@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/apigatewayv2/api/route/sim-http-api-route.js

@@ -0,0 +1,56 @@
+import { faker } from "@faker-js/faker";
+import { SimHttpApiRouteScopes } from "./sim-http-api-route-scopes.js";
+import { simHttpApiRouteView, } from "./sim-http-api-route-view.js";
+/**
+ * Allocate a route id, in the same opaque shape as an integration id.
+ */
+export function makeSimHttpApiRouteId() {
+    return faker.helpers.fromRegExp(/[a-z0-9]{8}/);
+}
+/**
+ * A simulated HTTP API route: which requests reach which integration, and what
+ * a caller has to present to get there.
+ */
+export class SimHttpApiRoute {
+    routeId;
+    key;
+    integrationId;
+    authorizationType;
+    /**
+     * The authorizer this route sends requests through, which a `JWT` and a
+     * `CUSTOM` route each have. An `AWS_IAM` route takes no authorizer, since
+     * IAM itself is what decides, and a `NONE` route authorizes nobody.
+     */
+    authorizerId;
+    authorizationScopes;
+    constructor(properties) {
+        this.routeId = properties.routeId;
+        this.key = properties.key;
+        this.integrationId = properties.integrationId;
+        this.authorizationType = properties.authorizationType;
+        this.authorizerId = properties.authorizerId;
+        this.authorizationScopes =
+            properties.authorizationScopes ?? new SimHttpApiRouteScopes();
+    }
+    /**
+     * The route key as it was written, which is what the API reports back and
+     * what reaches the handler as `event.routeKey`.
+     */
+    get routeKey() {
+        return this.key.text;
+    }
+    /**
+     * The route's target, in the `integrations/<id>` form the API takes it in
+     * and hands it back.
+     */
+    get target() {
+        return `integrations/${this.integrationId}`;
+    }
+    /**
+     * Get the AWS-like view of this route.
+     */
+    view() {
+        return simHttpApiRouteView(this);
+    }
+}
+//# sourceMappingURL=sim-http-api-route.js.map

package/dist/service/apigatewayv2/api/route/sim-http-api-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/route/sim-http-api-route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAMxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAetC;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAsB,CAAC;AACtE,CAAC;AAWD;;;GAGG;AACH,MAAM,OAAO,eAAe;IACV,OAAO,CAAoB;IAC3B,GAAG,CAAqB;IACxB,aAAa,CAA0B;IACvC,iBAAiB,CAA8B;IAE/D;;;;OAIG;IACa,YAAY,CAAqC;IAEjD,mBAAmB,CAAwB;IAE3D,YAAY,UAAqC;QAC/C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,mBAAmB;YACtB,UAAU,CAAC,mBAAmB,IAAI,IAAI,qBAAqB,EAAE,CAAC;IAClE,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/apigatewayv2/api/sim-http-api-execute-api-arn.d.ts

