@kensio/yulin 1.20.17 → 1.21.1

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-config.js

@@ -0,0 +1,46 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimCloudFrontOriginRequestPolicy } from "../../origin-request-policy/sim-cf-origin-request-policy.js";
+import { simCfnCfOriginRequestForwarding } from "./sim-cfn-cf-orp-forwarding.js";
+/**
+ * Reads an AWS::CloudFront::OriginRequestPolicy Resource into a simulated
+ * policy.
+ *
+ * The policy carries its `Name`, its `Comment` and the three sections that say
+ * what it forwards to the Origin. A section a template left out falls back to
+ * CloudFront's `none`. A Resource missing its `Name` is refused, as
+ * CloudFormation refuses one.
+ */
+export class SimCfnCfOriginRequestPolicyConfig {
+    resource;
+    properties;
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    refuse = (detail) => {
+        throw new Error(`Invalid AWS::CloudFront::OriginRequestPolicy ${this.resource.logicalId}: ${detail}`);
+    };
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.properties = properties.properties;
+    }
+    /**
+     * Build the simulated policy this Resource describes.
+     */
+    build() {
+        const { refuse } = this;
+        const config = this.properties["OriginRequestPolicyConfig"];
+        if (!isRecord(config)) {
+            return refuse("OriginRequestPolicyConfig must be an object");
+        }
+        const name = config["Name"];
+        if (typeof name !== "string") {
+            return refuse("OriginRequestPolicyConfig needs a string Name");
+        }
+        const comment = config["Comment"];
+        return new SimCloudFrontOriginRequestPolicy({
+            name,
+            ...(typeof comment === "string" && { comment }),
+            forwarding: simCfnCfOriginRequestForwarding(config, refuse),
+        });
+    }
+}

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-creator.d.ts

@@ -0,0 +1,24 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCloudFront } from "../../sim-cloudfront.js";
+import type { SimCloudFrontOriginRequestPolicy } from "../../origin-request-policy/sim-cf-origin-request-policy.js";
+interface SimCfnCfOriginRequestPolicyCreatorProperties {
+    readonly cloudFront: SimCloudFront;
+}
+/**
+ * Creates simulated origin request policies from
+ * AWS::CloudFront::OriginRequestPolicy Resources.
+ */
+export declare class SimCfnCfOriginRequestPolicyCreator {
+    private readonly cloudFront;
+    constructor(properties: SimCfnCfOriginRequestPolicyCreatorProperties);
+    /**
+     * Create and store the policy one Resource describes.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontOriginRequestPolicy;
+    /**
+     * Remove a policy created from a Resource.
+     */
+    delete(resource: SimCfnResource): void;
+}
+export {};

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-creator.js

@@ -0,0 +1,32 @@
+import { SimCfnCfOriginRequestPolicyConfig } from "./sim-cfn-cf-orp-config.js";
+/**
+ * Creates simulated origin request policies from
+ * AWS::CloudFront::OriginRequestPolicy Resources.
+ */
+export class SimCfnCfOriginRequestPolicyCreator {
+    cloudFront;
+    constructor(properties) {
+        this.cloudFront = properties.cloudFront;
+    }
+    /**
+     * Create and store the policy one Resource describes.
+     */
+    create(resource, properties) {
+        const policy = new SimCfnCfOriginRequestPolicyConfig({
+            resource,
+            properties,
+        }).build();
+        this.cloudFront.addOriginRequestPolicy(policy);
+        return policy;
+    }
+    /**
+     * Remove a policy created from a Resource.
+     */
+    delete(resource) {
+        const policy = resource.simResource;
+        if (policy === undefined) {
+            return;
+        }
+        this.cloudFront.removeOriginRequestPolicy(policy.id);
+    }
+}

