npm - @kensio/yulin - Versions diffs - 1.17.2 → 1.18.0 - Mend

@kensio/yulin 1.17.2 → 1.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1577) hide show

package/dist/service/wafv2/evaluate/sim-waf-blocked-response.js ADDED Viewed

@@ -0,0 +1,37 @@
+/**
+ * The body a block action with no custom response of its own answers with.
+ *
+ * Real WAF hands the blocking off to whatever the web ACL is in front of, and
+ * each of them writes its own page. CloudFront writes an error page and API
+ * Gateway writes `{"message":"Forbidden"}`. This is the simulator's own body
+ * for all of them, which is a deliberate divergence recorded in
+ * `docs/services/wafv2`. The status is the 403 every one of them answers with,
+ * and a rule with a custom response replaces this whole thing anyway.
+ */
+export function simWafDefaultBlockedResponse() {
+    return {
+        statusCode: 403,
+        contentType: "text/html",
+        body: "<html><head><title>403 Forbidden</title></head>" +
+            "<body>Request blocked by AWS WAF.</body></html>",
+        headers: [],
+    };
+}
+/**
+ * Turn a blocked verdict into the HTTP response to send.
+ *
+ * This is what a serving path uses once a web ACL is in front of it, so the
+ * status, the body and the headers a custom response named all reach the
+ * client together.
+ */
+export function simWafBlockedHttpResponse(blocked) {
+    const headers = new Headers({ "content-type": blocked.contentType });
+    for (const header of blocked.headers) {
+        headers.set(header.name, header.value);
+    }
+    return new Response(blocked.body, {
+        status: blocked.statusCode,
+        headers,
+    });
+}
+//# sourceMappingURL=sim-waf-blocked-response.js.map

package/dist/service/wafv2/evaluate/sim-waf-blocked-response.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-blocked-response.js","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-blocked-response.ts"],"names":[],"mappings":"AAYA;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,WAAW;QACxB,IAAI,EACF,iDAAiD;YACjD,iDAAiD;QACnD,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAErE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;QAChC,MAAM,EAAE,OAAO,CAAC,UAAU;QAC1B,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/service/wafv2/evaluate/sim-waf-decision.d.ts ADDED Viewed

@@ -0,0 +1,58 @@
+import type { SimWafAction } from "../web-acl/sim-waf-action.js";
+import type { SimWafHeader } from "../web-acl/sim-waf-custom-response.type.js";
+import type { SimWafBlockedResponse } from "./sim-waf-blocked-response.js";
+/**
+ * What a web ACL decided about one request.
+ *
+ * This is what a fronting service acts on: allow the request through, adding
+ * whatever headers the matching rules asked for, or answer with the blocked
+ * response and never reach the origin at all.
+ *
+ * The counted rules are here because that is the whole point of a `Count`
+ * action. A rule in count mode changes nothing about the request, so the only
+ * way to know it matched is to be told, and a test staging a rule before
+ * turning it on has nothing else to assert against.
+ */
+export interface SimWafDecision {
+    readonly action: "ALLOW" | "BLOCK";
+    readonly webAclName: string;
+    readonly webAclArn: string;
+    /**
+     * The rule whose terminating action decided this, or nothing when no rule
+     * matched and the web ACL's default action decided instead.
+     */
+    readonly terminatingRuleName: string | undefined;
+    /** The rules that matched in count mode, in the order they were evaluated. */
+    readonly countedRuleNames: readonly string[];
+    /**
+     * The labels the rules that matched added to the request, in the order they
+     * were added.
+     *
+     * A managed rule group adds one for every rule of its own that matched, so
+     * this is what says which rule inside a group claimed the request. The rule
+     * that decided is the web ACL's own rule, and the group it names holds
+     * dozens.
+     */
+    readonly labels: readonly string[];
+    /** The headers to add to the request before it is forwarded. */
+    readonly insertedHeaders: readonly SimWafHeader[];
+    /** What to answer with, when the decision was to block. */
+    readonly blocked: SimWafBlockedResponse | undefined;
+}
+/**
+ * What a web ACL knows when it has finished evaluating a request.
+ */
+export interface SimWafDecisionProperties {
+    readonly action: SimWafAction;
+    readonly webAclName: string;
+    readonly webAclArn: string;
+    readonly terminatingRuleName: string | undefined;
+    readonly countedRuleNames: readonly string[];
+    readonly insertedHeaders: readonly SimWafHeader[];
+    readonly labels: readonly string[];
+}
+/**
+ * Turn what a web ACL worked out into the decision it answers with.
+ */
+export declare function simWafDecision(properties: SimWafDecisionProperties): SimWafDecision;
+//# sourceMappingURL=sim-waf-decision.d.ts.map

