@kensio/yulin 1.21.3 → 1.21.5

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-lambda-authorizer.js

@@ -0,0 +1,67 @@
+import { samAuthError, samAuthorizerLogicalId, samAuthorizerResultTtl, } from "./sim-cfn-sam-api-auth.js";
+import { samApiIdentity } from "./sim-cfn-sam-api-identity.js";
+import { samAuthorizerPermissionResource, samAuthorizerUri, } from "./sim-cfn-sam-authorizer-function.js";
+import { samRestIdentityPrefixes } from "./sim-cfn-sam-identity-prefixes.js";
+/**
+ * A REST API Lambda authorizer, which asks a function of the template what to
+ * do with the request.
+ *
+ * `FunctionPayloadType` decides which of the two kinds it is. A `TOKEN`
+ * authorizer is handed one header, and a `REQUEST` authorizer the whole
+ * request. SAM defaults to `TOKEN`, and so does this. A `TOKEN` authorizer
+ * naming no header of its own reads `Authorization`, and a `REQUEST` one is
+ * allowed to read nothing by name, which is how it is asked to run on every
+ * request.
+ */
+export function samRestLambdaAuthorizer(authorizer, functionArn) {
+    const { api, name, definition } = authorizer;
+    const identity = samApiIdentity({
+        api,
+        authorizerName: name,
+        authorizer: definition,
+        prefixes: samRestIdentityPrefixes,
+    });
+    const logicalId = samAuthorizerLogicalId(api, name);
+    const type = payloadType(authorizer);
+    const declared = identity.identitySource.join(",");
+    return {
+        authorizationType: "CUSTOM",
+        logicalId,
+        authorizationScopes: undefined,
+        resources: {
+            [logicalId]: {
+                Type: "AWS::ApiGateway::Authorizer",
+                Properties: {
+                    RestApiId: { Ref: api.logicalId },
+                    Name: name,
+                    Type: type,
+                    AuthorizerUri: samAuthorizerUri(functionArn),
+                    ...identitySource(type, declared),
+                    ...samAuthorizerResultTtl(identity.reauthorizeEvery),
+                },
+            },
+            [`${logicalId}Permission`]: samAuthorizerPermissionResource({
+                functionArn,
+                apiLogicalId: api.logicalId,
+            }),
+        },
+    };
+}
+/**
+ * Which kind of Lambda authorizer the definition asks for.
+ */
+function payloadType(authorizer) {
+    const declared = authorizer.definition["FunctionPayloadType"] ?? "TOKEN";
+    if (declared !== "TOKEN" && declared !== "REQUEST") {
+        throw samAuthError(authorizer.api, `Auth.Authorizers.${authorizer.name}.FunctionPayloadType`, "it is neither TOKEN nor REQUEST");
+    }
+    return declared;
+}
+/**
+ * The `IdentitySource` the authorizer is created with, which a REST API states
+ * as one comma-separated string.
+ */
+function identitySource(type, declared) {
+    const source = declared || (type === "TOKEN" ? "method.request.header.Authorization" : "");
+    return source === "" ? {} : { IdentitySource: source };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-template-api-auth.d.ts

@@ -0,0 +1,26 @@
+import type { CfnTemplateBodyRecord } from "../../../template/sim-cfn-template.js";
+import type { SamTemplateGlobals } from "../../sim-cfn-sam-globals.js";
+import type { SamApiAuth } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The `Auth` of every API of a template, by the logical ID the API is expanded
+ * under.
+ *
+ * An `Api` or `HttpApi` event puts its method on an API declared somewhere
+ * else in the template, and has to know what that API's `Auth` block declared
+ * before it can name one of its authorizers. This is read once for the whole
+ * template and handed to every event.
+ */
+export type SamTemplateApiAuth = ReadonlyMap<string, SamApiAuth>;
+/**
+ * Read the `Auth` of every API a template declares, and of the two implicit
+ * APIs its events may make.
+ *
+ * The implicit APIs are read from `Globals`, which is where SAM says their
+ * `Auth` comes from. An API the template declares under one of their logical
+ * IDs is the API of that name, and is read last for that reason.
+ *
+ * An API naming a `DefinitionUri` is left out. Nothing here reads the document
+ * it points at, so the API is not expanded at all and there is no authorizer
+ * Resource for a method to name.
+ */
+export declare function samTemplateApiAuth(template: CfnTemplateBodyRecord, globals: SamTemplateGlobals): SamTemplateApiAuth;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-template-api-auth.js

