@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.js

@@ -1,5 +1,7 @@
 import { validateS3BucketName } from "../../bucket/validate/validate-s3-bucket-name.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnS3BucketConfigurator } from "./sim-cfn-s3-bucket-configurator.js";
+import { SimCfnS3BucketPropertyRules } from "./sim-cfn-s3-bucket-property-rules.js";
 /**
  * Creates simulated S3 Buckets from AWS::S3::Bucket CloudFormation Resources.
  */
@@ -9,52 +11,36 @@ export class SimCfnS3BucketCreator {
         this.simS3 = properties.simS3;
     }
     /**
-     * Create a simulated Bucket, with its website configuration when declared.
+     * Create a simulated Bucket, with the configurations it declares.
+     *
+     * Which properties the Resource carries is checked before anything is
+     * created, so a Resource asking for something this simulation does not model
+     * fails the Stack rather than leaving a Bucket behind that is configured
+     * differently from the template. What each of them says is then checked as it
+     * is applied.
      */
     async create(resource, properties) {
+        new SimCfnS3BucketPropertyRules({
+            logicalId: resource.logicalId,
+            properties,
+        }).assertSimulated();
         const bucketName = this.bucketNameForResource(resource, properties);
         validateS3BucketName(bucketName);
-        await this.simS3.createBucket({
-            input: {
-                Bucket: bucketName,
-            },
-        });
+        await this.simS3.createBucket({ input: { Bucket: bucketName } });
         const bucket = this.simS3.getSimBucketByName(bucketName);
         assertDefined(bucket, `sim S3 Bucket ${bucketName} after CloudFormation creation`);
-        const websiteConfig = this.websiteConfigurationForResource(properties);
-        if (websiteConfig !== undefined) {
-            await this.simS3.putBucketWebsite({
-                input: {
-                    Bucket: bucketName,
-                    WebsiteConfiguration: websiteConfig,
-                },
-            });
-        }
-        const publicAccessConfig = this.publicAccessConfigurationForResource(properties);
-        if (publicAccessConfig !== undefined) {
-            await this.simS3.putPublicAccessBlock({
-                input: {
-                    Bucket: bucketName,
-                    PublicAccessBlockConfiguration: publicAccessConfig,
-                },
-            });
-        }
+        await new SimCfnS3BucketConfigurator({
+            simS3: this.simS3,
+            resource,
+            properties,
+            bucketName,
+        }).configure();
         return bucket;
     }
     /**
-     * Read PublicAccessBlockConfiguration, which a template uses to open a
-     * Bucket up from the all-blocked state a new Bucket starts in.
+     * A Resource without a BucketName is named after its logical id, rather than
+     * the generated name real CloudFormation invents.
      */
-    publicAccessConfigurationForResource(properties) {
-        const publicAccessConfig = properties["PublicAccessBlockConfiguration"];
-        if (publicAccessConfig === undefined ||
-            publicAccessConfig === null ||
-            typeof publicAccessConfig !== "object" ||
-            Array.isArray(publicAccessConfig)) {
-            return undefined;
-        }
-        return publicAccessConfig;
-    }
     bucketNameForResource(resource, properties) {
         const bucketName = properties["BucketName"];
         if (typeof bucketName === "string") {
@@ -62,31 +48,5 @@ export class SimCfnS3BucketCreator {
         }
         return resource.logicalId.toLowerCase();
     }
-    websiteConfigurationForResource(properties) {
-        const websiteConfig = properties["WebsiteConfiguration"];
-        if (websiteConfig === undefined ||
-            websiteConfig === null ||
-            typeof websiteConfig !== "object" ||
-            Array.isArray(websiteConfig)) {
-            return undefined;
-        }
-        if ("RoutingRules" in websiteConfig &&
-            !Array.isArray(websiteConfig["RoutingRules"])) {
-            return undefined;
-        }
-        return {
-            ...websiteConfig,
-            IndexDocument: typeof websiteConfig["IndexDocument"] === "string"
-                ? {
-                    Suffix: websiteConfig["IndexDocument"],
-                }
-                : websiteConfig["IndexDocument"],
-            ErrorDocument: typeof websiteConfig["ErrorDocument"] === "string"
-                ? {
-                    Key: websiteConfig["ErrorDocument"],
-                }
-                : websiteConfig["ErrorDocument"],
-        };
-    }
 }
 //# sourceMappingURL=sim-cfn-s3-bucket-creator.js.map

