@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/wafv2/association/sim-waf-protected-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resources.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resources.ts"],"names":[],"mappings":"AAgBA;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,GAAG;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-protection.d.ts

@@ -0,0 +1,60 @@
+import type { SimWafDecision } from "../evaluate/sim-waf-decision.js";
+/**
+ * One request put to whatever web ACL is in front of the resource it reached.
+ */
+export interface SimWafProtectedRequest {
+    /** The resource the request reached, by ARN. */
+    readonly resourceArn: string;
+    readonly request: Request;
+    /**
+     * The request body, when the rules might inspect it. A request body is a
+     * stream that cannot be read twice, so it is passed in already buffered.
+     */
+    readonly body?: Uint8Array | undefined;
+}
+/**
+ * The web ACLs a fronting service's resources are protected by.
+ *
+ * A service serving a request asks this what the web ACL in front of the
+ * resource decided, and tells it when a resource is deleted. That is how API
+ * Gateway reaches simulated WAFv2 without depending on it.
+ */
+export interface SimWafProtection {
+    /**
+     * Whether a web ACL is in front of one resource.
+     *
+     * Asked before a request is put to a web ACL, because inspecting one means
+     * buffering its body and a resource with no web ACL has no reason to.
+     */
+    protects(resourceArn: string): boolean;
+    /**
+     * What the web ACL in front of one resource decides about a request, or
+     * nothing when no web ACL is in front of it.
+     */
+    decide(request: SimWafProtectedRequest): SimWafDecision | undefined;
+    /**
+     * Forget whatever protects a resource, as deleting the resource does.
+     */
+    release(resourceArn: string): void;
+}
+/**
+ * The protection available to a service with no WAFv2 to ask.
+ *
+ * Nothing is in front of anything, so a standalone simulated API Gateway
+ * serves every request the way it did before web ACLs existed.
+ */
+export declare class SimWafNoProtection implements SimWafProtection {
+    /**
+     * Nothing is protected here.
+     */
+    protects(): boolean;
+    /**
+     * No web ACL decides anything here.
+     */
+    decide(): undefined;
+    /**
+     * There is nothing held against a resource to let go of.
+     */
+    release(): void;
+}
+//# sourceMappingURL=sim-waf-protection.d.ts.map

package/dist/service/wafv2/association/sim-waf-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protection.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAEvC;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,GAAG,SAAS,CAAC;IAEpE;;OAEG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,gBAAgB;IACzD;;OAEG;IACH,QAAQ,IAAI,OAAO,CAElB;IAED;;OAEG;IACH,MAAM,IAAI,SAAS,CAElB;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAEd;CACF"}

package/dist/service/wafv2/association/sim-waf-protection.js

@@ -0,0 +1,27 @@
+/**
+ * The protection available to a service with no WAFv2 to ask.
+ *
+ * Nothing is in front of anything, so a standalone simulated API Gateway
+ * serves every request the way it did before web ACLs existed.
+ */
+export class SimWafNoProtection {
+    /**
+     * Nothing is protected here.
+     */
+    protects() {
+        return false;
+    }
+    /**
+     * No web ACL decides anything here.
+     */
+    decide() {
+        return;
+    }
+    /**
+     * There is nothing held against a resource to let go of.
+     */
+    release() {
+        return;
+    }
+}
+//# sourceMappingURL=sim-waf-protection.js.map

package/dist/service/wafv2/association/sim-waf-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protection.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protection.ts"],"names":[],"mappings":"AA8CA;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACH,QAAQ;QACN,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO;IACT,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO;IACT,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-request-inspection.d.ts

