@kensio/yulin 1.21.23 → 1.21.24

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js

@@ -1,3 +1,4 @@
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The resources of one simulated AWS instance a web ACL can be put in front
  * of.
@@ -19,6 +20,9 @@ export class SimAwsWafProtectedResources {
      * Whether the resource an ARN names is one this scope holds.
      */
     has(resource) {
+        if (resource instanceof SimWafUnsimulatedResource) {
+            return true;
+        }
         if (resource.resourceType === "COGNITO_USER_POOL") {
             return this.hasUserPool(resource);
         }

package/dist/service/wafv2/association/sim-waf-associations.d.ts

@@ -1,4 +1,5 @@
 import type { SimWafDecision } from "../evaluate/sim-waf-decision.js";
+import type { SimWafUnsimulatedPart } from "../resource/sim-waf-unsimulated-part.js";
 import type { SimWafWebAcl } from "../web-acl/sim-waf-web-acl.js";
 import type { SimWafProtectedResource, SimWafProtectedResourceType } from "./sim-waf-protected-resource.js";
 import type { SimWafProtectedRequest, SimWafProtection } from "./sim-waf-protection.js";
@@ -32,6 +33,11 @@ export declare class SimWafAssociations implements SimWafProtection {
      * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
      */
     resourceArnsFor(webAcl: SimWafWebAcl, resourceType?: SimWafProtectedResourceType): readonly string[];
+    /**
+     * The associations of one web ACL that nothing is evaluated through, one
+     * part per resource ARN.
+     */
+    unsimulatedFor(webAcl: SimWafWebAcl): readonly SimWafUnsimulatedPart[];
     /**
      * Whether a web ACL is in front of one resource.
      */

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -1,4 +1,5 @@
 import { simWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The web ACLs one Account and Region has in front of things.
  *
@@ -19,6 +20,9 @@ export class SimWafAssociations {
         this.#associations.set(resource.arn, {
             webAcl,
             resourceType: resource.resourceType,
+            unsimulatedReason: resource instanceof SimWafUnsimulatedResource
+                ? resource.reason
+                : undefined,
         });
     }
     /**
@@ -44,6 +48,19 @@ export class SimWafAssociations {
             .map(([resourceArn]) => resourceArn)
             .toArray();
     }
+    /**
+     * The associations of one web ACL that nothing is evaluated through, one
+     * part per resource ARN.
+     */
+    unsimulatedFor(webAcl) {
+        return this.#associations
+            .entries()
+            .filter(([, association]) => association.webAcl === webAcl)
+            .flatMap(([resourceArn, { unsimulatedReason }]) => unsimulatedReason === undefined
+            ? []
+            : [{ part: `Association.${resourceArn}`, reason: unsimulatedReason }])
+            .toArray();
+    }
     /**
      * Whether a web ACL is in front of one resource.
      */

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts

@@ -1,13 +1,16 @@
 import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 import { SimWafUserPool } from "./sim-waf-user-pool.js";
 /**
  * A resource a `REGIONAL` web ACL can be put in front of.
  *
- * Two types are simulated. A third one joins this union and the reader below
- * gains a branch for it, and everything that holds an association goes on
+ * Requests reach a web ACL through two types here. The rest are held as
+ * `SimWafUnsimulatedResource`, associated and listed, with nothing evaluated
+ * in front of them. A type that starts serving requests gets a class of its
+ * own in this union, and everything that holds an association goes on
  * addressing a resource by its ARN.
  */
-export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool;
+export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool | SimWafUnsimulatedResource;
 /**
  * The type ListResourcesForWebACL lists one simulated resource under.
  */
@@ -21,17 +24,19 @@ export declare const simWafApiGatewayResourceType = "API_GATEWAY";
  */
 export declare const simWafUserPoolResourceType = "COGNITO_USER_POOL";
 /**
- * The resource types this simulation holds, as a refusal names them.
+ * The resource types ListResourcesForWebACL lists, which are all the types
+ * an association can hold.
  */
 export declare const simWafProtectedResourceTypes: readonly SimWafProtectedResourceType[];
 /**
  * Read the resource an association names, refusing anything a web ACL cannot
- * be put in front of here.
+ * be put in front of.
  *
  * The three refusals mean different things. An HTTP API stage is refused
  * because AWS WAF protects no HTTP API, so an association accepted here would
- * let a test cover protection AWS never applies. A load balancer and the rest
- * are resource types AWS does protect and this simulation does not, which is
- * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ * let a test cover protection AWS never applies. An Amplify app takes a
+ * `CLOUDFRONT` web ACL from `us-east-1` for an app in any Region, and a WAFv2
+ * here reaches web ACLs in its own Region only. Anything else is not a
+ * resource ARN.
  */
 export declare function simWafProtectedResource(arn: string): SimWafProtectedResource;

