@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.d.ts

@@ -0,0 +1,27 @@
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+/**
+ * The IAM policy document a Lambda authorizer answers with, evaluated for
+ * `execute-api:Invoke` on the route the request matched.
+ *
+ * This is the same evaluation an `AWS_IAM` route goes through, with one
+ * difference: the document the authorizer returned is the whole decision.
+ * There are no stored policies to gather, because there is no IAM principal
+ * here at all. The `principalId` the authorizer returns alongside is a name it
+ * chose for the caller rather than anything IAM knows, so it identifies the
+ * caller in the authorizer's own logs and grants nothing.
+ *
+ * An explicit Deny still wins over an Allow, and a document allowing nothing
+ * relevant refuses the request, which is how IAM reads any policy.
+ */
+export declare class SimHttpApiAuthorizerPolicy {
+    private readonly document;
+    constructor(document: SimIamPolicyDocument);
+    /**
+     * Whether this document allows the request to reach the route.
+     *
+     * Throws the way IAM does for a document it cannot read, which the caller
+     * answers with the same 500 any other unusable authorizer response gets.
+     */
+    allows(routeArn: string): boolean;
+}
+//# sourceMappingURL=sim-http-api-authorizer-policy.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGlF;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAEhD,YAAY,QAAQ,EAAE,oBAAoB,EAEzC;IAED;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAyBhC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.js

@@ -0,0 +1,56 @@
+import { SimIamEitherSideAllowRequirement } from "../../../iam/authorize/allow/sim-iam-allow-requirement.js";
+import { SimIamPolicyDecision } from "../../../iam/authorize/sim-iam-decision.js";
+import { simExecuteApiInvokeAction } from "./sim-http-api-iam-route-authorizer.js";
+/**
+ * The IAM policy document a Lambda authorizer answers with, evaluated for
+ * `execute-api:Invoke` on the route the request matched.
+ *
+ * This is the same evaluation an `AWS_IAM` route goes through, with one
+ * difference: the document the authorizer returned is the whole decision.
+ * There are no stored policies to gather, because there is no IAM principal
+ * here at all. The `principalId` the authorizer returns alongside is a name it
+ * chose for the caller rather than anything IAM knows, so it identifies the
+ * caller in the authorizer's own logs and grants nothing.
+ *
+ * An explicit Deny still wins over an Allow, and a document allowing nothing
+ * relevant refuses the request, which is how IAM reads any policy.
+ */
+export class SimHttpApiAuthorizerPolicy {
+    document;
+    constructor(document) {
+        this.document = document;
+    }
+    /**
+     * Whether this document allows the request to reach the route.
+     *
+     * Throws the way IAM does for a document it cannot read, which the caller
+     * answers with the same 500 any other unusable authorizer response gets.
+     */
+    allows(routeArn) {
+        return new SimIamPolicyDecision({
+            // The document is evaluated as the identity side, which is the side with
+            // no Principal to state: an authorizer's policy says what the caller it
+            // just identified may do, not who may reach the route.
+            identityPolicies: [
+                {
+                    sourceType: "identity-inline",
+                    document: this.document,
+                    policyName: "AuthorizerPolicyDocument",
+                },
+            ],
+            resourcePolicies: [],
+            allowRequirement: new SimIamEitherSideAllowRequirement(),
+            action: simExecuteApiInvokeAction,
+            resource: routeArn,
+            conditionContext: {},
+            // There is no principal behind this document, and nothing in it can name
+            // one, so the caller is anonymous. A condition on a principal key
+            // therefore never matches, which is the strict direction to be wrong in.
