@kensio/yulin 1.23.0 → 1.23.1

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js

@@ -29,6 +29,10 @@ export class SimCloudFrontControllerDependenciesFactory {
             new DefaultSimCloudFrontBehaviorResolver();
         const originFetcher = properties.originFetcher ?? new SimCloudFrontOriginFetcher();
         const edgeFunctions = new SimAwsCfEdgeFunctions(simAws);
+        // A request the web ACL blocks with WAF's default 403 gets the same custom
+        // error response an Origin's 403 would, so the one responder serves both.
+        const customErrorResponder = properties.customErrorResponder ??
+            new SimCfCustomErrorResponder({ behaviourResolver, originFetcher });
         return {
             distroRouter: properties.distroRouter ??
                 new DefaultSimCloudFrontDistroRouter({
@@ -36,14 +40,13 @@ export class SimCloudFrontControllerDependenciesFactory {
                     cloudFrontRegistry,
                 }),
             webAclGuard: properties.webAclGuard ??
-                new SimCfWebAclGuard(makeSimCfWebAclResolver(simAws)),
+                new SimCfWebAclGuard(makeSimCfWebAclResolver(simAws), customErrorResponder),
             behaviourResolver,
             cffApplicator: properties.cffApplicator ?? new SimCffApplicator(),
             edgeApplicator: properties.edgeApplicator ??
                 new SimLambdaEdgeApplicator({ edgeFunctions }),
             contentStage: new SimCfContentStage(new SimCfOriginStage(originFetcher, properties.edgeOriginApplicator ??
-                new SimLambdaEdgeOriginApplicator({ edgeFunctions })), properties.customErrorResponder ??
-                new SimCfCustomErrorResponder({ behaviourResolver, originFetcher })),
+                new SimLambdaEdgeOriginApplicator({ edgeFunctions })), customErrorResponder),
             responseHeadersApplicator: properties.responseHeadersApplicator ??
                 new SimCfResponseHeadersApplicator(),
         };

package/dist/service/cloudfront/controller/sim-cloudfront-request-pipeline.js

@@ -44,7 +44,8 @@ export class SimCloudFrontRequestPipeline {
         // Put the request through the Distribution's web ACL, if it has one.
         // CloudFront asks WAF before any content handling, so a blocked request is
         // answered at the edge without a Behavior, a CloudFront Function or the
-        // Origin ever seeing it.
+        // Origin ever seeing it. Its 403 still goes through the Distribution's
+        // custom error responses, unless the block action named its own response.
         const webAclResult = await this.stages.webAclGuard.apply(requestReference, distro);
         if (webAclResult instanceof Response) {
             return webAclResult;

package/dist/service/cloudfront/controller/web-acl/sim-cf-web-acl-guard.d.ts

@@ -1,17 +1,26 @@
 import type { SimCloudFrontDistribution } from "../../distribution/sim-cloudfront-distribution.js";
 import type { SimCfWebAclResolver } from "../../web-acl/sim-cf-web-acl.js";
+import type { SimCfCustomErrorResponder } from "../error/sim-cf-custom-error-responder.js";
 /**
  * Puts a request through the web ACL a Distribution names, before anything
  * else has a look at it.
  *
  * CloudFront asks WAF ahead of every content-handling stage, so a blocked
  * request never reaches a viewer-request CloudFront Function, a cache
- * Behavior, a response headers policy or the Origin. It is answered at the
- * edge with the 403 the web ACL's block action describes.
+ * Behavior, a response headers policy or the Origin.
+ *
+ * A blocked request is answered with the custom response its block action
+ * names, where it names one. Otherwise WAF hands CloudFront its default 403,
+ * and CloudFront treats that like a 403 from the Origin: a custom error
+ * response the Distribution configures for 403 replaces it. CloudFront cannot
+ * tell the two 403s apart, so one rule covers both.
+ *
+ * https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-waf-use-cases.html
  */
 export declare class SimCfWebAclGuard {
     private readonly resolveWebAcl;
-    constructor(resolveWebAcl: SimCfWebAclResolver);
+    private readonly customErrorResponder;
+    constructor(resolveWebAcl: SimCfWebAclResolver, customErrorResponder: SimCfCustomErrorResponder);
     /**
      * Answer with the request to carry on with, or the response a blocked
      * request gets.
@@ -21,4 +30,17 @@ export declare class SimCfWebAclGuard {
      * request handling is for.
      */
     apply(request: Request, distribution: SimCloudFrontDistribution): Promise<Request | Response>;
+    /**
+     * The response a blocked request gets.
+     *
+     * A custom response from the block action takes precedence over anything
+     * the Distribution configures, whatever its status. WAF's default 403 goes
+     * through the Distribution's custom error responses instead.
+     *
+     * The answer is not stored in the Distribution's cache. WAF decides every
+     * request before the cache is consulted, so a blocked response stored under
+     * the request's cache key would only ever be served to a request WAF had
+     * already allowed.
+     */
+    private blockedResponse;
 }