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-forwarding.d.ts

@@ -0,0 +1,10 @@
+import { SimCfOriginRequestForwarding } from "../../origin-request-policy/sim-cf-origin-request-forwarding.js";
+import { type SimCfnCfPolicyRefuse } from "../policy/sim-cfn-cf-policy-section.js";
+/**
+ * Read the three sections of an `OriginRequestPolicyConfig` into what the
+ * policy forwards.
+ *
+ * A template leaving a section out gets CloudFront's own `none`. A policy that
+ * says nothing forwards nothing.
+ */
+export declare function simCfnCfOriginRequestForwarding(config: Record<string, unknown>, refuse: SimCfnCfPolicyRefuse): SimCfOriginRequestForwarding;

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-forwarding.js

@@ -0,0 +1,51 @@
+import { simCfForwardedCookieBehaviors, simCfForwardedHeaderBehaviors, simCfForwardedQueryStringBehaviors, SimCfOriginRequestForwarding, } from "../../origin-request-policy/sim-cf-origin-request-forwarding.js";
+import { simCfnCfPolicySection, } from "../policy/sim-cfn-cf-policy-section.js";
+/**
+ * The three sections of an origin request policy, each with the fields
+ * CloudFormation names it by and the behaviours CloudFront offers for it.
+ *
+ * The fields are the ones a cache policy writes. The header section is where
+ * the two kinds part: an origin request policy can forward every header the
+ * viewer sent, which is no use as a cache key.
+ */
+const cookiesSpec = {
+    section: "CookiesConfig",
+    behaviorField: "CookieBehavior",
+    itemsField: "Cookies",
+    behaviors: simCfForwardedCookieBehaviors,
+    defaultBehavior: "none",
+};
+const headersSpec = {
+    section: "HeadersConfig",
+    behaviorField: "HeaderBehavior",
+    itemsField: "Headers",
+    behaviors: simCfForwardedHeaderBehaviors,
+    defaultBehavior: "none",
+};
+const queryStringsSpec = {
+    section: "QueryStringsConfig",
+    behaviorField: "QueryStringBehavior",
+    itemsField: "QueryStrings",
+    behaviors: simCfForwardedQueryStringBehaviors,
+    defaultBehavior: "none",
+};
+/**
+ * Read the three sections of an `OriginRequestPolicyConfig` into what the
+ * policy forwards.
+ *
+ * A template leaving a section out gets CloudFront's own `none`. A policy that
+ * says nothing forwards nothing.
+ */
+export function simCfnCfOriginRequestForwarding(config, refuse) {
+    const cookies = simCfnCfPolicySection(config, cookiesSpec, refuse);
+    const headers = simCfnCfPolicySection(config, headersSpec, refuse);
+    const queries = simCfnCfPolicySection(config, queryStringsSpec, refuse);
+    return new SimCfOriginRequestForwarding({
+        cookieBehavior: cookies.behavior,
+        cookies: cookies.items,
+        headerBehavior: headers.behavior,
+        headers: headers.items,
+        queryStringBehavior: queries.behavior,
+        queryStrings: queries.items,
+    });
+}

package/dist/service/cloudfront/cfn/policy/sim-cfn-cf-policy-section.d.ts

@@ -0,0 +1,22 @@
+export type SimCfnCfPolicyRefuse = (detail: string) => never;
+export interface SimCfnCfPolicySectionSpec<TBehavior extends string> {
+    readonly section: string;
+    readonly behaviorField: string;
+    readonly itemsField: string;
+    readonly behaviors: readonly TBehavior[];
+    readonly defaultBehavior: TBehavior;
+}
+/**
+ * One `<name>Config` section of a cache policy or an origin request policy, as
+ * the behaviour it names and the names that behaviour applies to.
+ *
+ * The two policy kinds write these sections the same way, down to the field
+ * names, and differ only in the behaviours each section offers. An absent
+ * section is CloudFront's `none` with an empty list, and so is a section that
+ * named no behaviour of its own. A behaviour outside the set CloudFront offers
+ * for the section is refused.
+ */
+export declare function simCfnCfPolicySection<TBehavior extends string>(parameters: Record<string, unknown>, spec: SimCfnCfPolicySectionSpec<TBehavior>, refuse: SimCfnCfPolicyRefuse): {
+    behavior: TBehavior;
+    items: readonly string[];
+};

