@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.d.ts

@@ -0,0 +1,69 @@
+import type { SimRestApiAuthorization } from "./sim-rest-api-authorization.js";
+/**
+ * What one held decision was made for.
+ */
+export interface SimRestApiCacheKey {
+    /**
+     * The ARN of the request the decision was made about, which is what the
+     * authorizer's policy was evaluated against.
+     */
+    readonly methodArn: string;
+    /**
+     * The values the authorizer's identity sources found, in the order they were
+     * configured. A `TOKEN` authorizer has one of these, and it is the token.
+     */
+    readonly identityValues: readonly string[];
+}
+/**
+ * The decisions one Lambda authorizer has already made, held for as long as
+ * its `AuthorizerResultTtlInSeconds` says.
+ *
+ * A `TOKEN` authorizer is keyed on the token it was handed and a `REQUEST`
+ * authorizer on the values of its identity sources, which come to the same
+ * thing here: a `TOKEN` authorizer has one identity source, and its value is
+ * the token.
+ *
+ * The method the request was made to is part of the key as well, because what
+ * is held is the decision rather than the policy it came from. That policy was
+ * evaluated against one request ARN, and the admission or refusal it produced
+ * says nothing about any other. An HTTP API keys on the identity source values
+ * alone, and holds a route-shaped answer that carries over.
+ *
+ * The cache belongs to the authorizer rather than to whatever is serving,
+ * because it outlives one request and one server the way the authorizer does.
+ * It holds no clock of its own: the caller passes the instant it is asking
+ * about, so expiry follows the simulation's clock and a test advances time
+ * rather than waiting.
+ */
+export declare class SimRestApiAuthorizerResultCache {
+    private readonly ttlSeconds;
+    private readonly results;
+    constructor(ttlSeconds: number);
+    /**
+     * Whether this authorizer holds anything at all.
+     *
+     * A TTL of zero is what switches caching off, and is what an authorizer that
+     * says nothing about it gets.
+     */
+    get isEnabled(): boolean;
+    /**
+     * The decision already made for this request, if one was made and has not
+     * expired.
+     */
+    find(key: SimRestApiCacheKey, at: Date): SimRestApiAuthorization | undefined;
+    /**
+     * Hold a decision for this authorizer's TTL.
+     *
+     * A refusal is held the same way an admission is, which is what real API
+     * Gateway does: it holds the authorizer's answer, whatever that was.
+     */
+    store(key: SimRestApiCacheKey, at: Date, authorization: SimRestApiAuthorization): void;
+    /**
+     * The string one decision is held under.
+     *
+     * The parts are JSON-encoded rather than joined, so two sets that differ
+     * only in where one value ends and the next begins are different keys.
+     */
+    private keyOf;
+}
+//# sourceMappingURL=sim-rest-api-authorizer-result-cache.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-result-cache.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAU/E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IAErE,YAAY,UAAU,EAAE,MAAM,EAE7B;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,GAAG,uBAAuB,GAAG,SAAS,CAe3E;IAED;;;;;OAKG;IACH,KAAK,CACH,GAAG,EAAE,kBAAkB,EACvB,EAAE,EAAE,IAAI,EACR,aAAa,EAAE,uBAAuB,GACrC,IAAI,CASN;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAK;CAGd"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.js

@@ -0,0 +1,79 @@
+/**
+ * The decisions one Lambda authorizer has already made, held for as long as
+ * its `AuthorizerResultTtlInSeconds` says.
+ *
+ * A `TOKEN` authorizer is keyed on the token it was handed and a `REQUEST`
+ * authorizer on the values of its identity sources, which come to the same
+ * thing here: a `TOKEN` authorizer has one identity source, and its value is
+ * the token.
+ *
+ * The method the request was made to is part of the key as well, because what
+ * is held is the decision rather than the policy it came from. That policy was
+ * evaluated against one request ARN, and the admission or refusal it produced
+ * says nothing about any other. An HTTP API keys on the identity source values
+ * alone, and holds a route-shaped answer that carries over.
+ *
+ * The cache belongs to the authorizer rather than to whatever is serving,
+ * because it outlives one request and one server the way the authorizer does.
+ * It holds no clock of its own: the caller passes the instant it is asking
+ * about, so expiry follows the simulation's clock and a test advances time
+ * rather than waiting.
