@kensio/yulin 1.21.3 → 1.21.5

package/dist/service/s3/command/list-objects-v2/list-objects-v2.command.d.ts

@@ -12,7 +12,9 @@ export interface SimListObjectsV2Command {
  *
  * `ContinuationToken` resumes a truncated listing and takes precedence over
  * `StartAfter`, which only positions the first page. `Delimiter` rolls every
- * key holding it after the `Prefix` up into a common prefix.
+ * key holding it after the `Prefix` up into a common prefix. `EncodingType`
+ * asks for the keys the listing answers with to be encoded, so that a key
+ * holding a character XML cannot carry survives the response.
  */
 export interface SimListObjectsV2CommandInput {
     readonly Bucket?: string | undefined;
@@ -21,6 +23,7 @@ export interface SimListObjectsV2CommandInput {
     readonly MaxKeys?: number | undefined;
     readonly ContinuationToken?: string | undefined;
     readonly StartAfter?: string | undefined;
+    readonly EncodingType?: string | undefined;
 }
 /**
  * Minimal structural sim S3 ListObjectsV2 output.
@@ -42,5 +45,6 @@ export interface SimListObjectsV2CommandOutput {
     readonly ContinuationToken?: string | undefined;
     readonly NextContinuationToken?: string | undefined;
     readonly StartAfter?: string | undefined;
+    readonly EncodingType?: string | undefined;
     readonly $metadata: SimResponseMetadata;
 }

package/dist/service/s3/command/list-objects-v2/list-objects-v2.handler.js

@@ -2,6 +2,7 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { SimS3NoSuchBucket } from "../../error/sim-s3.error.js";
 import { BackgroundTasks, } from "../../../../util/background/background.js";
 import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3ListingEncoding } from "../../object/s3-listing-encoding.js";
 import { simS3EffectiveMaxKeys } from "../../object/s3-object-listing.js";
 import { SimS3ObjectListingLimits } from "../../object/s3-object-listing-limits.js";
 import { ListObjectsAuthorizer } from "../list-objects/list-objects-authorizer.js";
@@ -45,6 +46,9 @@ export class ListObjectsV2CommandHandler {
         }
         // Complete request sequencing before authorization and storage access.
         await this.background.sequence();
+        // Refused before anything is listed, the way real S3 refuses an argument
+        // it cannot read, rather than after a page has been built.
+        const encoding = new SimS3ListingEncoding(command.input.EncodingType);
         const maxKeys = simS3EffectiveMaxKeys(command.input.MaxKeys, this.listing.maxKeysPerPage);
         this.authorizer.authorize({
             bucket,
@@ -60,6 +64,7 @@ export class ListObjectsV2CommandHandler {
             continuationToken: command.input.ContinuationToken,
             startAfter: command.input.StartAfter,
             maxKeys,
+            encoding,
         });
     }
 }

package/dist/service/s3/command/list-parts/list-parts.handler.js

@@ -1,6 +1,5 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simS3QuotedETag } from "../../object/s3-object-etag.js";
-import { simS3DefaultStorageClass } from "../../object/s3-object-summary.js";
 import { SimS3MultipartAccess, } from "../multipart/sim-s3-multipart-access.js";
 /**
  * Simulated S3 ListPartsCommand handler.
@@ -25,7 +24,8 @@ export class ListPartsCommandHandler {
         assertDefined(Key, "ListPartsCommand.input.Key");
         assertDefined(UploadId, "ListPartsCommand.input.UploadId");
         const { bucket } = await this.access.reach(Bucket, Key, options);
-        const parts = this.access.requireUpload(bucket, UploadId).storedParts();
+        const upload = this.access.requireUpload(bucket, UploadId);
+        const parts = upload.storedParts();
         return {
             Bucket: bucket.bucketName,
             Key,
@@ -38,7 +38,7 @@ export class ListPartsCommandHandler {
                     Size: part.body.length,
                     LastModified: part.lastModified,
                 })),
-            StorageClass: simS3DefaultStorageClass,
+            StorageClass: upload.storageClass,
             IsTruncated: false,
             $metadata: {},
         };

package/dist/service/s3/command/multipart/sim-s3-multipart-access.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../../../util/background/background.js";
 import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
-import { SimS3NoSuchUpload } from "../../error/sim-s3.error.js";
+import { SimS3NoSuchUpload } from "../../error/sim-s3-upload.error.js";
 import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
 import { SimS3MultipartAuthorizer } from "./sim-s3-multipart-authorizer.js";
 /**

package/dist/service/s3/command/put-bucket-encryption/put-bucket-encryption.command.d.ts