package/dist/service/cloudfront/cfn/policy/sim-cfn-cf-policy-section.js

@@ -0,0 +1,54 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+/**
+ * One `<name>Config` section of a cache policy or an origin request policy, as
+ * the behaviour it names and the names that behaviour applies to.
+ *
+ * The two policy kinds write these sections the same way, down to the field
+ * names, and differ only in the behaviours each section offers. An absent
+ * section is CloudFront's `none` with an empty list, and so is a section that
+ * named no behaviour of its own. A behaviour outside the set CloudFront offers
+ * for the section is refused.
+ */
+export function simCfnCfPolicySection(parameters, spec, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    const section = parameters[spec.section];
+    if (section === undefined) {
+        return { behavior: spec.defaultBehavior, items: [] };
+    }
+    if (!isRecord(section)) {
+        return refuse(`${spec.section} must be an object`);
+    }
+    return {
+        // oxlint-disable-next-line security/detect-object-injection
+        behavior: behaviorNamed(section[spec.behaviorField], spec, refuse),
+        items: namesListed(section, spec, refuse),
+    };
+}
+/**
+ * The behaviour a section named, refused where CloudFront does not offer it
+ * for that section.
+ */
+function behaviorNamed(named, spec, refuse) {
+    if (named === undefined) {
+        return spec.defaultBehavior;
+    }
+    const offered = spec.behaviors;
+    return typeof named === "string" && offered.includes(named)
+        ? named
+        : refuse(`${spec.section} ${spec.behaviorField} must be one of ${offered.join(", ")}`);
+}
+/**
+ * The names a section lists, which a `whitelist` applies to and an `allExcept`
+ * applies to everything but.
+ */
+function namesListed(section, spec, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    const listed = section[spec.itemsField];
+    if (listed === undefined) {
+        return [];
+    }
+    return Array.isArray(listed) &&
+        listed.every((name) => typeof name === "string")
+        ? listed
+        : refuse(`${spec.section} ${spec.itemsField} must be a list of strings`);
+}

package/dist/service/cloudfront/cfn/sim-cfn-cloudfront-resource-factory.d.ts

@@ -10,6 +10,7 @@ export declare class SimCloudFrontCloudFormationResourceFactory implements SimCf
     private readonly distroDeleter;
     private readonly responseHeadersPolicyCreator;
     private readonly cachePolicyCreator;
+    private readonly originRequestPolicyCreator;
     private readonly originAccessControlCreator;
     private readonly keyValueStoreCreator;
     constructor(cloudFront: SimCloudFront);

