@kensio/yulin 1.17.0 → 1.17.1

package/dist/service/cognito/user-pool/sim-cognito-registrations.d.ts

@@ -0,0 +1,34 @@
+import type { SimCognitoUserPoolClientFactory } from "./client/sim-cognito-user-pool-client-factory.js";
+import type { SimCognitoUserPoolClient } from "./client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPoolClientRegistration, SimCognitoUserPoolRegistration } from "./sim-cognito-registration.types.js";
+import type { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolFactory } from "./sim-cognito-user-pool-factory.js";
+import type { SimCognitoUserPoolStore } from "./sim-cognito-user-pool-store.js";
+interface SimCognitoRegistrationsProperties {
+    /** The Region a pool registered here has to name in its id. */
+    readonly regionName: string;
+    readonly pools: SimCognitoUserPoolStore;
+    readonly poolFactory: SimCognitoUserPoolFactory;
+    readonly clientFactory: SimCognitoUserPoolClientFactory;
+}
+/**
+ * The user pools and app clients a simulation is told already exist.
+ *
+ * These are the simulator's own setup operations rather than AWS ones, so they
+ * skip the command surface and its authorization, as `mountBucketFilesystem`
+ * and `registerHostedZone` do.
+ */
+export declare class SimCognitoRegistrations {
+    private readonly properties;
+    constructor(properties: SimCognitoRegistrationsProperties);
+    /**
+     * Register a user pool under a chosen pool id.
+     */
+    userPool(registration: SimCognitoUserPoolRegistration): SimCognitoUserPool;
+    /**
+     * Register an app client of a pool under a chosen client id.
+     */
+    userPoolClient(registration: SimCognitoUserPoolClientRegistration): SimCognitoUserPoolClient;
+}
+export {};
+//# sourceMappingURL=sim-cognito-registrations.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-registrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-registrations.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-registrations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACxG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,UAAU,iCAAiC;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,+BAA+B,CAAC;CACzD;AAED;;;;;;GAMG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,iCAAiC,EAAI;IAE9E;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,8BAA8B,GAAG,kBAAkB,CAEzE;IAED;;OAEG;IACH,cAAc,CACZ,YAAY,EAAE,oCAAoC,GACjD,wBAAwB,CAE1B;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-registrations.js

@@ -0,0 +1,28 @@
+import { registerSimCognitoUserPoolClient } from "./register-sim-cognito-user-pool-client.js";
+import { registerSimCognitoUserPool } from "./register-sim-cognito-user-pool.js";
+/**
+ * The user pools and app clients a simulation is told already exist.
+ *
+ * These are the simulator's own setup operations rather than AWS ones, so they
+ * skip the command surface and its authorization, as `mountBucketFilesystem`
+ * and `registerHostedZone` do.
+ */
+export class SimCognitoRegistrations {
+    properties;
+    constructor(properties) {
+        this.properties = properties;
+    }
+    /**
+     * Register a user pool under a chosen pool id.
+     */
+    userPool(registration) {
+        return registerSimCognitoUserPool(registration, this.properties);
+    }
+    /**
+     * Register an app client of a pool under a chosen client id.
+     */
+    userPoolClient(registration) {
+        return registerSimCognitoUserPoolClient(registration, this.properties);
+    }
+}
+//# sourceMappingURL=sim-cognito-registrations.js.map

package/dist/service/cognito/user-pool/sim-cognito-registrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-registrations.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-registrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAoBjF;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IACL,UAAU;IAAvC,YAA6B,UAA6C;0BAA7C,UAAU;IAAsC,CAAC;IAE9E;;OAEG;IACH,QAAQ,CAAC,YAA4C;QACnD,OAAO,0BAA0B,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,YAAkD;QAElD,OAAO,gCAAgC,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.d.ts

