@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorizer.js

@@ -0,0 +1,90 @@
+import { SimRestApiAdmitted, SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { SimRestApiLambdaAuthorizer } from "../../api/authorizer/sim-rest-api-lambda-authorizer.js";
+import { SimRestApiExecuteApiArn } from "../../api/sim-rest-api-execute-api-arn.js";
+import { SimRestApiAuthorizerDecisions } from "./sim-rest-api-authorizer-decisions.js";
+import { SimRestApiAuthorizerInvocation, } from "./sim-rest-api-authorizer-invocation.js";
+import { SimRestApiCognitoMethodAuthorizer } from "./sim-rest-api-cognito-method-authorizer.js";
+import { SimRestApiIamMethodAuthorizer } from "./sim-rest-api-iam-method-authorizer.js";
+/**
+ * Decides whether one request may have the method that matched it.
+ *
+ * This is the client's side of the question, and it runs before the API asks
+ * whether it may invoke the integration. A request presenting no credentials
+ * is refused whether or not the integration behind the method would have
+ * worked.
+ *
+ * Which kind of authorization the method asks for is settled here, and each
+ * kind decides on its own terms. The steps for a `CUSTOM` method are the ones
+ * real API Gateway takes:
+ *
+ * 1. the request has to carry something at every one of the authorizer's
+ *    identity sources, or it is refused with a 401 and the function is never
+ *    invoked;
+ * 2. a decision already made for that same identity at that same method, and
+ *    not yet expired, is reused by `SimRestApiAuthorizerDecisions`, and
+ *    nothing further happens;
+ * 3. otherwise the function is asked, and the policy it answers with is
+ *    evaluated against the ARN of the request being made.
+ *
+ * An authorizer with no `authorizerResultTtlInSeconds` holds nothing, so its
+ * function is invoked once per request reaching the method.
+ */
+export class SimRestApiMethodAuthorizer {
+    invocation;
+    decisions;
+    iamAuthorizer = new SimRestApiIamMethodAuthorizer();
+    cognito;
+    constructor(properties) {
+        this.invocation = new SimRestApiAuthorizerInvocation({
+            functions: properties.functions,
+            clock: properties.clock,
+        });
+        this.decisions = new SimRestApiAuthorizerDecisions({
+            clock: properties.clock,
+        });
+        this.cognito = new SimRestApiCognitoMethodAuthorizer({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Authorize one request against the method that matched it.
+     */
+    async authorize(input) {
+        switch (input.match.method.authorizationType) {
+            case "NONE": {
+                // Nobody was authorized, so there is no caller to describe, which is
+                // what leaves requestContext.authorizer out of the event entirely.
+                return new SimRestApiAdmitted();
+            }
+            case "AWS_IAM": {
+                return this.iamAuthorizer.authorize(input);
+            }
+            case "COGNITO_USER_POOLS": {
+                return this.cognito.authorize(input);
+            }
+            case "CUSTOM": {
+                return await this.custom(input);
+            }
+        }
+    }
+    /**
+     * Authorize one request against the `CUSTOM` method that matched it.
+     */
+    async custom(input) {
+        const { restApi, match, request } = input;
+        const authorizer = restApi.authorizers.find(match.method.authorizerId ?? "");
+        // A CUSTOM method always names a Lambda authorizer, and that authorizer
+        // can still be deleted out from under it, so the two come to the same
+        // thing here: with nothing to ask, the method stays closed.
+        if (!(authorizer instanceof SimRestApiLambdaAuthorizer)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const identityValues = authorizer.identitySources.values(request);
+        if (identityValues === undefined) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const methodArn = SimRestApiExecuteApiArn.forRequest(restApi, match, request.method).toString();
+        return await this.decisions.decide(authorizer, { methodArn, identityValues }, async () => await this.invocation.invoke(input, authorizer, identityValues, methodArn));
+    }
+}
+//# sourceMappingURL=sim-rest-api-method-authorizer.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-method-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-method-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAEL,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAkBxF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,0BAA0B;IACpB,UAAU,CAAiC;IAC3C,SAAS,CAAgC;IACzC,aAAa,GAAG,IAAI,6BAA6B,EAAE,CAAC;IACpD,OAAO,CAAoC;IAE5D,YAAY,UAAgD;QAC1D,IAAI,CAAC,UAAU,GAAG,IAAI,8BAA8B,CAAC;YACnD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,6BAA6B,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,iCAAiC,CAAC;YACnD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,KAAqC;QAErC,QAAQ,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7C,KAAK,MAAM,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,mEAAmE;gBACnE,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAClB,KAAqC;QAErC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CACzC,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAChC,CAAC;QAEF,wEAAwE;QACxE,sEAAsE;QACtE,4DAA4D;QAC5D,IAAI,CAAC,CAAC,UAAU,YAAY,0BAA0B,CAAC,EAAE,CAAC;YACxD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAClD,OAAO,EACP,KAAK,EACL,OAAO,CAAC,MAAM,CACf,CAAC,QAAQ,EAAE,CAAC;QAEb,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAChC,UAAU,EACV,EAAE,SAAS,EAAE,cAAc,EAAE,EAC7B,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAC1B,KAAK,EACL,UAAU,EACV,cAAc,EACd,SAAS,CACV,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.d.ts

