@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/apigateway/openapi/sim-rest-api-openapi-refusal.d.ts

@@ -0,0 +1,15 @@
+import { SimApiGatewayBadRequest } from "../error/sim-api-gateway.error.js";
+import type { SimRestApiOpenApiPointer } from "./sim-rest-api-openapi-pointer.js";
+/**
+ * Refuse a member of the document being imported, naming where it is.
+ *
+ * Every refusal an import makes is one of these, including the ones the
+ * ordinary commands make about an input the document produced, so a reader
+ * always has a pointer to follow into their own document.
+ *
+ * The wording names the import rather than the command, because `ImportRestApi`,
+ * `PutRestApi` and a `Body` on an `AWS::ApiGateway::RestApi` all reach this
+ * with the same document and the same refusals.
+ */
+export declare function simRestApiOpenApiRefusal(pointer: SimRestApiOpenApiPointer, reason: string): SimApiGatewayBadRequest;
+//# sourceMappingURL=sim-rest-api-openapi-refusal.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-refusal.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,MAAM,GACb,uBAAuB,CAIzB"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-refusal.js

@@ -0,0 +1,16 @@
+import { SimApiGatewayBadRequest } from "../error/sim-api-gateway.error.js";
+/**
+ * Refuse a member of the document being imported, naming where it is.
+ *
+ * Every refusal an import makes is one of these, including the ones the
+ * ordinary commands make about an input the document produced, so a reader
+ * always has a pointer to follow into their own document.
+ *
+ * The wording names the import rather than the command, because `ImportRestApi`,
+ * `PutRestApi` and a `Body` on an `AWS::ApiGateway::RestApi` all reach this
+ * with the same document and the same refusals.
+ */
+export function simRestApiOpenApiRefusal(pointer, reason) {
+    return new SimApiGatewayBadRequest(`Importing an OpenAPI document refused ${pointer.toString()}: ${reason}`);
+}
+//# sourceMappingURL=sim-rest-api-openapi-refusal.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-refusal.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAG5E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAiC,EACjC,MAAc;IAEd,OAAO,IAAI,uBAAuB,CAChC,yCAAyC,OAAO,CAAC,QAAQ,EAAE,KAAK,MAAM,EAAE,CACzE,CAAC;AACJ,CAAC"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-replacement.d.ts

@@ -0,0 +1,45 @@
+import type { SimRestApi } from "../api/sim-rest-api.js";
+import type { SimRestApiAuthorizerCommands } from "../command/authorizer/sim-rest-api-authorizer-commands.js";
+import type { SimRestApiResourceCommands } from "../command/resource/sim-rest-api-resource-commands.js";
+import type { SimRestApiOpenApiDocument } from "./sim-rest-api-openapi-document.js";
+import type { SimRestApiOpenApiImport } from "./sim-rest-api-openapi-import.js";
+interface SimRestApiOpenApiReplacementProperties {
+    readonly resourceCommands: SimRestApiResourceCommands;
+    readonly authorizerCommands: SimRestApiAuthorizerCommands;
+    readonly openApiImport: SimRestApiOpenApiImport;
+}
+/**
+ * Replaces an API's whole definition with the one a document declares, which
+ * is what `PutRestApi` in overwrite mode asks for.
+ *
+ * The API itself stays, so its id, its endpoint and the stages serving it all
+ * survive the replacement.
+ */
+export declare class SimRestApiOpenApiReplacement {
+    private readonly resourceCommands;
+    private readonly authorizerCommands;
+    private readonly openApiImport;
+    constructor(properties: SimRestApiOpenApiReplacementProperties);
+    /**
+     * Put a document over an API's existing definition.
+     *
+     * A refused document leaves the API with an empty path tree rather than with
+     * the half of it that was read before the refusal. The API is then plainly
+     * serving nothing, which is what the next request to it says, where a
+     * half-replaced one would answer some paths and not others.
+     */
+    over(restApi: SimRestApi, document: SimRestApiOpenApiDocument): void;
+    /**
+     * Delete the whole definition, through the ordinary commands.
