@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source-parser.js

@@ -0,0 +1,92 @@
+import { SimApiGatewayV2BadRequest } from "../../../error/sim-api-gateway-v2.error.js";
+import { SimHttpApiHeaderIdentitySource, simHttpApiHeaderIdentityPrefix, } from "./sim-http-api-header-identity-source.js";
+import { SimHttpApiQueryStringIdentitySource, simHttpApiQueryStringIdentityPrefix, } from "./sim-http-api-query-string-identity-source.js";
+import { simHttpApiRouteKeyIdentityExpression, SimHttpApiRouteKeyIdentitySource, } from "./sim-http-api-route-key-identity-source.js";
+/**
+ * The characters an HTTP field name holds, which is the RFC 9110 token.
+ */
+const httpFieldName = /^[!#$%&'*+.^_`|~\w-]+$/u;
+/**
+ * Reads the identity source expressions an authorizer is configured with.
+ *
+ * An expression naming somewhere this simulation does not read from is refused
+ * rather than accepted and looked for nowhere, since an authorizer that never
+ * finds what it looks for refuses every request, which looks like a signing
+ * problem rather than a configuration one. That leaves out the rest of
+ * `$context` and all of `$stageVariables`, which a Lambda `REQUEST` authorizer
+ * may also name on AWS.
+ *
+ * A JWT authorizer reads something the client sent and nothing else, so it
+ * parses with `requestSource` and `$context.routeKey` is refused for it.
+ */
+export class SimHttpApiIdentitySourceParser {
+    /**
+     * Read an identity source of any kind a Lambda `REQUEST` authorizer takes.
+     */
+    parse(expression) {
+        if (expression === simHttpApiRouteKeyIdentityExpression) {
+            return new SimHttpApiRouteKeyIdentitySource();
+        }
+        return this.requestSource(expression, [
+            simHttpApiRouteKeyIdentityExpression,
+        ]);
+    }
+    /**
+     * Read an identity source naming something the client sent, which is all a
+     * JWT authorizer takes.
+     */
+    requestSource(expression, alsoSimulated = []) {
+        if (expression.startsWith(simHttpApiHeaderIdentityPrefix)) {
+            return new SimHttpApiHeaderIdentitySource(this.headerName(expression, expression.slice(simHttpApiHeaderIdentityPrefix.length)));
+        }
+        if (expression.startsWith(simHttpApiQueryStringIdentityPrefix)) {
+            return new SimHttpApiQueryStringIdentitySource(this.named(expression, expression.slice(simHttpApiQueryStringIdentityPrefix.length), "query string parameter"));
+        }
+        throw new SimApiGatewayV2BadRequest(`IdentitySource '${expression}' is not simulated: an identity source ` +
+            `is ${this.simulatedForms(alsoSimulated)}`);
+    }
+    /**
+     * The header an expression names, refusing one no request could carry.
+     *
+     * A header name is an HTTP field name, and anything else is refused here
+     * rather than at request time: reading a header by an invalid name throws,
+     * and it would throw on every request to the route rather than on the
+     * command that configured it.
+     */
+    headerName(expression, name) {
+        const headerName = this.named(expression, name, "header");
+        if (!httpFieldName.test(headerName)) {
+            throw new SimApiGatewayV2BadRequest(`IdentitySource '${expression}' names the header '${headerName}', ` +
+                `which is not a header name: an HTTP field name holds letters, ` +
+                `digits and the characters !#$%&'*+-.^_\`|~`);
+        }
+        return headerName;
+    }
+    /**
+     * The name an expression carries after its prefix, refusing an empty one.
+     *
+     * An expression naming nothing finds nothing on every request, so the
+     * authorizer refuses everyone for a reason that reads like a signing problem
+     * rather than the configuration one it is.
+     */
+    named(expression, name, what) {
+        if (name.length === 0) {
+            throw new SimApiGatewayV2BadRequest(`IdentitySource '${expression}' names no ${what}, so it would find ` +
+                `nothing on every request`);
+        }
+        return name;
+    }
+    /**
+     * How a refusal names the expressions it would have accepted instead.
+     */
+    simulatedForms(alsoSimulated) {
+        const forms = [
+            `'${simHttpApiHeaderIdentityPrefix}<name>'`,
+            `'${simHttpApiQueryStringIdentityPrefix}<name>'`,
+            ...alsoSimulated.map((expression) => `'${expression}'`),
+        ];
+        const last = forms.pop() ?? "";
+        return `${forms.join(", ")} or ${last}`;
+    }
+}
+//# sourceMappingURL=sim-http-api-identity-source-parser.js.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-identity-source-parser.js","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAElD,OAAO,EACL,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GACjC,MAAM,6CAA6C,CAAC;AAErD;;GAEG;AACH,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACH,KAAK,CAAC,UAAkB;QACtB,IAAI,UAAU,KAAK,oCAAoC,EAAE,CAAC;YACxD,OAAO,IAAI,gCAAgC,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;YACpC,oCAAoC;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,aAAa,CACX,UAAkB,EAClB,aAAa,GAAsB,EAAE;QAErC,IAAI,UAAU,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,8BAA8B,CACvC,IAAI,CAAC,UAAU,CACb,UAAU,EACV,UAAU,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,CACxD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,mCAAmC,CAC5C,IAAI,CAAC,KAAK,CACR,UAAU,EACV,UAAU,CAAC,KAAK,CAAC,mCAAmC,CAAC,MAAM,CAAC,EAC5D,wBAAwB,CACzB,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,UAAU,yCAAyC;YACpE,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,UAAU,CAAC,UAAkB,EAAE,IAAY;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE1D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,UAAU,uBAAuB,UAAU,KAAK;gBACjE,gEAAgE;gBAChE,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAkB,EAAE,IAAY,EAAE,IAAY;QAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,UAAU,cAAc,IAAI,qBAAqB;gBAClE,0BAA0B,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,aAAgC;QACrD,MAAM,KAAK,GAAG;YACZ,IAAI,8BAA8B,SAAS;YAC3C,IAAI,mCAAmC,SAAS;YAChD,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,UAAU,GAAG,CAAC;SACxD,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAE/B,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source.d.ts

