@kensio/yulin 1.9.0 → 1.10.1

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-properties.js

@@ -0,0 +1,93 @@
+import { simCfnSnsAttributeValue } from "../sim-cfn-sns-attribute-value.js";
+import { simCfnSnsResourceError } from "../sim-cfn-sns-resource-error.js";
+import { snsTopicResourceType } from "../sim-cfn-sns-resource-types.js";
+import { simCfnSnsInlineSubscriptions, } from "./sim-cfn-sns-inline-subscriptions.js";
+import { SimCfnSnsTopicName } from "./sim-cfn-sns-topic-name.js";
+import { attributePropertyNames, topicNamePropertyName, topicSubscriptionPropertyName, unsimulatedPropertyReasons, } from "./sim-cfn-sns-topic-property-names.js";
+/**
+ * Reads AWS::SNS::Topic CloudFormation properties into the shape CreateTopic
+ * takes.
+ *
+ * Most of what a template can say about a topic is a topic attribute of the
+ * same name, so those are passed straight through and simulated SNS decides
+ * what it will take. A property that is not an attribute, and that this
+ * simulation gives no behaviour to, is refused here instead. Refusing rather
+ * than dropping is the point: a topic deployed without its data protection
+ * policy looks protected to the template that wrote it and redacts nothing.
+ */
+export class SimCfnSnsTopicProperties {
+    resource;
+    properties;
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.properties = new Map(Object.entries(properties.properties));
+    }
+    /**
+     * The topic name.
+     *
+     * An unnamed topic is named after the stack and the logical ID, as real
+     * CloudFormation names one.
+     */
+    name() {
+        const name = this.properties.get(topicNamePropertyName);
+        if (name === undefined) {
+            return new SimCfnSnsTopicName({
+                stackName: this.resource.stackName,
+                logicalId: this.resource.logicalId,
+            }).value;
+        }
+        if (typeof name !== "string") {
+            throw this.propertyError(`${topicNamePropertyName} must be a string`);
+        }
+        return name;
+    }
+    /**
+     * The topic attributes the template sets, in the string form CreateTopic
+     * takes them in.
+     *
+     * The ones simulated SNS gives no behaviour to are passed on with the rest,
+     * because refusing them is SNS's own answer and it already carries the reason
+     * each one is missing. `FifoTopic` is the one that matters most: only
+     * standard topics are simulated, and a topic that appeared to accept the
+     * property would be a standard topic a test believed was ordered.
+     */
+    attributes() {
+        return Object.fromEntries(this.properties
+            .entries()
+            .filter(([name]) => this.isAttributeProperty(name))
+            .map(([name, value]) => [name, simCfnSnsAttributeValue(value)]));
+    }
+    /**
+     * The subscriptions the topic declares inside itself.
+     */
+    inlineSubscriptions() {
+        return simCfnSnsInlineSubscriptions(this.resource.logicalId, this.properties.get(topicSubscriptionPropertyName));
+    }
+    /**
+     * Whether a property is handed to CreateTopic as an attribute.
+     *
+     * The two properties the CloudFormation layer reads itself are not. The rest
+     * are refused as they are reached: the ones with a reason of their own with
+     * that reason, and anything else as a property AWS::SNS::Topic does not have,
+     * which is how real CloudFormation answers one too.
+     */
+    isAttributeProperty(name) {
+        if (name === topicNamePropertyName ||
+            name === topicSubscriptionPropertyName) {
+            return false;
+        }
+        if (attributePropertyNames.has(name)) {
+            return true;
+        }
+        const unsimulatedReason = unsimulatedPropertyReasons.get(name);
+        if (unsimulatedReason !== undefined) {
+            throw this.propertyError(`${name} is a real ${snsTopicResourceType} property simulated SNS ` +
+                `does not act on: ${unsimulatedReason}`);
+        }
+        throw this.propertyError(`${name} is not a property of ${snsTopicResourceType}`);
+    }
+    propertyError(reason) {
+        return simCfnSnsResourceError(snsTopicResourceType, this.resource.logicalId, reason);
+    }
+}
+//# sourceMappingURL=sim-cfn-sns-topic-properties.js.map