+     *
+     * Only the resources directly under the root are named, because deleting one
+     * takes its subtree with it. The root itself stays, since every REST API has
+     * one. The authorizers go with the methods that named them, since a document
+     * declares the authorizers of the API it replaces along with everything
+     * else, and each import of the same document would otherwise create another
+     * authorizer nothing names.
+     */
+    private empty;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-openapi-replacement.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-replacement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-replacement.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-replacement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AAC9G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uDAAuD,CAAC;AACxG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;IACtD,QAAQ,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC1D,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;CACjD;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA+B;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IAExD,YAAY,UAAU,EAAE,sCAAsC,EAI7D;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAUnE;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,KAAK;CAkBd"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-replacement.js

@@ -0,0 +1,61 @@
+/**
+ * Replaces an API's whole definition with the one a document declares, which
+ * is what `PutRestApi` in overwrite mode asks for.
+ *
+ * The API itself stays, so its id, its endpoint and the stages serving it all
+ * survive the replacement.
+ */
+export class SimRestApiOpenApiReplacement {
+    resourceCommands;
+    authorizerCommands;
+    openApiImport;
+    constructor(properties) {
+        this.resourceCommands = properties.resourceCommands;
+        this.authorizerCommands = properties.authorizerCommands;
+        this.openApiImport = properties.openApiImport;
+    }
+    /**
+     * Put a document over an API's existing definition.
+     *
+     * A refused document leaves the API with an empty path tree rather than with
+     * the half of it that was read before the refusal. The API is then plainly
+     * serving nothing, which is what the next request to it says, where a
+     * half-replaced one would answer some paths and not others.
+     */
+    over(restApi, document) {
+        this.empty(restApi);
+        try {
+            this.openApiImport.into(restApi, document);
+        }
+        catch (error) {
+            this.empty(restApi);
+            throw error;
+        }
+    }
+    /**
+     * Delete the whole definition, through the ordinary commands.
+     *
+     * Only the resources directly under the root are named, because deleting one
+     * takes its subtree with it. The root itself stays, since every REST API has
+     * one. The authorizers go with the methods that named them, since a document
+     * declares the authorizers of the API it replaces along with everything
+     * else, and each import of the same document would otherwise create another
+     * authorizer nothing names.
+     */
+    empty(restApi) {
+        for (const child of restApi.resources.children(restApi.rootResource.resourceId)) {
+            this.resourceCommands.deleteResource({
+                input: { restApiId: restApi.apiId, resourceId: child.resourceId },
+            });
+        }
+        for (const authorizer of restApi.authorizers.list()) {
+            this.authorizerCommands.deleteAuthorizer({
+                input: {
+                    restApiId: restApi.apiId,
+                    authorizerId: authorizer.authorizerId,
+                },
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-rest-api-openapi-replacement.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-replacement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-replacement.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-replacement.ts"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,gBAAgB,CAA6B;IAC7C,kBAAkB,CAA+B;IACjD,aAAa,CAA0B;IAExD,YAAY,UAAkD;QAC5D,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,OAAmB,EAAE,QAAmC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpB,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEpB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,OAAmB;QAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAC5C,OAAO,CAAC,YAAY,CAAC,UAAU,CAChC,EAAE,CAAC;YACF,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;gBACnC,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;gBACvC,KAAK,EAAE;oBACL,SAAS,EAAE,OAAO,CAAC,KAAK;oBACxB,YAAY,EAAE,UAAU,CAAC,YAAY;iBACtC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-root-members.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The root members that change what the API serves and are not simulated.
+ */
+export declare const simRestApiOpenApiRefusedRootMembers: readonly (readonly [
+    string,
+    string
+])[];
+//# sourceMappingURL=sim-rest-api-openapi-root-members.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-root-members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-root-members.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-root-members.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,mCAAmC,EAAE,SAAS,CAAC,SAAS;IACnE,MAAM;IACN,MAAM;CACP,CAAC,EA2CD,CAAC"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-root-members.js

@@ -0,0 +1,48 @@
+/**
+ * The root members that change what the API serves and are not simulated.