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-s3-bucket-creator.js","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAQ;IAE9B,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpE,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5B,KAAK,EAAE;gBACL,MAAM,EAAE,UAAU;aACnB;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACzD,aAAa,CACX,MAAM,EACN,iBAAiB,UAAU,gCAAgC,CAC5D,CAAC;QAEF,MAAM,aAAa,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAEvE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAChC,KAAK,EAAE;oBACL,MAAM,EAAE,UAAU;oBAClB,oBAAoB,EAAE,aAAa;iBACpC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GACtB,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC;QAExD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;gBACpC,KAAK,EAAE;oBACL,MAAM,EAAE,UAAU;oBAClB,8BAA8B,EAAE,kBAAkB;iBACnD;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,oCAAoC,CAC1C,UAAqC;QAErC,MAAM,kBAAkB,GAAG,UAAU,CAAC,gCAAgC,CAAC,CAAC;QAExE,IACE,kBAAkB,KAAK,SAAS;YAChC,kBAAkB,KAAK,IAAI;YAC3B,OAAO,kBAAkB,KAAK,QAAQ;YACtC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EACjC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAEO,qBAAqB,CAC3B,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IAEO,+BAA+B,CACrC,UAAqC;QAErC,MAAM,aAAa,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAEzD,IACE,aAAa,KAAK,SAAS;YAC3B,aAAa,KAAK,IAAI;YACtB,OAAO,aAAa,KAAK,QAAQ;YACjC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IACE,cAAc,IAAI,aAAa;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,EAC7C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,GAAG,aAAa;YAChB,aAAa,EACX,OAAO,aAAa,CAAC,eAAe,CAAC,KAAK,QAAQ;gBAChD,CAAC,CAAC;oBACE,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC;iBACvC;gBACH,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC;YACpC,aAAa,EACX,OAAO,aAAa,CAAC,eAAe,CAAC,KAAK,QAAQ;gBAChD,CAAC,CAAC;oBACE,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC;iBACpC;gBACH,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC;SACf,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-s3-bucket-creator.js","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket/sim-cfn-s3-bucket-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAMpF;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAQ;IAE9B,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,IAAI,2BAA2B,CAAC;YAC9B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU;SACX,CAAC,CAAC,eAAe,EAAE,CAAC;QAErB,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpE,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACzD,aAAa,CACX,MAAM,EACN,iBAAiB,UAAU,gCAAgC,CAC5D,CAAC;QAEF,MAAM,IAAI,0BAA0B,CAAC;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ;YACR,UAAU;YACV,UAAU;SACX,CAAC,CAAC,SAAS,EAAE,CAAC;QAEf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAC3B,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-rules.d.ts

@@ -0,0 +1,33 @@
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SimCfnS3BucketPropertyRulesProperties {
+    readonly logicalId: string;
+    readonly properties: SimCfnTemplateValueRecord;
+}
+/**
+ * Which AWS::S3::Bucket properties simulated S3 can act on.
+ *
+ * Anything else fails the Resource. Being stricter than CloudFormation shows up
+ * as a puzzling deployment failure here; being looser shows up as a Bucket
+ * behaving one way in a test and another way on AWS.
+ */
+export declare class SimCfnS3BucketPropertyRules {
+    private readonly logicalId;
+    private readonly properties;
+    constructor(properties: SimCfnS3BucketPropertyRulesProperties);
+    /**
+     * Refuse everything about this Resource that is not simulated.
+     */
+    assertSimulated(): void;
+    /**
+     * Refuse a BucketName that is not a name.
+     *
+     * A Resource stating none is named after its logical id. One stating
+     * something that is not a string is a template error, and falling back to
+     * the logical id would deploy a Bucket under a name nothing else in the
+     * template refers to.
+     */
+    private refuseUnusableBucketName;
+    private assertSimulatedProperty;
+}
+export {};
+//# sourceMappingURL=sim-cfn-s3-bucket-property-rules.d.ts.map

