@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/apigateway/serve/sim-api-gateway-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-router.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-router.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAW9C;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAkC,EAAE;QACxD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aAChD,UAAU,EAAE;aACZ,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAmB;QACxB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAE7D,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,WAAW,CACT,SAA8B;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC1C,SAAS,CAAC,SAA4B,EACtC,SAAS,CAAC,UAA2B,CACtC,CAAC;QACF,MAAM,MAAM,GAAG,KAAK;aACjB,MAAM,EAAE;aACR,oBAAoB,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAErE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC5E,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-rest-api-endpoint.d.ts

@@ -0,0 +1,12 @@
+import type { SimPayload1Endpoint } from "../../../serve/payload-1/sim-payload-1-endpoint.js";
+import type { SimRestApiMatch } from "../api/match/sim-rest-api-match.js";
+import type { SimRestApi } from "../api/sim-rest-api.js";
+/**
+ * Describe a matched request as the endpoint identity the event builder reads.
+ *
+ * The resource fields name the tree node the path matched rather than the path
+ * the client asked for, which is what lets a handler behind a `{proxy+}` tell
+ * which template caught its request.
+ */
+export declare function simRestApiEndpoint(restApi: SimRestApi, match: SimRestApiMatch): SimPayload1Endpoint;
+//# sourceMappingURL=sim-rest-api-endpoint.d.ts.map

package/dist/service/apigateway/serve/sim-rest-api-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-endpoint.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,GACrB,mBAAmB,CAYrB"}

package/dist/service/apigateway/serve/sim-rest-api-endpoint.js

@@ -0,0 +1,21 @@
+/**
+ * Describe a matched request as the endpoint identity the event builder reads.
+ *
+ * The resource fields name the tree node the path matched rather than the path
+ * the client asked for, which is what lets a handler behind a `{proxy+}` tell
+ * which template caught its request.
+ */
+export function simRestApiEndpoint(restApi, match) {
+    return {
+        apiId: restApi.apiId,
+        accountId: restApi.accountRegionScope.accountId,
+        domainName: restApi.hostname,
+        stage: match.stage.stageName,
+        resourceId: match.resource.resourceId,
+        resourcePath: match.resource.path,
+        httpMethod: match.method.httpMethod,
+        pathParameters: match.pathParameters,
+        stageVariables: match.stage.variables,
+    };
+}
+//# sourceMappingURL=sim-rest-api-endpoint.js.map

package/dist/service/apigateway/serve/sim-rest-api-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-endpoint.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-endpoint.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAmB,EACnB,KAAsB;IAEtB,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,SAAS;QAC/C,UAAU,EAAE,OAAO,CAAC,QAAQ;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACjC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;KACtC,CAAC;AACJ,CAAC"}

package/dist/service/apigateway/serve/sim-rest-api-function-target.d.ts

@@ -0,0 +1,17 @@
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimLambdaFunctionTarget } from "../../lambda/function/version/sim-lambda-function-target.js";
+/**
+ * A function a REST API invokes, and what decides whether it may.
+ *
+ * What the API invokes is what any service delivering to a function ARN
+ * invokes, so the resource named and the version that runs come from Lambda's
+ * own target. All this adds is the IAM the decision is made in.
+ */
+export interface SimRestApiFunctionTarget extends SimLambdaFunctionTarget {
+    /**
+     * IAM of the Account that owns the function, which is what the API's invoke
+     * permission is evaluated against. It need not be the API's Account.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+//# sourceMappingURL=sim-rest-api-function-target.d.ts.map

package/dist/service/apigateway/serve/sim-rest-api-function-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-function-target.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-function-target.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AAE3G;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,uBAAuB;IACvE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC"}

package/dist/service/apigateway/serve/sim-rest-api-function-target.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-rest-api-function-target.js.map

package/dist/service/apigateway/serve/sim-rest-api-function-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-function-target.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-function-target.ts"],"names":[],"mappings":""}

