@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/apigateway/sdk/sim-api-gateway-sdk-command-router.js

@@ -0,0 +1,129 @@
+import { simSdkCallerOptions, } from "../../../sdk/index.js";
+/**
+ * Routes intercepted SDK Commands to one scoped simulated API Gateway.
+ *
+ * These are the `@aws-sdk/client-api-gateway` Command names, which are the v1
+ * REST API ones. The v2 client has its own router, and no Command name is
+ * shared between the two.
+ */
+export class SimApiGatewaySdkCommandRouter {
+    routes;
+    constructor(simApiGateway) {
+        this.routes = new Map([
+            [
+                "CreateRestApiCommand",
+                async (command, context) => await simApiGateway.createRestApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ImportRestApiCommand",
+                async (command, context) => await simApiGateway.importRestApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "PutRestApiCommand",
+                async (command, context) => await simApiGateway.putRestApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetRestApiCommand",
+                async (command, context) => await simApiGateway.getRestApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetRestApisCommand",
+                async (command, context) => await simApiGateway.getRestApis(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "UpdateRestApiCommand",
+                async (command, context) => await simApiGateway.updateRestApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteRestApiCommand",
+                async (command, context) => await simApiGateway.deleteRestApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateResourceCommand",
+                async (command, context) => await simApiGateway.createResource(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetResourceCommand",
+                async (command, context) => await simApiGateway.getResource(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetResourcesCommand",
+                async (command, context) => await simApiGateway.getResources(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteResourceCommand",
+                async (command, context) => await simApiGateway.deleteResource(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateAuthorizerCommand",
+                async (command, context) => await simApiGateway.createAuthorizer(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetAuthorizerCommand",
+                async (command, context) => await simApiGateway.getAuthorizer(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetAuthorizersCommand",
+                async (command, context) => await simApiGateway.getAuthorizers(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteAuthorizerCommand",
+                async (command, context) => await simApiGateway.deleteAuthorizer(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "PutMethodCommand",
+                async (command, context) => await simApiGateway.putMethod(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetMethodCommand",
+                async (command, context) => await simApiGateway.getMethod(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteMethodCommand",
+                async (command, context) => await simApiGateway.deleteMethod(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "PutIntegrationCommand",
+                async (command, context) => await simApiGateway.putIntegration(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetIntegrationCommand",
+                async (command, context) => await simApiGateway.getIntegration(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateDeploymentCommand",
+                async (command, context) => await simApiGateway.createDeployment(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateStageCommand",
+                async (command, context) => await simApiGateway.createStage(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetStageCommand",
+                async (command, context) => await simApiGateway.getStage(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetStagesCommand",
+                async (command, context) => await simApiGateway.getStages(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteStageCommand",
+                async (command, context) => await simApiGateway.deleteStage(command, simSdkCallerOptions(context)),
+            ],
+        ]);
+    }
+    /**
+     * The SDK Command names simulated API Gateway can handle.
+     */
+    supportedCommandNames() {
+        return this.routes.keys().toArray();
+    }
+    /**
+     * Get the route for an SDK Command name, if simulated API Gateway supports
+     * it.
