@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-identity-source.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthApi } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * What one authorizer's `Identity` block is read against.
+ */
+export interface SamApiIdentityProperties {
+    readonly api: SamApiAuthApi;
+    /** The name the `Authorizers` map declared this authorizer under. */
+    readonly authorizerName: string;
+    /** The authorizer's own properties, which may declare no `Identity` at all. */
+    readonly authorizer: SimCfnTemplateValueRecord;
+    /** How the API this authorizer belongs to names the parts of a request. */
+    readonly prefixes: ReadonlyMap<string, string>;
+}
+/**
+ * The request parts the authorizer is keyed on, in the order the API names
+ * them.
+ *
+ * The singular `Header` a Cognito or `TOKEN` authorizer states reads as a
+ * `Headers` of one, so both spellings arrive under the same prefix.
+ */
+export declare function samIdentitySource(properties: SamApiIdentityProperties, identity: SimCfnTemplateValueRecord): readonly string[];
+/**
+ * The error a property of an authorizer's `Identity` block is refused with.
+ */
+export declare function samIdentityError(properties: SamApiIdentityProperties, property: string, reason: string): Error;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-identity-source.js

@@ -0,0 +1,44 @@
+import { samAuthError } from "./sim-cfn-sam-api-auth.js";
+/**
+ * The request parts the authorizer is keyed on, in the order the API names
+ * them.
+ *
+ * The singular `Header` a Cognito or `TOKEN` authorizer states reads as a
+ * `Headers` of one, so both spellings arrive under the same prefix.
+ */
+export function samIdentitySource(properties, identity) {
+    return properties.prefixes
+        .entries()
+        .flatMap(([name, prefix]) => identityNames(properties, identity, name).map((part) => `${prefix}${part}`))
+        .toArray();
+}
+/**
+ * The error a property of an authorizer's `Identity` block is refused with.
+ */
+export function samIdentityError(properties, property, reason) {
+    return samAuthError(properties.api, `Auth.Authorizers.${properties.authorizerName}.${property}`, reason);
+}
+function identityNames(properties, identity, name) {
+    const singular = name === "Headers" ? identity["Header"] : undefined;
+    // oxlint-disable-next-line security/detect-object-injection -- a template record read by one of the Identity property names.
+    const declared = identity[name];
+    return [
+        ...(singular === undefined ? [] : [singular]),
+        ...asList(properties, name, declared),
+    ].map((value) => identityName(properties, name, value));
+}
+function asList(properties, name, declared) {
+    if (declared === undefined) {
+        return [];
+    }
+    if (!Array.isArray(declared)) {
+        throw samIdentityError(properties, `Identity.${name}`, "it is not a list of names");
+    }
+    return declared;
+}
+function identityName(properties, name, value) {
+    if (typeof value !== "string") {
+        throw samIdentityError(properties, `Identity.${name}`, "it names a part of the request as something other than a string");
+    }
+    return value;
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-api-auth.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuth } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The `Auth` of one AWS::Serverless::Api, as the authorizer Resources it
+ * declares and the default every method takes.
+ *
+ * SAM writes these into the Swagger document it generates. They are written as
+ * `AWS::ApiGateway::Authorizer` Resources here, the way the methods beside them
+ * are written as Resources, so an authorizer is something a Stack holds,
+ * answers `Ref` for and tears down.
+ *
+ * `AWS_IAM` is an authorizer of every REST API without being declared, since a
+ * SAM template names it as a `DefaultAuthorizer` without declaring one.
+ */
+export declare function samRestApiAuth(logicalId: string, apiProperties: SimCfnTemplateValueRecord): SamApiAuth;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-api-auth.js

