@kensio/yulin 1.20.12 → 1.20.13

package/dist/service/iam/authorize/allow/sim-iam-policy-evaluation.d.ts

@@ -0,0 +1,45 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamPolicyDocumentParser } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamPolicyStatementMatcher } from "../match/sim-iam-policy-statement-matcher.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamAllowStatements } from "./sim-iam-allow-statements.js";
+import type { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+interface SimIamPolicyEvaluationProperties {
+    readonly policies: readonly SimIamAuthZPolicySource[];
+    readonly policyDocumentParser: SimIamPolicyDocumentParser;
+    readonly statementMatcher: SimIamPolicyStatementMatcher;
+}
+/**
+ * The statements of the identity and resource policies that matched one
+ * request.
+ *
+ * These are the two sides that can allow a request, so they are read together
+ * and kept apart by side afterwards. Which of them has to allow for the
+ * request to go ahead belongs to the allow requirement rather than here.
+ */
+export declare class SimIamPolicyEvaluation {
+    private readonly explicitDenyStatementRecords;
+    private readonly allows;
+    constructor(properties: SimIamPolicyEvaluationProperties);
+    /**
+     * Whether a matching Deny statement was found.
+     */
+    get isExplicitDeny(): boolean;
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * The matching Allow statements, kept per side.
+     */
+    get allowStatements(): SimIamAllowStatements;
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides(): SimIamAllowSides;
+    /**
+     * Record the matching statements of one policy.
+     */
+    private evaluate;
+}
+export {};

package/dist/service/iam/authorize/allow/sim-iam-policy-evaluation.js

@@ -0,0 +1,59 @@
+import { SimIamAllowStatements } from "./sim-iam-allow-statements.js";
+/**
+ * The statements of the identity and resource policies that matched one
+ * request.
+ *
+ * These are the two sides that can allow a request, so they are read together
+ * and kept apart by side afterwards. Which of them has to allow for the
+ * request to go ahead belongs to the allow requirement rather than here.
+ */
+export class SimIamPolicyEvaluation {
+    explicitDenyStatementRecords = [];
+    allows = new SimIamAllowStatements();
+    constructor(properties) {
+        for (const policy of properties.policies) {
+            this.evaluate(policy, properties);
+        }
+    }
+    /**
+     * Whether a matching Deny statement was found.
+     */
+    get isExplicitDeny() {
+        return this.explicitDenyStatementRecords.length > 0;
+    }
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements() {
+        return this.explicitDenyStatementRecords;
+    }
+    /**
+     * The matching Allow statements, kept per side.
+     */
+    get allowStatements() {
+        return this.allows;
+    }
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides() {
+        return this.allows.sides;
+    }
+    /**
+     * Record the matching statements of one policy.
+     */
+    evaluate(policy, properties) {
+        const parsedPolicy = properties.policyDocumentParser.parse(policy.document);
+        for (const statement of parsedPolicy.statements) {
+            const principal = properties.statementMatcher.matches(policy, statement);
+            if (!principal.matched) {
+                continue;
+            }
+            if (statement.effect === "Deny") {
+                this.explicitDenyStatementRecords.push(statement.source);
+                continue;
+            }
+            this.allows.record(policy, statement.source, principal);
+        }
+    }
+}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -8,6 +8,7 @@ import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-sou
 import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
+import type { SimIamServiceControlPolicyResolver } from "../scp/sim-iam-scp-resolver.js";
 export interface SimIamResourcePolicyInput {
     readonly document: SimIamPolicyDocument;
     readonly sourceType?: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
@@ -77,6 +78,11 @@ interface SimIamAuthZContextBuilderProperties {
      * of a cross-Account request.
      */
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    /**
+     * Resolves the service control policies in force for an Account. A
+     * standalone SimIam has no organization around it and leaves this out.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
@@ -99,16 +105,21 @@ interface SimIamAuthZContextBuilderProperties {
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
  *
- * Permissions boundaries, session policies, SCPs, and role trust-policy
- * assume-role semantics are not part of this context assembly path yet. Add
- * those concerns through separate policy-source builders so this class stays
- * focused on composing the authorization request.
+ * Service control policies come from the organization the caller's Account
+ * belongs to, read by SimIamAuthZScpSourceBuilder. They filter and grant
+ * nothing, so they travel apart from the sides that can allow a request.
+ *
+ * Permissions boundaries, session policies, and role trust-policy assume-role
+ * semantics are not part of this context assembly path yet. Add those concerns
+ * through separate policy-source builders so this class stays focused on
+ * composing the authorization request.
  */
 export declare class SimIamAuthZContextBuilder {
     private readonly callerContextBuilder;
     private readonly identityPolicyCoordinator;
     private readonly callerAccountResolver;
     private readonly allowRequirement;
+    private readonly scpSourceBuilder;
     constructor(properties: SimIamAuthZContextBuilderProperties);
     /**
      * Build the context consumed by SimIamAuthorizer.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -3,6 +3,7 @@ import { SimIamCallerAccountResolver } from "../caller-account/sim-iam-caller-ac
 import { SimIamAuthZAllowRequirement } from "./sim-iam-auth-z-allow-requirement.js";
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
 import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
+import { SimIamAuthZScpSourceBuilder } from "./sim-iam-auth-z-scp-source-builder.js";
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
  *
@@ -24,16 +25,21 @@ import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-contex
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
  *
- * Permissions boundaries, session policies, SCPs, and role trust-policy
- * assume-role semantics are not part of this context assembly path yet. Add
- * those concerns through separate policy-source builders so this class stays
- * focused on composing the authorization request.
+ * Service control policies come from the organization the caller's Account
+ * belongs to, read by SimIamAuthZScpSourceBuilder. They filter and grant
+ * nothing, so they travel apart from the sides that can allow a request.
+ *
+ * Permissions boundaries, session policies, and role trust-policy assume-role
+ * semantics are not part of this context assembly path yet. Add those concerns
+ * through separate policy-source builders so this class stays focused on
+ * composing the authorization request.
  */
 export class SimIamAuthZContextBuilder {
     callerContextBuilder;
     identityPolicyCoordinator;
     callerAccountResolver;
     allowRequirement = new SimIamAuthZAllowRequirement();
+    scpSourceBuilder;
     constructor(properties) {
         this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
@@ -45,6 +51,10 @@ export class SimIamAuthZContextBuilder {
             accountId: properties.accountId,
             iamResolver: properties.iamResolver,
         });
+        this.scpSourceBuilder = new SimIamAuthZScpSourceBuilder({
+            accountId: properties.accountId,
+            scpResolver: properties.scpResolver,
+        });
     }
     /**
      * Build the context consumed by SimIamAuthorizer.
@@ -58,6 +68,7 @@ export class SimIamAuthZContextBuilder {
                 ...callerAccount.identityPolicies,
             ],
             resourcePolicies: this.resourcePolicySources(input),
+            serviceControlPolicies: this.scpSourceBuilder.build(callerContext.caller),
             allowRequirement: this.allowRequirement.resolve(callerAccount, input.requiresResourcePolicyAllow),
             action: input.action,
             resource: input.resource,