package/dist/service/cloudfront/controller/web-acl/sim-cf-web-acl-guard.js

@@ -6,13 +6,22 @@ import { SimCloudFrontInvalidWebAclId } from "../../error/sim-cloudfront.error.j
  *
  * CloudFront asks WAF ahead of every content-handling stage, so a blocked
  * request never reaches a viewer-request CloudFront Function, a cache
- * Behavior, a response headers policy or the Origin. It is answered at the
- * edge with the 403 the web ACL's block action describes.
+ * Behavior, a response headers policy or the Origin.
+ *
+ * A blocked request is answered with the custom response its block action
+ * names, where it names one. Otherwise WAF hands CloudFront its default 403,
+ * and CloudFront treats that like a 403 from the Origin: a custom error
+ * response the Distribution configures for 403 replaces it. CloudFront cannot
+ * tell the two 403s apart, so one rule covers both.
+ *
+ * https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-waf-use-cases.html
  */
 export class SimCfWebAclGuard {
     resolveWebAcl;
-    constructor(resolveWebAcl) {
+    customErrorResponder;
+    constructor(resolveWebAcl, customErrorResponder) {
         this.resolveWebAcl = resolveWebAcl;
+        this.customErrorResponder = customErrorResponder;
     }
     /**
      * Answer with the request to carry on with, or the response a blocked
@@ -41,9 +50,29 @@ export class SimCfWebAclGuard {
             body: await requestBody(request),
             resourceType: "CLOUDFRONT",
         });
-        return decision.action === "BLOCK"
-            ? simWafBlockedHttpResponse(decision.blocked ?? simWafDefaultBlockedResponse())
-            : allowedRequest(request, decision);
+        if (decision.action === "BLOCK") {
+            return await this.blockedResponse(request, distribution, decision.blocked ?? simWafDefaultBlockedResponse());
+        }
+        return allowedRequest(request, decision);
+    }
+    /**
+     * The response a blocked request gets.
+     *
+     * A custom response from the block action takes precedence over anything
+     * the Distribution configures, whatever its status. WAF's default 403 goes
+     * through the Distribution's custom error responses instead.
+     *
+     * The answer is not stored in the Distribution's cache. WAF decides every
+     * request before the cache is consulted, so a blocked response stored under
+     * the request's cache key would only ever be served to a request WAF had
+     * already allowed.
+     */
+    async blockedResponse(request, distribution, blocked) {
+        const response = simWafBlockedHttpResponse(blocked);
+        if (blocked.isCustom) {
+            return response;
+        }
+        return await this.customErrorResponder.apply(request, distribution, response);
     }
 }
 /**

package/dist/service/wafv2/evaluate/sim-waf-blocked-response.d.ts

@@ -7,6 +7,18 @@ export interface SimWafBlockedResponse {
     readonly contentType: string;
     readonly body: string;
     readonly headers: readonly SimWafHeader[];
+    /**
+     * Whether the block action named a `CustomResponse` of its own.
+     *
+     * A fronting service treats the two differently. A custom response goes to
+     * the client exactly as the rule describes it, and the service's own error
+     * handling has no say in it. WAF's default 403 is handed to the service as
+     * any other 403 would be, so a CloudFront custom error response for 403
+     * replaces it.
+     *
+     * https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-for-blocked-requests.html
+     */
+    readonly isCustom: boolean;
 }
 /**
  * The body a block action with no custom response of its own answers with.