@@ -0,0 +1,78 @@
+import type { SimHttpApiMatch } from "./sim-http-api-match.js";
+import type { SimHttpApi } from "./sim-http-api.js";
+interface SimHttpApiExecuteApiArnProperties {
+    readonly api: SimHttpApi;
+    readonly stageName: string;
+    /**
+     * The method and path part of the ARN, such as `GET/orders/{orderId}` or
+     * the literal `$default`.
+     */
+    readonly methodAndPath: string;
+}
+/**
+ * The `execute-api` ARN of one request to an API.
+ *
+ * ```text
+ * arn:aws:execute-api:<region>:<account>:<apiId>/<stage>/<METHOD>/<path>
+ * ```
+ *
+ * Three things want this ARN and they fill the last part differently:
+ *
+ * - the invoke permission a Lambda integration is authorized against, where
+ *   the path is the matched route key's template with its braces intact,
+ *   because that is the form a permission's `SourceArn` is written in;
+ * - `AWS_IAM` route authorization, where the path is the path the request
+ *   asked for, because that is the resource the caller is acting on;
+ * - the `routeArn` a Lambda `REQUEST` authorizer is given, and the resource
+ *   the policy it answers with is evaluated against, which is the route key
+ *   form: AWS's own example of that event names a `$default` route as
+ *   `<apiId>/<stage>/$default`.
+ *
+ * Neither part is documented by AWS as the value API Gateway supplies. The
+ * path is the better supported of the two: CDK synthesises a `SourceArn`
+ * whose stage and method segments are wildcards and whose path segments are
+ * the route key template, braces and all. IAM wildcard matching treats a brace
+ * as a literal, so a concrete request path could never match a permission
+ * written that way.
+ *
+ * The method is weaker. AWS's CLI example for granting an `ANY /test` route on
+ * the `prod` stage wildcards the method segment, which shows what a permission
+ * may say rather than what API Gateway puts there. A concrete verb matches
+ * such a pattern, while a permission written with a literal `ANY` would not
+ * match a concrete verb, so the concrete verb is the reading that keeps a
+ * CDK-deployed route working.
+ */
+export declare class SimHttpApiExecuteApiArn {
+    private readonly api;
+    private readonly stageName;
+    private readonly methodAndPath;
+    constructor(properties: SimHttpApiExecuteApiArnProperties);
+    /**
+     * The ARN of the route a request matched, in the route key form.
+     *
+     * This is the one two callers share: the invoke permission of the route's
+     * integration, and the `routeArn` a Lambda `REQUEST` authorizer is given and
+     * answers a policy against.
+     */
+    static forMatchedRoute(api: SimHttpApi, match: SimHttpApiMatch, requestMethod: string): SimHttpApiExecuteApiArn;
+    /**
+     * The ARN API Gateway invokes one of an API's authorizers under.
+     *
+     * ```text
+     * arn:aws:execute-api:<region>:<account>:<apiId>/authorizers/<authorizerId>
+     * ```
+     *
+     * This is the `SourceArn` AWS documents for granting API Gateway permission
+     * to invoke a Lambda authorizer's function, and it names no stage: an
+     * authorizer belongs to the API rather than to anything serving a request.
+     * A function integrated behind a route and used as that route's authorizer
+     * therefore needs two permissions, as it does on AWS.
+     */
+    static forAuthorizer(api: SimHttpApi, authorizerId: string): SimHttpApiExecuteApiArn;
+    /**
+     * The ARN as a permission or a policy names it.
+     */
+    toString(): string;
+}
+export {};
+//# sourceMappingURL=sim-http-api-execute-api-arn.d.ts.map

package/dist/service/apigatewayv2/api/sim-http-api-execute-api-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-execute-api-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-execute-api-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,UAAU,iCAAiC;IACzC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YAAY,UAAU,EAAE,iCAAiC,EAIxD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CACpB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,MAAM,GACpB,uBAAuB,CAMzB;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,aAAa,CAClB,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,GACnB,uBAAuB,CAMzB;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAOjB;CACF"}

