@kensio/yulin 1.21.12 → 1.21.13

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.d.ts

@@ -29,7 +29,7 @@ export declare class SimDynamoDbAuthorizer {
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorizeTable(action: string, tableName: string, caller?: SimAwsCaller): SimAwsResolvedCaller;
+    authorizeTable(action: string, tableName: string, caller?: SimAwsCaller, leadingKeys?: readonly string[]): SimAwsResolvedCaller;
     /**
      * Ensure the caller may perform an action on a table's stream.
      *

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -1,5 +1,19 @@
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
 import { simDynamoDbTableArn } from "../../table/sim-dynamodb-table-arn.js";
+import { simDynamoDbLeadingKeysConditionKey } from "./sim-dynamodb-leading-keys.js";
+/**
+ * The condition values a request carries for the table it names.
+ *
+ * A request reaching no partition key value supplies none rather than an empty
+ * list, leaving the key absent from the context as it is on AWS for an
+ * operation that names no item.
+ */
+function conditionContextOf(leadingKeys) {
+    if (leadingKeys === undefined || leadingKeys.length === 0) {
+        return {};
+    }
+    return { [simDynamoDbLeadingKeysConditionKey]: leadingKeys };
+}
 /**
  * Applies simulated IAM authorization to DynamoDB requests.
  *
@@ -26,8 +40,8 @@ export class SimDynamoDbAuthorizer {
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
      */
-    authorizeTable(action, tableName, caller) {
-        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller);
+    authorizeTable(action, tableName, caller, leadingKeys) {
+        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller, leadingKeys);
     }
     /**
      * Ensure the caller may perform an action on a table's stream.
@@ -51,8 +65,13 @@ export class SimDynamoDbAuthorizer {
     authorizeAnyTable(action, caller) {
         return this.authorizeResource(action, "*", caller);
     }
-    authorizeResource(action, resource, caller) {
-        const decision = this.iam.authorize({ action, resource, caller });
+    authorizeResource(action, resource, caller, leadingKeys) {
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller,
+            conditionContext: conditionContextOf(leadingKeys),
+        });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,

package/dist/service/dynamodb/command/authorize/sim-dynamodb-leading-keys.d.ts

@@ -0,0 +1,33 @@
+import type { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
+import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
+import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
+/**
+ * The condition key DynamoDB names a request's partition key values by.
+ */
+export declare const simDynamoDbLeadingKeysConditionKey = "dynamodb:LeadingKeys";
+/**
+ * The partition key values one request reaches in one table.
+ *
+ * Which attribute holds the partition key is the table's to say, so a command
+ * hands over how to read the values rather than the values themselves. The
+ * table is found before the caller is authorized against it, and the values
+ * are read from it in between.
+ */
+export type SimDynamoDbLeadingKeys = (table: SimDynamoDbTable) => readonly string[];
+/**
+ * Read the partition key values a run of items or keys carries.
+ *
+ * The items are read when authorization asks for them rather than at the call
+ * site, which is what keeps a request DynamoDB would refuse being refused
+ * after the caller has been authorized rather than before.
+ *
+ * An item with no readable partition key value is left out.
+ */
+export declare function simDynamoDbLeadingKeysOf(items: () => readonly SimDynamoDbItem[]): SimDynamoDbLeadingKeys;
+/**
+ * Read the one partition key value a key condition names.
+ *
+ * The value is already held against the key schema of what is being read, so
+ * the table says nothing more about it here.
+ */
+export declare function simDynamoDbLeadingKeyOf(value: SimDynamoDbValue): readonly string[];

