@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.js

@@ -0,0 +1,27 @@
+import { simRestApiIdentityValue, } from "./sim-rest-api-identity-source.js";
+/**
+ * The prefix a query string identity source is written with.
+ */
+export const simRestApiQueryStringIdentityPrefix = "method.request.querystring.";
+/**
+ * An identity source naming one query string parameter, such as
+ * `method.request.querystring.access_token`.
+ *
+ * A repeated parameter supplies its first value, which is the one a mapping
+ * expression reads on real API Gateway.
+ */
+export class SimRestApiQueryStringIdentitySource {
+    expression;
+    parameterName;
+    constructor(parameterName) {
+        this.expression = `${simRestApiQueryStringIdentityPrefix}${parameterName}`;
+        this.parameterName = parameterName;
+    }
+    /**
+     * The query string parameter this request carries, if it carries one.
+     */
+    value(request) {
+        return simRestApiIdentityValue(new URL(request.url).searchParams.get(this.parameterName));
+    }
+}
+//# sourceMappingURL=sim-rest-api-query-string-identity-source.js.map

package/dist/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-query-string-identity-source.js","sourceRoot":"","sources":["../../../../../../src/service/apigateway/api/authorizer/identity/sim-rest-api-query-string-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,6BAA6B,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,OAAO,mCAAmC;IAC9B,UAAU,CAAS;IAElB,aAAa,CAAS;IAEvC,YAAY,aAAqB;QAC/B,IAAI,CAAC,UAAU,GAAG,GAAG,mCAAmC,GAAG,aAAa,EAAE,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAgB;QACpB,OAAO,uBAAuB,CAC5B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.d.ts

@@ -0,0 +1,24 @@
+import type { SimCognitoUserPoolRegistry } from "../../../cognito/registry/sim-cognito-user-pool-registry.js";
+import type { SimRestApiUserPool, SimRestApiUserPools } from "./sim-rest-api-user-pools.js";
+interface SimCognitoRestApiUserPoolsProperties {
+    readonly userPoolRegistry: SimCognitoUserPoolRegistry;
+}
+/**
+ * Simulated Cognito user pools as the pools a REST API authorizer verifies
+ * against.
+ *
+ * All of the Cognito lookup lives here rather than in API Gateway, which knows
+ * only that an authorizer names pools by id. The registry spans simulated
+ * Accounts, matching an API Gateway authorizer that can name a pool in any
+ * Account.
+ */
+export declare class SimCognitoRestApiUserPools implements SimRestApiUserPools {
+    private readonly userPoolRegistry;
+    constructor(properties: SimCognitoRestApiUserPoolsProperties);
+    /**
+     * The pool this id names, in whichever Account and Region created it.
+     */
+    find(userPoolId: string): SimRestApiUserPool | undefined;
+}
+export {};
+//# sourceMappingURL=sim-cognito-rest-api-user-pools.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-rest-api-user-pools.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAWvD;CACF"}

package/dist/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.js

@@ -0,0 +1,30 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * Simulated Cognito user pools as the pools a REST API authorizer verifies
+ * against.
+ *
+ * All of the Cognito lookup lives here rather than in API Gateway, which knows
+ * only that an authorizer names pools by id. The registry spans simulated
+ * Accounts, matching an API Gateway authorizer that can name a pool in any
+ * Account.
+ */
+export class SimCognitoRestApiUserPools {
+    userPoolRegistry;
+    constructor(properties) {
+        this.userPoolRegistry = properties.userPoolRegistry;
+    }
+    /**
+     * The pool this id names, in whichever Account and Region created it.
+     */
+    find(userPoolId) {
+        const pool = this.userPoolRegistry.find(userPoolId);
+        if (pool === undefined) {
+            return undefined;
+        }
+        return {
+            issuerUrl: pool.issuerUrl,
+            keys: new SimJwtKeys(pool.jwks().keys),
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-rest-api-user-pools.js.map

package/dist/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-rest-api-user-pools.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-cognito-rest-api-user-pools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAWlE;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA0B;IACpB,gBAAgB,CAA6B;IAE9D,YAAY,UAAgD;QAC1D,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAkB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorization.d.ts

