@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/apigateway/serve/sim-api-gateway-controller.js

@@ -0,0 +1,120 @@
+import { SimAws } from "../../aws/sim-aws.js";
+import { isSimRestApiMatch, } from "../api/match/sim-rest-api-match.js";
+import { SimRestApiRequest } from "../api/match/sim-rest-api-request.js";
+import { SimRestApiMethodAuthorizer } from "./auth/sim-rest-api-method-authorizer.js";
+import { SimApiGatewayErrorResponse } from "./sim-api-gateway-error-response.js";
+import { SimApiGatewayRouter } from "./sim-api-gateway-router.js";
+import { SimRestApiIntegrationInvocation } from "./sim-rest-api-integration-invocation.js";
+import { SimRestApiRefusalResponse } from "./sim-rest-api-refusal-response.js";
+import { SimRestApiWebAclInspection } from "./sim-rest-api-web-acl-inspection.js";
+/**
+ * Localhost HTTP controller for simulated API Gateway REST APIs.
+ *
+ * A request reaching the generated endpoint is matched to a stage, then walked
+ * down the resource tree to a method, and that method's integration invokes a
+ * simulated Lambda function with a payload format 1.0 event. The function runs
+ * as its execution Role, as it does for any other invocation.
+ *
+ * A method that authorizes anybody is checked before any of that. An `AWS_IAM`
+ * method's caller has to be allowed `execute-api:Invoke` on the method, and a
+ * `CUSTOM` method's Lambda authorizer has to allow the request, or the request
+ * is refused and the integration is never invoked. Whether the API may invoke a
+ * function is a separate question, and the API's own rather than the client's.
+ *
+ * A web ACL in front of the stage comes ahead of all of it, as it does on real
+ * API Gateway. A request the web ACL blocks is answered before the method is
+ * matched, so neither the authorizer nor the integration sees it.
+ */
+export class SimApiGatewayServiceController {
+    router;
+    methodAuthorizer;
+    integration;
+    errorResponse = new SimApiGatewayErrorResponse();
+    refusalResponse = new SimRestApiRefusalResponse();
+    webAcl = new SimRestApiWebAclInspection();
+    constructor(properties = {}) {
+        const { simAws = new SimAws() } = properties;
+        this.router = properties.router ?? new SimApiGatewayRouter({ simAws });
+        // The clock is taken from the router rather than from properties, so a
+        // supplied router and the event timestamps belong to the same simulation.
+        this.methodAuthorizer = new SimRestApiMethodAuthorizer({
+            functions: this.router,
+            clock: this.router.simAws,
+        });
+        this.integration = new SimRestApiIntegrationInvocation({
+            router: this.router,
+            clock: this.router.simAws,
+        });
+    }
+    /**
+     * Handle an HTTP request routed to a simulated REST API.
+     */
+    async handleRequest(serviceRequest) {
+        const restApi = this.router.route(serviceRequest.target);
+        if (restApi === undefined) {
+            return this.errorResponse.forbidden();
+        }
+        if (restApi.disableExecuteApiEndpoint) {
+            // The API exists and has switched its generated endpoint off, which is
+            // how an API reachable only through a custom domain is configured.
+            return this.errorResponse.forbidden();
+        }
+        return await this.invoke(restApi, serviceRequest);
+    }
+    async invoke(restApi, serviceRequest) {
+        // The whole request path, stage segment and all. The stage takes its own
+        // segment off, and the event reports the path as the client sent it.
+        const restApiRequest = new SimRestApiRequest({
+            method: serviceRequest.request.method,
+            path: new URL(serviceRequest.request.url).pathname,
+        });
+        // The stage's web ACL sees the request before anything the API does with
+        // it, which is why this comes before matching rather than after it.
+        const inspected = await this.webAcl.inspect({
+            restApi,
+            stageName: restApiRequest.segments[0] ?? "",
+            request: serviceRequest.request,
+        });
+        if (inspected.blocked !== undefined) {
+            return inspected.blocked;
+        }
+        const { request } = inspected;
+        const match = restApi.match(restApiRequest);
+        if (!isSimRestApiMatch(match)) {
+            return this.missResponse(match);
+        }
+        // The client's own authorization comes next: a request with no
+        // credentials is refused whether or not the integration behind the method
+        // would work.
+        const authorization = await this.methodAuthorizer.authorize({
+            restApi,
+            match,
+            request,
+            caller: serviceRequest.caller,
+            iam: this.router.iamFor(restApi),
+        });
+        if (!authorization.admitted) {
+            return this.refusalResponse.build(authorization);
+        }
+        return await this.integration.invoke({
+            restApi,
+            match,
+            request,
+            authorization,
+        });
+    }
+    /**
+     * What a request that reached nothing is answered with.
+     *
+     * Real API Gateway tells the two apart. A stage the API does not serve is a
+     * plain `Forbidden`, while a request that found the stage and matched no
+     * method gets `Missing Authentication Token`, whether or not it carried
+     * credentials.
+     */
+    missResponse(miss) {
+        return miss === "stage"
+            ? this.errorResponse.forbidden()
+            : this.errorResponse.missingAuthenticationToken();
+    }
+}
+//# sourceMappingURL=sim-api-gateway-controller.js.map

