@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.js

@@ -0,0 +1,46 @@
+import { SimRestApiAuthorizer, simRestApiCognitoAuthType, } from "./sim-rest-api-authorizer.js";
+/**
+ * A simulated REST API `COGNITO_USER_POOLS` authorizer: the user pools whose
+ * tokens a method admits.
+ *
+ * Nothing is invoked for a request. The authorizer verifies the token itself
+ * against the keys the pools publish, which is why it names pools where a
+ * Lambda authorizer names a function.
+ *
+ * What a token has to carry beyond a signature one of those pools made is the
+ * method's business rather than this one's: the scopes a method asks for are
+ * declared on the method, so one authorizer covers methods asking for
+ * different scopes.
+ */
+export class SimRestApiCognitoAuthorizer extends SimRestApiAuthorizer {
+    type = "COGNITO_USER_POOLS";
+    /**
+     * The user pools this authorizer accepts tokens from, read from its
+     * `providerARNs`.
+     */
+    providers;
+    /**
+     * The header carrying the token, which is where the request is read from.
+     * There is one, as there is for a `TOKEN` authorizer.
+     */
+    identitySource;
+    constructor(properties) {
+        super(properties);
+        this.providers = properties.providers;
+        this.identitySource = properties.identitySource;
+    }
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view() {
+        return {
+            id: this.authorizerId,
+            name: this.name,
+            type: this.type,
+            authType: simRestApiCognitoAuthType,
+            providerARNs: [...this.providers.arns],
+            identitySource: this.identitySource.expression,
+        };
+    }
+}
+//# sourceMappingURL=sim-rest-api-cognito-authorizer.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-cognito-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EAGpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAUtC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,2BAA4B,SAAQ,oBAAoB;IACnD,IAAI,GAAG,oBAA6B,CAAC;IAErD;;;OAGG;IACa,SAAS,CAA8B;IAEvD;;;OAGG;IACa,cAAc,CAA2B;IAEzD,YAAY,UAAiD;QAC3D,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,yBAAyB;YACnC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACtC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.d.ts

@@ -0,0 +1,61 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimRestApiMethodScopes } from "../method/sim-rest-api-method-scopes.js";
+import { type SimRestApiAuthorization } from "./sim-rest-api-authorization.js";
+import type { SimRestApiCognitoAuthorizer } from "./sim-rest-api-cognito-authorizer.js";
+import type { SimRestApiUserPools } from "./sim-rest-api-user-pools.js";
+interface SimRestApiCognitoVerificationProperties {
+    readonly userPools: SimRestApiUserPools;
+    readonly clock: SimClock;
+}
+/**
+ * Verifies one token against one `COGNITO_USER_POOLS` authorizer.
+ *
+ * The checks are the ones a JWT verifier makes: decode the token, check its
+ * algorithm, find the pool publishing the key its `kid` names, verify the
+ * signature, then check the claims. Every one of them answers the same 401, so
+ * a client learns that its token was not accepted and nothing about which
+ * check it failed.
+ *
+ * `token_use` is not checked, so an id token and an access token are both
+ * accepted by a method asking for no scope. The method's scopes are the one
+ * thing that tells the two apart, since only an access token carries a `scope`
+ * claim, and they are checked here because they are checked against the token.
+ */
+export declare class SimRestApiCognitoVerification {
+    private readonly userPools;
+    private readonly times;
+    private readonly rs256;
+    constructor(properties: SimRestApiCognitoVerificationProperties);
+    /**
+     * Verify a token, answering what the method should do with the request that
+     * carried it.
+     */
+    verify(authorizer: SimRestApiCognitoAuthorizer, token: string, scopes: SimRestApiMethodScopes): SimRestApiAuthorization;
+    /**
+     * The request once the token is known to be genuine, which the method's
+     * scopes can still refuse.
+     *
+     * An unmet scope is a 403 rather than a 401: the token was accepted, and it
+     * does not allow this method. It is the same refusal a policy allowing
+     * nothing relevant gets, since both are a caller API Gateway identified and
+     * then would not admit.
+     */
+    private admitted;
+    /**
+     * The pool of this authorizer that published the key the token names.
+     *
+     * A pool the simulation has not got publishes nothing and matches nothing,
+     * which is what makes an authorizer naming a deleted pool refuse every
+     * token rather than admit one it could not check.
+     */
+    private signingPool;
+    /**
+     * Read the token, or answer undefined for one that is not a JWT at all.
+     *
+     * The refusal for an unreadable token and for one that fails verification is
+     * the same, so nothing is gained by carrying the parse error further.
+     */
+    private decode;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-cognito-verification.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-verification.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAOpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAUD;;;;;;;;;;;;;GAaG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;;OAGG;IACH,MAAM,CACJ,UAAU,EAAE,2BAA2B,EACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,sBAAsB,GAC7B,uBAAuB,CAqBzB;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ;IAahB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAgBnB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;CAOf"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.js

