@kensio/yulin 1.22.0 → 1.23.1

package/dist/serve/controller/sim-service-controller.d.ts

@@ -25,6 +25,7 @@ interface SimAwsServiceRequestProperties {
     readonly request: Request;
     readonly caller?: SimAwsRequestCaller | undefined;
     readonly source?: SimAwsRequestSource | undefined;
+    readonly sourceIp?: string | undefined;
     readonly body?: Uint8Array | undefined;
 }
 /**
@@ -49,6 +50,11 @@ export declare class SimAwsServiceRequest {
      * conditioned on, and most requests state none.
      */
     readonly source: SimAwsRequestSource | undefined;
+    /**
+     * The client address the request came from, which is loopback unless the
+     * request stated another with `x-sim-aws-source-ip`.
+     */
+    readonly sourceIp: string;
     readonly body?: Uint8Array | undefined;
     constructor(properties: SimAwsServiceRequestProperties);
 }

package/dist/serve/controller/sim-service-controller.js

@@ -1,3 +1,4 @@
+import { simAwsProxiedSourceIp } from "../http/sim-aws-proxied-connection.js";
 import { SimAwsRequestCaller } from "../../service/iam/request/sim-aws-request-caller.js";
 /**
  * One HTTP request, routed to a simulated service and attributed to a
@@ -21,6 +22,11 @@ export class SimAwsServiceRequest {
      * conditioned on, and most requests state none.
      */
     source;
+    /**
+     * The client address the request came from, which is loopback unless the
+     * request stated another with `x-sim-aws-source-ip`.
+     */
+    sourceIp;
     body;
     constructor(properties) {
         this.target = properties.target;
@@ -28,6 +34,7 @@ export class SimAwsServiceRequest {
         // An unattributed request is anonymous, never the Account root.
         this.caller = properties.caller ?? SimAwsRequestCaller.anonymous();
         this.source = properties.source;
+        this.sourceIp = properties.sourceIp ?? simAwsProxiedSourceIp;
         this.body = properties.body;
     }
 }

package/dist/serve/http/request/sim-aws-request-authenticator.js

@@ -1,6 +1,7 @@
 import { simAwsServiceSigningName } from "../../controller/sim-aws-service-signing-name.js";
 import { SimAwsServiceRequest, } from "../../controller/sim-service-controller.js";
 import { SimAwsRequestSource } from "../../../service/iam/request/sim-aws-request-source.js";
+import { simAwsRequestSourceIp } from "../../../service/iam/request/sim-aws-source-ip-header.js";
 import { SimAwsReceivedRequest } from "./sim-aws-received-request.js";
 /**
  * Turns a received HTTP request into a request a simulated service can serve.
@@ -40,11 +41,13 @@ export class SimAwsRequestAuthenticator {
             },
         });
         const source = SimAwsRequestSource.fromHeaders(request.headers);
+        const sourceIp = simAwsRequestSourceIp(request.headers);
         return new SimAwsServiceRequest({
             target,
             request: received.forService(),
             caller,
             ...(source !== undefined && { source }),
+            sourceIp,
             body: received.body,
         });
     }

package/dist/service/apigateway/serve/sim-api-gateway-controller.js

@@ -77,6 +77,7 @@ export class SimApiGatewayServiceController {
             restApi,
             stageName: restApiRequest.segments[0] ?? "",
             request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         if (inspected.blocked !== undefined) {
             return inspected.blocked;

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.d.ts

@@ -5,6 +5,8 @@ interface SimRestApiInspectionInput {
     /** The first path segment of the request, which names the stage. */
     readonly stageName: string;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
 }
 /**
  * Puts a request to the web ACL in front of the stage it reached.