package/dist/service/wafv2/association/sim-waf-protected-resource.js

@@ -1,5 +1,6 @@
 import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
 import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUnsimulatedResource, simWafUnsimulatedResourceTypes, } from "./sim-waf-unsimulated-resource.js";
 import { SimWafUserPool } from "./sim-waf-user-pool.js";
 /**
  * The type ListResourcesForWebACL lists a simulated REST API stage under.
@@ -10,32 +11,28 @@ export const simWafApiGatewayResourceType = "API_GATEWAY";
  */
 export const simWafUserPoolResourceType = "COGNITO_USER_POOL";
 /**
- * The resource types this simulation holds, as a refusal names them.
+ * The resource types ListResourcesForWebACL lists, which are all the types
+ * an association can hold.
  */
-export const simWafProtectedResourceTypes = [simWafApiGatewayResourceType, simWafUserPoolResourceType];
+export const simWafProtectedResourceTypes = [
+    simWafApiGatewayResourceType,
+    simWafUserPoolResourceType,
+    ...simWafUnsimulatedResourceTypes,
+];
 const restApiStagePattern = /^arn:aws:apigateway:(?<regionName>[^:]+)::\/restapis\/(?<restApiId>[^/]+)\/stages\/(?<stageName>[^/]+)$/u;
 const httpApiStagePattern = /^arn:aws:apigateway:[^:]+::\/apis\/[^/]+\/stages\/[^/]+$/u;
 const userPoolPattern = /^arn:aws:cognito-idp:(?<regionName>[^:]+):(?<accountId>[^:]+):userpool\/(?<userPoolId>[^/]+)$/u;
-/**
- * The resource types real WAF protects that this simulation does not, by the
- * service in their ARN.
- */
-const unsimulatedResources = new Map([
-    ["elasticloadbalancing", "an Application Load Balancer"],
-    ["appsync", "an AppSync GraphQL API"],
-    ["apprunner", "an App Runner service"],
-    ["amplify", "an Amplify app"],
-    ["ec2", "a Verified Access instance"],
-]);
+const amplifyAppPattern = /^arn:aws:amplify:[^:]+:[^:]+:apps\/[^/]+$/u;
 /**
  * Read the resource an association names, refusing anything a web ACL cannot
- * be put in front of here.
+ * be put in front of.
  *
  * The three refusals mean different things. An HTTP API stage is refused
  * because AWS WAF protects no HTTP API, so an association accepted here would
- * let a test cover protection AWS never applies. A load balancer and the rest
- * are resource types AWS does protect and this simulation does not, which is
- * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ * let a test cover protection AWS never applies. An Amplify app takes a
+ * `CLOUDFRONT` web ACL from `us-east-1` for an app in any Region, and a WAFv2
+ * here reaches web ACLs in its own Region only. Anything else is not a
+ * resource ARN.
  */
 export function simWafProtectedResource(arn) {
     const stage = restApiStage(arn);
@@ -46,6 +43,10 @@ export function simWafProtectedResource(arn) {
     if (userPool !== undefined) {
         return userPool;
     }
+    const unsimulated = SimWafUnsimulatedResource.read(arn);
+    if (unsimulated !== undefined) {
+        return unsimulated;
+    }
     if (httpApiStagePattern.test(arn)) {
         throw new SimWafInvalidParameterException(`AWS WAF does not protect an API Gateway HTTP API. The resource types ` +
             `it protects cover a REST API stage and not an HTTP API stage, so ` +
@@ -87,13 +88,12 @@ function simWafUserPool(arn) {
     });
 }
 /**
- * Refuse an ARN naming a resource type AWS WAF protects and Yulin does not.
+ * Refuse an Amplify app, whose web ACL is out of this WAFv2's reach.
  */
 function refuseUnsimulatedResource(arn) {
-    const described = unsimulatedResources.get(arn.split(":", 3)[2] ?? "");
-    if (described !== undefined) {
-        throw new SimWafUnsimulatedInputException(`AWS WAF protects ${described}, and Yulin does not simulate a web ACL ` +
-            `in front of one, so ${arn} is refused rather than protected by ` +
-            `nothing.`);
+    if (amplifyAppPattern.test(arn)) {
+        throw new SimWafUnsimulatedInputException(`AWS WAF protects an Amplify app with a CLOUDFRONT web ACL held in ` +
+            `us-east-1, and a simulated WAFv2 associates web ACLs of its own ` +
+            `Region only, so ${arn} is refused.`);
     }
 }