@@ -0,0 +1,97 @@
+import { simJwtClaimStrings } from "../../../../util/jwt/sim-jwt-claim-strings.js";
+import { SimJwtRs256 } from "../../../../util/jwt/sim-jwt-rs256.js";
+import { simJwtScopes } from "../../../../util/jwt/sim-jwt-scopes.js";
+import { SimJwtTimeClaims } from "../../../../util/jwt/sim-jwt-time-claims.js";
+import { SimJwt } from "../../../../util/jwt/sim-jwt.js";
+import { SimRestApiAdmitted, SimRestApiRefused, } from "./sim-rest-api-authorization.js";
+/**
+ * Verifies one token against one `COGNITO_USER_POOLS` authorizer.
+ *
+ * The checks are the ones a JWT verifier makes: decode the token, check its
+ * algorithm, find the pool publishing the key its `kid` names, verify the
+ * signature, then check the claims. Every one of them answers the same 401, so
+ * a client learns that its token was not accepted and nothing about which
+ * check it failed.
+ *
+ * `token_use` is not checked, so an id token and an access token are both
+ * accepted by a method asking for no scope. The method's scopes are the one
+ * thing that tells the two apart, since only an access token carries a `scope`
+ * claim, and they are checked here because they are checked against the token.
+ */
+export class SimRestApiCognitoVerification {
+    userPools;
+    times;
+    rs256 = new SimJwtRs256();
+    constructor(properties) {
+        this.userPools = properties.userPools;
+        this.times = new SimJwtTimeClaims({ clock: properties.clock });
+    }
+    /**
+     * Verify a token, answering what the method should do with the request that
+     * carried it.
+     */
+    verify(authorizer, token, scopes) {
+        const jwt = this.decode(token);
+        if (jwt === undefined || !this.rs256.isSupportedAlgorithm(jwt)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const signing = this.signingPool(authorizer, jwt);
+        if (signing === undefined || !this.rs256.verify(jwt, signing.key)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        if (jwt.claims.text("iss") !== signing.pool.issuerUrl ||
+            !this.times.hold(jwt.claims)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        return this.admitted(jwt, scopes);
+    }
+    /**
+     * The request once the token is known to be genuine, which the method's
+     * scopes can still refuse.
+     *
+     * An unmet scope is a 403 rather than a 401: the token was accepted, and it
+     * does not allow this method. It is the same refusal a policy allowing
+     * nothing relevant gets, since both are a caller API Gateway identified and
+     * then would not admit.
+     */
+    admitted(jwt, scopes) {
+        if (!scopes.permits(simJwtScopes(jwt.claims))) {
+            return SimRestApiRefused.implicitDeny();
+        }
+        return new SimRestApiAdmitted({
+            cognito: { claims: simJwtClaimStrings(jwt.claims) },
+        });
+    }
+    /**
+     * The pool of this authorizer that published the key the token names.
+     *
+     * A pool the simulation has not got publishes nothing and matches nothing,
+     * which is what makes an authorizer naming a deleted pool refuse every
+     * token rather than admit one it could not check.
+     */
+    signingPool(authorizer, jwt) {
+        for (const userPoolId of authorizer.providers.userPoolIds) {
+            const pool = this.userPools.find(userPoolId);
+            const key = pool?.keys.find(jwt.header.kid);
+            if (pool !== undefined && key !== undefined) {
+                return { pool, key };
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Read the token, or answer undefined for one that is not a JWT at all.
+     *
+     * The refusal for an unreadable token and for one that fails verification is
+     * the same, so nothing is gained by carrying the parse error further.
+     */
+    decode(token) {
+        try {
+            return SimJwt.parse(token);
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=sim-rest-api-cognito-verification.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-verification.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-cognito-verification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AAEnF,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAoBzC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,6BAA6B;IACvB,SAAS,CAAsB;IAC/B,KAAK,CAAmB;IACxB,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAE3C,YAAY,UAAmD;QAC7D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,UAAuC,EACvC,KAAa,EACb,MAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAElD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IACE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,SAAS;YACjD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAC5B,CAAC;YACD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CACd,GAAW,EACX,MAA8B;QAE9B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CACjB,UAAuC,EACvC,GAAW;QAEX,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-lambda-authorizer.d.ts