package/dist/service/apigateway/serve/sim-rest-api-integration-invocation.d.ts

@@ -0,0 +1,55 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimRestApiAdmitted } from "../api/authorizer/sim-rest-api-authorization.js";
+import type { SimRestApiMatch } from "../api/match/sim-rest-api-match.js";
+import type { SimRestApi } from "../api/sim-rest-api.js";
+import type { SimApiGatewayRouter } from "./sim-api-gateway-router.js";
+interface SimRestApiIntegrationInvocationProperties {
+    readonly router: SimApiGatewayRouter;
+    /** Clock the invocation event is stamped with. */
+    readonly clock: SimClock;
+}
+interface SimRestApiIntegrationInvocationInput {
+    readonly restApi: SimRestApi;
+    readonly match: SimRestApiMatch;
+    readonly request: Request;
+    /** What the method's authorization knows about the caller. */
+    readonly authorization: SimRestApiAdmitted;
+}
+/**
+ * Invokes the Lambda function behind the matched method's integration, and
+ * turns what it returns into the HTTP response.
+ *
+ * Whether the API may invoke the function is asked here, and is the API's own
+ * question rather than the client's. The client's was already answered by the
+ * method's authorization.
+ *
+ * A method with no integration, one naming a function that is not there, one
+ * the API may not invoke, and one whose handler threw are all the same 502 on
+ * real API Gateway, with `Internal server error` in the body and the reason
+ * only in the API's own logs.
+ */
+export declare class SimRestApiIntegrationInvocation {
+    private readonly router;
+    private readonly eventBuilder;
+    private readonly responseBuilder;
+    private readonly errorResponse;
+    constructor(properties: SimRestApiIntegrationInvocationProperties);
+    /**
+     * Invoke the integration behind one matched request.
+     */
+    invoke(input: SimRestApiIntegrationInvocationInput): Promise<Response>;
+    /**
+     * The function this request's method invokes, where there is one the API is
+     * allowed to invoke.
+     */
+    private integrationTarget;
+    /**
+     * Whether the API lacks permission to invoke the integrated function.
+     *
+     * The method the request matched is supplied as the source ARN, so a
+     * permission granted for one method does not open another.
+     */
+    private mayNotInvoke;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-integration-invocation.d.ts.map

package/dist/service/apigateway/serve/sim-rest-api-integration-invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-integration-invocation.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-integration-invocation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAEjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAIvE,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAElE,YAAY,UAAU,EAAE,yCAAyC,EAKhE;IAED;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,oCAAoC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6B3E;IAED;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAgBzB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;CAiBrB"}