+            caller: {
+                principal: { kind: "anonymous" },
+                identityPolicyPrincipal: { kind: "anonymous" },
+            },
+        }).isAllowed;
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-policy.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-policy.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,0BAA0B;IACpB,QAAQ,CAAuB;IAEhD,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,QAAgB;QACrB,OAAO,IAAI,oBAAoB,CAAC;YAC9B,yEAAyE;YACzE,wEAAwE;YACxE,uDAAuD;YACvD,gBAAgB,EAAE;gBAChB;oBACE,UAAU,EAAE,iBAAiB;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,0BAA0B;iBACvC;aACF;YACD,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,IAAI,gCAAgC,EAAE;YACxD,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,QAAQ;YAClB,gBAAgB,EAAE,EAAE;YACpB,yEAAyE;YACzE,kEAAkE;YAClE,yEAAyE;YACzE,MAAM,EAAE;gBACN,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAChC,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC/C;SACF,CAAC,CAAC,SAAS,CAAC;IACf,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.d.ts

@@ -0,0 +1,52 @@
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiRequestAuthorizer } from "../../api/authorizer/sim-http-api-request-authorizer.js";
+interface SimHttpApiAuthorizerResponseProperties {
+    readonly authorizer: SimHttpApiRequestAuthorizer;
+    /** The route ARN a policy response is evaluated against. */
+    readonly routeArn: string;
+}
+/**
+ * Reads what a Lambda `REQUEST` authorizer answered.
+ *
+ * There are two shapes, and `EnableSimpleResponses` says which one applies:
+ * `{ isAuthorized, context }`, or a `principalId` with an IAM `policyDocument`
+ * that has to allow `execute-api:Invoke` on the route. A response that is not
+ * the shape its authorizer was configured for is a 500 rather than a refusal,
+ * because API Gateway could not read it either.
+ *
+ * `{ "errorMessage": "Unauthorized" }` is the one answer that produces a 401,
+ * and it is read whichever shape the authorizer is configured for. A function
+ * that throws is an invocation failure here rather than that value: real
+ * Lambda turns a thrown error into a payload carrying this member, while
+ * simulated Lambda rejects with the error itself, so returning the value is
+ * the way to ask for a 401.
+ */
+export declare class SimHttpApiAuthorizerResponse {
+    private readonly authorizer;
+    private readonly routeArn;
+    constructor(properties: SimHttpApiAuthorizerResponseProperties);
+    /**
+     * What the endpoint should do with the request, given what the authorizer
+     * answered.
+     */
+    read(result: unknown): SimHttpApiAuthorization;
+    /**
+     * Read a simple response, which says yes or no and nothing else.
+     */
+    private simpleResponse;
+    /**
+     * Read a policy response, and put the document it carries to IAM.
+     */
+    private policyResponse;
+    private evaluated;
+    /**
+     * The admitted request, carrying whatever the authorizer passed on.
+     *
+     * A context that is not an object is left out rather than passed on as it
+     * stands, since `requestContext.authorizer.lambda` is a JSON object on AWS
+     * and a handler reading a member off it would find something else here.
+     */
+    private admitted;
+}
+export {};
+//# sourceMappingURL=sim-http-api-authorizer-response.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAmB3G,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,uBAAuB,CAc7C;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;IAgBtB;;OAEG;IACH,OAAO,CAAC,cAAc;IAqBtB,OAAO,CAAC,SAAS;IAejB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;CAWjB"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.js

@@ -0,0 +1,112 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimHttpApiAdmitted, SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiAuthorizerPolicy } from "./sim-http-api-authorizer-policy.js";
+/**
+ * The one message a Lambda authorizer answers a 401 with.
+ */
+const unauthorizedErrorMessage = "Unauthorized";
+/**
+ * Whether the returned `policyDocument` is worth handing to IAM at all.
+ *
+ * Only its outer shape is checked here. What is inside it is IAM's business,
+ * and a document IAM cannot read is a response API Gateway could not have used
+ * either, so both end up as the same 500.
+ */
+function isPolicyDocument(value) {
+    return isRecord(value);
+}
+/**
+ * Reads what a Lambda `REQUEST` authorizer answered.
+ *
+ * There are two shapes, and `EnableSimpleResponses` says which one applies:
+ * `{ isAuthorized, context }`, or a `principalId` with an IAM `policyDocument`
+ * that has to allow `execute-api:Invoke` on the route. A response that is not
+ * the shape its authorizer was configured for is a 500 rather than a refusal,
+ * because API Gateway could not read it either.
