@ashishpandeyone/cdk-lambda-web-function 0.1.4 → 0.1.6

package/lib/web-function-origin.js

@@ -0,0 +1,201 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebFunctionOrigin = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const cloudfront = __importStar(require("aws-cdk-lib/aws-cloudfront"));
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const enums_1 = require("./enums");
+/**
+ * Regions that are not enabled by default. CloudFront can't sign a request that a MULTI_REGION endpoint routes
+ * to one of them, so the origin returns 403 (CloudFront Developer Guide, Lambda Web Function origins, 2026-10).
+ */
+const OPT_IN_REGIONS = [
+    'af-south-1', 'ap-east-1', 'ap-east-2', 'ap-south-2', 'ap-southeast-3', 'ap-southeast-4', 'ap-southeast-5', 'ap-southeast-6',
+    'ap-southeast-7', 'ca-west-1', 'eu-central-2', 'eu-south-1', 'eu-south-2', 'il-central-1', 'me-central-1', 'me-south-1', 'mx-central-1',
+];
+/**
+ * A CloudFront origin for a Web Function endpoint.
+ *
+ * Use `WebFunctionOrigin.withOriginAccessControl(endpoint)` for an `AWS_IAM` endpoint: CloudFront signs every request,
+ * and only your distribution may call the endpoint. `new WebFunctionOrigin(endpoint)` is for a public (`NONE`) endpoint.
+ */
+class WebFunctionOrigin extends cloudfront.OriginBase {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin", version: "0.1.6" };
+    /**
+     * An origin for an `AWS_IAM` endpoint, with origin access control: CloudFront signs every request to the endpoint
+     * (`always-amz-auth`, which keeps the viewer's `Authorization` header for your application), and the function's
+     * resource policy allows `cloudfront.amazonaws.com` to call this endpoint on behalf of this distribution only.
+     *
+     * The distribution must be in the function's stack.
+     */
+    static withOriginAccessControl(endpoint, props = {}) {
+        if (endpoint.authType !== enums_1.WebFunctionAuthType.AWS_IAM) {
+            throw new Error(`${endpoint.node.path}: origin access control needs an AWS_IAM endpoint (this one is ${endpoint.authType}, which Lambda doesn't authenticate); use new WebFunctionOrigin(endpoint)`);
+        }
+        if (endpoint.endpointType === enums_1.WebFunctionEndpointType.MULTI_REGION) {
+            const optIn = endpoint.regions.filter((r) => OPT_IN_REGIONS.includes(r));
+            if (optIn.length > 0) {
+                throw new Error(`${endpoint.node.path}: CloudFront can't sign requests that a MULTI_REGION endpoint routes to opt-in regions (${optIn.join(', ')}); use a PER_REGION endpoint and one origin per region`);
+            }
+        }
+        return new WebFunctionOriginWithOac(endpoint, props);
+    }
+    props;
+    constructor(endpoint, props = {}) {
+        if (endpoint.authType === enums_1.WebFunctionAuthType.AWS_IAM) {
+            throw new Error(`${endpoint.node.path}: CloudFront can only call an AWS_IAM endpoint with origin access control; use WebFunctionOrigin.withOriginAccessControl(endpoint)`);
+        }
+        super(originDomainName(endpoint, props.region), props);
+        validateTimeouts(endpoint, props);
+        this.validateResponseCompletionTimeoutWithReadTimeout(props.responseCompletionTimeout, props.readTimeout);
+        this.props = props;
+    }
+    renderCustomOriginConfig() {
+        return customOriginConfig(this.props);
+    }
+}
+exports.WebFunctionOrigin = WebFunctionOrigin;
+class WebFunctionOriginWithOac extends cloudfront.OriginBase {
+    endpoint;
+    props;
+    signingProtocol;
+    constructor(endpoint, props) {
+        super(originDomainName(endpoint, props.region), props);
+        this.endpoint = endpoint;
+        this.props = props;
+        validateTimeouts(endpoint, props);
+        this.validateResponseCompletionTimeoutWithReadTimeout(props.responseCompletionTimeout, props.readTimeout);
+        // The global domain routes to any of the endpoint's regions, so CloudFront signs for all of them.
+        this.signingProtocol = endpoint.endpointType === enums_1.WebFunctionEndpointType.MULTI_REGION ? 'sigv4a' : 'sigv4';
+        if (props.originAccessControl)
+            assertOriginAccessControl(endpoint, props.originAccessControl, this.signingProtocol);
+    }
+    bind(scope, options) {
+        const config = super.bind(scope, options);
+        const stack = aws_cdk_lib_1.Stack.of(scope);
+        if (stack !== aws_cdk_lib_1.Stack.of(this.endpoint)) {
+            // The resource policy names the distribution, and the distribution names the endpoint: a reference cycle.
+            throw new Error(`${scope.node.path}: a distribution with a WebFunctionOrigin must be in the function's stack (${aws_cdk_lib_1.Stack.of(this.endpoint).stackName})`);
+        }
+        if (options.distributionId === undefined) {
+            throw new Error(`${scope.node.path}: a WebFunctionOrigin with origin access control must be used by a cloudfront.Distribution (its ID scopes the resource policy)`);
+        }
+        const oac = this.props.originAccessControl ?? this.sharedOriginAccessControl(stack);
+        const result = this.endpoint.webFunction.addToResourcePolicy(new iam.PolicyStatement({
+            principals: [new iam.ServicePrincipal('cloudfront.amazonaws.com')],
+            actions: ['lambda:InvokeWebFunctionEndpoint'],
+            resources: [this.endpoint.endpointArn],
+            conditions: {
+                StringEquals: {
+                    'aws:SourceArn': stack.formatArn({ service: 'cloudfront', region: '', resource: 'distribution', resourceName: options.distributionId }),
+                },
+            },
+        }));
+        if (!result.statementAdded) {
+            throw new Error(`${scope.node.path}: could not add CloudFront to the resource policy of ${this.endpoint.webFunction.node.path}`);
+        }
+        return { ...config, originProperty: { ...config.originProperty, originAccessControlId: oac.originAccessControlRef.originAccessControlId } };
+    }
+    renderCustomOriginConfig() {
+        return customOriginConfig(this.props);
+    }
+    /** One origin access control per stack and signing protocol, shared by the stack's Web Function origins. */
+    sharedOriginAccessControl(scope) {
+        const id = `WebFunctionOriginAccessControl${this.signingProtocol === 'sigv4a' ? 'SigV4a' : 'SigV4'}`;
+        const existing = scope.node.tryFindChild(id);
+        if (existing)
+            return existing;
+        const oac = new cloudfront.CfnOriginAccessControl(scope, id, {
+            originAccessControlConfig: {
+                // Unique in the account, like the names CDK generates for its own origin access controls.
+                name: aws_cdk_lib_1.Lazy.string({ produce: () => aws_cdk_lib_1.Names.uniqueResourceName(oac, { maxLength: 64 }) }),
+                description: `Lambda Web Function origins (${this.signingProtocol})`,
+                // The CDK enums have neither value yet. Lambda Web Function origins accept only always-amz-auth.
+                originAccessControlOriginType: 'lambda',
+                signingBehavior: 'always-amz-auth',
+                signingProtocol: this.signingProtocol,
+            },
+        });
+        return oac;
+    }
+}
+/**
+ * Checks a given origin access control when its configuration is known (one created in this app, not imported):
+ * CloudFront rejects other settings for a Web Function origin only when the distribution deploys.