@@ -0,0 +1,61 @@
+import { samImplicitHttpApiLogicalId } from "../../function/event/sim-cfn-sam-implicit-http-api.js";
+import { samImplicitRestApiLogicalId } from "../../function/event/sim-cfn-sam-implicit-rest-api.js";
+import { samResourceProperties } from "../../function/sim-cfn-sam-function-properties.js";
+import { samMergedApiProperties } from "../../sim-cfn-sam-globals.js";
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samHttpApiType } from "../sim-cfn-sam-http-api.js";
+import { samRestApiType } from "../sim-cfn-sam-rest-api.js";
+import { samHttpApiAuth } from "./sim-cfn-sam-http-api-auth.js";
+import { samRestApiAuth } from "./sim-cfn-sam-rest-api-auth.js";
+/**
+ * Read the `Auth` of every API a template declares, and of the two implicit
+ * APIs its events may make.
+ *
+ * The implicit APIs are read from `Globals`, which is where SAM says their
+ * `Auth` comes from. An API the template declares under one of their logical
+ * IDs is the API of that name, and is read last for that reason.
+ *
+ * An API naming a `DefinitionUri` is left out. Nothing here reads the document
+ * it points at, so the API is not expanded at all and there is no authorizer
+ * Resource for a method to name.
+ */
+export function samTemplateApiAuth(template, globals) {
+    const resources = isSamTemplateRecord(template.Resources)
+        ? Object.entries(template.Resources)
+        : [];
+    return new Map([
+        [
+            samImplicitRestApiLogicalId,
+            samRestApiAuth(samImplicitRestApiLogicalId, globals.forApi),
+        ],
+        [
+            samImplicitHttpApiLogicalId,
+            samHttpApiAuth(samImplicitHttpApiLogicalId, globals.forHttpApi),
+        ],
+        ...resources.flatMap(([logicalId, resource]) => declaredApiAuth(logicalId, resource, globals)),
+    ]);
+}
+/**
+ * The `Auth` of one Resource of the template, where the Resource is a SAM API
+ * this expansion covers.
+ */
+function declaredApiAuth(logicalId, resource, globals) {
+    if (!isSamTemplateRecord(resource)) {
+        return [];
+    }
+    const type = resource["Type"];
+    if (type === samRestApiType) {
+        return apiAuth(logicalId, resource, globals.forApi, samRestApiAuth);
+    }
+    if (type === samHttpApiType) {
+        return apiAuth(logicalId, resource, globals.forHttpApi, samHttpApiAuth);
+    }
+    return [];
+}
+function apiAuth(logicalId, resource, globals, read) {
+    const apiProperties = samMergedApiProperties(globals, samResourceProperties(resource));
+    if (apiProperties["DefinitionUri"] !== undefined) {
+        return [];
+    }
+    return [[logicalId, read(logicalId, apiProperties)]];
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-unsupported-auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The `Auth` properties an API can declare that this expansion does not model,
+ * and what each one would have done.
+ *
+ * Every one of them is refused by name rather than dropped, because an API
+ * that quietly lost part of its `Auth` block deploys open under a template
+ * that reads as closed.
+ */
+export declare const samUnsupportedApiAuth: ReadonlyMap<string, string>;
+/**
+ * The `Auth` properties an `Api` or `HttpApi` event can declare that this
+ * expansion does not model.
+ */
+export declare const samUnsupportedEventAuth: ReadonlyMap<string, string>;
+/**
+ * The `Identity` properties of an authorizer this expansion does not model.
+ */
+export declare const samUnsupportedIdentity: ReadonlyMap<string, string>;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-unsupported-auth.js