package/dist/service/dynamodb/command/authorize/sim-dynamodb-leading-keys.js

@@ -0,0 +1,45 @@
+/**
+ * The condition key DynamoDB names a request's partition key values by.
+ */
+export const simDynamoDbLeadingKeysConditionKey = "dynamodb:LeadingKeys";
+/**
+ * Write one partition key value the way an IAM policy condition holds it.
+ *
+ * A policy condition value is a string. A string key is its text and a number
+ * key is its digits. Binary has no form documented for the condition key, and
+ * a request carrying a binary partition key leaves the value out rather than
+ * inventing an encoding for it.
+ */
+function leadingKeyText(value) {
+    if (value?.kind === "S") {
+        return value.text;
+    }
+    if (value?.kind === "N") {
+        return value.number.text;
+    }
+    return undefined;
+}
+/**
+ * Read the partition key values a run of items or keys carries.
+ *
+ * The items are read when authorization asks for them rather than at the call
+ * site, which is what keeps a request DynamoDB would refuse being refused
+ * after the caller has been authorized rather than before.
+ *
+ * An item with no readable partition key value is left out.
+ */
+export function simDynamoDbLeadingKeysOf(items) {
+    return (table) => items()
+        .map((item) => leadingKeyText(item.attribute(table.keySchema.hashKeyAttributeName)))
+        .filter((text) => text !== undefined);
+}
+/**
+ * Read the one partition key value a key condition names.
+ *
+ * The value is already held against the key schema of what is being read, so
+ * the table says nothing more about it here.
+ */
+export function simDynamoDbLeadingKeyOf(value) {
+    const text = leadingKeyText(value);
+    return text === undefined ? [] : [text];
+}

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-get-item.js

@@ -2,6 +2,7 @@ import { readSimDynamoDbBatchReads, } from "./sim-dynamodb-batch-reads.js";
 import { assertDistinctBatchItems } from "./sim-dynamodb-batch-request-items.js";
 import { reachSimDynamoDbBatchTables, } from "./sim-dynamodb-batch-tables.js";
 import { refuseUnsimulatedBatchReadInput } from "./sim-dynamodb-unsimulated-batch-input.js";
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
 /**
  * The BatchGetItem command.
  *
@@ -27,6 +28,7 @@ export class SimDynamoDbBatchGetItem {
             access: this.access,
             operation: "BatchGetItem",
             caller: options?.caller,
+            leadingKeys: (entry) => simDynamoDbLeadingKeysOf(() => entry.keys),
         });
         const responses = Object.fromEntries(reached.map((entry) => [entry.requested.reference, readItems(entry)]));
         // Nothing here throttles or stops at a response size, so no key is ever

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-tables.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimDynamoDbTableAccess } from "../table/sim-dynamodb-table-access.js";
+import type { SimDynamoDbLeadingKeys } from "../authorize/sim-dynamodb-leading-keys.js";
 /**
  * What one table of a batch asks for, against the table it names.
  */
@@ -8,10 +9,17 @@ export interface SimDynamoDbBatchTable<Requested> {
     readonly table: SimDynamoDbTable;
     readonly requested: Requested;
 }
-interface SimDynamoDbBatchReach {
+interface SimDynamoDbBatchReach<Requested> {
     readonly access: SimDynamoDbTableAccess;
     readonly operation: string;
     readonly caller: SimAwsCaller | undefined;
+    /**
+     * How to read the partition key values one table of the batch is asked for.
+     *
+     * Each table is authorized on its own, so each carries the keys the batch
+     * names in that table and no others.
+     */
+    readonly leadingKeys: (requested: Requested) => SimDynamoDbLeadingKeys;
 }
 /**
  * Reach every table a batch names, authorizing the caller against each.
@@ -24,5 +32,5 @@ interface SimDynamoDbBatchReach {
  */
 export declare function reachSimDynamoDbBatchTables<Requested extends {
     readonly reference: string;
-}>(requested: readonly Requested[], reach: SimDynamoDbBatchReach): readonly SimDynamoDbBatchTable<Requested>[];
+}>(requested: readonly Requested[], reach: SimDynamoDbBatchReach<Requested>): readonly SimDynamoDbBatchTable<Requested>[];
 export {};

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-tables.js

@@ -11,7 +11,7 @@ import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
 export function reachSimDynamoDbBatchTables(requested, reach) {
     const action = `dynamodb:${reach.operation}`;
     const reached = requested.map((entry) => ({
-        table: reach.access.required(action, entry.reference, reach.caller),
+        table: reach.access.required(action, entry.reference, reach.caller, reach.leadingKeys(entry)),
         requested: entry,
     }));
     assertDistinctTables(reached, reach.operation);