+ */
+export class SimRestApiAuthorizerResultCache {
+    ttlSeconds;
+    results = new Map();
+    constructor(ttlSeconds) {
+        this.ttlSeconds = ttlSeconds;
+    }
+    /**
+     * Whether this authorizer holds anything at all.
+     *
+     * A TTL of zero is what switches caching off, and is what an authorizer that
+     * says nothing about it gets.
+     */
+    get isEnabled() {
+        return this.ttlSeconds > 0;
+    }
+    /**
+     * The decision already made for this request, if one was made and has not
+     * expired.
+     */
+    find(key, at) {
+        const cached = this.results.get(this.keyOf(key));
+        if (cached === undefined) {
+            return undefined;
+        }
+        if (cached.expiresAt.getTime() <= at.getTime()) {
+            // Dropped rather than left to be overwritten, so an authorizer that is
+            // never asked about this identity again does not hold it for ever.
+            this.results.delete(this.keyOf(key));
+            return undefined;
+        }
+        return cached.authorization;
+    }
+    /**
+     * Hold a decision for this authorizer's TTL.
+     *
+     * A refusal is held the same way an admission is, which is what real API
+     * Gateway does: it holds the authorizer's answer, whatever that was.
+     */
+    store(key, at, authorization) {
+        if (!this.isEnabled) {
+            return;
+        }
+        this.results.set(this.keyOf(key), {
+            authorization,
+            expiresAt: new Date(at.getTime() + this.ttlSeconds * 1000),
+        });
+    }
+    /**
+     * The string one decision is held under.
+     *
+     * The parts are JSON-encoded rather than joined, so two sets that differ
+     * only in where one value ends and the next begins are different keys.
+     */
+    keyOf(key) {
+        return JSON.stringify([key.methodArn, key.identityValues]);
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-result-cache.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-result-cache.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,+BAA+B;IACzB,UAAU,CAAS;IACnB,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAErE,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,GAAuB,EAAE,EAAQ;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CACH,GAAuB,EACvB,EAAQ,EACR,aAAsC;QAEtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAChC,aAAa;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,GAAuB;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.d.ts

@@ -0,0 +1,31 @@
+import { type SimRestApiAuthorizer, type SimRestApiAuthorizerId } from "./sim-rest-api-authorizer.js";
+/**
+ * The authorizers of one REST API, keyed by the id the API allocated.
+ *
+ * An authorizer belongs to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export declare class SimRestApiAuthorizerStore {
+    private readonly authorizers;
+    /**
+     * Allocate an authorizer id this API is not already using.
+     */
+    allocateId(): SimRestApiAuthorizerId;
+    /**
+     * Add an authorizer to this API.
+     */
+    add(authorizer: SimRestApiAuthorizer): void;
+    /**
+     * Find an authorizer by id.
+     */
+    find(authorizerId: string): SimRestApiAuthorizer | undefined;
+    /**
+     * Forget a deleted authorizer.
+     */
+    remove(authorizerId: SimRestApiAuthorizerId): void;
+    /**
+     * List every authorizer of this API, in the order they were created.
+     */
+    list(): SimRestApiAuthorizer[];
+}
+//# sourceMappingURL=sim-rest-api-authorizer-store.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ;;OAEG;IACH,UAAU,IAAI,sBAAsB,CASnC;IAED;;OAEG;IACH,GAAG,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAE1C;IAED;;OAEG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE3D;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,IAAI,IAAI,oBAAoB,EAAE,CAE7B;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.js

@@ -0,0 +1,46 @@
+import { makeSimRestApiAuthorizerId, } from "./sim-rest-api-authorizer.js";
+/**
+ * The authorizers of one REST API, keyed by the id the API allocated.
+ *
+ * An authorizer belongs to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export class SimRestApiAuthorizerStore {
+    authorizers = new Map();
+    /**
+     * Allocate an authorizer id this API is not already using.
+     */
+    allocateId() {
+        let authorizerId = makeSimRestApiAuthorizerId();
+        while (this.authorizers.has(authorizerId)) {
+            /* v8 ignore next -- does not happen in practice */
+            authorizerId = makeSimRestApiAuthorizerId();
+        }
+        return authorizerId;
+    }
+    /**
+     * Add an authorizer to this API.