+ *
+ * `{ "errorMessage": "Unauthorized" }` is the one answer that produces a 401,
+ * and it is read whichever shape the authorizer is configured for. A function
+ * that throws is an invocation failure here rather than that value: real
+ * Lambda turns a thrown error into a payload carrying this member, while
+ * simulated Lambda rejects with the error itself, so returning the value is
+ * the way to ask for a 401.
+ */
+export class SimHttpApiAuthorizerResponse {
+    authorizer;
+    routeArn;
+    constructor(properties) {
+        this.authorizer = properties.authorizer;
+        this.routeArn = properties.routeArn;
+    }
+    /**
+     * What the endpoint should do with the request, given what the authorizer
+     * answered.
+     */
+    read(result) {
+        if (!isRecord(result)) {
+            return SimHttpApiRefused.error();
+        }
+        if (result["errorMessage"] === unauthorizedErrorMessage) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (this.authorizer.enableSimpleResponses) {
+            return this.simpleResponse(result);
+        }
+        return this.policyResponse(result);
+    }
+    /**
+     * Read a simple response, which says yes or no and nothing else.
+     */
+    simpleResponse(result) {
+        const isAuthorized = result["isAuthorized"];
+        if (typeof isAuthorized !== "boolean") {
+            return SimHttpApiRefused.error();
+        }
+        if (!isAuthorized) {
+            return SimHttpApiRefused.forbidden();
+        }
+        return this.admitted(result);
+    }
+    /**
+     * Read a policy response, and put the document it carries to IAM.
+     */
+    policyResponse(result) {
+        const policyDocument = result["policyDocument"];
+        if (typeof result["principalId"] !== "string" ||
+            !isPolicyDocument(policyDocument)) {
+            return SimHttpApiRefused.error();
+        }
+        try {
+            return this.evaluated(policyDocument, result);
+        }
+        catch {
+            // IAM refused to read the document, which is a malformed policy rather
+            // than a policy that says no.
+            return SimHttpApiRefused.error();
+        }
+    }
+    evaluated(policyDocument, result) {
+        const allowed = new SimHttpApiAuthorizerPolicy(policyDocument).allows(this.routeArn);
+        if (!allowed) {
+            return SimHttpApiRefused.forbidden();
+        }
+        return this.admitted(result);
+    }
+    /**
+     * The admitted request, carrying whatever the authorizer passed on.
+     *
+     * A context that is not an object is left out rather than passed on as it
+     * stands, since `requestContext.authorizer.lambda` is a JSON object on AWS
+     * and a handler reading a member off it would find something else here.
+     */
+    admitted(result) {
+        const context = result["context"];
+        if (!isRecord(context)) {
+            return new SimHttpApiAdmitted({ lambda: null });
+        }
+        return new SimHttpApiAdmitted({
+            lambda: context,
+        });
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-response.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-response.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAE5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;GAEG;AACH,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEhD;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAQD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,4BAA4B;IACtB,UAAU,CAA8B;IACxC,QAAQ,CAAS;IAElC,YAAY,UAAkD;QAC5D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,MAAe;QAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,wBAAwB,EAAE,CAAC;YACxD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEhD,IACE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ;YACzC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EACjC,CAAC;YACD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,8BAA8B;YAC9B,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,SAAS,CACf,cAAoC,EACpC,MAA+B;QAE/B,MAAM,OAAO,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC,MAAM,CACnE,IAAI,CAAC,QAAQ,CACd,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACK,QAAQ,CAAC,MAA+B;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAElC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC;YAC5B,MAAM,EAAE,OAAsC;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.d.ts

@@ -0,0 +1,40 @@
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+/**
+ * The IAM action a request to an `AWS_IAM` route is authorized against.
+ *
+ * It is the only `execute-api` action evaluated here. The others AWS defines
+ * are WebSocket management and REST API cache invalidation, and nothing
+ * constrains the action string a policy may name, so a policy is free to grant
+ * one of them and nothing will ask about it.
