@kensio/yulin 1.21.3 → 1.21.5

package/dist/service/s3/command/authorize/sim-s3-authorize-action.js

@@ -9,6 +9,10 @@ import { simS3ConditionContext } from "./sim-s3-condition-context.js";
  * supplied as the condition keys a Bucket policy is usually written against.
  * An omitted caller is passed through to sim IAM, so Account root fallback
  * stays owned by IAM.
+ *
+ * The resolved caller is answered rather than discarded, because this is the
+ * only point in a request where the principal has been worked out, and an
+ * Object event notification has to say who caused it.
  */
 export function simS3AuthorizeAction(request) {
     const { iam, action, resource, bucket, options } = request;
@@ -27,4 +31,5 @@ export function simS3AuthorizeAction(request) {
             resource,
         });
     }
+    return decision.caller;
 }

package/dist/service/s3/command/copy-object/copy-object-builder.d.ts

@@ -1,5 +1,6 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import { SimS3Object } from "../../object/s3-object.js";
+import type { SimS3ServerSideEncryption } from "../../object/s3-server-side-encryption.js";
 import type { SimCopyObjectCommandInput } from "./copy-object.command.js";
 interface CopyObjectBuilderProperties {
     readonly clock: SimClock;
@@ -27,7 +28,15 @@ export declare class CopyObjectBuilder {
      * its own to carry. An Object uploaded in parts keeps the multipart ETag it
      * was given, and real S3 rewrites a copy of one as a single part. The copy's
      * ETag is therefore the plain digest of its bytes.
+     *
+     * The storage class and the encryption come from the request and the
+     * destination Bucket. Real S3 stores a copy in the default class where the
+     * request names none, whatever class the source was in.
+     *
+     * The tags come from the source unless the request asked to replace them,
+     * which is the other way round from the metadata: real S3 copies tags by
+     * default and takes `TaggingDirective: REPLACE` to be told otherwise.
      */
-    build(input: SimCopyObjectCommandInput, key: string, source: SimS3Object): SimS3Object;
+    build(input: SimCopyObjectCommandInput, key: string, source: SimS3Object, destinationEncryption: SimS3ServerSideEncryption): SimS3Object;
 }
 export {};

package/dist/service/s3/command/copy-object/copy-object-builder.js

@@ -1,5 +1,7 @@
 import { SimS3Object } from "../../object/s3-object.js";
 import { simS3WriteMetadata } from "../../object/s3-write-metadata.js";
+import { simS3WriteEncryption, simS3WriteStorageClass, } from "../../object/s3-write-storage.js";
+import { simS3WriteTags } from "../../object/s3-write-tagging.js";
 /**
  * Builds the Object a copy stores at its destination.
  *
@@ -25,15 +27,29 @@ export class CopyObjectBuilder {
      * its own to carry. An Object uploaded in parts keeps the multipart ETag it
      * was given, and real S3 rewrites a copy of one as a single part. The copy's
      * ETag is therefore the plain digest of its bytes.
+     *
+     * The storage class and the encryption come from the request and the
+     * destination Bucket. Real S3 stores a copy in the default class where the
+     * request names none, whatever class the source was in.
+     *
+     * The tags come from the source unless the request asked to replace them,
+     * which is the other way round from the metadata: real S3 copies tags by
+     * default and takes `TaggingDirective: REPLACE` to be told otherwise.
      */
-    build(input, key, source) {
+    build(input, key, source, destinationEncryption) {
+        const storageClass = simS3WriteStorageClass(input, "CopyObjectCommand");
         return new SimS3Object({
             key,
             body: Buffer.from(source.body),
             metadata: input.MetadataDirective === "REPLACE"
                 ? simS3WriteMetadata(input)
                 : source.metadata,
+            tags: input.TaggingDirective === "REPLACE"
+                ? simS3WriteTags(input, "CopyObjectCommand")
+                : source.tags,
             lastModified: this.clock.now(),
+            ...(storageClass !== undefined && { storageClass }),
+            serverSideEncryption: simS3WriteEncryption(input, destinationEncryption, "CopyObjectCommand"),
         });
     }
 }