+     */
+    add(authorizer) {
+        this.authorizers.set(authorizer.authorizerId, authorizer);
+    }
+    /**
+     * Find an authorizer by id.
+     */
+    find(authorizerId) {
+        return this.authorizers.get(authorizerId);
+    }
+    /**
+     * Forget a deleted authorizer.
+     */
+    remove(authorizerId) {
+        this.authorizers.delete(authorizerId);
+    }
+    /**
+     * List every authorizer of this API, in the order they were created.
+     */
+    list() {
+        return this.authorizers.values().toArray();
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-store.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-store.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ;;OAEG;IACH,UAAU;QACR,IAAI,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAEhD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,mDAAmD;YACnD,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,UAAgC;QAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAsC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAoC;QACzC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer.d.ts

@@ -0,0 +1,74 @@
+import type { Brand } from "../../../../util/brand.type.js";
+/**
+ * The id API Gateway allocates for one authorizer.
+ */
+export type SimRestApiAuthorizerId = Brand<string, "SimRestApiAuthorizerId">;
+/**
+ * The kinds of authorizer a REST API has.
+ *
+ * A `TOKEN` authorizer sends one header's value to a Lambda function. A
+ * `REQUEST` authorizer sends the whole request to one instead, so it can
+ * identify a caller by several headers together or by the query string. Both
+ * do what the policy that function answers with says. A `COGNITO_USER_POOLS`
+ * authorizer invokes nothing and verifies the token against the user pools it
+ * names.
+ */
+export type SimRestApiAuthorizerType = "TOKEN" | "REQUEST" | "COGNITO_USER_POOLS";
+/**
+ * What `GetAuthorizer` reports for the family a Lambda authorizer belongs to.
+ *
+ * A `TOKEN` or `REQUEST` authorizer is `custom`.
+ */
+export declare const simRestApiCustomAuthType = "custom";
+/**
+ * What `GetAuthorizer` reports for the family a Cognito authorizer belongs to.
+ */
+export declare const simRestApiCognitoAuthType = "cognito_user_pools";
+/**
+ * Allocate an authorizer id, in the same opaque shape as a resource id.
+ */
+export declare function makeSimRestApiAuthorizerId(): SimRestApiAuthorizerId;
+/**
+ * Minimal structural authorizer view, as the Create and Get commands return.
+ *
+ * `authorizerUri`, `providerARNs` and `authorizerResultTtlInSeconds` belong to
+ * one kind of authorizer each, so each view carries the ones its kind has.
+ */
+export interface SimRestApiAuthorizerView {
+    id: string;
+    name: string;
+    type: SimRestApiAuthorizerType;
+    authType: string;
+    identitySource: string;
+    authorizerUri?: string;
+    providerARNs?: string[];
+    authorizerResultTtlInSeconds?: number;
+}
+interface SimRestApiAuthorizerProperties {
+    readonly authorizerId: SimRestApiAuthorizerId;
+    readonly name: string;
+}
+/**
+ * A simulated REST API authorizer: what a method sends a request through
+ * before it reaches the integration.
+ *
+ * An authorizer belongs to an API and is attached to methods by id, so one
+ * authorizer covers as many methods of the API as name it. What it does with
+ * a request is its kind's business, and that is all the subclasses are.
+ */
+export declare abstract class SimRestApiAuthorizer {
+    readonly authorizerId: SimRestApiAuthorizerId;
+    readonly name: string;
+    /**
+     * Which kind of authorizer this is, which is also what decides whether a
+     * method may name it.
+     */
+    abstract readonly type: SimRestApiAuthorizerType;
+    protected constructor(properties: SimRestApiAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    abstract view(): SimRestApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-authorizer.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAE5D;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,SAAS,GACT,oBAAoB,CAAC;AAEzB;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,sBAAsB,CAEnE;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,wBAAwB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,8BAAsB,oBAAoB;IACxC,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,kBAAyB,IAAI,EAAE,wBAAwB,CAAC;IAExD,SAAS,aAAa,UAAU,EAAE,8BAA8B,EAG/D;IAED;;OAEG;IACH,QAAQ,CAAC,IAAI,IAAI,wBAAwB,CAAC;CAC3C"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer.js

@@ -0,0 +1,34 @@
+import { faker } from "@faker-js/faker";
+/**
+ * What `GetAuthorizer` reports for the family a Lambda authorizer belongs to.
