@kensio/yulin 1.0.0 → 1.2.0

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.js

@@ -1,4 +1,6 @@
 import { SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { simHttpApiBearerToken } from "../../api/authorizer/sim-http-api-bearer-token.js";
+import { SimHttpApiJwtAuthorizer } from "../../api/authorizer/sim-http-api-jwt-authorizer.js";
 import { SimHttpApiJwtVerification } from "../../api/authorizer/sim-http-api-jwt-verification.js";
 /**
  * Decides whether one request may have a `JWT` route.
@@ -18,14 +20,17 @@ export class SimHttpApiJwtRouteAuthorizer {
     authorize(input) {
         const { api, match, request } = input;
         const { route } = match;
-        // A JWT route always names an authorizer, and that authorizer can still be
-        // deleted out from under it, so the two come to the same thing here: with
-        // no authorizer to ask, the route stays closed.
+        // A JWT route always names a JWT authorizer, and that authorizer can still
+        // be deleted out from under it, so the two come to the same thing here:
+        // with no authorizer to ask, the route stays closed.
         const authorizer = api.authorizers.find(route.authorizerId ?? "");
-        if (authorizer === undefined) {
+        if (!(authorizer instanceof SimHttpApiJwtAuthorizer)) {
             return SimHttpApiRefused.unauthorized();
         }
-        const presented = authorizer.identitySource.token(request);
+        const presented = simHttpApiBearerToken(authorizer.identitySource.value({
+            request,
+            routeKey: route.routeKey,
+        }));
         if (presented === undefined) {
             return SimHttpApiRefused.unauthorized();
         }

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-jwt-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAWlG;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,KAAK,CAAW;IAEjC,YAAY,UAAkD;QAC5D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAExB,2EAA2E;QAC3E,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAElE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAyB,CAAC;YAClD,UAAU,EAAE,GAAG,CAAC,aAAa;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,oBAAoB;QACpB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YAC1E,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-jwt-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAWlG;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,KAAK,CAAW;IAEjC,YAAY,UAAkD;QAC5D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAExB,2EAA2E;QAC3E,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,CAAC,UAAU,YAAY,uBAAuB,CAAC,EAAE,CAAC;YACrD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CACrC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC;YAC9B,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CACH,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAyB,CAAC;YAClD,UAAU,EAAE,GAAG,CAAC,aAAa;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,oBAAoB;QACpB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YAC1E,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.d.ts

@@ -0,0 +1,42 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import { type SimHttpApiAuthorizerFunctions } from "./sim-http-api-authorizer-invocation.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+interface SimHttpApiRequestRouteAuthorizerProperties {
+    /**
+     * Clock the authorizer's own invocation event is stamped with, and the one
+     * a held decision expires against, so advancing simulated time drops a
+     * decision that was being reused a moment before.
+     */
+    readonly clock: SimClock;
+    readonly functions: SimHttpApiAuthorizerFunctions;
+}
+/**
+ * Decides whether one request may have a `CUSTOM` route, by invoking the
+ * Lambda function the route's authorizer names.
+ *
+ * The steps are the ones real API Gateway takes, in this order:
+ *
+ * 1. the request has to carry every identity source the authorizer was
+ *    configured with, or it is refused with a 401 and the function is never
+ *    invoked;
+ * 2. a decision already made for those same identity source values, and not
+ *    yet expired, is reused by `SimHttpApiAuthorizerDecisions`, and nothing
+ *    further happens;
+ * 3. otherwise `SimHttpApiAuthorizerInvocation` asks the function, and what it
+ *    answered decides.
+ *
+ * An authorizer with no `AuthorizerResultTtlInSeconds` holds nothing, so its
+ * function is invoked once per request reaching the route.
+ */
+export declare class SimHttpApiRequestRouteAuthorizer {
+    private readonly decisions;
+    private readonly invocation;
+    constructor(properties: SimHttpApiRequestRouteAuthorizerProperties);
+    /**
+     * Authorize one request against the `CUSTOM` route that matched it.
+     */
+    authorize(input: SimHttpApiRouteAuthorizeInput): Promise<SimHttpApiAuthorization>;
+}
+export {};
+//# sourceMappingURL=sim-http-api-request-route-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-request-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,0CAA0C;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAE5D,YAAY,UAAU,EAAE,0CAA0C,EAQjE;IAED;;OAEG;IACG,SAAS,CACb,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAuBlC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.js