package/dist/service/s3/command/copy-object/copy-object.command.d.ts

@@ -1,5 +1,7 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimS3ObjectWriteMetadata } from "../../object/s3-write-metadata.js";
+import type { SimS3ObjectWriteStorage } from "../../object/s3-write-storage.js";
+import type { SimS3ObjectWriteTagging } from "../../object/s3-write-tagging.js";
 /**
  * Minimal structural sim S3 CopyObject command.
  */
@@ -13,12 +15,18 @@ export interface SimCopyObjectCommand {
  * apply to the destination Object under `MetadataDirective: REPLACE`. Under
  * the default `COPY` they are ignored, as real S3 ignores them.
  */
-export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata {
+export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging {
     readonly Bucket?: string | undefined;
     readonly Key?: string | undefined;
     /** The source Object, as `sourceBucket/sourceKey`, URL-encoded. */
     readonly CopySource?: string | undefined;
     readonly MetadataDirective?: string | undefined;
+    /**
+     * Whether the copy carries the source Object's tags or the request's own.
+     * `REPLACE` takes the request's `Tagging`, and anything else leaves the copy
+     * carrying what the source carried.
+     */
+    readonly TaggingDirective?: string | undefined;
 }
 /**
  * Minimal structural sim S3 CopyObject output.
@@ -31,6 +39,8 @@ export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata {
 export interface SimCopyObjectCommandOutput {
     readonly CopyObjectResult?: SimCopyObjectResult;
     readonly VersionId?: string | undefined;
+    /** The encryption S3 stamped on the copy it stored. */
+    readonly ServerSideEncryption?: string | undefined;
     readonly $metadata: SimResponseMetadata;
 }
 /**

package/dist/service/s3/command/copy-object/copy-object.handler.js

@@ -56,7 +56,7 @@ export class CopyObjectCommandHandler {
         this.sourceAuthorizer.authorize(source, from.key, options);
         const caller = this.destinationAuthorizer.authorize(destination, key, options);
         const stored = await simS3CopySourceObject(source, from.key);
-        const object = this.objectBuilder.build(command.input, key, stored);
+        const object = this.objectBuilder.build(command.input, key, stored, destination.getEncryption().algorithm);
         const version = await destination.putObject(object);
         this.notifications.objectCreated({
             bucket: destination,
@@ -71,6 +71,7 @@ export class CopyObjectCommandHandler {
                 LastModified: object.lastModified,
             },
             ...(version !== undefined && { VersionId: version.versionId }),
+            ServerSideEncryption: object.serverSideEncryption,
             $metadata: {},
         };
     }

package/dist/service/s3/command/create-bucket/create-bucket.handler.d.ts

@@ -1,6 +1,6 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { SimCreateBucketCommand, SimCreateBucketCommandOutput } from "./create-bucket.command.js";
-import { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
 import type { SimS3GlobalRegistry } from "../../sim-s3-global-registry.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
@@ -8,7 +8,7 @@ import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-int
 import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
 interface CreateBucketCommandHandlerProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
-    readonly buckets: Map<string, SimS3Bucket>;
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
     readonly s3GlobalRegistry: SimS3GlobalRegistry;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;

package/dist/service/s3/command/create-bucket/create-bucket.handler.js

@@ -1,7 +1,6 @@
-import { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { BackgroundTasks, } from "../../../../util/background/background.js";
-import { SimS3BucketNameAvailability } from "../../bucket/name-availability/sim-s3-bucket-name-availability.js";
+import { SimS3BucketMaker } from "../../bucket/sim-s3-bucket-maker.js";
 import { validateS3BucketName } from "../../bucket/validate/validate-s3-bucket-name.js";
 import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
@@ -49,19 +48,12 @@ export class CreateBucketCommandHandler {
                 resource,
             });
         }
-        const simS3BucketNameAvailability = new SimS3BucketNameAvailability({
+        new SimS3BucketMaker({
             accountRegionScope: this.accountRegionScope,
             buckets: this.buckets,
             s3GlobalRegistry: this.s3GlobalRegistry,
-        });
-        simS3BucketNameAvailability.ensureCanCreateBucketNamed(bucketName);
-        const bucket = new SimS3Bucket({
-            bucketName,
-            accountRegionScope: this.accountRegionScope,
-            clock: this.background,
-        });
-        this.buckets.set(bucketName, bucket);
-        this.s3GlobalRegistry.registerBucket(bucketName, this.accountRegionScope);
+            background: this.background,
+        }).make(bucketName);
         return {
             BucketArn: resource,
             Location: `/${bucketName}`,