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.js

@@ -20,6 +20,7 @@ export class SimRestApiWebAclInspection {
             protection: restApi.webAcls,
             resourceArn: restApi.stageArn(input.stageName),
             request,
+            sourceIp: input.sourceIp,
             forwardBody: true,
         });
     }

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js

@@ -29,6 +29,10 @@ export class SimCloudFrontControllerDependenciesFactory {
             new DefaultSimCloudFrontBehaviorResolver();
         const originFetcher = properties.originFetcher ?? new SimCloudFrontOriginFetcher();
         const edgeFunctions = new SimAwsCfEdgeFunctions(simAws);
+        // A request the web ACL blocks with WAF's default 403 gets the same custom
+        // error response an Origin's 403 would, so the one responder serves both.
+        const customErrorResponder = properties.customErrorResponder ??
+            new SimCfCustomErrorResponder({ behaviourResolver, originFetcher });
         return {
             distroRouter: properties.distroRouter ??
                 new DefaultSimCloudFrontDistroRouter({
@@ -36,14 +40,13 @@ export class SimCloudFrontControllerDependenciesFactory {
                     cloudFrontRegistry,
                 }),
             webAclGuard: properties.webAclGuard ??
-                new SimCfWebAclGuard(makeSimCfWebAclResolver(simAws)),
+                new SimCfWebAclGuard(makeSimCfWebAclResolver(simAws), customErrorResponder),
             behaviourResolver,
             cffApplicator: properties.cffApplicator ?? new SimCffApplicator(),
             edgeApplicator: properties.edgeApplicator ??
                 new SimLambdaEdgeApplicator({ edgeFunctions }),
             contentStage: new SimCfContentStage(new SimCfOriginStage(originFetcher, properties.edgeOriginApplicator ??
-                new SimLambdaEdgeOriginApplicator({ edgeFunctions })), properties.customErrorResponder ??
-                new SimCfCustomErrorResponder({ behaviourResolver, originFetcher })),
+                new SimLambdaEdgeOriginApplicator({ edgeFunctions })), customErrorResponder),
             responseHeadersApplicator: properties.responseHeadersApplicator ??
                 new SimCfResponseHeadersApplicator(),
         };

package/dist/service/cloudfront/controller/sim-cloudfront-request-pipeline.js

@@ -44,7 +44,8 @@ export class SimCloudFrontRequestPipeline {
         // Put the request through the Distribution's web ACL, if it has one.
         // CloudFront asks WAF before any content handling, so a blocked request is
         // answered at the edge without a Behavior, a CloudFront Function or the
-        // Origin ever seeing it.
+        // Origin ever seeing it. Its 403 still goes through the Distribution's
+        // custom error responses, unless the block action named its own response.
         const webAclResult = await this.stages.webAclGuard.apply(requestReference, distro);
         if (webAclResult instanceof Response) {
             return webAclResult;

package/dist/service/cloudfront/controller/web-acl/sim-cf-web-acl-guard.d.ts

@@ -1,17 +1,26 @@
 import type { SimCloudFrontDistribution } from "../../distribution/sim-cloudfront-distribution.js";
 import type { SimCfWebAclResolver } from "../../web-acl/sim-cf-web-acl.js";
+import type { SimCfCustomErrorResponder } from "../error/sim-cf-custom-error-responder.js";
 /**
  * Puts a request through the web ACL a Distribution names, before anything
  * else has a look at it.
  *
  * CloudFront asks WAF ahead of every content-handling stage, so a blocked
  * request never reaches a viewer-request CloudFront Function, a cache
- * Behavior, a response headers policy or the Origin. It is answered at the
- * edge with the 403 the web ACL's block action describes.
+ * Behavior, a response headers policy or the Origin.
+ *
+ * A blocked request is answered with the custom response its block action
+ * names, where it names one. Otherwise WAF hands CloudFront its default 403,
+ * and CloudFront treats that like a 403 from the Origin: a custom error
+ * response the Distribution configures for 403 replaces it. CloudFront cannot
+ * tell the two 403s apart, so one rule covers both.
+ *
+ * https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-waf-use-cases.html
  */
 export declare class SimCfWebAclGuard {
     private readonly resolveWebAcl;
-    constructor(resolveWebAcl: SimCfWebAclResolver);
+    private readonly customErrorResponder;
+    constructor(resolveWebAcl: SimCfWebAclResolver, customErrorResponder: SimCfCustomErrorResponder);
     /**
      * Answer with the request to carry on with, or the response a blocked
      * request gets.
@@ -21,4 +30,17 @@ export declare class SimCfWebAclGuard {
      * request handling is for.
      */
     apply(request: Request, distribution: SimCloudFrontDistribution): Promise<Request | Response>;
+    /**
+     * The response a blocked request gets.
+     *
+     * A custom response from the block action takes precedence over anything
+     * the Distribution configures, whatever its status. WAF's default 403 goes
+     * through the Distribution's custom error responses instead.
+     *
+     * The answer is not stored in the Distribution's cache. WAF decides every
+     * request before the cache is consulted, so a blocked response stored under
+     * the request's cache key would only ever be served to a request WAF had
+     * already allowed.
+     */
+    private blockedResponse;
 }

