@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source-parser.d.ts

@@ -0,0 +1,45 @@
+import type { SimRestApiAuthorizerType } from "../sim-rest-api-authorizer.js";
+import type { SimRestApiIdentitySource } from "./sim-rest-api-identity-source.js";
+/**
+ * Reads the identity source expressions a REST API authorizer is configured
+ * with.
+ *
+ * An expression naming somewhere this simulation does not read from is refused
+ * rather than accepted and looked for nowhere, since an authorizer that never
+ * finds what it looks for refuses every request, which looks like a signing
+ * problem rather than the configuration one it is. That leaves out
+ * `method.request.path`, `context` and `stageVariables`, which a `REQUEST`
+ * authorizer may also name on AWS.
+ *
+ * A `TOKEN` and a `COGNITO_USER_POOLS` authorizer each read one header and
+ * nothing else, which is the rule real API Gateway holds both to, so they
+ * parse with `header`.
+ */
+export declare class SimRestApiIdentitySourceParser {
+    /**
+     * Read the one header an authorizer of this kind takes its token from.
+     */
+    header(expression: string, authorizerType: SimRestApiAuthorizerType): SimRestApiIdentitySource;
+    /**
+     * Read one expression of a `REQUEST` authorizer's identity source.
+     */
+    parse(expression: string): SimRestApiIdentitySource;
+    /**
+     * The header an expression names, refusing one no request could carry.
+     *
+     * A header name is an HTTP field name, and anything else is refused here
+     * rather than at request time: reading a header by an invalid name throws,
+     * and it would throw on every request to the method rather than on the
+     * command that configured it.
+     */
+    private headerSource;
+    /**
+     * The name an expression carries after its prefix, refusing an empty one.
+     *
+     * An expression naming nothing finds nothing on every request, so the
+     * authorizer refuses everyone for a reason that reads like a signing problem
+     * rather than the configuration one it is.
+     */
+    private named;
+}
+//# sourceMappingURL=sim-rest-api-identity-source-parser.d.ts.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-identity-source-parser.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAK9E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAWlF;;;;;;;;;;;;;;GAcG;AACH,qBAAa,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,wBAAwB,GACvC,wBAAwB,CAU1B;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,wBAAwB,CAqBlD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;CAUd"}

