@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.d.ts

@@ -0,0 +1,49 @@
+import type { SimHttpApiAuthorization } from "./sim-http-api-authorization.js";
+/**
+ * The decisions one Lambda `REQUEST` authorizer has already made, held for as
+ * long as its `AuthorizerResultTtlInSeconds` says.
+ *
+ * Real API Gateway keys this on the values of the authorizer's identity
+ * sources and nothing else, so by default one decision covers every route of
+ * the API that uses the authorizer. That is the behaviour AWS warns about, and
+ * `$context.routeKey` as an identity source is the documented way to put the
+ * route in the key.
+ *
+ * The cache belongs to the authorizer rather than to whatever is serving,
+ * because it outlives one request and one server the way the authorizer does.
+ * It holds no clock of its own: the caller passes the instant it is asking
+ * about, so expiry follows the simulation's clock and a test advances time
+ * rather than waiting.
+ */
+export declare class SimHttpApiAuthorizerResultCache {
+    private readonly ttlSeconds;
+    private readonly results;
+    constructor(ttlSeconds: number);
+    /**
+     * Whether this authorizer caches anything at all.
+     *
+     * A TTL of zero is what switches caching off, and is what an authorizer that
+     * says nothing about it gets.
+     */
+    get isEnabled(): boolean;
+    /**
+     * The decision already made for these identity source values, if one was
+     * made and has not expired.
+     */
+    find(identitySource: readonly string[], at: Date): SimHttpApiAuthorization | undefined;
+    /**
+     * Hold a decision for this authorizer's TTL.
+     *
+     * A refusal is held the same way an admission is, which is what real API
+     * Gateway does: the cache holds the authorizer's answer, whatever it was.
+     */
+    store(identitySource: readonly string[], at: Date, authorization: SimHttpApiAuthorization): void;
+    /**
+     * The key one set of identity source values is held under.
+     *
+     * The values are JSON-encoded rather than joined, so two sets that differ
+     * only in where one value ends and the next begins are different keys.
+     */
+    private key;
+}
+//# sourceMappingURL=sim-http-api-authorizer-result-cache.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-result-cache.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAU/E;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IAErE,YAAY,UAAU,EAAE,MAAM,EAE7B;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;OAGG;IACH,IAAI,CACF,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,EAAE,EAAE,IAAI,GACP,uBAAuB,GAAG,SAAS,CAerC;IAED;;;;;OAKG;IACH,KAAK,CACH,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,EAAE,EAAE,IAAI,EACR,aAAa,EAAE,uBAAuB,GACrC,IAAI,CASN;IAED;;;;;OAKG;IACH,OAAO,CAAC,GAAG;CAGZ"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.js

@@ -0,0 +1,74 @@
+/**
+ * The decisions one Lambda `REQUEST` authorizer has already made, held for as
+ * long as its `AuthorizerResultTtlInSeconds` says.
+ *
+ * Real API Gateway keys this on the values of the authorizer's identity
+ * sources and nothing else, so by default one decision covers every route of
+ * the API that uses the authorizer. That is the behaviour AWS warns about, and
+ * `$context.routeKey` as an identity source is the documented way to put the
+ * route in the key.
+ *
+ * The cache belongs to the authorizer rather than to whatever is serving,
+ * because it outlives one request and one server the way the authorizer does.
+ * It holds no clock of its own: the caller passes the instant it is asking
+ * about, so expiry follows the simulation's clock and a test advances time
+ * rather than waiting.
+ */
+export class SimHttpApiAuthorizerResultCache {
+    ttlSeconds;
+    results = new Map();
+    constructor(ttlSeconds) {
+        this.ttlSeconds = ttlSeconds;
+    }
+    /**
+     * Whether this authorizer caches anything at all.
+     *
+     * A TTL of zero is what switches caching off, and is what an authorizer that
+     * says nothing about it gets.
+     */
+    get isEnabled() {
+        return this.ttlSeconds > 0;
+    }
+    /**
+     * The decision already made for these identity source values, if one was
+     * made and has not expired.
+     */
+    find(identitySource, at) {
+        const cached = this.results.get(this.key(identitySource));
+        if (cached === undefined) {
+            return undefined;
+        }
+        if (cached.expiresAt.getTime() <= at.getTime()) {
+            // Dropped rather than left to be overwritten, so an authorizer that is
+            // never called with these values again does not hold them for ever.
+            this.results.delete(this.key(identitySource));
+            return undefined;
+        }
+        return cached.authorization;
+    }
+    /**
+     * Hold a decision for this authorizer's TTL.
+     *
+     * A refusal is held the same way an admission is, which is what real API
+     * Gateway does: the cache holds the authorizer's answer, whatever it was.
+     */
+    store(identitySource, at, authorization) {
+        if (!this.isEnabled) {
+            return;
+        }
+        this.results.set(this.key(identitySource), {
+            authorization,
+            expiresAt: new Date(at.getTime() + this.ttlSeconds * 1000),
+        });
+    }
+    /**
+     * The key one set of identity source values is held under.
+     *
+     * The values are JSON-encoded rather than joined, so two sets that differ
+     * only in where one value ends and the next begins are different keys.
+     */
+    key(identitySource) {
+        return JSON.stringify(identitySource);
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-result-cache.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-result-cache.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,+BAA+B;IACzB,UAAU,CAAS;IACnB,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAErE,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI,CACF,cAAiC,EACjC,EAAQ;QAER,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CACH,cAAiC,EACjC,EAAQ,EACR,aAAsC;QAEtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;YACzC,aAAa;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,GAAG,CAAC,cAAiC;QAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.d.ts