package/dist/service/wafv2/association/sim-waf-protected-resources.d.ts

@@ -9,20 +9,25 @@ import type { SimWafProtectedResource } from "./sim-waf-protected-resource.js";
 export interface SimWafProtectedResources {
     /**
      * Whether this simulation holds the resource an ARN names.
+     *
+     * A `SimWafUnsimulatedResource` is held by no simulated service, so there is
+     * nothing to look for, and it is taken as named.
      */
     has(resource: SimWafProtectedResource): boolean;
 }
 /**
  * The resources available to a WAFv2 with nothing around it to ask.
  *
- * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
- * web ACL with nothing at all. That is the safe answer: an association held
- * against a resource no request will ever reach protects nothing, and saying
- * so is better than reporting a web ACL in front of something imaginary.
+ * Every simulated resource ARN resolves to nothing, so a standalone simulated
+ * WAFv2 associates a web ACL with no stage or pool. That is the safe answer:
+ * an association held against a resource no request will ever reach protects
+ * nothing, and saying so is better than reporting a web ACL in front of
+ * something imaginary. A `SimWafUnsimulatedResource` is taken as named here
+ * as everywhere else.
  */
 export declare class SimWafNoProtectedResources implements SimWafProtectedResources {
     /**
-     * No resource is reachable here.
+     * Whether the resource is one no simulated service holds.
      */
-    has(): boolean;
+    has(resource: SimWafProtectedResource): boolean;
 }

package/dist/service/wafv2/association/sim-waf-protected-resources.js

@@ -1,16 +1,19 @@
+import { SimWafUnsimulatedResource } from "./sim-waf-unsimulated-resource.js";
 /**
  * The resources available to a WAFv2 with nothing around it to ask.
  *
- * Every ARN resolves to nothing, so a standalone simulated WAFv2 associates a
- * web ACL with nothing at all. That is the safe answer: an association held
- * against a resource no request will ever reach protects nothing, and saying
- * so is better than reporting a web ACL in front of something imaginary.
+ * Every simulated resource ARN resolves to nothing, so a standalone simulated
+ * WAFv2 associates a web ACL with no stage or pool. That is the safe answer:
+ * an association held against a resource no request will ever reach protects
+ * nothing, and saying so is better than reporting a web ACL in front of
+ * something imaginary. A `SimWafUnsimulatedResource` is taken as named here
+ * as everywhere else.
  */
 export class SimWafNoProtectedResources {
     /**
-     * No resource is reachable here.
+     * Whether the resource is one no simulated service holds.
      */
-    has() {
-        return false;
+    has(resource) {
+        return resource instanceof SimWafUnsimulatedResource;
     }
 }

package/dist/service/wafv2/association/sim-waf-unsimulated-resource.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The resource types AWS WAF protects that no simulated request passes
+ * through, as ListResourcesForWebACL lists them.
+ */
+export type SimWafUnsimulatedResourceType = "APPLICATION_LOAD_BALANCER" | "APPSYNC" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE";
+/**
+ * The types listed for a resource AWS WAF protects and Yulin does not.
+ */
+export declare const simWafUnsimulatedResourceTypes: readonly SimWafUnsimulatedResourceType[];
+/**
+ * A resource AWS WAF protects and no simulated request passes through.
+ *
+ * An association with one is held, and GetWebACLForResource and
+ * ListResourcesForWebACL report it. Nothing is evaluated in front of it,
+ * because nothing here serves a request through it. Whether the resource
+ * exists is not checked, since no simulated service holds it to ask.
+ */
+export declare class SimWafUnsimulatedResource {
+    readonly resourceType: SimWafUnsimulatedResourceType;
+    readonly arn: string;
+    readonly regionName: string;
+    readonly accountId: string;
+    /** Why the web ACL in front of this resource evaluates nothing. */
+    readonly reason: string;
+    private constructor();
+    /**
+     * The unsimulated resource an ARN names, or nothing when it names none.
+     *
+     * Every pattern places the Region and the Account where any ARN does, so a
+     * match is read for them by position.
+     */
+    static read(arn: string): SimWafUnsimulatedResource | undefined;
+}

