@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-auth.types.d.ts

@@ -0,0 +1,51 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+/**
+ * The API an `Auth` block was read from, for a refusal to name it.
+ */
+export interface SamApiAuthApi {
+    /** `AWS::Serverless::Api` or `AWS::Serverless::HttpApi`. */
+    readonly resourceType: string;
+    /** The logical ID the API is expanded under. */
+    readonly logicalId: string;
+}
+/**
+ * One authorizer an API's `Auth` block declares, as the methods and routes it
+ * decides need it.
+ */
+export interface SamApiAuthorizer {
+    /** What a method or route naming this authorizer sets as its type. */
+    readonly authorizationType: string;
+    /**
+     * The logical ID of the authorizer Resource, which a method or route names
+     * by `Ref`. The built-in `AWS_IAM` authorizer has none: IAM itself decides,
+     * and there is no authorizer to point at.
+     */
+    readonly logicalId: string | undefined;
+    /** The scopes the authorizer asks of every method it decides. */
+    readonly authorizationScopes: SimCfnTemplateValue | undefined;
+    /** The Resources the authorizer is expanded into. */
+    readonly resources: Record<string, SimCfnTemplateValueRecord>;
+}
+/**
+ * The `Auth` of one API, once expanded.
+ *
+ * Both API kinds arrive here. What differs between them is how one authorizer
+ * becomes a Resource, and that is decided before this is built.
+ */
+export interface SamApiAuth {
+    readonly api: SamApiAuthApi;
+    /** The authorizers, by the name `Authorizers` declared each under. */
+    readonly authorizers: ReadonlyMap<string, SamApiAuthorizer>;
+    /** The authorizer every method takes when its event names none. */
+    readonly defaultAuthorizer: string | undefined;
+}
+/**
+ * The name SAM reserves for the authorizer IAM itself decides, on either API
+ * kind.
+ */
+export declare const samIamAuthorizerName = "AWS_IAM";
+/**
+ * The name an event writes to open a method the API's `DefaultAuthorizer`
+ * would otherwise have closed.
+ */
+export declare const samNoAuthorizerName = "NONE";

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-auth.types.js

@@ -0,0 +1,10 @@
+/**
+ * The name SAM reserves for the authorizer IAM itself decides, on either API
+ * kind.
+ */
+export const samIamAuthorizerName = "AWS_IAM";
+/**
+ * The name an event writes to open a method the API's `DefaultAuthorizer`
+ * would otherwise have closed.
+ */
+export const samNoAuthorizerName = "NONE";

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-authorizers.d.ts

@@ -0,0 +1,11 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthApi } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The authorizers an `Auth` block declares, in the order it declares them.
+ */
+export declare function samApiAuthorizerDefinitions(api: SamApiAuthApi, auth: SimCfnTemplateValueRecord): readonly (readonly [string, SimCfnTemplateValueRecord])[];
+/**
+ * The `DefaultAuthorizer` an `Auth` block names, which every method it decides
+ * takes when its own event names none.
+ */
+export declare function samApiDefaultAuthorizer(api: SamApiAuthApi, auth: SimCfnTemplateValueRecord): string | undefined;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-authorizers.js

@@ -0,0 +1,34 @@
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samAuthError } from "./sim-cfn-sam-api-auth.js";
+/**
+ * The authorizers an `Auth` block declares, in the order it declares them.
+ */
+export function samApiAuthorizerDefinitions(api, auth) {
+    const declared = auth["Authorizers"];
+    if (declared === undefined) {
+        return [];
+    }
+    if (!isSamTemplateRecord(declared)) {
+        throw samAuthError(api, "Auth.Authorizers", "it is not a map of authorizers by name");
+    }
+    return Object.entries(declared).map(([name, definition]) => {
+        if (!isSamTemplateRecord(definition)) {
+            throw samAuthError(api, `Auth.Authorizers.${name}`, "it is not a block of authorizer settings");
+        }
+        return [name, definition];
+    });
+}
+/**
+ * The `DefaultAuthorizer` an `Auth` block names, which every method it decides
+ * takes when its own event names none.
+ */
+export function samApiDefaultAuthorizer(api, auth) {
+    const declared = auth["DefaultAuthorizer"];
+    if (declared === undefined) {
+        return undefined;
+    }
+    if (typeof declared !== "string") {
+        throw samAuthError(api, "Auth.DefaultAuthorizer", "it is not the name of one of the API's authorizers");
+    }
+    return declared;
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-identity.d.ts

