@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,4 +1,5 @@
 import type { SimArn } from "../../../aws/arn.js";
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
 import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
@@ -8,6 +9,7 @@ import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-sou
 import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
+import type { SimIamServiceControlPolicyResolver } from "../scp/sim-iam-scp-resolver.js";
 export interface SimIamResourcePolicyInput {
     readonly document: SimIamPolicyDocument;
     readonly sourceType?: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
@@ -20,6 +22,17 @@ export interface SimIamResourcePolicyInput {
 export interface SimIamAuthorizationInput {
     readonly action: string;
     readonly resource: string;
+    /**
+     * The Region the request was made in, which sim IAM derives
+     * `aws:RequestedRegion` from.
+     *
+     * A simulated service supplies its own Region. A request reaching one
+     * through its command handlers therefore carries it, with the caller saying
+     * nothing. IAM itself belongs to an Account and has no Region to fall back
+     * on. A request arriving without one leaves the key out of the condition
+     * context, and a statement conditioned on it matches nothing.
+     */
+    readonly region?: AwsRegionName | undefined;
     /**
      * Condition values known by the service handling the simulated request, such
      * as S3 object tags. Sim IAM automatically supplies global condition values
@@ -77,6 +90,11 @@ interface SimIamAuthZContextBuilderProperties {
      * of a cross-Account request.
      */
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    /**
+     * Resolves the service control policies in force for an Account. A
+     * standalone SimIam has no organization around it and leaves this out.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
@@ -99,16 +117,22 @@ interface SimIamAuthZContextBuilderProperties {
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
  *
- * Permissions boundaries, session policies, SCPs, and role trust-policy
- * assume-role semantics are not part of this context assembly path yet. Add
- * those concerns through separate policy-source builders so this class stays
- * focused on composing the authorization request.
+ * Service control policies come from the organization the caller's Account
+ * belongs to, read by SimIamAuthZScpSourceBuilder. They filter and grant
+ * nothing, so they travel apart from the sides that can allow a request.
+ *
+ * Permissions boundaries, session policies, and role trust-policy assume-role
+ * semantics are not part of this context assembly path yet. Add those concerns
+ * through separate policy-source builders so this class stays focused on
+ * composing the authorization request.
  */
 export declare class SimIamAuthZContextBuilder {
     private readonly callerContextBuilder;
     private readonly identityPolicyCoordinator;
     private readonly callerAccountResolver;
     private readonly allowRequirement;
+    private readonly derivedConditions;
+    private readonly scpSourceBuilder;
     constructor(properties: SimIamAuthZContextBuilderProperties);
     /**
      * Build the context consumed by SimIamAuthorizer.
@@ -128,23 +152,14 @@ export declare class SimIamAuthZContextBuilder {
      */
     private ownIdentityPolicySources;
     /**
-     * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller.
+     * Combine service-provided condition values with the global values IAM
+     * derives itself.
      *
      * A service supplies values it knows from the request, and values it can
      * only work out once the caller is resolved. IAM's own values are applied
      * last, so nothing a service supplies can overwrite them.
      */
     private conditionContext;
-    /**
-     * The condition values IAM derives from the caller itself.
-     *
-     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
-     * temporary Role credentials this is the underlying Role ARN, rather than
-     * the STS assumed-role session ARN retained as the effective caller for
-     * diagnostics.
-     */
-    private callerDerivedConditions;
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -3,6 +3,8 @@ import { SimIamCallerAccountResolver } from "../caller-account/sim-iam-caller-ac
 import { SimIamAuthZAllowRequirement } from "./sim-iam-auth-z-allow-requirement.js";
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
 import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
+import { SimIamAuthZScpSourceBuilder } from "./sim-iam-auth-z-scp-source-builder.js";
+import { SimIamDerivedConditions } from "./sim-iam-derived-conditions.js";
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
  *
@@ -24,16 +26,22 @@ import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-contex
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
  *
- * Permissions boundaries, session policies, SCPs, and role trust-policy
- * assume-role semantics are not part of this context assembly path yet. Add
- * those concerns through separate policy-source builders so this class stays
- * focused on composing the authorization request.
+ * Service control policies come from the organization the caller's Account
+ * belongs to, read by SimIamAuthZScpSourceBuilder. They filter and grant
+ * nothing, so they travel apart from the sides that can allow a request.
+ *
+ * Permissions boundaries, session policies, and role trust-policy assume-role
+ * semantics are not part of this context assembly path yet. Add those concerns
+ * through separate policy-source builders so this class stays focused on
+ * composing the authorization request.
  */
 export class SimIamAuthZContextBuilder {
     callerContextBuilder;
     identityPolicyCoordinator;
     callerAccountResolver;
     allowRequirement = new SimIamAuthZAllowRequirement();
+    derivedConditions = new SimIamDerivedConditions();
+    scpSourceBuilder;
     constructor(properties) {
         this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
@@ -45,6 +53,10 @@ export class SimIamAuthZContextBuilder {
             accountId: properties.accountId,
             iamResolver: properties.iamResolver,
         });
+        this.scpSourceBuilder = new SimIamAuthZScpSourceBuilder({
+            accountId: properties.accountId,
+            scpResolver: properties.scpResolver,
+        });
     }
     /**
      * Build the context consumed by SimIamAuthorizer.
@@ -58,6 +70,7 @@ export class SimIamAuthZContextBuilder {
                 ...callerAccount.identityPolicies,
             ],
             resourcePolicies: this.resourcePolicySources(input),
+            serviceControlPolicies: this.scpSourceBuilder.build(callerContext.caller),
             allowRequirement: this.allowRequirement.resolve(callerAccount, input.requiresResourcePolicyAllow),
             action: input.action,
             resource: input.resource,
@@ -86,8 +99,8 @@ export class SimIamAuthZContextBuilder {
         ];
     }
     /**
-     * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller.
+     * Combine service-provided condition values with the global values IAM
+     * derives itself.
      *
      * A service supplies values it knows from the request, and values it can
      * only work out once the caller is resolved. IAM's own values are applied
@@ -97,24 +110,9 @@ export class SimIamAuthZContextBuilder {
         return {
             ...input.conditionContext,
             ...input.callerConditions?.conditionValuesFor(caller),
-            ...this.callerDerivedConditions(caller),
+            ...this.derivedConditions.of({ caller, region: input.region }),
         };
     }
-    /**
-     * The condition values IAM derives from the caller itself.
-     *
-     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
-     * temporary Role credentials this is the underlying Role ARN, rather than
-     * the STS assumed-role session ARN retained as the effective caller for
-     * diagnostics.
-     */
-    callerDerivedConditions(caller) {
-        const principalArn = caller.identityPolicyArn ?? caller.arn;
-        if (principalArn === undefined) {
-            return {};
-        }
-        return { "aws:PrincipalArn": principalArn };
-    }
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts

