@kensio/yulin 1.21.3 → 1.21.5

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-authorizer-function.js

@@ -0,0 +1,58 @@
+/**
+ * The `AuthorizerUri` an authorizer invokes a function through.
+ *
+ * API Gateway names the function through its own service path rather than by
+ * ARN, and this is the wrapped form both authorizer Resource types take. The
+ * function ARN goes in as the template wrote it, which is a `Fn::GetAtt` on a
+ * function of the same template more often than not.
+ */
+export function samAuthorizerUri(functionArn) {
+    return {
+        "Fn::Join": [
+            "",
+            [
+                "arn:",
+                { Ref: "AWS::Partition" },
+                ":apigateway:",
+                { Ref: "AWS::Region" },
+                ":lambda:path/2015-03-31/functions/",
+                functionArn,
+                "/invocations",
+            ],
+        ],
+    };
+}
+/**
+ * The AWS::Lambda::Permission an API invokes its authorizer function under.
+ *
+ * Without it the authorizer answers nothing and every request the authorizer
+ * decides is refused. The source ARN wildcards the authorizers of the one API,
+ * because the authorizer's own id is only known once it is created, and a
+ * grant naming it would have to be deployed after the thing that needs it.
+ */
+export function samAuthorizerPermissionResource(properties) {
+    return {
+        Type: "AWS::Lambda::Permission",
+        Properties: {
+            Action: "lambda:InvokeFunction",
+            FunctionName: properties.functionArn,
+            Principal: "apigateway.amazonaws.com",
+            SourceArn: {
+                "Fn::Join": [
+                    "",
+                    [
+                        "arn:",
+                        { Ref: "AWS::Partition" },
+                        ":execute-api:",
+                        { Ref: "AWS::Region" },
+                        ":",
+                        { Ref: "AWS::AccountId" },
+                        ":",
+                        { Ref: properties.apiLogicalId },
+                        "/authorizers/*",
+                    ],
+                ],
+            },
+        },
+    };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-event-authorization.d.ts

@@ -0,0 +1,18 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamFunctionEvent } from "../../function/event/sim-cfn-sam-declared-event.js";
+/**
+ * How the method or route one event expands into is authorized.
+ *
+ * The event names one of the API's authorizers, or takes the API's
+ * `DefaultAuthorizer` when it names none. `Authorizer: NONE` opens a method the
+ * default would otherwise have closed, which is the only way SAM has of
+ * leaving one path of a protected API open.
+ *
+ * An event naming an authorizer the API does not declare is refused. The
+ * alternative is a method deployed open under a name that reads as closed.
+ *
+ * The API is named by logical ID, and an event naming its API with an
+ * intrinsic this cannot read names no `Auth` block either. Its method carries
+ * whatever the event states for itself, which is nothing more often than not.
+ */
+export declare function samEventAuthorization(event: SamFunctionEvent, apiLogicalId: string | undefined): SimCfnTemplateValueRecord;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-event-authorization.js