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts

@@ -2,7 +2,7 @@ import type { SimArn } from "../../../aws/arn.js";
 import type { SimIamConditionValue, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
-export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session";
+export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session" | "service-control";
 export interface SimIamAuthZPolicySource {
     readonly sourceType: SimIamAuthZPolicySourceType;
     readonly document: SimIamPolicyDocument;
@@ -16,6 +16,29 @@ export interface SimIamAuthZPolicySource {
 export type SimIamAuthZResourcePolicySource = Omit<SimIamAuthZPolicySource, "sourceType"> & {
     readonly sourceType: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
 };
+/**
+ * The service control policies attached at one level above the caller's
+ * Account, which is the root, an organizational unit, or the Account itself.
+ *
+ * Each level has to allow the action on its own. A level allowing nothing
+ * denies the request whatever another level allows, which is why the sources
+ * stay grouped rather than being read as one list.
+ */
+export interface SimIamAuthZServiceControlPolicyLevel {
+    readonly nodeName: string;
+    readonly sources: readonly SimIamAuthZPolicySource[];
+}
+/**
+ * The service control policies in force for an authorization request.
+ *
+ * `applies` is a separate fact from how many levels there are. An Account
+ * inside an organization holding no policy allows nothing, while an Account
+ * outside every organization is unrestricted, and both can carry no levels.
+ */
+export interface SimIamAuthZServiceControlPolicies {
+    readonly applies: boolean;
+    readonly levels: readonly SimIamAuthZServiceControlPolicyLevel[];
+}
 export interface SimIamAuthZContext {
     /**
      * Identity-based policies that grant permissions to the principal.
@@ -29,6 +52,13 @@ export interface SimIamAuthZContext {
      * Resource policies are not gathered from IAM's managed policy store.
      */
     readonly resourcePolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * Service control policies in force for the caller's Account.
+     *
+     * These filter what the Account's principals may do and grant nothing, so
+     * they are kept apart from the two sides that can allow a request.
+     */
+    readonly serviceControlPolicies: SimIamAuthZServiceControlPolicies;
     /**
      * How an Allow from each policy side combines into the final decision.
      *