@@ -0,0 +1,21 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3ServerSideEncryptionConfiguration } from "../../bucket/encryption/sim-s3-bucket-encryption.js";
+/**
+ * Minimal structural sim S3 PutBucketEncryption command.
+ */
+export interface SimPutBucketEncryptionCommand {
+    readonly input: SimPutBucketEncryptionCommandInput;
+}
+/**
+ * Minimal structural sim S3 PutBucketEncryption input.
+ */
+export interface SimPutBucketEncryptionCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly ServerSideEncryptionConfiguration?: SimS3ServerSideEncryptionConfiguration | undefined;
+}
+/**
+ * Minimal structural sim S3 PutBucketEncryption output.
+ */
+export interface SimPutBucketEncryptionCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/put-bucket-encryption/put-bucket-encryption.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/put-bucket-encryption/put-bucket-encryption.handler.d.ts

@@ -0,0 +1,31 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimPutBucketEncryptionCommand, SimPutBucketEncryptionCommandOutput } from "./put-bucket-encryption.command.js";
+interface PutBucketEncryptionHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated S3 PutBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/PutBucketEncryptionCommand/
+ */
+export declare class PutBucketEncryptionCommandHandler implements CommandHandler<SimPutBucketEncryptionCommand, SimPutBucketEncryptionCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: PutBucketEncryptionHandlerProperties);
+    /**
+     * Authorize and apply a Bucket's default encryption.
+     *
+     * The configuration decides the algorithm an Object written without one is
+     * stamped with. Objects already in the Bucket keep what they were written
+     * with, as they do in real S3.
+     */
+    handle(command: SimPutBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<SimPutBucketEncryptionCommandOutput>;
+}
+export {};

package/dist/service/s3/command/put-bucket-encryption/put-bucket-encryption.handler.js

@@ -0,0 +1,41 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3BucketEncryption } from "../../bucket/encryption/sim-s3-bucket-encryption.js";
+import { SimS3EncryptionAuthorizer } from "../encryption/sim-s3-encryption-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 PutBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/PutBucketEncryptionCommand/
+ */
+export class PutBucketEncryptionCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3EncryptionAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and apply a Bucket's default encryption.
+     *
+     * The configuration decides the algorithm an Object written without one is
+     * stamped with. Objects already in the Bucket keep what they were written
+     * with, as they do in real S3.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "PutBucketEncryptionCommand.input.Bucket");
+        assertDefined(command.input.ServerSideEncryptionConfiguration, "PutBucketEncryptionCommand.input.ServerSideEncryptionConfiguration");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeWrite(bucket, options);
+        bucket.configureEncryption(SimS3BucketEncryption.fromConfiguration(command.input.ServerSideEncryptionConfiguration, bucketName));
+        return {
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/put-object/put-object-builder.d.ts

@@ -1,4 +1,5 @@
 import { SimS3Object } from "../../object/s3-object.js";
+import type { SimS3ServerSideEncryption } from "../../object/s3-server-side-encryption.js";
 import type { SimPutObjectCommand } from "./put-object.command.js";
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 interface PutObjectBuilderProperties {
@@ -25,7 +26,10 @@ export declare class PutObjectBuilder {
      *
      * The Object is dated by the simulation's clock rather than the host's, so a
      * test that freezes time gets a last-modified time it can assert on.
+     *
+     * The Bucket's default encryption is passed in because the request has the
+     * last word on it and the Bucket answers for a request that names none.
      */
-    build(command: SimPutObjectCommand): SimS3Object;
+    build(command: SimPutObjectCommand, bucketEncryption: SimS3ServerSideEncryption): SimS3Object;
 }
 export {};

