@kensio/yulin 1.20.13 → 1.20.14

package/dist/service/scheduler/command/authorize/sim-scheduler-authorizer.d.ts

@@ -10,7 +10,8 @@ interface SimSchedulerAuthorizerProperties {
  * The resource is the schedule ARN, which carries its group:
  * `arn:aws:scheduler:<region>:<account>:schedule/<group>/<name>`. A policy
  * written without the group in it matches nothing here, as it matches nothing
- * on real AWS.
+ * on real AWS. A group command authorizes against the group's own ARN, which
+ * is a different resource path: `schedule-group/<name>`.
  *
  * This is the caller's own authorization to manage schedules, and is a separate
  * question from whether a schedule's execution role may invoke its target. The
@@ -22,16 +23,16 @@ export declare class SimSchedulerAuthorizer {
     private readonly callerIdentifier;
     constructor(properties: SimSchedulerAuthorizerProperties);
     /**
-     * Ensure the caller may perform an action on a schedule, named by its ARN.
+     * Ensure the caller may perform an action on a resource, named by its ARN.
      *
-     * The schedule need not exist: `CreateSchedule` authorizes against the ARN
-     * the schedule is about to have.
+     * The resource need not exist: `CreateSchedule` authorizes against the ARN
+     * the schedule is about to have, and `CreateScheduleGroup` against the
+     * group's.
      */
-    authorizeSchedule(action: string, scheduleArn: string, options?: SimSchedulerRequestOptions): SimAwsResolvedCaller;
+    authorizeResource(action: string, resource: string, options?: SimSchedulerRequestOptions): SimAwsResolvedCaller;
     /**
-     * Ensure the caller may perform an action naming no particular schedule.
+     * Ensure the caller may perform an action naming no particular resource.
      */
-    authorizeAnySchedule(action: string, options?: SimSchedulerRequestOptions): SimAwsResolvedCaller;
-    private authorizeResource;
+    authorizeAnyResource(action: string, options?: SimSchedulerRequestOptions): SimAwsResolvedCaller;
 }
 export {};

package/dist/service/scheduler/command/authorize/sim-scheduler-authorizer.js

@@ -3,8 +3,8 @@ import { SimSchedulerAccessDeniedException } from "../../error/sim-scheduler.err
 /**
  * The resource an action with no resource type authorizes against.
  *
- * `ListSchedules` names no schedule, so IAM evaluates it against `*` and only a
- * policy whose Resource is `*` allows it.
+ * `ListSchedules` and `ListScheduleGroups` name nothing, so IAM evaluates them
+ * against `*` and only a policy whose Resource is `*` allows them.
  */
 const noResource = "*";
 /**
@@ -13,7 +13,8 @@ const noResource = "*";
  * The resource is the schedule ARN, which carries its group:
  * `arn:aws:scheduler:<region>:<account>:schedule/<group>/<name>`. A policy
  * written without the group in it matches nothing here, as it matches nothing
- * on real AWS.
+ * on real AWS. A group command authorizes against the group's own ARN, which
+ * is a different resource path: `schedule-group/<name>`.
  *
  * This is the caller's own authorization to manage schedules, and is a separate
  * question from whether a schedule's execution role may invoke its target. The
@@ -27,20 +28,12 @@ export class SimSchedulerAuthorizer {
         this.iam = properties.iam;
     }
     /**
-     * Ensure the caller may perform an action on a schedule, named by its ARN.
+     * Ensure the caller may perform an action on a resource, named by its ARN.
      *
-     * The schedule need not exist: `CreateSchedule` authorizes against the ARN
-     * the schedule is about to have.
+     * The resource need not exist: `CreateSchedule` authorizes against the ARN
+     * the schedule is about to have, and `CreateScheduleGroup` against the
+     * group's.
      */
-    authorizeSchedule(action, scheduleArn, options) {
-        return this.authorizeResource(action, scheduleArn, options);
-    }
-    /**
-     * Ensure the caller may perform an action naming no particular schedule.
-     */
-    authorizeAnySchedule(action, options) {
-        return this.authorizeResource(action, noResource, options);
-    }
     authorizeResource(action, resource, options) {
         const decision = this.iam.authorize({
             action,
@@ -54,4 +47,10 @@ export class SimSchedulerAuthorizer {
         }
         return decision.caller;
     }
+    /**
+     * Ensure the caller may perform an action naming no particular resource.
+     */
+    authorizeAnyResource(action, options) {
+        return this.authorizeResource(action, noResource, options);
+    }
 }