@@ -0,0 +1,77 @@
+import type { SimPayload1CognitoAuthorizer, SimPayload1LambdaAuthorizer } from "../../../../serve/payload-1/sim-payload-1-event.type.js";
+import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
+/**
+ * Why a method refused a request, which decides the response it gets.
+ *
+ * `unauthorized` is a request carrying no token at the authorizer's identity
+ * source, and a token the authorizer answered `Unauthorized` for.
+ * `explicit-deny` and `implicit-deny` are both 403 with different bodies, as
+ * real API Gateway answers them. `error` is the authorizer itself failing,
+ * which is the API's problem rather than the caller's.
+ */
+export type SimRestApiRefusalKind = "unauthorized" | "explicit-deny" | "implicit-deny" | "error";
+interface SimRestApiAdmittedProperties {
+    /**
+     * What a `CUSTOM` method's authorizer passed on to the integration, which is
+     * absent on a method admitting anybody.
+     */
+    readonly lambda?: SimPayload1LambdaAuthorizer | undefined;
+    /** The principal an `AWS_IAM` method allowed the request. */
+    readonly caller?: SimAwsRequestCaller | undefined;
+    /**
+     * The claims of the token a `COGNITO_USER_POOLS` method's authorizer
+     * accepted.
+     */
+    readonly cognito?: SimPayload1CognitoAuthorizer | undefined;
+}
+/**
+ * A request the method admitted, and what its authorization knows about the
+ * caller.
+ *
+ * Every member is absent on a method that authorizes nobody, since there is
+ * no caller to describe. That is what leaves `requestContext.authorizer` out of
+ * the event entirely and every `requestContext.identity` field describing a
+ * principal `null`. Which one is present says which kind of authorization
+ * admitted the request.
+ */
+export declare class SimRestApiAdmitted {
+    readonly admitted: true;
+    readonly lambda: SimPayload1LambdaAuthorizer | undefined;
+    readonly caller: SimAwsRequestCaller | undefined;
+    readonly cognito: SimPayload1CognitoAuthorizer | undefined;
+    constructor(properties?: SimRestApiAdmittedProperties);
+}
+/**
+ * A request the method refused, before any integration was invoked.
+ */
+export declare class SimRestApiRefused {
+    readonly admitted: false;
+    readonly kind: SimRestApiRefusalKind;
+    private constructor();
+    /**
+     * The request carried nothing at the authorizer's identity source, or the
+     * authorizer answered `Unauthorized`.
+     */
+    static unauthorized(): SimRestApiRefused;
+    /**
+     * A Deny statement in the authorizer's policy matched the method.
+     */
+    static explicitDeny(): SimRestApiRefused;
+    /**
+     * The authorizer's policy allowed nothing that covers the method.
+     */
+    static implicitDeny(): SimRestApiRefused;
+    /**
+     * The method's authorizer could not answer at all. Its function is missing,
+     * may not be invoked, failed, or replied in a shape API Gateway does not
+     * understand. None of that is the caller's doing, so it is the 500 an
+     * authorizer failure gets on real AWS.
+     */
+    static error(): SimRestApiRefused;
+}
+/**
+ * What a method decided about one request.
+ */
+export type SimRestApiAuthorization = SimRestApiAdmitted | SimRestApiRefused;
+export {};
+//# sourceMappingURL=sim-rest-api-authorization.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAC7B,cAAc,GACd,eAAe,GACf,eAAe,GACf,OAAO,CAAC;AAEZ,UAAU,4BAA4B;IACpC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC1D,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,QAAQ,OAAiB;IACzC,SAAgB,MAAM,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAChE,SAAgB,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACxD,SAAgB,OAAO,EAAE,4BAA4B,GAAG,SAAS,CAAC;IAElE,YAAY,UAAU,GAAE,4BAAiC,EAIxD;CACF;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,QAAQ,QAAkB;IAC1C,SAAgB,IAAI,EAAE,qBAAqB,CAAC;IAE5C,OAAO,eAEN;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,IAAI,iBAAiB,CAEvC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,IAAI,iBAAiB,CAEvC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,IAAI,iBAAiB,CAEvC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAEhC;CACF;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorization.js

