@mavogel/awscdk-rootmail 0.0.336 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (50) hide show
  1. package/.codegraph/.gitignore +5 -0
  2. package/.jsii +460 -8
  3. package/CLAUDE.md +1 -1
  4. package/README.md +6 -1
  5. package/docs/plans/2026-08-09-bump-mvc-projen-cdk-nag-v3.md +199 -0
  6. package/integ-tests/integ.rootmail-custom-santa.ts +2 -2
  7. package/integ-tests/integ.rootmail-filter-subject.ts +2 -2
  8. package/integ-tests/integ.rootmail.ts +2 -2
  9. package/lib/hosted-zone-dkim-propagation.js +46 -15
  10. package/lib/hosted-zone-dkim-verification-records.js +47 -12
  11. package/lib/rootmail-autowire-dns.js +47 -15
  12. package/lib/rootmail.js +13 -16
  13. package/lib/ses-receipt-ruleset-activation.js +53 -15
  14. package/lib/ses-receive.js +12 -12
  15. package/node_modules/cdk-nag/.jsii +6331 -2945
  16. package/node_modules/cdk-nag/.jsii.tabl.json +1 -1
  17. package/node_modules/cdk-nag/API.md +490 -1778
  18. package/node_modules/cdk-nag/MIGRATION.md +239 -0
  19. package/node_modules/cdk-nag/README.md +88 -513
  20. package/node_modules/cdk-nag/lib/index.d.ts +0 -3
  21. package/node_modules/cdk-nag/lib/index.js +1 -4
  22. package/node_modules/cdk-nag/lib/nag-logger.d.ts +5 -145
  23. package/node_modules/cdk-nag/lib/nag-logger.js +4 -199
  24. package/node_modules/cdk-nag/lib/nag-pack.d.ts +57 -44
  25. package/node_modules/cdk-nag/lib/nag-pack.js +140 -114
  26. package/node_modules/cdk-nag/lib/nag-rules.d.ts +0 -2
  27. package/node_modules/cdk-nag/lib/nag-rules.js +3 -5
  28. package/node_modules/cdk-nag/lib/packs/aws-solutions.d.ts +4 -15
  29. package/node_modules/cdk-nag/lib/packs/aws-solutions.js +21 -40
  30. package/node_modules/cdk-nag/lib/packs/hipaa-security.d.ts +4 -2
  31. package/node_modules/cdk-nag/lib/packs/hipaa-security.js +31 -37
  32. package/node_modules/cdk-nag/lib/packs/nist-800-53-r4.d.ts +4 -2
  33. package/node_modules/cdk-nag/lib/packs/nist-800-53-r4.js +29 -35
  34. package/node_modules/cdk-nag/lib/packs/nist-800-53-r5.d.ts +4 -2
  35. package/node_modules/cdk-nag/lib/packs/nist-800-53-r5.js +30 -36
  36. package/node_modules/cdk-nag/lib/packs/pci-dss-321.d.ts +4 -2
  37. package/node_modules/cdk-nag/lib/packs/pci-dss-321.js +29 -35
  38. package/node_modules/cdk-nag/lib/packs/serverless.d.ts +4 -2
  39. package/node_modules/cdk-nag/lib/packs/serverless.js +14 -20
  40. package/node_modules/cdk-nag/lib/rules/ec2/EC2IMDSv2Enabled.js +5 -1
  41. package/node_modules/cdk-nag/package.json +5 -5
  42. package/package.json +16 -17
  43. package/node_modules/cdk-nag/lib/ignore-suppression-conditions.d.ts +0 -59
  44. package/node_modules/cdk-nag/lib/ignore-suppression-conditions.js +0 -97
  45. package/node_modules/cdk-nag/lib/models/nag-suppression.d.ts +0 -30
  46. package/node_modules/cdk-nag/lib/models/nag-suppression.js +0 -7
  47. package/node_modules/cdk-nag/lib/nag-suppressions.d.ts +0 -30
  48. package/node_modules/cdk-nag/lib/nag-suppressions.js +0 -96
  49. package/node_modules/cdk-nag/lib/utils/nag-suppression-helper.d.ts +0 -20
  50. package/node_modules/cdk-nag/lib/utils/nag-suppression-helper.js +0 -119
@@ -1,96 +0,0 @@
1
- "use strict";
2
- var _a;
3
- Object.defineProperty(exports, "__esModule", { value: true });
4
- exports.NagSuppressions = void 0;
5
- const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
6
- /*
7
- Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
8
- SPDX-License-Identifier: Apache-2.0
9
- */
10
- const aws_cdk_lib_1 = require("aws-cdk-lib");
11
- const nag_suppression_helper_1 = require("./utils/nag-suppression-helper");
12
- /**
13
- * Helper class with methods to add cdk-nag suppressions to cdk resources
14
- */
15
- class NagSuppressions {
16
- /**
17
- * Apply cdk-nag suppressions to a Stack and optionally nested stacks
18
- * @param stack The Stack to apply the suppression to
19
- * @param suppressions A list of suppressions to apply to the stack
20
- * @param applyToNestedStacks Apply the suppressions to children stacks (default:false)
21
- */
22
- static addStackSuppressions(stack, suppressions, applyToNestedStacks = false) {
23
- const stacks = applyToNestedStacks
24
- ? stack.node.findAll().filter((x) => x instanceof aws_cdk_lib_1.Stack)
