@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-config.js

@@ -0,0 +1,114 @@
+import { SimCfnGeneratedResourceName } from "../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+import { simCfnWafResourceError } from "./sim-cfn-waf-resource-error.js";
+/**
+ * How long a WAFv2 resource name may be, which is the same for all three of
+ * the named types.
+ */
+const maximumNameLength = 128;
+/**
+ * What the three named WAFv2 Resource types read the same way.
+ *
+ * A web ACL, an IP set and a regex pattern set are each named within a scope
+ * and carry an optional description, and each is created through the ordinary
+ * WAFv2 command for it. What is left to a subclass is the handful of
+ * properties that say which of the three it is.
+ *
+ * The scope is read as whatever the template wrote and handed straight to the
+ * command, which refuses anything that is not `CLOUDFRONT` or `REGIONAL` and
+ * refuses `CLOUDFRONT` outside `us-east-1`. Deciding it here as well would be
+ * a second answer to a question WAFv2 already answers.
+ */
+export class SimCfnWafResourceConfig {
+    resource;
+    properties;
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.properties = properties.properties;
+    }
+    /**
+     * The resource name.
+     *
+     * `Name` is optional on all three types, and an unnamed resource is named
+     * after the stack and the logical ID as real CloudFormation names one. The
+     * name is part of the ARN and of what `Ref` answers with, so a template that
+     * leaves it out still gets something a test can predict.
+     */
+    name() {
+        const name = this.text("Name");
+        return (name ??
+            new SimCfnGeneratedResourceName({
+                stackName: this.resource.stackName,
+                logicalId: this.resource.logicalId,
+                maximumLength: maximumNameLength,
+            }).value);
+    }
+    /**
+     * The scope the resource belongs to, as the template wrote it.
+     */
+    scope() {
+        return this.text("Scope");
+    }
+    /**
+     * The description, when the template gave one.
+     */
+    description() {
+        return this.text("Description");
+    }
+    /**
+     * One property of the Resource, whatever shape it is in.
+     */
+    value(key) {
+        // oxlint-disable-next-line security/detect-object-injection
+        return this.properties[key] ?? undefined;
+    }
+    /**
+     * One string property, or nothing when the template left it out.
+     */
+    text(key) {
+        const value = this.value(key);
+        if (value === undefined) {
+            return undefined;
+        }
+        if (typeof value !== "string") {
+            this.refuse(`${key} must be a string`);
+        }
+        return value;
+    }
+    /**
+     * One list-of-strings property, or nothing when the template left it out.
+     */
+    strings(key) {
+        const value = this.value(key);
+        if (value === undefined) {
+            return undefined;
+        }
+        if (!Array.isArray(value)) {
+            this.refuse(`${key} must be a list`);
+        }
+        return value.map((entry) => {
+            if (typeof entry !== "string") {
+                this.refuse(`every entry of ${key} must be a string`);
+            }
+            return entry;
+        });
+    }
+    /**
+     * One list-of-strings property the Resource type requires.
+     *
+     * An omitted list is refused rather than read as an empty one. Both places
+     * this is used name a list CloudFormation requires, and an empty IP set or
+     * pattern set matches nothing, so a template that misspells `Addresses`
+     * would otherwise deploy a set with nothing in it and a rule pointing at it
+     * that never fires.
+     */
+    requiredStrings(key) {
+        return this.strings(key) ?? this.refuse(`${key} is required`);
+    }
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    refuse(reason) {
+        throw simCfnWafResourceError(this.resourceType, this.resource.logicalId, reason);
+    }
+}
+//# sourceMappingURL=sim-cfn-waf-resource-config.js.map

