@kensio/yulin 1.21.34 → 1.23.0

package/dist/serve/controller/sim-service-controller.d.ts

@@ -25,6 +25,7 @@ interface SimAwsServiceRequestProperties {
     readonly request: Request;
     readonly caller?: SimAwsRequestCaller | undefined;
     readonly source?: SimAwsRequestSource | undefined;
+    readonly sourceIp?: string | undefined;
     readonly body?: Uint8Array | undefined;
 }
 /**
@@ -49,6 +50,11 @@ export declare class SimAwsServiceRequest {
      * conditioned on, and most requests state none.
      */
     readonly source: SimAwsRequestSource | undefined;
+    /**
+     * The client address the request came from, which is loopback unless the
+     * request stated another with `x-sim-aws-source-ip`.
+     */
+    readonly sourceIp: string;
     readonly body?: Uint8Array | undefined;
     constructor(properties: SimAwsServiceRequestProperties);
 }

package/dist/serve/controller/sim-service-controller.js

@@ -1,3 +1,4 @@
+import { simAwsProxiedSourceIp } from "../http/sim-aws-proxied-connection.js";
 import { SimAwsRequestCaller } from "../../service/iam/request/sim-aws-request-caller.js";
 /**
  * One HTTP request, routed to a simulated service and attributed to a
@@ -21,6 +22,11 @@ export class SimAwsServiceRequest {
      * conditioned on, and most requests state none.
      */
     source;
+    /**
+     * The client address the request came from, which is loopback unless the
+     * request stated another with `x-sim-aws-source-ip`.
+     */
+    sourceIp;
     body;
     constructor(properties) {
         this.target = properties.target;
@@ -28,6 +34,7 @@ export class SimAwsServiceRequest {
         // An unattributed request is anonymous, never the Account root.
         this.caller = properties.caller ?? SimAwsRequestCaller.anonymous();
         this.source = properties.source;
+        this.sourceIp = properties.sourceIp ?? simAwsProxiedSourceIp;
         this.body = properties.body;
     }
 }

package/dist/serve/http/request/sim-aws-request-authenticator.js

@@ -1,6 +1,7 @@
 import { simAwsServiceSigningName } from "../../controller/sim-aws-service-signing-name.js";
 import { SimAwsServiceRequest, } from "../../controller/sim-service-controller.js";
 import { SimAwsRequestSource } from "../../../service/iam/request/sim-aws-request-source.js";
+import { simAwsRequestSourceIp } from "../../../service/iam/request/sim-aws-source-ip-header.js";
 import { SimAwsReceivedRequest } from "./sim-aws-received-request.js";
 /**
  * Turns a received HTTP request into a request a simulated service can serve.
@@ -40,11 +41,13 @@ export class SimAwsRequestAuthenticator {
             },
         });
         const source = SimAwsRequestSource.fromHeaders(request.headers);
+        const sourceIp = simAwsRequestSourceIp(request.headers);
         return new SimAwsServiceRequest({
             target,
             request: received.forService(),
             caller,
             ...(source !== undefined && { source }),
+            sourceIp,
             body: received.body,
         });
     }

package/dist/service/apigateway/serve/sim-api-gateway-controller.js

@@ -77,6 +77,7 @@ export class SimApiGatewayServiceController {
             restApi,
             stageName: restApiRequest.segments[0] ?? "",
             request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         if (inspected.blocked !== undefined) {
             return inspected.blocked;

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.d.ts

@@ -5,6 +5,8 @@ interface SimRestApiInspectionInput {
     /** The first path segment of the request, which names the stage. */
     readonly stageName: string;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
 }
 /**
  * Puts a request to the web ACL in front of the stage it reached.