@@ -0,0 +1,59 @@
+import type { SimRestApiLambdaUri } from "../method/sim-rest-api-lambda-uri.js";
+import type { SimRestApiIdentitySources } from "./identity/sim-rest-api-identity-sources.js";
+import { SimRestApiAuthorizerResultCache } from "./sim-rest-api-authorizer-result-cache.js";
+import { SimRestApiAuthorizer, type SimRestApiAuthorizerId, type SimRestApiAuthorizerView } from "./sim-rest-api-authorizer.js";
+/**
+ * The kinds of authorizer that decide by invoking a function.
+ */
+export type SimRestApiLambdaAuthorizerType = "TOKEN" | "REQUEST";
+interface SimRestApiLambdaAuthorizerProperties {
+    readonly authorizerId: SimRestApiAuthorizerId;
+    readonly name: string;
+    readonly type: SimRestApiLambdaAuthorizerType;
+    readonly lambdaUri: SimRestApiLambdaUri;
+    readonly identitySources: SimRestApiIdentitySources;
+    readonly resultTtlSeconds: number;
+}
+/**
+ * A simulated REST API Lambda authorizer: the function a method sends a
+ * request to before it reaches the integration.
+ *
+ * The function decides, so nothing here says what a caller has to present.
+ * All this holds is which function to invoke, what the request has to carry
+ * before it is worth invoking, how much of the request that function is shown,
+ * and the decisions it has already made.
+ */
+export declare class SimRestApiLambdaAuthorizer extends SimRestApiAuthorizer {
+    /**
+     * How much of the request the function sees, which is the whole difference
+     * between the two kinds.
+     */
+    readonly type: SimRestApiLambdaAuthorizerType;
+    /**
+     * The Lambda function this authorizer invokes, read from its
+     * `authorizerUri`.
+     */
+    readonly lambdaUri: SimRestApiLambdaUri;
+    /**
+     * Where the request has to carry something for the function to be invoked at
+     * all. A `TOKEN` authorizer has exactly one, and its value is the token the
+     * function is invoked with.
+     */
+    readonly identitySources: SimRestApiIdentitySources;
+    /**
+     * How long a decision is held for, in seconds, with zero meaning none.
+     */
+    readonly resultTtlSeconds: number;
+    /**
+     * The decisions already made, which a request presenting the same identity
+     * to the same method is served from rather than invoking the function again.
+     */
+    readonly results: SimRestApiAuthorizerResultCache;
+    constructor(properties: SimRestApiLambdaAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view(): SimRestApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-lambda-authorizer.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-lambda-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-lambda-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-lambda-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EACL,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE9B,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjE,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,oBAAoB;IAClE;;;OAGG;IACH,SAAgB,IAAI,EAAE,8BAA8B,CAAC;IAErD;;;OAGG;IACH,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAE/C;;;;OAIG;IACH,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAE3D;;OAEG;IACH,SAAgB,gBAAgB,EAAE,MAAM,CAAC;IAEzC;;;OAGG;IACH,SAAgB,OAAO,EAAE,+BAA+B,CAAC;IAEzD,YAAY,UAAU,EAAE,oCAAoC,EAS3D;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAU/B;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-lambda-authorizer.js