package/dist/service/cloudfront/cfn/sim-cfn-cloudfront-resource-factory.js

@@ -4,6 +4,7 @@ import { SimCfnCffCreator } from "./cff/sim-cfn-cff-creator.js";
 import { SimCfnCfDistroDeleter } from "./distro/sim-cfn-cf-distro-deleter.js";
 import { SimCfnCfResponseHeadersPolicyCreator } from "./response-headers-policy/sim-cfn-cf-rh-policy-creator.js";
 import { SimCfnCfCachePolicyCreator } from "./cache-policy/sim-cfn-cf-cache-policy-creator.js";
+import { SimCfnCfOriginRequestPolicyCreator } from "./origin-request-policy/sim-cfn-cf-orp-creator.js";
 import { SimCfnCfOriginAccessControlCreator } from "./origin-access-control/sim-cfn-cf-oac-creator.js";
 import { SimCfnCfKeyValueStoreCreator } from "./key-value-store/sim-cfn-cf-kvs-creator.js";
 /**
@@ -15,6 +16,7 @@ export class SimCloudFrontCloudFormationResourceFactory {
     distroDeleter;
     responseHeadersPolicyCreator;
     cachePolicyCreator;
+    originRequestPolicyCreator;
     originAccessControlCreator;
     keyValueStoreCreator;
     constructor(cloudFront) {
@@ -24,6 +26,9 @@ export class SimCloudFrontCloudFormationResourceFactory {
         this.responseHeadersPolicyCreator =
             new SimCfnCfResponseHeadersPolicyCreator({ cloudFront });
         this.cachePolicyCreator = new SimCfnCfCachePolicyCreator({ cloudFront });
+        this.originRequestPolicyCreator = new SimCfnCfOriginRequestPolicyCreator({
+            cloudFront,
+        });
         this.originAccessControlCreator = new SimCfnCfOriginAccessControlCreator({
             cloudFront,
         });
@@ -49,6 +54,9 @@ export class SimCloudFrontCloudFormationResourceFactory {
             case "CachePolicy": {
                 return this.cachePolicyCreator.create(resource, properties);
             }
+            case "OriginRequestPolicy": {
+                return this.originRequestPolicyCreator.create(resource, properties);
+            }
             case "OriginAccessControl": {
                 return this.originAccessControlCreator.create(resource, properties);
             }
@@ -83,6 +91,10 @@ export class SimCloudFrontCloudFormationResourceFactory {
                 this.cachePolicyCreator.delete(resource);
                 return;
             }
+            case "OriginRequestPolicy": {
+                this.originRequestPolicyCreator.delete(resource);
+                return;
+            }
             case "OriginAccessControl": {
                 this.originAccessControlCreator.delete(resource);
                 return;

package/dist/service/cloudfront/command/create-distribution/create-distribution.command.d.ts

@@ -145,6 +145,7 @@ export interface SimCloudFrontDefaultCacheBehaviorConfig {
     readonly LambdaFunctionAssociations?: SimCloudFrontLambdaFunctionAssociations | undefined;
     readonly ResponseHeadersPolicyId?: string | undefined;
     readonly CachePolicyId?: string | undefined;
+    readonly OriginRequestPolicyId?: string | undefined;
 }
 /**
  * Minimal structural sim CloudFront cache behavior config.

package/dist/service/cloudfront/command/create-distribution/create-distribution.handler.d.ts

@@ -6,6 +6,7 @@ import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimCloudFrontS3OriginResolver } from "../../origin/s3/sim-cloudfront-s3-origin.js";
 import type { SimCfCustomOriginDispatcher } from "../../origin/custom/sim-cf-custom-origin-dispatcher.js";
 import type { SimCloudFrontOriginAccessControlRegistry } from "../../origin-access-control/sim-cf-origin-access-control-registry.js";
+import type { SimCloudFrontOriginRequestPolicyRegistry } from "../../origin-request-policy/sim-cf-origin-request-policy-registry.js";
 import type { SimCloudFrontResponseHeadersPolicyRegistry } from "../../response-headers-policy/sim-cf-response-headers-policy-registry.js";
 import type { SimCloudFrontCachePolicyRegistry } from "../../cache-policy/sim-cf-cache-policy-registry.js";
 import type { SimCfWebAclResolver } from "../../web-acl/sim-cf-web-acl.js";
@@ -23,6 +24,7 @@ interface CreateDistributionCommandHandlerProperties {
     readonly originAccessControls: SimCloudFrontOriginAccessControlRegistry;
     readonly responseHeadersPolicies: SimCloudFrontResponseHeadersPolicyRegistry;
     readonly cachePolicies: SimCloudFrontCachePolicyRegistry;
+    readonly originRequestPolicies: SimCloudFrontOriginRequestPolicyRegistry;
     readonly webAclResolver?: SimCfWebAclResolver | undefined;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly acmRegistry?: SimAcmRegistry | undefined;

package/dist/service/cloudfront/command/invalidation/sim-cf-create-invalidation.d.ts