package/dist/service/apigateway/serve/sim-api-gateway-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-controller.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,iBAAiB,GAElB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAOlF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,8BAA8B;IACxB,MAAM,CAAsB;IAC5B,gBAAgB,CAA6B;IAC7C,WAAW,CAAkC;IAC7C,aAAa,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACjD,eAAe,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAClD,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,YAAY,UAAU,GAA6C,EAAE;QACnE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CAAC;YACrD,SAAS,EAAE,IAAI,CAAC,MAAM;YACtB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,+BAA+B,CAAC;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACtC,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,OAAmB,EACnB,cAAoC;QAEpC,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,cAAc,GAAG,IAAI,iBAAiB,CAAC;YAC3C,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM;YACrC,IAAI,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;SACnD,CAAC,CAAC;QACH,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1C,OAAO;YACP,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE;YAC3C,OAAO,EAAE,cAAc,CAAC,OAAO;SAChC,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,+DAA+D;QAC/D,0EAA0E;QAC1E,cAAc;QACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAC1D,OAAO;YACP,KAAK;YACL,OAAO;YACP,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACnC,OAAO;YACP,KAAK;YACL,OAAO;YACP,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,YAAY,CAAC,IAAoB;QACvC,OAAO,IAAI,KAAK,OAAO;YACrB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAChC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,EAAE,CAAC;IACtD,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-api-gateway-error-response.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The error responses a REST API endpoint returns itself, before or instead of
+ * an integration producing one.
+ *
+ * Real API Gateway answers these with a small JSON document whose field is
+ * `message`. The wording is what the endpoint was observed to answer, since
+ * AWS publishes neither the status nor the body for most of them.
+ */
+export declare class SimApiGatewayErrorResponse {
+    /**
+     * Nothing at this API serves the request.
+     *
+     * `Missing Authentication Token` is the message real API Gateway is well
+     * known for, and it answers a path that matched no method just as much as
+     * one that needed credentials. A client reading it here reads what it would
+     * read on AWS, misleading wording and all.
+     */
+    missingAuthenticationToken(): Response;
+    /**
+     * No such API, or a stage the API does not serve.
+     */
+    forbidden(): Response;
+    /**
+     * The request carried nothing at the authorizer's identity source, or the
+     * authorizer answered `Unauthorized`.
+     */
+    unauthorized(): Response;
+    /**
+     * A Deny statement in the authorizer's policy matched the method.
+     *
+     * The body names the deny, and its member is `Message` where every other
+     * message here is `message`. Real API Gateway is inconsistent about the two
+     * and this follows it.
+     */
+    explicitDeny(): Response;
+    /**
+     * The authorizer's policy allowed nothing covering the method.
+     */
+    implicitDeny(): Response;
+    /**
+     * The method's authorizer could not answer at all.
+     */
+    internalServerError(): Response;
+    /**
+     * The integration could not be reached, or answered something that is not a
+     * response.
+     */
+    badGateway(): Response;
+    private jsonResponse;
+    private messageResponse;
+}
+//# sourceMappingURL=sim-api-gateway-error-response.d.ts.map

