@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.d.ts

@@ -0,0 +1,38 @@
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+/**
+ * The IAM action a request to a method is authorized against.
+ *
+ * It is the only `execute-api` action evaluated here. The others AWS defines
+ * are WebSocket management and REST API cache invalidation, and nothing
+ * constrains the action string a policy may name, so a policy is free to grant
+ * one of them and nothing will ask about it.
+ */
+export declare const simExecuteApiInvokeAction = "execute-api:Invoke";
+/**
+ * The IAM policy document a Lambda authorizer answers with, evaluated for
+ * `execute-api:Invoke` on the method ARN the request was authorized under.
+ *
+ * The document the authorizer returned is the whole decision. There are no
+ * stored policies to gather, because there is no IAM principal here at all.
+ * The `principalId` returned alongside is a name the authorizer chose for the
+ * caller, so it identifies the caller in the authorizer's own logs and grants
+ * nothing.
+ *
+ * An explicit Deny wins over an Allow, and a document allowing nothing
+ * relevant refuses the request. Real API Gateway answers the two with
+ * different bodies, so they are told apart here.
+ */
+export declare class SimRestApiAuthorizerPolicy {
+    private readonly document;
+    constructor(document: SimIamPolicyDocument);
+    /**
+     * What this document says about a request to one method, answering
+     * `undefined` where it allows the request through.
+     *
+     * Throws the way IAM does for a document it cannot read, which the caller
+     * answers with the same 500 any other unusable authorizer response gets.
+     */
+    refusal(methodArn: string): SimRestApiAuthorization | undefined;
+}
+//# sourceMappingURL=sim-rest-api-authorizer-policy.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAEhD,YAAY,QAAQ,EAAE,oBAAoB,EAEzC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CA+B9D;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.js

@@ -0,0 +1,70 @@
+import { SimIamEitherSideAllowRequirement } from "../../../iam/authorize/allow/sim-iam-allow-requirement.js";
+import { SimIamPolicyDecision } from "../../../iam/authorize/sim-iam-decision.js";
+import { SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+/**
+ * The IAM action a request to a method is authorized against.
+ *
+ * It is the only `execute-api` action evaluated here. The others AWS defines
+ * are WebSocket management and REST API cache invalidation, and nothing
+ * constrains the action string a policy may name, so a policy is free to grant
+ * one of them and nothing will ask about it.
+ */
+export const simExecuteApiInvokeAction = "execute-api:Invoke";
+/**
+ * The IAM policy document a Lambda authorizer answers with, evaluated for
+ * `execute-api:Invoke` on the method ARN the request was authorized under.
+ *
+ * The document the authorizer returned is the whole decision. There are no
+ * stored policies to gather, because there is no IAM principal here at all.
+ * The `principalId` returned alongside is a name the authorizer chose for the
+ * caller, so it identifies the caller in the authorizer's own logs and grants
+ * nothing.
+ *
+ * An explicit Deny wins over an Allow, and a document allowing nothing
+ * relevant refuses the request. Real API Gateway answers the two with
+ * different bodies, so they are told apart here.
+ */
+export class SimRestApiAuthorizerPolicy {
+    document;
+    constructor(document) {
+        this.document = document;
+    }
+    /**
+     * What this document says about a request to one method, answering
+     * `undefined` where it allows the request through.
+     *
+     * Throws the way IAM does for a document it cannot read, which the caller
+     * answers with the same 500 any other unusable authorizer response gets.
+     */
+    refusal(methodArn) {
+        const decision = new SimIamPolicyDecision({
+            // The document is evaluated as the identity side, which is the side with
+            // no Principal to state. An authorizer's policy says what the caller it
+            // just identified may do rather than who may reach the method.
+            identityPolicies: [
+                {
+                    sourceType: "identity-inline",
+                    document: this.document,
+                    policyName: "AuthorizerPolicyDocument",
+                },
+            ],
+            resourcePolicies: [],
+            allowRequirement: new SimIamEitherSideAllowRequirement(),
+            action: simExecuteApiInvokeAction,
+            resource: methodArn,
+            conditionContext: {},
+            // There is no principal behind this document, and nothing in it can name
+            // one, so the caller is anonymous. A condition on a principal key
+            // therefore never matches, which is the strict direction to be wrong in.
+            caller: {
+                principal: { kind: "anonymous" },
+                identityPolicyPrincipal: { kind: "anonymous" },
+            },
+        });
+        if (decision.isExplicitDeny) {
+            return SimRestApiRefused.explicitDeny();
+        }
+        return decision.isAllowed ? undefined : SimRestApiRefused.implicitDeny();
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-policy.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-policy.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,0BAA0B;IACpB,QAAQ,CAAuB;IAEhD,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAiB;QACvB,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACxC,yEAAyE;YACzE,wEAAwE;YACxE,+DAA+D;YAC/D,gBAAgB,EAAE;gBAChB;oBACE,UAAU,EAAE,iBAAiB;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,0BAA0B;iBACvC;aACF;YACD,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,IAAI,gCAAgC,EAAE;YACxD,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,SAAS;YACnB,gBAAgB,EAAE,EAAE;YACpB,yEAAyE;YACzE,kEAAkE;YAClE,yEAAyE;YACzE,MAAM,EAAE;gBACN,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAChC,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-response.d.ts

