@kensio/yulin 1.21.10 → 1.21.11

package/dist/service/apigatewayv2/command/stage/sim-http-api-stage-commands.js

@@ -1,6 +1,7 @@
 import { SimHttpApiStage } from "../../api/stage/sim-http-api-stage.js";
 import { SimApiGatewayV2NotFound } from "../../error/sim-api-gateway-v2.error.js";
 import { SimApiGatewayV2UnsimulatedInput } from "../sim-api-gateway-v2-unsimulated-input.js";
+import { simHttpApiAccessLogSettings } from "./sim-http-api-access-log-settings-input.js";
 import { simHttpApiStageRouteSettings } from "./sim-http-api-stage-route-settings-input.js";
 import { SimHttpApiStageRules } from "./sim-http-api-stage-rules.js";
 const stagesPath = "/stages";
@@ -12,6 +13,7 @@ const acceptedCreateStageOptions = [
     "Description",
     "DefaultRouteSettings",
     "RouteSettings",
+    "AccessLogSettings",
 ];
 /**
  * The commands addressing the stages of an API.
@@ -38,6 +40,7 @@ export class SimHttpApiStageCommands {
             unsimulated,
             clock: this.clock,
         });
+        const accessLogSettings = simHttpApiAccessLogSettings(input, unsimulated);
         const httpApi = this.access.api({
             method: "POST",
             apiId,
@@ -52,6 +55,7 @@ export class SimHttpApiStageCommands {
             description: input.Description,
             createdDate: this.clock.now(),
             routeSettings,
+            accessLogSettings,
         });
         httpApi.stages.add(stage);
         return { ...stage.view(), $metadata: {} };

package/dist/service/apigatewayv2/command/stage/stage.command.d.ts

@@ -1,5 +1,6 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimHttpApiRouteSettings, SimHttpApiRouteSettingsMap } from "../../api/stage/settings/sim-http-api-route-settings.type.js";
+import type { SimHttpApiAccessLogSettingsInput } from "../../api/stage/access-log/sim-http-api-access-log-settings.type.js";
 import type { SimHttpApiStageView } from "../../api/stage/sim-http-api-stage.js";
 /**
  * Minimal structural sim API Gateway v2 CreateStage command.
@@ -17,6 +18,7 @@ export interface SimCreateStageCommandInput {
     readonly Description?: string | undefined;
     readonly DefaultRouteSettings?: SimHttpApiRouteSettings | undefined;
     readonly RouteSettings?: SimHttpApiRouteSettingsMap | undefined;
+    readonly AccessLogSettings?: SimHttpApiAccessLogSettingsInput | undefined;
 }
 export interface SimCreateStageCommandOutput extends SimHttpApiStageView {
     readonly $metadata: SimResponseMetadata;

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.d.ts

@@ -35,4 +35,10 @@ export interface SimHttpApiRouteAuthorizeInput {
      * integrated function's.
      */
     readonly iam: SimIamInterServiceAuthZ;
+    /**
+     * The id the endpoint stamped this request with, which a `REQUEST`
+     * authorizer's event reports as its own. The authorizer and the integration
+     * behind the same request name one id, as they do on real AWS.
+     */
+    readonly requestId?: string | undefined;
 }