@@ -0,0 +1,21 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiIdentityProperties } from "./sim-cfn-sam-identity-source.js";
+/**
+ * What an authorizer reads off a request, and how long it may reuse the answer
+ * it gave for it.
+ */
+export interface SamApiIdentity {
+    /** The request parts the authorizer is keyed on, in declaration order. */
+    readonly identitySource: readonly string[];
+    /** The `AuthorizerResultTtlInSeconds` the authorizer is created with. */
+    readonly reauthorizeEvery: SimCfnTemplateValue | undefined;
+}
+/**
+ * The `Identity` block of one authorizer, as the identity source and result
+ * TTL an authorizer Resource is created with.
+ *
+ * An authorizer stating no `Identity` reads nothing off the request by name,
+ * and the Resource it becomes is left to whatever the command requires of its
+ * type.
+ */
+export declare function samApiIdentity(properties: SamApiIdentityProperties): SamApiIdentity;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-identity.js

@@ -0,0 +1,31 @@
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samIdentityPropertyNames } from "./sim-cfn-sam-identity-prefixes.js";
+import { samIdentityError, samIdentitySource, } from "./sim-cfn-sam-identity-source.js";
+import { samUnsupportedIdentity } from "./sim-cfn-sam-unsupported-auth.js";
+/**
+ * The `Identity` block of one authorizer, as the identity source and result
+ * TTL an authorizer Resource is created with.
+ *
+ * An authorizer stating no `Identity` reads nothing off the request by name,
+ * and the Resource it becomes is left to whatever the command requires of its
+ * type.
+ */
+export function samApiIdentity(properties) {
+    const declared = properties.authorizer["Identity"];
+    if (declared === undefined) {
+        return { identitySource: [], reauthorizeEvery: undefined };
+    }
+    if (!isSamTemplateRecord(declared)) {
+        throw samIdentityError(properties, "Identity", "it is not a block");
+    }
+    for (const name of Object.keys(declared)) {
+        if (!samIdentityPropertyNames.has(name)) {
+            throw samIdentityError(properties, `Identity.${name}`, samUnsupportedIdentity.get(name) ??
+                "it is not an Identity property this expansion knows");
+        }
+    }
+    return {
+        identitySource: samIdentitySource(properties, declared),
+        reauthorizeEvery: declared["ReauthorizeEvery"],
+    };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-authorizer-definition.d.ts

@@ -0,0 +1,14 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthApi } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * One authorizer of an `Auth` block, as the expansion of its kind is asked
+ * about it.
+ */
+export interface SamAuthorizerDefinition {
+    /** The API the authorizer belongs to. */
+    readonly api: SamApiAuthApi;
+    /** The name the `Authorizers` map declared it under. */
+    readonly name: string;
+    /** What the template stated for it. */
+    readonly definition: SimCfnTemplateValueRecord;
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-authorizer-definition.js

@@ -0,0 +1 @@
+export {};

