@gemeentenijmegen/webapp 0.0.1

package/lib/index.d.ts

@@ -0,0 +1,4 @@
+export * from './webapp/Webapp';
+export * from './webapp/WebappOptions';
+export * from './webapp/OIDCConnectionProfile';
+export * from './webapp/Webpage';

package/lib/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !exports.hasOwnProperty(p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./webapp/Webapp"), exports);
+__exportStar(require("./webapp/WebappOptions"), exports);
+__exportStar(require("./webapp/OIDCConnectionProfile"), exports);
+__exportStar(require("./webapp/Webpage"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7O0FBQUEsa0RBQWdDO0FBQ2hDLHlEQUF1QztBQUN2QyxpRUFBK0M7QUFDL0MsbURBQWlDIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0ICogZnJvbSAnLi93ZWJhcHAvV2ViYXBwJztcbmV4cG9ydCAqIGZyb20gJy4vd2ViYXBwL1dlYmFwcE9wdGlvbnMnO1xuZXhwb3J0ICogZnJvbSAnLi93ZWJhcHAvT0lEQ0Nvbm5lY3Rpb25Qcm9maWxlJztcbmV4cG9ydCAqIGZyb20gJy4vd2ViYXBwL1dlYnBhZ2UnO1xuIl19

package/lib/webapp/Api.d.ts

@@ -0,0 +1,63 @@
+import { aws_lambda as lambda, aws_apigatewayv2 as apigatewayv2 } from 'aws-cdk-lib';
+import { HttpMethod } from 'aws-cdk-lib/aws-apigatewayv2';
+import { Role } from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+import { OpenIdConnectConnectionProfile } from './OIDCConnectionProfile';
+import { SessionsTable } from './SessionsTable';
+import { WebappConfigurable } from './WebappOptions';
+import { Webpage } from './Webpage';
+export interface ApiProps extends WebappConfigurable {
+    /**
+     * The dynamodb session table
+     */
+    sessionsTable: SessionsTable;
+}
+/**
+ * The API Stack creates the API Gateway and related
+ * lambda's. It requires supporting resources (such as the
+ * DynamoDB sessions table to be provided and thus created first)
+ */
+export declare class Api extends Construct {
+    private sessionsTable;
+    private customLambdaLayer?;
+    private configurationLambdaLayer;
+    private props;
+    api: apigatewayv2.HttpApi;
+    role: Role;
+    constructor(scope: Construct, id: string, props: ApiProps);
+    /**
+     * Create a lambda layer that incldues templates overwrites
+     * and configuration files. It is made available to all lambda
+     * registerd in this webapp.
+     * @param props
+     */
+    setupCustomLambdaLayer(customLambdaLayerDir?: string): lambda.LayerVersion | undefined;
+    /**
+     * Create a configuration lambda layer that contains the configuration files
+     * for the lambda.
+     * @param profiles
+     */
+    setupConfigurationLambdaLayer(profiles: OpenIdConnectConnectionProfile[]): lambda.LayerVersion;
+    /**
+     * Create and configure lambda's for all api routes, and
+     * add routes to the gateway.
+     */
+    setFunctions(props: ApiProps): void;
+    /**
+     * Add a new page to the webapp
+     * @param id
+     * @param handler
+     * @param path
+     * @param methods
+     */
+    addRoute(id: string, handler: Webpage, path: string, methods: HttpMethod[]): void;
+    /**
+     * Clean and return the apigateway subdomain placeholder
+     * https://${Token[TOKEN.246]}.execute-api.eu-west-1.${Token[AWS.URLSuffix.3]}/
+     * which can't be parsed by the URL class.
+     *
+     * @returns a domain-like string cleaned of protocol and trailing slash
+     */
+    domain(): string;
+    private setupLambdaExecutionRole;
+}

package/lib/webapp/Api.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Api = void 0;
+const fs = require("fs");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_apigatewayv2_integrations_1 = require("aws-cdk-lib/aws-apigatewayv2-integrations");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const constructs_1 = require("constructs");
+const auth_function_1 = require("./auth/auth-function");
+const login_function_1 = require("./login/login-function");
+const logout_function_1 = require("./logout/logout-function");
+const Webpage_1 = require("./Webpage");
+/**
+ * The API Stack creates the API Gateway and related
+ * lambda's. It requires supporting resources (such as the
+ * DynamoDB sessions table to be provided and thus created first)
+ */
+class Api extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.props = props;
+        this.sessionsTable = props.sessionsTable.table;
+        this.customLambdaLayer = this.setupCustomLambdaLayer(props.webappOptions.additionalSourceFilesDir);
+        this.configurationLambdaLayer = this.setupConfigurationLambdaLayer(props.webappOptions.oidcProfiles);
+        this.role = this.setupLambdaExecutionRole(props.webappOptions.applicationName);
+        this.api = new aws_cdk_lib_1.aws_apigatewayv2.HttpApi(this, 'gateway', {
+            description: `API Gateway webapp: ${props.webappOptions.applicationName}`,
+        });
+        this.setFunctions(props);
+    }
+    /**
+     * Create a lambda layer that incldues templates overwrites
+     * and configuration files. It is made available to all lambda
+     * registerd in this webapp.
+     * @param props
+     */
+    setupCustomLambdaLayer(customLambdaLayerDir) {
+        if (!customLambdaLayerDir) {
+            return;
+        }
+        return new aws_cdk_lib_1.aws_lambda.LayerVersion(this, 'layer', {
+            code: aws_cdk_lib_1.aws_lambda.Code.fromAsset(customLambdaLayerDir),
+        });
+    }
+    /**
+     * Create a configuration lambda layer that contains the configuration files
+     * for the lambda.
+     * @param profiles
+     */
+    setupConfigurationLambdaLayer(profiles) {
+        // Create temp directory (use projen assets dir)
+        const tempDir = './assets/webapp/configuration-layer';
+        fs.mkdirSync(tempDir, { recursive: true });
+        // Write configuration objects to JSON files in temp dir
+        const authenticationJson = JSON.stringify(profiles);
+        fs.writeFileSync(`${tempDir}/authentication.json`, authenticationJson);
+        // Make layer using the temp directory
+        return new aws_cdk_lib_1.aws_lambda.LayerVersion(this, 'configuration-layer', {
+            code: aws_cdk_lib_1.aws_lambda.Code.fromAsset(tempDir),
+            description: 'Webapp construct managed layer to inject configuration files in lambdas',
+        });
+    }
+    /**
+     * Create and configure lambda's for all api routes, and
+     * add routes to the gateway.
+     */
+    setFunctions(props) {
+        const loginFunction = new Webpage_1.Webpage(this, 'login-function', {
+            description: `Login page for webapp ${props.webappOptions.applicationName}.`,
+            apiFunction: login_function_1.LoginFunction,
+            role: this.role,
+        });
+        this.addRoute('login', loginFunction, '/login', [aws_cdk_lib_1.aws_apigatewayv2.HttpMethod.GET]);
+        const logoutFunction = new Webpage_1.Webpage(this, 'logout-function', {
+            description: `Logout page for webapp ${props.webappOptions.applicationName}.`,
+            apiFunction: logout_function_1.LogoutFunction,
+            role: this.role,
+        });
+        this.addRoute('logout', logoutFunction, '/logout', [aws_cdk_lib_1.aws_apigatewayv2.HttpMethod.GET]);
+        const authFunction = new Webpage_1.Webpage(this, 'auth-function', {
+            description: `Auth landingpoint for webapp ${props.webappOptions.applicationName}.`,
+            role: this.role,
+            apiFunction: auth_function_1.AuthFunction,
+            environment: {
+                REDIRECT_TO_POST_LOGIN_HOOK: props.webappOptions.postLoginProcessor ? 'true' : 'false',
+            },
+        });
+        this.addRoute('auth', authFunction, '/auth', [aws_cdk_lib_1.aws_apigatewayv2.HttpMethod.GET]);
+    }
+    /**
+     * Add a new page to the webapp
+     * @param id
+     * @param handler
+     * @param path
+     * @param methods
+     */
+    addRoute(id, handler, path, methods) {
+        handler.allowSessionAccess(this.sessionsTable);
+        if (this.customLambdaLayer) {
+            handler.addLambdaLayer(this.customLambdaLayer);
+        }
+        handler.addLambdaLayer(this.configurationLambdaLayer);
+        handler.overwriteSessionLifetime(this.props.webappOptions.sessionLifetime ?? 15);
+        handler.monitor(this.props.webappOptions.applicationName);
+        handler.addStandardEnvironment(this.props.webappOptions.applicationName);
+        this.api.addRoutes({
+            path,
+            methods,
+            integration: new aws_apigatewayv2_integrations_1.HttpLambdaIntegration(id, handler.lambda),
+        });
+    }
+    /**
+     * Clean and return the apigateway subdomain placeholder
+     * https://${Token[TOKEN.246]}.execute-api.eu-west-1.${Token[AWS.URLSuffix.3]}/
+     * which can't be parsed by the URL class.