@@ -0,0 +1,28 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfInvalidationAccess } from "./sim-cf-invalidation-access.js";
+import type { SimCreateInvalidationCommand, SimCreateInvalidationCommandOutput } from "./sim-cf-invalidation-command.types.js";
+/**
+ * Simulated CloudFront CreateInvalidation command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/CreateInvalidationCommand/
+ */
+export declare class SimCfCreateInvalidation {
+    private readonly access;
+    private static readonly action;
+    constructor(access: SimCfInvalidationAccess);
+    /**
+     * Clear what a batch of paths names. The next request for one of them
+     * reaches the Origin.
+     *
+     * The entries go as the invalidation is created. Real CloudFront clears each
+     * point of presence over the following seconds, and a test waiting for that
+     * before asking again would be waiting on the simulator.
+     */
+    handle(command: SimCreateInvalidationCommand, options?: {
+        readonly caller?: SimAwsCaller;
+    }): Promise<SimCreateInvalidationCommandOutput>;
+    /**
+     * Create an invalidation, clear what it names, and start it running.
+     */
+    private invalidate;
+}

package/dist/service/cloudfront/command/invalidation/sim-cf-create-invalidation.js

@@ -0,0 +1,59 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfInvalidation } from "../../invalidation/sim-cf-invalidation.js";
+import { simCfInvalidationLocation, simCfInvalidationView, } from "../../invalidation/sim-cf-invalidation-view.js";
+import { simCfRepeatedInvalidation } from "../../invalidation/sim-cf-repeated-invalidation.js";
+import { assertConsistentQuantity } from "../sim-cf-list-quantity.js";
+/**
+ * Simulated CloudFront CreateInvalidation command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/CreateInvalidationCommand/
+ */
+export class SimCfCreateInvalidation {
+    access;
+    static action = "cloudfront:CreateInvalidation";
+    constructor(access) {
+        this.access = access;
+    }
+    /**
+     * Clear what a batch of paths names. The next request for one of them
+     * reaches the Origin.
+     *
+     * The entries go as the invalidation is created. Real CloudFront clears each
+     * point of presence over the following seconds, and a test waiting for that
+     * before asking again would be waiting on the simulator.
+     */
+    async handle(command, options) {
+        const batch = command.input.InvalidationBatch;
+        assertDefined(batch, "CreateInvalidationCommand.InvalidationBatch");
+        const callerReference = batch.CallerReference;
+        assertDefined(callerReference, "CreateInvalidationCommand.InvalidationBatch.CallerReference");
+        assertConsistentQuantity("InvalidationBatch.Paths", batch.Paths);
+        await this.access.background.sequence();
+        const distribution = this.access.authorizedDistribution(SimCfCreateInvalidation.action, command.input.DistributionId, options?.caller);
+        const paths = batch.Paths?.Items ?? [];
+        const invalidation = simCfRepeatedInvalidation(distribution, callerReference, paths) ??
+            this.invalidate(distribution, callerReference, paths);
+        return {
+            Location: simCfInvalidationLocation(distribution.distributionId, invalidation.invalidationId),
+            Invalidation: simCfInvalidationView(invalidation),
+            $metadata: {},
+        };
+    }
+    /**
+     * Create an invalidation, clear what it names, and start it running.
+     */
+    invalidate(distribution, callerReference, paths) {
+        const invalidation = new SimCfInvalidation({
+            invalidationId: distribution.invalidations.allocateInvalidationId(),
+            callerReference,
+            paths,
+            createTime: this.access.background.now(),
+        });
+        distribution.invalidations.add(invalidation);
+        distribution.cache.clearPaths(paths);
+        // The invalidation reaches Completed in the background, the way a
+        // Distribution reaches Deployed.
+        this.access.background.schedule(async () => invalidation.completeInvalidation());
+        return invalidation;
+    }
+}

package/dist/service/cloudfront/command/invalidation/sim-cf-get-invalidation.d.ts

