@kensio/yulin 1.20.11 → 1.20.13

package/dist/service/aws/sim-aws.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsAccountRegionContainer } from "./sim-aws-account-region-scop
 import { SimAwsServiceFactory } from "./factory/sim-aws-service-factory.js";
 import { SimAwsServiceAccessors } from "./sim-aws-service-accessors.js";
 import type { SimIamRegistry } from "../iam/registry/sim-iam-registry.js";
+import type { SimOrganizations } from "../organizations/index.js";
 import type { SimAwsPrincipal } from "./caller/sim-aws-caller.js";
 import type { SimClockControl } from "../../util/clock/sim-clock-control.js";
 import type { SimAwsProperties, SimAwsRequestCallerOptions } from "./sim-aws-properties.js";
@@ -36,6 +37,23 @@ export declare class SimAws extends SimAwsServiceAccessors {
     private readonly timekeeping;
     private readonly requestAuthentication;
     constructor(properties?: SimAwsProperties);
+    /**
+     * Get simulated AWS Organizations for this simulated AWS environment.
+     *
+     * An organization spans Accounts, so this one belongs to the whole
+     * simulation and is reached here rather than from an Account scope. The
+     * service control policies attached through it filter what the Accounts in
+     * this simulation may do, whether a request arrives through a CloudFormation
+     * deployment, an intercepted SDK client, or a service call in a handler.
+     *
+     * ```typescript
+     * simAws.organizations().attachServiceControlPolicy("123456789012", {
+     *   Version: "2012-10-17",
+     *   Statement: { Effect: "Deny", Action: "s3:CreateBucket", Resource: "*" },
+     * });
+     * ```
+     */
+    organizations(): SimOrganizations;
     /**
      * Get the current time in this simulated AWS environment.
      *

package/dist/service/aws/sim-aws.js

@@ -55,6 +55,25 @@ export class SimAws extends SimAwsServiceAccessors {
             clock: background,
         });
     }
+    /**
+     * Get simulated AWS Organizations for this simulated AWS environment.
+     *
+     * An organization spans Accounts, so this one belongs to the whole
+     * simulation and is reached here rather than from an Account scope. The
+     * service control policies attached through it filter what the Accounts in
+     * this simulation may do, whether a request arrives through a CloudFormation
+     * deployment, an intercepted SDK client, or a service call in a handler.
+     *
+     * ```typescript
+     * simAws.organizations().attachServiceControlPolicy("123456789012", {
+     *   Version: "2012-10-17",
+     *   Statement: { Effect: "Deny", Action: "s3:CreateBucket", Resource: "*" },
+     * });
+     * ```
+     */
+    organizations() {
+        return this.serviceFactory.organizations;
+    }
     /**
      * Get the current time in this simulated AWS environment.
      *

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn-value-adapter.d.ts

@@ -0,0 +1,6 @@
+import type { SimCfnResourceValueAdapterProperties, SimCfnServiceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Organizations
+ * Resource.
+ */
+export declare function organizationsValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnServiceValueAdapter;

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn-value-adapter.js

@@ -0,0 +1,23 @@
+import { SimCfnOrganization, SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy, } from "../../../../organizations/cfn/sim-cfn-organizations-record.js";
+import { SimOrganizationsOrganizationalUnit } from "../../../../organizations/tree/sim-organizations-node.js";
+import { SimOrganizationalUnitCfn, SimOrganizationCfn, SimOrganizationsAccountCfn, SimOrganizationsPolicyCfn, } from "./sim-organizations-cfn.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Organizations
+ * Resource.
+ */
+export function organizationsValueAdapter(properties) {
+    const { simResource } = properties;
+    if (simResource instanceof SimCfnOrganization) {
+        return new SimOrganizationCfn(simResource);
+    }
+    if (simResource instanceof SimOrganizationsOrganizationalUnit) {
+        return new SimOrganizationalUnitCfn(simResource);
+    }
+    if (simResource instanceof SimCfnOrganizationsAccount) {
+        return new SimOrganizationsAccountCfn(simResource);
+    }
+    if (simResource instanceof SimCfnOrganizationsPolicy) {
+        return new SimOrganizationsPolicyCfn(simResource);
+    }
+    return undefined;
+}