package/dist/service/cloudfront/controller/web-acl/sim-cf-web-acl-guard.js

@@ -6,13 +6,22 @@ import { SimCloudFrontInvalidWebAclId } from "../../error/sim-cloudfront.error.j
  *
  * CloudFront asks WAF ahead of every content-handling stage, so a blocked
  * request never reaches a viewer-request CloudFront Function, a cache
- * Behavior, a response headers policy or the Origin. It is answered at the
- * edge with the 403 the web ACL's block action describes.
+ * Behavior, a response headers policy or the Origin.
+ *
+ * A blocked request is answered with the custom response its block action
+ * names, where it names one. Otherwise WAF hands CloudFront its default 403,
+ * and CloudFront treats that like a 403 from the Origin: a custom error
+ * response the Distribution configures for 403 replaces it. CloudFront cannot
+ * tell the two 403s apart, so one rule covers both.
+ *
+ * https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-waf-use-cases.html
  */
 export class SimCfWebAclGuard {
     resolveWebAcl;
-    constructor(resolveWebAcl) {
+    customErrorResponder;
+    constructor(resolveWebAcl, customErrorResponder) {
         this.resolveWebAcl = resolveWebAcl;
+        this.customErrorResponder = customErrorResponder;
     }
     /**
      * Answer with the request to carry on with, or the response a blocked
@@ -41,9 +50,29 @@ export class SimCfWebAclGuard {
             body: await requestBody(request),
             resourceType: "CLOUDFRONT",
         });
-        return decision.action === "BLOCK"
-            ? simWafBlockedHttpResponse(decision.blocked ?? simWafDefaultBlockedResponse())
-            : allowedRequest(request, decision);
+        if (decision.action === "BLOCK") {
+            return await this.blockedResponse(request, distribution, decision.blocked ?? simWafDefaultBlockedResponse());
+        }
+        return allowedRequest(request, decision);
+    }
+    /**
+     * The response a blocked request gets.
+     *
+     * A custom response from the block action takes precedence over anything
+     * the Distribution configures, whatever its status. WAF's default 403 goes
+     * through the Distribution's custom error responses instead.
+     *
+     * The answer is not stored in the Distribution's cache. WAF decides every
+     * request before the cache is consulted, so a blocked response stored under
+     * the request's cache key would only ever be served to a request WAF had
+     * already allowed.
+     */
+    async blockedResponse(request, distribution, blocked) {
+        const response = simWafBlockedHttpResponse(blocked);
+        if (blocked.isCustom) {
+            return response;
+        }
+        return await this.customErrorResponder.apply(request, distribution, response);
     }
 }
 /**