package/dist/service/wafv2/association/sim-waf-unsimulated-resource.js

@@ -0,0 +1,66 @@
+/**
+ * The ARN shapes AWS documents for each of them.
+ */
+const kinds = [
+    {
+        resourceType: "APPLICATION_LOAD_BALANCER",
+        described: "an Application Load Balancer",
+        pattern: /^arn:aws:elasticloadbalancing:[^:]+:[^:]+:loadbalancer\/app\/[^/]+\/[^/]+$/u,
+    },
+    {
+        resourceType: "APPSYNC",
+        described: "an AppSync GraphQL API",
+        pattern: /^arn:aws:appsync:[^:]+:[^:]+:apis\/[^/]+$/u,
+    },
+    {
+        resourceType: "APP_RUNNER_SERVICE",
+        described: "an App Runner service",
+        pattern: /^arn:aws:apprunner:[^:]+:[^:]+:service\/[^/]+\/[^/]+$/u,
+    },
+    {
+        resourceType: "VERIFIED_ACCESS_INSTANCE",
+        described: "a Verified Access instance",
+        pattern: /^arn:aws:ec2:[^:]+:[^:]+:verified-access-instance\/[^/]+$/u,
+    },
+];
+/**
+ * The types listed for a resource AWS WAF protects and Yulin does not.
+ */
+export const simWafUnsimulatedResourceTypes = kinds.map((kind) => kind.resourceType);
+/**
+ * A resource AWS WAF protects and no simulated request passes through.
+ *
+ * An association with one is held, and GetWebACLForResource and
+ * ListResourcesForWebACL report it. Nothing is evaluated in front of it,
+ * because nothing here serves a request through it. Whether the resource
+ * exists is not checked, since no simulated service holds it to ask.
+ */
+export class SimWafUnsimulatedResource {
+    resourceType;
+    arn;
+    regionName;
+    accountId;
+    /** Why the web ACL in front of this resource evaluates nothing. */
+    reason;
+    constructor(arn, kind) {
+        const [regionName, accountId] = arn.split(":").slice(3, 5);
+        this.resourceType = kind.resourceType;
+        this.arn = arn;
+        this.regionName = String(regionName);
+        this.accountId = String(accountId);
+        this.reason =
+            `AWS WAF protects ${kind.described}, and no simulated request passes ` +
+                `through one, so the association with ${arn} is held and nothing in ` +
+                `front of it is evaluated`;
+    }
+    /**
+     * The unsimulated resource an ARN names, or nothing when it names none.
+     *
+     * Every pattern places the Region and the Account where any ARN does, so a
+     * match is read for them by position.
+     */
+    static read(arn) {
+        const kind = kinds.find((candidate) => candidate.pattern.test(arn));
+        return kind && new SimWafUnsimulatedResource(arn, kind);
+    }
+}

package/dist/service/wafv2/cfn/association/sim-cfn-waf-association-creator.js

@@ -1,3 +1,4 @@
+import { SimWafUnsimulatedResource } from "../../association/sim-waf-unsimulated-resource.js";
 import { SimWafUnavailableEntityException } from "../../error/sim-wafv2.error.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
 import { wafWebAclAssociationResourceType } from "../sim-cfn-waf-resource-types.js";
@@ -44,6 +45,10 @@ export class SimCfnWafAssociationCreator {
                     WebACLArn: association.webAclArn,
                 },
             }, options);
+            const unsimulated = SimWafUnsimulatedResource.read(association.resourceArn);
+            if (unsimulated !== undefined) {
+                resource.ignoreProperty("ResourceArn", unsimulated.reason);
+            }
             return association;
         });
     }