@@ -0,0 +1,57 @@
+import { SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiRequestAuthorizer } from "../../api/authorizer/sim-http-api-request-authorizer.js";
+import { SimHttpApiAuthorizerDecisions } from "./sim-http-api-authorizer-decisions.js";
+import { SimHttpApiAuthorizerInvocation, } from "./sim-http-api-authorizer-invocation.js";
+/**
+ * Decides whether one request may have a `CUSTOM` route, by invoking the
+ * Lambda function the route's authorizer names.
+ *
+ * The steps are the ones real API Gateway takes, in this order:
+ *
+ * 1. the request has to carry every identity source the authorizer was
+ *    configured with, or it is refused with a 401 and the function is never
+ *    invoked;
+ * 2. a decision already made for those same identity source values, and not
+ *    yet expired, is reused by `SimHttpApiAuthorizerDecisions`, and nothing
+ *    further happens;
+ * 3. otherwise `SimHttpApiAuthorizerInvocation` asks the function, and what it
+ *    answered decides.
+ *
+ * An authorizer with no `AuthorizerResultTtlInSeconds` holds nothing, so its
+ * function is invoked once per request reaching the route.
+ */
+export class SimHttpApiRequestRouteAuthorizer {
+    decisions;
+    invocation;
+    constructor(properties) {
+        this.decisions = new SimHttpApiAuthorizerDecisions({
+            clock: properties.clock,
+        });
+        this.invocation = new SimHttpApiAuthorizerInvocation({
+            clock: properties.clock,
+            functions: properties.functions,
+        });
+    }
+    /**
+     * Authorize one request against the `CUSTOM` route that matched it.
+     */
+    async authorize(input) {
+        const { api, match, request } = input;
+        const authorizer = api.authorizers.find(match.route.authorizerId ?? "");
+        // A CUSTOM route always names a REQUEST authorizer, and that authorizer
+        // can still be deleted out from under it, so the two come to the same
+        // thing here: with nothing to ask, the route stays closed.
+        if (!(authorizer instanceof SimHttpApiRequestAuthorizer)) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        const identitySource = authorizer.identitySources.values({
+            request,
+            routeKey: match.route.routeKey,
+        });
+        if (identitySource === undefined) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        return await this.decisions.decide(authorizer, identitySource, async () => this.invocation.invoke(input, authorizer, identitySource));
+    }
+}
+//# sourceMappingURL=sim-http-api-request-route-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-request-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAEL,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAajD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,gCAAgC;IAC1B,SAAS,CAAgC;IACzC,UAAU,CAAiC;IAE5D,YAAY,UAAsD;QAChE,IAAI,CAAC,SAAS,GAAG,IAAI,6BAA6B,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,8BAA8B,CAAC;YACnD,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,KAAoC;QAEpC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAExE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,CAAC,CAAC,UAAU,YAAY,2BAA2B,CAAC,EAAE,CAAC;YACzD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC;YACvD,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,CACxE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.d.ts

@@ -1,12 +1,19 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiAuthorizerFunctions } from "./sim-http-api-authorizer-invocation.js";
 import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
 interface SimHttpApiRouteAuthorizerProperties {
     /**
      * Clock a JWT route's time claims are checked against, so advancing
-     * simulated time expires a token that was accepted before it.
+     * simulated time expires a token that was accepted before it, and the one a
+     * Lambda authorizer's own invocation event is stamped with.
      */
     readonly clock: SimClock;
+    /**
+     * Where a Lambda authorizer's function is found, which is the same router
+     * that finds an integration's.
+     */
+    readonly functions: SimHttpApiAuthorizerFunctions;
 }
 /**
  * Decides whether one request may have the route that matched it.
@@ -21,12 +28,13 @@ interface SimHttpApiRouteAuthorizerProperties {
  */
 export declare class SimHttpApiRouteAuthorizer {
     private readonly jwtAuthorizer;
+    private readonly requestAuthorizer;
     private readonly iamAuthorizer;
     constructor(properties: SimHttpApiRouteAuthorizerProperties);
     /**
      * Authorize one request against the route that matched it.
      */
-    authorize(input: SimHttpApiRouteAuthorizeInput): SimHttpApiAuthorization;
+    authorize(input: SimHttpApiRouteAuthorizeInput): Promise<SimHttpApiAuthorization>;
 }
 export {};
 //# sourceMappingURL=sim-http-api-route-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,mCAAmC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CAcvE;CACF"}
+{"version":3,"file":"sim-http-api-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,mCAAmC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;CACnD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,EAAE,mCAAmC,EAQ1D;IAED;;OAEG;IACG,SAAS,CACb,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAiBlC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.js