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sns-topic-properties.js","sourceRoot":"","sources":["../../../../../src/service/sns/cfn/topic/sim-cfn-sns-topic-properties.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uCAAuC,CAAC;AAO/C;;;;;;;;;;GAUG;AACH,MAAM,OAAO,wBAAwB;IAClB,QAAQ,CAAiB;IACzB,UAAU,CAA2C;IAEtE,YAAY,UAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACH,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAExD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;aACnC,CAAC,CAAC,KAAK,CAAC;QACX,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,qBAAqB,mBAAmB,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,UAAU;QACR,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,CAAC,UAAU;aACZ,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAClE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,4BAA4B,CACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,EACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,6BAA6B,CAAC,CACnD,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB,CAAC,IAAY;QACtC,IACE,IAAI,KAAK,qBAAqB;YAC9B,IAAI,KAAK,6BAA6B,EACtC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE/D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,aAAa,CACtB,GAAG,IAAI,cAAc,oBAAoB,0BAA0B;gBACjE,oBAAoB,iBAAiB,EAAE,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CACtB,GAAG,IAAI,yBAAyB,oBAAoB,EAAE,CACvD,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,OAAO,sBAAsB,CAC3B,oBAAoB,EACpB,IAAI,CAAC,QAAQ,CAAC,SAAS,EACvB,MAAM,CACP,CAAC;IACJ,CAAC;CACF"}

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-property-names.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The name the template gives the topic.
+ */
+export declare const topicNamePropertyName = "TopicName";
+/**
+ * The subscriptions declared inside the topic rather than as Resources of their
+ * own.
+ */
+export declare const topicSubscriptionPropertyName = "Subscription";
+/**
+ * The AWS::SNS::Topic properties carrying a topic attribute of the same name.
+ *
+ * CloudFormation names these exactly as the SNS API names the attributes, so
+ * they are handed to CreateTopic rather than read here. Simulated SNS takes
+ * `DisplayName` and refuses the rest by name with the reason each one is
+ * missing, which is the same refusal an SDK caller setting the attribute gets.
+ * Keeping that decision in one place is what stops a template quietly accepting
+ * something the SDK path would not.
+ */
+export declare const attributePropertyNames: ReadonlySet<string>;
+/**
+ * The real AWS::SNS::Topic properties this simulation has no behaviour for and
+ * no single topic attribute to hand them to.
+ *
+ * The rest of the unsimulated properties are attributes of the same name, so
+ * SNS refuses those itself. These three are not: two are inputs of their own on
+ * a CreateTopic request, and `DeliveryStatusLogging` is a list that would
+ * become fifteen separate attributes.
+ */
+export declare const unsimulatedPropertyReasons: ReadonlyMap<string, string>;
+//# sourceMappingURL=sim-cfn-sns-topic-property-names.d.ts.map

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-property-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sns-topic-property-names.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/cfn/topic/sim-cfn-sns-topic-property-names.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,6BAA6B,iBAAiB,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CASrD,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAYjE,CAAC"}

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-property-names.js

@@ -0,0 +1,52 @@
+/**
+ * The name the template gives the topic.
+ */
+export const topicNamePropertyName = "TopicName";
+/**
+ * The subscriptions declared inside the topic rather than as Resources of their
+ * own.
+ */
+export const topicSubscriptionPropertyName = "Subscription";
+/**
+ * The AWS::SNS::Topic properties carrying a topic attribute of the same name.
+ *
+ * CloudFormation names these exactly as the SNS API names the attributes, so
+ * they are handed to CreateTopic rather than read here. Simulated SNS takes
+ * `DisplayName` and refuses the rest by name with the reason each one is
+ * missing, which is the same refusal an SDK caller setting the attribute gets.
+ * Keeping that decision in one place is what stops a template quietly accepting
+ * something the SDK path would not.
+ */
+export const attributePropertyNames = new Set([
+    "ArchivePolicy",
+    "ContentBasedDeduplication",
+    "DisplayName",
+    "FifoThroughputScope",
+    "FifoTopic",
+    "KmsMasterKeyId",
+    "SignatureVersion",
+    "TracingConfig",
+]);
+/**
+ * The real AWS::SNS::Topic properties this simulation has no behaviour for and
+ * no single topic attribute to hand them to.
+ *
+ * The rest of the unsimulated properties are attributes of the same name, so
+ * SNS refuses those itself. These three are not: two are inputs of their own on
+ * a CreateTopic request, and `DeliveryStatusLogging` is a list that would
+ * become fifteen separate attributes.
+ */
+export const unsimulatedPropertyReasons = new Map([
+    [
+        "DataProtectionPolicy",
+        "data protection policies are not simulated, so a topic deployed with one " +
+            "would redact nothing while a test believed it was protecting the " +
+            "messages going through the topic",
+    ],
+    [
+        "DeliveryStatusLogging",
+        "delivery status logging writes to CloudWatch Logs, which is not simulated",
+    ],
+    ["Tags", "no simulated service reads a topic tag"],
+]);
+//# sourceMappingURL=sim-cfn-sns-topic-property-names.js.map