package/dist/service/apigateway/serve/sim-rest-api-integration-invocation.js

@@ -0,0 +1,89 @@
+import { SimPayload1EventBuilder } from "../../../serve/payload-1/sim-payload-1-event-builder.js";
+import { SimPayload1ResponseBuilder } from "../../../serve/payload-1/sim-payload-1-response-builder.js";
+import { SimLambdaServiceInvokeAuthorizer } from "../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
+import { SimRestApiExecuteApiArn } from "../api/sim-rest-api-execute-api-arn.js";
+import { simApiGatewayServicePrincipal } from "../sim-api-gateway-service-principal.js";
+import { SimApiGatewayErrorResponse } from "./sim-api-gateway-error-response.js";
+import { simRestApiEndpoint } from "./sim-rest-api-endpoint.js";
+/**
+ * Invokes the Lambda function behind the matched method's integration, and
+ * turns what it returns into the HTTP response.
+ *
+ * Whether the API may invoke the function is asked here, and is the API's own
+ * question rather than the client's. The client's was already answered by the
+ * method's authorization.
+ *
+ * A method with no integration, one naming a function that is not there, one
+ * the API may not invoke, and one whose handler threw are all the same 502 on
+ * real API Gateway, with `Internal server error` in the body and the reason
+ * only in the API's own logs.
+ */
+export class SimRestApiIntegrationInvocation {
+    router;
+    eventBuilder;
+    responseBuilder = new SimPayload1ResponseBuilder();
+    errorResponse = new SimApiGatewayErrorResponse();
+    constructor(properties) {
+        this.router = properties.router;
+        this.eventBuilder = new SimPayload1EventBuilder({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Invoke the integration behind one matched request.
+     */
+    async invoke(input) {
+        const target = this.integrationTarget(input);
+        if (target === undefined) {
+            return this.errorResponse.badGateway();
+        }
+        try {
+            const event = await this.eventBuilder.build(input.request, simRestApiEndpoint(input.restApi, input.match), {
+                lambda: input.authorization.lambda,
+                caller: input.authorization.caller,
+                cognito: input.authorization.cognito,
+            });
+            const result = await target.simFunction.invoke(event);
+            return this.responseBuilder.isStructuredResult(result)
+                ? this.responseBuilder.build(result)
+                : this.errorResponse.badGateway();
+        }
+        catch {
+            // Real API Gateway reports an unhandled integration error as a 502, with
+            // the error itself only visible in the function's logs. Reading the
+            // request body can fail the same way, so building the event is inside
+            // this too.
+            return this.errorResponse.badGateway();
+        }
+    }
+    /**
+     * The function this request's method invokes, where there is one the API is
+     * allowed to invoke.
+     */
+    integrationTarget(input) {
+        const { integration } = input.match.method;
+        if (integration === undefined) {
+            return undefined;
+        }
+        const target = this.router.functionFor(integration.lambdaUri);
+        return target === undefined || this.mayNotInvoke(input, target)
+            ? undefined
+            : target;
+    }
+    /**
+     * Whether the API lacks permission to invoke the integrated function.
+     *
+     * The method the request matched is supplied as the source ARN, so a
+     * permission granted for one method does not open another.
+     */
+    mayNotInvoke(input, target) {
+        const { restApi, match, request } = input;
+        return new SimLambdaServiceInvokeAuthorizer({ iam: target.iam }).authorize({
+            resource: target.resource,
+            servicePrincipal: simApiGatewayServicePrincipal,
+            sourceArn: SimRestApiExecuteApiArn.forMatch(restApi, match, request.method).toString(),
+            sourceAccount: restApi.accountRegionScope.accountId,
+        }).isDenied;
+    }
+}
+//# sourceMappingURL=sim-rest-api-integration-invocation.js.map

package/dist/service/apigateway/serve/sim-rest-api-integration-invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-integration-invocation.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-integration-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAExG,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAG1H,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAiBhE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAAsB;IAC5B,YAAY,CAA0B;IACtC,eAAe,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACnD,aAAa,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAElE,YAAY,UAAqD;QAC/D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAA2C;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CACzC,KAAK,CAAC,OAAO,EACb,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAC9C;gBACE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;gBAClC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;gBAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO;aACrC,CACF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEtD,OAAO,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBACpD,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,sEAAsE;YACtE,YAAY;YACZ,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,iBAAiB,CACvB,KAA2C;QAE3C,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAE3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAE9D,OAAO,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAC7D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAClB,KAA2C,EAC3C,MAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAE1C,OAAO,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;YACzE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,6BAA6B;YAC/C,SAAS,EAAE,uBAAuB,CAAC,QAAQ,CACzC,OAAO,EACP,KAAK,EACL,OAAO,CAAC,MAAM,CACf,CAAC,QAAQ,EAAE;YACZ,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC,SAAS;SACpD,CAAC,CAAC,QAAQ,CAAC;IACd,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-rest-api-refusal-response.d.ts