+     *
+     * @returns a domain-like string cleaned of protocol and trailing slash
+     */
+    domain() {
+        const url = this.api.url;
+        if (!url) {
+            return '';
+        }
+        let cleanedUrl = url
+            .replace(/^https?:\/\//, '') //protocol
+            .replace(/\/$/, ''); //optional trailing slash
+        return cleanedUrl;
+    }
+    setupLambdaExecutionRole(applicationName) {
+        return new aws_iam_1.Role(this, 'role', {
+            assumedBy: new aws_iam_1.ServicePrincipal('lambda.amazonaws.com'),
+            description: `Role used for lambdas in webapp ${applicationName}`,
+            managedPolicies: [
+                aws_iam_1.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
+            ],
+        });
+    }
+}
+exports.Api = Api;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQXBpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3dlYmFwcC9BcGkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEseUJBQXlCO0FBQ3pCLDZDQUdxQjtBQUVyQiw2RkFBa0Y7QUFFbEYsaURBQTRFO0FBRTVFLDJDQUF1QztBQUN2Qyx3REFBb0Q7QUFDcEQsMkRBQXVEO0FBQ3ZELDhEQUEwRDtBQUkxRCx1Q0FBb0M7QUFTcEM7Ozs7R0FJRztBQUNILE1BQWEsR0FBSSxTQUFRLHNCQUFTO0lBU2hDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBZTtRQUN2RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pCLElBQUksQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDO1FBQ25CLElBQUksQ0FBQyxhQUFhLEdBQUcsS0FBSyxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUM7UUFDL0MsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDbkcsSUFBSSxDQUFDLHdCQUF3QixHQUFHLElBQUksQ0FBQyw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBRXJHLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDL0UsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLDhCQUFZLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUU7WUFDbkQsV0FBVyxFQUFFLHVCQUF1QixLQUFLLENBQUMsYUFBYSxDQUFDLGVBQWUsRUFBRTtTQUMxRSxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNILHNCQUFzQixDQUFDLG9CQUE2QjtRQUNsRCxJQUFJLENBQUMsb0JBQW9CLEVBQUU7WUFBRSxPQUFPO1NBQUU7UUFDdEMsT0FBTyxJQUFJLHdCQUFNLENBQUMsWUFBWSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUU7WUFDNUMsSUFBSSxFQUFFLHdCQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxvQkFBb0IsQ0FBQztTQUNsRCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNILDZCQUE2QixDQUFDLFFBQTBDO1FBQ3RFLGdEQUFnRDtRQUNoRCxNQUFNLE9BQU8sR0FBRyxxQ0FBcUMsQ0FBQztRQUN0RCxFQUFFLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBRTNDLHdEQUF3RDtRQUN4RCxNQUFNLGtCQUFrQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDcEQsRUFBRSxDQUFDLGFBQWEsQ0FBQyxHQUFHLE9BQU8sc0JBQXNCLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztRQUV2RSxzQ0FBc0M7UUFDdEMsT0FBTyxJQUFJLHdCQUFNLENBQUMsWUFBWSxDQUFDLElBQUksRUFBRSxxQkFBcUIsRUFBRTtZQUMxRCxJQUFJLEVBQUUsd0JBQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQztZQUNwQyxXQUFXLEVBQUUseUVBQXlFO1NBQ3ZGLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7O09BR0c7SUFDSCxZQUFZLENBQUMsS0FBZTtRQUMxQixNQUFNLGFBQWEsR0FBRyxJQUFJLGlCQUFPLENBQUMsSUFBSSxFQUFFLGdCQUFnQixFQUFFO1lBQ3hELFdBQVcsRUFBRSx5QkFBeUIsS0FBSyxDQUFDLGFBQWEsQ0FBQyxlQUFlLEdBQUc7WUFDNUUsV0FBVyxFQUFFLDhCQUFhO1lBQzFCLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtTQUNoQixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxhQUFhLEVBQUUsUUFBUSxFQUFFLENBQUMsOEJBQVksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUUvRSxNQUFNLGNBQWMsR0FBRyxJQUFJLGlCQUFPLENBQUMsSUFBSSxFQUFFLGlCQUFpQixFQUFFO1lBQzFELFdBQVcsRUFBRSwwQkFBMEIsS0FBSyxDQUFDLGFBQWEsQ0FBQyxlQUFlLEdBQUc7WUFDN0UsV0FBVyxFQUFFLGdDQUFjO1lBQzNCLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtTQUNoQixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxjQUFjLEVBQUUsU0FBUyxFQUFFLENBQUMsOEJBQVksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUVsRixNQUFNLFlBQVksR0FBRyxJQUFJLGlCQUFPLENBQUMsSUFBSSxFQUFFLGVBQWUsRUFBRTtZQUN0RCxXQUFXLEVBQUUsZ0NBQWdDLEtBQUssQ0FBQyxhQUFhLENBQUMsZUFBZSxHQUFHO1lBQ25GLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtZQUNmLFdBQVcsRUFBRSw0QkFBWTtZQUN6QixXQUFXLEVBQUU7Z0JBQ1gsMkJBQTJCLEVBQUUsS0FBSyxDQUFDLGFBQWEsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxPQUFPO2FBQ3ZGO1NBQ0YsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsWUFBWSxFQUFFLE9BQU8sRUFBRSxDQUFDLDhCQUFZLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNILFFBQVEsQ0FBQyxFQUFVLEVBQUUsT0FBZ0IsRUFBRSxJQUFZLEVBQUUsT0FBcUI7UUFDeEUsT0FBTyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMvQyxJQUFJLElBQUksQ0FBQyxpQkFBaUIsRUFBRTtZQUFFLE9BQU8sQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLENBQUM7U0FBRTtRQUMvRSxPQUFPLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1FBQ3RELE9BQU8sQ0FBQyx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxlQUFlLElBQUksRUFBRSxDQUFDLENBQUM7UUFDakYsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMxRCxPQUFPLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDekUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUM7WUFDakIsSUFBSTtZQUNKLE9BQU87WUFDUCxXQUFXLEVBQUUsSUFBSSxxREFBcUIsQ0FBQyxFQUFFLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQztTQUMzRCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0gsTUFBTTtRQUNKLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDO1FBQ3pCLElBQUksQ0FBQyxHQUFHLEVBQUU7WUFBRSxPQUFPLEVBQUUsQ0FBQztTQUFFO1FBQ3hCLElBQUksVUFBVSxHQUFHLEdBQUc7YUFDakIsT0FBTyxDQUFDLGNBQWMsRUFBRSxFQUFFLENBQUMsQ0FBQyxVQUFVO2FBQ3RDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyx5QkFBeUI7UUFDaEQsT0FBTyxVQUFVLENBQUM7SUFDcEIsQ0FBQztJQUVPLHdCQUF3QixDQUFDLGVBQXVCO1FBQ3RELE9BQU8sSUFBSSxjQUFJLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRTtZQUM1QixTQUFTLEVBQUUsSUFBSSwwQkFBZ0IsQ0FBQyxzQkFBc0IsQ0FBQztZQUN2RCxXQUFXLEVBQUUsbUNBQW1DLGVBQWUsRUFBRTtZQUNqRSxlQUFlLEVBQUU7Z0JBQ2YsdUJBQWEsQ0FBQyx3QkFBd0IsQ0FBQywwQ0FBMEMsQ0FBQzthQUNuRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FFRjtBQXZJRCxrQkF1SUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBmcyBmcm9tICdmcyc7XG5pbXBvcnQge1xuICBhd3NfbGFtYmRhIGFzIGxhbWJkYSxcbiAgYXdzX2FwaWdhdGV3YXl2MiBhcyBhcGlnYXRld2F5djIsXG59IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IEh0dHBNZXRob2QgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtYXBpZ2F0ZXdheXYyJztcbmltcG9ydCB7IEh0dHBMYW1iZGFJbnRlZ3JhdGlvbiB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1hcGlnYXRld2F5djItaW50ZWdyYXRpb25zJztcbmltcG9ydCB7IFRhYmxlIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWR5bmFtb2RiJztcbmltcG9ydCB7IE1hbmFnZWRQb2xpY3ksIFJvbGUsIFNlcnZpY2VQcmluY2lwYWwgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IExheWVyVmVyc2lvbiB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1sYW1iZGEnO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBBdXRoRnVuY3Rpb24gfSBmcm9tICcuL2F1dGgvYXV0aC1mdW5jdGlvbic7XG5pbXBvcnQgeyBMb2dpbkZ1bmN0aW9uIH0gZnJvbSAnLi9sb2dpbi9sb2dpbi1mdW5jdGlvbic7XG5pbXBvcnQgeyBMb2dvdXRGdW5jdGlvbiB9IGZyb20gJy4vbG9nb3V0L2xvZ291dC1mdW5jdGlvbic7XG5pbXBvcnQgeyBPcGVuSWRDb25uZWN0Q29ubmVjdGlvblByb2ZpbGUgfSBmcm9tICcuL09JRENDb25uZWN0aW9uUHJvZmlsZSc7XG5pbXBvcnQgeyBTZXNzaW9uc1RhYmxlIH0gZnJvbSAnLi9TZXNzaW9uc1RhYmxlJztcbmltcG9ydCB7IFdlYmFwcENvbmZpZ3VyYWJsZSB9IGZyb20gJy4vV2ViYXBwT3B0aW9ucyc7XG5pbXBvcnQgeyBXZWJwYWdlIH0gZnJvbSAnLi9XZWJwYWdlJztcblxuZXhwb3J0IGludGVyZmFjZSBBcGlQcm9wcyBleHRlbmRzIFdlYmFwcENvbmZpZ3VyYWJsZSB7XG4gIC8qKlxuICAgKiBUaGUgZHluYW1vZGIgc2Vzc2lvbiB0YWJsZVxuICAgKi9cbiAgc2Vzc2lvbnNUYWJsZTogU2Vzc2lvbnNUYWJsZTtcbn1cblxuLyoqXG4gKiBUaGUgQVBJIFN0YWNrIGNyZWF0ZXMgdGhlIEFQSSBHYXRld2F5IGFuZCByZWxhdGVkXG4gKiBsYW1iZGEncy4gSXQgcmVxdWlyZXMgc3VwcG9ydGluZyByZXNvdXJjZXMgKHN1Y2ggYXMgdGhlXG4gKiBEeW5hbW9EQiBzZXNzaW9ucyB0YWJsZSB0byBiZSBwcm92aWRlZCBhbmQgdGh1cyBjcmVhdGVkIGZpcnN0KVxuICovXG5leHBvcnQgY2xhc3MgQXBpIGV4dGVuZHMgQ29uc3RydWN0IHtcblxuICBwcml2YXRlIHNlc3Npb25zVGFibGU6IFRhYmxlO1xuICBwcml2YXRlIGN1c3RvbUxhbWJkYUxheWVyPzogTGF5ZXJWZXJzaW9uO1xuICBwcml2YXRlIGNvbmZpZ3VyYXRpb25MYW1iZGFMYXllcjogTGF5ZXJWZXJzaW9uO1xuICBwcml2YXRlIHByb3BzOiBBcGlQcm9wcztcbiAgYXBpOiBhcGlnYXRld2F5djIuSHR0cEFwaTtcbiAgcm9sZTogUm9sZTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogQXBpUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIHRoaXMucHJvcHMgPSBwcm9wcztcbiAgICB0aGlzLnNlc3Npb25zVGFibGUgPSBwcm9wcy5zZXNzaW9uc1RhYmxlLnRhYmxlO1xuICAgIHRoaXMuY3VzdG9tTGFtYmRhTGF5ZXIgPSB0aGlzLnNldHVwQ3VzdG9tTGFtYmRhTGF5ZXIocHJvcHMud2ViYXBwT3B0aW9ucy5hZGRpdGlvbmFsU291cmNlRmlsZXNEaXIpO1xuICAgIHRoaXMuY29uZmlndXJhdGlvbkxhbWJkYUxheWVyID0gdGhpcy5zZXR1cENvbmZpZ3VyYXRpb25MYW1iZGFMYXllcihwcm9wcy53ZWJhcHBPcHRpb25zLm9pZGNQcm9maWxlcyk7XG5cbiAgICB0aGlzLnJvbGUgPSB0aGlzLnNldHVwTGFtYmRhRXhlY3V0aW9uUm9sZShwcm9wcy53ZWJhcHBPcHRpb25zLmFwcGxpY2F0aW9uTmFtZSk7XG4gICAgdGhpcy5hcGkgPSBuZXcgYXBpZ2F0ZXdheXYyLkh0dHBBcGkodGhpcywgJ2dhdGV3YXknLCB7XG4gICAgICBkZXNjcmlwdGlvbjogYEFQSSBHYXRld2F5IHdlYmFwcDogJHtwcm9wcy53ZWJhcHBPcHRpb25zLmFwcGxpY2F0aW9uTmFtZX1gLFxuICAgIH0pO1xuXG4gICAgdGhpcy5zZXRGdW5jdGlvbnMocHJvcHMpO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhIGxhbWJkYSBsYXllciB0aGF0IGluY2xkdWVzIHRlbXBsYXRlcyBvdmVyd3JpdGVzXG4gICAqIGFuZCBjb25maWd1cmF0aW9uIGZpbGVzLiBJdCBpcyBtYWRlIGF2YWlsYWJsZSB0byBhbGwgbGFtYmRhXG4gICAqIHJlZ2lzdGVyZCBpbiB0aGlzIHdlYmFwcC5cbiAgICogQHBhcmFtIHByb3BzXG4gICAqL1xuICBzZXR1cEN1c3RvbUxhbWJkYUxheWVyKGN1c3RvbUxhbWJkYUxheWVyRGlyPzogc3RyaW5nKSB7XG4gICAgaWYgKCFjdXN0b21MYW1iZGFMYXllckRpcikgeyByZXR1cm47IH1cbiAgICByZXR1cm4gbmV3IGxhbWJkYS5MYXllclZlcnNpb24odGhpcywgJ2xheWVyJywge1xuICAgICAgY29kZTogbGFtYmRhLkNvZGUuZnJvbUFzc2V0KGN1c3RvbUxhbWJkYUxheWVyRGlyKSxcbiAgICB9KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBDcmVhdGUgYSBjb25maWd1cmF0aW9uIGxhbWJkYSBsYXllciB0aGF0IGNvbnRhaW5zIHRoZSBjb25maWd1cmF0aW9uIGZpbGVzXG4gICAqIGZvciB0aGUgbGFtYmRhLlxuICAgKiBAcGFyYW0gcHJvZmlsZXNcbiAgICovXG4gIHNldHVwQ29uZmlndXJhdGlvbkxhbWJkYUxheWVyKHByb2ZpbGVzOiBPcGVuSWRDb25uZWN0Q29ubmVjdGlvblByb2ZpbGVbXSkge1xuICAgIC8vIENyZWF0ZSB0ZW1wIGRpcmVjdG9yeSAodXNlIHByb2plbiBhc3NldHMgZGlyKVxuICAgIGNvbnN0IHRlbXBEaXIgPSAnLi9hc3NldHMvd2ViYXBwL2NvbmZpZ3VyYXRpb24tbGF5ZXInO1xuICAgIGZzLm1rZGlyU3luYyh0ZW1wRGlyLCB7IHJlY3Vyc2l2ZTogdHJ1ZSB9KTtcblxuICAgIC8vIFdyaXRlIGNvbmZpZ3VyYXRpb24gb2JqZWN0cyB0byBKU09OIGZpbGVzIGluIHRlbXAgZGlyXG4gICAgY29uc3QgYXV0aGVudGljYXRpb25Kc29uID0gSlNPTi5zdHJpbmdpZnkocHJvZmlsZXMpO1xuICAgIGZzLndyaXRlRmlsZVN5bmMoYCR7dGVtcERpcn0vYXV0aGVudGljYXRpb24uanNvbmAsIGF1dGhlbnRpY2F0aW9uSnNvbik7XG5cbiAgICAvLyBNYWtlIGxheWVyIHVzaW5nIHRoZSB0ZW1wIGRpcmVjdG9yeVxuICAgIHJldHVybiBuZXcgbGFtYmRhLkxheWVyVmVyc2lvbih0aGlzLCAnY29uZmlndXJhdGlvbi1sYXllcicsIHtcbiAgICAgIGNvZGU6IGxhbWJkYS5Db2RlLmZyb21Bc3NldCh0ZW1wRGlyKSxcbiAgICAgIGRlc2NyaXB0aW9uOiAnV2ViYXBwIGNvbnN0cnVjdCBtYW5hZ2VkIGxheWVyIHRvIGluamVjdCBjb25maWd1cmF0aW9uIGZpbGVzIGluIGxhbWJkYXMnLFxuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhbmQgY29uZmlndXJlIGxhbWJkYSdzIGZvciBhbGwgYXBpIHJvdXRlcywgYW5kXG4gICAqIGFkZCByb3V0ZXMgdG8gdGhlIGdhdGV3YXkuXG4gICAqL1xuICBzZXRGdW5jdGlvbnMocHJvcHM6IEFwaVByb3BzKSB7XG4gICAgY29uc3QgbG9naW5GdW5jdGlvbiA9IG5ldyBXZWJwYWdlKHRoaXMsICdsb2dpbi1mdW5jdGlvbicsIHtcbiAgICAgIGRlc2NyaXB0aW9uOiBgTG9naW4gcGFnZSBmb3Igd2ViYXBwICR7cHJvcHMud2ViYXBwT3B0aW9ucy5hcHBsaWNhdGlvbk5hbWV9LmAsXG4gICAgICBhcGlGdW5jdGlvbjogTG9naW5GdW5jdGlvbixcbiAgICAgIHJvbGU6IHRoaXMucm9sZSxcbiAgICB9KTtcbiAgICB0aGlzLmFkZFJvdXRlKCdsb2dpbicsIGxvZ2luRnVuY3Rpb24sICcvbG9naW4nLCBbYXBpZ2F0ZXdheXYyLkh0dHBNZXRob2QuR0VUXSk7XG5cbiAgICBjb25zdCBsb2dvdXRGdW5jdGlvbiA9IG5ldyBXZWJwYWdlKHRoaXMsICdsb2dvdXQtZnVuY3Rpb24nLCB7XG4gICAgICBkZXNjcmlwdGlvbjogYExvZ291dCBwYWdlIGZvciB3ZWJhcHAgJHtwcm9wcy53ZWJhcHBPcHRpb25zLmFwcGxpY2F0aW9uTmFtZX0uYCxcbiAgICAgIGFwaUZ1bmN0aW9uOiBMb2dvdXRGdW5jdGlvbixcbiAgICAgIHJvbGU6IHRoaXMucm9sZSxcbiAgICB9KTtcbiAgICB0aGlzLmFkZFJvdXRlKCdsb2dvdXQnLCBsb2dvdXRGdW5jdGlvbiwgJy9sb2dvdXQnLCBbYXBpZ2F0ZXdheXYyLkh0dHBNZXRob2QuR0VUXSk7XG5cbiAgICBjb25zdCBhdXRoRnVuY3Rpb24gPSBuZXcgV2VicGFnZSh0aGlzLCAnYXV0aC1mdW5jdGlvbicsIHtcbiAgICAgIGRlc2NyaXB0aW9uOiBgQXV0aCBsYW5kaW5ncG9pbnQgZm9yIHdlYmFwcCAke3Byb3BzLndlYmFwcE9wdGlvbnMuYXBwbGljYXRpb25OYW1lfS5gLFxuICAgICAgcm9sZTogdGhpcy5yb2xlLFxuICAgICAgYXBpRnVuY3Rpb246IEF1dGhGdW5jdGlvbixcbiAgICAgIGVudmlyb25tZW50OiB7XG4gICAgICAgIFJFRElSRUNUX1RPX1BPU1RfTE9HSU5fSE9PSzogcHJvcHMud2ViYXBwT3B0aW9ucy5wb3N0TG9naW5Qcm9jZXNzb3IgPyAndHJ1ZScgOiAnZmFsc2UnLFxuICAgICAgfSxcbiAgICB9KTtcbiAgICB0aGlzLmFkZFJvdXRlKCdhdXRoJywgYXV0aEZ1bmN0aW9uLCAnL2F1dGgnLCBbYXBpZ2F0ZXdheXYyLkh0dHBNZXRob2QuR0VUXSk7XG4gIH1cblxuICAvKipcbiAgICogQWRkIGEgbmV3IHBhZ2UgdG8gdGhlIHdlYmFwcFxuICAgKiBAcGFyYW0gaWRcbiAgICogQHBhcmFtIGhhbmRsZXJcbiAgICogQHBhcmFtIHBhdGhcbiAgICogQHBhcmFtIG1ldGhvZHNcbiAgICovXG4gIGFkZFJvdXRlKGlkOiBzdHJpbmcsIGhhbmRsZXI6IFdlYnBhZ2UsIHBhdGg6IHN0cmluZywgbWV0aG9kczogSHR0cE1ldGhvZFtdKSB7XG4gICAgaGFuZGxlci5hbGxvd1Nlc3Npb25BY2Nlc3ModGhpcy5zZXNzaW9uc1RhYmxlKTtcbiAgICBpZiAodGhpcy5jdXN0b21MYW1iZGFMYXllcikgeyBoYW5kbGVyLmFkZExhbWJkYUxheWVyKHRoaXMuY3VzdG9tTGFtYmRhTGF5ZXIpOyB9XG4gICAgaGFuZGxlci5hZGRMYW1iZGFMYXllcih0aGlzLmNvbmZpZ3VyYXRpb25MYW1iZGFMYXllcik7XG4gICAgaGFuZGxlci5vdmVyd3JpdGVTZXNzaW9uTGlmZXRpbWUodGhpcy5wcm9wcy53ZWJhcHBPcHRpb25zLnNlc3Npb25MaWZldGltZSA/PyAxNSk7XG4gICAgaGFuZGxlci5tb25pdG9yKHRoaXMucHJvcHMud2ViYXBwT3B0aW9ucy5hcHBsaWNhdGlvbk5hbWUpO1xuICAgIGhhbmRsZXIuYWRkU3RhbmRhcmRFbnZpcm9ubWVudCh0aGlzLnByb3BzLndlYmFwcE9wdGlvbnMuYXBwbGljYXRpb25OYW1lKTtcbiAgICB0aGlzLmFwaS5hZGRSb3V0ZXMoe1xuICAgICAgcGF0aCxcbiAgICAgIG1ldGhvZHMsXG4gICAgICBpbnRlZ3JhdGlvbjogbmV3IEh0dHBMYW1iZGFJbnRlZ3JhdGlvbihpZCwgaGFuZGxlci5sYW1iZGEpLFxuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIENsZWFuIGFuZCByZXR1cm4gdGhlIGFwaWdhdGV3YXkgc3ViZG9tYWluIHBsYWNlaG9sZGVyXG4gICAqIGh0dHBzOi8vJHtUb2tlbltUT0tFTi4yNDZdfS5leGVjdXRlLWFwaS5ldS13ZXN0LTEuJHtUb2tlbltBV1MuVVJMU3VmZml4LjNdfS9cbiAgICogd2hpY2ggY2FuJ3QgYmUgcGFyc2VkIGJ5IHRoZSBVUkwgY2xhc3MuXG4gICAqXG4gICAqIEByZXR1cm5zIGEgZG9tYWluLWxpa2Ugc3RyaW5nIGNsZWFuZWQgb2YgcHJvdG9jb2wgYW5kIHRyYWlsaW5nIHNsYXNoXG4gICAqL1xuICBkb21haW4oKTogc3RyaW5nIHtcbiAgICBjb25zdCB1cmwgPSB0aGlzLmFwaS51cmw7XG4gICAgaWYgKCF1cmwpIHsgcmV0dXJuICcnOyB9XG4gICAgbGV0IGNsZWFuZWRVcmwgPSB1cmxcbiAgICAgIC5yZXBsYWNlKC9eaHR0cHM/OlxcL1xcLy8sICcnKSAvL3Byb3RvY29sXG4gICAgICAucmVwbGFjZSgvXFwvJC8sICcnKTsgLy9vcHRpb25hbCB0cmFpbGluZyBzbGFzaFxuICAgIHJldHVybiBjbGVhbmVkVXJsO1xuICB9XG5cbiAgcHJpdmF0ZSBzZXR1cExhbWJkYUV4ZWN1dGlvblJvbGUoYXBwbGljYXRpb25OYW1lOiBzdHJpbmcpIHtcbiAgICByZXR1cm4gbmV3IFJvbGUodGhpcywgJ3JvbGUnLCB7XG4gICAgICBhc3N1bWVkQnk6IG5ldyBTZXJ2aWNlUHJpbmNpcGFsKCdsYW1iZGEuYW1hem9uYXdzLmNvbScpLFxuICAgICAgZGVzY3JpcHRpb246IGBSb2xlIHVzZWQgZm9yIGxhbWJkYXMgaW4gd2ViYXBwICR7YXBwbGljYXRpb25OYW1lfWAsXG4gICAgICBtYW5hZ2VkUG9saWNpZXM6IFtcbiAgICAgICAgTWFuYWdlZFBvbGljeS5mcm9tQXdzTWFuYWdlZFBvbGljeU5hbWUoJ3NlcnZpY2Utcm9sZS9BV1NMYW1iZGFCYXNpY0V4ZWN1dGlvblJvbGUnKSxcbiAgICAgIF0sXG4gICAgfSk7XG4gIH1cblxufSJdfQ==

package/lib/webapp/Cloudfront.d.ts

@@ -0,0 +1,86 @@
+import { aws_s3 as S3 } from 'aws-cdk-lib';
+import { Distribution, ResponseHeadersPolicy, OriginAccessIdentity } from 'aws-cdk-lib/aws-cloudfront';
+import { Construct } from 'constructs';
+import { WebappConfigurable } from './WebappOptions';
+export interface CloudFrontProps extends WebappConfigurable {
+    /**
+     * The domain name of the API gateway to forward requests to.
+     */
+    apiGatewayDomain: string;
+}
+export declare class Cloudfront extends Construct {
+    cloudfront: Distribution;
+    constructor(scope: Construct, id: string, props: CloudFrontProps);
+    /**
+     * Add static contents to cloudfront
+     *
+     * Creates a bucket, deploys contents from a folder and adds it to
+     * the cloudfront distribution.
+     *
+     * @param cloudfrontDistribution the distribution for these resources
+     */
+    private addStaticResources;
+    /**
+     * Create a cloudfront distribution for the application
+     *
+     * Do not forward the Host header to API Gateway. This results in
+     * an HTTP 403 because API Gateway won't be able to find an endpoint
+     * on the cloudfront domain.
+     *
+     * @param {string} apiGatewayDomain the domain the api gateway can be reached at
+     * @returns {Distribution} the cloudfront distribution
+     */
+    setupCloudfront(props: CloudFrontProps): Distribution;
+    private errorResponses;
+    /**
+     * Add DNS records for cloudfront to the Route53 Zone
+     *
+     * Requests to the custom domain will correctly use cloudfront.