25
- : [stack];
26
- stacks.forEach((s) => {
27
- nag_suppression_helper_1.NagSuppressionHelper.assertSuppressionsAreValid(s.node.id, suppressions);
28
- let metadata = s.templateOptions.metadata?.cdk_nag ?? {};
29
- metadata = nag_suppression_helper_1.NagSuppressionHelper.addRulesToMetadata(metadata, suppressions);
30
- if (!s.templateOptions.metadata) {
31
- s.templateOptions.metadata = {};
32
- }
33
- s.templateOptions.metadata.cdk_nag = metadata;
34
- });
35
- }
36
- /**
37
- * Add cdk-nag suppressions to a CfnResource and optionally its children
38
- * @param construct The IConstruct(s) to apply the suppression to
39
- * @param suppressions A list of suppressions to apply to the resource
40
- * @param applyToChildren Apply the suppressions to children CfnResources (default:false)
41
- */
42
- static addResourceSuppressions(construct, suppressions, applyToChildren = false) {
43
- const constructArray = Array.isArray(construct)
44
- ? construct
45
- : [construct];
46
- if (constructArray.length === 0) {
47
- throw new Error(`Construct cannot be an empty array.`);
48
- }
49
- constructArray.forEach((c) => {
50
- nag_suppression_helper_1.NagSuppressionHelper.assertSuppressionsAreValid(c.node.id, suppressions);
51
- const constructs = applyToChildren ? c.node.findAll() : [c];
52
- for (const child of constructs) {
53
- const possibleL1 = child.node.defaultChild
54
- ? child.node.defaultChild
55
- : child;
56
- if (possibleL1 instanceof aws_cdk_lib_1.CfnResource) {
57
- const resource = possibleL1;
58
- let metadata = resource.getMetadata('cdk_nag');
59
- metadata = nag_suppression_helper_1.NagSuppressionHelper.addRulesToMetadata(metadata, suppressions);
60
- resource.addMetadata('cdk_nag', metadata);
61
- }
62
- }
63
- });
64
- }
65
- /**
66
- * Add cdk-nag suppressions to a CfnResource and optionally its children via its path
67
- * @param stack The Stack the construct belongs to
68
- * @param path The path(s) to the construct in the provided stack
69
- * @param suppressions A list of suppressions to apply to the resource
70
- * @param applyToChildren Apply the suppressions to children CfnResources (default:false)
71
- */
72
- static addResourceSuppressionsByPath(stack, path, suppressions, applyToChildren = false) {
73
- const pathArray = Array.isArray(path) ? path : [path];
74
- if (pathArray.length === 0) {
75
- throw new Error(`Path cannot be an empty array.`);
76
- }
77
- pathArray.forEach((p) => {
78
- let added = false;
79
- for (const child of stack.node.findAll()) {
80
- const fixedPath = p.replace(/^\//, '');
81
- if (child.node.path === fixedPath ||
82
- child.node.path + '/Resource' === fixedPath) {
83
- NagSuppressions.addResourceSuppressions(child, suppressions, applyToChildren);
84
- added = true;
85
- }
86
- }
87
- if (!added) {
88
- throw new Error(`Suppression path "${p}" did not match any resource. This can occur when a resource does not exist or if a suppression is applied before a resource is created.`);
89
- }
90
- });
91
- }
92
- }
93
- exports.NagSuppressions = NagSuppressions;
94
- _a = JSII_RTTI_SYMBOL_1;
95
- NagSuppressions[_a] = { fqn: "cdk-nag.NagSuppressions", version: "2.38.2" };
96
- //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFnLXN1cHByZXNzaW9ucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9uYWctc3VwcHJlc3Npb25zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUE7OztFQUdFO0FBQ0YsNkNBQWlEO0FBR2pELDJFQUFzRTtBQUV0RTs7R0FFRztBQUNILE1BQWEsZUFBZTtJQUMxQjs7Ozs7T0FLRztJQUNILE1BQU0sQ0FBQyxvQkFBb0IsQ0FDekIsS0FBWSxFQUNaLFlBQWtDLEVBQ2xDLHNCQUErQixLQUFLO1FBRXBDLE1BQU0sTUFBTSxHQUFHLG1CQUFtQjtZQUNoQyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQWMsRUFBRSxDQUFDLENBQUMsWUFBWSxtQkFBSyxDQUFDO1lBQ3BFLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ1osTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFO1lBQ25CLDZDQUFvQixDQUFDLDBCQUEwQixDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQ3pFLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQyxlQUFlLENBQUMsUUFBUSxFQUFFLE9BQU8sSUFBSSxFQUFFLENBQUM7WUFDekQsUUFBUSxHQUFHLDZDQUFvQixDQUFDLGtCQUFrQixDQUNoRCxRQUFRLEVBQ1IsWUFBWSxDQUNiLENBQUM7WUFDRixJQUFJLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztnQkFDaEMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxRQUFRLEdBQUcsRUFBRSxDQUFDO1lBQ2xDLENBQUM7WUFDRCxDQUFDLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEdBQUcsUUFBUSxDQUFDO1FBQ2hELENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsTUFBTSxDQUFDLHVCQUF1QixDQUM1QixTQUFvQyxFQUNwQyxZQUFrQyxFQUNsQyxrQkFBMkIsS0FBSztRQUVoQyxNQUFNLGNBQWMsR0FBaUIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUM7WUFDM0QsQ0FBQyxDQUFDLFNBQVM7WUFDWCxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoQixJQUFJLGNBQWMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDaEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFFRCxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7WUFDM0IsNkNBQW9CLENBQUMsMEJBQTBCLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsWUFBWSxDQUFDLENBQUM7WUFDekUsTUFBTSxVQUFVLEdBQUcsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzVELEtBQUssTUFBTSxLQUFLLElBQUksVUFBVSxFQUFFLENBQUM7Z0JBQy9CLE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWTtvQkFDeEMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWTtvQkFDekIsQ0FBQyxDQUFDLEtBQUssQ0FBQztnQkFDVixJQUFJLFVBQVUsWUFBWSx5QkFBVyxFQUFFLENBQUM7b0JBQ3RDLE1BQU0sUUFBUSxHQUFHLFVBQXlCLENBQUM7b0JBQzNDLElBQUksUUFBUSxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDLENBQUM7b0JBQy9DLFFBQVEsR0FBRyw2Q0FBb0IsQ0FBQyxrQkFBa0IsQ0FDaEQsUUFBUSxFQUNSLFlBQVksQ0FDYixDQUFDO29CQUNGLFFBQVEsQ0FBQyxXQUFXLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUM1QyxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNILE1BQU0sQ0FBQyw2QkFBNkIsQ0FDbEMsS0FBWSxFQUNaLElBQXVCLEVBQ3ZCLFlBQWtDLEVBQ2xDLGtCQUEyQixLQUFLO1FBRWhDLE1BQU0sU0FBUyxHQUFhLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNoRSxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDM0IsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFFRCxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7WUFDdEIsSUFBSSxLQUFLLEdBQUcsS0FBSyxDQUFDO1lBQ2xCLEtBQUssTUFBTSxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO2dCQUN6QyxNQUFNLFNBQVMsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDdkMsSUFDRSxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksS0FBSyxTQUFTO29CQUM3QixLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxXQUFXLEtBQUssU0FBUyxFQUMzQyxDQUFDO29CQUNELGVBQWUsQ0FBQyx1QkFBdUIsQ0FDckMsS0FBSyxFQUNMLFlBQVksRUFDWixlQUFlLENBQ2hCLENBQUM7b0JBQ0YsS0FBSyxHQUFHLElBQUksQ0FBQztnQkFDZixDQUFDO1lBQ0gsQ0FBQztZQUNELElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDWCxNQUFNLElBQUksS0FBSyxDQUNiLHFCQUFxQixDQUFDLDBJQUEwSSxDQUNqSyxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUEzR0gsMENBNEdDIiwic291cmNlc0NvbnRlbnQiOlsiLypcbkNvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcbiovXG5pbXBvcnQgeyBDZm5SZXNvdXJjZSwgU3RhY2sgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBJQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBOYWdQYWNrU3VwcHJlc3Npb24gfSBmcm9tICcuL21vZGVscy9uYWctc3VwcHJlc3Npb24nO1xuaW1wb3J0IHsgTmFnU3VwcHJlc3Npb25IZWxwZXIgfSBmcm9tICcuL3V0aWxzL25hZy1zdXBwcmVzc2lvbi1oZWxwZXInO1xuXG4vKipcbiAqIEhlbHBlciBjbGFzcyB3aXRoIG1ldGhvZHMgdG8gYWRkIGNkay1uYWcgc3VwcHJlc3Npb25zIHRvIGNkayByZXNvdXJjZXNcbiAqL1xuZXhwb3J0IGNsYXNzIE5hZ1N1cHByZXNzaW9ucyB7XG4gIC8qKlxuICAgKiBBcHBseSBjZGstbmFnIHN1cHByZXNzaW9ucyB0byBhIFN0YWNrIGFuZCBvcHRpb25hbGx5IG5lc3RlZCBzdGFja3NcbiAgICogQHBhcmFtIHN0YWNrIFRoZSBTdGFjayB0byBhcHBseSB0aGUgc3VwcHJlc3Npb24gdG9cbiAgICogQHBhcmFtIHN1cHByZXNzaW9ucyBBIGxpc3Qgb2Ygc3VwcHJlc3Npb25zIHRvIGFwcGx5IHRvIHRoZSBzdGFja1xuICAgKiBAcGFyYW0gYXBwbHlUb05lc3RlZFN0YWNrcyBBcHBseSB0aGUgc3VwcHJlc3Npb25zIHRvIGNoaWxkcmVuIHN0YWNrcyAoZGVmYXVsdDpmYWxzZSlcbiAgICovXG4gIHN0YXRpYyBhZGRTdGFja1N1cHByZXNzaW9ucyhcbiAgICBzdGFjazogU3RhY2ssXG4gICAgc3VwcHJlc3Npb25zOiBOYWdQYWNrU3VwcHJlc3Npb25bXSxcbiAgICBhcHBseVRvTmVzdGVkU3RhY2tzOiBib29sZWFuID0gZmFsc2VcbiAgKTogdm9pZCB7XG4gICAgY29uc3Qgc3RhY2tzID0gYXBwbHlUb05lc3RlZFN0YWNrc1xuICAgICAgPyBzdGFjay5ub2RlLmZpbmRBbGwoKS5maWx0ZXIoKHgpOiB4IGlzIFN0YWNrID0+IHggaW5zdGFuY2VvZiBTdGFjaylcbiAgICAgIDogW3N0YWNrXTtcbiAgICBzdGFja3MuZm9yRWFjaCgocykgPT4ge1xuICAgICAgTmFnU3VwcHJlc3Npb25IZWxwZXIuYXNzZXJ0U3VwcHJlc3Npb25zQXJlVmFsaWQocy5ub2RlLmlkLCBzdXBwcmVzc2lvbnMpO1xuICAgICAgbGV0IG1ldGFkYXRhID0gcy50ZW1wbGF0ZU9wdGlvbnMubWV0YWRhdGE/LmNka19uYWcgPz8ge307XG4gICAgICBtZXRhZGF0YSA9IE5hZ1N1cHByZXNzaW9uSGVscGVyLmFkZFJ1bGVzVG9NZXRhZGF0YShcbiAgICAgICAgbWV0YWRhdGEsXG4gICAgICAgIHN1cHByZXNzaW9uc1xuICAgICAgKTtcbiAgICAgIGlmICghcy50ZW1wbGF0ZU9wdGlvbnMubWV0YWRhdGEpIHtcbiAgICAgICAgcy50ZW1wbGF0ZU9wdGlvbnMubWV0YWRhdGEgPSB7fTtcbiAgICAgIH1cbiAgICAgIHMudGVtcGxhdGVPcHRpb25zLm1ldGFkYXRhLmNka19uYWcgPSBtZXRhZGF0YTtcbiAgICB9KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBBZGQgY2RrLW5hZyBzdXBwcmVzc2lvbnMgdG8gYSBDZm5SZXNvdXJjZSBhbmQgb3B0aW9uYWxseSBpdHMgY2hpbGRyZW5cbiAgICogQHBhcmFtIGNvbnN0cnVjdCBUaGUgSUNvbnN0cnVjdChzKSB0byBhcHBseSB0aGUgc3VwcHJlc3Npb24gdG9cbiAgICogQHBhcmFtIHN1cHByZXNzaW9ucyBBIGxpc3Qgb2Ygc3VwcHJlc3Npb25zIHRvIGFwcGx5IHRvIHRoZSByZXNvdXJjZVxuICAgKiBAcGFyYW0gYXBwbHlUb0NoaWxkcmVuIEFwcGx5IHRoZSBzdXBwcmVzc2lvbnMgdG8gY2hpbGRyZW4gQ2ZuUmVzb3VyY2VzICAoZGVmYXVsdDpmYWxzZSlcbiAgICovXG4gIHN0YXRpYyBhZGRSZXNvdXJjZVN1cHByZXNzaW9ucyhcbiAgICBjb25zdHJ1Y3Q6IElDb25zdHJ1Y3QgfCBJQ29uc3RydWN0W10sXG4gICAgc3VwcHJlc3Npb25zOiBOYWdQYWNrU3VwcHJlc3Npb25bXSxcbiAgICBhcHBseVRvQ2hpbGRyZW46IGJvb2xlYW4gPSBmYWxzZVxuICApOiB2b2lkIHtcbiAgICBjb25zdCBjb25zdHJ1Y3RBcnJheTogSUNvbnN0cnVjdFtdID0gQXJyYXkuaXNBcnJheShjb25zdHJ1Y3QpXG4gICAgICA/IGNvbnN0cnVjdFxuICAgICAgOiBbY29uc3RydWN0XTtcbiAgICBpZiAoY29uc3RydWN0QXJyYXkubGVuZ3RoID09PSAwKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYENvbnN0cnVjdCBjYW5ub3QgYmUgYW4gZW1wdHkgYXJyYXkuYCk7XG4gICAgfVxuXG4gICAgY29uc3RydWN0QXJyYXkuZm9yRWFjaCgoYykgPT4ge1xuICAgICAgTmFnU3VwcHJlc3Npb25IZWxwZXIuYXNzZXJ0U3VwcHJlc3Npb25zQXJlVmFsaWQoYy5ub2RlLmlkLCBzdXBwcmVzc2lvbnMpO1xuICAgICAgY29uc3QgY29uc3RydWN0cyA9IGFwcGx5VG9DaGlsZHJlbiA/IGMubm9kZS5maW5kQWxsKCkgOiBbY107XG4gICAgICBmb3IgKGNvbnN0IGNoaWxkIG9mIGNvbnN0cnVjdHMpIHtcbiAgICAgICAgY29uc3QgcG9zc2libGVMMSA9IGNoaWxkLm5vZGUuZGVmYXVsdENoaWxkXG4gICAgICAgICAgPyBjaGlsZC5ub2RlLmRlZmF1bHRDaGlsZFxuICAgICAgICAgIDogY2hpbGQ7XG4gICAgICAgIGlmIChwb3NzaWJsZUwxIGluc3RhbmNlb2YgQ2ZuUmVzb3VyY2UpIHtcbiAgICAgICAgICBjb25zdCByZXNvdXJjZSA9IHBvc3NpYmxlTDEgYXMgQ2ZuUmVzb3VyY2U7XG4gICAgICAgICAgbGV0IG1ldGFkYXRhID0gcmVzb3VyY2UuZ2V0TWV0YWRhdGEoJ2Nka19uYWcnKTtcbiAgICAgICAgICBtZXRhZGF0YSA9IE5hZ1N1cHByZXNzaW9uSGVscGVyLmFkZFJ1bGVzVG9NZXRhZGF0YShcbiAgICAgICAgICAgIG1ldGFkYXRhLFxuICAgICAgICAgICAgc3VwcHJlc3Npb25zXG4gICAgICAgICAgKTtcbiAgICAgICAgICByZXNvdXJjZS5hZGRNZXRhZGF0YSgnY2RrX25hZycsIG1ldGFkYXRhKTtcbiAgICAgICAgfVxuICAgICAgfVxuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIEFkZCBjZGstbmFnIHN1cHByZXNzaW9ucyB0byBhIENmblJlc291cmNlIGFuZCBvcHRpb25hbGx5IGl0cyBjaGlsZHJlbiB2aWEgaXRzIHBhdGhcbiAgICogQHBhcmFtIHN0YWNrIFRoZSBTdGFjayB0aGUgY29uc3RydWN0IGJlbG9uZ3MgdG9cbiAgICogQHBhcmFtIHBhdGggVGhlIHBhdGgocykgdG8gdGhlIGNvbnN0cnVjdCBpbiB0aGUgcHJvdmlkZWQgc3RhY2tcbiAgICogQHBhcmFtIHN1cHByZXNzaW9ucyBBIGxpc3Qgb2Ygc3VwcHJlc3Npb25zIHRvIGFwcGx5IHRvIHRoZSByZXNvdXJjZVxuICAgKiBAcGFyYW0gYXBwbHlUb0NoaWxkcmVuIEFwcGx5IHRoZSBzdXBwcmVzc2lvbnMgdG8gY2hpbGRyZW4gQ2ZuUmVzb3VyY2VzICAoZGVmYXVsdDpmYWxzZSlcbiAgICovXG4gIHN0YXRpYyBhZGRSZXNvdXJjZVN1cHByZXNzaW9uc0J5UGF0aChcbiAgICBzdGFjazogU3RhY2ssXG4gICAgcGF0aDogc3RyaW5nIHwgc3RyaW5nW10sXG4gICAgc3VwcHJlc3Npb25zOiBOYWdQYWNrU3VwcHJlc3Npb25bXSxcbiAgICBhcHBseVRvQ2hpbGRyZW46IGJvb2xlYW4gPSBmYWxzZVxuICApOiB2b2lkIHtcbiAgICBjb25zdCBwYXRoQXJyYXk6IHN0cmluZ1tdID0gQXJyYXkuaXNBcnJheShwYXRoKSA/IHBhdGggOiBbcGF0aF07XG4gICAgaWYgKHBhdGhBcnJheS5sZW5ndGggPT09IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgUGF0aCBjYW5ub3QgYmUgYW4gZW1wdHkgYXJyYXkuYCk7XG4gICAgfVxuXG4gICAgcGF0aEFycmF5LmZvckVhY2goKHApID0+IHtcbiAgICAgIGxldCBhZGRlZCA9IGZhbHNlO1xuICAgICAgZm9yIChjb25zdCBjaGlsZCBvZiBzdGFjay5ub2RlLmZpbmRBbGwoKSkge1xuICAgICAgICBjb25zdCBmaXhlZFBhdGggPSBwLnJlcGxhY2UoL15cXC8vLCAnJyk7XG4gICAgICAgIGlmIChcbiAgICAgICAgICBjaGlsZC5ub2RlLnBhdGggPT09IGZpeGVkUGF0aCB8fFxuICAgICAgICAgIGNoaWxkLm5vZGUucGF0aCArICcvUmVzb3VyY2UnID09PSBmaXhlZFBhdGhcbiAgICAgICAgKSB7XG4gICAgICAgICAgTmFnU3VwcHJlc3Npb25zLmFkZFJlc291cmNlU3VwcHJlc3Npb25zKFxuICAgICAgICAgICAgY2hpbGQsXG4gICAgICAgICAgICBzdXBwcmVzc2lvbnMsXG4gICAgICAgICAgICBhcHBseVRvQ2hpbGRyZW5cbiAgICAgICAgICApO1xuICAgICAgICAgIGFkZGVkID0gdHJ1ZTtcbiAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgKCFhZGRlZCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgYFN1cHByZXNzaW9uIHBhdGggXCIke3B9XCIgZGlkIG5vdCBtYXRjaCBhbnkgcmVzb3VyY2UuIFRoaXMgY2FuIG9jY3VyIHdoZW4gYSByZXNvdXJjZSBkb2VzIG5vdCBleGlzdCBvciBpZiBhIHN1cHByZXNzaW9uIGlzIGFwcGxpZWQgYmVmb3JlIGEgcmVzb3VyY2UgaXMgY3JlYXRlZC5gXG4gICAgICAgICk7XG4gICAgICB9XG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==