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-property-rules.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AA4DlH,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;GAMG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IAEvD,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,eAAe,IAAI,IAAI,CAMtB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,uBAAuB;CAkBhC"}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-rules.js

@@ -0,0 +1,105 @@
+import { s3BucketResourceError } from "./error/sim-cfn-s3-bucket-error.js";
+/**
+ * The AWS::S3::Bucket properties this simulation acts on.
+ */
+const simulatedPropertyNames = new Set([
+    "BucketName",
+    "NotificationConfiguration",
+    "PublicAccessBlockConfiguration",
+    "WebsiteConfiguration",
+]);
+/**
+ * Real AWS::S3::Bucket properties this simulation reads and does nothing with.
+ *
+ * Nothing this simulator models can tell the difference. There is no simulated
+ * KMS and Object bytes are stored as they arrive, so an encrypted Bucket and an
+ * unencrypted one answer every simulated command identically, and no simulated
+ * service reads a Bucket tag. Both are on almost every Bucket CDK synthesizes,
+ * so refusing them would leave a CDK app unable to deploy over a difference no
+ * test could observe.
+ */
+const inertPropertyNames = new Set([
+    "BucketEncryption",
+    "Tags",
+]);
+/**
+ * Real AWS::S3::Bucket properties this simulation does not model.
+ *
+ * Each of these changes what a simulated command answers on real AWS. A
+ * versioned Bucket answers a delete with a delete marker and an
+ * `ObjectRemoved:DeleteMarkerCreated` event, where this simulator removes the
+ * Object and raises `ObjectRemoved:Delete`. So they fail the Resource rather
+ * than being dropped on the way through, which would leave a Bucket that looks
+ * configured to the template and behaves as though it were not.
+ */
+const unsimulatedPropertyNames = new Set([
+    "AbacStatus",
+    "AccelerateConfiguration",
+    "AccessControl",
+    "AnalyticsConfigurations",
+    "BucketNamePrefix",
+    "BucketNamespace",
+    "CorsConfiguration",
+    "IntelligentTieringConfigurations",
+    "InventoryConfigurations",
+    "LifecycleConfiguration",
+    "LoggingConfiguration",
+    "MetadataConfiguration",
+    "MetadataTableConfiguration",
+    "MetricsConfigurations",
+    "ObjectLockConfiguration",
+    "ObjectLockEnabled",
+    "OwnershipControls",
+    "ReplicationConfiguration",
+    "VersioningConfiguration",
+]);
+/**
+ * Which AWS::S3::Bucket properties simulated S3 can act on.
+ *
+ * Anything else fails the Resource. Being stricter than CloudFormation shows up
+ * as a puzzling deployment failure here; being looser shows up as a Bucket
+ * behaving one way in a test and another way on AWS.
+ */
+export class SimCfnS3BucketPropertyRules {
+    logicalId;
+    properties;
+    constructor(properties) {
+        this.logicalId = properties.logicalId;
+        this.properties = properties.properties;
+    }
+    /**
+     * Refuse everything about this Resource that is not simulated.
+     */
+    assertSimulated() {
+        this.refuseUnusableBucketName();
+        for (const name of Object.keys(this.properties)) {
+            this.assertSimulatedProperty(name);
+        }
+    }
+    /**
+     * Refuse a BucketName that is not a name.
+     *
+     * A Resource stating none is named after its logical id. One stating
+     * something that is not a string is a template error, and falling back to
+     * the logical id would deploy a Bucket under a name nothing else in the
+     * template refers to.
+     */
+    refuseUnusableBucketName() {
+        const bucketName = this.properties["BucketName"];
+        if (bucketName === undefined || typeof bucketName === "string") {
+            return;
+        }
+        throw s3BucketResourceError(this.logicalId, "BucketName must be a Bucket name string");
+    }
+    assertSimulatedProperty(name) {
+        if (simulatedPropertyNames.has(name) || inertPropertyNames.has(name)) {
+            return;
+        }
+        if (unsimulatedPropertyNames.has(name)) {
+            throw s3BucketResourceError(this.logicalId, `${name} is a real AWS::S3::Bucket property that simulated S3 does ` +
+                `not simulate, so it is refused rather than ignored`);
+        }
+        throw s3BucketResourceError(this.logicalId, `${name} is not an AWS::S3::Bucket property`);
+    }
+}
+//# sourceMappingURL=sim-cfn-s3-bucket-property-rules.js.map