+ */
+export const simRestApiOpenApiRefusedRootMembers = [
+    [
+        "servers",
+        "a server URL sets the base path every method is served under, and base " +
+            "path handling is not simulated",
+    ],
+    [
+        "security",
+        "a security requirement applying to every operation is not simulated. " +
+            "Declare the requirement on each operation instead.",
+    ],
+    [
+        "x-amazon-apigateway-policy",
+        "a resource policy on the API is not simulated, so every request that " +
+            "reaches a method here is served",
+    ],
+    [
+        "x-amazon-apigateway-binary-media-types",
+        "binary media types negotiated by Accept are not simulated",
+    ],
+    [
+        "x-amazon-apigateway-gateway-responses",
+        "gateway responses are not simulated, and a request nothing matches is " +
+            "answered with API Gateway's own default",
+    ],
+    [
+        "x-amazon-apigateway-request-validators",
+        "request validation is not simulated, so a request the document declares " +
+            "as invalid still reaches the handler",
+    ],
+    [
+        "x-amazon-apigateway-api-key-source",
+        "API keys and usage plans are not simulated",
+    ],
+    [
+        "x-amazon-apigateway-endpoint-configuration",
+        "endpoint types are not simulated, and every API is served on the one " +
+            "generated endpoint",
+    ],
+    [
+        "x-amazon-apigateway-minimum-compression-size",
+        "response compression is not simulated",
+    ],
+];
+//# sourceMappingURL=sim-rest-api-openapi-root-members.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-root-members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-root-members.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-root-members.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAGzC;IACL;QACE,SAAS;QACT,yEAAyE;YACvE,gCAAgC;KACnC;IACD;QACE,UAAU;QACV,uEAAuE;YACrE,oDAAoD;KACvD;IACD;QACE,4BAA4B;QAC5B,uEAAuE;YACrE,iCAAiC;KACpC;IACD;QACE,wCAAwC;QACxC,2DAA2D;KAC5D;IACD;QACE,uCAAuC;QACvC,wEAAwE;YACtE,yCAAyC;KAC5C;IACD;QACE,wCAAwC;QACxC,0EAA0E;YACxE,sCAAsC;KACzC;IACD;QACE,oCAAoC;QACpC,4CAA4C;KAC7C;IACD;QACE,4CAA4C;QAC5C,uEAAuE;YACrE,oBAAoB;KACvB;IACD;QACE,8CAA8C;QAC9C,uCAAuC;KACxC;CACF,CAAC"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.d.ts

@@ -0,0 +1,12 @@
+import type { SimRestApiOpenApiObject } from "./sim-rest-api-openapi-object.js";
+/**
+ * The header an `apiKey` security scheme names, which is where AWS reads the
+ * identity source of a `TOKEN` or `COGNITO_USER_POOLS` authorizer from.
+ *
+ * Both kinds read one header and nothing else, and the scheme's own `name` and
+ * `in` are what say which. An `x-amazon-apigateway-authorizer` of either kind
+ * carries no `identitySource` of its own, so a scheme that writes one is
+ * refused where it wrote it rather than importing as a header it did not name.
+ */
+export declare function simRestApiOpenApiSchemeIdentitySource(scheme: SimRestApiOpenApiObject): string;
+//# sourceMappingURL=sim-rest-api-openapi-scheme-identity-source.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-scheme-identity-source.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,uBAAuB,GAC9B,MAAM,CAYR"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.js

@@ -0,0 +1,20 @@
+import { simRestApiHeaderIdentityPrefix } from "../api/authorizer/identity/sim-rest-api-header-identity-source.js";
+/**
+ * The header an `apiKey` security scheme names, which is where AWS reads the
+ * identity source of a `TOKEN` or `COGNITO_USER_POOLS` authorizer from.
+ *
+ * Both kinds read one header and nothing else, and the scheme's own `name` and
+ * `in` are what say which. An `x-amazon-apigateway-authorizer` of either kind
+ * carries no `identitySource` of its own, so a scheme that writes one is
+ * refused where it wrote it rather than importing as a header it did not name.
