@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/cloudfront/sim-cloudfront-commands.d.ts

@@ -5,10 +5,8 @@ import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-sco
 import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
 import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimCreateDistributionCommand, SimCreateDistributionCommandOutput } from "./command/create-distribution/create-distribution.command.js";
-import type { SimCreateFunctionCommand, SimCreateFunctionCommandOutput } from "./command/create-function/create-function.command.js";
-import { type SimCloudFrontFunctionMap } from "./command/create-function/create-function.handler.js";
+import type { SimCloudFrontFunctionMap } from "./command/create-function/create-function.handler.js";
 import type { SimDeleteDistributionCommand, SimDeleteDistributionCommandOutput } from "./command/delete-distribution/delete-distribution.command.js";
-import type { SimDeleteFunctionCommand, SimDeleteFunctionCommandOutput } from "./command/delete-function/delete-function.command.js";
 import type { SimGetDistributionCommand, SimGetDistributionCommandOutput } from "./command/get-distribution/get-distribution.command.js";
 import type { SimUpdateDistributionCommand, SimUpdateDistributionCommandOutput } from "./command/update-distribution/update-distribution.command.js";
 import type { SimCloudFrontDistribution, SimCloudFrontDistributionId } from "./distribution/sim-cloudfront-distribution.js";
@@ -16,11 +14,13 @@ import type { SimCfCustomOriginDispatcher } from "./origin/custom/sim-cf-custom-
 import { type SimCloudFrontS3OriginResolver } from "./origin/s3/sim-cloudfront-s3-origin.js";
 import type { SimCloudFrontOriginAccessControlRegistry } from "./origin-access-control/sim-cf-origin-access-control-registry.js";
 import type { SimCloudFrontResponseHeadersPolicyRegistry } from "./response-headers-policy/sim-cf-response-headers-policy-registry.js";
+import type { SimCloudFrontCachePolicyRegistry } from "./cache-policy/sim-cf-cache-policy-registry.js";
 import { SimCloudFrontRegistry } from "./registry/sim-cloud-front-registry.js";
 import type { SimCfWebAclResolver } from "./web-acl/sim-cf-web-acl.js";
 import type { SimCfEdgeFunctions } from "./edge/sim-cf-edge-functions.js";
 import { SimCfKeyValueStoreCommands } from "./key-value-store/sim-cf-key-value-store-commands.js";
 import { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.js";
+import { SimCfFunctionCommands } from "./cff/sim-cf-function-commands.js";
 /**
  * How one simulated CloudFront is put together.
  */
@@ -43,6 +43,7 @@ interface SimCloudFrontCommandsProperties extends SimCloudFrontProperties {
     readonly cloudFrontFunctions: SimCloudFrontFunctionMap;
     readonly originAccessControls: SimCloudFrontOriginAccessControlRegistry;
     readonly responseHeadersPolicies: SimCloudFrontResponseHeadersPolicyRegistry;
+    readonly cachePolicies: SimCloudFrontCachePolicyRegistry;
 }
 /**
  * Options carried by any simulated CloudFront request.
@@ -75,8 +76,11 @@ export declare class SimCloudFrontCommands {
      * well as by the Distribution commands, which check one can be associated.
      */
     readonly edgeFunctions: SimCfEdgeFunctions | undefined;
+    /**
+     * The CloudFront Function commands, and the Functions they work on.
+     */
+    readonly functions: SimCfFunctionCommands;
     private readonly distributionState;
-    private readonly functionState;
     private readonly configurationState;
     constructor(properties: SimCloudFrontCommandsProperties);
     /**
@@ -95,13 +99,5 @@ export declare class SimCloudFrontCommands {
      * Handle a Delete Distribution Command from the SDK.
      */
     deleteDistribution(command: SimDeleteDistributionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDeleteDistributionCommandOutput>;
-    /**
-     * Handle a Create Function Command from the SDK.
-     */
-    createFunction(command: SimCreateFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimCreateFunctionCommandOutput>;
-    /**
-     * Handle a Delete Function Command from the SDK.
-     */
-    deleteFunction(command: SimDeleteFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDeleteFunctionCommandOutput>;
 }
 export {};

