@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/wafv2/sim-wafv2.d.ts

@@ -0,0 +1,151 @@
+import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
+import type { SimWafProtection } from "./association/sim-waf-protection.js";
+import type * as simWafCommands from "./command/sim-wafv2-command.types.js";
+import type { SimWafRequestOptions } from "./command/sim-wafv2-request-options.js";
+import type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
+import type { SimWafEvaluationRequest } from "./evaluate/sim-waf-evaluation-request.js";
+import type { SimWafIpSet } from "./ip-set/sim-waf-ip-set.js";
+import type { SimWafManagedRules } from "./managed/sim-waf-managed-rules.js";
+import type { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern-set.js";
+import type { SimWafScope } from "./scope/sim-waf-scope.js";
+import { type SimWafV2Properties } from "./sim-wafv2-commands.js";
+import { SimWafCfnResourceFactory } from "./cfn/sim-waf-cfn-resource-factory.js";
+import { SimWafSets } from "./sim-wafv2-sets.js";
+import type { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
+import { type SimWafUnevaluatableRule } from "./web-acl/sim-waf-unevaluatable-rules.js";
+import type { SimWafWebAclWriteInput } from "./command/web-acl/web-acl.command.js";
+export type { SimWafEvaluationRequest } from "./evaluate/sim-waf-evaluation-request.js";
+/**
+ * Simulated AWS WAFv2. Handles SDK commands. Emulates AWS behaviour and state.
+ *
+ * A web ACL is a list of rules and a decision about the requests none of them
+ * claims, and `evaluateRequest` is what that adds up to. `AssociateWebACL`
+ * puts one in front of an API Gateway REST API stage or a Cognito user pool,
+ * and the stage or the pool's hosted domain then asks for that decision itself
+ * on every request it serves.
+ *
+ * Resources are scoped to an Account and Region, and within that to
+ * `CLOUDFRONT` or `REGIONAL`. The two scopes are separate namespaces rather
+ * than a label, and `CLOUDFRONT` lives in `us-east-1` because CloudFront is
+ * global and its web ACLs are held there.
+ */
+export declare class SimWafV2 extends SimWafSets {
+    #private;
+    constructor(properties?: SimWafV2Properties);
+    /**
+     * The web ACLs this WAFv2 has in front of things, as a fronting service sees
+     * them.
+     *
+     * The simulator's own accessor rather than a WAFv2 operation. It is how a
+     * simulated API Gateway reaches the web ACL protecting a stage it is about
+     * to serve, and how a simulated Cognito reaches the one protecting a pool's
+     * hosted domain. It is also how each lets go of one when the resource is
+     * deleted.
+     */
+    protection(): SimWafProtection;
+    /**
+     * Every web ACL in one scope, in the order they were created.
+     *
+     * The simulator's own accessor, for tests inspecting web ACL state without
+     * going through a Command and its authorization.
+     */
+    allWebAcls(scope: SimWafScope): readonly SimWafWebAcl[];
+    /**
+     * Find a web ACL by its ARN.
+     *
+     * This is how a fronting service reaches the web ACL it was associated with,
+     * since an association carries the ARN and nothing else.
+     */
+    findWebAclByArn(webAclArn: string): SimWafWebAcl | undefined;
+    /**
+     * Find an IP set by its ARN.
+     *
+     * The simulator's own accessor, and what the CloudFormation layer reaches
+     * for once CreateIPSet has reported the ARN of the set it made.
+     */
+    findIpSetByArn(ipSetArn: string): SimWafIpSet | undefined;
+    /**
+     * Find a regex pattern set by its ARN.
+     *
+     * The simulator's own accessor, and what a rule naming a pattern set is
+     * compiled against, since a reference carries the ARN and nothing else.
+     */
+    findRegexPatternSetByArn(regexPatternSetArn: string): SimWafRegexPatternSet | undefined;
+    /**
+     * Evaluate one HTTP request against a web ACL's rules.
+     *
+     * Rules run in ascending priority, the first terminating match decides, and
+     * a request no rule terminates gets the web ACL's default action. This is
+     * the simulator's own entry point rather than a WAFv2 operation: on AWS the
+     * evaluation happens because the request reached something the web ACL is in
+     * front of.
+     */
+    evaluateRequest(evaluation: SimWafEvaluationRequest): SimWafDecision;
+    /**
+     * What the AWS managed rule groups do here, and what a test declares of
+     * them.
+     *
+     * `onRequest` says which rules claim a request, for the ones that detect
+     * nothing here, and `rules()` reports what is covered of each.
+     */
+    managedRules(): SimWafManagedRules;
+    /**
+     * The rules of a web ACL input this simulation cannot evaluate.
+     *
+     * The simulator's own accessor rather than a WAFv2 operation. `CreateWebACL`
+     * refuses a web ACL carrying such a rule, because a web ACL that accepted
+     * one would allow a request AWS blocks. A template is deployed rule by rule
+     * instead, so the CloudFormation layer asks this first and leaves the rules
+     * it names out of the web ACL it writes.
+     */
+    unevaluatableWebAclRules(input: SimWafWebAclWriteInput): readonly SimWafUnevaluatableRule[];
+    /**
+     * Handle a CreateWebACL Command from the SDK.
+     */
+    createWebAcl(command: simWafCommands.SimCreateWebAclCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimCreateWebAclCommandOutput>;
+    /**
+     * Handle a GetWebACL Command from the SDK.
+     */
+    getWebAcl(command: simWafCommands.SimGetWebAclCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimGetWebAclCommandOutput>;
+    /**
+     * Handle an UpdateWebACL Command from the SDK.
+     */
+    updateWebAcl(command: simWafCommands.SimUpdateWebAclCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimUpdateWebAclCommandOutput>;
+    /**
+     * Handle a ListWebACLs Command from the SDK.
+     */
+    listWebAcls(command: simWafCommands.SimListWebAclsCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimListWebAclsCommandOutput>;
+    /**
+     * Handle a DeleteWebACL Command from the SDK.
+     */
+    deleteWebAcl(command: simWafCommands.SimDeleteWebAclCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimDeleteWebAclCommandOutput>;
+    /**
+     * Handle a DescribeManagedRuleGroup Command from the SDK.
+     */
+    describeManagedRuleGroup(command: simWafCommands.SimDescribeManagedRuleGroupCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimDescribeManagedRuleGroupCommandOutput>;
+    /**
+     * Handle an AssociateWebACL Command from the SDK.
+     */
+    associateWebAcl(command: simWafCommands.SimAssociateWebAclCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimAssociateWebAclCommandOutput>;
+    /**
+     * Handle a DisassociateWebACL Command from the SDK.
+     */
+    disassociateWebAcl(command: simWafCommands.SimDisassociateWebAclCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimDisassociateWebAclCommandOutput>;
+    /**
+     * Handle a GetWebACLForResource Command from the SDK.
+     */
+    getWebAclForResource(command: simWafCommands.SimGetWebAclForResourceCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimGetWebAclForResourceCommandOutput>;
+    /**
+     * Handle a ListResourcesForWebACL Command from the SDK.
+     */
+    listResourcesForWebAcl(command: simWafCommands.SimListResourcesForWebAclCommand, options?: SimWafRequestOptions): Promise<simWafCommands.SimListResourcesForWebAclCommandOutput>;
+    /**
+     * Get the CloudFormation Resource factory for AWS::WAFv2::* Resources.
+     */
+    cfnResourceFactory(): SimWafCfnResourceFactory;
+    /**
+     * Get this service's SDK Command router for SDK client interception.
+     */
+    sdkCommandRouter(): SimSdkCommandRouter;
+}
+//# sourceMappingURL=sim-wafv2.d.ts.map