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-property-rules.js","sourceRoot":"","sources":["../../../../../src/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E;;GAEG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,YAAY;IACZ,2BAA2B;IAC3B,gCAAgC;IAChC,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,kBAAkB;IAClB,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,YAAY;IACZ,yBAAyB;IACzB,eAAe;IACf,yBAAyB;IACzB,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,kCAAkC;IAClC,yBAAyB;IACzB,wBAAwB;IACxB,sBAAsB;IACtB,uBAAuB;IACvB,4BAA4B;IAC5B,uBAAuB;IACvB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,0BAA0B;IAC1B,yBAAyB;CAC1B,CAAC,CAAC;AAOH;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACrB,SAAS,CAAS;IAClB,UAAU,CAA4B;IAEvD,YAAY,UAAiD;QAC3D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,eAAe;QACb,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,wBAAwB;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,MAAM,qBAAqB,CACzB,IAAI,CAAC,SAAS,EACd,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,IAAY;QAC1C,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,qBAAqB,CACzB,IAAI,CAAC,SAAS,EACd,GAAG,IAAI,6DAA6D;gBAClE,oDAAoD,CACvD,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,CACzB,IAAI,CAAC,SAAS,EACd,GAAG,IAAI,qCAAqC,CAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/cfn/bucket/website/sim-cfn-s3-bucket-website-configuration.d.ts

@@ -0,0 +1,29 @@
+import type { SimCfnTemplateValueRecord } from "../../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3WebsiteConfiguration } from "../../../command/put-bucket-website/put-bucket-website.command.js";
+/**
+ * Reads the `WebsiteConfiguration` property of an AWS::S3::Bucket Resource into
+ * a PutBucketWebsite request.
+ *
+ * CloudFormation states `IndexDocument` and `ErrorDocument` as plain strings,
+ * where the request nests each under the one field it carries.
+ */
+export declare class SimCfnS3BucketWebsiteConfiguration {
+    private readonly properties;
+    private readonly shape;
+    constructor(logicalId: string, properties: SimCfnTemplateValueRecord);
+    /**
+     * The configuration to apply, or nothing when the Resource declares none.
+     *
+     * A configuration that is there but is not the shape it should be fails the
+     * Resource. Read as nothing, it would deploy a Bucket that serves no website
+     * and a Stack that succeeded.
+     */
+    read(): SimS3WebsiteConfiguration | undefined;
+    /**
+     * A template naming the index document as a string gets it nested under the
+     * `Suffix` the request carries. One already nested is left alone.
+     */
+    private indexDocument;
+    private errorDocument;
+}
+//# sourceMappingURL=sim-cfn-s3-bucket-website-configuration.d.ts.map

package/dist/service/s3/cfn/bucket/website/sim-cfn-s3-bucket-website-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-website-configuration.d.ts","sourceRoot":"","sources":["../../../../../../src/service/s3/cfn/bucket/website/sim-cfn-s3-bucket-website-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,qEAAqE,CAAC;AAE7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mEAAmE,CAAC;AAGnH;;;;;;GAMG;AACH,qBAAa,kCAAkC;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IAEzC,YAAY,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,yBAAyB,EAKnE;IAED;;;;;;OAMG;IACH,IAAI,IAAI,yBAAyB,GAAG,SAAS,CAmB5C;IAED;;;OAGG;IACH,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,aAAa;CAWtB"}

package/dist/service/s3/cfn/bucket/website/sim-cfn-s3-bucket-website-configuration.js