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-resource-config.js","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-cfn-waf-resource-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,uEAAuE,CAAC;AAMpH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;GAGG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAO9B;;;;;;;;;;;;GAYG;AACH,MAAM,OAAgB,uBAAuB;IACxB,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IAEzD,YAAY,UAA6C;QACvD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAOD;;;;;;;OAOG;IACH,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/B,OAAO,CACL,IAAI;YACJ,IAAI,2BAA2B,CAAC;gBAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAClC,aAAa,EAAE,iBAAiB;aACjC,CAAC,CAAC,KAAK,CACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,GAAW;QACzB,4DAA4D;QAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IAC3C,CAAC;IAED;;OAEG;IACO,IAAI,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACO,OAAO,CAAC,GAAW;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,kBAAkB,GAAG,mBAAmB,CAAC,CAAC;YACxD,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACO,eAAe,CAAC,GAAW;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACO,MAAM,CAAC,MAAc;QAC7B,MAAM,sBAAsB,CAC1B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,QAAQ,CAAC,SAAS,EACvB,MAAM,CACP,CAAC;IACJ,CAAC;CACF"}

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-deleter.d.ts

@@ -0,0 +1,21 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import { type SimCfnWafCreators } from "./sim-cfn-waf-creators.js";
+/**
+ * Deletes the simulated WAFv2 resources a CloudFormation Stack created.
+ *
+ * Each Resource is deleted through what CloudFormation held for it rather than
+ * by reading its template again. A web ACL is asked for by name, id and lock
+ * token, and an association by the resource ARN it was made against, and both
+ * of those come off the thing that was created.
+ */
+export declare class SimCfnWafResourceDeleter {
+    #private;
+    constructor(properties: {
+        readonly creators: SimCfnWafCreators;
+    });
+    /**
+     * Delete one simulated WAFv2 Resource.
+     */
+    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+}
+//# sourceMappingURL=sim-cfn-waf-resource-deleter.d.ts.map

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-deleter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-resource-deleter.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-cfn-waf-resource-deleter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAKxF,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,2BAA2B,CAAC;AAQnC;;;;;;;GAOG;AACH,qBAAa,wBAAwB;;IAGnC,YAAY,UAAU,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;KAAE,EAE/D;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC,CAoCf;CACF"}

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-deleter.js

@@ -0,0 +1,53 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { unsupportedSimWafResourceType, } from "./sim-cfn-waf-creators.js";
+import { wafIpSetResourceTypeName, wafRegexPatternSetResourceTypeName, wafWebAclAssociationResourceTypeName, wafWebAclResourceTypeName, } from "./sim-cfn-waf-resource-types.js";
+/**
+ * Deletes the simulated WAFv2 resources a CloudFormation Stack created.
+ *
+ * Each Resource is deleted through what CloudFormation held for it rather than
+ * by reading its template again. A web ACL is asked for by name, id and lock
+ * token, and an association by the resource ARN it was made against, and both
+ * of those come off the thing that was created.
+ */
+export class SimCfnWafResourceDeleter {
+    #creators;
+    constructor(properties) {
+        this.#creators = properties.creators;
+    }
+    /**
+     * Delete one simulated WAFv2 Resource.
+     */
+    async delete(resourceTypeName, resource) {
+        const creators = this.#creators;
+        switch (resourceTypeName) {
+            case wafWebAclResourceTypeName: {
+                await creators.webAcl.delete(resource, created(resource, "web ACL"));
+                return;
+            }
+            case wafWebAclAssociationResourceTypeName: {
+                await creators.association.delete(resource, created(resource, "web ACL association"));
+                return;
+            }
+            case wafIpSetResourceTypeName: {
+                await creators.ipSet.delete(resource, created(resource, "IP set"));
+                return;
+            }
+            case wafRegexPatternSetResourceTypeName: {
+                await creators.regexPatternSet.delete(resource, created(resource, "regex pattern set"));
+                return;
+            }
+            default: {
+                throw unsupportedSimWafResourceType(resourceTypeName, " deletion");
+            }
+        }
+    }
+}
+/**
+ * What CloudFormation held for a Resource, which a deletion cannot do without.
+ */
+function created(resource, described) {
+    const simResource = resource.simResource;
+    assertDefined(simResource, `sim WAFv2 ${described} for CloudFormation Resource ${resource.logicalId}`);
+    return simResource;
+}
+//# sourceMappingURL=sim-cfn-waf-resource-deleter.js.map

