@kensio/yulin 1.21.34 → 1.23.0

package/dist/service/cloudformation/registry/sim-cfn-resource-arn.d.ts

@@ -0,0 +1,46 @@
+import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../template/value/sim-cfn-template-value.js";
+interface SimCfnResourceArnProperties {
+    readonly resource: SimCfnResource;
+    readonly arnFormat: string;
+    readonly resolvedProperties: SimCfnTemplateValueRecord;
+}
+/**
+ * The ARN a read handler's calls on one Resource are authorized on.
+ *
+ * The ARN format's variables are filled from the Stack's scope and from the
+ * Resource's own properties, which is the whole of it for a Resource whose
+ * template names it (`DomainName` and `RepositoryName` on a CodeArtifact
+ * repository). A Resource whose name CloudFormation generated holds no such
+ * property. Its ARN comes from its `Arn` attribute, from a Ref that is an ARN, or
+ * from its Ref where the format has one variable left, all of which a service answers once it has
+ * created the Resource.
+ *
+ * An ARN that cannot be built is refused. Authorizing the calls on a guessed
+ * ARN would let a policy scoped to the real one pass or fail by accident.
+ */
+export declare class SimCfnResourceArn {
+    private readonly resource;
+    private readonly arnFormat;
+    private readonly resolvedProperties;
+    constructor(properties: SimCfnResourceArnProperties);
+    /** The Resource's ARN, or a refusal saying which variable could not be filled. */
+    value(): string;
+    private filled;
+    private unfilledVariables;
+    private variable;
+    private property;
+    /**
+     * The property an ARN variable is held in under another name. The Service
+     * Authorization Reference names a CodeBuild project's `${ProjectName}`,
+     * which `AWS::CodeBuild::Project` calls `Name`.
+     */
+    private namePropertyFor;
+    /**
+     * A value the Resource answers once a service has created it. A Resource
+     * that was skipped answers with a stand-in naming itself, which is no part
+     * of an ARN.
+     */
+    private deployedValue;
+}
+export {};