@@ -0,0 +1,59 @@
+import { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
+import { s3BucketResourceError } from "../error/sim-cfn-s3-bucket-error.js";
+/**
+ * Reads the `WebsiteConfiguration` property of an AWS::S3::Bucket Resource into
+ * a PutBucketWebsite request.
+ *
+ * CloudFormation states `IndexDocument` and `ErrorDocument` as plain strings,
+ * where the request nests each under the one field it carries.
+ */
+export class SimCfnS3BucketWebsiteConfiguration {
+    properties;
+    shape;
+    constructor(logicalId, properties) {
+        this.properties = properties;
+        this.shape = new SimCfnValueShape((reason) => s3BucketResourceError(logicalId, reason));
+    }
+    /**
+     * The configuration to apply, or nothing when the Resource declares none.
+     *
+     * A configuration that is there but is not the shape it should be fails the
+     * Resource. Read as nothing, it would deploy a Bucket that serves no website
+     * and a Stack that succeeded.
+     */
+    read() {
+        const declared = this.properties["WebsiteConfiguration"];
+        if (declared === undefined) {
+            return undefined;
+        }
+        const websiteConfig = this.shape.record(declared, "WebsiteConfiguration");
+        const routingRules = websiteConfig["RoutingRules"];
+        if (routingRules !== undefined) {
+            this.shape.list(routingRules, "WebsiteConfiguration RoutingRules");
+        }
+        return {
+            ...websiteConfig,
+            IndexDocument: this.indexDocument(websiteConfig),
+            ErrorDocument: this.errorDocument(websiteConfig),
+        };
+    }
+    /**
+     * A template naming the index document as a string gets it nested under the
+     * `Suffix` the request carries. One already nested is left alone.
+     */
+    indexDocument(websiteConfig) {
+        const indexDocument = websiteConfig["IndexDocument"];
+        if (typeof indexDocument === "string") {
+            return { Suffix: indexDocument };
+        }
+        return indexDocument;
+    }
+    errorDocument(websiteConfig) {
+        const errorDocument = websiteConfig["ErrorDocument"];
+        if (typeof errorDocument === "string") {
+            return { Key: errorDocument };
+        }
+        return errorDocument;
+    }
+}
+//# sourceMappingURL=sim-cfn-s3-bucket-website-configuration.js.map

