@kensio/yulin 1.0.0 → 1.2.0

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-request-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,wCAAwC,QAAQ,CAAC;AAE9D,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA4B,SAAQ,oBAAoB;IACnE,SAAgB,cAAc,EAAG,SAAS,CAAU;IAEpD;;;OAGG;IACH,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAE/C,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAE3D;;;OAGG;IACH,SAAgB,qBAAqB,EAAE,OAAO,CAAC;IAE/C;;OAEG;IACH,SAAgB,gBAAgB,EAAE,MAAM,CAAC;IAEzC;;;OAGG;IACH,SAAgB,OAAO,EAAE,+BAA+B,CAAC;IAEzD,YAAY,UAAU,EAAE,qCAAqC,EAS5D;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAW/B;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.js

@@ -0,0 +1,63 @@
+import { SimHttpApiAuthorizer, } from "./sim-http-api-authorizer.js";
+import { SimHttpApiAuthorizerResultCache } from "./sim-http-api-authorizer-result-cache.js";
+/**
+ * The only authorizer payload format simulated, which is the one the rest of
+ * this simulation builds events in.
+ */
+export const simHttpApiAuthorizerPayloadFormatVersion = "2.0";
+/**
+ * A simulated HTTP API Lambda `REQUEST` authorizer: the function a route sends
+ * a request to before it reaches its integration.
+ *
+ * The function decides, so nothing here says what a caller has to present. All
+ * this holds is which function to invoke, what has to be on the request before
+ * it is worth invoking, which of the two answer shapes the function replies in,
+ * and the decisions it has already made.
+ */
+export class SimHttpApiRequestAuthorizer extends SimHttpApiAuthorizer {
+    authorizerType = "REQUEST";
+    /**
+     * The Lambda function this authorizer invokes, read from its
+     * `AuthorizerUri`.
+     */
+    lambdaUri;
+    identitySources;
+    /**
+     * Whether the function answers `{ isAuthorized, context }` rather than a
+     * principal and an IAM policy document.
+     */
+    enableSimpleResponses;
+    /**
+     * How long a decision is held for, in seconds, with zero meaning none.
+     */
+    resultTtlSeconds;
+    /**
+     * The decisions already made, which a request presenting the same identity
+     * source values is served from rather than invoking the function again.
+     */
+    results;
+    constructor(properties) {
+        super(properties);
+        this.lambdaUri = properties.lambdaUri;
+        this.identitySources = properties.identitySources;
+        this.enableSimpleResponses = properties.enableSimpleResponses;
+        this.resultTtlSeconds = properties.resultTtlSeconds;
+        this.results = new SimHttpApiAuthorizerResultCache(properties.resultTtlSeconds);
+    }
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view() {
+        return {
+            AuthorizerId: this.authorizerId,
+            Name: this.name,
+            AuthorizerType: this.authorizerType,
+            IdentitySource: this.identitySources.expressions,
+            AuthorizerUri: this.lambdaUri.uri,
+            AuthorizerPayloadFormatVersion: simHttpApiAuthorizerPayloadFormatVersion,
+            EnableSimpleResponses: this.enableSimpleResponses,
+            AuthorizerResultTtlInSeconds: this.resultTtlSeconds,
+        };
+    }
+}
+//# sourceMappingURL=sim-http-api-request-authorizer.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-request-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,GAGrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAE5F;;;GAGG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAW9D;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA4B,SAAQ,oBAAoB;IACnD,cAAc,GAAG,SAAkB,CAAC;IAEpD;;;OAGG;IACa,SAAS,CAAsB;IAE/B,eAAe,CAA4B;IAE3D;;;OAGG;IACa,qBAAqB,CAAU;IAE/C;;OAEG;IACa,gBAAgB,CAAS;IAEzC;;;OAGG;IACa,OAAO,CAAkC;IAEzD,YAAY,UAAiD;QAC3D,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAC,qBAAqB,CAAC;QAC9D,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,+BAA+B,CAChD,UAAU,CAAC,gBAAgB,CAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW;YAChD,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG;YACjC,8BAA8B,EAAE,wCAAwC;YACxE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,4BAA4B,EAAE,IAAI,CAAC,gBAAgB;SACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.d.ts

@@ -1,6 +1,7 @@
 /**
- * The `IntegrationUri` of an `AWS_PROXY` integration: the ARN of the Lambda
- * function the integration invokes.
+ * A URI naming the Lambda function something on an API invokes: the
+ * `IntegrationUri` of an `AWS_PROXY` integration, or the `AuthorizerUri` of a
+ * `REQUEST` authorizer. Both are written the same way.
  *
  * Only an unqualified function ARN is accepted. A version or alias qualifier
  * on the end names a published function version, and simulated Lambda has no
@@ -23,6 +24,11 @@ export declare class SimHttpApiLambdaUri {
      * ARN.
      */
     static parse(uri: string): SimHttpApiLambdaUri;
+    /**
+     * Read a `REQUEST` authorizer's URI, which names its function the same way.
+     */
+    static parseAuthorizerUri(uri: string): SimHttpApiLambdaUri;
+    private static read;
     /**
      * The function ARN a URI names, in either form it is written in.
      */

package/dist/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-lambda-uri.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;GAaG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC,OAAO,eAMN;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAc7C;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;CAG3B"}
+{"version":3,"file":"sim-http-api-lambda-uri.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;;GAcG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC,OAAO,eAMN;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAO7C;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAO1D;IAED,OAAO,CAAC,MAAM,CAAC,IAAI;IAmBnB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;CAG3B"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.js