package/dist/service/wafv2/sim-wafv2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-wafv2.d.ts","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,KAAK,cAAc,MAAM,sCAAsC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAEnF,YAAY,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,qBAAa,QAAS,SAAQ,UAAU;;IAItC,YAAY,UAAU,GAAE,kBAAuB,EAE9C;IAED;;;;;;;;;OASG;IACH,UAAU,IAAI,gBAAgB,CAE7B;IAED;;;;;OAKG;IACH,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,YAAY,EAAE,CAEtD;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE3D;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAExD;IAED;;;;;OAKG;IACH,wBAAwB,CACtB,kBAAkB,EAAE,MAAM,GACzB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,UAAU,EAAE,uBAAuB,GAAG,cAAc,CAanE;IAED;;;;;;OAMG;IACH,YAAY,IAAI,kBAAkB,CAEjC;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,KAAK,EAAE,sBAAsB,GAC5B,SAAS,uBAAuB,EAAE,CAMpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,cAAc,CAAC,mBAAmB,EAC3C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAGnD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,cAAc,CAAC,qBAAqB,EAC7C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,CAGrD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,cAAc,CAAC,kCAAkC,EAC1D,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,wCAAwC,CAAC,CAMlE;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,cAAc,CAAC,yBAAyB,EACjD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAGzD;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,cAAc,CAAC,4BAA4B,EACpD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAM5D;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,cAAc,CAAC,8BAA8B,EACtD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,oCAAoC,CAAC,CAM9D;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,cAAc,CAAC,gCAAgC,EACxD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,sCAAsC,CAAC,CAMhE;IAED;;OAEG;IACH,kBAAkB,IAAI,wBAAwB,CAE7C;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}

