@kensio/yulin 1.21.3 → 1.21.4

package/dist/service/cloudformation/parameters/sim-cfn-parameters.js

@@ -16,10 +16,12 @@ import { assertDefined } from "../../../util/type-guard/defined.js";
 export class SimCfnParameters {
     definitions;
     values;
+    supplied;
     properties;
     constructor(properties = {}) {
         this.properties = properties;
         this.definitions = simCfnParameterDefinitions(properties);
+        this.supplied = new Map(Object.entries(properties.values ?? {}));
         this.values = new SimCfnParameterValues({
             definitions: this.definitions,
             supplied: properties.values ?? {},
@@ -68,6 +70,16 @@ export class SimCfnParameters {
     has(parameterName) {
         return this.definitions.has(parameterName);
     }
+    /**
+     * The value a command supplied for this Parameter, if it supplied one.
+     *
+     * What `UsePreviousValue` on an UpdateStack Parameter reads off the Stack.
+     * A Parameter the Stack was deployed without has nothing here, and takes the
+     * template Default again as it did the first time.
+     */
+    suppliedValue(parameterName) {
+        return this.supplied.get(parameterName);
+    }
     /**
      * Resolve the runtime value for a declared or referenced Parameter.
      *

package/dist/service/cloudformation/resource/delete/sim-cfn-resource-delete-operation.d.ts

@@ -29,6 +29,10 @@ export declare class SimCfnResourceDeleteOperation<T extends object = object> {
      * while the Resource itself is updated through CloudFormation delete states:
      * in progress before scheduling, complete after the deleter returns, skipped
      * if nothing can delete the Resource type, or failed if the deleter throws.
+     *
+     * A Resource the operation's retention keeps never reaches the deleter at
+     * all. CloudFormation leaves it where it is and reports it as DELETE_SKIPPED,
+     * so the Stack can finish deleting around it.
      */
     run(context: SimCloudFormationResourceDeleteContext): Promise<void>;
     private resourceDeletionError;

package/dist/service/cloudformation/resource/delete/sim-cfn-resource-delete-operation.js

@@ -1,4 +1,5 @@
 import { SimCfnResourceDeleter } from "./sim-cfn-resource-deleter.js";
+import { SimCfnResourceRetention } from "./sim-cfn-resource-retention.js";
 import { isSimCfnUnsupportedResourceError } from "../unsupported/sim-cfn-unsupported-resource.js";
 /**
  * Runs the asynchronous CloudFormation Resource deletion lifecycle.
@@ -29,8 +30,17 @@ export class SimCfnResourceDeleteOperation {
      * while the Resource itself is updated through CloudFormation delete states:
      * in progress before scheduling, complete after the deleter returns, skipped
      * if nothing can delete the Resource type, or failed if the deleter throws.
+     *
+     * A Resource the operation's retention keeps never reaches the deleter at
+     * all. CloudFormation leaves it where it is and reports it as DELETE_SKIPPED,
+     * so the Stack can finish deleting around it.
      */
     run(context) {
+        const retention = context.retention ?? new SimCfnResourceRetention();
+        if (retention.retains(this.resource)) {
+            this.resource.markDeleteRetained();
+            return Promise.resolve();
+        }
         this.resource.markDeleteInProgress();
         return new Promise((resolve, reject) => {
             this.background.schedule(async () => {

package/dist/service/cloudformation/resource/delete/sim-cfn-resource-retention.d.ts