+     */
+    route(commandName) {
+        return this.routes.get(commandName);
+    }
+}
+//# sourceMappingURL=sim-api-gateway-sdk-command-router.js.map

package/dist/service/apigateway/sdk/sim-api-gateway-sdk-command-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-sdk-command-router.js","sourceRoot":"","sources":["../../../../src/service/apigateway/sdk/sim-api-gateway-sdk-command-router.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AA8B/B;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACvB,MAAM,CAA0C;IAEjE,YAAY,aAA4B;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAA6B;YAChD;gBACE,sBAAsB;gBACtB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,aAAa,CAC/B,OAAkC,EAClC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,sBAAsB;gBACtB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,aAAa,CAC/B,OAAkC,EAClC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,mBAAmB;gBACnB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,UAAU,CAC5B,OAA+B,EAC/B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,mBAAmB;gBACnB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,UAAU,CAC5B,OAA+B,EAC/B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,WAAW,CAC7B,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,sBAAsB;gBACtB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,aAAa,CAC/B,OAAkC,EAClC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,sBAAsB;gBACtB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,aAAa,CAC/B,OAAkC,EAClC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,uBAAuB;gBACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,cAAc,CAChC,OAAmC,EACnC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,WAAW,CAC7B,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,qBAAqB;gBACrB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,YAAY,CAC9B,OAAiC,EACjC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,uBAAuB;gBACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,cAAc,CAChC,OAAmC,EACnC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,yBAAyB;gBACzB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,gBAAgB,CAClC,OAAqC,EACrC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,sBAAsB;gBACtB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,aAAa,CAC/B,OAAkC,EAClC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,uBAAuB;gBACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,cAAc,CAChC,OAAmC,EACnC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,yBAAyB;gBACzB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,gBAAgB,CAClC,OAAqC,EACrC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,SAAS,CAC3B,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,SAAS,CAC3B,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,qBAAqB;gBACrB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,YAAY,CAC9B,OAAiC,EACjC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,uBAAuB;gBACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,cAAc,CAChC,OAAmC,EACnC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,uBAAuB;gBACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,cAAc,CAChC,OAAmC,EACnC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,yBAAyB;gBACzB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,gBAAgB,CAClC,OAAqC,EACrC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,WAAW,CAC7B,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,iBAAiB;gBACjB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,QAAQ,CAC1B,OAA6B,EAC7B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,SAAS,CAC3B,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,aAAa,CAAC,WAAW,CAC7B,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAmB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-decisions.d.ts

@@ -0,0 +1,37 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+import type { SimRestApiCacheKey } from "../../api/authorizer/sim-rest-api-authorizer-result-cache.js";
+import type { SimRestApiLambdaAuthorizer } from "../../api/authorizer/sim-rest-api-lambda-authorizer.js";
+interface SimRestApiAuthorizerDecisionsProperties {
+    /**
+     * Clock a held decision expires against, so advancing simulated time drops
+     * one that was being reused a moment before.
+     */
+    readonly clock: SimClock;
+}
+/**
+ * Reuses a Lambda authorizer's decision for as long as its
+ * `authorizerResultTtlInSeconds` says, and makes a new one when there is none
+ * to reuse.
+ *
+ * What is held and what is not is the whole of this: a refusal is held the way
+ * an admission is, because AWS holds whatever answer the authorizer gave. An
+ * authorizer that could not answer at all is not held, since there is no
+ * answer to hold and a request a moment later may find its function working.
+ */
+export declare class SimRestApiAuthorizerDecisions {
+    private readonly clock;
+    constructor(properties: SimRestApiAuthorizerDecisionsProperties);
+    /**
+     * The decision for this identity at this method, made only if there is not
+     * one already.
+     */
+    decide(authorizer: SimRestApiLambdaAuthorizer, key: SimRestApiCacheKey, invoke: () => Promise<SimRestApiAuthorization>): Promise<SimRestApiAuthorization>;
+    /**
+     * Whether this is something the authorizer answered, rather than the
+     * authorizer failing to answer.
+     */
+    private isAnswer;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-authorizer-decisions.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-decisions.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8DAA8D,CAAC;AACvG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAEzG,UAAU,uCAAuC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,uCAAuC,EAE9D;IAED;;;OAGG;IACG,MAAM,CACV,UAAU,EAAE,0BAA0B,EACtC,GAAG,EAAE,kBAAkB,EACvB,MAAM,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,GAC7C,OAAO,CAAC,uBAAuB,CAAC,CAclC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-decisions.js

@@ -0,0 +1,39 @@
+/**
+ * Reuses a Lambda authorizer's decision for as long as its
+ * `authorizerResultTtlInSeconds` says, and makes a new one when there is none
+ * to reuse.
+ *
+ * What is held and what is not is the whole of this: a refusal is held the way
+ * an admission is, because AWS holds whatever answer the authorizer gave. An
+ * authorizer that could not answer at all is not held, since there is no
+ * answer to hold and a request a moment later may find its function working.
