@kensio/yulin 1.21.22 → 1.21.24

package/dist/service/wafv2/managed/sim-waf-managed-group-statement.js

@@ -1,6 +1,7 @@
 import { compileSimWafStatement } from "../statement/sim-waf-statement.js";
-import { SimWafAction } from "../web-acl/sim-waf-action.js";
 import { requiredSimWafManagedRuleGroup, simWafGroupCountsEverything, } from "./sim-waf-managed-group-input.js";
+import { simWafDeclaredGroupLabels } from "./sim-waf-managed-declaration.js";
+import { simWafAddGroupLabels, simWafManagedRuleActions, } from "./sim-waf-managed-rule-actions.js";
 import { simWafManagedRuleOverrides } from "./sim-waf-managed-rule-overrides.js";
 import { simWafManagedRequestParts } from "./sim-waf-managed-request.js";
 /**
@@ -20,8 +21,11 @@ import { simWafManagedRequestParts } from "./sim-waf-managed-request.js";
 export function compileSimWafManagedRuleGroup(properties) {
     const { statement, ruleName, scope } = properties;
     const group = requiredSimWafManagedRuleGroup(statement, ruleName);
-    const overrides = simWafManagedRuleOverrides(statement, group, ruleName, scope.customResponseBodies);
-    const counting = simWafGroupCountsEverything(properties.overrideAction, ruleName);
+    const actions = simWafManagedRuleActions({
+        ruleName,
+        overrides: simWafManagedRuleOverrides(statement, group, ruleName, scope.customResponseBodies),
+        counting: simWafGroupCountsEverything(properties.overrideAction, ruleName),
+    });
     const scopeDown = statement.ScopeDownStatement === undefined
         ? undefined
         : compileSimWafStatement(statement.ScopeDownStatement, {
@@ -29,10 +33,6 @@ export function compileSimWafManagedRuleGroup(properties) {
             clock: scope.clock,
             ruleName,
         });
-    // Every rule in the three simulated groups blocks by default, and a group
-    // that is counting counts whatever the rule that matched was set to.
-    const blocking = SimWafAction.read({ Block: {} }, ruleName, {});
-    const counted = SimWafAction.read({ Count: {} }, ruleName, {});
     const { managedRules } = scope;
     return (request) => {
         // A scope-down statement decides whether the group sees the request at
@@ -41,21 +41,23 @@ export function compileSimWafManagedRuleGroup(properties) {
             return undefined;
         }
         const parts = simWafManagedRequestParts(request);
-        const declared = managedRules.declaredMatches(request);
+        const declared = managedRules.declared(request);
         let matched = false;
+        simWafAddGroupLabels(request, group, simWafDeclaredGroupLabels(declared, group.name));
         for (const rule of group.rules) {
-            if (!declared.has(rule.name) && rule.detects?.(parts) !== true) {
+            if (!declared.matches.has(rule.name) && rule.detects?.(parts) !== true) {
                 continue;
             }
-            request.labels.add(`${group.labelNamespace}:${rule.label}`);
-            const action = counting
-                ? counted
-                : (overrides.get(rule.name) ?? blocking);
+            simWafAddGroupLabels(request, group, [
+                rule.label,
+                ...(rule.labels ?? []),
+            ]);
+            const action = actions.of(rule);
             if (action.isTerminating) {
                 return action;
             }
             matched = true;
         }
-        return matched ? counted : undefined;
+        return matched ? actions.counted : undefined;
     };
 }

package/dist/service/wafv2/managed/sim-waf-managed-group.type.d.ts

@@ -3,8 +3,8 @@ import type { SimWafActionInput } from "../web-acl/sim-waf-action.type.js";
 /**
  * Minimal structural WAFv2 ManagedRuleGroupStatement.
  *
- * The members Yulin refuses are declared here rather than left out, so a
- * statement that names one is refused by name.
+ * The members Yulin does not simulate are declared here rather than left out,
+ * so a rule whose statement names one is held and reported by name.
  *
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/wafv2/Interface/ManagedRuleGroupStatement/
  */