package/dist/service/apigatewayv2/api/sim-http-api-execute-api-arn.js

@@ -0,0 +1,86 @@
+/**
+ * The `execute-api` ARN of one request to an API.
+ *
+ * ```text
+ * arn:aws:execute-api:<region>:<account>:<apiId>/<stage>/<METHOD>/<path>
+ * ```
+ *
+ * Three things want this ARN and they fill the last part differently:
+ *
+ * - the invoke permission a Lambda integration is authorized against, where
+ *   the path is the matched route key's template with its braces intact,
+ *   because that is the form a permission's `SourceArn` is written in;
+ * - `AWS_IAM` route authorization, where the path is the path the request
+ *   asked for, because that is the resource the caller is acting on;
+ * - the `routeArn` a Lambda `REQUEST` authorizer is given, and the resource
+ *   the policy it answers with is evaluated against, which is the route key
+ *   form: AWS's own example of that event names a `$default` route as
+ *   `<apiId>/<stage>/$default`.
+ *
+ * Neither part is documented by AWS as the value API Gateway supplies. The
+ * path is the better supported of the two: CDK synthesises a `SourceArn`
+ * whose stage and method segments are wildcards and whose path segments are
+ * the route key template, braces and all. IAM wildcard matching treats a brace
+ * as a literal, so a concrete request path could never match a permission
+ * written that way.
+ *
+ * The method is weaker. AWS's CLI example for granting an `ANY /test` route on
+ * the `prod` stage wildcards the method segment, which shows what a permission
+ * may say rather than what API Gateway puts there. A concrete verb matches
+ * such a pattern, while a permission written with a literal `ANY` would not
+ * match a concrete verb, so the concrete verb is the reading that keeps a
+ * CDK-deployed route working.
+ */
+export class SimHttpApiExecuteApiArn {
+    api;
+    stageName;
+    methodAndPath;
+    constructor(properties) {
+        this.api = properties.api;
+        this.stageName = properties.stageName;
+        this.methodAndPath = properties.methodAndPath;
+    }
+    /**
+     * The ARN of the route a request matched, in the route key form.
+     *
+     * This is the one two callers share: the invoke permission of the route's
+     * integration, and the `routeArn` a Lambda `REQUEST` authorizer is given and
+     * answers a policy against.
+     */
+    static forMatchedRoute(api, match, requestMethod) {
+        return new SimHttpApiExecuteApiArn({
+            api,
+            stageName: match.stage.stageName,
+            methodAndPath: match.route.key.methodAndPath(requestMethod),
+        });
+    }
+    /**
+     * The ARN API Gateway invokes one of an API's authorizers under.
+     *
+     * ```text
+     * arn:aws:execute-api:<region>:<account>:<apiId>/authorizers/<authorizerId>
+     * ```
+     *
+     * This is the `SourceArn` AWS documents for granting API Gateway permission
+     * to invoke a Lambda authorizer's function, and it names no stage: an
+     * authorizer belongs to the API rather than to anything serving a request.
+     * A function integrated behind a route and used as that route's authorizer
+     * therefore needs two permissions, as it does on AWS.
+     */
+    static forAuthorizer(api, authorizerId) {
+        return new SimHttpApiExecuteApiArn({
+            api,
+            stageName: "authorizers",
+            methodAndPath: authorizerId,
+        });
+    }
+    /**
+     * The ARN as a permission or a policy names it.
+     */
+    toString() {
+        const { accountId, regionName } = this.api.accountRegionScope;
+        return (`arn:aws:execute-api:${regionName}:${accountId}:` +
+            `${this.api.apiId}/${this.stageName}/${this.methodAndPath}`);
+    }
+}
+//# sourceMappingURL=sim-http-api-execute-api-arn.js.map

package/dist/service/apigatewayv2/api/sim-http-api-execute-api-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-execute-api-arn.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-execute-api-arn.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,uBAAuB;IACjB,GAAG,CAAa;IAChB,SAAS,CAAS;IAClB,aAAa,CAAS;IAEvC,YAAY,UAA6C;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CACpB,GAAe,EACf,KAAsB,EACtB,aAAqB;QAErB,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG;YACH,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,aAAa,CAClB,GAAe,EACf,YAAoB;QAEpB,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG;YACH,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAE9D,OAAO,CACL,uBAAuB,UAAU,IAAI,SAAS,GAAG;YACjD,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAC5D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/sim-http-api-host.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The DNS label API Gateway uses for the endpoint it generates for an API,
+ * sitting between the API id and the region:
+ *
+ *   <api-id>.execute-api.<region>.amazonaws.com
+ *
+ * It is also the SigV4 signing name of that endpoint, which is not the signing
+ * name of the API Gateway control plane.
+ */
+export declare const executeApiHostLabel = "execute-api";
+/**
+ * The real AWS domain generated API endpoints live under.
+ */
+export declare const executeApiDomain = "amazonaws.com";
+interface SimHttpApiHostProperties {
+    readonly apiId: string;
+    readonly regionName: string;
+}
+/**
+ * Build the real AWS endpoint hostname for an API.
+ */
+export declare function simHttpApiHost(properties: SimHttpApiHostProperties): string;
+/**
+ * Build the logical hostname for an API: the AWS endpoint hostname without the
+ * real AWS domain.
+ *
+ * This is the form Yulin serves on localhost, where the `.amazonaws.com` tail
+ * is replaced by the local suffix, in the same way S3 endpoint hostnames are.
+ */
+export declare function simHttpApiLogicalHost(properties: SimHttpApiHostProperties): string;
+export {};
+//# sourceMappingURL=sim-http-api-host.d.ts.map