@@ -0,0 +1,59 @@
+import { samApiAuthBlock, samAuthError, samIamAuthorizer, } from "./sim-cfn-sam-api-auth.js";
+import { samApiAuthorizerDefinitions, samApiDefaultAuthorizer, } from "./sim-cfn-sam-api-authorizers.js";
+import { samIamAuthorizerName } from "./sim-cfn-sam-api-auth.types.js";
+import { samRestCognitoAuthorizer } from "./sim-cfn-sam-rest-cognito-authorizer.js";
+import { samRestLambdaAuthorizer } from "./sim-cfn-sam-rest-lambda-authorizer.js";
+/**
+ * The SAM Resource type a REST API `Auth` block is declared on.
+ */
+const resourceType = "AWS::Serverless::Api";
+/**
+ * The `Auth` properties this expansion reads on a REST API. Everything else
+ * SAM has there is refused by name.
+ */
+const supportedProperties = new Set(["Authorizers", "DefaultAuthorizer"]);
+/**
+ * The `Auth` of one AWS::Serverless::Api, as the authorizer Resources it
+ * declares and the default every method takes.
+ *
+ * SAM writes these into the Swagger document it generates. They are written as
+ * `AWS::ApiGateway::Authorizer` Resources here, the way the methods beside them
+ * are written as Resources, so an authorizer is something a Stack holds,
+ * answers `Ref` for and tears down.
+ *
+ * `AWS_IAM` is an authorizer of every REST API without being declared, since a
+ * SAM template names it as a `DefaultAuthorizer` without declaring one.
+ */
+export function samRestApiAuth(logicalId, apiProperties) {
+    const api = { resourceType, logicalId };
+    const auth = samApiAuthBlock(api, apiProperties, supportedProperties);
+    return {
+        api,
+        authorizers: new Map([
+            [samIamAuthorizerName, samIamAuthorizer()],
+            ...samApiAuthorizerDefinitions(api, auth).map(([name, definition]) => [name, restAuthorizer({ api, name, definition })]),
+        ]),
+        defaultAuthorizer: samApiDefaultAuthorizer(api, auth),
+    };
+}
+/**
+ * One authorizer of a REST API, as the Resource it becomes and what a method
+ * naming it carries.
+ *
+ * A Cognito authorizer is the one that names a `UserPoolArn`, and a Lambda one
+ * the one that names a `FunctionArn`. That is how SAM tells them apart, and an
+ * authorizer naming neither is refused rather than deployed as something it
+ * did not ask to be.
+ */
+function restAuthorizer(authorizer) {
+    const userPoolArn = authorizer.definition["UserPoolArn"];
+    if (userPoolArn !== undefined) {
+        return samRestCognitoAuthorizer(authorizer, userPoolArn);
+    }
+    const functionArn = authorizer.definition["FunctionArn"];
+    if (functionArn !== undefined) {
+        return samRestLambdaAuthorizer(authorizer, functionArn);
+    }
+    throw samAuthError(authorizer.api, `Auth.Authorizers.${authorizer.name}`, "it names neither a UserPoolArn nor a FunctionArn, so there is no " +
+        "telling what would decide a request");
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-cognito-authorizer.d.ts

@@ -0,0 +1,11 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+import type { SamAuthorizerDefinition } from "./sim-cfn-sam-authorizer-definition.js";
+/**
+ * A REST API Cognito user pool authorizer, which verifies the token a request
+ * carries against the pool it names.
+ *
+ * `AuthorizationScopes` on the authorizer is what every method it decides asks
+ * of the token, and an event may ask for different ones of its own.
+ */
+export declare function samRestCognitoAuthorizer(authorizer: SamAuthorizerDefinition, userPoolArn: SimCfnTemplateValue): SamApiAuthorizer;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-cognito-authorizer.js

