@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-scalar-string-operator.js

@@ -0,0 +1,29 @@
+import { simIamStringValues } from "../string/sim-iam-string-values.js";
+/**
+ * An unqualified negated IAM string operator, such as `StringNotEquals`.
+ *
+ * The request value must be scalar, as it must for the positive operators.
+ * Several policy values are an AND rather than an OR: the request value has to
+ * differ from every one of them, so a carve-out naming three roles exempts all
+ * three.
+ */
+export class SimIamNegatedScalarStringOperator {
+    comparison;
+    matchesAbsentKey = true;
+    constructor(comparison) {
+        this.comparison = comparison;
+    }
+    /**
+     * Check whether a request value differs from every policy value.
+     */
+    matches(actual, expected) {
+        if (typeof actual !== "string") {
+            return false;
+        }
+        const expectedValues = simIamStringValues(expected);
+        if (expectedValues === undefined) {
+            return false;
+        }
+        return expectedValues.every((expectedValue) => !this.comparison(actual, expectedValue));
+    }
+}

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.d.ts

@@ -15,6 +15,7 @@ import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.j
  * are rejected rather than being converted through JavaScript coercion rules.
  */
 export declare class SimIamNumericLessThanEquals implements SimIamConditionOperator {
+    readonly matchesAbsentKey = false;
     /**
      * Compare one request value with one or more policy limits.
      */

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.js

@@ -13,6 +13,7 @@
  * are rejected rather than being converted through JavaScript coercion rules.
  */
 export class SimIamNumericLessThanEquals {
+    matchesAbsentKey = false;
     /**
      * Compare one request value with one or more policy limits.
      */

package/dist/service/iam/authorize/match/condition/sim-iam-condition-match.d.ts

@@ -0,0 +1,26 @@
+/**
+ * What reading one statement's condition block told the simulator.
+ *
+ * A condition block either matched the request or it did not, and separately
+ * from that it may have held an operator sim IAM has no implementation for.
+ * The two facts travel together because a statement carrying an unread
+ * operator does not match, and a caller that only reads `matched` cannot tell
+ * that apart from a condition the simulator read and rejected.
+ */
+export interface SimIamConditionMatch {
+    /**
+     * Whether the whole condition block matched the request.
+     *
+     * An operator the simulator cannot evaluate fails closed. A block holding
+     * one never matches.
+     */
+    readonly matched: boolean;
+    /**
+     * The operator keywords sim IAM has no implementation for.
+     *
+     * These are reported only where every other operator in the block matched.
+     * A block ruled out by an operator the simulator did read needs nothing
+     * said about it: the statement would not have matched either way.
+     */
+    readonly unsupportedOperators: readonly string[];
+}

package/dist/service/iam/authorize/match/condition/sim-iam-condition-match.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js

@@ -1,3 +1,4 @@
+import { simIamNegatedOperatorFactories } from "./negated/sim-iam-negated-operator-factories.js";
 import { SimIamForAllValuesStringEquals } from "./string/all-values/sim-iam-for-all-values-string-equals.js";
 import { SimIamForAllValuesStringLike } from "./string/all-values/sim-iam-for-all-values-string-like.js";
 import { SimIamForAnyValueStringEquals } from "./string/any-value/sim-iam-for-any-value-string-equals.js";
@@ -32,6 +33,7 @@ const operatorFactories = new Map([
         "ForAllValues:StringLike",
         () => new SimIamForAllValuesStringLike(),
     ],
+    ...simIamNegatedOperatorFactories,
 ]);
 /**
  * Parses IAM condition operator keywords into their behavior objects.