package/dist/service/cloudfront/sim-cloudfront-commands.js

@@ -1,9 +1,7 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simIamGlobalServiceRegion, simIamInRegion, } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { CreateDistributionCommandHandler } from "./command/create-distribution/create-distribution.handler.js";
-import { CreateFunctionCommandHandler, } from "./command/create-function/create-function.handler.js";
 import { DeleteDistributionCommandHandler } from "./command/delete-distribution/delete-distribution.handler.js";
-import { DeleteFunctionCommandHandler } from "./command/delete-function/delete-function.handler.js";
 import { GetDistributionCommandHandler } from "./command/get-distribution/get-distribution.handler.js";
 import { UpdateDistributionCommandHandler } from "./command/update-distribution/update-distribution.handler.js";
 import { emptyCloudFrontS3OriginResolver, } from "./origin/s3/sim-cloudfront-s3-origin.js";
@@ -13,6 +11,7 @@ import { SimCfKeyValueStoreCommands } from "./key-value-store/sim-cf-key-value-s
 import { SimCloudFrontKeyValueStoreRegistry } from "./key-value-store/sim-cf-key-value-store-registry.js";
 import { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.js";
 import { SimCffKeyValueStoreUsers } from "./cff/kvs/sim-cff-key-value-store-users.js";
+import { SimCfFunctionCommands } from "./cff/sim-cf-function-commands.js";
 /**
  * The commands of one simulated CloudFront, and the state they share.
  *
@@ -37,8 +36,11 @@ export class SimCloudFrontCommands {
      * well as by the Distribution commands, which check one can be associated.
      */
     edgeFunctions;
+    /**
+     * The CloudFront Function commands, and the Functions they work on.
+     */
+    functions;
     distributionState;
-    functionState;
     configurationState;
     constructor(properties) {
         const { accountId, distributions, cloudFrontFunctions, cloudFrontRegistry = new SimCloudFrontRegistry(), s3OriginResolver = emptyCloudFrontS3OriginResolver, customOriginDispatcher, acmRegistry, webAclResolver, edgeFunctions, background = new BackgroundTasks(), } = properties;
@@ -54,13 +56,13 @@ export class SimCloudFrontCommands {
             iam,
             background,
         };
-        this.functionState = {
+        this.functions = new SimCfFunctionCommands({
             accountId,
             cloudFrontFunctions,
             iam,
             background,
             keyValueStores,
-        };
+        });
         this.configurationState = {
             s3OriginResolver,
             customOriginDispatcher,
@@ -69,6 +71,7 @@ export class SimCloudFrontCommands {
             edgeFunctions,
             originAccessControls: properties.originAccessControls,
             responseHeadersPolicies: properties.responseHeadersPolicies,
+            cachePolicies: properties.cachePolicies,
         };
         const keyValueStoreAccess = new SimCfKeyValueStoreAccess({
             accountId,
@@ -111,16 +114,4 @@ export class SimCloudFrontCommands {
     async deleteDistribution(command, options) {
         return await new DeleteDistributionCommandHandler(this.distributionState).handle(command, options);
     }
-    /**
-     * Handle a Create Function Command from the SDK.
-     */
-    async createFunction(command, options) {
-        return await new CreateFunctionCommandHandler(this.functionState).handle(command, options);
-    }
-    /**
-     * Handle a Delete Function Command from the SDK.
-     */
-    async deleteFunction(command, options) {
-        return await new DeleteFunctionCommandHandler(this.functionState).handle(command, options);
-    }
 }