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js

@@ -6,6 +6,7 @@ import { SimIamEitherSideAllowRequirement } from "../allow/sim-iam-allow-require
 export const simIamAuthZContextFactory = new StaticFactory({
     identityPolicies: [],
     resourcePolicies: [],
+    serviceControlPolicies: { applies: false, levels: [] },
     allowRequirement: new SimIamEitherSideAllowRequirement(),
     action: "s3:GetObject",
     resource: "arn:aws:s3:::test-bucket/test-key",

package/dist/service/iam/authorize/context/sim-iam-auth-z-scp-source-builder.d.ts

@@ -0,0 +1,46 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamServiceControlPolicyResolver } from "../scp/sim-iam-scp-resolver.js";
+import type { SimIamAuthZServiceControlPolicies } from "./sim-iam-auth-z-context.js";
+interface SimIamAuthZScpSourceBuilderProperties {
+    /**
+     * The Account whose IAM is evaluating the request.
+     */
+    readonly accountId: SimAwsAccountId;
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
+}
+/**
+ * Finds the service control policies that apply to one request.
+ *
+ * An SCP belongs to the caller's own Account, which is the Account whose
+ * principal is asking. For a request within one Account that is the Account
+ * evaluating it. For a cross-Account request it is the other one, because AWS
+ * filters a principal by the organization its own account sits in and leaves
+ * the resource's organization to say nothing about it.
+ *
+ * A caller with no Account in its ARN, which means a service principal or an
+ * anonymous request, belongs to no Account and is subject to no SCP.
+ */
+export declare class SimIamAuthZScpSourceBuilder {
+    /**
+     * What a caller no organization reaches is subject to.
+     */
+    private static readonly unrestricted;
+    private readonly accountId;
+    private readonly scpResolver?;
+    constructor(properties: SimIamAuthZScpSourceBuilderProperties);
+    /**
+     * The service control policies in force for a resolved caller.
+     */
+    build(caller: SimAwsResolvedCaller): SimIamAuthZServiceControlPolicies;
+    /**
+     * The Account whose organization decides this request.
+     *
+     * A caller identified only by a service name or by nothing at all has no
+     * Account of its own. The Account root fallback IAM applies to a request
+     * with no caller carries this Account's id, so a CloudFormation deployment
+     * is filtered like any other principal in it.
+     */
+    private callerAccountId;
+}
+export {};

package/dist/service/iam/authorize/context/sim-iam-auth-z-scp-source-builder.js

@@ -0,0 +1,71 @@
+import { isSimAwsAccountId } from "../../../aws/sim-aws-account.js";
+/**
+ * Finds the service control policies that apply to one request.
+ *
+ * An SCP belongs to the caller's own Account, which is the Account whose
+ * principal is asking. For a request within one Account that is the Account
+ * evaluating it. For a cross-Account request it is the other one, because AWS
+ * filters a principal by the organization its own account sits in and leaves
+ * the resource's organization to say nothing about it.
+ *
+ * A caller with no Account in its ARN, which means a service principal or an
+ * anonymous request, belongs to no Account and is subject to no SCP.
+ */
+export class SimIamAuthZScpSourceBuilder {
+    /**
+     * What a caller no organization reaches is subject to.
+     */
+    static unrestricted = {
+        applies: false,
+        levels: [],
+    };
+    accountId;
+    scpResolver;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.scpResolver = properties.scpResolver;
+    }
+    /**
+     * The service control policies in force for a resolved caller.
+     */
+    build(caller) {
+        const scpResolver = this.scpResolver;
+        if (scpResolver === undefined) {
+            return SimIamAuthZScpSourceBuilder.unrestricted;
+        }
+        const accountId = this.callerAccountId(caller);
+        if (accountId === undefined) {
+            return SimIamAuthZScpSourceBuilder.unrestricted;
+        }
+        const set = scpResolver.serviceControlPolicySetFor(accountId);
+        return {
+            applies: set.applies,
+            levels: set.levels.map((level) => ({
+                nodeName: level.nodeName,
+                sources: level.policies.map((policy) => ({
+                    sourceType: "service-control",
+                    document: policy.document,
+                    policyName: policy.policyName,
+                })),
+            })),
+        };
+    }
+    /**
+     * The Account whose organization decides this request.
+     *
+     * A caller identified only by a service name or by nothing at all has no
+     * Account of its own. The Account root fallback IAM applies to a request
+     * with no caller carries this Account's id, so a CloudFormation deployment
+     * is filtered like any other principal in it.
+     */
+    callerAccountId(caller) {
+        if (caller.principal.kind === "anonymous" || caller.service !== undefined) {
+            return undefined;
+        }
+        const callerAccountId = caller.accountId;
+        if (callerAccountId === undefined) {
+            return this.accountId;
+        }
+        return isSimAwsAccountId(callerAccountId) ? callerAccountId : undefined;
+    }
+}