@@ -1,20 +0,0 @@
1
- import { CfnResource } from 'aws-cdk-lib';
2
- import { NagPackSuppression, NagPackSuppressionAppliesTo } from '../models/nag-suppression';
3
- interface NagCfnMetadata {
4
- rules_to_suppress: NagCfnSuppression[];
5
- }
6
- interface NagCfnSuppression extends Omit<NagPackSuppression, 'appliesTo'> {
7
- applies_to?: NagPackSuppressionAppliesTo[];
8
- is_reason_encoded?: boolean;
9
- }
10
- export declare class NagSuppressionHelper {
11
- static toCfnFormat(suppression: NagPackSuppression): NagCfnSuppression;
12
- static toApiFormat(suppression: NagCfnSuppression): NagPackSuppression;
13
- static addRulesToMetadata(metadata: NagCfnMetadata, rules: NagPackSuppression[]): NagCfnMetadata;
14
- static getSuppressions(node: CfnResource): NagPackSuppression[];
15
- static assertSuppressionsAreValid(id: string, suppressions: NagPackSuppression[]): void;
16
- static doesApply(suppression: NagPackSuppression, ruleId: string, findingId: string): boolean;
17
- private static getSuppressionFormatError;
18
- private static toRegEx;
19
- }
20
- export {};
@@ -1,119 +0,0 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.NagSuppressionHelper = void 0;
4
- /*
5
- Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
6
- SPDX-License-Identifier: Apache-2.0
7
- */
8
- const buffer_1 = require("buffer");
9
- const aws_cdk_lib_1 = require("aws-cdk-lib");
10
- class NagSuppressionHelper {
11
- static toCfnFormat(suppression) {
12
- const { appliesTo, reason, ...result } = suppression;
13
- if (appliesTo) {
14
- result.applies_to = appliesTo;
15
- }
16
- if ([...reason].some((c) => c.codePointAt(0) === undefined ? false : c.codePointAt(0) > 255)) {
17
- result.is_reason_encoded = true;
18
- return { reason: buffer_1.Buffer.from(reason).toString('base64'), ...result };
19
- }
20
- return { reason, ...result };
21
- }
22
- static toApiFormat(suppression) {
23
- const { applies_to, reason, is_reason_encoded, ...result } = suppression;
24
- if (applies_to) {
25
- result.appliesTo = applies_to;
26
- }
27
- if (is_reason_encoded) {
28
- return { reason: buffer_1.Buffer.from(reason, 'base64').toString(), ...result };
29
- }
30
- return { reason, ...result };
31
- }
32
- static addRulesToMetadata(metadata, rules) {
33
- const { rules_to_suppress } = metadata ?? {};
34
- const serialisedRules = [
35
- ...(rules_to_suppress ?? []).map((r) => JSON.stringify(r)),
36
- ...rules
37
- .map(NagSuppressionHelper.toCfnFormat)
38
- .map((r) => JSON.stringify(r)),
39
- ];
40
- const deduplicatedRules = Array.from(new Set(serialisedRules));
41
- return { rules_to_suppress: deduplicatedRules.map((r) => JSON.parse(r)) };
42
- }
43
- static getSuppressions(node) {
44
- const resourceIgnores = node.getMetadata('cdk_nag')?.rules_to_suppress ?? [];
45
- const stackIgnores = aws_cdk_lib_1.Stack.of(node).templateOptions.metadata?.cdk_nag?.rules_to_suppress ?? [];
46
- const result = [...resourceIgnores, ...stackIgnores].map(NagSuppressionHelper.toApiFormat);
47
- NagSuppressionHelper.assertSuppressionsAreValid(node.node.id, result);
48
- return result;
49
- }
50
- static assertSuppressionsAreValid(id, suppressions) {
51
- const errors = suppressions
52
- .map(NagSuppressionHelper.getSuppressionFormatError)
53
- .filter((errorMessage) => !!errorMessage);
54
- if (errors.length) {
55
- throw Error(`${id}: ${errors.join('')}\nSee https://github.com/cdklabs/cdk-nag#suppressing-a-rule for information on suppressing a rule.`);
56
- }
57
- }
58
- static doesApply(suppression, ruleId, findingId) {
59
- if (ruleId !== suppression.id) {
60
- return false;
61
- }
62
- if (!suppression.appliesTo) {
63
- // the rule is not granular so it always applies
64
- return true;
65
- }
66
- if (findingId &&
67
- suppression.appliesTo.some((appliesTo) => {
68
- if (typeof appliesTo === 'string') {
69
- return appliesTo === findingId;
70
- }
71
- else {
72
- const regex = NagSuppressionHelper.toRegEx(appliesTo.regex);
73
- return regex.test(findingId);
74
- }
75
- })) {
76
- return true;
77
- }
78
- return false;
79
- }
80
- static getSuppressionFormatError(suppression) {
81
- let errors = '';
82
- const finding = suppression.id.match(/\[.*\]/);
83
- if (finding) {
84
