@kensio/yulin 1.20.12 → 1.20.13

package/dist/service/organizations/tree/sim-organizations-node.d.ts

@@ -0,0 +1,57 @@
+import type { Brand } from "../../../util/brand.type.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+export type SimOrganizationsRootId = Brand<string, "SimOrganizationsRootId">;
+export type SimOrganizationsOrganizationalUnitId = Brand<string, "SimOrganizationsOrganizationalUnitId">;
+/**
+ * Anything a service control policy can hang on.
+ *
+ * AWS attaches a policy to the root, to an organizational unit, or to one
+ * account, and an account inherits every policy on the path down to it.
+ */
+export type SimOrganizationsNodeId = SimOrganizationsRootId | SimOrganizationsOrganizationalUnitId | SimAwsAccountId;
+/**
+ * Generate an AWS-shaped organization root id.
+ */
+export declare function makeSimOrganizationsRootId(): SimOrganizationsRootId;
+/**
+ * Generate an AWS-shaped organizational unit id.
+ */
+export declare function makeSimOrganizationsOrganizationalUnitId(rootId: SimOrganizationsRootId): SimOrganizationsOrganizationalUnitId;
+/**
+ * Generate an AWS-shaped service control policy id.
+ */
+export declare function makeSimOrganizationsPolicyId(): string;
+/**
+ * An organizational unit in a simulated organization.
+ *
+ * This is the handle a test holds on to. Pass it where a policy is attached or
+ * an Account is moved, so neither reads back as a bare string.
+ */
+export declare class SimOrganizationsOrganizationalUnit {
+    readonly id: SimOrganizationsOrganizationalUnitId;
+    readonly name: string;
+    readonly parentId: SimOrganizationsNodeId;
+    constructor(id: SimOrganizationsOrganizationalUnitId, name: string, parentId: SimOrganizationsNodeId);
+}
+/**
+ * The root of a simulated organization.
+ */
+export declare class SimOrganizationsRoot {
+    readonly id: SimOrganizationsRootId;
+    readonly name = "Root";
+    constructor(id: SimOrganizationsRootId);
+}
+/**
+ * Somewhere a policy can be attached, given as a handle or as an id.
+ *
+ * An id is what a CloudFormation template carries, since a `Ref` to a unit
+ * resolves to the id AWS gave it rather than to anything holding a reference.
+ */
+export type SimOrganizationsTarget = SimOrganizationsRoot | SimOrganizationsOrganizationalUnit | string;
+/**
+ * Whether an id names the root or an organizational unit.
+ *
+ * AWS ids carry their own kind in a prefix, and an Account id is twelve
+ * digits, so nothing here has to guess which of the two a string is.
+ */
+export declare function isSimOrganizationsUnitId(value: string): boolean;

package/dist/service/organizations/tree/sim-organizations-node.js

@@ -0,0 +1,58 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Generate an AWS-shaped organization root id.
+ */
+export function makeSimOrganizationsRootId() {
+    return `r-${faker.string.alphanumeric({
+        length: 4,
+        casing: "lower",
+    })}`;
+}
+/**
+ * Generate an AWS-shaped organizational unit id.
+ */
+export function makeSimOrganizationsOrganizationalUnitId(rootId) {
+    const suffix = faker.string.alphanumeric({ length: 8, casing: "lower" });
+    return `ou-${rootId.slice(2)}-${suffix}`;
+}
+/**
+ * Generate an AWS-shaped service control policy id.
+ */
+export function makeSimOrganizationsPolicyId() {
+    return `p-${faker.string.alphanumeric({ length: 8, casing: "lower" })}`;
+}
+/**
+ * An organizational unit in a simulated organization.
+ *
+ * This is the handle a test holds on to. Pass it where a policy is attached or
+ * an Account is moved, so neither reads back as a bare string.
+ */
+export class SimOrganizationsOrganizationalUnit {
+    id;
+    name;
+    parentId;
+    constructor(id, name, parentId) {
+        this.id = id;
+        this.name = name;
+        this.parentId = parentId;
+    }
+}
+/**
+ * The root of a simulated organization.
+ */
+export class SimOrganizationsRoot {
+    id;
+    name = "Root";
+    constructor(id) {
+        this.id = id;
+    }
+}
+/**
+ * Whether an id names the root or an organizational unit.
+ *
+ * AWS ids carry their own kind in a prefix, and an Account id is twelve
+ * digits, so nothing here has to guess which of the two a string is.
+ */
+export function isSimOrganizationsUnitId(value) {
+    return value.startsWith("r-") || value.startsWith("ou-");
+}