@@ -0,0 +1,62 @@
+import type { SimPayload1Endpoint } from "../../../../serve/payload-1/sim-payload-1-endpoint.js";
+import type { SimPayload1RequestContext } from "../../../../serve/payload-1/sim-payload-1-event.type.js";
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+/**
+ * The event a `REQUEST` authorizer's function is invoked with.
+ *
+ * It is the payload format 1.0 request event with `type` and `methodArn` added
+ * and the body left out. AWS's own example of this event carries no `body` and
+ * no `isBase64Encoded`, which is the one published account of what an
+ * authorizer receives, so neither is sent here.
+ *
+ * The maps are empty rather than `null` for the same reason. An integration
+ * event sends `null` where nothing was supplied, and the published authorizer
+ * event sends `{}`, so a `REQUEST` authorizer reading
+ * `event.queryStringParameters.token` finds nothing rather than throwing.
+ */
+export interface SimRestApiRequestAuthorizerEvent {
+    type: "REQUEST";
+    /**
+     * The `execute-api` ARN of the request being authorized. The policy the
+     * function answers with is evaluated against this same ARN.
+     */
+    methodArn: string;
+    /** The resource path template the request matched, without the stage. */
+    resource: string;
+    /** The request path, stage segment and all. */
+    path: string;
+    httpMethod: string;
+    headers: Record<string, string>;
+    multiValueHeaders: Record<string, string[]>;
+    queryStringParameters: Record<string, string>;
+    multiValueQueryStringParameters: Record<string, string[]>;
+    pathParameters: Record<string, string>;
+    stageVariables: Record<string, string>;
+    requestContext: SimPayload1RequestContext;
+}
+interface SimRestApiRequestAuthorizerEventInput {
+    readonly request: Request;
+    readonly endpoint: SimPayload1Endpoint;
+    readonly methodArn: string;
+}
+interface SimRestApiRequestAuthorizerEventBuilderProperties {
+    /** Clock stamping the event's requestContext time. */
+    readonly clock: SimClock;
+}
+/**
+ * Builds the event a `REQUEST` authorizer is invoked with.
+ *
+ * The members are copied across one at a time rather than spread, so what an
+ * authorizer receives is stated here rather than following from whatever the
+ * integration event happens to hold.
+ */
+export declare class SimRestApiRequestAuthorizerEventBuilder {
+    private readonly eventBuilder;
+    constructor(properties: SimRestApiRequestAuthorizerEventBuilderProperties);
+    /**
+     * Build the authorizer event for one request.
+     */
+    build(input: SimRestApiRequestAuthorizerEventInput): Promise<SimRestApiRequestAuthorizerEvent>;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-request-authorizer-event.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-request-authorizer-event.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AAEjG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACzG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,+BAA+B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,cAAc,EAAE,yBAAyB,CAAC;CAC3C;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,iDAAiD;IACzD,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,uCAAuC;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IAEvD,YAAY,UAAU,EAAE,iDAAiD,EAIxE;IAED;;OAEG;IACG,KAAK,CACT,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,gCAAgC,CAAC,CAwB3C;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.js