@@ -0,0 +1,47 @@
+/**
+ * What one identity source reads its value out of.
+ *
+ * Most sources read the request, and `$context.routeKey` reads the route that
+ * matched, so both are carried rather than the request alone.
+ */
+export interface SimHttpApiIdentityInput {
+    readonly request: Request;
+    /** The route key of the route the request matched, as it was written. */
+    readonly routeKey: string;
+}
+/**
+ * Where an authorizer takes what it identifies the caller by.
+ *
+ * An identity source is a request mapping expression. Each kind reads from
+ * somewhere different and answers the same question, so reading a list of them
+ * is a loop rather than a switch over kinds.
+ *
+ * A source the request supplies nothing at is what refuses a request before
+ * the authorizer is invoked, and is also part of what a cached decision is
+ * keyed on.
+ */
+export interface SimHttpApiIdentitySource {
+    /**
+     * The expression as it was written, which is what the API reports back.
+     */
+    readonly expression: string;
+    /**
+     * What this request carries at this identity source, if it carries anything.
+     *
+     * An empty value is the same as no value here: real API Gateway treats a
+     * source it finds nothing at as one the request did not supply, and refuses
+     * the request without asking the authorizer anything.
+     */
+    value(input: SimHttpApiIdentityInput): string | undefined;
+}
+/**
+ * A value the request actually supplied, rather than an empty one.
+ *
+ * The value is answered as it arrived, and trimmed only to decide whether the
+ * request supplied anything at all. What is around a value is part of it: an
+ * authorizer is handed what the client sent, and two values differing only in
+ * their whitespace are two different callers as far as a held decision is
+ * concerned.
+ */
+export declare function simHttpApiIdentityValue(value: string | null | undefined): string | undefined;
+//# sourceMappingURL=sim-http-api-identity-source.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-identity-source.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,GAAG,SAAS,CAAC;CAC3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,SAAS,CAMpB"}

