@kensio/yulin 1.0.0 → 1.2.0

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-event.d.ts

@@ -0,0 +1,58 @@
+import type { SimPayload2Endpoint } from "../../../../serve/payload-2/sim-payload-2-endpoint.js";
+import type { SimPayload2Event } from "../../../../serve/payload-2/sim-payload-2-event.type.js";
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+/**
+ * The event a payload format 2.0 Lambda `REQUEST` authorizer is invoked with.
+ *
+ * It is the payload format 2.0 request event with three members added and the
+ * body left out. AWS's own example of this event carries no `body` and no
+ * `isBase64Encoded`, which is the one published account of what an authorizer
+ * receives, so neither is sent here: an authorizer written against a body it
+ * would not get on AWS is exactly the divergence worth refusing to create.
+ */
+export interface SimHttpApiAuthorizerEvent extends Omit<SimPayload2Event, "body" | "isBase64Encoded"> {
+    type: "REQUEST";
+    /**
+     * The route the request matched, as an `execute-api` ARN. A policy response
+     * is evaluated against this same ARN.
+     */
+    routeArn: string;
+    /**
+     * What the request carried at each of the authorizer's identity sources, in
+     * the order they were configured. These are the values, not the expressions
+     * that found them.
+     */
+    identitySource: string[];
+}
+interface SimHttpApiAuthorizerEventInput {
+    readonly request: Request;
+    readonly endpoint: SimPayload2Endpoint;
+    readonly routeArn: string;
+    readonly identitySource: readonly string[];
+}
+interface SimHttpApiAuthorizerEventBuilderProperties {
+    /** Clock stamping the event's requestContext time. */
+    readonly clock: SimClock;
+}
+/**
+ * Builds the event a Lambda `REQUEST` authorizer is invoked with.
+ *
+ * The members are copied across one at a time rather than spread, so what an
+ * authorizer receives is stated here rather than following from whatever the
+ * integration event happens to hold.
+ */
+export declare class SimHttpApiAuthorizerEventBuilder {
+    private readonly eventBuilder;
+    constructor(properties: SimHttpApiAuthorizerEventBuilderProperties);
+    /**
+     * Build the authorizer event for one request.
+     */
+    build(input: SimHttpApiAuthorizerEventInput): Promise<SimHttpApiAuthorizerEvent>;
+    /**
+     * Copy across the members the request only sometimes has, which the event
+     * builder leaves out when it has nothing to put there.
+     */
+    private addPresentFields;
+}
+export {};
+//# sourceMappingURL=sim-http-api-authorizer-event.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-event.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AAEjG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CACrD,gBAAgB,EAChB,MAAM,GAAG,iBAAiB,CAC3B;IACC,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,UAAU,0CAA0C;IAClD,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IAEvD,YAAY,UAAU,EAAE,0CAA0C,EAIjE;IAED;;OAEG;IACG,KAAK,CACT,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,yBAAyB,CAAC,CAwBpC;IAED;;;OAGG;IACH,OAAO,CAAC,gBAAgB;CAuBzB"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-event.js

@@ -0,0 +1,58 @@
+import { SimPayload2EventBuilder } from "../../../../serve/payload-2/sim-payload-2-event-builder.js";
+/**
+ * Builds the event a Lambda `REQUEST` authorizer is invoked with.
+ *
+ * The members are copied across one at a time rather than spread, so what an
+ * authorizer receives is stated here rather than following from whatever the
+ * integration event happens to hold.
+ */
+export class SimHttpApiAuthorizerEventBuilder {
+    eventBuilder;
+    constructor(properties) {
+        this.eventBuilder = new SimPayload2EventBuilder({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Build the authorizer event for one request.
+     */
+    async build(input) {
+        // The request is cloned because reading it consumes its body, and the
+        // integration behind the route still has to build an event of its own from
+        // the same request.
+        const requestEvent = await this.eventBuilder.build(input.request.clone(), input.endpoint);
+        const event = {
+            version: requestEvent.version,
+            type: "REQUEST",
+            routeArn: input.routeArn,
+            identitySource: [...input.identitySource],
+            routeKey: requestEvent.routeKey,
+            rawPath: requestEvent.rawPath,
+            rawQueryString: requestEvent.rawQueryString,
+            headers: requestEvent.headers,
+            requestContext: requestEvent.requestContext,
+        };
+        this.addPresentFields(event, requestEvent);
+        return event;
+    }
+    /**
+     * Copy across the members the request only sometimes has, which the event
+     * builder leaves out when it has nothing to put there.