@@ -0,0 +1,43 @@
+import { samAuthorizerLogicalId, samAuthorizerResultTtl, } from "./sim-cfn-sam-api-auth.js";
+import { samApiIdentity } from "./sim-cfn-sam-api-identity.js";
+import { samRestIdentityPrefixes } from "./sim-cfn-sam-identity-prefixes.js";
+/**
+ * The header a Cognito authorizer reads its token from where the template says
+ * nothing, which is the one real API Gateway defaults to.
+ */
+const defaultIdentitySource = "method.request.header.Authorization";
+/**
+ * A REST API Cognito user pool authorizer, which verifies the token a request
+ * carries against the pool it names.
+ *
+ * `AuthorizationScopes` on the authorizer is what every method it decides asks
+ * of the token, and an event may ask for different ones of its own.
+ */
+export function samRestCognitoAuthorizer(authorizer, userPoolArn) {
+    const { api, name, definition } = authorizer;
+    const identity = samApiIdentity({
+        api,
+        authorizerName: name,
+        authorizer: definition,
+        prefixes: samRestIdentityPrefixes,
+    });
+    const logicalId = samAuthorizerLogicalId(api, name);
+    return {
+        authorizationType: "COGNITO_USER_POOLS",
+        logicalId,
+        authorizationScopes: definition["AuthorizationScopes"],
+        resources: {
+            [logicalId]: {
+                Type: "AWS::ApiGateway::Authorizer",
+                Properties: {
+                    RestApiId: { Ref: api.logicalId },
+                    Name: name,
+                    Type: "COGNITO_USER_POOLS",
+                    ProviderARNs: [userPoolArn],
+                    IdentitySource: identity.identitySource.join(",") || defaultIdentitySource,
+                    ...samAuthorizerResultTtl(identity.reauthorizeEvery),
+                },
+            },
+        },
+    };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-lambda-authorizer.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+import type { SamAuthorizerDefinition } from "./sim-cfn-sam-authorizer-definition.js";
+/**
+ * A REST API Lambda authorizer, which asks a function of the template what to
+ * do with the request.
+ *
+ * `FunctionPayloadType` decides which of the two kinds it is. A `TOKEN`
+ * authorizer is handed one header, and a `REQUEST` authorizer the whole
+ * request. SAM defaults to `TOKEN`, and so does this. A `TOKEN` authorizer
+ * naming no header of its own reads `Authorization`, and a `REQUEST` one is
+ * allowed to read nothing by name, which is how it is asked to run on every
+ * request.
+ */
+export declare function samRestLambdaAuthorizer(authorizer: SamAuthorizerDefinition, functionArn: SimCfnTemplateValue): SamApiAuthorizer;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-lambda-authorizer.js

@@ -0,0 +1,67 @@
+import { samAuthError, samAuthorizerLogicalId, samAuthorizerResultTtl, } from "./sim-cfn-sam-api-auth.js";
+import { samApiIdentity } from "./sim-cfn-sam-api-identity.js";
+import { samAuthorizerPermissionResource, samAuthorizerUri, } from "./sim-cfn-sam-authorizer-function.js";
+import { samRestIdentityPrefixes } from "./sim-cfn-sam-identity-prefixes.js";
+/**
+ * A REST API Lambda authorizer, which asks a function of the template what to
+ * do with the request.
+ *
+ * `FunctionPayloadType` decides which of the two kinds it is. A `TOKEN`
+ * authorizer is handed one header, and a `REQUEST` authorizer the whole
+ * request. SAM defaults to `TOKEN`, and so does this. A `TOKEN` authorizer
+ * naming no header of its own reads `Authorization`, and a `REQUEST` one is
+ * allowed to read nothing by name, which is how it is asked to run on every
+ * request.
+ */
+export function samRestLambdaAuthorizer(authorizer, functionArn) {
+    const { api, name, definition } = authorizer;
+    const identity = samApiIdentity({
+        api,
+        authorizerName: name,
+        authorizer: definition,
+        prefixes: samRestIdentityPrefixes,
+    });
+    const logicalId = samAuthorizerLogicalId(api, name);
+    const type = payloadType(authorizer);
+    const declared = identity.identitySource.join(",");
+    return {
+        authorizationType: "CUSTOM",
+        logicalId,
+        authorizationScopes: undefined,
+        resources: {
+            [logicalId]: {
+                Type: "AWS::ApiGateway::Authorizer",
+                Properties: {
+                    RestApiId: { Ref: api.logicalId },
+                    Name: name,
+                    Type: type,
+                    AuthorizerUri: samAuthorizerUri(functionArn),
+                    ...identitySource(type, declared),
+                    ...samAuthorizerResultTtl(identity.reauthorizeEvery),
+                },
+            },
+            [`${logicalId}Permission`]: samAuthorizerPermissionResource({
+                functionArn,
+                apiLogicalId: api.logicalId,
+            }),
+        },
+    };
+}
+/**
+ * Which kind of Lambda authorizer the definition asks for.
+ */
+function payloadType(authorizer) {
+    const declared = authorizer.definition["FunctionPayloadType"] ?? "TOKEN";
+    if (declared !== "TOKEN" && declared !== "REQUEST") {
+        throw samAuthError(authorizer.api, `Auth.Authorizers.${authorizer.name}.FunctionPayloadType`, "it is neither TOKEN nor REQUEST");
+    }
+    return declared;
+}
+/**
+ * The `IdentitySource` the authorizer is created with, which a REST API states
+ * as one comma-separated string.
+ */
+function identitySource(type, declared) {
+    const source = declared || (type === "TOKEN" ? "method.request.header.Authorization" : "");
+    return source === "" ? {} : { IdentitySource: source };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-template-api-auth.d.ts