+ *
+ * A `TOKEN` or `REQUEST` authorizer is `custom`.
+ */
+export const simRestApiCustomAuthType = "custom";
+/**
+ * What `GetAuthorizer` reports for the family a Cognito authorizer belongs to.
+ */
+export const simRestApiCognitoAuthType = "cognito_user_pools";
+/**
+ * Allocate an authorizer id, in the same opaque shape as a resource id.
+ */
+export function makeSimRestApiAuthorizerId() {
+    return faker.helpers.fromRegExp(/[a-z0-9]{6}/);
+}
+/**
+ * A simulated REST API authorizer: what a method sends a request through
+ * before it reaches the integration.
+ *
+ * An authorizer belongs to an API and is attached to methods by id, so one
+ * authorizer covers as many methods of the API as name it. What it does with
+ * a request is its kind's business, and that is all the subclasses are.
+ */
+export class SimRestApiAuthorizer {
+    authorizerId;
+    name;
+    constructor(properties) {
+        this.authorizerId = properties.authorizerId;
+        this.name = properties.name;
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAwBxC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAA2B,CAAC;AAC3E,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,OAAgB,oBAAoB;IACxB,YAAY,CAAyB;IACrC,IAAI,CAAS;IAQ7B,YAAsB,UAA0C;QAC9D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,CAAC;CAMF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.d.ts

@@ -0,0 +1,42 @@
+import type { SimRestApiIdentitySource } from "./identity/sim-rest-api-identity-source.js";
+import { SimRestApiAuthorizer, type SimRestApiAuthorizerId, type SimRestApiAuthorizerView } from "./sim-rest-api-authorizer.js";
+import type { SimRestApiUserPoolProviders } from "./sim-rest-api-user-pool-providers.js";
+interface SimRestApiCognitoAuthorizerProperties {
+    readonly authorizerId: SimRestApiAuthorizerId;
+    readonly name: string;
+    readonly providers: SimRestApiUserPoolProviders;
+    readonly identitySource: SimRestApiIdentitySource;
+}
+/**
+ * A simulated REST API `COGNITO_USER_POOLS` authorizer: the user pools whose
+ * tokens a method admits.
+ *
+ * Nothing is invoked for a request. The authorizer verifies the token itself
+ * against the keys the pools publish, which is why it names pools where a
+ * Lambda authorizer names a function.
+ *
+ * What a token has to carry beyond a signature one of those pools made is the
+ * method's business rather than this one's: the scopes a method asks for are
+ * declared on the method, so one authorizer covers methods asking for
+ * different scopes.
+ */
+export declare class SimRestApiCognitoAuthorizer extends SimRestApiAuthorizer {
+    readonly type: "COGNITO_USER_POOLS";
+    /**
+     * The user pools this authorizer accepts tokens from, read from its
+     * `providerARNs`.
+     */
+    readonly providers: SimRestApiUserPoolProviders;
+    /**
+     * The header carrying the token, which is where the request is read from.
+     * There is one, as there is for a `TOKEN` authorizer.
+     */
+    readonly identitySource: SimRestApiIdentitySource;
+    constructor(properties: SimRestApiCognitoAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view(): SimRestApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-cognito-authorizer.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAEzF,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,2BAA4B,SAAQ,oBAAoB;IACnE,SAAgB,IAAI,EAAG,oBAAoB,CAAU;IAErD;;;OAGG;IACH,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IAEvD;;;OAGG;IACH,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IAEzD,YAAY,UAAU,EAAE,qCAAqC,EAI5D;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAS/B;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.js

@@ -0,0 +1,46 @@
+import { SimRestApiAuthorizer, simRestApiCognitoAuthType, } from "./sim-rest-api-authorizer.js";
+/**
+ * A simulated REST API `COGNITO_USER_POOLS` authorizer: the user pools whose
+ * tokens a method admits.
+ *
+ * Nothing is invoked for a request. The authorizer verifies the token itself
+ * against the keys the pools publish, which is why it names pools where a
+ * Lambda authorizer names a function.