@@ -2,7 +2,7 @@ import type { SimArn } from "../../../aws/arn.js";
 import type { SimIamConditionValue, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
-export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session";
+export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session" | "service-control";
 export interface SimIamAuthZPolicySource {
     readonly sourceType: SimIamAuthZPolicySourceType;
     readonly document: SimIamPolicyDocument;
@@ -16,6 +16,29 @@ export interface SimIamAuthZPolicySource {
 export type SimIamAuthZResourcePolicySource = Omit<SimIamAuthZPolicySource, "sourceType"> & {
     readonly sourceType: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
 };
+/**
+ * The service control policies attached at one level above the caller's
+ * Account, which is the root, an organizational unit, or the Account itself.
+ *
+ * Each level has to allow the action on its own. A level allowing nothing
+ * denies the request whatever another level allows, which is why the sources
+ * stay grouped rather than being read as one list.
+ */
+export interface SimIamAuthZServiceControlPolicyLevel {
+    readonly nodeName: string;
+    readonly sources: readonly SimIamAuthZPolicySource[];
+}
+/**
+ * The service control policies in force for an authorization request.
+ *
+ * `applies` is a separate fact from how many levels there are. An Account
+ * inside an organization holding no policy allows nothing, while an Account
+ * outside every organization is unrestricted, and both can carry no levels.
+ */
+export interface SimIamAuthZServiceControlPolicies {
+    readonly applies: boolean;
+    readonly levels: readonly SimIamAuthZServiceControlPolicyLevel[];
+}
 export interface SimIamAuthZContext {
     /**
      * Identity-based policies that grant permissions to the principal.
@@ -29,6 +52,13 @@ export interface SimIamAuthZContext {
      * Resource policies are not gathered from IAM's managed policy store.
      */
     readonly resourcePolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * Service control policies in force for the caller's Account.
+     *
+     * These filter what the Account's principals may do and grant nothing, so
+     * they are kept apart from the two sides that can allow a request.
+     */
+    readonly serviceControlPolicies: SimIamAuthZServiceControlPolicies;
     /**
      * How an Allow from each policy side combines into the final decision.
      *