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.d.ts

@@ -10,31 +10,29 @@ interface SimApiGatewayV2ServiceControllerProperties {
  *
  * A request reaching the generated endpoint, or a custom domain mapped to the
  * API, is matched to a route, and the route's integration invokes a simulated
- * Lambda function with a payload format 2.0 event. The function runs as its execution Role, as it does for
- * any other invocation.
+ * Lambda function with a payload format 2.0 event. The function runs as its
+ * execution Role, as it does for any other invocation. The throttle and the
+ * authorization standing in front of that are the pipeline's.
  *
- * The stage's throttle comes before any of that. A route whose bucket is empty
- * is answered 429, and neither its authorizer nor its integration runs.
- *
- * A route that authorizes anybody is checked next: a JWT route's
- * token has to verify and meet the route's scopes, an `AWS_IAM` route's caller
- * has to be allowed `execute-api:Invoke` on the route, and a `CUSTOM` route's
- * Lambda authorizer has to allow the request, or the request is refused and the
- * integration is never invoked. Whether the API may invoke a function is a
- * separate question, and the API's own rather than the client's.
+ * Every request the resolver matches is stamped with an id before anything
+ * runs, so the stage's access log line, the authorizer event and the
+ * integration event all name the same request, as they do on real AWS.
  */
 export declare class SimApiGatewayV2ServiceController implements SimAwsServiceController {
     private readonly router;
-    private readonly routeAuthorizer;
-    private readonly integration;
+    private readonly pipeline;
     private readonly serving;
+    private readonly accessLog;
     private readonly errorResponse;
-    private readonly refusalResponse;
     constructor(properties?: SimApiGatewayV2ServiceControllerProperties);
     /**
      * Handle an HTTP request routed to a simulated HTTP API.
      */
     handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
-    private invoke;
+    /**
+     * Serve one request the resolver matched to a stage, and record it in that
+     * stage's access log.
+     */
+    private serve;
 }
 export {};

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.js

@@ -1,50 +1,38 @@
+import { randomUUID } from "node:crypto";
 import { SimAws } from "../../aws/sim-aws.js";
-import { SimHttpApiRouteAuthorizer } from "./auth/sim-http-api-route-authorizer.js";
+import { SimHttpApiAccessLog } from "./sim-http-api-access-log.js";
 import { SimApiGatewayV2ErrorResponse } from "./sim-api-gateway-v2-error-response.js";
 import { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
-import { SimHttpApiIntegrationInvocation } from "./sim-http-api-integration-invocation.js";
-import { SimHttpApiRefusalResponse } from "./sim-http-api-refusal-response.js";
+import { SimHttpApiServePipeline } from "./sim-http-api-serve-pipeline.js";
 import { SimHttpApiServingResolver, } from "./sim-http-api-serving.js";
 /**
  * Localhost HTTP controller for simulated API Gateway HTTP APIs.
  *
  * A request reaching the generated endpoint, or a custom domain mapped to the
  * API, is matched to a route, and the route's integration invokes a simulated
- * Lambda function with a payload format 2.0 event. The function runs as its execution Role, as it does for
- * any other invocation.
+ * Lambda function with a payload format 2.0 event. The function runs as its
+ * execution Role, as it does for any other invocation. The throttle and the
+ * authorization standing in front of that are the pipeline's.
  *
- * The stage's throttle comes before any of that. A route whose bucket is empty
- * is answered 429, and neither its authorizer nor its integration runs.
- *
- * A route that authorizes anybody is checked next: a JWT route's
- * token has to verify and meet the route's scopes, an `AWS_IAM` route's caller
- * has to be allowed `execute-api:Invoke` on the route, and a `CUSTOM` route's
- * Lambda authorizer has to allow the request, or the request is refused and the
- * integration is never invoked. Whether the API may invoke a function is a
- * separate question, and the API's own rather than the client's.
+ * Every request the resolver matches is stamped with an id before anything
+ * runs, so the stage's access log line, the authorizer event and the
+ * integration event all name the same request, as they do on real AWS.
  */
 export class SimApiGatewayV2ServiceController {
     router;
-    routeAuthorizer;
-    integration;
+    pipeline;
     serving;
+    accessLog;
     errorResponse = new SimApiGatewayV2ErrorResponse();
-    refusalResponse = new SimHttpApiRefusalResponse();
     constructor(properties = {}) {
         const { simAws = new SimAws() } = properties;
         this.router = properties.router ?? new SimApiGatewayV2Router({ simAws });
-        // The clock is taken from the router rather than from properties, so a
-        // supplied router, the event timestamps and the token expiry checks all
-        // belong to the same simulation.
-        this.routeAuthorizer = new SimHttpApiRouteAuthorizer({
-            clock: this.router.simAws,
-            functions: this.router,
-        });
-        this.integration = new SimHttpApiIntegrationInvocation({
-            router: this.router,
+        this.pipeline = new SimHttpApiServePipeline({ router: this.router });
+        this.serving = new SimHttpApiServingResolver({ router: this.router });
+        this.accessLog = new SimHttpApiAccessLog({
+            simAws: this.router.simAws,
             clock: this.router.simAws,
         });
-        this.serving = new SimHttpApiServingResolver({ router: this.router });
     }
     /**
      * Handle an HTTP request routed to a simulated HTTP API.
@@ -59,41 +47,19 @@ export class SimApiGatewayV2ServiceController {
                 return this.errorResponse.forbiddenHost();
             }
             case "served": {
-                return await this.invoke(resolution.serving, serviceRequest);
+                return await this.serve(resolution.serving, serviceRequest);
             }
         }
     }
-    async invoke(serving, serviceRequest) {
-        const { request } = serviceRequest;
-        const { api, match } = serving;
-        // The stage's throttle is asked before the route's authorizer. A flood of
-        // requests to a throttled route invokes neither. AWS publishes no order
-        // between the two.
-        if (!match.stage.admits(match.route.routeKey)) {
-            return this.errorResponse.tooManyRequests();
-        }
-        // The client's own authorization comes next: a request with no
-        // credentials is refused whether or not the integration behind the route
-        // would work.
-        const authorization = await this.routeAuthorizer.authorize({
-            api,
-            match,
-            request,
-            caller: serviceRequest.caller,
-            iam: this.router.iamFor(api),
-            domainName: serving.domainName,
-            rawPath: serving.rawPath,
-        });
-        if (!authorization.admitted) {
-            return this.refusalResponse.build(authorization);
-        }
-        return await this.integration.invoke({
-            api,
-            match,
-            request,
-            authorization,
-            domainName: serving.domainName,
-            rawPath: serving.rawPath,
-        });
+    /**
+     * Serve one request the resolver matched to a stage, and record it in that
+     * stage's access log.
+     */
+    async serve(resolved, serviceRequest) {
+        const serving = { ...resolved, requestId: randomUUID() };
+        const at = this.router.simAws.now();
+        const served = await this.pipeline.run(serving, serviceRequest);
+        await this.accessLog.served(serving, serviceRequest.request, served, at);
+        return served.response;
     }
 }