+     */
+    addPresentFields(event, requestEvent) {
+        const { cookies, queryStringParameters, pathParameters, stageVariables } = requestEvent;
+        if (cookies !== undefined) {
+            event.cookies = cookies;
+        }
+        if (queryStringParameters !== undefined) {
+            event.queryStringParameters = queryStringParameters;
+        }
+        if (pathParameters !== undefined) {
+            event.pathParameters = pathParameters;
+        }
+        if (stageVariables !== undefined) {
+            event.stageVariables = stageVariables;
+        }
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-event.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-event.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4DAA4D,CAAC;AA2CrG;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC1B,YAAY,CAA0B;IAEvD,YAAY,UAAsD;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CACT,KAAqC;QAErC,sEAAsE;QACtE,2EAA2E;QAC3E,oBAAoB;QACpB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAChD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EACrB,KAAK,CAAC,QAAQ,CACf,CAAC;QAEF,MAAM,KAAK,GAA8B;YACvC,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;YACzC,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,cAAc,EAAE,YAAY,CAAC,cAAc;SAC5C,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAE3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,gBAAgB,CACtB,KAAgC,EAChC,YAA8B;QAE9B,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,cAAc,EAAE,GACtE,YAAY,CAAC;QAEf,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QAED,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACxC,KAAK,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACtD,CAAC;QAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,CAAC;QAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.d.ts

@@ -0,0 +1,36 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiRequestAuthorizer } from "../../api/authorizer/sim-http-api-request-authorizer.js";
+import type { SimHttpApiLambdaUri } from "../../api/integration/sim-http-api-lambda-uri.js";
+import type { SimHttpApiFunctionTarget } from "../sim-api-gateway-v2-router.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+/**
+ * Finds the function an authorizer names, which the serving router does.
+ */
+export interface SimHttpApiAuthorizerFunctions {
+    functionFor(lambdaUri: SimHttpApiLambdaUri): SimHttpApiFunctionTarget | undefined;
+}
+interface SimHttpApiAuthorizerInvocationProperties {
+    /** Clock the authorizer's own invocation event is stamped with. */
+    readonly clock: SimClock;
+    readonly functions: SimHttpApiAuthorizerFunctions;
+}
+/**
+ * Invokes a Lambda `REQUEST` authorizer's function and reads what it answered.
+ *
+ * The API's permission to invoke that function is asked first, under an ARN
+ * naming the authorizer rather than any route. A function that is not there,
+ * one the API may not invoke, and one that failed are the same 500, as they
+ * are on real AWS: none of them is anything the caller could act on.
+ */
+export declare class SimHttpApiAuthorizerInvocation {
+    private readonly functions;
+    private readonly eventBuilder;
+    constructor(properties: SimHttpApiAuthorizerInvocationProperties);
+    /**
+     * Ask the authorizer's function about one request.
+     */
+    invoke(input: SimHttpApiRouteAuthorizeInput, authorizer: SimHttpApiRequestAuthorizer, identitySource: readonly string[]): Promise<SimHttpApiAuthorization>;
+}
+export {};
+//# sourceMappingURL=sim-http-api-authorizer-invocation.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-invocation.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAE5F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAKhF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CAAC;CACzC;AAED,UAAU,wCAAwC;IAChD,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAEhE,YAAY,UAAU,EAAE,wCAAwC,EAK/D;IAED;;OAEG;IACG,MAAM,CACV,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,2BAA2B,EACvC,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAkClC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.js

@@ -0,0 +1,52 @@
+import { SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
+import { simHttpApiEndpoint } from "../sim-http-api-endpoint.js";
+import { SimHttpApiAuthorizerEventBuilder } from "./sim-http-api-authorizer-event.js";
+import { SimHttpApiAuthorizerResponse } from "./sim-http-api-authorizer-response.js";
+import { simHttpApiMayNotInvokeAuthorizer } from "./sim-http-api-invoke-authorizer.js";
+/**
+ * Invokes a Lambda `REQUEST` authorizer's function and reads what it answered.