package/dist/service/cognito/serve/sim-cognito-controller.js

@@ -69,7 +69,7 @@ export class SimCognitoServiceController {
         // The web ACL sits in front of the endpoint rather than behind it, so a
         // request it blocks is answered before the method is judged. A write the
         // rules turned away gets WAF's 403 and never learns the endpoint reads.
-        const blocked = await this.blocked(pool, segment, request);
+        const blocked = await this.blocked(pool, segment, serviceRequest);
         if (blocked !== undefined) {
             return blocked;
         }
@@ -90,14 +90,15 @@ export class SimCognitoServiceController {
      * A blocked request is answered before the document is read, so a verifier
      * the rules turn away gets 403 and no keys.
      */
-    async blocked(pool, segment, request) {
+    async blocked(pool, segment, serviceRequest) {
         if (!simCognitoProtectedSegment(segment)) {
             return undefined;
         }
         const inspected = await this.webAcl.inspect({
             pool,
             cognito: simCognitoPoolScope(this.simAws, pool),
-            request,
+            request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         return inspected.blocked;
     }

package/dist/service/cognito/serve/sim-cognito-domain-controller.js

@@ -44,6 +44,7 @@ export class SimCognitoDomainController {
             pool,
             cognito,
             request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         if (inspected.blocked !== undefined) {
             return inspected.blocked;
@@ -95,6 +96,7 @@ function forwarded(serviceRequest, request) {
         request,
         caller: serviceRequest.caller,
         source: serviceRequest.source,
+        sourceIp: serviceRequest.sourceIp,
         body: serviceRequest.body,
     });
 }

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.d.ts

@@ -6,6 +6,8 @@ interface SimCognitoInspectionInput {
     /** The simulated Cognito scope the pool belongs to. */
     readonly cognito: SimCognitoIdentityProvider;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
 }
 /**
  * Puts a request to the web ACL in front of the pool it reached.

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.js

@@ -23,6 +23,7 @@ export class SimCognitoWebAclInspection {
             protection: input.cognito.webAcls(),
             resourceArn: input.pool.arn.value,
             request: input.request,
+            sourceIp: input.sourceIp,
             forwardBody: false,
         });
     }

package/dist/service/iam/index.d.ts

@@ -9,4 +9,5 @@ export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-sc
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { type SimAwsRequestAuthMethod, SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
 export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
+export { simAwsRequestSourceIp, simAwsSourceIpHeaderName, } from "./request/sim-aws-source-ip-header.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, type SimAwsRequestAuthFailure, } from "./request/error/sim-aws-request-auth.error.js";

package/dist/service/iam/index.js

@@ -4,4 +4,5 @@ export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSign
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
 export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
+export { simAwsRequestSourceIp, simAwsSourceIpHeaderName, } from "./request/sim-aws-source-ip-header.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, } from "./request/error/sim-aws-request-auth.error.js";

package/dist/service/iam/request/error/sim-aws-request-auth.error.d.ts

@@ -1,7 +1,7 @@
 import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
 /**
  * Raised when the `x-sim-aws-caller` header does not name a principal the
- * simulator understands.
+ * simulator understands, or `x-sim-aws-source-ip` names no address.
  *
  * This is a simulator control header rather than anything real AWS defines, so
  * a bad value is the caller's mistake in using Yulin, not a failed AWS

package/dist/service/iam/request/error/sim-aws-request-auth.error.js

@@ -1,7 +1,7 @@
 import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
 /**
  * Raised when the `x-sim-aws-caller` header does not name a principal the
- * simulator understands.
+ * simulator understands, or `x-sim-aws-source-ip` names no address.
  *
  * This is a simulator control header rather than anything real AWS defines, so
  * a bad value is the caller's mistake in using Yulin, not a failed AWS