package/dist/service/apigatewayv2/serve/sim-http-api-access-log-record.d.ts

@@ -0,0 +1,31 @@
+import type { SimHttpApiAccessLogRequest } from "../api/stage/access-log/sim-http-api-access-log-request.js";
+import type { SimHttpApiAuthorization } from "../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiServing } from "./sim-http-api-serving.js";
+import type { SimHttpApiIntegrationOutcome } from "./sim-http-api-integration-outcome.js";
+interface SimHttpApiAccessLogRecordInput {
+    readonly serving: SimHttpApiServing;
+    readonly requestId: string;
+    readonly request: Request;
+    readonly response: Response;
+    /** Simulated milliseconds the whole request took. */
+    readonly responseLatency: number;
+    /** How long the response body is, measured from the response itself. */
+    readonly responseLength: number;
+    /** The simulated instant the request arrived. */
+    readonly at: Date;
+    /** Absent for a request refused before the route's authorizer ran. */
+    readonly authorization?: SimHttpApiAuthorization | undefined;
+    /** Absent for a request no integration was invoked for. */
+    readonly integration?: SimHttpApiIntegrationOutcome | undefined;
+}
+/**
+ * Describe one served request as its stage's access log records it.
+ *
+ * Every path through the endpoint arrives here, including the ones that
+ * refused the request. A throttled request has no authorization and no
+ * integration, and an authorizer that said no has an authorization and no
+ * integration. What each one knows is what its line carries, and the rest of
+ * the format's variables render as dashes.
+ */
+export declare function simHttpApiAccessLogRecord(input: SimHttpApiAccessLogRecordInput): SimHttpApiAccessLogRequest;
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-access-log-record.js

