@kensio/yulin 1.20.12 → 1.20.14

package/dist/service/organizations/sim-organizations-structure.js

@@ -0,0 +1,140 @@
+import { simAwsAccountId } from "../aws/sim-aws-account.js";
+import { SimOrganizationsEffectivePolicies } from "./policy/sim-organizations-effective-policies.js";
+import { SimOrganizationsScpStore } from "./policy/sim-organizations-scp-store.js";
+import { isSimOrganizationsUnitId, } from "./tree/sim-organizations-node.js";
+import { SimOrganizationsTree } from "./tree/sim-organizations-tree.js";
+/**
+ * The shape of one simulated organization: its root, the organizational units
+ * under it, and where its Accounts sit.
+ *
+ * SimOrganizations is the facade a test reaches through, and this is the half
+ * of it concerned with structure. The policies that hang on that structure are
+ * the other half.
+ */
+export class SimOrganizationsStructure {
+    scpStore = new SimOrganizationsScpStore();
+    tree = new SimOrganizationsTree();
+    effectivePolicies = new SimOrganizationsEffectivePolicies({
+        tree: this.tree,
+        scpStore: this.scpStore,
+    });
+    /**
+     * The root of this organization, which every Account sits under.
+     */
+    root() {
+        return this.tree.root;
+    }
+    /**
+     * Create an organizational unit, under the root unless a parent unit is
+     * given.
+     */
+    createOrganizationalUnit(name, parent) {
+        return this.tree.createOrganizationalUnit(name, this.parentIdOf(parent));
+    }
+    /**
+     * Put an Account in the organization, under an organizational unit or under
+     * the root.
+     */
+    moveAccount(accountId, parent) {
+        this.tree.placeAccount(simAwsAccountId(accountId), this.parentIdOf(parent));
+    }
+    /**
+     * Name the Account that pays the organization's bills.
+     *
+     * AWS exempts the management account from every service control policy, and
+     * so does this. An Account named here is decided by its identity and
+     * resource policies alone, whatever is attached above it.
+     */
+    setManagementAccount(accountId) {
+        const account = simAwsAccountId(accountId);
+        this.effectivePolicies.setManagementAccount(account);
+        this.tree.placeAccount(account);
+    }
+    /**
+     * Every Account this organization holds.
+     *
+     * A test tracking down where a denial came from reads this to see which
+     * Accounts the organization is filtering at all.
+     */
+    accountIds() {
+        return this.tree.accountIds();
+    }
+    /**
+     * Take an Account out of the organization.
+     *
+     * Nothing then filters its requests, whatever is attached above where it
+     * sat. This is how an Account leaves an organization, and it is a different
+     * thing from taking the policies off it.
+     */
+    removeAccount(accountId) {
+        this.tree.removeAccount(simAwsAccountId(accountId));
+    }
+    /**
+     * Take an organizational unit out of the organization.
+     *
+     * Anything still under it moves up to its parent, so every Account keeps a
+     * path back to the root.
+     */
+    removeOrganizationalUnit(target) {
+        const nodeId = this.knownNodeIdOf(target);
+        if (nodeId !== undefined) {
+            this.tree.removeOrganizationalUnit(nodeId);
+        }
+    }
+    /**
+     * The node a target names.
+     *
+     * An Account is named by its twelve-digit id and needs no place in the
+     * organization yet, because attaching a policy to one is what puts it there.
+     * A root or organizational unit, whether given as a handle or as the `r-` or
+     * `ou-` id a template carries, has to be this organization's own. One from
+     * another organization is refused rather than attached to and never read.
+     */
+    nodeIdOf(target) {
+        if (typeof target !== "string") {
+            this.tree.requireNode(target.id);
+            return target.id;
+        }
+        if (!isSimOrganizationsUnitId(target)) {
+            return simAwsAccountId(target);
+        }
+        const nodeId = target;
+        this.tree.requireNode(nodeId);
+        return nodeId;
+    }
+    /**
+     * Refuse the whole set unless every target names a node this organization
+     * has.
+     *
+     * Attaching one policy to several nodes is one act, so it either reaches all
+     * of them or none. Failing partway would leave a policy attached where
+     * nothing knows to take it off.
+     */
+    requireTargets(targets) {
+        for (const target of targets) {
+            this.nodeIdOf(target);
+        }
+    }
+    /**
+     * The node a target names, or nothing where this organization has no such
+     * node.
+     *
+     * Taking something off a node that has already gone is what a Stack teardown
+     * asks for when a unit came down before the policy pointing at it. There is
+     * nothing to take off, and refusing would fail a teardown over work already
+     * done.
+     */
+    knownNodeIdOf(target) {
+        if (typeof target === "string" && !isSimOrganizationsUnitId(target)) {
+            return simAwsAccountId(target);
+        }
+        const nodeId = (typeof target === "string" ? target : target.id);
+        return this.tree.hasNode(nodeId) ? nodeId : undefined;
+    }
+    /**
+     * The node something sits under, defaulting to the root.
+     */
+    parentIdOf(parent) {
+        return parent === undefined ? undefined : this.nodeIdOf(parent);
+    }
+}