@@ -0,0 +1,48 @@
+import type { SimWafProtection } from "./sim-waf-protection.js";
+interface SimWafInspectionInput {
+    /** The web ACLs the fronting service's resources are protected by. */
+    readonly protection: SimWafProtection;
+    /** The resource the request reached, by ARN. */
+    readonly resourceArn: string;
+    readonly request: Request;
+    /**
+     * Whether the fronting service forwards the request body to AWS WAF.
+     *
+     * API Gateway forwards it. Cognito forwards it for the user pool API and not
+     * for managed login, so a rule inspecting the body of a hosted domain
+     * request matches nothing, as it matches nothing on AWS.
+     */
+    readonly forwardBody: boolean;
+}
+interface SimWafInspectedProperties {
+    readonly request: Request;
+    readonly blocked?: Response | undefined;
+}
+/**
+ * What the web ACL in front of a resource left of one request.
+ *
+ * A blocked request has a response to send and goes no further. An allowed one
+ * carries on, as the request the rules asked for rather than the one that
+ * arrived, since a rule can add headers to what is forwarded.
+ */
+export declare class SimWafInspected {
+    readonly request: Request;
+    readonly blocked: Response | undefined;
+    constructor(properties: SimWafInspectedProperties);
+}
+/**
+ * Puts a served request to the web ACL in front of the resource it reached.
+ *
+ * This is the serving half of an association, shared by every service that
+ * answers HTTP requests for a protected resource. What differs between them is
+ * where the resource ARN comes from and whether the body is forwarded, so both
+ * are asked for rather than worked out here.
+ */
+export declare class SimWafRequestInspection {
+    /**
+     * Put one request to whatever protects the resource it addressed.
+     */
+    inspect(input: SimWafInspectionInput): Promise<SimWafInspected>;
+}
+export {};
+//# sourceMappingURL=sim-waf-request-inspection.d.ts.map

package/dist/service/wafv2/association/sim-waf-request-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-request-inspection.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-request-inspection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,UAAU,qBAAqB;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;GAMG;AACH,qBAAa,eAAe;IAC1B,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE9C,YAAY,UAAU,EAAE,yBAAyB,EAGhD;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC;;OAEG;IACG,OAAO,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuBpE;CACF"}

package/dist/service/wafv2/association/sim-waf-request-inspection.js

@@ -0,0 +1,77 @@
+import { simWafBlockedHttpResponse } from "../evaluate/sim-waf-blocked-response.js";
+/**
+ * What the web ACL in front of a resource left of one request.
+ *
+ * A blocked request has a response to send and goes no further. An allowed one
+ * carries on, as the request the rules asked for rather than the one that
+ * arrived, since a rule can add headers to what is forwarded.
+ */
+export class SimWafInspected {
+    request;
+    blocked;
+    constructor(properties) {
+        this.request = properties.request;
+        this.blocked = properties.blocked;
+    }
+}
+/**
+ * Puts a served request to the web ACL in front of the resource it reached.
+ *
+ * This is the serving half of an association, shared by every service that
+ * answers HTTP requests for a protected resource. What differs between them is
+ * where the resource ARN comes from and whether the body is forwarded, so both
+ * are asked for rather than worked out here.
+ */
+export class SimWafRequestInspection {
+    /**
+     * Put one request to whatever protects the resource it addressed.
+     */
+    async inspect(input) {
+        const { protection, resourceArn, request } = input;
+        if (!protection.protects(resourceArn)) {
+            return new SimWafInspected({ request });
+        }
+        const body = input.forwardBody ? await inspectedBody(request) : undefined;
+        const decision = protection.decide({ resourceArn, request, body });
+        // A decision carries a blocked response when its action was to block, and
+        // carries none when the request was allowed. That one reading is what
+        // decides the request here.
+        if (decision?.blocked !== undefined) {
+            return new SimWafInspected({
+                request,
+                blocked: simWafBlockedHttpResponse(decision.blocked),
+            });
+        }
+        return new SimWafInspected({
+            request: forwarded(request, decision?.insertedHeaders ?? []),
+        });
+    }
+}
+/**
+ * The request body a web ACL's rules are matched against.
+ *
+ * The request is cloned rather than read, so whatever the request goes on to
+ * reach still has a body to send.
+ */
+async function inspectedBody(request) {
+    const buffered = new Uint8Array(await request.clone().arrayBuffer());
+    return buffered.byteLength === 0 ? undefined : buffered;
+}
+/**
+ * The request as the web ACL asked for it to be forwarded.
+ *
+ * A rule with custom request handling adds headers to what reaches the origin.
+ * Only the headers are replaced, so the body carries over as the stream it
+ * arrived as: inspection read a clone of it rather than the request itself.
+ */
+function forwarded(request, insertedHeaders) {
+    if (insertedHeaders.length === 0) {
+        return request;
+    }
+    const headers = new Headers(request.headers);
+    for (const header of insertedHeaders) {
+        headers.set(header.name, header.value);
+    }
+    return new Request(request, { headers });
+}
+//# sourceMappingURL=sim-waf-request-inspection.js.map