+ */
+function assertOriginAccessControl(endpoint, oac, protocol) {
+    const cfn = oac instanceof cloudfront.CfnOriginAccessControl
+        ? oac
+        : oac.node.children.find((c) => c instanceof cloudfront.CfnOriginAccessControl);
+    if (cfn === undefined)
+        return;
+    const config = aws_cdk_lib_1.Stack.of(cfn).resolve(cfn.originAccessControlConfig);
+    const expected = { OriginAccessControlOriginType: 'lambda', SigningBehavior: 'always-amz-auth', SigningProtocol: protocol };
+    const wrong = Object.entries(expected).filter(([key, value]) => {
+        const actual = config[key] ?? config[key.charAt(0).toLowerCase() + key.slice(1)];
+        return typeof actual === 'string' && actual !== value;
+    });
+    if (wrong.length > 0) {
+        throw new Error(`${endpoint.node.path}: the origin access control ${oac.node.path} must have ${wrong.map(([k, v]) => `${k} '${v}'`).join(', ')} for this endpoint`);
+    }
+}
+function originDomainName(endpoint, region) {
+    if (region === undefined)
+        return endpoint.domainName;
+    if (endpoint.endpointType !== enums_1.WebFunctionEndpointType.PER_REGION) {
+        throw new Error(`${endpoint.node.path}: region is only for PER_REGION endpoints (this one is ${endpoint.endpointType})`);
+    }
+    return endpoint.regionalDomainName(region);
+}
+function validateTimeouts(endpoint, props) {
+    for (const [name, value] of [['readTimeout', props.readTimeout], ['keepaliveTimeout', props.keepaliveTimeout]]) {
+        const seconds = value?.toSeconds();
+        if (seconds !== undefined && !aws_cdk_lib_1.Token.isUnresolved(seconds) && (!Number.isInteger(seconds) || seconds < 1)) {
+            throw new Error(`${endpoint.node.path}: ${name} must be a whole number of seconds, at least 1, got ${seconds}`);
+        }
+    }
+}
+function customOriginConfig(props) {
+    return {
+        originProtocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+        originSslProtocols: [cloudfront.OriginSslPolicy.TLS_V1_2],
+        originReadTimeout: props.readTimeout?.toSeconds(),
+        originKeepaliveTimeout: props.keepaliveTimeout?.toSeconds(),
+        ipAddressType: props.ipAddressType,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid2ViLWZ1bmN0aW9uLW9yaWdpbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy93ZWItZnVuY3Rpb24tb3JpZ2luLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSw2Q0FBa0U7QUFDbEUsdUVBQXlEO0FBQ3pELHlEQUEyQztBQUUzQyxtQ0FBdUU7QUFHdkU7OztHQUdHO0FBQ0gsTUFBTSxjQUFjLEdBQUc7SUFDckIsWUFBWSxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGdCQUFnQixFQUFFLGdCQUFnQixFQUFFLGdCQUFnQjtJQUM1SCxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLFlBQVksRUFBRSxZQUFZLEVBQUUsY0FBYyxFQUFFLGNBQWMsRUFBRSxZQUFZLEVBQUUsY0FBYztDQUN4SSxDQUFDO0FBbURGOzs7OztHQUtHO0FBQ0gsTUFBYSxpQkFBa0IsU0FBUSxVQUFVLENBQUMsVUFBVTs7SUFDMUQ7Ozs7OztPQU1HO0lBQ0ksTUFBTSxDQUFDLHVCQUF1QixDQUFDLFFBQTZCLEVBQUUsUUFBdUMsRUFBRTtRQUM1RyxJQUFJLFFBQVEsQ0FBQyxRQUFRLEtBQUssMkJBQW1CLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEQsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxrRUFBa0UsUUFBUSxDQUFDLFFBQVEsMkVBQTJFLENBQUMsQ0FBQztRQUN2TSxDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsWUFBWSxLQUFLLCtCQUF1QixDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ25FLE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDekUsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUNyQixNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLDJGQUEyRixLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO1lBQzVNLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxJQUFJLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBRWdCLEtBQUssQ0FBeUI7SUFFL0MsWUFBWSxRQUE2QixFQUFFLFFBQWdDLEVBQUU7UUFDM0UsSUFBSSxRQUFRLENBQUMsUUFBUSxLQUFLLDJCQUFtQixDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3RELE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksb0lBQW9JLENBQUMsQ0FBQztRQUM3SyxDQUFDO1FBQ0QsS0FBSyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDdkQsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2xDLElBQUksQ0FBQyxnREFBZ0QsQ0FBQyxLQUFLLENBQUMseUJBQXlCLEVBQUUsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzFHLElBQUksQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDO0lBQ3JCLENBQUM7SUFFUyx3QkFBd0I7UUFDaEMsT0FBTyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEMsQ0FBQzs7QUFuQ0gsOENBb0NDO0FBRUQsTUFBTSx3QkFBeUIsU0FBUSxVQUFVLENBQUMsVUFBVTtJQUc3QjtJQUFnRDtJQUY1RCxlQUFlLENBQXFCO0lBRXJELFlBQTZCLFFBQTZCLEVBQW1CLEtBQW9DO1FBQy9HLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBRDVCLGFBQVEsR0FBUixRQUFRLENBQXFCO1FBQW1CLFVBQUssR0FBTCxLQUFLLENBQStCO1FBRS9HLGdCQUFnQixDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNsQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsS0FBSyxDQUFDLHlCQUF5QixFQUFFLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUMxRyxrR0FBa0c7UUFDbEcsSUFBSSxDQUFDLGVBQWUsR0FBRyxRQUFRLENBQUMsWUFBWSxLQUFLLCtCQUF1QixDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDM0csSUFBSSxLQUFLLENBQUMsbUJBQW1CO1lBQUUseUJBQXlCLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxtQkFBbUIsRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDdEgsQ0FBQztJQUVNLElBQUksQ0FBQyxLQUFnQixFQUFFLE9BQXFDO1FBQ2pFLE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQzFDLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlCLElBQUksS0FBSyxLQUFLLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ3RDLDBHQUEwRztZQUMxRyxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLDhFQUE4RSxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQztRQUN4SixDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3pDLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksZ0lBQWdJLENBQUMsQ0FBQztRQUN0SyxDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxtQkFBbUIsSUFBSSxJQUFJLENBQUMseUJBQXlCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFcEYsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1lBQ25GLFVBQVUsRUFBRSxDQUFDLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLDBCQUEwQixDQUFDLENBQUM7WUFDbEUsT0FBTyxFQUFFLENBQUMsa0NBQWtDLENBQUM7WUFDN0MsU0FBUyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7WUFDdEMsVUFBVSxFQUFFO2dCQUNWLFlBQVksRUFBRTtvQkFDWixlQUFlLEVBQUUsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsY0FBYyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7aUJBQ3hJO2FBQ0Y7U0FDRixDQUFDLENBQUMsQ0FBQztRQUNKLElBQUksQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDM0IsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSx3REFBd0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDbkksQ0FBQztRQUVELE9BQU8sRUFBRSxHQUFHLE1BQU0sRUFBRSxjQUFjLEVBQUUsRUFBRSxHQUFHLE1BQU0sQ0FBQyxjQUFlLEVBQUUscUJBQXFCLEVBQUUsR0FBRyxDQUFDLHNCQUFzQixDQUFDLHFCQUFxQixFQUFFLEVBQUUsQ0FBQztJQUMvSSxDQUFDO0lBRVMsd0JBQXdCO1FBQ2hDLE9BQU8sa0JBQWtCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRCw0R0FBNEc7SUFDcEcseUJBQXlCLENBQUMsS0FBWTtRQUM1QyxNQUFNLEVBQUUsR0FBRyxpQ0FBaUMsSUFBSSxDQUFDLGVBQWUsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDckcsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFrRCxDQUFDO1FBQzlGLElBQUksUUFBUTtZQUFFLE9BQU8sUUFBUSxDQUFDO1FBQzlCLE1BQU0sR0FBRyxHQUFzQyxJQUFJLFVBQVUsQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQzlGLHlCQUF5QixFQUFFO2dCQUN6QiwwRkFBMEY7Z0JBQzFGLElBQUksRUFBRSxrQkFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxtQkFBSyxDQUFDLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RGLFdBQVcsRUFBRSxnQ0FBZ0MsSUFBSSxDQUFDLGVBQWUsR0FBRztnQkFDcEUsaUdBQWlHO2dCQUNqRyw2QkFBNkIsRUFBRSxRQUFRO2dCQUN2QyxlQUFlLEVBQUUsaUJBQWlCO2dCQUNsQyxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWU7YUFDdEM7U0FDRixDQUFDLENBQUM7UUFDSCxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7Q0FDRjtBQUVEOzs7R0FHRztBQUNILFNBQVMseUJBQXlCLENBQUMsUUFBNkIsRUFBRSxHQUF1QyxFQUFFLFFBQWdCO0lBQ3pILE1BQU0sR0FBRyxHQUFHLEdBQUcsWUFBWSxVQUFVLENBQUMsc0JBQXNCO1FBQzFELENBQUMsQ0FBQyxHQUFHO1FBQ0wsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBMEMsRUFBRSxDQUFDLENBQUMsWUFBWSxVQUFVLENBQUMsc0JBQXNCLENBQUMsQ0FBQztJQUMxSCxJQUFJLEdBQUcsS0FBSyxTQUFTO1FBQUUsT0FBTztJQUM5QixNQUFNLE1BQU0sR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHlCQUF5QixDQUE0QixDQUFDO0lBQy9GLE1BQU0sUUFBUSxHQUEyQixFQUFFLDZCQUE2QixFQUFFLFFBQVEsRUFBRSxlQUFlLEVBQUUsaUJBQWlCLEVBQUUsZUFBZSxFQUFFLFFBQVEsRUFBRSxDQUFDO0lBQ3BKLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRTtRQUM3RCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2pGLE9BQU8sT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLE1BQU0sS0FBSyxLQUFLLENBQUM7SUFDeEQsQ0FBQyxDQUFDLENBQUM7SUFDSCxJQUFJLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSwrQkFBK0IsR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLGNBQWMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsQ0FBQztJQUN0SyxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsUUFBNkIsRUFBRSxNQUFlO0lBQ3RFLElBQUksTUFBTSxLQUFLLFNBQVM7UUFBRSxPQUFPLFFBQVEsQ0FBQyxVQUFVLENBQUM7SUFDckQsSUFBSSxRQUFRLENBQUMsWUFBWSxLQUFLLCtCQUF1QixDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksMERBQTBELFFBQVEsQ0FBQyxZQUFZLEdBQUcsQ0FBQyxDQUFDO0lBQzNILENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUM3QyxDQUFDO0FBRUQsU0FBUyxnQkFBZ0IsQ0FBQyxRQUE2QixFQUFFLEtBQTZCO0lBQ3BGLEtBQUssTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFVLEVBQUUsQ0FBQztRQUN4SCxNQUFNLE9BQU8sR0FBRyxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUM7UUFDbkMsSUFBSSxPQUFPLEtBQUssU0FBUyxJQUFJLENBQUMsbUJBQUssQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDekcsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLElBQUksdURBQXVELE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDbEgsQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxrQkFBa0IsQ0FBQyxLQUE2QjtJQUN2RCxPQUFPO1FBQ0wsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLG9CQUFvQixDQUFDLFVBQVU7UUFDaEUsa0JBQWtCLEVBQUUsQ0FBQyxVQUFVLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQztRQUN6RCxpQkFBaUIsRUFBRSxLQUFLLENBQUMsV0FBVyxFQUFFLFNBQVMsRUFBRTtRQUNqRCxzQkFBc0IsRUFBRSxLQUFLLENBQUMsZ0JBQWdCLEVBQUUsU0FBUyxFQUFFO1FBQzNELGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYTtLQUNuQyxDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IER1cmF0aW9uLCBMYXp5LCBOYW1lcywgU3RhY2ssIFRva2VuIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgY2xvdWRmcm9udCBmcm9tICdhd3MtY2RrLWxpYi9hd3MtY2xvdWRmcm9udCc7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgdHlwZSB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgV2ViRnVuY3Rpb25BdXRoVHlwZSwgV2ViRnVuY3Rpb25FbmRwb2ludFR5cGUgfSBmcm9tICcuL2VudW1zJztcbmltcG9ydCB0eXBlIHsgV2ViRnVuY3Rpb25FbmRwb2ludCB9IGZyb20gJy4vd2ViLWZ1bmN0aW9uLWVuZHBvaW50JztcblxuLyoqXG4gKiBSZWdpb25zIHRoYXQgYXJlIG5vdCBlbmFibGVkIGJ5IGRlZmF1bHQuIENsb3VkRnJvbnQgY2FuJ3Qgc2lnbiBhIHJlcXVlc3QgdGhhdCBhIE1VTFRJX1JFR0lPTiBlbmRwb2ludCByb3V0ZXNcbiAqIHRvIG9uZSBvZiB0aGVtLCBzbyB0aGUgb3JpZ2luIHJldHVybnMgNDAzIChDbG91ZEZyb250IERldmVsb3BlciBHdWlkZSwgTGFtYmRhIFdlYiBGdW5jdGlvbiBvcmlnaW5zLCAyMDI2LTEwKS5cbiAqL1xuY29uc3QgT1BUX0lOX1JFR0lPTlMgPSBbXG4gICdhZi1zb3V0aC0xJywgJ2FwLWVhc3QtMScsICdhcC1lYXN0LTInLCAnYXAtc291dGgtMicsICdhcC1zb3V0aGVhc3QtMycsICdhcC1zb3V0aGVhc3QtNCcsICdhcC1zb3V0aGVhc3QtNScsICdhcC1zb3V0aGVhc3QtNicsXG4gICdhcC1zb3V0aGVhc3QtNycsICdjYS13ZXN0LTEnLCAnZXUtY2VudHJhbC0yJywgJ2V1LXNvdXRoLTEnLCAnZXUtc291dGgtMicsICdpbC1jZW50cmFsLTEnLCAnbWUtY2VudHJhbC0xJywgJ21lLXNvdXRoLTEnLCAnbXgtY2VudHJhbC0xJyxcbl07XG5cbi8qKlxuICogUHJvcGVydGllcyBmb3IgYSBXZWIgRnVuY3Rpb24gZW5kcG9pbnQgb3JpZ2luLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFdlYkZ1bmN0aW9uT3JpZ2luUHJvcHMgZXh0ZW5kcyBjbG91ZGZyb250Lk9yaWdpblByb3BzIHtcbiAgLyoqXG4gICAqIEZvciBhIGBQRVJfUkVHSU9OYCBlbmRwb2ludDogdGhlIHJlZ2lvbiB3aG9zZSBVUkwgQ2xvdWRGcm9udCBjYWxscy4gT25seSBvbmUgcmVnaW9uIHBlciBvcmlnaW47IHVzZSBhbiBvcmlnaW5cbiAgICogZ3JvdXAgb3Igb25lIG9yaWdpbiBwZXIgYmVoYXZpb3IgZm9yIG1vcmUuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gdGhlIGVuZHBvaW50J3MgaG9tZSByZWdpb25cbiAgICovXG4gIHJlYWRvbmx5IHJlZ2lvbj86IHN0cmluZztcblxuICAvKipcbiAgICogSG93IGxvbmcgQ2xvdWRGcm9udCB3YWl0cyBmb3IgYSByZXNwb25zZSBmcm9tIHRoZSBvcmlnaW4uIEFib3ZlIDEyMCBzZWNvbmRzIG5lZWRzIGEgQ2xvdWRGcm9udCBxdW90YSBpbmNyZWFzZS5cbiAgICpcbiAgICogQGRlZmF1bHQgRHVyYXRpb24uc2Vjb25kcygzMClcbiAgICovXG4gIHJlYWRvbmx5IHJlYWRUaW1lb3V0PzogRHVyYXRpb247XG5cbiAgLyoqXG4gICAqIEhvdyBsb25nIENsb3VkRnJvbnQga2VlcHMgaXRzIGNvbm5lY3Rpb24gdG8gdGhlIG9yaWdpbiBvcGVuLlxuICAgKlxuICAgKiBAZGVmYXVsdCBEdXJhdGlvbi5zZWNvbmRzKDUpXG4gICAqL1xuICByZWFkb25seSBrZWVwYWxpdmVUaW1lb3V0PzogRHVyYXRpb247XG5cbiAgLyoqXG4gICAqIFdoaWNoIElQIHByb3RvY29sIENsb3VkRnJvbnQgdXNlcyB0byBjb25uZWN0IHRvIHRoZSBvcmlnaW4uXG4gICAqXG4gICAqIEBkZWZhdWx0IE9yaWdpbklwQWRkcmVzc1R5cGUuSVBWNFxuICAgKi9cbiAgcmVhZG9ubHkgaXBBZGRyZXNzVHlwZT86IGNsb3VkZnJvbnQuT3JpZ2luSXBBZGRyZXNzVHlwZTtcbn1cblxuLyoqXG4gKiBQcm9wZXJ0aWVzIGZvciBhIFdlYiBGdW5jdGlvbiBlbmRwb2ludCBvcmlnaW4gd2l0aCBvcmlnaW4gYWNjZXNzIGNvbnRyb2wuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgV2ViRnVuY3Rpb25PcmlnaW5XaXRoT2FjUHJvcHMgZXh0ZW5kcyBXZWJGdW5jdGlvbk9yaWdpblByb3BzIHtcbiAgLyoqXG4gICAqIFRoZSBvcmlnaW4gYWNjZXNzIGNvbnRyb2wuIEl0IG11c3QgaGF2ZSBvcmlnaW4gdHlwZSBgbGFtYmRhYCwgc2lnbmluZyBiZWhhdmlvciBgYWx3