@@ -0,0 +1,89 @@
+import { samFunctionType } from "../../function/sim-cfn-sam-function-type.js";
+import { samPropertyError } from "../../sim-cfn-sam-error.js";
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samNoAuthorizerName } from "./sim-cfn-sam-api-auth.types.js";
+import { samUnsupportedEventAuth } from "./sim-cfn-sam-unsupported-auth.js";
+/**
+ * The `Auth` properties an event may state. Everything else SAM has there is
+ * refused by name.
+ */
+const supportedProperties = new Set(["Authorizer", "AuthorizationScopes"]);
+/**
+ * How the method or route one event expands into is authorized.
+ *
+ * The event names one of the API's authorizers, or takes the API's
+ * `DefaultAuthorizer` when it names none. `Authorizer: NONE` opens a method the
+ * default would otherwise have closed, which is the only way SAM has of
+ * leaving one path of a protected API open.
+ *
+ * An event naming an authorizer the API does not declare is refused. The
+ * alternative is a method deployed open under a name that reads as closed.
+ *
+ * The API is named by logical ID, and an event naming its API with an
+ * intrinsic this cannot read names no `Auth` block either. Its method carries
+ * whatever the event states for itself, which is nothing more often than not.
+ */
+export function samEventAuthorization(event, apiLogicalId) {
+    const apiAuth = apiLogicalId === undefined ? undefined : event.apiAuth.get(apiLogicalId);
+    const auth = eventAuthBlock(event);
+    const name = auth["Authorizer"] ?? apiAuth?.defaultAuthorizer;
+    if (name === undefined || name === samNoAuthorizerName) {
+        return { AuthorizationType: "NONE" };
+    }
+    const authorizer = namedAuthorizer(event, apiAuth, name);
+    const scopes = auth["AuthorizationScopes"] ?? authorizer.authorizationScopes;
+    return {
+        AuthorizationType: authorizer.authorizationType,
+        ...(authorizer.logicalId !== undefined && {
+            AuthorizerId: { Ref: authorizer.logicalId },
+        }),
+        ...(scopes !== undefined && { AuthorizationScopes: scopes }),
+    };
+}
+/**
+ * The `Auth` block the event declares, refusing every property this expansion
+ * cannot model.
+ */
+function eventAuthBlock(event) {
+    const declared = event.properties["Auth"];
+    if (declared === undefined) {
+        return {};
+    }
+    if (!isSamTemplateRecord(declared)) {
+        throw eventAuthError(event, "Auth", "it is not a block of settings");
+    }
+    for (const name of Object.keys(declared)) {
+        if (!supportedProperties.has(name)) {
+            throw eventAuthError(event, `Auth.${name}`, samUnsupportedEventAuth.get(name) ??
+                "it is not an event Auth property this expansion knows");
+        }
+    }
+    return declared;
+}
+/**
+ * The authorizer the event named, refusing a name the API has no authorizer
+ * for.
+ */
+function namedAuthorizer(event, apiAuth, name) {
+    if (typeof name !== "string") {
+        throw eventAuthError(event, "Auth.Authorizer", "it is not the name of one of the API's authorizers");
+    }
+    if (apiAuth === undefined) {
+        throw eventAuthError(event, "Auth.Authorizer", `${name} names an authorizer of an API whose Auth block is out of ` +
+            "reach. An event reaches one by naming a SAM API of this template, " +
+            "as the logical ID or as a `Ref` to it");
+    }
+    const authorizer = apiAuth.authorizers.get(name);
+    if (authorizer === undefined) {
+        throw eventAuthError(event, "Auth.Authorizer", `${name} is not an authorizer the API's Auth block declares`);
+    }
+    return authorizer;
+}
+function eventAuthError(event, property, reason) {
+    return samPropertyError({
+        resourceType: samFunctionType,
+        logicalId: event.functionLogicalId,
+        property: `Events.${event.eventName}.${property}`,
+        reason,
+    });
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-api-auth.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuth } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The `Auth` of one AWS::Serverless::HttpApi, as the authorizer Resources it
+ * declares and the default every route takes.
+ *
+ * SAM writes these into the OpenAPI document it generates. They are written as
+ * `AWS::ApiGatewayV2::Authorizer` Resources here, the way the routes beside
+ * them are written as Resources.
+ *
+ * `AWS_IAM` is an authorizer of an HTTP API only once `EnableIamAuthorizer`
+ * asks for it, which is the rule real SAM applies. A REST API has it either
+ * way.
+ */
+export declare function samHttpApiAuth(logicalId: string, apiProperties: SimCfnTemplateValueRecord): SamApiAuth;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-api-auth.js