package/dist/service/organizations/tree/sim-organizations-tree.d.ts

@@ -0,0 +1,91 @@
+import { SimOrganizationsOrganizationalUnit, type SimOrganizationsNodeId, SimOrganizationsRoot } from "./sim-organizations-node.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+/**
+ * Thrown for an organizational unit this organization has never seen.
+ */
+export declare class SimOrganizationsUnknownNode extends Error {
+    constructor(nodeId: string);
+}
+/**
+ * Where the Accounts and organizational units of one simulated organization
+ * sit relative to each other.
+ *
+ * The tree answers one question for authorization: which nodes lie on the path
+ * from the root down to an Account. Every policy on that path applies to the
+ * Account, which is what makes an organizational unit worth modelling at all.
+ *
+ * An Account joins the organization the moment it is named, whether by being
+ * moved into a unit or by having a policy attached to it. An Account never
+ * named sits outside the organization and is unrestricted.
+ */
+export declare class SimOrganizationsTree {
+    readonly root: SimOrganizationsRoot;
+    private readonly organizationalUnits;
+    private readonly accountParents;
+    /**
+     * Create an organizational unit, under the root unless another unit is
+     * named as its parent.
+     */
+    createOrganizationalUnit(name: string, parentId?: SimOrganizationsNodeId): SimOrganizationsOrganizationalUnit;
+    /**
+     * Place an Account under a node, joining the organization if it was outside
+     * it.
+     */
+    placeAccount(accountId: SimAwsAccountId, parentId?: SimOrganizationsNodeId): void;
+    /**
+     * Take an Account out of the organization.
+     */
+    removeAccount(accountId: SimAwsAccountId): void;
+    /**
+     * Take an organizational unit out of the organization.
+     *
+     * Whatever still sits under it moves up to its parent, which is the only
+     * answer that leaves every Account on a path back to the root. AWS refuses
+     * to delete a unit that still holds anything, and a Stack tears down in
+     * reverse dependency order, so nothing should still be there.
+     */
+    removeOrganizationalUnit(unitId: SimOrganizationsNodeId): void;
+    /**
+     * Every Account in the organization.
+     */
+    accountIds(): readonly SimAwsAccountId[];
+    /**
+     * Whether this Account is in the organization.
+     */
+    holds(accountId: SimAwsAccountId): boolean;
+    /**
+     * Refuse a root or organizational unit this organization never created.
+     *
+     * A handle from another simulated organization would otherwise be attached
+     * to and then never read, because no Account here has it on its path. A
+     * policy that silently applies to nothing is worse than a refusal.
+     */
+    requireNode(nodeId: SimOrganizationsNodeId): void;
+    /**
+     * Whether this organization has a root or unit under an id.
+     */
+    hasNode(nodeId: SimOrganizationsNodeId): boolean;
+    /**
+     * The nodes a request against an Account is filtered by, root first.
+     *
+     * The Account itself is the last of them, because a policy attached to an
+     * Account applies alongside the ones it inherits.
+     */
+    pathTo(accountId: SimAwsAccountId): readonly SimOrganizationsNodeId[];
+    /**
+     * What to call a node in a denial.
+     */
+    nameOf(nodeId: SimOrganizationsNodeId): string;
+    /**
+     * Move everything under one node up to another.
+     */
+    private reparent;
+    /**
+     * The nodes from the root down to one node, root first.
+     */
+    private ancestors;
+    /**
+     * Refuse a node this organization never created.
+     */
+    private requireKnown;
+}