package/dist/service/s3/command/create-multipart-upload/create-multipart-upload.command.d.ts

@@ -1,5 +1,7 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimS3ObjectWriteMetadata } from "../../object/s3-write-metadata.js";
+import type { SimS3ObjectWriteStorage } from "../../object/s3-write-storage.js";
+import type { SimS3ObjectWriteTagging } from "../../object/s3-write-tagging.js";
 /**
  * Minimal structural sim S3 CreateMultipartUpload command.
  */
@@ -12,7 +14,7 @@ export interface SimCreateMultipartUploadCommand {
  * This is the request that says what the Object will be, so it carries the same
  * metadata members a `PutObject` does. None of the Object's bytes arrive here.
  */
-export interface SimCreateMultipartUploadCommandInput extends SimS3ObjectWriteMetadata {
+export interface SimCreateMultipartUploadCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging {
     readonly Bucket?: string | undefined;
     readonly Key?: string | undefined;
 }
@@ -23,6 +25,8 @@ export interface SimCreateMultipartUploadCommandInput extends SimS3ObjectWriteMe
  */
 export interface SimCreateMultipartUploadCommandOutput {
     readonly Bucket?: string;
+    /** The encryption S3 will stamp on the Object the upload completes into. */
+    readonly ServerSideEncryption?: string | undefined;
     readonly Key?: string;
     readonly UploadId?: string;
     readonly $metadata: SimResponseMetadata;

package/dist/service/s3/command/create-multipart-upload/create-multipart-upload.handler.js

@@ -1,5 +1,7 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simS3WriteMetadata } from "../../object/s3-write-metadata.js";
+import { simS3WriteEncryption, simS3WriteStorageClass, } from "../../object/s3-write-storage.js";
+import { simS3WriteTags } from "../../object/s3-write-tagging.js";
 import { SimS3MultipartAccess, } from "../multipart/sim-s3-multipart-access.js";
 /**
  * Simulated S3 CreateMultipartUploadCommand handler.
@@ -22,15 +24,20 @@ export class CreateMultipartUploadCommandHandler {
         assertDefined(Bucket, "CreateMultipartUploadCommand.input.Bucket");
         assertDefined(Key, "CreateMultipartUploadCommand.input.Key");
         const { bucket } = await this.access.reach(Bucket, Key, options);
+        const storageClass = simS3WriteStorageClass(command.input, "CreateMultipartUploadCommand");
         const upload = bucket.getMultipartUploads().start({
             key: Key,
             metadata: simS3WriteMetadata(command.input),
+            tags: simS3WriteTags(command.input, "CreateMultipartUploadCommand"),
             initiated: this.access.now(),
+            ...(storageClass !== undefined && { storageClass }),
+            serverSideEncryption: simS3WriteEncryption(command.input, bucket.getEncryption().algorithm, "CreateMultipartUploadCommand"),
         });
         return {
             Bucket: bucket.bucketName,
             Key: upload.key,
             UploadId: upload.uploadId,
+            ServerSideEncryption: upload.serverSideEncryption,
             $metadata: {},
         };
     }

package/dist/service/s3/command/delete-bucket-encryption/delete-bucket-encryption.command.d.ts