package/dist/service/s3/command/put-object/put-object-builder.js

@@ -1,6 +1,8 @@
 import { SimS3Object } from "../../object/s3-object.js";
 import { simS3WriteBodyBuffer } from "../../object/s3-write-body.js";
 import { simS3WriteMetadata } from "../../object/s3-write-metadata.js";
+import { simS3WriteEncryption, simS3WriteStorageClass, } from "../../object/s3-write-storage.js";
+import { simS3WriteTags } from "../../object/s3-write-tagging.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 /**
  * Converts the supported PutObject request fields into a stored sim S3 Object.
@@ -25,14 +27,21 @@ export class PutObjectBuilder {
      *
      * The Object is dated by the simulation's clock rather than the host's, so a
      * test that freezes time gets a last-modified time it can assert on.
+     *
+     * The Bucket's default encryption is passed in because the request has the
+     * last word on it and the Bucket answers for a request that names none.
      */
-    build(command) {
+    build(command, bucketEncryption) {
         assertDefined(command.input.Key, "PutObjectCommand.input.Key");
+        const storageClass = simS3WriteStorageClass(command.input, "PutObjectCommand");
         return new SimS3Object({
             key: command.input.Key,
             body: simS3WriteBodyBuffer(command.input.Body, "PutObjectCommand"),
             metadata: simS3WriteMetadata(command.input),
+            tags: simS3WriteTags(command.input, "PutObjectCommand"),
             lastModified: this.clock.now(),
+            ...(storageClass !== undefined && { storageClass }),
+            serverSideEncryption: simS3WriteEncryption(command.input, bucketEncryption, "PutObjectCommand"),
         });
     }
 }

package/dist/service/s3/command/put-object/put-object.command.d.ts

@@ -1,6 +1,8 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimS3WriteBody } from "../../object/s3-write-body.js";
 import type { SimS3ObjectWriteMetadata } from "../../object/s3-write-metadata.js";
+import type { SimS3ObjectWriteStorage } from "../../object/s3-write-storage.js";
+import type { SimS3ObjectWriteTagging } from "../../object/s3-write-tagging.js";
 /**
  * Minimal structural sim S3 PutObject command.
  */
@@ -14,7 +16,7 @@ export interface SimPutObjectCommand {
  * Object carries, which is why they are declared once in
  * `SimS3ObjectWriteMetadata` and shared with `CreateMultipartUpload`.
  */
-export interface SimPutObjectCommandInput extends SimS3ObjectWriteMetadata {
+export interface SimPutObjectCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging {
     readonly Bucket?: string | undefined;
     readonly Key?: string | undefined;
     readonly Body?: SimPutObjectBody;
@@ -30,6 +32,8 @@ export interface SimPutObjectCommandInput extends SimS3ObjectWriteMetadata {
 export interface SimPutObjectCommandOutput {
     readonly ETag?: string;
     readonly VersionId?: string | undefined;
+    /** The encryption S3 stamped on the Object it stored. */
+    readonly ServerSideEncryption?: string | undefined;
     readonly $metadata: SimResponseMetadata;
 }
 /**

package/dist/service/s3/command/put-object/put-object.handler.js

@@ -44,7 +44,7 @@ export class PutObjectCommandHandler {
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
         const caller = this.authorizer.authorize(bucket, Key, options);
-        const object = this.objectBuilder.build(command);
+        const object = this.objectBuilder.build(command, bucket.getEncryption().algorithm);
         const version = await bucket.putObject(object);
         const versionId = version?.versionId;
         // Every write path funnels through here, so this one call covers the SDK,
@@ -59,6 +59,7 @@ export class PutObjectCommandHandler {
         return {
             ETag: simS3QuotedETag(object.etag),
             ...(versionId !== undefined && { VersionId: versionId }),
+            ServerSideEncryption: object.serverSideEncryption,
             $metadata: {},
         };
     }

package/dist/service/s3/command/put-object-tagging/put-object-tagging.command.d.ts