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.js

@@ -20,6 +20,7 @@ export class SimRestApiWebAclInspection {
             protection: restApi.webAcls,
             resourceArn: restApi.stageArn(input.stageName),
             request,
+            sourceIp: input.sourceIp,
             forwardBody: true,
         });
     }

package/dist/service/cloudformation/registry/sim-cfn-attribute-reads.d.ts

@@ -0,0 +1,11 @@
+import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
+/**
+ * The logical IDs of the Resources a template reads an attribute of, through
+ * `Fn::GetAtt` or a `${LogicalId.Attribute}` in `Fn::Sub`, anywhere in its
+ * Resources or Outputs.
+ *
+ * This reads the raw template, before conditions are applied. A `Fn::GetAtt`
+ * in an `Fn::If` branch the conditions rule out still counts, which can
+ * authorize a read real CloudFormation would not make.
+ */
+export declare function simCfnAttributeReads(template: CfnTemplateBodyRecord): ReadonlySet<string>;

package/dist/service/cloudformation/registry/sim-cfn-attribute-reads.js

@@ -0,0 +1,64 @@
+import { isRecord } from "../../../util/type-guard/record.js";
+const subVariablePattern = /\$\{(?<name>[^!}][^}]*)\}/gu;
+/**
+ * The logical IDs of the Resources a template reads an attribute of, through
+ * `Fn::GetAtt` or a `${LogicalId.Attribute}` in `Fn::Sub`, anywhere in its
+ * Resources or Outputs.
+ *
+ * This reads the raw template, before conditions are applied. A `Fn::GetAtt`
+ * in an `Fn::If` branch the conditions rule out still counts, which can
+ * authorize a read real CloudFormation would not make.
+ */
+export function simCfnAttributeReads(template) {
+    const reads = new Set();
+    collect(template.Resources, reads);
+    collect(template.Outputs ?? {}, reads);
+    return reads;
+}
+function collect(value, reads) {
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            collect(item, reads);
+        }
+        return;
+    }
+    if (!isRecord(value)) {
+        return;
+    }
+    for (const [key, entry] of Object.entries(value)) {
+        if (key === "Fn::GetAtt") {
+            addGetAttTarget(entry, reads);
+        }
+        else if (key === "Fn::Sub") {
+            addSubTargets(entry, reads);
+        }
+        collect(entry, reads);
+    }
+}
+/** `["Logical", "Attribute"]`, or the short form `"Logical.Attribute"`. */
+function addGetAttTarget(value, reads) {
+    const target = Array.isArray(value) ? value[0] : value;
+    if (typeof target === "string") {
+        reads.add(target.split(".", 1)[0] ?? target);
+    }
+}
+/**
+ * A `${Logical.Attribute}` in a `Fn::Sub` string. A name the Sub's own
+ * variable map gives is a variable and reads no Resource, and `${!Literal}` is
+ * escaped text.
+ */
+function addSubTargets(value, reads) {
+    const [text, variables] = Array.isArray(value) ? value : [value, undefined];
+    if (typeof text !== "string") {
+        return;
+    }
+    for (const match of text.matchAll(subVariablePattern)) {
+        const name = match.groups?.["name"] ?? "";
+        const [logicalId, attribute] = name.split(".", 2);
+        if (logicalId !== undefined &&
+            attribute !== undefined &&
+            !(isRecord(variables) && Object.hasOwn(variables, name))) {
+            reads.add(logicalId);
+        }
+    }
+}

package/dist/service/cloudformation/registry/sim-cfn-read-handler-authorizer.d.ts