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-write-item.js

@@ -2,6 +2,7 @@ import { assertDistinctBatchItems } from "./sim-dynamodb-batch-request-items.js"
 import { reachSimDynamoDbBatchTables } from "./sim-dynamodb-batch-tables.js";
 import { readSimDynamoDbBatchWrites } from "./sim-dynamodb-batch-writes.js";
 import { refuseUnsimulatedBatchWriteInput } from "./sim-dynamodb-unsimulated-batch-input.js";
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
 const operation = "BatchWriteItem";
 /**
  * The BatchWriteItem command.
@@ -25,7 +26,12 @@ export class SimDynamoDbBatchWriteItem {
     handle(command, options) {
         const input = command.input;
         refuseUnsimulatedBatchWriteInput(input);
-        const reached = reachSimDynamoDbBatchTables(readSimDynamoDbBatchWrites(input.RequestItems), { access: this.access, operation, caller: options?.caller });
+        const reached = reachSimDynamoDbBatchTables(readSimDynamoDbBatchWrites(input.RequestItems), {
+            access: this.access,
+            operation,
+            caller: options?.caller,
+            leadingKeys: (entry) => simDynamoDbLeadingKeysOf(() => entry.writes.map((write) => write.names)),
+        });
         // Marshalling every key checks it against the table's key schema, and is
         // what tells two operations on one item apart. Every table is checked
         // before any of them is written to.

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-write.d.ts

@@ -1,3 +1,4 @@
+import { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
 import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimDynamoDbWriteRequest } from "./batch.command.js";
 /**
@@ -8,6 +9,11 @@ import type { SimDynamoDbWriteRequest } from "./batch.command.js";
  * before it applies anything, since the check and the write read the same item.
  */
 export interface SimDynamoDbBatchWrite {
+    /**
+     * The item or key this write names, which is where a policy condition reads
+     * its partition key value from.
+     */
+    readonly names: SimDynamoDbItem;
     /**
      * The primary key this write works on, as the table marshals it.
      */

package/dist/service/dynamodb/command/batch/sim-dynamodb-batch-write.js

@@ -5,15 +5,15 @@ import { readSimDynamoDbKey } from "../item/sim-dynamodb-key-input.js";
  * A put in a batch write, which replaces the whole item as PutItem does.
  */
 class SimDynamoDbBatchPut {
-    item;
+    names;
     constructor(item) {
-        this.item = item;
+        this.names = item;
     }
     keyIn(table) {
-        return table.keyOfItem(this.item);
+        return table.keyOfItem(this.names);
     }
     applyTo(table) {
-        table.putItem(this.item);
+        table.putItem(this.names);
     }
 }
 /**
@@ -21,15 +21,15 @@ class SimDynamoDbBatchPut {
  * that is already free is deleted successfully.
  */
 class SimDynamoDbBatchDelete {
-    key;
+    names;
     constructor(key) {
-        this.key = key;
+        this.names = key;
     }
     keyIn(table) {
-        return table.keyOfKey(this.key);
+        return table.keyOfKey(this.names);
     }
     applyTo(table) {
-        table.deleteItem(this.key);
+        table.deleteItem(this.names);
     }
 }
 /**

package/dist/service/dynamodb/command/item/sim-dynamodb-delete-item.js

@@ -1,3 +1,4 @@
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
@@ -26,7 +27,7 @@ export class SimDynamoDbDeleteItem {
         // The condition is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
         const check = SimDynamoDbConditionCheck.read(input, "DeleteItem");
-        const table = this.access.required("dynamodb:DeleteItem", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:DeleteItem", input.TableName, options?.caller, simDynamoDbLeadingKeysOf(() => [readSimDynamoDbKey(input.Key)]));
         const asked = SimDynamoDbReturnValues.read(input.ReturnValues, "DeleteItem");
         const key = readSimDynamoDbKey(input.Key);
         check.assertHoldsFor(table.getItem(key));