@@ -1,6 +1,7 @@
 import type { SimClock } from "../../../util/clock/sim-clock.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
+import { type SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
 import { type SimCognitoUserPoolSettingsInput } from "./sim-cognito-user-pool-settings.js";
 import type { SimCognitoUserPoolStore } from "./sim-cognito-user-pool-store.js";
 interface SimCognitoUserPoolFactoryProperties {
@@ -14,6 +15,14 @@ interface SimCognitoMakeUserPoolProperties {
      * The `CreateUserPool` request the pool's settings are read out of.
      */
     readonly settings: SimCognitoUserPoolSettingsInput;
+    /**
+     * The id the pool takes, where something else already decided it.
+     *
+     * `CreateUserPool` leaves this out and gets an allocated id, as real Cognito
+     * allocates one. A registration passes the id it was given, having checked
+     * that it is free and that it names this scope's region.
+     */
+    readonly id?: SimCognitoUserPoolId | undefined;
 }
 /**
  * Builds simulated user pools, including their id, ARN and defaults.

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,gCAAgC,GAAG,kBAAkB,CAsBrE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,CAAC;IAEnD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CAChD;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,gCAAgC,GAAG,kBAAkB,CAwBrE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.js

@@ -1,7 +1,7 @@
 import { SimCognitoName } from "./sim-cognito-name.js";
 import { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
 import { SimCognitoUserPoolArn } from "./sim-cognito-user-pool-arn.js";
-import { makeSimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+import { makeSimCognitoUserPoolId, } from "./sim-cognito-user-pool-id.js";
 import { SimCognitoUserPoolSettings, } from "./sim-cognito-user-pool-settings.js";
 /**
  * Builds simulated user pools, including their id, ARN and defaults.
@@ -23,7 +23,8 @@ export class SimCognitoUserPoolFactory {
      * Make a new pool with no app clients yet.
      */
     make(properties) {
-        const userPoolId = makeSimCognitoUserPoolId(this.accountRegionScope.regionName, this.pools.ids);
+        const userPoolId = properties.id ??
+            makeSimCognitoUserPoolId(this.accountRegionScope.regionName, this.pools.ids);
         return new SimCognitoUserPool({
             id: userPoolId,
             arn: new SimCognitoUserPoolArn({

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-factory.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAkB7C;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,kBAAkB,CAA2B;IAC7C,KAAK,CAA0B;IAC/B,KAAK,CAAW;IAEjC,YAAY,UAA+C;QACzD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAA4C;QAC/C,MAAM,UAAU,GAAG,wBAAwB,CACzC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAC;QAEF,OAAO,IAAI,kBAAkB,CAAC;YAC5B,EAAE,EAAE,UAAU;YACd,GAAG,EAAE,IAAI,qBAAqB,CAAC;gBAC7B,UAAU;gBACV,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C,CAAC;YACF,IAAI,EAAE,IAAI,cAAc,CAAC;gBACvB,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,UAAU,CAAC,IAAI;aACvB,CAAC;YACF,QAAQ,EAAE,IAAI,0BAA0B,CAAC;gBACvC,KAAK,EAAE,UAAU,CAAC,QAAQ;gBAC1B,SAAS,EAAE,gBAAgB;aAC5B,CAAC;YACF,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-factory.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,wBAAwB,GAEzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AA2B7C;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,kBAAkB,CAA2B;IAC7C,KAAK,CAA0B;IAC/B,KAAK,CAAW;IAEjC,YAAY,UAA+C;QACzD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAA4C;QAC/C,MAAM,UAAU,GACd,UAAU,CAAC,EAAE;YACb,wBAAwB,CACtB,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAC;QAEJ,OAAO,IAAI,kBAAkB,CAAC;YAC5B,EAAE,EAAE,UAAU;YACd,GAAG,EAAE,IAAI,qBAAqB,CAAC;gBAC7B,UAAU;gBACV,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C,CAAC;YACF,IAAI,EAAE,IAAI,cAAc,CAAC;gBACvB,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,UAAU,CAAC,IAAI;aACvB,CAAC;YACF,QAAQ,EAAE,IAAI,0BAA0B,CAAC;gBACvC,KAAK,EAAE,UAAU,CAAC,QAAQ;gBAC1B,SAAS,EAAE,gBAAgB;aAC5B,CAAC;YACF,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.d.ts