package/dist/service/wafv2/sim-wafv2.fixture.d.ts

@@ -0,0 +1,50 @@
+import type { SimCreateWebAclCommandInput, SimWafSummaryOutput } from "./command/web-acl/web-acl.command.js";
+import type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
+import type { SimWafStatementInput } from "./statement/sim-waf-statement.type.js";
+import type { SimWafRuleInput } from "./web-acl/sim-waf-rule.type.js";
+import type { SimWafV2 } from "./sim-wafv2.js";
+/**
+ * Create a web ACL and answer with what CreateWebACL reported about it.
+ *
+ * The summary is where the generated id, the ARN and the first lock token
+ * come from, and a test needs all three to do anything else with the web ACL.
+ * CreateWebACL reports one for every web ACL it makes, so a test reading
+ * around a missing summary would be writing around a simulator fault.
+ */
+export declare function createSimWafWebAcl(simWaf: SimWafV2, input: SimCreateWebAclCommandInput): Promise<SimWafSummaryOutput>;
+/**
+ * Whether one statement claims a request.
+ */
+export type SimWafStatementMatch = (request: Request, body?: Uint8Array) => boolean;
+/**
+ * Create a web ACL whose one rule blocks whatever a statement claims, and
+ * answer with a way to ask that statement about a request.
+ *
+ * A test about one statement kind is about which requests that statement
+ * claims, and the web ACL around it is the same every time: one rule, blocking,
+ * over a default action of allow. A blocked request is then one the statement
+ * matched, and an allowed one is a request it did not.
+ */
+export declare function simWafStatementMatches(simWaf: SimWafV2, statement: SimWafStatementInput): Promise<SimWafStatementMatch>;
+/**
+ * What a web ACL decided about one request.
+ */
+export type SimWafRequestDecision = (request: Request, body?: Uint8Array) => SimWafDecision;
+/**
+ * Create a web ACL holding some rules, and answer with a way to put requests
+ * through it.
+ *
+ * This is `simWafStatementMatches` for a test that wants the whole decision
+ * rather than whether one statement claimed the request: which rule decided,
+ * which rules counted, and what labels the request came away with.
+ */
+export declare function simWafWebAclDecisions(simWaf: SimWafV2, rules: readonly SimWafRuleInput[], webAcl?: Partial<SimCreateWebAclCommandInput>): Promise<SimWafRequestDecision>;
+/**
+ * A request the core rule set does not claim on sight.
+ *
+ * `NoUserAgent_HEADER` blocks a request that sends no User-Agent header, and
+ * nothing here sends one unless it is asked to, so a test about any other rule
+ * makes its requests with this.
+ */
+export declare function simWafBrowserRequest(url: string, init?: RequestInit): Request;
+//# sourceMappingURL=sim-wafv2.fixture.d.ts.map