package/dist/service/dynamodb/command/item/sim-dynamodb-get-item.js

@@ -1,3 +1,4 @@
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { refuseUnsimulatedItemReadInput } from "./sim-dynamodb-unsimulated-item-read-input.js";
 import { readSimDynamoDbProjection } from "../../expression/projection/sim-dynamodb-projection-expression.js";
@@ -26,7 +27,7 @@ export class SimDynamoDbGetItem {
         // The projection is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
         const projection = readSimDynamoDbProjection(input);
-        const table = this.access.required("dynamodb:GetItem", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:GetItem", input.TableName, options?.caller, simDynamoDbLeadingKeysOf(() => [readSimDynamoDbKey(input.Key)]));
         const found = table.getItem(readSimDynamoDbKey(input.Key));
         if (found === undefined) {
             return { $metadata: {} };

package/dist/service/dynamodb/command/item/sim-dynamodb-put-item.js

@@ -1,5 +1,6 @@
 import { SimDynamoDbValidationException } from "../../error/dynamodb.error.js";
 import { SimDynamoDbItem } from "../../item/sim-dynamodb-item.js";
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
 import { SimDynamoDbConditionCheck } from "./sim-dynamodb-condition-check.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
 import { refuseUnsimulatedItemWriteInput } from "./sim-dynamodb-unsimulated-item-write-input.js";
@@ -36,7 +37,7 @@ export class SimDynamoDbPutItem {
         // The condition is read before the table is reached, so an expression
         // DynamoDB would refuse is refused whether or not the key holds anything.
         const check = SimDynamoDbConditionCheck.read(input, "PutItem");
-        const table = this.access.required("dynamodb:PutItem", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:PutItem", input.TableName, options?.caller, simDynamoDbLeadingKeysOf(() => [readItem(input)]));
         const asked = SimDynamoDbReturnValues.read(input.ReturnValues, "PutItem");
         const item = readItem(input);
         check.assertHoldsFor(table.itemUnder(item));

package/dist/service/dynamodb/command/item/sim-dynamodb-update-item.js

@@ -1,3 +1,4 @@
+import { simDynamoDbLeadingKeysOf } from "../authorize/sim-dynamodb-leading-keys.js";
 import { readSimDynamoDbKey } from "./sim-dynamodb-key-input.js";
 import { SimDynamoDbReturnValues } from "./sim-dynamodb-return-values.js";
 import { refuseUnsimulatedItemUpdateInput } from "./sim-dynamodb-unsimulated-item-update-input.js";
@@ -28,7 +29,7 @@ export class SimDynamoDbUpdateItem {
         // The expressions are read before the table is reached, so one DynamoDB
         // would refuse is refused whether or not the key holds anything.
         const plan = SimDynamoDbUpdatePlan.read(input, "UpdateItem");
-        const table = this.access.required("dynamodb:UpdateItem", input.TableName, options?.caller);
+        const table = this.access.required("dynamodb:UpdateItem", input.TableName, options?.caller, simDynamoDbLeadingKeysOf(() => [readSimDynamoDbKey(input.Key)]));
         const asked = SimDynamoDbReturnValues.readForUpdate(input.ReturnValues, "UpdateItem");
         const key = readSimDynamoDbKey(input.Key);
         const existing = table.getItem(key);