+ */
+export function simRestApiOpenApiSchemeIdentitySource(scheme) {
+    const where = scheme.member("in");
+    const declared = where.requiredString();
+    if (declared !== "header") {
+        throw where.refusal(`is '${declared}', and the authorizer this scheme declares reads one ` +
+            `request header, so the scheme names that header with 'in: header'`);
+    }
+    return `${simRestApiHeaderIdentityPrefix}${scheme.member("name").requiredString()}`;
+}
+//# sourceMappingURL=sim-rest-api-openapi-scheme-identity-source.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-scheme-identity-source.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,mEAAmE,CAAC;AAGnH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,MAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAExC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CACjB,OAAO,QAAQ,uDAAuD;YACpE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;AACtF,CAAC"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.d.ts

@@ -0,0 +1,26 @@
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimRestApiOpenApiObject } from "./sim-rest-api-openapi-object.js";
+/**
+ * One `components.securitySchemes` member, read into what the methods naming
+ * it are gated by.
+ *
+ * Which of the three kinds of authorization a scheme declares is decided here,
+ * by `x-amazon-apigateway-authtype`, and reading each kind of authorizer is
+ * the class named after it. A scheme whose authtype and whose authorizer type
+ * disagree is refused rather than resolved either way.
+ */
+export declare class SimRestApiOpenApiSecurityScheme {
+    private readonly scheme;
+    constructor(scheme: SimRestApiOpenApiObject);
+    /**
+     * The CreateAuthorizer input this scheme asks for, or nothing at all when it
+     * declares a method decided by IAM.
+     */
+    createAuthorizerInput(restApiId: string, name: string): SimCreateAuthorizerCommandInput | undefined;
+    /**
+     * The kind of authorization this scheme declares, refusing a scheme a REST
+     * API method cannot be gated by.
+     */
+    private authType;
+}
+//# sourceMappingURL=sim-rest-api-openapi-security-scheme.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-security-scheme.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAOnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAmChF;;;;;;;;GAQG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED;;;OAGG;IACH,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,+BAA+B,GAAG,SAAS,CA6B7C;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAwBjB"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.js

@@ -0,0 +1,88 @@
+import { simRestApiOpenApiAuthorizerType, simRestApiOpenApiDeclaresAuthorizer, } from "./sim-rest-api-openapi-authorizer-type.js";
+import { SimRestApiOpenApiCognitoAuthorizerScheme } from "./sim-rest-api-openapi-cognito-authorizer-scheme.js";
+import { SimRestApiOpenApiLambdaAuthorizerScheme } from "./sim-rest-api-openapi-lambda-authorizer-scheme.js";
+/**
+ * The security scheme type a REST API declares every authorizer under.
+ *
+ * `custom`, `cognito_user_pools` and `awsSigv4` are all written as an `apiKey`
+ * scheme naming the header the caller presents, and told apart by
+ * `x-amazon-apigateway-authtype`.
+ */
+const apiKeySchemeType = "apiKey";
+/**
+ * The `x-amazon-apigateway-authtype` of a method decided by IAM, which
+ * declares no authorizer of its own.
+ */
+const iamAuthType = "awsSigv4";
+const schemeTypeRefusal = `is not '${apiKeySchemeType}', and a REST API declares every authorizer it ` +
+    `has as an apiKey scheme naming the header the caller presents. An http, ` +
+    `oauth2 or openIdConnect scheme names nothing a REST API method is gated by.`;
+const apiKeyRefusal = "is required: an apiKey scheme carrying no x-amazon-apigateway-authtype " +
+    "declares an API key, and API keys and usage plans are not simulated";
+const authTypeRefusal = `and a REST API method is decided by a 'custom' Lambda authorizer, a ` +
+    `'cognito_user_pools' one, or '${iamAuthType}' IAM authorization`;
+const iamAuthorizerRefusal = `declares an authorizer to invoke or verify a token with, and the scheme ` +
+    `carrying it declares x-amazon-apigateway-authtype '${iamAuthType}', which ` +
+    `is decided by IAM and asks nothing else`;
+/**
+ * One `components.securitySchemes` member, read into what the methods naming
+ * it are gated by.
+ *
+ * Which of the three kinds of authorization a scheme declares is decided here,
+ * by `x-amazon-apigateway-authtype`, and reading each kind of authorizer is
+ * the class named after it. A scheme whose authtype and whose authorizer type
+ * disagree is refused rather than resolved either way.