package/dist/service/wafv2/sim-wafv2.fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-wafv2.fixture.d.ts","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2.fixture.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,2BAA2B,EAC3B,mBAAmB,EACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG/C;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAS9B;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,UAAU,KACd,OAAO,CAAC;AAEb;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,QAAQ,EAChB,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAU/B;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,UAAU,KACd,cAAc,CAAC;AAEpB;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,MAAM,GAAE,OAAO,CAAC,2BAA2B,CAAM,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAShC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,GACrB,OAAO,CAQT"}

package/dist/service/wafv2/sim-wafv2.fixture.js

@@ -0,0 +1,63 @@
+import { assertDefined } from "../../util/type-guard/defined.js";
+import { simWafCreateWebAclFactory } from "./command/web-acl/sim-waf-create-web-acl.factory.js";
+import { simWafRuleFactory } from "./web-acl/sim-waf-rule.factory.js";
+/**
+ * Create a web ACL and answer with what CreateWebACL reported about it.
+ *
+ * The summary is where the generated id, the ARN and the first lock token
+ * come from, and a test needs all three to do anything else with the web ACL.
+ * CreateWebACL reports one for every web ACL it makes, so a test reading
+ * around a missing summary would be writing around a simulator fault.
+ */
+export async function createSimWafWebAcl(simWaf, input) {
+    const created = await simWaf.createWebAcl({ input });
+    assertDefined(created.Summary, "Simulated WAFv2 created a web ACL and reported no summary for it");
+    return created.Summary;
+}
+/**
+ * Create a web ACL whose one rule blocks whatever a statement claims, and
+ * answer with a way to ask that statement about a request.
+ *
+ * A test about one statement kind is about which requests that statement
+ * claims, and the web ACL around it is the same every time: one rule, blocking,
+ * over a default action of allow. A blocked request is then one the statement
+ * matched, and an allowed one is a request it did not.
+ */
+export async function simWafStatementMatches(simWaf, statement) {
+    const { ARN: webAclArn } = await createSimWafWebAcl(simWaf, simWafCreateWebAclFactory.make({
+        Rules: [{ ...simWafRuleFactory.make(), Statement: statement }],
+    }));
+    return (request, body) => simWaf.evaluateRequest({ webAclArn, request, body }).action === "BLOCK";
+}
+/**
+ * Create a web ACL holding some rules, and answer with a way to put requests
+ * through it.
+ *
+ * This is `simWafStatementMatches` for a test that wants the whole decision
+ * rather than whether one statement claimed the request: which rule decided,
+ * which rules counted, and what labels the request came away with.
+ */
+export async function simWafWebAclDecisions(simWaf, rules, webAcl = {}) {
+    const { ARN: webAclArn } = await createSimWafWebAcl(simWaf, {
+        ...simWafCreateWebAclFactory.make(),
+        ...webAcl,
+        Rules: rules,
+    });
+    return (request, body) => simWaf.evaluateRequest({ webAclArn, request, body });
+}
+/**
+ * A request the core rule set does not claim on sight.
+ *
+ * `NoUserAgent_HEADER` blocks a request that sends no User-Agent header, and
+ * nothing here sends one unless it is asked to, so a test about any other rule
+ * makes its requests with this.
+ */
+export function simWafBrowserRequest(url, init = {}) {
+    const headers = new Headers(init.headers);
+    if (!headers.has("user-agent")) {
+        headers.set("user-agent", browserUserAgent);
+    }
+    return new Request(url, { ...init, headers });
+}
+const browserUserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36";
+//# sourceMappingURL=sim-wafv2.fixture.js.map