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source.js

@@ -0,0 +1,16 @@
+/**
+ * A value the request actually supplied, rather than an empty one.
+ *
+ * The value is answered as it arrived, and trimmed only to decide whether the
+ * request supplied anything at all. What is around a value is part of it: an
+ * authorizer is handed what the client sent, and two values differing only in
+ * their whitespace are two different callers as far as a held decision is
+ * concerned.
+ */
+export function simHttpApiIdentityValue(value) {
+    if (value === undefined || value === null || value.trim().length === 0) {
+        return undefined;
+    }
+    return value;
+}
+//# sourceMappingURL=sim-http-api-identity-source.js.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-identity-source.js","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-source.ts"],"names":[],"mappings":"AAuCA;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAgC;IAEhC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-sources.d.ts

@@ -0,0 +1,29 @@
+import type { SimHttpApiIdentityInput, SimHttpApiIdentitySource } from "./sim-http-api-identity-source.js";
+/**
+ * The identity sources a Lambda `REQUEST` authorizer is configured with.
+ *
+ * A `REQUEST` authorizer takes a list rather than the single source a JWT
+ * authorizer takes, and API Gateway checks the whole list before it invokes
+ * anything: a request missing any one of them is refused with a 401 and the
+ * authorizer function never runs.
+ *
+ * The values found are also what a cached decision is keyed on, which is why
+ * the order they were configured in is kept.
+ */
+export declare class SimHttpApiIdentitySources {
+    private readonly sources;
+    constructor(sources: readonly SimHttpApiIdentitySource[]);
+    /**
+     * The expressions as they were written, which is what the API reports back.
+     */
+    get expressions(): string[];
+    /**
+     * The values this request carries, in the order the sources were configured,
+     * or nothing at all when it is missing any one of them.
+     *
+     * This is what reaches the authorizer as the event's `identitySource`: the
+     * values rather than the expressions that found them.
+     */
+    values(input: SimHttpApiIdentityInput): string[] | undefined;
+}
+//# sourceMappingURL=sim-http-api-identity-sources.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-identity-sources.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,mCAAmC,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAE9D,YAAY,OAAO,EAAE,SAAS,wBAAwB,EAAE,EAEvD;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,MAAM,EAAE,CAE1B;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,EAAE,GAAG,SAAS,CAc3D;CACF"}

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-sources.js

@@ -0,0 +1,42 @@
+/**
+ * The identity sources a Lambda `REQUEST` authorizer is configured with.
+ *
+ * A `REQUEST` authorizer takes a list rather than the single source a JWT
+ * authorizer takes, and API Gateway checks the whole list before it invokes
+ * anything: a request missing any one of them is refused with a 401 and the
+ * authorizer function never runs.
+ *
+ * The values found are also what a cached decision is keyed on, which is why
+ * the order they were configured in is kept.
+ */
+export class SimHttpApiIdentitySources {
+    sources;
+    constructor(sources) {
+        this.sources = [...sources];
+    }
+    /**
+     * The expressions as they were written, which is what the API reports back.
+     */
+    get expressions() {
+        return this.sources.map((source) => source.expression);
+    }
+    /**
+     * The values this request carries, in the order the sources were configured,
+     * or nothing at all when it is missing any one of them.
+     *
+     * This is what reaches the authorizer as the event's `identitySource`: the
+     * values rather than the expressions that found them.
+     */
+    values(input) {
+        const values = [];
+        for (const source of this.sources) {
+            const value = source.value(input);
+            if (value === undefined) {
+                return undefined;
+            }
+            values.push(value);
+        }
+        return values;
+    }
+}
+//# sourceMappingURL=sim-http-api-identity-sources.js.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-identity-sources.js","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-identity-sources.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yBAAyB;IACnB,OAAO,CAAsC;IAE9D,YAAY,OAA4C;QACtD,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAA8B;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-query-string-identity-source.d.ts

@@ -0,0 +1,19 @@
+import { type SimHttpApiIdentityInput, type SimHttpApiIdentitySource } from "./sim-http-api-identity-source.js";
+/**
+ * The prefix a query string identity source is written with.
+ */
+export declare const simHttpApiQueryStringIdentityPrefix = "$request.querystring.";
+/**
+ * An identity source naming one query string parameter, such as
+ * `$request.querystring.access_token`.
+ */
+export declare class SimHttpApiQueryStringIdentitySource implements SimHttpApiIdentitySource {
+    readonly expression: string;
+    private readonly parameterName;
+    constructor(parameterName: string);
+    /**
+     * The query string parameter this request carries, if it carries one.
+     */
+    value(input: SimHttpApiIdentityInput): string | undefined;
+}
+//# sourceMappingURL=sim-http-api-query-string-identity-source.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-query-string-identity-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-query-string-identity-source.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-query-string-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAE9B,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;GAGG;AACH,qBAAa,mCAAoC,YAAW,wBAAwB;IAClF,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YAAY,aAAa,EAAE,MAAM,EAGhC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,GAAG,SAAS,CAIxD;CACF"}