@@ -0,0 +1,60 @@
+/**
+ * A request the method admitted, and what its authorization knows about the
+ * caller.
+ *
+ * Every member is absent on a method that authorizes nobody, since there is
+ * no caller to describe. That is what leaves `requestContext.authorizer` out of
+ * the event entirely and every `requestContext.identity` field describing a
+ * principal `null`. Which one is present says which kind of authorization
+ * admitted the request.
+ */
+export class SimRestApiAdmitted {
+    admitted = true;
+    lambda;
+    caller;
+    cognito;
+    constructor(properties = {}) {
+        this.lambda = properties.lambda;
+        this.caller = properties.caller;
+        this.cognito = properties.cognito;
+    }
+}
+/**
+ * A request the method refused, before any integration was invoked.
+ */
+export class SimRestApiRefused {
+    admitted = false;
+    kind;
+    constructor(kind) {
+        this.kind = kind;
+    }
+    /**
+     * The request carried nothing at the authorizer's identity source, or the
+     * authorizer answered `Unauthorized`.
+     */
+    static unauthorized() {
+        return new SimRestApiRefused("unauthorized");
+    }
+    /**
+     * A Deny statement in the authorizer's policy matched the method.
+     */
+    static explicitDeny() {
+        return new SimRestApiRefused("explicit-deny");
+    }
+    /**
+     * The authorizer's policy allowed nothing that covers the method.
+     */
+    static implicitDeny() {
+        return new SimRestApiRefused("implicit-deny");
+    }
+    /**
+     * The method's authorizer could not answer at all. Its function is missing,
+     * may not be invoked, failed, or replied in a shape API Gateway does not
+     * understand. None of that is the caller's doing, so it is the 500 an
+     * authorizer failure gets on real AWS.
+     */
+    static error() {
+        return new SimRestApiRefused("error");
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorization.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorization.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorization.ts"],"names":[],"mappings":"AAoCA;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IACb,QAAQ,GAAG,IAAa,CAAC;IACzB,MAAM,CAA0C;IAChD,MAAM,CAAkC;IACxC,OAAO,CAA2C;IAElE,YAAY,UAAU,GAAiC,EAAE;QACvD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACZ,QAAQ,GAAG,KAAc,CAAC;IAC1B,IAAI,CAAwB;IAE5C,YAAoB,IAA2B;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.d.ts