package/dist/service/iam/request/sim-aws-control-headers.d.ts

@@ -2,7 +2,8 @@
  * Header names that are instructions to the simulator rather than part of the
  * request being simulated.
  *
- * They state who a request is from and what it is for, so anything passing a
+ * They state who a request is from, where it came from and what it is for, so
+ * anything passing a
  * request on to a simulated service has to decide what to do with them rather
  * than forward them by accident: the HTTP boundary strips them once the
  * request has been attributed, and sim CloudFront strips a viewer's before

package/dist/service/iam/request/sim-aws-control-headers.js

@@ -1,10 +1,12 @@
 import { simAwsCallerHeaderName } from "./sim-aws-caller-header.js";
+import { simAwsSourceIpHeaderName } from "./sim-aws-source-ip-header.js";
 import { simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./sim-aws-request-source.js";
 /**
  * Header names that are instructions to the simulator rather than part of the
  * request being simulated.
  *
- * They state who a request is from and what it is for, so anything passing a
+ * They state who a request is from, where it came from and what it is for, so
+ * anything passing a
  * request on to a simulated service has to decide what to do with them rather
  * than forward them by accident: the HTTP boundary strips them once the
  * request has been attributed, and sim CloudFront strips a viewer's before
@@ -14,6 +16,7 @@ export const simAwsControlHeaderNames = [
     simAwsCallerHeaderName,
     simAwsSourceArnHeaderName,
     simAwsSourceAccountHeaderName,
+    simAwsSourceIpHeaderName,
 ];
 /**
  * Remove the simulator's control headers from a set of request headers.

package/dist/service/iam/request/sim-aws-source-ip-header.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The header naming the client address a request into simulated AWS comes
+ * from.
+ *
+ * A request arrives in process or over loopback, so there is no remote address
+ * for the simulation to read. Whatever decides by where a request came from,
+ * such as a web ACL's IP reputation and anonymous IP rules, reads this instead,
+ * and a test sends it to say which client a request stands for.
+ */
+export declare const simAwsSourceIpHeaderName = "x-sim-aws-source-ip";
+/**
+ * Read the client address a request states, or the loopback address when it
+ * states none.
+ *
+ * The header holds one IPv4 or IPv6 address. A value that is neither is
+ * refused rather than read as loopback, since a test that misspelt an address
+ * would otherwise pass for the wrong reason.
+ */
+export declare function simAwsRequestSourceIp(headers: Headers): string;

package/dist/service/iam/request/sim-aws-source-ip-header.js

@@ -0,0 +1,32 @@
+import { isIP } from "node:net";
+import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
+import { SimAwsInvalidCallerHeader } from "./error/sim-aws-request-auth.error.js";
+/**
+ * The header naming the client address a request into simulated AWS comes
+ * from.
+ *
+ * A request arrives in process or over loopback, so there is no remote address
+ * for the simulation to read. Whatever decides by where a request came from,
+ * such as a web ACL's IP reputation and anonymous IP rules, reads this instead,
+ * and a test sends it to say which client a request stands for.
+ */
+export const simAwsSourceIpHeaderName = "x-sim-aws-source-ip";
+/**
+ * Read the client address a request states, or the loopback address when it
+ * states none.
+ *
+ * The header holds one IPv4 or IPv6 address. A value that is neither is
+ * refused rather than read as loopback, since a test that misspelt an address
+ * would otherwise pass for the wrong reason.
+ */
+export function simAwsRequestSourceIp(headers) {
+    const value = headers.get(simAwsSourceIpHeaderName)?.trim();
+    if (value === undefined || value === "") {
+        return simAwsProxiedSourceIp;
+    }
+    if (isIP(value) === 0) {
+        throw new SimAwsInvalidCallerHeader(`${simAwsSourceIpHeaderName} value ${value} must be one IPv4 or IPv6 ` +
+            `address`);
+    }
+    return value;
+}

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -75,7 +75,7 @@ export class SimWafAssociations {
         if (association === undefined) {
             return undefined;
         }
-        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body, association.webAcl.bodyInspectionLimitBytes(association.resourceType)));
+        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body, association.webAcl.bodyInspectionLimitBytes(association.resourceType), request.sourceIp));
     }
     /**
      * Forget whatever is in front of one resource.