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-authorizer-function.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+/**
+ * The `AuthorizerUri` an authorizer invokes a function through.
+ *
+ * API Gateway names the function through its own service path rather than by
+ * ARN, and this is the wrapped form both authorizer Resource types take. The
+ * function ARN goes in as the template wrote it, which is a `Fn::GetAtt` on a
+ * function of the same template more often than not.
+ */
+export declare function samAuthorizerUri(functionArn: SimCfnTemplateValue): SimCfnTemplateValue;
+interface SamAuthorizerPermissionProperties {
+    /** The function the authorizer runs, as the template names it. */
+    readonly functionArn: SimCfnTemplateValue;
+    /** The logical ID of the API whose authorizers the grant covers. */
+    readonly apiLogicalId: string;
+}
+/**
+ * The AWS::Lambda::Permission an API invokes its authorizer function under.
+ *
+ * Without it the authorizer answers nothing and every request the authorizer
+ * decides is refused. The source ARN wildcards the authorizers of the one API,
+ * because the authorizer's own id is only known once it is created, and a
+ * grant naming it would have to be deployed after the thing that needs it.
+ */
+export declare function samAuthorizerPermissionResource(properties: SamAuthorizerPermissionProperties): SimCfnTemplateValueRecord;
+export {};

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-authorizer-function.js

@@ -0,0 +1,58 @@
+/**
+ * The `AuthorizerUri` an authorizer invokes a function through.
+ *
+ * API Gateway names the function through its own service path rather than by
+ * ARN, and this is the wrapped form both authorizer Resource types take. The
+ * function ARN goes in as the template wrote it, which is a `Fn::GetAtt` on a
+ * function of the same template more often than not.
+ */
+export function samAuthorizerUri(functionArn) {
+    return {
+        "Fn::Join": [
+            "",
+            [
+                "arn:",
+                { Ref: "AWS::Partition" },
+                ":apigateway:",
+                { Ref: "AWS::Region" },
+                ":lambda:path/2015-03-31/functions/",
+                functionArn,
+                "/invocations",
+            ],
+        ],
+    };
+}
+/**
+ * The AWS::Lambda::Permission an API invokes its authorizer function under.
+ *
+ * Without it the authorizer answers nothing and every request the authorizer
+ * decides is refused. The source ARN wildcards the authorizers of the one API,
+ * because the authorizer's own id is only known once it is created, and a
+ * grant naming it would have to be deployed after the thing that needs it.
+ */
+export function samAuthorizerPermissionResource(properties) {
+    return {
+        Type: "AWS::Lambda::Permission",
+        Properties: {
+            Action: "lambda:InvokeFunction",
+            FunctionName: properties.functionArn,
+            Principal: "apigateway.amazonaws.com",
+            SourceArn: {
+                "Fn::Join": [
+                    "",
+                    [
+                        "arn:",
+                        { Ref: "AWS::Partition" },
+                        ":execute-api:",
+                        { Ref: "AWS::Region" },
+                        ":",
+                        { Ref: "AWS::AccountId" },
+                        ":",
+                        { Ref: properties.apiLogicalId },
+                        "/authorizers/*",
+                    ],
+                ],
+            },
+        },
+    };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-event-authorization.d.ts

@@ -0,0 +1,18 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamFunctionEvent } from "../../function/event/sim-cfn-sam-declared-event.js";
+/**
+ * How the method or route one event expands into is authorized.
+ *
+ * The event names one of the API's authorizers, or takes the API's
+ * `DefaultAuthorizer` when it names none. `Authorizer: NONE` opens a method the
+ * default would otherwise have closed, which is the only way SAM has of
+ * leaving one path of a protected API open.
+ *
+ * An event naming an authorizer the API does not declare is refused. The
+ * alternative is a method deployed open under a name that reads as closed.
+ *
+ * The API is named by logical ID, and an event naming its API with an
+ * intrinsic this cannot read names no `Auth` block either. Its method carries
+ * whatever the event states for itself, which is nothing more often than not.
+ */
+export declare function samEventAuthorization(event: SamFunctionEvent, apiLogicalId: string | undefined): SimCfnTemplateValueRecord;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-event-authorization.js