@@ -1,6 +1,7 @@
 import { SimHttpApiAdmitted, } from "../../api/authorizer/sim-http-api-authorization.js";
 import { SimHttpApiIamRouteAuthorizer } from "./sim-http-api-iam-route-authorizer.js";
 import { SimHttpApiJwtRouteAuthorizer } from "./sim-http-api-jwt-route-authorizer.js";
+import { SimHttpApiRequestRouteAuthorizer } from "./sim-http-api-request-route-authorizer.js";
 /**
  * Decides whether one request may have the route that matched it.
  *
@@ -14,16 +15,21 @@ import { SimHttpApiJwtRouteAuthorizer } from "./sim-http-api-jwt-route-authorize
  */
 export class SimHttpApiRouteAuthorizer {
     jwtAuthorizer;
+    requestAuthorizer;
     iamAuthorizer = new SimHttpApiIamRouteAuthorizer();
     constructor(properties) {
         this.jwtAuthorizer = new SimHttpApiJwtRouteAuthorizer({
             clock: properties.clock,
         });
+        this.requestAuthorizer = new SimHttpApiRequestRouteAuthorizer({
+            clock: properties.clock,
+            functions: properties.functions,
+        });
     }
     /**
      * Authorize one request against the route that matched it.
      */
-    authorize(input) {
+    async authorize(input) {
         switch (input.match.route.authorizationType) {
             case "NONE": {
                 // Nobody was authorized, so there is no caller to describe, which is
@@ -36,6 +42,9 @@ export class SimHttpApiRouteAuthorizer {
             case "AWS_IAM": {
                 return this.iamAuthorizer.authorize(input);
             }
+            case "CUSTOM": {
+                return await this.requestAuthorizer.authorize(input);
+            }
         }
     }
 }

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,GAEnB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAWtF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yBAAyB;IACnB,aAAa,CAA+B;IAC5C,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAA+C;QACzD,IAAI,CAAC,aAAa,GAAG,IAAI,4BAA4B,CAAC;YACpD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,QAAQ,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5C,KAAK,MAAM,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,mEAAmE;gBACnE,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,GAEnB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAEtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAiB9F;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yBAAyB;IACnB,aAAa,CAA+B;IAC5C,iBAAiB,CAAmC;IACpD,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAA+C;QACzD,IAAI,CAAC,aAAa,GAAG,IAAI,4BAA4B,CAAC;YACpD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,gCAAgC,CAAC;YAC5D,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,KAAoC;QAEpC,QAAQ,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5C,KAAK,MAAM,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,mEAAmE;gBACnE,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.d.ts