@@ -0,0 +1,37 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3ObjectTagInput } from "../../object/s3-object-tags.js";
+/**
+ * Minimal structural sim S3 PutObjectTagging command.
+ */
+export interface SimPutObjectTaggingCommand {
+    readonly input: SimPutObjectTaggingCommandInput;
+}
+/**
+ * Minimal structural sim S3 PutObjectTagging input.
+ *
+ * The tag set arrives as a list here rather than as the query string a write
+ * carries it in, because this request has a body of its own to put it in.
+ */
+export interface SimPutObjectTaggingCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly Key?: string | undefined;
+    /** The version to tag. A request naming none tags the current one. */
+    readonly VersionId?: string | undefined;
+    readonly Tagging?: SimS3TaggingInput | undefined;
+}
+/**
+ * Minimal structural sim S3 tag set, as a tagging request states one.
+ */
+export interface SimS3TaggingInput {
+    readonly TagSet?: readonly SimS3ObjectTagInput[] | undefined;
+}
+/**
+ * Minimal structural sim S3 PutObjectTagging output.
+ *
+ * `VersionId` is the version the tags were put on, on a Bucket keeping
+ * versions.
+ */
+export interface SimPutObjectTaggingCommandOutput {
+    readonly VersionId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/put-object-tagging/put-object-tagging.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/put-object-tagging/put-object-tagging.handler.d.ts

@@ -0,0 +1,22 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type SimS3ObjectTaggingAccessProperties } from "../tagging/sim-s3-object-tagging-access.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimPutObjectTaggingCommand, SimPutObjectTaggingCommandOutput } from "./put-object-tagging.command.js";
+/**
+ * Simulated S3 PutObjectTaggingCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/PutObjectTaggingCommand/
+ */
+export declare class PutObjectTaggingCommandHandler implements CommandHandler<SimPutObjectTaggingCommand, SimPutObjectTaggingCommandOutput> {
+    private readonly access;
+    constructor(properties: SimS3ObjectTaggingAccessProperties);
+    /**
+     * Replace the tags on an Object, or on the version the request named.
+     *
+     * Real S3 puts the whole tag set rather than adding to it, so a request
+     * naming one tag leaves the Object carrying that tag alone. The set is read
+     * before anything is written, which is what refuses eleven tags without
+     * leaving ten of them on the Object.
+     */
+    handle(command: SimPutObjectTaggingCommand, options?: SimS3RequestOptions): Promise<SimPutObjectTaggingCommandOutput>;
+}

package/dist/service/s3/command/put-object-tagging/put-object-tagging.handler.js

@@ -0,0 +1,46 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimS3ObjectTagSet } from "../../object/s3-object-tags.js";
+import { SimS3ObjectTaggingAccess, } from "../tagging/sim-s3-object-tagging-access.js";
+/**
+ * Simulated S3 PutObjectTaggingCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/PutObjectTaggingCommand/
+ */
+export class PutObjectTaggingCommandHandler {
+    access;
+    constructor(properties) {
+        this.access = new SimS3ObjectTaggingAccess(properties);
+    }
+    /**
+     * Replace the tags on an Object, or on the version the request named.
+     *
+     * Real S3 puts the whole tag set rather than adding to it, so a request
+     * naming one tag leaves the Object carrying that tag alone. The set is read
+     * before anything is written, which is what refuses eleven tags without
+     * leaving ten of them on the Object.
+     */
+    async handle(command, options) {
+        const { Tagging } = command.input;
+        assertDefined(Tagging, "PutObjectTaggingCommand.input.Tagging");
+        const tags = SimS3ObjectTagSet.from(Tagging.TagSet ?? [], "PutObjectTaggingCommand");
+        const { bucket, taggable, caller } = await this.access.reach({
+            commandName: "PutObjectTaggingCommand",
+            action: "s3:PutObjectTagging",
+            input: command.input,
+        }, options);
+        const object = await taggable.retag(tags);
+        this.access.notifications.objectTagged({
+            bucket,
+            object,
+            caller,
+            eventName: "s3:ObjectTagging:Put",
+            versionId: taggable.versionId,
+        });
+        return {
+            ...(taggable.versionId !== undefined && {
+                VersionId: taggable.versionId,
+            }),
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/sim-s3-command.types.d.ts