package/dist/service/cloudfront/sim-cloudfront-policies.d.ts

@@ -0,0 +1,43 @@
+import type { SimCloudFrontCachePolicy, SimCloudFrontCachePolicyId } from "./cache-policy/sim-cf-cache-policy.js";
+import { SimCloudFrontCachePolicyRegistry } from "./cache-policy/sim-cf-cache-policy-registry.js";
+import type { SimCloudFrontResponseHeadersPolicy, SimCloudFrontResponseHeadersPolicyId } from "./response-headers-policy/sim-cf-response-headers-policy.js";
+import { SimCloudFrontResponseHeadersPolicyRegistry } from "./response-headers-policy/sim-cf-response-headers-policy-registry.js";
+/**
+ * The policies one simulated CloudFront holds.
+ *
+ * A cache Behavior names a response headers policy and a cache policy by ID,
+ * and both are stored here. Neither has a create command in this simulation,
+ * so CloudFormation is the only thing that makes one, and these methods are
+ * how it hands a policy over. `SimCloudFront` extends this, and a caller
+ * reaches the policies on the one service object.
+ */
+export declare class SimCloudFrontPolicies {
+    protected readonly responseHeadersPolicies: SimCloudFrontResponseHeadersPolicyRegistry;
+    protected readonly cachePolicies: SimCloudFrontCachePolicyRegistry;
+    /**
+     * Store a simulated response headers policy. A name another policy already
+     * holds is refused, as CloudFront refuses one.
+     */
+    addResponseHeadersPolicy(policy: SimCloudFrontResponseHeadersPolicy): void;
+    /**
+     * Forget a simulated response headers policy.
+     */
+    removeResponseHeadersPolicy(policyId: SimCloudFrontResponseHeadersPolicyId): void;
+    /**
+     * Get a simulated response headers policy by ID.
+     */
+    getResponseHeadersPolicyById(policyId: SimCloudFrontResponseHeadersPolicyId | string): SimCloudFrontResponseHeadersPolicy | undefined;
+    /**
+     * Store a simulated cache policy. A name another policy already holds is
+     * refused, as CloudFront refuses one.
+     */
+    addCachePolicy(policy: SimCloudFrontCachePolicy): void;
+    /**
+     * Forget a simulated cache policy.
+     */
+    removeCachePolicy(policyId: SimCloudFrontCachePolicyId): void;
+    /**
+     * Get a simulated cache policy by ID.
+     */
+    getCachePolicyById(policyId: SimCloudFrontCachePolicyId | string): SimCloudFrontCachePolicy | undefined;
+}

package/dist/service/cloudfront/sim-cloudfront-policies.js

@@ -0,0 +1,53 @@
+import { SimCloudFrontCachePolicyRegistry } from "./cache-policy/sim-cf-cache-policy-registry.js";
+import { SimCloudFrontResponseHeadersPolicyRegistry } from "./response-headers-policy/sim-cf-response-headers-policy-registry.js";
+/**
+ * The policies one simulated CloudFront holds.
+ *
+ * A cache Behavior names a response headers policy and a cache policy by ID,
+ * and both are stored here. Neither has a create command in this simulation,
+ * so CloudFormation is the only thing that makes one, and these methods are
+ * how it hands a policy over. `SimCloudFront` extends this, and a caller
+ * reaches the policies on the one service object.
+ */
+export class SimCloudFrontPolicies {
+    responseHeadersPolicies = new SimCloudFrontResponseHeadersPolicyRegistry();
+    cachePolicies = new SimCloudFrontCachePolicyRegistry();
+    /**
+     * Store a simulated response headers policy. A name another policy already
+     * holds is refused, as CloudFront refuses one.
+     */
+    addResponseHeadersPolicy(policy) {
+        this.responseHeadersPolicies.add(policy);
+    }
+    /**
+     * Forget a simulated response headers policy.
+     */
+    removeResponseHeadersPolicy(policyId) {
+        this.responseHeadersPolicies.remove(policyId);
+    }
+    /**
+     * Get a simulated response headers policy by ID.
+     */
+    getResponseHeadersPolicyById(policyId) {
+        return this.responseHeadersPolicies.byId(policyId);
+    }
+    /**
+     * Store a simulated cache policy. A name another policy already holds is
+     * refused, as CloudFront refuses one.
+     */
+    addCachePolicy(policy) {
+        this.cachePolicies.add(policy);
+    }
+    /**
+     * Forget a simulated cache policy.
+     */
+    removeCachePolicy(policyId) {
+        this.cachePolicies.remove(policyId);
+    }
+    /**
+     * Get a simulated cache policy by ID.
+     */
+    getCachePolicyById(policyId) {
+        return this.cachePolicies.byId(policyId);
+    }
+}