@@ -0,0 +1,69 @@
+import type { SimRestApiAuthorization } from "./sim-rest-api-authorization.js";
+/**
+ * What one held decision was made for.
+ */
+export interface SimRestApiCacheKey {
+    /**
+     * The ARN of the request the decision was made about, which is what the
+     * authorizer's policy was evaluated against.
+     */
+    readonly methodArn: string;
+    /**
+     * The values the authorizer's identity sources found, in the order they were
+     * configured. A `TOKEN` authorizer has one of these, and it is the token.
+     */
+    readonly identityValues: readonly string[];
+}
+/**
+ * The decisions one Lambda authorizer has already made, held for as long as
+ * its `AuthorizerResultTtlInSeconds` says.
+ *
+ * A `TOKEN` authorizer is keyed on the token it was handed and a `REQUEST`
+ * authorizer on the values of its identity sources, which come to the same
+ * thing here: a `TOKEN` authorizer has one identity source, and its value is
+ * the token.
+ *
+ * The method the request was made to is part of the key as well, because what
+ * is held is the decision rather than the policy it came from. That policy was
+ * evaluated against one request ARN, and the admission or refusal it produced
+ * says nothing about any other. An HTTP API keys on the identity source values
+ * alone, and holds a route-shaped answer that carries over.
+ *
+ * The cache belongs to the authorizer rather than to whatever is serving,
+ * because it outlives one request and one server the way the authorizer does.
+ * It holds no clock of its own: the caller passes the instant it is asking
+ * about, so expiry follows the simulation's clock and a test advances time
+ * rather than waiting.
+ */
+export declare class SimRestApiAuthorizerResultCache {
+    private readonly ttlSeconds;
+    private readonly results;
+    constructor(ttlSeconds: number);
+    /**
+     * Whether this authorizer holds anything at all.
+     *
+     * A TTL of zero is what switches caching off, and is what an authorizer that
+     * says nothing about it gets.
+     */
+    get isEnabled(): boolean;
+    /**
+     * The decision already made for this request, if one was made and has not
+     * expired.
+     */
+    find(key: SimRestApiCacheKey, at: Date): SimRestApiAuthorization | undefined;
+    /**
+     * Hold a decision for this authorizer's TTL.
+     *
+     * A refusal is held the same way an admission is, which is what real API
+     * Gateway does: it holds the authorizer's answer, whatever that was.
+     */
+    store(key: SimRestApiCacheKey, at: Date, authorization: SimRestApiAuthorization): void;
+    /**
+     * The string one decision is held under.
+     *
+     * The parts are JSON-encoded rather than joined, so two sets that differ
+     * only in where one value ends and the next begins are different keys.
+     */
+    private keyOf;
+}
+//# sourceMappingURL=sim-rest-api-authorizer-result-cache.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-result-cache.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAU/E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IAErE,YAAY,UAAU,EAAE,MAAM,EAE7B;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,GAAG,uBAAuB,GAAG,SAAS,CAe3E;IAED;;;;;OAKG;IACH,KAAK,CACH,GAAG,EAAE,kBAAkB,EACvB,EAAE,EAAE,IAAI,EACR,aAAa,EAAE,uBAAuB,GACrC,IAAI,CASN;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAK;CAGd"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.js

@@ -0,0 +1,79 @@
+/**
+ * The decisions one Lambda authorizer has already made, held for as long as
+ * its `AuthorizerResultTtlInSeconds` says.
+ *
+ * A `TOKEN` authorizer is keyed on the token it was handed and a `REQUEST`
+ * authorizer on the values of its identity sources, which come to the same
+ * thing here: a `TOKEN` authorizer has one identity source, and its value is
+ * the token.
+ *
+ * The method the request was made to is part of the key as well, because what
+ * is held is the decision rather than the policy it came from. That policy was
+ * evaluated against one request ARN, and the admission or refusal it produced
+ * says nothing about any other. An HTTP API keys on the identity source values
+ * alone, and holds a route-shaped answer that carries over.
+ *
+ * The cache belongs to the authorizer rather than to whatever is serving,
+ * because it outlives one request and one server the way the authorizer does.
+ * It holds no clock of its own: the caller passes the instant it is asking
+ * about, so expiry follows the simulation's clock and a test advances time
+ * rather than waiting.
+ */
+export class SimRestApiAuthorizerResultCache {
+    ttlSeconds;
+    results = new Map();
+    constructor(ttlSeconds) {
+        this.ttlSeconds = ttlSeconds;
+    }
+    /**
+     * Whether this authorizer holds anything at all.
+     *
+     * A TTL of zero is what switches caching off, and is what an authorizer that
+     * says nothing about it gets.
+     */
+    get isEnabled() {
+        return this.ttlSeconds > 0;
+    }
+    /**
+     * The decision already made for this request, if one was made and has not
+     * expired.
+     */
+    find(key, at) {
+        const cached = this.results.get(this.keyOf(key));
+        if (cached === undefined) {
+            return undefined;
+        }
+        if (cached.expiresAt.getTime() <= at.getTime()) {
+            // Dropped rather than left to be overwritten, so an authorizer that is
+            // never asked about this identity again does not hold it for ever.
+            this.results.delete(this.keyOf(key));
+            return undefined;
+        }
+        return cached.authorization;
+    }
+    /**
+     * Hold a decision for this authorizer's TTL.
+     *
+     * A refusal is held the same way an admission is, which is what real API
+     * Gateway does: it holds the authorizer's answer, whatever that was.
+     */
+    store(key, at, authorization) {
+        if (!this.isEnabled) {
+            return;
+        }
+        this.results.set(this.keyOf(key), {
+            authorization,
+            expiresAt: new Date(at.getTime() + this.ttlSeconds * 1000),
+        });
+    }
+    /**
+     * The string one decision is held under.
+     *
+     * The parts are JSON-encoded rather than joined, so two sets that differ
+     * only in where one value ends and the next begins are different keys.
+     */
+    keyOf(key) {
+        return JSON.stringify([key.methodArn, key.identityValues]);
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-result-cache.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-result-cache.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer-result-cache.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,+BAA+B;IACzB,UAAU,CAAS;IACnB,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAErE,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,GAAuB,EAAE,EAAQ;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CACH,GAAuB,EACvB,EAAQ,EACR,aAAsC;QAEtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAChC,aAAa;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,GAAuB;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.d.ts

