@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/s3/serve/api/sim-s3-api-listing.d.ts

@@ -9,10 +9,15 @@ interface ObjectSummary {
     readonly LastModified?: Date | undefined;
     readonly StorageClass?: string | undefined;
 }
+interface CommonPrefix {
+    readonly Prefix?: string | undefined;
+}
 interface ListObjectsOutput {
     readonly Contents?: readonly ObjectSummary[] | undefined;
+    readonly CommonPrefixes?: readonly CommonPrefix[] | undefined;
     readonly Name?: string | undefined;
     readonly Prefix?: string | undefined;
+    readonly Delimiter?: string | undefined;
     readonly MaxKeys?: number | undefined;
     readonly IsTruncated?: boolean | undefined;
     readonly KeyCount?: number | undefined;

package/dist/service/s3/serve/api/sim-s3-api-listing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-api-listing.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/serve/api/sim-s3-api-listing.ts"],"names":[],"mappings":"AAMA,UAAU,aAAa;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAC1C;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAiBrE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,CAAC,GAAG,CAAC,GACb,MAAM,CAYR"}
+{"version":3,"file":"sim-s3-api-listing.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/serve/api/sim-s3-api-listing.ts"],"names":[],"mappings":"AAMA,UAAU,aAAa;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAC1C;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAiBrE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,CAAC,GAAG,CAAC,GACb,MAAM,CAmBR"}

package/dist/service/s3/serve/api/sim-s3-api-listing.js

@@ -20,12 +20,17 @@ export function simS3ListBucketsXml(output) {
  */
 export function simS3ListObjectsXml(output, version) {
     const contents = (output.Contents ?? []).map(objectSummaryXml).join("");
+    const commonPrefixes = (output.CommonPrefixes ?? [])
+        .map((commonPrefix) => xmlElement("CommonPrefixes", xmlValue("Prefix", commonPrefix.Prefix)))
+        .join("");
     return xmlDocument("ListBucketResult", xmlValue("Name", output.Name) +
         xmlValue("Prefix", output.Prefix) +
+        xmlValue("Delimiter", output.Delimiter) +
         xmlValue("MaxKeys", output.MaxKeys) +
         xmlValue("IsTruncated", output.IsTruncated ?? false) +
         pagingXml(output, version) +
-        contents);
+        contents +
+        commonPrefixes);
 }
 /**
  * The elements that say where a page started and where the next one does.