package/dist/service/apigateway/serve/sim-api-gateway-error-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-error-response.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC;;;;;;;OAOG;IACH,0BAA0B,IAAI,QAAQ,CAErC;IAED;;OAEG;IACH,SAAS,IAAI,QAAQ,CAEpB;IAED;;;OAGG;IACH,YAAY,IAAI,QAAQ,CAEvB;IAED;;;;;;OAMG;IACH,YAAY,IAAI,QAAQ,CAKvB;IAED;;OAEG;IACH,YAAY,IAAI,QAAQ,CAKvB;IAED;;OAEG;IACH,mBAAmB,IAAI,QAAQ,CAE9B;IAED;;;OAGG;IACH,UAAU,IAAI,QAAQ,CAErB;IAED,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,eAAe;CAMxB"}

package/dist/service/apigateway/serve/sim-api-gateway-error-response.js

@@ -0,0 +1,70 @@
+/**
+ * The error responses a REST API endpoint returns itself, before or instead of
+ * an integration producing one.
+ *
+ * Real API Gateway answers these with a small JSON document whose field is
+ * `message`. The wording is what the endpoint was observed to answer, since
+ * AWS publishes neither the status nor the body for most of them.
+ */
+export class SimApiGatewayErrorResponse {
+    /**
+     * Nothing at this API serves the request.
+     *
+     * `Missing Authentication Token` is the message real API Gateway is well
+     * known for, and it answers a path that matched no method just as much as
+     * one that needed credentials. A client reading it here reads what it would
+     * read on AWS, misleading wording and all.
+     */
+    missingAuthenticationToken() {
+        return this.jsonResponse(403, "Missing Authentication Token");
+    }
+    /**
+     * No such API, or a stage the API does not serve.
+     */
+    forbidden() {
+        return this.jsonResponse(403, "Forbidden");
+    }
+    /**
+     * The request carried nothing at the authorizer's identity source, or the
+     * authorizer answered `Unauthorized`.
+     */
+    unauthorized() {
+        return this.jsonResponse(401, "Unauthorized");
+    }
+    /**
+     * A Deny statement in the authorizer's policy matched the method.
+     *
+     * The body names the deny, and its member is `Message` where every other
+     * message here is `message`. Real API Gateway is inconsistent about the two
+     * and this follows it.
+     */
+    explicitDeny() {
+        return this.messageResponse(403, "User is not authorized to access this resource with an explicit deny");
+    }
+    /**
+     * The authorizer's policy allowed nothing covering the method.
+     */
+    implicitDeny() {
+        return this.messageResponse(403, "User is not authorized to access this resource");
+    }
+    /**
+     * The method's authorizer could not answer at all.
+     */
+    internalServerError() {
+        return this.jsonResponse(500, "Internal server error");
+    }
+    /**
+     * The integration could not be reached, or answered something that is not a
+     * response.
+     */
+    badGateway() {
+        return this.jsonResponse(502, "Internal server error");
+    }
+    jsonResponse(status, message) {
+        return Response.json({ message }, { status, headers: { "content-type": "application/json" } });
+    }
+    messageResponse(status, message) {
+        return Response.json({ Message: message }, { status, headers: { "content-type": "application/json" } });
+    }
+}
+//# sourceMappingURL=sim-api-gateway-error-response.js.map

package/dist/service/apigateway/serve/sim-api-gateway-error-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-error-response.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;;;;;;OAOG;IACH,0BAA0B;QACxB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,eAAe,CACzB,GAAG,EACH,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,eAAe,CACzB,GAAG,EACH,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,OAAe;QAClD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,EACX,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAC5D,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,MAAc,EAAE,OAAe;QACrD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAC5D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-api-gateway-router.d.ts