@@ -17,6 +17,15 @@ export declare function makeSimCognitoUserPoolId(regionName: AwsRegionName, exis
  * as a missing pool.
  */
 export declare function requireSimCognitoUserPoolId(value: string | undefined): SimCognitoUserPoolId;
+/**
+ * Read a requested user pool id that has to belong to one Region.
+ *
+ * A pool id carries the Region its pool lives in, and a pool's ARN carries the
+ * Region of the simulated Cognito holding it. Registering a pool under an id
+ * from another Region would name two Regions in one pool, which no real pool
+ * does.
+ */
+export declare function requireSimCognitoUserPoolIdInRegion(value: string | undefined, regionName: string): SimCognitoUserPoolId;
 /**
  * The Region a pool lives in, which its id names.
  *

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-id.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAczE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,aAAa,EACzB,QAAQ,cAAoB,GAC3B,oBAAoB,CAatB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAetB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAItE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzE"}
+{"version":3,"file":"sim-cognito-user-pool-id.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAczE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,aAAa,EACzB,QAAQ,cAAoB,GAC3B,oBAAoB,CAatB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAetB;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,UAAU,EAAE,MAAM,GACjB,oBAAoB,CAatB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAItE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzE"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.js

@@ -45,6 +45,24 @@ export function requireSimCognitoUserPoolId(value) {
     }
     return value;
 }
+/**
+ * Read a requested user pool id that has to belong to one Region.
+ *
+ * A pool id carries the Region its pool lives in, and a pool's ARN carries the
+ * Region of the simulated Cognito holding it. Registering a pool under an id
+ * from another Region would name two Regions in one pool, which no real pool
+ * does.
+ */
+export function requireSimCognitoUserPoolIdInRegion(value, regionName) {
+    const userPoolId = requireSimCognitoUserPoolId(value);
+    const idRegionName = simCognitoUserPoolRegionName(userPoolId);
+    if (idRegionName !== regionName) {
+        throw new SimCognitoInvalidParameterException(`UserPoolId '${userPoolId}' names Region ${idRegionName}, and this ` +
+            `simulated Cognito is ${regionName}. Register the pool on the ` +
+            `simulated Cognito of Region ${idRegionName}.`);
+    }
+    return userPoolId;
+}
 /**
  * The Region a pool lives in, which its id names.
  *

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-id.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAGxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAIpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAyB,EACzB,QAAQ,GAAG,IAAI,GAAG,EAAU;IAE5B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5D,MAAM,EAAE,sBAAsB;SAC/B,CAAC,EAA0B,CAAC;QAE7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,mCAAmC,CAC3C,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,mCAAmC,CAC3C,eAAe,KAAK,wCAAwC;YAC1D,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,KAA6B,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC7D,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE9C,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,UAAU,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAE5D,OAAO,uBAAuB,UAAU,kBAAkB,UAAU,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC"}
+{"version":3,"file":"sim-cognito-user-pool-id.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAGxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAIpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAyB,EACzB,QAAQ,GAAG,IAAI,GAAG,EAAU;IAE5B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5D,MAAM,EAAE,sBAAsB;SAC/B,CAAC,EAA0B,CAAC;QAE7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,mCAAmC,CAC3C,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,mCAAmC,CAC3C,eAAe,KAAK,wCAAwC;YAC1D,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,KAA6B,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAAyB,EACzB,UAAkB;IAElB,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAE9D,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,mCAAmC,CAC3C,eAAe,UAAU,kBAAkB,YAAY,aAAa;YAClE,wBAAwB,UAAU,6BAA6B;YAC/D,+BAA+B,YAAY,GAAG,CACjD,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC7D,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE9C,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,UAAU,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAE5D,OAAO,uBAAuB,UAAU,kBAAkB,UAAU,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts

@@ -82,6 +82,14 @@ export declare class SimCognitoUserPoolStore {
      * from.
      */
     requireClient(clientId: SimCognitoUserPoolClientId): SimCognitoClientInPool;
+    /**
+     * Find an app client by id alone, and the pool holding it.
+     *
+     * This is the same search `requireClient` makes, for a caller that has
+     * something to do with the absence. Registering a client under a chosen id
+     * uses it to keep one client id out of two pools.
+     */
+    findClient(clientId: SimCognitoUserPoolClientId): SimCognitoClientInPool | undefined;
     /**
      * Resolve the access token a request is authorized with, and the pool that
      * signed it, or refuse.