package/dist/service/wafv2/association/sim-waf-protection.d.ts

@@ -6,6 +6,11 @@ export interface SimWafProtectedRequest {
     /** The resource the request reached, by ARN. */
     readonly resourceArn: string;
     readonly request: Request;
+    /**
+     * The client address the request came from, which is loopback when nothing
+     * says otherwise.
+     */
+    readonly sourceIp?: string | undefined;
     /**
      * The request body, when the rules might inspect it. A request body is a
      * stream that cannot be read twice, so it is passed in already buffered.

package/dist/service/wafv2/association/sim-waf-request-inspection.d.ts

@@ -5,6 +5,8 @@ interface SimWafInspectionInput {
     /** The resource the request reached, by ARN. */
     readonly resourceArn: string;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
     /**
      * Whether the fronting service forwards the request body to AWS WAF.
      *

package/dist/service/wafv2/association/sim-waf-request-inspection.js

@@ -27,12 +27,17 @@ export class SimWafRequestInspection {
      * Put one request to whatever protects the resource it addressed.
      */
     async inspect(input) {
-        const { protection, resourceArn, request } = input;
+        const { protection, resourceArn, request, sourceIp } = input;
         if (!protection.protects(resourceArn)) {
             return new SimWafInspected({ request });
         }
         const body = input.forwardBody ? await inspectedBody(request) : undefined;
-        const decision = protection.decide({ resourceArn, request, body });
+        const decision = protection.decide({
+            resourceArn,
+            request,
+            sourceIp,
+            body,
+        });
         // A decision carries a blocked response when its action was to block, and
         // carries none when the request was allowed. That one reading is what
         // decides the request here.

package/dist/service/wafv2/evaluate/sim-waf-blocked-response.d.ts

@@ -7,6 +7,18 @@ export interface SimWafBlockedResponse {
     readonly contentType: string;
     readonly body: string;
     readonly headers: readonly SimWafHeader[];
+    /**
+     * Whether the block action named a `CustomResponse` of its own.
+     *
+     * A fronting service treats the two differently. A custom response goes to
+     * the client exactly as the rule describes it, and the service's own error
+     * handling has no say in it. WAF's default 403 is handed to the service as
+     * any other 403 would be, so a CloudFront custom error response for 403
+     * replaces it.
+     *
+     * https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-for-blocked-requests.html
+     */
+    readonly isCustom: boolean;
 }
 /**
  * The body a block action with no custom response of its own answers with.

package/dist/service/wafv2/evaluate/sim-waf-blocked-response.js

@@ -15,6 +15,7 @@ export function simWafDefaultBlockedResponse() {
         body: "<html><head><title>403 Forbidden</title></head>" +
             "<body>Request blocked by AWS WAF.</body></html>",
         headers: [],
+        isCustom: false,
     };
 }
 /**

package/dist/service/wafv2/evaluate/sim-waf-evaluation-request.d.ts

@@ -6,6 +6,11 @@ export interface SimWafEvaluationRequest {
     /** The web ACL to evaluate against, by ARN. */
     readonly webAclArn: string;
     readonly request: Request;
+    /**
+     * The client address the request came from. A request naming none comes
+     * from `127.0.0.1`, as every request does that states no other address.
+     */
+    readonly sourceIp?: string | undefined;
     /**
      * The request body, when the rules might inspect it. A request body is a
      * stream that cannot be read twice, so it is passed in already buffered.