package/dist/service/wafv2/managed/sim-waf-managed-rule-actions.d.ts

@@ -0,0 +1,30 @@
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import { SimWafAction } from "../web-acl/sim-waf-action.js";
+import type { SimWafManagedRuleDefinition, SimWafManagedRuleGroupDefinition } from "./sim-waf-managed-rule.type.js";
+interface SimWafManagedRuleActionsProperties {
+    readonly ruleName: string;
+    readonly overrides: ReadonlyMap<string, SimWafAction>;
+    readonly counting: boolean;
+}
+/**
+ * What each rule of one managed rule group does to a request it claims.
+ */
+export interface SimWafManagedRuleActions {
+    /** The action one rule of the group takes. */
+    of(rule: SimWafManagedRuleDefinition): SimWafAction;
+    /** The action a group answers with when its rules only counted. */
+    readonly counted: SimWafAction;
+}
+/**
+ * Settle what the rules of a group do, where the rule naming it is compiled.
+ *
+ * A rule takes its own default (`Block`, or `Count` for the few AWS ships
+ * counting), an action override replaces that, and a group counting as a
+ * whole counts whatever its rules were set to.
+ */
+export declare function simWafManagedRuleActions(properties: SimWafManagedRuleActionsProperties): SimWafManagedRuleActions;
+/**
+ * Add labels to a request within a group's namespace.
+ */
+export declare function simWafAddGroupLabels(request: SimWafInspectedRequest, group: SimWafManagedRuleGroupDefinition, labels: readonly string[]): void;
+export {};

package/dist/service/wafv2/managed/sim-waf-managed-rule-actions.js

@@ -0,0 +1,26 @@
+import { SimWafAction } from "../web-acl/sim-waf-action.js";
+/**
+ * Settle what the rules of a group do, where the rule naming it is compiled.
+ *
+ * A rule takes its own default (`Block`, or `Count` for the few AWS ships
+ * counting), an action override replaces that, and a group counting as a
+ * whole counts whatever its rules were set to.
+ */
+export function simWafManagedRuleActions(properties) {
+    const { ruleName, overrides, counting } = properties;
+    const blocking = SimWafAction.read({ Block: {} }, ruleName, {});
+    const counted = SimWafAction.read({ Count: {} }, ruleName, {});
+    const ownAction = (rule) => rule.counts === true ? counted : blocking;
+    return {
+        of: (rule) => counting ? counted : (overrides.get(rule.name) ?? ownAction(rule)),
+        counted,
+    };
+}
+/**
+ * Add labels to a request within a group's namespace.
+ */
+export function simWafAddGroupLabels(request, group, labels) {
+    for (const label of labels) {
+        request.labels.add(`${group.labelNamespace}:${label}`);
+    }
+}

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.d.ts

@@ -2,8 +2,9 @@ import type { SimWafManagedRuleDefinition, SimWafManagedRuleGroupDefinition } fr
 /**
  * The vendor the simulated managed rule groups belong to.
  *
- * A group from any other vendor is refused, marketplace groups included: a
- * subscription buys rules nobody outside the vendor has ever seen.
+ * A rule naming a group from any other vendor is held unevaluated,
+ * marketplace groups included: a subscription buys rules nobody outside the
+ * vendor has ever seen.
  */
 export declare const simWafManagedVendorName = "AWS";
 /**
@@ -18,7 +19,8 @@ export interface SimWafManagedRuleEntry {
  */
 export declare function findSimWafManagedRuleGroup(vendorName: string | undefined, name: string | undefined): SimWafManagedRuleGroupDefinition | undefined;
 /**
- * The groups that are simulated, named as a refusal names them.
+ * The groups that are simulated, named as an unsimulated group's reason names
+ * them.
  */
 export declare function simWafManagedRuleGroupNames(): readonly string[];
 /**