@@ -0,0 +1,19 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim S3 DeleteBucketEncryption command.
+ */
+export interface SimDeleteBucketEncryptionCommand {
+    readonly input: SimDeleteBucketEncryptionCommandInput;
+}
+/**
+ * Minimal structural sim S3 DeleteBucketEncryption input.
+ */
+export interface SimDeleteBucketEncryptionCommandInput {
+    readonly Bucket?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 DeleteBucketEncryption output.
+ */
+export interface SimDeleteBucketEncryptionCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/delete-bucket-encryption/delete-bucket-encryption.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/delete-bucket-encryption/delete-bucket-encryption.handler.d.ts

@@ -0,0 +1,30 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimDeleteBucketEncryptionCommand, SimDeleteBucketEncryptionCommandOutput } from "./delete-bucket-encryption.command.js";
+interface DeleteBucketEncryptionHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated S3 DeleteBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteBucketEncryptionCommand/
+ */
+export declare class DeleteBucketEncryptionCommandHandler implements CommandHandler<SimDeleteBucketEncryptionCommand, SimDeleteBucketEncryptionCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: DeleteBucketEncryptionHandlerProperties);
+    /**
+     * Authorize and put a Bucket back to the encryption every Bucket has.
+     *
+     * Real S3 leaves the Bucket SSE-S3 encrypted rather than unencrypted, and
+     * the request is idempotent, so this reports nothing about what was there.
+     */
+    handle(command: SimDeleteBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<SimDeleteBucketEncryptionCommandOutput>;
+}
+export {};

package/dist/service/s3/command/delete-bucket-encryption/delete-bucket-encryption.handler.js

@@ -0,0 +1,38 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3EncryptionAuthorizer } from "../encryption/sim-s3-encryption-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 DeleteBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteBucketEncryptionCommand/
+ */
+export class DeleteBucketEncryptionCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3EncryptionAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and put a Bucket back to the encryption every Bucket has.
+     *
+     * Real S3 leaves the Bucket SSE-S3 encrypted rather than unencrypted, and
+     * the request is idempotent, so this reports nothing about what was there.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "DeleteBucketEncryptionCommand.input.Bucket");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeWrite(bucket, options);
+        bucket.deleteEncryption();
+        return {
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/delete-object-tagging/delete-object-tagging.command.d.ts

@@ -0,0 +1,23 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim S3 DeleteObjectTagging command.
+ */
+export interface SimDeleteObjectTaggingCommand {
+    readonly input: SimDeleteObjectTaggingCommandInput;
+}
+/**
+ * Minimal structural sim S3 DeleteObjectTagging input.
+ */
+export interface SimDeleteObjectTaggingCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly Key?: string | undefined;
+    /** The version to untag. A request naming none untags the current one. */
+    readonly VersionId?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 DeleteObjectTagging output.
+ */
+export interface SimDeleteObjectTaggingCommandOutput {
+    readonly VersionId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/delete-object-tagging/delete-object-tagging.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/delete-object-tagging/delete-object-tagging.handler.d.ts

@@ -0,0 +1,22 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type SimS3ObjectTaggingAccessProperties } from "../tagging/sim-s3-object-tagging-access.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimDeleteObjectTaggingCommand, SimDeleteObjectTaggingCommandOutput } from "./delete-object-tagging.command.js";
+/**
+ * Simulated S3 DeleteObjectTaggingCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteObjectTaggingCommand/
+ */
+export declare class DeleteObjectTaggingCommandHandler implements CommandHandler<SimDeleteObjectTaggingCommand, SimDeleteObjectTaggingCommandOutput> {
+    private readonly access;
+    constructor(properties: SimS3ObjectTaggingAccessProperties);
+    /**
+     * Take every tag off an Object, or off the version the request named.
+     *
+     * Real S3 removes the whole tag set and answers the same way whether or not
+     * the Object was carrying one, so an Object nobody had tagged is not an
+     * error. The event is raised either way, because the request is what real S3
+     * raises it for.
+     */
+    handle(command: SimDeleteObjectTaggingCommand, options?: SimS3RequestOptions): Promise<SimDeleteObjectTaggingCommandOutput>;
+}

package/dist/service/s3/command/delete-object-tagging/delete-object-tagging.handler.js