package/dist/service/wafv2/evaluate/sim-waf-decision.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAEnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjD,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAEnC,gEAAgE;IAChE,QAAQ,CAAC,eAAe,EAAE,SAAS,YAAY,EAAE,CAAC;IAElD,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,eAAe,EAAE,SAAS,YAAY,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,wBAAwB,GACnC,cAAc,CAYhB"}

package/dist/service/wafv2/evaluate/sim-waf-decision.js ADDED Viewed

@@ -0,0 +1,16 @@
+/**
+ * Turn what a web ACL worked out into the decision it answers with.
+ */
+export function simWafDecision(properties) {
+    const { action } = properties;
+    const blocking = action.kind === "BLOCK";
+    return {
+        ...properties,
+        action: blocking ? "BLOCK" : "ALLOW",
+        // Nothing is forwarded when the request is blocked, so there is nothing
+        // for a rule's inserted headers to be added to.
+        insertedHeaders: blocking ? [] : properties.insertedHeaders,
+        blocked: action.blocked,
+    };
+}
+//# sourceMappingURL=sim-waf-decision.js.map

package/dist/service/wafv2/evaluate/sim-waf-decision.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-decision.js","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-decision.ts"],"names":[],"mappings":"AA8DA;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAoC;IAEpC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;IAEzC,OAAO;QACL,GAAG,UAAU;QACb,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACpC,wEAAwE;QACxE,gDAAgD;QAChD,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe;QAC3D,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/evaluate/sim-waf-evaluate-rules.d.ts ADDED Viewed

@@ -0,0 +1,27 @@
+import type { SimWafAction } from "../web-acl/sim-waf-action.js";
+import type { SimWafHeader } from "../web-acl/sim-waf-custom-response.type.js";
+import type { SimWafRule } from "../web-acl/sim-waf-rule.js";
+import type { SimWafInspectedRequest } from "./sim-waf-inspected-request.js";
+/**
+ * What a web ACL's rules did with one request.
+ *
+ * The action is the one that decided the request, and nothing when no rule
+ * terminated: the web ACL's default action decides then, and that belongs to
+ * the web ACL rather than to its rules.
+ */
+export interface SimWafRuleOutcome {
+    readonly action: SimWafAction | undefined;
+    readonly terminatingRuleName: string | undefined;
+    readonly countedRuleNames: readonly string[];
+    readonly insertedHeaders: readonly SimWafHeader[];
+}
+/**
+ * Run a web ACL's rules over one request.
+ *
+ * The rules are already in ascending priority, and the first of them that
+ * matches with a terminating action decides the request. A `Count` action
+ * records the match and lets the next rule have a look, which is why this
+ * carries on past a match rather than answering with the first one.
+ */
+export declare function simWafEvaluateRules(rules: readonly SimWafRule[], request: SimWafInspectedRequest): SimWafRuleOutcome;
+//# sourceMappingURL=sim-waf-evaluate-rules.d.ts.map

package/dist/service/wafv2/evaluate/sim-waf-evaluate-rules.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-evaluate-rules.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-evaluate-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,eAAe,EAAE,SAAS,YAAY,EAAE,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,OAAO,EAAE,sBAAsB,GAC9B,iBAAiB,CA+BnB"}