package/dist/service/s3/serve/api/sim-s3-api-listing.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-s3-api-listing.js","sourceRoot":"","sources":["../../../../../src/service/s3/serve/api/sim-s3-api-listing.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,GACT,MAAM,oCAAoC,CAAC;AAmC5C;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SACnC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACd,UAAU,CACR,QAAQ,EACR,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;QAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAChD,CACF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,WAAW,CAChB,wBAAwB,EACxB,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,OAAc;IAEd,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAExE,OAAO,WAAW,CAChB,kBAAkB,EAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;QACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC;QACpD,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1B,QAAQ,CACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,MAAyB,EAAE,OAAc;IAC1D,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,CACL,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB,CAAC;YACvD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC,qBAAqB,CAAC;YAC/D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED,OAAO,CACL,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,OAAO,UAAU,CACf,UAAU,EACV,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;QAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC;QAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;QAC9B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,CAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-s3-api-listing.js","sourceRoot":"","sources":["../../../../../src/service/s3/serve/api/sim-s3-api-listing.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,EACV,QAAQ,GACT,MAAM,oCAAoC,CAAC;AAyC5C;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SACnC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACd,UAAU,CACR,QAAQ,EACR,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;QAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAChD,CACF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,WAAW,CAChB,wBAAwB,EACxB,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,OAAc;IAEd,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;SACjD,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CACpB,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CACtE;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,WAAW,CAChB,kBAAkB,EAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;QACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;QACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC;QACpD,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1B,QAAQ;QACR,cAAc,CACjB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,MAAyB,EAAE,OAAc;IAC1D,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,CACL,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB,CAAC;YACvD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC,qBAAqB,CAAC;YAC/D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED,OAAO,CACL,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,OAAO,UAAU,CACf,UAAU,EACV,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;QAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC;QAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;QAC9B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,CAC/D,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimWafProtectedResource } from "./sim-waf-protected-resource.js";
+import type { SimWafProtectedResources } from "./sim-waf-protected-resources.js";
+interface SimAwsWafProtectedResourcesProperties {
+    readonly simAws: SimAws;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The resources of one simulated AWS instance a web ACL can be put in front
+ * of.
+ *
+ * The lookup is made in the Account and Region the WAFv2 handling the request
+ * belongs to. A stage ARN names no Account, and AWS WAF associates within one
+ * Account, so a stage created elsewhere in the simulation is not there to be
+ * found. A user pool ARN does name an Account, and one naming another Account
+ * was already refused before the lookup.
+ */
+export declare class SimAwsWafProtectedResources implements SimWafProtectedResources {
+    #private;
+    constructor(properties: SimAwsWafProtectedResourcesProperties);
+    /**
+     * Whether the resource an ARN names is one this scope holds.
+     */
+    has(resource: SimWafProtectedResource): boolean;
+    /**
+     * Whether this scope holds the REST API stage an ARN names.
+     */
+    private hasRestApiStage;
+    /**
+     * Whether this scope holds the user pool an ARN names.
+     *
+     * The ARN is compared rather than the id alone. A pool id is unique across
+     * the whole simulation, so a pool this scope does not hold is simply not
+     * found, and comparing the ARN says the same thing about a pool id that is
+     * there under a different Account.
+     */
+    private hasUserPool;
+    /**
+     * The simulated services of the Account and Region this WAFv2 belongs to.
+     */
+    private scope;
+}
+export {};
+//# sourceMappingURL=sim-aws-waf-protected-resources.d.ts.map

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-waf-protected-resources.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-aws-waf-protected-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,wBAAwB,EACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAIjF,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,YAAW,wBAAwB;;IAI1E,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAM9C;IAED;;OAEG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,KAAK;CAKd"}

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js

@@ -0,0 +1,56 @@
+/**
+ * The resources of one simulated AWS instance a web ACL can be put in front
+ * of.
+ *
+ * The lookup is made in the Account and Region the WAFv2 handling the request
+ * belongs to. A stage ARN names no Account, and AWS WAF associates within one
+ * Account, so a stage created elsewhere in the simulation is not there to be
+ * found. A user pool ARN does name an Account, and one naming another Account
+ * was already refused before the lookup.
+ */
+export class SimAwsWafProtectedResources {
+    #simAws;
+    #accountRegionScope;
+    constructor(properties) {
+        this.#simAws = properties.simAws;
+        this.#accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Whether the resource an ARN names is one this scope holds.
+     */
+    has(resource) {
+        if (resource.resourceType === "COGNITO_USER_POOL") {
+            return this.hasUserPool(resource);
+        }
+        return this.hasRestApiStage(resource);
+    }
+    /**
+     * Whether this scope holds the REST API stage an ARN names.
+     */
+    hasRestApiStage(resource) {
+        const restApi = this.scope().apiGateway().findRestApi(resource.restApiId);
+        return restApi?.stages.find(resource.stageName) !== undefined;
+    }
+    /**
+     * Whether this scope holds the user pool an ARN names.
+     *
+     * The ARN is compared rather than the id alone. A pool id is unique across
+     * the whole simulation, so a pool this scope does not hold is simply not
+     * found, and comparing the ARN says the same thing about a pool id that is
+     * there under a different Account.
+     */
+    hasUserPool(resource) {
+        const pool = this.scope()
+            .cognitoIdentityProvider()
+            .findUserPool(resource.userPoolId);
+        return pool?.arn.value === resource.arn;
+    }
+    /**
+     * The simulated services of the Account and Region this WAFv2 belongs to.
+     */
+    scope() {
+        const { accountId, regionName } = this.#accountRegionScope;
+        return this.#simAws.accountRegionScope(accountId, regionName);
+    }
+}
+//# sourceMappingURL=sim-aws-waf-protected-resources.js.map

