@kensio/yulin 1.21.10 → 1.21.12

package/dist/service/apigatewayv2/serve/sim-http-api-may-invoke.d.ts

@@ -0,0 +1,19 @@
+import type { SimHttpApiMatch } from "../api/sim-http-api-match.js";
+import type { SimHttpApi } from "../api/sim-http-api.js";
+import type { SimHttpApiFunctionTarget } from "./sim-http-api-function-target.js";
+interface SimHttpApiMayInvokeInput {
+    readonly api: SimHttpApi;
+    readonly match: SimHttpApiMatch;
+    readonly request: Request;
+}
+/**
+ * Whether the API lacks permission to invoke a function behind one of its
+ * routes.
+ *
+ * The route the request matched is supplied as the source ARN, so a permission
+ * granted for one route does not open another. This is the API's own question
+ * rather than the client's, whose was already answered by the route's
+ * authorization.
+ */
+export declare function simHttpApiMayNotInvoke(input: SimHttpApiMayInvokeInput, target: SimHttpApiFunctionTarget): boolean;
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-may-invoke.js

@@ -0,0 +1,19 @@
+import { SimHttpApiExecuteApiArn } from "../api/sim-http-api-execute-api-arn.js";
+import { SimHttpApiInvokeAuthorizer } from "./auth/sim-http-api-invoke-authorizer.js";
+/**
+ * Whether the API lacks permission to invoke a function behind one of its
+ * routes.
+ *
+ * The route the request matched is supplied as the source ARN, so a permission
+ * granted for one route does not open another. This is the API's own question
+ * rather than the client's, whose was already answered by the route's
+ * authorization.
+ */
+export function simHttpApiMayNotInvoke(input, target) {
+    const { api, match, request } = input;
+    return new SimHttpApiInvokeAuthorizer({ iam: target.iam }).authorize({
+        api,
+        target,
+        sourceArn: SimHttpApiExecuteApiArn.forMatchedRoute(api, match, request.method),
+    }).isDenied;
+}

package/dist/service/apigatewayv2/serve/sim-http-api-serve-pipeline.d.ts

@@ -0,0 +1,27 @@
+import type { SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import type { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
+import type { SimHttpApiServed, SimHttpApiServedRequest } from "./sim-http-api-served.js";
+interface SimHttpApiServePipelineProperties {
+    readonly router: SimApiGatewayV2Router;
+}
+/**
+ * Takes one request the resolver matched to a stage through the three things
+ * that stand between it and a response.
+ *
+ * The stage's throttle is asked first. A flood of requests to a throttled
+ * route invokes neither the authorizer nor the integration, and AWS publishes
+ * no order between the two. The client's own authorization comes next, so a
+ * request with no credentials is refused whether or not the integration
+ * behind the route would work. What each step decided is carried out with the
+ * response, because the stage's access log describes the request afterwards
+ * and a refused request is the case that log exists for.
+ */
+export declare class SimHttpApiServePipeline {
+    #private;
+    constructor(properties: SimHttpApiServePipelineProperties);
+    /**
+     * Serve one request, and report what each step of serving it decided.
+     */
+    run(serving: SimHttpApiServedRequest, serviceRequest: SimAwsServiceRequest): Promise<SimHttpApiServed>;
+}
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-serve-pipeline.js