@@ -0,0 +1,40 @@
+import { SimPayload1EventBuilder } from "../../../../serve/payload-1/sim-payload-1-event-builder.js";
+/**
+ * Builds the event a `REQUEST` authorizer is invoked with.
+ *
+ * The members are copied across one at a time rather than spread, so what an
+ * authorizer receives is stated here rather than following from whatever the
+ * integration event happens to hold.
+ */
+export class SimRestApiRequestAuthorizerEventBuilder {
+    eventBuilder;
+    constructor(properties) {
+        this.eventBuilder = new SimPayload1EventBuilder({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Build the authorizer event for one request.
+     */
+    async build(input) {
+        // The request is cloned because reading it consumes its body, and the
+        // integration behind the method still has to build an event of its own
+        // from the same request.
+        const requestEvent = await this.eventBuilder.build(input.request.clone(), input.endpoint);
+        return {
+            type: "REQUEST",
+            methodArn: input.methodArn,
+            resource: requestEvent.resource,
+            path: requestEvent.path,
+            httpMethod: requestEvent.httpMethod,
+            headers: requestEvent.headers ?? {},
+            multiValueHeaders: requestEvent.multiValueHeaders ?? {},
+            queryStringParameters: requestEvent.queryStringParameters ?? {},
+            multiValueQueryStringParameters: requestEvent.multiValueQueryStringParameters ?? {},
+            pathParameters: requestEvent.pathParameters ?? {},
+            stageVariables: requestEvent.stageVariables ?? {},
+            requestContext: requestEvent.requestContext,
+        };
+    }
+}
+//# sourceMappingURL=sim-rest-api-request-authorizer-event.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-request-authorizer-event.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4DAA4D,CAAC;AAiDrG;;;;;;GAMG;AACH,MAAM,OAAO,uCAAuC;IACjC,YAAY,CAA0B;IAEvD,YAAY,UAA6D;QACvE,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CACT,KAA4C;QAE5C,sEAAsE;QACtE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAChD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EACrB,KAAK,CAAC,QAAQ,CACf,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,EAAE;YACnC,iBAAiB,EAAE,YAAY,CAAC,iBAAiB,IAAI,EAAE;YACvD,qBAAqB,EAAE,YAAY,CAAC,qBAAqB,IAAI,EAAE;YAC/D,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B,IAAI,EAAE;YACpD,cAAc,EAAE,YAAY,CAAC,cAAc,IAAI,EAAE;YACjD,cAAc,EAAE,YAAY,CAAC,cAAc,IAAI,EAAE;YACjD,cAAc,EAAE,YAAY,CAAC,cAAc;SAC5C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-api-gateway-controller.d.ts