+ *
+ * The API's permission to invoke that function is asked first, under an ARN
+ * naming the authorizer rather than any route. A function that is not there,
+ * one the API may not invoke, and one that failed are the same 500, as they
+ * are on real AWS: none of them is anything the caller could act on.
+ */
+export class SimHttpApiAuthorizerInvocation {
+    functions;
+    eventBuilder;
+    constructor(properties) {
+        this.functions = properties.functions;
+        this.eventBuilder = new SimHttpApiAuthorizerEventBuilder({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Ask the authorizer's function about one request.
+     */
+    async invoke(input, authorizer, identitySource) {
+        const { api, match, request } = input;
+        const target = this.functions.functionFor(authorizer.lambdaUri);
+        if (target === undefined ||
+            simHttpApiMayNotInvokeAuthorizer(api, authorizer, target)) {
+            return SimHttpApiRefused.error();
+        }
+        const routeArn = SimHttpApiExecuteApiArn.forMatchedRoute(api, match, request.method).toString();
+        try {
+            const event = await this.eventBuilder.build({
+                request,
+                endpoint: simHttpApiEndpoint(api, match),
+                routeArn,
+                identitySource,
+            });
+            return new SimHttpApiAuthorizerResponse({ authorizer, routeArn }).read(await target.simFunction.invoke(event));
+        }
+        catch {
+            // An authorizer that failed tells the caller nothing, the way an
+            // integration that failed does not. Reading the request to build the
+            // event can fail the same way, so it is inside this too.
+            return SimHttpApiRefused.error();
+        }
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-invocation.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-invocation.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAG5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAEpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAkBvF;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA8B;IACxB,SAAS,CAAgC;IACzC,YAAY,CAAmC;IAEhE,YAAY,UAAoD;QAC9D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,gCAAgC,CAAC;YACvD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,KAAoC,EACpC,UAAuC,EACvC,cAAiC;QAEjC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEhE,IACE,MAAM,KAAK,SAAS;YACpB,gCAAgC,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,EACzD,CAAC;YACD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,eAAe,CACtD,GAAG,EACH,KAAK,EACL,OAAO,CAAC,MAAM,CACf,CAAC,QAAQ,EAAE,CAAC;QAEb,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC1C,OAAO;gBACP,QAAQ,EAAE,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC;gBACxC,QAAQ;gBACR,cAAc;aACf,CAAC,CAAC;YAEH,OAAO,IAAI,4BAA4B,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CACpE,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CACvC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,qEAAqE;YACrE,yDAAyD;YACzD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.d.ts

@@ -0,0 +1,27 @@
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+/**
+ * The IAM policy document a Lambda authorizer answers with, evaluated for
+ * `execute-api:Invoke` on the route the request matched.
+ *
+ * This is the same evaluation an `AWS_IAM` route goes through, with one
+ * difference: the document the authorizer returned is the whole decision.
+ * There are no stored policies to gather, because there is no IAM principal
+ * here at all. The `principalId` the authorizer returns alongside is a name it
+ * chose for the caller rather than anything IAM knows, so it identifies the
+ * caller in the authorizer's own logs and grants nothing.
+ *
+ * An explicit Deny still wins over an Allow, and a document allowing nothing
+ * relevant refuses the request, which is how IAM reads any policy.
+ */
+export declare class SimHttpApiAuthorizerPolicy {
+    private readonly document;
+    constructor(document: SimIamPolicyDocument);
+    /**
+     * Whether this document allows the request to reach the route.
+     *
+     * Throws the way IAM does for a document it cannot read, which the caller
+     * answers with the same 500 any other unusable authorizer response gets.
+     */
+    allows(routeArn: string): boolean;
+}
+//# sourceMappingURL=sim-http-api-authorizer-policy.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGlF;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAEhD,YAAY,QAAQ,EAAE,oBAAoB,EAEzC;IAED;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAyBhC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.js

@@ -0,0 +1,56 @@
+import { SimIamEitherSideAllowRequirement } from "../../../iam/authorize/allow/sim-iam-allow-requirement.js";
+import { SimIamPolicyDecision } from "../../../iam/authorize/sim-iam-decision.js";
+import { simExecuteApiInvokeAction } from "./sim-http-api-iam-route-authorizer.js";
+/**
+ * The IAM policy document a Lambda authorizer answers with, evaluated for
+ * `execute-api:Invoke` on the route the request matched.