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-deleter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-resource-deleter.js","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-cfn-waf-resource-deleter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAMpE,OAAO,EAEL,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,oCAAoC,EACpC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAC1B,SAAS,CAAoB;IAEtC,YAAY,UAAoD;QAC9D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAEhC,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,yBAAyB,EAAE,CAAC;gBAC/B,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAC1B,QAAQ,EACR,OAAO,CAAe,QAAQ,EAAE,SAAS,CAAC,CAC3C,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,oCAAoC,EAAE,CAAC;gBAC1C,MAAM,QAAQ,CAAC,WAAW,CAAC,MAAM,CAC/B,QAAQ,EACR,OAAO,CAA6B,QAAQ,EAAE,qBAAqB,CAAC,CACrE,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,wBAAwB,EAAE,CAAC;gBAC9B,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CACzB,QAAQ,EACR,OAAO,CAAc,QAAQ,EAAE,QAAQ,CAAC,CACzC,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,kCAAkC,EAAE,CAAC;gBACxC,MAAM,QAAQ,CAAC,eAAe,CAAC,MAAM,CACnC,QAAQ,EACR,OAAO,CAAwB,QAAQ,EAAE,mBAAmB,CAAC,CAC9D,CAAC;gBACF,OAAO;YACT,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,6BAA6B,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,SAAS,OAAO,CACd,QAAwB,EACxB,SAAiB;IAEjB,MAAM,WAAW,GAAG,QAAQ,CAAC,WAA4B,CAAC;IAE1D,aAAa,CACX,WAAW,EACX,aAAa,SAAS,gCAAgC,QAAQ,CAAC,SAAS,EAAE,CAC3E,CAAC;IAEF,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-error.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Build the error a Resource of a simulated WAFv2 type is refused with.
+ *
+ * The wording is deliberate. Sim CloudFormation reads an error saying a
+ * Resource is unsupported as one to record and step over, and stepping over a
+ * web ACL that cannot be created as the template asked for it is the wrong
+ * answer: the stack would look deployed while every request the rules were
+ * written to stop went through. So a refusal here says the Resource is
+ * invalid.
+ */
+export declare function simCfnWafResourceError(resourceType: string, logicalId: string, reason: string, cause?: unknown): Error;
+/**
+ * Run the simulated WAFv2 commands one Resource is made of, naming the
+ * Resource in whatever they refuse.
+ *
+ * Every Resource type here goes through the ordinary WAFv2 commands, so what a
+ * template may ask for is decided once, by simulated WAFv2, rather than again
+ * in the CloudFormation layer. What that leaves out is where the request came
+ * from: a deployment failing with `Rule block-admin uses the statement kind
+ * SqliMatchStatement` says which rule but not which Resource declared it, and
+ * a template can hold several. Only WAFv2's own errors are renamed, so a
+ * refusal the CloudFormation layer decided keeps the wording it was written
+ * with.
+ */
+export declare function simCfnWafResourceCommand<T>(resourceType: string, logicalId: string, run: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=sim-cfn-waf-resource-error.d.ts.map

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-resource-error.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-cfn-waf-resource-error.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,OAAO,GACd,KAAK,CAIP;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAeZ"}