package/dist/service/iam/authorize/scp/sim-iam-scp-gate.d.ts

@@ -0,0 +1,96 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamPolicyDocumentParser } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamPolicyStatementMatcher } from "../match/sim-iam-policy-statement-matcher.js";
+import type { SimIamAuthZServiceControlPolicies } from "../context/sim-iam-auth-z-context.js";
+import { SimIamPolicyDecisionValue } from "../sim-iam-decision-value.js";
+interface SimIamScpGateProperties {
+    readonly serviceControlPolicies: SimIamAuthZServiceControlPolicies;
+    readonly policyDocumentParser: SimIamPolicyDocumentParser;
+    readonly statementMatcher: SimIamPolicyStatementMatcher;
+}
+/**
+ * What an Account's service control policies say about one request.
+ *
+ * An SCP is a filter on the permissions an Account's principals can be given.
+ * It grants nothing, so this runs as a gate in front of the identity and
+ * resource policy evaluation instead of contributing Allows to it. The rules
+ * are the ones AWS applies at the Account boundary:
+ *
+ * - a matching Deny at any level ends the request;
+ * - every level between the root and the Account has to produce a matching
+ *   Allow of its own.
+ *
+ * The second rule is what makes the levels worth keeping apart. A root
+ * allowing S3 and an organizational unit allowing DynamoDB leave an Account
+ * beneath them able to do neither, because each level is asked separately.
+ *
+ * An Account outside any organization's reach is unrestricted, and this gate
+ * stands open for it. An Account inside one that holds no policy is a
+ * different case: nothing allows it anything, so the gate is shut.
+ */
+export declare class SimIamScpGate {
+    private readonly applies;
+    private readonly denyStatementRecords;
+    private readonly allowStatementRecords;
+    private readonly unallowedLevelNames;
+    constructor(properties: SimIamScpGateProperties);
+    /**
+     * Whether any service control policy applied to this request at all.
+     */
+    get isApplied(): boolean;
+    /**
+     * Whether an attached policy explicitly denied the request.
+     */
+    get isExplicitDeny(): boolean;
+    /**
+     * Whether a level left the request unallowed.
+     *
+     * A Deny is reported by `isExplicitDeny` and leaves this false, so the two
+     * name different denials and a reader can tell them apart.
+     */
+    get isImplicitDeny(): boolean;
+    /**
+     * Whether the service control policies denied the request either way.
+     */
+    get isDenied(): boolean;
+    /**
+     * The decision this gate forces, where it forces one.
+     *
+     * Undefined leaves the request to the identity and resource policies, which
+     * is what an open gate means.
+     */
+    get value(): SimIamPolicyDecisionValue | undefined;
+    /**
+     * Matching Deny statements from the attached policies.
+     */
+    get denyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from the attached policies, across every level.
+     */
+    get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * The levels that allowed nothing matching the request, root first.
+     *
+     * This is what a test reads to find which node in the organization is in the
+     * way, which is the part of an SCP denial AWS makes hardest to work out.
+     */
+    get unallowedLevels(): readonly string[];
+    /**
+     * How an AWS error explains this denial, if this gate is what denied it.
+     *
+     * The wording follows the AccessDenied messages AWS returns for the two
+     * cases, so a test asserting on the message reads what it would in a real
+     * account.
+     */
+    denialReason(action: string): string | undefined;
+    /**
+     * Record what one level of the organization said.
+     */
+    private evaluateLevel;
+    /**
+     * Record the matching statements of one attached policy, and say whether it
+     * allowed the request.
+     */
+    private evaluatePolicy;
+}
+export {};