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn.d.ts

@@ -0,0 +1,66 @@
+import type { SimCfnOrganization, SimCfnOrganizationsAccount, SimCfnOrganizationsPolicy } from "../../../../organizations/cfn/sim-cfn-organizations-record.js";
+import type { SimOrganizationsOrganizationalUnit } from "../../../../organizations/tree/sim-organizations-node.js";
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SimCfnResourceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * CloudFormation-facing values for a simulated organization.
+ */
+export declare class SimOrganizationCfn implements SimCfnResourceValueAdapter {
+    private readonly organization;
+    constructor(organization: SimCfnOrganization);
+    /**
+     * AWS::Organizations::Organization Ref returns the organization id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * The attributes the AWS Resource reference lists, less the management
+     * account email, which a simulation has no address for.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for a simulated organizational unit.
+ */
+export declare class SimOrganizationalUnitCfn implements SimCfnResourceValueAdapter {
+    private readonly unit;
+    constructor(unit: SimOrganizationsOrganizationalUnit);
+    /**
+     * AWS::Organizations::OrganizationalUnit Ref returns the unit id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * Id, Arn and Name, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for an Account a template put in the
+ * organization.
+ */
+export declare class SimOrganizationsAccountCfn implements SimCfnResourceValueAdapter {
+    private readonly account;
+    constructor(account: SimCfnOrganizationsAccount);
+    /**
+     * AWS::Organizations::Account Ref returns the Account id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * The attributes the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+/**
+ * CloudFormation-facing values for a simulated service control policy.
+ */
+export declare class SimOrganizationsPolicyCfn implements SimCfnResourceValueAdapter {
+    private readonly policy;
+    constructor(policy: SimCfnOrganizationsPolicy);
+    /**
+     * AWS::Organizations::Policy Ref returns the policy id.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * Id, Arn and AwsManaged, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}

package/dist/service/cloudformation/resource/cfn/organizations/sim-organizations-cfn.js

@@ -0,0 +1,136 @@
+/**
+ * Refuse an attribute the AWS Resource reference does not list.
+ */
+function unknownAttribute(resourceType, attributeName) {
+    throw new Error(`AWS::Organizations::${resourceType} has no attribute ${attributeName}`);
+}
+/**
+ * CloudFormation-facing values for a simulated organization.
+ */
+export class SimOrganizationCfn {
+    organization;
+    constructor(organization) {
+        this.organization = organization;
+    }
+    /**
+     * AWS::Organizations::Organization Ref returns the organization id.
+     */
+    refValue() {
+        return this.organization.id;
+    }
+    /**
+     * The attributes the AWS Resource reference lists, less the management
+     * account email, which a simulation has no address for.
+     */
+    attributeValue(attributeName) {
+        const { organization } = this;
+        const values = new Map([
+            ["Id", organization.id],
+            [
+                "Arn",
+                `arn:aws:organizations::${organization.managementAccountId}:organization/${organization.id}`,
+            ],
+            ["RootId", organization.rootId],
+            ["ManagementAccountId", organization.managementAccountId],
+            [
+                "ManagementAccountArn",
+                `arn:aws:organizations::${organization.managementAccountId}:account/${organization.id}/${organization.managementAccountId}`,
+            ],
+        ]);
+        return (values.get(attributeName) ??
+            unknownAttribute("Organization", attributeName));
+    }
+}
+/**
+ * CloudFormation-facing values for a simulated organizational unit.
+ */
+export class SimOrganizationalUnitCfn {
+    unit;
+    constructor(unit) {
+        this.unit = unit;
+    }
+    /**
+     * AWS::Organizations::OrganizationalUnit Ref returns the unit id.
+     */
+    refValue() {
+        return this.unit.id;
+    }
+    /**
+     * Id, Arn and Name, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName) {
+        const { unit } = this;
+        const values = new Map([
+            ["Id", unit.id],
+            ["Arn", `arn:aws:organizations::organizational-unit/${unit.id}`],
+            ["Name", unit.name],
+        ]);
+        return (values.get(attributeName) ??
+            unknownAttribute("OrganizationalUnit", attributeName));
+    }
+}
+/**
+ * CloudFormation-facing values for an Account a template put in the
+ * organization.
+ */
+export class SimOrganizationsAccountCfn {
+    account;
+    constructor(account) {
+        this.account = account;
+    }
+    /**
+     * AWS::Organizations::Account Ref returns the Account id.
+     */
+    refValue() {
+        return this.account.accountId;
+    }
+    /**
+     * The attributes the AWS Resource reference lists.
+     */
+    attributeValue(attributeName) {
+        const { account } = this;
+        const values = new Map([
+            ["AccountId", account.accountId],
+            [
+                "Arn",
+                `arn:aws:organizations::${account.accountId}:account/${account.accountId}`,
+            ],
+            ["Email", account.email],
+            ["AccountName", account.accountName],
+            ["JoinedMethod", "CREATED"],
+            ["JoinedTimestamp", account.joinedTimestamp.toISOString()],
+            ["Status", "ACTIVE"],
+        ]);
+        return (values.get(attributeName) ?? unknownAttribute("Account", attributeName));
+    }
+}
+/**
+ * CloudFormation-facing values for a simulated service control policy.
+ */
+export class SimOrganizationsPolicyCfn {
+    policy;
+    constructor(policy) {
+        this.policy = policy;
+    }
+    /**
+     * AWS::Organizations::Policy Ref returns the policy id.
+     */
+    refValue() {
+        return this.policy.id;
+    }
+    /**
+     * Id, Arn and AwsManaged, as the AWS Resource reference lists.
+     */
+    attributeValue(attributeName) {
+        const { policy } = this;
+        const values = new Map([
+            ["Id", policy.id],
+            [
+                "Arn",
+                `arn:aws:organizations::policy/service_control_policy/${policy.id}`,
+            ],
+            ["AwsManaged", false],
+        ]);
+        return (values.get(attributeName) ?? unknownAttribute("Policy", attributeName));
+    }
+}