package/dist/service/wafv2/sim-wafv2.fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-wafv2.fixture.js","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2.fixture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAShG,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAgB,EAChB,KAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,aAAa,CACX,OAAO,CAAC,OAAO,EACf,kEAAkE,CACnE,CAAC;IAEF,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAUD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAgB,EAChB,SAA+B;IAE/B,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CACjD,MAAM,EACN,yBAAyB,CAAC,IAAI,CAAC;QAC7B,KAAK,EAAE,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;KAC/D,CAAC,CACH,CAAC;IAEF,OAAO,CAAC,OAAO,EAAE,IAAI,EAAW,EAAE,CAChC,MAAM,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;AAC5E,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAgB,EAChB,KAAiC,EACjC,MAAM,GAAyC,EAAE;IAEjD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE;QAC1D,GAAG,yBAAyB,CAAC,IAAI,EAAE;QACnC,GAAG,MAAM;QACT,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,EAAE,IAAI,EAAkB,EAAE,CACvC,MAAM,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,IAAI,GAAgB,EAAE;IAEtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,gBAAgB,GACpB,oEAAoE,CAAC"}

package/dist/service/wafv2/sim-wafv2.js

@@ -0,0 +1,203 @@
+import { SimWafNonexistentItemException } from "./error/sim-wafv2.error.js";
+import { simWafInspectedRequest } from "./evaluate/sim-waf-inspected-request.js";
+import { SimWafSdkCommandRouter } from "./sdk/sim-wafv2-sdk-command-router.js";
+import { SimWafCommands, } from "./sim-wafv2-commands.js";
+import { SimWafCfnResourceFactory } from "./cfn/sim-waf-cfn-resource-factory.js";
+import { SimWafSets } from "./sim-wafv2-sets.js";
+import { unevaluatableSimWafRules, } from "./web-acl/sim-waf-unevaluatable-rules.js";
+/**
+ * Simulated AWS WAFv2. Handles SDK commands. Emulates AWS behaviour and state.
+ *
+ * A web ACL is a list of rules and a decision about the requests none of them
+ * claims, and `evaluateRequest` is what that adds up to. `AssociateWebACL`
+ * puts one in front of an API Gateway REST API stage or a Cognito user pool,
+ * and the stage or the pool's hosted domain then asks for that decision itself
+ * on every request it serves.
+ *
+ * Resources are scoped to an Account and Region, and within that to
+ * `CLOUDFRONT` or `REGIONAL`. The two scopes are separate namespaces rather
+ * than a label, and `CLOUDFRONT` lives in `us-east-1` because CloudFront is
+ * global and its web ACLs are held there.
+ */
+export class SimWafV2 extends SimWafSets {
+    #sdkRouter = new SimWafSdkCommandRouter(this);
+    #cfnFactory = new SimWafCfnResourceFactory({ wafV2: this });
+    constructor(properties = {}) {
+        super(new SimWafCommands(properties));
+    }
+    /**
+     * The web ACLs this WAFv2 has in front of things, as a fronting service sees
+     * them.
+     *
+     * The simulator's own accessor rather than a WAFv2 operation. It is how a
+     * simulated API Gateway reaches the web ACL protecting a stage it is about
+     * to serve, and how a simulated Cognito reaches the one protecting a pool's
+     * hosted domain. It is also how each lets go of one when the resource is
+     * deleted.
+     */
+    protection() {
+        return this.commands.associations;
+    }
+    /**
+     * Every web ACL in one scope, in the order they were created.
+     *
+     * The simulator's own accessor, for tests inspecting web ACL state without
+     * going through a Command and its authorization.
+     */
+    allWebAcls(scope) {
+        return this.commands.webAcls.all(scope);
+    }
+    /**
+     * Find a web ACL by its ARN.
+     *
+     * This is how a fronting service reaches the web ACL it was associated with,
+     * since an association carries the ARN and nothing else.
+     */
+    findWebAclByArn(webAclArn) {
+        return this.commands.webAcls.findByArn(webAclArn);
+    }
+    /**
+     * Find an IP set by its ARN.
+     *
+     * The simulator's own accessor, and what the CloudFormation layer reaches
+     * for once CreateIPSet has reported the ARN of the set it made.
+     */
+    findIpSetByArn(ipSetArn) {
+        return this.commands.ipSets.findByArn(ipSetArn);
+    }
+    /**
+     * Find a regex pattern set by its ARN.
+     *
+     * The simulator's own accessor, and what a rule naming a pattern set is
+     * compiled against, since a reference carries the ARN and nothing else.
+     */
+    findRegexPatternSetByArn(regexPatternSetArn) {