@@ -0,0 +1,89 @@
+import { samFunctionType } from "../../function/sim-cfn-sam-function-type.js";
+import { samPropertyError } from "../../sim-cfn-sam-error.js";
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samNoAuthorizerName } from "./sim-cfn-sam-api-auth.types.js";
+import { samUnsupportedEventAuth } from "./sim-cfn-sam-unsupported-auth.js";
+/**
+ * The `Auth` properties an event may state. Everything else SAM has there is
+ * refused by name.
+ */
+const supportedProperties = new Set(["Authorizer", "AuthorizationScopes"]);
+/**
+ * How the method or route one event expands into is authorized.
+ *
+ * The event names one of the API's authorizers, or takes the API's
+ * `DefaultAuthorizer` when it names none. `Authorizer: NONE` opens a method the
+ * default would otherwise have closed, which is the only way SAM has of
+ * leaving one path of a protected API open.
+ *
+ * An event naming an authorizer the API does not declare is refused. The
+ * alternative is a method deployed open under a name that reads as closed.
+ *
+ * The API is named by logical ID, and an event naming its API with an
+ * intrinsic this cannot read names no `Auth` block either. Its method carries
+ * whatever the event states for itself, which is nothing more often than not.
+ */
+export function samEventAuthorization(event, apiLogicalId) {
+    const apiAuth = apiLogicalId === undefined ? undefined : event.apiAuth.get(apiLogicalId);
+    const auth = eventAuthBlock(event);
+    const name = auth["Authorizer"] ?? apiAuth?.defaultAuthorizer;
+    if (name === undefined || name === samNoAuthorizerName) {
+        return { AuthorizationType: "NONE" };
+    }
+    const authorizer = namedAuthorizer(event, apiAuth, name);
+    const scopes = auth["AuthorizationScopes"] ?? authorizer.authorizationScopes;
+    return {
+        AuthorizationType: authorizer.authorizationType,
+        ...(authorizer.logicalId !== undefined && {
+            AuthorizerId: { Ref: authorizer.logicalId },
+        }),
+        ...(scopes !== undefined && { AuthorizationScopes: scopes }),
+    };
+}
+/**
+ * The `Auth` block the event declares, refusing every property this expansion
+ * cannot model.
+ */
+function eventAuthBlock(event) {
+    const declared = event.properties["Auth"];
+    if (declared === undefined) {
+        return {};
+    }
+    if (!isSamTemplateRecord(declared)) {
+        throw eventAuthError(event, "Auth", "it is not a block of settings");
+    }
+    for (const name of Object.keys(declared)) {
+        if (!supportedProperties.has(name)) {
+            throw eventAuthError(event, `Auth.${name}`, samUnsupportedEventAuth.get(name) ??
+                "it is not an event Auth property this expansion knows");
+        }
+    }
+    return declared;
+}
+/**
+ * The authorizer the event named, refusing a name the API has no authorizer
+ * for.
+ */
+function namedAuthorizer(event, apiAuth, name) {
+    if (typeof name !== "string") {
+        throw eventAuthError(event, "Auth.Authorizer", "it is not the name of one of the API's authorizers");
+    }
+    if (apiAuth === undefined) {
+        throw eventAuthError(event, "Auth.Authorizer", `${name} names an authorizer of an API whose Auth block is out of ` +
+            "reach. An event reaches one by naming a SAM API of this template, " +
+            "as the logical ID or as a `Ref` to it");
+    }
+    const authorizer = apiAuth.authorizers.get(name);
+    if (authorizer === undefined) {
+        throw eventAuthError(event, "Auth.Authorizer", `${name} is not an authorizer the API's Auth block declares`);
+    }
+    return authorizer;
+}
+function eventAuthError(event, property, reason) {
+    return samPropertyError({
+        resourceType: samFunctionType,
+        logicalId: event.functionLogicalId,
+        property: `Events.${event.eventName}.${property}`,
+        reason,
+    });
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-api-auth.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuth } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The `Auth` of one AWS::Serverless::HttpApi, as the authorizer Resources it
+ * declares and the default every route takes.
+ *
+ * SAM writes these into the OpenAPI document it generates. They are written as
+ * `AWS::ApiGatewayV2::Authorizer` Resources here, the way the routes beside
+ * them are written as Resources.
+ *
+ * `AWS_IAM` is an authorizer of an HTTP API only once `EnableIamAuthorizer`
+ * asks for it, which is the rule real SAM applies. A REST API has it either
+ * way.
+ */
+export declare function samHttpApiAuth(logicalId: string, apiProperties: SimCfnTemplateValueRecord): SamApiAuth;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-api-auth.js

