"use strict";var _a;Object.defineProperty(exports,"__esModule",{value:!0}),exports.Policy=void 0;const jsiiDeprecationWarnings=require("../../.warnings.jsii.js"),JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti"),core_1=require("../../core"),iam_generated_1=require("./iam.generated"),policy_document_1=require("./policy-document"),util_1=require("./util");class Policy extends core_1.Resource{constructor(scope,id,props={}){var _b;super(scope,id,{physicalName:props.policyName||core_1.Lazy.string({produce:()=>util_1.generatePolicyName(scope,resource.logicalId)})});this.document=new policy_document_1.PolicyDocument,this.roles=new Array,this.users=new Array,this.groups=new Array,this.referenceTaken=!1,jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_PolicyProps(props);const self=this;class CfnPolicyConditional extends iam_generated_1.CfnPolicy{shouldSynthesize(){return self.force||self.referenceTaken||!self.document.isEmpty&&self.isAttached}}props.document&&(this.document=props.document);const resource=new CfnPolicyConditional(this,"Resource",{policyDocument:this.document,policyName:this.physicalName,roles:util_1.undefinedIfEmpty(()=>this.roles.map(r=>r.roleName)),users:util_1.undefinedIfEmpty(()=>this.users.map(u=>u.userName)),groups:util_1.undefinedIfEmpty(()=>this.groups.map(g=>g.groupName))});this._policyName=this.physicalName,this.force=(_b=props.force)!==null&&_b!==void 0?_b:!1,props.users&&props.users.forEach(u=>this.attachToUser(u)),props.groups&&props.groups.forEach(g=>this.attachToGroup(g)),props.roles&&props.roles.forEach(r=>this.attachToRole(r)),props.statements&&props.statements.forEach(p=>this.addStatements(p)),this.node.addValidation({validate:()=>this.validatePolicy()})}static fromPolicyName(scope,id,policyName){class Import extends core_1.Resource{constructor(){super(...arguments);this.policyName=policyName}}return new Import(scope,id)}addStatements(...statement){jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_PolicyStatement(statement),this.document.addStatements(...statement)}attachToUser(user){jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_IUser(user),!this.users.find(u=>u===user)&&(this.users.push(user),user.attachInlinePolicy(this))}attachToRole(role){jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_IRole(role),!this.roles.find(r=>r===role)&&(this.roles.push(role),role.attachInlinePolicy(this))}attachToGroup(group){jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_IGroup(group),!this.groups.find(g=>g===group)&&(this.groups.push(group),group.attachInlinePolicy(this))}get policyName(){return this.referenceTaken=!0,this._policyName}validatePolicy(){const result=new Array;return this.document.isEmpty&&(this.force&&result.push("Policy created with force=true is empty. You must add statements to the policy"),!this.force&&this.referenceTaken&&result.push("This Policy has been referenced by a resource, so it must contain at least one statement.")),this.isAttached||(this.force&&result.push("Policy created with force=true must be attached to at least one principal: user, group or role"),!this.force&&this.referenceTaken&&result.push("This Policy has been referenced by a resource, so it must be attached to at least one user, group or role.")),result.push(...this.document.validateForIdentityPolicy()),result}get isAttached(){return this.groups.length+this.users.length+this.roles.length>0}}exports.Policy=Policy,_a=JSII_RTTI_SYMBOL_1,Policy[_a]={fqn:"aws-cdk-lib.aws_iam.Policy",version:"2.13.0"};
//# sourceMappingURL=policy.js.map