@@ -13,8 +13,9 @@ const lambdaFunctionArn = /^arn:aws:lambda:(?<regionName>[a-z0-9-]+):(?<accountI
  */
 const apiGatewayLambdaPathUri = /^arn:[^:]+:apigateway:[^:]+:lambda:path\/2015-03-31\/functions\/(?<functionArn>arn:[^/]+)\/invocations$/;
 /**
- * The `IntegrationUri` of an `AWS_PROXY` integration: the ARN of the Lambda
- * function the integration invokes.
+ * A URI naming the Lambda function something on an API invokes: the
+ * `IntegrationUri` of an `AWS_PROXY` integration, or the `AuthorizerUri` of a
+ * `REQUEST` authorizer. Both are written the same way.
  *
  * Only an unqualified function ARN is accepted. A version or alias qualifier
  * on the end names a published function version, and simulated Lambda has no
@@ -43,12 +44,22 @@ export class SimHttpApiLambdaUri {
      * ARN.
      */
     static parse(uri) {
+        return this.read("IntegrationUri", uri, "an AWS_PROXY integration is simulated only for an unqualified Lambda " +
+            "function ARN");
+    }
+    /**
+     * Read a `REQUEST` authorizer's URI, which names its function the same way.
+     */
+    static parseAuthorizerUri(uri) {
+        return this.read("AuthorizerUri", uri, "a REQUEST authorizer is simulated only for an unqualified Lambda " +
+            "function ARN");
+    }
+    static read(option, uri, refusal) {
         const functionArn = this.functionArn(uri);
         const groups = lambdaFunctionArn.exec(functionArn)?.groups;
         if (groups === undefined) {
-            throw new SimApiGatewayV2BadRequest(`IntegrationUri '${uri}' is not a simulated integration target: an ` +
-                `AWS_PROXY integration is simulated only for an unqualified Lambda ` +
-                `function ARN, such as ` +
+            throw new SimApiGatewayV2BadRequest(`${option} '${uri}' is not a simulated invocation target: ` +
+                `${refusal}, such as ` +
                 `arn:aws:lambda:eu-west-2:111111111111:function:orders`);
         }
         return new SimHttpApiLambdaUri(functionArn, groups);

package/dist/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-lambda-uri.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,MAAM,iBAAiB,GACrB,0GAA0G,CAAC;AAE7G;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAC3B,yGAAyG,CAAC;AAE5G;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,mBAAmB;IACd,GAAG,CAAS;IACZ,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,YAAY,CAAS;IAErC,YAAoB,GAAW,EAAE,MAA8B;QAC7D,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,GAAW;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAE3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,GAAG,8CAA8C;gBAClE,oEAAoE;gBACpE,wBAAwB;gBACxB,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,WAAW,CAAC,GAAW;QACpC,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-lambda-uri.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-lambda-uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,MAAM,iBAAiB,GACrB,0GAA0G,CAAC;AAE7G;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAC3B,yGAAyG,CAAC;AAE5G;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,mBAAmB;IACd,GAAG,CAAS;IACZ,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,YAAY,CAAS;IAErC,YAAoB,GAAW,EAAE,MAA8B;QAC7D,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,IAAI,CACd,gBAAgB,EAChB,GAAG,EACH,uEAAuE;YACrE,cAAc,CACjB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAW;QACnC,OAAO,IAAI,CAAC,IAAI,CACd,eAAe,EACf,GAAG,EACH,mEAAmE;YACjE,cAAc,CACjB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,IAAI,CACjB,MAAc,EACd,GAAW,EACX,OAAe;QAEf,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAE3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CACjC,GAAG,MAAM,KAAK,GAAG,0CAA0C;gBACzD,GAAG,OAAO,YAAY;gBACtB,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,WAAW,CAAC,GAAW;QACpC,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/apigatewayv2/api/route/sim-http-api-route.d.ts

@@ -9,14 +9,12 @@ import { type SimHttpApiRouteView } from "./sim-http-api-route-view.js";
  */
 export type SimHttpApiRouteId = Brand<string, "SimHttpApiRouteId">;
 /**
- * The authorization types simulated: none, so anyone may call the route, a JWT
- * the route's authorizer verifies, or a SigV4-signed caller IAM allows
- * `execute-api:Invoke` on the route being called.
- *
- * `CUSTOM`, which is a Lambda authorizer, is refused at creation rather than
- * created open.
+ * The authorization types a route asks for: none, so anyone may call the
+ * route, a JWT the route's authorizer verifies, a SigV4-signed caller IAM
+ * allows `execute-api:Invoke` on the route being called, or a Lambda
+ * `REQUEST` authorizer that decides for itself.
  */
-export type SimHttpApiAuthorizationType = "NONE" | "JWT" | "AWS_IAM";
+export type SimHttpApiAuthorizationType = "NONE" | "JWT" | "AWS_IAM" | "CUSTOM";
 /**
  * Allocate a route id, in the same opaque shape as an integration id.
  */
@@ -39,9 +37,9 @@ export declare class SimHttpApiRoute {
     readonly integrationId: SimHttpApiIntegrationId;
     readonly authorizationType: SimHttpApiAuthorizationType;
     /**
-     * The authorizer this route sends requests through, which only a `JWT` route
-     * has. An `AWS_IAM` route takes no authorizer, since IAM itself is what
-     * decides, and a `NONE` route authorizes nobody.
+     * The authorizer this route sends requests through, which a `JWT` and a
+     * `CUSTOM` route each have. An `AWS_IAM` route takes no authorizer, since
+     * IAM itself is what decides, and a `NONE` route authorizes nobody.
      */
     readonly authorizerId: SimHttpApiAuthorizerId | undefined;
     readonly authorizationScopes: SimHttpApiRouteScopes;