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-error.js

@@ -0,0 +1,41 @@
+import { SimWafError } from "../error/sim-wafv2.error.js";
+/**
+ * Build the error a Resource of a simulated WAFv2 type is refused with.
+ *
+ * The wording is deliberate. Sim CloudFormation reads an error saying a
+ * Resource is unsupported as one to record and step over, and stepping over a
+ * web ACL that cannot be created as the template asked for it is the wrong
+ * answer: the stack would look deployed while every request the rules were
+ * written to stop went through. So a refusal here says the Resource is
+ * invalid.
+ */
+export function simCfnWafResourceError(resourceType, logicalId, reason, cause) {
+    return new Error(`Invalid ${resourceType} Resource ${logicalId}: ${reason}`, {
+        cause,
+    });
+}
+/**
+ * Run the simulated WAFv2 commands one Resource is made of, naming the
+ * Resource in whatever they refuse.
+ *
+ * Every Resource type here goes through the ordinary WAFv2 commands, so what a
+ * template may ask for is decided once, by simulated WAFv2, rather than again
+ * in the CloudFormation layer. What that leaves out is where the request came
+ * from: a deployment failing with `Rule block-admin uses the statement kind
+ * SqliMatchStatement` says which rule but not which Resource declared it, and
+ * a template can hold several. Only WAFv2's own errors are renamed, so a
+ * refusal the CloudFormation layer decided keeps the wording it was written
+ * with.
+ */
+export async function simCfnWafResourceCommand(resourceType, logicalId, run) {
+    try {
+        return await run();
+    }
+    catch (error) {
+        if (error instanceof SimWafError) {
+            throw simCfnWafResourceError(resourceType, logicalId, error.message, error);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=sim-cfn-waf-resource-error.js.map

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-resource-error.js","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-cfn-waf-resource-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,SAAiB,EACjB,MAAc,EACd,KAAe;IAEf,OAAO,IAAI,KAAK,CAAC,WAAW,YAAY,aAAa,SAAS,KAAK,MAAM,EAAE,EAAE;QAC3E,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,YAAoB,EACpB,SAAiB,EACjB,GAAqB;IAErB,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,sBAAsB,CAC1B,YAAY,EACZ,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CACN,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-types.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The CloudFormation Resource types simulated WAFv2 creates.
+ *
+ * Named here rather than spelled out where they are used, because each one is
+ * written twice: once by the factory dispatching on it, and once by the
+ * refusals that quote it back to whoever wrote the template.
+ */
+export declare const wafWebAclResourceType = "AWS::WAFv2::WebACL";
+export declare const wafWebAclAssociationResourceType = "AWS::WAFv2::WebACLAssociation";
+export declare const wafIpSetResourceType = "AWS::WAFv2::IPSet";
+export declare const wafRegexPatternSetResourceType = "AWS::WAFv2::RegexPatternSet";
+/** The type names the CloudFormation layer dispatches on, without a prefix. */
+export declare const wafWebAclResourceTypeName = "WebACL";
+export declare const wafWebAclAssociationResourceTypeName = "WebACLAssociation";
+export declare const wafIpSetResourceTypeName = "IPSet";
+export declare const wafRegexPatternSetResourceTypeName = "RegexPatternSet";
+//# sourceMappingURL=sim-cfn-waf-resource-types.d.ts.map

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-resource-types.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-cfn-waf-resource-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAE1D,eAAO,MAAM,gCAAgC,kCAAkC,CAAC;AAEhF,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD,eAAO,MAAM,8BAA8B,gCAAgC,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAElD,eAAO,MAAM,oCAAoC,sBAAsB,CAAC;AAExE,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAEhD,eAAO,MAAM,kCAAkC,oBAAoB,CAAC"}

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-types.js

@@ -0,0 +1,17 @@
+/**
+ * The CloudFormation Resource types simulated WAFv2 creates.
+ *
+ * Named here rather than spelled out where they are used, because each one is
+ * written twice: once by the factory dispatching on it, and once by the
+ * refusals that quote it back to whoever wrote the template.
+ */
+export const wafWebAclResourceType = "AWS::WAFv2::WebACL";
+export const wafWebAclAssociationResourceType = "AWS::WAFv2::WebACLAssociation";
+export const wafIpSetResourceType = "AWS::WAFv2::IPSet";
+export const wafRegexPatternSetResourceType = "AWS::WAFv2::RegexPatternSet";
+/** The type names the CloudFormation layer dispatches on, without a prefix. */
+export const wafWebAclResourceTypeName = "WebACL";
+export const wafWebAclAssociationResourceTypeName = "WebACLAssociation";
+export const wafIpSetResourceTypeName = "IPSet";
+export const wafRegexPatternSetResourceTypeName = "RegexPatternSet";
+//# sourceMappingURL=sim-cfn-waf-resource-types.js.map