@@ -0,0 +1,31 @@
+import { type SimHttpApiAuthorizer, type SimHttpApiAuthorizerId } from "./sim-http-api-authorizer.js";
+/**
+ * The authorizers of one API, keyed by the id the API allocated for them.
+ *
+ * Authorizers belong to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export declare class SimHttpApiAuthorizerStore {
+    private readonly authorizers;
+    /**
+     * Allocate an authorizer id this API is not already using.
+     */
+    allocateId(): SimHttpApiAuthorizerId;
+    /**
+     * Add an authorizer to this API.
+     */
+    add(authorizer: SimHttpApiAuthorizer): void;
+    /**
+     * Find an authorizer by id.
+     */
+    find(authorizerId: string): SimHttpApiAuthorizer | undefined;
+    /**
+     * Forget a deleted authorizer.
+     */
+    remove(authorizerId: SimHttpApiAuthorizerId): void;
+    /**
+     * List every authorizer of this API, in the order they were created.
+     */
+    list(): SimHttpApiAuthorizer[];
+}
+//# sourceMappingURL=sim-http-api-authorizer-store.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ;;OAEG;IACH,UAAU,IAAI,sBAAsB,CASnC;IAED;;OAEG;IACH,GAAG,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAE1C;IAED;;OAEG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE3D;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,IAAI,IAAI,oBAAoB,EAAE,CAE7B;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.js

@@ -0,0 +1,46 @@
+import { makeSimHttpApiAuthorizerId, } from "./sim-http-api-authorizer.js";
+/**
+ * The authorizers of one API, keyed by the id the API allocated for them.
+ *
+ * Authorizers belong to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export class SimHttpApiAuthorizerStore {
+    authorizers = new Map();
+    /**
+     * Allocate an authorizer id this API is not already using.
+     */
+    allocateId() {
+        let authorizerId = makeSimHttpApiAuthorizerId();
+        while (this.authorizers.has(authorizerId)) {
+            /* v8 ignore next -- does not happen in practice */
+            authorizerId = makeSimHttpApiAuthorizerId();
+        }
+        return authorizerId;
+    }
+    /**
+     * Add an authorizer to this API.
+     */
+    add(authorizer) {
+        this.authorizers.set(authorizer.authorizerId, authorizer);
+    }
+    /**
+     * Find an authorizer by id.
+     */
+    find(authorizerId) {
+        return this.authorizers.get(authorizerId);
+    }
+    /**
+     * Forget a deleted authorizer.
+     */
+    remove(authorizerId) {
+        this.authorizers.delete(authorizerId);
+    }
+    /**
+     * List every authorizer of this API, in the order they were created.
+     */
+    list() {
+        return this.authorizers.values().toArray();
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-store.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-store.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ;;OAEG;IACH,UAAU;QACR,IAAI,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAEhD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,mDAAmD;YACnD,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,UAAgC;QAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAsC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAoC;QACzC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.d.ts