@@ -0,0 +1,88 @@
+import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
+/**
+ * The `$context.error.message` an endpoint's own refusal carries.
+ *
+ * These are the bodies `SimApiGatewayV2ErrorResponse` answers with, keyed by
+ * the status they answer with. A response an integration produced has no entry
+ * here, and leaves the variable empty as real API Gateway does.
+ */
+const refusalMessages = new Map([
+    [401, "Unauthorized"],
+    [403, "Forbidden"],
+    [429, "Too Many Requests"],
+    [500, "Internal Server Error"],
+]);
+/**
+ * Describe one served request as its stage's access log records it.
+ *
+ * Every path through the endpoint arrives here, including the ones that
+ * refused the request. A throttled request has no authorization and no
+ * integration, and an authorizer that said no has an authorization and no
+ * integration. What each one knows is what its line carries, and the rest of
+ * the format's variables render as dashes.
+ */
+export function simHttpApiAccessLogRecord(input) {
+    const { serving, request, response, authorization, integration } = input;
+    const { api, match, domainName } = serving;
+    const admitted = authorization?.admitted === true ? authorization : undefined;
+    return {
+        requestId: input.requestId,
+        at: input.at,
+        accountId: api.accountRegionScope.accountId,
+        apiId: api.apiId,
+        domainName,
+        domainPrefix: domainName.split(".", 1).join(""),
+        stage: match.stage.stageName,
+        routeKey: match.route.routeKey,
+        method: request.method,
+        path: serving.rawPath,
+        protocol: "HTTP/1.1",
+        sourceIp: simAwsProxiedSourceIp,
+        userAgent: request.headers.get("user-agent") ?? "",
+        status: response.status,
+        responseLength: input.responseLength,
+        responseLatency: input.responseLatency,
+        ...(refusalMessage(response, integration) !== undefined && {
+            errorMessage: refusalMessage(response, integration),
+        }),
+        ...(authorization?.admitted === false &&
+            authorization.errorDescription !== undefined && {
+            authorizerError: authorization.errorDescription,
+        }),
+        ...integrationFields(integration),
+        ...(admitted?.jwt !== undefined && { jwt: admitted.jwt }),
+        ...(admitted?.lambda !== undefined && { lambda: admitted.lambda }),
+        ...(serving.basePathMatched !== undefined && {
+            basePathMatched: serving.basePathMatched,
+        }),
+    };
+}
+/**
+ * What the integration contributed, with the members it has no value for left
+ * out so that they render as dashes.
+ *
+ * A request no integration ran for contributes nothing at all, which is what a
+ * throttled or refused request does.
+ */
+function integrationFields(integration) {
+    if (integration === undefined) {
+        return {};
+    }
+    const { integrationStatus, lambdaInvokeStatus, integrationErrorMessage, integrationLatency, } = integration;
+    return {
+        ...(integrationStatus !== undefined && { integrationStatus }),
+        ...(lambdaInvokeStatus !== undefined && { lambdaInvokeStatus }),
+        ...(integrationErrorMessage !== undefined && { integrationErrorMessage }),
+        ...(integrationLatency !== undefined && { integrationLatency }),
+    };
+}
+/**
+ * The message the endpoint answered with, where the endpoint answered rather
+ * than the integration.
+ */
+function refusalMessage(response, integration) {
+    if (integration?.integrationStatus !== undefined) {
+        return undefined;
+    }
+    return refusalMessages.get(response.status);
+}

package/dist/service/apigatewayv2/serve/sim-http-api-access-log.d.ts

@@ -0,0 +1,43 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimHttpApiAccessLogRequest } from "../api/stage/access-log/sim-http-api-access-log-request.js";
+import type { SimHttpApiStage } from "../api/stage/sim-http-api-stage.js";
+import type { SimHttpApiServed } from "./sim-http-api-served.js";
+import type { SimHttpApiServing } from "./sim-http-api-serving.js";
+interface SimHttpApiAccessLogProperties {
+    readonly simAws: SimAws;
+    readonly clock: SimClock;
+}
+/**
+ * Writes a stage's access log line for one request.
+ *
+ * The line goes to the log group alone. Sim Lambda forwards a handler's output
+ * to the host console as well, and an API answering a few hundred requests in
+ * one test file would bury the suite's own output the same way. Writing
+ * through `SimLogsServiceWriter` keeps it out of the console, and a test reads
+ * the lines back with `FilterLogEvents`.
+ *
+ * Nothing here fails. A destination log group that was never declared is
+ * created by the write, and a stage with no access log settings writes
+ * nothing, which is how a request is served whether or not anybody is logging
+ * it.
+ */
+export declare class SimHttpApiAccessLog {
+    #private;
+    constructor(properties: SimHttpApiAccessLogProperties);
+    /**
+     * Record one finished request against the stage that served it.
+     *
+     * A stage with no access log settings does nothing here, including none of
+     * the measuring a line needs. The response body is measured from a clone,
+     * since the one the client gets still has to be readable, and the latency is
+     * simulated milliseconds, so a test holding the clock logs a latency of zero
+     * rather than however long the process happened to take.
+     */
+    served(serving: SimHttpApiServing, request: Request, served: SimHttpApiServed, at: Date): Promise<void>;
+    /**
+     * Record one described request against the stage that served it.
+     */
+    record(stage: SimHttpApiStage, request: SimHttpApiAccessLogRequest): void;
+}
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-access-log.js