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-resource-types.js","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-cfn-waf-resource-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAE1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,6BAA6B,CAAC;AAE5E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD,MAAM,CAAC,MAAM,oCAAoC,GAAG,mBAAmB,CAAC;AAExE,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,MAAM,CAAC,MAAM,kCAAkC,GAAG,iBAAiB,CAAC"}

package/dist/service/wafv2/cfn/sim-waf-cfn-resource-factory.d.ts

@@ -0,0 +1,34 @@
+import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimWafV2 } from "../sim-wafv2.js";
+interface SimWafCfnResourceFactoryProperties {
+    readonly wafV2: SimWafV2;
+}
+/**
+ * CloudFormation Resource factory for simulated WAFv2 resources.
+ *
+ * Four `AWS::WAFv2::*` Resource types are modelled: the web ACL, the
+ * association putting one in front of a resource, and the two sets a rule can
+ * refer to. A rule group is a resource in its own right that nothing here
+ * simulates, and a logging configuration has no log to write to, so a template
+ * declaring either is reported as unsupported rather than quietly treated as
+ * deployed.
+ *
+ * A CloudFront distribution is not associated through this factory. CloudFront
+ * carries the web ACL on the distribution itself, as `WebACLId`, and simulated
+ * CloudFront resolves that ARN when it serves a request.
+ */
+export declare class SimWafCfnResourceFactory implements SimCfnServiceResourceFactory {
+    #private;
+    constructor(properties: SimWafCfnResourceFactoryProperties);
+    /**
+     * Create a simulated WAFv2 resource from a CloudFormation Resource.
+     */
+    create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
+    /**
+     * Delete a simulated WAFv2 resource created from a CloudFormation Resource.
+     */
+    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sim-waf-cfn-resource-factory.d.ts.map

package/dist/service/wafv2/cfn/sim-waf-cfn-resource-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-cfn-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-waf-cfn-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAC3H,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAchD,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAyB,YAAW,4BAA4B;;IAI3E,YAAY,UAAU,EAAE,kCAAkC,EAKzD;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB7B;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC,CAEf;CACF"}