@@ -0,0 +1,41 @@
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+/**
+ * Reads what a REST API Lambda authorizer answered.
+ *
+ * There is one shape: a `principalId` naming the caller and an IAM
+ * `policyDocument` that has to allow `execute-api:Invoke` on the method ARN. A
+ * REST API authorizer always answers a policy, where an HTTP API authorizer
+ * may answer a boolean. A response of any other shape is a 500 rather than a
+ * refusal, because API Gateway could not read it either.
+ *
+ * `{ "errorMessage": "Unauthorized" }` is the one answer that produces a 401.
+ * A function that throws is an invocation failure here rather than that value.
+ * Real Lambda turns a thrown error into a payload carrying this member, while
+ * simulated Lambda rejects with the error itself, so returning the value is
+ * the way to ask for a 401.
+ */
+export declare class SimRestApiAuthorizerResponse {
+    private readonly methodArn;
+    constructor(methodArn: string);
+    /**
+     * What the endpoint should do with the request, given what the authorizer
+     * answered.
+     */
+    read(result: unknown): SimRestApiAuthorization;
+    /**
+     * Put the returned document to IAM, and gather what reaches the handler
+     * where it allows the request.
+     */
+    private evaluated;
+    /**
+     * The `requestContext.authorizer` block for an admitted request.
+     *
+     * A REST API flattens the authorizer's `context` alongside its
+     * `principalId`, so a handler reads `requestContext.authorizer.tenantId`
+     * where payload format 2.0 would put the context in a block of its own. A
+     * context that is not an object is left out, since a handler reading a
+     * member off it would find something else here.
+     */
+    private authorizerContext;
+}
+//# sourceMappingURL=sim-rest-api-authorizer-response.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-response.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAQ5D;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,SAAS,EAAE,MAAM,EAE5B;IAED;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,uBAAuB,CAmB7C;IAED;;;OAGG;IACH,OAAO,CAAC,SAAS;IAiBjB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-response.js

