@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/wafv2/statement/sim-waf-unsimulated-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-unsimulated-field.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-unsimulated-field.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAA8B,EAC9B,QAAgB;IAEhB,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEjC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,qBAAqB,CACnB,QAAQ,EACR,6BAA6B,EAC7B,uEAAuE;YACrE,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,qBAAqB,CACnB,QAAQ,EACR,gCAAgC,EAChC,oEAAoE;YAClE,SAAS,CACZ,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,qBAAqB,CACnB,QAAQ,EACR,gCAAgC,EAChC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAA8B,EAC9B,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;IAEnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,iBAAiB,CACf,QAAQ,EACR,4BAA4B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB;YACjE,gCAAgC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA8B,EAC9B,QAAgB;IAEhB,MAAM,WAAW,GACf,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACpE,MAAM,KAAK,GACT,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAEtE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,qBAAqB,CACnB,QAAQ,EACR,sBAAsB,KAAK,EAAE,EAC7B,iEAAiE;YAC/D,uCAAuC,CAC1C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/wafv2/statement/sim-waf-unsimulated-statement.d.ts

@@ -0,0 +1,6 @@
+import type { SimWafStatementInput } from "./sim-waf-statement.type.js";
+/**
+ * Refuse a statement kind this simulation cannot evaluate.
+ */
+export declare function refuseUnsimulatedSimWafStatement(statement: SimWafStatementInput, ruleName: string): void;
+//# sourceMappingURL=sim-waf-unsimulated-statement.d.ts.map

package/dist/service/wafv2/statement/sim-waf-unsimulated-statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-unsimulated-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-unsimulated-statement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAgCxE;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,oBAAoB,EAC/B,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN"}

package/dist/service/wafv2/statement/sim-waf-unsimulated-statement.js

@@ -0,0 +1,38 @@
+import { refuseSimWafRuleInput } from "./sim-waf-rule-refusals.js";
+const oneClientAddress = "every request in this simulation reports a source address of 127.0.0.1, " +
+    "so a rule on where a request came from would see one client for the " +
+    "whole simulation";
+const undocumentedDetection = "AWS does not document the detection it runs, so a simulation of it would " +
+    "agree with real WAF by coincidence or not at all";
+/**
+ * The statement kinds real WAFv2 evaluates and this simulation does not, and
+ * why each of them is refused rather than deferred.
+ */
+const refusedStatements = new Map([
+    ["IPSetReferenceStatement", oneClientAddress],
+    ["GeoMatchStatement", oneClientAddress],
+    ["AsnMatchStatement", oneClientAddress],
+    ["SqliMatchStatement", undocumentedDetection],
+    ["XssMatchStatement", undocumentedDetection],
+    [
+        "RateBasedStatement",
+        "counting requests over a time window against the simulated clock is " +
+            "feasible and is not part of this",
+    ],
+    [
+        "RuleGroupReferenceStatement",
+        "a rule group is a resource in its own right, and none is simulated",
+    ],
+]);
+/**
+ * Refuse a statement kind this simulation cannot evaluate.
+ */
+export function refuseUnsimulatedSimWafStatement(statement, ruleName) {
+    for (const [kind, value] of Object.entries(statement)) {
+        const reason = refusedStatements.get(kind);
+        if (reason !== undefined && value !== undefined) {
+            refuseSimWafRuleInput(ruleName, `the statement kind ${kind}`, reason);
+        }
+    }
+}
+//# sourceMappingURL=sim-waf-unsimulated-statement.js.map