package/dist/service/sns/cfn/topic/sim-cfn-sns-topic-property-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sns-topic-property-names.js","sourceRoot":"","sources":["../../../../../src/service/sns/cfn/topic/sim-cfn-sns-topic-property-names.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,cAAc,CAAC;AAE5D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,eAAe;IACf,2BAA2B;IAC3B,aAAa;IACb,qBAAqB;IACrB,WAAW;IACX,gBAAgB;IAChB,kBAAkB;IAClB,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAgC,IAAI,GAAG,CAAC;IAC7E;QACE,sBAAsB;QACtB,2EAA2E;YACzE,mEAAmE;YACnE,kCAAkC;KACrC;IACD;QACE,uBAAuB;QACvB,2EAA2E;KAC5E;IACD,CAAC,MAAM,EAAE,wCAAwC,CAAC;CACnD,CAAC,CAAC"}

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-creator.d.ts

@@ -0,0 +1,34 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimSns } from "../../sim-sns.js";
+import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
+interface SimCfnSnsTopicPolicyCreatorProperties {
+    readonly sns: SimSns;
+}
+/**
+ * Creates simulated topic policies from AWS::SNS::TopicPolicy Resources.
+ *
+ * This is what CDK emits for `grantPublish` to a service principal and for
+ * every `addToResourcePolicy`, so a synthesized template reaches it whether or
+ * not the app mentions a topic policy itself. The policy is set through the
+ * ordinary SetTopicAttributes command, so one declared in a template is
+ * validated and enforced exactly as one set through the SDK.
+ */
+export declare class SimCfnSnsTopicPolicyCreator {
+    private readonly sns;
+    constructor(properties: SimCfnSnsTopicPolicyCreatorProperties);
+    /**
+     * Attach a policy to each topic the Resource names.
+     *
+     * The first topic is returned as the Resource's simulated object, because a
+     * topic policy has no existence of its own in SNS: it is the `Policy`
+     * attribute of the topics it names.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimSnsTopic>;
+    /**
+     * Set the policy on one topic and hand back the topic it was set on.
+     */
+    private policyApplied;
+}
+export {};
+//# sourceMappingURL=sim-cfn-sns-topic-policy-creator.d.ts.map

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sns-topic-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-creator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAUhE,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;;OAMG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,WAAW,CAAC,CA0BtB;IAED;;OAEG;YACW,aAAa;CAoB5B"}

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-creator.js

@@ -0,0 +1,58 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { jsonStringify } from "../../../../util/type-guard/json.js";
+import { simSnsPolicyAttributeName } from "../../topic/sim-sns-topic-attribute-names.js";
+import { parseSnsTopicArn } from "../../topic/sim-sns-topic-arn.js";
+import { simCfnSnsResourceCreation } from "../sim-cfn-sns-resource-error.js";
+import { snsTopicPolicyResourceType } from "../sim-cfn-sns-resource-types.js";
+import { simCfnSnsPolicyDocument, simCfnSnsPolicyTopicArns, } from "./sim-cfn-sns-topic-policy-properties.js";
+/**
+ * Creates simulated topic policies from AWS::SNS::TopicPolicy Resources.
+ *
+ * This is what CDK emits for `grantPublish` to a service principal and for
+ * every `addToResourcePolicy`, so a synthesized template reaches it whether or
+ * not the app mentions a topic policy itself. The policy is set through the
+ * ordinary SetTopicAttributes command, so one declared in a template is
+ * validated and enforced exactly as one set through the SDK.
+ */
+export class SimCfnSnsTopicPolicyCreator {
+    sns;
+    constructor(properties) {
+        this.sns = properties.sns;
+    }
+    /**
+     * Attach a policy to each topic the Resource names.
+     *
+     * The first topic is returned as the Resource's simulated object, because a
+     * topic policy has no existence of its own in SNS: it is the `Policy`
+     * attribute of the topics it names.
+     */
+    async create(resource, properties) {
+        const { logicalId } = resource;
+        const topicArns = simCfnSnsPolicyTopicArns(logicalId, properties);
+        const policy = jsonStringify(simCfnSnsPolicyDocument(logicalId, properties));
+        return simCfnSnsResourceCreation(snsTopicPolicyResourceType, logicalId, async () => {
+            const topics = await Promise.all(topicArns.map(async (topicArn) => this.policyApplied(topicArn, policy)));
+            const first = topics[0];
+            assertDefined(first, `sim SNS topic after CloudFormation topic policy creation for ${logicalId}`);
+            return first;
+        });
+    }
+    /**
+     * Set the policy on one topic and hand back the topic it was set on.
+     */
+    async policyApplied(topicArn, policy) {
+        await this.sns.setTopicAttributes({
+            input: {
+                TopicArn: topicArn,
+                AttributeName: simSnsPolicyAttributeName,
+                AttributeValue: policy,
+            },
+        });
+        const parts = parseSnsTopicArn(topicArn);
+        assertDefined(parts, `topic ARN ${topicArn} SetTopicAttributes accepted`);
+        const topic = this.sns.findTopic(parts.name);
+        assertDefined(topic, `sim SNS topic at ${topicArn}`);
+        return topic;
+    }
+}
+//# sourceMappingURL=sim-cfn-sns-topic-policy-creator.js.map