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-waf-protected-resources.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-aws-waf-protected-resources.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA2B;IAC7B,OAAO,CAAS;IAChB,mBAAmB,CAA2B;IAEvD,YAAY,UAAiD;QAC3D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAiC;QACnC,IAAI,QAAQ,CAAC,YAAY,KAAK,mBAAmB,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,QAA4B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE1E,OAAO,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,QAAwB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE;aACtB,uBAAuB,EAAE;aACzB,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAErC,OAAO,IAAI,EAAE,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,GAAG,CAAC;IAC1C,CAAC;IAED;;OAEG;IACK,KAAK;QACX,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAE3D,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-associations.d.ts

@@ -0,0 +1,52 @@
+import type { SimWafDecision } from "../evaluate/sim-waf-decision.js";
+import type { SimWafWebAcl } from "../web-acl/sim-waf-web-acl.js";
+import type { SimWafProtectedResource, SimWafProtectedResourceType } from "./sim-waf-protected-resource.js";
+import type { SimWafProtectedRequest, SimWafProtection } from "./sim-waf-protection.js";
+/**
+ * The web ACLs one Account and Region has in front of things.
+ *
+ * A resource carries at most one web ACL, which is why this is keyed by
+ * resource ARN. The web ACL itself is held rather than its ARN, so a request
+ * reaching a protected resource is evaluated without a second lookup, and so a
+ * web ACL cannot be deleted out from under a resource still pointing at it.
+ */
+export declare class SimWafAssociations implements SimWafProtection {
+    #private;
+    /**
+     * Put a web ACL in front of one resource, replacing whatever was there.
+     *
+     * AssociateWebACL overwrites rather than refusing, because a resource has
+     * one web ACL and pointing it at another is how it is changed.
+     */
+    associate(resource: SimWafProtectedResource, webAcl: SimWafWebAcl): void;
+    /**
+     * The web ACL in front of one resource, or nothing when it has none.
+     */
+    webAclFor(resourceArn: string): SimWafWebAcl | undefined;
+    /**
+     * The resources one web ACL is in front of, in the order they were
+     * associated.
+     *
+     * A resource type narrows the answer to the resources of that type, as
+     * `ListResourcesForWebACL` does. Naming none answers with all of them, which
+     * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
+     */
+    resourceArnsFor(webAcl: SimWafWebAcl, resourceType?: SimWafProtectedResourceType): readonly string[];
+    /**
+     * Whether a web ACL is in front of one resource.
+     */
+    protects(resourceArn: string): boolean;
+    /**
+     * What the web ACL in front of one resource decides about a request.
+     */
+    decide(request: SimWafProtectedRequest): SimWafDecision | undefined;
+    /**
+     * Forget whatever is in front of one resource.
+     *
+     * This is both what DisassociateWebACL does and what deleting the resource
+     * does. A stage that is deleted and created again under the same name is
+     * unprotected, as it is on AWS.
+     */
+    release(resourceArn: string): void;
+}
+//# sourceMappingURL=sim-waf-associations.d.ts.map

package/dist/service/wafv2/association/sim-waf-associations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-associations.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-associations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAcjC;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,gBAAgB;;IAGzD;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAKvE;IAED;;OAEG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEvD;IAED;;;;;;;OAOG;IACH,eAAe,CACb,MAAM,EAAE,YAAY,EACpB,YAAY,CAAC,EAAE,2BAA2B,GACzC,SAAS,MAAM,EAAE,CAWnB;IAED;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAErC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,GAAG,SAAS,CAUlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAEjC;CACF"}