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js

@@ -6,6 +6,7 @@ import { SimIamEitherSideAllowRequirement } from "../allow/sim-iam-allow-require
 export const simIamAuthZContextFactory = new StaticFactory({
     identityPolicies: [],
     resourcePolicies: [],
+    serviceControlPolicies: { applies: false, levels: [] },
     allowRequirement: new SimIamEitherSideAllowRequirement(),
     action: "s3:GetObject",
     resource: "arn:aws:s3:::test-bucket/test-key",

package/dist/service/iam/authorize/context/sim-iam-auth-z-scp-source-builder.d.ts

@@ -0,0 +1,46 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamServiceControlPolicyResolver } from "../scp/sim-iam-scp-resolver.js";
+import type { SimIamAuthZServiceControlPolicies } from "./sim-iam-auth-z-context.js";
+interface SimIamAuthZScpSourceBuilderProperties {
+    /**
+     * The Account whose IAM is evaluating the request.
+     */
+    readonly accountId: SimAwsAccountId;
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
+}
+/**
+ * Finds the service control policies that apply to one request.
+ *
+ * An SCP belongs to the caller's own Account, which is the Account whose
+ * principal is asking. For a request within one Account that is the Account
+ * evaluating it. For a cross-Account request it is the other one, because AWS
+ * filters a principal by the organization its own account sits in and leaves
+ * the resource's organization to say nothing about it.
+ *
+ * A caller with no Account in its ARN, which means a service principal or an
+ * anonymous request, belongs to no Account and is subject to no SCP.
+ */
+export declare class SimIamAuthZScpSourceBuilder {
+    /**
+     * What a caller no organization reaches is subject to.
+     */
+    private static readonly unrestricted;
+    private readonly accountId;
+    private readonly scpResolver?;
+    constructor(properties: SimIamAuthZScpSourceBuilderProperties);
+    /**
+     * The service control policies in force for a resolved caller.
+     */
+    build(caller: SimAwsResolvedCaller): SimIamAuthZServiceControlPolicies;
+    /**
+     * The Account whose organization decides this request.
+     *
+     * A caller identified only by a service name or by nothing at all has no
+     * Account of its own. The Account root fallback IAM applies to a request
+     * with no caller carries this Account's id, so a CloudFormation deployment
+     * is filtered like any other principal in it.
+     */
+    private callerAccountId;
+}
+export {};