package/dist/service/wafv2/evaluate/sim-waf-evaluate-rules.js ADDED Viewed

@@ -0,0 +1,35 @@
+/**
+ * Run a web ACL's rules over one request.
+ *
+ * The rules are already in ascending priority, and the first of them that
+ * matches with a terminating action decides the request. A `Count` action
+ * records the match and lets the next rule have a look, which is why this
+ * carries on past a match rather than answering with the first one.
+ */
+export function simWafEvaluateRules(rules, request) {
+    const countedRuleNames = [];
+    const insertedHeaders = [];
+    for (const rule of rules) {
+        const action = rule.evaluate(request);
+        if (action === undefined) {
+            continue;
+        }
+        insertedHeaders.push(...action.insertHeaders);
+        if (action.isTerminating) {
+            return {
+                action,
+                terminatingRuleName: rule.name,
+                countedRuleNames,
+                insertedHeaders,
+            };
+        }
+        countedRuleNames.push(rule.name);
+    }
+    return {
+        action: undefined,
+        terminatingRuleName: undefined,
+        countedRuleNames,
+        insertedHeaders,
+    };
+}
+//# sourceMappingURL=sim-waf-evaluate-rules.js.map

package/dist/service/wafv2/evaluate/sim-waf-evaluate-rules.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-evaluate-rules.js","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-evaluate-rules.ts"],"names":[],"mappings":"AAmBA;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA4B,EAC5B,OAA+B;IAE/B,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,eAAe,GAAmB,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAE9C,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM;gBACN,mBAAmB,EAAE,IAAI,CAAC,IAAI;gBAC9B,gBAAgB;gBAChB,eAAe;aAChB,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,mBAAmB,EAAE,SAAS;QAC9B,gBAAgB;QAChB,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/evaluate/sim-waf-evaluation-request.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+/**
+ * What a web ACL is asked to decide about.
+ */
+export interface SimWafEvaluationRequest {
+    /** The web ACL to evaluate against, by ARN. */
+    readonly webAclArn: string;
+    readonly request: Request;
+    /**
+     * The request body, when the rules might inspect it. A request body is a
+     * stream that cannot be read twice, so it is passed in already buffered.
+     */
+    readonly body?: Uint8Array | undefined;
+}
+//# sourceMappingURL=sim-waf-evaluation-request.d.ts.map

package/dist/service/wafv2/evaluate/sim-waf-evaluation-request.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"sim-waf-evaluation-request.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-evaluation-request.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACxC"}

package/dist/service/wafv2/evaluate/sim-waf-evaluation-request.js ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=sim-waf-evaluation-request.js.map

package/dist/service/wafv2/evaluate/sim-waf-evaluation-request.js.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"sim-waf-evaluation-request.js","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-evaluation-request.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.d.ts ADDED Viewed

@@ -0,0 +1,41 @@
+import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
+/**
+ * The parts of an HTTP request a web ACL's rules are matched against.
+ *
+ * A rule reads the request rather than anything about the resource it reached,
+ * so this is everything the simulated field-to-match kinds need and nothing
+ * else. It is what the CloudFront, API Gateway and Cognito serving paths hand
+ * to a web ACL once they are associated with one.
+ */
+export interface SimWafInspectedRequest {
+    /** The request method, upper case, as WAF reports it. */
+    readonly method: string;
+    /** The path of the request URL, which is not its query string. */
+    readonly uriPath: string;
+    /** The query string with no leading `?`, undecoded. */
+    readonly queryString: string;
+    readonly headers: Headers;
+    /**
+     * The AWS-facing hostname the request was addressed to, which is the Host
+     * header with the Yulin-local suffix taken off it.
+     */
+    readonly host: string;
+    /** The request body, or nothing when the request carried none. */
+    readonly body: Uint8Array | undefined;
+    /** The labels the rules that have run so far added to this request. */
+    readonly labels: SimWafRequestLabels;
+}
+/**
+ * Read the parts of an HTTP request that a web ACL inspects.
+ *
+ * The body is passed in rather than read here because a request body is a
+ * stream that cannot be consumed twice, and everything that serves a request in
+ * this simulator has already buffered it by the time WAF gets a look.
+ *
+ * The hostname is the one the request would have used against real AWS. A
+ * simulated endpoint is served under `*.sim-aws.localhost`, and a rule reading
+ * the raw Host header would see that suffix on every request that reached
+ * anything at all.
+ */
+export declare function simWafInspectedRequest(request: Request, body?: Uint8Array): SimWafInspectedRequest;
+//# sourceMappingURL=sim-waf-inspected-request.d.ts.map