@@ -0,0 +1,65 @@
+import { samApiAuthBlock, samAuthError, samIamAuthorizer, } from "./sim-cfn-sam-api-auth.js";
+import { samApiAuthorizerDefinitions, samApiDefaultAuthorizer, } from "./sim-cfn-sam-api-authorizers.js";
+import { samIamAuthorizerName } from "./sim-cfn-sam-api-auth.types.js";
+import { samHttpJwtAuthorizer } from "./sim-cfn-sam-http-jwt-authorizer.js";
+import { samHttpLambdaAuthorizer } from "./sim-cfn-sam-http-lambda-authorizer.js";
+/**
+ * The SAM Resource type an HTTP API `Auth` block is declared on.
+ */
+const resourceType = "AWS::Serverless::HttpApi";
+/**
+ * The `Auth` properties this expansion reads on an HTTP API. Everything else
+ * SAM has there is refused by name.
+ */
+const supportedProperties = new Set([
+    "Authorizers",
+    "DefaultAuthorizer",
+    "EnableIamAuthorizer",
+]);
+/**
+ * The `Auth` of one AWS::Serverless::HttpApi, as the authorizer Resources it
+ * declares and the default every route takes.
+ *
+ * SAM writes these into the OpenAPI document it generates. They are written as
+ * `AWS::ApiGatewayV2::Authorizer` Resources here, the way the routes beside
+ * them are written as Resources.
+ *
+ * `AWS_IAM` is an authorizer of an HTTP API only once `EnableIamAuthorizer`
+ * asks for it, which is the rule real SAM applies. A REST API has it either
+ * way.
+ */
+export function samHttpApiAuth(logicalId, apiProperties) {
+    const api = { resourceType, logicalId };
+    const auth = samApiAuthBlock(api, apiProperties, supportedProperties);
+    const iam = auth["EnableIamAuthorizer"] === true
+        ? [[samIamAuthorizerName, samIamAuthorizer()]]
+        : [];
+    return {
+        api,
+        authorizers: new Map([
+            ...iam,
+            ...samApiAuthorizerDefinitions(api, auth).map(([name, definition]) => [name, httpAuthorizer({ api, name, definition })]),
+        ]),
+        defaultAuthorizer: samApiDefaultAuthorizer(api, auth),
+    };
+}
+/**
+ * One authorizer of an HTTP API, as the Resource it becomes and what a route
+ * naming it carries.
+ *
+ * An authorizer naming a `JwtConfiguration` verifies tokens itself, and one
+ * naming a `FunctionArn` asks a function of the template. An authorizer naming
+ * neither is refused rather than deployed as something it did not ask to be.
+ */
+function httpAuthorizer(authorizer) {
+    const jwtConfiguration = authorizer.definition["JwtConfiguration"];
+    if (jwtConfiguration !== undefined) {
+        return samHttpJwtAuthorizer(authorizer, jwtConfiguration);
+    }
+    const functionArn = authorizer.definition["FunctionArn"];
+    if (functionArn !== undefined) {
+        return samHttpLambdaAuthorizer(authorizer, functionArn);
+    }
+    throw samAuthError(authorizer.api, `Auth.Authorizers.${authorizer.name}`, "it names neither a JwtConfiguration nor a FunctionArn, so there is no " +
+        "telling what would decide a request");
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-jwt-authorizer.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+import type { SamAuthorizerDefinition } from "./sim-cfn-sam-authorizer-definition.js";
+/**
+ * An HTTP API JWT authorizer, which verifies the token a request carries
+ * against the issuer it names.
+ *
+ * SAM writes the issuer and audience the way the OpenAPI document does, in
+ * lower case, where the Resource takes them capitalised. Both spellings are
+ * read, since a template written against the CloudFormation shape is the one
+ * more likely to be pasted in from elsewhere.
+ */
+export declare function samHttpJwtAuthorizer(authorizer: SamAuthorizerDefinition, jwtConfiguration: SimCfnTemplateValue): SamApiAuthorizer;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-jwt-authorizer.js