package/dist/service/organizations/tree/sim-organizations-tree.js

@@ -0,0 +1,154 @@
+import { makeSimOrganizationsOrganizationalUnitId, makeSimOrganizationsRootId, SimOrganizationsOrganizationalUnit, SimOrganizationsRoot, } from "./sim-organizations-node.js";
+/**
+ * Thrown for an organizational unit this organization has never seen.
+ */
+export class SimOrganizationsUnknownNode extends Error {
+    constructor(nodeId) {
+        super(`Unknown simulated Organizations node "${nodeId}"`);
+        this.name = "SimOrganizationsUnknownNode";
+    }
+}
+/**
+ * Where the Accounts and organizational units of one simulated organization
+ * sit relative to each other.
+ *
+ * The tree answers one question for authorization: which nodes lie on the path
+ * from the root down to an Account. Every policy on that path applies to the
+ * Account, which is what makes an organizational unit worth modelling at all.
+ *
+ * An Account joins the organization the moment it is named, whether by being
+ * moved into a unit or by having a policy attached to it. An Account never
+ * named sits outside the organization and is unrestricted.
+ */
+export class SimOrganizationsTree {
+    root = new SimOrganizationsRoot(makeSimOrganizationsRootId());
+    organizationalUnits = new Map();
+    accountParents = new Map();
+    /**
+     * Create an organizational unit, under the root unless another unit is
+     * named as its parent.
+     */
+    createOrganizationalUnit(name, parentId = this.root.id) {
+        this.requireKnown(parentId);
+        const unit = new SimOrganizationsOrganizationalUnit(makeSimOrganizationsOrganizationalUnitId(this.root.id), name, parentId);
+        this.organizationalUnits.set(unit.id, unit);
+        return unit;
+    }
+    /**
+     * Place an Account under a node, joining the organization if it was outside
+     * it.
+     */
+    placeAccount(accountId, parentId = this.root.id) {
+        this.requireKnown(parentId);
+        this.accountParents.set(accountId, parentId);
+    }
+    /**
+     * Take an Account out of the organization.
+     */
+    removeAccount(accountId) {
+        this.accountParents.delete(accountId);
+    }
+    /**
+     * Take an organizational unit out of the organization.
+     *
+     * Whatever still sits under it moves up to its parent, which is the only
+     * answer that leaves every Account on a path back to the root. AWS refuses
+     * to delete a unit that still holds anything, and a Stack tears down in
+     * reverse dependency order, so nothing should still be there.
+     */
+    removeOrganizationalUnit(unitId) {
+        const unit = this.organizationalUnits.get(unitId);
+        if (unit === undefined) {
+            return;
+        }
+        this.organizationalUnits.delete(unitId);
+        this.reparent(unitId, unit.parentId);
+    }
+    /**
+     * Every Account in the organization.
+     */
+    accountIds() {
+        return this.accountParents.keys().toArray();
+    }
+    /**
+     * Whether this Account is in the organization.
+     */
+    holds(accountId) {
+        return this.accountParents.has(accountId);
+    }
+    /**
+     * Refuse a root or organizational unit this organization never created.
+     *
+     * A handle from another simulated organization would otherwise be attached
+     * to and then never read, because no Account here has it on its path. A
+     * policy that silently applies to nothing is worse than a refusal.
+     */
+    requireNode(nodeId) {
+        this.requireKnown(nodeId);
+    }
+    /**
+     * Whether this organization has a root or unit under an id.
+     */
+    hasNode(nodeId) {
+        return nodeId === this.root.id || this.organizationalUnits.has(nodeId);
+    }
+    /**
+     * The nodes a request against an Account is filtered by, root first.
+     *
+     * The Account itself is the last of them, because a policy attached to an
+     * Account applies alongside the ones it inherits.
+     */
+    pathTo(accountId) {
+        const parentId = this.accountParents.get(accountId);
+        if (parentId === undefined) {
+            return [];
+        }
+        return [...this.ancestors(parentId), accountId];
+    }
+    /**
+     * What to call a node in a denial.
+     */
+    nameOf(nodeId) {
+        if (nodeId === this.root.id) {
+            return this.root.name;
+        }
+        return this.organizationalUnits.get(nodeId)?.name ?? String(nodeId);
+    }
+    /**
+     * Move everything under one node up to another.
+     */
+    reparent(fromId, toId) {
+        for (const [accountId, parentId] of this.accountParents) {
+            if (parentId === fromId) {
+                this.accountParents.set(accountId, toId);
+            }
+        }
+        const orphaned = this.organizationalUnits
+            .values()
+            .filter((unit) => unit.parentId === fromId)
+            .toArray();
+        for (const unit of orphaned) {
+            this.organizationalUnits.set(unit.id, new SimOrganizationsOrganizationalUnit(unit.id, unit.name, toId));
+        }
+    }
+    /**
+     * The nodes from the root down to one node, root first.
+     */
+    ancestors(nodeId) {
+        const path = [];
+        let currentId = nodeId;
+        while (currentId !== undefined && currentId !== this.root.id) {
+            path.unshift(currentId);
+            currentId = this.organizationalUnits.get(currentId)?.parentId;
+        }
+        return [this.root.id, ...path];
+    }
+    /**
+     * Refuse a node this organization never created.
+     */
+    requireKnown(nodeId) {
+        if (nodeId !== this.root.id && !this.organizationalUnits.has(nodeId)) {
+            throw new SimOrganizationsUnknownNode(nodeId);
+        }
+    }
+}

package/dist/service/route53/command/change-resource-record-sets/change-resource-record-sets-authorizer.js

@@ -33,6 +33,7 @@ export class ChangeResourceRecordSetsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ChangeResourceRecordSetsAuthorizer.action,
                 resource: hostedZoneArn,
             });

package/dist/service/route53/command/create-hosted-zone/create-hosted-zone-authorizer.js

@@ -29,6 +29,7 @@ export class CreateHostedZoneAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: CreateHostedZoneAuthorizer.action,
                 resource: CreateHostedZoneAuthorizer.resource,
             });

package/dist/service/route53/command/delete-hosted-zone/delete-hosted-zone-authorizer.js