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-inspected-request.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-inspected-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAEtC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,UAAU,GAChB,sBAAsB,CAexB"}

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.js ADDED Viewed

@@ -0,0 +1,30 @@
+import { simAwsRequestHostname } from "../../../serve/http/url/sim-aws-request-hostname.js";
+import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
+/**
+ * Read the parts of an HTTP request that a web ACL inspects.
+ *
+ * The body is passed in rather than read here because a request body is a
+ * stream that cannot be consumed twice, and everything that serves a request in
+ * this simulator has already buffered it by the time WAF gets a look.
+ *
+ * The hostname is the one the request would have used against real AWS. A
+ * simulated endpoint is served under `*.sim-aws.localhost`, and a rule reading
+ * the raw Host header would see that suffix on every request that reached
+ * anything at all.
+ */
+export function simWafInspectedRequest(request, body) {
+    const url = new URL(request.url);
+    return {
+        method: request.method,
+        // The pathname excludes the query string and keeps its percent encoding,
+        // which is the value real WAF compares a `UriPath` rule against. Decoding
+        // it is what the URL_DECODE text transformation is for.
+        uriPath: url.pathname,
+        queryString: url.search.replace(/^\?/u, ""),
+        headers: request.headers,
+        host: simAwsRequestHostname(request),
+        body,
+        labels: new SimWafRequestLabels(),
+    };
+}
+//# sourceMappingURL=sim-waf-inspected-request.js.map

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-inspected-request.js","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-inspected-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAmClE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,IAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,yEAAyE;QACzE,0EAA0E;QAC1E,wDAAwD;QACxD,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACpC,IAAI;QACJ,MAAM,EAAE,IAAI,mBAAmB,EAAE;KAClC,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/evaluate/sim-waf-request-labels.d.ts ADDED Viewed

@@ -0,0 +1,34 @@
+/**
+ * The labels one request has picked up as a web ACL evaluates it.
+ *
+ * A rule adds its labels when it matches, and the rules that run after it can
+ * match on them, so the labels belong to the request being evaluated rather
+ * than to the web ACL. That is what makes the tuning pattern work: a managed
+ * rule group runs in count mode and labels the request, and a rule of the
+ * reader's own blocks on the label.
+ */
+export declare class SimWafRequestLabels {
+    #private;
+    /**
+     * Add a label, by its fully qualified name.
+     */
+    add(label: string): void;
+    /**
+     * Whether this exact label was added.
+     */
+    has(label: string): boolean;
+    /**
+     * Whether any label within a namespace was added.
+     *
+     * A namespace is the label name up to and including a colon, so a key
+     * written without the trailing colon is read as if it had one. Without that,
+     * `awswaf:managed:aws:core-rule-set` would also match a label from a group
+     * whose name merely started with `core-rule-set`.
+     */
+    hasNamespace(namespace: string): boolean;
+    /**
+     * Every label added, in the order the rules that added them ran.
+     */
+    all(): readonly string[];
+}
+//# sourceMappingURL=sim-waf-request-labels.d.ts.map