package/dist/service/wafv2/association/sim-waf-request-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-request-inspection.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-request-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AA4BpF;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IACV,OAAO,CAAU;IACjB,OAAO,CAAuB;IAE9C,YAAY,UAAqC;QAC/C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,KAA4B;QACxC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEnE,0EAA0E;QAC1E,sEAAsE;QACtE,4BAA4B;QAC5B,IAAI,QAAQ,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAI,eAAe,CAAC;gBACzB,OAAO;gBACP,OAAO,EAAE,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,eAAe,CAAC;YACzB,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,OAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAErE,OAAO,QAAQ,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAChB,OAAgB,EAChB,eAAwC;IAExC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/service/wafv2/association/sim-waf-rest-api-stage.d.ts

@@ -0,0 +1,29 @@
+interface SimWafRestApiStageProperties {
+    readonly arn: string;
+    readonly regionName: string;
+    readonly restApiId: string;
+    readonly stageName: string;
+}
+/**
+ * One API Gateway REST API stage, as the ARN an association names it by.
+ *
+ * The ARN is written `arn:aws:apigateway:<region>::/restapis/<id>/stages/<name>`
+ * and carries no Account.
+ */
+export declare class SimWafRestApiStage {
+    /** The type this resource is listed under by ListResourcesForWebACL. */
+    readonly resourceType = "API_GATEWAY";
+    /**
+     * The Account the stage is in, which its ARN does not name. A web ACL and
+     * the resource it protects are in the same Account on AWS, so the Account is
+     * the one the WAFv2 handling the request belongs to.
+     */
+    readonly accountId: string | undefined;
+    readonly arn: string;
+    readonly regionName: string;
+    readonly restApiId: string;
+    readonly stageName: string;
+    constructor(properties: SimWafRestApiStageProperties);
+}
+export {};
+//# sourceMappingURL=sim-waf-rest-api-stage.d.ts.map

package/dist/service/wafv2/association/sim-waf-rest-api-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rest-api-stage.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-rest-api-stage.ts"],"names":[],"mappings":"AAAA,UAAU,4BAA4B;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B,wEAAwE;IACxE,SAAgB,YAAY,iBAAiB;IAE7C;;;;OAIG;IACH,SAAgB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAa;IAE1D,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC,YAAY,UAAU,EAAE,4BAA4B,EAKnD;CACF"}

package/dist/service/wafv2/association/sim-waf-rest-api-stage.js

@@ -0,0 +1,27 @@
+/**
+ * One API Gateway REST API stage, as the ARN an association names it by.
+ *
+ * The ARN is written `arn:aws:apigateway:<region>::/restapis/<id>/stages/<name>`
+ * and carries no Account.
+ */
+export class SimWafRestApiStage {
+    /** The type this resource is listed under by ListResourcesForWebACL. */
+    resourceType = "API_GATEWAY";
+    /**
+     * The Account the stage is in, which its ARN does not name. A web ACL and
+     * the resource it protects are in the same Account on AWS, so the Account is
+     * the one the WAFv2 handling the request belongs to.
+     */
+    accountId = undefined;
+    arn;
+    regionName;
+    restApiId;
+    stageName;
+    constructor(properties) {
+        this.arn = properties.arn;
+        this.regionName = properties.regionName;
+        this.restApiId = properties.restApiId;
+        this.stageName = properties.stageName;
+    }
+}
+//# sourceMappingURL=sim-waf-rest-api-stage.js.map