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sns-topic-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAKpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,0CAA0C,CAAC;AAMlD;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,GAAG,CAAS;IAE7B,YAAY,UAAiD;QAC3D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;QAC/B,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,aAAa,CAC1B,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAC/C,CAAC;QAEF,OAAO,yBAAyB,CAC9B,0BAA0B,EAC1B,SAAS,EACT,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/B,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CACrC,CACF,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,aAAa,CACX,KAAK,EACL,gEAAgE,SAAS,EAAE,CAC5E,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CACzB,QAAgB,EAChB,MAAc;QAEd,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAChC,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,aAAa,EAAE,yBAAyB;gBACxC,cAAc,EAAE,MAAM;aACvB;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzC,aAAa,CAAC,KAAK,EAAE,aAAa,QAAQ,8BAA8B,CAAC,CAAC;QAE1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,aAAa,CAAC,KAAK,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.d.ts

@@ -0,0 +1,20 @@
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * The topic ARNs an AWS::SNS::TopicPolicy Resource names.
+ *
+ * `Ref` on an AWS::SNS::Topic gives its ARN, so a template naming its topics
+ * the way CDK does arrives here as the ARNs SetTopicAttributes takes.
+ *
+ * Creation and deletion both read them, because the Resource points at only the
+ * first of the topics it named and taking the policy back off needs all of
+ * them.
+ */
+export declare function simCfnSnsPolicyTopicArns(logicalId: string, properties: SimCfnTemplateValueRecord): readonly string[];
+/**
+ * The policy document an AWS::SNS::TopicPolicy Resource carries.
+ *
+ * A template writes it as an object where SetTopicAttributes takes a JSON
+ * string, so what comes back here is what is serialised on the way in.
+ */
+export declare function simCfnSnsPolicyDocument(logicalId: string, properties: SimCfnTemplateValueRecord): object;
+//# sourceMappingURL=sim-cfn-sns-topic-policy-properties.d.ts.map

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sns-topic-policy-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAIlH;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,yBAAyB,GACpC,SAAS,MAAM,EAAE,CAoBnB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,yBAAyB,GACpC,MAAM,CAgBR"}