@@ -0,0 +1,61 @@
+import { SimRestApiAuthorizerResultCache } from "./sim-rest-api-authorizer-result-cache.js";
+import { SimRestApiAuthorizer, simRestApiCustomAuthType, } from "./sim-rest-api-authorizer.js";
+/**
+ * A simulated REST API Lambda authorizer: the function a method sends a
+ * request to before it reaches the integration.
+ *
+ * The function decides, so nothing here says what a caller has to present.
+ * All this holds is which function to invoke, what the request has to carry
+ * before it is worth invoking, how much of the request that function is shown,
+ * and the decisions it has already made.
+ */
+export class SimRestApiLambdaAuthorizer extends SimRestApiAuthorizer {
+    /**
+     * How much of the request the function sees, which is the whole difference
+     * between the two kinds.
+     */
+    type;
+    /**
+     * The Lambda function this authorizer invokes, read from its
+     * `authorizerUri`.
+     */
+    lambdaUri;
+    /**
+     * Where the request has to carry something for the function to be invoked at
+     * all. A `TOKEN` authorizer has exactly one, and its value is the token the
+     * function is invoked with.
+     */
+    identitySources;
+    /**
+     * How long a decision is held for, in seconds, with zero meaning none.
+     */
+    resultTtlSeconds;
+    /**
+     * The decisions already made, which a request presenting the same identity
+     * to the same method is served from rather than invoking the function again.
+     */
+    results;
+    constructor(properties) {
+        super(properties);
+        this.type = properties.type;
+        this.lambdaUri = properties.lambdaUri;
+        this.identitySources = properties.identitySources;
+        this.resultTtlSeconds = properties.resultTtlSeconds;
+        this.results = new SimRestApiAuthorizerResultCache(properties.resultTtlSeconds);
+    }
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view() {
+        return {
+            id: this.authorizerId,
+            name: this.name,
+            type: this.type,
+            authType: simRestApiCustomAuthType,
+            authorizerUri: this.lambdaUri.uri,
+            identitySource: this.identitySources.expression,
+            authorizerResultTtlInSeconds: this.resultTtlSeconds,
+        };
+    }
+}
+//# sourceMappingURL=sim-rest-api-lambda-authorizer.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-lambda-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-lambda-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-lambda-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EACL,oBAAoB,EAGpB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AAgBtC;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,oBAAoB;IAClE;;;OAGG;IACa,IAAI,CAAiC;IAErD;;;OAGG;IACa,SAAS,CAAsB;IAE/C;;;;OAIG;IACa,eAAe,CAA4B;IAE3D;;OAEG;IACa,gBAAgB,CAAS;IAEzC;;;OAGG;IACa,OAAO,CAAkC;IAEzD,YAAY,UAAgD;QAC1D,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,+BAA+B,CAChD,UAAU,CAAC,gBAAgB,CAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,wBAAwB;YAClC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG;YACjC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU;YAC/C,4BAA4B,EAAE,IAAI,CAAC,gBAAgB;SACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-user-pool-providers.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The user pools a `COGNITO_USER_POOLS` authorizer accepts tokens from.
+ *
+ * Real `CreateAuthorizer` takes them as ARNs and requires at least one, and a
+ * token is admitted when any one of the pools issued it. The ARNs are kept as
+ * they were written, because that is what `GetAuthorizer` hands back, and the
+ * pool ids are what a token is verified against.
+ */
+export declare class SimRestApiUserPoolProviders {
+    /**
+     * The ARNs as they were written, which is what the API reports back.
+     */
+    readonly arns: readonly string[];
+    /**
+     * The pool ids those ARNs name, in the order they were written.
+     */
+    readonly userPoolIds: readonly string[];
+    private constructor();
+    /**
+     * Read the `providerARNs` an authorizer was created with, refusing a list
+     * this simulation could not verify a token against.
+     *
+     * An authorizer naming no pool, or naming something that is not a user pool
+     * ARN, refuses every request. That reads to a caller like a signing problem
+     * rather than the configuration one it is, so it is refused when the
+     * authorizer is created.
+     */
+    static parse(providerArns: readonly string[]): SimRestApiUserPoolProviders;
+}
+//# sourceMappingURL=sim-rest-api-user-pool-providers.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-user-pool-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-user-pool-providers.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-user-pool-providers.ts"],"names":[],"mappings":"AAYA;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC;;OAEG;IACH,SAAgB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC;;OAEG;IACH,SAAgB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAE/C,OAAO,eAGN;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,2BAA2B,CAYzE;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-user-pool-providers.js