package/dist/service/wafv2/evaluate/sim-waf-request-labels.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-request-labels.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-request-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;;IAG9B;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEvB;IAED;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1B;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAIvC;IAED;;OAEG;IACH,GAAG,IAAI,SAAS,MAAM,EAAE,CAEvB;CACF"}

package/dist/service/wafv2/evaluate/sim-waf-request-labels.js ADDED Viewed

@@ -0,0 +1,43 @@
+/**
+ * The labels one request has picked up as a web ACL evaluates it.
+ *
+ * A rule adds its labels when it matches, and the rules that run after it can
+ * match on them, so the labels belong to the request being evaluated rather
+ * than to the web ACL. That is what makes the tuning pattern work: a managed
+ * rule group runs in count mode and labels the request, and a rule of the
+ * reader's own blocks on the label.
+ */
+export class SimWafRequestLabels {
+    #added = new Set();
+    /**
+     * Add a label, by its fully qualified name.
+     */
+    add(label) {
+        this.#added.add(label);
+    }
+    /**
+     * Whether this exact label was added.
+     */
+    has(label) {
+        return this.#added.has(label);
+    }
+    /**
+     * Whether any label within a namespace was added.
+     *
+     * A namespace is the label name up to and including a colon, so a key
+     * written without the trailing colon is read as if it had one. Without that,
+     * `awswaf:managed:aws:core-rule-set` would also match a label from a group
+     * whose name merely started with `core-rule-set`.
+     */
+    hasNamespace(namespace) {
+        const prefix = namespace.endsWith(":") ? namespace : `${namespace}:`;
+        return this.#added.values().some((label) => label.startsWith(prefix));
+    }
+    /**
+     * Every label added, in the order the rules that added them ran.
+     */
+    all() {
+        return [...this.#added];
+    }
+}
+//# sourceMappingURL=sim-waf-request-labels.js.map

package/dist/service/wafv2/evaluate/sim-waf-request-labels.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-request-labels.js","sourceRoot":"","sources":["../../../../src/service/wafv2/evaluate/sim-waf-request-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IACrB,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC;;OAEG;IACH,GAAG,CAAC,KAAa;QACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,SAAiB;QAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC;QAErE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/wafv2/index.d.ts ADDED Viewed