package/dist/service/wafv2/statement/sim-waf-unsimulated-statement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-unsimulated-statement.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-unsimulated-statement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,MAAM,gBAAgB,GACpB,0EAA0E;IAC1E,sEAAsE;IACtE,kBAAkB,CAAC;AAErB,MAAM,qBAAqB,GACzB,2EAA2E;IAC3E,kDAAkD,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAiB;IAChD,CAAC,yBAAyB,EAAE,gBAAgB,CAAC;IAC7C,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACvC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACvC,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAC7C,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5C;QACE,oBAAoB;QACpB,sEAAsE;YACpE,kCAAkC;KACrC;IACD;QACE,6BAA6B;QAC7B,oEAAoE;KACrE;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAA+B,EAC/B,QAAgB;IAEhB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE3C,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAChD,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/service/wafv2/statement/sim-waf-url-decode.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Decode percent escapes and `+` as a space, as WAF's URL_DECODE does.
+ *
+ * Consecutive escapes are decoded as one run, because a non-ASCII character
+ * arrives as several of them and decoding a byte at a time would leave the
+ * whole sequence encoded.
+ *
+ * An escape that decodes to nothing is left as it stands rather than failing
+ * the whole match. WAF still inspects malformed input, and a rule that threw
+ * its hands up at it would be a way past the rule.
+ */
+export declare function simWafUrlDecode(value: string): string;
+//# sourceMappingURL=sim-waf-url-decode.d.ts.map

package/dist/service/wafv2/statement/sim-waf-url-decode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-url-decode.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-url-decode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqBrD"}

package/dist/service/wafv2/statement/sim-waf-url-decode.js

@@ -0,0 +1,51 @@
+/**
+ * Decode percent escapes and `+` as a space, as WAF's URL_DECODE does.
+ *
+ * Consecutive escapes are decoded as one run, because a non-ASCII character
+ * arrives as several of them and decoding a byte at a time would leave the
+ * whole sequence encoded.
+ *
+ * An escape that decodes to nothing is left as it stands rather than failing
+ * the whole match. WAF still inspects malformed input, and a rule that threw
+ * its hands up at it would be a way past the rule.
+ */
+export function simWafUrlDecode(value) {
+    /*
+     * The repeated group is fixed width and every alternative starts with a
+     * character the others cannot, so each position is decided without
+     * backtracking. The unsafe-expression check reads the nested quantifier and
+     * cannot see that.
+     */
+    // oxlint-disable-next-line security/detect-unsafe-regex
+    const escapeRun = /\+|(?:%[\da-f]{2})+/giu;
+    return value.replaceAll(escapeRun, (escapes) => {
+        if (escapes === "+") {
+            return " ";
+        }
+        try {
+            return decodeURIComponent(escapes);
+        }
+        catch {
+            return decodeEachEscape(escapes);
+        }
+    });
+}
+/**
+ * Decode what can be decoded in a run of escapes, leaving the rest alone.
+ *
+ * A run that is not valid UTF-8 still holds escapes that stand for a character
+ * on their own, and WAF inspects what it can read of it.
+ */
+function decodeEachEscape(escapes) {
+    return (escapes.match(/%[\da-f]{2}/giu) ?? [])
+        .map((escape) => {
+        try {
+            return decodeURIComponent(escape);
+        }
+        catch {
+            return escape;
+        }
+    })
+        .join("");
+}
+//# sourceMappingURL=sim-waf-url-decode.js.map

package/dist/service/wafv2/statement/sim-waf-url-decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-url-decode.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-url-decode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C;;;;;OAKG;IACH,wDAAwD;IACxD,MAAM,SAAS,GAAG,wBAAwB,CAAC;IAE3C,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;QAC7C,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;SAC3C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-action-input.d.ts