package/dist/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-config.js

@@ -20,6 +20,7 @@ export class SimCfnWafIpSetConfig extends SimCfnWafResourceConfig {
             Name: this.name(),
             Scope: this.scope(),
             Description: this.description(),
+            Tags: this.tags(),
             IPAddressVersion: this.text("IPAddressVersion"),
             Addresses: this.requiredStrings("Addresses"),
         };

package/dist/service/wafv2/cfn/ip-set/sim-cfn-waf-ip-set-creator.js

@@ -1,5 +1,6 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { simCfnWafRecordUnsimulated } from "../sim-cfn-waf-unsimulated.js";
 import { wafIpSetResourceType } from "../sim-cfn-waf-resource-types.js";
 import { SimCfnWafIpSetConfig } from "./sim-cfn-waf-ip-set-config.js";
 /**
@@ -29,6 +30,7 @@ export class SimCfnWafIpSetCreator {
             assertDefined(arn, `sim WAFv2 IP set ARN for CloudFormation Resource ${resource.logicalId}`);
             const ipSet = this.#wafV2.findIpSetByArn(arn);
             assertDefined(ipSet, `sim WAFv2 IP set ${arn} after CloudFormation creation`);
+            simCfnWafRecordUnsimulated(resource, ipSet);
             return ipSet;
         });
     }

package/dist/service/wafv2/cfn/regex-pattern-set/sim-cfn-waf-regex-set-config.js

@@ -21,6 +21,7 @@ export class SimCfnWafRegexPatternSetConfig extends SimCfnWafResourceConfig {
             Name: this.name(),
             Scope: this.scope(),
             Description: this.description(),
+            Tags: this.tags(),
             RegularExpressionList: this.requiredStrings("RegularExpressionList").map((pattern) => ({ RegexString: pattern })),
         };
     }

package/dist/service/wafv2/cfn/regex-pattern-set/sim-cfn-waf-regex-set-creator.js

@@ -1,5 +1,6 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { simCfnWafRecordUnsimulated } from "../sim-cfn-waf-unsimulated.js";
 import { wafRegexPatternSetResourceType } from "../sim-cfn-waf-resource-types.js";
 import { SimCfnWafRegexPatternSetConfig } from "./sim-cfn-waf-regex-set-config.js";
 /**
@@ -29,6 +30,7 @@ export class SimCfnWafRegexPatternSetCreator {
             assertDefined(arn, `sim WAFv2 regex pattern set ARN for CloudFormation Resource ${resource.logicalId}`);
             const patternSet = this.#wafV2.findRegexPatternSetByArn(arn);
             assertDefined(patternSet, `sim WAFv2 regex pattern set ${arn} after CloudFormation creation`);
+            simCfnWafRecordUnsimulated(resource, patternSet);
             return patternSet;
         });
     }

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-config.d.ts

@@ -45,6 +45,10 @@ export declare abstract class SimCfnWafResourceConfig {
     /**
      * One property of the Resource, whatever shape it is in.
      */
+    /**
+     * The tags the template gave the Resource, as written.
+     */
+    tags(): readonly unknown[] | undefined;
     protected value(key: string): SimCfnTemplateValue | undefined;
     /**
      * One string property, or nothing when the template left it out.

package/dist/service/wafv2/cfn/sim-cfn-waf-resource-config.js

@@ -57,6 +57,16 @@ export class SimCfnWafResourceConfig {
     /**
      * One property of the Resource, whatever shape it is in.
      */
+    /**
+     * The tags the template gave the Resource, as written.
+     */
+    tags() {
+        const tags = this.value("Tags");
+        if (tags !== undefined && !Array.isArray(tags)) {
+            this.refuse("Tags must be a list");
+        }
+        return tags;
+    }
     value(key) {
         // oxlint-disable-next-line security/detect-object-injection
         return this.properties[key] ?? undefined;

package/dist/service/wafv2/cfn/sim-cfn-waf-unsimulated.d.ts

@@ -0,0 +1,10 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimWafResource } from "../resource/sim-waf-resource.js";
+/**
+ * Record on a Resource each part of the WAFv2 resource it created that the
+ * simulation holds and does not act on.
+ *
+ * The path is the one `unsimulatedParts` reports, so `stack.ignoredProperties`
+ * and an SDK caller read the same names.
+ */
+export declare function simCfnWafRecordUnsimulated(resource: SimCfnResource, created: SimWafResource): void;