@@ -0,0 +1,59 @@
+/**
+ * The `Auth` properties an API can declare that this expansion does not model,
+ * and what each one would have done.
+ *
+ * Every one of them is refused by name rather than dropped, because an API
+ * that quietly lost part of its `Auth` block deploys open under a template
+ * that reads as closed.
+ */
+export const samUnsupportedApiAuth = new Map([
+    [
+        "AddDefaultAuthorizerToCorsPreflight",
+        "it decides whether the OPTIONS method a Cors block generates is " +
+            "authorized, and Cors is not expanded here",
+    ],
+    ["ApiKeyRequired", "API keys and usage plans are not simulated"],
+    ["UsagePlan", "API keys and usage plans are not simulated"],
+    [
+        "InvokeRole",
+        "it names the Role API Gateway calls the integration as, and an " +
+            "integration here is invoked as the API rather than as a Role",
+    ],
+    [
+        "ResourcePolicy",
+        "an API Gateway resource policy is not simulated. Close the API with an " +
+            "authorizer instead",
+    ],
+]);
+/**
+ * The `Auth` properties an `Api` or `HttpApi` event can declare that this
+ * expansion does not model.
+ */
+export const samUnsupportedEventAuth = new Map([
+    ["ApiKeyRequired", "API keys and usage plans are not simulated"],
+    [
+        "InvokeRole",
+        "it names the Role API Gateway calls the integration as, and an " +
+            "integration here is invoked as the API rather than as a Role",
+    ],
+    [
+        "ResourcePolicy",
+        "an API Gateway resource policy is not simulated. Close the method with " +
+            "an authorizer instead",
+    ],
+    [
+        "OverrideApiAuth",
+        "it lets an event replace the API's own Auth block rather than name one " +
+            "of its authorizers",
+    ],
+]);
+/**
+ * The `Identity` properties of an authorizer this expansion does not model.
+ */
+export const samUnsupportedIdentity = new Map([
+    [
+        "ValidationExpression",
+        "it turns a token that does not match into a 401 before the authorizer " +
+            "runs, and that check is not simulated",
+    ],
+]);

package/dist/service/cloudformation/sam/api/sim-cfn-sam-http-api-template.factory.js

@@ -1,5 +1,5 @@
 import { MappedFactory } from "@kensio/part-factory";
-import { samFunctionType } from "../function/sim-cfn-sam-function.js";
+import { samFunctionType } from "../function/sim-cfn-sam-function-type.js";
 import { samTransformName } from "../sim-cfn-sam-transform.js";
 import { samHttpApiType } from "./sim-cfn-sam-http-api.js";
 /**

package/dist/service/cloudformation/sam/api/sim-cfn-sam-http-api.d.ts

@@ -22,6 +22,10 @@ export declare const samHttpApiType = "AWS::Serverless::HttpApi";
  * points at a document on disk or in S3. Nothing here reads either, and an API
  * declaring one is left as the template wrote it, to be recorded as
  * unsupported. The alternative is an API deployed with no routes at all.
+ *
+ * An `Auth` block becomes one `AWS::ApiGatewayV2::Authorizer` per authorizer it
+ * declares, named after the API and the authorizer, which the routes on the API
+ * name by `Ref`.
  */
 export declare function samHttpApiResources(properties: SamHttpApiExpansionProperties): Record<string, SimCfnTemplateValue>;
 export {};