@@ -0,0 +1,42 @@
+import { SimS3ObjectTagSet } from "../../object/s3-object-tags.js";
+import { SimS3ObjectTaggingAccess, } from "../tagging/sim-s3-object-tagging-access.js";
+/**
+ * Simulated S3 DeleteObjectTaggingCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteObjectTaggingCommand/
+ */
+export class DeleteObjectTaggingCommandHandler {
+    access;
+    constructor(properties) {
+        this.access = new SimS3ObjectTaggingAccess(properties);
+    }
+    /**
+     * Take every tag off an Object, or off the version the request named.
+     *
+     * Real S3 removes the whole tag set and answers the same way whether or not
+     * the Object was carrying one, so an Object nobody had tagged is not an
+     * error. The event is raised either way, because the request is what real S3
+     * raises it for.
+     */
+    async handle(command, options) {
+        const { bucket, taggable, caller } = await this.access.reach({
+            commandName: "DeleteObjectTaggingCommand",
+            action: "s3:DeleteObjectTagging",
+            input: command.input,
+        }, options);
+        const object = await taggable.retag(SimS3ObjectTagSet.empty());
+        this.access.notifications.objectTagged({
+            bucket,
+            object,
+            caller,
+            eventName: "s3:ObjectTagging:Delete",
+            versionId: taggable.versionId,
+        });
+        return {
+            ...(taggable.versionId !== undefined && {
+                VersionId: taggable.versionId,
+            }),
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/encryption/sim-s3-encryption-authorizer.d.ts

@@ -0,0 +1,29 @@
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+interface SimS3EncryptionAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to the S3 Bucket encryption commands.
+ *
+ * Two actions for three commands. Real S3 governs both applying and removing a
+ * default encryption configuration with s3:PutEncryptionConfiguration, since
+ * removing one is applying the default in its place.
+ */
+export declare class SimS3EncryptionAuthorizer {
+    private static readonly readAction;
+    private static readonly writeAction;
+    private readonly iam;
+    constructor(properties: SimS3EncryptionAuthorizerProperties);
+    /**
+     * Ensure the caller may read the Bucket's default encryption.
+     */
+    authorizeRead(bucket: SimS3Bucket, options?: SimS3RequestOptions): void;
+    /**
+     * Ensure the caller may change the Bucket's default encryption.
+     */
+    authorizeWrite(bucket: SimS3Bucket, options?: SimS3RequestOptions): void;
+    private authorize;
+}
+export {};

package/dist/service/s3/command/encryption/sim-s3-encryption-authorizer.js

@@ -0,0 +1,49 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+import { simS3BucketResourcePolicies } from "../authorize/sim-s3-bucket-resource-policies.js";
+import { simS3ConditionContext } from "../authorize/sim-s3-condition-context.js";
+/**
+ * Applies IAM authorization to the S3 Bucket encryption commands.
+ *
+ * Two actions for three commands. Real S3 governs both applying and removing a
+ * default encryption configuration with s3:PutEncryptionConfiguration, since
+ * removing one is applying the default in its place.
+ */
+export class SimS3EncryptionAuthorizer {
+    static readAction = "s3:GetEncryptionConfiguration";
+    static writeAction = "s3:PutEncryptionConfiguration";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may read the Bucket's default encryption.
+     */
+    authorizeRead(bucket, options) {
+        this.authorize(SimS3EncryptionAuthorizer.readAction, bucket, options);
+    }
+    /**
+     * Ensure the caller may change the Bucket's default encryption.
+     */
+    authorizeWrite(bucket, options) {
+        this.authorize(SimS3EncryptionAuthorizer.writeAction, bucket, options);
+    }
+    authorize(action, bucket, options) {
+        const resource = simS3BucketArn(bucket.bucketName);
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller: options?.caller,
+            conditionContext: simS3ConditionContext(options),
+            resourcePolicies: simS3BucketResourcePolicies(bucket),
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                reason: decision.denialReason,
+                action,
+                resource,
+            });
+        }
+    }
+}