@@ -0,0 +1,75 @@
+import { SimHttpApiRouteAuthorizer } from "./auth/sim-http-api-route-authorizer.js";
+import { SimApiGatewayV2ErrorResponse } from "./sim-api-gateway-v2-error-response.js";
+import { SimHttpApiIntegrationInvocation } from "./sim-http-api-integration-invocation.js";
+import { SimHttpApiRefusalResponse } from "./sim-http-api-refusal-response.js";
+/**
+ * Takes one request the resolver matched to a stage through the three things
+ * that stand between it and a response.
+ *
+ * The stage's throttle is asked first. A flood of requests to a throttled
+ * route invokes neither the authorizer nor the integration, and AWS publishes
+ * no order between the two. The client's own authorization comes next, so a
+ * request with no credentials is refused whether or not the integration
+ * behind the route would work. What each step decided is carried out with the
+ * response, because the stage's access log describes the request afterwards
+ * and a refused request is the case that log exists for.
+ */
+export class SimHttpApiServePipeline {
+    #router;
+    #routeAuthorizer;
+    #integration;
+    #errorResponse = new SimApiGatewayV2ErrorResponse();
+    #refusalResponse = new SimHttpApiRefusalResponse();
+    constructor(properties) {
+        this.#router = properties.router;
+        // The clock is the router's, so the event timestamps and the token expiry
+        // checks belong to the same simulation.
+        this.#routeAuthorizer = new SimHttpApiRouteAuthorizer({
+            clock: properties.router.simAws,
+            functions: properties.router,
+        });
+        this.#integration = new SimHttpApiIntegrationInvocation({
+            router: properties.router,
+            clock: properties.router.simAws,
+        });
+    }
+    /**
+     * Serve one request, and report what each step of serving it decided.
+     */
+    async run(serving, serviceRequest) {
+        const { request } = serviceRequest;
+        const { api, match, domainName, rawPath, requestId } = serving;
+        // What the authorizer's event and the integration's event both describe.
+        const asked = { api, match, request, domainName, rawPath, requestId };
+        // The throttle takes a token from the route's bucket, and a route whose
+        // bucket is empty is answered here. Neither the authorizer nor the
+        // integration runs for it, and the stage's access log is the only place
+        // the refusal is recorded.
+        if (!match.stage.admits(match.route.routeKey)) {
+            return { response: this.#errorResponse.tooManyRequests() };
+        }
+        const authorization = await this.#routeAuthorizer.authorize({
+            ...asked,
+            caller: serviceRequest.caller,
+            iam: this.#router.iamFor(api),
+        });
+        // A refusal is carried out alongside its response, because the access log
+        // line reports what the authorizer said. An unmet route scope, an
+        // `AWS_IAM` route IAM did not allow, and a Lambda authorizer that said no
+        // all arrive here.
+        if (!authorization.admitted) {
+            return {
+                response: this.#refusalResponse.build(authorization),
+                authorization,
+            };
+        }
+        const clock = this.#router.simAws;
+        const invokedAt = clock.now().getTime();
+        const outcome = await this.#integration.invoke({ ...asked, authorization });
+        const integration = {
+            ...outcome,
+            integrationLatency: clock.now().getTime() - invokedAt,
+        };
+        return { response: integration.response, authorization, integration };
+    }
+}

package/dist/service/apigatewayv2/serve/sim-http-api-served.d.ts

@@ -0,0 +1,22 @@
+import type { SimHttpApiAuthorization } from "../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiIntegrationOutcome } from "./sim-http-api-integration-outcome.js";
+import type { SimHttpApiServing } from "./sim-http-api-serving.js";
+/**
+ * What one request through the endpoint produced, gathered as it happened so
+ * that the stage's access log can describe it afterwards.
+ *
+ * A request the stage's throttle refused has neither an authorization nor an
+ * integration, and one an authorizer refused has an authorization alone.
+ */
+export interface SimHttpApiServed {
+    readonly response: Response;
+    readonly authorization?: SimHttpApiAuthorization | undefined;
+    readonly integration?: SimHttpApiIntegrationOutcome | undefined;
+}
+/**
+ * A serving the controller has stamped with the id this request is logged and
+ * reported under, which every path below it then names.
+ */
+export interface SimHttpApiServedRequest extends SimHttpApiServing {
+    readonly requestId: string;
+}

package/dist/service/apigatewayv2/serve/sim-http-api-served.js

@@ -0,0 +1 @@
+export {};

package/dist/service/apigatewayv2/serve/sim-http-api-serving.d.ts

@@ -21,6 +21,18 @@ export interface SimHttpApiServing {
      * carrying.
      */
     readonly rawPath: string;
+    /**
+     * The id this request is logged and reported under, settled by the
+     * controller before anything runs. The resolver leaves it out, and the
+     * controller adds it to the serving it passes on.
+     */
+    readonly requestId?: string | undefined;
+    /**
+     * The API mapping base path this request matched, for a request that
+     * reached a custom domain. It is the empty string for a mapping serving the
+     * root of its domain, and absent for the generated endpoint.
+     */
+    readonly basePathMatched?: string | undefined;
 }
 /**
  * What an HTTP API endpoint decided about one request before any of it ran.