@@ -0,0 +1,26 @@
+import type { CfnTemplateBodyRecord } from "../../../template/sim-cfn-template.js";
+import type { SamTemplateGlobals } from "../../sim-cfn-sam-globals.js";
+import type { SamApiAuth } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The `Auth` of every API of a template, by the logical ID the API is expanded
+ * under.
+ *
+ * An `Api` or `HttpApi` event puts its method on an API declared somewhere
+ * else in the template, and has to know what that API's `Auth` block declared
+ * before it can name one of its authorizers. This is read once for the whole
+ * template and handed to every event.
+ */
+export type SamTemplateApiAuth = ReadonlyMap<string, SamApiAuth>;
+/**
+ * Read the `Auth` of every API a template declares, and of the two implicit
+ * APIs its events may make.
+ *
+ * The implicit APIs are read from `Globals`, which is where SAM says their
+ * `Auth` comes from. An API the template declares under one of their logical
+ * IDs is the API of that name, and is read last for that reason.
+ *
+ * An API naming a `DefinitionUri` is left out. Nothing here reads the document
+ * it points at, so the API is not expanded at all and there is no authorizer
+ * Resource for a method to name.
+ */
+export declare function samTemplateApiAuth(template: CfnTemplateBodyRecord, globals: SamTemplateGlobals): SamTemplateApiAuth;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-template-api-auth.js

@@ -0,0 +1,61 @@
+import { samImplicitHttpApiLogicalId } from "../../function/event/sim-cfn-sam-implicit-http-api.js";
+import { samImplicitRestApiLogicalId } from "../../function/event/sim-cfn-sam-implicit-rest-api.js";
+import { samResourceProperties } from "../../function/sim-cfn-sam-function-properties.js";
+import { samMergedApiProperties } from "../../sim-cfn-sam-globals.js";
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samHttpApiType } from "../sim-cfn-sam-http-api.js";
+import { samRestApiType } from "../sim-cfn-sam-rest-api.js";
+import { samHttpApiAuth } from "./sim-cfn-sam-http-api-auth.js";
+import { samRestApiAuth } from "./sim-cfn-sam-rest-api-auth.js";
+/**
+ * Read the `Auth` of every API a template declares, and of the two implicit
+ * APIs its events may make.
+ *
+ * The implicit APIs are read from `Globals`, which is where SAM says their
+ * `Auth` comes from. An API the template declares under one of their logical
+ * IDs is the API of that name, and is read last for that reason.
+ *
+ * An API naming a `DefinitionUri` is left out. Nothing here reads the document
+ * it points at, so the API is not expanded at all and there is no authorizer
+ * Resource for a method to name.
+ */
+export function samTemplateApiAuth(template, globals) {
+    const resources = isSamTemplateRecord(template.Resources)
+        ? Object.entries(template.Resources)
+        : [];
+    return new Map([
+        [
+            samImplicitRestApiLogicalId,
+            samRestApiAuth(samImplicitRestApiLogicalId, globals.forApi),
+        ],
+        [
+            samImplicitHttpApiLogicalId,
+            samHttpApiAuth(samImplicitHttpApiLogicalId, globals.forHttpApi),
+        ],
+        ...resources.flatMap(([logicalId, resource]) => declaredApiAuth(logicalId, resource, globals)),
+    ]);
+}
+/**
+ * The `Auth` of one Resource of the template, where the Resource is a SAM API
+ * this expansion covers.
+ */
+function declaredApiAuth(logicalId, resource, globals) {
+    if (!isSamTemplateRecord(resource)) {
+        return [];
+    }
+    const type = resource["Type"];
+    if (type === samRestApiType) {
+        return apiAuth(logicalId, resource, globals.forApi, samRestApiAuth);
+    }
+    if (type === samHttpApiType) {
+        return apiAuth(logicalId, resource, globals.forHttpApi, samHttpApiAuth);
+    }
+    return [];
+}
+function apiAuth(logicalId, resource, globals, read) {
+    const apiProperties = samMergedApiProperties(globals, samResourceProperties(resource));
+    if (apiProperties["DefinitionUri"] !== undefined) {
+        return [];
+    }
+    return [[logicalId, read(logicalId, apiProperties)]];
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-unsupported-auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The `Auth` properties an API can declare that this expansion does not model,
+ * and what each one would have done.
+ *
+ * Every one of them is refused by name rather than dropped, because an API
+ * that quietly lost part of its `Auth` block deploys open under a template
+ * that reads as closed.
+ */
+export declare const samUnsupportedApiAuth: ReadonlyMap<string, string>;
+/**
+ * The `Auth` properties an `Api` or `HttpApi` event can declare that this
+ * expansion does not model.
+ */
+export declare const samUnsupportedEventAuth: ReadonlyMap<string, string>;
+/**
+ * The `Identity` properties of an authorizer this expansion does not model.
+ */
+export declare const samUnsupportedIdentity: ReadonlyMap<string, string>;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-unsupported-auth.js