@@ -0,0 +1,60 @@
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samAuthError, samAuthorizerLogicalId, } from "./sim-cfn-sam-api-auth.js";
+/**
+ * An HTTP API JWT authorizer, which verifies the token a request carries
+ * against the issuer it names.
+ *
+ * SAM writes the issuer and audience the way the OpenAPI document does, in
+ * lower case, where the Resource takes them capitalised. Both spellings are
+ * read, since a template written against the CloudFormation shape is the one
+ * more likely to be pasted in from elsewhere.
+ */
+export function samHttpJwtAuthorizer(authorizer, jwtConfiguration) {
+    const { api, name, definition } = authorizer;
+    if (!isSamTemplateRecord(jwtConfiguration)) {
+        throw samAuthError(api, `Auth.Authorizers.${name}.JwtConfiguration`, "it is not a block naming an issuer and an audience");
+    }
+    const logicalId = samAuthorizerLogicalId(api, name);
+    return {
+        authorizationType: "JWT",
+        logicalId,
+        authorizationScopes: definition["AuthorizationScopes"],
+        resources: {
+            [logicalId]: {
+                Type: "AWS::ApiGatewayV2::Authorizer",
+                Properties: {
+                    ApiId: { Ref: api.logicalId },
+                    Name: name,
+                    AuthorizerType: "JWT",
+                    IdentitySource: identitySource(definition),
+                    JwtConfiguration: jwtProperties(jwtConfiguration),
+                },
+            },
+        },
+    };
+}
+/**
+ * The issuer and audience the authorizer Resource is created with.
+ *
+ * A key naming nothing is left out rather than written as nothing, so what the
+ * Resource is refused for is the key the template left out.
+ */
+function jwtProperties(jwtConfiguration) {
+    const issuer = jwtConfiguration["Issuer"] ?? jwtConfiguration["issuer"];
+    const audience = jwtConfiguration["Audience"] ?? jwtConfiguration["audience"];
+    return {
+        ...(issuer !== undefined && { Issuer: issuer }),
+        ...(audience !== undefined && { Audience: audience }),
+    };
+}
+/**
+ * Where the authorizer reads the token from, which an HTTP API states as a
+ * list even where SAM states one string.
+ */
+function identitySource(definition) {
+    const declared = definition["IdentitySource"];
+    if (declared === undefined) {
+        return ["$request.header.Authorization"];
+    }
+    return Array.isArray(declared) ? declared : [declared];
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-lambda-authorizer.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+import type { SamAuthorizerDefinition } from "./sim-cfn-sam-authorizer-definition.js";
+/**
+ * An HTTP API Lambda authorizer, which asks a function of the template what to
+ * do with the request.
+ *
+ * `AuthorizerPayloadFormatVersion` is required by SAM and goes on as it came,
+ * so a version the simulation does not run is refused by CreateAuthorizer
+ * naming it rather than here. An authorizer stating none gets `2.0`, the
+ * format the rest of this expansion integrates a function under.
+ */
+export declare function samHttpLambdaAuthorizer(authorizer: SamAuthorizerDefinition, functionArn: SimCfnTemplateValue): SamApiAuthorizer;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-lambda-authorizer.js