package/dist/service/wafv2/association/sim-waf-rest-api-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rest-api-stage.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-rest-api-stage.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAC7B,wEAAwE;IACxD,YAAY,GAAG,aAAa,CAAC;IAE7C;;;;OAIG;IACa,SAAS,GAAuB,SAAS,CAAC;IAE1C,GAAG,CAAS;IACZ,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,SAAS,CAAS;IAElC,YAAY,UAAwC;QAClD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-user-pool.d.ts

@@ -0,0 +1,24 @@
+interface SimWafUserPoolProperties {
+    readonly arn: string;
+    readonly regionName: string;
+    readonly accountId: string;
+    readonly userPoolId: string;
+}
+/**
+ * One Cognito user pool, as the ARN an association names it by.
+ *
+ * The ARN is written `arn:aws:cognito-idp:<region>:<account>:userpool/<pool-id>`
+ * and names both the Account and the Region, where a REST API stage ARN names
+ * neither. The pool id repeats the Region, as a real pool id does.
+ */
+export declare class SimWafUserPool {
+    /** The type this resource is listed under by ListResourcesForWebACL. */
+    readonly resourceType = "COGNITO_USER_POOL";
+    readonly arn: string;
+    readonly regionName: string;
+    readonly accountId: string;
+    readonly userPoolId: string;
+    constructor(properties: SimWafUserPoolProperties);
+}
+export {};
+//# sourceMappingURL=sim-waf-user-pool.d.ts.map

package/dist/service/wafv2/association/sim-waf-user-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-user-pool.ts"],"names":[],"mappings":"AAAA,UAAU,wBAAwB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,wEAAwE;IACxE,SAAgB,YAAY,uBAAuB;IAEnD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,YAAY,UAAU,EAAE,wBAAwB,EAK/C;CACF"}

package/dist/service/wafv2/association/sim-waf-user-pool.js

@@ -0,0 +1,22 @@
+/**
+ * One Cognito user pool, as the ARN an association names it by.
+ *
+ * The ARN is written `arn:aws:cognito-idp:<region>:<account>:userpool/<pool-id>`
+ * and names both the Account and the Region, where a REST API stage ARN names
+ * neither. The pool id repeats the Region, as a real pool id does.
+ */
+export class SimWafUserPool {
+    /** The type this resource is listed under by ListResourcesForWebACL. */
+    resourceType = "COGNITO_USER_POOL";
+    arn;
+    regionName;
+    accountId;
+    userPoolId;
+    constructor(properties) {
+        this.arn = properties.arn;
+        this.regionName = properties.regionName;
+        this.accountId = properties.accountId;
+        this.userPoolId = properties.userPoolId;
+    }
+}
+//# sourceMappingURL=sim-waf-user-pool.js.map

package/dist/service/wafv2/association/sim-waf-user-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-user-pool.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-user-pool.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACzB,wEAAwE;IACxD,YAAY,GAAG,mBAAmB,CAAC;IAEnC,GAAG,CAAS;IACZ,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,UAAU,CAAS;IAEnC,YAAY,UAAoC;QAC9C,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-config.d.ts

@@ -0,0 +1,23 @@
+import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
+/**
+ * Reads an AWS::WAFv2::WebACLAssociation Resource into the two ARNs it names.
+ *
+ * Both are required, and neither is read for what it names. `ResourceArn` goes
+ * to AssociateWebACL as the template wrote it, so a REST API stage and a user
+ * pool are resolved by the same reader an SDK caller's association goes
+ * through, and an ARN naming something WAF does not protect — or something
+ * Yulin does not simulate — is refused there with the reason it gives.
+ */
+export declare class SimCfnWafAssociationConfig extends SimCfnWafResourceConfig {
+    protected get resourceType(): string;
+    /**
+     * The resource the web ACL is put in front of.
+     */
+    resourceArn(): string;
+    /**
+     * The web ACL to put in front of it.
+     */
+    webAclArn(): string;
+    private required;
+}
+//# sourceMappingURL=sim-cfn-waf-association-config.d.ts.map

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-association-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/association/sim-cfn-waf-association-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAG5E;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,uBAAuB;IACrE,cAAuB,YAAY,IAAI,MAAM,CAE5C;IAED;;OAEG;IACH,WAAW,IAAI,MAAM,CAEpB;IAED;;OAEG;IACH,SAAS,IAAI,MAAM,CAElB;IAED,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-config.js

@@ -0,0 +1,32 @@
+import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
+import { wafWebAclAssociationResourceType } from "../sim-cfn-waf-resource-types.js";
+/**
+ * Reads an AWS::WAFv2::WebACLAssociation Resource into the two ARNs it names.
+ *
+ * Both are required, and neither is read for what it names. `ResourceArn` goes
+ * to AssociateWebACL as the template wrote it, so a REST API stage and a user
+ * pool are resolved by the same reader an SDK caller's association goes
+ * through, and an ARN naming something WAF does not protect — or something
+ * Yulin does not simulate — is refused there with the reason it gives.
+ */
+export class SimCfnWafAssociationConfig extends SimCfnWafResourceConfig {
+    get resourceType() {
+        return wafWebAclAssociationResourceType;
+    }
+    /**
+     * The resource the web ACL is put in front of.
+     */
+    resourceArn() {
+        return this.required("ResourceArn");
+    }
+    /**
+     * The web ACL to put in front of it.
+     */
+    webAclArn() {
+        return this.required("WebACLArn");
+    }
+    required(key) {
+        return this.text(key) ?? this.refuse(`${key} is required`);
+    }
+}
+//# sourceMappingURL=sim-cfn-waf-association-config.js.map

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-association-config.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/association/sim-cfn-waf-association-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,uBAAuB;IACrE,IAAuB,YAAY;QACjC,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAEO,QAAQ,CAAC,GAAW;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.d.ts

@@ -0,0 +1,42 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimWafV2 } from "../../sim-wafv2.js";
+import { SimWafCfnWebAclAssociation } from "./sim-cfn-waf-web-acl-association.js";
+interface SimCfnWafAssociationCreatorProperties {
+    readonly wafV2: SimWafV2;
+}
+/**
+ * Puts a web ACL in front of a resource from an AWS::WAFv2::WebACLAssociation
+ * Resource.
+ *
+ * The association is made through AssociateWebACL and taken off through
+ * DisassociateWebACL, so a template gets the same association an SDK caller
+ * gets, and the same refusals: a resource type WAF does not protect, a
+ * resource this simulation does not hold, and a `CLOUDFRONT` scope web ACL,
+ * which reaches a distribution through the distribution's own `WebACLId`
+ * rather than through an association.
+ */
+export declare class SimCfnWafAssociationCreator {
+    #private;
+    constructor(properties: SimCfnWafAssociationCreatorProperties);
+    /**
+     * Make the association an AWS::WAFv2::WebACLAssociation Resource describes.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimWafCfnWebAclAssociation>;
+    /**
+     * Take the association an AWS::WAFv2::WebACLAssociation Resource made off
+     * again.
+     *
+     * The web ACL and the resource are both left as they are. Deleting the
+     * association is only ever about the association, which is why a teardown
+     * reaches it before the web ACL it names.
+     *
+     * A stage or a user pool that has gone already is not an error. A template
+     * whose `ResourceArn` is a literal rather than a reference gives
+     * CloudFormation no reason to bring the association down first, and deleting
+     * the stage took the association with it, so there is nothing left to undo.
+     */
+    delete(resource: SimCfnResource, association: SimWafCfnWebAclAssociation): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-waf-association-creator.d.ts.map