+     *
+     * @param distribution the cloudfront distribution
+     */
+    addDnsRecords(distribution: Distribution, props: CloudFrontProps): void;
+    /**
+     * Create a bucket to hold cloudfront logs
+     * @returns s3.Bucket
+     */
+    logBucket(): S3.Bucket;
+    /**
+     * Get a set of (security) response headers to inject into the response
+     * @returns {ResponseHeadersPolicy} cloudfront responseHeadersPolicy
+     */
+    responseHeadersPolicy(props: CloudFrontProps): ResponseHeadersPolicy;
+    /**
+     * Get the cleaned, trimmed header values for the csp header
+     *
+     * @returns string csp header values
+     */
+    cspHeaderValue(): string;
+    /**
+     * Create an s3 bucket to hold static resources.
+     * Must be unencrypted to allow cloudfront to serve
+     * these resources.
+     *
+     * @returns S3.Bucket
+     */
+    staticResourcesBucket(): S3.Bucket;
+    /**
+     * Allow listBucket to the origin access identity
+     *
+     * Necessary so cloudfront receives 404's as 404 instead of 403. This also allows
+     * a listing of the bucket if no /index.html is present in the bucket.
+     *
+     * @param originAccessIdentity
+     * @param bucket
+     */
+    allowOriginAccessIdentityAccessToBucket(originAccessIdentity: OriginAccessIdentity, bucket: S3.Bucket): void;
+    /**
+     * Deploy contents of folder to the s3 bucket
+     *
+     * Invalidates the correct cloudfront path
+     * @param bucket s3.Bucket
+     * @param distribution Distribution
+     */
+    deployBucket(props: CloudFrontProps, bucket: S3.Bucket, distribution: Distribution): void;
+    private domainNames;
+}

package/lib/webapp/Cloudfront.js

@@ -0,0 +1,259 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Cloudfront = void 0;
+const fs = require("fs");
+const path = require("path");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_cloudfront_1 = require("aws-cdk-lib/aws-cloudfront");
+const aws_cloudfront_origins_1 = require("aws-cdk-lib/aws-cloudfront-origins");
+const constructs_1 = require("constructs");
+class Cloudfront extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.cloudfront = this.setupCloudfront(props);
+        this.addStaticResources(props, this.cloudfront);
+        this.addDnsRecords(this.cloudfront, props);
+    }
+    /**
+     * Add static contents to cloudfront
+     *
+     * Creates a bucket, deploys contents from a folder and adds it to
+     * the cloudfront distribution.
+     *
+     * @param cloudfrontDistribution the distribution for these resources
+     */
+    addStaticResources(props, cloudfrontDistribution) {
+        const staticResourcesBucket = this.staticResourcesBucket();
+        const originAccessIdentity = new aws_cloudfront_1.OriginAccessIdentity(this, 'publicresourcesbucket-oia');
+        this.allowOriginAccessIdentityAccessToBucket(originAccessIdentity, staticResourcesBucket);
+        const origin = new aws_cloudfront_origins_1.S3Origin(staticResourcesBucket, {
+            originAccessIdentity: originAccessIdentity,
+        });
+        cloudfrontDistribution.addBehavior('/static/*', origin, {
+            viewerProtocolPolicy: aws_cloudfront_1.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        });
+        cloudfrontDistribution.addBehavior('/.well-known/*', origin, {
+            viewerProtocolPolicy: aws_cloudfront_1.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        });
+        this.deployBucket(props, staticResourcesBucket, cloudfrontDistribution);
+    }
+    /**
+     * Create a cloudfront distribution for the application
+     *
+     * Do not forward the Host header to API Gateway. This results in
+     * an HTTP 403 because API Gateway won't be able to find an endpoint
+     * on the cloudfront domain.
+     *
+     * @param {string} apiGatewayDomain the domain the api gateway can be reached at
+     * @returns {Distribution} the cloudfront distribution
+     */
+    setupCloudfront(props) {
+        let defaultPath = props.webappOptions.defaultPath;
+        if (defaultPath.startsWith('/')) {
+            defaultPath = defaultPath.substring(1); // Strip leading /
+        }
+        const distribution = new aws_cloudfront_1.Distribution(this, 'cf-distribution', {
+            priceClass: aws_cloudfront_1.PriceClass.PRICE_CLASS_100,
+            domainNames: this.domainNames(props),
+            certificate: props.webappOptions.cloudFrontCertificate,
+            defaultBehavior: {
+                origin: new aws_cloudfront_origins_1.HttpOrigin(props.apiGatewayDomain),
+                originRequestPolicy: new aws_cloudfront_1.OriginRequestPolicy(this, 'cf-originrequestpolicy', {
+                    originRequestPolicyName: 'cfOriginRequestPolicyMijnUitkering',
+                    headerBehavior: aws_cloudfront_1.OriginRequestHeaderBehavior.allowList('Accept-Charset', 'Origin', 'Accept', 'Referer', 'Accept-Language', 'Accept-Datetime', 'Authoriz'),
+                }),
+                viewerProtocolPolicy: aws_cloudfront_1.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+                allowedMethods: aws_cloudfront_1.AllowedMethods.ALLOW_ALL,
+                cachePolicy: new aws_cloudfront_1.CachePolicy(this, 'cf-caching', {
+                    cachePolicyName: 'cfCachingSessionsMijnUitkering',
+                    cookieBehavior: aws_cloudfront_1.CacheCookieBehavior.all(),
+                    headerBehavior: aws_cloudfront_1.CacheHeaderBehavior.allowList('Authorization'),
+                    queryStringBehavior: aws_cloudfront_1.CacheQueryStringBehavior.all(),
+                    defaultTtl: aws_cdk_lib_1.Duration.seconds(0),
+                    minTtl: aws_cdk_lib_1.Duration.seconds(0),
+                    maxTtl: aws_cdk_lib_1.Duration.seconds(1),
+                }),
+                responseHeadersPolicy: this.responseHeadersPolicy(props),
+            },
+            errorResponses: this.errorResponses(),
+            logBucket: this.logBucket(),
+            minimumProtocolVersion: aws_cloudfront_1.SecurityPolicyProtocol.TLS_V1_2_2021,
+            defaultRootObject: defaultPath,
+        });
+        return distribution;
+    }
+    errorResponses() {
+        const errorCodes = [403, 404, 500, 503];
+        return errorCodes.map(code => {
+            return {
+                httpStatus: code,
+                responseHttpStatus: code,
+                responsePagePath: `/static/http-errors/${code}.html`,
+            };
+        });
+    }
+    /**
+     * Add DNS records for cloudfront to the Route53 Zone
+     *
+     * Requests to the custom domain will correctly use cloudfront.
+     *
+     * @param distribution the cloudfront distribution
+     */
+    addDnsRecords(distribution, props) {
+        new aws_cdk_lib_1.aws_route53.ARecord(this, 'a-record', {
+            zone: props.webappOptions.hostedZone,
+            target: aws_cdk_lib_1.aws_route53.RecordTarget.fromAlias(new aws_cdk_lib_1.aws_route53_targets.CloudFrontTarget(distribution)),
+        });
+        new aws_cdk_lib_1.aws_route53.AaaaRecord(this, 'aaaa-record', {
+            zone: props.webappOptions.hostedZone,
+            target: aws_cdk_lib_1.aws_route53.RecordTarget.fromAlias(new aws_cdk_lib_1.aws_route53_targets.CloudFrontTarget(distribution)),
+        });
+    }
+    /**
+     * Create a bucket to hold cloudfront logs
+     * @returns s3.Bucket
+     */
+    logBucket() {
+        const cfLogBucket = new aws_cdk_lib_1.aws_s3.Bucket(this, 'CloudfrontLogs', {
+            blockPublicAccess: aws_cdk_lib_1.aws_s3.BlockPublicAccess.BLOCK_ALL,
+            eventBridgeEnabled: true,
+            enforceSSL: true,
+            encryption: aws_cdk_lib_1.aws_s3.BucketEncryption.S3_MANAGED,
+            objectOwnership: aws_cdk_lib_1.aws_s3.ObjectOwnership.OBJECT_WRITER,
+            lifecycleRules: [
+                {
+                    id: 'delete objects after 180 days',
+                    enabled: true,
+                    expiration: aws_cdk_lib_1.Duration.days(180),
+                },
+            ],
+        });
+        return cfLogBucket;
+    }
+    /**
+     * Get a set of (security) response headers to inject into the response
+     * @returns {ResponseHeadersPolicy} cloudfront responseHeadersPolicy
+     */
+    responseHeadersPolicy(props) {
+        const csp = props.webappOptions.cspHeaderValue ?? this.cspHeaderValue();
+        const responseHeadersPolicy = new aws_cloudfront_1.ResponseHeadersPolicy(this, 'headers', {
+            securityHeadersBehavior: {
+                contentSecurityPolicy: { contentSecurityPolicy: csp, override: true },
+                contentTypeOptions: { override: true },
+                frameOptions: { frameOption: aws_cloudfront_1.HeadersFrameOption.DENY, override: true },
+                referrerPolicy: { referrerPolicy: aws_cloudfront_1.HeadersReferrerPolicy.NO_REFERRER, override: true },
+                strictTransportSecurity: { accessControlMaxAge: aws_cdk_lib_1.Duration.days(366), includeSubdomains: true, override: true },
+            },
+            customHeadersBehavior: {
+                customHeaders: [
+                    {
+                        header: 'Cache-Control',
+                        value: 'no-cache, no-store, must-revalidate',
+                        override: false,
+                    },
+                    {
+                        header: 'Pragma',
+                        value: 'no-cache',
+                        override: false,
+                    },
+                    {
+                        header: 'Expires',
+                        value: '0',
+                        override: false,
+                    },
+                ],
+            },
+        });
+        return responseHeadersPolicy;
+    }
+    /**
+     * Get the cleaned, trimmed header values for the csp header
+     *
+     * @returns string csp header values
+     */
+    cspHeaderValue() {
+        const cspValues = 'default-src \'self\';\
+    frame-ancestors \'self\';\
+    frame-src \'self\';\
+    connect-src \'self\' https://componenten.nijmegen.nl;\
+    style-src \'self\' https://componenten.nijmegen.nl https://fonts.googleapis.com https://fonts.gstatic.com \
+    \'sha256-hS1LM/30PjUBJK3kBX9Vm9eOAhQNCiNhf/SCDnUqu14=\' \'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=\' \'sha256-OTeu7NEHDo6qutIWo0F2TmYrDhsKWCzrUgGoxxHGJ8o=\';\
+    script-src \'self\' https://componenten.nijmegen.nl https://siteimproveanalytics.com;\
+    font-src \'self\' https://componenten.nijmegen.nl https://fonts.gstatic.com;\
+    img-src \'self\' https://componenten.nijmegen.nl data: https://*.siteimproveanalytics.io;\
+    object-src \'none\';\
+    ';
+        return cspValues.replace(/[ ]+/g, ' ').trim();
+    }
+    /**
+     * Create an s3 bucket to hold static resources.
+     * Must be unencrypted to allow cloudfront to serve
+     * these resources.
+     *
+     * @returns S3.Bucket
+     */
+    staticResourcesBucket() {
+        const bucket = new aws_cdk_lib_1.aws_s3.Bucket(this, 'resources-bucket', {
+            blockPublicAccess: aws_cdk_lib_1.aws_s3.BlockPublicAccess.BLOCK_ALL,
+            eventBridgeEnabled: true,
+            enforceSSL: true,
+            encryption: aws_cdk_lib_1.aws_s3.BucketEncryption.UNENCRYPTED,
+        });
+        return bucket;
+    }
+    /**
+     * Allow listBucket to the origin access identity
+     *
+     * Necessary so cloudfront receives 404's as 404 instead of 403. This also allows
+     * a listing of the bucket if no /index.html is present in the bucket.