@@ -0,0 +1,65 @@
+import { samApiAuthBlock, samAuthError, samIamAuthorizer, } from "./sim-cfn-sam-api-auth.js";
+import { samApiAuthorizerDefinitions, samApiDefaultAuthorizer, } from "./sim-cfn-sam-api-authorizers.js";
+import { samIamAuthorizerName } from "./sim-cfn-sam-api-auth.types.js";
+import { samHttpJwtAuthorizer } from "./sim-cfn-sam-http-jwt-authorizer.js";
+import { samHttpLambdaAuthorizer } from "./sim-cfn-sam-http-lambda-authorizer.js";
+/**
+ * The SAM Resource type an HTTP API `Auth` block is declared on.
+ */
+const resourceType = "AWS::Serverless::HttpApi";
+/**
+ * The `Auth` properties this expansion reads on an HTTP API. Everything else
+ * SAM has there is refused by name.
+ */
+const supportedProperties = new Set([
+    "Authorizers",
+    "DefaultAuthorizer",
+    "EnableIamAuthorizer",
+]);
+/**
+ * The `Auth` of one AWS::Serverless::HttpApi, as the authorizer Resources it
+ * declares and the default every route takes.
+ *
+ * SAM writes these into the OpenAPI document it generates. They are written as
+ * `AWS::ApiGatewayV2::Authorizer` Resources here, the way the routes beside
+ * them are written as Resources.
+ *
+ * `AWS_IAM` is an authorizer of an HTTP API only once `EnableIamAuthorizer`
+ * asks for it, which is the rule real SAM applies. A REST API has it either
+ * way.
+ */
+export function samHttpApiAuth(logicalId, apiProperties) {
+    const api = { resourceType, logicalId };
+    const auth = samApiAuthBlock(api, apiProperties, supportedProperties);
+    const iam = auth["EnableIamAuthorizer"] === true
+        ? [[samIamAuthorizerName, samIamAuthorizer()]]
+        : [];
+    return {
+        api,
+        authorizers: new Map([
+            ...iam,
+            ...samApiAuthorizerDefinitions(api, auth).map(([name, definition]) => [name, httpAuthorizer({ api, name, definition })]),
+        ]),
+        defaultAuthorizer: samApiDefaultAuthorizer(api, auth),
+    };
+}
+/**
+ * One authorizer of an HTTP API, as the Resource it becomes and what a route
+ * naming it carries.
+ *
+ * An authorizer naming a `JwtConfiguration` verifies tokens itself, and one
+ * naming a `FunctionArn` asks a function of the template. An authorizer naming
+ * neither is refused rather than deployed as something it did not ask to be.
+ */
+function httpAuthorizer(authorizer) {
+    const jwtConfiguration = authorizer.definition["JwtConfiguration"];
+    if (jwtConfiguration !== undefined) {
+        return samHttpJwtAuthorizer(authorizer, jwtConfiguration);
+    }
+    const functionArn = authorizer.definition["FunctionArn"];
+    if (functionArn !== undefined) {
+        return samHttpLambdaAuthorizer(authorizer, functionArn);
+    }
+    throw samAuthError(authorizer.api, `Auth.Authorizers.${authorizer.name}`, "it names neither a JwtConfiguration nor a FunctionArn, so there is no " +
+        "telling what would decide a request");
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-jwt-authorizer.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+import type { SamAuthorizerDefinition } from "./sim-cfn-sam-authorizer-definition.js";
+/**
+ * An HTTP API JWT authorizer, which verifies the token a request carries
+ * against the issuer it names.
+ *
+ * SAM writes the issuer and audience the way the OpenAPI document does, in
+ * lower case, where the Resource takes them capitalised. Both spellings are
+ * read, since a template written against the CloudFormation shape is the one
+ * more likely to be pasted in from elsewhere.
+ */
+export declare function samHttpJwtAuthorizer(authorizer: SamAuthorizerDefinition, jwtConfiguration: SimCfnTemplateValue): SamApiAuthorizer;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-jwt-authorizer.js