package/dist/service/iam/authorize/scp/sim-iam-scp-gate.js

@@ -0,0 +1,148 @@
+import { SimIamPolicyDecisionValue } from "../sim-iam-decision-value.js";
+/**
+ * What an Account's service control policies say about one request.
+ *
+ * An SCP is a filter on the permissions an Account's principals can be given.
+ * It grants nothing, so this runs as a gate in front of the identity and
+ * resource policy evaluation instead of contributing Allows to it. The rules
+ * are the ones AWS applies at the Account boundary:
+ *
+ * - a matching Deny at any level ends the request;
+ * - every level between the root and the Account has to produce a matching
+ *   Allow of its own.
+ *
+ * The second rule is what makes the levels worth keeping apart. A root
+ * allowing S3 and an organizational unit allowing DynamoDB leave an Account
+ * beneath them able to do neither, because each level is asked separately.
+ *
+ * An Account outside any organization's reach is unrestricted, and this gate
+ * stands open for it. An Account inside one that holds no policy is a
+ * different case: nothing allows it anything, so the gate is shut.
+ */
+export class SimIamScpGate {
+    applies;
+    denyStatementRecords = [];
+    allowStatementRecords = [];
+    unallowedLevelNames = [];
+    constructor(properties) {
+        this.applies = properties.serviceControlPolicies.applies;
+        for (const level of properties.serviceControlPolicies.levels) {
+            this.evaluateLevel(level, properties);
+        }
+        if (this.applies && properties.serviceControlPolicies.levels.length === 0) {
+            this.unallowedLevelNames.push("the organization");
+        }
+    }
+    /**
+     * Whether any service control policy applied to this request at all.
+     */
+    get isApplied() {
+        return this.applies;
+    }
+    /**
+     * Whether an attached policy explicitly denied the request.
+     */
+    get isExplicitDeny() {
+        return this.denyStatementRecords.length > 0;
+    }
+    /**
+     * Whether a level left the request unallowed.
+     *
+     * A Deny is reported by `isExplicitDeny` and leaves this false, so the two
+     * name different denials and a reader can tell them apart.
+     */
+    get isImplicitDeny() {
+        return (this.applies &&
+            !this.isExplicitDeny &&
+            this.unallowedLevelNames.length > 0);
+    }
+    /**
+     * Whether the service control policies denied the request either way.
+     */
+    get isDenied() {
+        return this.isExplicitDeny || this.isImplicitDeny;
+    }
+    /**
+     * The decision this gate forces, where it forces one.
+     *
+     * Undefined leaves the request to the identity and resource policies, which
+     * is what an open gate means.
+     */
+    get value() {
+        if (this.isExplicitDeny) {
+            return SimIamPolicyDecisionValue.ExplicitDeny;
+        }
+        return this.isImplicitDeny
+            ? SimIamPolicyDecisionValue.ImplicitDeny
+            : undefined;
+    }
+    /**
+     * Matching Deny statements from the attached policies.
+     */
+    get denyStatements() {
+        return this.denyStatementRecords;
+    }
+    /**
+     * Matching Allow statements from the attached policies, across every level.
+     */
+    get allowStatements() {
+        return this.allowStatementRecords;
+    }
+    /**
+     * The levels that allowed nothing matching the request, root first.
+     *
+     * This is what a test reads to find which node in the organization is in the
+     * way, which is the part of an SCP denial AWS makes hardest to work out.
+     */
+    get unallowedLevels() {
+        return this.unallowedLevelNames;
+    }
+    /**
+     * How an AWS error explains this denial, if this gate is what denied it.
+     *
+     * The wording follows the AccessDenied messages AWS returns for the two
+     * cases, so a test asserting on the message reads what it would in a real
+     * account.
+     */
+    denialReason(action) {
+        if (this.isExplicitDeny) {
+            return "with an explicit deny in a service control policy";
+        }
+        if (this.isImplicitDeny) {
+            return `because no service control policy allows the ${action} action`;
+        }
+        return undefined;
+    }
+    /**
+     * Record what one level of the organization said.
+     */
+    evaluateLevel(level, properties) {
+        let allowed = false;
+        for (const policy of level.sources) {
+            allowed = this.evaluatePolicy(policy, properties) || allowed;
+        }
+        if (!allowed) {
+            this.unallowedLevelNames.push(level.nodeName);
+        }
+    }
+    /**
+     * Record the matching statements of one attached policy, and say whether it
+     * allowed the request.
+     */
+    evaluatePolicy(policy, properties) {
+        const parsedPolicy = properties.policyDocumentParser.parse(policy.document);
+        let allowed = false;
+        for (const statement of parsedPolicy.statements) {
+            if (!properties.statementMatcher.matches(policy, statement).matched) {
+                continue;
+            }
+            if (statement.effect === "Deny") {
+                this.denyStatementRecords.push(statement.source);
+                continue;
+            }
+            this.allowStatementRecords.push(statement.source);
+            allowed = true;
+        }
+        return allowed;
+    }
+}