package/dist/service/scheduler/command/group/group.command.d.ts

@@ -0,0 +1,90 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * One tag a request asks to put on a schedule group.
+ *
+ * Read only so the group commands can refuse them. Nothing here stores a tag,
+ * and a group carrying one it never got would be worse than the refusal.
+ */
+export interface SimSchedulerTag {
+    readonly Key?: string | undefined;
+    readonly Value?: string | undefined;
+}
+/**
+ * Minimal structural sim Scheduler CreateScheduleGroup command.
+ *
+ * https://docs.aws.amazon.com/scheduler/latest/APIReference/API_CreateScheduleGroup.html
+ */
+export interface SimCreateScheduleGroupCommand {
+    readonly input: SimCreateScheduleGroupCommandInput;
+}
+export interface SimCreateScheduleGroupCommandInput {
+    readonly Name?: string | undefined;
+    readonly Tags?: readonly SimSchedulerTag[] | undefined;
+    readonly ClientToken?: string | undefined;
+}
+export interface SimCreateScheduleGroupCommandOutput {
+    readonly ScheduleGroupArn?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim Scheduler GetScheduleGroup command.
+ *
+ * https://docs.aws.amazon.com/scheduler/latest/APIReference/API_GetScheduleGroup.html
+ */
+export interface SimGetScheduleGroupCommand {
+    readonly input: SimGetScheduleGroupCommandInput;
+}
+export interface SimGetScheduleGroupCommandInput {
+    readonly Name?: string | undefined;
+}
+export interface SimGetScheduleGroupCommandOutput {
+    readonly Arn?: string | undefined;
+    readonly Name?: string | undefined;
+    readonly State?: string | undefined;
+    readonly CreationDate?: Date | undefined;
+    readonly LastModificationDate?: Date | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim Scheduler DeleteScheduleGroup command.
+ *
+ * https://docs.aws.amazon.com/scheduler/latest/APIReference/API_DeleteScheduleGroup.html
+ */
+export interface SimDeleteScheduleGroupCommand {
+    readonly input: SimDeleteScheduleGroupCommandInput;
+}
+export interface SimDeleteScheduleGroupCommandInput {
+    readonly Name?: string | undefined;
+    readonly ClientToken?: string | undefined;
+}
+export interface SimDeleteScheduleGroupCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * One schedule group as a listing reports it, which is all of it.
+ */
+export interface SimSchedulerListedScheduleGroup {
+    readonly Arn: string;
+    readonly Name: string;
+    readonly State: string;
+    readonly CreationDate: Date;
+    readonly LastModificationDate: Date;
+}
+/**
+ * Minimal structural sim Scheduler ListScheduleGroups command.
+ *
+ * https://docs.aws.amazon.com/scheduler/latest/APIReference/API_ListScheduleGroups.html
+ */
+export interface SimListScheduleGroupsCommand {
+    readonly input: SimListScheduleGroupsCommandInput;
+}
+export interface SimListScheduleGroupsCommandInput {
+    readonly NamePrefix?: string | undefined;
+    readonly MaxResults?: number | undefined;
+    readonly NextToken?: string | undefined;
+}
+export interface SimListScheduleGroupsCommandOutput {
+    readonly ScheduleGroups?: readonly SimSchedulerListedScheduleGroup[] | undefined;
+    readonly NextToken?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/scheduler/command/group/group.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/scheduler/command/group/sim-scheduler-described-group.d.ts

@@ -0,0 +1,15 @@
+import type { SimSchedulerScheduleGroup } from "../../group/sim-scheduler-schedule-group.js";
+import type { SimGetScheduleGroupCommandOutput, SimSchedulerListedScheduleGroup } from "./group.command.js";
+/**
+ * One group as `GetScheduleGroup` reports it.
+ */
+export declare function describedScheduleGroup(group: SimSchedulerScheduleGroup): Omit<SimGetScheduleGroupCommandOutput, "$metadata">;
+/**
+ * One group as a listing reports it.
+ *
+ * A group has nothing a describe carries and a listing does not, unlike a
+ * schedule, so these two agree on everything. They are written apart anyway
+ * because the AWS shapes are separate and only one of them has required
+ * fields.
+ */
+export declare function listedScheduleGroup(group: SimSchedulerScheduleGroup): SimSchedulerListedScheduleGroup;