package/dist/service/iam/authorize/context/sim-iam-auth-z-scp-source-builder.js

@@ -0,0 +1,71 @@
+import { isSimAwsAccountId } from "../../../aws/sim-aws-account.js";
+/**
+ * Finds the service control policies that apply to one request.
+ *
+ * An SCP belongs to the caller's own Account, which is the Account whose
+ * principal is asking. For a request within one Account that is the Account
+ * evaluating it. For a cross-Account request it is the other one, because AWS
+ * filters a principal by the organization its own account sits in and leaves
+ * the resource's organization to say nothing about it.
+ *
+ * A caller with no Account in its ARN, which means a service principal or an
+ * anonymous request, belongs to no Account and is subject to no SCP.
+ */
+export class SimIamAuthZScpSourceBuilder {
+    /**
+     * What a caller no organization reaches is subject to.
+     */
+    static unrestricted = {
+        applies: false,
+        levels: [],
+    };
+    accountId;
+    scpResolver;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.scpResolver = properties.scpResolver;
+    }
+    /**
+     * The service control policies in force for a resolved caller.
+     */
+    build(caller) {
+        const scpResolver = this.scpResolver;
+        if (scpResolver === undefined) {
+            return SimIamAuthZScpSourceBuilder.unrestricted;
+        }
+        const accountId = this.callerAccountId(caller);
+        if (accountId === undefined) {
+            return SimIamAuthZScpSourceBuilder.unrestricted;
+        }
+        const set = scpResolver.serviceControlPolicySetFor(accountId);
+        return {
+            applies: set.applies,
+            levels: set.levels.map((level) => ({
+                nodeName: level.nodeName,
+                sources: level.policies.map((policy) => ({
+                    sourceType: "service-control",
+                    document: policy.document,
+                    policyName: policy.policyName,
+                })),
+            })),
+        };
+    }
+    /**
+     * The Account whose organization decides this request.
+     *
+     * A caller identified only by a service name or by nothing at all has no
+     * Account of its own. The Account root fallback IAM applies to a request
+     * with no caller carries this Account's id, so a CloudFormation deployment
+     * is filtered like any other principal in it.
+     */
+    callerAccountId(caller) {
+        if (caller.principal.kind === "anonymous" || caller.service !== undefined) {
+            return undefined;
+        }
+        const callerAccountId = caller.accountId;
+        if (callerAccountId === undefined) {
+            return this.accountId;
+        }
+        return isSimAwsAccountId(callerAccountId) ? callerAccountId : undefined;
+    }
+}

package/dist/service/iam/authorize/context/sim-iam-derived-conditions.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
+import type { SimIamConditionValue } from "../../policy/sim-iam-policy.js";
+/**
+ * What a request has to say about itself for IAM to derive its global
+ * condition values.
+ */
+export interface SimIamDerivedConditionRequest {
+    readonly caller: SimAwsResolvedCaller;
+    readonly region?: AwsRegionName | undefined;
+}
+/**
+ * The global condition values IAM works out for itself.
+ *
+ * These are the keys a policy can be written against without the service
+ * handling the request supplying anything. They are applied over the values a
+ * service does supply. A service cannot overwrite one of them.
+ *
+ * A key the request leaves unsaid is left out. The condition matcher counts a
+ * missing key as no match, and a statement conditioned on one then matches
+ * nothing.
+ */
+export declare class SimIamDerivedConditions {
+    /**
+     * Derive what IAM knows about this request.
+     */
+    of(request: SimIamDerivedConditionRequest): Readonly<Record<string, SimIamConditionValue>>;
+    /**
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply. For
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    private principalArn;
+    /**
+     * AWS:RequestedRegion is the Region the request was made in, which on real
+     * AWS is the Region of the endpoint it was sent to. Here it is the Region of
+     * the simulated service handling the request. A service in one Region's
+     * scope answers only requests made to that Region.
+     */
+    private region;
+}

package/dist/service/iam/authorize/context/sim-iam-derived-conditions.js

@@ -0,0 +1,44 @@
+/**
+ * The global condition values IAM works out for itself.
+ *
+ * These are the keys a policy can be written against without the service
+ * handling the request supplying anything. They are applied over the values a
+ * service does supply. A service cannot overwrite one of them.
+ *
+ * A key the request leaves unsaid is left out. The condition matcher counts a
+ * missing key as no match, and a statement conditioned on one then matches
+ * nothing.
+ */
+export class SimIamDerivedConditions {
+    /**
+     * Derive what IAM knows about this request.
+     */
+    of(request) {
+        return { ...this.principalArn(request.caller), ...this.region(request) };
+    }
+    /**
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply. For
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    principalArn(caller) {
+        const principalArn = caller.identityPolicyArn ?? caller.arn;
+        if (principalArn === undefined) {
+            return {};
+        }
+        return { "aws:PrincipalArn": principalArn };
+    }
+    /**
+     * AWS:RequestedRegion is the Region the request was made in, which on real
+     * AWS is the Region of the endpoint it was sent to. Here it is the Region of
+     * the simulated service handling the request. A service in one Region's
+     * scope answers only requests made to that Region.
+     */
+    region(request) {
+        if (request.region === undefined) {
+            return {};
+        }
+        return { "aws:RequestedRegion": request.region };
+    }
+}