+ *
+ * What a token has to carry beyond a signature one of those pools made is the
+ * method's business rather than this one's: the scopes a method asks for are
+ * declared on the method, so one authorizer covers methods asking for
+ * different scopes.
+ */
+export class SimRestApiCognitoAuthorizer extends SimRestApiAuthorizer {
+    type = "COGNITO_USER_POOLS";
+    /**
+     * The user pools this authorizer accepts tokens from, read from its
+     * `providerARNs`.
+     */
+    providers;
+    /**
+     * The header carrying the token, which is where the request is read from.
+     * There is one, as there is for a `TOKEN` authorizer.
+     */
+    identitySource;
+    constructor(properties) {
+        super(properties);
+        this.providers = properties.providers;
+        this.identitySource = properties.identitySource;
+    }
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view() {
+        return {
+            id: this.authorizerId,
+            name: this.name,
+            type: this.type,
+            authType: simRestApiCognitoAuthType,
+            providerARNs: [...this.providers.arns],
+            identitySource: this.identitySource.expression,
+        };
+    }
+}
+//# sourceMappingURL=sim-rest-api-cognito-authorizer.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EAGpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAUtC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,2BAA4B,SAAQ,oBAAoB;IACnD,IAAI,GAAG,oBAA6B,CAAC;IAErD;;;OAGG;IACa,SAAS,CAA8B;IAEvD;;;OAGG;IACa,cAAc,CAA2B;IAEzD,YAAY,UAAiD;QAC3D,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,yBAAyB;YACnC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACtC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.d.ts

@@ -0,0 +1,61 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimRestApiMethodScopes } from "../method/sim-rest-api-method-scopes.js";
+import { type SimRestApiAuthorization } from "./sim-rest-api-authorization.js";
+import type { SimRestApiCognitoAuthorizer } from "./sim-rest-api-cognito-authorizer.js";
+import type { SimRestApiUserPools } from "./sim-rest-api-user-pools.js";
+interface SimRestApiCognitoVerificationProperties {
+    readonly userPools: SimRestApiUserPools;
+    readonly clock: SimClock;
+}
+/**
+ * Verifies one token against one `COGNITO_USER_POOLS` authorizer.
+ *
+ * The checks are the ones a JWT verifier makes: decode the token, check its
+ * algorithm, find the pool publishing the key its `kid` names, verify the
+ * signature, then check the claims. Every one of them answers the same 401, so
+ * a client learns that its token was not accepted and nothing about which
+ * check it failed.
+ *
+ * `token_use` is not checked, so an id token and an access token are both
+ * accepted by a method asking for no scope. The method's scopes are the one
+ * thing that tells the two apart, since only an access token carries a `scope`
+ * claim, and they are checked here because they are checked against the token.
+ */
+export declare class SimRestApiCognitoVerification {
+    private readonly userPools;
+    private readonly times;
+    private readonly rs256;
+    constructor(properties: SimRestApiCognitoVerificationProperties);
+    /**
+     * Verify a token, answering what the method should do with the request that
+     * carried it.
+     */
+    verify(authorizer: SimRestApiCognitoAuthorizer, token: string, scopes: SimRestApiMethodScopes): SimRestApiAuthorization;
+    /**
+     * The request once the token is known to be genuine, which the method's
+     * scopes can still refuse.
+     *
+     * An unmet scope is a 403 rather than a 401: the token was accepted, and it
+     * does not allow this method. It is the same refusal a policy allowing
+     * nothing relevant gets, since both are a caller API Gateway identified and
+     * then would not admit.
+     */
+    private admitted;
+    /**
+     * The pool of this authorizer that published the key the token names.
+     *
+     * A pool the simulation has not got publishes nothing and matches nothing,
+     * which is what makes an authorizer naming a deleted pool refuse every
+     * token rather than admit one it could not check.
+     */
+    private signingPool;
+    /**
+     * Read the token, or answer undefined for one that is not a JWT at all.
+     *
+     * The refusal for an unreadable token and for one that fails verification is
+     * the same, so nothing is gained by carrying the parse error further.