@@ -16,7 +16,10 @@ export type { SimDeletePublicAccessBlockCommand, SimDeletePublicAccessBlockComma
 export type { SimDeleteBucketLifecycleCommand, SimDeleteBucketLifecycleCommandOutput, } from "./delete-bucket-lifecycle/delete-bucket-lifecycle.command.js";
 export type { SimGetBucketLifecycleConfigurationCommand, SimGetBucketLifecycleConfigurationCommandOutput, } from "./get-bucket-lifecycle-configuration/get-bucket-lifecycle-configuration.command.js";
 export type { SimPutBucketLifecycleConfigurationCommand, SimPutBucketLifecycleConfigurationCommandOutput, SimS3LifecycleConfiguration, SimS3LifecycleRule, } from "./put-bucket-lifecycle-configuration/put-bucket-lifecycle-configuration.command.js";
+export type { SimDeleteBucketEncryptionCommand, SimDeleteBucketEncryptionCommandOutput, } from "./delete-bucket-encryption/delete-bucket-encryption.command.js";
+export type { SimGetBucketEncryptionCommand, SimGetBucketEncryptionCommandOutput, } from "./get-bucket-encryption/get-bucket-encryption.command.js";
 export type { SimGetBucketVersioningCommand, SimGetBucketVersioningCommandOutput, } from "./get-bucket-versioning/get-bucket-versioning.command.js";
+export type { SimPutBucketEncryptionCommand, SimPutBucketEncryptionCommandOutput, } from "./put-bucket-encryption/put-bucket-encryption.command.js";
 export type { SimPutBucketVersioningCommand, SimPutBucketVersioningCommandOutput, } from "./put-bucket-versioning/put-bucket-versioning.command.js";
 export type { SimListObjectVersionsCommand, SimListObjectVersionsCommandOutput, SimS3DeleteMarkerSummary, SimS3ObjectVersionSummary, } from "./list-object-versions/list-object-versions.command.js";
 export type { SimGetBucketPolicyCommand, SimGetBucketPolicyCommandOutput, } from "./get-bucket-policy/get-bucket-policy.command.js";
@@ -41,3 +44,6 @@ export type { SimPutObjectLockConfigurationCommand, SimPutObjectLockConfiguratio
 export type { SimGetObjectLockConfigurationCommand, SimGetObjectLockConfigurationCommandInput, SimGetObjectLockConfigurationCommandOutput, } from "./get-object-lock-configuration/get-object-lock-configuration.command.js";
 export type { SimPutObjectRetentionCommand, SimPutObjectRetentionCommandInput, SimPutObjectRetentionCommandOutput, } from "./put-object-retention/put-object-retention.command.js";
 export type { SimPutObjectLegalHoldCommand, SimPutObjectLegalHoldCommandInput, SimPutObjectLegalHoldCommandOutput, } from "./put-object-legal-hold/put-object-legal-hold.command.js";
+export type { SimPutObjectTaggingCommand, SimPutObjectTaggingCommandInput, SimPutObjectTaggingCommandOutput, SimS3TaggingInput, } from "./put-object-tagging/put-object-tagging.command.js";
+export type { SimGetObjectTaggingCommand, SimGetObjectTaggingCommandInput, SimGetObjectTaggingCommandOutput, } from "./get-object-tagging/get-object-tagging.command.js";
+export type { SimDeleteObjectTaggingCommand, SimDeleteObjectTaggingCommandInput, SimDeleteObjectTaggingCommandOutput, } from "./delete-object-tagging/delete-object-tagging.command.js";