package/dist/service/scheduler/command/group/sim-scheduler-described-group.js

@@ -0,0 +1,29 @@
+/**
+ * One group as `GetScheduleGroup` reports it.
+ */
+export function describedScheduleGroup(group) {
+    return {
+        Arn: group.arn,
+        Name: group.name,
+        State: group.state,
+        CreationDate: group.creationDate,
+        LastModificationDate: group.lastModificationDate,
+    };
+}
+/**
+ * One group as a listing reports it.
+ *
+ * A group has nothing a describe carries and a listing does not, unlike a
+ * schedule, so these two agree on everything. They are written apart anyway
+ * because the AWS shapes are separate and only one of them has required
+ * fields.
+ */
+export function listedScheduleGroup(group) {
+    return {
+        Arn: group.arn,
+        Name: group.name,
+        State: group.state,
+        CreationDate: group.creationDate,
+        LastModificationDate: group.lastModificationDate,
+    };
+}

package/dist/service/scheduler/command/group/sim-scheduler-group-access.d.ts

@@ -0,0 +1,57 @@
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimSchedulerScheduleGroup } from "../../group/sim-scheduler-schedule-group.js";
+import type { SimSchedulerScheduleGroupStore } from "../../group/sim-scheduler-schedule-group-store.js";
+import type { SimSchedulerAuthorizer } from "../authorize/sim-scheduler-authorizer.js";
+import type { SimSchedulerRequestOptions } from "../sim-scheduler-request-options.js";
+interface SimSchedulerGroupAccessProperties {
+    readonly groups: SimSchedulerScheduleGroupStore;
+    readonly authorizer: SimSchedulerAuthorizer;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * How a request reaches the schedule group it names.
+ *
+ * The same shape as `SimSchedulerScheduleAccess`, and for the same reason. The
+ * caller is authorized before the group is looked up, and a caller with no
+ * permission is refused whether or not the group is there.
+ */
+export declare class SimSchedulerGroupAccess {
+    private readonly groups;
+    private readonly authorizer;
+    private readonly accountRegionScope;
+    constructor(properties: SimSchedulerGroupAccessProperties);
+    /**
+     * Read the group name a request names, and authorize the action on it.
+     *
+     * The group need not exist: `CreateScheduleGroup` authorizes against the ARN
+     * the group is about to have.
+     */
+    authorized(action: string, name: string | undefined, options?: SimSchedulerRequestOptions): string;
+    /**
+     * Resolve the group a request names, authorizing the action first.
+     */
+    require(action: string, name: string | undefined, options?: SimSchedulerRequestOptions): SimSchedulerScheduleGroup;
+    /**
+     * Resolve the group a request wants deleted, which `default` is never one
+     * of.
+     *
+     * AWS leaves the answer for the `default` group undocumented, and a
+     * simulation that let it go would have no way of getting it back. It comes
+     * with the Account rather than being created, and every request naming no
+     * group wants it.
+     */
+    requireDeletable(action: string, name: string | undefined, options?: SimSchedulerRequestOptions): SimSchedulerScheduleGroup;
+    /**
+     * Let a listing through, which names no group.
+     *
+     * `ListScheduleGroups` authorizes against every group in the Account rather
+     * than against each one it is about to report, and does not filter the
+     * listing by what the caller can reach.
+     */
+    authorizeListing(action: string, options?: SimSchedulerRequestOptions): void;
+    /**
+     * The ARN a group of this name has, or would have.
+     */
+    private arnFor;
+}
+export {};