@@ -0,0 +1,44 @@
+import type { SimCfnResourceRecord } from "../sim-cfn-resource-record.js";
+interface SimCfnResourceRetentionProperties {
+    /**
+     * For each logical ID this operation is replacing, whether the definition
+     * taking its place says to keep the deployed Resource.
+     *
+     * The answer comes from the new definition because that is the template
+     * CloudFormation is applying. An update that adds `UpdateReplacePolicy:
+     * Retain` keeps the Resource it replaces, and one that drops the attribute
+     * deletes it.
+     */
+    readonly replaced?: ReadonlyMap<string, boolean> | undefined;
+    /**
+     * The logical IDs the caller asked for by name, kept whatever their policy
+     * attributes say. DeleteStack RetainResources is what names them.
+     */
+    readonly named?: ReadonlySet<string> | undefined;
+}
+/**
+ * Which of the Resources an operation is deleting it has to leave behind.
+ *
+ * Three things can keep a Resource in simulated AWS. The DeleteStack call can
+ * name it, UpdateReplacePolicy can keep one a Stack update is replacing, and
+ * DeletionPolicy can keep one being removed. They are gathered here so that one
+ * delete has one answer.
+ *
+ * Which of the two attributes applies is the part worth stating. CloudFormation
+ * reads UpdateReplacePolicy for a replacement and DeletionPolicy for a removal,
+ * and neither stands in for the other. A Resource marked to survive a teardown
+ * still goes when an update replaces it.
+ *
+ * A retention with nothing in it reads DeletionPolicy, the way a plain teardown
+ * does.
+ */
+export declare class SimCfnResourceRetention {
+    private readonly replaced;
+    private readonly named;
+    constructor(properties?: SimCfnResourceRetentionProperties);
+    /**
+     * Whether this Resource is to be left in simulated AWS rather than deleted.
+     */
+    retains(resource: SimCfnResourceRecord): boolean;
+}
+export {};

package/dist/service/cloudformation/resource/delete/sim-cfn-resource-retention.js

@@ -0,0 +1,33 @@
+/**
+ * Which of the Resources an operation is deleting it has to leave behind.
+ *
+ * Three things can keep a Resource in simulated AWS. The DeleteStack call can
+ * name it, UpdateReplacePolicy can keep one a Stack update is replacing, and
+ * DeletionPolicy can keep one being removed. They are gathered here so that one
+ * delete has one answer.
+ *
+ * Which of the two attributes applies is the part worth stating. CloudFormation
+ * reads UpdateReplacePolicy for a replacement and DeletionPolicy for a removal,
+ * and neither stands in for the other. A Resource marked to survive a teardown
+ * still goes when an update replaces it.
+ *
+ * A retention with nothing in it reads DeletionPolicy, the way a plain teardown
+ * does.
+ */
+export class SimCfnResourceRetention {
+    replaced;
+    named;
+    constructor(properties = {}) {
+        this.replaced = properties.replaced ?? new Map();
+        this.named = properties.named ?? new Set();
+    }
+    /**
+     * Whether this Resource is to be left in simulated AWS rather than deleted.
+     */
+    retains(resource) {
+        if (this.named.has(resource.logicalId)) {
+            return true;
+        }
+        return this.replaced.get(resource.logicalId) ?? resource.retainedOnDelete;
+    }
+}

package/dist/service/cloudformation/resource/sim-cfn-resource-record.d.ts

@@ -68,6 +68,21 @@ export declare abstract class SimCfnResourceRecord implements SimCfnPropertyIgno
      * the two are the same thing here.
      */
     get retainedOnDelete(): boolean;
+    /**
+     * The UpdateReplacePolicy attribute from the Resource template, if it has
+     * one.
+     */
+    get updateReplacePolicy(): string | undefined;
+    /**
+     * Whether an update that replaces this Resource should leave the deployed one
+     * where it is.
+     *
+     * UpdateReplacePolicy decides this on its own. CloudFormation does not fall
+     * back to DeletionPolicy for a Resource it is replacing. A Resource kept on
+     * teardown still goes when its replacement is created, unless it says
+     * otherwise here.
+     */
+    get retainedOnReplace(): boolean;
     /**
      * The value returned when this Resource is referenced via { "Ref": logicalId }.
      *