package/dist/service/apigatewayv2/api/route/sim-http-api-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-route.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/route/sim-http-api-route.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,MAAM,2BAA2B,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;AAErE;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,iBAAiB,CAEzD;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAClE;AAED;;;GAGG;AACH,qBAAa,eAAe;IAC1B,SAAgB,OAAO,EAAE,iBAAiB,CAAC;IAC3C,SAAgB,GAAG,EAAE,kBAAkB,CAAC;IACxC,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAE/D;;;;OAIG;IACH,SAAgB,YAAY,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAEjE,SAAgB,mBAAmB,EAAE,qBAAqB,CAAC;IAE3D,YAAY,UAAU,EAAE,yBAAyB,EAQhD;IAED;;;OAGG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;OAEG;IACH,IAAI,IAAI,mBAAmB,CAE1B;CACF"}
+{"version":3,"file":"sim-http-api-route.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/route/sim-http-api-route.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhF;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,iBAAiB,CAEzD;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAClE;AAED;;;GAGG;AACH,qBAAa,eAAe;IAC1B,SAAgB,OAAO,EAAE,iBAAiB,CAAC;IAC3C,SAAgB,GAAG,EAAE,kBAAkB,CAAC;IACxC,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAE/D;;;;OAIG;IACH,SAAgB,YAAY,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAEjE,SAAgB,mBAAmB,EAAE,qBAAqB,CAAC;IAE3D,YAAY,UAAU,EAAE,yBAAyB,EAQhD;IAED;;;OAGG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;OAEG;IACH,IAAI,IAAI,mBAAmB,CAE1B;CACF"}

package/dist/service/apigatewayv2/api/route/sim-http-api-route.js

@@ -17,9 +17,9 @@ export class SimHttpApiRoute {
     integrationId;
     authorizationType;
     /**
-     * The authorizer this route sends requests through, which only a `JWT` route
-     * has. An `AWS_IAM` route takes no authorizer, since IAM itself is what
-     * decides, and a `NONE` route authorizes nobody.
+     * The authorizer this route sends requests through, which a `JWT` and a
+     * `CUSTOM` route each have. An `AWS_IAM` route takes no authorizer, since
+     * IAM itself is what decides, and a `NONE` route authorizes nobody.
      */
     authorizerId;
     authorizationScopes;

package/dist/service/apigatewayv2/api/route/sim-http-api-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-route.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/route/sim-http-api-route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAMxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAiBtC;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAsB,CAAC;AACtE,CAAC;AAWD;;;GAGG;AACH,MAAM,OAAO,eAAe;IACV,OAAO,CAAoB;IAC3B,GAAG,CAAqB;IACxB,aAAa,CAA0B;IACvC,iBAAiB,CAA8B;IAE/D;;;;OAIG;IACa,YAAY,CAAqC;IAEjD,mBAAmB,CAAwB;IAE3D,YAAY,UAAqC;QAC/C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,mBAAmB;YACtB,UAAU,CAAC,mBAAmB,IAAI,IAAI,qBAAqB,EAAE,CAAC;IAClE,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-route.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/route/sim-http-api-route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAMxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAetC;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAsB,CAAC;AACtE,CAAC;AAWD;;;GAGG;AACH,MAAM,OAAO,eAAe;IACV,OAAO,CAAoB;IAC3B,GAAG,CAAqB;IACxB,aAAa,CAA0B;IACvC,iBAAiB,CAA8B;IAE/D;;;;OAIG;IACa,YAAY,CAAqC;IAEjD,mBAAmB,CAAwB;IAE3D,YAAY,UAAqC;QAC/C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,mBAAmB;YACtB,UAAU,CAAC,mBAAmB,IAAI,IAAI,qBAAqB,EAAE,CAAC;IAClE,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/apigatewayv2/api/sim-http-api-execute-api-arn.d.ts