+     *
+     * @param originAccessIdentity
+     * @param bucket
+     */
+    allowOriginAccessIdentityAccessToBucket(originAccessIdentity, bucket) {
+        bucket.addToResourcePolicy(new aws_cdk_lib_1.aws_iam.PolicyStatement({
+            resources: [
+                `${bucket.bucketArn}`,
+                `${bucket.bucketArn}/*`,
+            ],
+            actions: [
+                's3:GetObject',
+                's3:ListBucket',
+            ],
+            effect: aws_cdk_lib_1.aws_iam.Effect.ALLOW,
+            principals: [originAccessIdentity.grantPrincipal],
+        }));
+    }
+    /**
+     * Deploy contents of folder to the s3 bucket
+     *
+     * Invalidates the correct cloudfront path
+     * @param bucket s3.Bucket
+     * @param distribution Distribution
+     */
+    deployBucket(props, bucket, distribution) {
+        // Do some synth time validation on the directory provided!
+        const staticDir = path.join(props.webappOptions.staticResourcesDirectory, 'static');
+        if (!fs.existsSync(staticDir)) {
+            throw Error(`Thers no directory for statics. Expected: ${staticDir}`);
+        }
+        const wellKnown = path.join(props.webappOptions.staticResourcesDirectory, '.well-known');
+        if (!fs.existsSync(wellKnown)) {
+            throw Error(`Thers no directory for .well-known. Expected: ${wellKnown}`);
+        }
+        //Deploy static resources to s3
+        new aws_cdk_lib_1.aws_s3_deployment.BucketDeployment(this, 'staticResources', {
+            sources: [aws_cdk_lib_1.aws_s3_deployment.Source.asset(props.webappOptions.staticResourcesDirectory)],
+            destinationBucket: bucket,
+            distribution: distribution,
+            distributionPaths: ['/static/*', '/.well-known/'],
+        });
+    }
+    domainNames(props) {
+        let cloudfrontDomainNames = props.webappOptions.alternativeDomainNames ?? [];
+        cloudfrontDomainNames.push(props.webappOptions.domainName);
+        return cloudfrontDomainNames;
+    }
+}
+exports.Cloudfront = Cloudfront;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ2xvdWRmcm9udC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy93ZWJhcHAvQ2xvdWRmcm9udC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSx5QkFBeUI7QUFDekIsNkJBQTZCO0FBQzdCLDZDQU9xQjtBQUNyQiwrREFnQm9DO0FBQ3BDLCtFQUEwRTtBQUMxRSwyQ0FBdUM7QUFVdkMsTUFBYSxVQUFXLFNBQVEsc0JBQVM7SUFJdkMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFzQjtRQUM5RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pCLElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUM5QyxJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNoRCxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSyxrQkFBa0IsQ0FBQyxLQUFzQixFQUFFLHNCQUFvQztRQUNyRixNQUFNLHFCQUFxQixHQUFHLElBQUksQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1FBQzNELE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxxQ0FBb0IsQ0FBQyxJQUFJLEVBQUUsMkJBQTJCLENBQUMsQ0FBQztRQUN6RixJQUFJLENBQUMsdUNBQXVDLENBQUMsb0JBQW9CLEVBQUUscUJBQXFCLENBQUMsQ0FBQztRQUMxRixNQUFNLE1BQU0sR0FBRyxJQUFJLGlDQUFRLENBQUMscUJBQXFCLEVBQUU7WUFDakQsb0JBQW9CLEVBQUUsb0JBQW9CO1NBQzNDLENBQUMsQ0FBQztRQUNILHNCQUFzQixDQUFDLFdBQVcsQ0FDaEMsV0FBVyxFQUNYLE1BQU0sRUFDTjtZQUNFLG9CQUFvQixFQUFFLHFDQUFvQixDQUFDLGlCQUFpQjtTQUM3RCxDQUNGLENBQUM7UUFDRixzQkFBc0IsQ0FBQyxXQUFXLENBQ2hDLGdCQUFnQixFQUNoQixNQUFNLEVBQ047WUFDRSxvQkFBb0IsRUFBRSxxQ0FBb0IsQ0FBQyxpQkFBaUI7U0FDN0QsQ0FDRixDQUFDO1FBQ0YsSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUscUJBQXFCLEVBQUUsc0JBQXNCLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0gsZUFBZSxDQUFDLEtBQXNCO1FBRXBDLElBQUksV0FBVyxHQUFHLEtBQUssQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDO1FBQ2xELElBQUksV0FBVyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsRUFBRTtZQUMvQixXQUFXLEdBQUcsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLGtCQUFrQjtTQUMzRDtRQUVELE1BQU0sWUFBWSxHQUFHLElBQUksNkJBQVksQ0FBQyxJQUFJLEVBQUUsaUJBQWlCLEVBQUU7WUFDN0QsVUFBVSxFQUFFLDJCQUFVLENBQUMsZUFBZTtZQUN0QyxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUM7WUFDcEMsV0FBVyxFQUFFLEtBQUssQ0FBQyxhQUFhLENBQUMscUJBQXFCO1lBQ3RELGVBQWUsRUFBRTtnQkFDZixNQUFNLEVBQUUsSUFBSSxtQ0FBVSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztnQkFDOUMsbUJBQW1CLEVBQUUsSUFBSSxvQ0FBbUIsQ0FBQyxJQUFJLEVBQUUsd0JBQXdCLEVBQUU7b0JBQzNFLHVCQUF1QixFQUFFLG9DQUFvQztvQkFDN0QsY0FBYyxFQUFFLDRDQUEyQixDQUFDLFNBQVMsQ0FDbkQsZ0JBQWdCLEVBQ2hCLFFBQVEsRUFDUixRQUFRLEVBQ1IsU0FBUyxFQUNULGlCQUFpQixFQUNqQixpQkFBaUIsRUFDakIsVUFBVSxDQUNYO2lCQUNGLENBQUM7Z0JBQ0Ysb0JBQW9CLEVBQUUscUNBQW9CLENBQUMsaUJBQWlCO2dCQUM1RCxjQUFjLEVBQUUsK0JBQWMsQ0FBQyxTQUFTO2dCQUN4QyxXQUFXLEVBQUUsSUFBSSw0QkFBVyxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUU7b0JBQy9DLGVBQWUsRUFBRSxnQ0FBZ0M7b0JBQ2pELGNBQWMsRUFBRSxvQ0FBbUIsQ0FBQyxHQUFHLEVBQUU7b0JBQ3pDLGNBQWMsRUFBRSxvQ0FBbUIsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDO29CQUM5RCxtQkFBbUIsRUFBRSx5Q0FBd0IsQ0FBQyxHQUFHLEVBQUU7b0JBQ25ELFVBQVUsRUFBRSxzQkFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7b0JBQy9CLE1BQU0sRUFBRSxzQkFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7b0JBQzNCLE1BQU0sRUFBRSxzQkFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7aUJBQzVCLENBQUM7Z0JBQ0YscUJBQXFCLEVBQUUsSUFBSSxDQUFDLHFCQUFxQixDQUFDLEtBQUssQ0FBQzthQUN6RDtZQUNELGNBQWMsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFO1lBQ3JDLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFO1lBQzNCLHNCQUFzQixFQUFFLHVDQUFzQixDQUFDLGFBQWE7WUFDNUQsaUJBQWlCLEVBQUUsV0FBVztTQUMvQixDQUFDLENBQUM7UUFDSCxPQUFPLFlBQVksQ0FBQztJQUN0QixDQUFDO0lBRU8sY0FBYztRQUNwQixNQUFNLFVBQVUsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRTtZQUMzQixPQUFPO2dCQUNMLFVBQVUsRUFBRSxJQUFJO2dCQUNoQixrQkFBa0IsRUFBRSxJQUFJO2dCQUN4QixnQkFBZ0IsRUFBRSx1QkFBdUIsSUFBSSxPQUFPO2FBQ3JELENBQUM7UUFDSixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxhQUFhLENBQUMsWUFBMEIsRUFBRSxLQUFzQjtRQUU5RCxJQUFJLHlCQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUU7WUFDcEMsSUFBSSxFQUFFLEtBQUssQ0FBQyxhQUFhLENBQUMsVUFBVTtZQUNwQyxNQUFNLEVBQUUseUJBQU8sQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLElBQUksaUNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxZQUFZLENBQUMsQ0FBQztTQUMxRixDQUFDLENBQUM7UUFFSCxJQUFJLHlCQUFPLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxhQUFhLEVBQUU7WUFDMUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxhQUFhLENBQUMsVUFBVTtZQUNwQyxNQUFNLEVBQUUseUJBQU8sQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLElBQUksaUNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxZQUFZLENBQUMsQ0FBQztTQUMxRixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsU0FBUztRQUNQLE1BQU0sV0FBVyxHQUFHLElBQUksb0JBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLGdCQUFnQixFQUFFO1lBQ3hELGlCQUFpQixFQUFFLG9CQUFFLENBQUMsaUJBQWlCLENBQUMsU0FBUztZQUNqRCxrQkFBa0IsRUFBRSxJQUFJO1lBQ3hCLFVBQVUsRUFBRSxJQUFJO1lBQ2hCLFVBQVUsRUFBRSxvQkFBRSxDQUFDLGdCQUFnQixDQUFDLFVBQVU7WUFDMUMsZUFBZSxFQUFFLG9CQUFFLENBQUMsZUFBZSxDQUFDLGFBQWE7WUFDakQsY0FBYyxFQUFFO2dCQUNkO29CQUNFLEVBQUUsRUFBRSwrQkFBK0I7b0JBQ25DLE9BQU8sRUFBRSxJQUFJO29CQUNiLFVBQVUsRUFBRSxzQkFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7aUJBQy9CO2FBQ0Y7U0FDRixDQUFDLENBQUM7UUFDSCxPQUFPLFdBQVcsQ0FBQztJQUNyQixDQUFDO0lBR0Q7OztPQUdHO0lBQ0gscUJBQXFCLENBQUMsS0FBc0I7UUFFMUMsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLGFBQWEsQ0FBQyxjQUFjLElBQUksSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQ3hFLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxzQ0FBcUIsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFO1lBQ3ZFLHVCQUF1QixFQUFFO2dCQUN2QixxQkFBcUIsRUFBRSxFQUFFLHFCQUFxQixFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFO2dCQUNyRSxrQkFBa0IsRUFBRSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUU7Z0JBQ3RDLFlBQVksRUFBRSxFQUFFLFdBQVcsRUFBRSxtQ0FBa0IsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRTtnQkFDdEUsY0FBYyxFQUFFLEVBQUUsY0FBYyxFQUFFLHNDQUFxQixDQUFDLFdBQVcsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFO2dCQUNyRix1QkFBdUIsRUFBRSxFQUFFLG1CQUFtQixFQUFFLHNCQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLGlCQUFpQixFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFO2FBQzlHO1lBQ0QscUJBQXFCLEVBQUU7Z0JBQ3JCLGFBQWEsRUFBRTtvQkFDYjt3QkFDRSxNQUFNLEVBQUUsZUFBZTt3QkFDdkIsS0FBSyxFQUFFLHFDQUFxQzt3QkFDNUMsUUFBUSxFQUFFLEtBQUs7cUJBQ2hCO29CQUNEO3dCQUNFLE1BQU0sRUFBRSxRQUFRO3dCQUNoQixLQUFLLEVBQUUsVUFBVTt3QkFDakIsUUFBUSxFQUFFLEtBQUs7cUJBQ2hCO29CQUNEO3dCQUNFLE1BQU0sRUFBRSxTQUFTO3dCQUNqQixLQUFLLEVBQUUsR0FBRzt3QkFDVixRQUFRLEVBQUUsS0FBSztxQkFDaEI7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUNILE9BQU8scUJBQXFCLENBQUM7SUFDL0IsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxjQUFjO1FBQ1osTUFBTSxTQUFTLEdBQUc7Ozs7Ozs7Ozs7S0FVakIsQ0FBQztRQUNGLE9BQU8sU0FBUyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDaEQsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNILHFCQUFxQjtRQUNuQixNQUFNLE1BQU0sR0FBRyxJQUFJLG9CQUFFLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxrQkFBa0IsRUFBRTtZQUNyRCxpQkFBaUIsRUFBRSxvQkFBRSxDQUFDLGlCQUFpQixDQUFDLFNBQVM7WUFDakQsa0JBQWtCLEVBQUUsSUFBSTtZQUN4QixVQUFVLEVBQUUsSUFBSTtZQUNoQixVQUFVLEVBQUUsb0JBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxXQUFXO1NBQzVDLENBQUMsQ0FBQztRQUVILE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFRDs7Ozs7Ozs7T0FRRztJQUNILHVDQUF1QyxDQUFDLG9CQUEwQyxFQUFFLE1BQWlCO1FBQ25HLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLHFCQUFHLENBQUMsZUFBZSxDQUFDO1lBQ2pELFNBQVMsRUFBRTtnQkFDVCxHQUFHLE1BQU0sQ0FBQyxTQUFTLEVBQUU7Z0JBQ3JCLEdBQUcsTUFBTSxDQUFDLFNBQVMsSUFBSTthQUN4QjtZQUNELE9BQU8sRUFBRTtnQkFDUCxjQUFjO2dCQUNkLGVBQWU7YUFDaEI7WUFDRCxNQUFNLEVBQUUscUJBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztZQUN4QixVQUFVLEVBQUUsQ0FBQyxvQkFBb0IsQ0FBQyxjQUFjLENBQUM7U0FDbEQsQ0FBQyxDQUNELENBQUM7SUFDSixDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0gsWUFBWSxDQUFDLEtBQXNCLEVBQUUsTUFBaUIsRUFBRSxZQUEwQjtRQUVoRiwyREFBMkQ7UUFDM0QsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLHdCQUF3QixFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3BGLElBQUksQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFO1lBQzdCLE1BQU0sS0FBSyxDQUFDLDZDQUE2QyxTQUFTLEVBQUUsQ0FBQyxDQUFDO1NBQ3ZFO1FBRUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLHdCQUF3QixFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBQ3pGLElBQUksQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFO1lBQzdCLE1BQU0sS0FBSyxDQUFDLGlEQUFpRCxTQUFTLEVBQUUsQ0FBQyxDQUFDO1NBQzNFO1FBRUQsK0JBQStCO1FBQy9CLElBQUksK0JBQWlCLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLGlCQUFpQixFQUFFO1lBQzlELE9BQU8sRUFBRSxDQUFDLCtCQUFpQixDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1lBQ3ZGLGlCQUFpQixFQUFFLE1BQU07WUFDekIsWUFBWSxFQUFFLFlBQVk7WUFDMUIsaUJBQWlCLEVBQUUsQ0FBQyxXQUFXLEVBQUUsZUFBZSxDQUFDO1NBQ2xELENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxXQUFXLENBQUMsS0FBc0I7UUFDeEMsSUFBSSxxQkFBcUIsR0FBRyxLQUFLLENBQUMsYUFBYSxDQUFDLHNCQUFzQixJQUFJLEVBQUUsQ0FBQztRQUM3RSxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMzRCxPQUFPLHFCQUFxQixDQUFDO0lBQy9CLENBQUM7Q0FFRjtBQWpTRCxnQ0FpU0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBmcyBmcm9tICdmcyc7XG5pbXBvcnQgKiBhcyBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHtcbiAgRHVyYXRpb24sXG4gIGF3c19yb3V0ZTUzIGFzIFJvdXRlNTMsXG4gIGF3c19yb3V0ZTUzX3RhcmdldHMgYXMgUm91dGU1M1RhcmdldHMsXG4gIGF3c19zMyBhcyBTMyxcbiAgYXdzX3MzX2RlcGxveW1lbnQsXG4gIGF3c19pYW0gYXMgSUFNLFxufSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQge1xuICBEaXN0cmlidXRpb24sXG4gIFByaWNlQ2xhc3MsXG4gIE9yaWdpblJlcXVlc3RQb2xpY3ksXG4gIFZpZXdlclByb3RvY29sUG9saWN5LFxuICBBbGxvd2VkTWV0aG9kcyxcbiAgUmVzcG9uc2VIZWFkZXJzUG9saWN5LFxuICBIZWFkZXJzRnJhbWVPcHRpb24sXG4gIEhlYWRlcnNSZWZlcnJlclBvbGljeSxcbiAgQ2FjaGVQb2xpY3ksXG4gIE9yaWdpblJlcXVlc3RIZWFkZXJCZWhhdmlvcixcbiAgQ2FjaGVDb29raWVCZWhhdmlvcixcbiAgQ2FjaGVIZWFkZXJCZWhhdmlvcixcbiAgQ2FjaGVRdWVyeVN0cmluZ0JlaGF2aW9yLFxuICBTZWN1cml0eVBvbGljeVByb3RvY29sLFxuICBPcmlnaW5BY2Nlc3NJZGVudGl0eSxcbn0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWNsb3VkZnJvbnQnO1xuaW1wb3J0IHsgSHR0cE9yaWdpbiwgUzNPcmlnaW4gfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtY2xvdWRmcm9udC1vcmlnaW5zJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgV2ViYXBwQ29uZmlndXJhYmxlIH0gZnJvbSAnLi9XZWJhcHBPcHRpb25zJztcblxuZXhwb3J0IGludGVyZmFjZSBDbG91ZEZyb250UHJvcHMgZXh0ZW5kcyBXZWJhcHBDb25maWd1cmFibGUge1xuICAvKipcbiAgICogVGhlIGRvbWFpbiBuYW1lIG9mIHRoZSBBUEkgZ2F0ZXdheSB0byBmb3J3YXJkIHJlcXVlc3RzIHRvLlxuICAgKi9cbiAgYXBpR2F0ZXdheURvbWFpbjogc3RyaW5nO1xufVxuXG5leHBvcnQgY2xhc3MgQ2xvdWRmcm9udCBleHRlbmRzIENvbnN0cnVjdCB7XG5cbiAgY2xvdWRmcm9udDogRGlzdHJpYnV0aW9uO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBDbG91ZEZyb250UHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIHRoaXMuY2xvdWRmcm9udCA9IHRoaXMuc2V0dXBDbG91ZGZyb250KHByb3BzKTtcbiAgICB0aGlzLmFkZFN0YXRpY1Jlc291cmNlcyhwcm9wcywgdGhpcy5jbG91ZGZyb250KTtcbiAgICB0aGlzLmFkZERuc1JlY29yZHModGhpcy5jbG91ZGZyb250LCBwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQWRkIHN0YXRpYyBjb250ZW50cyB0byBjbG91ZGZyb250XG4gICAqXG4gICAqIENyZWF0ZXMgYSBidWNrZXQsIGRlcGxveXMgY29udGVudHMgZnJvbSBhIGZvbGRlciBhbmQgYWRkcyBpdCB0b1xuICAgKiB0aGUgY2xvdWRmcm9udCBkaXN0cmlidXRpb24uXG4gICAqXG4gICAqIEBwYXJhbSBjbG91ZGZyb250RGlzdHJpYnV0aW9uIHRoZSBkaXN0cmlidXRpb24gZm9yIHRoZXNlIHJlc291