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAE/C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAE,iCAAsC,EAG7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CASrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAE/C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAE,iCAAsC,EAG7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CASrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAU1E;IAED;;;;;;OAMG;IACH,UAAU,CACR,QAAQ,EAAE,0BAA0B,GACnC,sBAAsB,GAAG,SAAS,CAUpC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js

@@ -86,13 +86,27 @@ export class SimCognitoUserPoolStore {
      * from.
      */
     requireClient(clientId) {
+        const found = this.findClient(clientId);
+        if (found === undefined) {
+            throw new SimCognitoResourceNotFoundException(`App client ${clientId} does not exist.`);
+        }
+        return found;
+    }
+    /**
+     * Find an app client by id alone, and the pool holding it.
+     *
+     * This is the same search `requireClient` makes, for a caller that has
+     * something to do with the absence. Registering a client under a chosen id
+     * uses it to keep one client id out of two pools.
+     */
+    findClient(clientId) {
         for (const pool of this.all) {
             const client = pool.findClient(clientId);
             if (client !== undefined) {
                 return { pool, client };
             }
         }
-        throw new SimCognitoResourceNotFoundException(`App client ${clientId} does not exist.`);
+        return undefined;
     }
     /**
      * Resolve the access token a request is authorized with, and the pool that

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAiC3F;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,CAA6B;IACrC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAsC,EAAE;QAC5D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,0BAA0B,EAAE,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACtE,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,MAA6B,EAC7B,GAAS;QAET,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,2BAA2B,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAE7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAoC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,cAAc,QAAQ,kBAAkB,CACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa,EAAE,GAAS;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,gCAAgC,CACxC,gCAAgC,CACjC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAiC3F;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,CAA6B;IACrC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAsC,EAAE;QAC5D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,0BAA0B,EAAE,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACtE,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,MAA6B,EAC7B,GAAS;QAET,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,2BAA2B,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAE7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAoC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,cAAc,QAAQ,kBAAkB,CACzC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CACR,QAAoC;QAEpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa,EAAE,GAAS;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,gCAAgC,CACxC,gCAAgC,CACjC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.d.ts

@@ -0,0 +1,40 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIam } from "../../sim-iam.js";
+import type { SimIamRoleName } from "../../role/sim-iam-role.js";
+interface SimCfnIamManagedPolicyAttacherProperties {
+    readonly iam: SimIam;
+}
+/**
+ * Attaches a CloudFormation-created Managed Policy to the principals its
+ * Resource names.
+ *
+ * `Roles` names the Roles the policy is attached to as it is created, which is
+ * the attachment AttachRolePolicy records. `Users` and `Groups` name
+ * principals with nowhere to hold a managed policy attachment here, and both
+ * fail the Resource. Dropping the grant a template asked for without saying so
+ * would be misleading.
+ */
+export declare class SimCfnIamManagedPolicyAttacher {
+    private readonly iam;
+    constructor(properties: SimCfnIamManagedPolicyAttacherProperties);
+    /**
+     * The Roles an AWS::IAM::ManagedPolicy Resource attaches itself to. Role
+     * Refs are resolved to Role names before creation, so entries arrive as
+     * plain strings.
+     *
+     * A name no simulated Role answers to fails the Resource before the policy
+     * is created. Checking afterwards would leave a policy behind with nothing
+     * attached to it.
+     */
+    roleNames(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): readonly SimIamRoleName[];
+    /**
+     * Attach the created Managed Policy to each of the Roles.
+     */
+    attach(policyArn: SimArn, roleNames: readonly SimIamRoleName[]): Promise<void>;
+    private roleName;
+    private rejectUnsimulatedPrincipals;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-managed-policy-attacher.d.ts.map

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-managed-policy-attacher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;;;;;;OAQG;IACH,SAAS,CACP,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,SAAS,cAAc,EAAE,CAgB3B;IAED;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAQf;IAED,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,2BAA2B;CAcpC"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.js