@@ -0,0 +1,45 @@
+import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
+import type { SimCfnStackDeployContext } from "../stack/sim-cfn-stack-deploy-context.js";
+import type { SimCfnStackUpdatePlan } from "../stack/update/sim-cfn-stack-update-plan.js";
+import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
+interface SimCfnReadHandlerAuthorizerProperties {
+    /**
+     * Where the simulation and the Stack's caller are read from. The caller is
+     * read when the update authorizes, because an update naming a caller of its
+     * own takes it on after this is made.
+     */
+    readonly context: SimCfnStackDeployContext;
+}
+/**
+ * Authorizes the calls CloudFormation's read handlers make as the deployment's
+ * caller.
+ *
+ * Real CloudFormation calls a Resource's read handler when it needs the
+ * Resource's attributes and holds no fresh model of it. A Stack update that
+ * leaves a Resource alone, while the new template reads one of its attributes
+ * through `Fn::GetAtt`, is the case simulated here. The handler runs as the
+ * Stack's execution role, so a role missing one of its calls fails the update.
+ *
+ * This needs no model of the Resource's service. A Resource type yulin skips
+ * is authorized the same way as one it creates, from the registry snapshot
+ * and the Resource's properties.
+ */
+export declare class SimCfnReadHandlerAuthorizer {
+    private readonly context;
+    constructor(properties: SimCfnReadHandlerAuthorizerProperties);
+    /**
+     * Ensure the caller may make the read handler calls of each Resource an
+     * update leaves alone while its new template reads the Resource's
+     * attributes.
+     */
+    authorizeUpdate(plan: SimCfnStackUpdatePlan, update: {
+        readonly updated: SimCfnTemplate;
+        readonly resources: ReadonlyMap<string, SimCfnResource>;
+    }): Promise<void>;
+    /**
+     * Ensure the caller may make every call each Resource's read handler makes.
+     */
+    authorize(reading: readonly SimCfnResource[], resources: ReadonlyMap<string, SimCfnResource>): Promise<void>;
+    private authorizeOne;
+}
+export {};

package/dist/service/cloudformation/registry/sim-cfn-read-handler-authorizer.js

@@ -0,0 +1,72 @@
+import { SimIamActionAuthorizer } from "../../iam/authorize/sim-iam-action-authorizer.js";
+import { simScopeIamAuthZ } from "../../iam/authorize/sim-iam-region-auth-z.js";
+import { simCfnReadHandler } from "./sim-cfn-read-handlers.js";
+import { SimCfnResourceArn } from "./sim-cfn-resource-arn.js";
+/**
+ * Authorizes the calls CloudFormation's read handlers make as the deployment's
+ * caller.
+ *
+ * Real CloudFormation calls a Resource's read handler when it needs the
+ * Resource's attributes and holds no fresh model of it. A Stack update that
+ * leaves a Resource alone, while the new template reads one of its attributes
+ * through `Fn::GetAtt`, is the case simulated here. The handler runs as the
+ * Stack's execution role, so a role missing one of its calls fails the update.
+ *
+ * This needs no model of the Resource's service. A Resource type yulin skips
+ * is authorized the same way as one it creates, from the registry snapshot
+ * and the Resource's properties.
+ */
+export class SimCfnReadHandlerAuthorizer {
+    context;
+    constructor(properties) {
+        this.context = properties.context;
+    }
+    /**
+     * Ensure the caller may make the read handler calls of each Resource an
+     * update leaves alone while its new template reads the Resource's
+     * attributes.
+     */
+    async authorizeUpdate(plan, update) {
+        await this.authorize(plan.untouchedReadBy(update.updated.template), update.resources);
+    }
+    /**
+     * Ensure the caller may make every call each Resource's read handler makes.
+     */
+    async authorize(reading, resources) {
+        await Promise.all(reading.map(async (resource) => {
+            await this.authorizeOne(resource, resources);
+        }));
+    }
+    async authorizeOne(resource, resources) {
+        const handler = simCfnReadHandler(resource.type ?? "");
+        if (handler === undefined) {
+            return;
+        }
+        const { simAws, caller } = this.context;
+        const resolvedProperties = await resource.resolvedProperties({
+            resources,
+            simAws,
+            caller,
+        });
+        const resourceArn = new SimCfnResourceArn({
+            resource,
+            arnFormat: handler.arnFormat,
+            resolvedProperties,
+        }).value();
+        const { accountId, regionName } = resource.accountRegionScope;
+        const authorizer = new SimIamActionAuthorizer({
+            iam: simScopeIamAuthZ(simAws.accountRegionScope(accountId, regionName)),
+        });
+        // The denial keeps its AccessDenied name, as a failed creation's does, so a
+        // test can match it the way it matches any other refusal.
+        try {
+            handler.authorize(authorizer, resourceArn, caller);
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                error.message = `Sim CloudFormation Resource ${resource.logicalId} read handler failed: ${error.message}`;
+            }
+            throw error;
+        }
+    }
+}