package/dist/service/organizations/sim-organizations.d.ts

@@ -0,0 +1,95 @@
+import { type SimAwsAccountId } from "../aws/sim-aws-account.js";
+import type { SimIamPolicyDocument } from "../iam/policy/sim-iam-policy.js";
+import type { SimIamServiceControlPolicy, SimIamServiceControlPolicyResolver, SimIamServiceControlPolicySet } from "../iam/authorize/scp/sim-iam-scp-resolver.js";
+import { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+import { type SimOrganizationsTarget } from "./tree/sim-organizations-node.js";
+/**
+ * Options for one attached service control policy.
+ */
+export interface SimOrganizationsAttachOptions {
+    /**
+     * What to call the policy in a denial. Defaults to `ServiceControlPolicy`.
+     */
+    readonly policyName?: string | undefined;
+    /**
+     * The id to attach the policy under, for taking it off again later.
+     *
+     * One policy attached to several nodes takes the same id at each of them.
+     * Defaults to an id of this attachment's own.
+     */
+    readonly policyId?: string | undefined;
+}
+/**
+ * Simulated AWS Organizations, holding the organization structure and the
+ * service control policies that decide what its Accounts may do.
+ *
+ * An organization spans Accounts, so one of these belongs to a SimAws rather
+ * than to an Account scope, and it is reached as `simAws.organizations()`.
+ *
+ * A service control policy filters permissions and grants none. Every level
+ * between the root and an Account has to allow an action for the Account to be
+ * allowed it, and a Deny at any level ends the request whatever else allows
+ * it. That applies to the Account root as well as to its Roles and Users, so
+ * it catches a CloudFormation deployment and an intercepted SDK call alike.
+ *
+ * The root, the organizational units and where the Accounts sit come from
+ * SimOrganizationsStructure, which this extends.
+ */
+export declare class SimOrganizations extends SimOrganizationsStructure implements SimIamServiceControlPolicyResolver {
+    /**
+     * Attach a service control policy to the root, an organizational unit, or an
+     * Account.
+     *
+     * The node also holds AWS's own FullAWSAccess policy, as it would in a real
+     * organization, so one Deny statement denies that action and leaves the rest
+     * of the node's Accounts working.
+     */
+    attachServiceControlPolicy(target: SimOrganizationsTarget, document: SimIamPolicyDocument, options?: SimOrganizationsAttachOptions): string;
+    /**
+     * Take one service control policy off a node, leaving whatever else is
+     * attached there.
+     *
+     * This is what a CloudFormation teardown uses, because a node can hold
+     * policies from more than one Stack and clearing it would take another
+     * Stack's guardrail away.
+     */
+    detachServiceControlPolicy(target: SimOrganizationsTarget, policyId: string): void;
+    /**
+     * Take AWS's FullAWSAccess policy off a node, leaving only the policies
+     * attached to it to allow anything through that level.
+     *
+     * This turns the node into an allow list. An action no policy attached there
+     * allows is denied for every Account beneath it.
+     */
+    detachFullAwsAccess(target: SimOrganizationsTarget): void;
+    /**
+     * Remove every service control policy attached to a node.
+     *
+     * Only that node is cleared. An Account sitting in an organizational unit
+     * goes on inheriting what the levels above it say, as it does in AWS, where
+     * detaching a policy from an account leaves the account where it is. Take an
+     * Account out of the organization with `removeAccount`.
+     *
+     * A node that has already gone leaves nothing to take off, so this does
+     * nothing rather than refusing. A Stack teardown reaches that case whenever
+     * a unit came down before the policy pointing at it.
+     */
+    detachServiceControlPolicies(target: SimOrganizationsTarget): void;
+    /**
+     * The service control policies in force for an Account, root level first.
+     *
+     * This flattens the levels, so it says what was evaluated without saying
+     * which level each policy came from. `serviceControlPolicySetFor` keeps that
+     * apart, and a denial needs it, because a level allowing nothing denies the
+     * Account whatever another level allows.
+     */
+    serviceControlPoliciesFor(accountId: SimAwsAccountId | string): readonly SimIamServiceControlPolicy[];
+    /**
+     * The policies in force for an Account, level by level, along with whether
+     * the Account is inside this organization at all.
+     *
+     * Sim IAM reads this rather than the flattened list, because each level has
+     * to allow an action on its own.
+     */
+    serviceControlPolicySetFor(accountId: SimAwsAccountId | string): SimIamServiceControlPolicySet;
+}