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-query-string-identity-source.js

@@ -0,0 +1,24 @@
+import { simHttpApiIdentityValue, } from "./sim-http-api-identity-source.js";
+/**
+ * The prefix a query string identity source is written with.
+ */
+export const simHttpApiQueryStringIdentityPrefix = "$request.querystring.";
+/**
+ * An identity source naming one query string parameter, such as
+ * `$request.querystring.access_token`.
+ */
+export class SimHttpApiQueryStringIdentitySource {
+    expression;
+    parameterName;
+    constructor(parameterName) {
+        this.expression = `${simHttpApiQueryStringIdentityPrefix}${parameterName}`;
+        this.parameterName = parameterName;
+    }
+    /**
+     * The query string parameter this request carries, if it carries one.
+     */
+    value(input) {
+        return simHttpApiIdentityValue(new URL(input.request.url).searchParams.get(this.parameterName));
+    }
+}
+//# sourceMappingURL=sim-http-api-query-string-identity-source.js.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-query-string-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-query-string-identity-source.js","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-query-string-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAE3E;;;GAGG;AACH,MAAM,OAAO,mCAAmC;IAC9B,UAAU,CAAS;IAElB,aAAa,CAAS;IAEvC,YAAY,aAAqB;QAC/B,IAAI,CAAC,UAAU,GAAG,GAAG,mCAAmC,GAAG,aAAa,EAAE,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA8B;QAClC,OAAO,uBAAuB,CAC5B,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAChE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-route-key-identity-source.d.ts

@@ -0,0 +1,25 @@
+import type { SimHttpApiIdentityInput, SimHttpApiIdentitySource } from "./sim-http-api-identity-source.js";
+/**
+ * The one `$context` identity source simulated.
+ */
+export declare const simHttpApiRouteKeyIdentityExpression = "$context.routeKey";
+/**
+ * An identity source naming the route the request matched.
+ *
+ * This is the source AWS documents for caching a Lambda authorizer's decision
+ * per route. Every other identity source reads something the client sent, and
+ * a decision keyed only on those covers every route of the API using that
+ * authorizer, which is what AWS warns about. Adding this one puts the route in
+ * the key.
+ *
+ * It never refuses a request the way a missing header does: every matched
+ * request has a route key, so this source always supplies a value.
+ */
+export declare class SimHttpApiRouteKeyIdentitySource implements SimHttpApiIdentitySource {
+    readonly expression = "$context.routeKey";
+    /**
+     * The route key of the route that matched.
+     */
+    value(input: SimHttpApiIdentityInput): string;
+}
+//# sourceMappingURL=sim-http-api-route-key-identity-source.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-route-key-identity-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-key-identity-source.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-route-key-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,eAAO,MAAM,oCAAoC,sBAAsB,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,qBAAa,gCAAiC,YAAW,wBAAwB;IAC/E,SAAgB,UAAU,uBAAwC;IAElE;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAE5C;CACF"}

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-route-key-identity-source.js

@@ -0,0 +1,26 @@
+/**
+ * The one `$context` identity source simulated.
+ */
+export const simHttpApiRouteKeyIdentityExpression = "$context.routeKey";
+/**
+ * An identity source naming the route the request matched.
+ *
+ * This is the source AWS documents for caching a Lambda authorizer's decision
+ * per route. Every other identity source reads something the client sent, and
+ * a decision keyed only on those covers every route of the API using that
+ * authorizer, which is what AWS warns about. Adding this one puts the route in
+ * the key.
+ *
+ * It never refuses a request the way a missing header does: every matched
+ * request has a route key, so this source always supplies a value.
+ */
+export class SimHttpApiRouteKeyIdentitySource {
+    expression = simHttpApiRouteKeyIdentityExpression;
+    /**
+     * The route key of the route that matched.
+     */
+    value(input) {
+        return input.routeKey;
+    }
+}
+//# sourceMappingURL=sim-http-api-route-key-identity-source.js.map