@@ -0,0 +1,19 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfInvalidationAccess } from "./sim-cf-invalidation-access.js";
+import type { SimGetInvalidationCommand, SimGetInvalidationCommandOutput } from "./sim-cf-invalidation-command.types.js";
+/**
+ * Simulated CloudFront GetInvalidation command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/GetInvalidationCommand/
+ */
+export declare class SimCfGetInvalidation {
+    private readonly access;
+    private static readonly action;
+    constructor(access: SimCfInvalidationAccess);
+    /**
+     * Read one invalidation of a Distribution back.
+     */
+    handle(command: SimGetInvalidationCommand, options?: {
+        readonly caller?: SimAwsCaller;
+    }): Promise<SimGetInvalidationCommandOutput>;
+}

package/dist/service/cloudfront/command/invalidation/sim-cf-get-invalidation.js

@@ -0,0 +1,32 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCloudFrontNoSuchInvalidation } from "../../error/sim-cf-invalidation.error.js";
+import { simCfInvalidationView } from "../../invalidation/sim-cf-invalidation-view.js";
+/**
+ * Simulated CloudFront GetInvalidation command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/GetInvalidationCommand/
+ */
+export class SimCfGetInvalidation {
+    access;
+    static action = "cloudfront:GetInvalidation";
+    constructor(access) {
+        this.access = access;
+    }
+    /**
+     * Read one invalidation of a Distribution back.
+     */
+    async handle(command, options) {
+        const invalidationId = command.input.Id;
+        assertDefined(invalidationId, "GetInvalidationCommand.Id");
+        await this.access.background.sequence();
+        const distribution = this.access.authorizedDistribution(SimCfGetInvalidation.action, command.input.DistributionId, options?.caller);
+        const invalidation = distribution.invalidations.byId(invalidationId);
+        if (invalidation === undefined) {
+            throw new SimCloudFrontNoSuchInvalidation(`No sim CloudFront invalidation with ID ${invalidationId} on Distribution ${distribution.distributionId}`);
+        }
+        return {
+            Invalidation: simCfInvalidationView(invalidation),
+            $metadata: {},
+        };
+    }
+}

package/dist/service/cloudfront/command/invalidation/sim-cf-invalidation-access.d.ts

@@ -0,0 +1,36 @@
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimCloudFrontDistribution, SimCloudFrontDistributionId } from "../../distribution/sim-cloudfront-distribution.js";
+interface SimCfInvalidationAccessProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly distributions: Map<SimCloudFrontDistributionId, SimCloudFrontDistribution>;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * What every invalidation command needs: the Distributions, IAM, and the
+ * clock.
+ *
+ * The three commands all name a Distribution, authorize against its ARN and
+ * resolve it the same way, so that happens here once rather than in each of
+ * them.
+ */
+export declare class SimCfInvalidationAccess {
+    readonly background: BackgroundScheduler;
+    private readonly accountId;
+    private readonly distributions;
+    private readonly iam;
+    constructor(properties: SimCfInvalidationAccessProperties);
+    /**
+     * Resolve the Distribution an invalidation command names, having authorized
+     * the action against its ARN.
+     *
+     * The ARN is built from the ID the caller gave, so authorization happens
+     * before the Distribution map is read and an unauthorized caller learns
+     * nothing about which IDs exist.
+     */
+    authorizedDistribution(action: string, distributionId: string | undefined, caller?: SimAwsCaller): SimCloudFrontDistribution;
+}
+export {};

package/dist/service/cloudfront/command/invalidation/sim-cf-invalidation-access.js