@@ -0,0 +1,50 @@
+import type { SimAwsServiceController, SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import { SimAws } from "../../aws/sim-aws.js";
+import { SimApiGatewayRouter } from "./sim-api-gateway-router.js";
+interface SimApiGatewayServiceControllerProperties {
+    readonly simAws?: SimAws;
+    readonly router?: SimApiGatewayRouter;
+}
+/**
+ * Localhost HTTP controller for simulated API Gateway REST APIs.
+ *
+ * A request reaching the generated endpoint is matched to a stage, then walked
+ * down the resource tree to a method, and that method's integration invokes a
+ * simulated Lambda function with a payload format 1.0 event. The function runs
+ * as its execution Role, as it does for any other invocation.
+ *
+ * A method that authorizes anybody is checked before any of that. An `AWS_IAM`
+ * method's caller has to be allowed `execute-api:Invoke` on the method, and a
+ * `CUSTOM` method's Lambda authorizer has to allow the request, or the request
+ * is refused and the integration is never invoked. Whether the API may invoke a
+ * function is a separate question, and the API's own rather than the client's.
+ *
+ * A web ACL in front of the stage comes ahead of all of it, as it does on real
+ * API Gateway. A request the web ACL blocks is answered before the method is
+ * matched, so neither the authorizer nor the integration sees it.
+ */
+export declare class SimApiGatewayServiceController implements SimAwsServiceController {
+    private readonly router;
+    private readonly methodAuthorizer;
+    private readonly integration;
+    private readonly errorResponse;
+    private readonly refusalResponse;
+    private readonly webAcl;
+    constructor(properties?: SimApiGatewayServiceControllerProperties);
+    /**
+     * Handle an HTTP request routed to a simulated REST API.
+     */
+    handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
+    private invoke;
+    /**
+     * What a request that reached nothing is answered with.
+     *
+     * Real API Gateway tells the two apart. A stage the API does not serve is a
+     * plain `Forbidden`, while a request that found the stage and matched no
+     * method gets `Missing Authentication Token`, whether or not it carried
+     * credentials.
+     */
+    private missResponse;
+}
+export {};
+//# sourceMappingURL=sim-api-gateway-controller.d.ts.map

package/dist/service/apigateway/serve/sim-api-gateway-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAS9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAKlE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,YAAY,UAAU,GAAE,wCAA6C,EAapE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E;YAEa,MAAM;IAoDpB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;CAKrB"}