package/dist/service/cloudformation/sam/api/sim-cfn-sam-http-api.js

@@ -1,6 +1,8 @@
-import { samCarriedAttributes, samResourceProperties, } from "../function/sim-cfn-sam-function-properties.js";
+import { samCarriedAttributes, samConditionAttribute, samResourceProperties, } from "../function/sim-cfn-sam-function-properties.js";
 import { samMergedApiProperties } from "../sim-cfn-sam-globals.js";
 import { samPickedProperties } from "../sim-cfn-sam-picked.js";
+import { samApiAuthResources } from "./auth/sim-cfn-sam-api-auth.js";
+import { samHttpApiAuth } from "./auth/sim-cfn-sam-http-api-auth.js";
 import { samHttpApiStageResources } from "./sim-cfn-sam-http-api-stage.js";
 /**
  * The SAM Resource type this expansion covers.
@@ -10,10 +12,10 @@ export const samHttpApiType = "AWS::Serverless::HttpApi";
  * The properties whose names and meanings are the same on both Resource types.
  * Expanding one of them is carrying it across.
  *
- * `Auth` and `Domain` are absent from the list. SAM writes an `Auth` block
- * into the OpenAPI document it generates, and deploys a `Domain` as a custom
- * domain name Resource. Neither is expanded here, and an API declaring one is
- * deployed without it.
+ * `Auth` and `Domain` are absent from the list. SAM deploys a `Domain` as a
+ * custom domain name Resource. That is not expanded here, and an API declaring
+ * one is deployed without it. `Auth` becomes authorizer Resources of its own
+ * beside the API.
  */
 const propertyNames = new Set([
     "CorsConfiguration",
@@ -36,6 +38,10 @@ const propertyNames = new Set([
  * points at a document on disk or in S3. Nothing here reads either, and an API
  * declaring one is left as the template wrote it, to be recorded as
  * unsupported. The alternative is an API deployed with no routes at all.
+ *
+ * An `Auth` block becomes one `AWS::ApiGatewayV2::Authorizer` per authorizer it
+ * declares, named after the API and the authorizer, which the routes on the API
+ * name by `Ref`.
  */
 export function samHttpApiResources(properties) {
     const { logicalId, resource, globals } = properties;
@@ -55,6 +61,7 @@ export function samHttpApiResources(properties) {
             },
         },
         ...samHttpApiStageResources({ logicalId, resource, apiProperties }),
+        ...samApiAuthResources(samHttpApiAuth(logicalId, apiProperties), samConditionAttribute(resource["Condition"])),
     };
 }
 /**

package/dist/service/cloudformation/sam/api/sim-cfn-sam-rest-api-template.factory.js

@@ -1,5 +1,5 @@
 import { MappedFactory } from "@kensio/part-factory";
-import { samFunctionType } from "../function/sim-cfn-sam-function.js";
+import { samFunctionType } from "../function/sim-cfn-sam-function-type.js";
 import { samTransformName } from "../sim-cfn-sam-transform.js";
 import { samRestApiType } from "./sim-cfn-sam-rest-api.js";
 /**