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.d.ts

@@ -20,6 +20,14 @@ export interface SimWafInspectedRequest {
      * header with the Yulin-local suffix taken off it.
      */
     readonly host: string;
+    /**
+     * The client address the request came from, which is what the IP-based
+     * rules read.
+     *
+     * Nothing reaches this simulation over a public network, so this is
+     * `127.0.0.1` unless the request said otherwise with `x-sim-aws-source-ip`.
+     */
+    readonly sourceIp: string;
     /** The request body, or nothing when the request carried none. */
     readonly body: Uint8Array | undefined;
     /**
@@ -49,5 +57,8 @@ export interface SimWafInspectedRequest {
  * The body inspection limit defaults to the 16 KB every resource type this
  * simulation protects reads by default. A web ACL raising it with
  * `AssociationConfig` passes the raised figure in.
+ *
+ * The client address defaults to loopback, which is where a request comes from
+ * when it states no other address.
  */
-export declare function simWafInspectedRequest(request: Request, body?: Uint8Array, bodyInspectionLimitBytes?: number): SimWafInspectedRequest;
+export declare function simWafInspectedRequest(request: Request, body?: Uint8Array, bodyInspectionLimitBytes?: number, sourceIp?: string): SimWafInspectedRequest;

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.js

@@ -1,4 +1,7 @@
+import { isIP } from "node:net";
+import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
 import { simAwsRequestHostname } from "../../../serve/http/url/sim-aws-request-hostname.js";
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
 import { simWafBodyInspectionLimitBytes } from "../web-acl/sim-waf-association-config.js";
 import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
 /**
@@ -16,8 +19,15 @@ import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
  * The body inspection limit defaults to the 16 KB every resource type this
  * simulation protects reads by default. A web ACL raising it with
  * `AssociationConfig` passes the raised figure in.
+ *
+ * The client address defaults to loopback, which is where a request comes from
+ * when it states no other address.
  */
-export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes = simWafBodyInspectionLimitBytes) {
+export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes = simWafBodyInspectionLimitBytes, sourceIp = simAwsProxiedSourceIp) {
+    if (isIP(sourceIp) === 0) {
+        throw new SimWafDeclarationError(`A request's source address must be one IPv4 or IPv6 address, and ` +
+            `${sourceIp} is neither`);
+    }
     const url = new URL(request.url);
     return {
         method: request.method,
@@ -28,6 +38,7 @@ export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes =
         queryString: url.search.replace(/^\?/u, ""),
         headers: request.headers,
         host: simAwsRequestHostname(request),
+        sourceIp,
         body,
         bodyInspectionLimitBytes,
         labels: new SimWafRequestLabels(),

package/dist/service/wafv2/index.d.ts

@@ -25,13 +25,14 @@ export { SimWafIpSet, type SimWafIpAddressVersion, } from "./ip-set/sim-waf-ip-s
 export { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern-set.js";
 export type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
 export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
-export { SimWafManagedRules, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
+export { SimWafManagedRules, type SimWafManagedAddressDeclaration, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
 export type { SimWafBotDeclaration } from "./managed/sim-waf-bot-declaration.js";
 export type { SimWafManagedRuleReport } from "./managed/sim-waf-managed-rule-report.js";
 export type { SimWafManagedRuleTier } from "./managed/sim-waf-managed-rule.type.js";
 export type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput, SimWafRuleActionOverrideInput, } from "./managed/sim-waf-managed-group.type.js";
 export { simWafBlockedHttpResponse, type SimWafBlockedResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { type SimWafInspectedRequest, simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
+export { simAwsSourceIpHeaderName } from "../iam/request/sim-aws-source-ip-header.js";
 export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
 export { type SimWafAssociationConfigInput, type SimWafBodyInspectionResourceType, simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export type { SimWafRateBasedStatementInput } from "./statement/sim-waf-rate-based.type.js";

package/dist/service/wafv2/index.js

@@ -20,6 +20,7 @@ export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
 export { SimWafManagedRules, } from "./managed/sim-waf-managed-rules.js";
 export { simWafBlockedHttpResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
+export { simAwsSourceIpHeaderName } from "../iam/request/sim-aws-source-ip-header.js";
 export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
 export { simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";