@@ -1,3 +1,4 @@
+import type { SimHttpApiMatch } from "./sim-http-api-match.js";
 import type { SimHttpApi } from "./sim-http-api.js";
 interface SimHttpApiExecuteApiArnProperties {
     readonly api: SimHttpApi;
@@ -15,13 +16,17 @@ interface SimHttpApiExecuteApiArnProperties {
  * arn:aws:execute-api:<region>:<account>:<apiId>/<stage>/<METHOD>/<path>
  * ```
  *
- * Two things want this ARN and they fill the last part differently:
+ * Three things want this ARN and they fill the last part differently:
  *
  * - the invoke permission a Lambda integration is authorized against, where
  *   the path is the matched route key's template with its braces intact,
  *   because that is the form a permission's `SourceArn` is written in;
  * - `AWS_IAM` route authorization, where the path is the path the request
- *   asked for, because that is the resource the caller is acting on.
+ *   asked for, because that is the resource the caller is acting on;
+ * - the `routeArn` a Lambda `REQUEST` authorizer is given, and the resource
+ *   the policy it answers with is evaluated against, which is the route key
+ *   form: AWS's own example of that event names a `$default` route as
+ *   `<apiId>/<stage>/$default`.
  *
  * Neither part is documented by AWS as the value API Gateway supplies. The
  * path is the better supported of the two: CDK synthesises a `SourceArn`
@@ -42,6 +47,28 @@ export declare class SimHttpApiExecuteApiArn {
     private readonly stageName;
     private readonly methodAndPath;
     constructor(properties: SimHttpApiExecuteApiArnProperties);
+    /**
+     * The ARN of the route a request matched, in the route key form.
+     *
+     * This is the one two callers share: the invoke permission of the route's
+     * integration, and the `routeArn` a Lambda `REQUEST` authorizer is given and
+     * answers a policy against.
+     */
+    static forMatchedRoute(api: SimHttpApi, match: SimHttpApiMatch, requestMethod: string): SimHttpApiExecuteApiArn;
+    /**
+     * The ARN API Gateway invokes one of an API's authorizers under.
+     *
+     * ```text
+     * arn:aws:execute-api:<region>:<account>:<apiId>/authorizers/<authorizerId>
+     * ```
+     *
+     * This is the `SourceArn` AWS documents for granting API Gateway permission
+     * to invoke a Lambda authorizer's function, and it names no stage: an
+     * authorizer belongs to the API rather than to anything serving a request.
+     * A function integrated behind a route and used as that route's authorizer
+     * therefore needs two permissions, as it does on AWS.
+     */
+    static forAuthorizer(api: SimHttpApi, authorizerId: string): SimHttpApiExecuteApiArn;
     /**
      * The ARN as a permission or a policy names it.
      */

package/dist/service/apigatewayv2/api/sim-http-api-execute-api-arn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-execute-api-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-execute-api-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,UAAU,iCAAiC;IACzC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YAAY,UAAU,EAAE,iCAAiC,EAIxD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAOjB;CACF"}
+{"version":3,"file":"sim-http-api-execute-api-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-execute-api-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,UAAU,iCAAiC;IACzC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YAAY,UAAU,EAAE,iCAAiC,EAIxD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CACpB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,MAAM,GACpB,uBAAuB,CAMzB;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,aAAa,CAClB,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,GACnB,uBAAuB,CAMzB;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAOjB;CACF"}

package/dist/service/apigatewayv2/api/sim-http-api-execute-api-arn.js

@@ -5,13 +5,17 @@
  * arn:aws:execute-api:<region>:<account>:<apiId>/<stage>/<METHOD>/<path>
  * ```
  *
- * Two things want this ARN and they fill the last part differently:
+ * Three things want this ARN and they fill the last part differently:
  *
  * - the invoke permission a Lambda integration is authorized against, where
  *   the path is the matched route key's template with its braces intact,
  *   because that is the form a permission's `SourceArn` is written in;
  * - `AWS_IAM` route authorization, where the path is the path the request
- *   asked for, because that is the resource the caller is acting on.
+ *   asked for, because that is the resource the caller is acting on;
+ * - the `routeArn` a Lambda `REQUEST` authorizer is given, and the resource
+ *   the policy it answers with is evaluated against, which is the route key
+ *   form: AWS's own example of that event names a `$default` route as
+ *   `<apiId>/<stage>/$default`.
  *
  * Neither part is documented by AWS as the value API Gateway supplies. The
  * path is the better supported of the two: CDK synthesises a `SourceArn`
@@ -36,6 +40,40 @@ export class SimHttpApiExecuteApiArn {
         this.stageName = properties.stageName;
         this.methodAndPath = properties.methodAndPath;
     }
+    /**
+     * The ARN of the route a request matched, in the route key form.
+     *
+     * This is the one two callers share: the invoke permission of the route's
+     * integration, and the `routeArn` a Lambda `REQUEST` authorizer is given and
+     * answers a policy against.
+     */
+    static forMatchedRoute(api, match, requestMethod) {
+        return new SimHttpApiExecuteApiArn({
+            api,
+            stageName: match.stage.stageName,
+            methodAndPath: match.route.key.methodAndPath(requestMethod),
+        });
+    }
+    /**
+     * The ARN API Gateway invokes one of an API's authorizers under.
+     *
+     * ```text
+     * arn:aws:execute-api:<region>:<account>:<apiId>/authorizers/<authorizerId>
+     * ```
+     *
+     * This is the `SourceArn` AWS documents for granting API Gateway permission
+     * to invoke a Lambda authorizer's function, and it names no stage: an
+     * authorizer belongs to the API rather than to anything serving a request.
+     * A function integrated behind a route and used as that route's authorizer
+     * therefore needs two permissions, as it does on AWS.
+     */
+    static forAuthorizer(api, authorizerId) {
+        return new SimHttpApiExecuteApiArn({
+            api,
+            stageName: "authorizers",
+            methodAndPath: authorizerId,
+        });
+    }
     /**
      * The ARN as a permission or a policy names it.
      */