package/dist/service/cloudfront/sim-cloudfront.d.ts

@@ -6,10 +6,11 @@ import type { SimCreateDistributionCommand, SimCreateDistributionCommandOutput }
 import type { SimCreateFunctionCommand, SimCreateFunctionCommandOutput } from "./command/create-function/create-function.command.js";
 import type { SimDeleteDistributionCommand, SimDeleteDistributionCommandOutput } from "./command/delete-distribution/delete-distribution.command.js";
 import type { SimDeleteFunctionCommand, SimDeleteFunctionCommandOutput } from "./command/delete-function/delete-function.command.js";
+import type { SimDescribeFunctionCommand, SimDescribeFunctionCommandOutput, SimGetFunctionCommand, SimGetFunctionCommandOutput, SimListFunctionsCommand, SimListFunctionsCommandOutput } from "./command/function/sim-cf-function-command.types.js";
 import type { SimGetDistributionCommand, SimGetDistributionCommandOutput } from "./command/get-distribution/get-distribution.command.js";
 import type { SimUpdateDistributionCommand, SimUpdateDistributionCommandOutput } from "./command/update-distribution/update-distribution.command.js";
 import type { SimCloudFrontDistribution, SimCloudFrontDistributionId } from "./distribution/sim-cloudfront-distribution.js";
-import type { SimCloudFrontResponseHeadersPolicy, SimCloudFrontResponseHeadersPolicyId } from "./response-headers-policy/sim-cf-response-headers-policy.js";
+import { SimCloudFrontPolicies } from "./sim-cloudfront-policies.js";
 import type { SimCloudFrontOriginAccessControl, SimCloudFrontOriginAccessControlId } from "./origin-access-control/sim-cf-origin-access-control.js";
 import type { SimCfKeyValueStoreCommands } from "./key-value-store/sim-cf-key-value-store-commands.js";
 import type { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.js";
@@ -18,10 +19,9 @@ export type { SimCloudFrontProperties, SimCloudFrontRequestOptions, } from "./si
 /**
  * Simulated CloudFront. Handles SDK commands. Emulates AWS behaviour and state.
  */
-export declare class SimCloudFront {
+export declare class SimCloudFront extends SimCloudFrontPolicies {
     private readonly distributions;
     private readonly cloudFrontFunctions;
-    private readonly responseHeadersPolicies;
     private readonly originAccessControls;
     private readonly accountRegionScope;
     private readonly commands;
@@ -72,29 +72,25 @@ export declare class SimCloudFront {
      */
     deleteFunction(command: SimDeleteFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDeleteFunctionCommandOutput>;
     /**
-     * Get a sim CloudFront Function by ARN.
+     * Handle a List Functions Command from the SDK.
      */
-    getCloudFrontFunctionByArn(cloudFrontFunctionArn: SimArn): SimCloudFrontFunction | undefined;
+    listFunctions(command: SimListFunctionsCommand, options?: SimCloudFrontRequestOptions): Promise<SimListFunctionsCommandOutput>;
     /**
-     * Get a sim CloudFront Function by name.
+     * Handle a Describe Function Command from the SDK.
      */
-    getCloudFrontFunctionByName(cloudFrontFunctionName: SimCloudFrontFunctionName | string): SimCloudFrontFunction | undefined;
+    describeFunction(command: SimDescribeFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDescribeFunctionCommandOutput>;
     /**
-     * Store a simulated response headers policy.
-     *
-     * There is no CreateResponseHeadersPolicy command here, so CloudFormation is
-     * the only thing that makes one, and this is how it hands the policy over.
-     * A name another policy already holds is refused, as CloudFront refuses one.
+     * Handle a Get Function Command from the SDK.
      */
-    addResponseHeadersPolicy(policy: SimCloudFrontResponseHeadersPolicy): void;
+    getFunction(command: SimGetFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimGetFunctionCommandOutput>;
     /**
-     * Forget a simulated response headers policy.
+     * Get a sim CloudFront Function by ARN.
      */
-    removeResponseHeadersPolicy(policyId: SimCloudFrontResponseHeadersPolicyId): void;
+    getCloudFrontFunctionByArn(cloudFrontFunctionArn: SimArn): SimCloudFrontFunction | undefined;
     /**
-     * Get a simulated response headers policy by ID.
+     * Get a sim CloudFront Function by name.
      */
-    getResponseHeadersPolicyById(policyId: SimCloudFrontResponseHeadersPolicyId | string): SimCloudFrontResponseHeadersPolicy | undefined;
+    getCloudFrontFunctionByName(cloudFrontFunctionName: SimCloudFrontFunctionName | string): SimCloudFrontFunction | undefined;
     /**
      * Store a simulated origin access control.
      *