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator.d.ts

@@ -7,8 +7,23 @@ import type { SimIamConditionValue } from "../../../policy/sim-iam-policy.js";
  * matcher.
  */
 export interface SimIamConditionOperator {
+    /**
+     * Whether the operator matches a request carrying no value for the key.
+     *
+     * An unqualified positive operator has nothing to compare and matches
+     * nothing, while its negated form matches. With no value in the request
+     * there is none for the policy value to equal.
+     *
+     * A `ForAnyValue` operator answers false whatever it wraps, because no
+     * request value is there to satisfy it. AWS documents both rules.
+     */
+    readonly matchesAbsentKey: boolean;
     /**
      * Determine whether an actual request value satisfies the expected policy value.
      */
     matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
 }
+/**
+ * Builds a fresh condition operator for one keyword.
+ */
+export type SimIamConditionOperatorFactory = () => SimIamConditionOperator;

package/dist/service/iam/authorize/match/condition/sim-iam-policy-condition-matcher.d.ts

@@ -1,4 +1,5 @@
 import type { SimIamConditionValue, SimIamPolicyDocumentCondition } from "../../../policy/sim-iam-policy.js";
+import type { SimIamConditionMatch } from "./sim-iam-condition-match.js";
 import { SimIamConditionOperatorParser } from "./sim-iam-condition-operator-parser.js";
 /**
  * Matches IAM policy conditions against request condition-context values.
@@ -7,19 +8,26 @@ import { SimIamConditionOperatorParser } from "./sim-iam-condition-operator-pars
  * key lookup. Individual condition operators encapsulate value validation,
  * comparison, and set semantics.
  *
- * Unsupported operators and missing context keys fail closed by making the
- * condition non-matching.
+ * An unsupported operator fails closed by making the condition non-matching,
+ * and is named in the result so the decision can report the statement as one
+ * it never read. A context key the request carries no value for is left to the
+ * operator, which answers for itself whether an absent key matches it.
  */
 export declare class SimIamPolicyConditionMatcher {
     private readonly operatorParser;
+    private static readonly noCondition;
     private readonly conditionContext;
     constructor(conditionContext: Readonly<Record<string, SimIamConditionValue>>, operatorParser?: SimIamConditionOperatorParser);
     /**
      * Match every operator and every key in a condition block.
      *
      * Separate operators and separate keys use logical AND semantics.
+     *
+     * Every operator in the block is read. Stopping at the first that fails
+     * would leave the operators the simulator could not evaluate depending on
+     * the order the policy happens to list them in.
      */
-    matches(condition: SimIamPolicyDocumentCondition | undefined): boolean;
+    matches(condition: SimIamPolicyDocumentCondition | undefined): SimIamConditionMatch;
     private operatorMatches;
     private entryMatches;
     private normalizeContextKey;

package/dist/service/iam/authorize/match/condition/sim-iam-policy-condition-matcher.js

@@ -6,11 +6,17 @@ import { SimIamConditionOperatorParser } from "./sim-iam-condition-operator-pars
  * key lookup. Individual condition operators encapsulate value validation,
  * comparison, and set semantics.
  *
- * Unsupported operators and missing context keys fail closed by making the
- * condition non-matching.
+ * An unsupported operator fails closed by making the condition non-matching,
+ * and is named in the result so the decision can report the statement as one
+ * it never read. A context key the request carries no value for is left to the
+ * operator, which answers for itself whether an absent key matches it.
  */
 export class SimIamPolicyConditionMatcher {
     operatorParser;
+    static noCondition = {
+        matched: true,
+        unsupportedOperators: [],
+    };
     conditionContext;
     constructor(conditionContext, operatorParser = new SimIamConditionOperatorParser()) {
         this.operatorParser = operatorParser;
@@ -23,25 +29,37 @@ export class SimIamPolicyConditionMatcher {
      * Match every operator and every key in a condition block.
      *
      * Separate operators and separate keys use logical AND semantics.
+     *
+     * Every operator in the block is read. Stopping at the first that fails
+     * would leave the operators the simulator could not evaluate depending on
+     * the order the policy happens to list them in.
      */
     matches(condition) {
         if (condition === undefined) {
-            return true;
+            return SimIamPolicyConditionMatcher.noCondition;
         }
-        return Object.entries(condition).every(([keyword, keyValues]) => this.operatorMatches(keyword, keyValues));
-    }
-    operatorMatches(keyword, keyValues) {
-        const operator = this.operatorParser.parse(keyword);
-        /* v8 ignore if -- defensive */
-        if (operator === undefined) {
-            return false;
+        const unsupportedOperators = [];
+        let matched = true;
+        for (const [keyword, keyValues] of Object.entries(condition)) {
+            const operator = this.operatorParser.parse(keyword);
+            if (operator === undefined) {
+                unsupportedOperators.push(keyword);
+                continue;
+            }
+            matched = this.operatorMatches(operator, keyValues) && matched;
         }
+        return {
+            matched: matched && unsupportedOperators.length === 0,
+            unsupportedOperators: matched ? unsupportedOperators : [],
+        };
+    }
+    operatorMatches(operator, keyValues) {
         return Object.entries(keyValues).every(([key, expected]) => this.entryMatches(operator, key, expected));
     }
     entryMatches(operator, key, expected) {
         const actual = this.conditionContext.get(this.normalizeContextKey(key));
         if (actual === undefined) {
-            return false;
+            return operator.matchesAbsentKey;
         }
         return operator.matches(actual, expected);
     }