@@ -0,0 +1,60 @@
+import { isSamTemplateRecord } from "../../sim-cfn-sam-record.js";
+import { samAuthError, samAuthorizerLogicalId, } from "./sim-cfn-sam-api-auth.js";
+/**
+ * An HTTP API JWT authorizer, which verifies the token a request carries
+ * against the issuer it names.
+ *
+ * SAM writes the issuer and audience the way the OpenAPI document does, in
+ * lower case, where the Resource takes them capitalised. Both spellings are
+ * read, since a template written against the CloudFormation shape is the one
+ * more likely to be pasted in from elsewhere.
+ */
+export function samHttpJwtAuthorizer(authorizer, jwtConfiguration) {
+    const { api, name, definition } = authorizer;
+    if (!isSamTemplateRecord(jwtConfiguration)) {
+        throw samAuthError(api, `Auth.Authorizers.${name}.JwtConfiguration`, "it is not a block naming an issuer and an audience");
+    }
+    const logicalId = samAuthorizerLogicalId(api, name);
+    return {
+        authorizationType: "JWT",
+        logicalId,
+        authorizationScopes: definition["AuthorizationScopes"],
+        resources: {
+            [logicalId]: {
+                Type: "AWS::ApiGatewayV2::Authorizer",
+                Properties: {
+                    ApiId: { Ref: api.logicalId },
+                    Name: name,
+                    AuthorizerType: "JWT",
+                    IdentitySource: identitySource(definition),
+                    JwtConfiguration: jwtProperties(jwtConfiguration),
+                },
+            },
+        },
+    };
+}
+/**
+ * The issuer and audience the authorizer Resource is created with.
+ *
+ * A key naming nothing is left out rather than written as nothing, so what the
+ * Resource is refused for is the key the template left out.
+ */
+function jwtProperties(jwtConfiguration) {
+    const issuer = jwtConfiguration["Issuer"] ?? jwtConfiguration["issuer"];
+    const audience = jwtConfiguration["Audience"] ?? jwtConfiguration["audience"];
+    return {
+        ...(issuer !== undefined && { Issuer: issuer }),
+        ...(audience !== undefined && { Audience: audience }),
+    };
+}
+/**
+ * Where the authorizer reads the token from, which an HTTP API states as a
+ * list even where SAM states one string.
+ */
+function identitySource(definition) {
+    const declared = definition["IdentitySource"];
+    if (declared === undefined) {
+        return ["$request.header.Authorization"];
+    }
+    return Array.isArray(declared) ? declared : [declared];
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-lambda-authorizer.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+import type { SamAuthorizerDefinition } from "./sim-cfn-sam-authorizer-definition.js";
+/**
+ * An HTTP API Lambda authorizer, which asks a function of the template what to
+ * do with the request.
+ *
+ * `AuthorizerPayloadFormatVersion` is required by SAM and goes on as it came,
+ * so a version the simulation does not run is refused by CreateAuthorizer
+ * naming it rather than here. An authorizer stating none gets `2.0`, the
+ * format the rest of this expansion integrates a function under.
+ */
+export declare function samHttpLambdaAuthorizer(authorizer: SamAuthorizerDefinition, functionArn: SimCfnTemplateValue): SamApiAuthorizer;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-http-lambda-authorizer.js

@@ -0,0 +1,50 @@
+import { samAuthorizerLogicalId, samAuthorizerResultTtl, } from "./sim-cfn-sam-api-auth.js";
+import { samApiIdentity } from "./sim-cfn-sam-api-identity.js";
+import { samAuthorizerPermissionResource, samAuthorizerUri, } from "./sim-cfn-sam-authorizer-function.js";
+import { samHttpIdentityPrefixes } from "./sim-cfn-sam-identity-prefixes.js";
+/**
+ * An HTTP API Lambda authorizer, which asks a function of the template what to
+ * do with the request.
+ *
+ * `AuthorizerPayloadFormatVersion` is required by SAM and goes on as it came,
+ * so a version the simulation does not run is refused by CreateAuthorizer
+ * naming it rather than here. An authorizer stating none gets `2.0`, the
+ * format the rest of this expansion integrates a function under.
+ */
+export function samHttpLambdaAuthorizer(authorizer, functionArn) {
+    const { api, name, definition } = authorizer;
+    const identity = samApiIdentity({
+        api,
+        authorizerName: name,
+        authorizer: definition,
+        prefixes: samHttpIdentityPrefixes,
+    });
+    const logicalId = samAuthorizerLogicalId(api, name);
+    const simpleResponses = definition["EnableSimpleResponses"];
+    return {
+        authorizationType: "CUSTOM",
+        logicalId,
+        authorizationScopes: undefined,
+        resources: {
+            [logicalId]: {
+                Type: "AWS::ApiGatewayV2::Authorizer",
+                Properties: {
+                    ApiId: { Ref: api.logicalId },
+                    Name: name,
+                    AuthorizerType: "REQUEST",
+                    AuthorizerUri: samAuthorizerUri(functionArn),
+                    IdentitySource: [...identity.identitySource],
+                    AuthorizerPayloadFormatVersion: definition["AuthorizerPayloadFormatVersion"] ?? "2.0",
+                    ...(simpleResponses !== undefined && {
+                        EnableSimpleResponses: simpleResponses,
+                    }),
+                    ...samAuthorizerResultTtl(identity.reauthorizeEvery),
+                },
+            },
+            [`${logicalId}Permission`]: samAuthorizerPermissionResource({
+                functionArn,
+                apiLogicalId: api.logicalId,
+            }),
+        },
+    };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-identity-prefixes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * How a REST API names the parts of a request an authorizer reads.
+ */
+export declare const samRestIdentityPrefixes: ReadonlyMap<string, string>;
+/**
+ * How an HTTP API names the same parts.
+ */
+export declare const samHttpIdentityPrefixes: ReadonlyMap<string, string>;
+/**
+ * The `Identity` properties this expansion reads. `Header` is the singular a
+ * Cognito or `TOKEN` authorizer states, and reads as a `Headers` of one.
+ */
+export declare const samIdentityPropertyNames: Set<string>;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-identity-prefixes.js