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.js

@@ -1,17 +1,23 @@
 import { simWafAdminProtectionRuleSet } from "./group/sim-waf-admin-protection.js";
+import { simWafBotControlRuleSet } from "./group/sim-waf-bot-control.js";
 import { simWafCommonRuleSet } from "./group/sim-waf-common-rule-set.js";
+import { simWafAnonymousIpList, simWafIpReputationList, } from "./group/sim-waf-ip-reputation.js";
 import { simWafKnownBadInputsRuleSet } from "./group/sim-waf-known-bad-inputs.js";
 /**
  * The vendor the simulated managed rule groups belong to.
  *
- * A group from any other vendor is refused, marketplace groups included: a
- * subscription buys rules nobody outside the vendor has ever seen.
+ * A rule naming a group from any other vendor is held unevaluated,
+ * marketplace groups included: a subscription buys rules nobody outside the
+ * vendor has ever seen.
  */
 export const simWafManagedVendorName = "AWS";
 const groups = [
     simWafCommonRuleSet,
     simWafKnownBadInputsRuleSet,
     simWafAdminProtectionRuleSet,
+    simWafIpReputationList,
+    simWafAnonymousIpList,
+    simWafBotControlRuleSet,
 ];
 const byName = new Map(groups.map((group) => [group.name, group]));
 const rulesByName = new Map(groups.flatMap((group) => group.rules.map((rule) => [rule.name, { group, rule }])));
@@ -24,7 +30,8 @@ export function findSimWafManagedRuleGroup(vendorName, name) {
         : undefined;
 }
 /**
- * The groups that are simulated, named as a refusal names them.
+ * The groups that are simulated, named as an unsimulated group's reason names
+ * them.
  */
 export function simWafManagedRuleGroupNames() {
     return groups.map((group) => group.name);

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.d.ts

@@ -23,14 +23,23 @@ export type SimWafManagedDetector = (parts: SimWafManagedRequestParts) => boolea
 /**
  * One rule of an AWS managed rule group.
  *
- * Every rule in the three simulated groups blocks by default, so the action is
- * not carried here. A rule with no detector is a declared-only rule.
+ * A rule blocks by default unless it says it counts. A rule with no detector
+ * is a declared-only rule.
  */
 export interface SimWafManagedRuleDefinition {
     /** The rule name, as AWS names it and as an override names it. */
     readonly name: string;
     /** The label this rule adds, within its group's namespace. */
     readonly label: string;
+    /**
+     * The labels the rule adds beside its own, within its group's namespace.
+     *
+     * A Bot Control rule labels the bot category or the signal it found as well
+     * as itself.
+     */
+    readonly labels?: readonly string[] | undefined;
+    /** Whether the rule counts by default where most rules block. */
+    readonly counts?: boolean | undefined;
     readonly tier: SimWafManagedRuleTier;
     readonly detects?: SimWafManagedDetector | undefined;
 }

package/dist/service/wafv2/managed/sim-waf-managed-rules.d.ts

@@ -1,13 +1,8 @@
 import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
 import { type SimWafManagedRuleReport } from "./sim-waf-managed-rule-report.js";
 import type { SimWafManagedRuleTier } from "./sim-waf-managed-rule.type.js";
-/**
- * The managed rules a test says claim a request.
- */
-export interface SimWafManagedMatchDeclaration {
-    /** The rules that claim the request, by the name AWS gives them. */
-    readonly matches: readonly string[];
-}
+import { type SimWafDeclared, type SimWafManagedMatchDeclaration } from "./sim-waf-managed-declaration.js";
+export type { SimWafDeclared, SimWafManagedMatchDeclaration, } from "./sim-waf-managed-declaration.js";
 /**
  * The managed rule matches this simulated WAFv2 answers with, and what it
  * covers of each rule.
@@ -24,6 +19,15 @@ export interface SimWafManagedMatchDeclaration {
  * });
  * ```
  *
+ * Bot Control is declared by the bot rather than the rule, since a verified
+ * bot is labelled and matches no rule:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onRequest("/search", {
+ *   bot: { category: "search_engine", name: "googlebot", verified: true },
+ * });
+ * ```
+ *
  * A declared match is a match, and everything after it is what the group would
  * have done anyway: the rule adds its label, an action override applies to it,
  * and the group blocks by that rule.
@@ -39,9 +43,10 @@ export declare class SimWafManagedRules {
      */
     onRequest(uriPath: string, declaration: SimWafManagedMatchDeclaration): void;
     /**
-     * The rules declared to claim one request.
+     * What a test declared about one request: the rules that claim it, and the
+     * labels a group adds to it whatever its rules decide.
      */
-    declaredMatches(request: SimWafInspectedRequest): ReadonlySet<string>;
+    declared(request: SimWafInspectedRequest): SimWafDeclared;
     /**
      * What this simulation covers of one managed rule.
      */

package/dist/service/wafv2/managed/sim-waf-managed-rules.js

@@ -1,7 +1,7 @@
 import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
 import { findSimWafManagedRule, } from "./sim-waf-managed-rule-groups.js";
 import { simWafManagedRuleReports, } from "./sim-waf-managed-rule-report.js";
-const noMatches = new Set();
+import { simWafNothingDeclared, simWafReadDeclaration, } from "./sim-waf-managed-declaration.js";
 /**
  * The managed rule matches this simulated WAFv2 answers with, and what it
  * covers of each rule.
@@ -18,6 +18,15 @@ const noMatches = new Set();
  * });
  * ```
  *
+ * Bot Control is declared by the bot rather than the rule, since a verified
+ * bot is labelled and matches no rule:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onRequest("/search", {
+ *   bot: { category: "search_engine", name: "googlebot", verified: true },
+ * });
+ * ```
+ *
  * A declared match is a match, and everything after it is what the group would
  * have done anyway: the rule adds its label, an action override applies to it,
  * and the group blocks by that rule.
@@ -36,13 +45,14 @@ export class SimWafManagedRules {
             throw new SimWafDeclarationError("A declared managed rule match needs the URI path of the request it " +
                 "is declared for");
         }
-        this.#byUriPath.set(uriPath, new Set(declaration.matches.map((name) => this.requiredRule(name).rule.name)));
+        this.#byUriPath.set(uriPath, simWafReadDeclaration(declaration, (name) => this.requiredRule(name).rule.name));
     }
     /**
-     * The rules declared to claim one request.
+     * What a test declared about one request: the rules that claim it, and the
+     * labels a group adds to it whatever its rules decide.
      */
-    declaredMatches(request) {
-        return this.#byUriPath.get(request.uriPath) ?? noMatches;
+    declared(request) {
+        return this.#byUriPath.get(request.uriPath) ?? simWafNothingDeclared;
     }
     /**
      * What this simulation covers of one managed rule.