package/dist/service/cloudformation/resource/cfn/sim-cfn-service-value-adapters.js

@@ -18,6 +18,7 @@ import { iamValueAdapter } from "./iam/sim-iam-cfn-value-adapter.js";
 import { kinesisValueAdapter } from "./kinesis/sim-kinesis-cfn-value-adapter.js";
 import { kmsValueAdapter } from "./kms/sim-kms-cfn-value-adapter.js";
 import { lambdaValueAdapter } from "./lambda/sim-lambda-cfn-value-adapter.js";
+import { organizationsValueAdapter } from "./organizations/sim-organizations-cfn-value-adapter.js";
 import { personalizeValueAdapter } from "./personalize/sim-personalize-cfn-value-adapter.js";
 import { route53ValueAdapter } from "./route53/sim-route53-cfn-value-adapter.js";
 import { s3ValueAdapter } from "./s3/sim-s3-cfn-value-adapter.js";
@@ -60,6 +61,7 @@ export const simCfnServiceValueAdapters = [
     kinesisValueAdapter,
     kmsValueAdapter,
     lambdaValueAdapter,
+    organizationsValueAdapter,
     personalizeValueAdapter,
     route53ValueAdapter,
     s3ValueAdapter,

package/dist/service/cloudformation/resource/resolve/service/sim-cfn-service-factories.js

@@ -1,4 +1,5 @@
 import { SimCfnCfnResourceFactory } from "../../factory/sim-cfn-cfn-resource-factory.js";
+import { SimOrganizationsCfnResourceFactory } from "../../../../organizations/cfn/sim-organizations-cfn-resource-factory.js";
 /**
  * Certificates arrive under two service names. `AWS::CertificateManager::*` is
  * the real one, and `AWS::ACM::*` is the shorthand some templates use, so both
@@ -34,6 +35,12 @@ export const simCfnServiceResourceFactories = new Map([
         "CloudFormation",
         () => new SimCfnCfnResourceFactory(),
     ],
+    // An organization spans Accounts, so this factory reads the one on the
+    // creation context rather than the Account and Region scope it deploys into.
+    [
+        "Organizations",
+        () => new SimOrganizationsCfnResourceFactory(),
+    ],
     [
         "CloudFront",
         (scopedAws) => scopedAws.cloudFront().cfnResourceFactory(),

package/dist/service/cloudfront/command/create-distribution/create-distribution-authorizer.js

@@ -28,6 +28,7 @@ export class CreateDistributionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: CreateDistributionAuthorizer.action,
                 resource: CreateDistributionAuthorizer.resource,
             });

package/dist/service/cloudfront/command/create-function/create-function-authorizer.js

@@ -26,6 +26,7 @@ export class CreateFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: CreateFunctionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/command/delete-distribution/delete-distribution-authorizer.js

@@ -31,6 +31,7 @@ export class DeleteDistributionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteDistributionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/command/delete-function/delete-function-authorizer.js