+ */
+export declare const simExecuteApiInvokeAction = "execute-api:Invoke";
+/**
+ * Decides whether a caller may have an `AWS_IAM` route.
+ *
+ * This is the client's own authorization, evaluated against the identity
+ * policies of the caller the serving boundary resolved. An HTTP API has no
+ * resource policy, so no resource policies are supplied, and the caller's
+ * identity policies are the whole decision. That is also why a caller from
+ * another Account is always refused: a cross-Account request needs an Allow
+ * from each side, and there is nowhere on an HTTP API to put the resource side.
+ * The way through, here as on AWS, is to assume a Role in the API's Account.
+ */
+export declare class SimHttpApiIamRouteAuthorizer {
+    /**
+     * Evaluate `execute-api:Invoke` for the caller against the route being
+     * called.
+     */
+    authorize(input: SimHttpApiRouteAuthorizeInput): SimHttpApiAuthorization;
+    /**
+     * The `execute-api` ARN of the request being authorized.
+     *
+     * An identity policy is written by hand against the request a caller is
+     * making, so this names the concrete method and the concrete path, unlike
+     * the ARN the integration's invoke permission is matched against. The method
+     * is upper-cased because AWS puts a verb there and a policy names one, while
+     * a Fetch request may carry a method in any case.
+     */
+    private routeArn;
+}
+//# sourceMappingURL=sim-http-api-iam-route-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-iam-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAE5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,qBAAa,4BAA4B;IACvC;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CAYvE;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ;CAWjB"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.js

@@ -0,0 +1,57 @@
+import { SimHttpApiAdmitted, SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
+/**
+ * The IAM action a request to an `AWS_IAM` route is authorized against.
+ *
+ * It is the only `execute-api` action evaluated here. The others AWS defines
+ * are WebSocket management and REST API cache invalidation, and nothing
+ * constrains the action string a policy may name, so a policy is free to grant
+ * one of them and nothing will ask about it.
+ */
+export const simExecuteApiInvokeAction = "execute-api:Invoke";
+/**
+ * Decides whether a caller may have an `AWS_IAM` route.
+ *
+ * This is the client's own authorization, evaluated against the identity
+ * policies of the caller the serving boundary resolved. An HTTP API has no
+ * resource policy, so no resource policies are supplied, and the caller's
+ * identity policies are the whole decision. That is also why a caller from
+ * another Account is always refused: a cross-Account request needs an Allow
+ * from each side, and there is nowhere on an HTTP API to put the resource side.
+ * The way through, here as on AWS, is to assume a Role in the API's Account.
+ */
+export class SimHttpApiIamRouteAuthorizer {
+    /**
+     * Evaluate `execute-api:Invoke` for the caller against the route being
+     * called.
+     */
+    authorize(input) {
+        const decision = input.iam.authorize({
+            action: simExecuteApiInvokeAction,
+            resource: this.routeArn(input).toString(),
+            caller: input.caller.toCaller(),
+        });
+        if (decision.isDenied) {
+            return SimHttpApiRefused.forbidden();
+        }
+        return new SimHttpApiAdmitted({ caller: input.caller });
+    }
+    /**
+     * The `execute-api` ARN of the request being authorized.
+     *
+     * An identity policy is written by hand against the request a caller is
+     * making, so this names the concrete method and the concrete path, unlike
+     * the ARN the integration's invoke permission is matched against. The method
+     * is upper-cased because AWS puts a verb there and a policy names one, while
+     * a Fetch request may carry a method in any case.
+     */
+    routeArn(input) {
+        const { api, match, request } = input;
+        return new SimHttpApiExecuteApiArn({
+            api,
+            stageName: match.stage.stageName,
+            methodAndPath: `${request.method.toUpperCase()}/${match.pathAfterStage}`,
+        });
+    }
+}
+//# sourceMappingURL=sim-http-api-iam-route-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-iam-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAGpF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,4BAA4B;IACvC;;;OAGG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YACnC,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CACd,KAAoC;QAEpC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAEtC,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG;YACH,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.d.ts

@@ -0,0 +1,60 @@
+import type { SimIamAuthorizationDecision, SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimLambdaFunction } from "../../../lambda/function/sim-lambda-function.js";
+import type { SimHttpApiRequestAuthorizer } from "../../api/authorizer/sim-http-api-request-authorizer.js";
+import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
+import type { SimHttpApi } from "../../api/sim-http-api.js";
+import type { SimHttpApiFunctionTarget } from "../sim-api-gateway-v2-router.js";
+/**
+ * The service principal API Gateway invokes a Lambda function as, whether that
+ * function is behind an integration or behind an authorizer.