package/dist/service/cloudformation/resource/sim-cfn-resource-record.js

@@ -30,7 +30,7 @@ export class SimCfnResourceRecord {
     propertyResolver;
     resourceLogicalIds;
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), logicalId = "Resource", stackName, template = {}, parameters, resourceLogicalIds = new Set(), exports, } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), logicalId = "Resource", stackName, stackId, template = {}, parameters, resourceLogicalIds = new Set(), exports, } = properties;
         this.accountRegionScope = accountRegionScope;
         this.logicalId = logicalId;
         this.stackName = stackName;
@@ -47,6 +47,7 @@ export class SimCfnResourceRecord {
             pseudoParameters: new SimCfnPseudoParameters({
                 accountRegionScope: this.accountRegionScope,
                 stackName,
+                stackId,
             }),
             propertyIgnorer: this,
             resourceType: this.type,
@@ -102,6 +103,25 @@ export class SimCfnResourceRecord {
         return (this.deletionPolicy === "Retain" ||
             this.deletionPolicy === "RetainExceptOnCreate");
     }
+    /**
+     * The UpdateReplacePolicy attribute from the Resource template, if it has
+     * one.
+     */
+    get updateReplacePolicy() {
+        return this.resourceTemplateReader.updateReplacePolicy();
+    }
+    /**
+     * Whether an update that replaces this Resource should leave the deployed one
+     * where it is.
+     *
+     * UpdateReplacePolicy decides this on its own. CloudFormation does not fall
+     * back to DeletionPolicy for a Resource it is replacing. A Resource kept on
+     * teardown still goes when its replacement is created, unless it says
+     * otherwise here.
+     */
+    get retainedOnReplace() {
+        return this.updateReplacePolicy === "Retain";
+    }
     /**
      * The value returned when this Resource is referenced via { "Ref": logicalId }.
      *

package/dist/service/cloudformation/resource/sim-cfn-resource.d.ts

@@ -103,19 +103,16 @@ export declare class SimCfnResource<T extends object = object> extends SimCfnRes
      */
     create(context: SimCloudFormationResourceCreateContext): Promise<void>;
     /**
-     * Whether this Resource was left in simulated AWS by a Stack teardown,
-     * because its DeletionPolicy says to keep it.
+     * Whether this Resource was left in simulated AWS rather than deleted,
+     * because a policy or the caller said to keep it.
      */
     get retained(): boolean;
     /**
      * Start deleting this Resource from simulated AWS.
      *
-     * A Resource whose DeletionPolicy retains it never reaches the delete
-     * operation. CloudFormation leaves it where it is and reports it as
-     * DELETE_SKIPPED, so the Stack can finish deleting around it.
-     *
      * The actual work is delegated to SimCfnResourceDeleteOperation, for the same
-     * reason creation is.
+     * reason creation is. That includes deciding whether to delete the Resource
+     * at all, since a retained Resource is a deletion outcome like any other.
      */
     delete(context: SimCloudFormationResourceDeleteContext): Promise<void>;
     /**
@@ -159,6 +156,11 @@ export declare class SimCfnResource<T extends object = object> extends SimCfnRes
      * Mark this Resource as successfully deleted.
      */
     markDeleteComplete(): void;
+    /**
+     * Mark this Resource as left in simulated AWS rather than deleted, because a
+     * policy or the DeleteStack call said to keep it.
+     */
+    markDeleteRetained(): void;
     /**
      * Mark this Resource's deletion as skipped because sim CloudFormation has no
      * way to delete its service or Resource type.