package/dist/service/iam/authorize/match/condition/arn/equals/sim-iam-arn-equals.js

@@ -1,4 +1,4 @@
-import { simIamArnMatch } from "../../../../sim-iam-arn-match.js";
+import { simIamArnComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar-string-condition-operator.js";
 /**
  * IAM `ArnEquals` condition operator.
@@ -11,6 +11,6 @@ import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar
  */
 export class SimIamArnEquals extends SimIamScalarStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamArnMatch(expected, actual);
+        return simIamArnComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/arn/like/sim-iam-arn-like.js

@@ -1,4 +1,4 @@
-import { simIamArnMatch } from "../../../../sim-iam-arn-match.js";
+import { simIamArnComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar-string-condition-operator.js";
 /**
  * IAM `ArnLike` condition operator.
@@ -10,6 +10,6 @@ import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar
  */
 export class SimIamArnLike extends SimIamScalarStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamArnMatch(expected, actual);
+        return simIamArnComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-all-values-string-operator.d.ts

@@ -0,0 +1,20 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
+import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
+/**
+ * A `ForAllValues` negated IAM string operator, such as
+ * `ForAllValues:StringNotEquals`.
+ *
+ * Every request value has to differ from every policy value. A request
+ * supplying no values leaves nothing to contradict that, so an empty set
+ * matches, as an absent key does.
+ */
+export declare class SimIamNegatedForAllValuesStringOperator implements SimIamConditionOperator {
+    private readonly comparison;
+    readonly matchesAbsentKey = true;
+    constructor(comparison: SimIamStringComparison);
+    /**
+     * Check whether every request value differs from every policy value.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-all-values-string-operator.js

@@ -0,0 +1,27 @@
+import { simIamStringValues } from "../string/sim-iam-string-values.js";
+/**
+ * A `ForAllValues` negated IAM string operator, such as
+ * `ForAllValues:StringNotEquals`.
+ *
+ * Every request value has to differ from every policy value. A request
+ * supplying no values leaves nothing to contradict that, so an empty set
+ * matches, as an absent key does.
+ */
+export class SimIamNegatedForAllValuesStringOperator {
+    comparison;
+    matchesAbsentKey = true;
+    constructor(comparison) {
+        this.comparison = comparison;
+    }
+    /**
+     * Check whether every request value differs from every policy value.
+     */
+    matches(actual, expected) {
+        const actualValues = simIamStringValues(actual);
+        const expectedValues = simIamStringValues(expected);
+        if (actualValues === undefined || expectedValues === undefined) {
+            return false;
+        }
+        return actualValues.every((actualValue) => expectedValues.every((expectedValue) => !this.comparison(actualValue, expectedValue)));
+    }
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-any-value-string-operator.d.ts

@@ -0,0 +1,21 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
+import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
+/**
+ * A `ForAnyValue` negated IAM string operator, such as
+ * `ForAnyValue:StringNotEquals`.
+ *
+ * One request value differing from every policy value is enough. A request
+ * supplying no such value satisfies nothing, which covers both an empty value
+ * set and a key the request omits. The `ForAnyValue` qualifier settles the
+ * absent key here, ahead of the rule that a negated operator matches one.
+ */
+export declare class SimIamNegatedForAnyValueStringOperator implements SimIamConditionOperator {
+    private readonly comparison;
+    readonly matchesAbsentKey = false;
+    constructor(comparison: SimIamStringComparison);
+    /**
+     * Check whether any request value differs from every policy value.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-any-value-string-operator.js