@@ -0,0 +1,19 @@
+import { type SimWafBlockedResponse } from "../evaluate/sim-waf-blocked-response.js";
+import type { SimWafCustomResponseBodies, SimWafCustomResponseInput } from "./sim-waf-custom-response.type.js";
+import type { SimWafActionInput } from "./sim-waf-action.type.js";
+/**
+ * What a block action answers with, which is WAF's own 403 unless the rule
+ * named a response of its own.
+ */
+export declare function simWafBlockedResponse(customResponse: SimWafCustomResponseInput | undefined, bodies: SimWafCustomResponseBodies): SimWafBlockedResponse;
+/**
+ * Refuse an action this simulation cannot carry out.
+ *
+ * `Captcha` and `Challenge` are answered by a browser solving a puzzle and
+ * sending a token back, which nothing in a test does. An action naming two
+ * things to do is refused as well: real WAFv2 takes one, so reading the first
+ * one found would make which of them applied a matter of the order they are
+ * checked in.
+ */
+export declare function refuseUnsimulatedSimWafAction(action: SimWafActionInput | undefined, ruleName: string): void;
+//# sourceMappingURL=sim-waf-action-input.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-action-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-action-input.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-action-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,yCAAyC,CAAC;AAUjD,OAAO,KAAK,EACV,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,yBAAyB,GAAG,SAAS,EACrD,MAAM,EAAE,0BAA0B,GACjC,qBAAqB,CAiBvB;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,GACf,IAAI,CAsBN"}

package/dist/service/wafv2/web-acl/sim-waf-action-input.js

@@ -0,0 +1,62 @@
+import { simWafDefaultBlockedResponse, } from "../evaluate/sim-waf-blocked-response.js";
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+import { invalidSimWafRule, refuseSimWafRuleInput, } from "../statement/sim-waf-rule-refusals.js";
+import { requiredSimWafResponseBody, simWafResponseHeaders, } from "./sim-waf-custom-response.js";
+/**
+ * What a block action answers with, which is WAF's own 403 unless the rule
+ * named a response of its own.
+ */
+export function simWafBlockedResponse(customResponse, bodies) {
+    const fallback = simWafDefaultBlockedResponse();
+    if (customResponse === undefined) {
+        return fallback;
+    }
+    const key = customResponse.CustomResponseBodyKey;
+    const body = key === undefined ? undefined : requiredSimWafResponseBody(key, bodies);
+    return {
+        statusCode: requiredResponseCode(customResponse.ResponseCode),
+        contentType: body?.contentType ?? fallback.contentType,
+        body: body?.content ?? fallback.body,
+        headers: simWafResponseHeaders(customResponse.ResponseHeaders),
+    };
+}
+/**
+ * Read the status a custom response answers with.
+ *
+ * Real WAFv2 requires one in the 200 to 599 range. Falling back to WAF's own
+ * 403 would answer with a status the rule did not ask for.
+ */
+function requiredResponseCode(responseCode) {
+    if (responseCode === undefined ||
+        !Number.isSafeInteger(responseCode) ||
+        responseCode < 200 ||
+        responseCode > 599) {
+        throw new SimWafInvalidParameterException(`Error reason: A custom response code is a whole number from 200 to ` +
+            `599, field: CUSTOM_RESPONSE, parameter: ${String(responseCode)}`);
+    }
+    return responseCode;
+}
+/**
+ * Refuse an action this simulation cannot carry out.
+ *
+ * `Captcha` and `Challenge` are answered by a browser solving a puzzle and
+ * sending a token back, which nothing in a test does. An action naming two
+ * things to do is refused as well: real WAFv2 takes one, so reading the first
+ * one found would make which of them applied a matter of the order they are
+ * checked in.
+ */
+export function refuseUnsimulatedSimWafAction(action, ruleName) {
+    const named = Object.entries(action ?? {})
+        .filter(([, value]) => value !== undefined)
+        .map(([kind]) => kind);
+    for (const kind of named) {
+        if (kind === "Captcha" || kind === "Challenge") {
+            refuseSimWafRuleInput(ruleName, `the ${kind} action`, "it is answered by a browser solving a puzzle and sending a token " +
+                "back, and nothing in a test does that");
+        }
+    }
+    if (named.length > 1) {
+        invalidSimWafRule(ruleName, `The action names ${named.join(" and ")}, and a rule takes one action`);
+    }
+}
+//# sourceMappingURL=sim-waf-action-input.js.map