package/dist/service/cloudformation/resource/sim-cfn-resource.js

@@ -148,8 +148,8 @@ export class SimCfnResource extends SimCfnResourceRecord {
         }).run(context);
     }
     /**
-     * Whether this Resource was left in simulated AWS by a Stack teardown,
-     * because its DeletionPolicy says to keep it.
+     * Whether this Resource was left in simulated AWS rather than deleted,
+     * because a policy or the caller said to keep it.
      */
     get retained() {
         return this.deletionState.retained;
@@ -157,18 +157,11 @@ export class SimCfnResource extends SimCfnResourceRecord {
     /**
      * Start deleting this Resource from simulated AWS.
      *
-     * A Resource whose DeletionPolicy retains it never reaches the delete
-     * operation. CloudFormation leaves it where it is and reports it as
-     * DELETE_SKIPPED, so the Stack can finish deleting around it.
-     *
      * The actual work is delegated to SimCfnResourceDeleteOperation, for the same
-     * reason creation is.
+     * reason creation is. That includes deciding whether to delete the Resource
+     * at all, since a retained Resource is a deletion outcome like any other.
      */
     delete(context) {
-        if (this.retainedOnDelete) {
-            this.deletionState.markDeleteRetained();
-            return Promise.resolve();
-        }
         return new SimCfnResourceDeleteOperation({
             background: this.background,
             resource: this,
@@ -231,6 +224,13 @@ export class SimCfnResource extends SimCfnResourceRecord {
     markDeleteComplete() {
         this.deletionState.markDeleteComplete();
     }
+    /**
+     * Mark this Resource as left in simulated AWS rather than deleted, because a
+     * policy or the DeleteStack call said to keep it.
+     */
+    markDeleteRetained() {
+        this.deletionState.markDeleteRetained();
+    }
     /**
      * Mark this Resource's deletion as skipped because sim CloudFormation has no
      * way to delete its service or Resource type.

package/dist/service/cloudformation/resource/sim-cfn-resource.type.d.ts

@@ -9,11 +9,13 @@ import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCfnResource } from "./sim-cfn-resource.js";
 import type { SimCfnExports } from "../export/sim-cfn-exports.js";
+import type { SimCfnResourceRetention } from "./delete/sim-cfn-resource-retention.js";
 export interface SimCloudFormationResourceProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
     readonly background?: BackgroundScheduler;
     readonly logicalId?: string;
     readonly stackName?: string | undefined;
+    readonly stackId?: string | undefined;
     readonly template?: SimCfnTemplateValueRecord;
     readonly cfnResourceFactory?: SimCfnServiceResourceFactory | undefined;
     readonly parameters?: SimCfnParameters | undefined;
@@ -85,6 +87,12 @@ export interface SimCloudFormationResourceDeleteContext {
     readonly resolvedProperties?: SimCfnTemplateValueRecord | undefined;
     /** The principal the teardown runs as, as creation carries it. */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * Which of the Resources this operation is deleting it has to leave in
+     * simulated AWS. An omitted retention reads each Resource's DeletionPolicy,
+     * which is what a Stack teardown asked for nothing else does.
+     */
+    readonly retention?: SimCfnResourceRetention | undefined;
 }
 /**
  * The two resolved Resource definitions available to update validation.

package/dist/service/cloudformation/resource/state/sim-cfn-resource-deletion-state.d.ts

@@ -19,8 +19,8 @@ export declare class SimCfnResourceDeletionState {
      */
     get deleteComplete(): boolean;
     /**
-     * Whether this Resource was left in simulated AWS because its DeletionPolicy
-     * says to keep it.
+     * Whether this Resource was left in simulated AWS because a policy attribute
+     * or the DeleteStack call said to keep it.
      */
     get retained(): boolean;
     /**
@@ -61,7 +61,7 @@ export declare class SimCfnResourceDeletionState {
      */
     markDeleteSkipped(reason: string): void;
     /**
-     * Mark this Resource as kept because its DeletionPolicy is Retain.
+     * Mark this Resource as kept in simulated AWS.
      *
      * DELETE_SKIPPED is the status CloudFormation itself reports for a retained
      * Resource, and it counts as terminal so the rest of the teardown carries on

package/dist/service/cloudformation/resource/state/sim-cfn-resource-deletion-state.js