@@ -0,0 +1,56 @@
+import type { SimAwsServiceTarget } from "../../../serve/controller/sim-service-controller.js";
+import { SimAws } from "../../aws/sim-aws.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimRestApiLambdaUri } from "../api/method/sim-rest-api-lambda-uri.js";
+import type { SimRestApi } from "../api/sim-rest-api.js";
+import type { SimRestApiFunctionTarget } from "./sim-rest-api-function-target.js";
+interface SimApiGatewayRouterProperties {
+    readonly simAws?: SimAws;
+}
+/**
+ * Routes a served REST API request to the API behind it, and an integration to
+ * the function behind that.
+ *
+ * The request hostname gives the API id and the Region, and not the Account.
+ * The registry supplies that missing hop. The integrated function is a second
+ * hop again, because its ARN names its own Account and Region, which need not
+ * be the API's.
+ */
+export declare class SimApiGatewayRouter {
+    /**
+     * The simulation this router routes within.
+     *
+     * Exposed so collaborators needing the same simulation, such as the clock
+     * stamping invocation events, take it from here rather than being given a
+     * second SimAws that could be a different one.
+     */
+    readonly simAws: SimAws;
+    private readonly registry;
+    constructor(properties?: SimApiGatewayRouterProperties);
+    /**
+     * Find the REST API a request target addresses.
+     */
+    route(target: SimAwsServiceTarget): SimRestApi | undefined;
+    /**
+     * The IAM that decides an `AWS_IAM` method of one API.
+     *
+     * It is the IAM of the Account that owns the API, which is where the
+     * policies allowing a caller `execute-api:Invoke` on its methods live.
+     */
+    iamFor(restApi: SimRestApi): SimIamInterServiceAuthZ;
+    /**
+     * Find the function a URI names, and the IAM deciding whether API Gateway
+     * may invoke it.
+     *
+     * The function is looked up in the Account and Region its own ARN names,
+     * rather than the API's, because an integration URI is free to name either.
+     *
+     * A version or alias qualifier on the URI is resolved here, once per
+     * request, so a method built on an alias runs whichever version the alias
+     * points at now. A qualifier naming neither answers with nothing, the way a
+     * function that was never created does.
+     */
+    functionFor(lambdaUri: SimRestApiLambdaUri): SimRestApiFunctionTarget | undefined;
+}
+export {};
+//# sourceMappingURL=sim-api-gateway-router.d.ts.map

package/dist/service/apigateway/serve/sim-api-gateway-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAG/F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,UAAU,6BAA6B;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B;;;;;;OAMG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAE,6BAAkC,EAGzD;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAWzD;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,uBAAuB,CAInD;IAED;;;;;;;;;;;OAWG;IACH,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CAUtC;CACF"}

package/dist/service/apigateway/serve/sim-api-gateway-router.js

@@ -0,0 +1,68 @@
+import { SimAws } from "../../aws/sim-aws.js";
+/**
+ * Routes a served REST API request to the API behind it, and an integration to
+ * the function behind that.
+ *
+ * The request hostname gives the API id and the Region, and not the Account.
+ * The registry supplies that missing hop. The integrated function is a second
+ * hop again, because its ARN names its own Account and Region, which need not
+ * be the API's.
+ */
+export class SimApiGatewayRouter {
+    /**
+     * The simulation this router routes within.
+     *
+     * Exposed so collaborators needing the same simulation, such as the clock
+     * stamping invocation events, take it from here rather than being given a
+     * second SimAws that could be a different one.
+     */
+    simAws;
+    registry;
+    constructor(properties = {}) {
+        this.simAws = properties.simAws ?? new SimAws();
+        this.registry = this.simAws.serviceFactory.registries.restApi;
+    }
+    /**
+     * Find the REST API a request target addresses.
+     */
+    route(target) {
+        const accountId = this.registry.accountIdForApi(target.resourceName);
+        if (accountId === undefined) {
+            return undefined;
+        }
+        return this.simAws
+            .accountRegionScope(accountId, target.regionName)
+            .apiGateway()
+            .findRestApi(target.resourceName);
+    }
+    /**
+     * The IAM that decides an `AWS_IAM` method of one API.
+     *
+     * It is the IAM of the Account that owns the API, which is where the
+     * policies allowing a caller `execute-api:Invoke` on its methods live.
+     */
+    iamFor(restApi) {
+        const { accountId, regionName } = restApi.accountRegionScope;
+        return this.simAws.accountRegionScope(accountId, regionName).iam();
+    }
+    /**
+     * Find the function a URI names, and the IAM deciding whether API Gateway
+     * may invoke it.
+     *
+     * The function is looked up in the Account and Region its own ARN names,
+     * rather than the API's, because an integration URI is free to name either.
+     *
+     * A version or alias qualifier on the URI is resolved here, once per
+     * request, so a method built on an alias runs whichever version the alias
+     * points at now. A qualifier naming neither answers with nothing, the way a
+     * function that was never created does.
+     */
+    functionFor(lambdaUri) {
+        const scope = this.simAws.accountRegionScope(lambdaUri.accountId, lambdaUri.regionName);
+        const target = scope
+            .lambda()
+            .getSimFunctionTarget(lambdaUri.functionName, lambdaUri.qualifier);
+        return target === undefined ? undefined : { ...target, iam: scope.iam() };
+    }
+}
+//# sourceMappingURL=sim-api-gateway-router.js.map