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source-parser.js

@@ -0,0 +1,82 @@
+import { SimApiGatewayBadRequest } from "../../../error/sim-api-gateway.error.js";
+import { SimRestApiHeaderIdentitySource, simRestApiHeaderIdentityPrefix, } from "./sim-rest-api-header-identity-source.js";
+import { SimRestApiQueryStringIdentitySource, simRestApiQueryStringIdentityPrefix, } from "./sim-rest-api-query-string-identity-source.js";
+/**
+ * The characters an HTTP field name holds, which is the RFC 9110 token.
+ */
+const httpFieldName = /^[!#$%&'*+.^_`|~\w-]+$/u;
+/**
+ * Reads the identity source expressions a REST API authorizer is configured
+ * with.
+ *
+ * An expression naming somewhere this simulation does not read from is refused
+ * rather than accepted and looked for nowhere, since an authorizer that never
+ * finds what it looks for refuses every request, which looks like a signing
+ * problem rather than the configuration one it is. That leaves out
+ * `method.request.path`, `context` and `stageVariables`, which a `REQUEST`
+ * authorizer may also name on AWS.
+ *
+ * A `TOKEN` and a `COGNITO_USER_POOLS` authorizer each read one header and
+ * nothing else, which is the rule real API Gateway holds both to, so they
+ * parse with `header`.
+ */
+export class SimRestApiIdentitySourceParser {
+    /**
+     * Read the one header an authorizer of this kind takes its token from.
+     */
+    header(expression, authorizerType) {
+        if (!expression.startsWith(simRestApiHeaderIdentityPrefix)) {
+            throw new SimApiGatewayBadRequest(`identitySource '${expression}' is not simulated: a ` +
+                `${authorizerType} authorizer reads one header, written as ` +
+                `'${simRestApiHeaderIdentityPrefix}<name>'`);
+        }
+        return this.headerSource(expression);
+    }
+    /**
+     * Read one expression of a `REQUEST` authorizer's identity source.
+     */
+    parse(expression) {
+        if (expression.startsWith(simRestApiHeaderIdentityPrefix)) {
+            return this.headerSource(expression);
+        }
+        if (expression.startsWith(simRestApiQueryStringIdentityPrefix)) {
+            return new SimRestApiQueryStringIdentitySource(this.named(expression, expression.slice(simRestApiQueryStringIdentityPrefix.length), "query string parameter"));
+        }
+        throw new SimApiGatewayBadRequest(`identitySource '${expression}' is not simulated: a REQUEST ` +
+            `authorizer reads request headers and query string parameters, ` +
+            `written as '${simRestApiHeaderIdentityPrefix}<name>' or ` +
+            `'${simRestApiQueryStringIdentityPrefix}<name>'`);
+    }
+    /**
+     * The header an expression names, refusing one no request could carry.
+     *
+     * A header name is an HTTP field name, and anything else is refused here
+     * rather than at request time: reading a header by an invalid name throws,
+     * and it would throw on every request to the method rather than on the
+     * command that configured it.
+     */
+    headerSource(expression) {
+        const name = this.named(expression, expression.slice(simRestApiHeaderIdentityPrefix.length), "header");
+        if (!httpFieldName.test(name)) {
+            throw new SimApiGatewayBadRequest(`identitySource '${expression}' names the header '${name}', which ` +
+                `is not a header name: an HTTP field name holds letters, digits ` +
+                `and the characters !#$%&'*+-.^_\`|~`);
+        }
+        return new SimRestApiHeaderIdentitySource(name);
+    }
+    /**
+     * The name an expression carries after its prefix, refusing an empty one.
+     *
+     * An expression naming nothing finds nothing on every request, so the
+     * authorizer refuses everyone for a reason that reads like a signing problem
+     * rather than the configuration one it is.
+     */
+    named(expression, name, what) {
+        if (name.length === 0) {
+            throw new SimApiGatewayBadRequest(`identitySource '${expression}' names no ${what}, so it would find ` +
+                `nothing on every request`);
+        }
+        return name;
+    }
+}
+//# sourceMappingURL=sim-rest-api-identity-source-parser.js.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-identity-source-parser.js","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAElD,OAAO,EACL,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,gDAAgD,CAAC;AAExD;;GAEG;AACH,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,UAAkB,EAClB,cAAwC;QAExC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,UAAU,wBAAwB;gBACnD,GAAG,cAAc,2CAA2C;gBAC5D,IAAI,8BAA8B,SAAS,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAkB;QACtB,IAAI,UAAU,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,mCAAmC,CAC5C,IAAI,CAAC,KAAK,CACR,UAAU,EACV,UAAU,CAAC,KAAK,CAAC,mCAAmC,CAAC,MAAM,CAAC,EAC5D,wBAAwB,CACzB,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,UAAU,gCAAgC;YAC3D,gEAAgE;YAChE,eAAe,8BAA8B,aAAa;YAC1D,IAAI,mCAAmC,SAAS,CACnD,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,YAAY,CAAC,UAAkB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CACrB,UAAU,EACV,UAAU,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,EACvD,QAAQ,CACT,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,UAAU,uBAAuB,IAAI,WAAW;gBACjE,iEAAiE;gBACjE,qCAAqC,CACxC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAkB,EAAE,IAAY,EAAE,IAAY;QAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,UAAU,cAAc,IAAI,qBAAqB;gBAClE,0BAA0B,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Where an authorizer takes what it identifies the caller by.
+ *
+ * An identity source is a request mapping expression. Each kind reads from
+ * somewhere different and answers the same question, so reading a list of them
+ * is a loop rather than a switch over kinds.
+ *
+ * A source the request supplies nothing at is what refuses a request before
+ * the authorizer is invoked.
+ */
+export interface SimRestApiIdentitySource {
+    /**
+     * The expression as it was written, which is what the API reports back.
+     */
+    readonly expression: string;
+    /**
+     * What this request carries at this identity source, if it carries anything.
+     *
+     * An empty value is the same as no value here: real API Gateway treats a
+     * source it finds nothing at as one the request did not supply, and refuses
+     * the request without asking the authorizer anything.
+     */
+    value(request: Request): string | undefined;
+}
+/**
+ * A value the request actually supplied, rather than an empty one.
+ *
+ * The value is answered as it arrived, and trimmed only to decide whether the
+ * request supplied anything at all. What is around a value is part of it,
+ * since an authorizer is handed what the client sent.
+ */
+export declare function simRestApiIdentityValue(value: string | null): string | undefined;
+//# sourceMappingURL=sim-rest-api-identity-source.d.ts.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-identity-source.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,GAAG,SAAS,CAMpB"}