@@ -0,0 +1,59 @@
+import { SimApiGatewayBadRequest } from "../../error/sim-api-gateway.error.js";
+/**
+ * The ARN of one Cognito user pool, whose last segment is the pool's own id.
+ *
+ * The Account and the Region the ARN names are not read. A pool in another
+ * Account is out of scope here, and the pool id already carries its Region, so
+ * the id is the whole of what this simulation looks a pool up by.
+ */
+const userPoolArn = /^arn:aws:cognito-idp:[a-z0-9-]+:\d{12}:userpool\/(?<poolId>[a-z0-9-]+_[A-Za-z0-9]+)$/u;
+/**
+ * The user pools a `COGNITO_USER_POOLS` authorizer accepts tokens from.
+ *
+ * Real `CreateAuthorizer` takes them as ARNs and requires at least one, and a
+ * token is admitted when any one of the pools issued it. The ARNs are kept as
+ * they were written, because that is what `GetAuthorizer` hands back, and the
+ * pool ids are what a token is verified against.
+ */
+export class SimRestApiUserPoolProviders {
+    /**
+     * The ARNs as they were written, which is what the API reports back.
+     */
+    arns;
+    /**
+     * The pool ids those ARNs name, in the order they were written.
+     */
+    userPoolIds;
+    constructor(arns, userPoolIds) {
+        this.arns = arns;
+        this.userPoolIds = userPoolIds;
+    }
+    /**
+     * Read the `providerARNs` an authorizer was created with, refusing a list
+     * this simulation could not verify a token against.
+     *
+     * An authorizer naming no pool, or naming something that is not a user pool
+     * ARN, refuses every request. That reads to a caller like a signing problem
+     * rather than the configuration one it is, so it is refused when the
+     * authorizer is created.
+     */
+    static parse(providerArns) {
+        if (providerArns.length === 0) {
+            throw new SimApiGatewayBadRequest("CreateAuthorizer with type COGNITO_USER_POOLS requires providerARNs " +
+                "naming at least one user pool");
+        }
+        return new SimRestApiUserPoolProviders([...providerArns], providerArns.map((arn) => userPoolId(arn)));
+    }
+}
+/**
+ * The pool an ARN names, refusing one that names no user pool.
+ */
+function userPoolId(arn) {
+    const poolId = userPoolArn.exec(arn)?.groups?.["poolId"];
+    if (poolId === undefined) {
+        throw new SimApiGatewayBadRequest(`providerARNs entry '${arn}' is not a user pool ARN, which is written ` +
+            `as 'arn:aws:cognito-idp:<region>:<account>:userpool/<poolId>'`);
+    }
+    return poolId;
+}
+//# sourceMappingURL=sim-rest-api-user-pool-providers.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-user-pool-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-user-pool-providers.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-user-pool-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,WAAW,GACf,uFAAuF,CAAC;AAE1F;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACa,IAAI,CAAoB;IAExC;;OAEG;IACa,WAAW,CAAoB;IAE/C,YAAoB,IAAuB,EAAE,WAA8B;QACzE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,YAA+B;QAC1C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,uBAAuB,CAC/B,sEAAsE;gBACpE,+BAA+B,CAClC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,2BAA2B,CACpC,CAAC,GAAG,YAAY,CAAC,EACjB,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAC3C,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;IAEzD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,GAAG,6CAA6C;YACrE,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-user-pools.d.ts