package/dist/service/apigatewayv2/api/sim-http-api-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-host.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,UAAU,wBAAwB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,wBAAwB,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,wBAAwB,GACnC,MAAM,CAER"}

package/dist/service/apigatewayv2/api/sim-http-api-host.js

@@ -0,0 +1,31 @@
+/**
+ * The DNS label API Gateway uses for the endpoint it generates for an API,
+ * sitting between the API id and the region:
+ *
+ *   <api-id>.execute-api.<region>.amazonaws.com
+ *
+ * It is also the SigV4 signing name of that endpoint, which is not the signing
+ * name of the API Gateway control plane.
+ */
+export const executeApiHostLabel = "execute-api";
+/**
+ * The real AWS domain generated API endpoints live under.
+ */
+export const executeApiDomain = "amazonaws.com";
+/**
+ * Build the real AWS endpoint hostname for an API.
+ */
+export function simHttpApiHost(properties) {
+    return `${simHttpApiLogicalHost(properties)}.${executeApiDomain}`;
+}
+/**
+ * Build the logical hostname for an API: the AWS endpoint hostname without the
+ * real AWS domain.
+ *
+ * This is the form Yulin serves on localhost, where the `.amazonaws.com` tail
+ * is replaced by the local suffix, in the same way S3 endpoint hostnames are.
+ */
+export function simHttpApiLogicalHost(properties) {
+    return `${properties.apiId}.${executeApiHostLabel}.${properties.regionName}`;
+}
+//# sourceMappingURL=sim-http-api-host.js.map

package/dist/service/apigatewayv2/api/sim-http-api-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-host.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAOhD;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,UAAoC;IACjE,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,IAAI,gBAAgB,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAoC;IAEpC,OAAO,GAAG,UAAU,CAAC,KAAK,IAAI,mBAAmB,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;AAC/E,CAAC"}

package/dist/service/apigatewayv2/api/sim-http-api-id.d.ts

@@ -0,0 +1,12 @@
+import type { Brand } from "../../../util/brand.type.js";
+/**
+ * The id API Gateway allocates for one API, which is the leading DNS label of
+ * the endpoint it generates.
+ */
+export type SimHttpApiId = Brand<string, "SimHttpApiId">;
+/**
+ * Allocate an API id in the shape real API Gateway uses: 10 lowercase
+ * alphanumeric characters, forming one DNS label.
+ */
+export declare function makeSimHttpApiId(): SimHttpApiId;
+//# sourceMappingURL=sim-http-api-id.d.ts.map

package/dist/service/apigatewayv2/api/sim-http-api-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-id.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAEzD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C"}

package/dist/service/apigatewayv2/api/sim-http-api-id.js

@@ -0,0 +1,9 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Allocate an API id in the shape real API Gateway uses: 10 lowercase
+ * alphanumeric characters, forming one DNS label.
+ */
+export function makeSimHttpApiId() {
+    return faker.helpers.fromRegExp(/[a-z0-9]{10}/);
+}
+//# sourceMappingURL=sim-http-api-id.js.map

package/dist/service/apigatewayv2/api/sim-http-api-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-id.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAUxC;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAiB,CAAC;AAClE,CAAC"}