+ */
+export class SimRestApiOpenApiSecurityScheme {
+    scheme;
+    constructor(scheme) {
+        this.scheme = scheme;
+    }
+    /**
+     * The CreateAuthorizer input this scheme asks for, or nothing at all when it
+     * declares a method decided by IAM.
+     */
+    createAuthorizerInput(restApiId, name) {
+        const authType = this.authType();
+        if (authType === iamAuthType) {
+            this.scheme.refuseMember("x-amazon-apigateway-authorizer", iamAuthorizerRefusal);
+            return undefined;
+        }
+        const authorizer = this.scheme
+            .member("x-amazon-apigateway-authorizer")
+            .object();
+        const type = simRestApiOpenApiAuthorizerType(authorizer, authType);
+        if (type === "COGNITO_USER_POOLS") {
+            return new SimRestApiOpenApiCognitoAuthorizerScheme({
+                scheme: this.scheme,
+                authorizer,
+            }).createAuthorizerInput(restApiId, name);
+        }
+        return new SimRestApiOpenApiLambdaAuthorizerScheme({
+            scheme: this.scheme,
+            authorizer,
+            type,
+        }).createAuthorizerInput(restApiId, name);
+    }
+    /**
+     * The kind of authorization this scheme declares, refusing a scheme a REST
+     * API method cannot be gated by.
+     */
+    authType() {
+        const schemeType = this.scheme.member("type");
+        if (schemeType.requiredString() !== apiKeySchemeType) {
+            throw schemeType.refusal(schemeTypeRefusal);
+        }
+        const declared = this.scheme.member("x-amazon-apigateway-authtype");
+        if (declared.absent()) {
+            throw declared.refusal(apiKeyRefusal);
+        }
+        const authType = declared.requiredString();
+        if (authType !== iamAuthType &&
+            !simRestApiOpenApiDeclaresAuthorizer(authType)) {
+            throw declared.refusal(`is '${authType}', ${authTypeRefusal}`);
+        }
+        return authType;
+    }
+}
+//# sourceMappingURL=sim-rest-api-openapi-security-scheme.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-security-scheme.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.ts"],"names":[],"mappings":"AACA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,wCAAwC,EAAE,MAAM,qDAAqD,CAAC;AAC/G,OAAO,EAAE,uCAAuC,EAAE,MAAM,oDAAoD,CAAC;AAG7G;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B,MAAM,iBAAiB,GACrB,WAAW,gBAAgB,iDAAiD;IAC5E,0EAA0E;IAC1E,6EAA6E,CAAC;AAEhF,MAAM,aAAa,GACjB,yEAAyE;IACzE,qEAAqE,CAAC;AAExE,MAAM,eAAe,GACnB,sEAAsE;IACtE,iCAAiC,WAAW,qBAAqB,CAAC;AAEpE,MAAM,oBAAoB,GACxB,0EAA0E;IAC1E,sDAAsD,WAAW,WAAW;IAC5E,yCAAyC,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAA0B;IAEjD,YAAY,MAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,SAAiB,EACjB,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,gCAAgC,EAChC,oBAAoB,CACrB,CAAC;YAEF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;aAC3B,MAAM,CAAC,gCAAgC,CAAC;aACxC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,+BAA+B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEnE,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,IAAI,wCAAwC,CAAC;gBAClD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU;aACX,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,uCAAuC,CAAC;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU;YACV,IAAI;SACL,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACK,QAAQ;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,UAAU,CAAC,cAAc,EAAE,KAAK,gBAAgB,EAAE,CAAC;YACrD,MAAM,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAEpE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;QAE3C,IACE,QAAQ,KAAK,WAAW;YACxB,CAAC,mCAAmC,CAAC,QAAQ,CAAC,EAC9C,CAAC;YACD,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,QAAQ,MAAM,eAAe,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.d.ts

@@ -0,0 +1,53 @@
+import type { SimRestApiAuthorizerView } from "../api/authorizer/sim-rest-api-authorizer.js";
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimRestApiOpenApiSecurityRequirement } from "./sim-rest-api-openapi-operation.js";
+import type { SimRestApiOpenApiPointer } from "./sim-rest-api-openapi-pointer.js";
+import type { SimRestApiOpenApiValue } from "./sim-rest-api-openapi-value.js";
+/**
+ * What one security scheme comes to.