package/dist/service/cloudformation/sam/api/sim-cfn-sam-rest-api.js

@@ -1,6 +1,8 @@
-import { samCarriedAttributes, samResourceProperties, } from "../function/sim-cfn-sam-function-properties.js";
+import { samCarriedAttributes, samConditionAttribute, samResourceProperties, } from "../function/sim-cfn-sam-function-properties.js";
 import { samMergedApiProperties } from "../sim-cfn-sam-globals.js";
 import { samPickedProperties } from "../sim-cfn-sam-picked.js";
+import { samApiAuthResources } from "./auth/sim-cfn-sam-api-auth.js";
+import { samRestApiAuth } from "./auth/sim-cfn-sam-rest-api-auth.js";
 import { samRestApiStageResources } from "./sim-cfn-sam-rest-api-stage.js";
 /**
  * The SAM Resource type this expansion covers.
@@ -10,10 +12,11 @@ export const samRestApiType = "AWS::Serverless::Api";
  * The properties whose names and meanings are the same on both Resource types.
  * Expanding one of them is carrying it across.
  *
- * `Auth`, `Cors`, `Domain`, `GatewayResponses`, `MethodSettings` and
+ * `Cors`, `Domain`, `GatewayResponses`, `MethodSettings` and
  * `BinaryMediaTypes` are absent from the list. SAM writes all of them into the
  * Swagger document it generates, and none is expanded here, so an API
- * declaring one is deployed without it.
+ * declaring one is deployed without it. `Auth` is absent for the opposite
+ * reason. It becomes authorizer Resources of its own beside the API.
  */
 const propertyNames = new Set([
     "Description",
@@ -60,6 +63,7 @@ export function samRestApiResources(properties) {
             },
         },
         ...samRestApiStageResources({ logicalId, resource, apiProperties }),
+        ...samApiAuthResources(samRestApiAuth(logicalId, apiProperties), samConditionAttribute(resource["Condition"])),
     };
 }
 /**

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-api-event.js

@@ -1,3 +1,4 @@
+import { samEventAuthorization } from "../../api/auth/sim-cfn-sam-event-authorization.js";
 import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
 import { samApiInvokePermissionResource } from "./sim-cfn-sam-api-invoke-permission.js";
 import { samApiEventPathParts, samApiEventPathResources, samApiEventResourceId, } from "./sim-cfn-sam-api-event-path.js";
@@ -84,8 +85,11 @@ function samApiEventPath(properties) {
  *
  * SAM integrates an `Api` event as a proxy, which is the shape the function is
  * handed the request in, and the REST API declares an integration as a block
- * of the method. `Auth` on the event is not expanded, so the method authorizes
- * nothing and every request matching it reaches the function.
+ * of the method.
+ *
+ * `Auth` on the event names one of the API's authorizers, and an event naming
+ * none takes the API's `DefaultAuthorizer`. A method neither of them closes
+ * authorizes nothing, and every request matching it reaches the function.
  */
 function methodResource(properties) {
     const { event, apiLogicalId, path } = properties;
@@ -96,7 +100,7 @@ function methodResource(properties) {
             RestApiId: { Ref: apiLogicalId },
             ResourceId: samApiEventResourceId(apiLogicalId, path),
             HttpMethod: samApiEventHttpMethod(event.properties),
-            AuthorizationType: "NONE",
+            ...samEventAuthorization(event, apiLogicalId),
             Integration: {
                 Type: "AWS_PROXY",
                 IntegrationHttpMethod: "POST",

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-cognito-event.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamFunctionEvent } from "./sim-cfn-sam-declared-event.js";
+import type { SamResourceEdit } from "./sim-cfn-sam-resource-edit.js";
+/**
+ * The Resource a `Cognito` event expands into, which is the permission the
+ * pool invokes the function under.
+ *
+ * A user pool checks the function's resource policy every time a trigger
+ * fires, so the entry in its `LambdaConfig` is not enough on its own. The
+ * grant names the pool as the source, so a permission written for one pool
+ * does not open the function to another.
+ *
+ * The pool is not made to depend on the permission. Cognito reads the policy
+ * when the trigger fires rather than when the pool is created, and a pool
+ * depending on a permission that names the pool is the circular dependency
+ * CloudFormation refuses.
+ */
+export declare function samCognitoEventResources(event: SamFunctionEvent): Record<string, SimCfnTemplateValue>;
+/**
+ * The change a `Cognito` event makes to the user pool the template already
+ * declares.
+ *
+ * A trigger is a property of the pool, so this is the second event type with
+ * no Resource of its own to be.
+ */
+export declare function samCognitoEventEdits(event: SamFunctionEvent): readonly SamResourceEdit[];