package/dist/service/wafv2/cfn/sim-cfn-waf-unsimulated.js

@@ -0,0 +1,12 @@
+/**
+ * Record on a Resource each part of the WAFv2 resource it created that the
+ * simulation holds and does not act on.
+ *
+ * The path is the one `unsimulatedParts` reports, so `stack.ignoredProperties`
+ * and an SDK caller read the same names.
+ */
+export function simCfnWafRecordUnsimulated(resource, created) {
+    for (const { part, reason } of created.unsimulated) {
+        resource.ignoreProperty(part, reason);
+    }
+}

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.d.ts

@@ -8,26 +8,14 @@ import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
  * template wrote them. They are not read here at all: every rule is compiled
  * by CreateWebACL, which is where a statement kind Yulin cannot evaluate is
  * found, and reading them twice would mean two answers to the same question.
+ * The members Yulin holds without acting on are handed over the same way.
  */
 export declare class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
     protected get resourceType(): string;
     /**
      * The input the web ACL this Resource describes is created from.
-     *
-     * The properties this simulation has no behaviour for are left out of it and
-     * recorded, so the web ACL deploys with the rest of what the template wrote.
-     * An SDK caller is refused for the same properties, because a request that
-     * was answered and then quietly dropped is a worse answer than a refusal.
      */
     createInput(): SimCreateWebAclCommandInput;
-    /**
-     * Record the web ACL members this simulation has no behaviour for.
-     *
-     * Each of them changes what a web ACL does on real WAF, so a web ACL
-     * deployed without one behaves differently to the one the template
-     * describes. `stack.ignoredProperties` is where a test reads that.
-     */
-    private recordUnsimulatedMembers;
     /**
      * The rules the template declared.
      *

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-config.js

@@ -1,4 +1,3 @@
-import { simWafUnsimulatedWebAclMembers } from "../../command/web-acl/sim-wafv2-unsimulated-web-acl-input.js";
 import { SimCfnWafResourceConfig } from "../sim-cfn-waf-resource-config.js";
 import { wafWebAclResourceType } from "../sim-cfn-waf-resource-types.js";
 /**
@@ -9,6 +8,7 @@ import { wafWebAclResourceType } from "../sim-cfn-waf-resource-types.js";
  * template wrote them. They are not read here at all: every rule is compiled
  * by CreateWebACL, which is where a statement kind Yulin cannot evaluate is
  * found, and reading them twice would mean two answers to the same question.
+ * The members Yulin holds without acting on are handed over the same way.
  */
 export class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
     get resourceType() {
@@ -16,39 +16,26 @@ export class SimCfnWafWebAclConfig extends SimCfnWafResourceConfig {
     }
     /**
      * The input the web ACL this Resource describes is created from.
-     *
-     * The properties this simulation has no behaviour for are left out of it and
-     * recorded, so the web ACL deploys with the rest of what the template wrote.
-     * An SDK caller is refused for the same properties, because a request that
-     * was answered and then quietly dropped is a worse answer than a refusal.
      */
     createInput() {
-        this.recordUnsimulatedMembers();
         return {
             Name: this.name(),
             Scope: this.scope(),
             Description: this.description(),
+            Tags: this.tags(),
             DefaultAction: this.value("DefaultAction"),
             Rules: this.rules(),
             VisibilityConfig: this.value("VisibilityConfig"),
             CustomResponseBodies: this.value("CustomResponseBodies"),
             AssociationConfig: this.value("AssociationConfig"),
+            CaptchaConfig: this.value("CaptchaConfig"),
+            ChallengeConfig: this.value("ChallengeConfig"),
+            TokenDomains: this.value("TokenDomains"),
+            DataProtectionConfig: this.value("DataProtectionConfig"),
+            OnSourceDDoSProtectionConfig: this.value("OnSourceDDoSProtectionConfig"),
+            ApplicationConfig: this.value("ApplicationConfig"),
         };
     }
-    /**
-     * Record the web ACL members this simulation has no behaviour for.
-     *
-     * Each of them changes what a web ACL does on real WAF, so a web ACL
-     * deployed without one behaves differently to the one the template
-     * describes. `stack.ignoredProperties` is where a test reads that.
-     */
-    recordUnsimulatedMembers() {
-        for (const [member, reason] of simWafUnsimulatedWebAclMembers) {
-            if (this.value(member) !== undefined) {
-                this.resource.ignoreProperty(member, `${member} is not simulated: ${reason}`);
-            }
-        }
-    }
     /**
      * The rules the template declared.
      *