package/dist/service/dynamodb/command/query/sim-dynamodb-query.js

@@ -2,6 +2,7 @@ import { SimDynamoDbItemPage } from "../item/sim-dynamodb-item-page.js";
 import { SimDynamoDbReadAnswer } from "../read/sim-dynamodb-read-answer.js";
 import { assertSimDynamoDbConsistentReadAnswerable } from "../read/sim-dynamodb-consistent-read.js";
 import { SimDynamoDbSelect } from "../read/sim-dynamodb-select.js";
+import { simDynamoDbLeadingKeyOf } from "../authorize/sim-dynamodb-leading-keys.js";
 import { readSimDynamoDbQueryExpressions } from "./sim-dynamodb-query-expressions.js";
 import { refuseSimDynamoDbQuerySegment } from "./sim-dynamodb-query-segment.js";
 import { readSimDynamoDbQueryStartKey } from "./sim-dynamodb-query-start-key.js";
@@ -30,7 +31,11 @@ export class SimDynamoDbQuery {
         refuseUnsimulatedQueryInput(input);
         refuseSimDynamoDbQuerySegment(input);
         const expressions = readSimDynamoDbQueryExpressions(input);
-        const table = this.access.required("dynamodb:Query", input.TableName, options?.caller);
+        // The one partition key the query reads is what authorization needs, and
+        // reading it needs the view rather than the table, so it is read again
+        // here against whichever of the two the request names.
+        const table = this.access.required("dynamodb:Query", input.TableName, options?.caller, (reached) => simDynamoDbLeadingKeyOf(expressions.terms.forTable(reached.view(input.IndexName))
+            .partitionKeyValue));
         // What is being read is settled here: the table, or one of its indexes. An
         // IndexName the table does not have is refused rather than read as the
         // table. Everything after this asks the view rather than the table, so a

package/dist/service/dynamodb/command/table/sim-dynamodb-table-access.d.ts

@@ -4,6 +4,7 @@ import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
 import type { SimDynamoDbTableName } from "../../table/sim-dynamodb-table-name.js";
 import type { SimDynamoDbTableStore } from "../../table/sim-dynamodb-table-store.js";
 import type { SimDynamoDbAuthorizer } from "../authorize/sim-dynamodb-authorizer.js";
+import type { SimDynamoDbLeadingKeys } from "../authorize/sim-dynamodb-leading-keys.js";
 interface SimDynamoDbTableAccessProperties {
     readonly tables: SimDynamoDbTableStore;
     readonly authorizer: SimDynamoDbAuthorizer;
@@ -14,9 +15,14 @@ interface SimDynamoDbTableAccessProperties {
  *
  * Every table command goes through the same two steps in the same order: read
  * the name or ARN the request carries, then authorize the caller against it
- * before anything looks the table up. Keeping them here is what makes that
- * order the same for all of them, so no command can accidentally tell an
- * unauthorized caller which table names are taken.
+ * before the command is told whether the table is there. Keeping them here is
+ * what makes that order the same for all of them, so no command can
+ * accidentally tell an unauthorized caller which table names are taken.
+ *
+ * A command reaching particular items hands over how to read their partition
+ * key values, which authorization needs the table to read. The table is found
+ * first for that, and a caller refused against a table that is not there still
+ * hears AccessDenied rather than a missing table.
  */
 export declare class SimDynamoDbTableAccess {
     private readonly tables;
@@ -28,13 +34,17 @@ export declare class SimDynamoDbTableAccess {
      */
     reference(tableName: string | undefined): SimDynamoDbTableName;
     /**
-     * Find the table a request names, refusing the caller before looking it up.
+     * Find the table a request names, refusing the caller before answering.
      */
-    required(action: string, tableName: string | undefined, caller: SimAwsCaller | undefined): SimDynamoDbTable;
+    required(action: string, tableName: string | undefined, caller: SimAwsCaller | undefined, leadingKeys?: SimDynamoDbLeadingKeys): SimDynamoDbTable;
     /**
      * Find a table by a name that has already been read.
+     *
+     * A caller with no permission hears AccessDenied whether or not the table is
+     * there, which keeps an unauthorized caller from finding out which table
+     * names are taken.
      */
-    requiredByName(action: string, name: SimDynamoDbTableName, caller: SimAwsCaller | undefined): SimDynamoDbTable;
+    requiredByName(action: string, name: SimDynamoDbTableName, caller: SimAwsCaller | undefined, leadingKeys?: SimDynamoDbLeadingKeys): SimDynamoDbTable;
     /**
      * Ensure the caller may perform an action that names no particular table.
      */