package/dist/service/cloudformation/registry/sim-cfn-resource-arn.js

@@ -0,0 +1,119 @@
+const variablePattern = /\$\{(?<name>[^}]+)\}/gu;
+/**
+ * The ARN a read handler's calls on one Resource are authorized on.
+ *
+ * The ARN format's variables are filled from the Stack's scope and from the
+ * Resource's own properties, which is the whole of it for a Resource whose
+ * template names it (`DomainName` and `RepositoryName` on a CodeArtifact
+ * repository). A Resource whose name CloudFormation generated holds no such
+ * property. Its ARN comes from its `Arn` attribute, from a Ref that is an ARN, or
+ * from its Ref where the format has one variable left, all of which a service answers once it has
+ * created the Resource.
+ *
+ * An ARN that cannot be built is refused. Authorizing the calls on a guessed
+ * ARN would let a policy scoped to the real one pass or fail by accident.
+ */
+export class SimCfnResourceArn {
+    resource;
+    arnFormat;
+    resolvedProperties;
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.arnFormat = properties.arnFormat;
+        this.resolvedProperties = new Map(Object.entries(properties.resolvedProperties));
+    }
+    /** The Resource's ARN, or a refusal saying which variable could not be filled. */
+    value() {
+        const unfilled = this.unfilledVariables();
+        if (unfilled.length === 0) {
+            return this.filled();
+        }
+        const arnAttribute = this.deployedValue(() => {
+            return this.resource.attributeValue("Arn");
+        });
+        if (arnAttribute?.startsWith("arn:") === true) {
+            return arnAttribute;
+        }
+        const refValue = this.deployedValue(() => this.resource.refValue);
+        // An SNS topic's Ref is its whole ARN, where a hosted zone's is the one
+        // identifier its ARN format lacks.
+        if (refValue?.startsWith("arn:") === true) {
+            return refValue;
+        }
+        const [onlyUnfilled] = unfilled;
+        if (refValue !== undefined && unfilled.length === 1) {
+            return this.filled(new Map([[onlyUnfilled, refValue]]));
+        }
+        throw new Error(`Sim CloudFormation cannot authorize the read handler of Resource ${this.resource.logicalId} (${String(this.resource.type)}): its ARN format ${this.arnFormat} needs ${unfilled.join(", ")}, which neither its properties nor its attributes give`);
+    }
+    filled(extra = new Map()) {
+        return this.arnFormat.replaceAll(variablePattern, (_match, name) => {
+            return extra.get(name) ?? this.variable(name) ?? "";
+        });
+    }
+    unfilledVariables() {
+        return this.arnFormat
+            .matchAll(variablePattern)
+            .map((match) => match.groups?.["name"] ?? "")
+            .filter((name) => this.variable(name) === undefined)
+            .toArray();
+    }
+    variable(name) {
+        const { accountId, regionName } = this.resource.accountRegionScope;
+        switch (name) {
+            case "Partition": {
+                return "aws";
+            }
+            case "Region": {
+                return regionName;
+            }
+            case "Account": {
+                return accountId;
+            }
+            default: {
+                return this.property(name) ?? this.property(this.namePropertyFor(name));
+            }
+        }
+    }
+    property(name) {
+        return stringValue(this.resolvedProperties.get(name));
+    }
+    /**
+     * The property an ARN variable is held in under another name. The Service
+     * Authorization Reference names a CodeBuild project's `${ProjectName}`,
+     * which `AWS::CodeBuild::Project` calls `Name`.
+     */
+    namePropertyFor(variable) {
+        const typeName = this.resource.type?.split("::").at(-1);
+        if (variable === `${String(typeName)}Name`) {
+            return "Name";
+        }
+        return variable;
+    }
+    /**
+     * A value the Resource answers once a service has created it. A Resource
+     * that was skipped answers with a stand-in naming itself, which is no part
+     * of an ARN.
+     */
+    deployedValue(read) {
+        const { createComplete, skipped, inert } = this.resource;
+        if (!createComplete || skipped || inert) {
+            return undefined;
+        }
+        // A Resource type with no Arn attribute refuses to answer for one, which
+        // here only means the ARN has to come from somewhere else.
+        try {
+            return stringValue(read());
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+/** The value where it is a string, which is all an ARN can be made of. */
+function stringValue(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return undefined;
+}

package/dist/service/cloudformation/stack/sim-cfn-stack-deploy-context.d.ts

@@ -1,3 +1,4 @@
+import type { SimAws } from "../../aws/sim-aws.js";
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
 /**
@@ -18,13 +19,17 @@ export interface SimCfnStackUpdateContext {
  * values the deployment started with.
  */
 export declare class SimCfnStackDeployContext {
+    /** The simulation the Stack deploys into, which an update never moves. */
+    readonly simAws: SimAws;
     /** The CDK cloud assembly the Stack's template was synthesized into. */
     cdkOutContext: SimCdkOutContext | undefined;
     /** The principal the Stack's Resource work is authorized as. */
     caller: SimAwsCaller | undefined;
     /** The principal the Stack's CDK file assets are published as. */
     assetsCaller: SimAwsCaller | undefined;
-    constructor(properties: SimCfnStackUpdateContext);
+    constructor(properties: SimCfnStackUpdateContext & {
+        readonly simAws: SimAws;
+    });
     /**
      * Take on what an update brings with it, for this and every later operation.
      *

package/dist/service/cloudformation/stack/sim-cfn-stack-deploy-context.js

@@ -7,6 +7,8 @@
  * values the deployment started with.
  */
 export class SimCfnStackDeployContext {
+    /** The simulation the Stack deploys into, which an update never moves. */
+    simAws;
     /** The CDK cloud assembly the Stack's template was synthesized into. */
     cdkOutContext;
     /** The principal the Stack's Resource work is authorized as. */
@@ -14,6 +16,7 @@ export class SimCfnStackDeployContext {
     /** The principal the Stack's CDK file assets are published as. */
     assetsCaller;
     constructor(properties) {
+        this.simAws = properties.simAws;
         this.cdkOutContext = properties.cdkOutContext;
         this.caller = properties.caller;
         this.assetsCaller = properties.assetsCaller;