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-cognito-event.js

@@ -0,0 +1,88 @@
+import { isSamTemplateRecord, samValueList } from "../../sim-cfn-sam-record.js";
+import { samTriggeredUserPool } from "./sim-cfn-sam-triggered-user-pool.js";
+/**
+ * The Resource a `Cognito` event expands into, which is the permission the
+ * pool invokes the function under.
+ *
+ * A user pool checks the function's resource policy every time a trigger
+ * fires, so the entry in its `LambdaConfig` is not enough on its own. The
+ * grant names the pool as the source, so a permission written for one pool
+ * does not open the function to another.
+ *
+ * The pool is not made to depend on the permission. Cognito reads the policy
+ * when the trigger fires rather than when the pool is created, and a pool
+ * depending on a permission that names the pool is the circular dependency
+ * CloudFormation refuses.
+ */
+export function samCognitoEventResources(event) {
+    const trigger = samCognitoTrigger(event);
+    if (trigger === undefined) {
+        return {};
+    }
+    return {
+        [`${event.functionLogicalId}${event.eventName}CognitoPermission`]: {
+            Type: "AWS::Lambda::Permission",
+            ...event.condition,
+            Properties: {
+                Action: "lambda:InvokeFunction",
+                FunctionName: { "Fn::GetAtt": [event.functionLogicalId, "Arn"] },
+                Principal: "cognito-idp.amazonaws.com",
+                SourceArn: { "Fn::GetAtt": [trigger.userPoolLogicalId, "Arn"] },
+            },
+        },
+    };
+}
+/**
+ * The change a `Cognito` event makes to the user pool the template already
+ * declares.
+ *
+ * A trigger is a property of the pool, so this is the second event type with
+ * no Resource of its own to be.
+ */
+export function samCognitoEventEdits(event) {
+    const trigger = samCognitoTrigger(event);
+    if (trigger === undefined) {
+        return [];
+    }
+    return [
+        {
+            logicalId: trigger.userPoolLogicalId,
+            edit: (resource) => samTriggeredUserPool(event, trigger.triggers, resource),
+        },
+    ];
+}
+/**
+ * What the event asks of the pool, or nothing where it named no pool or no
+ * trigger.
+ *
+ * Either one missing leaves the function as it is rather than failing the
+ * deployment, the same answer an event of a type nothing expands gets.
+ *
+ * `UserPool` is the logical ID of a pool of this template, written as the name
+ * or as a `Ref` to it, which is what SAM accepts. A pool named any other way is
+ * a pool this cannot reach to put a trigger on.
+ */
+function samCognitoTrigger(event) {
+    const userPoolLogicalId = logicalIdOf(event.properties["UserPool"]);
+    const triggers = triggerNames(event.properties["Trigger"]);
+    if (userPoolLogicalId === undefined || triggers.length === 0) {
+        return undefined;
+    }
+    return { userPoolLogicalId, triggers };
+}
+function logicalIdOf(userPool) {
+    if (typeof userPool === "string") {
+        return userPool;
+    }
+    const reference = isSamTemplateRecord(userPool) ? userPool["Ref"] : undefined;
+    return typeof reference === "string" ? reference : undefined;
+}
+/**
+ * The triggers the event names, which SAM states as one name or as a list.
+ */
+function triggerNames(trigger) {
+    if (typeof trigger === "string") {
+        return [trigger];
+    }
+    return samValueList(trigger).filter((name) => typeof name === "string");
+}