package/dist/service/wafv2/resource/sim-waf-resource.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import { type SimWafResourceKind } from "../sim-wafv2-arn.js";
 import type { SimWafScope } from "../scope/sim-waf-scope.js";
+import { type SimWafUnsimulatedPart } from "./sim-waf-unsimulated-part.js";
 /**
  * What every WAFv2 resource reports about itself in a listing.
  */
@@ -16,6 +17,7 @@ export interface SimWafResourceProperties {
     readonly scope: SimWafScope;
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly description?: string | undefined;
+    readonly tags?: readonly unknown[] | undefined;
 }
 /**
  * What a web ACL, an IP set and a regex pattern set have in common.
@@ -32,11 +34,19 @@ export declare abstract class SimWafResource {
     readonly scope: SimWafScope;
     readonly id: string;
     readonly arn: string;
+    /** The tags the resource was created with, held as they were written. */
+    readonly tags: readonly unknown[];
     protected constructor(kind: SimWafResourceKind, properties: SimWafResourceProperties);
     /**
      * What the resource was created or last updated with as its description.
      */
     get description(): string | undefined;
+    /**
+     * What this resource was written with and the simulation does not act on.
+     *
+     * A web ACL adds the rules and members it holds without evaluating.
+     */
+    get unsimulated(): readonly SimWafUnsimulatedPart[];
     /**
      * The token the next write to this resource has to present.
      */

package/dist/service/wafv2/resource/sim-waf-resource.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { SimWafOptimisticLockException } from "../error/sim-wafv2.error.js";
 import { simWafArn } from "../sim-wafv2-arn.js";
+import { simWafTagsParts, } from "./sim-waf-unsimulated-part.js";
 /**
  * What a web ACL, an IP set and a regex pattern set have in common.
  *
@@ -15,12 +16,15 @@ export class SimWafResource {
     scope;
     id = randomUUID();
     arn;
+    /** The tags the resource was created with, held as they were written. */
+    tags;
     #description;
     #lockToken = randomUUID();
     constructor(kind, properties) {
         this.name = properties.name;
         this.scope = properties.scope;
         this.#description = properties.description;
+        this.tags = properties.tags ?? [];
         this.arn = simWafArn({
             accountRegionScope: properties.accountRegionScope,
             scope: properties.scope,
@@ -35,6 +39,14 @@ export class SimWafResource {
     get description() {
         return this.#description;
     }
+    /**
+     * What this resource was written with and the simulation does not act on.
+     *
+     * A web ACL adds the rules and members it holds without evaluating.
+     */
+    get unsimulated() {
+        return simWafTagsParts(this.tags);
+    }
     /**
      * The token the next write to this resource has to present.
      */

