@kensio/yulin 1.21.34 → 1.22.0

package/dist/service/cloudformation/registry/sim-cfn-attribute-reads.d.ts

@@ -0,0 +1,11 @@
+import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
+/**
+ * The logical IDs of the Resources a template reads an attribute of, through
+ * `Fn::GetAtt` or a `${LogicalId.Attribute}` in `Fn::Sub`, anywhere in its
+ * Resources or Outputs.
+ *
+ * This reads the raw template, before conditions are applied. A `Fn::GetAtt`
+ * in an `Fn::If` branch the conditions rule out still counts, which can
+ * authorize a read real CloudFormation would not make.
+ */
+export declare function simCfnAttributeReads(template: CfnTemplateBodyRecord): ReadonlySet<string>;

package/dist/service/cloudformation/registry/sim-cfn-attribute-reads.js

@@ -0,0 +1,64 @@
+import { isRecord } from "../../../util/type-guard/record.js";
+const subVariablePattern = /\$\{(?<name>[^!}][^}]*)\}/gu;
+/**
+ * The logical IDs of the Resources a template reads an attribute of, through
+ * `Fn::GetAtt` or a `${LogicalId.Attribute}` in `Fn::Sub`, anywhere in its
+ * Resources or Outputs.
+ *
+ * This reads the raw template, before conditions are applied. A `Fn::GetAtt`
+ * in an `Fn::If` branch the conditions rule out still counts, which can
+ * authorize a read real CloudFormation would not make.
+ */
+export function simCfnAttributeReads(template) {
+    const reads = new Set();
+    collect(template.Resources, reads);
+    collect(template.Outputs ?? {}, reads);
+    return reads;
+}
+function collect(value, reads) {
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            collect(item, reads);
+        }
+        return;
+    }
+    if (!isRecord(value)) {
+        return;
+    }
+    for (const [key, entry] of Object.entries(value)) {
+        if (key === "Fn::GetAtt") {
+            addGetAttTarget(entry, reads);
+        }
+        else if (key === "Fn::Sub") {
+            addSubTargets(entry, reads);
+        }
+        collect(entry, reads);
+    }
+}
+/** `["Logical", "Attribute"]`, or the short form `"Logical.Attribute"`. */
+function addGetAttTarget(value, reads) {
+    const target = Array.isArray(value) ? value[0] : value;
+    if (typeof target === "string") {
+        reads.add(target.split(".", 1)[0] ?? target);
+    }
+}
+/**
+ * A `${Logical.Attribute}` in a `Fn::Sub` string. A name the Sub's own
+ * variable map gives is a variable and reads no Resource, and `${!Literal}` is
+ * escaped text.
+ */
+function addSubTargets(value, reads) {
+    const [text, variables] = Array.isArray(value) ? value : [value, undefined];
+    if (typeof text !== "string") {
+        return;
+    }
+    for (const match of text.matchAll(subVariablePattern)) {
+        const name = match.groups?.["name"] ?? "";
+        const [logicalId, attribute] = name.split(".", 2);
+        if (logicalId !== undefined &&
+            attribute !== undefined &&
+            !(isRecord(variables) && Object.hasOwn(variables, name))) {
+            reads.add(logicalId);
+        }
+    }
+}

package/dist/service/cloudformation/registry/sim-cfn-read-handler-authorizer.d.ts