@@ -0,0 +1,59 @@
+/**
+ * The `Auth` properties an API can declare that this expansion does not model,
+ * and what each one would have done.
+ *
+ * Every one of them is refused by name rather than dropped, because an API
+ * that quietly lost part of its `Auth` block deploys open under a template
+ * that reads as closed.
+ */
+export const samUnsupportedApiAuth = new Map([
+    [
+        "AddDefaultAuthorizerToCorsPreflight",
+        "it decides whether the OPTIONS method a Cors block generates is " +
+            "authorized, and Cors is not expanded here",
+    ],
+    ["ApiKeyRequired", "API keys and usage plans are not simulated"],
+    ["UsagePlan", "API keys and usage plans are not simulated"],
+    [
+        "InvokeRole",
+        "it names the Role API Gateway calls the integration as, and an " +
+            "integration here is invoked as the API rather than as a Role",
+    ],
+    [
+        "ResourcePolicy",
+        "an API Gateway resource policy is not simulated. Close the API with an " +
+            "authorizer instead",
+    ],
+]);
+/**
+ * The `Auth` properties an `Api` or `HttpApi` event can declare that this
+ * expansion does not model.
+ */
+export const samUnsupportedEventAuth = new Map([
+    ["ApiKeyRequired", "API keys and usage plans are not simulated"],
+    [
+        "InvokeRole",
+        "it names the Role API Gateway calls the integration as, and an " +
+            "integration here is invoked as the API rather than as a Role",
+    ],
+    [
+        "ResourcePolicy",
+        "an API Gateway resource policy is not simulated. Close the method with " +
+            "an authorizer instead",
+    ],
+    [
+        "OverrideApiAuth",
+        "it lets an event replace the API's own Auth block rather than name one " +
+            "of its authorizers",
+    ],
+]);
+/**
+ * The `Identity` properties of an authorizer this expansion does not model.
+ */
+export const samUnsupportedIdentity = new Map([
+    [
+        "ValidationExpression",
+        "it turns a token that does not match into a 401 before the authorizer " +
+            "runs, and that check is not simulated",
+    ],
+]);

package/dist/service/cloudformation/sam/api/sim-cfn-sam-http-api-template.factory.js