YXlzLWFtei1hdXRoYCwgYW5kIHNpZ25pbmdcbiAgICogcHJvdG9jb2wgYHNpZ3Y0YCAoYSByZWdpb25hbCBlbmRwb2ludCkgb3IgYHNpZ3Y0YWAgKGEgYE1VTFRJX1JFR0lPTmAgZW5kcG9pbnQncyBnbG9iYWwgZG9tYWluKS4gQ2hlY2tlZCBhdFxuICAgKiBzeW50aGVzaXMgd2hlbiBpdCdzIGRlZmluZWQgaW4gdGhpcyBhcHAgKENESydzIGBGdW5jdGlvblVybE9yaWdpbkFjY2Vzc0NvbnRyb2xgIHNpZ25zIHdpdGggYGFsd2F5c2AsIHdoaWNoXG4gICAqIENsb3VkRnJvbnQgcmVqZWN0cyBmb3IgV2ViIEZ1bmN0aW9uIG9yaWdpbnMpLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG9uZSBpcyBjcmVhdGVkIHBlciBzdGFjayBhbmQgc2lnbmluZyBwcm90b2NvbFxuICAgKi9cbiAgcmVhZG9ubHkgb3JpZ2luQWNjZXNzQ29udHJvbD86IGNsb3VkZnJvbnQuSU9yaWdpbkFjY2Vzc0NvbnRyb2xSZWY7XG59XG5cbi8qKlxuICogQSBDbG91ZEZyb250IG9yaWdpbiBmb3IgYSBXZWIgRnVuY3Rpb24gZW5kcG9pbnQuXG4gKlxuICogVXNlIGBXZWJGdW5jdGlvbk9yaWdpbi53aXRoT3JpZ2luQWNjZXNzQ29udHJvbChlbmRwb2ludClgIGZvciBhbiBgQVdTX0lBTWAgZW5kcG9pbnQ6IENsb3VkRnJvbnQgc2lnbnMgZXZlcnkgcmVxdWVzdCxcbiAqIGFuZCBvbmx5IHlvdXIgZGlzdHJpYnV0aW9uIG1heSBjYWxsIHRoZSBlbmRwb2ludC4gYG5ldyBXZWJGdW5jdGlvbk9yaWdpbihlbmRwb2ludClgIGlzIGZvciBhIHB1YmxpYyAoYE5PTkVgKSBlbmRwb2ludC5cbiAqL1xuZXhwb3J0IGNsYXNzIFdlYkZ1bmN0aW9uT3JpZ2luIGV4dGVuZHMgY2xvdWRmcm9udC5PcmlnaW5CYXNlIHtcbiAgLyoqXG4gICAqIEFuIG9yaWdpbiBmb3IgYW4gYEFXU19JQU1gIGVuZHBvaW50LCB3aXRoIG9yaWdpbiBhY2Nlc3MgY29udHJvbDogQ2xvdWRGcm9udCBzaWducyBldmVyeSByZXF1ZXN0IHRvIHRoZSBlbmRwb2ludFxuICAgKiAoYGFsd2F5cy1hbXotYXV0aGAsIHdoaWNoIGtlZXBzIHRoZSB2aWV3ZXIncyBgQXV0aG9yaXphdGlvbmAgaGVhZGVyIGZvciB5b3VyIGFwcGxpY2F0aW9uKSwgYW5kIHRoZSBmdW5jdGlvbidzXG4gICAqIHJlc291cmNlIHBvbGljeSBhbGxvd3MgYGNsb3VkZnJvbnQuYW1hem9uYXdzLmNvbWAgdG8gY2FsbCB0aGlzIGVuZHBvaW50IG9uIGJlaGFsZiBvZiB0aGlzIGRpc3RyaWJ1dGlvbiBvbmx5LlxuICAgKlxuICAgKiBUaGUgZGlzdHJpYnV0aW9uIG11c3QgYmUgaW4gdGhlIGZ1bmN0aW9uJ3Mgc3RhY2suXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHdpdGhPcmlnaW5BY2Nlc3NDb250cm9sKGVuZHBvaW50OiBXZWJGdW5jdGlvbkVuZHBvaW50LCBwcm9wczogV2ViRnVuY3Rpb25PcmlnaW5XaXRoT2FjUHJvcHMgPSB7fSk6IGNsb3VkZnJvbnQuSU9yaWdpbiB7XG4gICAgaWYgKGVuZHBvaW50LmF1dGhUeXBlICE9PSBXZWJGdW5jdGlvbkF1dGhUeXBlLkFXU19JQU0pIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgJHtlbmRwb2ludC5ub2RlLnBhdGh9OiBvcmlnaW4gYWNjZXNzIGNvbnRyb2wgbmVlZHMgYW4gQVdTX0lBTSBlbmRwb2ludCAodGhpcyBvbmUgaXMgJHtlbmRwb2ludC5hdXRoVHlwZX0sIHdoaWNoIExhbWJkYSBkb2Vzbid0IGF1dGhlbnRpY2F0ZSk7IHVzZSBuZXcgV2ViRnVuY3Rpb25PcmlnaW4oZW5kcG9pbnQpYCk7XG4gICAgfVxuICAgIGlmIChlbmRwb2ludC5lbmRwb2ludFR5cGUgPT09IFdlYkZ1bmN0aW9uRW5kcG9pbnRUeXBlLk1VTFRJX1JFR0lPTikge1xuICAgICAgY29uc3Qgb3B0SW4gPSBlbmRwb2ludC5yZWdpb25zLmZpbHRlcigocikgPT4gT1BUX0lOX1JFR0lPTlMuaW5jbHVkZXMocikpO1xuICAgICAgaWYgKG9wdEluLmxlbmd0aCA+IDApIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGAke2VuZHBvaW50Lm5vZGUucGF0aH06IENsb3VkRnJvbnQgY2FuJ3Qgc2lnbiByZXF1ZXN0cyB0aGF0IGEgTVVMVElfUkVHSU9OIGVuZHBvaW50IHJvdXRlcyB0byBvcHQtaW4gcmVnaW9ucyAoJHtvcHRJbi5qb2luKCcsICcpfSk7IHVzZSBhIFBFUl9SRUdJT04gZW5kcG9pbnQgYW5kIG9uZSBvcmlnaW4gcGVyIHJlZ2lvbmApO1xuICAgICAgfVxuICAgIH1cbiAgICByZXR1cm4gbmV3IFdlYkZ1bmN0aW9uT3JpZ2luV2l0aE9hYyhlbmRwb2ludCwgcHJvcHMpO1xuICB9XG5cbiAgcHJpdmF0ZSByZWFkb25seSBwcm9wczogV2ViRnVuY3Rpb25PcmlnaW5Qcm9wcztcblxuICBjb25zdHJ1Y3RvcihlbmRwb2ludDogV2ViRnVuY3Rpb25FbmRwb2ludCwgcHJvcHM6IFdlYkZ1bmN0aW9uT3JpZ2luUHJvcHMgPSB7fSkge1xuICAgIGlmIChlbmRwb2ludC5hdXRoVHlwZSA9PT0gV2ViRnVuY3Rpb25BdXRoVHlwZS5BV1NfSUFNKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7ZW5kcG9pbnQubm9kZS5wYXRofTogQ2xvdWRGcm9udCBjYW4gb25seSBjYWxsIGFuIEFXU19JQU0gZW5kcG9pbnQgd2l0aCBvcmlnaW4gYWNjZXNzIGNvbnRyb2w7IHVzZSBXZWJGdW5jdGlvbk9yaWdpbi53aXRoT3JpZ2luQWNjZXNzQ29udHJvbChlbmRwb2ludClgKTtcbiAgICB9XG4gICAgc3VwZXIob3JpZ2luRG9tYWluTmFtZShlbmRwb2ludCwgcHJvcHMucmVnaW9uKSwgcHJvcHMpO1xuICAgIHZhbGlkYXRlVGltZW91dHMoZW5kcG9pbnQsIHByb3BzKTtcbiAgICB0aGlzLnZhbGlkYXRlUmVzcG9uc2VDb21wbGV0aW9uVGltZW91dFdpdGhSZWFkVGltZW91dChwcm9wcy5yZXNwb25zZUNvbXBsZXRpb25UaW1lb3V0LCBwcm9wcy5yZWFkVGltZW91dCk7XG4gICAgdGhpcy5wcm9wcyA9IHByb3BzO1xuICB9XG5cbiAgcHJvdGVjdGVkIHJlbmRlckN1c3RvbU9yaWdpbkNvbmZpZygpOiBjbG91ZGZyb250LkNmbkRpc3RyaWJ1dGlvbi5DdXN0b21PcmlnaW5Db25maWdQcm9wZXJ0eSB8IHVuZGVmaW5lZCB7XG4gICAgcmV0dXJuIGN1c3RvbU9yaWdpbkNvbmZpZyh0aGlzLnByb3BzKTtcbiAgfVxufVxuXG5jbGFzcyBXZWJGdW5jdGlvbk9yaWdpbldpdGhPYWMgZXh0ZW5kcyBjbG91ZGZyb250Lk9yaWdpbkJhc2Uge1xuICBwcml2YXRlIHJlYWRvbmx5IHNpZ25pbmdQcm90b2NvbDogJ3NpZ3Y0JyB8ICdzaWd2NGEnO1xuXG4gIGNvbnN0cnVjdG9yKHByaXZhdGUgcmVhZG9ubHkgZW5kcG9pbnQ6IFdlYkZ1bmN0aW9uRW5kcG9pbnQsIHByaXZhdGUgcmVhZG9ubHkgcHJvcHM6IFdlYkZ1bmN