@@ -0,0 +1,45 @@
+import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
+import type { SimCfnStackDeployContext } from "../stack/sim-cfn-stack-deploy-context.js";
+import type { SimCfnStackUpdatePlan } from "../stack/update/sim-cfn-stack-update-plan.js";
+import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
+interface SimCfnReadHandlerAuthorizerProperties {
+    /**
+     * Where the simulation and the Stack's caller are read from. The caller is
+     * read when the update authorizes, because an update naming a caller of its
+     * own takes it on after this is made.
+     */
+    readonly context: SimCfnStackDeployContext;
+}
+/**
+ * Authorizes the calls CloudFormation's read handlers make as the deployment's
+ * caller.
+ *
+ * Real CloudFormation calls a Resource's read handler when it needs the
+ * Resource's attributes and holds no fresh model of it. A Stack update that
+ * leaves a Resource alone, while the new template reads one of its attributes
+ * through `Fn::GetAtt`, is the case simulated here. The handler runs as the
+ * Stack's execution role, so a role missing one of its calls fails the update.
+ *
+ * This needs no model of the Resource's service. A Resource type yulin skips
+ * is authorized the same way as one it creates, from the registry snapshot
+ * and the Resource's properties.
+ */
+export declare class SimCfnReadHandlerAuthorizer {
+    private readonly context;
+    constructor(properties: SimCfnReadHandlerAuthorizerProperties);
+    /**
+     * Ensure the caller may make the read handler calls of each Resource an
+     * update leaves alone while its new template reads the Resource's
+     * attributes.
+     */
+    authorizeUpdate(plan: SimCfnStackUpdatePlan, update: {
+        readonly updated: SimCfnTemplate;
+        readonly resources: ReadonlyMap<string, SimCfnResource>;
+    }): Promise<void>;
+    /**
+     * Ensure the caller may make every call each Resource's read handler makes.
+     */
+    authorize(reading: readonly SimCfnResource[], resources: ReadonlyMap<string, SimCfnResource>): Promise<void>;
+    private authorizeOne;
+}
+export {};

package/dist/service/cloudformation/registry/sim-cfn-read-handler-authorizer.js

@@ -0,0 +1,72 @@
+import { SimIamActionAuthorizer } from "../../iam/authorize/sim-iam-action-authorizer.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
+import { simCfnReadHandler } from "./sim-cfn-read-handlers.js";
+import { SimCfnResourceArn } from "./sim-cfn-resource-arn.js";
+/**
+ * Authorizes the calls CloudFormation's read handlers make as the deployment's
+ * caller.
+ *
+ * Real CloudFormation calls a Resource's read handler when it needs the
+ * Resource's attributes and holds no fresh model of it. A Stack update that
+ * leaves a Resource alone, while the new template reads one of its attributes
+ * through `Fn::GetAtt`, is the case simulated here. The handler runs as the
+ * Stack's execution role, so a role missing one of its calls fails the update.
+ *
+ * This needs no model of the Resource's service. A Resource type yulin skips
+ * is authorized the same way as one it creates, from the registry snapshot
+ * and the Resource's properties.
+ */
+export class SimCfnReadHandlerAuthorizer {
+    context;
+    constructor(properties) {
+        this.context = properties.context;
+    }
+    /**
+     * Ensure the caller may make the read handler calls of each Resource an
+     * update leaves alone while its new template reads the Resource's
+     * attributes.
+     */
+    async authorizeUpdate(plan, update) {
+        await this.authorize(plan.untouchedReadBy(update.updated.template), update.resources);
+    }
+    /**
+     * Ensure the caller may make every call each Resource's read handler makes.
+     */
+    async authorize(reading, resources) {
+        await Promise.all(reading.map(async (resource) => {
+            await this.authorizeOne(resource, resources);
+        }));
+    }
+    async authorizeOne(resource, resources) {
+        const handler = simCfnReadHandler(resource.type ?? "");
+        if (handler === undefined) {
+            return;
+        }
+        const { simAws, caller } = this.context;
+        const resolvedProperties = await resource.resolvedProperties({
+            resources,
+            simAws,
+            caller,
+        });
+        const resourceArn = new SimCfnResourceArn({
+            resource,
+            arnFormat: handler.arnFormat,
+            resolvedProperties,
+        }).value();
+        const { accountId, regionName } = resource.accountRegionScope;
+        const authorizer = new SimIamActionAuthorizer({
+            iam: simScopeIamAuthZ(simAws.accountRegionScope(accountId, regionName)),
+        });
+        // The denial keeps its AccessDenied name, as a failed creation's does, so a
+        // test can match it the way it matches any other refusal.
+        try {
+            handler.authorize(authorizer, resourceArn, caller);
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                error.message = `Sim CloudFormation Resource ${resource.logicalId} read handler failed: ${error.message}`;
+            }
+            throw error;
+        }
+    }
+}