package/dist/service/iam/authorize/match/condition/sim-iam-string-comparison.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Compares one request value with one policy value.
+ *
+ * Condition operators differ in how they quantify over the values on each
+ * side, and in whether they negate the result. The comparison of a single
+ * pair is the part they share, so `StringNotLike` is the same comparison as
+ * `StringLike` with the answer turned around.
+ */
+export type SimIamStringComparison = (actual: string, expected: string) => boolean;
+/**
+ * The comparison `StringEquals` and `StringNotEquals` are built from.
+ */
+export declare const simIamStringEqualsComparison: SimIamStringComparison;
+/**
+ * The comparison `StringLike` and `StringNotLike` are built from.
+ */
+export declare const simIamStringLikeComparison: SimIamStringComparison;
+/**
+ * The comparison the four ARN operators are built from.
+ *
+ * AWS documents `ArnEquals` and `ArnLike` as behaving identically, so one
+ * comparison serves both of them and both of their negated forms.
+ */
+export declare const simIamArnComparison: SimIamStringComparison;

package/dist/service/iam/authorize/match/condition/sim-iam-string-comparison.js

@@ -0,0 +1,17 @@
+import { simIamArnMatch } from "../../sim-iam-arn-match.js";
+import { simIamWildcardMatch } from "../../sim-iam-wildcard.js";
+/**
+ * The comparison `StringEquals` and `StringNotEquals` are built from.
+ */
+export const simIamStringEqualsComparison = (actual, expected) => actual === expected;
+/**
+ * The comparison `StringLike` and `StringNotLike` are built from.
+ */
+export const simIamStringLikeComparison = (actual, expected) => simIamWildcardMatch(expected, actual, { caseSensitive: true });
+/**
+ * The comparison the four ARN operators are built from.
+ *
+ * AWS documents `ArnEquals` and `ArnLike` as behaving identically, so one
+ * comparison serves both of them and both of their negated forms.
+ */
+export const simIamArnComparison = (actual, expected) => simIamArnMatch(expected, actual);

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-condition-operator.d.ts

@@ -4,6 +4,7 @@ import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.j
  * Base for `ForAllValues` IAM string operators.
  */
 export declare abstract class SimIamForAllValuesStringConditionOperator implements SimIamConditionOperator {
+    readonly matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-condition-operator.js

@@ -3,6 +3,7 @@ import { simIamStringValues } from "../sim-iam-string-values.js";
  * Base for `ForAllValues` IAM string operators.
  */
 export class SimIamForAllValuesStringConditionOperator {
+    matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-equals.js