package/dist/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.d.ts

@@ -0,0 +1,78 @@
+import { AsyncMappedFactory } from "@kensio/part-factory";
+import type { SimPayload2Event } from "../../../serve/payload-2/sim-payload-2-event.type.js";
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimHttpApi } from "./sim-http-api.js";
+import { type SimHttpApiProxyAuthorizer } from "./sim-http-api-proxy-authorization.js";
+import type { SimHttpApiProxyRequestAuthorizer } from "./sim-http-api-proxy-request-authorizer.js";
+/**
+ * What a test asks for when it wants an HTTP API that serves something.
+ */
+export interface SimHttpApiLambdaProxyInput {
+    readonly apiName: string;
+    readonly functionName: string;
+    /**
+     * The Account the function belongs to, which need not be the API's: an
+     * integration URI is free to name another one.
+     */
+    readonly functionAccountId: string;
+    readonly roleArn: string;
+    /** The function code every route of the API hands its requests to. */
+    readonly handler: (event: SimPayload2Event) => unknown;
+    readonly disableExecuteApiEndpoint: boolean;
+    /** The route keys the API routes, all onto the one integration. */
+    readonly routeKeys: readonly string[];
+    /**
+     * The JWT authorizer every route goes through, or undefined for an API
+     * whose routes admit anyone.
+     */
+    readonly jwtAuthorizer: SimHttpApiProxyAuthorizer | undefined;
+    /**
+     * The Lambda `REQUEST` authorizer every route goes through, or undefined for
+     * an API whose routes do not send requests through a function.
+     */
+    readonly requestAuthorizer: SimHttpApiProxyRequestAuthorizer | undefined;
+    /**
+     * Whether every route is authorized by IAM instead, which is what an
+     * `AWS_IAM` route asks for.
+     */
+    readonly iamAuthorization: boolean;
+    /** The scopes every route asks a token for. */
+    readonly authorizationScopes: readonly string[];
+    /** The stages the API serves from. */
+    readonly stageNames: readonly string[];
+    /** The variables every one of those stages carries. */
+    readonly stageVariables: Readonly<Record<string, string>>;
+    /**
+     * Whether the function grants the API permission to invoke it, which it
+     * needs before any route serves anything.
+     *
+     * The grant is the one CDK writes: `apigateway.amazonaws.com` may
+     * `lambda:InvokeFunction` for any stage and route of this API. A test about
+     * the permission itself turns this off and grants what it means to test.
+     */
+    readonly invokePermission: boolean;
+}
+/**
+ * Creates an HTTP API that proxies every request to a simulated Lambda
+ * function, through the ordinary commands.
+ *
+ * Four commands and a function stand between a test and a request it can
+ * serve, and a test about serving is about none of them. Tests about the
+ * commands themselves send them one at a time instead.
+ *
+ * ```typescript
+ * const api = await simHttpApiLambdaProxyFactory.make(
+ *   { handler: () => "hello" },
+ *   simAws,
+ * );
+ * const response = await new SimAwsHttp({ simAws }).fetch(
+ *   new SimAwsLocalUrl({ input: api.apiEndpoint }).toString(),
+ * );
+ * ```
+ *
+ * The API is created in the default Account and Region of the simulated AWS it
+ * is given, and so is the function unless another Account is asked for. A test
+ * working in another scope sends the commands itself.
+ */
+export declare const simHttpApiLambdaProxyFactory: AsyncMappedFactory<SimHttpApiLambdaProxyInput, SimHttpApi, SimAws>;
+//# sourceMappingURL=sim-http-api-lambda-proxy.factory.d.ts.map

package/dist/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-lambda-proxy.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAG7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAEnG;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC;IACvD,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;IAC5C,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,gCAAgC,GAAG,SAAS,CAAC;IACzE;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,4BAA4B,oEAgHxC,CAAC"}