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-declared-event.d.ts

@@ -1,4 +1,5 @@
 import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamTemplateApiAuth } from "../../api/auth/sim-cfn-sam-template-api-auth.js";
 /**
  * What the expansion of a SAM function is asked about its events.
  */
@@ -12,6 +13,11 @@ export interface SamFunctionEventsProperties {
      * an API of their own.
      */
     readonly apiGlobals: SimCfnTemplateValueRecord;
+    /**
+     * The `Auth` of every API of the template, for the events that put a method
+     * or a route on one.
+     */
+    readonly apiAuth: SamTemplateApiAuth;
     /** The `Condition` the SAM Resource carried, where it carried one. */
     readonly condition: SimCfnTemplateValue | undefined;
 }
@@ -43,6 +49,12 @@ export interface SamFunctionEvent {
      * defaults as one the template declared.
      */
     readonly apiGlobals: SimCfnTemplateValueRecord;
+    /**
+     * The `Auth` of every API of the template, by the logical ID each is expanded
+     * under. An `Api` or `HttpApi` event reads the one belonging to the API it
+     * names, to say how the method or route it expands into is authorized.
+     */
+    readonly apiAuth: SamTemplateApiAuth;
 }
 /**
  * One event of a function, as the expansion tables are asked about it.

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-declared-event.js

@@ -32,6 +32,7 @@ function declaredEvent(properties, eventName, event) {
                 properties: isSamTemplateRecord(eventProperties) ? eventProperties : {},
                 condition: samConditionAttribute(properties.condition),
                 apiGlobals: properties.apiGlobals,
+                apiAuth: properties.apiAuth,
             },
         },
     ];

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-function-events.js

@@ -2,6 +2,7 @@ import { samDeclaredEvents } from "./sim-cfn-sam-declared-event.js";
 import { samDynamoDbEventResources, samSqsEventResources, } from "./sim-cfn-sam-event-source-mapping-event.js";
 import { samDynamoDbEventEdits, samSqsEventEdits, } from "./sim-cfn-sam-event-source-role.js";
 import { samApiEventResources } from "./sim-cfn-sam-api-event.js";
+import { samCognitoEventEdits, samCognitoEventResources, } from "./sim-cfn-sam-cognito-event.js";
 import { samEventBridgeRuleEventResources } from "./sim-cfn-sam-event-bridge-rule-event.js";
 import { samHttpApiEventResources } from "./sim-cfn-sam-http-api-event.js";
 import { samS3EventEdits, samS3EventResources, } from "./sim-cfn-sam-s3-event.js";
@@ -19,6 +20,7 @@ import { samSnsEventResources } from "./sim-cfn-sam-sns-event.js";
  */
 const eventExpansions = new Map([
     ["Api", samApiEventResources],
+    ["Cognito", samCognitoEventResources],
     ["DynamoDB", samDynamoDbEventResources],
     ["EventBridgeRule", samEventBridgeRuleEventResources],
     ["HttpApi", samHttpApiEventResources],
@@ -34,15 +36,16 @@ const eventExpansions = new Map([
  *
  * This is the second half of the same table, for what an event cannot express
  * as a Resource of its own. An `S3` event notifies a Bucket the template
- * declares, and a polled event grants the function's own execution Role the
- * permission to poll. Keying either by the logical ID it changes would deploy
- * the change in place of the Resource, since expanded Resources are merged
- * last write wins.
+ * declares, a `Cognito` event puts a trigger on a user pool, and a polled event
+ * grants the function's own execution Role the permission to poll. Keying any
+ * of them by the logical ID it changes would deploy the change in place of the
+ * Resource, since expanded Resources are merged last write wins.
  *
- * An event type belongs in both tables where it does both, as all three of
+ * An event type belongs in both tables where it does both, as all four of
  * these do.
  */
 const eventEdits = new Map([
+    ["Cognito", samCognitoEventEdits],
     ["DynamoDB", samDynamoDbEventEdits],
     ["S3", samS3EventEdits],
     ["SQS", samSqsEventEdits],