@@ -1,9 +1,10 @@
+import { simIamStringEqualsComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamForAllValuesStringConditionOperator } from "./sim-iam-for-all-values-string-condition-operator.js";
 /**
  * IAM `ForAllValues:StringEquals` condition operator.
  */
 export class SimIamForAllValuesStringEquals extends SimIamForAllValuesStringConditionOperator {
     valueMatches(actual, expected) {
-        return actual === expected;
+        return simIamStringEqualsComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-like.js

@@ -1,12 +1,10 @@
-import { simIamWildcardMatch } from "../../../../sim-iam-wildcard.js";
+import { simIamStringLikeComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamForAllValuesStringConditionOperator } from "./sim-iam-for-all-values-string-condition-operator.js";
 /**
  * IAM `ForAllValues:StringLike` condition operator.
  */
 export class SimIamForAllValuesStringLike extends SimIamForAllValuesStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamWildcardMatch(expected, actual, {
-            caseSensitive: true,
-        });
+        return simIamStringLikeComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-condition-operator.d.ts

@@ -4,6 +4,7 @@ import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.j
  * Base for `ForAnyValue` IAM string operators.
  */
 export declare abstract class SimIamForAnyValueStringConditionOperator implements SimIamConditionOperator {
+    readonly matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-condition-operator.js

@@ -3,6 +3,7 @@ import { simIamStringValues } from "../sim-iam-string-values.js";
  * Base for `ForAnyValue` IAM string operators.
  */
 export class SimIamForAnyValueStringConditionOperator {
+    matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-equals.js

@@ -1,9 +1,10 @@
+import { simIamStringEqualsComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamForAnyValueStringConditionOperator } from "./sim-iam-for-any-value-string-condition-operator.js";
 /**
  * IAM `ForAnyValue:StringEquals` condition operator.
  */
 export class SimIamForAnyValueStringEquals extends SimIamForAnyValueStringConditionOperator {
     valueMatches(actual, expected) {
-        return actual === expected;
+        return simIamStringEqualsComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-like.js

@@ -1,12 +1,10 @@
-import { simIamWildcardMatch } from "../../../../sim-iam-wildcard.js";
+import { simIamStringLikeComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamForAnyValueStringConditionOperator } from "./sim-iam-for-any-value-string-condition-operator.js";
 /**
  * IAM `ForAnyValue:StringLike` condition operator.
  */
 export class SimIamForAnyValueStringLike extends SimIamForAnyValueStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamWildcardMatch(expected, actual, {
-            caseSensitive: true,
-        });
+        return simIamStringLikeComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/equals/sim-iam-string-equals.js

@@ -1,9 +1,10 @@
+import { simIamStringEqualsComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamScalarStringConditionOperator } from "../sim-iam-scalar-string-condition-operator.js";
 /**
  * IAM `StringEquals` condition operator.
  */
 export class SimIamStringEquals extends SimIamScalarStringConditionOperator {
     valueMatches(actual, expected) {
-        return actual === expected;
+        return simIamStringEqualsComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/like/sim-iam-string-like.js

@@ -1,12 +1,10 @@
-import { simIamWildcardMatch } from "../../../../sim-iam-wildcard.js";
+import { simIamStringLikeComparison } from "../../sim-iam-string-comparison.js";
 import { SimIamScalarStringConditionOperator } from "../sim-iam-scalar-string-condition-operator.js";
 /**
  * IAM `StringLike` condition operator.
  */
 export class SimIamStringLike extends SimIamScalarStringConditionOperator {
     valueMatches(actual, expected) {
-        return simIamWildcardMatch(expected, actual, {
-            caseSensitive: true,
-        });
+        return simIamStringLikeComparison(actual, expected);
     }
 }

package/dist/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.d.ts

@@ -7,6 +7,7 @@ import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
  * scalar or an array, with multiple policy values using OR semantics.
  */
 export declare abstract class SimIamScalarStringConditionOperator implements SimIamConditionOperator {
+    readonly matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/sim-iam-scalar-string-condition-operator.js

@@ -6,6 +6,7 @@ import { simIamStringValues } from "./sim-iam-string-values.js";
  * scalar or an array, with multiple policy values using OR semantics.
  */
 export class SimIamScalarStringConditionOperator {
+    matchesAbsentKey = false;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts

@@ -1,6 +1,7 @@
 import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
 import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
-import type { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
+import { SimIamUnevaluatedStatements } from "../unevaluated/sim-iam-unevaluated-statements.js";
 /**
  * Matches one parsed IAM policy statement against one authorization request.
  *
@@ -18,12 +19,23 @@ import type { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
  * - Action and NotAction;
  * - Resource and NotResource;
  * - supported IAM string conditions.
+ *
+ * One matcher reads every policy of one request, and it is also where the
+ * statements the simulator could not evaluate are collected. A statement is
+ * recorded only once everything else about it has matched. Each entry is a
+ * statement that would have applied to this request had its condition been
+ * readable.
  */
 export declare class SimIamPolicyStatementMatcher {
     private readonly context;
     private readonly conditionMatcher;
     private readonly principalMatcher;
+    private readonly unevaluated;
     constructor(context: SimIamAuthZContext);
+    /**
+     * The statements read so far that the simulator could not evaluate.
+     */
+    get unevaluatedStatements(): SimIamUnevaluatedStatements;
     /**
      * Check whether a parsed statement applies to the current request.
      *
@@ -32,6 +44,11 @@ export declare class SimIamPolicyStatementMatcher {
      * statement.
      */
     matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): SimIamPrincipalMatch;
+    /**
+     * Check the statement's condition block, recording it as unevaluated where
+     * an operator stopped the simulator reading it.
+     */
+    private conditionMatches;
     /**
      * Check Action or NotAction against the requested IAM action.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js

@@ -1,6 +1,8 @@
 import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
 import { SimIamPolicyConditionMatcher } from "./condition/sim-iam-policy-condition-matcher.js";
 import { SimIamPolicyPrincipalMatcher } from "./sim-iam-policy-principal-matcher.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
+import { SimIamUnevaluatedStatements } from "../unevaluated/sim-iam-unevaluated-statements.js";
 /**
  * Matches one parsed IAM policy statement against one authorization request.
  *
@@ -18,16 +20,29 @@ import { SimIamPolicyPrincipalMatcher } from "./sim-iam-policy-principal-matcher
  * - Action and NotAction;
  * - Resource and NotResource;
  * - supported IAM string conditions.
+ *
+ * One matcher reads every policy of one request, and it is also where the
+ * statements the simulator could not evaluate are collected. A statement is
+ * recorded only once everything else about it has matched. Each entry is a
+ * statement that would have applied to this request had its condition been
+ * readable.
  */
 export class SimIamPolicyStatementMatcher {
     context;
     conditionMatcher;
     principalMatcher;
+    unevaluated = new SimIamUnevaluatedStatements();
     constructor(context) {
         this.context = context;
         this.conditionMatcher = new SimIamPolicyConditionMatcher(context.conditionContext);
         this.principalMatcher = new SimIamPolicyPrincipalMatcher(context);
     }
+    /**
+     * The statements read so far that the simulator could not evaluate.
+     */
+    get unevaluatedStatements() {
+        return this.unevaluated;
+    }
     /**
      * Check whether a parsed statement applies to the current request.
      *
@@ -37,10 +52,23 @@ export class SimIamPolicyStatementMatcher {
      */
     matches(policy, statement) {
         const principal = this.principalMatcher.matches(policy, statement);
-        return principal.when(principal.matched &&
-            this.actionMatches(statement) &&
-            this.resourceMatches(policy, statement) &&
-            this.conditionMatcher.matches(statement.condition));
+        if (!principal.matched ||
+            !this.actionMatches(statement) ||
+            !this.resourceMatches(policy, statement)) {
+            return SimIamPrincipalMatch.none();
+        }
+        return principal.when(this.conditionMatches(policy, statement));
+    }
+    /**
+     * Check the statement's condition block, recording it as unevaluated where
+     * an operator stopped the simulator reading it.
+     */
+    conditionMatches(policy, statement) {
+        const condition = this.conditionMatcher.matches(statement.condition);
+        for (const operator of condition.unsupportedOperators) {
+            this.unevaluated.record(policy, statement.source, `unsupported condition operator ${operator}`);
+        }
+        return condition.matched;
     }
     /**
      * Check Action or NotAction against the requested IAM action.