+        return this.commands.regexPatternSets.findByArn(regexPatternSetArn);
+    }
+    /**
+     * Evaluate one HTTP request against a web ACL's rules.
+     *
+     * Rules run in ascending priority, the first terminating match decides, and
+     * a request no rule terminates gets the web ACL's default action. This is
+     * the simulator's own entry point rather than a WAFv2 operation: on AWS the
+     * evaluation happens because the request reached something the web ACL is in
+     * front of.
+     */
+    evaluateRequest(evaluation) {
+        const webAcl = this.findWebAclByArn(evaluation.webAclArn);
+        if (webAcl === undefined) {
+            throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource ` +
+                `doesn't exist: web ACL ${evaluation.webAclArn}.`);
+        }
+        return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body));
+    }
+    /**
+     * What the AWS managed rule groups do here, and what a test declares of
+     * them.
+     *
+     * `onRequest` says which rules claim a request, for the ones that detect
+     * nothing here, and `rules()` reports what is covered of each.
+     */
+    managedRules() {
+        return this.commands.managedRules;
+    }
+    /**
+     * The rules of a web ACL input this simulation cannot evaluate.
+     *
+     * The simulator's own accessor rather than a WAFv2 operation. `CreateWebACL`
+     * refuses a web ACL carrying such a rule, because a web ACL that accepted
+     * one would allow a request AWS blocks. A template is deployed rule by rule
+     * instead, so the CloudFormation layer asks this first and leaves the rules
+     * it names out of the web ACL it writes.
+     */
+    unevaluatableWebAclRules(input) {
+        return unevaluatableSimWafRules(input.Rules, {
+            regexPatternSets: this.commands.regexPatternSets,
+            managedRules: this.commands.managedRules,
+            customResponseBodies: input.CustomResponseBodies ?? {},
+        });
+    }
+    /**
+     * Handle a CreateWebACL Command from the SDK.
+     */
+    async createWebAcl(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.webAclCommands.createWebAcl(command, options);
+    }
+    /**
+     * Handle a GetWebACL Command from the SDK.
+     */
+    async getWebAcl(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.webAclCommands.getWebAcl(command, options);
+    }
+    /**
+     * Handle an UpdateWebACL Command from the SDK.
+     */
+    async updateWebAcl(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.webAclCommands.updateWebAcl(command, options);
+    }
+    /**
+     * Handle a ListWebACLs Command from the SDK.
+     */
+    async listWebAcls(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.webAclCommands.listWebAcls(command, options);
+    }
+    /**
+     * Handle a DeleteWebACL Command from the SDK.
+     */
+    async deleteWebAcl(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.webAclCommands.deleteWebAcl(command, options);
+    }
+    /**
+     * Handle a DescribeManagedRuleGroup Command from the SDK.
+     */
+    async describeManagedRuleGroup(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.managedRuleGroupCommands.describeManagedRuleGroup(command, options);
+    }
+    /**
+     * Handle an AssociateWebACL Command from the SDK.
+     */
+    async associateWebAcl(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.associationCommands.associateWebAcl(command, options);
+    }
+    /**
+     * Handle a DisassociateWebACL Command from the SDK.
+     */
+    async disassociateWebAcl(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.associationCommands.disassociateWebAcl(command, options);
+    }
+    /**
+     * Handle a GetWebACLForResource Command from the SDK.
+     */
+    async getWebAclForResource(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.associationCommands.getWebAclForResource(command, options);
+    }
+    /**
+     * Handle a ListResourcesForWebACL Command from the SDK.
+     */
+    async listResourcesForWebAcl(command, options) {
+        await this.commands.background.sequence();
+        return this.commands.associationCommands.listResourcesForWebAcl(command, options);
+    }
+    /**
+     * Get the CloudFormation Resource factory for AWS::WAFv2::* Resources.
+     */
+    cfnResourceFactory() {
+        return this.#cfnFactory;
+    }
+    /**
+     * Get this service's SDK Command router for SDK client interception.
+     */
+    sdkCommandRouter() {
+        return this.#sdkRouter;
+    }
+}
+//# sourceMappingURL=sim-wafv2.js.map