package/dist/service/apigatewayv2/api/sim-http-api-execute-api-arn.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-execute-api-arn.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-execute-api-arn.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,uBAAuB;IACjB,GAAG,CAAa;IAChB,SAAS,CAAS;IAClB,aAAa,CAAS;IAEvC,YAAY,UAA6C;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAE9D,OAAO,CACL,uBAAuB,UAAU,IAAI,SAAS,GAAG;YACjD,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAC5D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-execute-api-arn.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-execute-api-arn.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,uBAAuB;IACjB,GAAG,CAAa;IAChB,SAAS,CAAS;IAClB,aAAa,CAAS;IAEvC,YAAY,UAA6C;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CACpB,GAAe,EACf,KAAsB,EACtB,aAAqB;QAErB,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG;YACH,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,aAAa,CAClB,GAAe,EACf,YAAoB;QAEpB,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG;YACH,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAE9D,OAAO,CACL,uBAAuB,UAAU,IAAI,SAAS,GAAG;YACjD,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAC5D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.d.ts

@@ -3,6 +3,7 @@ import type { SimPayload2Event } from "../../../serve/payload-2/sim-payload-2-ev
 import type { SimAws } from "../../aws/sim-aws.js";
 import type { SimHttpApi } from "./sim-http-api.js";
 import { type SimHttpApiProxyAuthorizer } from "./sim-http-api-proxy-authorization.js";
+import type { SimHttpApiProxyRequestAuthorizer } from "./sim-http-api-proxy-request-authorizer.js";
 /**
  * What a test asks for when it wants an HTTP API that serves something.
  */
@@ -25,6 +26,11 @@ export interface SimHttpApiLambdaProxyInput {
      * whose routes admit anyone.
      */
     readonly jwtAuthorizer: SimHttpApiProxyAuthorizer | undefined;
+    /**
+     * The Lambda `REQUEST` authorizer every route goes through, or undefined for
+     * an API whose routes do not send requests through a function.
+     */
+    readonly requestAuthorizer: SimHttpApiProxyRequestAuthorizer | undefined;
     /**
      * Whether every route is authorized by IAM instead, which is what an
      * `AWS_IAM` route asks for.

package/dist/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-lambda-proxy.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAG7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,uCAAuC,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC;IACvD,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;IAC5C,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,4BAA4B,oEA4GxC,CAAC"}
+{"version":3,"file":"sim-http-api-lambda-proxy.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAG7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAEnG;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC;IACvD,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;IAC5C,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,gCAAgC,GAAG,SAAS,CAAC;IACzE;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,4BAA4B,oEAgHxC,CAAC"}

package/dist/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.js

@@ -2,7 +2,7 @@ import { AsyncMappedFactory } from "@kensio/part-factory";
 import { assertDefined } from "../../../util/type-guard/defined.js";
 import { DEFAULT_SIM_AWS_ACCOUNT_ID } from "../../aws/sim-aws-account.js";
 import { makeLambdaZipFileInput } from "../../lambda/function/code/lambda-zip-file-input.js";
-import { simApiGatewayServicePrincipal } from "../serve/auth/sim-http-api-integration-authorizer.js";
+import { simApiGatewayServicePrincipal } from "../serve/auth/sim-http-api-invoke-authorizer.js";
 import { simHttpApiProxyAuthorization, } from "./sim-http-api-proxy-authorization.js";
 /**
  * Creates an HTTP API that proxies every request to a simulated Lambda
@@ -35,6 +35,7 @@ export const simHttpApiLambdaProxyFactory = new AsyncMappedFactory(() => ({
     disableExecuteApiEndpoint: false,
     routeKeys: ["$default"],
     jwtAuthorizer: undefined,
+    requestAuthorizer: undefined,
     iamAuthorization: false,
     authorizationScopes: [],
     stageNames: ["$default"],
@@ -67,7 +68,10 @@ export const simHttpApiLambdaProxyFactory = new AsyncMappedFactory(() => ({
     });
     const authorization = await simHttpApiProxyAuthorization(simApiGatewayV2, {
         apiId,
+        simAws,
+        roleArn: input.roleArn,
         jwtAuthorizer: input.jwtAuthorizer,
+        requestAuthorizer: input.requestAuthorizer,
         iamAuthorization: input.iamAuthorization,
         authorizationScopes: input.authorizationScopes,
     });