@@ -27,6 +27,7 @@ export class DeleteFunctionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteFunctionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/command/get-distribution/get-distribution-authorizer.js

@@ -27,6 +27,7 @@ export class GetDistributionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetDistributionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/command/update-distribution/update-distribution-authorizer.js

@@ -27,6 +27,7 @@ export class UpdateDistributionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: UpdateDistributionAuthorizer.action,
                 resource,
             });

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.js

@@ -18,6 +18,7 @@ export function authorizeEdgeAssociation(iam, functionArn, caller) {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource: functionArn,
             });

package/dist/service/cloudfront/key-value-store/sim-cf-key-value-store-access.js

@@ -25,6 +25,7 @@ export class SimCfKeyValueStoreAccess {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/cloudwatch/command/authorize/sim-cloudwatch-decide.js

@@ -21,6 +21,7 @@ export function decideSimCloudWatchRequest(iam, request) {
     if (decision.isDenied) {
         throw new SimIamAccessDenied({
             principal: decision.caller.principal,
+            reason: decision.denialReason,
             action,
             resource,
         });

package/dist/service/cognito/command/authorize/sim-cognito-authorizer.js

@@ -45,6 +45,7 @@ export class SimCognitoAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -56,6 +56,7 @@ export class SimDynamoDbAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/firehose/command/authorize/sim-firehose-authorizer.js

@@ -39,6 +39,7 @@ export class SimFirehoseAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/glue/command/authorize/sim-glue-authorize-resources.js

@@ -14,6 +14,7 @@ export function authorizeSimGlueResources(properties) {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/iam/authorize/allow/sim-iam-policy-evaluation.d.ts

@@ -0,0 +1,45 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamPolicyDocumentParser } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamPolicyStatementMatcher } from "../match/sim-iam-policy-statement-matcher.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamAllowStatements } from "./sim-iam-allow-statements.js";
+import type { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+interface SimIamPolicyEvaluationProperties {
+    readonly policies: readonly SimIamAuthZPolicySource[];
+    readonly policyDocumentParser: SimIamPolicyDocumentParser;
+    readonly statementMatcher: SimIamPolicyStatementMatcher;
+}
+/**
+ * The statements of the identity and resource policies that matched one
+ * request.
+ *
+ * These are the two sides that can allow a request, so they are read together
+ * and kept apart by side afterwards. Which of them has to allow for the
+ * request to go ahead belongs to the allow requirement rather than here.
+ */
+export declare class SimIamPolicyEvaluation {
+    private readonly explicitDenyStatementRecords;
+    private readonly allows;
+    constructor(properties: SimIamPolicyEvaluationProperties);
+    /**
+     * Whether a matching Deny statement was found.
+     */
+    get isExplicitDeny(): boolean;
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * The matching Allow statements, kept per side.
+     */
+    get allowStatements(): SimIamAllowStatements;
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides(): SimIamAllowSides;
+    /**
+     * Record the matching statements of one policy.
+     */
+    private evaluate;
+}
+export {};