package/dist/service/wafv2/cfn/sim-waf-cfn-resource-factory.js

@@ -0,0 +1,58 @@
+import { simCfnWafCreators, unsupportedSimWafResourceType, } from "./sim-cfn-waf-creators.js";
+import { SimCfnWafResourceDeleter } from "./sim-cfn-waf-resource-deleter.js";
+import { wafIpSetResourceTypeName, wafRegexPatternSetResourceTypeName, wafWebAclAssociationResourceTypeName, wafWebAclResourceTypeName, } from "./sim-cfn-waf-resource-types.js";
+/**
+ * CloudFormation Resource factory for simulated WAFv2 resources.
+ *
+ * Four `AWS::WAFv2::*` Resource types are modelled: the web ACL, the
+ * association putting one in front of a resource, and the two sets a rule can
+ * refer to. A rule group is a resource in its own right that nothing here
+ * simulates, and a logging configuration has no log to write to, so a template
+ * declaring either is reported as unsupported rather than quietly treated as
+ * deployed.
+ *
+ * A CloudFront distribution is not associated through this factory. CloudFront
+ * carries the web ACL on the distribution itself, as `WebACLId`, and simulated
+ * CloudFront resolves that ARN when it serves a request.
+ */
+export class SimWafCfnResourceFactory {
+    #creators;
+    #deleter;
+    constructor(properties) {
+        this.#creators = simCfnWafCreators(properties.wafV2);
+        this.#deleter = new SimCfnWafResourceDeleter({
+            creators: this.#creators,
+        });
+    }
+    /**
+     * Create a simulated WAFv2 resource from a CloudFormation Resource.
+     */
+    async create(resourceTypeName, resource, context) {
+        const properties = context.resolvedProperties ?? resource.properties;
+        const creators = this.#creators;
+        switch (resourceTypeName) {
+            case wafWebAclResourceTypeName: {
+                return await creators.webAcl.create(resource, properties);
+            }
+            case wafWebAclAssociationResourceTypeName: {
+                return await creators.association.create(resource, properties);
+            }
+            case wafIpSetResourceTypeName: {
+                return await creators.ipSet.create(resource, properties);
+            }
+            case wafRegexPatternSetResourceTypeName: {
+                return await creators.regexPatternSet.create(resource, properties);
+            }
+            default: {
+                throw unsupportedSimWafResourceType(resourceTypeName, "");
+            }
+        }
+    }
+    /**
+     * Delete a simulated WAFv2 resource created from a CloudFormation Resource.
+     */
+    async delete(resourceTypeName, resource) {
+        await this.#deleter.delete(resourceTypeName, resource);
+    }
+}
+//# sourceMappingURL=sim-waf-cfn-resource-factory.js.map

package/dist/service/wafv2/cfn/sim-waf-cfn-resource-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-cfn-resource-factory.js","sourceRoot":"","sources":["../../../../src/service/wafv2/cfn/sim-waf-cfn-resource-factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,oCAAoC,EACpC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAMzC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,wBAAwB;IAC1B,SAAS,CAAoB;IAC7B,QAAQ,CAA2B;IAE5C,YAAY,UAA8C;QACxD,IAAI,CAAC,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,wBAAwB,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAEhC,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,yBAAyB,EAAE,CAAC;gBAC/B,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,oCAAoC,EAAE,CAAC;gBAC1C,OAAO,MAAM,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACjE,CAAC;YACD,KAAK,wBAAwB,EAAE,CAAC;gBAC9B,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC3D,CAAC;YACD,KAAK,kCAAkC,EAAE,CAAC;gBACxC,OAAO,MAAM,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACrE,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,6BAA6B,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB;QAExB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.d.ts

@@ -0,0 +1,31 @@
+import type { SimCreateWebAclCommandInput } from "../../command/web-acl/web-acl.command.js";
+import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
+/**
+ * Reads an AWS::WAFv2::WebACL Resource into what CreateWebACL takes.
+ *
+ * CloudFormation spells a web ACL the way the API spells it, so the rules, the
+ * default action and the custom response bodies are handed over as the
+ * template wrote them. They are not read here at all: every rule is compiled
+ * by CreateWebACL, which is where a statement kind Yulin cannot evaluate is
+ * refused, and reading them twice would mean two answers to the same question.
+ */
+export declare class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
+    protected get resourceType(): string;
+    /**
+     * The input the web ACL this Resource describes is created from.
+     *
+     * The properties this simulation has no behaviour for are passed through
+     * rather than dropped, so `CaptchaConfig` and the rest are refused by
+     * CreateWebACL as they are for an SDK caller.
+     */
+    createInput(): SimCreateWebAclCommandInput;
+    /**
+     * The rules the template declared.
+     *
+     * A web ACL with no `Rules` is one whose default action decides every
+     * request, which is a template AWS accepts and a reasonable thing to deploy
+     * before any rules are written.
+     */
+    private rules;
+}
+//# sourceMappingURL=sim-cfn-waf-web-acl-config.d.ts.map

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-web-acl-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAG5E;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,SAAQ,uBAAuB;IAChE,cAAuB,YAAY,IAAI,MAAM,CAE5C;IAED;;;;;;OAMG;IACH,WAAW,IAAI,2BAA2B,CAqBzC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;CAad"}

