Function validatePolicy

packages/cli/src/commands/lambda/policies.ts:311–379

(policyPath: string)

 *     not by our matcher. We end-anchor only.
 */
export function validatePolicy(policyPath: string): ValidateResult {
  const raw = readFileSync(policyPath, "utf-8");
  const parsed = JSON.parse(raw) as { Statement?: unknown };
  const statements: Array<{
    Effect?: string;
    Action?: unknown;
    NotAction?: unknown;
    NotResource?: unknown;
  }> = Array.isArray(parsed.Statement)
    ? (parsed.Statement as {
        Effect?: string;
        Action?: unknown;
        NotAction?: unknown;
        NotResource?: unknown;
      }[])
    : parsed.Statement
      ? [
          parsed.Statement as {
            Effect?: string;
            Action?: unknown;
            NotAction?: unknown;
            NotResource?: unknown;
          },
        ]
      : [];

  const grantedPatterns: string[] = [];
  const warnings: string[] = [];
  for (const stmt of statements) {
    if (stmt.Effect !== "Allow") continue;
    if (stmt.NotAction !== undefined) {
      warnings.push(
        "Allow statement uses NotAction; the validator only checks positive Action grants, so this statement is being ignored. Convert to an explicit Action list to validate it.",
      );
      continue;
    }
    if (stmt.NotResource !== undefined) {
      warnings.push(
        "Allow statement uses NotResource; resource-scoping is not modelled by this validator. Treating the statement as fully granted on its Action set.",
      );
    }
    const actions = stmt.Action;
    if (typeof actions === "string") {
      grantedPatterns.push(actions);
    } else if (Array.isArray(actions)) {
      for (const a of actions) if (typeof a === "string") grantedPatterns.push(a);
    }
  }

  for (const pattern of grantedPatterns) {
    if (hasMidStringWildcard(pattern)) {
      warnings.push(
        `Action pattern ${JSON.stringify(pattern)} contains a mid-string wildcard the validator can't expand; only end-anchored wildcards (\`*\`, \`service:*\`, \`prefix*\`) are honoured.`,
      );
    }
  }

  const required = allRequiredActions();