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -0,0 +1,74 @@
+import { simWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+/**
+ * The web ACLs one Account and Region has in front of things.
+ *
+ * A resource carries at most one web ACL, which is why this is keyed by
+ * resource ARN. The web ACL itself is held rather than its ARN, so a request
+ * reaching a protected resource is evaluated without a second lookup, and so a
+ * web ACL cannot be deleted out from under a resource still pointing at it.
+ */
+export class SimWafAssociations {
+    #associations = new Map();
+    /**
+     * Put a web ACL in front of one resource, replacing whatever was there.
+     *
+     * AssociateWebACL overwrites rather than refusing, because a resource has
+     * one web ACL and pointing it at another is how it is changed.
+     */
+    associate(resource, webAcl) {
+        this.#associations.set(resource.arn, {
+            webAcl,
+            resourceType: resource.resourceType,
+        });
+    }
+    /**
+     * The web ACL in front of one resource, or nothing when it has none.
+     */
+    webAclFor(resourceArn) {
+        return this.#associations.get(resourceArn)?.webAcl;
+    }
+    /**
+     * The resources one web ACL is in front of, in the order they were
+     * associated.
+     *
+     * A resource type narrows the answer to the resources of that type, as
+     * `ListResourcesForWebACL` does. Naming none answers with all of them, which
+     * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
+     */
+    resourceArnsFor(webAcl, resourceType) {
+        return this.#associations
+            .entries()
+            .filter(([, association]) => association.webAcl === webAcl)
+            .filter(([, association]) => resourceType === undefined ||
+            association.resourceType === resourceType)
+            .map(([resourceArn]) => resourceArn)
+            .toArray();
+    }
+    /**
+     * Whether a web ACL is in front of one resource.
+     */
+    protects(resourceArn) {
+        return this.#associations.has(resourceArn);
+    }
+    /**
+     * What the web ACL in front of one resource decides about a request.
+     */
+    decide(request) {
+        const association = this.#associations.get(request.resourceArn);
+        if (association === undefined) {
+            return undefined;
+        }
+        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body));
+    }
+    /**
+     * Forget whatever is in front of one resource.
+     *
+     * This is both what DisassociateWebACL does and what deleting the resource
+     * does. A stage that is deleted and created again under the same name is
+     * unprotected, as it is on AWS.
+     */
+    release(resourceArn) {
+        this.#associations.delete(resourceArn);
+    }
+}
+//# sourceMappingURL=sim-waf-associations.js.map

package/dist/service/wafv2/association/sim-waf-associations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-associations.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-associations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAuBlF;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACpB,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;IAE9D;;;;;OAKG;IACH,SAAS,CAAC,QAAiC,EAAE,MAAoB;QAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE;YACnC,MAAM;YACN,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,WAAmB;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,MAAoB,EACpB,YAA0C;QAE1C,OAAO,IAAI,CAAC,aAAa;aACtB,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC;aAC1D,MAAM,CACL,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,CAClB,YAAY,KAAK,SAAS;YAC1B,WAAW,CAAC,YAAY,KAAK,YAAY,CAC5C;aACA,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;aACnC,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA+B;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,CAChC,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CACtD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAmB;QACzB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts

@@ -0,0 +1,38 @@
+import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUserPool } from "./sim-waf-user-pool.js";
+/**
+ * A resource a `REGIONAL` web ACL can be put in front of.
+ *
+ * Two types are simulated. A third one joins this union and the reader below
+ * gains a branch for it, and everything that holds an association goes on
+ * addressing a resource by its ARN.
+ */
+export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool;
+/**
+ * The type ListResourcesForWebACL lists one simulated resource under.
+ */
+export type SimWafProtectedResourceType = SimWafProtectedResource["resourceType"];
+/**
+ * The type ListResourcesForWebACL lists a simulated REST API stage under.
+ */
+export declare const simWafApiGatewayResourceType = "API_GATEWAY";
+/**
+ * The type ListResourcesForWebACL lists a simulated user pool under.
+ */
+export declare const simWafUserPoolResourceType = "COGNITO_USER_POOL";
+/**
+ * The resource types this simulation holds, as a refusal names them.
+ */
+export declare const simWafProtectedResourceTypes: readonly SimWafProtectedResourceType[];
+/**
+ * Read the resource an association names, refusing anything a web ACL cannot
+ * be put in front of here.
+ *
+ * The three refusals mean different things. An HTTP API stage is refused
+ * because AWS WAF protects no HTTP API, so an association accepted here would
+ * let a test cover protection AWS never applies. A load balancer and the rest
+ * are resource types AWS does protect and this simulation does not, which is
+ * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ */
+export declare function simWafProtectedResource(arn: string): SimWafProtectedResource;
+//# sourceMappingURL=sim-waf-protected-resource.d.ts.map