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.js

@@ -0,0 +1,44 @@
+import { simCfnSnsResourceError } from "../sim-cfn-sns-resource-error.js";
+import { snsTopicPolicyResourceType } from "../sim-cfn-sns-resource-types.js";
+/**
+ * The topic ARNs an AWS::SNS::TopicPolicy Resource names.
+ *
+ * `Ref` on an AWS::SNS::Topic gives its ARN, so a template naming its topics
+ * the way CDK does arrives here as the ARNs SetTopicAttributes takes.
+ *
+ * Creation and deletion both read them, because the Resource points at only the
+ * first of the topics it named and taking the policy back off needs all of
+ * them.
+ */
+export function simCfnSnsPolicyTopicArns(logicalId, properties) {
+    const topics = properties["Topics"];
+    if (!Array.isArray(topics) || topics.length === 0) {
+        throw topicPolicyError(logicalId, "Topics is required and must be a list of topic ARNs");
+    }
+    return topics.map((topic) => {
+        if (typeof topic !== "string") {
+            throw topicPolicyError(logicalId, `each entry of Topics must be a topic ARN string, and one is a ${typeof topic}`);
+        }
+        return topic;
+    });
+}
+/**
+ * The policy document an AWS::SNS::TopicPolicy Resource carries.
+ *
+ * A template writes it as an object where SetTopicAttributes takes a JSON
+ * string, so what comes back here is what is serialised on the way in.
+ */
+export function simCfnSnsPolicyDocument(logicalId, properties) {
+    const policyDocument = properties["PolicyDocument"];
+    if (policyDocument === undefined ||
+        policyDocument === null ||
+        typeof policyDocument !== "object" ||
+        Array.isArray(policyDocument)) {
+        throw topicPolicyError(logicalId, "PolicyDocument is required and must be an object");
+    }
+    return policyDocument;
+}
+function topicPolicyError(logicalId, reason) {
+    return simCfnSnsResourceError(snsTopicPolicyResourceType, logicalId, reason);
+}
+//# sourceMappingURL=sim-cfn-sns-topic-policy-properties.js.map

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sns-topic-policy-properties.js","sourceRoot":"","sources":["../../../../../src/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAiB,EACjB,UAAqC;IAErC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,gBAAgB,CACpB,SAAS,EACT,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,gBAAgB,CACpB,SAAS,EACT,iEAAiE,OAAO,KAAK,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,UAAqC;IAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAEpD,IACE,cAAc,KAAK,SAAS;QAC5B,cAAc,KAAK,IAAI;QACvB,OAAO,cAAc,KAAK,QAAQ;QAClC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;QACD,MAAM,gBAAgB,CACpB,SAAS,EACT,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,MAAc;IACzD,OAAO,sBAAsB,CAAC,0BAA0B,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC"}

package/dist/service/sns/command/authorize/sim-sns-authorizer.d.ts

@@ -0,0 +1,58 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
+import type { SimSnsRequestOptions } from "../sim-sns-request-options.js";
+interface SimSnsAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface SimSnsTopicAuthorizationInput {
+    readonly action: string;
+    readonly topicArn: string;
+    /**
+     * The topic itself, when there is one. Its policy is what admits a caller
+     * with no identity policy of its own.
+     */
+    readonly topic?: SimSnsTopic | undefined;
+    readonly options?: SimSnsRequestOptions | undefined;
+}
+/**
+ * Applies simulated IAM authorization to SNS requests.
+ *
+ * A topic ARN has no resource type in it, so the resource an operation
+ * authorizes against is `arn:aws:sns:region:account:topic-name`. A policy
+ * written with a `topic/` in the resource matches nothing here, as it matches
+ * nothing on real AWS.
+ *
+ * The topic's own policy goes into the decision as its resource policy. That is
+ * what admits a caller from another Account or a service principal, since
+ * neither is covered by an identity policy in the Account owning the topic.
+ *
+ * ListTopics is the exception: real SNS gives it no resource type, so it
+ * authorizes against `*` rather than against a topic, and no topic policy
+ * applies to it.
+ *
+ * A denial is reported as SNS's own AuthorizationErrorException rather than the
+ * shared IAM error, because that is the error a real SNS caller would have to
+ * handle.
+ */
+export declare class SimSnsAuthorizer {
+    private readonly iam;
+    private readonly callerIdentifier;
+    constructor(properties: SimSnsAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a topic, named by its ARN.
+     *
+     * The topic need not exist. A topic that is not there contributes no policy,
+     * so a caller with no permission is refused whether or not the topic is
+     * there, and CreateTopic authorizes against the ARN the topic is about to
+     * have.
+     */
+    authorizeTopic(input: SimSnsTopicAuthorizationInput): SimAwsResolvedCaller;
+    /**
+     * Ensure the caller may perform an action that names no particular topic.
+     */
+    authorizeAnyTopic(action: string, options?: SimSnsRequestOptions): SimAwsResolvedCaller;
+    private authorizeResource;
+}
+export {};
+//# sourceMappingURL=sim-sns-authorizer.d.ts.map