package/dist/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-lambda-proxy.factory.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qDAAqD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EACL,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AA8C/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,kBAAkB,CAKhE,GAAG,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,0BAA0B;IAC7C,OAAO,EAAE,2CAA2C;IACpD,OAAO,EAAE,GAAW,EAAE,CAAC,OAAO;IAC9B,yBAAyB,EAAE,KAAK;IAChC,SAAS,EAAE,CAAC,UAAU,CAAC;IACvB,aAAa,EAAE,SAAS;IACxB,gBAAgB,EAAE,KAAK;IACvB,mBAAmB,EAAE,EAAE;IACvB,UAAU,EAAE,CAAC,UAAU,CAAC;IACxB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,IAAI;CACvB,CAAC,EACF,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACtB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC;QAClE,KAAK,EAAE;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;SACzD;KACF,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IAC9C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC;QACvD,KAAK,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,YAAY,EAAE,MAAM;YACpB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;SAC3D;KACF,CAAC,CAAC;IAEH,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GACpC,MAAM,eAAe,CAAC,iBAAiB,CAAC;QACtC,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,WAAW;YAC5B,cAAc,EAAE,WAAW;YAC3B,oBAAoB,EAAE,KAAK;SAC5B;KACF,CAAC,CAAC;IAEL,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,eAAe,EAAE;QACxE,KAAK;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CACrC,eAAe,CAAC,WAAW,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB,aAAa,EAAE;YACvC,GAAG,aAAa;SACjB;KACF,CAAC,CACH,CACF,CAAC;IAEF,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAC7B,MAAM,CAAC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACjD,MAAM,SAAS,CAAC,aAAa,CAAC;YAC5B,KAAK,EAAE;gBACL,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,oBAAoB;gBACjC,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,6BAA6B;gBACxC,SAAS,EAAE,uBAAuB,UAAU,IAAI,SAAS,IAAI,KAAK,MAAM;aACzE;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CACvC,eAAe,CAAC,WAAW,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CACH,CACF,CAAC;IAEF,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,aAAa,CACX,GAAG,EACH,yCAAyC,KAAK,2BAA2B,CAC1E,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC,CACF,CAAC"}
+{"version":3,"file":"sim-http-api-lambda-proxy.factory.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-lambda-proxy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qDAAqD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAEhG,OAAO,EACL,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAoD/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,kBAAkB,CAKhE,GAAG,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,0BAA0B;IAC7C,OAAO,EAAE,2CAA2C;IACpD,OAAO,EAAE,GAAW,EAAE,CAAC,OAAO;IAC9B,yBAAyB,EAAE,KAAK;IAChC,SAAS,EAAE,CAAC,UAAU,CAAC;IACvB,aAAa,EAAE,SAAS;IACxB,iBAAiB,EAAE,SAAS;IAC5B,gBAAgB,EAAE,KAAK;IACvB,mBAAmB,EAAE,EAAE;IACvB,UAAU,EAAE,CAAC,UAAU,CAAC;IACxB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,IAAI;CACvB,CAAC,EACF,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACtB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC;QAClE,KAAK,EAAE;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;SACzD;KACF,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IAC9C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC;QACvD,KAAK,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,YAAY,EAAE,MAAM;YACpB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;SAC3D;KACF,CAAC,CAAC;IAEH,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GACpC,MAAM,eAAe,CAAC,iBAAiB,CAAC;QACtC,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,WAAW;YAC5B,cAAc,EAAE,WAAW;YAC3B,oBAAoB,EAAE,KAAK;SAC5B;KACF,CAAC,CAAC;IAEL,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,eAAe,EAAE;QACxE,KAAK;QACL,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CACrC,eAAe,CAAC,WAAW,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB,aAAa,EAAE;YACvC,GAAG,aAAa;SACjB;KACF,CAAC,CACH,CACF,CAAC;IAEF,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAC7B,MAAM,CAAC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACjD,MAAM,SAAS,CAAC,aAAa,CAAC;YAC5B,KAAK,EAAE;gBACL,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,oBAAoB;gBACjC,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,6BAA6B;gBACxC,SAAS,EAAE,uBAAuB,UAAU,IAAI,SAAS,IAAI,KAAK,MAAM;aACzE;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CACvC,eAAe,CAAC,WAAW,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;KACF,CAAC,CACH,CACF,CAAC;IAEF,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,aAAa,CACX,GAAG,EACH,yCAAyC,KAAK,2BAA2B,CAC1E,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC,CACF,CAAC"}

package/dist/service/apigatewayv2/api/sim-http-api-proxy-authorization.d.ts

@@ -1,5 +1,7 @@
+import type { SimAws } from "../../aws/sim-aws.js";
 import type { SimCreateRouteCommandInput } from "../command/route/route.command.js";
 import type { SimApiGatewayV2 } from "../sim-api-gateway-v2.js";
+import { type SimHttpApiProxyRequestAuthorizer } from "./sim-http-api-proxy-request-authorizer.js";
 /**
  * A JWT authorizer every route of a test's API goes through.
  */
@@ -12,9 +14,14 @@ interface SimHttpApiProxyAuthorizationInput {
     readonly apiId: string;
     /** Undefined for an API whose routes admit anyone. */
     readonly jwtAuthorizer: SimHttpApiProxyAuthorizer | undefined;
+    /** Undefined unless every route goes through a Lambda authorizer. */
+    readonly requestAuthorizer: SimHttpApiProxyRequestAuthorizer | undefined;
     /** Whether every route is authorized by IAM instead. */
     readonly iamAuthorization: boolean;
     readonly authorizationScopes: readonly string[];
+    /** The Role the authorizer's own function runs as. */
+    readonly roleArn: string;
+    readonly simAws: SimAws;
 }
 /**
  * Create the authorizer a test's API asked for, and answer the authorization