@@ -0,0 +1,65 @@
+import { SimIamNoSuchEntity } from "../../error/sim-iam.error.js";
+/**
+ * Attaches a CloudFormation-created Managed Policy to the principals its
+ * Resource names.
+ *
+ * `Roles` names the Roles the policy is attached to as it is created, which is
+ * the attachment AttachRolePolicy records. `Users` and `Groups` name
+ * principals with nowhere to hold a managed policy attachment here, and both
+ * fail the Resource. Dropping the grant a template asked for without saying so
+ * would be misleading.
+ */
+export class SimCfnIamManagedPolicyAttacher {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * The Roles an AWS::IAM::ManagedPolicy Resource attaches itself to. Role
+     * Refs are resolved to Role names before creation, so entries arrive as
+     * plain strings.
+     *
+     * A name no simulated Role answers to fails the Resource before the policy
+     * is created. Checking afterwards would leave a policy behind with nothing
+     * attached to it.
+     */
+    roleNames(resource, properties) {
+        this.rejectUnsimulatedPrincipals(resource, properties);
+        const roles = properties["Roles"];
+        if (roles === undefined) {
+            return [];
+        }
+        if (!Array.isArray(roles)) {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: Roles must be an array`);
+        }
+        return roles.map((roleName) => this.roleName(resource, roleName));
+    }
+    /**
+     * Attach the created Managed Policy to each of the Roles.
+     */
+    async attach(policyArn, roleNames) {
+        await Promise.all(roleNames.map(async (roleName) => this.iam.attachRolePolicy({
+            input: { RoleName: roleName, PolicyArn: policyArn },
+        })));
+    }
+    roleName(resource, roleName) {
+        if (typeof roleName !== "string") {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: Roles entries must be strings`);
+        }
+        const simRoleName = roleName;
+        if (!this.iam.roles.has(simRoleName)) {
+            throw new SimIamNoSuchEntity(`No IAM Role with name ${roleName}`);
+        }
+        return simRoleName;
+    }
+    rejectUnsimulatedPrincipals(resource, properties) {
+        for (const principalProperty of ["Users", "Groups"]) {
+            // oxlint-disable-next-line security/detect-object-injection -- fixed property names.
+            if (properties[principalProperty] !== undefined) {
+                throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: ` +
+                    `${principalProperty} are not simulated`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-managed-policy-attacher.js.map

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-managed-policy-attacher.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAMlE;;;;;;;;;GASG;AACH,MAAM,OAAO,8BAA8B;IACxB,GAAG,CAAS;IAE7B,YAAY,UAAoD;QAC9D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CACP,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,0BAA0B,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,SAAiB,EACjB,SAAoC;QAEpC,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE;SACpD,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,QAAwB,EACxB,QAAiB;QAEjB,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,iCAAiC,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,QAA0B,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,2BAA2B,CACjC,QAAwB,EACxB,UAAqC;QAErC,KAAK,MAAM,iBAAiB,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,qFAAqF;YACrF,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,IAAI;oBACvD,GAAG,iBAAiB,oBAAoB,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts

@@ -10,6 +10,7 @@ interface SimCfnIamManagedPolicyCreatorProperties {
  */
 export declare class SimCfnIamManagedPolicyCreator {
     private readonly iam;
+    private readonly attacher;
     constructor(properties: SimCfnIamManagedPolicyCreatorProperties);
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-managed-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,uCAAuC,EAE9D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,cAAc;CAmBvB"}
+{"version":3,"file":"sim-cfn-iam-managed-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAI1E,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAE1D,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js

@@ -1,16 +1,20 @@
+import { SimCfnIamManagedPolicyAttacher } from "./sim-cfn-iam-managed-policy-attacher.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 /**
  * Creates simulated IAM Managed Policies from CloudFormation Resources.
  */
 export class SimCfnIamManagedPolicyCreator {
     iam;
+    attacher;
     constructor(properties) {
         this.iam = properties.iam;
+        this.attacher = new SimCfnIamManagedPolicyAttacher({ iam: properties.iam });
     }
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
      */
     async create(resource, properties) {
+        const roleNames = this.attacher.roleNames(resource, properties);
         const policyName = this.managedPolicyName(resource, properties);
         const path = this.path(resource, properties);
         const description = this.description(resource, properties);
@@ -25,6 +29,7 @@ export class SimCfnIamManagedPolicyCreator {
         });
         const policy = this.iam.policies.get(policyCreation.Policy.Arn);
         assertDefined(policy, `Sim IAM Managed Policy ${policyCreation.Policy.Arn} after CloudFormation creation`);
+        await this.attacher.attach(policy.arn, roleNames);
         return policy;
     }
     managedPolicyName(resource, properties) {