package/dist/service/apigatewayv2/api/authorizer/identity/sim-http-api-route-key-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-key-identity-source.js","sourceRoot":"","sources":["../../../../../../src/service/apigatewayv2/api/authorizer/identity/sim-http-api-route-key-identity-source.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,mBAAmB,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gCAAgC;IAC3B,UAAU,GAAG,oCAAoC,CAAC;IAElE;;OAEG;IACH,KAAK,CAAC,KAA8B;QAClC,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.d.ts

@@ -0,0 +1,29 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+import type { SimCognitoUserPoolRegistry } from "../../../cognito/registry/sim-cognito-user-pool-registry.js";
+import type { SimHttpApiJwtIssuerKeys } from "./sim-http-api-jwt-issuer-keys.js";
+interface SimCognitoHttpApiJwtIssuerKeysProperties {
+    readonly userPoolRegistry: SimCognitoUserPoolRegistry;
+}
+/**
+ * Simulated Cognito user pools as the issuers a JWT authorizer verifies
+ * against.
+ *
+ * All of the Cognito-shaped URL handling lives here rather than in API
+ * Gateway, which knows only that an authorizer names an issuer by URL. The
+ * registry spans simulated Accounts, matching an API Gateway authorizer that
+ * can name a pool in any Account.
+ */
+export declare class SimCognitoHttpApiJwtIssuerKeys implements SimHttpApiJwtIssuerKeys {
+    private readonly userPoolRegistry;
+    constructor(properties: SimCognitoHttpApiJwtIssuerKeysProperties);
+    /**
+     * The keys the pool this issuer URL names publishes.
+     *
+     * An issuer that is not a Cognito URL, names no pool this simulation has, or
+     * names one through another region's endpoint publishes nothing, and every
+     * token claiming it is refused.
+     */
+    publishedBy(issuerUrl: string): SimJwtKeys;
+}
+export {};
+//# sourceMappingURL=sim-cognito-http-api-jwt-issuer-keys.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-http-api-jwt-issuer-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAYjF,UAAU,wCAAwC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;;;;OAMG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAczC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.js

@@ -0,0 +1,43 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * The issuer URL a simulated Cognito user pool's tokens name.
+ *
+ * The region appears twice, once in the hostname and once as the leading part
+ * of the pool id, and real Cognito only issues for a pool through its own
+ * region's endpoint. Both are captured so the two can be compared.
+ */
+const cognitoIssuerUrl = /^https:\/\/cognito-idp\.(?<hostRegion>[a-z0-9-]+)\.amazonaws\.com\/(?<poolId>(?<poolRegion>[a-z0-9-]+)_[A-Za-z0-9]+)$/;
+/**
+ * Simulated Cognito user pools as the issuers a JWT authorizer verifies
+ * against.
+ *
+ * All of the Cognito-shaped URL handling lives here rather than in API
+ * Gateway, which knows only that an authorizer names an issuer by URL. The
+ * registry spans simulated Accounts, matching an API Gateway authorizer that
+ * can name a pool in any Account.
+ */
+export class SimCognitoHttpApiJwtIssuerKeys {
+    userPoolRegistry;
+    constructor(properties) {
+        this.userPoolRegistry = properties.userPoolRegistry;
+    }
+    /**
+     * The keys the pool this issuer URL names publishes.
+     *
+     * An issuer that is not a Cognito URL, names no pool this simulation has, or
+     * names one through another region's endpoint publishes nothing, and every
+     * token claiming it is refused.
+     */
+    publishedBy(issuerUrl) {
+        const groups = cognitoIssuerUrl.exec(issuerUrl)?.groups;
+        if (groups === undefined || groups["hostRegion"] !== groups["poolRegion"]) {
+            return new SimJwtKeys([]);
+        }
+        const pool = this.userPoolRegistry.find(groups["poolId"] ?? "");
+        if (pool === undefined) {
+            return new SimJwtKeys([]);
+        }
+        return new SimJwtKeys(pool.jwks().keys);
+    }
+}
+//# sourceMappingURL=sim-cognito-http-api-jwt-issuer-keys.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-http-api-jwt-issuer-keys.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAIlE;;;;;;GAMG;AACH,MAAM,gBAAgB,GACpB,uHAAuH,CAAC;AAM1H;;;;;;;;GAQG;AACH,MAAM,OAAO,8BAA8B;IACxB,gBAAgB,CAA6B;IAE9D,YAAY,UAAoD;QAC9D,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,SAAiB;QAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAExD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.d.ts