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source.js

@@ -0,0 +1,14 @@
+/**
+ * A value the request actually supplied, rather than an empty one.
+ *
+ * The value is answered as it arrived, and trimmed only to decide whether the
+ * request supplied anything at all. What is around a value is part of it,
+ * since an authorizer is handed what the client sent.
+ */
+export function simRestApiIdentityValue(value) {
+    if (value === null || value.trim().length === 0) {
+        return undefined;
+    }
+    return value;
+}
+//# sourceMappingURL=sim-rest-api-identity-source.js.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-identity-source.js","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-identity-source.ts"],"names":[],"mappings":"AA0BA;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAoB;IAEpB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-sources.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The identity sources an authorizer is configured with.
+ *
+ * A REST API writes them as one comma-separated string, where an HTTP API
+ * takes a list. A `TOKEN` authorizer names one header and a `REQUEST`
+ * authorizer names as many headers and query string parameters as identify its
+ * callers.
+ *
+ * API Gateway checks the whole set before it invokes anything: a request
+ * missing any one of them is refused with a 401 and the function never runs.
+ * The order they were configured in is kept, because that is the order their
+ * values reach the authorizer in.
+ */
+export declare class SimRestApiIdentitySources {
+    private readonly sources;
+    private constructor();
+    /**
+     * Read the one header a `TOKEN` authorizer takes its token from.
+     */
+    static token(identitySource: string): SimRestApiIdentitySources;
+    /**
+     * Read the comma-separated expressions a `REQUEST` authorizer identifies its
+     * callers by.
+     *
+     * Whitespace around a separator is dropped, since CDK's `IdentitySource`
+     * writes the list joined by commas and a template written by hand often
+     * spaces them out.
+     *
+     * A stray comma leaves an empty expression, and that is refused rather than
+     * dropped. A dropped one would make a list the caller wrote and a list the
+     * authorizer holds two different things.
+     */
+    static request(identitySource: string): SimRestApiIdentitySources;
+    /**
+     * The expressions as they were written, joined the way the REST API reports
+     * them back.
+     */
+    get expression(): string;
+    /**
+     * The values this request carries, in the order the sources were configured,
+     * or nothing at all when it is missing any one of them.
+     *
+     * These are the values rather than the expressions that found them, which is
+     * what a `TOKEN` authorizer is handed as its `authorizationToken`.
+     */
+    values(request: Request): string[] | undefined;
+}
+//# sourceMappingURL=sim-rest-api-identity-sources.d.ts.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-identity-sources.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-identity-sources.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;GAYG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAE9D,OAAO,eAEN;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,yBAAyB,CAI9D;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,yBAAyB,CAgBhE;IAED;;;OAGG;IACH,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAc7C;CACF"}

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-sources.js

@@ -0,0 +1,79 @@
+import { SimApiGatewayBadRequest } from "../../../error/sim-api-gateway.error.js";
+import { SimRestApiIdentitySourceParser } from "./sim-rest-api-identity-source-parser.js";
+const parser = new SimRestApiIdentitySourceParser();
+/**
+ * The identity sources an authorizer is configured with.
+ *
+ * A REST API writes them as one comma-separated string, where an HTTP API
+ * takes a list. A `TOKEN` authorizer names one header and a `REQUEST`
+ * authorizer names as many headers and query string parameters as identify its
+ * callers.
+ *
+ * API Gateway checks the whole set before it invokes anything: a request
+ * missing any one of them is refused with a 401 and the function never runs.
+ * The order they were configured in is kept, because that is the order their
+ * values reach the authorizer in.
+ */
+export class SimRestApiIdentitySources {
+    sources;
+    constructor(sources) {
+        this.sources = sources;
+    }
+    /**
+     * Read the one header a `TOKEN` authorizer takes its token from.
+     */
+    static token(identitySource) {
+        return new SimRestApiIdentitySources([
+            parser.header(identitySource, "TOKEN"),
+        ]);
+    }
+    /**
+     * Read the comma-separated expressions a `REQUEST` authorizer identifies its
+     * callers by.
+     *
+     * Whitespace around a separator is dropped, since CDK's `IdentitySource`
+     * writes the list joined by commas and a template written by hand often
+     * spaces them out.
+     *
+     * A stray comma leaves an empty expression, and that is refused rather than
+     * dropped. A dropped one would make a list the caller wrote and a list the
+     * authorizer holds two different things.
+     */
+    static request(identitySource) {
+        const expressions = identitySource
+            .split(",")
+            .map((expression) => expression.trim());
+        if (expressions.some((expression) => expression.length === 0)) {
+            throw new SimApiGatewayBadRequest(`identitySource '${identitySource}' holds an empty expression ` +
+                `between its commas, and every expression has to name somewhere ` +
+                `the request carries something`);
+        }
+        return new SimRestApiIdentitySources(expressions.map((expression) => parser.parse(expression)));
+    }
+    /**
+     * The expressions as they were written, joined the way the REST API reports
+     * them back.
+     */
+    get expression() {
+        return this.sources.map((source) => source.expression).join(",");
+    }
+    /**
+     * The values this request carries, in the order the sources were configured,
+     * or nothing at all when it is missing any one of them.
+     *
+     * These are the values rather than the expressions that found them, which is
+     * what a `TOKEN` authorizer is handed as its `authorizationToken`.
+     */
+    values(request) {
+        const values = [];
+        for (const source of this.sources) {
+            const value = source.value(request);
+            if (value === undefined) {
+                return undefined;
+            }
+            values.push(value);
+        }
+        return values;
+    }
+}
+//# sourceMappingURL=sim-rest-api-identity-sources.js.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-identity-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-identity-sources.js","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-identity-sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAG1F,MAAM,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,yBAAyB;IACnB,OAAO,CAAsC;IAE9D,YAAoB,OAA4C;QAC9D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,cAAsB;QACjC,OAAO,IAAI,yBAAyB,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,OAAO,CAAC,cAAsB;QACnC,MAAM,WAAW,GAAG,cAAc;aAC/B,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,cAAc,8BAA8B;gBAC7D,iEAAiE;gBACjE,+BAA+B,CAClC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,yBAAyB,CAClC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,OAAgB;QACrB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.d.ts