@@ -0,0 +1,45 @@
+import type { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * One user pool a `COGNITO_USER_POOLS` authorizer verifies tokens against.
+ */
+export interface SimRestApiUserPool {
+    /** The URL this pool's tokens name as their issuer. */
+    readonly issuerUrl: string;
+    /** The public keys this pool publishes. */
+    readonly keys: SimJwtKeys;
+}
+/**
+ * The user pools an API Gateway can reach, as its Cognito authorizers see
+ * them.
+ *
+ * A REST API authorizer names a pool by ARN, and all this asks for is what the
+ * pool id in that ARN resolves to. That is how a Cognito authorizer reaches
+ * simulated Cognito without API Gateway depending on it.
+ *
+ * Nothing is fetched over HTTP. A pool's published OpenID configuration names
+ * the localhost origin it is served from, while its tokens name the real AWS
+ * URL, so a discovery client would reject its own issuer's tokens. Resolving
+ * in process compares the two strings that both come from the same getter.
+ */
+export interface SimRestApiUserPools {
+    /**
+     * The pool this id names, which is nothing when this simulation has no such
+     * pool.
+     */
+    find(userPoolId: string): SimRestApiUserPool | undefined;
+}
+/**
+ * The pools available to an API Gateway that has no Cognito to ask.
+ *
+ * Every pool id resolves to nothing, so every token fails key selection and
+ * every request to a Cognito method is refused. That is the safe answer for a
+ * simulated API Gateway standing on its own: a method configured to be closed
+ * stays closed.
+ */
+export declare class SimRestApiNoUserPools implements SimRestApiUserPools {
+    /**
+     * No pool id resolves here.
+     */
+    find(): undefined;
+}
+//# sourceMappingURL=sim-rest-api-user-pools.d.ts.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-user-pools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-user-pools.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-user-pools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,YAAW,mBAAmB;IAC/D;;OAEG;IACH,IAAI,IAAI,SAAS,CAEhB;CACF"}

package/dist/service/apigateway/api/authorizer/sim-rest-api-user-pools.js

@@ -0,0 +1,17 @@
+/**
+ * The pools available to an API Gateway that has no Cognito to ask.
+ *
+ * Every pool id resolves to nothing, so every token fails key selection and
+ * every request to a Cognito method is refused. That is the safe answer for a
+ * simulated API Gateway standing on its own: a method configured to be closed
+ * stays closed.
+ */
+export class SimRestApiNoUserPools {
+    /**
+     * No pool id resolves here.
+     */
+    find() {
+        return;
+    }
+}
+//# sourceMappingURL=sim-rest-api-user-pools.js.map

package/dist/service/apigateway/api/authorizer/sim-rest-api-user-pools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-user-pools.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/authorizer/sim-rest-api-user-pools.ts"],"names":[],"mappings":"AAiCA;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChC;;OAEG;IACH,IAAI;QACF,OAAO;IACT,CAAC;CACF"}

package/dist/service/apigateway/api/deployment/sim-rest-api-deployment-store.d.ts