package/dist/service/apigatewayv2/serve/sim-http-api-serving.js

@@ -107,6 +107,7 @@ export class SimHttpApiServingResolver {
                 match,
                 domainName: domain.domainName,
                 rawPath: mapping.apiMappingKey.remainingPath(path),
+                basePathMatched: mapping.apiMappingKey.value,
             },
         };
     }

package/dist/service/cloudfront/controller/web-acl/sim-cf-web-acl-guard.js

@@ -39,6 +39,7 @@ export class SimCfWebAclGuard {
             webAclArn,
             request,
             body: await requestBody(request),
+            resourceType: "CLOUDFRONT",
         });
         return decision.action === "BLOCK"
             ? simWafBlockedHttpResponse(decision.blocked ?? simWafDefaultBlockedResponse())

package/dist/service/logs/group/sim-logs-arn.d.ts

@@ -33,3 +33,18 @@ export declare function simLogsAnyLogGroupArn(scope: SimAwsAccountRegionScope):
  * The ARN of a log stream inside a log group.
  */
 export declare function simLogsLogStreamArn(scope: SimAwsAccountRegionScope, logGroupName: string, logStreamName: string): string;
+/**
+ * The account, region and group name a log group ARN carries, or undefined
+ * for a string that is not one.
+ *
+ * Both forms are read. `DescribeLogGroups` reports `logGroupArn` without a
+ * trailing wildcard, while the `arn` field and CDK's `logGroup.logGroupArn`
+ * both end in `:*`, and a template naming either means the same group. A log
+ * group name cannot contain a colon, so what follows `log-group:` is the name
+ * up to an optional trailing `:*`.
+ */
+export declare function simLogsParsedLogGroupArn(arn: string): {
+    readonly accountId: string;
+    readonly regionName: string;
+    readonly logGroupName: string;
+} | undefined;

package/dist/service/logs/group/sim-logs-arn.js

@@ -42,3 +42,36 @@ export function simLogsAnyLogGroupArn(scope) {
 export function simLogsLogStreamArn(scope, logGroupName, logStreamName) {
     return `${simLogsLogGroupArn(scope, logGroupName)}:log-stream:${logStreamName}`;
 }
+/**
+ * The account, region and group name a log group ARN carries, or undefined
+ * for a string that is not one.
+ *
+ * Both forms are read. `DescribeLogGroups` reports `logGroupArn` without a
+ * trailing wildcard, while the `arn` field and CDK's `logGroup.logGroupArn`
+ * both end in `:*`, and a template naming either means the same group. A log
+ * group name cannot contain a colon, so what follows `log-group:` is the name
+ * up to an optional trailing `:*`.
+ */
+export function simLogsParsedLogGroupArn(arn) {
+    const [prefix, partition, service, region, account, resourceType, ...rest] = arn.split(":");
+    if (prefix !== "arn" ||
+        service !== "logs" ||
+        resourceType !== "log-group" ||
+        !isPresent(partition) ||
+        !isPresent(region) ||
+        !isPresent(account)) {
+        return undefined;
+    }
+    const [logGroupName, wildcard, ...extra] = rest;
+    if (logGroupName === undefined ||
+        logGroupName.length === 0 ||
+        extra.length > 0 ||
+        (wildcard !== undefined && wildcard !== "*")) {
+        return undefined;
+    }
+    return { accountId: account, regionName: region, logGroupName };
+}
+/** Whether an ARN component was written at all. */
+function isPresent(component) {
+    return component !== undefined && component.length > 0;
+}

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -58,7 +58,7 @@ export class SimWafAssociations {
         if (association === undefined) {
             return undefined;
         }
-        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body));
+        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body, association.webAcl.bodyInspectionLimitBytes(association.resourceType)));
     }
     /**
      * Forget whatever is in front of one resource.