+ */
+export interface SimRestApiOpenApiSchemeAuthorizer {
+    /**
+     * The authorizer to create, or nothing when the scheme declares a method
+     * decided by IAM, which asks no authorizer anything.
+     */
+    readonly input: SimCreateAuthorizerCommandInput | undefined;
+    /** Where the scheme is, for a refusal CreateAuthorizer makes about it. */
+    readonly pointer: SimRestApiOpenApiPointer;
+}
+interface SimRestApiOpenApiSecuritySchemesProperties {
+    readonly schemes: SimRestApiOpenApiValue;
+}
+/**
+ * The `components.securitySchemes` an operation's security requirement names.
+ *
+ * One authorizer is created per scheme name, shared by every method naming it,
+ * which is what a REST API has: an authorizer belongs to the API rather than
+ * to a method. A scheme nothing names creates nothing, so it is never read and
+ * never refused.
+ */
+export declare class SimRestApiOpenApiSecuritySchemes {
+    private readonly schemes;
+    private readonly created;
+    constructor(properties: SimRestApiOpenApiSecuritySchemesProperties);
+    /**
+     * What the scheme a requirement names gates its methods with.
+     */
+    authorizer(restApiId: string, requirement: SimRestApiOpenApiSecurityRequirement): SimRestApiOpenApiSchemeAuthorizer;
+    /**
+     * The authorizer already created for a scheme, if one was.
+     */
+    createdAuthorizer(schemeName: string): SimRestApiAuthorizerView | undefined;
+    /**
+     * Remember the authorizer created for a scheme, so the next method naming it
+     * shares that one.
+     */
+    remember(schemeName: string, authorizer: SimRestApiAuthorizerView): void;
+    /**
+     * The security scheme a requirement names, refusing one the document does
+     * not define.
+     */
+    private scheme;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-openapi-security-schemes.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-security-schemes.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAEnG,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE9E;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,+BAA+B,GAAG,SAAS,CAAC;IAC5D,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;CAC5C;AAED,UAAU,0CAA0C;IAClD,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+C;IAEvE,YAAY,UAAU,EAAE,0CAA0C,EAEjE;IAED;;OAEG;IACH,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,oCAAoC,GAChD,iCAAiC,CAUnC;IAED;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAE1E;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,IAAI,CAEvE;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM;CAcf"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.js

@@ -0,0 +1,52 @@
+import { SimRestApiOpenApiSecurityScheme } from "./sim-rest-api-openapi-security-scheme.js";
+/**
+ * The `components.securitySchemes` an operation's security requirement names.
+ *
+ * One authorizer is created per scheme name, shared by every method naming it,
+ * which is what a REST API has: an authorizer belongs to the API rather than
+ * to a method. A scheme nothing names creates nothing, so it is never read and
+ * never refused.
+ */
+export class SimRestApiOpenApiSecuritySchemes {
+    schemes;
+    created = new Map();
+    constructor(properties) {
+        this.schemes = properties.schemes;
+    }
+    /**
+     * What the scheme a requirement names gates its methods with.
+     */
+    authorizer(restApiId, requirement) {
+        const scheme = this.scheme(requirement);
+        return {
+            input: new SimRestApiOpenApiSecurityScheme(scheme).createAuthorizerInput(restApiId, requirement.schemeName),
+            pointer: scheme.pointer,
+        };
+    }
+    /**
+     * The authorizer already created for a scheme, if one was.
+     */
+    createdAuthorizer(schemeName) {
+        return this.created.get(schemeName);
+    }
+    /**
+     * Remember the authorizer created for a scheme, so the next method naming it
+     * shares that one.
+     */
+    remember(schemeName, authorizer) {
+        this.created.set(schemeName, authorizer);
+    }
+    /**
+     * The security scheme a requirement names, refusing one the document does
+     * not define.