package/dist/service/s3/command/tagging/sim-s3-object-tagging-access.d.ts

@@ -0,0 +1,61 @@
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3TaggableObject } from "../../bucket/tagging/sim-s3-taggable-object.js";
+import type { SimS3ObjectNotifier } from "../../notification/sim-s3-object-notifier.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import { type SimS3ObjectTaggingAction } from "./sim-s3-object-tagging-authorizer.js";
+export interface SimS3ObjectTaggingAccessProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+    readonly notifications: SimS3ObjectNotifier;
+}
+/**
+ * The members every tagging request states, alongside the IAM action it is
+ * granted by and the command name to report a missing member against.
+ */
+export interface SimS3TaggingRequest {
+    readonly commandName: string;
+    readonly action: SimS3ObjectTaggingAction;
+    readonly input: {
+        readonly Bucket?: string | undefined;
+        readonly Key?: string | undefined;
+        readonly VersionId?: string | undefined;
+    };
+}
+/**
+ * What a tagging request names once it has been allowed.
+ */
+interface SimS3ReachedObject {
+    readonly bucket: SimS3Bucket;
+    readonly taggable: SimS3TaggableObject;
+    readonly caller: SimAwsResolvedCaller;
+}
+/**
+ * Getting at the tags on an Object, with permission.
+ *
+ * The three tagging operations share the whole of their preamble: read the
+ * Bucket and key the request has to state, find the Bucket or answer
+ * NoSuchBucket, let the background scheduler order the request, authorize it
+ * under the action that operation is granted by, and find the Object or the
+ * version it names. Holding that here leaves each handler with the one thing it
+ * actually does to the tags.
+ */
+export declare class SimS3ObjectTaggingAccess {
+    readonly notifications: SimS3ObjectNotifier;
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: SimS3ObjectTaggingAccessProperties);
+    /**
+     * Find and authorize the Object a tagging request names.
+     *
+     * The Bucket is looked up before authorization so a request against a Bucket
+     * that is not there keeps S3's error, and the Object is read after it, which
+     * leaves a refused caller knowing nothing about which keys exist.
+     */
+    reach(request: SimS3TaggingRequest, options?: SimS3RequestOptions): Promise<SimS3ReachedObject>;
+}
+export {};

package/dist/service/s3/command/tagging/sim-s3-object-tagging-access.js

@@ -0,0 +1,49 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+import { SimS3ObjectTaggingAuthorizer, } from "./sim-s3-object-tagging-authorizer.js";
+/**
+ * Getting at the tags on an Object, with permission.
+ *
+ * The three tagging operations share the whole of their preamble: read the
+ * Bucket and key the request has to state, find the Bucket or answer
+ * NoSuchBucket, let the background scheduler order the request, authorize it
+ * under the action that operation is granted by, and find the Object or the
+ * version it names. Holding that here leaves each handler with the one thing it
+ * actually does to the tags.
+ */
+export class SimS3ObjectTaggingAccess {
+    notifications;
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3ObjectTaggingAuthorizer({ iam });
+        this.background = background;
+        this.notifications = properties.notifications;
+    }
+    /**
+     * Find and authorize the Object a tagging request names.
+     *
+     * The Bucket is looked up before authorization so a request against a Bucket
+     * that is not there keeps S3's error, and the Object is read after it, which
+     * leaves a refused caller knowing nothing about which keys exist.
+     */
+    async reach(request, options) {
+        const { Bucket, Key, VersionId } = request.input;
+        assertDefined(Bucket, `${request.commandName}.input.Bucket`);
+        assertDefined(Key, `${request.commandName}.input.Key`);
+        const bucket = requireSimS3Bucket(this.buckets, Bucket);
+        // Allow for potential non-deterministic sequencing of async events.
+        await this.background.sequence();
+        const caller = this.authorizer.authorize(request.action, bucket, Key, options);
+        return {
+            bucket,
+            taggable: await bucket.taggableObject(Key, VersionId),
+            caller,
+        };
+    }
+}