@@ -0,0 +1,22 @@
+import { type SimRestApiIdentitySource } from "./sim-rest-api-identity-source.js";
+/**
+ * The prefix a query string identity source is written with.
+ */
+export declare const simRestApiQueryStringIdentityPrefix = "method.request.querystring.";
+/**
+ * An identity source naming one query string parameter, such as
+ * `method.request.querystring.access_token`.
+ *
+ * A repeated parameter supplies its first value, which is the one a mapping
+ * expression reads on real API Gateway.
+ */
+export declare class SimRestApiQueryStringIdentitySource implements SimRestApiIdentitySource {
+    readonly expression: string;
+    private readonly parameterName;
+    constructor(parameterName: string);
+    /**
+     * The query string parameter this request carries, if it carries one.
+     */
+    value(request: Request): string | undefined;
+}
+//# sourceMappingURL=sim-rest-api-query-string-identity-source.d.ts.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-query-string-identity-source.d.ts","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,wBAAwB,EAE9B,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,eAAO,MAAM,mCAAmC,gCACjB,CAAC;AAEhC;;;;;;GAMG;AACH,qBAAa,mCAAoC,YAAW,wBAAwB;IAClF,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YAAY,aAAa,EAAE,MAAM,EAGhC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAI1C;CACF"}

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.js

@@ -0,0 +1,27 @@
+import { simRestApiIdentityValue, } from "./sim-rest-api-identity-source.js";
+/**
+ * The prefix a query string identity source is written with.
+ */
+export const simRestApiQueryStringIdentityPrefix = "method.request.querystring.";
+/**
+ * An identity source naming one query string parameter, such as
+ * `method.request.querystring.access_token`.
+ *
+ * A repeated parameter supplies its first value, which is the one a mapping
+ * expression reads on real API Gateway.
+ */
+export class SimRestApiQueryStringIdentitySource {
+    expression;
+    parameterName;
+    constructor(parameterName) {
+        this.expression = `${simRestApiQueryStringIdentityPrefix}${parameterName}`;
+        this.parameterName = parameterName;
+    }
+    /**
+     * The query string parameter this request carries, if it carries one.
+     */
+    value(request) {
+        return simRestApiIdentityValue(new URL(request.url).searchParams.get(this.parameterName));
+    }
+}
+//# sourceMappingURL=sim-rest-api-query-string-identity-source.js.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-query-string-identity-source.js","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,6BAA6B,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,OAAO,mCAAmC;IAC9B,UAAU,CAAS;IAElB,aAAa,CAAS;IAEvC,YAAY,aAAqB;QAC/B,IAAI,CAAC,UAAU,GAAG,GAAG,mCAAmC,GAAG,aAAa,EAAE,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAgB;QACpB,OAAO,uBAAuB,CAC5B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.d.ts