+ */
+export class SimRestApiAuthorizerDecisions {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * The decision for this identity at this method, made only if there is not
+     * one already.
+     */
+    async decide(authorizer, key, invoke) {
+        const cached = authorizer.results.find(key, this.clock.now());
+        if (cached !== undefined) {
+            return cached;
+        }
+        const authorization = await invoke();
+        if (this.isAnswer(authorization)) {
+            authorizer.results.store(key, this.clock.now(), authorization);
+        }
+        return authorization;
+    }
+    /**
+     * Whether this is something the authorizer answered, rather than the
+     * authorizer failing to answer.
+     */
+    isAnswer(authorization) {
+        return authorization.admitted || authorization.kind !== "error";
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-decisions.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-decisions.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-decisions.ts"],"names":[],"mappings":"AAaA;;;;;;;;;GASG;AACH,MAAM,OAAO,6BAA6B;IACvB,KAAK,CAAW;IAEjC,YAAY,UAAmD;QAC7D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,UAAsC,EACtC,GAAuB,EACvB,MAA8C;QAE9C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAE9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,MAAM,EAAE,CAAC;QAErC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,aAAsC;QACrD,OAAO,aAAa,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,CAAC;IAClE,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-event.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The event a `TOKEN` authorizer's function is invoked with.
+ *
+ * A `TOKEN` authorizer sees three things and no more: that it is a `TOKEN`
+ * authorizer, the value the request carried at its identity source, and the
+ * ARN of the method being called. It never sees the rest of the request, which
+ * is the whole difference between this and a `REQUEST` authorizer.
+ */
+export interface SimRestApiTokenAuthorizerEvent {
+    type: "TOKEN";
+    /** The value the request carried at the authorizer's identity source. */
+    authorizationToken: string;
+    /**
+     * The `execute-api` ARN of the request being authorized. The policy the
+     * function answers with is evaluated against this same ARN.
+     */
+    methodArn: string;
+}
+/**
+ * Build the event a `TOKEN` authorizer is invoked with.
+ */
+export declare function simRestApiTokenAuthorizerEvent(authorizationToken: string, methodArn: string): SimRestApiTokenAuthorizerEvent;
+//# sourceMappingURL=sim-rest-api-authorizer-event.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-event.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-event.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,MAAM,GAChB,8BAA8B,CAEhC"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-event.js

@@ -0,0 +1,7 @@
+/**
+ * Build the event a `TOKEN` authorizer is invoked with.
+ */
+export function simRestApiTokenAuthorizerEvent(authorizationToken, methodArn) {
+    return { type: "TOKEN", authorizationToken, methodArn };
+}
+//# sourceMappingURL=sim-rest-api-authorizer-event.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-event.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-event.ts"],"names":[],"mappings":"AAmBA;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,kBAA0B,EAC1B,SAAiB;IAEjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC;AAC1D,CAAC"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-invocation.d.ts

@@ -0,0 +1,44 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+import type { SimRestApiLambdaAuthorizer } from "../../api/authorizer/sim-rest-api-lambda-authorizer.js";
+import type { SimRestApiLambdaUri } from "../../api/method/sim-rest-api-lambda-uri.js";
+import type { SimRestApiFunctionTarget } from "../sim-rest-api-function-target.js";
+import type { SimRestApiMethodAuthorizeInput } from "./sim-rest-api-method-authorize-input.js";
+/**
+ * Finds the function an authorizer names, which the serving router does.
+ */
+export interface SimRestApiAuthorizerFunctions {
+    functionFor(lambdaUri: SimRestApiLambdaUri): SimRestApiFunctionTarget | undefined;
+}
+interface SimRestApiAuthorizerInvocationProperties {
+    readonly functions: SimRestApiAuthorizerFunctions;
+    /** Clock the authorizer's invocation event is stamped with. */
+    readonly clock: SimClock;
+}
+/**
+ * Invokes a Lambda authorizer's function and reads what it answered.