@@ -0,0 +1,18 @@
+import type { SimRestApiRefused } from "../api/authorizer/sim-rest-api-authorization.js";
+/**
+ * The response a request the method's authorization refused gets back.
+ *
+ * Real API Gateway answers a deny with two different bodies, one for a Deny
+ * statement that matched and one for a policy allowing nothing relevant, so
+ * both are here. An authorizer that could not answer is the API's problem
+ * rather than the caller's, and gets the same 500 it does on AWS. A request
+ * carrying no token is the one 401.
+ */
+export declare class SimRestApiRefusalResponse {
+    private readonly errorResponse;
+    /**
+     * Build the response for one refusal.
+     */
+    build(refused: SimRestApiRefused): Response;
+}
+//# sourceMappingURL=sim-rest-api-refusal-response.d.ts.map

package/dist/service/apigateway/serve/sim-rest-api-refusal-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-refusal-response.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-refusal-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGzF;;;;;;;;GAQG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAElE;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,CAe1C;CACF"}

package/dist/service/apigateway/serve/sim-rest-api-refusal-response.js

@@ -0,0 +1,33 @@
+import { SimApiGatewayErrorResponse } from "./sim-api-gateway-error-response.js";
+/**
+ * The response a request the method's authorization refused gets back.
+ *
+ * Real API Gateway answers a deny with two different bodies, one for a Deny
+ * statement that matched and one for a policy allowing nothing relevant, so
+ * both are here. An authorizer that could not answer is the API's problem
+ * rather than the caller's, and gets the same 500 it does on AWS. A request
+ * carrying no token is the one 401.
+ */
+export class SimRestApiRefusalResponse {
+    errorResponse = new SimApiGatewayErrorResponse();
+    /**
+     * Build the response for one refusal.
+     */
+    build(refused) {
+        switch (refused.kind) {
+            case "unauthorized": {
+                return this.errorResponse.unauthorized();
+            }
+            case "explicit-deny": {
+                return this.errorResponse.explicitDeny();
+            }
+            case "implicit-deny": {
+                return this.errorResponse.implicitDeny();
+            }
+            case "error": {
+                return this.errorResponse.internalServerError();
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-rest-api-refusal-response.js.map

package/dist/service/apigateway/serve/sim-rest-api-refusal-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-refusal-response.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-refusal-response.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAAyB;IACnB,aAAa,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAElE;;OAEG;IACH,KAAK,CAAC,OAA0B;QAC9B,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,cAAc,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;YAC3C,CAAC;YACD,KAAK,eAAe,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;YAC3C,CAAC;YACD,KAAK,eAAe,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;YAC3C,CAAC;YACD,KAAK,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.d.ts

@@ -0,0 +1,25 @@
+import { type SimWafInspected } from "../../wafv2/association/sim-waf-request-inspection.js";
+import type { SimRestApi } from "../api/sim-rest-api.js";
+interface SimRestApiInspectionInput {
+    readonly restApi: SimRestApi;
+    /** The first path segment of the request, which names the stage. */
+    readonly stageName: string;
+    readonly request: Request;
+}
+/**
+ * Puts a request to the web ACL in front of the stage it reached.
+ *
+ * This runs before the method is matched and before any authorizer, which is
+ * the order real API Gateway evaluates in: the web ACL comes ahead of resource
+ * policies, IAM, a Lambda authorizer and a Cognito authorizer alike. A blocked
+ * request therefore reaches neither the authorizer nor the integration.
+ */
+export declare class SimRestApiWebAclInspection {
+    private readonly inspection;
+    /**
+     * Put one request to whatever protects the stage it addressed.
+     */
+    inspect(input: SimRestApiInspectionInput): Promise<SimWafInspected>;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-web-acl-inspection.d.ts.map

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-web-acl-inspection.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-web-acl-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EAErB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,UAAU,yBAAyB;IACjC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAE5D;;OAEG;IACG,OAAO,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,eAAe,CAAC,CAWxE;CACF"}