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resource.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAE1E;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACrC,uBAAuB,CAAC,cAAc,CAAC,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,4BAA4B,gBAAgB,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,0BAA0B,sBAAsB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,2BAA2B,EACnB,CAAC;AAuB7D;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CA4B5E"}

package/dist/service/wafv2/association/sim-waf-protected-resource.js

@@ -0,0 +1,100 @@
+import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
+import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUserPool } from "./sim-waf-user-pool.js";
+/**
+ * The type ListResourcesForWebACL lists a simulated REST API stage under.
+ */
+export const simWafApiGatewayResourceType = "API_GATEWAY";
+/**
+ * The type ListResourcesForWebACL lists a simulated user pool under.
+ */
+export const simWafUserPoolResourceType = "COGNITO_USER_POOL";
+/**
+ * The resource types this simulation holds, as a refusal names them.
+ */
+export const simWafProtectedResourceTypes = [simWafApiGatewayResourceType, simWafUserPoolResourceType];
+const restApiStagePattern = /^arn:aws:apigateway:(?<regionName>[^:]+)::\/restapis\/(?<restApiId>[^/]+)\/stages\/(?<stageName>[^/]+)$/u;
+const httpApiStagePattern = /^arn:aws:apigateway:[^:]+::\/apis\/[^/]+\/stages\/[^/]+$/u;
+const userPoolPattern = /^arn:aws:cognito-idp:(?<regionName>[^:]+):(?<accountId>[^:]+):userpool\/(?<userPoolId>[^/]+)$/u;
+/**
+ * The resource types real WAF protects that this simulation does not, by the
+ * service in their ARN.
+ */
+const unsimulatedResources = new Map([
+    ["elasticloadbalancing", "an Application Load Balancer"],
+    ["appsync", "an AppSync GraphQL API"],
+    ["apprunner", "an App Runner service"],
+    ["amplify", "an Amplify app"],
+    ["ec2", "a Verified Access instance"],
+]);
+/**
+ * Read the resource an association names, refusing anything a web ACL cannot
+ * be put in front of here.
+ *
+ * The three refusals mean different things. An HTTP API stage is refused
+ * because AWS WAF protects no HTTP API, so an association accepted here would
+ * let a test cover protection AWS never applies. A load balancer and the rest
+ * are resource types AWS does protect and this simulation does not, which is
+ * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ */
+export function simWafProtectedResource(arn) {
+    const stage = restApiStage(arn);
+    if (stage !== undefined) {
+        return stage;
+    }
+    const userPool = simWafUserPool(arn);
+    if (userPool !== undefined) {
+        return userPool;
+    }
+    if (httpApiStagePattern.test(arn)) {
+        throw new SimWafInvalidParameterException(`AWS WAF does not protect an API Gateway HTTP API. The resource types ` +
+            `it protects cover a REST API stage and not an HTTP API stage, so ` +
+            `${arn} cannot be associated with a web ACL.`);
+    }
+    refuseUnsimulatedResource(arn);
+    throw new SimWafInvalidParameterException(`Error reason: The ARN isn't valid. A valid ARN begins with arn: and ` +
+        `includes other information separated by colons or slashes., ` +
+        `field: RESOURCE_ARN, parameter: ${arn}`);
+}
+/**
+ * The REST API stage an ARN names, or nothing when it names no stage.
+ */
+function restApiStage(arn) {
+    const { groups } = restApiStagePattern.exec(arn) ?? {};
+    if (groups === undefined) {
+        return undefined;
+    }
+    return new SimWafRestApiStage({
+        arn,
+        regionName: groups["regionName"] ?? "",
+        restApiId: groups["restApiId"] ?? "",
+        stageName: groups["stageName"] ?? "",
+    });
+}
+/**
+ * The user pool an ARN names, or nothing when it names no pool.
+ */
+function simWafUserPool(arn) {
+    const { groups } = userPoolPattern.exec(arn) ?? {};
+    if (groups === undefined) {
+        return undefined;
+    }
+    return new SimWafUserPool({
+        arn,
+        regionName: groups["regionName"] ?? "",
+        accountId: groups["accountId"] ?? "",
+        userPoolId: groups["userPoolId"] ?? "",
+    });
+}
+/**
+ * Refuse an ARN naming a resource type AWS WAF protects and Yulin does not.
+ */
+function refuseUnsimulatedResource(arn) {
+    const described = unsimulatedResources.get(arn.split(":", 3)[2] ?? "");
+    if (described !== undefined) {
+        throw new SimWafUnsimulatedInputException(`AWS WAF protects ${described}, and Yulin does not simulate a web ACL ` +
+            `in front of one, so ${arn} is refused rather than protected by ` +
+            `nothing.`);
+    }
+}
+//# sourceMappingURL=sim-waf-protected-resource.js.map