package/dist/service/scheduler/command/group/sim-scheduler-group-access.js

@@ -0,0 +1,70 @@
+import { schedulerScheduleGroupArn } from "../../group/sim-scheduler-schedule-group-arn.js";
+import { SimSchedulerValidationException } from "../../error/sim-scheduler.error.js";
+import { defaultScheduleGroupName, requiredScheduleGroupName, } from "../../schedule/sim-scheduler-schedule-name.js";
+/**
+ * How a request reaches the schedule group it names.
+ *
+ * The same shape as `SimSchedulerScheduleAccess`, and for the same reason. The
+ * caller is authorized before the group is looked up, and a caller with no
+ * permission is refused whether or not the group is there.
+ */
+export class SimSchedulerGroupAccess {
+    groups;
+    authorizer;
+    accountRegionScope;
+    constructor(properties) {
+        this.groups = properties.groups;
+        this.authorizer = properties.authorizer;
+        this.accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Read the group name a request names, and authorize the action on it.
+     *
+     * The group need not exist: `CreateScheduleGroup` authorizes against the ARN
+     * the group is about to have.
+     */
+    authorized(action, name, options) {
+        const groupName = requiredScheduleGroupName(name);
+        this.authorizer.authorizeResource(action, this.arnFor(groupName), options);
+        return groupName;
+    }
+    /**
+     * Resolve the group a request names, authorizing the action first.
+     */
+    require(action, name, options) {
+        return this.groups.require(this.authorized(action, name, options));
+    }
+    /**
+     * Resolve the group a request wants deleted, which `default` is never one
+     * of.
+     *
+     * AWS leaves the answer for the `default` group undocumented, and a
+     * simulation that let it go would have no way of getting it back. It comes
+     * with the Account rather than being created, and every request naming no
+     * group wants it.
+     */
+    requireDeletable(action, name, options) {
+        const groupName = this.authorized(action, name, options);
+        if (groupName === defaultScheduleGroupName) {
+            throw new SimSchedulerValidationException(`The ${defaultScheduleGroupName} schedule group comes with the ` +
+                `Account and cannot be deleted.`);
+        }
+        return this.groups.require(groupName);
+    }
+    /**
+     * Let a listing through, which names no group.
+     *
+     * `ListScheduleGroups` authorizes against every group in the Account rather
+     * than against each one it is about to report, and does not filter the
+     * listing by what the caller can reach.
+     */
+    authorizeListing(action, options) {
+        this.authorizer.authorizeAnyResource(action, options);
+    }
+    /**
+     * The ARN a group of this name has, or would have.
+     */
+    arnFor(groupName) {
+        return schedulerScheduleGroupArn(groupName, this.accountRegionScope);
+    }
+}

package/dist/service/scheduler/command/group/sim-scheduler-group-commands.d.ts

@@ -0,0 +1,46 @@
+import type { SimSchedulerScheduleGroupStore } from "../../group/sim-scheduler-schedule-group-store.js";
+import type { SimSchedulerScheduleStore } from "../../schedule/sim-scheduler-schedule-store.js";
+import type { SimSchedulerRequestOptions } from "../sim-scheduler-request-options.js";
+import type { SimSchedulerGroupAccess } from "./sim-scheduler-group-access.js";
+import type { SimCreateScheduleGroupCommand, SimCreateScheduleGroupCommandOutput, SimDeleteScheduleGroupCommand, SimDeleteScheduleGroupCommandOutput, SimGetScheduleGroupCommand, SimGetScheduleGroupCommandOutput, SimListScheduleGroupsCommand, SimListScheduleGroupsCommandOutput } from "./group.command.js";
+interface SimSchedulerGroupCommandsProperties {
+    readonly groups: SimSchedulerScheduleGroupStore;
+    readonly schedules: SimSchedulerScheduleStore;
+    readonly access: SimSchedulerGroupAccess;
+}
+/**
+ * The commands that manage schedule groups.
+ *
+ * All four in one handler, unlike schedules, where creating and updating are
+ * their own. A group is a name. There is no request to read into a resource,
+ * and no update at all, since `Name` is the only thing a group has and AWS
+ * replaces the group to change it.
+ */
+export declare class SimSchedulerGroupCommands {
+    private readonly groups;
+    private readonly schedules;
+    private readonly access;
+    constructor(properties: SimSchedulerGroupCommandsProperties);
+    /**
+     * Create a schedule group.
+     */
+    createScheduleGroup(command: SimCreateScheduleGroupCommand, options?: SimSchedulerRequestOptions): SimCreateScheduleGroupCommandOutput;
+    /**
+     * Describe a schedule group.
+     */
+    getScheduleGroup(command: SimGetScheduleGroupCommand, options?: SimSchedulerRequestOptions): SimGetScheduleGroupCommandOutput;
+    /**
+     * Delete a schedule group, and the schedules in it.
+     *
+     * AWS deletes the schedules with the group rather than refusing a group that
+     * still holds some, and leaves the group in a `DELETING` state until they
+     * have gone. Here they go in the same call, so nothing is ever seen in that
+     * state.
+     */
+    deleteScheduleGroup(command: SimDeleteScheduleGroupCommand, options?: SimSchedulerRequestOptions): SimDeleteScheduleGroupCommandOutput;
+    /**
+     * List the schedule groups of this scope, in creation order.
+     */
+    listScheduleGroups(command: SimListScheduleGroupsCommand, options?: SimSchedulerRequestOptions): SimListScheduleGroupsCommandOutput;
+}
+export {};