@@ -0,0 +1,35 @@
+export { SimWafV2, type SimWafEvaluationRequest } from "./sim-wafv2.js";
+export type { SimWafV2Properties } from "./sim-wafv2-commands.js";
+export type { SimWafRequestOptions } from "./command/sim-wafv2-request-options.js";
+export { type SimWafScope, simWafCloudFrontRegion, simWafScopePath, } from "./scope/sim-waf-scope.js";
+export { simWafArn, type SimWafArnParts, simWafArnParts, simWafArnPrefix, type SimWafResourceKind, } from "./sim-wafv2-arn.js";
+export { SimWafSets } from "./sim-wafv2-sets.js";
+export { SimWafAssociations } from "./association/sim-waf-associations.js";
+export { simWafApiGatewayResourceType, type SimWafProtectedResource, simWafProtectedResource, type SimWafProtectedResourceType, simWafProtectedResourceTypes, simWafUserPoolResourceType, } from "./association/sim-waf-protected-resource.js";
+export { SimWafNoProtectedResources, type SimWafProtectedResources, } from "./association/sim-waf-protected-resources.js";
+export { SimWafNoProtection, type SimWafProtectedRequest, type SimWafProtection, } from "./association/sim-waf-protection.js";
+export { SimWafInspected, SimWafRequestInspection, } from "./association/sim-waf-request-inspection.js";
+export { SimWafRestApiStage } from "./association/sim-waf-rest-api-stage.js";
+export { SimWafUserPool } from "./association/sim-waf-user-pool.js";
+export { SimWafResource, type SimWafResourceSummary, } from "./resource/sim-waf-resource.js";
+export { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
+export type { SimWafWebAclConfiguration } from "./web-acl/sim-waf-web-acl-configuration.js";
+export { SimWafRule } from "./web-acl/sim-waf-rule.js";
+export type { SimWafRuleInput } from "./web-acl/sim-waf-rule.type.js";
+export { SimWafAction } from "./web-acl/sim-waf-action.js";
+export type { SimWafActionInput, SimWafActionKind, } from "./web-acl/sim-waf-action.type.js";
+export type { SimWafHeader } from "./web-acl/sim-waf-custom-response.type.js";
+export { SimWafIpSet, type SimWafIpAddressVersion, } from "./ip-set/sim-waf-ip-set.js";
+export { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern-set.js";
+export type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
+export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
+export { SimWafManagedRules, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
+export type { SimWafManagedRuleReport } from "./managed/sim-waf-managed-rule-report.js";
+export type { SimWafManagedRuleTier } from "./managed/sim-waf-managed-rule.type.js";
+export type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput, SimWafRuleActionOverrideInput, } from "./managed/sim-waf-managed-group.type.js";
+export { simWafBlockedHttpResponse, type SimWafBlockedResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
+export { type SimWafInspectedRequest, simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
+export { simWafInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export type { SimWafStatementInput } from "./statement/sim-waf-statement.type.js";
+export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, type SimWafErrorMetadata, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/service/wafv2/index.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/wafv2/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACxE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,KAAK,WAAW,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,SAAS,EACT,KAAK,cAAc,EACnB,cAAc,EACd,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EACL,4BAA4B,EAC5B,KAAK,uBAAuB,EAC5B,uBAAuB,EACvB,KAAK,2BAA2B,EAChC,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EACL,cAAc,EACd,KAAK,qBAAqB,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,YAAY,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EACL,WAAW,EACX,KAAK,sBAAsB,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EACL,kBAAkB,EAClB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACxF,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,YAAY,EACV,oCAAoC,EACpC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,KAAK,sBAAsB,EAC3B,sBAAsB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,YAAY,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,WAAW,EACX,KAAK,mBAAmB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,4BAA4B,CAAC"}

package/dist/service/wafv2/index.js ADDED Viewed

@@ -0,0 +1,24 @@
+export { SimWafV2 } from "./sim-wafv2.js";
+export { simWafCloudFrontRegion, simWafScopePath, } from "./scope/sim-waf-scope.js";
+export { simWafArn, simWafArnParts, simWafArnPrefix, } from "./sim-wafv2-arn.js";
+export { SimWafSets } from "./sim-wafv2-sets.js";
+export { SimWafAssociations } from "./association/sim-waf-associations.js";
+export { simWafApiGatewayResourceType, simWafProtectedResource, simWafProtectedResourceTypes, simWafUserPoolResourceType, } from "./association/sim-waf-protected-resource.js";
+export { SimWafNoProtectedResources, } from "./association/sim-waf-protected-resources.js";
+export { SimWafNoProtection, } from "./association/sim-waf-protection.js";
+export { SimWafInspected, SimWafRequestInspection, } from "./association/sim-waf-request-inspection.js";
+export { SimWafRestApiStage } from "./association/sim-waf-rest-api-stage.js";
+export { SimWafUserPool } from "./association/sim-waf-user-pool.js";
+export { SimWafResource, } from "./resource/sim-waf-resource.js";
+export { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
+export { SimWafRule } from "./web-acl/sim-waf-rule.js";
+export { SimWafAction } from "./web-acl/sim-waf-action.js";
+export { SimWafIpSet, } from "./ip-set/sim-waf-ip-set.js";
+export { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern-set.js";
+export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
+export { SimWafManagedRules, } from "./managed/sim-waf-managed-rules.js";
+export { simWafBlockedHttpResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
+export { simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
+export { simWafInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";
+//# sourceMappingURL=index.js.map