package/dist/service/wafv2/resource/sim-waf-unsimulated-part.d.ts

@@ -0,0 +1,24 @@
+/**
+ * One part of a WAFv2 write this simulation holds and does not act on.
+ *
+ * A write carrying something Yulin does not simulate is accepted, and the read
+ * that follows returns it as written. What the simulation leaves out is
+ * reported here instead, so a test can find out how far the resource it wrote
+ * is from the one AWS would run.
+ */
+export interface SimWafUnsimulatedPart {
+    /**
+     * Where the part sits in what was written.
+     *
+     * A rule is `Rules.<rule name>`, a web ACL member is its own name, and a body
+     * inspection limit is `AssociationConfig.RequestBody.<resource type>`. These
+     * are the names a CloudFormation Resource records them under.
+     */
+    readonly part: string;
+    /** Why the simulation does not act on it. */
+    readonly reason: string;
+}
+/**
+ * What a resource's tags leave out, which is nothing when it has none.
+ */
+export declare function simWafTagsParts(tags: readonly unknown[]): readonly SimWafUnsimulatedPart[];

package/dist/service/wafv2/resource/sim-waf-unsimulated-part.js

@@ -0,0 +1,8 @@
+const tagsReason = "the tags are held and nothing reads them, since ListTagsForResource is " +
+    "not simulated";
+/**
+ * What a resource's tags leave out, which is nothing when it has none.
+ */
+export function simWafTagsParts(tags) {
+    return tags.length === 0 ? [] : [{ part: "Tags", reason: tagsReason }];
+}

package/dist/service/wafv2/sim-wafv2.d.ts

@@ -8,12 +8,11 @@ import type { SimWafIpSet } from "./ip-set/sim-waf-ip-set.js";
 import type { SimWafManagedRules } from "./managed/sim-waf-managed-rules.js";
 import type { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern-set.js";
 import type { SimWafScope } from "./scope/sim-waf-scope.js";
+import type { SimWafUnsimulatedPart } from "./resource/sim-waf-unsimulated-part.js";
 import { type SimWafV2Properties } from "./sim-wafv2-commands.js";
 import { SimWafCfnResourceFactory } from "./cfn/sim-waf-cfn-resource-factory.js";
 import { SimWafSets } from "./sim-wafv2-sets.js";
 import type { SimWafWebAcl } from "./web-acl/sim-waf-web-acl.js";
-import { type SimWafUnevaluatableRule } from "./web-acl/sim-waf-unevaluatable-rules.js";
-import type { SimWafWebAclWriteInput } from "./command/web-acl/web-acl.command.js";
 export type { SimWafEvaluationRequest } from "./evaluate/sim-waf-evaluation-request.js";
 /**
  * Simulated AWS WAFv2. Handles SDK commands. Emulates AWS behaviour and state.
@@ -71,6 +70,13 @@ export declare class SimWafV2 extends SimWafSets {
      * compiled against, since a reference carries the ARN and nothing else.
      */
     findRegexPatternSetByArn(regexPatternSetArn: string): SimWafRegexPatternSet | undefined;
+    /**
+     * What a web ACL holds and this simulation does not act on, each part with
+     * its reason: a rule that claims no request (`Rules.<rule name>`), a member
+     * such as `CaptchaConfig`, a body inspection limit, the tags, and an
+     * association nothing is evaluated through (`Association.<resource ARN>`).
+     */
+    unsimulatedParts(webAclArn: string): readonly SimWafUnsimulatedPart[];
     /**
      * Evaluate one HTTP request against a web ACL's rules.
      *
@@ -89,16 +95,6 @@ export declare class SimWafV2 extends SimWafSets {
      * nothing here, and `rules()` reports what is covered of each.
      */
     managedRules(): SimWafManagedRules;
-    /**
-     * The rules of a web ACL input this simulation cannot evaluate.
-     *
-     * The simulator's own accessor rather than a WAFv2 operation. `CreateWebACL`
-     * refuses a web ACL carrying such a rule, because a web ACL that accepted
-     * one would allow a request AWS blocks. A template is deployed rule by rule
-     * instead, so the CloudFormation layer asks this first and leaves the rules
-     * it names out of the web ACL it writes.
-     */
-    unevaluatableWebAclRules(input: SimWafWebAclWriteInput): readonly SimWafUnevaluatableRule[];
     /**
      * Handle a CreateWebACL Command from the SDK.
      */
@@ -147,4 +143,8 @@ export declare class SimWafV2 extends SimWafSets {
      * Get this service's SDK Command router for SDK client interception.
      */
     sdkCommandRouter(): SimSdkCommandRouter;
+    /**
+     * Find a web ACL by its ARN, refusing one that is not here.
+     */
+    private requireWebAcl;
 }