+     */
+    scheme(requirement) {
+        const schemes = this.schemes.optionalObject();
+        if (schemes?.has(requirement.schemeName) !== true) {
+            throw requirement.value.refusal(`names the security scheme '${requirement.schemeName}', which ` +
+                `${this.schemes.pointer.toString()} does not define`);
+        }
+        return schemes.member(requirement.schemeName).object();
+    }
+}
+//# sourceMappingURL=sim-rest-api-openapi-security-schemes.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-security-schemes.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAoB5F;;;;;;;GAOG;AACH,MAAM,OAAO,gCAAgC;IAC1B,OAAO,CAAyB;IAChC,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEvE,YAAY,UAAsD;QAChE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,UAAU,CACR,SAAiB,EACjB,WAAiD;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAExC,OAAO;YACL,KAAK,EAAE,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC,qBAAqB,CACtE,SAAS,EACT,WAAW,CAAC,UAAU,CACvB;YACD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,UAAkB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAkB,EAAE,UAAoC;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACK,MAAM,CACZ,WAAiD;QAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAE9C,IAAI,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAC7B,8BAA8B,WAAW,CAAC,UAAU,WAAW;gBAC7D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;CACF"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-value.d.ts

@@ -0,0 +1,60 @@
+import type { JSONValue } from "../../../util/type-guard/json.js";
+import type { SimApiGatewayBadRequest } from "../error/sim-api-gateway.error.js";
+import { SimRestApiOpenApiObject } from "./sim-rest-api-openapi-object.js";
+import type { SimRestApiOpenApiPointer } from "./sim-rest-api-openapi-pointer.js";
+interface SimRestApiOpenApiValueProperties {
+    readonly pointer: SimRestApiOpenApiPointer;
+    readonly value: JSONValue | undefined;
+}
+/**
+ * One value of the document being imported, at the pointer that reaches it.
+ *
+ * A document arrives as whatever JSON held, so every read narrows a value and
+ * refuses the shapes it cannot be. Nothing here knows what any member means:
+ * that is the readers above, which is what keeps the narrowing in one place
+ * and the meaning in classes named after the thing they read.
+ */
+export declare class SimRestApiOpenApiValue {
+    readonly pointer: SimRestApiOpenApiPointer;
+    private readonly value;
+    constructor(properties: SimRestApiOpenApiValueProperties);
+    /**
+     * Whether the document leaves this member out.
+     */
+    absent(): boolean;
+    /**
+     * Refuse this member, naming where it is in the document.
+     */
+    refusal(reason: string): SimApiGatewayBadRequest;
+    /**
+     * This value as an object, refusing a document that left it out.
+     */
+    object(): SimRestApiOpenApiObject;
+    /**
+     * This value as an object when the document carries one.
+     */
+    optionalObject(): SimRestApiOpenApiObject | undefined;
+    /**
+     * This value as a string, refusing a document that left it out.
+     */
+    requiredString(): string;
+    /**
+     * This value as a string when the document carries one.
+     */
+    optionalString(): string | undefined;
+    /**
+     * This value as a number when the document carries one, which is the shape
+     * an authorizer's `authorizerResultTtlInSeconds` takes.
+     */
+    optionalNumber(): number | undefined;
+    /**
+     * The entries of this value as an array, when the document carries one.
+     */
+    optionalArray(): readonly SimRestApiOpenApiValue[] | undefined;
+    /**
+     * The entries of this value as strings, when the document carries them.
+     */
+    optionalStringList(): readonly string[] | undefined;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-openapi-value.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-value.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-value.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAGlF,UAAU,gCAAgC;IACxC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC;AAID;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAE9C,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,MAAM,IAAI,OAAO,CAEhB;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAE/C;IAED;;OAEG;IACH,MAAM,IAAI,uBAAuB,CAQhC;IAED;;OAEG;IACH,cAAc,IAAI,uBAAuB,GAAG,SAAS,CAiBpD;IAED;;OAEG;IACH,cAAc,IAAI,MAAM,CAQvB;IAED;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,SAAS,CAUnC;IAED;;;OAGG;IACH,cAAc,IAAI,MAAM,GAAG,SAAS,CAUnC;IAED;;OAEG;IACH,aAAa,IAAI,SAAS,sBAAsB,EAAE,GAAG,SAAS,CAgB7D;IAED;;OAEG;IACH,kBAAkB,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,CAElD;CACF"}