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.d.ts

@@ -4,7 +4,7 @@ import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
-import { type SimCfnStackUpdateContext } from "./sim-cfn-stack-deploy-context.js";
+import { SimCfnStackDeployContext, type SimCfnStackUpdateContext } from "./sim-cfn-stack-deploy-context.js";
 import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
 import { SimCfnResourceRetention } from "../resource/delete/sim-cfn-resource-retention.js";
 import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
@@ -53,12 +53,13 @@ interface SimCfnStackResourceOperationsProperties {
  * ordering of the work itself.
  */
 export declare class SimCfnStackResourceOperations {
+    /** What the Stack deploys from, into and as. */
+    readonly context: SimCfnStackDeployContext;
     private readonly simAws;
     private readonly accountRegionScope;
     private readonly stackName;
     private readonly bindings;
     private readonly resourceOrder;
-    private readonly context;
     /**
      * Resources an update kept in simulated AWS.
      *

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.js

@@ -20,12 +20,13 @@ import { SimCfnStackResourceUpdates } from "./update/sim-cfn-stack-resource-upda
  * ordering of the work itself.
  */
 export class SimCfnStackResourceOperations {
+    /** What the Stack deploys from, into and as. */
+    context;
     simAws;
     accountRegionScope;
     stackName;
     bindings;
     resourceOrder;
-    context;
     /**
      * Resources an update kept in simulated AWS.
      *

package/dist/service/cloudformation/stack/sim-cfn-stack.js

@@ -3,6 +3,7 @@ import { makeSimCfnStackResourceMap } from "./resource-map/sim-cfn-stack-resourc
 import { SimCfnStackResourceLookup } from "./resource-map/sim-cfn-stack-resource-lookup.js";
 import { SimCfnStackDeploymentLifecycle } from "./deploy/sim-cfn-stack-deployment-lifecycle.js";
 import { SimCfnStackResourceOperations } from "./sim-cfn-stack-resource-operations.js";
+import { SimCfnReadHandlerAuthorizer } from "../registry/sim-cfn-read-handler-authorizer.js";
 import { SimCfnStackUpdateLifecycle } from "./update/sim-cfn-stack-update-lifecycle.js";
 import { SimCfnStackOutputs } from "./output/sim-cfn-stack-outputs.js";
 import { SimCfnStackOutputLookup } from "./output/sim-cfn-stack-output-lookup.js";
@@ -148,6 +149,14 @@ export class SimCfnStack {
         await this.updating.update({
             apply: async () => {
                 await updater.apply();
+                // Resolving an output reads an untouched Resource through its read
+                // handler. A rollback makes no such call, so it has no step here.
+                await new SimCfnReadHandlerAuthorizer({
+                    context: this.operations.context,
+                }).authorizeUpdate(updater.plan, {
+                    updated: template,
+                    resources: this.resourceMap,
+                });
                 this.resolveOutputs();
             },
             rollBack: async () => {

