatVersion: SimHttpApiPayloadFormatVersion;
+    Description?: string;
+}
+/**
+ * A simulated HTTP API integration: what the API does with a request one of
+ * its routes matched.
+ *
+ * Only `AWS_PROXY` is modelled, so an integration is a Lambda function and the
+ * payload format that function is invoked with.
+ */
+export declare class SimHttpApiIntegration {
+    readonly integrationId: SimHttpApiIntegrationId;
+    readonly integrationType: SimHttpApiIntegrationType;
+    readonly lambdaUri: SimHttpApiLambdaUri;
+    readonly payloadFormatVersion: SimHttpApiPayloadFormatVersion;
+    readonly description?: string | undefined;
+    constructor(properties: SimHttpApiIntegrationProperties);
+    /**
+     * The ARN of the Lambda function this integration invokes, as the request
+     * gave it and the API hands it back.
+     */
+    get integrationUri(): string;
+    /**
+     * Get the AWS-like view of this integration.
+     */
+    view(): SimHttpApiIntegrationView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-integration.d.ts.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-integration.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAEpD;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,KAAK,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,uBAAuB,CAErE;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,oBAAoB,EAAE,8BAA8B,CAAC;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,8BAA8B,CAAC;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAC3D,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAC/C,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IACrE,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjD,YAAY,UAAU,EAAE,+BAA+B,EAMtD;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED;;OAEG;IACH,IAAI,IAAI,yBAAyB,CAahC;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration.js

@@ -0,0 +1,54 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Allocate an integration id.
+ *
+ * Real API Gateway ids are opaque short lowercase alphanumeric strings; the
+ * exact length is not part of the API contract, so only the shape is matched.
+ */
+export function makeSimHttpApiIntegrationId() {
+    return faker.helpers.fromRegExp(/[a-z0-9]{8}/);
+}
+/**
+ * A simulated HTTP API integration: what the API does with a request one of
+ * its routes matched.
+ *
+ * Only `AWS_PROXY` is modelled, so an integration is a Lambda function and the
+ * payload format that function is invoked with.
+ */
+export class SimHttpApiIntegration {
+    integrationId;
+    integrationType;
+    lambdaUri;
+    payloadFormatVersion;
+    description;
+    constructor(properties) {
+        this.integrationId = properties.integrationId;
+        this.integrationType = properties.integrationType;
+        this.lambdaUri = properties.lambdaUri;
+        this.payloadFormatVersion = properties.payloadFormatVersion;
+        this.description = properties.description;
+    }
+    /**
+     * The ARN of the Lambda function this integration invokes, as the request
+     * gave it and the API hands it back.
+     */
+    get integrationUri() {
+        return this.lambdaUri.uri;
+    }
+    /**
+     * Get the AWS-like view of this integration.
+     */
+    view() {
+        const view = {
+            IntegrationId: this.integrationId,
+            IntegrationType: this.integrationType,
+            IntegrationUri: this.integrationUri,
+            PayloadFormatVersion: this.payloadFormatVersion,
+        };
+        if (this.description !== undefined) {
+            view.Description = this.description;
+        }
+        return view;
+    }
+}
+//# sourceMappingURL=sim-http-api-integration.js.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAsBxC;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAA4B,CAAC;AAC5E,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAChB,aAAa,CAA0B;IACvC,eAAe,CAA4B;IAC3C,SAAS,CAAsB;IAC/B,oBAAoB,CAAiC;IACrD,WAAW,CAAsB;IAEjD,YAAY,UAA2C;QACrD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,oBAAoB,GAAG,UAAU,CAAC,oBAAoB,CAAC;QAC5D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI;QACF,MAAM,IAAI,GAA8B;YACtC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The `IntegrationUri` of an `AWS_PROXY` integration: the ARN of the Lambda
+ * function the integration invokes.
+ *
+ * Only an unqualified function ARN is accepted. A version or alias qualifier
+ * on the end names a published function version, and simulated Lambda has no
+ * versions, so one is refused rather than invoked as the unpublished function
+ * it is not.
+ *
+ * Both URI forms reach the same function, and both are held as the function
+ * ARN, which is what the API hands back. Reading them here rather than in each
+ * caller is what lets an SDK caller, a template and an imported document write
+ * whichever form they write.
+ */
+export declare class SimHttpApiLambdaUri {
+    readonly uri: string;
+    readonly regionName: string;
+    readonly accountId: string;
+    readonly functionName: string;
+    private constructor();
+    /**
+     * Read an integration URI, refusing anything that is not a Lambda function
+     * ARN.
+     */
+    static parse(uri: string): SimHttpApiLambdaUri;
+    /**
+     * The function ARN a URI names, in either form it is written in.
+     */
+    private static functionArn;
+}
+//# sourceMappingURL=sim-http-api-lambda-uri.d.ts.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-lambda-uri.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;GAaG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC,OAAO,eAMN;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAc7C;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;CAG3B"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.js