package/dist/service/apigateway/serve/sim-api-gateway-controller.js

@@ -0,0 +1,120 @@
+import { SimAws } from "../../aws/sim-aws.js";
+import { isSimRestApiMatch, } from "../api/match/sim-rest-api-match.js";
+import { SimRestApiRequest } from "../api/match/sim-rest-api-request.js";
+import { SimRestApiMethodAuthorizer } from "./auth/sim-rest-api-method-authorizer.js";
+import { SimApiGatewayErrorResponse } from "./sim-api-gateway-error-response.js";
+import { SimApiGatewayRouter } from "./sim-api-gateway-router.js";
+import { SimRestApiIntegrationInvocation } from "./sim-rest-api-integration-invocation.js";
+import { SimRestApiRefusalResponse } from "./sim-rest-api-refusal-response.js";
+import { SimRestApiWebAclInspection } from "./sim-rest-api-web-acl-inspection.js";
+/**
+ * Localhost HTTP controller for simulated API Gateway REST APIs.
+ *
+ * A request reaching the generated endpoint is matched to a stage, then walked
+ * down the resource tree to a method, and that method's integration invokes a
+ * simulated Lambda function with a payload format 1.0 event. The function runs
+ * as its execution Role, as it does for any other invocation.
+ *
+ * A method that authorizes anybody is checked before any of that. An `AWS_IAM`
+ * method's caller has to be allowed `execute-api:Invoke` on the method, and a
+ * `CUSTOM` method's Lambda authorizer has to allow the request, or the request
+ * is refused and the integration is never invoked. Whether the API may invoke a
+ * function is a separate question, and the API's own rather than the client's.
+ *
+ * A web ACL in front of the stage comes ahead of all of it, as it does on real
+ * API Gateway. A request the web ACL blocks is answered before the method is
+ * matched, so neither the authorizer nor the integration sees it.
+ */
+export class SimApiGatewayServiceController {
+    router;
+    methodAuthorizer;
+    integration;
+    errorResponse = new SimApiGatewayErrorResponse();
+    refusalResponse = new SimRestApiRefusalResponse();
+    webAcl = new SimRestApiWebAclInspection();
+    constructor(properties = {}) {
+        const { simAws = new SimAws() } = properties;
+        this.router = properties.router ?? new SimApiGatewayRouter({ simAws });
+        // The clock is taken from the router rather than from properties, so a
+        // supplied router and the event timestamps belong to the same simulation.
+        this.methodAuthorizer = new SimRestApiMethodAuthorizer({
+            functions: this.router,
+            clock: this.router.simAws,
+        });
+        this.integration = new SimRestApiIntegrationInvocation({
+            router: this.router,
+            clock: this.router.simAws,
+        });
+    }
+    /**
+     * Handle an HTTP request routed to a simulated REST API.
+     */
+    async handleRequest(serviceRequest) {
+        const restApi = this.router.route(serviceRequest.target);
+        if (restApi === undefined) {
+            return this.errorResponse.forbidden();
+        }
+        if (restApi.disableExecuteApiEndpoint) {
+            // The API exists and has switched its generated endpoint off, which is
+            // how an API reachable only through a custom domain is configured.
+            return this.errorResponse.forbidden();
+        }
+        return await this.invoke(restApi, serviceRequest);
+    }
+    async invoke(restApi, serviceRequest) {
+        // The whole request path, stage segment and all. The stage takes its own
+        // segment off, and the event reports the path as the client sent it.
+        const restApiRequest = new SimRestApiRequest({
+            method: serviceRequest.request.method,
+            path: new URL(serviceRequest.request.url).pathname,
+        });
+        // The stage's web ACL sees the request before anything the API does with
+        // it, which is why this comes before matching rather than after it.
+        const inspected = await this.webAcl.inspect({
+            restApi,
+            stageName: restApiRequest.segments[0] ?? "",
+            request: serviceRequest.request,
+        });
+        if (inspected.blocked !== undefined) {
+            return inspected.blocked;
+        }
+        const { request } = inspected;
+        const match = restApi.match(restApiRequest);
+        if (!isSimRestApiMatch(match)) {
+            return this.missResponse(match);
+        }
+        // The client's own authorization comes next: a request with no
+        // credentials is refused whether or not the integration behind the method
+        // would work.
+        const authorization = await this.methodAuthorizer.authorize({
+            restApi,
+            match,
+            request,
+            caller: serviceRequest.caller,
+            iam: this.router.iamFor(restApi),
+        });
+        if (!authorization.admitted) {
+            return this.refusalResponse.build(authorization);
+        }
+        return await this.integration.invoke({
+            restApi,
+            match,
+            request,
+            authorization,
+        });
+    }
+    /**
+     * What a request that reached nothing is answered with.
+     *
+     * Real API Gateway tells the two apart. A stage the API does not serve is a
+     * plain `Forbidden`, while a request that found the stage and matched no
+     * method gets `Missing Authentication Token`, whether or not it carried
+     * credentials.
+     */
+    missResponse(miss) {
+        return miss === "stage"
+            ? this.errorResponse.forbidden()
+            : this.errorResponse.missingAuthenticationToken();
+    }
+}
+//# sourceMappingURL=sim-api-gateway-controller.js.map