0aW9uT3JpZ2luV2l0aE9hY1Byb3BzKSB7XG4gICAgc3VwZXIob3JpZ2luRG9tYWluTmFtZShlbmRwb2ludCwgcHJvcHMucmVnaW9uKSwgcHJvcHMpO1xuICAgIHZhbGlkYXRlVGltZW91dHMoZW5kcG9pbnQsIHByb3BzKTtcbiAgICB0aGlzLnZhbGlkYXRlUmVzcG9uc2VDb21wbGV0aW9uVGltZW91dFdpdGhSZWFkVGltZW91dChwcm9wcy5yZXNwb25zZUNvbXBsZXRpb25UaW1lb3V0LCBwcm9wcy5yZWFkVGltZW91dCk7XG4gICAgLy8gVGhlIGdsb2JhbCBkb21haW4gcm91dGVzIHRvIGFueSBvZiB0aGUgZW5kcG9pbnQncyByZWdpb25zLCBzbyBDbG91ZEZyb250IHNpZ25zIGZvciBhbGwgb2YgdGhlbS5cbiAgICB0aGlzLnNpZ25pbmdQcm90b2NvbCA9IGVuZHBvaW50LmVuZHBvaW50VHlwZSA9PT0gV2ViRnVuY3Rpb25FbmRwb2ludFR5cGUuTVVMVElfUkVHSU9OID8gJ3NpZ3Y0YScgOiAnc2lndjQnO1xuICAgIGlmIChwcm9wcy5vcmlnaW5BY2Nlc3NDb250cm9sKSBhc3NlcnRPcmlnaW5BY2Nlc3NDb250cm9sKGVuZHBvaW50LCBwcm9wcy5vcmlnaW5BY2Nlc3NDb250cm9sLCB0aGlzLnNpZ25pbmdQcm90b2NvbCk7XG4gIH1cblxuICBwdWJsaWMgYmluZChzY29wZTogQ29uc3RydWN0LCBvcHRpb25zOiBjbG91ZGZyb250Lk9yaWdpbkJpbmRPcHRpb25zKTogY2xvdWRmcm9udC5PcmlnaW5CaW5kQ29uZmlnIHtcbiAgICBjb25zdCBjb25maWcgPSBzdXBlci5iaW5kKHNjb3BlLCBvcHRpb25zKTtcbiAgICBjb25zdCBzdGFjayA9IFN0YWNrLm9mKHNjb3BlKTtcbiAgICBpZiAoc3RhY2sgIT09IFN0YWNrLm9mKHRoaXMuZW5kcG9pbnQpKSB7XG4gICAgICAvLyBUaGUgcmVzb3VyY2UgcG9saWN5IG5hbWVzIHRoZSBkaXN0cmlidXRpb24sIGFuZCB0aGUgZGlzdHJpYnV0aW9uIG5hbWVzIHRoZSBlbmRwb2ludDogYSByZWZlcmVuY2UgY3ljbGUuXG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7c2NvcGUubm9kZS5wYXRofTogYSBkaXN0cmlidXRpb24gd2l0aCBhIFdlYkZ1bmN0aW9uT3JpZ2luIG11c3QgYmUgaW4gdGhlIGZ1bmN0aW9uJ3Mgc3RhY2sgKCR7U3RhY2sub2YodGhpcy5lbmRwb2ludCkuc3RhY2tOYW1lfSlgKTtcbiAgICB9XG4gICAgaWYgKG9wdGlvbnMuZGlzdHJpYnV0aW9uSWQgPT09IHVuZGVmaW5lZCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGAke3Njb3BlLm5vZGUucGF0aH06IGEgV2ViRnVuY3Rpb25PcmlnaW4gd2l0aCBvcmlnaW4gYWNjZXNzIGNvbnRyb2wgbXVzdCBiZSB1c2VkIGJ5IGEgY2xvdWRmcm9udC5EaXN0cmlidXRpb24gKGl0cyBJRCBzY29wZXMgdGhlIHJlc291cmNlIHBvbGljeSlgKTtcbiAgICB9XG4gICAgY29uc3Qgb2FjID0gdGhpcy5wcm9wcy5vcmlnaW5BY2Nlc3NDb250cm9sID8/IHRoaXMuc2hhcmVkT3JpZ2luQWNjZXNzQ29udHJvbChzdGFjayk7XG5cbiAgICBjb25zdCByZXN1bHQgPSB0aGlzLmVuZHBvaW50LndlYkZ1bmN0aW9uLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgcHJpbmNpcGFsczogW25ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnY2xvdWRmcm9udC5hbWF6b25hd3MuY29tJyldLFxuICAgICAgYWN0aW9uczogWydsYW1iZGE6SW52b2tlV2ViRnVuY3Rpb25FbmRwb2ludCddLFxuICAgICAgcmVzb3VyY2VzOiBbdGhpcy5lbmRwb2ludC5lbmRwb2ludEFybl0sXG4gICAgICBjb25kaXRpb25zOiB7XG4gICAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICAgICdhd3M6U291cmNlQXJuJzogc3RhY2suZm9ybWF0QXJuKHsgc2VydmljZTogJ2Nsb3VkZnJvbnQnLCByZWdpb246ICcnLCByZXNvdXJjZTogJ2Rpc3RyaWJ1dGlvbicsIHJlc291cmNlTmFtZTogb3B0aW9ucy5kaXN0cmlidXRpb25JZCB9KSxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSkpO1xuICAgIGlmICghcmVzdWx0LnN0YXRlbWVudEFkZGVkKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7c2NvcGUubm9kZS5wYXRofTogY291bGQgbm90IGFkZCBDbG91ZEZyb250IHRvIHRoZSByZXNvdXJjZSBwb2xpY3kgb2YgJHt0aGlzLmVuZHBvaW50LndlYkZ1bmN0aW9uLm5vZGUucGF0aH1gKTtcbiAgICB9XG5cbiAgICByZXR1cm4geyAuLi5jb25maWcsIG9yaWdpblByb3BlcnR5OiB7IC4uLmNvbmZpZy5vcmlnaW5Qcm9wZXJ0eSEsIG9yaWdpbkFjY2Vzc0NvbnRyb2xJZDogb2FjLm9yaWdpbkFjY2Vzc0NvbnRyb2xSZWYub3JpZ2luQWNjZXNzQ29udHJvbElkIH0gfTtcbiAgfVxuXG4gIHByb3RlY3RlZCByZW5kZXJDdXN0b21PcmlnaW5Db25maWcoKTogY2xvdWRmcm9udC5DZm5EaXN0cmlidXRpb24uQ3VzdG9tT3JpZ2luQ29uZmlnUHJvcGVydHkgfCB1bmRlZmluZWQge1xuICAgIHJldHVybiBjdXN0b21PcmlnaW5Db25maWcodGhpcy5wcm9wcyk7XG4gIH1cblxuICAvKiogT25lIG9yaWdpbiBhY2Nlc3MgY29udHJvbCBwZXIgc3RhY2sgYW5kIHNpZ25pbmcgcHJvdG9jb2wsIHNoYXJlZCBieSB0aGUgc3RhY2sncyBXZWIgRnVuY3Rpb24gb3JpZ2lucy4gKi9cbiAgcHJpdmF0ZSBzaGFyZWRPcmlnaW5BY2Nlc3NDb250cm9sKHNjb3BlOiBTdGFjayk6IGNsb3VkZnJvbnQuSU9yaWdpbkFjY2Vzc0NvbnRyb2xSZWYge1xuICAgIGNvbnN0IGlkID0gYFdlYkZ1bmN0aW9uT3JpZ2luQWNjZXNzQ29udHJvbCR7dGhpcy5zaWduaW5nUHJvdG9jb2wgPT09ICdzaWd2NGEnID8gJ1NpZ1Y0YScgOiAnU2lnVjQnfWA7XG4gICAgY29uc3QgZXhpc3RpbmcgPSBzY29wZS5ub2RlLnRyeUZpbmRDaGlsZChpZCkgYXMgY2xvdWRmcm9udC5DZm5PcmlnaW5BY2Nlc3NDb250cm9sIHwgdW5kZWZpbmVkO1xuICAgIGlmIChleGlzdGluZykgcmV0dXJuIGV4aXN0aW5nO1xuICAgIGNvbnN0IG9hYzogY2xvdWRmcm9udC5DZm5PcmlnaW5BY2Nlc3NDb250cm9sID0gbmV3IGNsb3VkZnJvbnQuQ2ZuT3JpZ2luQWNjZXNzQ29udHJvbChzY29wZSwgaWQsIHtcbiAgICAgIG9yaWdpbkFjY2Vzc0NvbnRyb2xDb25maWc6IHtcbiAgICAgICAgLy8gVW5pcXVlIGluIHRoZSBhY2NvdW50LCBsaWtlIHRoZSBuYW1lcyBDREsgZ2VuZXJhdGVzIGZvciBpdHMgb3duIG9yaWdpbiBhY2Nlc3MgY29udHJvbHMuXG4gICAgICAgIG5hbWU6IExhenkuc3RyaW5nKHsgcHJvZHVjZTogKCkgPT4gTmFtZXMudW5pcXVlUmVzb3VyY2VOYW1lKG9hYywgeyBtYXhMZW5ndGg6IDY0IH0pIH0pLFxuICAgICAgICBkZXNjcmlwdGlvbjogYExhbWJkYSBXZWIgRnVuY3Rpb24gb3JpZ2lucyAoJHt0aGlzLnNpZ25pbmdQcm90b2NvbH0pYCxcbiAgICAgICAgLy8gVGhlIENESyBlbnVtcyBoYXZlIG5laXRoZXIgdmFsdWUgeWV0LiBMYW1iZGEgV2ViIEZ1bmN0aW9uIG9yaWdpbnMgYWNjZXB0IG9ubHkgYWx3YXlzLWFtei1hdXRoLlxuICAgICAgICBvcmlnaW5BY2Nlc3NDb250cm9sT3JpZ2luVHlwZTogJ2xhbWJkYScsXG4gICAgICAgIHNpZ25pbmdCZWhhdmlvcjogJ2Fsd2F5cy1hbXotYXV0aCcsXG4gICAgICAgIHNpZ25pbmdQcm90b2NvbDogdGhpcy5zaWduaW5nUHJvdG9jb2wsXG4gICAgICB9LFxuICAgIH0pO1xuICAgIHJldHVybiBvYWM7XG4gIH1cbn1cblxuLyoqXG4gKiBDaGVja3MgYSBnaXZlbiBvcmlnaW4gYWNjZXNzIGNvbnRyb2wgd2hlbiBpdHMgY29uZmlndXJhdGlvbiBpcyBrbm93biAob25lIGNyZWF0ZWQgaW4gdGhpcyBhcHAsIG5vdCBpbXBvcnRlZCk6XG4gKiBDbG91ZEZyb250IHJlamVjdHMgb3RoZXIgc2V0dGluZ3MgZm9yIGEgV2ViIEZ1bmN0aW9uIG9yaWdpbiBvbmx5IHdoZW4gdGhlIGRpc3RyaWJ1dGlvbiBkZXBsb3lzLlxuICovXG5mdW5jdGlvbiBhc3NlcnRPcmlnaW5BY2Nlc3NDb250cm9sKGVuZHBvaW50OiBXZWJGdW5jdGlvbkVuZHBvaW50LCBvYWM6IGNsb3VkZnJvbnQuSU9yaWdpbkFjY2Vzc0NvbnRyb2xSZWYsIHByb3RvY29sOiBzdHJpbmcpIHtcbiAgY29uc3QgY2ZuID0gb2FjIGluc3RhbmNlb2YgY2xvdWRmcm9udC5DZm5PcmlnaW5BY2Nlc3NDb250cm9sXG4gICAgPyBvYWNcbiAgICA6IG9hYy5ub2RlLmNoaWxkcmVuLmZpbmQoKGMpOiBjIGlzIGNsb3VkZnJvbnQuQ2ZuT3JpZ2luQWNjZXNzQ29udHJvbCA9PiBjIGluc3RhbmNlb2YgY2xvdWRmcm9udC5DZm5PcmlnaW5BY2Nlc3NDb250cm9sKTtcbiAgaWYgKGNmbiA9PT0gdW5kZWZpbmVkKSByZXR1cm47XG4gIGNvbnN0IGNvbmZpZyA9IFN0YWNrLm9mKGNmbikucmVzb2x2ZShjZm4ub3JpZ2luQWNjZXNzQ29udHJvbENvbmZpZykgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG4gIGNvbnN0IGV4cGVjdGVkOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+ID0geyBPcmlnaW5BY2Nlc3NDb250cm9sT3JpZ2luVHlwZTogJ2xhbWJkYScsIFNpZ25pbmdCZWhhdmlvcjogJ2Fsd2F5cy1hbXotYXV0aCcsIFNpZ25pbmdQcm90b2NvbDogcHJvdG9jb2wgfTtcbiAgY29uc3Qgd3JvbmcgPSBPYmplY3QuZW50cmllcyhleHBlY3RlZCkuZmlsdGVyKChba2V5LCB2YWx1ZV0pID0+IHtcbiAgICBjb25zdCBhY3R1YWwgPSBjb25maWdba2V5XSA/PyBjb25maWdba2V5LmNoYXJBdCgwKS50b0xvd2VyQ2FzZSgpICsga2V5LnNsaWNlKDEpXTtcbiAgICByZXR1cm4gdHlwZW9mIGFjdHVhbCA9PT0gJ3N0cmluZycgJiYgYWN0dWFsICE9PSB2YWx1ZTtcbiAgfSk7XG4gIGlmICh3cm9uZy5sZW5ndGggPiAwKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGAke2VuZHBvaW50Lm5vZGUucGF0aH06IHRoZSBvcmlnaW4gYWNjZXNzIGNvbnRyb2wgJHtvYWMubm9kZS5wYXRofSBtdXN0IGhhdmUgJHt3cm9uZy5tYXAoKFtrLCB2XSkgPT4gYCR7a30gJyR7dn0nYCkuam9pbignLCAnKX0gZm9yIHRoaXMgZW5kcG9pbnRgKTtcbiAgfVxufVxuXG5mdW5jdGlvbiBvcmlnaW5Eb21haW5OYW1lKGVuZHBvaW50OiBXZWJGdW5jdGlvbkVuZHBvaW50LCByZWdpb24/OiBzdHJpbmcpOiBzdHJpbmcge1xuICBpZiAocmVnaW9uID09PSB1bmRlZmluZWQpIHJldHVybiBlbmRwb2ludC5kb21haW5OYW1lO1xuICBpZiAoZW5kcG9pbnQuZW5kcG9pbnRUeXBlICE9PSBXZWJGdW5jdGlvbkVuZHBvaW50VHlwZS5QRVJfUkVHSU9OKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGAke2VuZHBvaW50Lm5vZGUucGF0aH06IHJlZ2lvbiBpcyBvbmx5IGZvciBQRVJfUkVHSU9OIGVuZHBvaW50cyAodGhpcyBvbmUgaXMgJHtlbmRwb2ludC5lbmRwb2ludFR5cGV9KWApO1xuICB9XG4gIHJldHVybiBlbmRwb2ludC5yZWdpb25hbERvbWFpbk5hbWUocmVnaW9uKTtcbn1cblxuZnVuY3Rpb24gdmFsaWRhdGVUaW1lb3V0cyhlbmRwb2ludDogV2ViRnVuY3Rpb25FbmRwb2ludCwgcHJvcHM6IFdlYkZ1bmN0aW9uT3JpZ2luUHJvcHMpIHtcbiAgZm9yIChjb25zdCBbbmFtZSwgdmFsdWVdIG9mIFtbJ3JlYWRUaW1lb3V0JywgcHJvcHMucmVhZFRpbWVvdXRdLCBbJ2tlZXBhbGl2ZVRpbWVvdXQnLCBwcm9wcy5rZWVwYWxpdmVUaW1lb3V0XV0gYXMgY29uc3QpIHtcbiAgICBjb25zdCBzZWNvbmRzID0gdmFsdWU/LnRvU2Vjb25kcygpO1xuICAgIGlmIChzZWNvbmRzICE9PSB1bmRlZmluZWQgJiYgIVRva2VuLmlzVW5yZXNvbHZlZChzZWNvbmRzKSAmJiAoIU51bWJlci5pc0ludGVnZXIoc2Vjb25kcykgfHwgc2Vjb25kcyA8IDEpKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7ZW5kcG9pbnQubm9kZS5wYXRofTogJHtuYW1lfSBtdXN0IGJlIGEgd2hvbGUgbnVtYmVyIG9mIHNlY29uZHMsIGF0IGxlYXN0IDEsIGdvdCAke3NlY29uZHN9YCk7XG4gICAgfVxuICB9XG59XG5cbmZ1bmN0aW9uIGN1c3RvbU9yaWdpbkNvbmZpZyhwcm9wczogV2ViRnVuY3Rpb25PcmlnaW5Qcm9wcyk6IGNsb3VkZnJvbnQuQ2ZuRGlzdHJpYnV0aW9uLkN1c3RvbU9yaWdpbkNvbmZpZ1Byb3BlcnR5IHtcbiAgcmV0dXJuIHtcbiAgICBvcmlnaW5Qcm90b2NvbFBvbGljeTogY2xvdWRmcm9udC5PcmlnaW5Qcm90b2NvbFBvbGljeS5IVFRQU19PTkxZLFxuICAgIG9yaWdpblNzbFByb3RvY29sczogW2Nsb3VkZnJvbnQuT3JpZ2luU3NsUG9saWN5LlRMU19WMV8yXSxcbiAgICBvcmlnaW5SZWFkVGltZW91dDogcHJvcHMucmVhZFRpbWVvdXQ/LnRvU2Vjb25kcygpLFxuICAgIG9yaWdpbktlZXBhbGl2ZVRpbWVvdXQ6IHByb3BzLmtlZXBhbGl2ZVRpbWVvdXQ/LnRvU2Vjb25kcygpLFxuICAgIGlwQWRkcmVzc1R5cGU6IHByb3BzLmlwQWRkcmVzc1R5cGUsXG4gIH07XG59XG4iXX0=

package/lib/web-function-revision.js

@@ -11,7 +11,7 @@ const constructs_1 = require("constructs");
  * only revisions within `revisionRetention`, or that an endpoint routes to, are kept.