+ *
+ * The API's permission to invoke that function is asked first, under an ARN
+ * naming the authorizer rather than any method. A function that is not there,
+ * one the API may not invoke, and one that failed are the same 500, as they
+ * are on real AWS. None of them is anything the caller could act on.
+ *
+ * What the function is shown is the whole difference between the two kinds. A
+ * `TOKEN` authorizer sees the one value the request carried at its identity
+ * source, and a `REQUEST` authorizer sees the request.
+ */
+export declare class SimRestApiAuthorizerInvocation {
+    private readonly functions;
+    private readonly requestEvent;
+    constructor(properties: SimRestApiAuthorizerInvocationProperties);
+    /**
+     * Ask the authorizer's function about one request.
+     */
+    invoke(input: SimRestApiMethodAuthorizeInput, authorizer: SimRestApiLambdaAuthorizer, identityValues: readonly string[], methodArn: string): Promise<SimRestApiAuthorization>;
+    /**
+     * The event this authorizer is invoked with.
+     */
+    private event;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-authorizer-invocation.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-invocation.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAEvF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAInF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAG/F;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CAAC;CACzC;AAED,UAAU,wCAAwC;IAChD,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,YAAY,UAAU,EAAE,wCAAwC,EAK/D;IAED;;OAEG;IACG,MAAM,CACV,KAAK,EAAE,8BAA8B,EACrC,UAAU,EAAE,0BAA0B,EACtC,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,uBAAuB,CAAC,CAqBlC;IAED;;OAEG;YACW,KAAK;CAoBpB"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-invocation.js

@@ -0,0 +1,63 @@
+import { SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { simRestApiEndpoint } from "../sim-rest-api-endpoint.js";
+import { simRestApiTokenAuthorizerEvent } from "./sim-rest-api-authorizer-event.js";
+import { SimRestApiAuthorizerResponse } from "./sim-rest-api-authorizer-response.js";
+import { simRestApiMayNotInvokeAuthorizer } from "./sim-rest-api-invoke-authorizer.js";
+import { SimRestApiRequestAuthorizerEventBuilder } from "./sim-rest-api-request-authorizer-event.js";
+/**
+ * Invokes a Lambda authorizer's function and reads what it answered.
+ *
+ * The API's permission to invoke that function is asked first, under an ARN
+ * naming the authorizer rather than any method. A function that is not there,
+ * one the API may not invoke, and one that failed are the same 500, as they
+ * are on real AWS. None of them is anything the caller could act on.
+ *
+ * What the function is shown is the whole difference between the two kinds. A
+ * `TOKEN` authorizer sees the one value the request carried at its identity
+ * source, and a `REQUEST` authorizer sees the request.
+ */
+export class SimRestApiAuthorizerInvocation {
+    functions;
+    requestEvent;
+    constructor(properties) {
+        this.functions = properties.functions;
+        this.requestEvent = new SimRestApiRequestAuthorizerEventBuilder({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Ask the authorizer's function about one request.
+     */
+    async invoke(input, authorizer, identityValues, methodArn) {
+        const target = this.functions.functionFor(authorizer.lambdaUri);
+        if (target === undefined ||
+            simRestApiMayNotInvokeAuthorizer(input.restApi, authorizer, target)) {
+            return SimRestApiRefused.error();
+        }
+        try {
+            const result = await target.simFunction.invoke(await this.event(input, authorizer, identityValues, methodArn));
+            return new SimRestApiAuthorizerResponse(methodArn).read(result);
+        }
+        catch {
+            // An authorizer that failed tells the caller nothing, the way an
+            // integration that failed does not.
+            return SimRestApiRefused.error();
+        }
+    }
+    /**
+     * The event this authorizer is invoked with.