+ *
+ * This is the same evaluation an `AWS_IAM` route goes through, with one
+ * difference: the document the authorizer returned is the whole decision.
+ * There are no stored policies to gather, because there is no IAM principal
+ * here at all. The `principalId` the authorizer returns alongside is a name it
+ * chose for the caller rather than anything IAM knows, so it identifies the
+ * caller in the authorizer's own logs and grants nothing.
+ *
+ * An explicit Deny still wins over an Allow, and a document allowing nothing
+ * relevant refuses the request, which is how IAM reads any policy.
+ */
+export class SimHttpApiAuthorizerPolicy {
+    document;
+    constructor(document) {
+        this.document = document;
+    }
+    /**
+     * Whether this document allows the request to reach the route.
+     *
+     * Throws the way IAM does for a document it cannot read, which the caller
+     * answers with the same 500 any other unusable authorizer response gets.
+     */
+    allows(routeArn) {
+        return new SimIamPolicyDecision({
+            // The document is evaluated as the identity side, which is the side with
+            // no Principal to state: an authorizer's policy says what the caller it
+            // just identified may do, not who may reach the route.
+            identityPolicies: [
+                {
+                    sourceType: "identity-inline",
+                    document: this.document,
+                    policyName: "AuthorizerPolicyDocument",
+                },
+            ],
+            resourcePolicies: [],
+            allowRequirement: new SimIamEitherSideAllowRequirement(),
+            action: simExecuteApiInvokeAction,
+            resource: routeArn,
+            conditionContext: {},
+            // There is no principal behind this document, and nothing in it can name
+            // one, so the caller is anonymous. A condition on a principal key
+            // therefore never matches, which is the strict direction to be wrong in.
+            caller: {
+                principal: { kind: "anonymous" },
+                identityPolicyPrincipal: { kind: "anonymous" },
+            },
+        }).isAllowed;
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-policy.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-policy.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,0BAA0B;IACpB,QAAQ,CAAuB;IAEhD,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,QAAgB;QACrB,OAAO,IAAI,oBAAoB,CAAC;YAC9B,yEAAyE;YACzE,wEAAwE;YACxE,uDAAuD;YACvD,gBAAgB,EAAE;gBAChB;oBACE,UAAU,EAAE,iBAAiB;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,0BAA0B;iBACvC;aACF;YACD,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,IAAI,gCAAgC,EAAE;YACxD,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,QAAQ;YAClB,gBAAgB,EAAE,EAAE;YACpB,yEAAyE;YACzE,kEAAkE;YAClE,yEAAyE;YACzE,MAAM,EAAE;gBACN,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAChC,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC/C;SACF,CAAC,CAAC,SAAS,CAAC;IACf,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.d.ts

@@ -0,0 +1,52 @@
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiRequestAuthorizer } from "../../api/authorizer/sim-http-api-request-authorizer.js";
+interface SimHttpApiAuthorizerResponseProperties {
+    readonly authorizer: SimHttpApiRequestAuthorizer;
+    /** The route ARN a policy response is evaluated against. */
+    readonly routeArn: string;
+}
+/**
+ * Reads what a Lambda `REQUEST` authorizer answered.
+ *
+ * There are two shapes, and `EnableSimpleResponses` says which one applies:
+ * `{ isAuthorized, context }`, or a `principalId` with an IAM `policyDocument`
+ * that has to allow `execute-api:Invoke` on the route. A response that is not
+ * the shape its authorizer was configured for is a 500 rather than a refusal,
+ * because API Gateway could not read it either.
+ *
+ * `{ "errorMessage": "Unauthorized" }` is the one answer that produces a 401,
+ * and it is read whichever shape the authorizer is configured for. A function
+ * that throws is an invocation failure here rather than that value: real
+ * Lambda turns a thrown error into a payload carrying this member, while
+ * simulated Lambda rejects with the error itself, so returning the value is
+ * the way to ask for a 401.
+ */
+export declare class SimHttpApiAuthorizerResponse {
+    private readonly authorizer;
+    private readonly routeArn;
+    constructor(properties: SimHttpApiAuthorizerResponseProperties);
+    /**
+     * What the endpoint should do with the request, given what the authorizer
+     * answered.