@@ -0,0 +1,75 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimRestApiAdmitted, SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { SimRestApiAuthorizerPolicy } from "./sim-rest-api-authorizer-policy.js";
+/**
+ * The one message a Lambda authorizer answers a 401 with.
+ */
+const unauthorizedErrorMessage = "Unauthorized";
+/**
+ * Reads what a REST API Lambda authorizer answered.
+ *
+ * There is one shape: a `principalId` naming the caller and an IAM
+ * `policyDocument` that has to allow `execute-api:Invoke` on the method ARN. A
+ * REST API authorizer always answers a policy, where an HTTP API authorizer
+ * may answer a boolean. A response of any other shape is a 500 rather than a
+ * refusal, because API Gateway could not read it either.
+ *
+ * `{ "errorMessage": "Unauthorized" }` is the one answer that produces a 401.
+ * A function that throws is an invocation failure here rather than that value.
+ * Real Lambda turns a thrown error into a payload carrying this member, while
+ * simulated Lambda rejects with the error itself, so returning the value is
+ * the way to ask for a 401.
+ */
+export class SimRestApiAuthorizerResponse {
+    methodArn;
+    constructor(methodArn) {
+        this.methodArn = methodArn;
+    }
+    /**
+     * What the endpoint should do with the request, given what the authorizer
+     * answered.
+     */
+    read(result) {
+        if (!isRecord(result)) {
+            return SimRestApiRefused.error();
+        }
+        if (result["errorMessage"] === unauthorizedErrorMessage) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const policyDocument = result["policyDocument"];
+        if (typeof result["principalId"] !== "string" ||
+            !isRecord(policyDocument)) {
+            return SimRestApiRefused.error();
+        }
+        return this.evaluated(policyDocument, result);
+    }
+    /**
+     * Put the returned document to IAM, and gather what reaches the handler
+     * where it allows the request.
+     */
+    evaluated(policyDocument, result) {
+        try {
+            return (new SimRestApiAuthorizerPolicy(policyDocument).refusal(this.methodArn) ?? new SimRestApiAdmitted({ lambda: this.authorizerContext(result) }));
+        }
+        catch {
+            // IAM refused to read the document, which is a malformed policy rather
+            // than a policy that says no.
+            return SimRestApiRefused.error();
+        }
+    }
+    /**
+     * The `requestContext.authorizer` block for an admitted request.
+     *
+     * A REST API flattens the authorizer's `context` alongside its
+     * `principalId`, so a handler reads `requestContext.authorizer.tenantId`
+     * where payload format 2.0 would put the context in a block of its own. A
+     * context that is not an object is left out, since a handler reading a
+     * member off it would find something else here.
+     */
+    authorizerContext(result) {
+        const context = result["context"];
+        const principalId = { principalId: result["principalId"] };
+        return isRecord(context) ? { ...context, ...principalId } : principalId;
+    }
+}
+//# sourceMappingURL=sim-rest-api-authorizer-response.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-authorizer-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-authorizer-response.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-authorizer-response.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;GAEG;AACH,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACtB,SAAS,CAAS;IAEnC,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,MAAe;QAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,wBAAwB,EAAE,CAAC;YACxD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEhD,IACE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ;YACzC,CAAC,QAAQ,CAAC,cAAc,CAAC,EACzB,CAAC;YACD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,cAAoC,EACpC,MAA+B;QAE/B,IAAI,CAAC;YACH,OAAO,CACL,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC,OAAO,CACpD,IAAI,CAAC,SAAS,CACf,IAAI,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CACxE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,8BAA8B;YAC9B,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,iBAAiB,CACvB,MAA+B;QAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,aAAa,CAAW,EAAE,CAAC;QAErE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1E,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.d.ts

@@ -0,0 +1,28 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+import type { SimRestApiMethodAuthorizeInput } from "./sim-rest-api-method-authorize-input.js";
+interface SimRestApiCognitoMethodAuthorizerProperties {
+    /**
+     * Clock the token's time claims are checked against, so advancing simulated
+     * time expires a token that was accepted before it.
+     */
+    readonly clock: SimClock;
+}
+/**
+ * Decides whether one request may have a `COGNITO_USER_POOLS` method.
+ *
+ * Nothing is invoked. The token has to verify against the keys one of the
+ * authorizer's pools publishes, and the scopes the method asks for have to be
+ * met.
+ */
+export declare class SimRestApiCognitoMethodAuthorizer {
+    private readonly clock;
+    constructor(properties: SimRestApiCognitoMethodAuthorizerProperties);
+    /**
+     * Authorize one request against the `COGNITO_USER_POOLS` method that
+     * matched it.
+     */
+    authorize(input: SimRestApiMethodAuthorizeInput): SimRestApiAuthorization;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-cognito-method-authorizer.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-method-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/F,UAAU,2CAA2C;IACnD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,2CAA2C,EAElE;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,8BAA8B,GAAG,uBAAuB,CAyBxE;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.js