package/dist/service/wafv2/sim-wafv2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-wafv2.js","sourceRoot":"","sources":["../../../src/service/wafv2/sim-wafv2.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAG5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAKjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAEL,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAKlD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,QAAS,SAAQ,UAAU;IAC7B,UAAU,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,WAAW,GAAG,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,YAAY,UAAU,GAAuB,EAAE;QAC7C,KAAK,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;OASG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,KAAkB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAgB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,wBAAwB,CACtB,kBAA0B;QAE1B,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,UAAmC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,8BAA8B,CACtC,+DAA+D;gBAC7D,0BAA0B,UAAU,CAAC,SAAS,GAAG,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,CACpB,sBAAsB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAC5D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,KAA6B;QAE7B,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE;YAC3C,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;YAChD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;YACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA2C,EAC3C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,OAA6C,EAC7C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA8C,EAC9C,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAA0D,EAC1D,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,wBAAwB,CACpE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAiD,EACjD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAoD,EACpD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,CACzD,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAsD,EACtD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,oBAAoB,CAC3D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAAwD,EACxD,OAA8B;QAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,sBAAsB,CAC7D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/service/wafv2/statement/sim-waf-byte-match.d.ts

@@ -0,0 +1,18 @@
+import type { SimWafValueTest } from "./sim-waf-field-match.js";
+/**
+ * Minimal structural WAFv2 ByteMatchStatement.
+ */
+export interface SimWafByteMatchStatementInput {
+    readonly SearchString?: Uint8Array | string | undefined;
+    readonly PositionalConstraint?: string | undefined;
+}
+/**
+ * Build the test a ByteMatchStatement puts each string through.
+ *
+ * Matching is case sensitive here as it is on AWS. A rule that means to ignore
+ * case says so with a LOWERCASE text transformation and a lower case search
+ * string, which is why the transformations are part of the statement rather
+ * than a property of the comparison.
+ */
+export declare function simWafByteMatchTest(statement: SimWafByteMatchStatementInput, ruleName: string): SimWafValueTest;
+//# sourceMappingURL=sim-waf-byte-match.d.ts.map

package/dist/service/wafv2/statement/sim-waf-byte-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-byte-match.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-byte-match.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpD;AASD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,6BAA6B,EACxC,QAAQ,EAAE,MAAM,GACf,eAAe,CA4BjB"}

package/dist/service/wafv2/statement/sim-waf-byte-match.js

@@ -0,0 +1,69 @@
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+const decoder = new TextDecoder();
+/**
+ * Characters WAF counts as part of a word, for CONTAINS_WORD.
+ */
+const wordCharacter = /[\da-z_]/iu;
+/**
+ * Build the test a ByteMatchStatement puts each string through.
+ *
+ * Matching is case sensitive here as it is on AWS. A rule that means to ignore
+ * case says so with a LOWERCASE text transformation and a lower case search
+ * string, which is why the transformations are part of the statement rather
+ * than a property of the comparison.
+ */
+export function simWafByteMatchTest(statement, ruleName) {
+    const searchString = readSearchString(statement.SearchString, ruleName);
+    const constraint = statement.PositionalConstraint ?? "";
+    switch (constraint) {
+        case "EXACTLY": {
+            return (value) => value === searchString;
+        }
+        case "STARTS_WITH": {
+            return (value) => value.startsWith(searchString);
+        }
+        case "ENDS_WITH": {
+            return (value) => value.endsWith(searchString);
+        }
+        case "CONTAINS": {
+            return (value) => value.includes(searchString);
+        }
+        case "CONTAINS_WORD": {
+            return (value) => containsWord(value, searchString);
+        }
+        default: {
+            invalidSimWafRule(ruleName, `The positional constraint ${String(statement.PositionalConstraint)} ` +
+                `is not valid`);
+        }
+    }
+}
+/**
+ * Whether the search string appears in the value as a word of its own.
+ *
+ * A word here is what WAF says it is: the match has to start at the beginning
+ * of the value or after something that is not a letter, digit or underscore,
+ * and end at the end of the value or before something that is not.
+ */
+function containsWord(value, searchString) {
+    let from = value.indexOf(searchString);
+    while (from !== -1) {
+        if (isBoundary(value[from - 1]) &&
+            isBoundary(value[from + searchString.length])) {
+            return true;
+        }
+        from = value.indexOf(searchString, from + 1);
+    }
+    return false;
+}
+function isBoundary(character) {
+    return character === undefined || !wordCharacter.test(character);
+}
+function readSearchString(searchString, ruleName) {
+    if (searchString === undefined) {
+        invalidSimWafRule(ruleName, "ByteMatchStatement needs a SearchString");
+    }
+    return typeof searchString === "string"
+        ? searchString
+        : decoder.decode(searchString);
+}
+//# sourceMappingURL=sim-waf-byte-match.js.map