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.js

@@ -0,0 +1,27 @@
+import { SimWafRequestInspection, } from "../../wafv2/association/sim-waf-request-inspection.js";
+/**
+ * Puts a request to the web ACL in front of the stage it reached.
+ *
+ * This runs before the method is matched and before any authorizer, which is
+ * the order real API Gateway evaluates in: the web ACL comes ahead of resource
+ * policies, IAM, a Lambda authorizer and a Cognito authorizer alike. A blocked
+ * request therefore reaches neither the authorizer nor the integration.
+ */
+export class SimRestApiWebAclInspection {
+    inspection = new SimWafRequestInspection();
+    /**
+     * Put one request to whatever protects the stage it addressed.
+     */
+    async inspect(input) {
+        const { request, restApi } = input;
+        // API Gateway forwards the request body to AWS WAF, so a rule inspecting
+        // the body of a request to a stage sees it.
+        return await this.inspection.inspect({
+            protection: restApi.webAcls,
+            resourceArn: restApi.stageArn(input.stageName),
+            request,
+            forwardBody: true,
+        });
+    }
+}
+//# sourceMappingURL=sim-rest-api-web-acl-inspection.js.map

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-web-acl-inspection.js","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-rest-api-web-acl-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,uDAAuD,CAAC;AAU/D;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,UAAU,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE5D;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,KAAgC;QAC5C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAEnC,yEAAyE;QACzE,4CAA4C;QAC5C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACnC,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,OAAO;YACP,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigateway/sim-api-gateway-commands.d.ts

@@ -0,0 +1,59 @@
+import { type BackgroundScheduler } from "../../util/background/background.js";
+import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { type SimRestApiUserPools } from "./api/authorizer/sim-rest-api-user-pools.js";
+import { type SimWafProtection } from "../wafv2/association/sim-waf-protection.js";
+import { SimRestApiStore } from "./api/sim-rest-api-store.js";
+import { SimRestApiCommands } from "./command/api/sim-rest-api-commands.js";
+import { SimRestApiImportCommands } from "./command/api/sim-rest-api-import-commands.js";
+import { SimRestApiAuthorizerCommands } from "./command/authorizer/sim-rest-api-authorizer-commands.js";
+import { SimRestApiDeploymentCommands } from "./command/deployment/sim-rest-api-deployment-commands.js";
+import { SimRestApiIntegrationCommands } from "./command/integration/sim-rest-api-integration-commands.js";
+import { SimRestApiMethodCommands } from "./command/method/sim-rest-api-method-commands.js";
+import { SimRestApiResourceCommands } from "./command/resource/sim-rest-api-resource-commands.js";
+import { SimRestApiStageCommands } from "./command/stage/sim-rest-api-stage-commands.js";
+import { SimRestApiRegistry } from "./registry/sim-rest-api-registry.js";
+/**
+ * How one simulated API Gateway REST API service is put together.
+ */
+export interface SimApiGatewayProperties {
+    readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+    readonly registry?: SimRestApiRegistry;
+    /**
+     * The user pools this API Gateway's Cognito authorizers verify tokens
+     * against. A standalone simulated API Gateway has none, so a
+     * `COGNITO_USER_POOLS` method refuses every request rather than admitting
+     * one it could not check.
+     */
+    readonly userPools?: SimRestApiUserPools;
+    /**
+     * The web ACLs this API Gateway's stages can be protected by. A standalone
+     * simulated API Gateway has none, so every stage serves the requests it
+     * always did.
+     */
+    readonly webAcls?: SimWafProtection;
+}
+/**
+ * The command areas of one simulated API Gateway, and the state they share.
+ *
+ * Every command authorizes against the same IAM and reaches its API through
+ * the same store, so the wiring lives here rather than being repeated once per
+ * command in the service facade. That leaves SimApiGateway as state plus
+ * delegation.
+ */
+export declare class SimApiGatewayCommands {
+    readonly apis: SimRestApiStore;
+    readonly api: SimRestApiCommands;
+    readonly imports: SimRestApiImportCommands;
+    readonly resources: SimRestApiResourceCommands;
+    readonly authorizers: SimRestApiAuthorizerCommands;
+    readonly methods: SimRestApiMethodCommands;
+    readonly integrations: SimRestApiIntegrationCommands;
+    readonly deployments: SimRestApiDeploymentCommands;
+    readonly stages: SimRestApiStageCommands;
+    readonly background: BackgroundScheduler;
+    constructor(properties?: SimApiGatewayProperties);
+}
+//# sourceMappingURL=sim-api-gateway-commands.d.ts.map