@@ -0,0 +1,28 @@
+import { simIamStringValues } from "../string/sim-iam-string-values.js";
+/**
+ * A `ForAnyValue` negated IAM string operator, such as
+ * `ForAnyValue:StringNotEquals`.
+ *
+ * One request value differing from every policy value is enough. A request
+ * supplying no such value satisfies nothing, which covers both an empty value
+ * set and a key the request omits. The `ForAnyValue` qualifier settles the
+ * absent key here, ahead of the rule that a negated operator matches one.
+ */
+export class SimIamNegatedForAnyValueStringOperator {
+    comparison;
+    matchesAbsentKey = false;
+    constructor(comparison) {
+        this.comparison = comparison;
+    }
+    /**
+     * Check whether any request value differs from every policy value.
+     */
+    matches(actual, expected) {
+        const actualValues = simIamStringValues(actual);
+        const expectedValues = simIamStringValues(expected);
+        if (actualValues === undefined || expectedValues === undefined) {
+            return false;
+        }
+        return actualValues.some((actualValue) => expectedValues.every((expectedValue) => !this.comparison(actualValue, expectedValue)));
+    }
+}

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-operator-factories.d.ts

@@ -0,0 +1,5 @@
+import type { SimIamConditionOperatorFactory } from "../sim-iam-condition-operator.js";
+/**
+ * Every negated condition operator sim IAM evaluates, keyed by its keyword.
+ */
+export declare const simIamNegatedOperatorFactories: ReadonlyMap<string, SimIamConditionOperatorFactory>;

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-operator-factories.js

@@ -0,0 +1,36 @@
+import { simIamArnComparison, simIamStringEqualsComparison, simIamStringLikeComparison, } from "../sim-iam-string-comparison.js";
+import { SimIamNegatedForAllValuesStringOperator } from "./sim-iam-negated-for-all-values-string-operator.js";
+import { SimIamNegatedForAnyValueStringOperator } from "./sim-iam-negated-for-any-value-string-operator.js";
+import { SimIamNegatedScalarStringOperator } from "./sim-iam-negated-scalar-string-operator.js";
+/**
+ * The comparison behind each negated operator keyword.
+ */
+const negatedComparisons = new Map([
+    ["ArnNotEquals", simIamArnComparison],
+    ["ArnNotLike", simIamArnComparison],
+    ["StringNotEquals", simIamStringEqualsComparison],
+    ["StringNotLike", simIamStringLikeComparison],
+]);
+/**
+ * Build the unqualified and set forms of one negated keyword.
+ */
+function keywordForms(keyword, comparison) {
+    return [
+        [
+            keyword,
+            () => new SimIamNegatedScalarStringOperator(comparison),
+        ],
+        [
+            `ForAnyValue:${keyword}`,
+            () => new SimIamNegatedForAnyValueStringOperator(comparison),
+        ],
+        [
+            `ForAllValues:${keyword}`,
+            () => new SimIamNegatedForAllValuesStringOperator(comparison),
+        ],
+    ];
+}
+/**
+ * Every negated condition operator sim IAM evaluates, keyed by its keyword.
+ */
+export const simIamNegatedOperatorFactories = new Map([...negatedComparisons].flatMap(([keyword, comparison]) => keywordForms(keyword, comparison)));

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-scalar-string-operator.d.ts

@@ -0,0 +1,20 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
+import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
+/**
+ * An unqualified negated IAM string operator, such as `StringNotEquals`.
+ *
+ * The request value must be scalar, as it must for the positive operators.
+ * Several policy values are an AND rather than an OR: the request value has to
+ * differ from every one of them, so a carve-out naming three roles exempts all
+ * three.
+ */
+export declare class SimIamNegatedScalarStringOperator implements SimIamConditionOperator {
+    private readonly comparison;
+    readonly matchesAbsentKey = true;
+    constructor(comparison: SimIamStringComparison);
+    /**
+     * Check whether a request value differs from every policy value.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+}