@@ -0,0 +1,31 @@
+import { type SimRestApiAuthorizer, type SimRestApiAuthorizerId } from "./sim-rest-api-authorizer.js";
+/**
+ * The authorizers of one REST API, keyed by the id the API allocated.
+ *
+ * An authorizer belongs to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export declare class SimRestApiAuthorizerStore {
+    private readonly authorizers;
+    /**
+     * Allocate an authorizer id this API is not already using.
+     */
+    allocateId(): SimRestApiAuthorizerId;
+    /**
+     * Add an authorizer to this API.
+     */
+    add(authorizer: SimRestApiAuthorizer): void;
+    /**
+     * Find an authorizer by id.
+     */
+    find(authorizerId: string): SimRestApiAuthorizer | undefined;
+    /**
+     * Forget a deleted authorizer.
+     */
+    remove(authorizerId: SimRestApiAuthorizerId): void;
+    /**
+     * List every authorizer of this API, in the order they were created.
+     */
+    list(): SimRestApiAuthorizer[];
+}
+//# sourceMappingURL=sim-rest-api-authorizer-store.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ;;OAEG;IACH,UAAU,IAAI,sBAAsB,CASnC;IAED;;OAEG;IACH,GAAG,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAE1C;IAED;;OAEG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE3D;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,IAAI,IAAI,oBAAoB,EAAE,CAE7B;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.js

@@ -0,0 +1,46 @@
+import { makeSimRestApiAuthorizerId, } from "./sim-rest-api-authorizer.js";
+/**
+ * The authorizers of one REST API, keyed by the id the API allocated.
+ *
+ * An authorizer belongs to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export class SimRestApiAuthorizerStore {
+    authorizers = new Map();
+    /**
+     * Allocate an authorizer id this API is not already using.
+     */
+    allocateId() {
+        let authorizerId = makeSimRestApiAuthorizerId();
+        while (this.authorizers.has(authorizerId)) {
+            /* v8 ignore next -- does not happen in practice */
+            authorizerId = makeSimRestApiAuthorizerId();
+        }
+        return authorizerId;
+    }
+    /**
+     * Add an authorizer to this API.
+     */
+    add(authorizer) {
+        this.authorizers.set(authorizer.authorizerId, authorizer);
+    }
+    /**
+     * Find an authorizer by id.
+     */
+    find(authorizerId) {
+        return this.authorizers.get(authorizerId);
+    }
+    /**
+     * Forget a deleted authorizer.
+     */
+    remove(authorizerId) {
+        this.authorizers.delete(authorizerId);
+    }
+    /**
+     * List every authorizer of this API, in the order they were created.
+     */
+    list() {
+        return this.authorizers.values().toArray();
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-store.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-store.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ;;OAEG;IACH,UAAU;QACR,IAAI,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAEhD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,mDAAmD;YACnD,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,UAAgC;QAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAsC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAoC;QACzC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer.d.ts