package/dist/service/wafv2/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/wafv2/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAgC,MAAM,gBAAgB,CAAC;AAGxE,OAAO,EAEL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,SAAS,EAET,cAAc,EACd,eAAe,GAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EACL,4BAA4B,EAE5B,uBAAuB,EAEvB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,0BAA0B,GAE3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,kBAAkB,GAGnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EACL,cAAc,GAEf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAM3D,OAAO,EACL,WAAW,GAEZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAEzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EACL,kBAAkB,GAEnB,MAAM,oCAAoC,CAAC;AAQ5C,OAAO,EACL,yBAAyB,EAEzB,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAEL,sBAAsB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAElF,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,WAAW,EAEX,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,4BAA4B,CAAC"}

package/dist/service/wafv2/ip-set/sim-waf-ip-set.d.ts ADDED Viewed

@@ -0,0 +1,45 @@
+import { SimWafResource, type SimWafResourceProperties } from "../resource/sim-waf-resource.js";
+/**
+ * Which kind of address an IP set holds. A set holds one or the other, never
+ * both, as it does on AWS.
+ */
+export type SimWafIpAddressVersion = "IPV4" | "IPV6";
+interface SimWafIpSetProperties extends SimWafResourceProperties {
+    readonly ipAddressVersion: SimWafIpAddressVersion;
+    readonly addresses: readonly string[];
+}
+/**
+ * One named list of address ranges.
+ *
+ * Nothing evaluates an IP set here, because `IPSetReferenceStatement` is
+ * refused: every request in this simulation comes from 127.0.0.1, so a rule on
+ * the client address would see one client for the whole simulation. The
+ * resource is still held, so a stack that creates one deploys and a test can
+ * read back what it created.
+ */
+export declare class SimWafIpSet extends SimWafResource {
+    #private;
+    readonly ipAddressVersion: SimWafIpAddressVersion;
+    constructor(properties: SimWafIpSetProperties);
+    /**
+     * The ranges this set holds.
+     */
+    get addresses(): readonly string[];
+    /**
+     * Write a new list of ranges over this one.
+     *
+     * The addresses are checked before anything is replaced. A set that refuses
+     * an update keeps the ranges it had.
+     */
+    replaceAddresses(properties: {
+        readonly addresses: readonly string[];
+        readonly description?: string | undefined;
+        readonly lockToken: string | undefined;
+    }): void;
+}
+/**
+ * Read the address version a request named, refusing anything else.
+ */
+export declare function requiredSimWafIpAddressVersion(version: string | undefined): SimWafIpAddressVersion;
+export {};
+//# sourceMappingURL=sim-waf-ip-set.d.ts.map

package/dist/service/wafv2/ip-set/sim-waf-ip-set.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-ip-set.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/ip-set/sim-waf-ip-set.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC9B,MAAM,iCAAiC,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,UAAU,qBAAsB,SAAQ,wBAAwB;IAC9D,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,WAAY,SAAQ,cAAc;;IAC7C,SAAgB,gBAAgB,EAAE,sBAAsB,CAAC;IAIzD,YAAY,UAAU,EAAE,qBAAqB,EAQ5C;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,SAAS,MAAM,EAAE,CAEjC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,EAAE;QAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KACxC,GAAG,IAAI,CASP;CACF;AASD;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,sBAAsB,CASxB"}