package/dist/service/sns/command/authorize/sim-sns-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAE3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAc1E,UAAU,0BAA0B;IAClC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACrD;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgC;IAEjE,YAAY,UAAU,EAAE,0BAA0B,EAEjD;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,6BAA6B,GAAG,oBAAoB,CAOzE;IAED;;OAEG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,oBAAoB,GAC7B,oBAAoB,CAOtB;IAED,OAAO,CAAC,iBAAiB;CAwB1B"}

package/dist/service/sns/command/authorize/sim-sns-authorizer.js

@@ -0,0 +1,83 @@
+import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
+import { SimSnsAuthorizationErrorException } from "../../error/sim-sns.error.js";
+import { simSnsConditionContext } from "./sim-sns-condition-context.js";
+import { simSnsTopicResourcePolicies } from "./sim-sns-topic-resource-policies.js";
+/**
+ * The resource an action with no resource type authorizes against.
+ *
+ * Real SNS gives ListTopics no resource type at all, so IAM evaluates it
+ * against `*` and only a policy whose Resource is `*` allows it. A policy
+ * naming a topic ARN, or every topic ARN in the Account and Region, allows no
+ * listing, here as on AWS.
+ */
+const noResource = "*";
+/**
+ * Applies simulated IAM authorization to SNS requests.
+ *
+ * A topic ARN has no resource type in it, so the resource an operation
+ * authorizes against is `arn:aws:sns:region:account:topic-name`. A policy
+ * written with a `topic/` in the resource matches nothing here, as it matches
+ * nothing on real AWS.
+ *
+ * The topic's own policy goes into the decision as its resource policy. That is
+ * what admits a caller from another Account or a service principal, since
+ * neither is covered by an identity policy in the Account owning the topic.
+ *
+ * ListTopics is the exception: real SNS gives it no resource type, so it
+ * authorizes against `*` rather than against a topic, and no topic policy
+ * applies to it.
+ *
+ * A denial is reported as SNS's own AuthorizationErrorException rather than the
+ * shared IAM error, because that is the error a real SNS caller would have to
+ * handle.
+ */
+export class SimSnsAuthorizer {
+    iam;
+    callerIdentifier = new SimIamCallerIdentifier();
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may perform an action on a topic, named by its ARN.
+     *
+     * The topic need not exist. A topic that is not there contributes no policy,
+     * so a caller with no permission is refused whether or not the topic is
+     * there, and CreateTopic authorizes against the ARN the topic is about to
+     * have.
+     */
+    authorizeTopic(input) {
+        return this.authorizeResource({
+            action: input.action,
+            resource: input.topicArn,
+            resourcePolicies: simSnsTopicResourcePolicies(input.topic),
+            options: input.options,
+        });
+    }
+    /**
+     * Ensure the caller may perform an action that names no particular topic.
+     */
+    authorizeAnyTopic(action, options) {
+        return this.authorizeResource({
+            action,
+            resource: noResource,
+            resourcePolicies: [],
+            options,
+        });
+    }
+    authorizeResource(input) {
+        const decision = this.iam.authorize({
+            action: input.action,
+            resource: input.resource,
+            caller: input.options?.caller,
+            resourcePolicies: input.resourcePolicies,
+            conditionContext: simSnsConditionContext(input.options),
+        });
+        if (decision.isDenied) {
+            const identifier = this.callerIdentifier.format(decision.caller.principal);
+            throw new SimSnsAuthorizationErrorException(`User: ${identifier} is not authorized to perform: ${input.action} ` +
+                `on resource: ${input.resource}`);
+        }
+        return decision.caller;
+    }
+}
+//# sourceMappingURL=sim-sns-authorizer.js.map

package/dist/service/sns/command/authorize/sim-sns-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AAGjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,GAAG,CAAC;AA0BvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAA0B;IAC7B,gBAAgB,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAEjE,YAAY,UAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,KAAoC;QACjD,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,MAAc,EACd,OAA8B;QAE9B,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,gBAAgB,EAAE,EAAE;YACpB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB,CACvB,KAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM;YAC7B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAC7C,QAAQ,CAAC,MAAM,CAAC,SAAS,CAC1B,CAAC;YAEF,MAAM,IAAI,iCAAiC,CACzC,SAAS,UAAU,kCAAkC,KAAK,CAAC,MAAM,GAAG;gBAClE,gBAAgB,KAAK,CAAC,QAAQ,EAAE,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;CACF"}