package/dist/service/apigateway/serve/sim-api-gateway-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-router.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-router.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAW9C;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAkC,EAAE;QACxD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aAChD,UAAU,EAAE;aACZ,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAmB;QACxB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAE7D,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,WAAW,CACT,SAA8B;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC1C,SAAS,CAAC,SAA4B,EACtC,SAAS,CAAC,UAA2B,CACtC,CAAC;QACF,MAAM,MAAM,GAAG,KAAK;aACjB,MAAM,EAAE;aACR,oBAAoB,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAErE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC5E,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-rest-api-endpoint.d.ts

@@ -0,0 +1,12 @@
+import type { SimPayload1Endpoint } from "../../../serve/payload-1/sim-payload-1-endpoint.js";
+import type { SimRestApiMatch } from "../api/match/sim-rest-api-match.js";
+import type { SimRestApi } from "../api/sim-rest-api.js";
+/**
+ * Describe a matched request as the endpoint identity the event builder reads.
+ *
+ * The resource fields name the tree node the path matched rather than the path
+ * the client asked for, which is what lets a handler behind a `{proxy+}` tell
+ * which template caught its request.
+ */
+export declare function simRestApiEndpoint(restApi: SimRestApi, match: SimRestApiMatch): SimPayload1Endpoint;
+//# sourceMappingURL=sim-rest-api-endpoint.d.ts.map

package/dist/service/apigateway/serve/sim-rest-api-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-endpoint.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,GACrB,mBAAmB,CAYrB"}

package/dist/service/apigateway/serve/sim-rest-api-endpoint.js

@@ -0,0 +1,21 @@
+/**
+ * Describe a matched request as the endpoint identity the event builder reads.
+ *
+ * The resource fields name the tree node the path matched rather than the path
+ * the client asked for, which is what lets a handler behind a `{proxy+}` tell
+ * which template caught its request.
+ */
+export function simRestApiEndpoint(restApi, match) {
+    return {
+        apiId: restApi.apiId,
+        accountId: restApi.accountRegionScope.accountId,
+        domainName: restApi.hostname,
+        stage: match.stage.stageName,
+        resourceId: match.resource.resourceId,
+        resourcePath: match.resource.path,
+        httpMethod: match.method.httpMethod,
+        pathParameters: match.pathParameters,
+        stageVariables: match.stage.variables,
+    };
+}
+//# sourceMappingURL=sim-rest-api-endpoint.js.map

package/dist/service/apigateway/serve/sim-rest-api-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-endpoint.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-endpoint.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAmB,EACnB,KAAsB;IAEtB,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,SAAS;QAC/C,UAAU,EAAE,OAAO,CAAC,QAAQ;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACjC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;KACtC,CAAC;AACJ,CAAC"}

package/dist/service/apigateway/serve/sim-rest-api-function-target.d.ts

@@ -0,0 +1,17 @@
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimLambdaFunctionTarget } from "../../lambda/function/version/sim-lambda-function-target.js";
+/**
+ * A function a REST API invokes, and what decides whether it may.
+ *
+ * What the API invokes is what any service delivering to a function ARN
+ * invokes, so the resource named and the version that runs come from Lambda's
+ * own target. All this adds is the IAM the decision is made in.
+ */
+export interface SimRestApiFunctionTarget extends SimLambdaFunctionTarget {
+    /**
+     * IAM of the Account that owns the function, which is what the API's invoke
+     * permission is evaluated against. It need not be the API's Account.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+//# sourceMappingURL=sim-rest-api-function-target.d.ts.map

package/dist/service/apigateway/serve/sim-rest-api-function-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-function-target.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-function-target.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AAE3G;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,uBAAuB;IACvE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC"}

package/dist/service/apigateway/serve/sim-rest-api-function-target.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-rest-api-function-target.js.map