@@ -0,0 +1,30 @@
+/**
+ * How a REST API names the parts of a request an authorizer reads.
+ */
+export const samRestIdentityPrefixes = new Map([
+    ["Headers", "method.request.header."],
+    ["QueryStrings", "method.request.querystring."],
+    ["StageVariables", "stageVariables."],
+    ["Context", "context."],
+]);
+/**
+ * How an HTTP API names the same parts.
+ */
+export const samHttpIdentityPrefixes = new Map([
+    ["Headers", "$request.header."],
+    ["QueryStrings", "$request.querystring."],
+    ["StageVariables", "$stageVariables."],
+    ["Context", "$context."],
+]);
+/**
+ * The `Identity` properties this expansion reads. `Header` is the singular a
+ * Cognito or `TOKEN` authorizer states, and reads as a `Headers` of one.
+ */
+export const samIdentityPropertyNames = new Set([
+    "Header",
+    "Headers",
+    "QueryStrings",
+    "StageVariables",
+    "Context",
+    "ReauthorizeEvery",
+]);

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-identity-source.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthApi } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * What one authorizer's `Identity` block is read against.
+ */
+export interface SamApiIdentityProperties {
+    readonly api: SamApiAuthApi;
+    /** The name the `Authorizers` map declared this authorizer under. */
+    readonly authorizerName: string;
+    /** The authorizer's own properties, which may declare no `Identity` at all. */
+    readonly authorizer: SimCfnTemplateValueRecord;
+    /** How the API this authorizer belongs to names the parts of a request. */
+    readonly prefixes: ReadonlyMap<string, string>;
+}
+/**
+ * The request parts the authorizer is keyed on, in the order the API names
+ * them.
+ *
+ * The singular `Header` a Cognito or `TOKEN` authorizer states reads as a
+ * `Headers` of one, so both spellings arrive under the same prefix.
+ */
+export declare function samIdentitySource(properties: SamApiIdentityProperties, identity: SimCfnTemplateValueRecord): readonly string[];
+/**
+ * The error a property of an authorizer's `Identity` block is refused with.
+ */
+export declare function samIdentityError(properties: SamApiIdentityProperties, property: string, reason: string): Error;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-identity-source.js