package/dist/service/apigateway/serve/sim-api-gateway-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-controller.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,iBAAiB,GAElB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAOlF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,8BAA8B;IACxB,MAAM,CAAsB;IAC5B,gBAAgB,CAA6B;IAC7C,WAAW,CAAkC;IAC7C,aAAa,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACjD,eAAe,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAClD,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,YAAY,UAAU,GAA6C,EAAE;QACnE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,CAAC,gBAAgB,GAAG,IAAI,0BAA0B,CAAC;YACrD,SAAS,EAAE,IAAI,CAAC,MAAM;YACtB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,+BAA+B,CAAC;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACtC,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,OAAmB,EACnB,cAAoC;QAEpC,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,cAAc,GAAG,IAAI,iBAAiB,CAAC;YAC3C,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM;YACrC,IAAI,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;SACnD,CAAC,CAAC;QACH,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1C,OAAO;YACP,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE;YAC3C,OAAO,EAAE,cAAc,CAAC,OAAO;SAChC,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,+DAA+D;QAC/D,0EAA0E;QAC1E,cAAc;QACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAC1D,OAAO;YACP,KAAK;YACL,OAAO;YACP,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACnC,OAAO;YACP,KAAK;YACL,OAAO;YACP,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,YAAY,CAAC,IAAoB;QACvC,OAAO,IAAI,KAAK,OAAO;YACrB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAChC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,EAAE,CAAC;IACtD,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-api-gateway-error-response.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The error responses a REST API endpoint returns itself, before or instead of
+ * an integration producing one.
+ *
+ * Real API Gateway answers these with a small JSON document whose field is
+ * `message`. The wording is what the endpoint was observed to answer, since
+ * AWS publishes neither the status nor the body for most of them.
+ */
+export declare class SimApiGatewayErrorResponse {
+    /**
+     * Nothing at this API serves the request.
+     *
+     * `Missing Authentication Token` is the message real API Gateway is well
+     * known for, and it answers a path that matched no method just as much as
+     * one that needed credentials. A client reading it here reads what it would
+     * read on AWS, misleading wording and all.
+     */
+    missingAuthenticationToken(): Response;
+    /**
+     * No such API, or a stage the API does not serve.
+     */
+    forbidden(): Response;
+    /**
+     * The request carried nothing at the authorizer's identity source, or the
+     * authorizer answered `Unauthorized`.
+     */
+    unauthorized(): Response;
+    /**
+     * A Deny statement in the authorizer's policy matched the method.
+     *
+     * The body names the deny, and its member is `Message` where every other
+     * message here is `message`. Real API Gateway is inconsistent about the two
+     * and this follows it.
+     */
+    explicitDeny(): Response;
+    /**
+     * The authorizer's policy allowed nothing covering the method.
+     */
+    implicitDeny(): Response;
+    /**
+     * The method's authorizer could not answer at all.
+     */
+    internalServerError(): Response;
+    /**
+     * The integration could not be reached, or answered something that is not a
+     * response.
+     */
+    badGateway(): Response;
+    private jsonResponse;
+    private messageResponse;
+}
+//# sourceMappingURL=sim-api-gateway-error-response.d.ts.map

package/dist/service/apigateway/serve/sim-api-gateway-error-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-error-response.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC;;;;;;;OAOG;IACH,0BAA0B,IAAI,QAAQ,CAErC;IAED;;OAEG;IACH,SAAS,IAAI,QAAQ,CAEpB;IAED;;;OAGG;IACH,YAAY,IAAI,QAAQ,CAEvB;IAED;;;;;;OAMG;IACH,YAAY,IAAI,QAAQ,CAKvB;IAED;;OAEG;IACH,YAAY,IAAI,QAAQ,CAKvB;IAED;;OAEG;IACH,mBAAmB,IAAI,QAAQ,CAE9B;IAED;;;OAGG;IACH,UAAU,IAAI,QAAQ,CAErB;IAED,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,eAAe;CAMxB"}