@@ -0,0 +1,72 @@
+import { simHttpApiAccessLogLine } from "../api/stage/access-log/sim-http-api-access-log-format.js";
+import { simHttpApiAccessLogStreamName } from "../api/stage/access-log/sim-http-api-access-log-stream-name.js";
+import { simHttpApiAccessLogVariables } from "../api/stage/access-log/sim-http-api-access-log-variables.js";
+import { simHttpApiAccessLogRecord } from "./sim-http-api-access-log-record.js";
+/**
+ * Writes a stage's access log line for one request.
+ *
+ * The line goes to the log group alone. Sim Lambda forwards a handler's output
+ * to the host console as well, and an API answering a few hundred requests in
+ * one test file would bury the suite's own output the same way. Writing
+ * through `SimLogsServiceWriter` keeps it out of the console, and a test reads
+ * the lines back with `FilterLogEvents`.
+ *
+ * Nothing here fails. A destination log group that was never declared is
+ * created by the write, and a stage with no access log settings writes
+ * nothing, which is how a request is served whether or not anybody is logging
+ * it.
+ */
+export class SimHttpApiAccessLog {
+    #simAws;
+    #clock;
+    constructor(properties) {
+        this.#simAws = properties.simAws;
+        this.#clock = properties.clock;
+    }
+    /**
+     * Record one finished request against the stage that served it.
+     *
+     * A stage with no access log settings does nothing here, including none of
+     * the measuring a line needs. The response body is measured from a clone,
+     * since the one the client gets still has to be readable, and the latency is
+     * simulated milliseconds, so a test holding the clock logs a latency of zero
+     * rather than however long the process happened to take.
+     */
+    async served(serving, request, served, at) {
+        const { match, requestId = "" } = serving;
+        if (match.stage.accessLogSettings === undefined) {
+            return;
+        }
+        const body = await served.response.clone().arrayBuffer();
+        this.record(match.stage, simHttpApiAccessLogRecord({
+            serving,
+            requestId,
+            request,
+            response: served.response,
+            responseLength: body.byteLength,
+            responseLatency: this.#clock.now().getTime() - at.getTime(),
+            at,
+            ...(served.authorization !== undefined && {
+                authorization: served.authorization,
+            }),
+            ...(served.integration !== undefined && {
+                integration: served.integration,
+            }),
+        }));
+    }
+    /**
+     * Record one described request against the stage that served it.
+     */
+    record(stage, request) {
+        const settings = stage.accessLogSettings;
+        if (settings === undefined) {
+            return;
+        }
+        const line = simHttpApiAccessLogLine(settings.format, simHttpApiAccessLogVariables(request));
+        this.#simAws
+            .accountRegionScope(settings.accountId, settings.regionName)
+            .logs()
+            .serviceWriter()
+            .write(settings.logGroupName, simHttpApiAccessLogStreamName(this.#clock), [line]);
+    }
+}

package/dist/service/apigatewayv2/serve/sim-http-api-endpoint.js

@@ -18,6 +18,7 @@
 export function simHttpApiEndpoint(serving) {
     const { api, match, domainName } = serving;
     return {
+        ...(serving.requestId !== undefined && { requestId: serving.requestId }),
         apiId: api.apiId,
         domainName,
         // The first label, which is the API id for a generated endpoint and the