package/dist/service/wafv2/web-acl/sim-waf-action-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-action-input.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-action-input.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,GAE7B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AAOtC;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,cAAqD,EACrD,MAAkC;IAElC,MAAM,QAAQ,GAAG,4BAA4B,EAAE,CAAC;IAEhD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GACR,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE1E,OAAO;QACL,UAAU,EAAE,oBAAoB,CAAC,cAAc,CAAC,YAAY,CAAC;QAC7D,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,QAAQ,CAAC,WAAW;QACtD,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI;QACpC,OAAO,EAAE,qBAAqB,CAAC,cAAc,CAAC,eAAe,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,YAAgC;IAC5D,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;QACnC,YAAY,GAAG,GAAG;QAClB,YAAY,GAAG,GAAG,EAClB,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,qEAAqE;YACnE,2CAA2C,MAAM,CAAC,YAAY,CAAC,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAqC,EACrC,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/C,qBAAqB,CACnB,QAAQ,EACR,OAAO,IAAI,SAAS,EACpB,mEAAmE;gBACjE,uCAAuC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,iBAAiB,CACf,QAAQ,EACR,oBAAoB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CACvE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-action.d.ts

@@ -0,0 +1,27 @@
+import type { SimWafBlockedResponse } from "../evaluate/sim-waf-blocked-response.js";
+import type { SimWafActionInput, SimWafActionKind } from "./sim-waf-action.type.js";
+import type { SimWafCustomResponseBodies, SimWafHeader } from "./sim-waf-custom-response.type.js";
+/**
+ * One resolved action, ready to apply to a request.
+ *
+ * `Count` is the odd one: it records that the rule matched and lets evaluation
+ * carry on to the next rule, so it is the one action that does not decide
+ * anything. `isTerminating` is what the evaluation loop reads.
+ */
+export declare class SimWafAction {
+    readonly kind: SimWafActionKind;
+    readonly insertHeaders: readonly SimWafHeader[];
+    readonly blocked: SimWafBlockedResponse | undefined;
+    private constructor();
+    /**
+     * Read the action a rule or a web ACL default named.
+     */
+    static read(action: SimWafActionInput | undefined, ruleName: string, bodies: SimWafCustomResponseBodies): SimWafAction;
+    private static handling;
+    /**
+     * Whether this action decides the request rather than noting it and moving
+     * on.
+     */
+    get isTerminating(): boolean;
+}
+//# sourceMappingURL=sim-waf-action.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-action.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAMrF,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAEjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,0BAA0B,EAC1B,YAAY,EACb,MAAM,mCAAmC,CAAC;AAQ3C;;;;;;GAMG;AACH,qBAAa,YAAY;IACvB,SAAgB,IAAI,EAAE,gBAAgB,CAAC;IACvC,SAAgB,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IACvD,SAAgB,OAAO,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAE3D,OAAO,eAIN;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,CACT,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,0BAA0B,GACjC,YAAY,CAoBd;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAavB;;;OAGG;IACH,IAAI,aAAa,IAAI,OAAO,CAE3B;CACF"}