package/dist/service/wafv2/sim-wafv2.fixture.d.ts

@@ -1,5 +1,6 @@
-import type { SimCreateWebAclCommandInput, SimWafSummaryOutput } from "./command/web-acl/web-acl.command.js";
+import type { SimCreateWebAclCommandInput, SimWafSummaryOutput, SimWafWebAclOutput } from "./command/web-acl/web-acl.command.js";
 import type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
+import type { SimWafUnsimulatedPart } from "./resource/sim-waf-unsimulated-part.js";
 import type { SimWafStatementInput } from "./statement/sim-waf-statement.type.js";
 import type { SimWafRuleInput } from "./web-acl/sim-waf-rule.type.js";
 import type { SimWafV2 } from "./sim-wafv2.js";
@@ -47,3 +48,20 @@ export declare function simWafWebAclDecisions(simWaf: SimWafV2, rules: readonly
  * makes its requests with this.
  */
 export declare function simWafBrowserRequest(url: string, init?: RequestInit): Request;
+/**
+ * A web ACL as GetWebACL reads it back, what the simulation says it left out
+ * of it, and what it decided about an ordinary request.
+ */
+export interface SimWafHeld {
+    readonly webAcl: SimWafWebAclOutput;
+    readonly parts: readonly SimWafUnsimulatedPart[];
+    readonly blocked: boolean;
+}
+/**
+ * Create a web ACL, read it back, and put one request through it.
+ */
+export declare function simWafHeldWebAcl(simWaf: SimWafV2, webAcl: Partial<SimCreateWebAclCommandInput>): Promise<SimWafHeld>;
+/**
+ * The reason the simulation gives for leaving out one part.
+ */
+export declare function simWafUnsimulatedReason(parts: readonly SimWafUnsimulatedPart[], part: string): string;

package/dist/service/wafv2/sim-wafv2.fixture.js

@@ -60,3 +60,32 @@ export function simWafBrowserRequest(url, init = {}) {
     return new Request(url, { ...init, headers });
 }
 const browserUserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36";
+/**
+ * Create a web ACL, read it back, and put one request through it.
+ */
+export async function simWafHeldWebAcl(simWaf, webAcl) {
+    const created = await createSimWafWebAcl(simWaf, {
+        ...simWafCreateWebAclFactory.make(),
+        ...webAcl,
+    });
+    const read = await simWaf.getWebAcl({
+        input: { Name: created.Name, Scope: "REGIONAL", Id: created.Id },
+    });
+    assertDefined(read.WebACL, "Simulated WAFv2 read back no web ACL");
+    return {
+        webAcl: read.WebACL,
+        parts: simWaf.unsimulatedParts(created.ARN),
+        blocked: simWaf.evaluateRequest({
+            webAclArn: created.ARN,
+            request: new Request("https://example.com/search"),
+        }).action === "BLOCK",
+    };
+}
+/**
+ * The reason the simulation gives for leaving out one part.
+ */
+export function simWafUnsimulatedReason(parts, part) {
+    const found = parts.find((candidate) => candidate.part === part);
+    assertDefined(found, `Simulated WAFv2 reported no unsimulated part ${part}`);
+    return found.reason;
+}