+     */
+    private decode;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-cognito-verification.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-verification.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAOpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAUD;;;;;;;;;;;;;GAaG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;;OAGG;IACH,MAAM,CACJ,UAAU,EAAE,2BAA2B,EACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,sBAAsB,GAC7B,uBAAuB,CAqBzB;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ;IAahB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAgBnB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;CAOf"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.js

@@ -0,0 +1,97 @@
+import { simJwtClaimStrings } from "../../../../util/jwt/sim-jwt-claim-strings.js";
+import { SimJwtRs256 } from "../../../../util/jwt/sim-jwt-rs256.js";
+import { simJwtScopes } from "../../../../util/jwt/sim-jwt-scopes.js";
+import { SimJwtTimeClaims } from "../../../../util/jwt/sim-jwt-time-claims.js";
+import { SimJwt } from "../../../../util/jwt/sim-jwt.js";
+import { SimRestApiAdmitted, SimRestApiRefused, } from "./sim-rest-api-authorization.js";
+/**
+ * Verifies one token against one `COGNITO_USER_POOLS` authorizer.
+ *
+ * The checks are the ones a JWT verifier makes: decode the token, check its
+ * algorithm, find the pool publishing the key its `kid` names, verify the
+ * signature, then check the claims. Every one of them answers the same 401, so
+ * a client learns that its token was not accepted and nothing about which
+ * check it failed.
+ *
+ * `token_use` is not checked, so an id token and an access token are both
+ * accepted by a method asking for no scope. The method's scopes are the one
+ * thing that tells the two apart, since only an access token carries a `scope`
+ * claim, and they are checked here because they are checked against the token.
+ */
+export class SimRestApiCognitoVerification {
+    userPools;
+    times;
+    rs256 = new SimJwtRs256();
+    constructor(properties) {
+        this.userPools = properties.userPools;
+        this.times = new SimJwtTimeClaims({ clock: properties.clock });
+    }
+    /**
+     * Verify a token, answering what the method should do with the request that
+     * carried it.
+     */
+    verify(authorizer, token, scopes) {
+        const jwt = this.decode(token);
+        if (jwt === undefined || !this.rs256.isSupportedAlgorithm(jwt)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const signing = this.signingPool(authorizer, jwt);
+        if (signing === undefined || !this.rs256.verify(jwt, signing.key)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        if (jwt.claims.text("iss") !== signing.pool.issuerUrl ||
+            !this.times.hold(jwt.claims)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        return this.admitted(jwt, scopes);
+    }
+    /**
+     * The request once the token is known to be genuine, which the method's
+     * scopes can still refuse.
+     *
+     * An unmet scope is a 403 rather than a 401: the token was accepted, and it
+     * does not allow this method. It is the same refusal a policy allowing
+     * nothing relevant gets, since both are a caller API Gateway identified and
+     * then would not admit.
+     */
+    admitted(jwt, scopes) {
+        if (!scopes.permits(simJwtScopes(jwt.claims))) {
+            return SimRestApiRefused.implicitDeny();
+        }
+        return new SimRestApiAdmitted({
+            cognito: { claims: simJwtClaimStrings(jwt.claims) },
+        });
+    }
+    /**
+     * The pool of this authorizer that published the key the token names.
+     *
+     * A pool the simulation has not got publishes nothing and matches nothing,
+     * which is what makes an authorizer naming a deleted pool refuse every
+     * token rather than admit one it could not check.
+     */
+    signingPool(authorizer, jwt) {
+        for (const userPoolId of authorizer.providers.userPoolIds) {
+            const pool = this.userPools.find(userPoolId);
+            const key = pool?.keys.find(jwt.header.kid);
+            if (pool !== undefined && key !== undefined) {
+                return { pool, key };
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Read the token, or answer undefined for one that is not a JWT at all.
+     *
+     * The refusal for an unreadable token and for one that fails verification is
+     * the same, so nothing is gained by carrying the parse error further.
+     */
+    decode(token) {
+        try {
+            return SimJwt.parse(token);
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=sim-rest-api-cognito-verification.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-verification.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AAEnF,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAoBzC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,6BAA6B;IACvB,SAAS,CAAsB;IAC/B,KAAK,CAAmB;IACxB,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAE3C,YAAY,UAAmD;QAC7D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,UAAuC,EACvC,KAAa,EACb,MAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAElD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IACE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,SAAS;YACjD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAC5B,CAAC;YACD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CACd,GAAW,EACX,MAA8B;QAE9B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CACjB,UAAuC,EACvC,GAAW;QAEX,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}