package/dist/service/wafv2/web-acl/sim-waf-action.js

@@ -0,0 +1,55 @@
+import { invalidSimWafRule } from "../statement/sim-waf-rule-refusals.js";
+import { refuseUnsimulatedSimWafAction, simWafBlockedResponse, } from "./sim-waf-action-input.js";
+import { simWafInsertedHeaders } from "./sim-waf-custom-response.js";
+/**
+ * One resolved action, ready to apply to a request.
+ *
+ * `Count` is the odd one: it records that the rule matched and lets evaluation
+ * carry on to the next rule, so it is the one action that does not decide
+ * anything. `isTerminating` is what the evaluation loop reads.
+ */
+export class SimWafAction {
+    kind;
+    insertHeaders;
+    blocked;
+    constructor(properties) {
+        this.kind = properties.kind;
+        this.insertHeaders = properties.insertHeaders;
+        this.blocked = properties.blocked;
+    }
+    /**
+     * Read the action a rule or a web ACL default named.
+     */
+    static read(action, ruleName, bodies) {
+        refuseUnsimulatedSimWafAction(action, ruleName);
+        if (action?.Allow !== undefined) {
+            return this.handling("ALLOW", action.Allow);
+        }
+        if (action?.Count !== undefined) {
+            return this.handling("COUNT", action.Count);
+        }
+        if (action?.Block !== undefined) {
+            return new SimWafAction({
+                kind: "BLOCK",
+                insertHeaders: [],
+                blocked: simWafBlockedResponse(action.Block.CustomResponse, bodies),
+            });
+        }
+        invalidSimWafRule(ruleName, "The action names no action to take");
+    }
+    static handling(kind, action) {
+        return new SimWafAction({
+            kind,
+            insertHeaders: simWafInsertedHeaders(action.CustomRequestHandling?.InsertHeaders),
+            blocked: undefined,
+        });
+    }
+    /**
+     * Whether this action decides the request rather than noting it and moving
+     * on.
+     */
+    get isTerminating() {
+        return this.kind !== "COUNT";
+    }
+}
+//# sourceMappingURL=sim-waf-action.js.map

package/dist/service/wafv2/web-acl/sim-waf-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-action.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-action.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAYrE;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACP,IAAI,CAAmB;IACvB,aAAa,CAA0B;IACvC,OAAO,CAAoC;IAE3D,YAAoB,UAAkC;QACpD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,CACT,MAAqC,EACrC,QAAgB,EAChB,MAAkC;QAElC,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEhD,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,YAAY,CAAC;gBACtB,IAAI,EAAE,OAAO;gBACb,aAAa,EAAE,EAAE;gBACjB,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC;aACpE,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB,CAAC,QAAQ,EAAE,oCAAoC,CAAC,CAAC;IACpE,CAAC;IAEO,MAAM,CAAC,QAAQ,CACrB,IAAsB,EACtB,MAAgC;QAEhC,OAAO,IAAI,YAAY,CAAC;YACtB,IAAI;YACJ,aAAa,EAAE,qBAAqB,CAClC,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAC5C;YACD,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IAC/B,CAAC;CACF"}

package/dist/service/wafv2/web-acl/sim-waf-action.type.d.ts

@@ -0,0 +1,25 @@
+import type { SimWafCustomRequestHandlingInput, SimWafCustomResponseInput } from "./sim-waf-custom-response.type.js";
+/**
+ * What a rule does with a request it claims.
+ */
+export type SimWafActionKind = "ALLOW" | "BLOCK" | "COUNT";
+/**
+ * Minimal structural WAFv2 RuleAction, which is also the shape of a web ACL's
+ * DefaultAction bar the two actions a default action cannot take.
+ */
+export interface SimWafActionInput {
+    readonly Allow?: SimWafHandledActionInput | undefined;
+    readonly Block?: {
+        readonly CustomResponse?: SimWafCustomResponseInput | undefined;
+    } | undefined;
+    readonly Count?: SimWafHandledActionInput | undefined;
+    readonly Captcha?: unknown;
+    readonly Challenge?: unknown;
+}
+/**
+ * An action that can add headers to the request it lets through.
+ */
+export interface SimWafHandledActionInput {
+    readonly CustomRequestHandling?: SimWafCustomRequestHandlingInput | undefined;
+}
+//# sourceMappingURL=sim-waf-action.type.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-action.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-action.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-action.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,yBAAyB,EAC1B,MAAM,mCAAmC,CAAC;AAE3C;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EACX;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAA;KAAE,GACnE,SAAS,CAAC;IACd,QAAQ,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;CAC/E"}

package/dist/service/wafv2/web-acl/sim-waf-action.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-action.type.js.map

package/dist/service/wafv2/web-acl/sim-waf-action.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-action.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-action.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/web-acl/sim-waf-custom-response.d.ts

