"use strict";var _a,_b;Object.defineProperty(exports,"__esModule",{value:!0}),exports.CompositeDependable=exports.Grant=void 0;const jsiiDeprecationWarnings=require("../../.warnings.jsii.js"),JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti"),cdk=require("../../core"),constructs_1=require("constructs"),policy_statement_1=require("./policy-statement");class Grant{constructor(props){this.options=props.options,this.principalStatement=props.principalStatement,this.resourceStatement=props.resourceStatement,constructs_1.Dependable.implement(this,{get dependencyRoots(){return props.policyDependable?constructs_1.Dependable.of(props.policyDependable).dependencyRoots:[]}})}static addToPrincipalOrResource(options){try{jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_GrantWithResourceOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addToPrincipalOrResource),error}const result=Grant.addToPrincipal({...options,scope:options.resource}),resourceAndPrincipalAccountComparison=options.grantee.grantPrincipal.principalAccount?cdk.Token.compareStrings(options.resource.env.account,options.grantee.grantPrincipal.principalAccount):void 0,equalOrBothUnresolved=resourceAndPrincipalAccountComparison===cdk.TokenComparison.SAME||resourceAndPrincipalAccountComparison==cdk.TokenComparison.BOTH_UNRESOLVED,sameAccount=resourceAndPrincipalAccountComparison?equalOrBothUnresolved:!1;if(result.success&&sameAccount)return result;const statement=new policy_statement_1.PolicyStatement({actions:options.actions,resources:options.resourceSelfArns||options.resourceArns,principals:[options.grantee.grantPrincipal]}),resourceResult=options.resource.addToResourcePolicy(statement);return new Grant({resourceStatement:statement,options,policyDependable:resourceResult.statementAdded?resourceResult.policyDependable??options.resource:void 0})}static addToPrincipal(options){try{jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_GrantOnPrincipalOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addToPrincipal),error}const statement=new policy_statement_1.PolicyStatement({actions:options.actions,resources:options.resourceArns}),addedToPrincipal=options.grantee.grantPrincipal.addToPrincipalPolicy(statement);if(!addedToPrincipal.statementAdded)return new Grant({principalStatement:void 0,options});if(!addedToPrincipal.policyDependable)throw new Error("Contract violation: when Principal returns statementAdded=true, it should return a dependable");return new Grant({principalStatement:statement,options,policyDependable:addedToPrincipal.policyDependable})}static addToPrincipalAndResource(options){try{jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_GrantOnPrincipalAndResourceOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addToPrincipalAndResource),error}const result=Grant.addToPrincipal({...options,scope:options.resource}),statement=new policy_statement_1.PolicyStatement({actions:options.actions,resources:options.resourceSelfArns||options.resourceArns,principals:[options.resourcePolicyPrincipal||options.grantee.grantPrincipal]}),resourceResult=options.resource.addToResourcePolicy(statement),resourceDependable=resourceResult.statementAdded?resourceResult.policyDependable??options.resource:void 0;return new Grant({principalStatement:statement,resourceStatement:result.resourceStatement,options,policyDependable:resourceDependable?new CompositeDependable(result,resourceDependable):result})}static drop(grantee,_intent){try{jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_IGrantable(grantee)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.drop),error}return new Grant({options:{grantee,actions:[],resourceArns:[]}})}get success(){return this.principalStatement!==void 0||this.resourceStatement!==void 0}assertSuccess(){if(!this.success)throw new Error(`${describeGrant(this.options)} could not be added on either identity or resource policy.`)}applyBefore(...constructs){for(const construct of constructs)construct.node.addDependency(this)}}exports.Grant=Grant,_a=JSII_RTTI_SYMBOL_1,Grant[_a]={fqn:"aws-cdk-lib.aws_iam.Grant",version:"2.46.0"};function describeGrant(options){return`Permissions for '${options.grantee}' to call '${options.actions}' on '${options.resourceArns}'`}class CompositeDependable{constructor(...dependables){constructs_1.Dependable.implement(this,{get dependencyRoots(){return Array.prototype.concat.apply([],dependables.map(d=>constructs_1.Dependable.of(d).dependencyRoots))}})}}exports.CompositeDependable=CompositeDependable,_b=JSII_RTTI_SYMBOL_1,CompositeDependable[_b]={fqn:"aws-cdk-lib.aws_iam.CompositeDependable",version:"2.46.0"};
//# sourceMappingURL=grant.js.map