package/dist/service/apigateway/sim-api-gateway-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-commands.d.ts","sourceRoot":"","sources":["../../../src/service/apigateway/sim-api-gateway-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAElG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,IAAI,kBAAyB;IAC7C,SAAgB,GAAG,EAAE,kBAAkB,CAAC;IACxC,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAClD,SAAgB,SAAS,EAAE,0BAA0B,CAAC;IACtD,SAAgB,WAAW,EAAE,4BAA4B,CAAC;IAC1D,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAClD,SAAgB,YAAY,EAAE,6BAA6B,CAAC;IAC5D,SAAgB,WAAW,EAAE,4BAA4B,CAAC;IAC1D,SAAgB,MAAM,EAAE,uBAAuB,CAAC;IAChD,SAAgB,UAAU,EAAE,mBAAmB,CAAC;IAEhD,YAAY,UAAU,GAAE,uBAA4B,EA4CnD;CACF"}

package/dist/service/apigateway/sim-api-gateway-commands.js

@@ -0,0 +1,74 @@
+import { BackgroundTasks, } from "../../util/background/background.js";
+import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimRestApiNoUserPools, } from "./api/authorizer/sim-rest-api-user-pools.js";
+import { SimWafNoProtection, } from "../wafv2/association/sim-waf-protection.js";
+import { SimRestApiStore } from "./api/sim-rest-api-store.js";
+import { SimRestApiCommands } from "./command/api/sim-rest-api-commands.js";
+import { SimRestApiImportCommands } from "./command/api/sim-rest-api-import-commands.js";
+import { SimApiGatewayAuthorizer } from "./command/authorize/sim-api-gateway-authorizer.js";
+import { SimRestApiAuthorizerCommands } from "./command/authorizer/sim-rest-api-authorizer-commands.js";
+import { SimRestApiDeploymentCommands } from "./command/deployment/sim-rest-api-deployment-commands.js";
+import { SimRestApiIntegrationCommands } from "./command/integration/sim-rest-api-integration-commands.js";
+import { SimRestApiMethodCommands } from "./command/method/sim-rest-api-method-commands.js";
+import { SimRestApiResourceCommands } from "./command/resource/sim-rest-api-resource-commands.js";
+import { SimRestApiAccess } from "./command/sim-rest-api-access.js";
+import { SimRestApiStageCommands } from "./command/stage/sim-rest-api-stage-commands.js";
+import { SimRestApiRegistry } from "./registry/sim-rest-api-registry.js";
+/**
+ * The command areas of one simulated API Gateway, and the state they share.
+ *
+ * Every command authorizes against the same IAM and reaches its API through
+ * the same store, so the wiring lives here rather than being repeated once per
+ * command in the service facade. That leaves SimApiGateway as state plus
+ * delegation.
+ */
+export class SimApiGatewayCommands {
+    apis = new SimRestApiStore();
+    api;
+    imports;
+    resources;
+    authorizers;
+    methods;
+    integrations;
+    deployments;
+    stages;
+    background;
+    constructor(properties = {}) {
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), registry = new SimRestApiRegistry(), userPools = new SimRestApiNoUserPools(), webAcls = new SimWafNoProtection(), } = properties;
+        const access = new SimRestApiAccess({
+            apis: this.apis,
+            authorizer: new SimApiGatewayAuthorizer({ iam, accountRegionScope }),
+        });
+        this.background = background;
+        this.api = new SimRestApiCommands({
+            apis: this.apis,
+            registry,
+            access,
+            accountRegionScope,
+            clock: background,
+            userPools,
+            webAcls,
+        });
+        this.resources = new SimRestApiResourceCommands({ access });
+        this.authorizers = new SimRestApiAuthorizerCommands({ access });
+        this.methods = new SimRestApiMethodCommands({ access });
+        this.integrations = new SimRestApiIntegrationCommands({ access });
+        this.deployments = new SimRestApiDeploymentCommands({
+            access,
+            clock: background,
+        });
+        this.stages = new SimRestApiStageCommands({ access, clock: background });
+        this.imports = new SimRestApiImportCommands({
+            apis: this.apis,
+            registry,
+            access,
+            apiCommands: this.api,
+            resourceCommands: this.resources,
+            methodCommands: this.methods,
+            integrationCommands: this.integrations,
+            authorizerCommands: this.authorizers,
+        });
+    }
+}
+//# sourceMappingURL=sim-api-gateway-commands.js.map