package/dist/service/cloudfront/sim-cloudfront.js

@@ -1,6 +1,6 @@
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimCloudFrontCloudFormationResourceFactory } from "./cfn/sim-cfn-cloudfront-resource-factory.js";
-import { SimCloudFrontResponseHeadersPolicyRegistry } from "./response-headers-policy/sim-cf-response-headers-policy-registry.js";
+import { SimCloudFrontPolicies } from "./sim-cloudfront-policies.js";
 import { SimCloudFrontOriginAccessControlRegistry } from "./origin-access-control/sim-cf-origin-access-control-registry.js";
 import { simCffNameInArn } from "./cff/sim-cff-arn.js";
 import { SimCloudFrontSdkCommandRouter } from "./sdk/sim-cloudfront-sdk-command-router.js";
@@ -8,16 +8,16 @@ import { SimCloudFrontCommands, } from "./sim-cloudfront-commands.js";
 /**
  * Simulated CloudFront. Handles SDK commands. Emulates AWS behaviour and state.
  */
-export class SimCloudFront {
+export class SimCloudFront extends SimCloudFrontPolicies {
     distributions = new Map();
     cloudFrontFunctions = new Map();
-    responseHeadersPolicies = new SimCloudFrontResponseHeadersPolicyRegistry();
     originAccessControls = new SimCloudFrontOriginAccessControlRegistry();
     accountRegionScope;
     commands;
     cfnFactory = new SimCloudFrontCloudFormationResourceFactory(this);
     sdkRouter = new SimCloudFrontSdkCommandRouter(this);
     constructor(properties = {}) {
+        super();
         this.accountRegionScope =
             properties.accountRegionScope ?? simAwsAccountRegionScopeFactory.make();
         this.commands = new SimCloudFrontCommands({
@@ -27,6 +27,7 @@ export class SimCloudFront {
             cloudFrontFunctions: this.cloudFrontFunctions,
             originAccessControls: this.originAccessControls,
             responseHeadersPolicies: this.responseHeadersPolicies,
+            cachePolicies: this.cachePolicies,
         });
     }
     /**
@@ -84,48 +85,44 @@ export class SimCloudFront {
      * Handle a Create Function Command from the SDK.
      */
     async createFunction(command, options) {
-        return await this.commands.createFunction(command, options);
+        return await this.commands.functions.createFunction(command, options);
     }
     /**
      * Handle a Delete Function Command from the SDK.
      */
     async deleteFunction(command, options) {
-        return await this.commands.deleteFunction(command, options);
+        return await this.commands.functions.deleteFunction(command, options);
     }
     /**
-     * Get a sim CloudFront Function by ARN.
+     * Handle a List Functions Command from the SDK.
      */
-    getCloudFrontFunctionByArn(cloudFrontFunctionArn) {
-        const name = simCffNameInArn(cloudFrontFunctionArn, this.accountRegionScope.accountId);
-        return name === undefined ? undefined : this.cloudFrontFunctions.get(name);
+    async listFunctions(command, options) {
+        return await this.commands.functions.listFunctions(command, options);
     }
     /**
-     * Get a sim CloudFront Function by name.
+     * Handle a Describe Function Command from the SDK.