@@ -0,0 +1,24 @@
+import type { SimCognitoUserPoolRegistry } from "../../../cognito/registry/sim-cognito-user-pool-registry.js";
+import type { SimRestApiUserPool, SimRestApiUserPools } from "./sim-rest-api-user-pools.js";
+interface SimCognitoRestApiUserPoolsProperties {
+    readonly userPoolRegistry: SimCognitoUserPoolRegistry;
+}
+/**
+ * Simulated Cognito user pools as the pools a REST API authorizer verifies
+ * against.
+ *
+ * All of the Cognito lookup lives here rather than in API Gateway, which knows
+ * only that an authorizer names pools by id. The registry spans simulated
+ * Accounts, matching an API Gateway authorizer that can name a pool in any
+ * Account.
+ */
+export declare class SimCognitoRestApiUserPools implements SimRestApiUserPools {
+    private readonly userPoolRegistry;
+    constructor(properties: SimCognitoRestApiUserPoolsProperties);
+    /**
+     * The pool this id names, in whichever Account and Region created it.
+     */
+    find(userPoolId: string): SimRestApiUserPool | undefined;
+}
+export {};
+//# sourceMappingURL=sim-cognito-rest-api-user-pools.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-rest-api-user-pools.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAWvD;CACF"}

package/dist/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.js

@@ -0,0 +1,30 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * Simulated Cognito user pools as the pools a REST API authorizer verifies
+ * against.
+ *
+ * All of the Cognito lookup lives here rather than in API Gateway, which knows
+ * only that an authorizer names pools by id. The registry spans simulated
+ * Accounts, matching an API Gateway authorizer that can name a pool in any
+ * Account.
+ */
+export class SimCognitoRestApiUserPools {
+    userPoolRegistry;
+    constructor(properties) {
+        this.userPoolRegistry = properties.userPoolRegistry;
+    }
+    /**
+     * The pool this id names, in whichever Account and Region created it.
+     */
+    find(userPoolId) {
+        const pool = this.userPoolRegistry.find(userPoolId);
+        if (pool === undefined) {
+            return undefined;
+        }
+        return {
+            issuerUrl: pool.issuerUrl,
+            keys: new SimJwtKeys(pool.jwks().keys),
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-rest-api-user-pools.js.map

package/dist/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-rest-api-user-pools.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAWlE;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA0B;IACpB,gBAAgB,CAA6B;IAE9D,YAAY,UAAgD;QAC1D,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAkB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorization.d.ts