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.js

@@ -32,6 +32,7 @@ export class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
             Rules: this.rules(),
             VisibilityConfig: this.value("VisibilityConfig"),
             CustomResponseBodies: this.value("CustomResponseBodies"),
+            AssociationConfig: this.value("AssociationConfig"),
         };
     }
     /**

package/dist/service/wafv2/command/web-acl/sim-waf-web-acl-output.js

@@ -17,5 +17,6 @@ export function simWafWebAclOutput(webAcl) {
         Rules: configuration.rules ?? [],
         VisibilityConfig: configuration.visibilityConfig,
         CustomResponseBodies: configuration.customResponseBodies,
+        AssociationConfig: configuration.associationConfig,
     };
 }

package/dist/service/wafv2/command/web-acl/sim-wafv2-unsimulated-web-acl-input.js

@@ -6,12 +6,6 @@ const refusedMembers = [
     [(input) => input.CaptchaConfig, "CaptchaConfig", tokenActions],
     [(input) => input.ChallengeConfig, "ChallengeConfig", tokenActions],
     [(input) => input.TokenDomains, "TokenDomains", tokenActions],
-    [
-        (input) => input.AssociationConfig,
-        "AssociationConfig",
-        "it sets the body size a web ACL inspects for the resources it is " +
-            "associated with, and nothing is associated with a web ACL yet",
-    ],
     [
         (input) => input.DataProtectionConfig,
         "DataProtectionConfig",

package/dist/service/wafv2/command/web-acl/sim-wafv2-web-acl-commands.js

@@ -137,5 +137,6 @@ function configurationOf(input) {
         customResponseBodies: input.CustomResponseBodies,
         visibilityConfig: input.VisibilityConfig,
         description: checkedSimWafDescription(input.Description),
+        associationConfig: input.AssociationConfig,
     };
 }

package/dist/service/wafv2/command/web-acl/web-acl.command.d.ts

@@ -1,5 +1,6 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimWafActionInput } from "../../web-acl/sim-waf-action.type.js";
+import type { SimWafAssociationConfigInput } from "../../web-acl/sim-waf-association-config.js";
 import type { SimWafCustomResponseBodies } from "../../web-acl/sim-waf-custom-response.type.js";
 import type { SimWafRuleInput } from "../../web-acl/sim-waf-rule.type.js";
 /**
@@ -27,7 +28,7 @@ export interface SimWafWebAclWriteInput {
     readonly CaptchaConfig?: unknown;
     readonly ChallengeConfig?: unknown;
     readonly TokenDomains?: readonly string[] | undefined;
-    readonly AssociationConfig?: unknown;
+    readonly AssociationConfig?: SimWafAssociationConfigInput | undefined;
     readonly DataProtectionConfig?: unknown;
     readonly OnSourceDDoSProtectionConfig?: unknown;
     readonly ApplicationConfig?: unknown;
@@ -72,6 +73,7 @@ export interface SimWafWebAclOutput {
     readonly Rules: readonly SimWafRuleInput[];
     readonly VisibilityConfig: unknown;
     readonly CustomResponseBodies: SimWafCustomResponseBodies | undefined;
+    readonly AssociationConfig: SimWafAssociationConfigInput | undefined;
 }
 export interface SimGetWebAclCommandOutput {
     readonly WebACL?: SimWafWebAclOutput | undefined;

package/dist/service/wafv2/evaluate/sim-waf-evaluation-request.d.ts

@@ -1,3 +1,4 @@
+import type { SimWafBodyInspectionResourceType } from "../web-acl/sim-waf-association-config.js";
 /**
  * What a web ACL is asked to decide about.
  */
@@ -10,4 +11,11 @@ export interface SimWafEvaluationRequest {
      * stream that cannot be read twice, so it is passed in already buffered.
      */
     readonly body?: Uint8Array | undefined;
+    /**
+     * The type of resource the request reached, when it reached one.
+     *
+     * Only the body inspection limit reads it, and a web ACL evaluated on its
+     * own reads the default limit for every resource type.
+     */
+    readonly resourceType?: SimWafBodyInspectionResourceType | undefined;
 }