cmNlc1xuICAgKi9cbiAgcHJpdmF0ZSBhZGRTdGF0aWNSZXNvdXJjZXMocHJvcHM6IENsb3VkRnJvbnRQcm9wcywgY2xvdWRmcm9udERpc3RyaWJ1dGlvbjogRGlzdHJpYnV0aW9uKSB7XG4gICAgY29uc3Qgc3RhdGljUmVzb3VyY2VzQnVja2V0ID0gdGhpcy5zdGF0aWNSZXNvdXJjZXNCdWNrZXQoKTtcbiAgICBjb25zdCBvcmlnaW5BY2Nlc3NJZGVudGl0eSA9IG5ldyBPcmlnaW5BY2Nlc3NJZGVudGl0eSh0aGlzLCAncHVibGljcmVzb3VyY2VzYnVja2V0LW9pYScpO1xuICAgIHRoaXMuYWxsb3dPcmlnaW5BY2Nlc3NJZGVudGl0eUFjY2Vzc1RvQnVja2V0KG9yaWdpbkFjY2Vzc0lkZW50aXR5LCBzdGF0aWNSZXNvdXJjZXNCdWNrZXQpO1xuICAgIGNvbnN0IG9yaWdpbiA9IG5ldyBTM09yaWdpbihzdGF0aWNSZXNvdXJjZXNCdWNrZXQsIHtcbiAgICAgIG9yaWdpbkFjY2Vzc0lkZW50aXR5OiBvcmlnaW5BY2Nlc3NJZGVudGl0eSxcbiAgICB9KTtcbiAgICBjbG91ZGZyb250RGlzdHJpYnV0aW9uLmFkZEJlaGF2aW9yKFxuICAgICAgJy9zdGF0aWMvKicsXG4gICAgICBvcmlnaW4sXG4gICAgICB7XG4gICAgICAgIHZpZXdlclByb3RvY29sUG9saWN5OiBWaWV3ZXJQcm90b2NvbFBvbGljeS5SRURJUkVDVF9UT19IVFRQUyxcbiAgICAgIH0sXG4gICAgKTtcbiAgICBjbG91ZGZyb250RGlzdHJpYnV0aW9uLmFkZEJlaGF2aW9yKFxuICAgICAgJy8ud2VsbC1rbm93bi8qJyxcbiAgICAgIG9yaWdpbixcbiAgICAgIHtcbiAgICAgICAgdmlld2VyUHJvdG9jb2xQb2xpY3k6IFZpZXdlclByb3RvY29sUG9saWN5LlJFRElSRUNUX1RPX0hUVFBTLFxuICAgICAgfSxcbiAgICApO1xuICAgIHRoaXMuZGVwbG95QnVja2V0KHByb3BzLCBzdGF0aWNSZXNvdXJjZXNCdWNrZXQsIGNsb3VkZnJvbnREaXN0cmlidXRpb24pO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhIGNsb3VkZnJvbnQgZGlzdHJpYnV0aW9uIGZvciB0aGUgYXBwbGljYXRpb25cbiAgICpcbiAgICogRG8gbm90IGZvcndhcmQgdGhlIEhvc3QgaGVhZGVyIHRvIEFQSSBHYXRld2F5LiBUaGlzIHJlc3VsdHMgaW5cbiAgICogYW4gSFRUUCA0MDMgYmVjYXVzZSBBUEkgR2F0ZXdheSB3b24ndCBiZSBhYmxlIHRvIGZpbmQgYW4gZW5kcG9pbnRcbiAgICogb24gdGhlIGNsb3VkZnJvbnQgZG9tYWluLlxuICAgKlxuICAgKiBAcGFyYW0ge3N0cmluZ30gYXBpR2F0ZXdheURvbWFpbiB0aGUgZG9tYWluIHRoZSBhcGkgZ2F0ZXdheSBjYW4gYmUgcmVhY2hlZCBhdFxuICAgKiBAcmV0dXJucyB7RGlzdHJpYnV0aW9ufSB0aGUgY2xvdWRmcm9udCBkaXN0cmlidXRpb25cbiAgICovXG4gIHNldHVwQ2xvdWRmcm9udChwcm9wczogQ2xvdWRGcm9udFByb3BzKTogRGlzdHJpYnV0aW9uIHtcblxuICAgIGxldCBkZWZhdWx0UGF0aCA9IHByb3BzLndlYmFwcE9wdGlvbnMuZGVmYXVsdFBhdGg7XG4gICAgaWYgKGRlZmF1bHRQYXRoLnN0YXJ0c1dpdGgoJy8nKSkge1xuICAgICAgZGVmYXVsdFBhdGggPSBkZWZhdWx0UGF0aC5zdWJzdHJpbmcoMSk7IC8vIFN0cmlwIGxlYWRpbmcgL1xuICAgIH1cblxuICAgIGNvbnN0IGRpc3RyaWJ1dGlvbiA9IG5ldyBEaXN0cmlidXRpb24odGhpcywgJ2NmLWRpc3RyaWJ1dGlvbicsIHtcbiAgICAgIHByaWNlQ2xhc3M6IFByaWNlQ2xhc3MuUFJJQ0VfQ0xBU1NfMTAwLFxuICAgICAgZG9tYWluTmFtZXM6IHRoaXMuZG9tYWluTmFtZXMocHJvcHMpLFxuICAgICAgY2VydGlmaWNhdGU6IHByb3BzLndlYmFwcE9wdGlvbnMuY2xvdWRGcm9udENlcnRpZmljYXRlLFxuICAgICAgZGVmYXVsdEJlaGF2aW9yOiB7XG4gICAgICAgIG9yaWdpbjogbmV3IEh0dHBPcmlnaW4ocHJvcHMuYXBpR2F0ZXdheURvbWFpbiksXG4gICAgICAgIG9yaWdpblJlcXVlc3RQb2xpY3k6IG5ldyBPcmlnaW5SZXF1ZXN0UG9saWN5KHRoaXMsICdjZi1vcmlnaW5yZXF1ZXN0cG9saWN5Jywge1xuICAgICAgICAgIG9yaWdpblJlcXVlc3RQb2xpY3lOYW1lOiAnY2ZPcmlnaW5SZXF1ZXN0UG9saWN5TWlqblVpdGtlcmluZycsXG4gICAgICAgICAgaGVhZGVyQmVoYXZpb3I6IE9yaWdpblJlcXVlc3RIZWFkZXJCZWhhdmlvci5hbGxvd0xpc3QoXG4gICAgICAgICAgICAnQWNjZXB0LUNoYXJzZXQnLFxuICAgICAgICAgICAgJ09yaWdpbicsXG4gICAgICAgICAgICAnQWNjZXB0JyxcbiAgICAgICAgICAgICdSZWZlcmVyJyxcbiAgICAgICAgICAgICdBY2NlcHQtTGFuZ3VhZ2UnLFxuICAgICAgICAgICAgJ0FjY2VwdC1EYXRldGltZScsXG4gICAgICAgICAgICAnQXV0aG9yaXonLFxuICAgICAgICAgICksXG4gICAgICAgIH0pLFxuICAgICAgICB2aWV3ZXJQcm90b2NvbFBvbGljeTogVmlld2VyUHJvdG9jb2xQb2xpY3kuUkVESVJFQ1RfVE9fSFRUUFMsXG4gICAgICAgIGFsbG93ZWRNZXRob2RzOiBBbGxvd2VkTWV0aG9kcy5BTExPV19BTEwsXG4gICAgICAgIGNhY2hlUG9saWN5OiBuZXcgQ2FjaGVQb2xpY3kodGhpcywgJ2NmLWNhY2hpbmcnLCB7XG4gICAgICAgICAgY2FjaGVQb2xpY3lOYW1lOiAnY2ZDYWNoaW5nU2Vzc2lvbnNNaWpuVWl0a2VyaW5nJyxcbiAgICAgICAgICBjb29raWVCZWhhdmlvcjogQ2FjaGVDb29raWVCZWhhdmlvci5hbGwoKSxcbiAgICAgICAgICBoZWFkZXJCZWhhdmlvcjogQ2FjaGVIZWFkZXJCZWhhdmlvci5hbGxvd0xpc3QoJ0F1dGhvcml6YXRpb24nKSxcbiAgICAgICAgICBxdWVyeVN0cmluZ0JlaGF2aW9yOiBDYWNoZVF1ZXJ5U3RyaW5nQmVoYXZpb3IuYWxsKCksXG4gICAgICAgICAgZGVmYXVsdFR0bDogRHVyYXRpb24uc2Vjb25kcygwKSxcbiAgICAgICAgICBtaW5UdGw6IER1cmF0aW9uLnNlY29uZHMoMCksXG4gICAgICAgICAgbWF4VHRsOiBEdXJhdGlvbi5zZWNvbmRzKDEpLFxuICAgICAgICB9KSxcbiAgICAgICAgcmVzcG9uc2VIZWFkZXJzUG9saWN5OiB0aGlzLnJlc3BvbnNlSGVhZGVyc1BvbGljeShwcm9wcyksXG4gICAgICB9LFxuICAgICAgZXJyb3JSZXNwb25zZXM6IHRoaXMuZXJyb3JSZXNwb25zZXMoKSxcbiAgICAgIGxvZ0J1Y2tldDogdGhpcy5sb2dCdWNrZXQoKSxcbiAgICAgIG1pbmltdW1Qcm90b2NvbFZlcnNpb246IFNlY3VyaXR5UG9saWN5UHJvdG9jb2wuVExTX1YxXzJfMjAyMSxcbiAgICAgIGRlZmF1bHRSb290T2JqZWN0OiBkZWZhdWx0UGF0aCxcbiAgICB9KTtcbiAgICByZXR1cm4gZGlzdHJpYnV0aW9uO1xuICB9XG5cbiAgcHJpdmF0ZSBlcnJvclJlc3BvbnNlcygpIHtcbiAgICBjb25zdCBlcnJvckNvZGVzID0gWzQwMywgNDA0LCA1MDAsIDUwM107XG4gICAgcmV0dXJuIGVycm9yQ29kZXMubWFwKGNvZGUgPT4ge1xuICAgICAgcmV0dXJuIHtcbiAgICAgICAgaHR0cFN0YXR1czogY29kZSxcbiAgICAgICAgcmVzcG9uc2VIdHRwU3RhdHVzOiBjb2RlLFxuICAgICAgICByZXNwb25zZVBhZ2VQYXRoOiBgL3N0YXRpYy9odHRwLWVycm9ycy8ke2NvZGV9Lmh0bWxgLFxuICAgICAgfTtcbiAgICB9KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBBZGQgRE5TIHJlY29yZHMgZm9yIGNsb3VkZnJvbnQgdG8gdGhlIFJvdXRlNTMgWm9uZVxuICAgKlxuICAgKiBSZXF1ZXN0cyB0byB0aGUgY3VzdG9tIGRvbWFpbiB3aWxsIGNvcnJlY3RseSB1c2UgY2xvdWRmcm9udC5cbiAgICpcbiAgICogQHBhcmFtIGRpc3RyaWJ1dGlvbiB0aGUgY2xvdWRmcm9udCBkaXN0cmlidXRpb25cbiAgICovXG4gIGFkZERuc1JlY29yZHMoZGlzdHJpYnV0aW9uOiBEaXN0cmlidXRpb24sIHByb3BzOiBDbG91ZEZyb250UHJvcHMpIHtcblxuICAgIG5ldyBSb3V0ZTUzLkFSZWNvcmQodGhpcywgJ2EtcmVjb3JkJywge1xuICAgICAgem9uZTogcHJvcHMud2ViYXBwT3B0aW9ucy5ob3N0ZWRab25lLFxuICAgICAgdGFyZ2V0OiBSb3V0ZTUzLlJlY29yZFRhcmdldC5mcm9tQWxpYXMobmV3IFJvdXRlNTNUYXJnZXRzLkNsb3VkRnJvbnRUYXJnZXQoZGlzdHJpYnV0aW9uKSksXG4gICAgfSk7XG5cbiAgICBuZXcgUm91dGU1My5BYWFhUmVjb3JkKHRoaXMsICdhYWFhLXJlY29yZCcsIHtcbiAgICAgIHpvbmU6IHByb3BzLndlYmFwcE9wdGlvbnMuaG9zdGVkWm9uZSxcbiAgICAgIHRhcmdldDogUm91dGU1My5SZWNvcmRUYXJnZXQuZnJvbUFsaWFzKG5ldyBSb3V0ZTUzVGFyZ2V0cy5DbG91ZEZyb250VGFyZ2V0KGRpc3RyaWJ1dGlvbikpLFxuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhIGJ1Y2tldCB0byBob2xkIGNsb3VkZnJvbnQgbG9nc1xuICAgKiBAcmV0dXJucyBzMy5CdWNrZXRcbiAgICovXG4gIGxvZ0J1Y2tldCgpIHtcbiAgICBjb25zdCBjZkxvZ0J1Y2tldCA9IG5ldyBTMy5CdWNrZXQodGhpcywgJ0Nsb3VkZnJvbnRMb2dzJywge1xuICAgICAgYmxvY2tQdWJsaWNBY2Nlc3M6IFMzLkJsb2NrUHVibGljQWNjZXNzLkJMT0NLX0FMTCxcbiAgICAgIGV2ZW50QnJpZGdlRW5hYmxlZDogdHJ1ZSxcbiAgICAgIGVuZm9yY2VTU0w6IHRydWUsXG4gICAgICBlbmNyeXB0aW9uOiBTMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUQsXG4gICAgICBvYmplY3RPd25lcnNoaXA6IFMzLk9iamVjdE93bmVyc2hpcC5PQkpFQ1RfV1JJVEVSLFxuICAgICAgbGlmZWN5Y2xlUnVsZXM6IFtcbiAgICAgICAge1xuICAgICAgICAgIGlkOiAnZGVsZXRlIG9iamVjdHMgYWZ0ZXIgMTgwIGRheXMnLFxuICAgICAgICAgIGVuYWJsZWQ6IHRydWUsXG4gICAgICAgICAgZXhwaXJhdGlvbjogRHVyYXRpb24uZGF5cygxODApLFxuICAgICAgICB9LFxuICAgICAgXSxcbiAgICB9KTtcbiAgICByZXR1cm4gY2ZMb2dCdWNrZXQ7XG4gIH1cblxuXG4gIC8qKlxuICAgKiBHZXQgYSBzZXQgb2YgKHNlY3VyaXR5KSByZXNwb25zZSBoZWFkZXJzIHRvIGluamVjdCBpbnRvIHRoZSByZXNwb25zZVxuICAgKiBAcmV0dXJucyB7UmVzcG9