package/dist/service/dynamodb/command/table/sim-dynamodb-table-access.js

@@ -1,13 +1,35 @@
 import { SimDynamoDbResourceNotFoundException } from "../../error/dynamodb.error.js";
 import { readSimDynamoDbTableReference } from "../../table/sim-dynamodb-table-reference.js";
+/**
+ * Read the partition key values a request reaches, or none where they cannot
+ * be read.
+ *
+ * Authorization runs ahead of the checks a command makes on what it was given,
+ * as it does on AWS. A request whose key or key condition is malformed is
+ * authorized carrying no values and refused by the check that follows, so
+ * whatever reading them throws is dropped here.
+ */
+function readLeadingKeys(leadingKeys, table) {
+    try {
+        return leadingKeys?.(table);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * How a command reaches the table a request names.
  *
  * Every table command goes through the same two steps in the same order: read
  * the name or ARN the request carries, then authorize the caller against it
- * before anything looks the table up. Keeping them here is what makes that
- * order the same for all of them, so no command can accidentally tell an
- * unauthorized caller which table names are taken.
+ * before the command is told whether the table is there. Keeping them here is
+ * what makes that order the same for all of them, so no command can
+ * accidentally tell an unauthorized caller which table names are taken.
+ *
+ * A command reaching particular items hands over how to read their partition
+ * key values, which authorization needs the table to read. The table is found
+ * first for that, and a caller refused against a table that is not there still
+ * hears AccessDenied rather than a missing table.
  */
 export class SimDynamoDbTableAccess {
     tables;
@@ -25,17 +47,21 @@ export class SimDynamoDbTableAccess {
         return readSimDynamoDbTableReference(tableName, this.accountRegionScope);
     }
     /**
-     * Find the table a request names, refusing the caller before looking it up.
+     * Find the table a request names, refusing the caller before answering.
      */
-    required(action, tableName, caller) {
-        return this.requiredByName(action, this.reference(tableName), caller);
+    required(action, tableName, caller, leadingKeys) {
+        return this.requiredByName(action, this.reference(tableName), caller, leadingKeys);
     }
     /**
      * Find a table by a name that has already been read.
+     *
+     * A caller with no permission hears AccessDenied whether or not the table is
+     * there, which keeps an unauthorized caller from finding out which table
+     * names are taken.
      */
-    requiredByName(action, name, caller) {
-        this.authorizer.authorizeTable(action, name.value, caller);
+    requiredByName(action, name, caller, leadingKeys) {
         const table = this.tables.find(name);
+        this.authorizer.authorizeTable(action, name.value, caller, table === undefined ? undefined : readLeadingKeys(leadingKeys, table));
         if (table === undefined) {
             throw new SimDynamoDbResourceNotFoundException(`No DynamoDB Table named ${name.value}`);
         }

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator.d.ts

@@ -15,7 +15,10 @@ export interface SimIamConditionOperator {
      * there is none for the policy value to equal.
      *
      * A `ForAnyValue` operator answers false whatever it wraps, because no
-     * request value is there to satisfy it. AWS documents both rules.
+     * request value is there to satisfy it. A `ForAllValues` operator answers
+     * true, because every value the request carries matches vacuously. AWS
+     * documents all three rules, and warns that the `ForAllValues` rule leaves
+     * an `Allow` overly permissive without a `Null` guard beside it.
      */
     readonly matchesAbsentKey: boolean;
     /**

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-condition-operator.d.ts

@@ -2,9 +2,13 @@ import type { SimIamConditionValue } from "../../../../../policy/sim-iam-policy.
 import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.js";
 /**
  * Base for `ForAllValues` IAM string operators.
+ *
+ * An absent context key matches. AWS answers true where the request carries
+ * no value for the key. A `ForAllValues` `Allow` therefore needs a `Null`
+ * guard beside it to stay tight.
  */
 export declare abstract class SimIamForAllValuesStringConditionOperator implements SimIamConditionOperator {
-    readonly matchesAbsentKey = false;
+    readonly matchesAbsentKey = true;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-condition-operator.js

@@ -1,9 +1,13 @@
 import { simIamStringValues } from "../sim-iam-string-values.js";
 /**
  * Base for `ForAllValues` IAM string operators.
+ *
+ * An absent context key matches. AWS answers true where the request carries
+ * no value for the key. A `ForAllValues` `Allow` therefore needs a `Null`
+ * guard beside it to stay tight.
  */
 export class SimIamForAllValuesStringConditionOperator {
-    matchesAbsentKey = false;
+    matchesAbsentKey = true;
     /**
      * Check whether a given value matches the expected value.
      */

package/docs/services/dynamodb/README.md

@@ -3637,6 +3637,101 @@ unauthorized caller cannot find out which names are taken.
 in the same way, each against the `dynamodb:` action of its own name. `ListTables` names no table.
 It authorizes against `*`.
 