@@ -0,0 +1,65 @@
+import type { Brand } from "../../../../util/brand.type.js";
+import type { SimHttpApiJwtConfigurationView } from "./sim-http-api-jwt-configuration.js";
+/**
+ * The id API Gateway allocates for one authorizer.
+ */
+export type SimHttpApiAuthorizerId = Brand<string, "SimHttpApiAuthorizerId">;
+/**
+ * The two kinds of authorizer an HTTP API has.
+ *
+ * A `JWT` authorizer verifies a token against the keys its issuer publishes. A
+ * `REQUEST` authorizer invokes a Lambda function of its own and does whatever
+ * that function decides.
+ */
+export type SimHttpApiAuthorizerType = "JWT" | "REQUEST";
+/**
+ * Allocate an authorizer id, in the same opaque shape as a route id.
+ */
+export declare function makeSimHttpApiAuthorizerId(): SimHttpApiAuthorizerId;
+interface SimHttpApiAuthorizerProperties {
+    readonly authorizerId: SimHttpApiAuthorizerId;
+    readonly name: string;
+}
+/**
+ * Minimal structural authorizer view, as the Create and Get commands return.
+ *
+ * The members below the identity sources belong to one kind of authorizer
+ * each, and only the kind that has them reports them, which is what real API
+ * Gateway answers with.
+ */
+export interface SimHttpApiAuthorizerView {
+    AuthorizerId: string;
+    Name: string;
+    AuthorizerType: SimHttpApiAuthorizerType;
+    IdentitySource: string[];
+    JwtConfiguration?: SimHttpApiJwtConfigurationView;
+    AuthorizerUri?: string;
+    AuthorizerPayloadFormatVersion?: string;
+    EnableSimpleResponses?: boolean;
+    AuthorizerResultTtlInSeconds?: number;
+}
+/**
+ * A simulated HTTP API authorizer: what a route sends a request through before
+ * it reaches an integration.
+ *
+ * An authorizer belongs to an API and is attached to routes by id, so one
+ * authorizer covers as many routes of the API as name it. What it does with a
+ * request is the subclass's business: the two kinds share an id, a name and
+ * nothing else.
+ */
+export declare abstract class SimHttpApiAuthorizer {
+    readonly authorizerId: SimHttpApiAuthorizerId;
+    readonly name: string;
+    /**
+     * The kind of authorizer this is, which is what a route's own authorization
+     * type has to agree with.
+     */
+    abstract readonly authorizerType: SimHttpApiAuthorizerType;
+    constructor(properties: SimHttpApiAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    abstract view(): SimHttpApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-authorizer.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,GAAG,SAAS,CAAC;AAEzD;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,sBAAsB,CAEnE;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,wBAAwB,CAAC;IACzC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,8BAAsB,oBAAoB;IACxC,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAE3D,YAAY,UAAU,EAAE,8BAA8B,EAGrD;IAED;;OAEG;IACH,QAAQ,CAAC,IAAI,IAAI,wBAAwB,CAAC;CAC3C"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.js

@@ -0,0 +1,25 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Allocate an authorizer id, in the same opaque shape as a route id.
+ */
+export function makeSimHttpApiAuthorizerId() {
+    return faker.helpers.fromRegExp(/[a-z0-9]{6}/);
+}
+/**
+ * A simulated HTTP API authorizer: what a route sends a request through before
+ * it reaches an integration.
+ *
+ * An authorizer belongs to an API and is attached to routes by id, so one
+ * authorizer covers as many routes of the API as name it. What it does with a
+ * request is the subclass's business: the two kinds share an id, a name and
+ * nothing else.
+ */
+export class SimHttpApiAuthorizer {
+    authorizerId;
+    name;
+    constructor(properties) {
+        this.authorizerId = properties.authorizerId;
+        this.name = properties.name;
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAmBxC;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAA2B,CAAC;AAC3E,CAAC;AA0BD;;;;;;;;GAQG;AACH,MAAM,OAAgB,oBAAoB;IACxB,YAAY,CAAyB;IACrC,IAAI,CAAS;IAQ7B,YAAY,UAA0C;QACpD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,CAAC;CAMF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The token an identity source value carries, if it carries one at all.
+ *
+ * This is a JWT authorizer's reading of the value. A Lambda `REQUEST`
+ * authorizer is handed the value as it arrived instead, since what it names
+ * may be a cookie or an API key rather than a bearer token.
+ */
+export declare function simHttpApiBearerToken(value: string | undefined): string | undefined;
+//# sourceMappingURL=sim-http-api-bearer-token.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-bearer-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAQpB"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.js