package/dist/service/scheduler/command/group/sim-scheduler-group-commands.js

@@ -0,0 +1,72 @@
+import { SimSchedulerConflictException } from "../../error/sim-scheduler.error.js";
+import { SimSchedulerPage } from "../sim-scheduler-page.js";
+import { narrowedScheduleGroups } from "./sim-scheduler-listed-groups.js";
+import { refuseUnsimulatedGroupInput } from "./sim-scheduler-unsimulated-group-input.js";
+import { describedScheduleGroup, listedScheduleGroup, } from "./sim-scheduler-described-group.js";
+/**
+ * The commands that manage schedule groups.
+ *
+ * All four in one handler, unlike schedules, where creating and updating are
+ * their own. A group is a name. There is no request to read into a resource,
+ * and no update at all, since `Name` is the only thing a group has and AWS
+ * replaces the group to change it.
+ */
+export class SimSchedulerGroupCommands {
+    groups;
+    schedules;
+    access;
+    constructor(properties) {
+        this.groups = properties.groups;
+        this.schedules = properties.schedules;
+        this.access = properties.access;
+    }
+    /**
+     * Create a schedule group.
+     */
+    createScheduleGroup(command, options) {
+        const input = command.input;
+        refuseUnsimulatedGroupInput(input);
+        const groupName = this.access.authorized("scheduler:CreateScheduleGroup", input.Name, options);
+        if (this.groups.find(groupName) !== undefined) {
+            throw new SimSchedulerConflictException(`Schedule group ${groupName} already exists.`);
+        }
+        return {
+            $metadata: {},
+            ScheduleGroupArn: this.groups.create(groupName).arn,
+        };
+    }
+    /**
+     * Describe a schedule group.
+     */
+    getScheduleGroup(command, options) {
+        const group = this.access.require("scheduler:GetScheduleGroup", command.input.Name, options);
+        return { $metadata: {}, ...describedScheduleGroup(group) };
+    }
+    /**
+     * Delete a schedule group, and the schedules in it.
+     *
+     * AWS deletes the schedules with the group rather than refusing a group that
+     * still holds some, and leaves the group in a `DELETING` state until they
+     * have gone. Here they go in the same call, so nothing is ever seen in that
+     * state.
+     */
+    deleteScheduleGroup(command, options) {
+        const group = this.access.requireDeletable("scheduler:DeleteScheduleGroup", command.input.Name, options);
+        this.schedules.removeGroup(group.name);
+        this.groups.remove(group);
+        return { $metadata: {} };
+    }
+    /**
+     * List the schedule groups of this scope, in creation order.
+     */
+    listScheduleGroups(command, options) {
+        const input = command.input;
+        this.access.authorizeListing("scheduler:ListScheduleGroups", options);
+        const page = new SimSchedulerPage(narrowedScheduleGroups(this.groups.all, input).map(listedScheduleGroup), input.MaxResults, input.NextToken);
+        return {
+            $metadata: {},
+            ScheduleGroups: page.items,
+            NextToken: page.nextToken,
+        };
+    }
+}

package/dist/service/scheduler/command/group/sim-scheduler-listed-groups.d.ts

@@ -0,0 +1,6 @@
+import type { SimSchedulerScheduleGroup } from "../../group/sim-scheduler-schedule-group.js";
+import type { SimListScheduleGroupsCommandInput } from "./group.command.js";
+/**
+ * The groups a listing reports, narrowed by what it asked for.
+ */
+export declare function narrowedScheduleGroups(groups: readonly SimSchedulerScheduleGroup[], input: SimListScheduleGroupsCommandInput): readonly SimSchedulerScheduleGroup[];

package/dist/service/scheduler/command/group/sim-scheduler-listed-groups.js

@@ -0,0 +1,10 @@
+/**
+ * The groups a listing reports, narrowed by what it asked for.
+ */
+export function narrowedScheduleGroups(groups, input) {
+    const prefix = input.NamePrefix;
+    if (prefix === undefined) {
+        return groups;
+    }
+    return groups.filter((group) => group.name.startsWith(prefix));
+}

package/dist/service/scheduler/command/group/sim-scheduler-unsimulated-group-input.d.ts