package/dist/service/wafv2/statement/sim-waf-byte-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-byte-match.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-byte-match.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAW/D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC;;GAEG;AACH,MAAM,aAAa,GAAG,YAAY,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAwC,EACxC,QAAgB;IAEhB,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,SAAS,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAExD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,KAAK,KAAK,YAAY,CAAC;QACpD,CAAC;QACD,KAAK,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/D,CAAC;QACD,SAAS,CAAC;YACR,iBAAiB,CACf,QAAQ,EACR,6BAA6B,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,GAAG;gBACpE,cAAc,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,YAAoB;IACvD,IAAI,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEvC,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,IACE,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YAC3B,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,EAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,SAA6B;IAC/C,OAAO,SAAS,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CACvB,YAA6C,EAC7C,QAAgB;IAEhB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,iBAAiB,CAAC,QAAQ,EAAE,yCAAyC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,OAAO,YAAY,KAAK,QAAQ;QACrC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACnC,CAAC"}

package/dist/service/wafv2/statement/sim-waf-field-content.d.ts

@@ -0,0 +1,42 @@
+/**
+ * What a rule found when it read the request field it inspects.
+ *
+ * Most reads answer with the strings to match against, which is `inspect`. The
+ * other two are what oversize content means: WAF stops reading a field at a
+ * fixed size, and the rule says whether content it could not read counts as a
+ * match or not.
+ */
+export type SimWafFieldContent = {
+    readonly outcome: "inspect";
+    readonly candidates: readonly string[];
+} | {
+    readonly outcome: "match";
+} | {
+    readonly outcome: "noMatch";
+};
+/**
+ * How much of a request body, header set or cookie set WAF reads.
+ *
+ * Real WAF stops at 8 KB for a web ACL as it is created here. A CloudFront
+ * association can raise the body limit, which is settled where associations
+ * are, so this is the one figure until then.
+ */
+export declare const simWafInspectionLimitBytes = 8192;
+/**
+ * What a rule does about content too large for WAF to read.
+ */
+export type SimWafOversizeHandling = "CONTINUE" | "MATCH" | "NO_MATCH";
+/**
+ * Read the oversize handling a rule named, refusing anything else.
+ */
+export declare function requiredSimWafOversizeHandling(handling: string | undefined, ruleName: string): SimWafOversizeHandling;
+/**
+ * Decide what a rule inspects, given everything the field held.
+ *
+ * Content within the limit is inspected whole. Past it, `MATCH` and `NO_MATCH`
+ * settle the statement without looking, and `CONTINUE` inspects as much as WAF
+ * would have read: whole entries while they fit, and the first entry cut to
+ * the limit when even one does not.
+ */
+export declare function simWafFieldContent(candidates: readonly string[], oversizeHandling: SimWafOversizeHandling): SimWafFieldContent;
+//# sourceMappingURL=sim-waf-field-content.d.ts.map

package/dist/service/wafv2/statement/sim-waf-field-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-field-content.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-field-content.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAEpC;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;AAKvE;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GACf,sBAAsB,CAWxB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,gBAAgB,EAAE,sBAAsB,GACvC,kBAAkB,CAapB"}