+     */
+    read(result: unknown): SimHttpApiAuthorization;
+    /**
+     * Read a simple response, which says yes or no and nothing else.
+     */
+    private simpleResponse;
+    /**
+     * Read a policy response, and put the document it carries to IAM.
+     */
+    private policyResponse;
+    private evaluated;
+    /**
+     * The admitted request, carrying whatever the authorizer passed on.
+     *
+     * A context that is not an object is left out rather than passed on as it
+     * stands, since `requestContext.authorizer.lambda` is a JSON object on AWS
+     * and a handler reading a member off it would find something else here.
+     */
+    private admitted;
+}
+export {};
+//# sourceMappingURL=sim-http-api-authorizer-response.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAmB3G,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,uBAAuB,CAc7C;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;IAgBtB;;OAEG;IACH,OAAO,CAAC,cAAc;IAqBtB,OAAO,CAAC,SAAS;IAejB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;CAWjB"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.js

@@ -0,0 +1,112 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimHttpApiAdmitted, SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiAuthorizerPolicy } from "./sim-http-api-authorizer-policy.js";
+/**
+ * The one message a Lambda authorizer answers a 401 with.
+ */
+const unauthorizedErrorMessage = "Unauthorized";
+/**
+ * Whether the returned `policyDocument` is worth handing to IAM at all.
+ *
+ * Only its outer shape is checked here. What is inside it is IAM's business,
+ * and a document IAM cannot read is a response API Gateway could not have used
+ * either, so both end up as the same 500.
+ */
+function isPolicyDocument(value) {
+    return isRecord(value);
+}
+/**
+ * Reads what a Lambda `REQUEST` authorizer answered.
+ *
+ * There are two shapes, and `EnableSimpleResponses` says which one applies:
+ * `{ isAuthorized, context }`, or a `principalId` with an IAM `policyDocument`
+ * that has to allow `execute-api:Invoke` on the route. A response that is not
+ * the shape its authorizer was configured for is a 500 rather than a refusal,
+ * because API Gateway could not read it either.
+ *
+ * `{ "errorMessage": "Unauthorized" }` is the one answer that produces a 401,
+ * and it is read whichever shape the authorizer is configured for. A function
+ * that throws is an invocation failure here rather than that value: real
+ * Lambda turns a thrown error into a payload carrying this member, while
+ * simulated Lambda rejects with the error itself, so returning the value is
+ * the way to ask for a 401.
+ */
+export class SimHttpApiAuthorizerResponse {
+    authorizer;
+    routeArn;
+    constructor(properties) {
+        this.authorizer = properties.authorizer;
+        this.routeArn = properties.routeArn;
+    }
+    /**
+     * What the endpoint should do with the request, given what the authorizer
+     * answered.
+     */
+    read(result) {
+        if (!isRecord(result)) {
+            return SimHttpApiRefused.error();
+        }
+        if (result["errorMessage"] === unauthorizedErrorMessage) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (this.authorizer.enableSimpleResponses) {
+            return this.simpleResponse(result);
+        }
+        return this.policyResponse(result);
+    }
+    /**
+     * Read a simple response, which says yes or no and nothing else.
+     */
+    simpleResponse(result) {
+        const isAuthorized = result["isAuthorized"];
+        if (typeof isAuthorized !== "boolean") {
+            return SimHttpApiRefused.error();
+        }
+        if (!isAuthorized) {
+            return SimHttpApiRefused.forbidden();
+        }
+        return this.admitted(result);
+    }
+    /**
+     * Read a policy response, and put the document it carries to IAM.
+     */
+    policyResponse(result) {
+        const policyDocument = result["policyDocument"];
+        if (typeof result["principalId"] !== "string" ||
+            !isPolicyDocument(policyDocument)) {
+            return SimHttpApiRefused.error();
+        }
+        try {
+            return this.evaluated(policyDocument, result);
+        }
+        catch {
+            // IAM refused to read the document, which is a malformed policy rather
+            // than a policy that says no.
+            return SimHttpApiRefused.error();
+        }
+    }
+    evaluated(policyDocument, result) {
+        const allowed = new SimHttpApiAuthorizerPolicy(policyDocument).allows(this.routeArn);
+        if (!allowed) {
+            return SimHttpApiRefused.forbidden();
+        }
+        return this.admitted(result);
+    }
+    /**
+     * The admitted request, carrying whatever the authorizer passed on.