package/dist/service/apigateway/serve/sim-rest-api-function-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-function-target.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-function-target.ts"],"names":[],"mappings":""}

package/dist/service/apigateway/serve/sim-rest-api-integration-invocation.d.ts

@@ -0,0 +1,55 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimRestApiAdmitted } from "../api/authorizer/sim-rest-api-authorization.js";
+import type { SimRestApiMatch } from "../api/match/sim-rest-api-match.js";
+import type { SimRestApi } from "../api/sim-rest-api.js";
+import type { SimApiGatewayRouter } from "./sim-api-gateway-router.js";
+interface SimRestApiIntegrationInvocationProperties {
+    readonly router: SimApiGatewayRouter;
+    /** Clock the invocation event is stamped with. */
+    readonly clock: SimClock;
+}
+interface SimRestApiIntegrationInvocationInput {
+    readonly restApi: SimRestApi;
+    readonly match: SimRestApiMatch;
+    readonly request: Request;
+    /** What the method's authorization knows about the caller. */
+    readonly authorization: SimRestApiAdmitted;
+}
+/**
+ * Invokes the Lambda function behind the matched method's integration, and
+ * turns what it returns into the HTTP response.
+ *
+ * Whether the API may invoke the function is asked here, and is the API's own
+ * question rather than the client's. The client's was already answered by the
+ * method's authorization.
+ *
+ * A method with no integration, one naming a function that is not there, one
+ * the API may not invoke, and one whose handler threw are all the same 502 on
+ * real API Gateway, with `Internal server error` in the body and the reason
+ * only in the API's own logs.
+ */
+export declare class SimRestApiIntegrationInvocation {
+    private readonly router;
+    private readonly eventBuilder;
+    private readonly responseBuilder;
+    private readonly errorResponse;
+    constructor(properties: SimRestApiIntegrationInvocationProperties);
+    /**
+     * Invoke the integration behind one matched request.
+     */
+    invoke(input: SimRestApiIntegrationInvocationInput): Promise<Response>;
+    /**
+     * The function this request's method invokes, where there is one the API is
+     * allowed to invoke.
+     */
+    private integrationTarget;
+    /**
+     * Whether the API lacks permission to invoke the integrated function.
+     *
+     * The method the request matched is supplied as the source ARN, so a
+     * permission granted for one method does not open another.
+     */
+    private mayNotInvoke;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-integration-invocation.d.ts.map

package/dist/service/apigateway/serve/sim-rest-api-integration-invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-integration-invocation.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-integration-invocation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAEjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAIvE,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAElE,YAAY,UAAU,EAAE,yCAAyC,EAKhE;IAED;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,oCAAoC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6B3E;IAED;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAgBzB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;CAiBrB"}