package/dist/service/apigatewayv2/api/sim-http-api-proxy-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-proxy-authorization.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-proxy-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,aAAa,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9D,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,eAAe,EAAE,eAAe,EAChC,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,0BAA0B,CAAC,CAsCrC"}
+{"version":3,"file":"sim-http-api-proxy-authorization.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-proxy-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,4CAA4C,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,aAAa,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9D,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,gCAAgC,GAAG,SAAS,CAAC;IACzE,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,eAAe,EAAE,eAAe,EAChC,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,0BAA0B,CAAC,CA+CrC"}

package/dist/service/apigatewayv2/api/sim-http-api-proxy-authorization.js

@@ -1,3 +1,4 @@
+import { simHttpApiProxyRequestAuthorizer, } from "./sim-http-api-proxy-request-authorizer.js";
 /**
  * Create the authorizer a test's API asked for, and answer the authorization
  * every route of that API is then created with.
@@ -6,7 +7,15 @@
  * exactly as they were before there was anything to authorize.
  */
 export async function simHttpApiProxyAuthorization(simApiGatewayV2, input) {
-    const { apiId, jwtAuthorizer } = input;
+    const { apiId, jwtAuthorizer, requestAuthorizer } = input;
+    if (requestAuthorizer !== undefined) {
+        return await simHttpApiProxyRequestAuthorizer(input.simAws, {
+            apiId,
+            roleArn: input.roleArn,
+            authorizer: requestAuthorizer,
+            authorizationScopes: input.authorizationScopes,
+        });
+    }
     if (input.iamAuthorization) {
         // An AWS_IAM route takes no authorizer at all, so there is nothing to
         // create. The scopes are still passed on, so a test asking for one is

package/dist/service/apigatewayv2/api/sim-http-api-proxy-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-proxy-authorization.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-proxy-authorization.ts"],"names":[],"mappings":"AAqBA;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,eAAgC,EAChC,KAAwC;IAExC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAEvC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,OAAO;YACL,iBAAiB,EAAE,SAAS;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yEAAyE;QACzE,sEAAsE;QACtE,yBAAyB;QACzB,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC;QACxD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,iBAAiB;YACvB,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC;YAC9C,gBAAgB,EAAE;gBAChB,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC;aACtC;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,iBAAiB,EAAE,KAAK;QACxB,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-http-api-proxy-authorization.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-proxy-authorization.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,gCAAgC,GAEjC,MAAM,4CAA4C,CAAC;AAyBpD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,eAAgC,EAChC,KAAwC;IAExC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,MAAM,gCAAgC,CAAC,KAAK,CAAC,MAAM,EAAE;YAC1D,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,iBAAiB;YAC7B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,OAAO;YACL,iBAAiB,EAAE,SAAS;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yEAAyE;QACzE,sEAAsE;QACtE,yBAAyB;QACzB,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC;QACxD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,iBAAiB;YACvB,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC;YAC9C,gBAAgB,EAAE;gBAChB,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC;aACtC;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,iBAAiB,EAAE,KAAK;QACxB,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC;AACJ,CAAC"}

package/dist/service/apigatewayv2/api/sim-http-api-proxy-request-authorizer.d.ts

@@ -0,0 +1,45 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCreateRouteCommandInput } from "../command/route/route.command.js";
+import type { SimHttpApiAuthorizerEvent } from "../serve/auth/sim-http-api-authorizer-event.js";
+/**
+ * A Lambda `REQUEST` authorizer every route of a test's API goes through.
+ */
+export interface SimHttpApiProxyRequestAuthorizer {
+    /** The function code the authorizer invokes. */
+    readonly handler: (event: SimHttpApiAuthorizerEvent) => unknown;
+    readonly functionName: string;
+    readonly identitySource: readonly string[];
+    readonly enableSimpleResponses: boolean;
+    /** How long a decision is held for, with zero meaning none. */
+    readonly resultTtlSeconds: number;
+    /**
+     * The `AuthorizerUri`, which defaults to the function just created. A test
+     * about an authorizer whose function is not there names one nothing created.
+     */
+    readonly uri?: string | undefined;
+    /**
+     * Whether the authorizer's function grants the API permission to invoke it.
+     *
+     * The grant names the authorizer rather than any route, so it is a separate
+     * one from the integration's. A test about the permission itself turns this
+     * off.
+     */
+    readonly invokePermission: boolean;
+}
+interface SimHttpApiProxyRequestAuthorizerInput {
+    readonly apiId: string;
+    readonly roleArn: string;
+    readonly authorizer: SimHttpApiProxyRequestAuthorizer;
+    readonly authorizationScopes: readonly string[];
+}
+/**
+ * Create the function a test's Lambda authorizer invokes, the authorizer
+ * itself, and the permission letting the API invoke it, and answer the
+ * authorization every route of that API is then created with.
+ *
+ * Three commands and a function stand between a test and a `CUSTOM` route it
+ * can serve, and a test about the authorizer is about none of them.
+ */
+export declare function simHttpApiProxyRequestAuthorizer(simAws: SimAws, input: SimHttpApiProxyRequestAuthorizerInput): Promise<SimCreateRouteCommandInput>;
+export {};
+//# sourceMappingURL=sim-http-api-proxy-request-authorizer.d.ts.map

package/dist/service/apigatewayv2/api/sim-http-api-proxy-request-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-proxy-request-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-proxy-request-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAEhG;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,yBAAyB,KAAK,OAAO,CAAC;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC;IACtD,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAsB,gCAAgC,CACpD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,0BAA0B,CAAC,CAgDrC"}