package/dist/service/s3/cfn/bucket/website/sim-cfn-s3-bucket-website-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-s3-bucket-website-configuration.js","sourceRoot":"","sources":["../../../../../../src/service/s3/cfn/bucket/website/sim-cfn-s3-bucket-website-configuration.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kEAAkE,CAAC;AAEpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,OAAO,kCAAkC;IAC5B,UAAU,CAA4B;IACtC,KAAK,CAAmB;IAEzC,YAAY,SAAiB,EAAE,UAAqC;QAClE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CACzC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAEzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAEnD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;QACrE,CAAC;QAED,OAAO;YACL,GAAG,aAAa;YAChB,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;YAChD,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;SACpB,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,aAAa,CACnB,aAAwC;QAExC,MAAM,aAAa,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAErD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,aAAa,CACnB,aAAwC;QAExC,MAAM,aAAa,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAErD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/service/s3/command/bucket/sim-s3-bucket-commands.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimS3GlobalRegistry } from "../../sim-s3-global-registry.js";
+import type { SimS3BucketCommandState } from "../sim-s3-bucket-command-state.js";
+import type * as simS3Commands from "../sim-s3-command.types.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+interface SimS3BucketCommandsProperties extends SimS3BucketCommandState {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly s3GlobalRegistry: SimS3GlobalRegistry;
+}
+/**
+ * The Bucket commands of one simulated S3 scope.
+ *
+ * Creating a Bucket also registers it in the cross-Region registry, so this
+ * area carries the Account Region scope and that registry as well as the shared
+ * Bucket state.
+ */
+export declare class SimS3BucketCommands {
+    private readonly properties;
+    constructor(properties: SimS3BucketCommandsProperties);
+    /**
+     * Create a Bucket in this scope and register it globally.
+     */
+    create(command: simS3Commands.SimCreateBucketCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimCreateBucketCommandOutput>;
+    /**
+     * List the Buckets this scope owns.
+     */
+    list(command: simS3Commands.SimListBucketsCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimListBucketsCommandOutput>;
+    /**
+     * Configure static website hosting on a Bucket.
+     */
+    putWebsite(command: simS3Commands.SimPutBucketWebsiteCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimPutBucketWebsiteCommandOutput>;
+}
+export {};
+//# sourceMappingURL=sim-s3-bucket-commands.d.ts.map

package/dist/service/s3/command/bucket/sim-s3-bucket-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-bucket-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/bucket/sim-s3-bucket-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAI3E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,KAAK,aAAa,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE,UAAU,6BAA8B,SAAQ,uBAAuB;IACrE,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;CAChD;AAED;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAE3D,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,aAAa,CAAC,sBAAsB,EAC7C,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAKrD;IAED;;OAEG;IACG,IAAI,CACR,OAAO,EAAE,aAAa,CAAC,qBAAqB,EAC5C,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAKpD;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,aAAa,CAAC,0BAA0B,EACjD,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAKzD;CACF"}

package/dist/service/s3/command/bucket/sim-s3-bucket-commands.js

@@ -0,0 +1,35 @@
+import { CreateBucketCommandHandler } from "../create-bucket/create-bucket.handler.js";
+import { ListBucketsCommandHandler } from "../list-buckets/list-buckets.handler.js";
+import { PutBucketWebsiteCommandHandler } from "../put-bucket-website/put-bucket-website.handler.js";
+/**
+ * The Bucket commands of one simulated S3 scope.
+ *
+ * Creating a Bucket also registers it in the cross-Region registry, so this
+ * area carries the Account Region scope and that registry as well as the shared
+ * Bucket state.
+ */
+export class SimS3BucketCommands {
+    properties;
+    constructor(properties) {
+        this.properties = properties;
+    }
+    /**
+     * Create a Bucket in this scope and register it globally.
+     */
+    async create(command, options) {
+        return await new CreateBucketCommandHandler(this.properties).handle(command, options);
+    }
+    /**
+     * List the Buckets this scope owns.
+     */
+    async list(command, options) {
+        return await new ListBucketsCommandHandler(this.properties).handle(command, options);
+    }
+    /**
+     * Configure static website hosting on a Bucket.
+     */
+    async putWebsite(command, options) {
+        return await new PutBucketWebsiteCommandHandler(this.properties).handle(command, options);
+    }
+}
+//# sourceMappingURL=sim-s3-bucket-commands.js.map

package/dist/service/s3/command/bucket/sim-s3-bucket-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-bucket-commands.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/bucket/sim-s3-bucket-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qDAAqD,CAAC;AAUrG;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,UAAU,CAAgC;IAE3D,YAAY,UAAyC;QACnD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA6C,EAC7C,OAA6B;QAE7B,OAAO,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CACjE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,OAA4C,EAC5C,OAA6B;QAE7B,OAAO,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAChE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAAiD,EACjD,OAA6B;QAE7B,OAAO,MAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CACrE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/bucket-policy/sim-s3-bucket-policy-commands.d.ts