package/dist/service/cloudformation/registry/sim-cfn-read-handler.d.ts

@@ -0,0 +1,33 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamActionAuthorizer } from "../../iam/authorize/sim-iam-action-authorizer.js";
+interface SimCfnReadHandlerProperties {
+    readonly resourceType: string;
+    readonly arnFormat: string;
+    readonly actions: readonly string[];
+    readonly anyResourceActions: readonly string[];
+}
+/**
+ * The IAM actions one Resource type's CloudFormation read handler calls as
+ * the Stack's execution role, and the ARN format they are decided on.
+ *
+ * Only the actions in the type's own service are held. Each is decided either
+ * on the Resource's own ARN or, for an action IAM scopes to no resource type
+ * (`batch:DescribeJobQueues`), on `*`.
+ */
+export declare class SimCfnReadHandler {
+    readonly resourceType: string;
+    /**
+     * The Resource's ARN with its variables left in, as the Service
+     * Authorization Reference writes it (`repository/${DomainName}/...`).
+     */
+    readonly arnFormat: string;
+    private readonly actions;
+    private readonly anyResourceActions;
+    constructor(properties: SimCfnReadHandlerProperties);
+    /**
+     * Ensure the caller may make every call the read handler makes on the
+     * Resource with this ARN.
+     */
+    authorize(authorizer: SimIamActionAuthorizer, resourceArn: string, caller: SimAwsCaller | undefined): void;
+}
+export {};

package/dist/service/cloudformation/registry/sim-cfn-read-handler.fixture.d.ts

@@ -0,0 +1,24 @@
+import { SimAws } from "../../aws/sim-aws.js";
+import { type SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+export declare const readHandlerRegionName = "eu-west-2";
+/** A Bucket an update adds, so that the update has something to do. */
+export declare const addedBucket: {
+    Type: string;
+    Properties: {
+        BucketName: string;
+    };
+};
+/** A simulation in a fresh Account, in the Region the tests read ARNs in. */
+export declare function readHandlerSimulation(): {
+    simAws: SimAws;
+    accountId: SimAwsAccountId;
+};
+/**
+ * Update a Stack, which goes on running as the role it was deployed as.
+ */
+export declare function updateStack(simAws: SimAws, stackName: string, template: object): Promise<void>;
+/**
+ * A Role a deployment can run as, holding the statements it is given.
+ */
+export declare function deployRole(simAws: SimAws, accountId: SimAwsAccountId, statements: readonly object[]): Promise<SimAwsCaller>;

package/dist/service/cloudformation/registry/sim-cfn-read-handler.fixture.js

@@ -0,0 +1,58 @@
+import { SimAws } from "../../aws/sim-aws.js";
+import { makeSimAwsAccountId, } from "../../aws/sim-aws-account.js";
+import { jsonStringify } from "../../../util/type-guard/json.js";
+export const readHandlerRegionName = "eu-west-2";
+/** A Bucket an update adds, so that the update has something to do. */
+export const addedBucket = {
+    Type: "AWS::S3::Bucket",
+    Properties: { BucketName: "chineseboost-sources" },
+};
+/** A simulation in a fresh Account, in the Region the tests read ARNs in. */
+export function readHandlerSimulation() {
+    const accountId = makeSimAwsAccountId();
+    return {
+        simAws: new SimAws({
+            defaultAccountId: accountId,
+            defaultRegionName: readHandlerRegionName,
+        }),
+        accountId,
+    };
+}
+/**
+ * Update a Stack, which goes on running as the role it was deployed as.
+ */
+export async function updateStack(simAws, stackName, template) {
+    await simAws.cloudFormation().updateStack({
+        input: { StackName: stackName, TemplateBody: jsonStringify(template) },
+    });
+}
+/**
+ * A Role a deployment can run as, holding the statements it is given.
+ */
+export async function deployRole(simAws, accountId, statements) {
+    const iam = simAws.account(accountId).iam();
+    await iam.createRole({
+        input: {
+            RoleName: "deployer",
+            AssumeRolePolicyDocument: jsonStringify({
+                Version: "2012-10-17",
+                Statement: {
+                    Effect: "Allow",
+                    Action: "sts:AssumeRole",
+                    Principal: { Service: "cloudformation.amazonaws.com" },
+                },
+            }),
+        },
+    });
+    await iam.putRolePolicy({
+        input: {
+            RoleName: "deployer",
+            PolicyName: "deployer-policy",
+            PolicyDocument: jsonStringify({
+                Version: "2012-10-17",
+                Statement: statements,
+            }),
+        },
+    });
+    return { kind: "arn", arn: `arn:aws:iam::${accountId}:role/deployer` };
+}