package/dist/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.js

@@ -0,0 +1,114 @@
+import { AsyncMappedFactory } from "@kensio/part-factory";
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { DEFAULT_SIM_AWS_ACCOUNT_ID } from "../../aws/sim-aws-account.js";
+import { makeLambdaZipFileInput } from "../../lambda/function/code/lambda-zip-file-input.js";
+import { simApiGatewayServicePrincipal } from "../serve/auth/sim-http-api-invoke-authorizer.js";
+import { simHttpApiProxyAuthorization, } from "./sim-http-api-proxy-authorization.js";
+/**
+ * Creates an HTTP API that proxies every request to a simulated Lambda
+ * function, through the ordinary commands.
+ *
+ * Four commands and a function stand between a test and a request it can
+ * serve, and a test about serving is about none of them. Tests about the
+ * commands themselves send them one at a time instead.
+ *
+ * ```typescript
+ * const api = await simHttpApiLambdaProxyFactory.make(
+ *   { handler: () => "hello" },
+ *   simAws,
+ * );
+ * const response = await new SimAwsHttp({ simAws }).fetch(
+ *   new SimAwsLocalUrl({ input: api.apiEndpoint }).toString(),
+ * );
+ * ```
+ *
+ * The API is created in the default Account and Region of the simulated AWS it
+ * is given, and so is the function unless another Account is asked for. A test
+ * working in another scope sends the commands itself.
+ */
+export const simHttpApiLambdaProxyFactory = new AsyncMappedFactory(() => ({
+    apiName: "orders",
+    functionName: "orders",
+    functionAccountId: DEFAULT_SIM_AWS_ACCOUNT_ID,
+    roleArn: "arn:aws:iam::111111111111:role/OrdersRole",
+    handler: () => "hello",
+    disableExecuteApiEndpoint: false,
+    routeKeys: ["$default"],
+    jwtAuthorizer: undefined,
+    requestAuthorizer: undefined,
+    iamAuthorization: false,
+    authorizationScopes: [],
+    stageNames: ["$default"],
+    stageVariables: {},
+    invokePermission: true,
+}), async (input, simAws) => {
+    const simLambda = simAws.account(input.functionAccountId).lambda();
+    const { FunctionArn: functionArn } = await simLambda.createFunction({
+        input: {
+            FunctionName: input.functionName,
+            Role: input.roleArn,
+            Code: { ZipFile: makeLambdaZipFileInput(input.handler) },
+        },
+    });
+    const simApiGatewayV2 = simAws.apiGatewayV2();
+    const { ApiId: apiId } = await simApiGatewayV2.createApi({
+        input: {
+            Name: input.apiName,
+            ProtocolType: "HTTP",
+            DisableExecuteApiEndpoint: input.disableExecuteApiEndpoint,
+        },
+    });
+    const { IntegrationId: integrationId } = await simApiGatewayV2.createIntegration({
+        input: {
+            ApiId: apiId,
+            IntegrationType: "AWS_PROXY",
+            IntegrationUri: functionArn,
+            PayloadFormatVersion: "2.0",
+        },
+    });
+    const authorization = await simHttpApiProxyAuthorization(simApiGatewayV2, {
+        apiId,
+        simAws,
+        roleArn: input.roleArn,
+        jwtAuthorizer: input.jwtAuthorizer,
+        requestAuthorizer: input.requestAuthorizer,
+        iamAuthorization: input.iamAuthorization,
+        authorizationScopes: input.authorizationScopes,
+    });
+    await Promise.all(input.routeKeys.map(async (routeKey) => simApiGatewayV2.createRoute({
+        input: {
+            ApiId: apiId,
+            RouteKey: routeKey,
+            Target: `integrations/${integrationId}`,
+            ...authorization,
+        },
+    })));
+    if (input.invokePermission) {
+        // The ARN names the API's own Account and Region, which is where the
+        // request arrives, whatever Account the function belongs to.
+        const { accountId, regionName } = simAws.accountRegionScope().accountRegionScope;
+        await simLambda.addPermission({
+            input: {
+                FunctionName: input.functionName,
+                StatementId: "api-gateway-invoke",
+                Action: "lambda:InvokeFunction",
+                Principal: simApiGatewayServicePrincipal,
+                SourceArn: `arn:aws:execute-api:${regionName}:${accountId}:${apiId}/*/*`,
+            },
+        });
+    }
+    await Promise.all(input.stageNames.map(async (stageName) => simApiGatewayV2.createStage({
+        input: {
+            ApiId: apiId,
+            StageName: stageName,
+            AutoDeploy: true,
+            StageVariables: input.stageVariables,
+        },
+    })));
+    // An id CreateApi allocated is an API the store holds, so this is only
+    // missing if something is wrong with the simulator itself.
+    const api = simApiGatewayV2.findApi(apiId);
+    assertDefined(api, `Simulated API Gateway created the API ${apiId} and then did not hold it`);
+    return api;
+});
+//# sourceMappingURL=sim-http-api-lambda-proxy.factory.js.map