@@ -0,0 +1,23 @@
+/**
+ * The authorization scheme a bearer token is usually sent under.
+ *
+ * API Gateway takes the token with or without it, so it is stripped when it is
+ * there rather than required. The comparison is case-insensitive, since HTTP
+ * authorization schemes are.
+ */
+const bearerPrefix = /^bearer\s+/i;
+/**
+ * The token an identity source value carries, if it carries one at all.
+ *
+ * This is a JWT authorizer's reading of the value. A Lambda `REQUEST`
+ * authorizer is handed the value as it arrived instead, since what it names
+ * may be a cookie or an API key rather than a bearer token.
+ */
+export function simHttpApiBearerToken(value) {
+    const token = value?.replace(bearerPrefix, "").trim();
+    if (token === undefined || token.length === 0) {
+        return undefined;
+    }
+    return token;
+}
+//# sourceMappingURL=sim-http-api-bearer-token.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-bearer-token.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyB;IAEzB,MAAM,KAAK,GAAG,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.d.ts

@@ -0,0 +1,29 @@
+import { SimHttpApiAuthorizer, type SimHttpApiAuthorizerId, type SimHttpApiAuthorizerView } from "./sim-http-api-authorizer.js";
+import type { SimHttpApiIdentitySource } from "./identity/sim-http-api-identity-source.js";
+import type { SimHttpApiJwtConfiguration } from "./sim-http-api-jwt-configuration.js";
+interface SimHttpApiJwtAuthorizerProperties {
+    readonly authorizerId: SimHttpApiAuthorizerId;
+    readonly name: string;
+    readonly identitySource: SimHttpApiIdentitySource;
+    readonly jwtConfiguration: SimHttpApiJwtConfiguration;
+}
+/**
+ * A simulated HTTP API JWT authorizer: which token a route asks for, and which
+ * issuer signed it.
+ *
+ * There is one identity source rather than a list, which is what a JWT
+ * authorizer takes: a token arrives in one place, and API Gateway refuses a
+ * second source on this kind of authorizer.
+ */
+export declare class SimHttpApiJwtAuthorizer extends SimHttpApiAuthorizer {
+    readonly authorizerType: "JWT";
+    readonly identitySource: SimHttpApiIdentitySource;
+    readonly jwtConfiguration: SimHttpApiJwtConfiguration;
+    constructor(properties: SimHttpApiJwtAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view(): SimHttpApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-authorizer.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,UAAU,iCAAiC;IACzC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,oBAAoB;IAC/D,SAAgB,cAAc,EAAG,KAAK,CAAU;IAEhD,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAE7D,YAAY,UAAU,EAAE,iCAAiC,EAIxD;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAQ/B;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.js

@@ -0,0 +1,32 @@
+import { SimHttpApiAuthorizer, } from "./sim-http-api-authorizer.js";
+/**
+ * A simulated HTTP API JWT authorizer: which token a route asks for, and which
+ * issuer signed it.
+ *
+ * There is one identity source rather than a list, which is what a JWT
+ * authorizer takes: a token arrives in one place, and API Gateway refuses a
+ * second source on this kind of authorizer.
+ */
+export class SimHttpApiJwtAuthorizer extends SimHttpApiAuthorizer {
+    authorizerType = "JWT";
+    identitySource;
+    jwtConfiguration;
+    constructor(properties) {
+        super(properties);
+        this.identitySource = properties.identitySource;
+        this.jwtConfiguration = properties.jwtConfiguration;
+    }
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view() {
+        return {
+            AuthorizerId: this.authorizerId,
+            Name: this.name,
+            AuthorizerType: this.authorizerType,
+            IdentitySource: [this.identitySource.expression],
+            JwtConfiguration: this.jwtConfiguration.view(),
+        };
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-authorizer.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,8BAA8B,CAAC;AAWtC;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,oBAAoB;IAC/C,cAAc,GAAG,KAAc,CAAC;IAEhC,cAAc,CAA2B;IACzC,gBAAgB,CAA6B;IAE7D,YAAY,UAA6C;QACvD,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;YAChD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.d.ts