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.d.ts

@@ -22,6 +22,15 @@ export interface SimWafInspectedRequest {
     readonly host: string;
     /** The request body, or nothing when the request carried none. */
     readonly body: Uint8Array | undefined;
+    /**
+     * How many bytes of the body a rule inspecting it reads.
+     *
+     * This travels with the request because it belongs to the resource the
+     * request reached rather than to the rule. A rule is compiled once, when the
+     * web ACL is written, and the same compiled rule then runs in front of a
+     * distribution and a REST API stage with a different limit for each.
+     */
+    readonly bodyInspectionLimitBytes: number;
     /** The labels the rules that have run so far added to this request. */
     readonly labels: SimWafRequestLabels;
 }
@@ -36,5 +45,9 @@ export interface SimWafInspectedRequest {
  * simulated endpoint is served under `*.sim-aws.localhost`, and a rule reading
  * the raw Host header would see that suffix on every request that reached
  * anything at all.
+ *
+ * The body inspection limit defaults to the 16 KB every resource type this
+ * simulation protects reads by default. A web ACL raising it with
+ * `AssociationConfig` passes the raised figure in.
  */
-export declare function simWafInspectedRequest(request: Request, body?: Uint8Array): SimWafInspectedRequest;
+export declare function simWafInspectedRequest(request: Request, body?: Uint8Array, bodyInspectionLimitBytes?: number): SimWafInspectedRequest;

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.js

@@ -1,4 +1,5 @@
 import { simAwsRequestHostname } from "../../../serve/http/url/sim-aws-request-hostname.js";
+import { simWafBodyInspectionLimitBytes } from "../web-acl/sim-waf-association-config.js";
 import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
 /**
  * Read the parts of an HTTP request that a web ACL inspects.
@@ -11,8 +12,12 @@ import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
  * simulated endpoint is served under `*.sim-aws.localhost`, and a rule reading
  * the raw Host header would see that suffix on every request that reached
  * anything at all.
+ *
+ * The body inspection limit defaults to the 16 KB every resource type this
+ * simulation protects reads by default. A web ACL raising it with
+ * `AssociationConfig` passes the raised figure in.
  */
-export function simWafInspectedRequest(request, body) {
+export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes = simWafBodyInspectionLimitBytes) {
     const url = new URL(request.url);
     return {
         method: request.method,
@@ -24,6 +29,7 @@ export function simWafInspectedRequest(request, body) {
         headers: request.headers,
         host: simAwsRequestHostname(request),
         body,
+        bodyInspectionLimitBytes,
         labels: new SimWafRequestLabels(),
     };
 }

package/dist/service/wafv2/index.d.ts

@@ -29,7 +29,8 @@ export type { SimWafManagedRuleTier } from "./managed/sim-waf-managed-rule.type.
 export type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput, SimWafRuleActionOverrideInput, } from "./managed/sim-waf-managed-group.type.js";
 export { simWafBlockedHttpResponse, type SimWafBlockedResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { type SimWafInspectedRequest, simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
-export { simWafInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { type SimWafAssociationConfigInput, type SimWafBodyInspectionResourceType, simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export type { SimWafRateBasedStatementInput } from "./statement/sim-waf-rate-based.type.js";
 export type { SimWafStatementInput } from "./statement/sim-waf-statement.type.js";
 export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, type SimWafErrorMetadata, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";

package/dist/service/wafv2/index.js

@@ -19,5 +19,6 @@ export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
 export { SimWafManagedRules, } from "./managed/sim-waf-managed-rules.js";
 export { simWafBlockedHttpResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
-export { simWafInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
+export { simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";

package/dist/service/wafv2/managed/sim-waf-managed-request.js

@@ -1,4 +1,3 @@
-import { simWafInspectionLimitBytes } from "../statement/sim-waf-field-content.js";
 import { simWafQueryArguments } from "../statement/sim-waf-request-fields.js";
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
@@ -22,7 +21,7 @@ export function simWafManagedRequestParts(request) {
         headerValues: [...request.headers].map(([, value]) => value),
         userAgent: request.headers.get("user-agent") ?? undefined,
         cookieHeader,
-        body: decoder.decode(body.subarray(0, simWafInspectionLimitBytes)),
+        body: decoder.decode(body.subarray(0, request.bodyInspectionLimitBytes)),
         uriPathBytes: simWafByteLength(request.uriPath),
         queryStringBytes: simWafByteLength(request.queryString),
         cookieHeaderBytes: simWafByteLength(cookieHeader),