+ */
+export declare const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+interface SimHttpApiInvokeAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface SimHttpApiInvokeAuthorizationInput {
+    readonly api: SimHttpApi;
+    readonly simFunction: SimLambdaFunction;
+    readonly sourceArn: SimHttpApiExecuteApiArn;
+}
+/**
+ * Decides whether an HTTP API may invoke one of its Lambda functions.
+ *
+ * A Lambda proxy integration created through CloudFormation, the CLI or an SDK
+ * does not work until the function's resource policy allows
+ * `apigateway.amazonaws.com` to invoke it, and a Lambda `REQUEST` authorizer's
+ * function needs the same grant under an ARN of its own.
+ *
+ * Whether a service may invoke a function is Lambda's own rule, so the decision
+ * is made there. What this adds is the part only API Gateway knows: which API
+ * is calling, and what it is calling for.
+ *
+ * The answer is a decision rather than a thrown error, because a refusal is an
+ * ordinary HTTP outcome: the endpoint answers 500 the way real API Gateway
+ * does, with nothing to propagate to a caller in process.
+ */
+export declare class SimHttpApiInvokeAuthorizer {
+    private readonly lambdaAuthorizer;
+    constructor(properties: SimHttpApiInvokeAuthorizerProperties);
+    /**
+     * Evaluate `lambda:InvokeFunction` for the API against the function.
+     *
+     * What the API is invoking the function for is supplied as `AWS:SourceArn`,
+     * so a permission granted for one route does not open another, and a
+     * permission granted for an integration does not make the same function
+     * usable as an authorizer. The API's own Account is supplied as
+     * `AWS:SourceAccount`, which is the Account the source ARN names rather than
+     * the one owning the function.
+     */
+    authorize(input: SimHttpApiInvokeAuthorizationInput): SimIamAuthorizationDecision;
+}
+/**
+ * Whether the API may not invoke a function as one of its authorizers.
+ *
+ * The source ARN names the authorizer rather than the route, so a function
+ * granted the invoke action for the API's routes is not thereby usable as its
+ * authorizer, as on real AWS.
+ */
+export declare function simHttpApiMayNotInvokeAuthorizer(api: SimHttpApi, authorizer: SimHttpApiRequestAuthorizer, target: SimHttpApiFunctionTarget): boolean;
+export {};
+//# sourceMappingURL=sim-http-api-invoke-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-invoke-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IAEpE,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;;;;;;;;OASG;IACH,SAAS,CACP,KAAK,EAAE,kCAAkC,GACxC,2BAA2B,CAO7B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,UAAU,EACf,UAAU,EAAE,2BAA2B,EACvC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAST"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.js

@@ -0,0 +1,64 @@
+import { SimLambdaServiceInvokeAuthorizer } from "../../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
+import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
+/**
+ * The service principal API Gateway invokes a Lambda function as, whether that
+ * function is behind an integration or behind an authorizer.
+ */
+export const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+/**
+ * Decides whether an HTTP API may invoke one of its Lambda functions.
+ *
+ * A Lambda proxy integration created through CloudFormation, the CLI or an SDK
+ * does not work until the function's resource policy allows
+ * `apigateway.amazonaws.com` to invoke it, and a Lambda `REQUEST` authorizer's
+ * function needs the same grant under an ARN of its own.
+ *
+ * Whether a service may invoke a function is Lambda's own rule, so the decision
+ * is made there. What this adds is the part only API Gateway knows: which API
+ * is calling, and what it is calling for.