@@ -0,0 +1,50 @@
+import { samAuthorizerLogicalId, samAuthorizerResultTtl, } from "./sim-cfn-sam-api-auth.js";
+import { samApiIdentity } from "./sim-cfn-sam-api-identity.js";
+import { samAuthorizerPermissionResource, samAuthorizerUri, } from "./sim-cfn-sam-authorizer-function.js";
+import { samHttpIdentityPrefixes } from "./sim-cfn-sam-identity-prefixes.js";
+/**
+ * An HTTP API Lambda authorizer, which asks a function of the template what to
+ * do with the request.
+ *
+ * `AuthorizerPayloadFormatVersion` is required by SAM and goes on as it came,
+ * so a version the simulation does not run is refused by CreateAuthorizer
+ * naming it rather than here. An authorizer stating none gets `2.0`, the
+ * format the rest of this expansion integrates a function under.
+ */
+export function samHttpLambdaAuthorizer(authorizer, functionArn) {
+    const { api, name, definition } = authorizer;
+    const identity = samApiIdentity({
+        api,
+        authorizerName: name,
+        authorizer: definition,
+        prefixes: samHttpIdentityPrefixes,
+    });
+    const logicalId = samAuthorizerLogicalId(api, name);
+    const simpleResponses = definition["EnableSimpleResponses"];
+    return {
+        authorizationType: "CUSTOM",
+        logicalId,
+        authorizationScopes: undefined,
+        resources: {
+            [logicalId]: {
+                Type: "AWS::ApiGatewayV2::Authorizer",
+                Properties: {
+                    ApiId: { Ref: api.logicalId },
+                    Name: name,
+                    AuthorizerType: "REQUEST",
+                    AuthorizerUri: samAuthorizerUri(functionArn),
+                    IdentitySource: [...identity.identitySource],
+                    AuthorizerPayloadFormatVersion: definition["AuthorizerPayloadFormatVersion"] ?? "2.0",
+                    ...(simpleResponses !== undefined && {
+                        EnableSimpleResponses: simpleResponses,
+                    }),
+                    ...samAuthorizerResultTtl(identity.reauthorizeEvery),
+                },
+            },
+            [`${logicalId}Permission`]: samAuthorizerPermissionResource({
+                functionArn,
+                apiLogicalId: api.logicalId,
+            }),
+        },
+    };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-identity-prefixes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * How a REST API names the parts of a request an authorizer reads.
+ */
+export declare const samRestIdentityPrefixes: ReadonlyMap<string, string>;
+/**
+ * How an HTTP API names the same parts.
+ */
+export declare const samHttpIdentityPrefixes: ReadonlyMap<string, string>;
+/**
+ * The `Identity` properties this expansion reads. `Header` is the singular a
+ * Cognito or `TOKEN` authorizer states, and reads as a `Headers` of one.
+ */
+export declare const samIdentityPropertyNames: Set<string>;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-identity-prefixes.js

@@ -0,0 +1,30 @@
+/**
+ * How a REST API names the parts of a request an authorizer reads.
+ */
+export const samRestIdentityPrefixes = new Map([
+    ["Headers", "method.request.header."],
+    ["QueryStrings", "method.request.querystring."],
+    ["StageVariables", "stageVariables."],
+    ["Context", "context."],
+]);
+/**
+ * How an HTTP API names the same parts.
+ */
+export const samHttpIdentityPrefixes = new Map([
+    ["Headers", "$request.header."],
+    ["QueryStrings", "$request.querystring."],
+    ["StageVariables", "$stageVariables."],
+    ["Context", "$context."],
+]);
+/**
+ * The `Identity` properties this expansion reads. `Header` is the singular a
+ * Cognito or `TOKEN` authorizer states, and reads as a `Headers` of one.
+ */
+export const samIdentityPropertyNames = new Set([
+    "Header",
+    "Headers",
+    "QueryStrings",
+    "StageVariables",
+    "Context",
+    "ReauthorizeEvery",
+]);