@@ -0,0 +1,74 @@
+import type { Brand } from "../../../../util/brand.type.js";
+/**
+ * The id API Gateway allocates for one authorizer.
+ */
+export type SimRestApiAuthorizerId = Brand<string, "SimRestApiAuthorizerId">;
+/**
+ * The kinds of authorizer a REST API has.
+ *
+ * A `TOKEN` authorizer sends one header's value to a Lambda function. A
+ * `REQUEST` authorizer sends the whole request to one instead, so it can
+ * identify a caller by several headers together or by the query string. Both
+ * do what the policy that function answers with says. A `COGNITO_USER_POOLS`
+ * authorizer invokes nothing and verifies the token against the user pools it
+ * names.
+ */
+export type SimRestApiAuthorizerType = "TOKEN" | "REQUEST" | "COGNITO_USER_POOLS";
+/**
+ * What `GetAuthorizer` reports for the family a Lambda authorizer belongs to.
+ *
+ * A `TOKEN` or `REQUEST` authorizer is `custom`.
+ */
+export declare const simRestApiCustomAuthType = "custom";
+/**
+ * What `GetAuthorizer` reports for the family a Cognito authorizer belongs to.
+ */
+export declare const simRestApiCognitoAuthType = "cognito_user_pools";
+/**
+ * Allocate an authorizer id, in the same opaque shape as a resource id.
+ */
+export declare function makeSimRestApiAuthorizerId(): SimRestApiAuthorizerId;
+/**
+ * Minimal structural authorizer view, as the Create and Get commands return.
+ *
+ * `authorizerUri`, `providerARNs` and `authorizerResultTtlInSeconds` belong to
+ * one kind of authorizer each, so each view carries the ones its kind has.
+ */
+export interface SimRestApiAuthorizerView {
+    id: string;
+    name: string;
+    type: SimRestApiAuthorizerType;
+    authType: string;
+    identitySource: string;
+    authorizerUri?: string;
+    providerARNs?: string[];
+    authorizerResultTtlInSeconds?: number;
+}
+interface SimRestApiAuthorizerProperties {
+    readonly authorizerId: SimRestApiAuthorizerId;
+    readonly name: string;
+}
+/**
+ * A simulated REST API authorizer: what a method sends a request through
+ * before it reaches the integration.
+ *
+ * An authorizer belongs to an API and is attached to methods by id, so one
+ * authorizer covers as many methods of the API as name it. What it does with
+ * a request is its kind's business, and that is all the subclasses are.
+ */
+export declare abstract class SimRestApiAuthorizer {
+    readonly authorizerId: SimRestApiAuthorizerId;
+    readonly name: string;
+    /**
+     * Which kind of authorizer this is, which is also what decides whether a
+     * method may name it.
+     */
+    abstract readonly type: SimRestApiAuthorizerType;
+    protected constructor(properties: SimRestApiAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    abstract view(): SimRestApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-authorizer.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAE5D;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,SAAS,GACT,oBAAoB,CAAC;AAEzB;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,sBAAsB,CAEnE;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,wBAAwB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,8BAAsB,oBAAoB;IACxC,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,kBAAyB,IAAI,EAAE,wBAAwB,CAAC;IAExD,SAAS,aAAa,UAAU,EAAE,8BAA8B,EAG/D;IAED;;OAEG;IACH,QAAQ,CAAC,IAAI,IAAI,wBAAwB,CAAC;CAC3C"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer.js