@@ -0,0 +1,45 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCloudFrontNoSuchDistribution } from "../../error/sim-cloudfront.error.js";
+import { simCfAuthorize } from "../../sim-cf-authorize.js";
+/**
+ * What every invalidation command needs: the Distributions, IAM, and the
+ * clock.
+ *
+ * The three commands all name a Distribution, authorize against its ARN and
+ * resolve it the same way, so that happens here once rather than in each of
+ * them.
+ */
+export class SimCfInvalidationAccess {
+    background;
+    accountId;
+    distributions;
+    iam;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.distributions = properties.distributions;
+        this.iam = properties.iam;
+        this.background = properties.background;
+    }
+    /**
+     * Resolve the Distribution an invalidation command names, having authorized
+     * the action against its ARN.
+     *
+     * The ARN is built from the ID the caller gave, so authorization happens
+     * before the Distribution map is read and an unauthorized caller learns
+     * nothing about which IDs exist.
+     */
+    authorizedDistribution(action, distributionId, caller) {
+        assertDefined(distributionId, `${action} DistributionId`);
+        simCfAuthorize({
+            iam: this.iam,
+            action,
+            resource: `arn:aws:cloudfront::${this.accountId}:distribution/${distributionId}`,
+            caller,
+        });
+        const distribution = this.distributions.get(distributionId);
+        if (distribution === undefined) {
+            throw new SimCloudFrontNoSuchDistribution(`No sim CloudFront Distribution with ID ${distributionId}`);
+        }
+        return distribution;
+    }
+}

package/dist/service/cloudfront/command/invalidation/sim-cf-invalidation-command.types.d.ts

@@ -0,0 +1,80 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimCfInvalidationSummaryView, SimCfInvalidationView } from "../../invalidation/sim-cf-invalidation-view.js";
+/**
+ * Minimal structural sim CloudFront invalidation batch, as a caller sends it.
+ */
+export interface SimCfInvalidationBatchInput {
+    readonly CallerReference?: string | undefined;
+    readonly Paths?: {
+        readonly Quantity?: number | undefined;
+        readonly Items?: readonly string[] | undefined;
+    } | undefined;
+}
+/**
+ * Minimal structural sim CloudFront CreateInvalidation command.
+ */
+export interface SimCreateInvalidationCommand {
+    readonly input: SimCreateInvalidationCommandInput;
+}
+/**
+ * Minimal structural sim CloudFront CreateInvalidation input.
+ */
+export interface SimCreateInvalidationCommandInput {
+    readonly DistributionId?: string | undefined;
+    readonly InvalidationBatch?: SimCfInvalidationBatchInput | undefined;
+}
+/**
+ * Minimal structural sim CloudFront CreateInvalidation output.
+ */
+export interface SimCreateInvalidationCommandOutput {
+    readonly Location?: string | undefined;
+    readonly Invalidation?: SimCfInvalidationView | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim CloudFront GetInvalidation command.
+ */
+export interface SimGetInvalidationCommand {
+    readonly input: SimGetInvalidationCommandInput;
+}
+/**
+ * Minimal structural sim CloudFront GetInvalidation input.
+ */
+export interface SimGetInvalidationCommandInput {
+    readonly DistributionId?: string | undefined;
+    readonly Id?: string | undefined;
+}
+/**
+ * Minimal structural sim CloudFront GetInvalidation output.
+ */
+export interface SimGetInvalidationCommandOutput {
+    readonly Invalidation?: SimCfInvalidationView | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim CloudFront ListInvalidations command.
+ */
+export interface SimListInvalidationsCommand {
+    readonly input: SimListInvalidationsCommandInput;
+}
+/**
+ * Minimal structural sim CloudFront ListInvalidations input.
+ */
+export interface SimListInvalidationsCommandInput {
+    readonly DistributionId?: string | undefined;
+    readonly Marker?: string | undefined;
+    readonly MaxItems?: number | undefined;
+}
+/**
+ * Minimal structural sim CloudFront ListInvalidations output.
+ */
+export interface SimListInvalidationsCommandOutput {
+    readonly InvalidationList?: {
+        readonly Marker: string;
+        readonly MaxItems: number;
+        readonly IsTruncated: boolean;
+        readonly Quantity: number;
+        readonly Items: readonly SimCfInvalidationSummaryView[];
+    } | undefined;
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/cloudfront/command/invalidation/sim-cf-invalidation-command.types.js

@@ -0,0 +1 @@
+export {};