package/dist/service/apigateway/sim-api-gateway-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-commands.js","sourceRoot":"","sources":["../../../src/service/apigateway/sim-api-gateway-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,qBAAqB,GAEtB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,kBAAkB,GAEnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAyBzE;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChB,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7B,GAAG,CAAqB;IACxB,OAAO,CAA2B;IAClC,SAAS,CAA6B;IACtC,WAAW,CAA+B;IAC1C,OAAO,CAA2B;IAClC,YAAY,CAAgC;IAC5C,WAAW,CAA+B;IAC1C,MAAM,CAA0B;IAChC,UAAU,CAAsB;IAEhD,YAAY,UAAU,GAA4B,EAAE;QAClD,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,QAAQ,GAAG,IAAI,kBAAkB,EAAE,EACnC,SAAS,GAAG,IAAI,qBAAqB,EAAE,EACvC,OAAO,GAAG,IAAI,kBAAkB,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,uBAAuB,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;SACrE,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ;YACR,MAAM;YACN,kBAAkB;YAClB,KAAK,EAAE,UAAU;YACjB,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,WAAW,GAAG,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,IAAI,4BAA4B,CAAC;YAClD,MAAM;YACN,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAwB,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ;YACR,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,gBAAgB,EAAE,IAAI,CAAC,SAAS;YAChC,cAAc,EAAE,IAAI,CAAC,OAAO;YAC5B,mBAAmB,EAAE,IAAI,CAAC,YAAY;YACtC,kBAAkB,EAAE,IAAI,CAAC,WAAW;SACrC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigateway/sim-api-gateway-service-principal.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The service principal API Gateway invokes a Lambda function as.
+ *
+ * An `AWS::Lambda::Permission` for a proxy integration grants this principal,
+ * so it lives at the service root rather than inside the serving layer that
+ * evaluates the grant. That keeps the API model, which writes the permission
+ * in test setup, from reaching into the layer that reads it.
+ *
+ * REST APIs and HTTP APIs are separate services and separate SDK clients, and
+ * they invoke a function as the same principal. A permission granted to it
+ * therefore says nothing about which of the two is calling, which is what the
+ * source ARN says.
+ */
+export declare const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+//# sourceMappingURL=sim-api-gateway-service-principal.d.ts.map

package/dist/service/apigateway/sim-api-gateway-service-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-service-principal.d.ts","sourceRoot":"","sources":["../../../src/service/apigateway/sim-api-gateway-service-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC"}

package/dist/service/apigateway/sim-api-gateway-service-principal.js

@@ -0,0 +1,15 @@
+/**
+ * The service principal API Gateway invokes a Lambda function as.
+ *
+ * An `AWS::Lambda::Permission` for a proxy integration grants this principal,
+ * so it lives at the service root rather than inside the serving layer that
+ * evaluates the grant. That keeps the API model, which writes the permission
+ * in test setup, from reaching into the layer that reads it.
+ *
+ * REST APIs and HTTP APIs are separate services and separate SDK clients, and
+ * they invoke a function as the same principal. A permission granted to it
+ * therefore says nothing about which of the two is calling, which is what the
+ * source ARN says.
+ */
+export const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+//# sourceMappingURL=sim-api-gateway-service-principal.js.map

package/dist/service/apigateway/sim-api-gateway-service-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-service-principal.js","sourceRoot":"","sources":["../../../src/service/apigateway/sim-api-gateway-service-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC"}