package/dist/service/iam/authorize/allow/sim-iam-policy-evaluation.js

@@ -0,0 +1,59 @@
+import { SimIamAllowStatements } from "./sim-iam-allow-statements.js";
+/**
+ * The statements of the identity and resource policies that matched one
+ * request.
+ *
+ * These are the two sides that can allow a request, so they are read together
+ * and kept apart by side afterwards. Which of them has to allow for the
+ * request to go ahead belongs to the allow requirement rather than here.
+ */
+export class SimIamPolicyEvaluation {
+    explicitDenyStatementRecords = [];
+    allows = new SimIamAllowStatements();
+    constructor(properties) {
+        for (const policy of properties.policies) {
+            this.evaluate(policy, properties);
+        }
+    }
+    /**
+     * Whether a matching Deny statement was found.
+     */
+    get isExplicitDeny() {
+        return this.explicitDenyStatementRecords.length > 0;
+    }
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements() {
+        return this.explicitDenyStatementRecords;
+    }
+    /**
+     * The matching Allow statements, kept per side.
+     */
+    get allowStatements() {
+        return this.allows;
+    }
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides() {
+        return this.allows.sides;
+    }
+    /**
+     * Record the matching statements of one policy.
+     */
+    evaluate(policy, properties) {
+        const parsedPolicy = properties.policyDocumentParser.parse(policy.document);
+        for (const statement of parsedPolicy.statements) {
+            const principal = properties.statementMatcher.matches(policy, statement);
+            if (!principal.matched) {
+                continue;
+            }
+            if (statement.effect === "Deny") {
+                this.explicitDenyStatementRecords.push(statement.source);
+                continue;
+            }
+            this.allows.record(policy, statement.source, principal);
+        }
+    }
+}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -8,6 +8,7 @@ import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-sou
 import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
+import type { SimIamServiceControlPolicyResolver } from "../scp/sim-iam-scp-resolver.js";
 export interface SimIamResourcePolicyInput {
     readonly document: SimIamPolicyDocument;
     readonly sourceType?: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
@@ -77,6 +78,11 @@ interface SimIamAuthZContextBuilderProperties {
      * of a cross-Account request.
      */
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    /**
+     * Resolves the service control policies in force for an Account. A
+     * standalone SimIam has no organization around it and leaves this out.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
@@ -99,16 +105,21 @@ interface SimIamAuthZContextBuilderProperties {
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
  *
- * Permissions boundaries, session policies, SCPs, and role trust-policy
- * assume-role semantics are not part of this context assembly path yet. Add
- * those concerns through separate policy-source builders so this class stays
- * focused on composing the authorization request.
+ * Service control policies come from the organization the caller's Account
+ * belongs to, read by SimIamAuthZScpSourceBuilder. They filter and grant
+ * nothing, so they travel apart from the sides that can allow a request.
+ *
+ * Permissions boundaries, session policies, and role trust-policy assume-role
+ * semantics are not part of this context assembly path yet. Add those concerns
+ * through separate policy-source builders so this class stays focused on
+ * composing the authorization request.
  */
 export declare class SimIamAuthZContextBuilder {
     private readonly callerContextBuilder;
     private readonly identityPolicyCoordinator;
     private readonly callerAccountResolver;
     private readonly allowRequirement;
+    private readonly scpSourceBuilder;
     constructor(properties: SimIamAuthZContextBuilderProperties);
     /**
      * Build the context consumed by SimIamAuthorizer.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -3,6 +3,7 @@ import { SimIamCallerAccountResolver } from "../caller-account/sim-iam-caller-ac
 import { SimIamAuthZAllowRequirement } from "./sim-iam-auth-z-allow-requirement.js";
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
 import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
+import { SimIamAuthZScpSourceBuilder } from "./sim-iam-auth-z-scp-source-builder.js";
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
  *
@@ -24,16 +25,21 @@ import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-contex
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
  *
- * Permissions boundaries, session policies, SCPs, and role trust-policy
- * assume-role semantics are not part of this context assembly path yet. Add
- * those concerns through separate policy-source builders so this class stays
- * focused on composing the authorization request.
+ * Service control policies come from the organization the caller's Account
+ * belongs to, read by SimIamAuthZScpSourceBuilder. They filter and grant
+ * nothing, so they travel apart from the sides that can allow a request.
+ *
+ * Permissions boundaries, session policies, and role trust-policy assume-role
+ * semantics are not part of this context assembly path yet. Add those concerns
+ * through separate policy-source builders so this class stays focused on
+ * composing the authorization request.
  */
 export class SimIamAuthZContextBuilder {
     callerContextBuilder;
     identityPolicyCoordinator;
     callerAccountResolver;
     allowRequirement = new SimIamAuthZAllowRequirement();
+    scpSourceBuilder;
     constructor(properties) {
         this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
@@ -45,6 +51,10 @@ export class SimIamAuthZContextBuilder {
             accountId: properties.accountId,
             iamResolver: properties.iamResolver,
         });
+        this.scpSourceBuilder = new SimIamAuthZScpSourceBuilder({
+            accountId: properties.accountId,
+            scpResolver: properties.scpResolver,
+        });
     }
     /**
      * Build the context consumed by SimIamAuthorizer.
@@ -58,6 +68,7 @@ export class SimIamAuthZContextBuilder {
                 ...callerAccount.identityPolicies,
             ],
             resourcePolicies: this.resourcePolicySources(input),
+            serviceControlPolicies: this.scpSourceBuilder.build(callerContext.caller),
             allowRequirement: this.allowRequirement.resolve(callerAccount, input.requiresResourcePolicyAllow),
             action: input.action,
             resource: input.resource,