@@ -14,31 +14,24 @@ interface SimApiGatewayV2ServiceControllerProperties {
  * any other invocation.
  *
  * A route that authorizes anybody is checked before any of that: a JWT route's
- * token has to verify and meet the route's scopes, and an `AWS_IAM` route's
- * caller has to be allowed `execute-api:Invoke` on the route, or the request is
- * refused and the function is never invoked. Whether the API may invoke the
- * function is a separate question, and the API's own rather than the client's.
+ * token has to verify and meet the route's scopes, an `AWS_IAM` route's caller
+ * has to be allowed `execute-api:Invoke` on the route, and a `CUSTOM` route's
+ * Lambda authorizer has to allow the request, or the request is refused and the
+ * integration is never invoked. Whether the API may invoke a function is a
+ * separate question, and the API's own rather than the client's.
  */
 export declare class SimApiGatewayV2ServiceController implements SimAwsServiceController {
     private readonly router;
-    private readonly eventBuilder;
     private readonly routeAuthorizer;
-    private readonly responseBuilder;
+    private readonly integration;
     private readonly errorResponse;
+    private readonly refusalResponse;
     constructor(properties?: SimApiGatewayV2ServiceControllerProperties);
     /**
      * Handle an HTTP request routed to a simulated HTTP API.
      */
     handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
     private invoke;
-    /**
-     * The response a refused request gets back.
-     *
-     * A 403 is an unmet route scope, where the token was accepted and does not
-     * allow this route, or an `AWS_IAM` route IAM did not allow the caller.
-     * Everything else is one 401.
-     */
-    private refusalResponse;
 }
 export {};
 //# sourceMappingURL=sim-api-gateway-v2-controller.d.ts.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-api-gateway-v2-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAQ9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAGvE,UAAU,0CAA0C;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gCAAiC,YAAW,uBAAuB;IAC9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,GAAE,0CAA+C,EAYtE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E;YAEa,MAAM;IA4EpB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAOxB"}
+{"version":3,"file":"sim-api-gateway-v2-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAK9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAIvE,UAAU,0CAA0C;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAiC,YAAW,uBAAuB;IAC9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IACpE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IAEnE,YAAY,UAAU,GAAE,0CAA+C,EActE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E;YAEa,MAAM;CAwCrB"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.js