package/dist/service/cloudformation/stack/update/sim-cfn-stack-update-plan.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 import { SimCfnResourceRetention } from "../../resource/delete/sim-cfn-resource-retention.js";
+import type { CfnTemplateBodyRecord } from "../../template/sim-cfn-template.js";
 import { type SimCfnStackInPlaceUpdates } from "./sim-cfn-stack-resource-changes.js";
 import { type SimCfnStackResourceChange } from "./sim-cfn-stack-resource-change-pairs.js";
 interface SimCfnStackUpdatePlanProperties {
@@ -39,6 +40,11 @@ export declare class SimCfnStackUpdatePlan {
      */
     readonly creations: readonly SimCfnResource[];
     readonly updated: ReadonlyMap<string, SimCfnResource>;
+    /**
+     * The deployed Resources the new template describes unchanged, which the
+     * update leaves where they are.
+     */
+    readonly untouched: readonly SimCfnResource[];
     constructor(properties: SimCfnStackUpdatePlanProperties);
     /**
      * What the update's deletions are to leave in simulated AWS.
@@ -49,6 +55,11 @@ export declare class SimCfnStackUpdatePlan {
      * deletes that Resource.
      */
     retention(): SimCfnResourceRetention;
+    /**
+     * The untouched Resources whose attributes the template reads, through
+     * `Fn::GetAtt` or `Fn::Sub`.
+     */
+    untouchedReadBy(template: CfnTemplateBodyRecord): SimCfnResource[];
     /**
      * Whether the update changes any Resource at all.
      *

package/dist/service/cloudformation/stack/update/sim-cfn-stack-update-plan.js

@@ -1,4 +1,5 @@
 import { SimCfnResourceRetention } from "../../resource/delete/sim-cfn-resource-retention.js";
+import { simCfnAttributeReads } from "../../registry/sim-cfn-attribute-reads.js";
 import { simCfnStackResourceChanges, } from "./sim-cfn-stack-resource-changes.js";
 import { simCfnStackResourceChangePairs, } from "./sim-cfn-stack-resource-change-pairs.js";
 /**
@@ -33,6 +34,11 @@ export class SimCfnStackUpdatePlan {
      */
     creations;
     updated;
+    /**
+     * The deployed Resources the new template describes unchanged, which the
+     * update leaves where they are.
+     */
+    untouched;
     constructor(properties) {
         const { current, updated, inPlaceUpdates } = properties;
         const { replaced, updatedInPlace } = simCfnStackResourceChanges({
@@ -57,6 +63,14 @@ export class SimCfnStackUpdatePlan {
             return (!current.has(resource.logicalId) || replaced.has(resource.logicalId));
         })
             .toArray();
+        this.untouched = current
+            .values()
+            .filter(({ logicalId }) => {
+            return (updated.has(logicalId) &&
+                !replaced.has(logicalId) &&
+                !updatedInPlace.has(logicalId));
+        })
+            .toArray();
     }
     /**
      * What the update's deletions are to leave in simulated AWS.
@@ -74,6 +88,14 @@ export class SimCfnStackUpdatePlan {
             ])),
         });
     }
+    /**
+     * The untouched Resources whose attributes the template reads, through
+     * `Fn::GetAtt` or `Fn::Sub`.
+     */
+    untouchedReadBy(template) {
+        const reads = simCfnAttributeReads(template);
+        return this.untouched.filter(({ logicalId }) => reads.has(logicalId));
+    }
     /**
      * Whether the update changes any Resource at all.
      *

package/dist/service/cloudformation/stack/update/sim-cfn-stack-updater.d.ts

@@ -3,6 +3,7 @@ import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-regi
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 import type { SimCfnTemplate } from "../../template/sim-cfn-template.js";
 import type { SimCfnStackResourceOperations } from "../sim-cfn-stack-resource-operations.js";
+import { SimCfnStackUpdatePlan } from "./sim-cfn-stack-update-plan.js";
 /**
  * What CloudFormation answers an update that would change nothing.
  *
@@ -34,8 +35,9 @@ interface SimCfnStackUpdaterProperties {
  * SimCfnStackUpdateLifecycle owns the first and SimCfnStack the second.
  */
 export declare class SimCfnStackUpdater {
+    /** What the update does to the Stack's Resources. */
+    readonly plan: SimCfnStackUpdatePlan;
     private readonly properties;
-    private readonly plan;
     constructor(properties: SimCfnStackUpdaterProperties);
     /**
      * Refuse an update that would do nothing, the way CloudFormation refuses one.