@@ -0,0 +1,82 @@
+import type { SimPayload2JwtAuthorizer, SimPayload2LambdaAuthorizer } from "../../../../serve/payload-2/sim-payload-2-event.type.js";
+import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
+/**
+ * Why an endpoint refused a request, which decides the response it gets.
+ *
+ * `unauthorized` covers everything up to and including claim validation: real
+ * API Gateway answers all of it with one 401 and one body, so a client learns
+ * that its token was not accepted and nothing about which check it failed.
+ * `forbidden` is an accepted caller the route does not allow, such as an unmet
+ * route scope or an authorizer that said no. `error` is the authorizer itself
+ * failing, which is the API's problem rather than the caller's.
+ */
+export type SimHttpApiRefusalKind = "unauthorized" | "forbidden" | "error";
+interface SimHttpApiAdmittedProperties {
+    /** The token a `JWT` route's authorizer accepted. */
+    readonly jwt?: SimPayload2JwtAuthorizer | undefined;
+    /** The principal an `AWS_IAM` route allowed the request. */
+    readonly caller?: SimAwsRequestCaller | undefined;
+    /**
+     * What a `CUSTOM` route's Lambda authorizer passed on to the integration,
+     * which is `null` when it allowed the request and returned no context.
+     */
+    readonly lambda?: SimPayload2LambdaAuthorizer | null | undefined;
+}
+/**
+ * A request the endpoint admitted, and what its authorizer knows about the
+ * caller.
+ *
+ * Every member is absent on a route that authorizes nobody, since there is no
+ * caller to describe, which is what leaves `requestContext.authorizer` out of
+ * the event entirely. Which one is present says which kind of authorization
+ * admitted the request.
+ */
+export declare class SimHttpApiAdmitted {
+    readonly admitted: true;
+    readonly jwt: SimPayload2JwtAuthorizer | undefined;
+    readonly caller: SimAwsRequestCaller | undefined;
+    readonly lambda: SimPayload2LambdaAuthorizer | null | undefined;
+    constructor(properties?: SimHttpApiAdmittedProperties);
+}
+/**
+ * A request the endpoint refused, before any integration was invoked.
+ *
+ * `errorDescription` is the one AWS publishes for a token whose audience does
+ * not match, and is absent everywhere else rather than filled in with text
+ * AWS was not seen to send.
+ *
+ * An `AWS_IAM` route refuses with `forbidden`, whoever the caller turned out
+ * to be: nothing about an unsigned request makes it a 401 here, because the
+ * boundary already resolved it to an anonymous caller and IAM then allows that
+ * caller nothing.
+ */
+export declare class SimHttpApiRefused {
+    readonly admitted: false;
+    readonly kind: SimHttpApiRefusalKind;
+    readonly errorDescription: string | undefined;
+    private constructor();
+    /**
+     * The token was missing, unreadable, or did not verify, or the request did
+     * not carry an identity source a Lambda authorizer was told to read.
+     */
+    static unauthorized(errorDescription?: string): SimHttpApiRefused;
+    /**
+     * The token verified and none of its scopes is one the route asks for, IAM
+     * did not allow the caller `execute-api:Invoke` on the route, or a Lambda
+     * authorizer decided against the request.
+     */
+    static forbidden(): SimHttpApiRefused;
+    /**
+     * The route's authorizer could not answer at all: its function is missing,
+     * may not be invoked, failed, or replied in a shape API Gateway does not
+     * understand. None of that is the caller's doing, so it is the same 500 an
+     * integration failure gets rather than a refusal the caller could act on.
+     */
+    static error(): SimHttpApiRefused;
+}
+/**
+ * What an endpoint decided about one request.
+ */
+export type SimHttpApiAuthorization = SimHttpApiAdmitted | SimHttpApiRefused;
+export {};
+//# sourceMappingURL=sim-http-api-authorization.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC5B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAE1F;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,WAAW,GAAG,OAAO,CAAC;AAE3E,UAAU,4BAA4B;IACpC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACpD,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,GAAG,IAAI,GAAG,SAAS,CAAC;CAClE;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,QAAQ,OAAiB;IACzC,SAAgB,GAAG,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,SAAgB,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACxD,SAAgB,MAAM,EAAE,2BAA2B,GAAG,IAAI,GAAG,SAAS,CAAC;IAEvE,YAAY,UAAU,GAAE,4BAAiC,EAIxD;CACF;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,QAAQ,QAAkB;IAC1C,SAAgB,IAAI,EAAE,qBAAqB,CAAC;IAC5C,SAAgB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAErD,OAAO,eAGN;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAEhE;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAS,IAAI,iBAAiB,CAEpC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAEhC;CACF;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.js