@@ -26,8 +26,8 @@ export class SimCfnResourceDeletionState {
             this.#status === "DELETE_FAILED");
     }
     /**
-     * Whether this Resource was left in simulated AWS because its DeletionPolicy
-     * says to keep it.
+     * Whether this Resource was left in simulated AWS because a policy attribute
+     * or the DeleteStack call said to keep it.
      */
     get retained() {
         return this.#status === "DELETE_SKIPPED";
@@ -90,7 +90,7 @@ export class SimCfnResourceDeletionState {
         this.#status = "DELETE_COMPLETE";
     }
     /**
-     * Mark this Resource as kept because its DeletionPolicy is Retain.
+     * Mark this Resource as kept in simulated AWS.
      *
      * DELETE_SKIPPED is the status CloudFormation itself reports for a retained
      * Resource, and it counts as terminal so the rest of the teardown carries on

package/dist/service/cloudformation/resource/template/sim-cfn-resource-template-reader.d.ts

@@ -21,6 +21,10 @@ export declare class SimCfnResourceTemplateReader {
      * The CloudFormation DeletionPolicy attribute, for example Retain.
      */
     deletionPolicy(): string | undefined;
+    /**
+     * The CloudFormation UpdateReplacePolicy attribute, for example Retain.
+     */
+    updateReplacePolicy(): string | undefined;
     /**
      * The CloudFormation Resource properties object.
      *

package/dist/service/cloudformation/resource/template/sim-cfn-resource-template-reader.js

@@ -30,6 +30,15 @@ export class SimCfnResourceTemplateReader {
         const deletionPolicy = this.template["DeletionPolicy"];
         return typeof deletionPolicy === "string" ? deletionPolicy : undefined;
     }
+    /**
+     * The CloudFormation UpdateReplacePolicy attribute, for example Retain.
+     */
+    updateReplacePolicy() {
+        const updateReplacePolicy = this.template["UpdateReplacePolicy"];
+        return typeof updateReplacePolicy === "string"
+            ? updateReplacePolicy
+            : undefined;
+    }
     /**
      * The CloudFormation Resource properties object.
      *

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-auth.d.ts

@@ -0,0 +1,37 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuth, SamApiAuthApi, SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The `Auth` block an API declares, refusing every property this expansion
+ * cannot model.
+ *
+ * A property is refused rather than dropped because dropping one deploys an
+ * API that authorizes less than the template asked for, which is the failure
+ * this whole expansion exists to prevent. An API declaring no `Auth` declares
+ * an empty block, and the methods on it stay open.
+ */
+export declare function samApiAuthBlock(api: SamApiAuthApi, apiProperties: SimCfnTemplateValueRecord, supported: ReadonlySet<string>): SimCfnTemplateValueRecord;
+/**
+ * The authorizer IAM itself decides, which names no Resource of its own.
+ */
+export declare function samIamAuthorizer(): SamApiAuthorizer;
+/**
+ * The Resources every authorizer of an API is expanded into.
+ *
+ * They are conditioned the way the API is. An API the template conditioned out
+ * leaves no authorizer behind pointing at an API the Stack never created.
+ */
+export declare function samApiAuthResources(auth: SamApiAuth, condition?: SimCfnTemplateValueRecord): Record<string, SimCfnTemplateValue>;
+/**
+ * The logical ID an authorizer Resource is expanded under, which is the API's
+ * own with the authorizer's name after it.
+ */
+export declare function samAuthorizerLogicalId(api: SamApiAuthApi, name: string): string;
+/**
+ * The `AuthorizerResultTtlInSeconds` an authorizer caches its answer for,
+ * where its `Identity` asked to be reauthorized on a period.
+ */
+export declare function samAuthorizerResultTtl(reauthorizeEvery: SimCfnTemplateValue | undefined): SimCfnTemplateValueRecord;
+/**
+ * The error a property of an API's `Auth` block is refused with.
+ */
+export declare function samAuthError(api: SamApiAuthApi, property: string, reason: string): Error;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-auth.js