package/dist/service/s3/command/encryption/sim-s3-encryption-commands.d.ts

@@ -0,0 +1,22 @@
+import type { SimS3BucketCommandState } from "../sim-s3-bucket-command-state.js";
+import type * as simS3Commands from "../sim-s3-command.types.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+/**
+ * The default encryption commands of one simulated S3 scope.
+ */
+export declare class SimS3EncryptionCommands {
+    private readonly state;
+    constructor(state: SimS3BucketCommandState);
+    /**
+     * Apply a Bucket's default encryption.
+     */
+    put(command: simS3Commands.SimPutBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimPutBucketEncryptionCommandOutput>;
+    /**
+     * Read a Bucket's default encryption.
+     */
+    get(command: simS3Commands.SimGetBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimGetBucketEncryptionCommandOutput>;
+    /**
+     * Put a Bucket back to the encryption every Bucket has.
+     */
+    delete(command: simS3Commands.SimDeleteBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimDeleteBucketEncryptionCommandOutput>;
+}

package/dist/service/s3/command/encryption/sim-s3-encryption-commands.js

@@ -0,0 +1,30 @@
+import { DeleteBucketEncryptionCommandHandler } from "../delete-bucket-encryption/delete-bucket-encryption.handler.js";
+import { GetBucketEncryptionCommandHandler } from "../get-bucket-encryption/get-bucket-encryption.handler.js";
+import { PutBucketEncryptionCommandHandler } from "../put-bucket-encryption/put-bucket-encryption.handler.js";
+/**
+ * The default encryption commands of one simulated S3 scope.
+ */
+export class SimS3EncryptionCommands {
+    state;
+    constructor(state) {
+        this.state = state;
+    }
+    /**
+     * Apply a Bucket's default encryption.
+     */
+    async put(command, options) {
+        return await new PutBucketEncryptionCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Read a Bucket's default encryption.
+     */
+    async get(command, options) {
+        return await new GetBucketEncryptionCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Put a Bucket back to the encryption every Bucket has.
+     */
+    async delete(command, options) {
+        return await new DeleteBucketEncryptionCommandHandler(this.state).handle(command, options);
+    }
+}

package/dist/service/s3/command/get-bucket-encryption/get-bucket-encryption.command.d.ts

@@ -0,0 +1,24 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3ServerSideEncryptionConfiguration } from "../../bucket/encryption/sim-s3-bucket-encryption.js";
+/**
+ * Minimal structural sim S3 GetBucketEncryption command.
+ */
+export interface SimGetBucketEncryptionCommand {
+    readonly input: SimGetBucketEncryptionCommandInput;
+}
+/**
+ * Minimal structural sim S3 GetBucketEncryption input.
+ */
+export interface SimGetBucketEncryptionCommandInput {
+    readonly Bucket?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 GetBucketEncryption output.
+ *
+ * A Bucket nobody has configured answers with the SSE-S3 rule real S3 applies
+ * to every Bucket, rather than with an error.
+ */
+export interface SimGetBucketEncryptionCommandOutput {
+    readonly ServerSideEncryptionConfiguration?: SimS3ServerSideEncryptionConfiguration;
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/get-bucket-encryption/get-bucket-encryption.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/get-bucket-encryption/get-bucket-encryption.handler.d.ts

@@ -0,0 +1,31 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimGetBucketEncryptionCommand, SimGetBucketEncryptionCommandOutput } from "./get-bucket-encryption.command.js";
+interface GetBucketEncryptionHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated S3 GetBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/GetBucketEncryptionCommand/
+ */
+export declare class GetBucketEncryptionCommandHandler implements CommandHandler<SimGetBucketEncryptionCommand, SimGetBucketEncryptionCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: GetBucketEncryptionHandlerProperties);
+    /**
+     * Authorize and report a Bucket's default encryption.
+     *
+     * A Bucket nobody has configured answers with the SSE-S3 rule rather than an
+     * error, which is what real S3 has answered since it began encrypting every
+     * Bucket by default.
+     */
+    handle(command: SimGetBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<SimGetBucketEncryptionCommandOutput>;
+}
+export {};