package/dist/service/wafv2/association/sim-waf-protected-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resource.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAiBxD;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,aAAa,CAAC;AAE1D;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AAE9D;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,CAAC,4BAA4B,EAAE,0BAA0B,CAAC,CAAC;AAE7D,MAAM,mBAAmB,GACvB,0GAA0G,CAAC;AAE7G,MAAM,mBAAmB,GACvB,2DAA2D,CAAC;AAE9D,MAAM,eAAe,GACnB,gGAAgG,CAAC;AAEnG;;;GAGG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAiB;IACnD,CAAC,sBAAsB,EAAE,8BAA8B,CAAC;IACxD,CAAC,SAAS,EAAE,wBAAwB,CAAC;IACrC,CAAC,WAAW,EAAE,uBAAuB,CAAC;IACtC,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAC7B,CAAC,KAAK,EAAE,4BAA4B,CAAC;CACtC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,+BAA+B,CACvC,uEAAuE;YACrE,mEAAmE;YACnE,GAAG,GAAG,uCAAuC,CAChD,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAE/B,MAAM,IAAI,+BAA+B,CACvC,sEAAsE;QACpE,8DAA8D;QAC9D,mCAAmC,GAAG,EAAE,CAC3C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,kBAAkB,CAAC;QAC5B,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACtC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACpC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,cAAc,CAAC;QACxB,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACtC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACpC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEvE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,SAAS,0CAA0C;YACrE,uBAAuB,GAAG,uCAAuC;YACjE,UAAU,CACb,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/wafv2/association/sim-waf-protected-resources.d.ts

@@ -0,0 +1,29 @@
+import type { SimWafProtectedResource } from "./sim-waf-protected-resource.js";
+/**
+ * The resources of one Account and Region a web ACL can be put in front of.
+ *
+ * An association names a resource that has to be there. WAFv2 holds no API
+ * Gateway state of its own, so this is how it asks whichever service owns the
+ * resource whether the ARN names anything.
+ */
+export interface SimWafProtectedResources {
+    /**
+     * Whether this simulation holds the resource an ARN names.
+     */
+    has(resource: SimWafProtectedResource): boolean;
+}
+/**
+ * The resources available to a WAFv2 with nothing around it to ask.
+ *
+ * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
+ * web ACL with nothing at all. That is the safe answer: an association held
+ * against a resource no request will ever reach protects nothing, and saying
+ * so is better than reporting a web ACL in front of something imaginary.
+ */
+export declare class SimWafNoProtectedResources implements SimWafProtectedResources {
+    /**
+     * No resource is reachable here.
+     */
+    has(): boolean;
+}
+//# sourceMappingURL=sim-waf-protected-resources.d.ts.map

package/dist/service/wafv2/association/sim-waf-protected-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resources.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA2B,YAAW,wBAAwB;IACzE;;OAEG;IACH,GAAG,IAAI,OAAO,CAEb;CACF"}