      */
-    getCloudFrontFunctionByName(cloudFrontFunctionName) {
-        return this.cloudFrontFunctions.get(cloudFrontFunctionName);
+    async describeFunction(command, options) {
+        return await this.commands.functions.describeFunction(command, options);
     }
     /**
-     * Store a simulated response headers policy.
-     *
-     * There is no CreateResponseHeadersPolicy command here, so CloudFormation is
-     * the only thing that makes one, and this is how it hands the policy over.
-     * A name another policy already holds is refused, as CloudFront refuses one.
+     * Handle a Get Function Command from the SDK.
      */
-    addResponseHeadersPolicy(policy) {
-        this.responseHeadersPolicies.add(policy);
+    async getFunction(command, options) {
+        return await this.commands.functions.getFunction(command, options);
     }
     /**
-     * Forget a simulated response headers policy.
+     * Get a sim CloudFront Function by ARN.
      */
-    removeResponseHeadersPolicy(policyId) {
-        this.responseHeadersPolicies.remove(policyId);
+    getCloudFrontFunctionByArn(cloudFrontFunctionArn) {
+        const name = simCffNameInArn(cloudFrontFunctionArn, this.accountRegionScope.accountId);
+        return name === undefined ? undefined : this.cloudFrontFunctions.get(name);
     }
     /**
-     * Get a simulated response headers policy by ID.
+     * Get a sim CloudFront Function by name.
      */
-    getResponseHeadersPolicyById(policyId) {
-        return this.responseHeadersPolicies.byId(policyId);
+    getCloudFrontFunctionByName(cloudFrontFunctionName) {
+        return this.cloudFrontFunctions.get(cloudFrontFunctionName);
     }
     /**
      * Store a simulated origin access control.

package/dist/service/ecr/authorize/sim-ecr-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimEcrRepositoryAddress } from "../repository/sim-ecr-repository-address.js";
+interface SimEcrAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly address: SimEcrRepositoryAddress;
+}
+/**
+ * Applies simulated IAM authorization to ECR requests.
+ *
+ * Registering a simulated image is not one of them. That is a Yulin-native
+ * operation on the simulator's own accessor, and it is how a test says what an
+ * image is. A CloudFormation deployment is what authorizes here. It makes and
+ * removes a repository as the caller its Stack named.
+ */
+export declare class SimEcrAuthorizer {
+    private readonly iam;
+    private readonly address;
+    constructor(properties: SimEcrAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a repository of this name.
+     *
+     * The repository need not be there. Real IAM evaluates a request before the
+     * service handles it, so a caller with no permission is refused whether or
+     * not the repository is there, and `CreateRepository` authorizes against the
+     * ARN the repository is about to have.
+     */
+    authorizeRepository(action: string, repositoryName: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+}
+export {};