@@ -1,13 +1,10 @@
-import { SimPayload2EventBuilder } from "../../../serve/payload-2/sim-payload-2-event-builder.js";
-import { SimPayload2ResponseBuilder } from "../../../serve/payload-2/sim-payload-2-response-builder.js";
 import { SimAws } from "../../aws/sim-aws.js";
-import { SimHttpApiExecuteApiArn } from "../api/sim-http-api-execute-api-arn.js";
 import { SimHttpApiRequest } from "../api/sim-http-api-request.js";
-import { SimHttpApiIntegrationAuthorizer } from "./auth/sim-http-api-integration-authorizer.js";
 import { SimHttpApiRouteAuthorizer } from "./auth/sim-http-api-route-authorizer.js";
 import { SimApiGatewayV2ErrorResponse } from "./sim-api-gateway-v2-error-response.js";
 import { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
-import { simHttpApiEndpoint } from "./sim-http-api-endpoint.js";
+import { SimHttpApiIntegrationInvocation } from "./sim-http-api-integration-invocation.js";
+import { SimHttpApiRefusalResponse } from "./sim-http-api-refusal-response.js";
 /**
  * Localhost HTTP controller for simulated API Gateway HTTP APIs.
  *
@@ -17,27 +14,30 @@ import { simHttpApiEndpoint } from "./sim-http-api-endpoint.js";
  * any other invocation.
  *
  * A route that authorizes anybody is checked before any of that: a JWT route's
- * token has to verify and meet the route's scopes, and an `AWS_IAM` route's
- * caller has to be allowed `execute-api:Invoke` on the route, or the request is
- * refused and the function is never invoked. Whether the API may invoke the
- * function is a separate question, and the API's own rather than the client's.
+ * token has to verify and meet the route's scopes, an `AWS_IAM` route's caller
+ * has to be allowed `execute-api:Invoke` on the route, and a `CUSTOM` route's
+ * Lambda authorizer has to allow the request, or the request is refused and the
+ * integration is never invoked. Whether the API may invoke a function is a
+ * separate question, and the API's own rather than the client's.
  */
 export class SimApiGatewayV2ServiceController {
     router;
-    eventBuilder;
     routeAuthorizer;
-    responseBuilder = new SimPayload2ResponseBuilder();
+    integration;
     errorResponse = new SimApiGatewayV2ErrorResponse();
+    refusalResponse = new SimHttpApiRefusalResponse();
     constructor(properties = {}) {
         const { simAws = new SimAws() } = properties;
         this.router = properties.router ?? new SimApiGatewayV2Router({ simAws });
-        // Taken from the router rather than from properties, so a supplied router,
-        // the event timestamps and the token expiry checks all belong to the same
-        // simulation.
-        this.eventBuilder = new SimPayload2EventBuilder({
+        // The clock is taken from the router rather than from properties, so a
+        // supplied router, the event timestamps and the token expiry checks all
+        // belong to the same simulation.
+        this.routeAuthorizer = new SimHttpApiRouteAuthorizer({
             clock: this.router.simAws,
+            functions: this.router,
         });
-        this.routeAuthorizer = new SimHttpApiRouteAuthorizer({
+        this.integration = new SimHttpApiIntegrationInvocation({
+            router: this.router,
             clock: this.router.simAws,
         });
     }
@@ -70,7 +70,7 @@ export class SimApiGatewayV2ServiceController {
         // The client's own authorization comes first: a request with no
         // credentials is refused whether or not the integration behind the route
         // would work.
-        const authorization = this.routeAuthorizer.authorize({
+        const authorization = await this.routeAuthorizer.authorize({
             api,
             match,
             request,
@@ -78,54 +78,14 @@ export class SimApiGatewayV2ServiceController {
             iam: this.router.iamFor(api),
         });
         if (!authorization.admitted) {
-            return this.refusalResponse(authorization);
+            return this.refusalResponse.build(authorization);
         }
-        const target = this.router.targetFor(match.integration);
-        if (target === undefined) {
-            // The integration names a function that is not there, which real API
-            // Gateway discovers the same way: only when it tries to invoke it.
-            return this.errorResponse.internalServerError();
-        }
-        const decision = new SimHttpApiIntegrationAuthorizer({
-            iam: target.iam,
-        }).authorize({
-            simFunction: target.simFunction,
-            sourceArn: new SimHttpApiExecuteApiArn({
-                api,
-                stageName: match.stage.stageName,
-                methodAndPath: match.route.key.methodAndPath(request.method),
-            }),
+        return await this.integration.invoke({
+            api,
+            match,
+            request,
+            authorization,
         });
-        if (decision.isDenied) {
-            // Real API Gateway answers a missing invoke permission with a 500 and
-            // never invokes the function, which is the same answer as an integration
-            // that failed. The refusal is only visible in the API's own logs.
-            return this.errorResponse.internalServerError();
-        }
-        try {
-            const event = await this.eventBuilder.build(request, simHttpApiEndpoint(api, match), { jwt: authorization.jwt, caller: authorization.caller });
-            return this.responseBuilder.build(await target.simFunction.invoke(event));
-        }
-        catch {
-            // Real API Gateway reports an unhandled integration error as a 500, with
-            // the error itself only visible in the function's logs. Reading the
-            // request body can fail the same way, so building the event is inside
-            // this too.
-            return this.errorResponse.internalServerError();
-        }
-    }
-    /**
-     * The response a refused request gets back.
-     *
-     * A 403 is an unmet route scope, where the token was accepted and does not
-     * allow this route, or an `AWS_IAM` route IAM did not allow the caller.
-     * Everything else is one 401.
-     */
-    refusalResponse(refused) {
-        if (refused.kind === "forbidden") {
-            return this.errorResponse.forbidden();
-        }
-        return this.errorResponse.unauthorized(refused.errorDescription);
     }
 }
 //# sourceMappingURL=sim-api-gateway-v2-controller.js.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-api-gateway-v2-controller.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AACxG,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAOhE;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,gCAAgC;IAC1B,MAAM,CAAwB;IAC9B,YAAY,CAA0B;IACtC,eAAe,CAA4B;IAC3C,eAAe,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACnD,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAAU,GAA+C,EAAE;QACrE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,cAAc;QACd,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,IAAI,yBAAyB,CAAC;YACnD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACtC,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,GAAe,EACf,cAAoC;QAEpC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CACrB,IAAI,iBAAiB,CAAC;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;SACpC,CAAC,CACH,CAAC;QAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QAED,gEAAgE;QAChE,yEAAyE;QACzE,cAAc;QACd,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;YACnD,GAAG;YACH,KAAK;YACL,OAAO;YACP,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAExD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,+BAA+B,CAAC;YACnD,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB,CAAC,CAAC,SAAS,CAAC;YACX,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,IAAI,uBAAuB,CAAC;gBACrC,GAAG;gBACH,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;aAC7D,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CACzC,OAAO,EACP,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAC9B,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CACzD,CAAC;YAEF,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,sEAAsE;YACtE,YAAY;YACZ,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,OAA0B;QAChD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;CACF"}
+{"version":3,"file":"sim-api-gateway-v2-controller.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAO/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAgC;IAC1B,MAAM,CAAwB;IAC9B,eAAe,CAA4B;IAC3C,WAAW,CAAkC;IAC7C,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IACnD,eAAe,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAEnE,YAAY,UAAU,GAA+C,EAAE;QACrE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,iCAAiC;QACjC,IAAI,CAAC,eAAe,GAAG,IAAI,yBAAyB,CAAC;YACnD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,+BAA+B,CAAC;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACtC,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,GAAe,EACf,cAAoC;QAEpC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CACrB,IAAI,iBAAiB,CAAC;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;SACpC,CAAC,CACH,CAAC;QAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QAED,gEAAgE;QAChE,yEAAyE;QACzE,cAAc;QACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;YACzD,GAAG;YACH,KAAK;YACL,OAAO;YACP,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACnC,GAAG;YACH,KAAK;YACL,OAAO;YACP,aAAa;SACd,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.d.ts