@@ -0,0 +1,40 @@
+import { simJwtBearerToken } from "../../../../util/jwt/sim-jwt-bearer-token.js";
+import { SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { SimRestApiCognitoAuthorizer } from "../../api/authorizer/sim-rest-api-cognito-authorizer.js";
+import { SimRestApiCognitoVerification } from "../../api/authorizer/sim-rest-api-cognito-verification.js";
+/**
+ * Decides whether one request may have a `COGNITO_USER_POOLS` method.
+ *
+ * Nothing is invoked. The token has to verify against the keys one of the
+ * authorizer's pools publishes, and the scopes the method asks for have to be
+ * met.
+ */
+export class SimRestApiCognitoMethodAuthorizer {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Authorize one request against the `COGNITO_USER_POOLS` method that
+     * matched it.
+     */
+    authorize(input) {
+        const { restApi, match, request } = input;
+        const authorizer = restApi.authorizers.find(match.method.authorizerId ?? "");
+        // Such a method always names a Cognito authorizer, and that authorizer can
+        // still be deleted out from under it, so the two come to the same thing
+        // here: with nothing to verify against, the method stays closed.
+        if (!(authorizer instanceof SimRestApiCognitoAuthorizer)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const presented = simJwtBearerToken(authorizer.identitySource.value(request));
+        if (presented === undefined) {
+            return SimRestApiRefused.unauthorized();
+        }
+        return new SimRestApiCognitoVerification({
+            userPools: restApi.userPools,
+            clock: this.clock,
+        }).verify(authorizer, presented, match.method.authorizationScopes);
+    }
+}
+//# sourceMappingURL=sim-rest-api-cognito-method-authorizer.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-method-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAW1G;;;;;;GAMG;AACH,MAAM,OAAO,iCAAiC;IAC3B,KAAK,CAAW;IAEjC,YAAY,UAAuD;QACjE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CACzC,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAChC,CAAC;QAEF,2EAA2E;QAC3E,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,CAAC,CAAC,UAAU,YAAY,2BAA2B,CAAC,EAAE,CAAC;YACzD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CACjC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CACzC,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,6BAA6B,CAAC;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACrE,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.d.ts

@@ -0,0 +1,24 @@
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+import type { SimRestApiMethodAuthorizeInput } from "./sim-rest-api-method-authorize-input.js";
+/**
+ * Decides whether a caller may have an `AWS_IAM` method.
+ *
+ * This is the client's own authorization, evaluated against the identity
+ * policies of the caller the serving boundary resolved. Resource policies on
+ * the API are a second mechanism a REST API has and this does not read, so the
+ * caller's identity policies are the whole decision, and a caller from another
+ * Account is refused: a cross-Account request needs an Allow from each side.
+ * The way through, here as on AWS, is to assume a Role in the API's Account.
+ *
+ * A request carrying no credentials is anonymous rather than unauthenticated,
+ * so it comes here like any other and is refused because nothing allows an
+ * anonymous caller anything.
+ */
+export declare class SimRestApiIamMethodAuthorizer {
+    /**
+     * Evaluate `execute-api:Invoke` for the caller against the method being
+     * called.
+     */
+    authorize(input: SimRestApiMethodAuthorizeInput): SimRestApiAuthorization;
+}
+//# sourceMappingURL=sim-rest-api-iam-method-authorizer.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-iam-method-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/F;;;;;;;;;;;;;GAaG;AACH,qBAAa,6BAA6B;IACxC;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,8BAA8B,GAAG,uBAAuB,CAwBxE;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.js