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-association-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/association/sim-cfn-waf-association-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAInD,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAElF,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,2BAA2B;;IAGtC,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAqBrC;IAED;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,0BAA0B,GACtC,OAAO,CAAC,IAAI,CAAC,CAgBf;CACF"}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.js

@@ -0,0 +1,69 @@
+import { SimWafUnavailableEntityException } from "../../error/sim-wafv2.error.js";
+import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { wafWebAclAssociationResourceType } from "../sim-cfn-waf-resource-types.js";
+import { SimCfnWafAssociationConfig } from "./sim-cfn-waf-association-config.js";
+import { SimWafCfnWebAclAssociation } from "./sim-cfn-waf-web-acl-association.js";
+/**
+ * Puts a web ACL in front of a resource from an AWS::WAFv2::WebACLAssociation
+ * Resource.
+ *
+ * The association is made through AssociateWebACL and taken off through
+ * DisassociateWebACL, so a template gets the same association an SDK caller
+ * gets, and the same refusals: a resource type WAF does not protect, a
+ * resource this simulation does not hold, and a `CLOUDFRONT` scope web ACL,
+ * which reaches a distribution through the distribution's own `WebACLId`
+ * rather than through an association.
+ */
+export class SimCfnWafAssociationCreator {
+    #wafV2;
+    constructor(properties) {
+        this.#wafV2 = properties.wafV2;
+    }
+    /**
+     * Make the association an AWS::WAFv2::WebACLAssociation Resource describes.
+     */
+    async create(resource, properties) {
+        const config = new SimCfnWafAssociationConfig({ resource, properties });
+        const association = new SimWafCfnWebAclAssociation({
+            resourceArn: config.resourceArn(),
+            webAclArn: config.webAclArn(),
+        });
+        return await simCfnWafResourceCommand(wafWebAclAssociationResourceType, resource.logicalId, async () => {
+            await this.#wafV2.associateWebAcl({
+                input: {
+                    ResourceArn: association.resourceArn,
+                    WebACLArn: association.webAclArn,
+                },
+            });
+            return association;
+        });
+    }
+    /**
+     * Take the association an AWS::WAFv2::WebACLAssociation Resource made off
+     * again.
+     *
+     * The web ACL and the resource are both left as they are. Deleting the
+     * association is only ever about the association, which is why a teardown
+     * reaches it before the web ACL it names.
+     *
+     * A stage or a user pool that has gone already is not an error. A template
+     * whose `ResourceArn` is a literal rather than a reference gives
+     * CloudFormation no reason to bring the association down first, and deleting
+     * the stage took the association with it, so there is nothing left to undo.
+     */
+    async delete(resource, association) {
+        await simCfnWafResourceCommand(wafWebAclAssociationResourceType, resource.logicalId, async () => {
+            try {
+                await this.#wafV2.disassociateWebAcl({
+                    input: { ResourceArn: association.resourceArn },
+                });
+            }
+            catch (error) {
+                if (!(error instanceof SimWafUnavailableEntityException)) {
+                    throw error;
+                }
+            }
+        });
+    }
+}
+//# sourceMappingURL=sim-cfn-waf-association-creator.js.map