@@ -0,0 +1,66 @@
+/**
+ * A request the endpoint admitted, and what its authorizer knows about the
+ * caller.
+ *
+ * Every member is absent on a route that authorizes nobody, since there is no
+ * caller to describe, which is what leaves `requestContext.authorizer` out of
+ * the event entirely. Which one is present says which kind of authorization
+ * admitted the request.
+ */
+export class SimHttpApiAdmitted {
+    admitted = true;
+    jwt;
+    caller;
+    lambda;
+    constructor(properties = {}) {
+        this.jwt = properties.jwt;
+        this.caller = properties.caller;
+        this.lambda = properties.lambda;
+    }
+}
+/**
+ * A request the endpoint refused, before any integration was invoked.
+ *
+ * `errorDescription` is the one AWS publishes for a token whose audience does
+ * not match, and is absent everywhere else rather than filled in with text
+ * AWS was not seen to send.
+ *
+ * An `AWS_IAM` route refuses with `forbidden`, whoever the caller turned out
+ * to be: nothing about an unsigned request makes it a 401 here, because the
+ * boundary already resolved it to an anonymous caller and IAM then allows that
+ * caller nothing.
+ */
+export class SimHttpApiRefused {
+    admitted = false;
+    kind;
+    errorDescription;
+    constructor(kind, errorDescription) {
+        this.kind = kind;
+        this.errorDescription = errorDescription;
+    }
+    /**
+     * The token was missing, unreadable, or did not verify, or the request did
+     * not carry an identity source a Lambda authorizer was told to read.
+     */
+    static unauthorized(errorDescription) {
+        return new SimHttpApiRefused("unauthorized", errorDescription);
+    }
+    /**
+     * The token verified and none of its scopes is one the route asks for, IAM
+     * did not allow the caller `execute-api:Invoke` on the route, or a Lambda
+     * authorizer decided against the request.
+     */
+    static forbidden() {
+        return new SimHttpApiRefused("forbidden");
+    }
+    /**
+     * The route's authorizer could not answer at all: its function is missing,
+     * may not be invoked, failed, or replied in a shape API Gateway does not
+     * understand. None of that is the caller's doing, so it is the same 500 an
+     * integration failure gets rather than a refusal the caller could act on.
+     */
+    static error() {
+        return new SimHttpApiRefused("error");
+    }
+}
+//# sourceMappingURL=sim-http-api-authorization.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorization.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorization.ts"],"names":[],"mappings":"AA8BA;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACb,QAAQ,GAAG,IAAa,CAAC;IACzB,GAAG,CAAuC;IAC1C,MAAM,CAAkC;IACxC,MAAM,CAAiD;IAEvE,YAAY,UAAU,GAAiC,EAAE;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAiB;IACZ,QAAQ,GAAG,KAAc,CAAC;IAC1B,IAAI,CAAwB;IAC5B,gBAAgB,CAAqB;IAErD,YAAoB,IAA2B,EAAE,gBAAyB;QACxE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAyB;QAC3C,OAAO,IAAI,iBAAiB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAS;QACd,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;CACF"}