package/dist/service/s3/command/tagging/sim-s3-object-tagging-authorizer.d.ts

@@ -0,0 +1,30 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+/**
+ * The IAM action one of the three tagging commands is granted by.
+ *
+ * Real S3 grants them separately, so a policy can let a caller read the tags on
+ * an Object it may not retag, and `s3:PutObject` grants none of them.
+ */
+export type SimS3ObjectTaggingAction = "s3:GetObjectTagging" | "s3:PutObjectTagging" | "s3:DeleteObjectTagging";
+interface SimS3ObjectTaggingAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to the S3 Object tagging commands.
+ *
+ * All three are authorized against the Object ARN, because tags belong to the
+ * Object rather than to the Bucket holding it.
+ */
+export declare class SimS3ObjectTaggingAuthorizer {
+    private readonly iam;
+    constructor(properties: SimS3ObjectTaggingAuthorizerProperties);
+    /**
+     * Ensure the caller may take this tagging action on an Object, answering the
+     * principal it turned out to be.
+     */
+    authorize(action: SimS3ObjectTaggingAction, bucket: SimS3Bucket, key: string, options?: SimS3RequestOptions): SimAwsResolvedCaller;
+}
+export {};

package/dist/service/s3/command/tagging/sim-s3-object-tagging-authorizer.js

@@ -0,0 +1,27 @@
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+import { simS3AuthorizeAction } from "../authorize/sim-s3-authorize-action.js";
+/**
+ * Applies IAM authorization to the S3 Object tagging commands.
+ *
+ * All three are authorized against the Object ARN, because tags belong to the
+ * Object rather than to the Bucket holding it.
+ */
+export class SimS3ObjectTaggingAuthorizer {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may take this tagging action on an Object, answering the
+     * principal it turned out to be.
+     */
+    authorize(action, bucket, key, options) {
+        return simS3AuthorizeAction({
+            iam: this.iam,
+            action,
+            resource: `${simS3BucketArn(bucket.bucketName)}/${key}`,
+            bucket,
+            options,
+        });
+    }
+}

package/dist/service/s3/command/tagging/sim-s3-object-tagging-commands.d.ts

@@ -0,0 +1,26 @@
+import type { SimS3BucketCommandState } from "../sim-s3-bucket-command-state.js";
+import type * as simS3Commands from "../sim-s3-command.types.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+/**
+ * The Object tagging commands of one simulated S3 scope.
+ *
+ * Real S3 holds tags against an Object without rewriting it, and grants each of
+ * the three a permission of its own, which is why they are an area rather than
+ * three more Object commands.
+ */
+export declare class SimS3ObjectTaggingCommands {
+    private readonly state;
+    constructor(state: SimS3BucketCommandState);
+    /**
+     * Replace the tags on an Object.
+     */
+    put(command: simS3Commands.SimPutObjectTaggingCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimPutObjectTaggingCommandOutput>;
+    /**
+     * Read the tags on an Object.
+     */
+    get(command: simS3Commands.SimGetObjectTaggingCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimGetObjectTaggingCommandOutput>;
+    /**
+     * Take every tag off an Object.
+     */
+    delete(command: simS3Commands.SimDeleteObjectTaggingCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimDeleteObjectTaggingCommandOutput>;
+}

package/dist/service/s3/command/tagging/sim-s3-object-tagging-commands.js

@@ -0,0 +1,34 @@
+import { DeleteObjectTaggingCommandHandler } from "../delete-object-tagging/delete-object-tagging.handler.js";
+import { GetObjectTaggingCommandHandler } from "../get-object-tagging/get-object-tagging.handler.js";
+import { PutObjectTaggingCommandHandler } from "../put-object-tagging/put-object-tagging.handler.js";
+/**
+ * The Object tagging commands of one simulated S3 scope.
+ *
+ * Real S3 holds tags against an Object without rewriting it, and grants each of
+ * the three a permission of its own, which is why they are an area rather than
+ * three more Object commands.
+ */
+export class SimS3ObjectTaggingCommands {
+    state;
+    constructor(state) {
+        this.state = state;
+    }
+    /**
+     * Replace the tags on an Object.
+     */
+    async put(command, options) {
+        return await new PutObjectTaggingCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Read the tags on an Object.
+     */
+    async get(command, options) {
+        return await new GetObjectTaggingCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Take every tag off an Object.
+     */
+    async delete(command, options) {
+        return await new DeleteObjectTaggingCommandHandler(this.state).handle(command, options);
+    }
+}