@@ -2,19 +2,20 @@ import type { SimAwsServiceTarget } from "../../../serve/controller/sim-service-
 import { SimAws } from "../../aws/sim-aws.js";
 import type { SimLambdaFunction } from "../../lambda/function/sim-lambda-function.js";
 import type { SimHttpApiIntegration } from "../api/integration/sim-http-api-integration.js";
+import type { SimHttpApiLambdaUri } from "../api/integration/sim-http-api-lambda-uri.js";
 import type { SimHttpApi } from "../api/sim-http-api.js";
 import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
 interface SimApiGatewayV2RouterProperties {
     readonly simAws?: SimAws;
 }
 /**
- * What an integration invokes, and what decides whether it may.
+ * A function the API invokes, and what decides whether it may.
  */
-export interface SimHttpApiIntegrationTarget {
+export interface SimHttpApiFunctionTarget {
     readonly simFunction: SimLambdaFunction;
     /**
-     * IAM of the Account that owns the function, which is what the integration's
-     * invoke permission is evaluated against. It need not be the API's Account.
+     * IAM of the Account that owns the function, which is what the API's invoke
+     * permission is evaluated against. It need not be the API's Account.
      */
     readonly iam: SimIamInterServiceAuthZ;
 }
@@ -54,11 +55,17 @@ export declare class SimApiGatewayV2Router {
     /**
      * Find the function an integration invokes, and the IAM deciding whether it
      * may be invoked.
+     */
+    targetFor(integration: SimHttpApiIntegration): SimHttpApiFunctionTarget | undefined;
+    /**
+     * Find the function a URI names, and the IAM deciding whether API Gateway
+     * may invoke it.
      *
-     * The function is looked up in the Account and Region its ARN names, not the
-     * API's, because an integration ARN is free to name either.
+     * The function is looked up in the Account and Region its own ARN names, not
+     * the API's, because an integration URI and an authorizer URI are each free
+     * to name either.
      */
-    targetFor(integration: SimHttpApiIntegration): SimHttpApiIntegrationTarget | undefined;
+    functionFor(lambdaUri: SimHttpApiLambdaUri): SimHttpApiFunctionTarget | undefined;
 }
 export {};
 //# sourceMappingURL=sim-api-gateway-v2-router.d.ts.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-api-gateway-v2-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE/F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAEnG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC;;;;;;OAMG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAE,+BAAoC,EAG3D;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAWzD;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,uBAAuB,CAI/C;IAED;;;;;;OAMG;IACH,SAAS,CACP,WAAW,EAAE,qBAAqB,GACjC,2BAA2B,GAAG,SAAS,CAczC;CACF"}
+{"version":3,"file":"sim-api-gateway-v2-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE/F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAEnG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC;;;;;;OAMG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAE,+BAAoC,EAG3D;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAWzD;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,uBAAuB,CAI/C;IAED;;;OAGG;IACH,SAAS,CACP,WAAW,EAAE,qBAAqB,GACjC,wBAAwB,GAAG,SAAS,CAEtC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CActC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.js