package/dist/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-lambda-proxy.factory.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qDAAqD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAEhG,OAAO,EACL,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAoD/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,kBAAkB,CAKhE,GAAG,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,0BAA0B;IAC7C,OAAO,EAAE,2CAA2C;IACpD,OAAO,EAAE,GAAW,EAAE,CAAC,OAAO;IAC9B,yBAAyB,EAAE,KAAK;IAChC,SAAS,EAAE,CAAC,UAAU,CAAC;IACvB,aAAa,EAAE,SAAS;IACxB,iBAAiB,EAAE,SAAS;IAC5B,gBAAgB,EAAE,KAAK;IACvB,mBAAmB,EAAE,EAAE;IACvB,UAAU,EAAE,CAAC,UAAU,CAAC;IACxB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,IAAI;CACvB,CAAC,EACF,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACtB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC;QAClE,KAAK,EAAE;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;SACzD;KACF,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IAC9C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC;QACvD,KAAK,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,YAAY,EAAE,MAAM;YACpB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;SAC3D;KACF,CAAC,CAAC;IAEH,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GACpC,MAAM,eAAe,CAAC,iBAAiB,CAAC;QACtC,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,WAAW;YAC5B,cAAc,EAAE,WAAW;YAC3B,oBAAoB,EAAE,KAAK;SAC5B;KACF,CAAC,CAAC;IAEL,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,eAAe,EAAE;QACxE,KAAK;QACL,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CACrC,eAAe,CAAC,WAAW,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB,aAAa,EAAE;YACvC,GAAG,aAAa;SACjB;KACF,CAAC,CACH,CACF,CAAC;IAEF,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAC7B,MAAM,CAAC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACjD,MAAM,SAAS,CAAC,aAAa,CAAC;YAC5B,KAAK,EAAE;gBACL,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,oBAAoB;gBACjC,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,6BAA6B;gBACxC,SAAS,EAAE,uBAAuB,UAAU,IAAI,SAAS,IAAI,KAAK,MAAM;aACzE;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CACvC,eAAe,CAAC,WAAW,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CACH,CACF,CAAC;IAEF,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,aAAa,CACX,GAAG,EACH,yCAAyC,KAAK,2BAA2B,CAC1E,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC,CACF,CAAC"}