package/dist/service/wafv2/sim-wafv2.js

@@ -89,7 +89,8 @@ export class SimWafV2 extends SimWafSets {
             throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource ` +
                 `doesn't exist: web ACL ${evaluation.webAclArn}.`);
         }
-        return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body));
+        const limitBytes = webAcl.bodyInspectionLimitBytes(evaluation.resourceType);
+        return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body, limitBytes));
     }
     /**
      * What the AWS managed rule groups do here, and what a test declares of

package/dist/service/wafv2/statement/sim-waf-field-content.d.ts

@@ -15,13 +15,13 @@ export type SimWafFieldContent = {
     readonly outcome: "noMatch";
 };
 /**
- * How much of a request body, header set or cookie set WAF reads.
+ * How much of a header set or a cookie set WAF reads.
  *
- * Real WAF stops at 8 KB for a web ACL as it is created here. A CloudFront
- * association can raise the body limit, which is settled where associations
- * are, so this is the one figure until then.
+ * Real WAF stops at 8 KB and 200 entries for both, whatever the web ACL is in
+ * front of. A body is the component whose limit varies by resource type, and
+ * `simWafBodyInspectionLimitBytes` carries that one.
  */
-export declare const simWafInspectionLimitBytes = 8192;
+export declare const simWafHeaderInspectionLimitBytes = 8192;
 /**
  * What a rule does about content too large for WAF to read.
  */
@@ -37,5 +37,8 @@ export declare function requiredSimWafOversizeHandling(handling: string | undefi
  * settle the statement without looking, and `CONTINUE` inspects as much as WAF
  * would have read: whole entries while they fit, and the first entry cut to
  * the limit when even one does not.
+ *
+ * The limit is passed in because a body's varies with the resource type the
+ * request reached, while a header set and a cookie set are always 8 KB.
  */
-export declare function simWafFieldContent(candidates: readonly string[], oversizeHandling: SimWafOversizeHandling): SimWafFieldContent;
+export declare function simWafFieldContent(candidates: readonly string[], oversizeHandling: SimWafOversizeHandling, limitBytes: number): SimWafFieldContent;

package/dist/service/wafv2/statement/sim-waf-field-content.js

@@ -1,12 +1,12 @@
 import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
 /**
- * How much of a request body, header set or cookie set WAF reads.
+ * How much of a header set or a cookie set WAF reads.
  *
- * Real WAF stops at 8 KB for a web ACL as it is created here. A CloudFront
- * association can raise the body limit, which is settled where associations
- * are, so this is the one figure until then.
+ * Real WAF stops at 8 KB and 200 entries for both, whatever the web ACL is in
+ * front of. A body is the component whose limit varies by resource type, and
+ * `simWafBodyInspectionLimitBytes` carries that one.
  */
-export const simWafInspectionLimitBytes = 8192;
+export const simWafHeaderInspectionLimitBytes = 8192;
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
 /**
@@ -26,24 +26,30 @@ export function requiredSimWafOversizeHandling(handling, ruleName) {
  * settle the statement without looking, and `CONTINUE` inspects as much as WAF
  * would have read: whole entries while they fit, and the first entry cut to
  * the limit when even one does not.
+ *
+ * The limit is passed in because a body's varies with the resource type the
+ * request reached, while a header set and a cookie set are always 8 KB.
  */
-export function simWafFieldContent(candidates, oversizeHandling) {
+export function simWafFieldContent(candidates, oversizeHandling, limitBytes) {
     const encoded = candidates.map((candidate) => encoder.encode(candidate));
     const total = encoded.reduce((sum, bytes) => sum + bytes.length, 0);
-    if (total <= simWafInspectionLimitBytes) {
+    if (total <= limitBytes) {
         return { outcome: "inspect", candidates };
     }
     if (oversizeHandling !== "CONTINUE") {
         return { outcome: oversizeHandling === "MATCH" ? "match" : "noMatch" };
     }
-    return { outcome: "inspect", candidates: readWithinLimit(encoded) };
+    return {
+        outcome: "inspect",
+        candidates: readWithinLimit(encoded, limitBytes),
+    };
 }
 /**
  * The content WAF would have read before it stopped.
  */
-function readWithinLimit(encoded) {
+function readWithinLimit(encoded, limitBytes) {
     const read = [];
-    let budget = simWafInspectionLimitBytes;
+    let budget = limitBytes;
     for (const bytes of encoded) {
         if (budget === 0) {
             break;