@@ -0,0 +1,60 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimJwtClaims } from "../../../../util/jwt/sim-jwt-claims.js";
+import { SimHttpApiRefused } from "./sim-http-api-authorization.js";
+import type { SimHttpApiJwtConfiguration } from "./sim-http-api-jwt-configuration.js";
+/**
+ * The only description AWS publishes for a refused token.
+ *
+ * Every other refusal here sends no description at all, rather than text AWS
+ * was not seen to send.
+ */
+export declare const simHttpApiInvalidAudience = "the token does not have a valid audience";
+interface SimHttpApiJwtClaimChecksProperties {
+    readonly clock: SimClock;
+}
+/**
+ * The claim validation a JWT authorizer does once a token's signature is known
+ * to be genuine.
+ *
+ * The order is the one AWS documents: the issuer, then the audience, then the
+ * time claims. It is only visible in which description a refusal carries,
+ * since every one of them answers the same 401.
+ *
+ * The time claims are compared with no allowance for clock skew. That is what
+ * makes advancing the simulation's clock past a token's `exp` turn an accepted
+ * request into a refused one with nothing else changed.
+ */
+export declare class SimHttpApiJwtClaimChecks {
+    private readonly clock;
+    constructor(properties: SimHttpApiJwtClaimChecksProperties);
+    /**
+     * Check the claims of a verified token, answering the refusal to send when
+     * one of them does not hold.
+     */
+    check(claims: SimJwtClaims, configuration: SimHttpApiJwtConfiguration): SimHttpApiRefused | undefined;
+    /**
+     * The audiences a token claims.
+     *
+     * `client_id` is consulted only when there is no `aud` claim at all, which
+     * is what makes an access token bound to a resource server fail rather than
+     * fall back to the app client it was issued to. An `aud` holding something
+     * that is not a string or a list of them claims no audience, rather than
+     * being read past.
+     */
+    private claimedAudience;
+    /**
+     * Check `exp`, `nbf` and `iat` against the simulation's clock.
+     *
+     * A token with no `exp` is refused rather than treated as one that never
+     * expires: real Cognito always sets it, and admitting a token nothing can
+     * expire is the divergence worth failing on.
+     */
+    private checkTimes;
+    /**
+     * Whether now is earlier than a time claim the token carries. A claim the
+     * token does not carry is nothing to be earlier than.
+     */
+    private isBefore;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-claim-checks.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-claim-checks.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,6CACM,CAAC;AAE7C,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,kCAAkC,EAEzD;IAED;;;OAGG;IACH,KAAK,CACH,MAAM,EAAE,YAAY,EACpB,aAAa,EAAE,0BAA0B,GACxC,iBAAiB,GAAG,SAAS,CAU/B;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAmBlB;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.js