+### Fine-grained access control with dynamodb:LeadingKeys
+
+`GetItem`, `BatchGetItem`, `Query`, `PutItem`, `UpdateItem`, `DeleteItem` and `BatchWriteItem`
+supply the partition key values they reach as `dynamodb:LeadingKeys`. A policy conditioned on that
+key restricts a caller to the items under particular partition keys. AWS scopes one user of a
+shared table to their own rows this way.
+
+The condition takes the `ForAllValues:` qualifier, as AWS requires for this key. Every partition key
+value the request reaches has to match. A batch or a write naming one item outside the allowed set
+is refused whole, and nothing it asked for is applied.
+
+```typescript sim-dynamodb-leading-keys
+import { CreateTableCommand, PutItemCommand } from "@aws-sdk/client-dynamodb";
+import { CreateRoleCommand, PutRolePolicyCommand } from "@aws-sdk/client-iam";
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws();
+const accountId = simAws.defaultAccountId;
+const region = simAws.defaultRegionName;
+
+await simAws.dynamoDb().createTable(
+  new CreateTableCommand({
+    TableName: "OrdersTable",
+    KeySchema: [{ AttributeName: "customerId", KeyType: "HASH" }],
+    AttributeDefinitions: [{ AttributeName: "customerId", AttributeType: "S" }],
+    BillingMode: "PAY_PER_REQUEST",
+  }),
+);
+
+const roleCreation = await simAws.iam().createRole(
+  new CreateRoleCommand({
+    RoleName: "CustomerRole",
+    AssumeRolePolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: {
+        Effect: "Allow",
+        Principal: { AWS: `arn:aws:iam::${accountId}:root` },
+        Action: "sts:AssumeRole",
+      },
+    }),
+  }),
+);
+
+await simAws.iam().putRolePolicy(
+  new PutRolePolicyCommand({
+    RoleName: "CustomerRole",
+    PolicyName: "OwnItemsOnly",
+    PolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: {
+        Effect: "Allow",
+        Action: "dynamodb:PutItem",
+        Resource: `arn:aws:dynamodb:${region}:${accountId}:table/OrdersTable`,
+        Condition: {
+          "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["c-1"] },
+        },
+      },
+    }),
+  }),
+);
+
+const caller = { kind: "arn", arn: roleCreation.Role.Arn } as const;
+
+// The customer's own item is written.
+await simAws.dynamoDb().putItem(
+  new PutItemCommand({
+    TableName: "OrdersTable",
+    Item: { customerId: { S: "c-1" }, total: { N: "25" } },
+  }),
+  { caller },
+);
+
+// Another customer's item is refused.
+try {
+  await simAws.dynamoDb().putItem(
+    new PutItemCommand({
+      TableName: "OrdersTable",
+      Item: { customerId: { S: "c-2" }, total: { N: "25" } },
+    }),
+    { caller },
+  );
+} catch (error) {
+  console.log(error instanceof Error ? error.name : "unknown error");
+  // "AccessDenied"
+}
+```
+
+Reading the partition key values needs the table's key schema. The table is found first for that,
+before the caller is authorized against it. A caller with no permission still hears `AccessDenied`
+when the table is missing, and an unauthorized caller cannot find out which table names are taken.
+
+A request carrying no readable partition key value leaves the key out of the condition context. A
+`ForAllValues:` condition matches a request carrying no value for its key, as it does on AWS. The
+condition allows such a request.
+
 A transaction is authorized as the operations it is made of rather than as itself. Each action of a
 `TransactWriteItems` needs `dynamodb:PutItem`, `dynamodb:UpdateItem`, `dynamodb:DeleteItem` or
 `dynamodb:ConditionCheckItem` against the table it names, and each `Get` of a `TransactGetItems`
@@ -3657,6 +3752,9 @@ is written.
   answering with the attributes it projects, and paging with a `LastEvaluatedKey` carrying the index
   key and the table key together. A local secondary index also answers a strongly consistent read,
   and fetches an unprojected attribute from the base table.
+- `dynamodb:LeadingKeys` on `GetItem`, `BatchGetItem`, `Query`, `PutItem`, `UpdateItem`,
+  `DeleteItem` and `BatchWriteItem`, carrying the partition key values the request reaches so a
+  `ForAllValues:` condition can scope a caller to particular items.
 - `DescribeTable`, answering with the full table description, by table name or ARN.
 - `ListTables`, ordered by UTF-8 bytes and paged with `Limit` and `ExclusiveStartTableName`.
 - `DeleteTable`, following the table status DynamoDB moves a deleted table through, and refusing a
@@ -3730,6 +3828,16 @@ Arn`, `Fn::GetAtt … StreamArn` and `Fn::GetAtt … TableId` answering. A CDK `
 