package/dist/service/wafv2/sim-wafv2.js

@@ -4,7 +4,6 @@ import { SimWafSdkCommandRouter } from "./sdk/sim-wafv2-sdk-command-router.js";
 import { SimWafCommands, } from "./sim-wafv2-commands.js";
 import { SimWafCfnResourceFactory } from "./cfn/sim-waf-cfn-resource-factory.js";
 import { SimWafSets } from "./sim-wafv2-sets.js";
-import { unevaluatableSimWafRules, } from "./web-acl/sim-waf-unevaluatable-rules.js";
 /**
  * Simulated AWS WAFv2. Handles SDK commands. Emulates AWS behaviour and state.
  *
@@ -74,6 +73,19 @@ export class SimWafV2 extends SimWafSets {
     findRegexPatternSetByArn(regexPatternSetArn) {
         return this.commands.regexPatternSets.findByArn(regexPatternSetArn);
     }
+    /**
+     * What a web ACL holds and this simulation does not act on, each part with
+     * its reason: a rule that claims no request (`Rules.<rule name>`), a member
+     * such as `CaptchaConfig`, a body inspection limit, the tags, and an
+     * association nothing is evaluated through (`Association.<resource ARN>`).
+     */
+    unsimulatedParts(webAclArn) {
+        const webAcl = this.requireWebAcl(webAclArn);
+        return [
+            ...webAcl.unsimulated,
+            ...this.commands.associations.unsimulatedFor(webAcl),
+        ];
+    }
     /**
      * Evaluate one HTTP request against a web ACL's rules.
      *
@@ -84,11 +96,7 @@ export class SimWafV2 extends SimWafSets {
      * front of.
      */
     evaluateRequest(evaluation) {
-        const webAcl = this.findWebAclByArn(evaluation.webAclArn);
-        if (webAcl === undefined) {
-            throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource ` +
-                `doesn't exist: web ACL ${evaluation.webAclArn}.`);
-        }
+        const webAcl = this.requireWebAcl(evaluation.webAclArn);
         const limitBytes = webAcl.bodyInspectionLimitBytes(evaluation.resourceType);
         return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body, limitBytes));
     }
@@ -102,23 +110,6 @@ export class SimWafV2 extends SimWafSets {
     managedRules() {
         return this.commands.managedRules;
     }
-    /**
-     * The rules of a web ACL input this simulation cannot evaluate.
-     *
-     * The simulator's own accessor rather than a WAFv2 operation. `CreateWebACL`
-     * refuses a web ACL carrying such a rule, because a web ACL that accepted
-     * one would allow a request AWS blocks. A template is deployed rule by rule
-     * instead, so the CloudFormation layer asks this first and leaves the rules
-     * it names out of the web ACL it writes.
-     */
-    unevaluatableWebAclRules(input) {
-        return unevaluatableSimWafRules(input.Rules, {
-            regexPatternSets: this.commands.regexPatternSets,
-            managedRules: this.commands.managedRules,
-            clock: this.commands.background,
-            customResponseBodies: input.CustomResponseBodies ?? {},
-        });
-    }
     /**
      * Handle a CreateWebACL Command from the SDK.
      */
@@ -201,4 +192,15 @@ export class SimWafV2 extends SimWafSets {
     sdkCommandRouter() {
         return this.#sdkRouter;
     }
+    /**
+     * Find a web ACL by its ARN, refusing one that is not here.
+     */
+    requireWebAcl(webAclArn) {
+        const webAcl = this.findWebAclByArn(webAclArn);
+        if (webAcl === undefined) {
+            throw new SimWafNonexistentItemException(`AWS WAF couldn't perform the operation because your resource ` +
+                `doesn't exist: web ACL ${webAclArn}.`);
+        }
+        return webAcl;
+    }
 }

package/dist/service/wafv2/statement/sim-waf-field-to-match.type.d.ts

@@ -4,8 +4,8 @@ import type { SimWafMatchPatternInput } from "./sim-waf-match-pattern.js";
  * shape.
  *
  * The members Yulin does not simulate are declared here rather than left out,
- * so a rule that names one is refused by name instead of being read as a rule
- * with no field at all.
+ * so a rule that names one is held and reported by name instead of being read
+ * as a rule with no field at all.
  */
 export interface SimWafFieldToMatchInput {
     readonly UriPath?: unknown;

package/dist/service/wafv2/statement/sim-waf-rule-refusals.d.ts

@@ -1,10 +1,12 @@
 /**
- * Refuse something in a rule that real WAFv2 takes and this simulation does
+ * Stop compiling a rule at something real WAFv2 takes and this simulation does
  * not.
  *
- * Every refusal names the rule and what in it was refused, because a web ACL
- * is a list of rules that all look alike from the outside and the name is the
- * only thing that says which one to go and look at.
+ * `SimWafRule.compile` catches it and holds the rule unevaluated, with this
+ * message as the reason the web ACL reports. The message names the rule and
+ * what in it was left out, because a web ACL is a list of rules that all look
+ * alike from the outside and the name is the only thing that says which one to
+ * go and look at.
  */
 export declare function refuseSimWafRuleInput(ruleName: string, refused: string, reason: string): never;
 /**