@@ -0,0 +1,14 @@
+import type { SimCreateScheduleGroupCommandInput } from "./group.command.js";
+/**
+ * Refuse the group request inputs this simulation does not model.
+ *
+ * Tagging is most of what AWS says a group is for, and nothing here reads a
+ * tag back, so a group created without them would look tagged to whoever
+ * asked and untagged to everything else. An empty list asks for no tags, so
+ * there is nothing to drop and nothing to refuse.
+ *
+ * A template is treated differently. The CDK puts a Stack's tags on a group
+ * without being asked, and failing a Stack over them would be a refusal nobody
+ * wrote.
+ */
+export declare function refuseUnsimulatedGroupInput(input: SimCreateScheduleGroupCommandInput): void;

package/dist/service/scheduler/command/group/sim-scheduler-unsimulated-group-input.js

@@ -0,0 +1,19 @@
+import { SimSchedulerUnsimulatedInputException } from "../../error/sim-scheduler.error.js";
+/**
+ * Refuse the group request inputs this simulation does not model.
+ *
+ * Tagging is most of what AWS says a group is for, and nothing here reads a
+ * tag back, so a group created without them would look tagged to whoever
+ * asked and untagged to everything else. An empty list asks for no tags, so
+ * there is nothing to drop and nothing to refuse.
+ *
+ * A template is treated differently. The CDK puts a Stack's tags on a group
+ * without being asked, and failing a Stack over them would be a refusal nobody
+ * wrote.
+ */
+export function refuseUnsimulatedGroupInput(input) {
+    if (input.Tags !== undefined && input.Tags.length > 0) {
+        throw new SimSchedulerUnsimulatedInputException("Schedule group tags are not simulated, so CreateScheduleGroup " +
+            "refuses them rather than dropping them");
+    }
+}

package/dist/service/scheduler/command/schedule/sim-scheduler-create-schedule.js

@@ -26,6 +26,7 @@ export class SimSchedulerCreateSchedule {
         const input = command.input;
         const requested = this.access.requested(input);
         this.access.authorize("scheduler:CreateSchedule", requested, options);
+        this.access.requireGroup(requested.groupName);
         if (this.schedules.find(requested.groupName, requested.name.value) !==
             undefined) {
             throw new SimSchedulerConflictException(`Schedule ${requested.name.value} already exists in group ` +

package/dist/service/scheduler/command/schedule/sim-scheduler-schedule-access.d.ts

@@ -1,4 +1,5 @@
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimSchedulerScheduleGroupStore } from "../../group/sim-scheduler-schedule-group-store.js";
 import { SimSchedulerScheduleName } from "../../schedule/sim-scheduler-schedule-name.js";
 import type { SimSchedulerSchedule } from "../../schedule/sim-scheduler-schedule.js";
 import type { SimSchedulerScheduleStore } from "../../schedule/sim-scheduler-schedule-store.js";
@@ -13,6 +14,7 @@ export interface SimSchedulerRequestedSchedule {
 }
 interface SimSchedulerScheduleAccessProperties {
     readonly schedules: SimSchedulerScheduleStore;
+    readonly groups: SimSchedulerScheduleGroupStore;
     readonly authorizer: SimSchedulerAuthorizer;
     readonly accountRegionScope: SimAwsAccountRegionScope;
 }
@@ -29,6 +31,7 @@ interface SimSchedulerScheduleRequest {
  */
 export declare class SimSchedulerScheduleAccess {
     private readonly schedules;
+    private readonly groups;
     private readonly authorizer;
     private readonly accountRegionScope;
     constructor(properties: SimSchedulerScheduleAccessProperties);
@@ -41,6 +44,19 @@ export declare class SimSchedulerScheduleAccess {
      * exist.
      */
     authorize(action: string, requested: SimSchedulerRequestedSchedule, options?: SimSchedulerRequestOptions): void;
+    /**
+     * Ensure the group a request names is there, which AWS requires of every
+     * request naming one.
+     *
+     * Real Scheduler refuses a schedule whose `GroupName` names no group rather
+     * than creating it in `default`, and so does this. The group is in a
+     * schedule's ARN, and a schedule quietly moved would carry an ARN naming a
+     * group it had never been put in.
+     *
+     * Asked after the caller is authorized, so a caller with no permission
+     * learns nothing about which groups exist.
+     */
+    requireGroup(groupName: string): void;
     /**
      * Resolve the schedule a request names, authorizing the action first.
      */