uc2VIZWFkZXJzUG9saWN5fSBjbG91ZGZyb250IHJlc3BvbnNlSGVhZGVyc1BvbGljeVxuICAgKi9cbiAgcmVzcG9uc2VIZWFkZXJzUG9saWN5KHByb3BzOiBDbG91ZEZyb250UHJvcHMpOiBSZXNwb25zZUhlYWRlcnNQb2xpY3kge1xuXG4gICAgY29uc3QgY3NwID0gcHJvcHMud2ViYXBwT3B0aW9ucy5jc3BIZWFkZXJWYWx1ZSA/PyB0aGlzLmNzcEhlYWRlclZhbHVlKCk7XG4gICAgY29uc3QgcmVzcG9uc2VIZWFkZXJzUG9saWN5ID0gbmV3IFJlc3BvbnNlSGVhZGVyc1BvbGljeSh0aGlzLCAnaGVhZGVycycsIHtcbiAgICAgIHNlY3VyaXR5SGVhZGVyc0JlaGF2aW9yOiB7XG4gICAgICAgIGNvbnRlbnRTZWN1cml0eVBvbGljeTogeyBjb250ZW50U2VjdXJpdHlQb2xpY3k6IGNzcCwgb3ZlcnJpZGU6IHRydWUgfSxcbiAgICAgICAgY29udGVudFR5cGVPcHRpb25zOiB7IG92ZXJyaWRlOiB0cnVlIH0sXG4gICAgICAgIGZyYW1lT3B0aW9uczogeyBmcmFtZU9wdGlvbjogSGVhZGVyc0ZyYW1lT3B0aW9uLkRFTlksIG92ZXJyaWRlOiB0cnVlIH0sXG4gICAgICAgIHJlZmVycmVyUG9saWN5OiB7IHJlZmVycmVyUG9saWN5OiBIZWFkZXJzUmVmZXJyZXJQb2xpY3kuTk9fUkVGRVJSRVIsIG92ZXJyaWRlOiB0cnVlIH0sXG4gICAgICAgIHN0cmljdFRyYW5zcG9ydFNlY3VyaXR5OiB7IGFjY2Vzc0NvbnRyb2xNYXhBZ2U6IER1cmF0aW9uLmRheXMoMzY2KSwgaW5jbHVkZVN1YmRvbWFpbnM6IHRydWUsIG92ZXJyaWRlOiB0cnVlIH0sXG4gICAgICB9LFxuICAgICAgY3VzdG9tSGVhZGVyc0JlaGF2aW9yOiB7XG4gICAgICAgIGN1c3RvbUhlYWRlcnM6IFtcbiAgICAgICAgICB7XG4gICAgICAgICAgICBoZWFkZXI6ICdDYWNoZS1Db250cm9sJyxcbiAgICAgICAgICAgIHZhbHVlOiAnbm8tY2FjaGUsIG5vLXN0b3JlLCBtdXN0LXJldmFsaWRhdGUnLFxuICAgICAgICAgICAgb3ZlcnJpZGU6IGZhbHNlLFxuICAgICAgICAgIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgaGVhZGVyOiAnUHJhZ21hJyxcbiAgICAgICAgICAgIHZhbHVlOiAnbm8tY2FjaGUnLFxuICAgICAgICAgICAgb3ZlcnJpZGU6IGZhbHNlLFxuICAgICAgICAgIH0sXG4gICAgICAgICAge1xuICAgICAgICAgICAgaGVhZGVyOiAnRXhwaXJlcycsXG4gICAgICAgICAgICB2YWx1ZTogJzAnLFxuICAgICAgICAgICAgb3ZlcnJpZGU6IGZhbHNlLFxuICAgICAgICAgIH0sXG4gICAgICAgIF0sXG4gICAgICB9LFxuICAgIH0pO1xuICAgIHJldHVybiByZXNwb25zZUhlYWRlcnNQb2xpY3k7XG4gIH1cblxuICAvKipcbiAgICogR2V0IHRoZSBjbGVhbmVkLCB0cmltbWVkIGhlYWRlciB2YWx1ZXMgZm9yIHRoZSBjc3AgaGVhZGVyXG4gICAqXG4gICAqIEByZXR1cm5zIHN0cmluZyBjc3AgaGVhZGVyIHZhbHVlc1xuICAgKi9cbiAgY3NwSGVhZGVyVmFsdWUoKSB7XG4gICAgY29uc3QgY3NwVmFsdWVzID0gJ2RlZmF1bHQtc3JjIFxcJ3NlbGZcXCc7XFxcbiAgICBmcmFtZS1hbmNlc3RvcnMgXFwnc2VsZlxcJztcXFxuICAgIGZyYW1lLXNyYyBcXCdzZWxmXFwnO1xcXG4gICAgY29ubmVjdC1zcmMgXFwnc2VsZlxcJyBodHRwczovL2NvbXBvbmVudGVuLm5pam1lZ2VuLm5sO1xcXG4gICAgc3R5bGUtc3JjIFxcJ3NlbGZcXCcgaHR0cHM6Ly9jb21wb25lbnRlbi5uaWptZWdlbi5ubCBodHRwczovL2ZvbnRzLmdvb2dsZWFwaXMuY29tIGh0dHBzOi8vZm9udHMuZ3N0YXRpYy5jb20gXFxcbiAgICBcXCdzaGEyNTYtaFMxTE0vMzBQalVCSksza0JYOVZtOWVPQWhRTkNpTmhmL1NDRG5VcXUxND1cXCcgXFwnc2hhMjU2LTQ3REVRcGo4SEJTYSsvVEltVys1SkNldVFlUmttNU5NcEpXWkczaFN1RlU9XFwnIFxcJ3NoYTI1Ni1PVGV1N05FSERvNnF1dElXbzBGMlRtWXJEaHNLV0N6clVnR294eEhHSjhvPVxcJztcXFxuICAgIHNjcmlwdC1zcmMgXFwnc2VsZlxcJyBodHRwczovL2NvbXBvbmVudGVuLm5pam1lZ2VuLm5sIGh0dHBzOi8vc2l0ZWltcHJvdmVhbmFseXRpY3MuY29tO1xcXG4gICAgZm9udC1zcmMgXFwnc2VsZlxcJyBodHRwczovL2NvbXBvbmVudGVuLm5pam1lZ2VuLm5sIGh0dHBzOi8vZm9udHMuZ3N0YXRpYy5jb207XFxcbiAgICBpbWctc3JjIFxcJ3NlbGZcXCcgaHR0cHM6Ly9jb21wb25lbnRlbi5uaWptZWdlbi5ubCBkYXRhOiBodHRwczovLyouc2l0ZWltcHJvdmVhbmFseXRpY3MuaW87XFxcbiAgICBvYmplY3Qtc3JjIFxcJ25vbmVcXCc7XFxcbiAgICAnO1xuICAgIHJldHVybiBjc3BWYWx1ZXMucmVwbGFjZSgvWyBdKy9nLCAnICcpLnRyaW0oKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBDcmVhdGUgYW4gczMgYnVja2V0IHRvIGhvbGQgc3RhdGljIHJlc291cmNlcy5cbiAgICogTXVzdCBiZSB1bmVuY3J5cHRlZCB0byBhbGxvdyBjbG91ZGZyb250IHRvIHNlcnZlXG4gICAqIHRoZXNlIHJlc291cmNlcy5cbiAgICpcbiAgICogQHJldHVybnMgUzMuQnVja2V0XG4gICAqL1xuICBzdGF0aWNSZXNvdXJjZXNCdWNrZXQoKSB7XG4gICAgY29uc3QgYnVja2V0ID0gbmV3IFMzLkJ1Y2tldCh0aGlzLCAncmVzb3VyY2VzLWJ1Y2tldCcsIHtcbiAgICAgIGJsb2NrUHVibGljQWNjZXNzOiBTMy5CbG9ja1B1YmxpY0FjY2Vzcy5CTE9DS19BTEwsXG4gICAgICBldmVudEJyaWRnZUVuYWJsZWQ6IHRydWUsXG4gICAgICBlbmZvcmNlU1NMOiB0cnVlLFxuICAgICAgZW5jcnlwdGlvbjogUzMuQnVja2V0RW5jcnlwdGlvbi5VTkVOQ1JZUFRFRCxcbiAgICB9KTtcblxuICAgIHJldHVybiBidWNrZXQ7XG4gIH1cblxuICAvKipcbiAgICogQWxsb3cgbGlzdEJ1Y2tldCB0byB0aGUgb3JpZ2luIGFjY2VzcyBpZGVudGl0eVxuICAgKlxuICAgKiBOZWNlc3Nhcnkgc28gY2xvdWRmcm9udCByZWNlaXZlcyA0MDQncyBhcyA0MDQgaW5zdGVhZCBvZiA0MDMuIFRoaXMgYWxzbyBhbGxvd3NcbiAgICogYSBsaXN0aW5nIG9mIHRoZSBidWNrZXQgaWYgbm8gL2luZGV4Lmh0bWwgaXMgcHJlc2VudCBpbiB0aGUgYnVja2V0LlxuICAgKlxuICAgKiBAcGFyYW0gb3JpZ2luQWNjZXNzSWRlbnRpdHlcbiAgICogQHBhcmFtIGJ1Y2tldFxuICAgKi9cbiAgYWxsb3dPcmlnaW5BY2Nlc3NJZGVudGl0eUFjY2Vzc1RvQnVja2V0KG9yaWdpbkFjY2Vzc0lkZW50aXR5OiBPcmlnaW5BY2Nlc3NJZGVudGl0eSwgYnVja2V0OiBTMy5CdWNrZXQpIHtcbiAgICBidWNrZXQuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgSUFNLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgYCR7YnVja2V0LmJ1Y2tldEFybn1gLFxuICAgICAgICBgJHtidWNrZXQuYnVja2V0QXJufS8qYCxcbiAgICAgIF0sXG4gICAgICBhY3Rpb25zOiBbXG4gICAgICAgICdzMzpHZXRPYmplY3QnLFxuICAgICAgICAnczM6TGlzdEJ1Y2tldCcsXG4gICAgICBdLFxuICAgICAgZWZmZWN0OiBJQU0uRWZmZWN0LkFMTE9XLFxuICAgICAgcHJpbmNpcGFsczogW29yaWdpbkFjY2Vzc0lkZW50aXR5LmdyYW50UHJpbmNpcGFsXSxcbiAgICB9KSxcbiAgICApO1xuICB9XG5cbiAgLyoqXG4gICAqIERlcGxveSBjb250ZW50cyBvZiBmb2xkZXIgdG8gdGhlIHMzIGJ1Y2tldFxuICAgKlxuICAgKiBJbnZhbGlkYXRlcyB0aGUgY29ycmVjdCBjbG91ZGZyb250IHBhdGhcbiAgICogQHBhcmFtIGJ1Y2tldCBzMy5CdWNrZXRcbiAgICogQHBhcmFtIGRpc3RyaWJ1dGlvbiBEaXN0cmlidXRpb25cbiAgICovXG4gIGRlcGxveUJ1Y2tldChwcm9wczogQ2xvdWRGcm9udFByb3BzLCBidWNrZXQ6IFMzLkJ1Y2tldCwgZGlzdHJpYnV0aW9uOiBEaXN0cmlidXRpb24pIHtcblxuICAgIC8vIERvIHNvbWUgc3ludGggdGltZSB2YWxpZGF0aW9uIG9uIHRoZSBkaXJlY3RvcnkgcHJvdmlkZWQhXG4gICAgY29uc3Qgc3RhdGljRGlyID0gcGF0aC5qb2luKHByb3BzLndlYmFwcE9wdGlvbnMuc3RhdGljUmVzb3VyY2VzRGlyZWN0b3J5LCAnc3RhdGljJyk7XG4gICAgaWYgKCFmcy5leGlzdHNTeW5jKHN0YXRpY0RpcikpIHtcbiAgICAgIHRocm93IEVycm9yKGBUaGVycyBubyBkaXJlY3RvcnkgZm9yIHN0YXRpY3MuIEV4cGVjdGVkOiAke3N0YXRpY0Rpcn1gKTtcbiAgICB9XG5cbiAgICBjb25zdCB3ZWxsS25vd24gPSBwYXRoLmpvaW4ocHJvcHMud2ViYXBwT3B0aW9ucy5zdGF0aWNSZXNvdXJjZXNEaXJlY3RvcnksICcud2VsbC1rbm93bicpO1xuICAgIGlmICghZnMuZXhpc3RzU3luYyh3ZWxsS25vd24pKSB7XG4gICAgICB0aHJvdyBFcnJvcihgVGhlcnMgbm8gZGlyZWN0b3J5IGZvciAud2VsbC1rbm93bi4gRXhwZWN0ZWQ6ICR7d2VsbEtub3dufWApO1xuICAgIH1cblxuICAgIC8vRGVwbG95IHN0YXRpYyByZXNvdXJjZXMgdG8gczNcbiAgICBuZXcgYXdzX3MzX2RlcGxveW1lbnQuQnVja2V0RGVwbG95bWVudCh0aGlzLCAnc3RhdGljUmVzb3VyY2VzJywge1xuICAgICAgc291cmNlczogW2F3c19zM19kZXBsb3ltZW50LlNvdXJjZS5hc3NldChwcm9wcy53ZWJhcHBPcHRpb25zLnN0YXRpY1Jlc291cmNlc0RpcmVjdG9yeSldLFxuICAgICAgZGVzdGluYXRpb25CdWNrZXQ6IGJ1Y2tldCxcbiAgICAgIGRpc3RyaWJ1dGlvbjogZGlzdHJpYnV0aW9uLFxuICAgICAgZGlzdHJpYnV0aW9uUGF0aHM6IFsnL3N0YXRpYy8qJywgJy8ud2VsbC1rbm93bi8nXSxcbiAgICB9KTtcbiAgfVxuXG4gIHByaXZhdGUgZG9tYWluTmFtZXMocHJvcHM6IENsb3VkRnJvbnRQcm9wcykge1xuICAgIGxldCBjbG91ZGZyb250RG9tYWluTmFtZXMgPSBwcm9wcy53ZWJhcHBPcHRpb25zLmFsdGVybmF0aXZlRG9tYWluTmFtZXMgPz8gW107XG4gICAgY2xvdWRmcm9udERvbWFpbk5hbWVzLnB1c2gocHJvcHMud2ViYXBwT3B0aW9ucy5kb21haW5OYW1lKTtcbiAgICByZXR1cm4gY2xvdWRmcm9udERvbWFpbk5hbWVzO1xuICB9XG5cbn1cbiJdfQ==