package/dist/service/organizations/sim-organizations.js

@@ -0,0 +1,99 @@
+import { simAwsAccountId, } from "../aws/sim-aws-account.js";
+import { SimOrganizationsStructure } from "./sim-organizations-structure.js";
+import { makeSimOrganizationsPolicyId, } from "./tree/sim-organizations-node.js";
+/**
+ * Simulated AWS Organizations, holding the organization structure and the
+ * service control policies that decide what its Accounts may do.
+ *
+ * An organization spans Accounts, so one of these belongs to a SimAws rather
+ * than to an Account scope, and it is reached as `simAws.organizations()`.
+ *
+ * A service control policy filters permissions and grants none. Every level
+ * between the root and an Account has to allow an action for the Account to be
+ * allowed it, and a Deny at any level ends the request whatever else allows
+ * it. That applies to the Account root as well as to its Roles and Users, so
+ * it catches a CloudFormation deployment and an intercepted SDK call alike.
+ *
+ * The root, the organizational units and where the Accounts sit come from
+ * SimOrganizationsStructure, which this extends.
+ */
+export class SimOrganizations extends SimOrganizationsStructure {
+    /**
+     * Attach a service control policy to the root, an organizational unit, or an
+     * Account.
+     *
+     * The node also holds AWS's own FullAWSAccess policy, as it would in a real
+     * organization, so one Deny statement denies that action and leaves the rest
+     * of the node's Accounts working.
+     */
+    attachServiceControlPolicy(target, document, options = {}) {
+        const policyName = options.policyName ?? "ServiceControlPolicy";
+        const policyId = options.policyId ?? makeSimOrganizationsPolicyId();
+        this.scpStore.attach(this.nodeIdOf(target), policyId, document, policyName);
+        return policyId;
+    }
+    /**
+     * Take one service control policy off a node, leaving whatever else is
+     * attached there.
+     *
+     * This is what a CloudFormation teardown uses, because a node can hold
+     * policies from more than one Stack and clearing it would take another
+     * Stack's guardrail away.
+     */
+    detachServiceControlPolicy(target, policyId) {
+        const nodeId = this.knownNodeIdOf(target);
+        if (nodeId !== undefined) {
+            this.scpStore.detach(nodeId, policyId);
+        }
+    }
+    /**
+     * Take AWS's FullAWSAccess policy off a node, leaving only the policies
+     * attached to it to allow anything through that level.
+     *
+     * This turns the node into an allow list. An action no policy attached there
+     * allows is denied for every Account beneath it.
+     */
+    detachFullAwsAccess(target) {
+        this.scpStore.detachFullAwsAccess(this.nodeIdOf(target));
+    }
+    /**
+     * Remove every service control policy attached to a node.
+     *
+     * Only that node is cleared. An Account sitting in an organizational unit
+     * goes on inheriting what the levels above it say, as it does in AWS, where
+     * detaching a policy from an account leaves the account where it is. Take an
+     * Account out of the organization with `removeAccount`.
+     *
+     * A node that has already gone leaves nothing to take off, so this does
+     * nothing rather than refusing. A Stack teardown reaches that case whenever
+     * a unit came down before the policy pointing at it.
+     */
+    detachServiceControlPolicies(target) {
+        const nodeId = this.knownNodeIdOf(target);
+        if (nodeId !== undefined) {
+            this.scpStore.detachAll(nodeId);
+        }
+    }
+    /**
+     * The service control policies in force for an Account, root level first.
+     *
+     * This flattens the levels, so it says what was evaluated without saying
+     * which level each policy came from. `serviceControlPolicySetFor` keeps that
+     * apart, and a denial needs it, because a level allowing nothing denies the
+     * Account whatever another level allows.
+     */
+    serviceControlPoliciesFor(accountId) {
+        const set = this.serviceControlPolicySetFor(accountId);
+        return set.levels.flatMap((level) => level.policies);
+    }
+    /**
+     * The policies in force for an Account, level by level, along with whether
+     * the Account is inside this organization at all.
+     *
+     * Sim IAM reads this rather than the flattened list, because each level has
+     * to allow an action on its own.
+     */
+    serviceControlPolicySetFor(accountId) {
+        return this.effectivePolicies.setFor(simAwsAccountId(accountId));
+    }
+}