@@ -1,5 +1,5 @@
 import { MappedFactory } from "@kensio/part-factory";
-import { samFunctionType } from "../function/sim-cfn-sam-function.js";
+import { samFunctionType } from "../function/sim-cfn-sam-function-type.js";
 import { samTransformName } from "../sim-cfn-sam-transform.js";
 import { samHttpApiType } from "./sim-cfn-sam-http-api.js";
 /**

package/dist/service/cloudformation/sam/api/sim-cfn-sam-http-api.d.ts

@@ -22,6 +22,10 @@ export declare const samHttpApiType = "AWS::Serverless::HttpApi";
  * points at a document on disk or in S3. Nothing here reads either, and an API
  * declaring one is left as the template wrote it, to be recorded as
  * unsupported. The alternative is an API deployed with no routes at all.
+ *
+ * An `Auth` block becomes one `AWS::ApiGatewayV2::Authorizer` per authorizer it
+ * declares, named after the API and the authorizer, which the routes on the API
+ * name by `Ref`.
  */
 export declare function samHttpApiResources(properties: SamHttpApiExpansionProperties): Record<string, SimCfnTemplateValue>;
 export {};

package/dist/service/cloudformation/sam/api/sim-cfn-sam-http-api.js

@@ -1,6 +1,8 @@
-import { samCarriedAttributes, samResourceProperties, } from "../function/sim-cfn-sam-function-properties.js";
+import { samCarriedAttributes, samConditionAttribute, samResourceProperties, } from "../function/sim-cfn-sam-function-properties.js";
 import { samMergedApiProperties } from "../sim-cfn-sam-globals.js";
 import { samPickedProperties } from "../sim-cfn-sam-picked.js";
+import { samApiAuthResources } from "./auth/sim-cfn-sam-api-auth.js";
+import { samHttpApiAuth } from "./auth/sim-cfn-sam-http-api-auth.js";
 import { samHttpApiStageResources } from "./sim-cfn-sam-http-api-stage.js";
 /**
  * The SAM Resource type this expansion covers.
@@ -10,10 +12,10 @@ export const samHttpApiType = "AWS::Serverless::HttpApi";
  * The properties whose names and meanings are the same on both Resource types.
  * Expanding one of them is carrying it across.
  *
- * `Auth` and `Domain` are absent from the list. SAM writes an `Auth` block
- * into the OpenAPI document it generates, and deploys a `Domain` as a custom
- * domain name Resource. Neither is expanded here, and an API declaring one is
- * deployed without it.
+ * `Auth` and `Domain` are absent from the list. SAM deploys a `Domain` as a
+ * custom domain name Resource. That is not expanded here, and an API declaring
+ * one is deployed without it. `Auth` becomes authorizer Resources of its own
+ * beside the API.
  */
 const propertyNames = new Set([
     "CorsConfiguration",
@@ -36,6 +38,10 @@ const propertyNames = new Set([
  * points at a document on disk or in S3. Nothing here reads either, and an API
  * declaring one is left as the template wrote it, to be recorded as
  * unsupported. The alternative is an API deployed with no routes at all.
+ *
+ * An `Auth` block becomes one `AWS::ApiGatewayV2::Authorizer` per authorizer it
+ * declares, named after the API and the authorizer, which the routes on the API
+ * name by `Ref`.
  */
 export function samHttpApiResources(properties) {
     const { logicalId, resource, globals } = properties;
@@ -55,6 +61,7 @@ export function samHttpApiResources(properties) {
             },
         },
         ...samHttpApiStageResources({ logicalId, resource, apiProperties }),
+        ...samApiAuthResources(samHttpApiAuth(logicalId, apiProperties), samConditionAttribute(resource["Condition"])),
     };
 }
 /**

package/dist/service/cloudformation/sam/api/sim-cfn-sam-rest-api-template.factory.js

@@ -1,5 +1,5 @@
 import { MappedFactory } from "@kensio/part-factory";
-import { samFunctionType } from "../function/sim-cfn-sam-function.js";
+import { samFunctionType } from "../function/sim-cfn-sam-function-type.js";
 import { samTransformName } from "../sim-cfn-sam-transform.js";
 import { samRestApiType } from "./sim-cfn-sam-rest-api.js";
 /**