+     *
+     * A context that is not an object is left out rather than passed on as it
+     * stands, since `requestContext.authorizer.lambda` is a JSON object on AWS
+     * and a handler reading a member off it would find something else here.
+     */
+    admitted(result) {
+        const context = result["context"];
+        if (!isRecord(context)) {
+            return new SimHttpApiAdmitted({ lambda: null });
+        }
+        return new SimHttpApiAdmitted({
+            lambda: context,
+        });
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-response.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-response.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-response.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAE5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;GAEG;AACH,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEhD;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAQD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,4BAA4B;IACtB,UAAU,CAA8B;IACxC,QAAQ,CAAS;IAElC,YAAY,UAAkD;QAC5D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,MAAe;QAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,wBAAwB,EAAE,CAAC;YACxD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEhD,IACE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ;YACzC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EACjC,CAAC;YACD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,8BAA8B;YAC9B,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,SAAS,CACf,cAAoC,EACpC,MAA+B;QAE/B,MAAM,OAAO,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC,MAAM,CACnE,IAAI,CAAC,QAAQ,CACd,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACK,QAAQ,CAAC,MAA+B;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAElC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC;YAC5B,MAAM,EAAE,OAAsC;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.d.ts

@@ -0,0 +1,60 @@
+import type { SimIamAuthorizationDecision, SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimLambdaFunction } from "../../../lambda/function/sim-lambda-function.js";
+import type { SimHttpApiRequestAuthorizer } from "../../api/authorizer/sim-http-api-request-authorizer.js";
+import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
+import type { SimHttpApi } from "../../api/sim-http-api.js";
+import type { SimHttpApiFunctionTarget } from "../sim-api-gateway-v2-router.js";
+/**
+ * The service principal API Gateway invokes a Lambda function as, whether that
+ * function is behind an integration or behind an authorizer.
+ */
+export declare const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+interface SimHttpApiInvokeAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface SimHttpApiInvokeAuthorizationInput {
+    readonly api: SimHttpApi;
+    readonly simFunction: SimLambdaFunction;
+    readonly sourceArn: SimHttpApiExecuteApiArn;
+}
+/**
+ * Decides whether an HTTP API may invoke one of its Lambda functions.
+ *
+ * A Lambda proxy integration created through CloudFormation, the CLI or an SDK
+ * does not work until the function's resource policy allows
+ * `apigateway.amazonaws.com` to invoke it, and a Lambda `REQUEST` authorizer's
+ * function needs the same grant under an ARN of its own.
+ *
+ * Whether a service may invoke a function is Lambda's own rule, so the decision
+ * is made there. What this adds is the part only API Gateway knows: which API
+ * is calling, and what it is calling for.
+ *
+ * The answer is a decision rather than a thrown error, because a refusal is an
+ * ordinary HTTP outcome: the endpoint answers 500 the way real API Gateway
+ * does, with nothing to propagate to a caller in process.
+ */
+export declare class SimHttpApiInvokeAuthorizer {
+    private readonly lambdaAuthorizer;
+    constructor(properties: SimHttpApiInvokeAuthorizerProperties);
+    /**
+     * Evaluate `lambda:InvokeFunction` for the API against the function.
+     *
+     * What the API is invoking the function for is supplied as `AWS:SourceArn`,
+     * so a permission granted for one route does not open another, and a
+     * permission granted for an integration does not make the same function
+     * usable as an authorizer. The API's own Account is supplied as
+     * `AWS:SourceAccount`, which is the Account the source ARN names rather than
+     * the one owning the function.
+     */
+    authorize(input: SimHttpApiInvokeAuthorizationInput): SimIamAuthorizationDecision;
+}
+/**
+ * Whether the API may not invoke a function as one of its authorizers.
+ *
+ * The source ARN names the authorizer rather than the route, so a function
+ * granted the invoke action for the API's routes is not thereby usable as its
+ * authorizer, as on real AWS.