@@ -0,0 +1,63 @@
+import { SimApiGatewayV2BadRequest } from "../../error/sim-api-gateway-v2.error.js";
+const lambdaFunctionArn = /^arn:aws:lambda:(?<regionName>[a-z0-9-]+):(?<accountId>\d{12}):function:(?<functionName>[a-zA-Z0-9-_]+)$/;
+/**
+ * The other form an integration URI is written in, wrapping a Lambda function
+ * ARN in an API Gateway path:
+ *
+ *   arn:aws:apigateway:eu-west-2:lambda:path/2015-03-31/functions/<function-arn>/invocations
+ *
+ * The date is the Lambda invoke API version and is part of the literal rather
+ * than something a caller chooses. An OpenAPI document being imported writes
+ * this form, and so does a hand-written CloudFormation template, while CDK
+ * emits the bare function ARN.
+ */
+const apiGatewayLambdaPathUri = /^arn:[^:]+:apigateway:[^:]+:lambda:path\/2015-03-31\/functions\/(?<functionArn>arn:[^/]+)\/invocations$/;
+/**
+ * The `IntegrationUri` of an `AWS_PROXY` integration: the ARN of the Lambda
+ * function the integration invokes.
+ *
+ * Only an unqualified function ARN is accepted. A version or alias qualifier
+ * on the end names a published function version, and simulated Lambda has no
+ * versions, so one is refused rather than invoked as the unpublished function
+ * it is not.
+ *
+ * Both URI forms reach the same function, and both are held as the function
+ * ARN, which is what the API hands back. Reading them here rather than in each
+ * caller is what lets an SDK caller, a template and an imported document write
+ * whichever form they write.
+ */
+export class SimHttpApiLambdaUri {
+    uri;
+    regionName;
+    accountId;
+    functionName;
+    constructor(uri, groups) {
+        this.uri = uri;
+        /* v8 ignore next 3 -- the pattern that matched fills all three groups */
+        this.regionName = groups["regionName"] ?? "";
+        this.accountId = groups["accountId"] ?? "";
+        this.functionName = groups["functionName"] ?? "";
+    }
+    /**
+     * Read an integration URI, refusing anything that is not a Lambda function
+     * ARN.
+     */
+    static parse(uri) {
+        const functionArn = this.functionArn(uri);
+        const groups = lambdaFunctionArn.exec(functionArn)?.groups;
+        if (groups === undefined) {
+            throw new SimApiGatewayV2BadRequest(`IntegrationUri '${uri}' is not a simulated integration target: an ` +
+                `AWS_PROXY integration is simulated only for an unqualified Lambda ` +
+                `function ARN, such as ` +
+                `arn:aws:lambda:eu-west-2:111111111111:function:orders`);
+        }
+        return new SimHttpApiLambdaUri(functionArn, groups);
+    }
+    /**
+     * The function ARN a URI names, in either form it is written in.
+     */
+    static functionArn(uri) {
+        return apiGatewayLambdaPathUri.exec(uri)?.groups?.["functionArn"] ?? uri;
+    }
+}
+//# sourceMappingURL=sim-http-api-lambda-uri.js.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-lambda-uri.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,MAAM,iBAAiB,GACrB,0GAA0G,CAAC;AAE7G;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAC3B,yGAAyG,CAAC;AAE5G;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,mBAAmB;IACd,GAAG,CAAS;IACZ,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,YAAY,CAAS;IAErC,YAAoB,GAAW,EAAE,MAA8B;QAC7D,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,GAAW;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAE3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,GAAG,8CAA8C;gBAClE,oEAAoE;gBACpE,wBAAwB;gBACxB,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,WAAW,CAAC,GAAW;QACpC,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/apigatewayv2/api/route/key/sim-http-api-default-route-key.d.ts

@@ -0,0 +1,36 @@
+import { SimHttpApiPathParameters } from "../path/sim-http-api-path-parameters.js";
+import { SimHttpApiRouteRank } from "../sim-http-api-route-rank.js";
+import type { SimHttpApiRouteKey } from "./sim-http-api-route-key.js";
+/**
+ * The catch-all route key, which serves any method and path the API has no
+ * more specific route for.
+ */
+export declare const simHttpApiDefaultRouteKey = "$default";
+/**
+ * The `$default` route.
+ *
+ * It matches everything and captures nothing, and it loses to every other
+ * matching route, which is the tier AWS documents it in.
+ */
+export declare class SimHttpApiDefaultRouteKey implements SimHttpApiRouteKey {
+    readonly text = "$default";
+    readonly signature = "$default";
+    readonly rank: SimHttpApiRouteRank;
+    /**
+     * Match any request, capturing nothing.
+     *
+     * The empty capture is what keeps `pathParameters` out of the event for a
+     * `$default` match, which is what real API Gateway does with it. That is
+     * observed rather than documented.
+     */
+    match(): SimHttpApiPathParameters;
+    /**
+     * Name this route in an `execute-api` ARN.
+     *
+     * The catch-all has no method and no path of its own, and both collapse into
+     * the single literal `$default`, so the ARN ends `<apiId>/<stage>/$default`.
+     * AWS gives that form as a CLI example for granting a `$default` route.
+     */
+    methodAndPath(): string;
+}
+//# sourceMappingURL=sim-http-api-default-route-key.d.ts.map

package/dist/service/apigatewayv2/api/route/key/sim-http-api-default-route-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-default-route-key.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/route/key/sim-http-api-default-route-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAEL,mBAAmB,EACpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAEpD;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAClE,SAAgB,IAAI,cAA6B;IACjD,SAAgB,SAAS,cAA6B;IACtD,SAAgB,IAAI,sBAIjB;IAEH;;;;;;OAMG;IACH,KAAK,IAAI,wBAAwB,CAEhC;IAED;;;;;;OAMG;IACH,aAAa,IAAI,MAAM,CAEtB;CACF"}