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.js

@@ -0,0 +1,59 @@
+import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
+import { wafWebAclResourceType } from "../sim-cfn-waf-resource-types.js";
+/**
+ * Reads an AWS::WAFv2::WebACL Resource into what CreateWebACL takes.
+ *
+ * CloudFormation spells a web ACL the way the API spells it, so the rules, the
+ * default action and the custom response bodies are handed over as the
+ * template wrote them. They are not read here at all: every rule is compiled
+ * by CreateWebACL, which is where a statement kind Yulin cannot evaluate is
+ * refused, and reading them twice would mean two answers to the same question.
+ */
+export class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
+    get resourceType() {
+        return wafWebAclResourceType;
+    }
+    /**
+     * The input the web ACL this Resource describes is created from.
+     *
+     * The properties this simulation has no behaviour for are passed through
+     * rather than dropped, so `CaptchaConfig` and the rest are refused by
+     * CreateWebACL as they are for an SDK caller.
+     */
+    createInput() {
+        return {
+            Name: this.name(),
+            Scope: this.scope(),
+            Description: this.description(),
+            DefaultAction: this.value("DefaultAction"),
+            Rules: this.rules(),
+            VisibilityConfig: this.value("VisibilityConfig"),
+            CustomResponseBodies: this.value("CustomResponseBodies"),
+            CaptchaConfig: this.value("CaptchaConfig"),
+            ChallengeConfig: this.value("ChallengeConfig"),
+            TokenDomains: this.strings("TokenDomains"),
+            AssociationConfig: this.value("AssociationConfig"),
+            DataProtectionConfig: this.value("DataProtectionConfig"),
+            OnSourceDDoSProtectionConfig: this.value("OnSourceDDoSProtectionConfig"),
+            ApplicationConfig: this.value("ApplicationConfig"),
+        };
+    }
+    /**
+     * The rules the template declared.
+     *
+     * A web ACL with no `Rules` is one whose default action decides every
+     * request, which is a template AWS accepts and a reasonable thing to deploy
+     * before any rules are written.
+     */
+    rules() {
+        const rules = this.value("Rules");
+        if (rules === undefined) {
+            return undefined;
+        }
+        if (!Array.isArray(rules)) {
+            this.refuse("Rules must be a list");
+        }
+        return rules;
+    }
+}
+//# sourceMappingURL=sim-cfn-waf-web-acl-config.js.map

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-web-acl-config.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAsB,SAAQ,uBAAuB;IAChE,IAAuB,YAAY;QACjC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC/B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAE5B;YACb,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAChD,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAE1C;YACb,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;YAC1C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC9C,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC1C,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;YAClD,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;YACxD,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;YACxE,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;SACnD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,KAAmC,CAAC;IAC7C,CAAC;CACF"}

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.d.ts

@@ -0,0 +1,34 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimWafV2 } from "../../sim-wafv2.js";
+import type { SimWafWebAcl } from "../../web-acl/sim-waf-web-acl.js";
+interface SimCfnWafWebAclCreatorProperties {
+    readonly wafV2: SimWafV2;
+}
+/**
+ * Creates simulated web ACLs from AWS::WAFv2::WebACL Resources.
+ *
+ * The web ACL is created through the ordinary CreateWebACL command rather than
+ * constructed directly, so one a template deployed is the same thing an SDK
+ * caller would have got: the same compilation of every rule, and the same
+ * refusal of a statement kind this simulation cannot evaluate.
+ */
+export declare class SimCfnWafWebAclCreator {
+    #private;
+    constructor(properties: SimCfnWafWebAclCreatorProperties);
+    /**
+     * Create the web ACL an AWS::WAFv2::WebACL Resource describes.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimWafWebAcl>;
+    /**
+     * Delete the web ACL an AWS::WAFv2::WebACL Resource created.
+     *
+     * DeleteWebACL refuses a web ACL something is still in front of, and a
+     * teardown reaches the associations first because each one names the web ACL
+     * it holds. A template that associates without naming it keeps that refusal,
+     * which says which resources are still pointing at the ACL.
+     */
+    delete(resource: SimCfnResource, webAcl: SimWafWebAcl): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-waf-web-acl-creator.d.ts.map