package/dist/service/apigateway/serve/sim-rest-api-integration-invocation.js

@@ -0,0 +1,89 @@
+import { SimPayload1EventBuilder } from "../../../serve/payload-1/sim-payload-1-event-builder.js";
+import { SimPayload1ResponseBuilder } from "../../../serve/payload-1/sim-payload-1-response-builder.js";
+import { SimLambdaServiceInvokeAuthorizer } from "../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
+import { SimRestApiExecuteApiArn } from "../api/sim-rest-api-execute-api-arn.js";
+import { simApiGatewayServicePrincipal } from "../sim-api-gateway-service-principal.js";
+import { SimApiGatewayErrorResponse } from "./sim-api-gateway-error-response.js";
+import { simRestApiEndpoint } from "./sim-rest-api-endpoint.js";
+/**
+ * Invokes the Lambda function behind the matched method's integration, and
+ * turns what it returns into the HTTP response.
+ *
+ * Whether the API may invoke the function is asked here, and is the API's own
+ * question rather than the client's. The client's was already answered by the
+ * method's authorization.
+ *
+ * A method with no integration, one naming a function that is not there, one
+ * the API may not invoke, and one whose handler threw are all the same 502 on
+ * real API Gateway, with `Internal server error` in the body and the reason
+ * only in the API's own logs.
+ */
+export class SimRestApiIntegrationInvocation {
+    router;
+    eventBuilder;
+    responseBuilder = new SimPayload1ResponseBuilder();
+    errorResponse = new SimApiGatewayErrorResponse();
+    constructor(properties) {
+        this.router = properties.router;
+        this.eventBuilder = new SimPayload1EventBuilder({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Invoke the integration behind one matched request.
+     */
+    async invoke(input) {
+        const target = this.integrationTarget(input);
+        if (target === undefined) {
+            return this.errorResponse.badGateway();
+        }
+        try {
+            const event = await this.eventBuilder.build(input.request, simRestApiEndpoint(input.restApi, input.match), {
+                lambda: input.authorization.lambda,
+                caller: input.authorization.caller,
+                cognito: input.authorization.cognito,
+            });
+            const result = await target.simFunction.invoke(event);
+            return this.responseBuilder.isStructuredResult(result)
+                ? this.responseBuilder.build(result)
+                : this.errorResponse.badGateway();
+        }
+        catch {
+            // Real API Gateway reports an unhandled integration error as a 502, with
+            // the error itself only visible in the function's logs. Reading the
+            // request body can fail the same way, so building the event is inside
+            // this too.
+            return this.errorResponse.badGateway();
+        }
+    }
+    /**
+     * The function this request's method invokes, where there is one the API is
+     * allowed to invoke.
+     */
+    integrationTarget(input) {
+        const { integration } = input.match.method;
+        if (integration === undefined) {
+            return undefined;
+        }
+        const target = this.router.functionFor(integration.lambdaUri);
+        return target === undefined || this.mayNotInvoke(input, target)
+            ? undefined
+            : target;
+    }
+    /**
+     * Whether the API lacks permission to invoke the integrated function.
+     *
+     * The method the request matched is supplied as the source ARN, so a
+     * permission granted for one method does not open another.
+     */
+    mayNotInvoke(input, target) {
+        const { restApi, match, request } = input;
+        return new SimLambdaServiceInvokeAuthorizer({ iam: target.iam }).authorize({
+            resource: target.resource,
+            servicePrincipal: simApiGatewayServicePrincipal,
+            sourceArn: SimRestApiExecuteApiArn.forMatch(restApi, match, request.method).toString(),
+            sourceAccount: restApi.accountRegionScope.accountId,
+        }).isDenied;
+    }
+}
+//# sourceMappingURL=sim-rest-api-integration-invocation.js.map

package/dist/service/apigateway/serve/sim-rest-api-integration-invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-integration-invocation.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-integration-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAExG,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAG1H,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAiBhE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAAsB;IAC5B,YAAY,CAA0B;IACtC,eAAe,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACnD,aAAa,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAElE,YAAY,UAAqD;QAC/D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAA2C;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CACzC,KAAK,CAAC,OAAO,EACb,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAC9C;gBACE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;gBAClC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;gBAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO;aACrC,CACF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEtD,OAAO,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBACpD,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,sEAAsE;YACtE,YAAY;YACZ,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,iBAAiB,CACvB,KAA2C;QAE3C,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAE3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAE9D,OAAO,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAC7D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAClB,KAA2C,EAC3C,MAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAE1C,OAAO,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;YACzE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,6BAA6B;YAC/C,SAAS,EAAE,uBAAuB,CAAC,QAAQ,CACzC,OAAO,EACP,KAAK,EACL,OAAO,CAAC,MAAM,CACf,CAAC,QAAQ,EAAE;YACZ,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC,SAAS;SACpD,CAAC,CAAC,QAAQ,CAAC;IACd,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-rest-api-refusal-response.d.ts

@@ -0,0 +1,18 @@
+import type { SimRestApiRefused } from "../api/authorizer/sim-rest-api-authorization.js";
+/**
+ * The response a request the method's authorization refused gets back.
+ *
+ * Real API Gateway answers a deny with two different bodies, one for a Deny
+ * statement that matched and one for a policy allowing nothing relevant, so
+ * both are here. An authorizer that could not answer is the API's problem
+ * rather than the caller's, and gets the same 500 it does on AWS. A request
+ * carrying no token is the one 401.
+ */
+export declare class SimRestApiRefusalResponse {
+    private readonly errorResponse;
+    /**
+     * Build the response for one refusal.
+     */
+    build(refused: SimRestApiRefused): Response;
+}
+//# sourceMappingURL=sim-rest-api-refusal-response.d.ts.map