package/dist/service/apigateway/serve/sim-api-gateway-error-response.js

@@ -0,0 +1,70 @@
+/**
+ * The error responses a REST API endpoint returns itself, before or instead of
+ * an integration producing one.
+ *
+ * Real API Gateway answers these with a small JSON document whose field is
+ * `message`. The wording is what the endpoint was observed to answer, since
+ * AWS publishes neither the status nor the body for most of them.
+ */
+export class SimApiGatewayErrorResponse {
+    /**
+     * Nothing at this API serves the request.
+     *
+     * `Missing Authentication Token` is the message real API Gateway is well
+     * known for, and it answers a path that matched no method just as much as
+     * one that needed credentials. A client reading it here reads what it would
+     * read on AWS, misleading wording and all.
+     */
+    missingAuthenticationToken() {
+        return this.jsonResponse(403, "Missing Authentication Token");
+    }
+    /**
+     * No such API, or a stage the API does not serve.
+     */
+    forbidden() {
+        return this.jsonResponse(403, "Forbidden");
+    }
+    /**
+     * The request carried nothing at the authorizer's identity source, or the
+     * authorizer answered `Unauthorized`.
+     */
+    unauthorized() {
+        return this.jsonResponse(401, "Unauthorized");
+    }
+    /**
+     * A Deny statement in the authorizer's policy matched the method.
+     *
+     * The body names the deny, and its member is `Message` where every other
+     * message here is `message`. Real API Gateway is inconsistent about the two
+     * and this follows it.
+     */
+    explicitDeny() {
+        return this.messageResponse(403, "User is not authorized to access this resource with an explicit deny");
+    }
+    /**
+     * The authorizer's policy allowed nothing covering the method.
+     */
+    implicitDeny() {
+        return this.messageResponse(403, "User is not authorized to access this resource");
+    }
+    /**
+     * The method's authorizer could not answer at all.
+     */
+    internalServerError() {
+        return this.jsonResponse(500, "Internal server error");
+    }
+    /**
+     * The integration could not be reached, or answered something that is not a
+     * response.
+     */
+    badGateway() {
+        return this.jsonResponse(502, "Internal server error");
+    }
+    jsonResponse(status, message) {
+        return Response.json({ message }, { status, headers: { "content-type": "application/json" } });
+    }
+    messageResponse(status, message) {
+        return Response.json({ Message: message }, { status, headers: { "content-type": "application/json" } });
+    }
+}
+//# sourceMappingURL=sim-api-gateway-error-response.js.map

package/dist/service/apigateway/serve/sim-api-gateway-error-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-error-response.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;;;;;;OAOG;IACH,0BAA0B;QACxB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,eAAe,CACzB,GAAG,EACH,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,eAAe,CACzB,GAAG,EACH,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,OAAe;QAClD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,EACX,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAC5D,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,MAAc,EAAE,OAAe;QACrD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAC5D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-api-gateway-router.d.ts

@@ -0,0 +1,56 @@
+import type { SimAwsServiceTarget } from "../../../serve/controller/sim-service-controller.js";
+import { SimAws } from "../../aws/sim-aws.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimRestApiLambdaUri } from "../api/method/sim-rest-api-lambda-uri.js";
+import type { SimRestApi } from "../api/sim-rest-api.js";
+import type { SimRestApiFunctionTarget } from "./sim-rest-api-function-target.js";
+interface SimApiGatewayRouterProperties {
+    readonly simAws?: SimAws;
+}
+/**
+ * Routes a served REST API request to the API behind it, and an integration to
+ * the function behind that.
+ *
+ * The request hostname gives the API id and the Region, and not the Account.
+ * The registry supplies that missing hop. The integrated function is a second
+ * hop again, because its ARN names its own Account and Region, which need not
+ * be the API's.
+ */
+export declare class SimApiGatewayRouter {
+    /**
+     * The simulation this router routes within.
+     *
+     * Exposed so collaborators needing the same simulation, such as the clock
+     * stamping invocation events, take it from here rather than being given a
+     * second SimAws that could be a different one.
+     */
+    readonly simAws: SimAws;
+    private readonly registry;
+    constructor(properties?: SimApiGatewayRouterProperties);
+    /**
+     * Find the REST API a request target addresses.
+     */
+    route(target: SimAwsServiceTarget): SimRestApi | undefined;
+    /**
+     * The IAM that decides an `AWS_IAM` method of one API.
+     *
+     * It is the IAM of the Account that owns the API, which is where the
+     * policies allowing a caller `execute-api:Invoke` on its methods live.
+     */
+    iamFor(restApi: SimRestApi): SimIamInterServiceAuthZ;
+    /**
+     * Find the function a URI names, and the IAM deciding whether API Gateway
+     * may invoke it.
+     *
+     * The function is looked up in the Account and Region its own ARN names,
+     * rather than the API's, because an integration URI is free to name either.
+     *
+     * A version or alias qualifier on the URI is resolved here, once per
+     * request, so a method built on an alias runs whichever version the alias
+     * points at now. A qualifier naming neither answers with nothing, the way a
+     * function that was never created does.
+     */
+    functionFor(lambdaUri: SimRestApiLambdaUri): SimRestApiFunctionTarget | undefined;
+}
+export {};
+//# sourceMappingURL=sim-api-gateway-router.d.ts.map