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.d.ts

@@ -14,15 +14,10 @@ interface SimCfnWafWebAclCreatorProperties {
  * caller would have got: the same compilation of every rule, and the same
  * refusals.
  *
- * A rule this simulation cannot evaluate is the exception, and the two part
- * company over it. An SDK caller has the whole web ACL refused. A template
- * deploys the web ACL without that rule and records it on
- * `stack.ignoredProperties`, because the alternative is one rule taking a
- * user pool, a table and two functions in the same template down with it.
- *
- * The web ACL is then real, and thinner than the one the template describes.
- * That is the cost of deploying it at all, and the record of the dropped rule
- * is what a test reads to know the size of it.
+ * A rule or member this simulation cannot act on is held by the web ACL as the
+ * template wrote it, and recorded on `stack.ignoredProperties` under the name
+ * the web ACL reports it by. That record is what a test reads to know how far
+ * the deployed web ACL is from the one AWS would run.
  */
 export declare class SimCfnWafWebAclCreator {
     #private;

package/dist/service/wafv2/cfn/web-acl/sim-cfn-waf-web-acl-creator.js

@@ -1,7 +1,7 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnWafResourceCommand } from "../sim-cfn-waf-resource-error.js";
+import { simCfnWafRecordUnsimulated } from "../sim-cfn-waf-unsimulated.js";
 import { wafWebAclResourceType } from "../sim-cfn-waf-resource-types.js";
-import { simCfnWafEvaluatableRules } from "./sim-cfn-waf-evaluatable-rules.js";
 import { SimCfnWafWebAclConfig } from "./sim-cfn-waf-web-acl-config.js";
 /**
  * Creates simulated web ACLs from AWS::WAFv2::WebACL Resources.
@@ -11,15 +11,10 @@ import { SimCfnWafWebAclConfig } from "./sim-cfn-waf-web-acl-config.js";
  * caller would have got: the same compilation of every rule, and the same
  * refusals.
  *
- * A rule this simulation cannot evaluate is the exception, and the two part
- * company over it. An SDK caller has the whole web ACL refused. A template
- * deploys the web ACL without that rule and records it on
- * `stack.ignoredProperties`, because the alternative is one rule taking a
- * user pool, a table and two functions in the same template down with it.
- *
- * The web ACL is then real, and thinner than the one the template describes.
- * That is the cost of deploying it at all, and the record of the dropped rule
- * is what a test reads to know the size of it.
+ * A rule or member this simulation cannot act on is held by the web ACL as the
+ * template wrote it, and recorded on `stack.ignoredProperties` under the name
+ * the web ACL reports it by. That record is what a test reads to know how far
+ * the deployed web ACL is from the one AWS would run.
  */
 export class SimCfnWafWebAclCreator {
     #wafV2;
@@ -34,16 +29,13 @@ export class SimCfnWafWebAclCreator {
             resource,
             properties,
         }).createInput();
-        const deployable = {
-            ...input,
-            Rules: simCfnWafEvaluatableRules(this.#wafV2, resource, input),
-        };
         return await simCfnWafResourceCommand(wafWebAclResourceType, resource.logicalId, async () => {
-            const created = await this.#wafV2.createWebAcl({ input: deployable }, options);
+            const created = await this.#wafV2.createWebAcl({ input }, options);
             const arn = created.Summary?.ARN;
             assertDefined(arn, `sim WAFv2 web ACL ARN for CloudFormation Resource ${resource.logicalId}`);
             const webAcl = this.#wafV2.findWebAclByArn(arn);
             assertDefined(webAcl, `sim WAFv2 web ACL ${arn} after CloudFormation creation`);
+            simCfnWafRecordUnsimulated(resource, webAcl);
             return webAcl;
         });
     }