package/dist/service/organizations/tree/sim-organizations-node.d.ts

@@ -0,0 +1,57 @@
+import type { Brand } from "../../../util/brand.type.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+export type SimOrganizationsRootId = Brand<string, "SimOrganizationsRootId">;
+export type SimOrganizationsOrganizationalUnitId = Brand<string, "SimOrganizationsOrganizationalUnitId">;
+/**
+ * Anything a service control policy can hang on.
+ *
+ * AWS attaches a policy to the root, to an organizational unit, or to one
+ * account, and an account inherits every policy on the path down to it.
+ */
+export type SimOrganizationsNodeId = SimOrganizationsRootId | SimOrganizationsOrganizationalUnitId | SimAwsAccountId;
+/**
+ * Generate an AWS-shaped organization root id.
+ */
+export declare function makeSimOrganizationsRootId(): SimOrganizationsRootId;
+/**
+ * Generate an AWS-shaped organizational unit id.
+ */
+export declare function makeSimOrganizationsOrganizationalUnitId(rootId: SimOrganizationsRootId): SimOrganizationsOrganizationalUnitId;
+/**
+ * Generate an AWS-shaped service control policy id.
+ */
+export declare function makeSimOrganizationsPolicyId(): string;
+/**
+ * An organizational unit in a simulated organization.
+ *
+ * This is the handle a test holds on to. Pass it where a policy is attached or
+ * an Account is moved, so neither reads back as a bare string.
+ */
+export declare class SimOrganizationsOrganizationalUnit {
+    readonly id: SimOrganizationsOrganizationalUnitId;
+    readonly name: string;
+    readonly parentId: SimOrganizationsNodeId;
+    constructor(id: SimOrganizationsOrganizationalUnitId, name: string, parentId: SimOrganizationsNodeId);
+}
+/**
+ * The root of a simulated organization.
+ */
+export declare class SimOrganizationsRoot {
+    readonly id: SimOrganizationsRootId;
+    readonly name = "Root";
+    constructor(id: SimOrganizationsRootId);
+}
+/**
+ * Somewhere a policy can be attached, given as a handle or as an id.
+ *
+ * An id is what a CloudFormation template carries, since a `Ref` to a unit
+ * resolves to the id AWS gave it rather than to anything holding a reference.
+ */
+export type SimOrganizationsTarget = SimOrganizationsRoot | SimOrganizationsOrganizationalUnit | string;
+/**
+ * Whether an id names the root or an organizational unit.
+ *
+ * AWS ids carry their own kind in a prefix, and an Account id is twelve
+ * digits, so nothing here has to guess which of the two a string is.
+ */
+export declare function isSimOrganizationsUnitId(value: string): boolean;