@@ -0,0 +1,77 @@
+import { samPropertyError } from "../../sim-cfn-sam-error.js";
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samIamAuthorizerName } from "./sim-cfn-sam-api-auth.types.js";
+import { samUnsupportedApiAuth } from "./sim-cfn-sam-unsupported-auth.js";
+/**
+ * The `Auth` block an API declares, refusing every property this expansion
+ * cannot model.
+ *
+ * A property is refused rather than dropped because dropping one deploys an
+ * API that authorizes less than the template asked for, which is the failure
+ * this whole expansion exists to prevent. An API declaring no `Auth` declares
+ * an empty block, and the methods on it stay open.
+ */
+export function samApiAuthBlock(api, apiProperties, supported) {
+    const declared = apiProperties["Auth"];
+    if (declared === undefined) {
+        return {};
+    }
+    if (!isSamTemplateRecord(declared)) {
+        throw samAuthError(api, "Auth", "it is not a block of authorizer settings");
+    }
+    for (const name of Object.keys(declared)) {
+        if (!supported.has(name)) {
+            throw samAuthError(api, `Auth.${name}`, samUnsupportedApiAuth.get(name) ??
+                "it is not an Auth property this expansion knows");
+        }
+    }
+    return declared;
+}
+/**
+ * The authorizer IAM itself decides, which names no Resource of its own.
+ */
+export function samIamAuthorizer() {
+    return {
+        authorizationType: samIamAuthorizerName,
+        logicalId: undefined,
+        authorizationScopes: undefined,
+        resources: {},
+    };
+}
+/**
+ * The Resources every authorizer of an API is expanded into.
+ *
+ * They are conditioned the way the API is. An API the template conditioned out
+ * leaves no authorizer behind pointing at an API the Stack never created.
+ */
+export function samApiAuthResources(auth, condition = {}) {
+    return Object.fromEntries(auth.authorizers
+        .values()
+        .flatMap((authorizer) => Object.entries(authorizer.resources))
+        .map(([logicalId, resource]) => [
+        logicalId,
+        { ...resource, ...condition },
+    ]));
+}
+/**
+ * The logical ID an authorizer Resource is expanded under, which is the API's
+ * own with the authorizer's name after it.
+ */
+export function samAuthorizerLogicalId(api, name) {
+    return `${api.logicalId}${name}Authorizer`;
+}
+/**
+ * The `AuthorizerResultTtlInSeconds` an authorizer caches its answer for,
+ * where its `Identity` asked to be reauthorized on a period.
+ */
+export function samAuthorizerResultTtl(reauthorizeEvery) {
+    return reauthorizeEvery === undefined
+        ? {}
+        : { AuthorizerResultTtlInSeconds: reauthorizeEvery };
+}
+/**
+ * The error a property of an API's `Auth` block is refused with.
+ */
+export function samAuthError(api, property, reason) {
+    return samPropertyError({ ...api, property, reason });
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-auth.types.d.ts

@@ -0,0 +1,51 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+/**
+ * The API an `Auth` block was read from, for a refusal to name it.
+ */
+export interface SamApiAuthApi {
+    /** `AWS::Serverless::Api` or `AWS::Serverless::HttpApi`. */
+    readonly resourceType: string;
+    /** The logical ID the API is expanded under. */
+    readonly logicalId: string;
+}
+/**
+ * One authorizer an API's `Auth` block declares, as the methods and routes it
+ * decides need it.
+ */
+export interface SamApiAuthorizer {
+    /** What a method or route naming this authorizer sets as its type. */
+    readonly authorizationType: string;
+    /**
+     * The logical ID of the authorizer Resource, which a method or route names
+     * by `Ref`. The built-in `AWS_IAM` authorizer has none: IAM itself decides,
+     * and there is no authorizer to point at.
+     */
+    readonly logicalId: string | undefined;
+    /** The scopes the authorizer asks of every method it decides. */
+    readonly authorizationScopes: SimCfnTemplateValue | undefined;
+    /** The Resources the authorizer is expanded into. */
+    readonly resources: Record<string, SimCfnTemplateValueRecord>;
+}
+/**
+ * The `Auth` of one API, once expanded.
+ *
+ * Both API kinds arrive here. What differs between them is how one authorizer
+ * becomes a Resource, and that is decided before this is built.
+ */
+export interface SamApiAuth {
+    readonly api: SamApiAuthApi;
+    /** The authorizers, by the name `Authorizers` declared each under. */
+    readonly authorizers: ReadonlyMap<string, SamApiAuthorizer>;
+    /** The authorizer every method takes when its event names none. */
+    readonly defaultAuthorizer: string | undefined;
+}
+/**
+ * The name SAM reserves for the authorizer IAM itself decides, on either API
+ * kind.
+ */
+export declare const samIamAuthorizerName = "AWS_IAM";
+/**
+ * The name an event writes to open a method the API's `DefaultAuthorizer`
+ * would otherwise have closed.
+ */
+export declare const samNoAuthorizerName = "NONE";