package/dist/service/wafv2/association/sim-waf-protected-resources.js

@@ -0,0 +1,17 @@
+/**
+ * The resources available to a WAFv2 with nothing around it to ask.
+ *
+ * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
+ * web ACL with nothing at all. That is the safe answer: an association held
+ * against a resource no request will ever reach protects nothing, and saying
+ * so is better than reporting a web ACL in front of something imaginary.
+ */
+export class SimWafNoProtectedResources {
+    /**
+     * No resource is reachable here.
+     */
+    has() {
+        return false;
+    }
+}
+//# sourceMappingURL=sim-waf-protected-resources.js.map

package/dist/service/wafv2/association/sim-waf-protected-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resources.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resources.ts"],"names":[],"mappings":"AAgBA;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,GAAG;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-protection.d.ts

@@ -0,0 +1,60 @@
+import type { SimWafDecision } from "../evaluate/sim-waf-decision.js";
+/**
+ * One request put to whatever web ACL is in front of the resource it reached.
+ */
+export interface SimWafProtectedRequest {
+    /** The resource the request reached, by ARN. */
+    readonly resourceArn: string;
+    readonly request: Request;
+    /**
+     * The request body, when the rules might inspect it. A request body is a
+     * stream that cannot be read twice, so it is passed in already buffered.
+     */
+    readonly body?: Uint8Array | undefined;
+}
+/**
+ * The web ACLs a fronting service's resources are protected by.
+ *
+ * A service serving a request asks this what the web ACL in front of the
+ * resource decided, and tells it when a resource is deleted. That is how API
+ * Gateway reaches simulated WAFv2 without depending on it.
+ */
+export interface SimWafProtection {
+    /**
+     * Whether a web ACL is in front of one resource.
+     *
+     * Asked before a request is put to a web ACL, because inspecting one means
+     * buffering its body and a resource with no web ACL has no reason to.
+     */
+    protects(resourceArn: string): boolean;
+    /**
+     * What the web ACL in front of one resource decides about a request, or
+     * nothing when no web ACL is in front of it.
+     */
+    decide(request: SimWafProtectedRequest): SimWafDecision | undefined;
+    /**
+     * Forget whatever protects a resource, as deleting the resource does.
+     */
+    release(resourceArn: string): void;
+}
+/**
+ * The protection available to a service with no WAFv2 to ask.
+ *
+ * Nothing is in front of anything, so a standalone simulated API Gateway
+ * serves every request the way it did before web ACLs existed.
+ */
+export declare class SimWafNoProtection implements SimWafProtection {
+    /**
+     * Nothing is protected here.
+     */
+    protects(): boolean;
+    /**
+     * No web ACL decides anything here.
+     */
+    decide(): undefined;
+    /**
+     * There is nothing held against a resource to let go of.
+     */
+    release(): void;
+}
+//# sourceMappingURL=sim-waf-protection.d.ts.map

package/dist/service/wafv2/association/sim-waf-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protection.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAEvC;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,GAAG,SAAS,CAAC;IAEpE;;OAEG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,gBAAgB;IACzD;;OAEG;IACH,QAAQ,IAAI,OAAO,CAElB;IAED;;OAEG;IACH,MAAM,IAAI,SAAS,CAElB;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAEd;CACF"}

package/dist/service/wafv2/association/sim-waf-protection.js

@@ -0,0 +1,27 @@
+/**
+ * The protection available to a service with no WAFv2 to ask.
+ *
+ * Nothing is in front of anything, so a standalone simulated API Gateway
+ * serves every request the way it did before web ACLs existed.
+ */
+export class SimWafNoProtection {
+    /**
+     * Nothing is protected here.
+     */
+    protects() {
+        return false;
+    }
+    /**
+     * No web ACL decides anything here.
+     */
+    decide() {
+        return;
+    }
+    /**
+     * There is nothing held against a resource to let go of.
+     */
+    release() {
+        return;
+    }
+}
+//# sourceMappingURL=sim-waf-protection.js.map

package/dist/service/wafv2/association/sim-waf-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protection.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protection.ts"],"names":[],"mappings":"AA8CA;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACH,QAAQ;QACN,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO;IACT,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO;IACT,CAAC;CACF"}