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-event.js

@@ -20,14 +20,16 @@ import { samImplicitHttpApiLogicalId, samImplicitHttpApiResources, } from "./sim
  */
 export function samHttpApiEventResources(event) {
     const apiId = samHttpApiEventApiId(event.properties);
+    const apiLogicalId = samHttpApiEventApiLogicalId(event.properties);
     const prefix = `${event.functionLogicalId}${event.eventName}HttpApi`;
     const integrationLogicalId = `${prefix}Integration`;
     return {
         ...(event.properties["ApiId"] === undefined &&
-            samImplicitHttpApiResources()),
+            samImplicitHttpApiResources(event.apiAuth.get(samImplicitHttpApiLogicalId))),
         [integrationLogicalId]: integrationResource(event, apiId),
         [`${prefix}Route`]: samHttpApiRouteResource({
             apiId,
+            apiLogicalId,
             integrationLogicalId,
             event,
         }),
@@ -54,6 +56,26 @@ function samHttpApiEventApiId(properties) {
     }
     return isSamTemplateRecord(apiId) ? apiId : { Ref: apiId };
 }
+/**
+ * The logical ID of the API this event routes to, where that API is a Resource
+ * of this template.
+ *
+ * It is the name the event's `Auth` is read against, since an API's
+ * authorizers are declared on the API the template holds. An `ApiId` written
+ * as an intrinsic this cannot read names an API whose `Auth` block is out of
+ * reach, and the route it expands into takes no authorizer from it.
+ */
+function samHttpApiEventApiLogicalId(properties) {
+    const apiId = properties["ApiId"];
+    if (apiId === undefined) {
+        return samImplicitHttpApiLogicalId;
+    }
+    if (typeof apiId === "string") {
+        return apiId;
+    }
+    const reference = isSamTemplateRecord(apiId) ? apiId["Ref"] : undefined;
+    return typeof reference === "string" ? reference : undefined;
+}
 /**
  * The AWS::ApiGatewayV2::Integration the route sends its requests through.
  *

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-route.d.ts

@@ -5,13 +5,20 @@ interface SamHttpApiRouteProperties {
     readonly apiId: SimCfnTemplateValue;
     /** The logical ID of the integration the route targets. */
     readonly integrationLogicalId: string;
+    /**
+     * The logical ID of the API the route belongs to, where the API is one this
+     * template declares. An event naming its API with an intrinsic this cannot
+     * read names no `Auth` block either.
+     */
+    readonly apiLogicalId: string | undefined;
     readonly event: SamFunctionEvent;
 }
 /**
  * The AWS::ApiGatewayV2::Route the event's path and method are served by.
  *
- * `Auth` on the event is not expanded. The route authorizes nothing, and every
- * request matching it reaches the function.
+ * `Auth` on the event names one of the API's authorizers, and an event naming
+ * none takes the API's `DefaultAuthorizer`. A route neither of them closes
+ * authorizes nothing, and every request matching it reaches the function.
  */
 export declare function samHttpApiRouteResource(route: SamHttpApiRouteProperties): SimCfnTemplateValueRecord;
 export {};

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-route.js

@@ -1,10 +1,12 @@
 import { simHttpApiDefaultRouteKey } from "../../../../apigatewayv2/api/route/key/sim-http-api-default-route-key.js";
 import { simHttpApiAnyMethod } from "../../../../apigatewayv2/api/route/key/sim-http-api-route-method.js";
+import { samEventAuthorization } from "../../api/auth/sim-cfn-sam-event-authorization.js";
 /**
  * The AWS::ApiGatewayV2::Route the event's path and method are served by.
  *
- * `Auth` on the event is not expanded. The route authorizes nothing, and every
- * request matching it reaches the function.
+ * `Auth` on the event names one of the API's authorizers, and an event naming
+ * none takes the API's `DefaultAuthorizer`. A route neither of them closes
+ * authorizes nothing, and every request matching it reaches the function.
  */
 export function samHttpApiRouteResource(route) {
     return {
@@ -13,7 +15,7 @@ export function samHttpApiRouteResource(route) {
         Properties: {
             ApiId: route.apiId,
             ...samHttpApiRouteKey(route.event.properties),
-            AuthorizationType: "NONE",
+            ...samEventAuthorization(route.event, route.apiLogicalId),
             Target: {
                 "Fn::Join": [
                     "",