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-managed-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAAS;IAE7B,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,aAAa,CACX,MAAM,EACN,0BAA0B,cAAc,CAAC,MAAM,CAAC,GAAG,gCAAgC,CACpF,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CACvB,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,sCAAsC,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,IAAI,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,yBAAyB,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,QAAwB,EACxB,UAAqC;QAErC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAE9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,gCAAgC,CACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,oCAAoC,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-managed-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAAS;IACZ,QAAQ,CAAiC;IAE1D,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,8BAA8B,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,aAAa,CACX,MAAM,EACN,0BAA0B,cAAc,CAAC,MAAM,CAAC,GAAG,gCAAgC,CACpF,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAElD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CACvB,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,sCAAsC,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,IAAI,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,yBAAyB,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,QAAwB,EACxB,UAAqC;QAErC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAE9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,gCAAgC,CACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,oCAAoC,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts

@@ -5,35 +5,26 @@ interface SimCfnIamPolicyCreatorProperties {
     readonly iam: SimIam;
 }
 /**
- * Creates simulated IAM inline role policies from AWS::IAM::Policy
- * CloudFormation Resources.
+ * Creates simulated IAM inline policies from AWS::IAM::Policy CloudFormation
+ * Resources.
  *
  * AWS::IAM::Policy is an inline policy put onto the referenced principals,
- * which is how CDK grants such as bucket.grantRead(fn) attach permissions to
- * a function's execution role (the "DefaultPolicy" resource). Only Roles are
- * simulated; the policy has no standalone stored resource, so creation
- * returns undefined and Ref resolution uses the default adapter.
+ * which is how CDK grants such as bucket.grantRead(fn) attach permissions to a
+ * function's execution role, and bucket.grantRead(user) to a user (the
+ * "DefaultPolicy" resource). Roles and Users are simulated. The policy has no
+ * standalone stored resource, so creation returns undefined and Ref resolution
+ * uses the default adapter.
  */
 export declare class SimCfnIamPolicyCreator {
     private readonly iam;
+    private readonly propsParser;
     constructor(properties: SimCfnIamPolicyCreatorProperties);
     /**
-     * Put the inline policy onto each referenced Role.
+     * Put the inline policy onto each referenced Role and User.
      */
     create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<undefined>;
-    private policyName;
-    private policyDocument;
-    /**
-     * The Role names the policy attaches to. Role Refs are resolved to Role
-     * names before creation, so entries arrive as plain strings.
-     */
-    private roleNames;
-    /**
-     * IAM Users and Groups are not simulated as CloudFormation policy
-     * principals, and silently dropping a grant would be misleading, so their
-     * presence fails creation.
-     */
-    private rejectUnsimulatedPrincipals;
+    private putRolePolicies;
+    private putUserPolicies;
 }
 export {};
 //# sourceMappingURL=sim-cfn-iam-policy-creator.d.ts.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,SAAS,CAAC,CAoBpB;IAED,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,cAAc;IAoBtB;;;OAGG;IACH,OAAO,CAAC,SAAS;IAsBjB;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;CAcpC"}
+{"version":3,"file":"sim-cfn-iam-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;IAErE,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,SAAS,CAAC,CASpB;YAEa,eAAe;YAgBf,eAAe;CAe9B"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js