@@ -0,0 +1,84 @@
+import { SimHttpApiRefused } from "./sim-http-api-authorization.js";
+/**
+ * The only description AWS publishes for a refused token.
+ *
+ * Every other refusal here sends no description at all, rather than text AWS
+ * was not seen to send.
+ */
+export const simHttpApiInvalidAudience = "the token does not have a valid audience";
+/**
+ * The claim validation a JWT authorizer does once a token's signature is known
+ * to be genuine.
+ *
+ * The order is the one AWS documents: the issuer, then the audience, then the
+ * time claims. It is only visible in which description a refusal carries,
+ * since every one of them answers the same 401.
+ *
+ * The time claims are compared with no allowance for clock skew. That is what
+ * makes advancing the simulation's clock past a token's `exp` turn an accepted
+ * request into a refused one with nothing else changed.
+ */
+export class SimHttpApiJwtClaimChecks {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Check the claims of a verified token, answering the refusal to send when
+     * one of them does not hold.
+     */
+    check(claims, configuration) {
+        if (!configuration.trustsIssuer(claims.text("iss"))) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (!configuration.acceptsAudience(this.claimedAudience(claims))) {
+            return SimHttpApiRefused.unauthorized(simHttpApiInvalidAudience);
+        }
+        return this.checkTimes(claims);
+    }
+    /**
+     * The audiences a token claims.
+     *
+     * `client_id` is consulted only when there is no `aud` claim at all, which
+     * is what makes an access token bound to a resource server fail rather than
+     * fall back to the app client it was issued to. An `aud` holding something
+     * that is not a string or a list of them claims no audience, rather than
+     * being read past.
+     */
+    claimedAudience(claims) {
+        if (claims.has("aud")) {
+            return claims.textList("aud") ?? [];
+        }
+        const clientId = claims.text("client_id");
+        return clientId === undefined ? [] : [clientId];
+    }
+    /**
+     * Check `exp`, `nbf` and `iat` against the simulation's clock.
+     *
+     * A token with no `exp` is refused rather than treated as one that never
+     * expires: real Cognito always sets it, and admitting a token nothing can
+     * expire is the divergence worth failing on.
+     */
+    checkTimes(claims) {
+        const now = Math.floor(this.clock.now().getTime() / 1000);
+        const expiresAt = claims.number("exp");
+        if (expiresAt === undefined || now >= expiresAt) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (this.isBefore(now, claims.number("nbf"))) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (this.isBefore(now, claims.number("iat"))) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        return undefined;
+    }
+    /**
+     * Whether now is earlier than a time claim the token carries. A claim the
+     * token does not carry is nothing to be earlier than.
+     */
+    isBefore(now, claimed) {
+        return claimed !== undefined && now < claimed;
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-claim-checks.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-claim-checks.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,0CAA0C,CAAC;AAM7C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,KAAK,CAAW;IAEjC,YAAY,UAA8C;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CACH,MAAoB,EACpB,aAAyC;QAEzC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,iBAAiB,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACK,eAAe,CAAC,MAAoB;QAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE1C,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,MAAoB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvC,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,GAAW,EAAE,OAA2B;QACvD,OAAO,OAAO,KAAK,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC;IAChD,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.d.ts

@@ -0,0 +1,34 @@
+import type { SimPayload2JwtAuthorizer } from "../../../../serve/payload-2/sim-payload-2-event.type.js";
+import { type SimJwtClaims } from "../../../../util/jwt/sim-jwt-claims.js";
+/**
+ * The claims of an accepted token, as they reach the handler.
+ *
+ * Two things here are observed rather than published by AWS. Every claim value
+ * arrives at the handler as a string, and a list claim such as
+ * `cognito:groups` is rendered the way Go prints a slice, so two groups arrive
+ * as `[GroupA GroupB]` rather than as JSON or as a comma-separated list. And
+ * `scopes` is null, not an empty list, when the token carries no scope claim.
+ */
+export declare class SimHttpApiJwtClaims {
+    private readonly claims;
+    constructor(claims: SimJwtClaims);
+    /**
+     * The `requestContext.authorizer.jwt` block for this token.
+     */
+    toAuthorizerContext(): SimPayload2JwtAuthorizer;
+    /**
+     * The scopes this token claims, or null when it claims none.
+     */
+    scopes(): string[] | null;
+    private claimedScopes;
+    private claimStrings;
+    /**
+     * One claim value as the string the handler receives.
+     *
+     * A nested object claim is JSON-encoded, which is the one shape here that
+     * was not observed on real AWS: no simulated issuer emits one, and neither
+     * does Cognito.
+     */
+    private claimString;
+}
+//# sourceMappingURL=sim-http-api-jwt-claims.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-claims.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yDAAyD,CAAC;AACxG,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,wCAAwC,CAAC;AAUhD;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IAEtC,YAAY,MAAM,EAAE,YAAY,EAE/B;IAED;;OAEG;IACH,mBAAmB,IAAI,wBAAwB,CAE9C;IAED;;OAEG;IACH,MAAM,IAAI,MAAM,EAAE,GAAG,IAAI,CAUxB;IAED,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;CAepB"}