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-association-creator.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/association/sim-cfn-waf-association-creator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAMlF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,2BAA2B;IAC7B,MAAM,CAAW;IAE1B,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,MAAM,GAAG,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC;YACjD,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;SAC9B,CAAC,CAAC;QAEH,OAAO,MAAM,wBAAwB,CACnC,gCAAgC,EAChC,QAAQ,CAAC,SAAS,EAClB,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;gBAChC,KAAK,EAAE;oBACL,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,SAAS,EAAE,WAAW,CAAC,SAAS;iBACjC;aACF,CAAC,CAAC;YAEH,OAAO,WAAW,CAAC;QACrB,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,WAAuC;QAEvC,MAAM,wBAAwB,CAC5B,gCAAgC,EAChC,QAAQ,CAAC,SAAS,EAClB,KAAK,IAAI,EAAE;YACT,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACnC,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;iBAChD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,gCAAgC,CAAC,EAAE,CAAC;oBACzD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-web-acl-association.d.ts

@@ -0,0 +1,18 @@
+/**
+ * One AWS::WAFv2::WebACLAssociation Resource, as CloudFormation holds it.
+ *
+ * WAFv2 keeps an association against the resource it protects rather than as a
+ * thing of its own, so there is nothing in the service for a deployed Resource
+ * to point at. This is what CloudFormation holds instead: the two ARNs the
+ * Resource named, which is what teardown needs to take the association off
+ * again and what `Ref` answers with.
+ */
+export declare class SimWafCfnWebAclAssociation {
+    readonly resourceArn: string;
+    readonly webAclArn: string;
+    constructor(properties: {
+        readonly resourceArn: string;
+        readonly webAclArn: string;
+    });
+}
+//# sourceMappingURL=sim-cfn-waf-web-acl-association.d.ts.map

package/dist/service/wafv2/cfn/association/sim-cfn-waf-web-acl-association.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-web-acl-association.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/association/sim-cfn-waf-web-acl-association.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,0BAA0B;IACrC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC,YAAY,UAAU,EAAE;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,EAGA;CACF"}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-web-acl-association.js

@@ -0,0 +1,18 @@
+/**
+ * One AWS::WAFv2::WebACLAssociation Resource, as CloudFormation holds it.
+ *
+ * WAFv2 keeps an association against the resource it protects rather than as a
+ * thing of its own, so there is nothing in the service for a deployed Resource
+ * to point at. This is what CloudFormation holds instead: the two ARNs the
+ * Resource named, which is what teardown needs to take the association off
+ * again and what `Ref` answers with.
+ */
+export class SimWafCfnWebAclAssociation {
+    resourceArn;
+    webAclArn;
+    constructor(properties) {
+        this.resourceArn = properties.resourceArn;
+        this.webAclArn = properties.webAclArn;
+    }
+}
+//# sourceMappingURL=sim-cfn-waf-web-acl-association.js.map

package/dist/service/wafv2/cfn/association/sim-cfn-waf-web-acl-association.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-web-acl-association.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/association/sim-cfn-waf-web-acl-association.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA0B;IACrB,WAAW,CAAS;IACpB,SAAS,CAAS;IAElC,YAAY,UAGX;QACC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;CACF"}

package/dist/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-config.d.ts

@@ -0,0 +1,18 @@
+import type { SimCreateIpSetCommandInput } from "../../command/ip-set/ip-set.command.js";
+import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
+/**
+ * Reads an AWS::WAFv2::IPSet Resource into what CreateIPSet takes.
+ *
+ * Both properties of a set are required by the CloudFormation schema, so one
+ * missing is a template AWS refuses before an IP set is reached. They are
+ * handed over as the template wrote them and checked by CreateIPSet, which is
+ * where an address that is not CIDR notation is refused.
+ */
+export declare class SimCfnWafIpSetConfig extends SimCfnWafResourceConfig {
+    protected get resourceType(): string;
+    /**
+     * The input the IP set this Resource describes is created from.
+     */
+    createInput(): SimCreateIpSetCommandInput;
+}
+//# sourceMappingURL=sim-cfn-waf-ip-set-config.d.ts.map

package/dist/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-ip-set-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAG5E;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,uBAAuB;IAC/D,cAAuB,YAAY,IAAI,MAAM,CAE5C;IAED;;OAEG;IACH,WAAW,IAAI,0BAA0B,CAQxC;CACF"}