package/dist/service/apigatewayv2/serve/sim-http-api-integration-input.d.ts

@@ -0,0 +1,22 @@
+import type { SimHttpApiAdmitted } from "../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiMatch } from "../api/sim-http-api-match.js";
+import type { SimHttpApi } from "../api/sim-http-api.js";
+/**
+ * One request an integration is invoked for, as the endpoint resolved it.
+ */
+export interface SimHttpApiIntegrationInvocationInput {
+    readonly api: SimHttpApi;
+    readonly match: SimHttpApiMatch;
+    readonly request: Request;
+    /** What the route's authorization knows about the caller. */
+    readonly authorization: SimHttpApiAdmitted;
+    /** The AWS-shaped hostname the request arrived on. */
+    readonly domainName: string;
+    /** The path the invocation event reports, which the resolver settled. */
+    readonly rawPath: string;
+    /**
+     * The id the endpoint stamped this request with, which the invocation event
+     * reports as its own.
+     */
+    readonly requestId?: string | undefined;
+}

package/dist/service/apigatewayv2/serve/sim-http-api-integration-input.js

@@ -0,0 +1 @@
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-integration-invocation.d.ts

@@ -1,24 +1,12 @@
 import type { SimClock } from "../../../util/clock/sim-clock.js";
-import type { SimHttpApiAdmitted } from "../api/authorizer/sim-http-api-authorization.js";
-import type { SimHttpApiMatch } from "../api/sim-http-api-match.js";
-import type { SimHttpApi } from "../api/sim-http-api.js";
 import type { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
+import type { SimHttpApiIntegrationInvocationInput } from "./sim-http-api-integration-input.js";
+import { type SimHttpApiIntegrationOutcome } from "./sim-http-api-integration-outcome.js";
 interface SimHttpApiIntegrationInvocationProperties {
     readonly router: SimApiGatewayV2Router;
     /** Clock the invocation event is stamped with. */
     readonly clock: SimClock;
 }
-interface SimHttpApiIntegrationInvocationInput {
-    readonly api: SimHttpApi;
-    readonly match: SimHttpApiMatch;
-    readonly request: Request;
-    /** What the route's authorization knows about the caller. */
-    readonly authorization: SimHttpApiAdmitted;
-    /** The AWS-shaped hostname the request arrived on. */
-    readonly domainName: string;
-    /** The path the invocation event reports, which the resolver settled. */
-    readonly rawPath: string;
-}
 /**
  * Invokes the Lambda function behind the matched route's integration, and
  * turns what it returns into the HTTP response.
@@ -37,13 +25,8 @@ export declare class SimHttpApiIntegrationInvocation {
     /**
      * Invoke the integration for one authorized request.
      */
-    invoke(input: SimHttpApiIntegrationInvocationInput): Promise<Response>;
-    /**
-     * Whether the API lacks permission to invoke the integrated function.
-     *
-     * The route the request matched is supplied as the source ARN, so a
-     * permission granted for one route does not open another.
-     */
-    private mayNotInvoke;
+    invoke(input: SimHttpApiIntegrationInvocationInput): Promise<SimHttpApiIntegrationOutcome>;
+    /** The 500 answered whenever a handler was never reached. */
+    private failed;
 }
 export {};