@@ -0,0 +1,23 @@
+import type { SimS3BucketCommandState } from "../sim-s3-bucket-command-state.js";
+import type * as simS3Commands from "../sim-s3-command.types.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+/**
+ * The Bucket resource policy commands of one simulated S3 scope.
+ */
+export declare class SimS3BucketPolicyCommands {
+    private readonly state;
+    constructor(state: SimS3BucketCommandState);
+    /**
+     * Replace a Bucket's resource policy.
+     */
+    put(command: simS3Commands.SimPutBucketPolicyCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimPutBucketPolicyCommandOutput>;
+    /**
+     * Read a Bucket's resource policy.
+     */
+    get(command: simS3Commands.SimGetBucketPolicyCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimGetBucketPolicyCommandOutput>;
+    /**
+     * Remove a Bucket's resource policy.
+     */
+    delete(command: simS3Commands.SimDeleteBucketPolicyCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimDeleteBucketPolicyCommandOutput>;
+}
+//# sourceMappingURL=sim-s3-bucket-policy-commands.d.ts.map

package/dist/service/s3/command/bucket-policy/sim-s3-bucket-policy-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-bucket-policy-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/bucket-policy/sim-s3-bucket-policy-commands.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,KAAK,aAAa,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAEhD,YAAY,KAAK,EAAE,uBAAuB,EAEzC;IAED;;OAEG;IACG,GAAG,CACP,OAAO,EAAE,aAAa,CAAC,yBAAyB,EAChD,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAKxD;IAED;;OAEG;IACG,GAAG,CACP,OAAO,EAAE,aAAa,CAAC,yBAAyB,EAChD,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAKxD;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,aAAa,CAAC,4BAA4B,EACnD,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAK3D;CACF"}

package/dist/service/s3/command/bucket-policy/sim-s3-bucket-policy-commands.js

@@ -0,0 +1,31 @@
+import { DeleteBucketPolicyCommandHandler } from "../delete-bucket-policy/delete-bucket-policy.handler.js";
+import { GetBucketPolicyCommandHandler } from "../get-bucket-policy/get-bucket-policy.handler.js";
+import { PutBucketPolicyCommandHandler } from "../put-bucket-policy/put-bucket-policy.handler.js";
+/**
+ * The Bucket resource policy commands of one simulated S3 scope.
+ */
+export class SimS3BucketPolicyCommands {
+    state;
+    constructor(state) {
+        this.state = state;
+    }
+    /**
+     * Replace a Bucket's resource policy.
+     */
+    async put(command, options) {
+        return await new PutBucketPolicyCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Read a Bucket's resource policy.
+     */
+    async get(command, options) {
+        return await new GetBucketPolicyCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Remove a Bucket's resource policy.
+     */
+    async delete(command, options) {
+        return await new DeleteBucketPolicyCommandHandler(this.state).handle(command, options);
+    }
+}
+//# sourceMappingURL=sim-s3-bucket-policy-commands.js.map

package/dist/service/s3/command/bucket-policy/sim-s3-bucket-policy-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-bucket-policy-commands.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/bucket-policy/sim-s3-bucket-policy-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAKlG;;GAEG;AACH,MAAM,OAAO,yBAAyB;IACnB,KAAK,CAA0B;IAEhD,YAAY,KAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACP,OAAgD,EAChD,OAA6B;QAE7B,OAAO,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC/D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACP,OAAgD,EAChD,OAA6B;QAE7B,OAAO,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC/D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAmD,EACnD,OAA6B;QAE7B,OAAO,MAAM,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAClE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/delete-object/delete-object-authorizer.d.ts