@@ -0,0 +1,44 @@
+import { samAuthError } from "./sim-cfn-sam-api-auth.js";
+/**
+ * The request parts the authorizer is keyed on, in the order the API names
+ * them.
+ *
+ * The singular `Header` a Cognito or `TOKEN` authorizer states reads as a
+ * `Headers` of one, so both spellings arrive under the same prefix.
+ */
+export function samIdentitySource(properties, identity) {
+    return properties.prefixes
+        .entries()
+        .flatMap(([name, prefix]) => identityNames(properties, identity, name).map((part) => `${prefix}${part}`))
+        .toArray();
+}
+/**
+ * The error a property of an authorizer's `Identity` block is refused with.
+ */
+export function samIdentityError(properties, property, reason) {
+    return samAuthError(properties.api, `Auth.Authorizers.${properties.authorizerName}.${property}`, reason);
+}
+function identityNames(properties, identity, name) {
+    const singular = name === "Headers" ? identity["Header"] : undefined;
+    // oxlint-disable-next-line security/detect-object-injection -- a template record read by one of the Identity property names.
+    const declared = identity[name];
+    return [
+        ...(singular === undefined ? [] : [singular]),
+        ...asList(properties, name, declared),
+    ].map((value) => identityName(properties, name, value));
+}
+function asList(properties, name, declared) {
+    if (declared === undefined) {
+        return [];
+    }
+    if (!Array.isArray(declared)) {
+        throw samIdentityError(properties, `Identity.${name}`, "it is not a list of names");
+    }
+    return declared;
+}
+function identityName(properties, name, value) {
+    if (typeof value !== "string") {
+        throw samIdentityError(properties, `Identity.${name}`, "it names a part of the request as something other than a string");
+    }
+    return value;
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-api-auth.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuth } from "./sim-cfn-sam-api-auth.types.js";
+/**
+ * The `Auth` of one AWS::Serverless::Api, as the authorizer Resources it
+ * declares and the default every method takes.
+ *
+ * SAM writes these into the Swagger document it generates. They are written as
+ * `AWS::ApiGateway::Authorizer` Resources here, the way the methods beside them
+ * are written as Resources, so an authorizer is something a Stack holds,
+ * answers `Ref` for and tears down.
+ *
+ * `AWS_IAM` is an authorizer of every REST API without being declared, since a
+ * SAM template names it as a `DefaultAuthorizer` without declaring one.
+ */
+export declare function samRestApiAuth(logicalId: string, apiProperties: SimCfnTemplateValueRecord): SamApiAuth;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-api-auth.js

@@ -0,0 +1,59 @@
+import { samApiAuthBlock, samAuthError, samIamAuthorizer, } from "./sim-cfn-sam-api-auth.js";
+import { samApiAuthorizerDefinitions, samApiDefaultAuthorizer, } from "./sim-cfn-sam-api-authorizers.js";
+import { samIamAuthorizerName } from "./sim-cfn-sam-api-auth.types.js";
+import { samRestCognitoAuthorizer } from "./sim-cfn-sam-rest-cognito-authorizer.js";
+import { samRestLambdaAuthorizer } from "./sim-cfn-sam-rest-lambda-authorizer.js";
+/**
+ * The SAM Resource type a REST API `Auth` block is declared on.
+ */
+const resourceType = "AWS::Serverless::Api";
+/**
+ * The `Auth` properties this expansion reads on a REST API. Everything else
+ * SAM has there is refused by name.
+ */
+const supportedProperties = new Set(["Authorizers", "DefaultAuthorizer"]);
+/**
+ * The `Auth` of one AWS::Serverless::Api, as the authorizer Resources it
+ * declares and the default every method takes.
+ *
+ * SAM writes these into the Swagger document it generates. They are written as
+ * `AWS::ApiGateway::Authorizer` Resources here, the way the methods beside them
+ * are written as Resources, so an authorizer is something a Stack holds,
+ * answers `Ref` for and tears down.
+ *
+ * `AWS_IAM` is an authorizer of every REST API without being declared, since a
+ * SAM template names it as a `DefaultAuthorizer` without declaring one.
+ */
+export function samRestApiAuth(logicalId, apiProperties) {
+    const api = { resourceType, logicalId };
+    const auth = samApiAuthBlock(api, apiProperties, supportedProperties);
+    return {
+        api,
+        authorizers: new Map([
+            [samIamAuthorizerName, samIamAuthorizer()],
+            ...samApiAuthorizerDefinitions(api, auth).map(([name, definition]) => [name, restAuthorizer({ api, name, definition })]),
+        ]),
+        defaultAuthorizer: samApiDefaultAuthorizer(api, auth),
+    };
+}
+/**
+ * One authorizer of a REST API, as the Resource it becomes and what a method
+ * naming it carries.
+ *
+ * A Cognito authorizer is the one that names a `UserPoolArn`, and a Lambda one
+ * the one that names a `FunctionArn`. That is how SAM tells them apart, and an
+ * authorizer naming neither is refused rather than deployed as something it
+ * did not ask to be.
+ */
+function restAuthorizer(authorizer) {
+    const userPoolArn = authorizer.definition["UserPoolArn"];
+    if (userPoolArn !== undefined) {
+        return samRestCognitoAuthorizer(authorizer, userPoolArn);
+    }
+    const functionArn = authorizer.definition["FunctionArn"];
+    if (functionArn !== undefined) {
+        return samRestLambdaAuthorizer(authorizer, functionArn);
+    }
+    throw samAuthError(authorizer.api, `Auth.Authorizers.${authorizer.name}`, "it names neither a UserPoolArn nor a FunctionArn, so there is no " +
+        "telling what would decide a request");
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-cognito-authorizer.d.ts