@@ -0,0 +1,16 @@
+import type { SimRestApiDeployment } from "./sim-rest-api-deployment.js";
+/**
+ * The deployments of one REST API, keyed by id.
+ */
+export declare class SimRestApiDeploymentStore {
+    private readonly deployments;
+    /**
+     * Add a deployment to this API.
+     */
+    add(deployment: SimRestApiDeployment): void;
+    /**
+     * Find a deployment by id.
+     */
+    find(deploymentId: string): SimRestApiDeployment | undefined;
+}
+//# sourceMappingURL=sim-rest-api-deployment-store.d.ts.map

package/dist/service/apigateway/api/deployment/sim-rest-api-deployment-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-deployment-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/deployment/sim-rest-api-deployment-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ;;OAEG;IACH,GAAG,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAE1C;IAED;;OAEG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE3D;CACF"}

package/dist/service/apigateway/api/deployment/sim-rest-api-deployment-store.js

@@ -0,0 +1,19 @@
+/**
+ * The deployments of one REST API, keyed by id.
+ */
+export class SimRestApiDeploymentStore {
+    deployments = new Map();
+    /**
+     * Add a deployment to this API.
+     */
+    add(deployment) {
+        this.deployments.set(deployment.deploymentId, deployment);
+    }
+    /**
+     * Find a deployment by id.
+     */
+    find(deploymentId) {
+        return this.deployments.get(deploymentId);
+    }
+}
+//# sourceMappingURL=sim-rest-api-deployment-store.js.map

package/dist/service/apigateway/api/deployment/sim-rest-api-deployment-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-deployment-store.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/deployment/sim-rest-api-deployment-store.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ;;OAEG;IACH,GAAG,CAAC,UAAgC;QAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAsC,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/service/apigateway/api/deployment/sim-rest-api-deployment.d.ts

@@ -0,0 +1,44 @@
+import type { Brand } from "../../../../util/brand.type.js";
+/**
+ * The id API Gateway allocates for one deployment of a REST API.
+ */
+export type SimRestApiDeploymentId = Brand<string, "SimRestApiDeploymentId">;
+/**
+ * Allocate a deployment id, in the opaque short lowercase alphanumeric shape
+ * real API Gateway uses.
+ */
+export declare function makeSimRestApiDeploymentId(): SimRestApiDeploymentId;
+interface SimRestApiDeploymentProperties {
+    readonly deploymentId: SimRestApiDeploymentId;
+    readonly createdDate: Date;
+    readonly description?: string | undefined;
+}
+/**
+ * Minimal structural deployment view, as CreateDeployment returns.
+ */
+export interface SimRestApiDeploymentView {
+    id: string;
+    createdDate: Date;
+    description?: string;
+}
+/**
+ * A simulated REST API deployment: a snapshot a stage points at.
+ *
+ * Real API Gateway freezes the resources and methods into the deployment, and
+ * an edit made afterwards reaches no client until another deployment is
+ * created. Here a deployment records that one was made and when. A stage
+ * serves the API's current resources, so a test editing a method sees the
+ * change without redeploying, which is the one place this departs from AWS.
+ */
+export declare class SimRestApiDeployment {
+    readonly deploymentId: SimRestApiDeploymentId;
+    readonly createdDate: Date;
+    readonly description?: string | undefined;
+    constructor(properties: SimRestApiDeploymentProperties);
+    /**
+     * Get the AWS-like view of this deployment.
+     */
+    view(): SimRestApiDeploymentView;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-deployment.d.ts.map

package/dist/service/apigateway/api/deployment/sim-rest-api-deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-deployment.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/api/deployment/sim-rest-api-deployment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAE5D;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE7E;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,sBAAsB,CAEnE;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,WAAW,EAAE,IAAI,CAAC;IAClC,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjD,YAAY,UAAU,EAAE,8BAA8B,EAIrD;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAW/B;CACF"}