@@ -27,6 +27,7 @@ export class DeleteHostedZoneAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteHostedZoneAuthorizer.action,
                 resource: hostedZoneArn,
             });

package/dist/service/route53/command/dnssec/sim-route53-dnssec-authorizer.js

@@ -22,6 +22,7 @@ export class SimRoute53DnssecAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/route53/command/get-hosted-zone/get-hosted-zone-authorizer.js

@@ -31,6 +31,7 @@ export class GetHostedZoneAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetHostedZoneAuthorizer.action,
                 resource: hostedZoneArn,
             });

package/dist/service/route53/command/list-hosted-zones-by-name/list-hosted-zones-by-name-authorizer.js

@@ -30,6 +30,7 @@ export class ListHostedZonesByNameAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListHostedZonesByNameAuthorizer.action,
                 resource: ListHostedZonesByNameAuthorizer.resource,
             });

package/dist/service/route53/command/list-resource-record-sets/list-resource-record-sets-authorizer.js

@@ -33,6 +33,7 @@ export class ListResourceRecordSetsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListResourceRecordSetsAuthorizer.action,
                 resource: hostedZoneArn,
             });

package/dist/service/s3/command/create-bucket/create-bucket.handler.js

@@ -44,6 +44,7 @@ export class CreateBucketCommandHandler {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: "s3:CreateBucket",
                 resource,
             });

package/dist/service/s3/command/delete-bucket/delete-bucket-authorizer.js

@@ -30,6 +30,7 @@ export class DeleteBucketAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteBucketAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/delete-bucket-policy/delete-bucket-policy-authorizer.js

@@ -29,6 +29,7 @@ export class DeleteBucketPolicyAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteBucketPolicyAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/delete-object/delete-object-authorizer.js

@@ -38,6 +38,7 @@ export class DeleteObjectAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: DeleteObjectAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy-authorizer.js

@@ -26,6 +26,7 @@ export class GetBucketPolicyAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetBucketPolicyAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/get-object/get-object-authorizer.js

@@ -41,6 +41,7 @@ export class GetObjectAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: GetObjectAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/head-bucket/head-bucket-authorizer.js

@@ -39,6 +39,7 @@ export class HeadBucketAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: HeadBucketAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/lifecycle/sim-s3-lifecycle-authorizer.js

@@ -42,6 +42,7 @@ export class SimS3LifecycleAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/s3/command/list-buckets/list-buckets-authorizer.js

@@ -37,6 +37,7 @@ export class ListBucketsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListBucketsAuthorizer.action,
                 resource: ListBucketsAuthorizer.resource,
             });

package/dist/service/s3/command/list-objects/list-objects-authorizer.js

@@ -48,6 +48,7 @@ export class ListObjectsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: ListObjectsAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/multipart/sim-s3-multipart-authorizer.js

@@ -42,6 +42,7 @@ export class SimS3MultipartAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: SimS3MultipartAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/notification/sim-s3-notification-authorizer.js

@@ -43,6 +43,7 @@ export class SimS3NotificationAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.js

@@ -41,6 +41,7 @@ export class SimS3PublicAccessBlockAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy-authorizer.js

@@ -23,6 +23,7 @@ export class PutBucketPolicyAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: PutBucketPolicyAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/put-bucket-website/put-bucket-website-authorizer.js

@@ -40,6 +40,7 @@ export class PutBucketWebsiteAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: PutBucketWebsiteAuthorizer.action,
                 resource,
             });

package/dist/service/s3/command/put-object/put-object-authorizer.js

@@ -41,6 +41,7 @@ export class PutObjectAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: PutObjectAuthorizer.action,
                 resource,
             });

package/dist/service/secretsmanager/command/authorize/sim-secrets-manager-authorizer.js

@@ -38,6 +38,7 @@ export class SimSecretsManagerAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/ses/command/authorize/sim-ses-authorizer.js

@@ -78,6 +78,7 @@ export class SimSesAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/sqs/command/authorize/sim-sqs-authorizer.js

@@ -69,6 +69,7 @@ export class SimSqsAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action: input.action,
                 resource: input.resource,
             });

package/dist/service/ssm/command/authorize/sim-ssm-authorizer.js

@@ -55,6 +55,7 @@ export class SimSsmAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/wafv2/command/authorize/sim-wafv2-authorizer.js

@@ -34,6 +34,7 @@ export class SimWafAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.20.12",
+  "version": "1.20.13",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -142,6 +142,10 @@
     },
     "./oxlint/cffjs2.oxlintrc.json": "./dist/config/oxlint/cffjs2.oxlintrc.json",
     "./package.json": "./package.json",
+    "./organizations": {
+      "import": "./dist/service/organizations/index.js",
+      "types": "./dist/service/organizations/index.d.ts"
+    },
     "./personalize": {
       "import": "./dist/service/personalize/index.js",
       "types": "./dist/service/personalize/index.d.ts"