package/dist/service/cloudformation/sam/api/sim-cfn-sam-rest-api.js

@@ -1,6 +1,8 @@
-import { samCarriedAttributes, samResourceProperties, } from "../function/sim-cfn-sam-function-properties.js";
+import { samCarriedAttributes, samConditionAttribute, samResourceProperties, } from "../function/sim-cfn-sam-function-properties.js";
 import { samMergedApiProperties } from "../sim-cfn-sam-globals.js";
 import { samPickedProperties } from "../sim-cfn-sam-picked.js";
+import { samApiAuthResources } from "./auth/sim-cfn-sam-api-auth.js";
+import { samRestApiAuth } from "./auth/sim-cfn-sam-rest-api-auth.js";
 import { samRestApiStageResources } from "./sim-cfn-sam-rest-api-stage.js";
 /**
  * The SAM Resource type this expansion covers.
@@ -10,10 +12,11 @@ export const samRestApiType = "AWS::Serverless::Api";
  * The properties whose names and meanings are the same on both Resource types.
  * Expanding one of them is carrying it across.
  *
- * `Auth`, `Cors`, `Domain`, `GatewayResponses`, `MethodSettings` and
+ * `Cors`, `Domain`, `GatewayResponses`, `MethodSettings` and
  * `BinaryMediaTypes` are absent from the list. SAM writes all of them into the
  * Swagger document it generates, and none is expanded here, so an API
- * declaring one is deployed without it.
+ * declaring one is deployed without it. `Auth` is absent for the opposite
+ * reason. It becomes authorizer Resources of its own beside the API.
  */
 const propertyNames = new Set([
     "Description",
@@ -60,6 +63,7 @@ export function samRestApiResources(properties) {
             },
         },
         ...samRestApiStageResources({ logicalId, resource, apiProperties }),
+        ...samApiAuthResources(samRestApiAuth(logicalId, apiProperties), samConditionAttribute(resource["Condition"])),
     };
 }
 /**

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-api-event.js

@@ -1,3 +1,4 @@
+import { samEventAuthorization } from "../../api/auth/sim-cfn-sam-event-authorization.js";
 import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
 import { samApiInvokePermissionResource } from "./sim-cfn-sam-api-invoke-permission.js";
 import { samApiEventPathParts, samApiEventPathResources, samApiEventResourceId, } from "./sim-cfn-sam-api-event-path.js";
@@ -84,8 +85,11 @@ function samApiEventPath(properties) {
  *
  * SAM integrates an `Api` event as a proxy, which is the shape the function is
  * handed the request in, and the REST API declares an integration as a block
- * of the method. `Auth` on the event is not expanded, so the method authorizes
- * nothing and every request matching it reaches the function.
+ * of the method.
+ *
+ * `Auth` on the event names one of the API's authorizers, and an event naming
+ * none takes the API's `DefaultAuthorizer`. A method neither of them closes
+ * authorizes nothing, and every request matching it reaches the function.
  */
 function methodResource(properties) {
     const { event, apiLogicalId, path } = properties;
@@ -96,7 +100,7 @@ function methodResource(properties) {
             RestApiId: { Ref: apiLogicalId },
             ResourceId: samApiEventResourceId(apiLogicalId, path),
             HttpMethod: samApiEventHttpMethod(event.properties),
-            AuthorizationType: "NONE",
+            ...samEventAuthorization(event, apiLogicalId),
             Integration: {
                 Type: "AWS_PROXY",
                 IntegrationHttpMethod: "POST",

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-cognito-event.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamFunctionEvent } from "./sim-cfn-sam-declared-event.js";
+import type { SamResourceEdit } from "./sim-cfn-sam-resource-edit.js";
+/**
+ * The Resource a `Cognito` event expands into, which is the permission the
+ * pool invokes the function under.
+ *
+ * A user pool checks the function's resource policy every time a trigger
+ * fires, so the entry in its `LambdaConfig` is not enough on its own. The
+ * grant names the pool as the source, so a permission written for one pool
+ * does not open the function to another.
+ *
+ * The pool is not made to depend on the permission. Cognito reads the policy
+ * when the trigger fires rather than when the pool is created, and a pool
+ * depending on a permission that names the pool is the circular dependency
+ * CloudFormation refuses.
+ */
+export declare function samCognitoEventResources(event: SamFunctionEvent): Record<string, SimCfnTemplateValue>;
+/**
+ * The change a `Cognito` event makes to the user pool the template already
+ * declares.
+ *
+ * A trigger is a property of the pool, so this is the second event type with
+ * no Resource of its own to be.
+ */
+export declare function samCognitoEventEdits(event: SamFunctionEvent): readonly SamResourceEdit[];