package/dist/service/apigatewayv2/serve/sim-http-api-integration-invocation.js

@@ -1,9 +1,9 @@
 import { SimPayload2EventBuilder } from "../../../serve/payload-2/sim-payload-2-event-builder.js";
 import { SimPayload2ResponseBuilder } from "../../../serve/payload-2/sim-payload-2-response-builder.js";
-import { SimHttpApiExecuteApiArn } from "../api/sim-http-api-execute-api-arn.js";
-import { SimHttpApiInvokeAuthorizer } from "./auth/sim-http-api-invoke-authorizer.js";
 import { SimApiGatewayV2ErrorResponse } from "./sim-api-gateway-v2-error-response.js";
+import { simHttpApiMayNotInvoke } from "./sim-http-api-may-invoke.js";
 import { simHttpApiEndpoint } from "./sim-http-api-endpoint.js";
+import { simHttpApiIntegrationFailure, } from "./sim-http-api-integration-outcome.js";
 /**
  * Invokes the Lambda function behind the matched route's integration, and
  * turns what it returns into the HTTP response.
@@ -30,11 +30,11 @@ export class SimHttpApiIntegrationInvocation {
     async invoke(input) {
         const { match, request, authorization } = input;
         const target = this.router.targetFor(match.integration);
-        if (target === undefined || this.mayNotInvoke(input, target)) {
+        if (target === undefined || simHttpApiMayNotInvoke(input, target)) {
             // The integration names a function that is not there, or one that
             // granted the API nothing. Real API Gateway discovers both only when it
             // tries to invoke, answers 500, and leaves the reason in its own logs.
-            return this.errorResponse.internalServerError();
+            return this.failed("The integration could not be invoked");
         }
         try {
             const event = await this.eventBuilder.build(request, simHttpApiEndpoint(input), {
@@ -42,28 +42,25 @@ export class SimHttpApiIntegrationInvocation {
                 caller: authorization.caller,
                 lambda: authorization.lambda,
             });
-            return this.responseBuilder.build(await target.simFunction.invoke(event));
+            const response = this.responseBuilder.build(await target.simFunction.invoke(event));
+            // Lambda answered the invocation, whatever the handler then returned.
+            // That is the distinction between the two statuses AWS logs.
+            return {
+                response,
+                integrationStatus: response.status,
+                lambdaInvokeStatus: 200,
+            };
         }
-        catch {
+        catch (error) {
             // Real API Gateway reports an unhandled integration error as a 500, with
             // the error itself only visible in the function's logs. Reading the
             // request body can fail the same way, so building the event is inside
             // this too.
-            return this.errorResponse.internalServerError();
+            return this.failed(error);
         }
     }
-    /**
-     * Whether the API lacks permission to invoke the integrated function.
-     *
-     * The route the request matched is supplied as the source ARN, so a
-     * permission granted for one route does not open another.
-     */
-    mayNotInvoke(input, target) {
-        const { api, match, request } = input;
-        return new SimHttpApiInvokeAuthorizer({ iam: target.iam }).authorize({
-            api,
-            target,
-            sourceArn: SimHttpApiExecuteApiArn.forMatchedRoute(api, match, request.method),
-        }).isDenied;
+    /** The 500 answered whenever a handler was never reached. */
+    failed(error) {
+        return simHttpApiIntegrationFailure(this.errorResponse.internalServerError(), error);
     }
 }

package/dist/service/apigatewayv2/serve/sim-http-api-integration-outcome.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What invoking an integration produced, beyond the response the client gets.
+ *
+ * The two statuses are the pair AWS distinguishes in its access log variables.
+ * `lambdaInvokeStatus` is Lambda's own answer to the invocation, and
+ * `integrationStatus` the status the handler's code returned. An invocation
+ * that never reached a handler has neither.
+ */
+export interface SimHttpApiIntegrationOutcome {
+    readonly response: Response;
+    readonly integrationStatus?: number | undefined;
+    readonly lambdaInvokeStatus?: number | undefined;
+    readonly integrationErrorMessage?: string | undefined;
+    /**
+     * Simulated milliseconds the invocation took. A test holding the clock still
+     * measures zero, the way the whole request's latency does.
+     */
+    readonly integrationLatency?: number | undefined;
+}
+/**
+ * The 500 every way of failing to reach a handler produces, carrying the
+ * reason the access log reports as `$context.integrationErrorMessage`.
+ *
+ * The message never reaches the client. Real API Gateway answers the same
+ * body whatever went wrong, and leaves the reason in its own logs.
+ */
+export declare function simHttpApiIntegrationFailure(response: Response, error: unknown): SimHttpApiIntegrationOutcome;

package/dist/service/apigatewayv2/serve/sim-http-api-integration-outcome.js

@@ -0,0 +1,13 @@
+/**
+ * The 500 every way of failing to reach a handler produces, carrying the
+ * reason the access log reports as `$context.integrationErrorMessage`.
+ *
+ * The message never reaches the client. Real API Gateway answers the same
+ * body whatever went wrong, and leaves the reason in its own logs.
+ */
+export function simHttpApiIntegrationFailure(response, error) {
+    return {
+        response,
+        integrationErrorMessage: error instanceof Error ? error.message : String(error),
+    };
+}