package/dist/service/cloudformation/registry/sim-cfn-read-handler.d.ts

@@ -0,0 +1,33 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamActionAuthorizer } from "../../iam/authorize/sim-iam-action-authorizer.js";
+interface SimCfnReadHandlerProperties {
+    readonly resourceType: string;
+    readonly arnFormat: string;
+    readonly actions: readonly string[];
+    readonly anyResourceActions: readonly string[];
+}
+/**
+ * The IAM actions one Resource type's CloudFormation read handler calls as
+ * the Stack's execution role, and the ARN format they are decided on.
+ *
+ * Only the actions in the type's own service are held. Each is decided either
+ * on the Resource's own ARN or, for an action IAM scopes to no resource type
+ * (`batch:DescribeJobQueues`), on `*`.
+ */
+export declare class SimCfnReadHandler {
+    readonly resourceType: string;
+    /**
+     * The Resource's ARN with its variables left in, as the Service
+     * Authorization Reference writes it (`repository/${DomainName}/...`).
+     */
+    readonly arnFormat: string;
+    private readonly actions;
+    private readonly anyResourceActions;
+    constructor(properties: SimCfnReadHandlerProperties);
+    /**
+     * Ensure the caller may make every call the read handler makes on the
+     * Resource with this ARN.
+     */
+    authorize(authorizer: SimIamActionAuthorizer, resourceArn: string, caller: SimAwsCaller | undefined): void;
+}
+export {};

package/dist/service/cloudformation/registry/sim-cfn-read-handler.fixture.d.ts

@@ -0,0 +1,24 @@
+import { SimAws } from "../../aws/sim-aws.js";
+import { type SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+export declare const readHandlerRegionName = "eu-west-2";
+/** A Bucket an update adds, so that the update has something to do. */
+export declare const addedBucket: {
+    Type: string;
+    Properties: {
+        BucketName: string;
+    };
+};
+/** A simulation in a fresh Account, in the Region the tests read ARNs in. */
+export declare function readHandlerSimulation(): {
+    simAws: SimAws;
+    accountId: SimAwsAccountId;
+};
+/**
+ * Update a Stack, which goes on running as the role it was deployed as.
+ */
+export declare function updateStack(simAws: SimAws, stackName: string, template: object): Promise<void>;
+/**
+ * A Role a deployment can run as, holding the statements it is given.
+ */
+export declare function deployRole(simAws: SimAws, accountId: SimAwsAccountId, statements: readonly object[]): Promise<SimAwsCaller>;

package/dist/service/cloudformation/registry/sim-cfn-read-handler.fixture.js

@@ -0,0 +1,58 @@
+import { SimAws } from "../../aws/sim-aws.js";
+import { makeSimAwsAccountId, } from "../../aws/sim-aws-account.js";
+import { jsonStringify } from "../../../util/type-guard/json.js";
+export const readHandlerRegionName = "eu-west-2";
+/** A Bucket an update adds, so that the update has something to do. */
+export const addedBucket = {
+    Type: "AWS::S3::Bucket",
+    Properties: { BucketName: "chineseboost-sources" },
+};
+/** A simulation in a fresh Account, in the Region the tests read ARNs in. */
+export function readHandlerSimulation() {
+    const accountId = makeSimAwsAccountId();
+    return {
+        simAws: new SimAws({
+            defaultAccountId: accountId,
+            defaultRegionName: readHandlerRegionName,
+        }),
+        accountId,
+    };
+}
+/**
+ * Update a Stack, which goes on running as the role it was deployed as.
+ */
+export async function updateStack(simAws, stackName, template) {
+    await simAws.cloudFormation().updateStack({
+        input: { StackName: stackName, TemplateBody: jsonStringify(template) },
+    });
+}
+/**
+ * A Role a deployment can run as, holding the statements it is given.
+ */
+export async function deployRole(simAws, accountId, statements) {
+    const iam = simAws.account(accountId).iam();
+    await iam.createRole({
+        input: {
+            RoleName: "deployer",
+            AssumeRolePolicyDocument: jsonStringify({
+                Version: "2012-10-17",
+                Statement: {
+                    Effect: "Allow",
+                    Action: "sts:AssumeRole",
+                    Principal: { Service: "cloudformation.amazonaws.com" },
+                },
+            }),
+        },
+    });
+    await iam.putRolePolicy({
+        input: {
+            RoleName: "deployer",
+            PolicyName: "deployer-policy",
+            PolicyDocument: jsonStringify({
+                Version: "2012-10-17",
+                Statement: statements,
+            }),
+        },
+    });
+    return { kind: "arn", arn: `arn:aws:iam::${accountId}:role/deployer` };
+}