package/dist/service/apigateway/serve/sim-api-gateway-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAG/F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,UAAU,6BAA6B;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B;;;;;;OAMG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAE,6BAAkC,EAGzD;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAWzD;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,uBAAuB,CAInD;IAED;;;;;;;;;;;OAWG;IACH,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CAUtC;CACF"}

package/dist/service/apigateway/serve/sim-api-gateway-router.js

@@ -0,0 +1,68 @@
+import { SimAws } from "../../aws/sim-aws.js";
+/**
+ * Routes a served REST API request to the API behind it, and an integration to
+ * the function behind that.
+ *
+ * The request hostname gives the API id and the Region, and not the Account.
+ * The registry supplies that missing hop. The integrated function is a second
+ * hop again, because its ARN names its own Account and Region, which need not
+ * be the API's.
+ */
+export class SimApiGatewayRouter {
+    /**
+     * The simulation this router routes within.
+     *
+     * Exposed so collaborators needing the same simulation, such as the clock
+     * stamping invocation events, take it from here rather than being given a
+     * second SimAws that could be a different one.
+     */
+    simAws;
+    registry;
+    constructor(properties = {}) {
+        this.simAws = properties.simAws ?? new SimAws();
+        this.registry = this.simAws.serviceFactory.registries.restApi;
+    }
+    /**
+     * Find the REST API a request target addresses.
+     */
+    route(target) {
+        const accountId = this.registry.accountIdForApi(target.resourceName);
+        if (accountId === undefined) {
+            return undefined;
+        }
+        return this.simAws
+            .accountRegionScope(accountId, target.regionName)
+            .apiGateway()
+            .findRestApi(target.resourceName);
+    }
+    /**
+     * The IAM that decides an `AWS_IAM` method of one API.
+     *
+     * It is the IAM of the Account that owns the API, which is where the
+     * policies allowing a caller `execute-api:Invoke` on its methods live.
+     */
+    iamFor(restApi) {
+        const { accountId, regionName } = restApi.accountRegionScope;
+        return this.simAws.accountRegionScope(accountId, regionName).iam();
+    }
+    /**
+     * Find the function a URI names, and the IAM deciding whether API Gateway
+     * may invoke it.
+     *
+     * The function is looked up in the Account and Region its own ARN names,
+     * rather than the API's, because an integration URI is free to name either.
+     *
+     * A version or alias qualifier on the URI is resolved here, once per
+     * request, so a method built on an alias runs whichever version the alias
+     * points at now. A qualifier naming neither answers with nothing, the way a
+     * function that was never created does.
+     */
+    functionFor(lambdaUri) {
+        const scope = this.simAws.accountRegionScope(lambdaUri.accountId, lambdaUri.regionName);
+        const target = scope
+            .lambda()
+            .getSimFunctionTarget(lambdaUri.functionName, lambdaUri.qualifier);
+        return target === undefined ? undefined : { ...target, iam: scope.iam() };
+    }
+}
+//# sourceMappingURL=sim-api-gateway-router.js.map