package/dist/service/cloudformation/stack/update/sim-cfn-stack-updater.js

@@ -25,8 +25,9 @@ export const simCfnNoUpdatesMessage = "No updates are to be performed.";
  * SimCfnStackUpdateLifecycle owns the first and SimCfnStack the second.
  */
 export class SimCfnStackUpdater {
-    properties;
+    /** What the update does to the Stack's Resources. */
     plan;
+    properties;
     constructor(properties) {
         const { accountRegionScope, background, resources, updated } = properties;
         this.properties = properties;

package/dist/service/cognito/serve/sim-cognito-controller.js

@@ -69,7 +69,7 @@ export class SimCognitoServiceController {
         // The web ACL sits in front of the endpoint rather than behind it, so a
         // request it blocks is answered before the method is judged. A write the
         // rules turned away gets WAF's 403 and never learns the endpoint reads.
-        const blocked = await this.blocked(pool, segment, request);
+        const blocked = await this.blocked(pool, segment, serviceRequest);
         if (blocked !== undefined) {
             return blocked;
         }
@@ -90,14 +90,15 @@ export class SimCognitoServiceController {
      * A blocked request is answered before the document is read, so a verifier
      * the rules turn away gets 403 and no keys.
      */
-    async blocked(pool, segment, request) {
+    async blocked(pool, segment, serviceRequest) {
         if (!simCognitoProtectedSegment(segment)) {
             return undefined;
         }
         const inspected = await this.webAcl.inspect({
             pool,
             cognito: simCognitoPoolScope(this.simAws, pool),
-            request,
+            request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         return inspected.blocked;
     }

package/dist/service/cognito/serve/sim-cognito-domain-controller.js

@@ -44,6 +44,7 @@ export class SimCognitoDomainController {
             pool,
             cognito,
             request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         if (inspected.blocked !== undefined) {
             return inspected.blocked;
@@ -95,6 +96,7 @@ function forwarded(serviceRequest, request) {
         request,
         caller: serviceRequest.caller,
         source: serviceRequest.source,
+        sourceIp: serviceRequest.sourceIp,
         body: serviceRequest.body,
     });
 }

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.d.ts

@@ -6,6 +6,8 @@ interface SimCognitoInspectionInput {
     /** The simulated Cognito scope the pool belongs to. */
     readonly cognito: SimCognitoIdentityProvider;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
 }
 /**
  * Puts a request to the web ACL in front of the pool it reached.

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.js

@@ -23,6 +23,7 @@ export class SimCognitoWebAclInspection {
             protection: input.cognito.webAcls(),
             resourceArn: input.pool.arn.value,
             request: input.request,
+            sourceIp: input.sourceIp,
             forwardBody: false,
         });
     }

package/dist/service/iam/index.d.ts

@@ -9,4 +9,5 @@ export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-sc
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { type SimAwsRequestAuthMethod, SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
 export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
+export { simAwsRequestSourceIp, simAwsSourceIpHeaderName, } from "./request/sim-aws-source-ip-header.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, type SimAwsRequestAuthFailure, } from "./request/error/sim-aws-request-auth.error.js";

package/dist/service/iam/index.js

@@ -4,4 +4,5 @@ export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSign
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
 export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
+export { simAwsRequestSourceIp, simAwsSourceIpHeaderName, } from "./request/sim-aws-source-ip-header.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, } from "./request/error/sim-aws-request-auth.error.js";

package/dist/service/iam/request/error/sim-aws-request-auth.error.d.ts

@@ -1,7 +1,7 @@
 import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
 /**
  * Raised when the `x-sim-aws-caller` header does not name a principal the
- * simulator understands.
+ * simulator understands, or `x-sim-aws-source-ip` names no address.
  *
  * This is a simulator control header rather than anything real AWS defines, so
  * a bad value is the caller's mistake in using Yulin, not a failed AWS

package/dist/service/iam/request/error/sim-aws-request-auth.error.js

@@ -1,7 +1,7 @@
 import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
 /**
  * Raised when the `x-sim-aws-caller` header does not name a principal the
- * simulator understands.
+ * simulator understands, or `x-sim-aws-source-ip` names no address.
  *
  * This is a simulator control header rather than anything real AWS defines, so
  * a bad value is the caller's mistake in using Yulin, not a failed AWS