package/dist/service/scheduler/command/schedule/sim-scheduler-schedule-access.js

@@ -9,10 +9,12 @@ import { requestedScheduleGroupName, SimSchedulerScheduleName, } from "../../sch
  */
 export class SimSchedulerScheduleAccess {
     schedules;
+    groups;
     authorizer;
     accountRegionScope;
     constructor(properties) {
         this.schedules = properties.schedules;
+        this.groups = properties.groups;
         this.authorizer = properties.authorizer;
         this.accountRegionScope = properties.accountRegionScope;
     }
@@ -30,7 +32,22 @@ export class SimSchedulerScheduleAccess {
      * exist.
      */
     authorize(action, requested, options) {
-        this.authorizer.authorizeSchedule(action, this.arnFor(requested), options);
+        this.authorizer.authorizeResource(action, this.arnFor(requested), options);
+    }
+    /**
+     * Ensure the group a request names is there, which AWS requires of every
+     * request naming one.
+     *
+     * Real Scheduler refuses a schedule whose `GroupName` names no group rather
+     * than creating it in `default`, and so does this. The group is in a
+     * schedule's ARN, and a schedule quietly moved would carry an ARN naming a
+     * group it had never been put in.
+     *
+     * Asked after the caller is authorized, so a caller with no permission
+     * learns nothing about which groups exist.
+     */
+    requireGroup(groupName) {
+        this.groups.require(groupName);
     }
     /**
      * Resolve the schedule a request names, authorizing the action first.
@@ -38,6 +55,7 @@ export class SimSchedulerScheduleAccess {
     require(action, request, options) {
         const requested = this.requested(request);
         this.authorize(action, requested, options);
+        this.requireGroup(requested.groupName);
         return this.schedules.require(requested.groupName, requested.name.value);
     }
     /**
@@ -48,8 +66,10 @@ export class SimSchedulerScheduleAccess {
      * listing by what the caller can reach.
      */
     listedGroupName(action, requested, options) {
-        this.authorizer.authorizeAnySchedule(action, options);
-        return requestedScheduleGroupName(requested);
+        this.authorizer.authorizeAnyResource(action, options);
+        const groupName = requestedScheduleGroupName(requested);
+        this.requireGroup(groupName);
+        return groupName;
     }
     /**
      * The ARN a schedule of this name in this group has, or would have.

package/dist/service/scheduler/command/sim-scheduler-command.types.d.ts

@@ -1 +1,2 @@
 export type { SimCreateScheduleCommand, SimCreateScheduleCommandOutput, SimDeleteScheduleCommand, SimDeleteScheduleCommandInput, SimDeleteScheduleCommandOutput, SimGetScheduleCommand, SimGetScheduleCommandInput, SimGetScheduleCommandOutput, SimListSchedulesCommand, SimListSchedulesCommandInput, SimListSchedulesCommandOutput, SimSchedulerFlexibleTimeWindow, SimSchedulerListedSchedule, SimSchedulerRequestTarget, SimSchedulerScheduleInput, SimUpdateScheduleCommand, SimUpdateScheduleCommandOutput, } from "./schedule/schedule.command.js";
+export type { SimCreateScheduleGroupCommand, SimCreateScheduleGroupCommandInput, SimCreateScheduleGroupCommandOutput, SimDeleteScheduleGroupCommand, SimDeleteScheduleGroupCommandInput, SimDeleteScheduleGroupCommandOutput, SimGetScheduleGroupCommand, SimGetScheduleGroupCommandInput, SimGetScheduleGroupCommandOutput, SimListScheduleGroupsCommand, SimListScheduleGroupsCommandInput, SimListScheduleGroupsCommandOutput, SimSchedulerListedScheduleGroup, SimSchedulerTag, } from "./group/group.command.js";