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-web-acl-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAKrE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAsB;;IAGjC,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,YAAY,CAAC,CA8BvB;IAED;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAc1E;CACF"}

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.js

@@ -0,0 +1,54 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { wafWebAclResourceType } from "../sim-cfn-waf-resource-types.js";
+import { SimCfnWafWebAclConfig } from "./sim-cfn-waf-web-acl-config.js";
+/**
+ * Creates simulated web ACLs from AWS::WAFv2::WebACL Resources.
+ *
+ * The web ACL is created through the ordinary CreateWebACL command rather than
+ * constructed directly, so one a template deployed is the same thing an SDK
+ * caller would have got: the same compilation of every rule, and the same
+ * refusal of a statement kind this simulation cannot evaluate.
+ */
+export class SimCfnWafWebAclCreator {
+    #wafV2;
+    constructor(properties) {
+        this.#wafV2 = properties.wafV2;
+    }
+    /**
+     * Create the web ACL an AWS::WAFv2::WebACL Resource describes.
+     */
+    async create(resource, properties) {
+        const input = new SimCfnWafWebAclConfig({
+            resource,
+            properties,
+        }).createInput();
+        return await simCfnWafResourceCommand(wafWebAclResourceType, resource.logicalId, async () => {
+            const created = await this.#wafV2.createWebAcl({ input });
+            const arn = created.Summary?.ARN;
+            assertDefined(arn, `sim WAFv2 web ACL ARN for CloudFormation Resource ${resource.logicalId}`);
+            const webAcl = this.#wafV2.findWebAclByArn(arn);
+            assertDefined(webAcl, `sim WAFv2 web ACL ${arn} after CloudFormation creation`);
+            return webAcl;
+        });
+    }
+    /**
+     * Delete the web ACL an AWS::WAFv2::WebACL Resource created.
+     *
+     * DeleteWebACL refuses a web ACL something is still in front of, and a
+     * teardown reaches the associations first because each one names the web ACL
+     * it holds. A template that associates without naming it keeps that refusal,
+     * which says which resources are still pointing at the ACL.
+     */
+    async delete(resource, webAcl) {
+        await simCfnWafResourceCommand(wafWebAclResourceType, resource.logicalId, async () => await this.#wafV2.deleteWebAcl({
+            input: {
+                Name: webAcl.name,
+                Scope: webAcl.scope,
+                Id: webAcl.id,
+                LockToken: webAcl.lockToken,
+            },
+        }));
+    }
+}
+//# sourceMappingURL=sim-cfn-waf-web-acl-creator.js.map

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-waf-web-acl-creator.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAMxE;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACxB,MAAM,CAAW;IAE1B,YAAY,UAA4C;QACtD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC;YACtC,QAAQ;YACR,UAAU;SACX,CAAC,CAAC,WAAW,EAAE,CAAC;QAEjB,OAAO,MAAM,wBAAwB,CACnC,qBAAqB,EACrB,QAAQ,CAAC,SAAS,EAClB,KAAK,IAAI,EAAE;YACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;YAEjC,aAAa,CACX,GAAG,EACH,qDACE,QAAQ,CAAC,SACX,EAAE,CACH,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAEhD,aAAa,CACX,MAAM,EACN,qBAAqB,GAAG,gCAAgC,CACzD,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,QAAwB,EAAE,MAAoB;QACzD,MAAM,wBAAwB,CAC5B,qBAAqB,EACrB,QAAQ,CAAC,SAAS,EAClB,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7B,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B;SACF,CAAC,CACL,CAAC;IACJ,CAAC;CACF"}