package/dist/service/ecr/authorize/sim-ecr-authorizer.js

@@ -0,0 +1,38 @@
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+/**
+ * Applies simulated IAM authorization to ECR requests.
+ *
+ * Registering a simulated image is not one of them. That is a Yulin-native
+ * operation on the simulator's own accessor, and it is how a test says what an
+ * image is. A CloudFormation deployment is what authorizes here. It makes and
+ * removes a repository as the caller its Stack named.
+ */
+export class SimEcrAuthorizer {
+    iam;
+    address;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.address = properties.address;
+    }
+    /**
+     * Ensure the caller may perform an action on a repository of this name.
+     *
+     * The repository need not be there. Real IAM evaluates a request before the
+     * service handles it, so a caller with no permission is refused whether or
+     * not the repository is there, and `CreateRepository` authorizes against the
+     * ARN the repository is about to have.
+     */
+    authorizeRepository(action, repositoryName, caller) {
+        const resource = this.address.arn(repositoryName);
+        const decision = this.iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                reason: decision.denialReason,
+                action,
+                resource,
+            });
+        }
+        return decision.caller;
+    }
+}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.d.ts

@@ -1,9 +1,12 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimEcrAuthorizer } from "../../authorize/sim-ecr-authorizer.js";
 import type { SimEcrRepository } from "../../repository/sim-ecr-repository.js";
 import type { SimEcr } from "../../sim-ecr.js";
 interface SimCfnEcrRepositoryCreatorProperties {
     readonly ecr: SimEcr;
+    readonly authorizer: SimEcrAuthorizer;
 }
 /**
  * Creates simulated repositories from AWS::ECR::Repository Resources.
@@ -16,11 +19,17 @@ interface SimCfnEcrRepositoryCreatorProperties {
  */
 export declare class SimCfnEcrRepositoryCreator {
     private readonly ecr;
+    private readonly authorizer;
     constructor(properties: SimCfnEcrRepositoryCreatorProperties);
     /**
      * Create a repository from an AWS::ECR::Repository Resource.
+     *
+     * Naming the repository is what makes it. That is where the deployment's
+     * caller is authorized, as it is on a real deploy before ECR answers. A
+     * repository a test has already registered a handler in is adopted, and the
+     * caller is authorized for it either way.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimEcrRepository;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimEcrRepository;
     /**
      * Delete a repository created from an AWS::ECR::Repository Resource.
      *
@@ -37,6 +46,6 @@ export declare class SimCfnEcrRepositoryCreator {
      * being protected here is a test's own registration rather than anything
      * CloudFormation put there.
      */
-    delete(resource: SimCfnResource, repository: SimEcrRepository): void;
+    delete(resource: SimCfnResource, repository: SimEcrRepository, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.js

@@ -10,19 +10,27 @@ import { SimCfnEcrRepositoryProperties } from "./sim-cfn-ecr-repository-properti
  */
 export class SimCfnEcrRepositoryCreator {
     ecr;
+    authorizer;
     constructor(properties) {
         this.ecr = properties.ecr;
+        this.authorizer = properties.authorizer;
     }
     /**
      * Create a repository from an AWS::ECR::Repository Resource.
+     *
+     * Naming the repository is what makes it. That is where the deployment's
+     * caller is authorized, as it is on a real deploy before ECR answers. A
+     * repository a test has already registered a handler in is adopted, and the
+     * caller is authorized for it either way.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
         const repositoryProperties = new SimCfnEcrRepositoryProperties({
             resource,
             properties,
         });
         const repositoryName = repositoryProperties.repositoryName();
         repositoryProperties.recordIgnoredProperties();
+        this.authorizer.authorizeRepository("ecr:CreateRepository", repositoryName, options?.caller);
         return this.ecr.repository(repositoryName);
     }
     /**
@@ -41,7 +49,8 @@ export class SimCfnEcrRepositoryCreator {
      * being protected here is a test's own registration rather than anything
      * CloudFormation put there.
      */
-    delete(resource, repository) {
+    delete(resource, repository, options) {
+        this.authorizer.authorizeRepository("ecr:DeleteRepository", repository.repositoryName, options?.caller);
         if (repository.hasImage) {
             throw new Error(`Unsupported sim ECR CloudFormation Resource ${resource.logicalId} ` +
                 `deletion: the simulated ECR repository ` +