package/dist/service/iam/request/sim-aws-control-headers.d.ts

@@ -2,7 +2,8 @@
  * Header names that are instructions to the simulator rather than part of the
  * request being simulated.
  *
- * They state who a request is from and what it is for, so anything passing a
+ * They state who a request is from, where it came from and what it is for, so
+ * anything passing a
  * request on to a simulated service has to decide what to do with them rather
  * than forward them by accident: the HTTP boundary strips them once the
  * request has been attributed, and sim CloudFront strips a viewer's before

package/dist/service/iam/request/sim-aws-control-headers.js

@@ -1,10 +1,12 @@
 import { simAwsCallerHeaderName } from "./sim-aws-caller-header.js";
+import { simAwsSourceIpHeaderName } from "./sim-aws-source-ip-header.js";
 import { simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./sim-aws-request-source.js";
 /**
  * Header names that are instructions to the simulator rather than part of the
  * request being simulated.
  *
- * They state who a request is from and what it is for, so anything passing a
+ * They state who a request is from, where it came from and what it is for, so
+ * anything passing a
  * request on to a simulated service has to decide what to do with them rather
  * than forward them by accident: the HTTP boundary strips them once the
  * request has been attributed, and sim CloudFront strips a viewer's before
@@ -14,6 +16,7 @@ export const simAwsControlHeaderNames = [
     simAwsCallerHeaderName,
     simAwsSourceArnHeaderName,
     simAwsSourceAccountHeaderName,
+    simAwsSourceIpHeaderName,
 ];
 /**
  * Remove the simulator's control headers from a set of request headers.

package/dist/service/iam/request/sim-aws-source-ip-header.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The header naming the client address a request into simulated AWS comes
+ * from.
+ *
+ * A request arrives in process or over loopback, so there is no remote address
+ * for the simulation to read. Whatever decides by where a request came from,
+ * such as a web ACL's IP reputation and anonymous IP rules, reads this instead,
+ * and a test sends it to say which client a request stands for.
+ */
+export declare const simAwsSourceIpHeaderName = "x-sim-aws-source-ip";
+/**
+ * Read the client address a request states, or the loopback address when it
+ * states none.
+ *
+ * The header holds one IPv4 or IPv6 address. A value that is neither is
+ * refused rather than read as loopback, since a test that misspelt an address
+ * would otherwise pass for the wrong reason.
+ */
+export declare function simAwsRequestSourceIp(headers: Headers): string;

package/dist/service/iam/request/sim-aws-source-ip-header.js

@@ -0,0 +1,32 @@
+import { isIP } from "node:net";
+import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
+import { SimAwsInvalidCallerHeader } from "./error/sim-aws-request-auth.error.js";
+/**
+ * The header naming the client address a request into simulated AWS comes
+ * from.
+ *
+ * A request arrives in process or over loopback, so there is no remote address
+ * for the simulation to read. Whatever decides by where a request came from,
+ * such as a web ACL's IP reputation and anonymous IP rules, reads this instead,
+ * and a test sends it to say which client a request stands for.
+ */
+export const simAwsSourceIpHeaderName = "x-sim-aws-source-ip";
+/**
+ * Read the client address a request states, or the loopback address when it
+ * states none.
+ *
+ * The header holds one IPv4 or IPv6 address. A value that is neither is
+ * refused rather than read as loopback, since a test that misspelt an address
+ * would otherwise pass for the wrong reason.
+ */
+export function simAwsRequestSourceIp(headers) {
+    const value = headers.get(simAwsSourceIpHeaderName)?.trim();
+    if (value === undefined || value === "") {
+        return simAwsProxiedSourceIp;
+    }
+    if (isIP(value) === 0) {
+        throw new SimAwsInvalidCallerHeader(`${simAwsSourceIpHeaderName} value ${value} must be one IPv4 or IPv6 ` +
+            `address`);
+    }
+    return value;
+}

package/dist/service/stepfunctions/command/execution/sim-states-execution-start.js