@@ -0,0 +1,33 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+interface DeleteObjectAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to an S3 DeleteObject request.
+ *
+ * DeleteObject is authorized against the target Object ARN rather than the
+ * Bucket ARN, as the other Object commands are. An omitted caller is passed
+ * through to sim IAM so Account root fallback behaviour remains owned by IAM.
+ *
+ * DeleteObjects authorizes each key through this same class, because real S3
+ * evaluates `s3:DeleteObject` per Object in a batch and reports the keys it
+ * refused alongside the ones it removed.
+ */
+export declare class DeleteObjectAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(properties: DeleteObjectAuthorizerProperties);
+    /**
+     * Ensure the caller may remove the requested S3 Object.
+     *
+     * The resolved caller is returned rather than discarded, because it is the
+     * only place in the request where the principal has been worked out, and an
+     * Object event notification has to say who caused it.
+     */
+    authorize(bucket: SimS3Bucket, key: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+}
+export {};
+//# sourceMappingURL=delete-object-authorizer.d.ts.map

package/dist/service/s3/command/delete-object/delete-object-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-object-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/delete-object/delete-object-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAEnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;;;;;OAMG;IACH,SAAS,CACP,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,YAAY,GACpB,oBAAoB,CAkBtB;CACF"}

package/dist/service/s3/command/delete-object/delete-object-authorizer.js

@@ -0,0 +1,46 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+import { simS3BucketResourcePolicies } from "../authorize/sim-s3-bucket-resource-policies.js";
+/**
+ * Applies IAM authorization to an S3 DeleteObject request.
+ *
+ * DeleteObject is authorized against the target Object ARN rather than the
+ * Bucket ARN, as the other Object commands are. An omitted caller is passed
+ * through to sim IAM so Account root fallback behaviour remains owned by IAM.
+ *
+ * DeleteObjects authorizes each key through this same class, because real S3
+ * evaluates `s3:DeleteObject` per Object in a batch and reports the keys it
+ * refused alongside the ones it removed.
+ */
+export class DeleteObjectAuthorizer {
+    static action = "s3:DeleteObject";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may remove the requested S3 Object.
+     *
+     * The resolved caller is returned rather than discarded, because it is the
+     * only place in the request where the principal has been worked out, and an
+     * Object event notification has to say who caused it.
+     */
+    authorize(bucket, key, caller) {
+        const resource = `${simS3BucketArn(bucket.bucketName)}/${key}`;
+        const decision = this.iam.authorize({
+            action: DeleteObjectAuthorizer.action,
+            resource,
+            caller,
+            resourcePolicies: simS3BucketResourcePolicies(bucket),
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: DeleteObjectAuthorizer.action,
+                resource,
+            });
+        }
+        return decision.caller;
+    }
+}
+//# sourceMappingURL=delete-object-authorizer.js.map

package/dist/service/s3/command/delete-object/delete-object-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-object-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/delete-object/delete-object-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAM9F;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IACzB,MAAM,CAAU,MAAM,GAAG,iBAAiB,CAAC;IAElC,GAAG,CAA0B;IAE9C,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CACP,MAAmB,EACnB,GAAW,EACX,MAAqB;QAErB,MAAM,QAAQ,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,sBAAsB,CAAC,MAAM;YACrC,QAAQ;YACR,MAAM;YACN,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,sBAAsB,CAAC,MAAM;gBACrC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;CACF"}

package/dist/service/s3/command/delete-object/delete-object.command.d.ts

@@ -0,0 +1,24 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim S3 DeleteObject command.
+ */
+export interface SimDeleteObjectCommand {
+    readonly input: SimDeleteObjectCommandInput;
+}
+/**
+ * Minimal structural sim S3 DeleteObject input.
+ */
+export interface SimDeleteObjectCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly Key?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 DeleteObject output.
+ *
+ * Real S3 reports `DeleteMarker` and `VersionId` on a versioned Bucket. Sim S3
+ * does not model versioning, so neither appears here.
+ */
+export interface SimDeleteObjectCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=delete-object.command.d.ts.map

package/dist/service/s3/command/delete-object/delete-object.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-object.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/delete-object/delete-object.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/s3/command/delete-object/delete-object.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=delete-object.command.js.map