@@ -0,0 +1,11 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+import type { SamAuthorizerDefinition } from "./sim-cfn-sam-authorizer-definition.js";
+/**
+ * A REST API Cognito user pool authorizer, which verifies the token a request
+ * carries against the pool it names.
+ *
+ * `AuthorizationScopes` on the authorizer is what every method it decides asks
+ * of the token, and an event may ask for different ones of its own.
+ */
+export declare function samRestCognitoAuthorizer(authorizer: SamAuthorizerDefinition, userPoolArn: SimCfnTemplateValue): SamApiAuthorizer;

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-cognito-authorizer.js

@@ -0,0 +1,43 @@
+import { samAuthorizerLogicalId, samAuthorizerResultTtl, } from "./sim-cfn-sam-api-auth.js";
+import { samApiIdentity } from "./sim-cfn-sam-api-identity.js";
+import { samRestIdentityPrefixes } from "./sim-cfn-sam-identity-prefixes.js";
+/**
+ * The header a Cognito authorizer reads its token from where the template says
+ * nothing, which is the one real API Gateway defaults to.
+ */
+const defaultIdentitySource = "method.request.header.Authorization";
+/**
+ * A REST API Cognito user pool authorizer, which verifies the token a request
+ * carries against the pool it names.
+ *
+ * `AuthorizationScopes` on the authorizer is what every method it decides asks
+ * of the token, and an event may ask for different ones of its own.
+ */
+export function samRestCognitoAuthorizer(authorizer, userPoolArn) {
+    const { api, name, definition } = authorizer;
+    const identity = samApiIdentity({
+        api,
+        authorizerName: name,
+        authorizer: definition,
+        prefixes: samRestIdentityPrefixes,
+    });
+    const logicalId = samAuthorizerLogicalId(api, name);
+    return {
+        authorizationType: "COGNITO_USER_POOLS",
+        logicalId,
+        authorizationScopes: definition["AuthorizationScopes"],
+        resources: {
+            [logicalId]: {
+                Type: "AWS::ApiGateway::Authorizer",
+                Properties: {
+                    RestApiId: { Ref: api.logicalId },
+                    Name: name,
+                    Type: "COGNITO_USER_POOLS",
+                    ProviderARNs: [userPoolArn],
+                    IdentitySource: identity.identitySource.join(",") || defaultIdentitySource,
+                    ...samAuthorizerResultTtl(identity.reauthorizeEvery),
+                },
+            },
+        },
+    };
+}

package/dist/service/cloudformation/sam/api/auth/sim-cfn-sam-rest-lambda-authorizer.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuthorizer } from "./sim-cfn-sam-api-auth.types.js";
+import type { SamAuthorizerDefinition } from "./sim-cfn-sam-authorizer-definition.js";
+/**
+ * A REST API Lambda authorizer, which asks a function of the template what to
+ * do with the request.
+ *
+ * `FunctionPayloadType` decides which of the two kinds it is. A `TOKEN`
+ * authorizer is handed one header, and a `REQUEST` authorizer the whole
+ * request. SAM defaults to `TOKEN`, and so does this. A `TOKEN` authorizer
+ * naming no header of its own reads `Authorization`, and a `REQUEST` one is
+ * allowed to read nothing by name, which is how it is asked to run on every
+ * request.
+ */
+export declare function samRestLambdaAuthorizer(authorizer: SamAuthorizerDefinition, functionArn: SimCfnTemplateValue): SamApiAuthorizer;