package/dist/service/organizations/tree/sim-organizations-node.js

@@ -0,0 +1,58 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Generate an AWS-shaped organization root id.
+ */
+export function makeSimOrganizationsRootId() {
+    return `r-${faker.string.alphanumeric({
+        length: 4,
+        casing: "lower",
+    })}`;
+}
+/**
+ * Generate an AWS-shaped organizational unit id.
+ */
+export function makeSimOrganizationsOrganizationalUnitId(rootId) {
+    const suffix = faker.string.alphanumeric({ length: 8, casing: "lower" });
+    return `ou-${rootId.slice(2)}-${suffix}`;
+}
+/**
+ * Generate an AWS-shaped service control policy id.
+ */
+export function makeSimOrganizationsPolicyId() {
+    return `p-${faker.string.alphanumeric({ length: 8, casing: "lower" })}`;
+}
+/**
+ * An organizational unit in a simulated organization.
+ *
+ * This is the handle a test holds on to. Pass it where a policy is attached or
+ * an Account is moved, so neither reads back as a bare string.
+ */
+export class SimOrganizationsOrganizationalUnit {
+    id;
+    name;
+    parentId;
+    constructor(id, name, parentId) {
+        this.id = id;
+        this.name = name;
+        this.parentId = parentId;
+    }
+}
+/**
+ * The root of a simulated organization.
+ */
+export class SimOrganizationsRoot {
+    id;
+    name = "Root";
+    constructor(id) {
+        this.id = id;
+    }
+}
+/**
+ * Whether an id names the root or an organizational unit.
+ *
+ * AWS ids carry their own kind in a prefix, and an Account id is twelve
+ * digits, so nothing here has to guess which of the two a string is.
+ */
+export function isSimOrganizationsUnitId(value) {
+    return value.startsWith("r-") || value.startsWith("ou-");
+}

package/dist/service/organizations/tree/sim-organizations-tree.d.ts

@@ -0,0 +1,91 @@
+import { SimOrganizationsOrganizationalUnit, type SimOrganizationsNodeId, SimOrganizationsRoot } from "./sim-organizations-node.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+/**
+ * Thrown for an organizational unit this organization has never seen.
+ */
+export declare class SimOrganizationsUnknownNode extends Error {
+    constructor(nodeId: string);
+}
+/**
+ * Where the Accounts and organizational units of one simulated organization
+ * sit relative to each other.
+ *
+ * The tree answers one question for authorization: which nodes lie on the path
+ * from the root down to an Account. Every policy on that path applies to the
+ * Account, which is what makes an organizational unit worth modelling at all.
+ *
+ * An Account joins the organization the moment it is named, whether by being
+ * moved into a unit or by having a policy attached to it. An Account never
+ * named sits outside the organization and is unrestricted.
+ */
+export declare class SimOrganizationsTree {
+    readonly root: SimOrganizationsRoot;
+    private readonly organizationalUnits;
+    private readonly accountParents;
+    /**
+     * Create an organizational unit, under the root unless another unit is
+     * named as its parent.
+     */
+    createOrganizationalUnit(name: string, parentId?: SimOrganizationsNodeId): SimOrganizationsOrganizationalUnit;
+    /**
+     * Place an Account under a node, joining the organization if it was outside
+     * it.
+     */
+    placeAccount(accountId: SimAwsAccountId, parentId?: SimOrganizationsNodeId): void;
+    /**
+     * Take an Account out of the organization.
+     */
+    removeAccount(accountId: SimAwsAccountId): void;
+    /**
+     * Take an organizational unit out of the organization.
+     *
+     * Whatever still sits under it moves up to its parent, which is the only
+     * answer that leaves every Account on a path back to the root. AWS refuses
+     * to delete a unit that still holds anything, and a Stack tears down in
+     * reverse dependency order, so nothing should still be there.
+     */
+    removeOrganizationalUnit(unitId: SimOrganizationsNodeId): void;
+    /**
+     * Every Account in the organization.
+     */
+    accountIds(): readonly SimAwsAccountId[];
+    /**
+     * Whether this Account is in the organization.
+     */
+    holds(accountId: SimAwsAccountId): boolean;
+    /**
+     * Refuse a root or organizational unit this organization never created.
+     *
+     * A handle from another simulated organization would otherwise be attached
+     * to and then never read, because no Account here has it on its path. A
+     * policy that silently applies to nothing is worse than a refusal.
+     */
+    requireNode(nodeId: SimOrganizationsNodeId): void;
+    /**
+     * Whether this organization has a root or unit under an id.
+     */
+    hasNode(nodeId: SimOrganizationsNodeId): boolean;
+    /**
+     * The nodes a request against an Account is filtered by, root first.
+     *
+     * The Account itself is the last of them, because a policy attached to an
+     * Account applies alongside the ones it inherits.
+     */
+    pathTo(accountId: SimAwsAccountId): readonly SimOrganizationsNodeId[];
+    /**
+     * What to call a node in a denial.
+     */
+    nameOf(nodeId: SimOrganizationsNodeId): string;
+    /**
+     * Move everything under one node up to another.
+     */
+    private reparent;
+    /**
+     * The nodes from the root down to one node, root first.
+     */
+    private ancestors;
+    /**
+     * Refuse a node this organization never created.
+     */
+    private requireKnown;
+}