@@ -0,0 +1,26 @@
+import type { SimWafCustomHeaderInput, SimWafCustomResponseBodies, SimWafHeader, SimWafResponseBody } from "./sim-waf-custom-response.type.js";
+/**
+ * Read the headers a custom request handling asks to insert.
+ *
+ * WAF prefixes every one of them with `x-amzn-waf-` as it inserts them, so a
+ * header a rule added cannot be mistaken for one the client sent.
+ */
+export declare function simWafInsertedHeaders(headers: readonly SimWafCustomHeaderInput[] | undefined): readonly SimWafHeader[];
+/**
+ * Read the headers a custom response carries.
+ *
+ * These keep the names they were configured with. The `x-amzn-waf-` prefix is
+ * for request header insertion, where it tells a rule's header apart from the
+ * client's. `content-type` is refused, because the custom response body
+ * decides that and a header setting it again would contradict the body.
+ */
+export declare function simWafResponseHeaders(headers: readonly SimWafCustomHeaderInput[] | undefined): readonly SimWafHeader[];
+/**
+ * Find the body a block action asked for among the web ACL's own.
+ *
+ * A key naming no body is refused where the web ACL is written, because a
+ * block action that fell back to the default body would answer with something
+ * other than what the rule said.
+ */
+export declare function requiredSimWafResponseBody(key: string, bodies: SimWafCustomResponseBodies): SimWafResponseBody;
+//# sourceMappingURL=sim-waf-custom-response.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-custom-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-custom-response.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-custom-response.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EACnB,MAAM,mCAAmC,CAAC;AAQ3C;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACtD,SAAS,YAAY,EAAE,CAKzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACtD,SAAS,YAAY,EAAE,CAKzB;AAwBD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,0BAA0B,GACjC,kBAAkB,CAapB"}

package/dist/service/wafv2/web-acl/sim-waf-custom-response.js

@@ -0,0 +1,64 @@
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+const contentTypes = new Map([
+    ["TEXT_PLAIN", "text/plain"],
+    ["TEXT_HTML", "text/html"],
+    ["APPLICATION_JSON", "application/json"],
+]);
+/**
+ * Read the headers a custom request handling asks to insert.
+ *
+ * WAF prefixes every one of them with `x-amzn-waf-` as it inserts them, so a
+ * header a rule added cannot be mistaken for one the client sent.
+ */
+export function simWafInsertedHeaders(headers) {
+    return (headers ?? []).map((header) => ({
+        name: `x-amzn-waf-${requiredHeaderName(header.Name)}`,
+        value: header.Value ?? "",
+    }));
+}
+/**
+ * Read the headers a custom response carries.
+ *
+ * These keep the names they were configured with. The `x-amzn-waf-` prefix is
+ * for request header insertion, where it tells a rule's header apart from the
+ * client's. `content-type` is refused, because the custom response body
+ * decides that and a header setting it again would contradict the body.
+ */
+export function simWafResponseHeaders(headers) {
+    return (headers ?? []).map((header) => ({
+        name: refusedContentType(requiredHeaderName(header.Name)),
+        value: header.Value ?? "",
+    }));
+}
+function refusedContentType(name) {
+    if (name.toLowerCase() === "content-type") {
+        throw new SimWafInvalidParameterException("Error reason: A custom response takes its content type from its body, " +
+            "field: CUSTOM_HTTP_HEADER, parameter: content-type");
+    }
+    return name;
+}
+function requiredHeaderName(name) {
+    if (name === undefined || name === "") {
+        throw new SimWafInvalidParameterException("Error reason: A custom header needs a Name, field: CUSTOM_HTTP_HEADER, " +
+            "parameter: Name");
+    }
+    return name;
+}
+/**
+ * Find the body a block action asked for among the web ACL's own.
+ *
+ * A key naming no body is refused where the web ACL is written, because a
+ * block action that fell back to the default body would answer with something
+ * other than what the rule said.
+ */
+export function requiredSimWafResponseBody(key, bodies) {
+    const body = new Map(Object.entries(bodies)).get(key);
+    const contentType = contentTypes.get(body?.ContentType ?? "");
+    if (body === undefined || contentType === undefined) {
+        throw new SimWafInvalidParameterException(`Error reason: The custom response body ${key} is not one of this web ` +
+            `ACL's CustomResponseBodies with a content type WAF answers with, ` +
+            `field: CUSTOM_RESPONSE_BODY, parameter: ${key}`);
+    }
+    return { contentType, content: body.Content ?? "" };
+}
+//# sourceMappingURL=sim-waf-custom-response.js.map