+ *
+ * The answer is a decision rather than a thrown error, because a refusal is an
+ * ordinary HTTP outcome: the endpoint answers 500 the way real API Gateway
+ * does, with nothing to propagate to a caller in process.
+ */
+export class SimHttpApiInvokeAuthorizer {
+    lambdaAuthorizer;
+    constructor(properties) {
+        this.lambdaAuthorizer = new SimLambdaServiceInvokeAuthorizer({
+            iam: properties.iam,
+        });
+    }
+    /**
+     * Evaluate `lambda:InvokeFunction` for the API against the function.
+     *
+     * What the API is invoking the function for is supplied as `AWS:SourceArn`,
+     * so a permission granted for one route does not open another, and a
+     * permission granted for an integration does not make the same function
+     * usable as an authorizer. The API's own Account is supplied as
+     * `AWS:SourceAccount`, which is the Account the source ARN names rather than
+     * the one owning the function.
+     */
+    authorize(input) {
+        return this.lambdaAuthorizer.authorize({
+            simFunction: input.simFunction,
+            servicePrincipal: simApiGatewayServicePrincipal,
+            sourceArn: input.sourceArn.toString(),
+            sourceAccount: input.api.accountRegionScope.accountId,
+        });
+    }
+}
+/**
+ * Whether the API may not invoke a function as one of its authorizers.
+ *
+ * The source ARN names the authorizer rather than the route, so a function
+ * granted the invoke action for the API's routes is not thereby usable as its
+ * authorizer, as on real AWS.
+ */
+export function simHttpApiMayNotInvokeAuthorizer(api, authorizer, target) {
+    return new SimHttpApiInvokeAuthorizer({ iam: target.iam }).authorize({
+        api,
+        simFunction: target.simFunction,
+        sourceArn: SimHttpApiExecuteApiArn.forAuthorizer(api, authorizer.authorizerId),
+    }).isDenied;
+}
+//# sourceMappingURL=sim-http-api-invoke-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-invoke-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAG7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAIpF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAYxE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,0BAA0B;IACpB,gBAAgB,CAAmC;IAEpE,YAAY,UAAgD;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,gCAAgC,CAAC;YAC3D,GAAG,EAAE,UAAU,CAAC,GAAG;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,CACP,KAAyC;QAEzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACrC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,gBAAgB,EAAE,6BAA6B;YAC/C,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE;YACrC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS;SACtD,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,GAAe,EACf,UAAuC,EACvC,MAAgC;IAEhC,OAAO,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;QACnE,GAAG;QACH,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,uBAAuB,CAAC,aAAa,CAC9C,GAAG,EACH,UAAU,CAAC,YAAY,CACxB;KACF,CAAC,CAAC,QAAQ,CAAC;AACd,CAAC"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.d.ts

@@ -0,0 +1,27 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+interface SimHttpApiJwtRouteAuthorizerProperties {
+    /**
+     * Clock the token's time claims are checked against, so advancing simulated
+     * time expires a token that was accepted before it.
+     */
+    readonly clock: SimClock;
+}
+/**
+ * Decides whether one request may have a `JWT` route.
+ *
+ * The token has to verify against the keys its issuer publishes, and the
+ * route's scopes have to be met. Every refusal up to and including claim
+ * validation is one 401; an unmet scope is the one 403.
+ */
+export declare class SimHttpApiJwtRouteAuthorizer {
+    private readonly clock;
+    constructor(properties: SimHttpApiJwtRouteAuthorizerProperties);
+    /**
+     * Authorize one request against the `JWT` route that matched it.
+     */
+    authorize(input: SimHttpApiRouteAuthorizeInput): SimHttpApiAuthorization;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-route-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAI5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,sCAAsC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,sCAAsC,EAE7D;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CA0CvE;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.js

@@ -0,0 +1,54 @@
+import { SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { simHttpApiBearerToken } from "../../api/authorizer/sim-http-api-bearer-token.js";
+import { SimHttpApiJwtAuthorizer } from "../../api/authorizer/sim-http-api-jwt-authorizer.js";
+import { SimHttpApiJwtVerification } from "../../api/authorizer/sim-http-api-jwt-verification.js";
+/**
+ * Decides whether one request may have a `JWT` route.