package/dist/service/apigatewayv2/api/sim-http-api-match.d.ts

@@ -0,0 +1,56 @@
+import type { SimHttpApiIntegrationStore } from "./integration/sim-http-api-integration-store.js";
+import type { SimHttpApiIntegration } from "./integration/sim-http-api-integration.js";
+import type { SimHttpApiPathParameters } from "./route/path/sim-http-api-path-parameters.js";
+import type { SimHttpApiRouteStore } from "./route/sim-http-api-route-store.js";
+import type { SimHttpApiRoute } from "./route/sim-http-api-route.js";
+import type { SimHttpApiStageStore } from "./stage/sim-http-api-stage-store.js";
+import type { SimHttpApiStage } from "./stage/sim-http-api-stage.js";
+import type { SimHttpApiRequest } from "./sim-http-api-request.js";
+/**
+ * What an API found for one request: the stage serving it, the route that
+ * matched it, the integration behind that route, and whatever the route
+ * captured from the path.
+ */
+export interface SimHttpApiMatch {
+    readonly route: SimHttpApiRoute;
+    readonly integration: SimHttpApiIntegration;
+    readonly stage: SimHttpApiStage;
+    readonly pathParameters: SimHttpApiPathParameters;
+    /**
+     * The request path the stage left for the routes, with the stage segment and
+     * the leading slash taken off: `/dev/pets/6` served from stage `dev` is
+     * `pets/6`, and a request to the root is the empty string.
+     *
+     * This is the form an `execute-api` ARN names a request by, which is what
+     * an `AWS_IAM` route is authorized against.
+     */
+    readonly pathAfterStage: string;
+}
+/**
+ * The stores a match is looked for in, which one simulated API satisfies.
+ */
+interface SimHttpApiStores {
+    readonly integrations: SimHttpApiIntegrationStore;
+    readonly routes: SimHttpApiRouteStore;
+    readonly stages: SimHttpApiStageStore;
+}
+/**
+ * Finds what should handle one request to an API.
+ *
+ * The stage goes first, because a named stage is a path segment the routes
+ * know nothing about: `/dev/pets/6` served from stage `dev` is the route path
+ * `/pets/6`. The routes then compete for what is left.
+ *
+ * A request reaching an API with no stage for it, or no route for it, matches
+ * nothing, which is a 404 on real AWS.
+ */
+export declare class SimHttpApiMatcher {
+    private readonly stageSelector;
+    private readonly routeSelector;
+    /**
+     * Find what serves one request to an API.
+     */
+    match(stores: SimHttpApiStores, request: SimHttpApiRequest): SimHttpApiMatch | undefined;
+}
+export {};
+//# sourceMappingURL=sim-http-api-match.d.ts.map

package/dist/service/apigatewayv2/api/sim-http-api-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-match.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-match.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAClG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAGhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,UAAU,gBAAgB;IACxB,QAAQ,CAAC,YAAY,EAAE,0BAA0B,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAE/D;;OAEG;IACH,KAAK,CACH,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,iBAAiB,GACzB,eAAe,GAAG,SAAS,CAiC7B;CACF"}

package/dist/service/apigatewayv2/api/sim-http-api-match.js

@@ -0,0 +1,46 @@
+import { SimHttpApiRouteRequest } from "./route/sim-http-api-route-request.js";
+import { SimHttpApiRouteSelector } from "./route/sim-http-api-route-selector.js";
+import { SimHttpApiStageSelector } from "./stage/sim-http-api-stage-selector.js";
+/**
+ * Finds what should handle one request to an API.
+ *
+ * The stage goes first, because a named stage is a path segment the routes
+ * know nothing about: `/dev/pets/6` served from stage `dev` is the route path
+ * `/pets/6`. The routes then compete for what is left.
+ *
+ * A request reaching an API with no stage for it, or no route for it, matches
+ * nothing, which is a 404 on real AWS.
+ */
+export class SimHttpApiMatcher {
+    stageSelector = new SimHttpApiStageSelector();
+    routeSelector = new SimHttpApiRouteSelector();
+    /**
+     * Find what serves one request to an API.
+     */
+    match(stores, request) {
+        const stage = this.stageSelector.select(stores.stages, request.segments);
+        if (stage === undefined) {
+            return undefined;
+        }
+        const selected = this.routeSelector.select(stores.routes.list(), new SimHttpApiRouteRequest({
+            method: request.method,
+            segments: stage.segments,
+        }));
+        if (selected === undefined) {
+            return undefined;
+        }
+        const integration = stores.integrations.find(selected.route.integrationId);
+        /* v8 ignore if -- a route cannot name an integration the API never had */
+        if (integration === undefined) {
+            return undefined;
+        }
+        return {
+            route: selected.route,
+            integration,
+            stage: stage.stage,
+            pathParameters: selected.pathParameters,
+            pathAfterStage: stage.segments.join("/"),
+        };
+    }
+}
+//# sourceMappingURL=sim-http-api-match.js.map