package/dist/service/wafv2/web-acl/sim-waf-custom-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-custom-response.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-custom-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAQ9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAiB;IAC3C,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;CACzC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAuD;IAEvD,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,cAAc,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACrD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;KAC1B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAuD;IAEvD,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;KAC1B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;QAC1C,MAAM,IAAI,+BAA+B,CACvC,wEAAwE;YACtE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAwB;IAClD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,+BAA+B,CACvC,yEAAyE;YACvE,iBAAiB,CACpB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAW,EACX,MAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IAE9D,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,+BAA+B,CACvC,0CAA0C,GAAG,0BAA0B;YACrE,mEAAmE;YACnE,2CAA2C,GAAG,EAAE,CACnD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;AACtD,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-custom-response.type.d.ts

@@ -0,0 +1,48 @@
+/**
+ * One header WAF adds to what it sends back, or to what it forwards.
+ */
+export interface SimWafHeader {
+    readonly name: string;
+    readonly value: string;
+}
+/**
+ * Minimal structural WAFv2 CustomHTTPHeader.
+ */
+export interface SimWafCustomHeaderInput {
+    readonly Name?: string | undefined;
+    readonly Value?: string | undefined;
+}
+/**
+ * Minimal structural WAFv2 CustomResponse.
+ */
+export interface SimWafCustomResponseInput {
+    readonly ResponseCode?: number | undefined;
+    readonly CustomResponseBodyKey?: string | undefined;
+    readonly ResponseHeaders?: readonly SimWafCustomHeaderInput[] | undefined;
+}
+/**
+ * Minimal structural WAFv2 CustomRequestHandling.
+ */
+export interface SimWafCustomRequestHandlingInput {
+    readonly InsertHeaders?: readonly SimWafCustomHeaderInput[] | undefined;
+}
+/**
+ * Minimal structural WAFv2 CustomResponseBody.
+ */
+export interface SimWafCustomResponseBodyInput {
+    readonly ContentType?: string | undefined;
+    readonly Content?: string | undefined;
+}
+/**
+ * The bodies a web ACL's block actions can answer with, by the key they are
+ * held under.
+ */
+export type SimWafCustomResponseBodies = Readonly<Record<string, SimWafCustomResponseBodyInput>>;
+/**
+ * One body a block action answers with, ready to send.
+ */
+export interface SimWafResponseBody {
+    readonly contentType: string;
+    readonly content: string;
+}
+//# sourceMappingURL=sim-waf-custom-response.type.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-custom-response.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-custom-response.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-custom-response.type.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;CACzE;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAC/C,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B"}

package/dist/service/wafv2/web-acl/sim-waf-custom-response.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-custom-response.type.js.map

package/dist/service/wafv2/web-acl/sim-waf-custom-response.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-custom-response.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-custom-response.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/web-acl/sim-waf-rule-evaluator.d.ts