package/dist/service/cloudformation/registry/sim-cfn-read-handler.js

@@ -0,0 +1,36 @@
+/**
+ * The IAM actions one Resource type's CloudFormation read handler calls as
+ * the Stack's execution role, and the ARN format they are decided on.
+ *
+ * Only the actions in the type's own service are held. Each is decided either
+ * on the Resource's own ARN or, for an action IAM scopes to no resource type
+ * (`batch:DescribeJobQueues`), on `*`.
+ */
+export class SimCfnReadHandler {
+    resourceType;
+    /**
+     * The Resource's ARN with its variables left in, as the Service
+     * Authorization Reference writes it (`repository/${DomainName}/...`).
+     */
+    arnFormat;
+    actions;
+    anyResourceActions;
+    constructor(properties) {
+        this.resourceType = properties.resourceType;
+        this.arnFormat = properties.arnFormat;
+        this.actions = properties.actions;
+        this.anyResourceActions = properties.anyResourceActions;
+    }
+    /**
+     * Ensure the caller may make every call the read handler makes on the
+     * Resource with this ARN.
+     */
+    authorize(authorizer, resourceArn, caller) {
+        for (const action of this.actions) {
+            authorizer.authorize(action, resourceArn, caller);
+        }
+        for (const action of this.anyResourceActions) {
+            authorizer.authorize(action, "*", caller);
+        }
+    }
+}

package/dist/service/cloudformation/registry/sim-cfn-read-handlers.d.ts

@@ -0,0 +1,10 @@
+import { SimCfnReadHandler } from "./sim-cfn-read-handler.js";
+/**
+ * The read handler of each CloudFormation Resource type, from the snapshot
+ * `scripts/mts/write-cfn-read-handlers.mts` writes.
+ *
+ * A type the snapshot leaves out has no read handler sim CloudFormation can
+ * authorize. Either the registry publishes none for it, or none of its
+ * permissions is decided on a resource type named after it.
+ */
+export declare function simCfnReadHandler(resourceType: string): SimCfnReadHandler | undefined;

package/dist/service/cloudformation/registry/sim-cfn-read-handlers.js

@@ -0,0 +1,23 @@
+import snapshot from "./sim-cfn-read-handlers.json" with { type: "json" };
+import { SimCfnReadHandler } from "./sim-cfn-read-handler.js";
+const records = new Map(Object.entries(snapshot.types));
+/**
+ * The read handler of each CloudFormation Resource type, from the snapshot
+ * `scripts/mts/write-cfn-read-handlers.mts` writes.
+ *
+ * A type the snapshot leaves out has no read handler sim CloudFormation can
+ * authorize. Either the registry publishes none for it, or none of its
+ * permissions is decided on a resource type named after it.
+ */
+export function simCfnReadHandler(resourceType) {
+    const record = records.get(resourceType);
+    if (record === undefined) {
+        return undefined;
+    }
+    return new SimCfnReadHandler({
+        resourceType,
+        arnFormat: record.arn,
+        actions: record.actions,
+        anyResourceActions: record.anyResourceActions,
+    });
+}