+ *
+ * The token has to verify against the keys its issuer publishes, and the
+ * route's scopes have to be met. Every refusal up to and including claim
+ * validation is one 401; an unmet scope is the one 403.
+ */
+export class SimHttpApiJwtRouteAuthorizer {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Authorize one request against the `JWT` route that matched it.
+     */
+    authorize(input) {
+        const { api, match, request } = input;
+        const { route } = match;
+        // A JWT route always names a JWT authorizer, and that authorizer can still
+        // be deleted out from under it, so the two come to the same thing here:
+        // with no authorizer to ask, the route stays closed.
+        const authorizer = api.authorizers.find(route.authorizerId ?? "");
+        if (!(authorizer instanceof SimHttpApiJwtAuthorizer)) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        const presented = simHttpApiBearerToken(authorizer.identitySource.value({
+            request,
+            routeKey: route.routeKey,
+        }));
+        if (presented === undefined) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        const authorization = new SimHttpApiJwtVerification({
+            issuerKeys: api.jwtIssuerKeys,
+            clock: this.clock,
+        }).verify(authorizer, presented);
+        if (!authorization.admitted) {
+            return authorization;
+        }
+        // The scopes are the route's own rather than the authorizer's, so one
+        // authorizer covers routes asking for different scopes. An unmet scope is
+        // the one refusal that is a 403: the token was accepted, and it does not
+        // allow this route.
+        if (!route.authorizationScopes.permits(authorization.jwt?.scopes ?? null)) {
+            return SimHttpApiRefused.forbidden();
+        }
+        return authorization;
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-route-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAWlG;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,KAAK,CAAW;IAEjC,YAAY,UAAkD;QAC5D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAExB,2EAA2E;QAC3E,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,CAAC,UAAU,YAAY,uBAAuB,CAAC,EAAE,CAAC;YACrD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CACrC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC;YAC9B,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CACH,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAyB,CAAC;YAClD,UAAU,EAAE,GAAG,CAAC,aAAa;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,oBAAoB;QACpB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YAC1E,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.d.ts

@@ -0,0 +1,42 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import { type SimHttpApiAuthorizerFunctions } from "./sim-http-api-authorizer-invocation.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+interface SimHttpApiRequestRouteAuthorizerProperties {
+    /**
+     * Clock the authorizer's own invocation event is stamped with, and the one
+     * a held decision expires against, so advancing simulated time drops a
+     * decision that was being reused a moment before.
+     */
+    readonly clock: SimClock;
+    readonly functions: SimHttpApiAuthorizerFunctions;
+}
+/**
+ * Decides whether one request may have a `CUSTOM` route, by invoking the
+ * Lambda function the route's authorizer names.
+ *
+ * The steps are the ones real API Gateway takes, in this order:
+ *
+ * 1. the request has to carry every identity source the authorizer was
+ *    configured with, or it is refused with a 401 and the function is never
+ *    invoked;
+ * 2. a decision already made for those same identity source values, and not
+ *    yet expired, is reused by `SimHttpApiAuthorizerDecisions`, and nothing
+ *    further happens;
+ * 3. otherwise `SimHttpApiAuthorizerInvocation` asks the function, and what it
+ *    answered decides.
+ *
+ * An authorizer with no `AuthorizerResultTtlInSeconds` holds nothing, so its
+ * function is invoked once per request reaching the route.
+ */
+export declare class SimHttpApiRequestRouteAuthorizer {
+    private readonly decisions;
+    private readonly invocation;
+    constructor(properties: SimHttpApiRequestRouteAuthorizerProperties);
+    /**
+     * Authorize one request against the `CUSTOM` route that matched it.
+     */
+    authorize(input: SimHttpApiRouteAuthorizeInput): Promise<SimHttpApiAuthorization>;
+}
+export {};
+//# sourceMappingURL=sim-http-api-request-route-authorizer.d.ts.map