 ## Limitations
 
+- `dynamodb:LeadingKeys` is the only DynamoDB condition key supplied. `dynamodb:Attributes`,
+  `dynamodb:Select` and `dynamodb:ReturnValues` are absent from the condition context, and a
+  statement conditioned on one of them matches no request. The transactional operations supply no
+  leading keys either, and are authorized by action and table alone.
+- A partition key value reaches a policy condition as a string for a `S` key and as its digits for
+  an `N` key. A binary partition key has no documented form for the condition key. A request
+  carrying one leaves the value out.
+- A request against a table that is not there is authorized carrying no leading keys, since there is
+  no key schema to read them with. A `ForAllValues:` condition matches such a request. A caller
+  barred only by that condition learns the table is missing.
 - The document client's PartiQL Commands go unconverted, because PartiQL is an operation this
   simulation lacks yet. `ExecuteStatementCommand`, `BatchExecuteStatementCommand` and
   `ExecuteTransactionCommand` are refused by name, never half converted.

package/docs/services/iam/README.md

@@ -335,6 +335,11 @@ matches instead, as AWS documents. With no value in the request there is none fo
 to equal. A `ForAnyValue:` operator answers false for an absent key whatever it wraps, because no
 request value is there to satisfy it.
 
+A `ForAllValues:` operator answers true for an absent key, which is also AWS behaviour. Every value
+the request carries matches when it carries none. AWS warns that this leaves a `ForAllValues:`
+`Allow` overly permissive, and asks for a `Null` check with a `false` value beside it. `Null` is
+absent from the operators above. A statement written that way fails closed here.
+
 ### Statements left unevaluated
 
 An operator from outside the list above fails closed. The statement holding it matches nothing, and
@@ -1684,8 +1689,9 @@ Sim IAM models the policy behaviour that multi-service tests most commonly need.
 - Only the condition operators listed above are supported. A statement using any other operator
   fails closed, matching no request. `decision.unevaluatedStatements` names those statements, and a
   test can assert that a decision was reached over policies read in full
-- A positive `ForAllValues:` condition fails to match a request carrying no value for the key, and
-  fails to match an empty value set. AWS matches both, and the negated form here matches both
+- A positive `ForAllValues:` condition fails to match an empty value set, where AWS matches one. An
+  absent context key matches, as it does on AWS. A service here leaves a key out where the request
+  carries no value for it, and the empty set is reached only by a caller passing one to `authorize`
 - Signature age is deliberately not enforced. `X-Amz-Date` must be present, well formed, and agree
   with the credential scope date, but is never compared to a clock. A client stamping real time can
   therefore reach a simulation keeping a different one. Session expiry _is_ enforced, against

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.12",
+  "version": "1.21.13",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -290,7 +290,7 @@
     "conventional-changelog-conventionalcommits": "9.3.1",
     "esbuild": "^0.28.2",
     "eslint": "^10.8.0",
-    "eslint-plugin-jsdoc": "^63.3.2",
+    "eslint-plugin-jsdoc": "^64.0.1",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-security": "^4.0.1",
     "eslint-plugin-unicorn": "^73.0.0",