@@ -0,0 +1,43 @@
+import { SimRestApiAdmitted, SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { SimRestApiExecuteApiArn } from "../../api/sim-rest-api-execute-api-arn.js";
+import { simExecuteApiInvokeAction } from "./sim-rest-api-authorizer-policy.js";
+/**
+ * Decides whether a caller may have an `AWS_IAM` method.
+ *
+ * This is the client's own authorization, evaluated against the identity
+ * policies of the caller the serving boundary resolved. Resource policies on
+ * the API are a second mechanism a REST API has and this does not read, so the
+ * caller's identity policies are the whole decision, and a caller from another
+ * Account is refused: a cross-Account request needs an Allow from each side.
+ * The way through, here as on AWS, is to assume a Role in the API's Account.
+ *
+ * A request carrying no credentials is anonymous rather than unauthenticated,
+ * so it comes here like any other and is refused because nothing allows an
+ * anonymous caller anything.
+ */
+export class SimRestApiIamMethodAuthorizer {
+    /**
+     * Evaluate `execute-api:Invoke` for the caller against the method being
+     * called.
+     */
+    authorize(input) {
+        const { restApi, match, request, caller, iam } = input;
+        const decision = iam.authorize({
+            action: simExecuteApiInvokeAction,
+            // The ARN of the request the client made, which names the concrete path
+            // rather than the resource template, because an identity policy is
+            // written by hand against the request being made.
+            resource: SimRestApiExecuteApiArn.forRequest(restApi, match, request.method).toString(),
+            caller: caller.toCaller(),
+        });
+        if (decision.isDenied) {
+            // Whether a Deny statement matched or nothing allowed the method is not
+            // told apart, because a service-facing decision does not carry it. Both
+            // are the 403 real API Gateway answers, with the body it gives a caller
+            // its policies left short.
+            return SimRestApiRefused.implicitDeny();
+        }
+        return new SimRestApiAdmitted({ caller });
+    }
+}
+//# sourceMappingURL=sim-rest-api-iam-method-authorizer.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-iam-method-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAGhF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,6BAA6B;IACxC;;;OAGG;IACH,SAAS,CAAC,KAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE,yBAAyB;YACjC,wEAAwE;YACxE,mEAAmE;YACnE,kDAAkD;YAClD,QAAQ,EAAE,uBAAuB,CAAC,UAAU,CAC1C,OAAO,EACP,KAAK,EACL,OAAO,CAAC,MAAM,CACf,CAAC,QAAQ,EAAE;YACZ,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;SAC1B,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,2BAA2B;YAC3B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.d.ts

@@ -0,0 +1,16 @@
+import type { SimRestApiAuthorizer } from "../../api/authorizer/sim-rest-api-authorizer.js";
+import type { SimRestApi } from "../../api/sim-rest-api.js";
+import type { SimRestApiFunctionTarget } from "../sim-rest-api-function-target.js";
+/**
+ * Whether the API may not invoke a function as one of its authorizers.
+ *
+ * Whether a service may invoke a function is Lambda's own rule, so the
+ * decision is made there. What this adds is the part only API Gateway knows,
+ * which is what the function is being invoked for.
+ *
+ * The source ARN names the authorizer rather than any method, so a function
+ * granted the invoke action for the API's methods is not thereby usable as its
+ * authorizer, as on real AWS.
+ */
+export declare function simRestApiMayNotInvokeAuthorizer(restApi: SimRestApi, authorizer: SimRestApiAuthorizer, target: SimRestApiFunctionTarget): boolean;
+//# sourceMappingURL=sim-rest-api-invoke-authorizer.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-invoke-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAE5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,oBAAoB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAUT"}

package/dist/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.js

@@ -0,0 +1,23 @@
+import { SimLambdaServiceInvokeAuthorizer } from "../../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
+import { SimRestApiExecuteApiArn } from "../../api/sim-rest-api-execute-api-arn.js";
+import { simApiGatewayServicePrincipal } from "../../sim-api-gateway-service-principal.js";
+/**
+ * Whether the API may not invoke a function as one of its authorizers.
+ *
+ * Whether a service may invoke a function is Lambda's own rule, so the
+ * decision is made there. What this adds is the part only API Gateway knows,
+ * which is what the function is being invoked for.
+ *
+ * The source ARN names the authorizer rather than any method, so a function
+ * granted the invoke action for the API's methods is not thereby usable as its
+ * authorizer, as on real AWS.
+ */
+export function simRestApiMayNotInvokeAuthorizer(restApi, authorizer, target) {
+    return new SimLambdaServiceInvokeAuthorizer({ iam: target.iam }).authorize({
+        resource: target.resource,
+        servicePrincipal: simApiGatewayServicePrincipal,
+        sourceArn: SimRestApiExecuteApiArn.forAuthorizer(restApi, authorizer.authorizerId).toString(),
+        sourceAccount: restApi.accountRegionScope.accountId,
+    }).isDenied;
+}
+//# sourceMappingURL=sim-rest-api-invoke-authorizer.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-invoke-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAEpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAG3F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAmB,EACnB,UAAgC,EAChC,MAAgC;IAEhC,OAAO,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;QACzE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,6BAA6B;QAC/C,SAAS,EAAE,uBAAuB,CAAC,aAAa,CAC9C,OAAO,EACP,UAAU,CAAC,YAAY,CACxB,CAAC,QAAQ,EAAE;QACZ,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC,SAAS;KACpD,CAAC,CAAC,QAAQ,CAAC;AACd,CAAC"}