@@ -0,0 +1,77 @@
+import type { SimPayload1CognitoAuthorizer, SimPayload1LambdaAuthorizer } from "../../../../serve/payload-1/sim-payload-1-event.type.js";
+import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
+/**
+ * Why a method refused a request, which decides the response it gets.
+ *
+ * `unauthorized` is a request carrying no token at the authorizer's identity
+ * source, and a token the authorizer answered `Unauthorized` for.
+ * `explicit-deny` and `implicit-deny` are both 403 with different bodies, as
+ * real API Gateway answers them. `error` is the authorizer itself failing,
+ * which is the API's problem rather than the caller's.
+ */
+export type SimRestApiRefusalKind = "unauthorized" | "explicit-deny" | "implicit-deny" | "error";
+interface SimRestApiAdmittedProperties {
+    /**
+     * What a `CUSTOM` method's authorizer passed on to the integration, which is
+     * absent on a method admitting anybody.
+     */
+    readonly lambda?: SimPayload1LambdaAuthorizer | undefined;
+    /** The principal an `AWS_IAM` method allowed the request. */
+    readonly caller?: SimAwsRequestCaller | undefined;
+    /**
+     * The claims of the token a `COGNITO_USER_POOLS` method's authorizer
+     * accepted.
+     */
+    readonly cognito?: SimPayload1CognitoAuthorizer | undefined;
+}
+/**
+ * A request the method admitted, and what its authorization knows about the
+ * caller.
+ *
+ * Every member is absent on a method that authorizes nobody, since there is
+ * no caller to describe. That is what leaves `requestContext.authorizer` out of
+ * the event entirely and every `requestContext.identity` field describing a
+ * principal `null`. Which one is present says which kind of authorization
+ * admitted the request.
+ */
+export declare class SimRestApiAdmitted {
+    readonly admitted: true;
+    readonly lambda: SimPayload1LambdaAuthorizer | undefined;
+    readonly caller: SimAwsRequestCaller | undefined;
+    readonly cognito: SimPayload1CognitoAuthorizer | undefined;
+    constructor(properties?: SimRestApiAdmittedProperties);
+}
+/**
+ * A request the method refused, before any integration was invoked.
+ */
+export declare class SimRestApiRefused {
+    readonly admitted: false;
+    readonly kind: SimRestApiRefusalKind;
+    private constructor();
+    /**
+     * The request carried nothing at the authorizer's identity source, or the
+     * authorizer answered `Unauthorized`.
+     */
+    static unauthorized(): SimRestApiRefused;
+    /**
+     * A Deny statement in the authorizer's policy matched the method.
+     */
+    static explicitDeny(): SimRestApiRefused;
+    /**
+     * The authorizer's policy allowed nothing that covers the method.
+     */
+    static implicitDeny(): SimRestApiRefused;
+    /**
+     * The method's authorizer could not answer at all. Its function is missing,
+     * may not be invoked, failed, or replied in a shape API Gateway does not
+     * understand. None of that is the caller's doing, so it is the 500 an
+     * authorizer failure gets on real AWS.
+     */
+    static error(): SimRestApiRefused;
+}
+/**
+ * What a method decided about one request.
+ */
+export type SimRestApiAuthorization = SimRestApiAdmitted | SimRestApiRefused;
+export {};
+//# sourceMappingURL=sim-rest-api-authorization.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAC7B,cAAc,GACd,eAAe,GACf,eAAe,GACf,OAAO,CAAC;AAEZ,UAAU,4BAA4B;IACpC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC1D,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,QAAQ,OAAiB;IACzC,SAAgB,MAAM,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAChE,SAAgB,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACxD,SAAgB,OAAO,EAAE,4BAA4B,GAAG,SAAS,CAAC;IAElE,YAAY,UAAU,GAAE,4BAAiC,EAIxD;CACF;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,QAAQ,QAAkB;IAC1C,SAAgB,IAAI,EAAE,qBAAqB,CAAC;IAE5C,OAAO,eAEN;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,IAAI,iBAAiB,CAEvC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,IAAI,iBAAiB,CAEvC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,IAAI,iBAAiB,CAEvC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAEhC;CACF;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorization.js

@@ -0,0 +1,60 @@
+/**
+ * A request the method admitted, and what its authorization knows about the
+ * caller.
+ *
+ * Every member is absent on a method that authorizes nobody, since there is
+ * no caller to describe. That is what leaves `requestContext.authorizer` out of
+ * the event entirely and every `requestContext.identity` field describing a
+ * principal `null`. Which one is present says which kind of authorization
+ * admitted the request.
+ */
+export class SimRestApiAdmitted {
+    admitted = true;
+    lambda;
+    caller;
+    cognito;
+    constructor(properties = {}) {
+        this.lambda = properties.lambda;
+        this.caller = properties.caller;
+        this.cognito = properties.cognito;
+    }
+}
+/**
+ * A request the method refused, before any integration was invoked.
+ */
+export class SimRestApiRefused {
+    admitted = false;
+    kind;
+    constructor(kind) {
+        this.kind = kind;
+    }
+    /**
+     * The request carried nothing at the authorizer's identity source, or the
+     * authorizer answered `Unauthorized`.
+     */
+    static unauthorized() {
+        return new SimRestApiRefused("unauthorized");
+    }
+    /**
+     * A Deny statement in the authorizer's policy matched the method.
+     */
+    static explicitDeny() {
+        return new SimRestApiRefused("explicit-deny");
+    }
+    /**
+     * The authorizer's policy allowed nothing that covers the method.
+     */
+    static implicitDeny() {
+        return new SimRestApiRefused("implicit-deny");
+    }
+    /**
+     * The method's authorizer could not answer at all. Its function is missing,
+     * may not be invoked, failed, or replied in a shape API Gateway does not
+     * understand. None of that is the caller's doing, so it is the 500 an
+     * authorizer failure gets on real AWS.
+     */
+    static error() {
+        return new SimRestApiRefused("error");
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorization.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorization.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorization.ts"],"names":[],"mappings":"AAoCA;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IACb,QAAQ,GAAG,IAAa,CAAC;IACzB,MAAM,CAA0C;IAChD,MAAM,CAAkC;IACxC,OAAO,CAA2C;IAElE,YAAY,UAAU,GAAiC,EAAE;QACvD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACZ,QAAQ,GAAG,KAAc,CAAC;IAC1B,IAAI,CAAwB;IAE5C,YAAoB,IAA2B;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;CACF"}