package/dist/service/iam/authorize/scp/sim-iam-scp-gate.d.ts

@@ -0,0 +1,96 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamPolicyDocumentParser } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamPolicyStatementMatcher } from "../match/sim-iam-policy-statement-matcher.js";
+import type { SimIamAuthZServiceControlPolicies } from "../context/sim-iam-auth-z-context.js";
+import { SimIamPolicyDecisionValue } from "../sim-iam-decision-value.js";
+interface SimIamScpGateProperties {
+    readonly serviceControlPolicies: SimIamAuthZServiceControlPolicies;
+    readonly policyDocumentParser: SimIamPolicyDocumentParser;
+    readonly statementMatcher: SimIamPolicyStatementMatcher;
+}
+/**
+ * What an Account's service control policies say about one request.
+ *
+ * An SCP is a filter on the permissions an Account's principals can be given.
+ * It grants nothing, so this runs as a gate in front of the identity and
+ * resource policy evaluation instead of contributing Allows to it. The rules
+ * are the ones AWS applies at the Account boundary:
+ *
+ * - a matching Deny at any level ends the request;
+ * - every level between the root and the Account has to produce a matching
+ *   Allow of its own.
+ *
+ * The second rule is what makes the levels worth keeping apart. A root
+ * allowing S3 and an organizational unit allowing DynamoDB leave an Account
+ * beneath them able to do neither, because each level is asked separately.
+ *
+ * An Account outside any organization's reach is unrestricted, and this gate
+ * stands open for it. An Account inside one that holds no policy is a
+ * different case: nothing allows it anything, so the gate is shut.
+ */
+export declare class SimIamScpGate {
+    private readonly applies;
+    private readonly denyStatementRecords;
+    private readonly allowStatementRecords;
+    private readonly unallowedLevelNames;
+    constructor(properties: SimIamScpGateProperties);
+    /**
+     * Whether any service control policy applied to this request at all.
+     */
+    get isApplied(): boolean;
+    /**
+     * Whether an attached policy explicitly denied the request.
+     */
+    get isExplicitDeny(): boolean;
+    /**
+     * Whether a level left the request unallowed.
+     *
+     * A Deny is reported by `isExplicitDeny` and leaves this false, so the two
+     * name different denials and a reader can tell them apart.
+     */
+    get isImplicitDeny(): boolean;
+    /**
+     * Whether the service control policies denied the request either way.
+     */
+    get isDenied(): boolean;
+    /**
+     * The decision this gate forces, where it forces one.
+     *
+     * Undefined leaves the request to the identity and resource policies, which
+     * is what an open gate means.
+     */
+    get value(): SimIamPolicyDecisionValue | undefined;
+    /**
+     * Matching Deny statements from the attached policies.
+     */
+    get denyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from the attached policies, across every level.
+     */
+    get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * The levels that allowed nothing matching the request, root first.
+     *
+     * This is what a test reads to find which node in the organization is in the
+     * way, which is the part of an SCP denial AWS makes hardest to work out.
+     */
+    get unallowedLevels(): readonly string[];
+    /**
+     * How an AWS error explains this denial, if this gate is what denied it.
+     *
+     * The wording follows the AccessDenied messages AWS returns for the two
+     * cases, so a test asserting on the message reads what it would in a real
+     * account.
+     */
+    denialReason(action: string): string | undefined;
+    /**
+     * Record what one level of the organization said.
+     */
+    private evaluateLevel;
+    /**
+     * Record the matching statements of one attached policy, and say whether it
+     * allowed the request.
+     */
+    private evaluatePolicy;
+}
+export {};