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.d.ts

@@ -0,0 +1,28 @@
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
+import type { SimRestApiMatch } from "../../api/match/sim-rest-api-match.js";
+import type { SimRestApi } from "../../api/sim-rest-api.js";
+/**
+ * Everything a method authorization decision is made from.
+ *
+ * The whole match is carried rather than only the method, because the
+ * `methodArn` an authorizer is handed names the stage that served the request
+ * and the path it asked for, both of which the match settled.
+ */
+export interface SimRestApiMethodAuthorizeInput {
+    readonly restApi: SimRestApi;
+    readonly match: SimRestApiMatch;
+    readonly request: Request;
+    /**
+     * The principal the serving boundary attributed the request to, from a
+     * signature or from a named caller, and anonymous when it carried neither.
+     */
+    readonly caller: SimAwsRequestCaller;
+    /**
+     * IAM of the Account that owns the API, which is what decides an `AWS_IAM`
+     * method. It is the API's own rather than the caller's, and rather than the
+     * integrated function's.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+//# sourceMappingURL=sim-rest-api-method-authorize-input.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-method-authorize-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC"}

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-rest-api-method-authorize-input.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-method-authorize-input.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.ts"],"names":[],"mappings":""}

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorizer.d.ts

@@ -0,0 +1,59 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { type SimRestApiAuthorizerFunctions } from "./sim-rest-api-authorizer-invocation.js";
+import type { SimRestApiMethodAuthorizeInput } from "./sim-rest-api-method-authorize-input.js";
+interface SimRestApiMethodAuthorizerProperties {
+    /**
+     * Where an authorizer's function is found, which is the same router that
+     * finds an integration's.
+     */
+    readonly functions: SimRestApiAuthorizerFunctions;
+    /**
+     * Clock an authorizer's invocation event is stamped with, a verified
+     * token's time claims are checked against, and a held decision expires
+     * against, so advancing simulated time expires a token that was accepted
+     * before it and drops a decision that was being reused.
+     */
+    readonly clock: SimClock;
+}
+/**
+ * Decides whether one request may have the method that matched it.
+ *
+ * This is the client's side of the question, and it runs before the API asks
+ * whether it may invoke the integration. A request presenting no credentials
+ * is refused whether or not the integration behind the method would have
+ * worked.
+ *
+ * Which kind of authorization the method asks for is settled here, and each
+ * kind decides on its own terms. The steps for a `CUSTOM` method are the ones
+ * real API Gateway takes:
+ *
+ * 1. the request has to carry something at every one of the authorizer's
+ *    identity sources, or it is refused with a 401 and the function is never
+ *    invoked;
+ * 2. a decision already made for that same identity at that same method, and
+ *    not yet expired, is reused by `SimRestApiAuthorizerDecisions`, and
+ *    nothing further happens;
+ * 3. otherwise the function is asked, and the policy it answers with is
+ *    evaluated against the ARN of the request being made.
+ *
+ * An authorizer with no `authorizerResultTtlInSeconds` holds nothing, so its
+ * function is invoked once per request reaching the method.
+ */
+export declare class SimRestApiMethodAuthorizer {
+    private readonly invocation;
+    private readonly decisions;
+    private readonly iamAuthorizer;
+    private readonly cognito;
+    constructor(properties: SimRestApiMethodAuthorizerProperties);
+    /**
+     * Authorize one request against the method that matched it.
+     */
+    authorize(input: SimRestApiMethodAuthorizeInput): Promise<SimRestApiAuthorization>;
+    /**
+     * Authorize one request against the `CUSTOM` method that matched it.
+     */
+    private custom;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-method-authorizer.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-method-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-method-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAI5D,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/F,UAAU,oCAAoC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,oCAAoC,EAW3D;IAED;;OAEG;IACG,SAAS,CACb,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAiBlC;IAED;;OAEG;YACW,MAAM;CAuCrB"}