package/dist/service/apigatewayv2/api/sim-http-api-proxy-request-authorizer.js

@@ -0,0 +1,55 @@
+import { makeLambdaZipFileInput } from "../../lambda/function/code/lambda-zip-file-input.js";
+import { simApiGatewayServicePrincipal } from "../serve/auth/sim-http-api-invoke-authorizer.js";
+/**
+ * Create the function a test's Lambda authorizer invokes, the authorizer
+ * itself, and the permission letting the API invoke it, and answer the
+ * authorization every route of that API is then created with.
+ *
+ * Three commands and a function stand between a test and a `CUSTOM` route it
+ * can serve, and a test about the authorizer is about none of them.
+ */
+export async function simHttpApiProxyRequestAuthorizer(simAws, input) {
+    const { apiId, authorizer } = input;
+    const simLambda = simAws.lambda();
+    const { FunctionArn: functionArn } = await simLambda.createFunction({
+        input: {
+            FunctionName: authorizer.functionName,
+            Role: input.roleArn,
+            Code: { ZipFile: makeLambdaZipFileInput(authorizer.handler) },
+        },
+    });
+    const created = await simAws.apiGatewayV2().createAuthorizer({
+        input: {
+            ApiId: apiId,
+            Name: "request-authorizer",
+            AuthorizerType: "REQUEST",
+            AuthorizerUri: authorizer.uri ?? functionArn,
+            AuthorizerPayloadFormatVersion: "2.0",
+            EnableSimpleResponses: authorizer.enableSimpleResponses,
+            AuthorizerResultTtlInSeconds: authorizer.resultTtlSeconds,
+            IdentitySource: [...authorizer.identitySource],
+        },
+    });
+    if (authorizer.invokePermission) {
+        const { accountId, regionName } = simAws.accountRegionScope().accountRegionScope;
+        await simLambda.addPermission({
+            input: {
+                FunctionName: authorizer.functionName,
+                StatementId: "api-gateway-invoke-authorizer",
+                Action: "lambda:InvokeFunction",
+                Principal: simApiGatewayServicePrincipal,
+                SourceArn: `arn:aws:execute-api:${regionName}:${accountId}:${apiId}` +
+                    `/authorizers/${created.AuthorizerId}`,
+            },
+        });
+    }
+    // The scopes are passed on rather than dropped, so a test asking for one on
+    // a route a Lambda authorizer decides is refused by CreateRoute rather than
+    // quietly getting an unchecked scope.
+    return {
+        AuthorizationType: "CUSTOM",
+        AuthorizerId: created.AuthorizerId,
+        AuthorizationScopes: input.authorizationScopes,
+    };
+}
+//# sourceMappingURL=sim-http-api-proxy-request-authorizer.js.map

package/dist/service/apigatewayv2/api/sim-http-api-proxy-request-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-proxy-request-authorizer.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/api/sim-http-api-proxy-request-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qDAAqD,CAAC;AAE7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAoChG;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,MAAc,EACd,KAA4C;IAE5C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAClC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC;QAClE,KAAK,EAAE;YACL,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;SAC9D;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,gBAAgB,CAAC;QAC3D,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,oBAAoB;YAC1B,cAAc,EAAE,SAAS;YACzB,aAAa,EAAE,UAAU,CAAC,GAAG,IAAI,WAAW;YAC5C,8BAA8B,EAAE,KAAK;YACrC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;YACvD,4BAA4B,EAAE,UAAU,CAAC,gBAAgB;YACzD,cAAc,EAAE,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC;SAC/C;KACF,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAChC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAC7B,MAAM,CAAC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACjD,MAAM,SAAS,CAAC,aAAa,CAAC;YAC5B,KAAK,EAAE;gBACL,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,WAAW,EAAE,+BAA+B;gBAC5C,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,6BAA6B;gBACxC,SAAS,EACP,uBAAuB,UAAU,IAAI,SAAS,IAAI,KAAK,EAAE;oBACzD,gBAAgB,OAAO,CAAC,YAAY,EAAE;aACzC;SACF,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,sCAAsC;IACtC,OAAO;QACL,iBAAiB,EAAE,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC;AACJ,CAAC"}

package/dist/service/apigatewayv2/cfn/authorizer/sim-cfn-http-api-authorizer-creator.d.ts

@@ -8,13 +8,12 @@ interface SimCfnHttpApiAuthorizerCreatorProperties {
     readonly imports: SimCfnHttpApiImports;
 }
 /**
- * Creates simulated JWT authorizers from AWS::ApiGatewayV2::Authorizer
- * Resources.
+ * Creates simulated authorizers from AWS::ApiGatewayV2::Authorizer Resources.
  *
  * The authorizer goes through the ordinary CreateAuthorizer command, so a
- * Lambda authorizer, a missing issuer or audience, and an identity source that
- * is not a header or query string are all refused here with the reason the
- * command gives.
+ * missing issuer or audience, an identity source that is not a header or query
+ * string, and a `REQUEST` authorizer asking for payload format `1.0` are all
+ * refused here with the reason the command gives.
  */
 export declare class SimCfnHttpApiAuthorizerCreator {
     private readonly apiGatewayV2;