package/dist/service/wafv2/statement/sim-waf-set-field.js

@@ -1,4 +1,4 @@
-import { requiredSimWafOversizeHandling, simWafFieldContent, } from "./sim-waf-field-content.js";
+import { requiredSimWafOversizeHandling, simWafFieldContent, simWafHeaderInspectionLimitBytes, } from "./sim-waf-field-content.js";
 import { requiredSimWafPatternSelection } from "./sim-waf-match-pattern.js";
 import { requiredSimWafMatchScope, simWafCookies, simWafHeaderEntries, simWafPatternCandidates, } from "./sim-waf-request-fields.js";
 import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
@@ -22,7 +22,7 @@ export function compileSimWafSetField(field, ruleName) {
         invalidSimWafRule(ruleName, "FieldToMatch names no field to match on");
     }
     const oversize = requiredSimWafOversizeHandling(field.Body.OversizeHandling, ruleName);
-    return (request) => simWafFieldContent(request.body === undefined ? [] : [decoder.decode(request.body)], oversize);
+    return (request) => simWafFieldContent(request.body === undefined ? [] : [decoder.decode(request.body)], oversize, request.bodyInspectionLimitBytes);
 }
 function entriesReader(input, ruleName, entries) {
     const matchScope = requiredSimWafMatchScope(input.MatchScope, ruleName);
@@ -32,5 +32,5 @@ function entriesReader(input, ruleName, entries) {
         entries: entries(request),
         selection,
         matchScope,
-    }), oversize);
+    }), oversize, simWafHeaderInspectionLimitBytes);
 }

package/dist/service/wafv2/web-acl/sim-waf-association-config.d.ts

@@ -0,0 +1,54 @@
+/**
+ * A resource type whose body inspection limit a web ACL can set.
+ *
+ * Real WAF keys `AssociationConfig.RequestBody` by resource type, and these
+ * three are the ones a web ACL goes in front of here. `APP_RUNNER_SERVICE` and
+ * `VERIFIED_ACCESS_INSTANCE` are keys AWS takes for resources this simulation
+ * has no association for.
+ */
+export type SimWafBodyInspectionResourceType = "CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL";
+/**
+ * How much of a request body WAF reads for a resource type given no
+ * `AssociationConfig`.
+ *
+ * CloudFront, API Gateway and Cognito all default to 16 KB. A load balancer
+ * and an AppSync API are fixed at 8 KB, and a web ACL cannot be put in front
+ * of either one here.
+ */
+export declare const simWafBodyInspectionLimitBytes = 16384;
+/**
+ * One resource type's entry under `AssociationConfig.RequestBody`.
+ */
+export interface SimWafRequestBodyConfigInput {
+    readonly DefaultSizeInspectionLimit?: string | undefined;
+}
+/**
+ * The `AssociationConfig` a web ACL is written with.
+ */
+export interface SimWafAssociationConfigInput {
+    readonly RequestBody?: Readonly<Record<string, SimWafRequestBodyConfigInput | undefined>> | undefined;
+}
+/**
+ * How much of a request body a web ACL's rules read, by resource type.
+ *
+ * A web ACL holds one of these whether or not it was written with an
+ * `AssociationConfig`, and a resource type the config left out reads the
+ * default 16 KB.
+ */
+export declare class SimWafBodyInspectionLimits {
+    private readonly limits;
+    private constructor();
+    /**
+     * Read the limits an `AssociationConfig` sets, refusing anything WAF would
+     * refuse and anything this simulation cannot apply.
+     */
+    static read(input: SimWafAssociationConfigInput | undefined): SimWafBodyInspectionLimits;
+    /**
+     * How many bytes of a body a request reaching one resource type is inspected
+     * for.
+     *
+     * A request evaluated against a web ACL that no resource holds names no
+     * resource type, and reads the default.
+     */
+    bytesFor(resourceType: SimWafBodyInspectionResourceType | undefined): number;
+}