package/dist/service/ecr/cfn/sim-ecr-cfn-resource-factory.d.ts

@@ -1,8 +1,10 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
-import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimEcrAuthorizer } from "../authorize/sim-ecr-authorizer.js";
 import type { SimEcr } from "../sim-ecr.js";
 interface SimEcrCfnResourceFactoryProperties {
     readonly ecr: SimEcr;
+    readonly authorizer: SimEcrAuthorizer;
 }
 /**
  * CloudFormation Resource factory for simulated ECR resources.
@@ -21,6 +23,6 @@ export declare class SimEcrCfnResourceFactory implements SimCfnServiceResourceFa
     /**
      * Delete a simulated ECR resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName: string, resource: SimCfnResource): Promise<void>;
+    delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }
 export {};

package/dist/service/ecr/cfn/sim-ecr-cfn-resource-factory.js

@@ -1,5 +1,7 @@
 import { assertDefined } from "../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimCfnEcrRepositoryCreator } from "./repository/sim-cfn-ecr-repository-creator.js";
+import { unsupportedSimEcrResourceType } from "./sim-ecr-cfn-unsupported-resource.js";
 /**
  * CloudFormation Resource factory for simulated ECR resources.
  *
@@ -10,30 +12,27 @@ import { SimCfnEcrRepositoryCreator } from "./repository/sim-cfn-ecr-repository-
 export class SimEcrCfnResourceFactory {
     repositoryCreator;
     constructor(properties) {
-        this.repositoryCreator = new SimCfnEcrRepositoryCreator({
-            ecr: properties.ecr,
-        });
+        this.repositoryCreator = new SimCfnEcrRepositoryCreator(properties);
     }
     /**
      * Create a simulated ECR resource from a CloudFormation Resource.
      */
     create(resourceTypeName, resource, context) {
         if (resourceTypeName !== "Repository") {
-            throw new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName}`);
+            throw unsupportedSimEcrResourceType(resourceTypeName, "");
         }
-        return Promise.resolve(this.repositoryCreator.create(resource, context.resolvedProperties ?? resource.properties));
+        return Promise.resolve(this.repositoryCreator.create(resource, context.resolvedProperties ?? resource.properties, simCfnResourceCallerOptions(context.caller)));
     }
     /**
      * Delete a simulated ECR resource created from a CloudFormation Resource.
      */
-    delete(resourceTypeName, resource) {
+    delete(resourceTypeName, resource, context) {
         if (resourceTypeName !== "Repository") {
-            throw new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName} ` +
-                `deletion`);
+            throw unsupportedSimEcrResourceType(resourceTypeName, " deletion");
         }
         const repository = resource.simResource;
         assertDefined(repository, `sim ECR repository for CloudFormation Resource ${resource.logicalId}`);
-        this.repositoryCreator.delete(resource, repository);
+        this.repositoryCreator.delete(resource, repository, simCfnResourceCallerOptions(context.caller));
         return Promise.resolve();
     }
 }

package/dist/service/ecr/cfn/sim-ecr-cfn-unsupported-resource.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A refusal naming an ECR Resource type this simulation has no creator for.
+ *
+ * The wording is what a Stack reads to record the Resource as a skip rather
+ * than failing the whole deployment over it.
+ */
+export declare function unsupportedSimEcrResourceType(resourceTypeName: string, suffix: string): Error;

package/dist/service/ecr/cfn/sim-ecr-cfn-unsupported-resource.js

@@ -0,0 +1,9 @@
+/**
+ * A refusal naming an ECR Resource type this simulation has no creator for.
+ *
+ * The wording is what a Stack reads to record the Resource as a skip rather
+ * than failing the whole deployment over it.
+ */
+export function unsupportedSimEcrResourceType(resourceTypeName, suffix) {
+    return new Error(`Unsupported sim ECR CloudFormation Resource ${resourceTypeName}${suffix}`);
+}