  */
 class WebFunctionRevision extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision", version: "0.1.4" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision", version: "0.1.6" };
     /**
      * References an existing revision of `webFunction`, e.g. to pin an endpoint to it or split traffic with it.
      */

package/lib/web-function.d.ts

@@ -127,8 +127,12 @@ export interface WebFunctionProps extends WebFunctionOptions {
 }
 /**
  * A Lambda Web Function, created in this app (`WebFunction`) or imported (`WebFunction.fromWebFunctionArn`).
+ *
+ * `addToResourcePolicy` adds to the function's resource policy (who else may call or manage it). A `WebFunction` has
+ * one, created by its stack on the first statement. An imported function's policy belongs to the stack that created
+ * it, so the statement isn't added (`statementAdded: false`).
  */
-export interface IWebFunction extends IResource, lambda.IWebFunctionRef {
+export interface IWebFunction extends IResource, lambda.IWebFunctionRef, iam.IResourceWithPolicy {
     /**
      * The function's name.
      *
@@ -145,7 +149,9 @@ export interface IWebFunction extends IResource, lambda.IWebFunctionRef {
      * Allows `grantee` to call the function's endpoint (`lambda:InvokeWebFunctionEndpoint`): the default endpoint
      * of a `WebFunction`; for an imported function, the endpoint named in its attributes, or every endpoint.
      *
-     * This adds to the grantee's IAM policy. For a function in another account, its resource policy must also allow the grantee.
+     * For a `WebFunction`, a grantee in this account gets an IAM policy statement; another account or an AWS service
+     * also gets a statement in the function's resource policy. For an imported function, only the grantee's IAM policy
+     * changes: across accounts, the function's own resource policy must also allow the grantee.
      * [disable-awslint:no-grants]
      */
     grantInvoke(grantee: iam.IGrantable): iam.Grant;
@@ -188,6 +194,37 @@ export interface WebFunctionAttributes {
      */
     readonly endpointName?: string;
 }
+/**
+ * Permission for a principal outside this account, an AWS service or an organization to call a function's endpoints.
+ */
+export interface WebFunctionPermission {
+    /**
+     * Who may call: an account (`iam.AccountPrincipal`), a role or user (`iam.ArnPrincipal`), an AWS service
+     * (`iam.ServicePrincipal`, with `sourceArn` or `sourceAccount`) or an organization (`iam.OrganizationPrincipal`).
+     *
+     * A principal in another account also needs `lambda:InvokeWebFunctionEndpoint` in its own IAM policy.
+     */
+    readonly principal: iam.IPrincipal;
+    /**
+     * The endpoint the principal may call. It must belong to this function.
+     *
+     * @default - every endpoint of the function, including ones added later
+     */
+    readonly endpoint?: WebFunctionEndpoint;
+    /**
+     * For an AWS service: the ARN of the resource calling on its behalf (condition `aws:SourceArn`, `ArnLike`),
+     * e.g. a CloudFront distribution. Without it or `sourceAccount`, any account's use of the service could call the endpoint.
+     *
+     * @default - no condition
+     */
+    readonly sourceArn?: string;
+    /**
+     * For an AWS service: the account that owns the resource calling on its behalf (condition `aws:SourceAccount`).
+     *
+     * @default - no condition
+     */
+    readonly sourceAccount?: string;
+}
 /**
  * What `WebFunction` and imported functions have in common.
  */
@@ -201,6 +238,10 @@ export declare abstract class WebFunctionBase extends Resource implements IWebFu
      * [disable-awslint:no-grants]
      */
     abstract grantInvoke(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Adds a statement to the function's resource policy (not added for an imported function).
+     */
+    abstract addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult;
     /**
      * A metric of this function's execution environments in `AWS/Lambda/Web` (dimension `FunctionName`), across all endpoints.
      * For request and error counts, use the endpoint's metrics (`fn.endpoint.metricRequests()`).
@@ -281,6 +322,8 @@ export declare class WebFunction extends WebFunctionBase implements iam.IGrantab
     private readonly logOptions;
     private readonly resource;
     private readonly revisionCleanup;
+    private readonly permissionIds;
+    private resourcePolicy?;
     constructor(scope: Construct, id: string, props: WebFunctionProps);
     /**
      * Adds an endpoint (up to 10 per function), e.g. a public one next to an IAM-only one, or one pinned to an
@@ -302,6 +345,23 @@ export declare class WebFunction extends WebFunctionBase implements iam.IGrantab
      * [disable-awslint:no-grants]
      */
     grantInvoke(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Allows a principal in another account, an AWS service or an organization to call the function's endpoints,
+     * through the function's resource policy. For a role in this account, use `grantInvoke`.
+     *
+     * @param id the statement ID (`Sid`): letters and digits, unique within the function
+     */
+    addPermission(id: string, permission: WebFunctionPermission): void;
+    /**
+     * Adds a statement to the function's resource policy, e.g. to let another account manage the function.
+     * For invoking, prefer `addPermission` or `grantInvoke`.
+     *
+     * The function has one resource policy (`AWS::Lambda::ResourcePolicy`), created on the first statement. This stack
+     * is its only writer: another stack or template can't also attach one, and changes made outside CloudFormation
+     * are overwritten by the next update of the policy.
+     */
+    addToResourcePolicy(statement: iam.PolicyStatement): iam.AddToResourcePolicyResult;
+    private createResourcePolicy;
     private createEndpoint;
     private createLogGroups;
     private logGroupIn;