@@ -1,81 +1,49 @@
+import { SimCfnIamPolicyPropertiesParser, } from "./sim-cfn-iam-policy-properties-parser.js";
 /**
- * Creates simulated IAM inline role policies from AWS::IAM::Policy
- * CloudFormation Resources.
+ * Creates simulated IAM inline policies from AWS::IAM::Policy CloudFormation
+ * Resources.
  *
  * AWS::IAM::Policy is an inline policy put onto the referenced principals,
- * which is how CDK grants such as bucket.grantRead(fn) attach permissions to
- * a function's execution role (the "DefaultPolicy" resource). Only Roles are
- * simulated; the policy has no standalone stored resource, so creation
- * returns undefined and Ref resolution uses the default adapter.
+ * which is how CDK grants such as bucket.grantRead(fn) attach permissions to a
+ * function's execution role, and bucket.grantRead(user) to a user (the
+ * "DefaultPolicy" resource). Roles and Users are simulated. The policy has no
+ * standalone stored resource, so creation returns undefined and Ref resolution
+ * uses the default adapter.
  */
 export class SimCfnIamPolicyCreator {
     iam;
+    propsParser = new SimCfnIamPolicyPropertiesParser();
     constructor(properties) {
         this.iam = properties.iam;
     }
     /**
-     * Put the inline policy onto each referenced Role.
+     * Put the inline policy onto each referenced Role and User.
      */
     async create(resource, properties) {
-        this.rejectUnsimulatedPrincipals(resource, properties);
-        const policyName = this.policyName(resource, properties);
-        const policyDocument = this.policyDocument(resource, properties);
-        const roleNames = this.roleNames(resource, properties);
-        await Promise.all(roleNames.map(async (roleName) => this.iam.putRolePolicy({
+        const policyProperties = this.propsParser.parse(resource, properties);
+        await Promise.all([
+            this.putRolePolicies(policyProperties),
+            this.putUserPolicies(policyProperties),
+        ]);
+        return undefined;
+    }
+    async putRolePolicies(policyProperties) {
+        await Promise.all(policyProperties.roleNames.map(async (roleName) => this.iam.putRolePolicy({
             input: {
                 RoleName: roleName,
-                PolicyName: policyName,
-                PolicyDocument: policyDocument,
+                PolicyName: policyProperties.policyName,
+                PolicyDocument: policyProperties.policyDocument,
             },
         })));
-        return undefined;
-    }
-    policyName(resource, properties) {
-        const policyName = properties["PolicyName"];
-        if (typeof policyName !== "string") {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: PolicyName must be a string`);
-        }
-        return policyName;
     }
-    policyDocument(resource, properties) {
-        const policyDocument = properties["PolicyDocument"];
-        if (policyDocument === undefined ||
-            typeof policyDocument !== "object" ||
-            policyDocument === null ||
-            Array.isArray(policyDocument)) {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: PolicyDocument must be an object`);
-        }
-        return JSON.stringify(policyDocument);
-    }
-    /**
-     * The Role names the policy attaches to. Role Refs are resolved to Role
-     * names before creation, so entries arrive as plain strings.
-     */
-    roleNames(resource, properties) {
-        const roles = properties["Roles"];
-        if (!Array.isArray(roles) || roles.length === 0) {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: Roles must be a non-empty array`);
-        }
-        return roles.map((roleName) => {
-            if (typeof roleName !== "string") {
-                throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: Roles entries must be strings`);
-            }
-            return roleName;
-        });
-    }
-    /**
-     * IAM Users and Groups are not simulated as CloudFormation policy
-     * principals, and silently dropping a grant would be misleading, so their
-     * presence fails creation.
-     */
-    rejectUnsimulatedPrincipals(resource, properties) {
-        for (const principalProperty of ["Users", "Groups"]) {
-            // oxlint-disable-next-line security/detect-object-injection -- fixed property names.
-            if (properties[principalProperty] !== undefined) {
-                throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: ` +
-                    `${principalProperty} are not simulated`);
-            }
-        }
+    async putUserPolicies(policyProperties) {
+        await Promise.all(policyProperties.usernames.map(async (username) => this.iam.putUserPolicy({
+            input: {
+                UserName: username,
+                PolicyName: policyProperties.policyName,
+                PolicyDocument: policyProperties.policyDocument,
+            },
+        })));
     }
 }
 //# sourceMappingURL=sim-cfn-iam-policy-creator.js.map