package/dist/service/sns/command/authorize/sim-sns-condition-context.d.ts

@@ -0,0 +1,13 @@
+import type { SimIamConditionValue } from "../../../iam/policy/sim-iam-policy.js";
+import { type SimSnsRequestOptions } from "../sim-sns-request-options.js";
+/**
+ * The request-time values a topic policy statement's conditions are matched
+ * against.
+ *
+ * A value the request does not carry is left out rather than supplied empty, so
+ * a statement conditioned on it fails to match instead of matching an empty
+ * string. That is the safe direction: a grant written for one Bucket should not
+ * admit a request that says nothing about where it came from.
+ */
+export declare function simSnsConditionContext(options: SimSnsRequestOptions | undefined): Readonly<Record<string, SimIamConditionValue>>;
+//# sourceMappingURL=sim-sns-condition-context.d.ts.map

package/dist/service/sns/command/authorize/sim-sns-condition-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-condition-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-condition-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GACxC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAShD"}

package/dist/service/sns/command/authorize/sim-sns-condition-context.js

@@ -0,0 +1,21 @@
+import { simSnsSourceAccountConditionKey, simSnsSourceArnConditionKey, } from "../sim-sns-request-options.js";
+/**
+ * The request-time values a topic policy statement's conditions are matched
+ * against.
+ *
+ * A value the request does not carry is left out rather than supplied empty, so
+ * a statement conditioned on it fails to match instead of matching an empty
+ * string. That is the safe direction: a grant written for one Bucket should not
+ * admit a request that says nothing about where it came from.
+ */
+export function simSnsConditionContext(options) {
+    return {
+        ...(options?.sourceArn !== undefined && {
+            [simSnsSourceArnConditionKey]: options.sourceArn,
+        }),
+        ...(options?.sourceAccount !== undefined && {
+            [simSnsSourceAccountConditionKey]: options.sourceAccount,
+        }),
+    };
+}
+//# sourceMappingURL=sim-sns-condition-context.js.map

package/dist/service/sns/command/authorize/sim-sns-condition-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-condition-context.js","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-condition-context.ts"],"names":[],"mappings":"AACA,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAE5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAyC;IAEzC,OAAO;QACL,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,IAAI;YACtC,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC,SAAS;SACjD,CAAC;QACF,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,IAAI;YAC1C,CAAC,+BAA+B,CAAC,EAAE,OAAO,CAAC,aAAa;SACzD,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/service/sns/command/authorize/sim-sns-service-publish-authorizer.d.ts

@@ -0,0 +1,41 @@
+import type { SimIamAuthorizationDecision, SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
+interface SimSnsServicePublishAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface SimSnsServicePublishAuthorizationInput {
+    readonly topic: SimSnsTopic;
+    /** The service principal the publishing service calls SNS as. */
+    readonly servicePrincipal: string;
+    /**
+     * What the service is publishing for, such as the S3 Bucket an event came
+     * from.
+     */
+    readonly sourceArn?: string | undefined;
+    /** The Account the publishing service's own resource belongs to. */
+    readonly sourceAccount?: string | undefined;
+}
+/**
+ * Decides whether a simulated AWS service may publish a message to a topic.
+ *
+ * A service principal owns no identity policies anywhere, so the topic's own
+ * policy is the whole decision. The answer is a decision rather than a thrown
+ * error because a service asks this before it has a message to publish: S3
+ * validates the destination when a notification configuration is applied, and
+ * has to report the refusal as part of refusing the configuration.
+ *
+ * A service with a message in hand publishes it through `Publish` as usual,
+ * which authorizes the same way. Nothing is remembered from the earlier
+ * question, so a topic policy changed in between stops the delivery.
+ */
+export declare class SimSnsServicePublishAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(properties: SimSnsServicePublishAuthorizerProperties);
+    /**
+     * Evaluate `sns:Publish` for a service against the topic.
+     */
+    authorize(input: SimSnsServicePublishAuthorizationInput): SimIamAuthorizationDecision;
+}
+export {};
+//# sourceMappingURL=sim-sns-service-publish-authorizer.d.ts.map

package/dist/service/sns/command/authorize/sim-sns-service-publish-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-service-publish-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-service-publish-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAIhE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAE5B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,oEAAoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAiB;IAE/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;OAEG;IACH,SAAS,CACP,KAAK,EAAE,sCAAsC,GAC5C,2BAA2B,CAa7B;CACF"}