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-auth.types.js

@@ -0,0 +1,10 @@
+/**
+ * The name SAM reserves for the authorizer IAM itself decides, on either API
+ * kind.
+ */
+export const samIamAuthorizerName = "AWS_IAM";
+/**
+ * The name an event writes to open a method the API's `DefaultAuthorizer`
+ * would otherwise have closed.
+ */
+export const samNoAuthorizerName = "NONE";

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-authorizers.d.ts

@@ -0,0 +1,11 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthApi } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The authorizers an `Auth` block declares, in the order it declares them.
+ */
+export declare function samApiAuthorizerDefinitions(api: SamApiAuthApi, auth: SimCfnTemplateValueRecord): readonly (readonly [string, SimCfnTemplateValueRecord])[];
+/**
+ * The `DefaultAuthorizer` an `Auth` block names, which every method it decides
+ * takes when its own event names none.
+ */
+export declare function samApiDefaultAuthorizer(api: SamApiAuthApi, auth: SimCfnTemplateValueRecord): string | undefined;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-authorizers.js

@@ -0,0 +1,34 @@
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samAuthError } from "./sim-cfn-sam-api-auth.js";
+/**
+ * The authorizers an `Auth` block declares, in the order it declares them.
+ */
+export function samApiAuthorizerDefinitions(api, auth) {
+    const declared = auth["Authorizers"];
+    if (declared === undefined) {
+        return [];
+    }
+    if (!isSamTemplateRecord(declared)) {
+        throw samAuthError(api, "Auth.Authorizers", "it is not a map of authorizers by name");
+    }
+    return Object.entries(declared).map(([name, definition]) => {
+        if (!isSamTemplateRecord(definition)) {
+            throw samAuthError(api, `Auth.Authorizers.${name}`, "it is not a block of authorizer settings");
+        }
+        return [name, definition];
+    });
+}
+/**
+ * The `DefaultAuthorizer` an `Auth` block names, which every method it decides
+ * takes when its own event names none.
+ */
+export function samApiDefaultAuthorizer(api, auth) {
+    const declared = auth["DefaultAuthorizer"];
+    if (declared === undefined) {
+        return undefined;
+    }
+    if (typeof declared !== "string") {
+        throw samAuthError(api, "Auth.DefaultAuthorizer", "it is not the name of one of the API's authorizers");
+    }
+    return declared;
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-api-identity.d.ts

@@ -0,0 +1,21 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiIdentityProperties } from "./sim-cfn-sam-identity-source.js";
+/**
+ * What an authorizer reads off a request, and how long it may reuse the answer
+ * it gave for it.
+ */
+export interface SamApiIdentity {
+    /** The request parts the authorizer is keyed on, in declaration order. */
+    readonly identitySource: readonly string[];
+    /** The `AuthorizerResultTtlInSeconds` the authorizer is created with. */
+    readonly reauthorizeEvery: SimCfnTemplateValue | undefined;
+}
+/**
+ * The `Identity` block of one authorizer, as the identity source and result
+ * TTL an authorizer Resource is created with.
+ *
+ * An authorizer stating no `Identity` reads nothing off the request by name,
+ * and the Resource it becomes is left to whatever the command requires of its
+ * type.
+ */
+export declare function samApiIdentity(properties: SamApiIdentityProperties): SamApiIdentity;