@@ -56,6 +56,7 @@ export class SimStatesExecutionStart {
             background: this.#background,
             tasks: this.#tasks,
             roleArn: stateMachine.roleArn,
+            stateMachineArn: stateMachine.arn,
         })({
             definition: stateMachine.parsedDefinition,
             record: execution,

package/dist/service/stepfunctions/execution/sim-states-run-task.js

@@ -14,6 +14,7 @@ export async function runSimStatesTask(state, input, context) {
         target: state.target,
         payload: simStatesEffectiveInput(input, state, context.contextObject),
         roleArn: context.roleArn,
+        stateMachineArn: context.stateMachineArn,
     });
     const output = simStatesEffectiveOutput(input, result, state, context.contextObject);
     return state.Next === undefined

package/dist/service/stepfunctions/execution/sim-states-state-outcome.d.ts

@@ -71,6 +71,7 @@ export interface SimStatesWalkContext {
      * The state machine's execution role, which a task assumes.
      */
     readonly roleArn: string;
+    readonly stateMachineArn: string;
     /**
      * What the walk is recording itself on, which a `Parallel` state's branch
      * hangs off.

package/dist/service/stepfunctions/execution/sim-states-walks.d.ts

@@ -11,6 +11,7 @@ interface SimStatesWalksProperties {
      * The state machine's execution role, which a task assumes.
      */
     readonly roleArn: string;
+    readonly stateMachineArn: string;
 }
 /**
  * How one execution walks a set of states, its `Parallel` branches included.

package/dist/service/stepfunctions/execution/sim-states-walks.js

@@ -16,6 +16,7 @@ export function simStatesWalks(properties) {
             contextObject: child.contextObject,
             tasks: properties.tasks,
             roleArn: properties.roleArn,
+            stateMachineArn: properties.stateMachineArn,
             walkChild: walks,
         },
         ...(child.onSettled !== undefined && { onSettled: child.onSettled }),

package/dist/service/stepfunctions/task/sim-aws-states-task-targets.js

@@ -30,7 +30,12 @@ export class SimAwsStatesTaskTargets {
         const { stateName, target } = invocation;
         const role = simStatesExecutionRoleTarget(invocation.roleArn, stateName);
         const roleScope = this.#simAws.accountRegionScope(role.accountId, this.#accountRegionScope.regionName);
-        const caller = await assumeSimStatesExecutionRole(role, roleScope);
+        // Step Functions supplies the state machine as the trust policy source.
+        // https://docs.aws.amazon.com/step-functions/latest/dg/procedure-create-iam-role.html
+        const caller = await assumeSimStatesExecutionRole(role, roleScope, {
+            arn: invocation.stateMachineArn,
+            accountId: this.#accountRegionScope.accountId,
+        });
         return await target.run({
             stateName,
             payload: invocation.payload,

package/dist/service/stepfunctions/task/sim-states-execution-role.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
 import { type SimServiceRoleTarget } from "../../sts/service-role/sim-service-role-target.js";
+import type { SimServiceRoleSource } from "../../sts/service-role/sim-service-role-source.js";
 /**
  * The service principal a state machine's execution role trusts.
  */
@@ -21,4 +22,4 @@ export declare function simStatesExecutionRoleTarget(roleArn: string, stateName:
  * rule, which reaches a function as a service principal and is admitted by the
  * function's resource policy.
  */
-export declare function assumeSimStatesExecutionRole(target: SimServiceRoleTarget, scope: SimAwsAccountRegionContainer): Promise<SimAwsCaller>;
+export declare function assumeSimStatesExecutionRole(target: SimServiceRoleTarget, scope: SimAwsAccountRegionContainer, source: SimServiceRoleSource): Promise<SimAwsCaller>;