+ */
+export declare function simHttpApiMayNotInvokeAuthorizer(api: SimHttpApi, authorizer: SimHttpApiRequestAuthorizer, target: SimHttpApiFunctionTarget): boolean;
+export {};
+//# sourceMappingURL=sim-http-api-invoke-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-invoke-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IAEpE,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;;;;;;;;OASG;IACH,SAAS,CACP,KAAK,EAAE,kCAAkC,GACxC,2BAA2B,CAO7B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,UAAU,EACf,UAAU,EAAE,2BAA2B,EACvC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAST"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.js

@@ -0,0 +1,64 @@
+import { SimLambdaServiceInvokeAuthorizer } from "../../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
+import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
+/**
+ * The service principal API Gateway invokes a Lambda function as, whether that
+ * function is behind an integration or behind an authorizer.
+ */
+export const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+/**
+ * Decides whether an HTTP API may invoke one of its Lambda functions.
+ *
+ * A Lambda proxy integration created through CloudFormation, the CLI or an SDK
+ * does not work until the function's resource policy allows
+ * `apigateway.amazonaws.com` to invoke it, and a Lambda `REQUEST` authorizer's
+ * function needs the same grant under an ARN of its own.
+ *
+ * Whether a service may invoke a function is Lambda's own rule, so the decision
+ * is made there. What this adds is the part only API Gateway knows: which API
+ * is calling, and what it is calling for.
+ *
+ * The answer is a decision rather than a thrown error, because a refusal is an
+ * ordinary HTTP outcome: the endpoint answers 500 the way real API Gateway
+ * does, with nothing to propagate to a caller in process.
+ */
+export class SimHttpApiInvokeAuthorizer {
+    lambdaAuthorizer;
+    constructor(properties) {
+        this.lambdaAuthorizer = new SimLambdaServiceInvokeAuthorizer({
+            iam: properties.iam,
+        });
+    }
+    /**
+     * Evaluate `lambda:InvokeFunction` for the API against the function.
+     *
+     * What the API is invoking the function for is supplied as `AWS:SourceArn`,
+     * so a permission granted for one route does not open another, and a
+     * permission granted for an integration does not make the same function
+     * usable as an authorizer. The API's own Account is supplied as
+     * `AWS:SourceAccount`, which is the Account the source ARN names rather than
+     * the one owning the function.
+     */
+    authorize(input) {
+        return this.lambdaAuthorizer.authorize({
+            simFunction: input.simFunction,
+            servicePrincipal: simApiGatewayServicePrincipal,
+            sourceArn: input.sourceArn.toString(),
+            sourceAccount: input.api.accountRegionScope.accountId,
+        });
+    }
+}
+/**
+ * Whether the API may not invoke a function as one of its authorizers.
+ *
+ * The source ARN names the authorizer rather than the route, so a function
+ * granted the invoke action for the API's routes is not thereby usable as its
+ * authorizer, as on real AWS.
+ */
+export function simHttpApiMayNotInvokeAuthorizer(api, authorizer, target) {
+    return new SimHttpApiInvokeAuthorizer({ iam: target.iam }).authorize({
+        api,
+        simFunction: target.simFunction,
+        sourceArn: SimHttpApiExecuteApiArn.forAuthorizer(api, authorizer.authorizerId),
+    }).isDenied;
+}
+//# sourceMappingURL=sim-http-api-invoke-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-invoke-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAG7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAIpF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAYxE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,0BAA0B;IACpB,gBAAgB,CAAmC;IAEpE,YAAY,UAAgD;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,gCAAgC,CAAC;YAC3D,GAAG,EAAE,UAAU,CAAC,GAAG;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,CACP,KAAyC;QAEzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACrC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,gBAAgB,EAAE,6BAA6B;YAC/C,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE;YACrC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS;SACtD,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,GAAe,EACf,UAAuC,EACvC,MAAgC;IAEhC,OAAO,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;QACnE,GAAG;QACH,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,uBAAuB,CAAC,aAAa,CAC9C,GAAG,EACH,UAAU,CAAC,YAAY,CACxB;KACF,CAAC,CAAC,QAAQ,CAAC;AACd,CAAC"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-jwt-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAE5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,sCAAsC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,sCAAsC,EAE7D;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CAqCvE;CACF"}
+{"version":3,"file":"sim-http-api-jwt-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAI5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,sCAAsC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,sCAAsC,EAE7D;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CA0CvE;CACF"}