+     */
+    async event(input, authorizer, identityValues, methodArn) {
+        if (authorizer.type === "TOKEN") {
+            return simRestApiTokenAuthorizerEvent(
+            /* v8 ignore next -- a TOKEN authorizer has exactly one identity source */
+            identityValues.at(0) ?? "", methodArn);
+        }
+        return await this.requestEvent.build({
+            request: input.request,
+            endpoint: simRestApiEndpoint(input.restApi, input.match),
+            methodArn,
+        });
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-invocation.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-invocation.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-invocation.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAG5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,EAAE,uCAAuC,EAAE,MAAM,4CAA4C,CAAC;AAiBrG;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,8BAA8B;IACxB,SAAS,CAAgC;IACzC,YAAY,CAA0C;IAEvE,YAAY,UAAoD;QAC9D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,uCAAuC,CAAC;YAC9D,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,KAAqC,EACrC,UAAsC,EACtC,cAAiC,EACjC,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEhE,IACE,MAAM,KAAK,SAAS;YACpB,gCAAgC,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EACnE,CAAC;YACD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,CAC/D,CAAC;YAEF,OAAO,IAAI,4BAA4B,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,oCAAoC;YACpC,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CACjB,KAAqC,EACrC,UAAsC,EACtC,cAAiC,EACjC,SAAiB;QAEjB,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,8BAA8B;YACnC,0EAA0E;YAC1E,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAC1B,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;YACxD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.d.ts

@@ -0,0 +1,38 @@
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+/**
+ * The IAM action a request to a method is authorized against.
+ *
+ * It is the only `execute-api` action evaluated here. The others AWS defines
+ * are WebSocket management and REST API cache invalidation, and nothing
+ * constrains the action string a policy may name, so a policy is free to grant
+ * one of them and nothing will ask about it.
+ */
+export declare const simExecuteApiInvokeAction = "execute-api:Invoke";
+/**
+ * The IAM policy document a Lambda authorizer answers with, evaluated for
+ * `execute-api:Invoke` on the method ARN the request was authorized under.
+ *
+ * The document the authorizer returned is the whole decision. There are no
+ * stored policies to gather, because there is no IAM principal here at all.
+ * The `principalId` returned alongside is a name the authorizer chose for the
+ * caller, so it identifies the caller in the authorizer's own logs and grants
+ * nothing.
+ *
+ * An explicit Deny wins over an Allow, and a document allowing nothing
+ * relevant refuses the request. Real API Gateway answers the two with
+ * different bodies, so they are told apart here.
+ */
+export declare class SimRestApiAuthorizerPolicy {
+    private readonly document;
+    constructor(document: SimIamPolicyDocument);
+    /**
+     * What this document says about a request to one method, answering
+     * `undefined` where it allows the request through.
+     *
+     * Throws the way IAM does for a document it cannot read, which the caller
+     * answers with the same 500 any other unusable authorizer response gets.
+     */
+    refusal(methodArn: string): SimRestApiAuthorization | undefined;
+}
+//# sourceMappingURL=sim-rest-api-authorizer-policy.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAEhD,YAAY,QAAQ,EAAE,oBAAoB,EAEzC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CA+B9D;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.js

@@ -0,0 +1,70 @@
+import { SimIamEitherSideAllowRequirement } from "../../../iam/authorize/allow/sim-iam-allow-requirement.js";
+import { SimIamPolicyDecision } from "../../../iam/authorize/sim-iam-decision.js";
+import { SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+/**
+ * The IAM action a request to a method is authorized against.
+ *
+ * It is the only `execute-api` action evaluated here. The others AWS defines
+ * are WebSocket management and REST API cache invalidation, and nothing
+ * constrains the action string a policy may name, so a policy is free to grant
+ * one of them and nothing will ask about it.
+ */
+export const simExecuteApiInvokeAction = "execute-api:Invoke";
+/**
+ * The IAM policy document a Lambda authorizer answers with, evaluated for
+ * `execute-api:Invoke` on the method ARN the request was authorized under.
+ *
+ * The document the authorizer returned is the whole decision. There are no
+ * stored policies to gather, because there is no IAM principal here at all.
+ * The `principalId` returned alongside is a name the authorizer chose for the
+ * caller, so it identifies the caller in the authorizer's own logs and grants
+ * nothing.