package/dist/service/wafv2/evaluate/sim-waf-blocked-response.js

@@ -15,6 +15,7 @@ export function simWafDefaultBlockedResponse() {
         body: "<html><head><title>403 Forbidden</title></head>" +
             "<body>Request blocked by AWS WAF.</body></html>",
         headers: [],
+        isCustom: false,
     };
 }
 /**

package/dist/service/wafv2/web-acl/sim-waf-action-input.js

@@ -18,6 +18,7 @@ export function simWafBlockedResponse(customResponse, bodies) {
         contentType: body?.contentType ?? fallback.contentType,
         body: body?.content ?? fallback.body,
         headers: simWafResponseHeaders(customResponse.ResponseHeaders),
+        isCustom: true,
     };
 }
 /**

package/docs/services/cloudfront/README.md

@@ -260,6 +260,11 @@ Origin again. A rule carrying it alone, with no `ResponsePagePath`, configures e
 status the Distribution serves no page for. See
 [What a Distribution stores](#what-a-distribution-stores).
 
+A request the Distribution's [web ACL](#web-acls) blocks gets the custom error response for 403
+as well. CloudFront cannot tell WAF's 403 from the Origin's, so a site mapping 403 to its not-found
+page serves that page to a blocked request too. A block action with a `CustomResponse` of its own
+is the exception (see [Web ACLs](#web-acls)).
+
 ## Serve simulated CloudFront on localhost
 
 Use `serveSimAws` to send HTTP requests through the simulated distribution on localhost.
@@ -1846,7 +1851,7 @@ the site serves from the Origin (see [Limitations](#limitations)).
 
 A Distribution can put a WAFv2 web ACL in front of everything it serves. Name the web ACL's ARN in
 `WebACLId` and the Distribution evaluates it against every request that arrives. A request the web
-ACL blocks gets 403 from the edge. A request it allows carries on to the cache Behavior and the
+ACL blocks is answered at the edge. A request it allows carries on to the cache Behavior and the
 Origin.
 
 CloudFront takes its web ACL this way. WAFv2's `AssociateWebACL` covers the regional resource types.
@@ -1859,6 +1864,17 @@ simulation never created, is refused with `InvalidWebACLId` at `CreateDistributi
 The web ACL decides before any other stage sees the request. A blocked request never reaches a
 viewer-request CloudFront Function, a cache Behavior, a response headers policy or the Origin.
 
+What a blocked request gets depends on the block action. A `CustomResponse` on the action is sent
+as the rule describes it, whatever its status, and the Distribution's `CustomErrorResponses` have no
+say. With no `CustomResponse`, WAF answers 403 and the Distribution treats it as it treats a 403
+from the Origin. A custom error response for 403 with a `ResponsePagePath` replaces it with the
+response page and its `ResponseCode`. Without one, the viewer gets WAF's 403. The order is the one
+[AWS documents for blocked requests](https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-for-blocked-requests.html).
+
+A blocked request's answer is never stored in the Distribution's cache, so `ErrorCachingMinTTL`
+has no effect on it. The next viewer to ask for the same URL is answered by WAF's decision about
+their own request.
+
 A CloudFormation Distribution naming a web ACL this simulation does not hold deploys without one.
 The `WebACLId` lands on `stack.ignoredProperties` and every request is served, including the ones
 the web ACL would have decided. A template naming a web ACL from a real account is ordinary, and a

package/docs/services/wafv2/README.md

@@ -1096,9 +1096,15 @@ its assets are outside the simulation.
 ## Protecting a CloudFront distribution
 
 A simulated CloudFront distribution names its web ACL in `WebACLId` on its `DistributionConfig`,
-and evaluates it against every request that reaches the distribution. A blocked request gets 403
+and evaluates it against every request that reaches the distribution. A blocked request is answered
 before a cache behaviour, a viewer-request CloudFront Function or the origin sees it.
 
+WAF's default 403 goes through the distribution's custom error responses, as a 403 from the origin
+would. A distribution mapping 403 to a not-found page serves that page, with its `ResponseCode`, to
+a request the web ACL blocked. A block action with a `CustomResponse` takes precedence. Its status
+and body reach the viewer unchanged, even when the distribution has a custom error response for the
+same status.
+
 CloudFront is associated this way and not through `AssociateWebACL`, which real WAF keeps for the
 regional resource types. The ARN has to name a `CLOUDFRONT` [scope](#scopes) web ACL. See
 [web ACLs in the CloudFront docs](https://yulinsim.dev/services/cloudfront/#web-acls) for the whole example.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.23.0",
+  "version": "1.23.1",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",