@@ -0,0 +1,34 @@
+import { faker } from "@faker-js/faker";
+/**
+ * What `GetAuthorizer` reports for the family a Lambda authorizer belongs to.
+ *
+ * A `TOKEN` or `REQUEST` authorizer is `custom`.
+ */
+export const simRestApiCustomAuthType = "custom";
+/**
+ * What `GetAuthorizer` reports for the family a Cognito authorizer belongs to.
+ */
+export const simRestApiCognitoAuthType = "cognito_user_pools";
+/**
+ * Allocate an authorizer id, in the same opaque shape as a resource id.
+ */
+export function makeSimRestApiAuthorizerId() {
+    return faker.helpers.fromRegExp(/[a-z0-9]{6}/);
+}
+/**
+ * A simulated REST API authorizer: what a method sends a request through
+ * before it reaches the integration.
+ *
+ * An authorizer belongs to an API and is attached to methods by id, so one
+ * authorizer covers as many methods of the API as name it. What it does with
+ * a request is its kind's business, and that is all the subclasses are.
+ */
+export class SimRestApiAuthorizer {
+    authorizerId;
+    name;
+    constructor(properties) {
+        this.authorizerId = properties.authorizerId;
+        this.name = properties.name;
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAwBxC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAA2B,CAAC;AAC3E,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,OAAgB,oBAAoB;IACxB,YAAY,CAAyB;IACrC,IAAI,CAAS;IAQ7B,YAAsB,UAA0C;QAC9D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,CAAC;CAMF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.d.ts

@@ -0,0 +1,42 @@
+import type { SimRestApiIdentitySource } from "./identity/sim-rest-api-identity-source.js";
+import { SimRestApiAuthorizer, type SimRestApiAuthorizerId, type SimRestApiAuthorizerView } from "./sim-rest-api-authorizer.js";
+import type { SimRestApiUserPoolProviders } from "./sim-rest-api-user-pool-providers.js";
+interface SimRestApiCognitoAuthorizerProperties {
+    readonly authorizerId: SimRestApiAuthorizerId;
+    readonly name: string;
+    readonly providers: SimRestApiUserPoolProviders;
+    readonly identitySource: SimRestApiIdentitySource;
+}
+/**
+ * A simulated REST API `COGNITO_USER_POOLS` authorizer: the user pools whose
+ * tokens a method admits.
+ *
+ * Nothing is invoked for a request. The authorizer verifies the token itself
+ * against the keys the pools publish, which is why it names pools where a
+ * Lambda authorizer names a function.
+ *
+ * What a token has to carry beyond a signature one of those pools made is the
+ * method's business rather than this one's: the scopes a method asks for are
+ * declared on the method, so one authorizer covers methods asking for
+ * different scopes.
+ */
+export declare class SimRestApiCognitoAuthorizer extends SimRestApiAuthorizer {
+    readonly type: "COGNITO_USER_POOLS";
+    /**
+     * The user pools this authorizer accepts tokens from, read from its
+     * `providerARNs`.
+     */
+    readonly providers: SimRestApiUserPoolProviders;
+    /**
+     * The header carrying the token, which is where the request is read from.
+     * There is one, as there is for a `TOKEN` authorizer.
+     */
+    readonly identitySource: SimRestApiIdentitySource;
+    constructor(properties: SimRestApiCognitoAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view(): SimRestApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-cognito-authorizer.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAEzF,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,2BAA4B,SAAQ,oBAAoB;IACnE,SAAgB,IAAI,EAAG,oBAAoB,CAAU;IAErD;;;OAGG;IACH,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IAEvD;;;OAGG;IACH,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IAEzD,YAAY,UAAU,EAAE,qCAAqC,EAI5D;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAS/B;CACF"}