@@ -50,12 +50,20 @@ export class SimApiGatewayV2Router {
     /**
      * Find the function an integration invokes, and the IAM deciding whether it
      * may be invoked.
-     *
-     * The function is looked up in the Account and Region its ARN names, not the
-     * API's, because an integration ARN is free to name either.
      */
     targetFor(integration) {
-        const { accountId, regionName, functionName } = integration.lambdaUri;
+        return this.functionFor(integration.lambdaUri);
+    }
+    /**
+     * Find the function a URI names, and the IAM deciding whether API Gateway
+     * may invoke it.
+     *
+     * The function is looked up in the Account and Region its own ARN names, not
+     * the API's, because an integration URI and an authorizer URI are each free
+     * to name either.
+     */
+    functionFor(lambdaUri) {
+        const { accountId, regionName, functionName } = lambdaUri;
         const scope = this.simAws.accountRegionScope(accountId, regionName);
         const simFunction = scope.lambda().getSimFunctionByName(functionName);
         if (simFunction === undefined) {

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-api-gateway-v2-router.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAwB9C;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChC;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAoC,EAAE;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aAChD,YAAY,EAAE;aACd,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAe;QACpB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,kBAAkB,CAAC;QAEzD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CACP,WAAkC;QAElC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC;QAEtE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC1C,SAA4B,EAC5B,UAA2B,CAC5B,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAEtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-api-gateway-v2-router.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAyB9C;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChC;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAoC,EAAE;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aAChD,YAAY,EAAE;aACd,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAe;QACpB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,kBAAkB,CAAC;QAEzD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,SAAS,CACP,WAAkC;QAElC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,SAA8B;QAE9B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;QAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC1C,SAA4B,EAC5B,UAA2B,CAC5B,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAEtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-http-api-integration-invocation.d.ts

@@ -0,0 +1,46 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimHttpApiAdmitted } from "../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiMatch } from "../api/sim-http-api-match.js";
+import type { SimHttpApi } from "../api/sim-http-api.js";
+import type { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
+interface SimHttpApiIntegrationInvocationProperties {
+    readonly router: SimApiGatewayV2Router;
+    /** Clock the invocation event is stamped with. */
+    readonly clock: SimClock;
+}
+interface SimHttpApiIntegrationInvocationInput {
+    readonly api: SimHttpApi;
+    readonly match: SimHttpApiMatch;
+    readonly request: Request;
+    /** What the route's authorization knows about the caller. */
+    readonly authorization: SimHttpApiAdmitted;
+}
+/**
+ * Invokes the Lambda function behind the matched route's integration, and
+ * turns what it returns into the HTTP response.
+ *
+ * Whether the API may invoke the function is asked first, and is the API's own
+ * question rather than the client's: the client's was already answered by the
+ * route's authorization. A function that is not there, one the API may not
+ * invoke, and one that failed are the same 500, as they are on real AWS.
+ */
+export declare class SimHttpApiIntegrationInvocation {
+    private readonly router;
+    private readonly eventBuilder;
+    private readonly responseBuilder;
+    private readonly errorResponse;
+    constructor(properties: SimHttpApiIntegrationInvocationProperties);
+    /**
+     * Invoke the integration for one authorized request.
+     */
+    invoke(input: SimHttpApiIntegrationInvocationInput): Promise<Response>;
+    /**
+     * Whether the API lacks permission to invoke the integrated function.
+     *
+     * The route the request matched is supplied as the source ARN, so a
+     * permission granted for one route does not open another.
+     */
+    private mayNotInvoke;
+}
+export {};
+//# sourceMappingURL=sim-http-api-integration-invocation.d.ts.map

package/dist/service/apigatewayv2/serve/sim-http-api-integration-invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration-invocation.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-http-api-integration-invocation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,gCAAgC,CAAC;AAGxC,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,EAAE,yCAAyC,EAKhE;IAED;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,oCAAoC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8B3E;IAED;;;;;OAKG;IACH,OAAO,CAAC,YAAY;CAgBrB"}