+ *
+ * An explicit Deny wins over an Allow, and a document allowing nothing
+ * relevant refuses the request. Real API Gateway answers the two with
+ * different bodies, so they are told apart here.
+ */
+export class SimRestApiAuthorizerPolicy {
+    document;
+    constructor(document) {
+        this.document = document;
+    }
+    /**
+     * What this document says about a request to one method, answering
+     * `undefined` where it allows the request through.
+     *
+     * Throws the way IAM does for a document it cannot read, which the caller
+     * answers with the same 500 any other unusable authorizer response gets.
+     */
+    refusal(methodArn) {
+        const decision = new SimIamPolicyDecision({
+            // The document is evaluated as the identity side, which is the side with
+            // no Principal to state. An authorizer's policy says what the caller it
+            // just identified may do rather than who may reach the method.
+            identityPolicies: [
+                {
+                    sourceType: "identity-inline",
+                    document: this.document,
+                    policyName: "AuthorizerPolicyDocument",
+                },
+            ],
+            resourcePolicies: [],
+            allowRequirement: new SimIamEitherSideAllowRequirement(),
+            action: simExecuteApiInvokeAction,
+            resource: methodArn,
+            conditionContext: {},
+            // There is no principal behind this document, and nothing in it can name
+            // one, so the caller is anonymous. A condition on a principal key
+            // therefore never matches, which is the strict direction to be wrong in.
+            caller: {
+                principal: { kind: "anonymous" },
+                identityPolicyPrincipal: { kind: "anonymous" },
+            },
+        });
+        if (decision.isExplicitDeny) {
+            return SimRestApiRefused.explicitDeny();
+        }
+        return decision.isAllowed ? undefined : SimRestApiRefused.implicitDeny();
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-policy.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-policy.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,0BAA0B;IACpB,QAAQ,CAAuB;IAEhD,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAiB;QACvB,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACxC,yEAAyE;YACzE,wEAAwE;YACxE,+DAA+D;YAC/D,gBAAgB,EAAE;gBAChB;oBACE,UAAU,EAAE,iBAAiB;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,0BAA0B;iBACvC;aACF;YACD,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,IAAI,gCAAgC,EAAE;YACxD,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,SAAS;YACnB,gBAAgB,EAAE,EAAE;YACpB,yEAAyE;YACzE,kEAAkE;YAClE,yEAAyE;YACzE,MAAM,EAAE;gBACN,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAChC,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-response.d.ts

@@ -0,0 +1,41 @@
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+/**
+ * Reads what a REST API Lambda authorizer answered.
+ *
+ * There is one shape: a `principalId` naming the caller and an IAM
+ * `policyDocument` that has to allow `execute-api:Invoke` on the method ARN. A
+ * REST API authorizer always answers a policy, where an HTTP API authorizer
+ * may answer a boolean. A response of any other shape is a 500 rather than a
+ * refusal, because API Gateway could not read it either.
+ *
+ * `{ "errorMessage": "Unauthorized" }` is the one answer that produces a 401.
+ * A function that throws is an invocation failure here rather than that value.
+ * Real Lambda turns a thrown error into a payload carrying this member, while
+ * simulated Lambda rejects with the error itself, so returning the value is
+ * the way to ask for a 401.
+ */
+export declare class SimRestApiAuthorizerResponse {
+    private readonly methodArn;
+    constructor(methodArn: string);
+    /**
+     * What the endpoint should do with the request, given what the authorizer
+     * answered.
+     */
+    read(result: unknown): SimRestApiAuthorization;
+    /**
+     * Put the returned document to IAM, and gather what reaches the handler
+     * where it allows the request.
+     */
+    private evaluated;
+    /**
+     * The `requestContext.authorizer` block for an admitted request.
+     *
+     * A REST API flattens the authorizer's `context` alongside its
+     * `principalId`, so a handler reads `requestContext.authorizer.tenantId`
+     * where payload format 2.0 would put the context in a block of its own. A
+     * context that is not an object is left out, since a handler reading a
+     * member off it would find something else here.