package/dist/service/cloudformation/registry/sim-cfn-read-handler.js

@@ -0,0 +1,36 @@
+/**
+ * The IAM actions one Resource type's CloudFormation read handler calls as
+ * the Stack's execution role, and the ARN format they are decided on.
+ *
+ * Only the actions in the type's own service are held. Each is decided either
+ * on the Resource's own ARN or, for an action IAM scopes to no resource type
+ * (`batch:DescribeJobQueues`), on `*`.
+ */
+export class SimCfnReadHandler {
+    resourceType;
+    /**
+     * The Resource's ARN with its variables left in, as the Service
+     * Authorization Reference writes it (`repository/${DomainName}/...`).
+     */
+    arnFormat;
+    actions;
+    anyResourceActions;
+    constructor(properties) {
+        this.resourceType = properties.resourceType;
+        this.arnFormat = properties.arnFormat;
+        this.actions = properties.actions;
+        this.anyResourceActions = properties.anyResourceActions;
+    }
+    /**
+     * Ensure the caller may make every call the read handler makes on the
+     * Resource with this ARN.
+     */
+    authorize(authorizer, resourceArn, caller) {
+        for (const action of this.actions) {
+            authorizer.authorize(action, resourceArn, caller);
+        }
+        for (const action of this.anyResourceActions) {
+            authorizer.authorize(action, "*", caller);
+        }
+    }
+}

package/dist/service/cloudformation/registry/sim-cfn-read-handlers.d.ts

@@ -0,0 +1,10 @@
+import { SimCfnReadHandler } from "./sim-cfn-read-handler.js";
+/**
+ * The read handler of each CloudFormation Resource type, from the snapshot
+ * `scripts/mts/write-cfn-read-handlers.mts` writes.
+ *
+ * A type the snapshot leaves out has no read handler sim CloudFormation can
+ * authorize. Either the registry publishes none for it, or none of its
+ * permissions is decided on a resource type named after it.
+ */
+export declare function simCfnReadHandler(resourceType: string): SimCfnReadHandler | undefined;

package/dist/service/cloudformation/registry/sim-cfn-read-handlers.js

@@ -0,0 +1,23 @@
+import snapshot from "./sim-cfn-read-handlers.json" with { type: "json" };
+import { SimCfnReadHandler } from "./sim-cfn-read-handler.js";
+const records = new Map(Object.entries(snapshot.types));
+/**
+ * The read handler of each CloudFormation Resource type, from the snapshot
+ * `scripts/mts/write-cfn-read-handlers.mts` writes.
+ *
+ * A type the snapshot leaves out has no read handler sim CloudFormation can
+ * authorize. Either the registry publishes none for it, or none of its
+ * permissions is decided on a resource type named after it.
+ */
+export function simCfnReadHandler(resourceType) {
+    const record = records.get(resourceType);
+    if (record === undefined) {
+        return undefined;
+    }
+    return new SimCfnReadHandler({
+        resourceType,
+        arnFormat: record.arn,
+        actions: record.actions,
+        anyResourceActions: record.anyResourceActions,
+    });
+}