package/dist/service/wafv2/ip-set/sim-waf-ip-set.js ADDED Viewed

@@ -0,0 +1,81 @@
+import { isIPv4, isIPv6 } from "node:net";
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+import { SimWafResource, } from "../resource/sim-waf-resource.js";
+/**
+ * One named list of address ranges.
+ *
+ * Nothing evaluates an IP set here, because `IPSetReferenceStatement` is
+ * refused: every request in this simulation comes from 127.0.0.1, so a rule on
+ * the client address would see one client for the whole simulation. The
+ * resource is still held, so a stack that creates one deploys and a test can
+ * read back what it created.
+ */
+export class SimWafIpSet extends SimWafResource {
+    ipAddressVersion;
+    #addresses;
+    constructor(properties) {
+        super("ipset", properties);
+        this.ipAddressVersion = properties.ipAddressVersion;
+        this.#addresses = checkedAddresses(properties.addresses, properties.ipAddressVersion);
+    }
+    /**
+     * The ranges this set holds.
+     */
+    get addresses() {
+        return this.#addresses;
+    }
+    /**
+     * Write a new list of ranges over this one.
+     *
+     * The addresses are checked before anything is replaced. A set that refuses
+     * an update keeps the ranges it had.
+     */
+    replaceAddresses(properties) {
+        const addresses = checkedAddresses(properties.addresses, this.ipAddressVersion);
+        this.takeLock(properties.lockToken);
+        this.replaceDescription(properties.description);
+        this.#addresses = addresses;
+    }
+}
+function checkedAddresses(addresses, version) {
+    return addresses.map((address) => checkedAddress(address, version));
+}
+/**
+ * Read the address version a request named, refusing anything else.
+ */
+export function requiredSimWafIpAddressVersion(version) {
+    if (version !== "IPV4" && version !== "IPV6") {
+        throw new SimWafInvalidParameterException(`Error reason: The IP address version is not valid, field: ` +
+            `IP_ADDRESS_VERSION, parameter: ${String(version)}`);
+    }
+    return version;
+}
+/**
+ * A prefix length as WAF writes one, which is digits and nothing else.
+ *
+ * Reading it as a number alone would take `192.0.2.0/` as `/0`, and would take
+ * a signed, spaced or hexadecimal prefix as well.
+ */
+const decimalPrefix = /^\d+$/u;
+/**
+ * Check one address is written the way WAF wants it.
+ *
+ * WAF takes CIDR notation and nothing else, so a bare address is refused here
+ * as it is on AWS: `192.0.2.44` has to be written `192.0.2.44/32`, and that is
+ * a mistake worth meeting in a test rather than in a deployment.
+ */
+function checkedAddress(address, version) {
+    const isAddress = version === "IPV4" ? isIPv4 : isIPv6;
+    const longestPrefix = version === "IPV4" ? 32 : 128;
+    const separator = address.lastIndexOf("/");
+    const prefix = address.slice(separator + 1);
+    if (separator === -1 ||
+        !isAddress(address.slice(0, separator)) ||
+        !decimalPrefix.test(prefix) ||
+        Number(prefix) > longestPrefix) {
+        throw new SimWafInvalidParameterException(`Error reason: The IP address ${address} is not valid ${version} CIDR ` +
+            `notation, field: IP_ADDRESS, parameter: ${address}`);
+    }
+    return address;
+}
+//# sourceMappingURL=sim-waf-ip-set.js.map

package/dist/service/wafv2/ip-set/sim-waf-ip-set.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sim-waf-ip-set.js","sourceRoot":"","sources":["../../../../src/service/wafv2/ip-set/sim-waf-ip-set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAE1C,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EACL,cAAc,GAEf,MAAM,iCAAiC,CAAC;AAazC;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAY,SAAQ,cAAc;IAC7B,gBAAgB,CAAyB;IAEzD,UAAU,CAAoB;IAE9B,YAAY,UAAiC;QAC3C,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE3B,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAChC,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,gBAAgB,CAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,UAIhB;QACC,MAAM,SAAS,GAAG,gBAAgB,CAChC,UAAU,CAAC,SAAS,EACpB,IAAI,CAAC,gBAAgB,CACtB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,SAA4B,EAC5B,OAA+B;IAE/B,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA2B;IAE3B,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,+BAA+B,CACvC,4DAA4D;YAC1D,kCAAkC,MAAM,CAAC,OAAO,CAAC,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,OAAe,EACf,OAA+B;IAE/B,MAAM,SAAS,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,aAAa,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAE5C,IACE,SAAS,KAAK,CAAC,CAAC;QAChB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,aAAa,EAC9B,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,gCAAgC,OAAO,iBAAiB,OAAO,QAAQ;YACrE,2CAA2C,OAAO,EAAE,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}