@@ -0,0 +1,11 @@
+import type { SimWafRuleEvaluator, SimWafRuleInput, SimWafRuleScope } from "./sim-waf-rule.type.js";
+/**
+ * Compile what one rule does with a request.
+ *
+ * A rule naming a managed rule group is the one rule that decides by something
+ * other than its own action, so it is the one branch here. Real WAFv2 draws
+ * the same line: a rule carries an `Action` or it names a rule group and
+ * carries an `OverrideAction`, and never both.
+ */
+export declare function compileSimWafRuleEvaluator(input: SimWafRuleInput, ruleName: string, scope: SimWafRuleScope): SimWafRuleEvaluator;
+//# sourceMappingURL=sim-waf-rule-evaluator.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-rule-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule-evaluator.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule-evaluator.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EACf,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,GACrB,mBAAmB,CAyCrB"}

package/dist/service/wafv2/web-acl/sim-waf-rule-evaluator.js

@@ -0,0 +1,39 @@
+import { compileSimWafManagedRuleGroup } from "../managed/sim-waf-managed-group-statement.js";
+import { invalidSimWafRule } from "../statement/sim-waf-rule-refusals.js";
+import { compileSimWafStatement } from "../statement/sim-waf-statement.js";
+import { SimWafAction } from "./sim-waf-action.js";
+/**
+ * Compile what one rule does with a request.
+ *
+ * A rule naming a managed rule group is the one rule that decides by something
+ * other than its own action, so it is the one branch here. Real WAFv2 draws
+ * the same line: a rule carries an `Action` or it names a rule group and
+ * carries an `OverrideAction`, and never both.
+ */
+export function compileSimWafRuleEvaluator(input, ruleName, scope) {
+    const managed = input.Statement?.ManagedRuleGroupStatement;
+    if (managed !== undefined) {
+        if (input.Action !== undefined) {
+            invalidSimWafRule(ruleName, "A rule naming a rule group takes an OverrideAction rather than an " +
+                "Action, since the action comes from the rule inside the group " +
+                "that claimed the request");
+        }
+        return compileSimWafManagedRuleGroup({
+            statement: managed,
+            overrideAction: input.OverrideAction,
+            ruleName,
+            scope,
+        });
+    }
+    if (input.OverrideAction !== undefined) {
+        invalidSimWafRule(ruleName, "An OverrideAction applies to a rule group statement, and this rule " +
+            "names no rule group");
+    }
+    const action = SimWafAction.read(input.Action, ruleName, scope.customResponseBodies);
+    const matches = compileSimWafStatement(input.Statement, {
+        regexPatternSets: scope.regexPatternSets,
+        ruleName,
+    });
+    return (request) => matches(request) ? action : undefined;
+}
+//# sourceMappingURL=sim-waf-rule-evaluator.js.map

package/dist/service/wafv2/web-acl/sim-waf-rule-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule-evaluator.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule-evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOnD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAsB,EACtB,QAAgB,EAChB,KAAsB;IAEtB,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,yBAAyB,CAAC;IAE3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,iBAAiB,CACf,QAAQ,EACR,oEAAoE;gBAClE,gEAAgE;gBAChE,0BAA0B,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,QAAQ;YACR,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,iBAAiB,CACf,QAAQ,EACR,qEAAqE;YACnE,qBAAqB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAC9B,KAAK,CAAC,MAAM,EACZ,QAAQ,EACR,KAAK,CAAC,oBAAoB,CAC3B,CAAC;IACF,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE;QACtD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,EAA4B,EAAE,CAC3C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-rule-input.d.ts

@@ -0,0 +1,15 @@
+import type { SimWafRuleInput } from "./sim-waf-rule.type.js";
+/**
+ * Read the name a rule was written under, refusing one with none.
+ */
+export declare function requiredSimWafRuleName(name: string | undefined): string;
+/**
+ * Read the priority a rule runs at, refusing anything that is not a place in
+ * an order.
+ */
+export declare function requiredSimWafRulePriority(priority: number | undefined, name: string): number;
+/**
+ * Refuse the parts of a rule real WAFv2 takes and this simulation does not.
+ */
+export declare function refuseUnsimulatedSimWafRuleInput(input: SimWafRuleInput, name: string): void;
+//# sourceMappingURL=sim-waf-rule-input.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-rule-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule-input.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-rule-input.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAc9D;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQvE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,GACX,MAAM,CAUR;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,GACX,IAAI,CAQN"}