+     */
+    private authorizerContext;
+}
+//# sourceMappingURL=sim-rest-api-authorizer-response.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-response.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAQ5D;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,SAAS,EAAE,MAAM,EAE5B;IAED;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,uBAAuB,CAmB7C;IAED;;;OAGG;IACH,OAAO,CAAC,SAAS;IAiBjB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-response.js

@@ -0,0 +1,75 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimRestApiAdmitted, SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { SimRestApiAuthorizerPolicy } from "./sim-rest-api-authorizer-policy.js";
+/**
+ * The one message a Lambda authorizer answers a 401 with.
+ */
+const unauthorizedErrorMessage = "Unauthorized";
+/**
+ * Reads what a REST API Lambda authorizer answered.
+ *
+ * There is one shape: a `principalId` naming the caller and an IAM
+ * `policyDocument` that has to allow `execute-api:Invoke` on the method ARN. A
+ * REST API authorizer always answers a policy, where an HTTP API authorizer
+ * may answer a boolean. A response of any other shape is a 500 rather than a
+ * refusal, because API Gateway could not read it either.
+ *
+ * `{ "errorMessage": "Unauthorized" }` is the one answer that produces a 401.
+ * A function that throws is an invocation failure here rather than that value.
+ * Real Lambda turns a thrown error into a payload carrying this member, while
+ * simulated Lambda rejects with the error itself, so returning the value is
+ * the way to ask for a 401.
+ */
+export class SimRestApiAuthorizerResponse {
+    methodArn;
+    constructor(methodArn) {
+        this.methodArn = methodArn;
+    }
+    /**
+     * What the endpoint should do with the request, given what the authorizer
+     * answered.
+     */
+    read(result) {
+        if (!isRecord(result)) {
+            return SimRestApiRefused.error();
+        }
+        if (result["errorMessage"] === unauthorizedErrorMessage) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const policyDocument = result["policyDocument"];
+        if (typeof result["principalId"] !== "string" ||
+            !isRecord(policyDocument)) {
+            return SimRestApiRefused.error();
+        }
+        return this.evaluated(policyDocument, result);
+    }
+    /**
+     * Put the returned document to IAM, and gather what reaches the handler
+     * where it allows the request.
+     */
+    evaluated(policyDocument, result) {
+        try {
+            return (new SimRestApiAuthorizerPolicy(policyDocument).refusal(this.methodArn) ?? new SimRestApiAdmitted({ lambda: this.authorizerContext(result) }));
+        }
+        catch {
+            // IAM refused to read the document, which is a malformed policy rather
+            // than a policy that says no.
+            return SimRestApiRefused.error();
+        }
+    }
+    /**
+     * The `requestContext.authorizer` block for an admitted request.
+     *
+     * A REST API flattens the authorizer's `context` alongside its
+     * `principalId`, so a handler reads `requestContext.authorizer.tenantId`
+     * where payload format 2.0 would put the context in a block of its own. A
+     * context that is not an object is left out, since a handler reading a
+     * member off it would find something else here.
+     */
+    authorizerContext(result) {
+        const context = result["context"];
+        const principalId = { principalId: result["principalId"] };
+        return isRecord(context) ? { ...context, ...principalId } : principalId;
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-response.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-response.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-response.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;GAEG;AACH,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACtB,SAAS,CAAS;IAEnC,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,MAAe;QAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,wBAAwB,EAAE,CAAC;YACxD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEhD,IACE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ;YACzC,CAAC,QAAQ,CAAC,cAAc,CAAC,EACzB,CAAC;YACD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,cAAoC,EACpC,MAA+B;QAE/B,IAAI,CAAC;YACH,OAAO,CACL,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC,OAAO,CACpD,IAAI,CAAC,SAAS,CACf,IAAI,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CACxE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,8BAA8B;YAC9B,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,iBAAiB,CACvB,MAA+B;QAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,aAAa,CAAW,EAAE,CAAC;QAErE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1E,CAAC;CACF"}