- errors += `The suppression 'id' contains a finding '${finding}. A finding must be suppressed using 'applies_to'.`;
85
- }
86
- if (suppression.reason.length < 10) {
87
- errors +=
88
- "The suppression must have a 'reason' of 10 characters or more.";
89
- }
90
- (suppression.appliesTo ?? []).forEach((appliesTo) => {
91
- if (typeof appliesTo !== 'string') {
92
- try {
93
- NagSuppressionHelper.toRegEx(appliesTo.regex);
94
- }
95
- catch (err) {
96
- errors += err.message;
97
- }
98
- }
99
- });
100
- return errors
101
- ? `\n\tError(s) detected in suppression with 'id' ${suppression.id}. ${errors}`
102
- : '';
103
- }
104
- static toRegEx(s) {
105
- try {
106
- // verify that the regex is correctly formatted
107
- const m = s.match(/\/(.*)\/(.*)?/);
108
- if (!m) {
109
- throw new Error();
110
- }
111
- return new RegExp(m[1], m[2] || '');
112
- }
113
- catch {
114
- throw new Error(`Invalid regular expression [${s}]`);
115
- }
116
- }
117
- }
118
- exports.NagSuppressionHelper = NagSuppressionHelper;
119
- //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFnLXN1cHByZXNzaW9uLWhlbHBlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9uYWctc3VwcHJlc3Npb24taGVscGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7RUFHRTtBQUNGLG1DQUFnQztBQUNoQyw2Q0FBaUQ7QUFlakQsTUFBYSxvQkFBb0I7SUFDL0IsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUErQjtRQUNoRCxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sRUFBRSxHQUFHLFdBQVcsQ0FBQztRQUVyRCxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQ2IsTUFBNEIsQ0FBQyxVQUFVLEdBQUcsU0FBUyxDQUFDO1FBQ3ZELENBQUM7UUFDRCxJQUNFLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUNyQixDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBRSxHQUFHLEdBQUcsQ0FDakUsRUFDRCxDQUFDO1lBQ0EsTUFBNEIsQ0FBQyxpQkFBaUIsR0FBRyxJQUFJLENBQUM7WUFDdkQsT0FBTyxFQUFFLE1BQU0sRUFBRSxlQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxDQUFDO1FBQ3ZFLENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxFQUFFLENBQUM7SUFDL0IsQ0FBQztJQUVELE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBOEI7UUFDL0MsTUFBTSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsaUJBQWlCLEVBQUUsR0FBRyxNQUFNLEVBQUUsR0FBRyxXQUFXLENBQUM7UUFFekUsSUFBSSxVQUFVLEVBQUUsQ0FBQztZQUNkLE1BQWMsQ0FBQyxTQUFTLEdBQUcsVUFBVSxDQUFDO1FBQ3pDLENBQUM7UUFDRCxJQUFJLGlCQUFpQixFQUFFLENBQUM7WUFDdEIsT0FBTyxFQUFFLE1BQU0sRUFBRSxlQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxHQUFHLE1BQU0sRUFBRSxDQUFDO1FBQ3pFLENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxFQUFFLENBQUM7SUFDL0IsQ0FBQztJQUVELE1BQU0sQ0FBQyxrQkFBa0IsQ0FDdkIsUUFBd0IsRUFDeEIsS0FBMkI7UUFFM0IsTUFBTSxFQUFFLGlCQUFpQixFQUFFLEdBQUcsUUFBUSxJQUFJLEVBQUUsQ0FBQztRQUM3QyxNQUFNLGVBQWUsR0FBRztZQUN0QixHQUFHLENBQUMsaUJBQWlCLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzFELEdBQUcsS0FBSztpQkFDTCxHQUFHLENBQUMsb0JBQW9CLENBQUMsV0FBVyxDQUFDO2lCQUNyQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7U0FDakMsQ0FBQztRQUNGLE1BQU0saUJBQWlCLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDO1FBQy9ELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzVFLENBQUM7SUFFRCxNQUFNLENBQUMsZUFBZSxDQUFDLElBQWlCO1FBQ3RDLE1BQU0sZUFBZSxHQUNuQixJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxFQUFFLGlCQUFpQixJQUFJLEVBQUUsQ0FBQztRQUN2RCxNQUFNLFlBQVksR0FDaEIsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsZUFBZSxDQUFDLFFBQVEsRUFBRSxPQUFPLEVBQUUsaUJBQWlCLElBQUksRUFBRSxDQUFDO1FBQzVFLE1BQU0sTUFBTSxHQUFHLENBQUMsR0FBRyxlQUFlLEVBQUUsR0FBRyxZQUFZLENBQUMsQ0FBQyxHQUFHLENBQ3RELG9CQUFvQixDQUFDLFdBQVcsQ0FDakMsQ0FBQztRQUNGLG9CQUFvQixDQUFDLDBCQUEwQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3RFLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFRCxNQUFNLENBQUMsMEJBQTBCLENBQy9CLEVBQVUsRUFDVixZQUFrQztRQUVsQyxNQUFNLE1BQU0sR0FBRyxZQUFZO2FBQ3hCLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQyx5QkFBeUIsQ0FBQzthQUNuRCxNQUFNLENBQUMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUU1QyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNsQixNQUFNLEtBQUssQ0FDVCxHQUFHLEVBQUUsS0FBSyxNQUFNLENBQUMsSUFBSSxDQUNuQixFQUFFLENBQ0gsb0dBQW9HLENBQ3RHLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVELE1BQU0sQ0FBQyxTQUFTLENBQ2QsV0FBK0IsRUFDL0IsTUFBYyxFQUNkLFNBQWlCO1FBRWpCLElBQUksTUFBTSxLQUFLLFdBQVcsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUM5QixPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFFRCxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQzNCLGdEQUFnRDtZQUNoRCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFFRCxJQUNFLFNBQVM7WUFDVCxXQUFXLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFO2dCQUN2QyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsRUFBRSxDQUFDO29CQUNsQyxPQUFPLFNBQVMsS0FBSyxTQUFTLENBQUM7Z0JBQ2pDLENBQUM7cUJBQU0sQ0FBQztvQkFDTixNQUFNLEtBQUssR0FBRyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUM1RCxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQy9CLENBQUM7WUFDSCxDQUFDLENBQUMsRUFDRixDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBRUQsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRU8sTUFBTSxDQUFDLHlCQUF5QixDQUN0QyxXQUErQjtRQUUvQixJQUFJLE1BQU0sR0FBRyxFQUFFLENBQUM7UUFDaEIsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDL0MsSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUNaLE1BQU0sSUFBSSw0Q0FBNEMsT0FBTyxvREFBb0QsQ0FBQztRQUNwSCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUNuQyxNQUFNO2dCQUNKLGdFQUFnRSxDQUFDO1FBQ3JFLENBQUM7UUFDRCxDQUFDLFdBQVcsQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUU7WUFDbEQsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztnQkFDbEMsSUFBSSxDQUFDO29CQUNILG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ2hELENBQUM7Z0JBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztvQkFDYixNQUFNLElBQUssR0FBYSxDQUFDLE9BQU8sQ0FBQztnQkFDbkMsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUNILE9BQU8sTUFBTTtZQUNYLENBQUMsQ0FBQyxrREFBa0QsV0FBVyxDQUFDLEVBQUUsS0FBSyxNQUFNLEVBQUU7WUFDL0UsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNULENBQUM7SUFFTyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQVM7UUFDOUIsSUFBSSxDQUFDO1lBQ0gsK0NBQStDO1lBQy9DLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDbkMsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUNQLE1BQU0sSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNwQixDQUFDO1lBQ0QsT0FBTyxJQUFJLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3RDLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUEvSUQsb0RBK0lDIiwic291cmNlc0NvbnRlbnQiOlsiLypcbkNvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcbiovXG5pbXBvcnQgeyBCdWZmZXIgfSBmcm9tICdidWZmZXInO1xuaW1wb3J0IHsgQ2ZuUmVzb3VyY2UsIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHtcbiAgTmFnUGFja1N1cHByZXNzaW9uLFxuICBOYWdQYWNrU3VwcHJlc3Npb25BcHBsaWVzVG8sXG59IGZyb20gJy4uL21vZGVscy9uYWctc3VwcHJlc3Npb24nO1xuXG5pbnRlcmZhY2UgTmFnQ2ZuTWV0YWRhdGEge1xuICBydWxlc190b19zdXBwcmVzczogTmFnQ2ZuU3VwcHJlc3Npb25bXTtcbn1cblxuaW50ZXJmYWNlIE5hZ0NmblN1cHByZXNzaW9uIGV4dGVuZHMgT21pdDxOYWdQYWNrU3VwcHJlc3Npb24sICdhcHBsaWVzVG8nPiB7XG4gIGFwcGxpZXNfdG8/OiBOYWdQYWNrU3VwcHJlc3Npb25BcHBsaWVzVG9bXTtcbiAgaXNfcmVhc29uX2VuY29kZWQ/OiBib29sZWFuO1xufVxuXG5leHBvcnQgY2xhc3MgTmFnU3VwcHJlc3Npb25IZWxwZXIge1xuICBzdGF0aWMgdG9DZm5Gb3JtYXQoc3VwcHJlc3Npb246IE5hZ1BhY2tTdXBwcmVzc2lvbik6IE5hZ0NmblN1cHByZXNzaW9uIHtcbiAgICBjb25zdCB7IGFwcGxpZXNUbywgcmVhc29uLCAuLi5yZXN1bHQgfSA9IHN1cHByZXNzaW9uO1xuXG4gICAgaWYgKGFwcGxpZXNUbykge1xuICAgICAgKHJlc3VsdCBhcyBOYWdDZm5TdXBwcmVzc2lvbikuYXBwbGllc190byA9IGFwcGxpZXNUbztcbiAgICB9XG4gICAgaWYgKFxuICAgICAgWy4uLnJlYXNvbl0uc29tZSgoYykgPT5cbiAgICAgICAgYy5jb2RlUG9pbnRBdCgwKSA9PT0gdW5kZWZpbmVkID8gZmFsc2UgOiBjLmNvZGVQb2ludEF0KDApISA+IDI1NVxuICAgICAgKVxuICAgICkge1xuICAgICAgKHJlc3VsdCBhcyBOYWdDZm5TdXBwcmVzc2lvbikuaXNfcmVhc29uX2VuY29kZWQgPSB0cnVlO1xuICAgICAgcmV0dXJuIHsgcmVhc29uOiBCdWZmZXIuZnJvbShyZWFzb24pLnRvU3RyaW5nKCdiYXNlNjQnKSwgLi4ucmVzdWx0IH07XG4gICAgfVxuICAgIHJldHVybiB7IHJlYXNvbiwgLi4ucmVzdWx0IH07XG4gIH1cblxuICBzdGF0aWMgdG9BcGlGb3JtYXQoc3VwcHJlc3Npb246IE5hZ0NmblN1cHByZXNzaW9uKTogTmFnUGFja1N1cHByZXNzaW9uIHtcbiAgICBjb25zdCB7IGFwcGxpZXNfdG8sIHJlYXNvbiwgaXNfcmVhc29uX2VuY29kZWQsIC4uLnJlc3VsdCB9ID0gc3VwcHJlc3Npb247XG5cbiAgICBpZiAoYXBwbGllc190bykge1xuICAgICAgKHJlc3VsdCBhcyBhbnkpLmFwcGxpZXNUbyA9IGFwcGxpZXNfdG87XG4gICAgfVxuICAgIGlmIChpc19yZWFzb25fZW5jb2RlZCkge1xuICAgICAgcmV0dXJuIHsgcmVhc29uOiBCdWZmZXIuZnJvbShyZWFzb24sICdiYXNlNjQnKS50b1N0cmluZygpLCAuLi5yZXN1bHQgfTtcbiAgICB9XG4gICAgcmV0dXJuIHsgcmVhc29uLCAuLi5yZXN1bHQgfTtcbiAgfVxuXG4gIHN0YXRpYyBhZGRSdWxlc1RvTWV0YWRhdGEoXG4gICAgbWV0YWRhdGE6IE5hZ0Nmbk1ldGFkYXRhLFxuICAgIHJ1bGVzOiBOYWdQYWNrU3VwcHJlc3Npb25bXVxuICApOiBOYWdDZm5NZXRhZGF0YSB7XG4gICAgY29uc3QgeyBydWxlc190b19zdXBwcmVzcyB9ID0gbWV0YWRhdGEgPz8ge307XG4gICAgY29uc3Qgc2VyaWFsaXNlZFJ1bGVzID0gW1xuICAgICAgLi4uKHJ1bGVzX3RvX3N1cHByZXNzID8/IFtdKS5tYXAoKHIpID0+IEpTT04uc3RyaW5naWZ5KHIpKSxcbiAgICAgIC4uLnJ1bGVzXG4gICAgICAgIC5tYXAoTmFnU3VwcHJlc3Npb25IZWxwZXIudG9DZm5Gb3JtYXQpXG4gICAgICAgIC5tYXAoKHIpID0+IEpTT04uc3RyaW5naWZ5KHIpKSxcbiAgICBdO1xuICAgIGNvbnN0IGRlZHVwbGljYXRlZFJ1bGVzID0gQXJyYXkuZnJvbShuZXcgU2V0KHNlcmlhbGlzZWRSdWxlcykpO1xuICAgIHJldHVybiB7IHJ1bGVzX3RvX3N1cHByZXNzOiBkZWR1cGxpY2F0ZWRSdWxlcy5tYXAoKHIpID0+IEpTT04ucGFyc2UocikpIH07XG4gIH1cblxuICBzdGF0aWMgZ2V0U3VwcHJlc3Npb25zKG5vZGU6IENmblJlc291cmNlKTogTmFnUGFja1N1cHByZXNzaW9uW10ge1xuICAgIGNvbnN0IHJlc291cmNlSWdub3JlcyA9XG4gICAgICBub2RlLmdldE1ldGFkYXRhKCdjZGtfbmFnJyk/LnJ1bGVzX3RvX3N1cHByZXNzID8/IFtdO1xuICAgIGNvbnN0IHN0YWNrSWdub3JlcyA9XG4gICAgICBTdGFjay5vZihub2RlKS50ZW1wbGF0ZU9wdGlvbnMubWV0YWRhdGE/LmNka19uYWc/LnJ1bGVzX3RvX3N1cHByZXNzID8/IFtdO1xuICAgIGNvbnN0IHJlc3VsdCA9IFsuLi5yZXNvdXJjZUlnbm9yZXMsIC4uLnN0YWNrSWdub3Jlc10ubWFwKFxuICAgICAgTmFnU3VwcHJlc3Npb25IZWxwZXIudG9BcGlGb3JtYXRcbiAgICApO1xuICAgIE5hZ1N1cHByZXNzaW9uSGVscGVyLmFzc2VydFN1cHByZXNzaW9uc0FyZVZhbGlkKG5vZGUubm9kZS5pZCwgcmVzdWx0KTtcbiAgICByZXR1cm4gcmVzdWx0O1xuICB9XG5cbiAgc3RhdGljIGFzc2VydFN1cHByZXNzaW9uc0FyZVZhbGlkKFxuICAgIGlkOiBzdHJpbmcsXG4gICAgc3VwcHJlc3Npb25zOiBOYWdQYWNrU3VwcHJlc3Npb25bXVxuICApOiB2b2lkIHtcbiAgICBjb25zdCBlcnJvcnMgPSBzdXBwcmVzc2lvbnNcbiAgICAgIC5tYXAoTmFnU3VwcHJlc3Npb25IZWxwZXIuZ2V0U3VwcHJlc3Npb25Gb3JtYXRFcnJvcilcbiAgICAgIC5maWx0ZXIoKGVycm9yTWVzc2FnZSkgPT4gISFlcnJvck1lc3NhZ2UpO1xuXG4gICAgaWYgKGVycm9ycy5sZW5ndGgpIHtcbiAgICAgIHRocm93IEVycm9yKFxuICAgICAgICBgJHtpZH06ICR7ZXJyb3JzLmpvaW4oXG4gICAgICAgICAgJydcbiAgICAgICAgKX1cXG5TZWUgaHR0cHM6Ly9naXRodWIuY29tL2Nka2xhYnMvY2RrLW5hZyNzdXBwcmVzc2luZy1hLXJ1bGUgZm9yIGluZm9ybWF0aW9uIG9uIHN1cHByZXNzaW5nIGEgcnVsZS5gXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIHN0YXRpYyBkb2VzQXBwbHkoXG4gICAgc3VwcHJlc3Npb246IE5hZ1BhY2tTdXBwcmVzc2lvbixcbiAgICBydWxlSWQ6IHN0cmluZyxcbiAgICBmaW5kaW5nSWQ6IHN0cmluZ1xuICApOiBib29sZWFuIHtcbiAgICBpZiAocnVsZUlkICE9PSBzdXBwcmVzc2lvbi5pZCkge1xuICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cblxuICAgIGlmICghc3VwcHJlc3Npb24uYXBwbGllc1RvKSB7XG4gICAgICAvLyB0aGUgcnVsZSBpcyBub3QgZ3JhbnVsYXIgc28gaXQgYWx3YXlzIGFwcGxpZXNcbiAgICAgIHJldHVybiB0cnVlO1xuICAgIH1cblxuICAgIGlmIChcbiAgICAgIGZpbmRpbmdJZCAmJlxuICAgICAgc3VwcHJlc3Npb24uYXBwbGllc1RvLnNvbWUoKGFwcGxpZXNUbykgPT4ge1xuICAgICAgICBpZiAodHlwZW9mIGFwcGxpZXNUbyA9PT0gJ3N0cmluZycpIHtcbiAgICAgICAgICByZXR1cm4gYXBwbGllc1RvID09PSBmaW5kaW5nSWQ7XG4gICAgICAgIH0gZWxzZSB7XG4gICAgICAgICAgY29uc3QgcmVnZXggPSBOYWdTdXBwcmVzc2lvbkhlbHBlci50b1JlZ0V4KGFwcGxpZXNUby5yZWdleCk7XG4gICAgICAgICAgcmV0dXJuIHJlZ2V4LnRlc3QoZmluZGluZ0lkKTtcbiAgICAgICAgfVxuICAgICAgfSlcbiAgICApIHtcbiAgICAgIHJldHVybiB0cnVlO1xuICAgIH1cblxuICAgIHJldHVybiBmYWxzZTtcbiAgfVxuXG4gIHByaXZhdGUgc3RhdGljIGdldFN1cHByZXNzaW9uRm9ybWF0RXJyb3IoXG4gICAgc3VwcHJlc3Npb246IE5hZ1BhY2tTdXBwcmVzc2lvblxuICApOiBzdHJpbmcge1xuICAgIGxldCBlcnJvcnMgPSAnJztcbiAgICBjb25zdCBmaW5kaW5nID0gc3VwcHJlc3Npb24uaWQubWF0Y2goL1xcWy4qXFxdLyk7XG4gICAgaWYgKGZpbmRpbmcpIHtcbiAgICAgIGVycm9ycyArPSBgVGhlIHN1cHByZXNzaW9uICdpZCcgY29udGFpbnMgYSBmaW5kaW5nICcke2ZpbmRpbmd9LiBBIGZpbmRpbmcgbXVzdCBiZSBzdXBwcmVzc2VkIHVzaW5nICdhcHBsaWVzX3RvJy5gO1xuICAgIH1cbiAgICBpZiAoc3VwcHJlc3Npb24ucmVhc29uLmxlbmd0aCA8IDEwKSB7XG4gICAgICBlcnJvcnMgKz1cbiAgICAgICAgXCJUaGUgc3VwcHJlc3Npb24gbXVzdCBoYXZlIGEgJ3JlYXNvbicgb2YgMTAgY2hhcmFjdGVycyBvciBtb3JlLlwiO1xuICAgIH1cbiAgICAoc3VwcHJlc3Npb24uYXBwbGllc1RvID8/IFtdKS5mb3JFYWNoKChhcHBsaWVzVG8pID0+IHtcbiAgICAgIGlmICh0eXBlb2YgYXBwbGllc1RvICE9PSAnc3RyaW5nJykge1xuICAgICAgICB0cnkge1xuICAgICAgICAgIE5hZ1N1cHByZXNzaW9uSGVscGVyLnRvUmVnRXgoYXBwbGllc1RvLnJlZ2V4KTtcbiAgICAgICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICAgICAgZXJyb3JzICs9IChlcnIgYXMgRXJyb3IpLm1lc3NhZ2U7XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICB9KTtcbiAgICByZXR1cm4gZXJyb3JzXG4gICAgICA/IGBcXG5cXHRFcnJvcihzKSBkZXRlY3RlZCBpbiBzdXBwcmVzc2lvbiB3aXRoICdpZCcgJHtzdXBwcmVzc2lvbi5pZH0uICR7ZXJyb3JzfWBcbiAgICAgIDogJyc7XG4gIH1cblxuICBwcml2YXRlIHN0YXRpYyB0b1JlZ0V4KHM6IHN0cmluZyk6IFJlZ0V4cCB7XG4gICAgdHJ5IHtcbiAgICAgIC8vIHZlcmlmeSB0aGF0IHRoZSByZWdleCBpcyBjb3JyZWN0bHkgZm9ybWF0dGVkXG4gICAgICBjb25zdCBtID0gcy5tYXRjaCgvXFwvKC4qKVxcLyguKik/Lyk7XG4gICAgICBpZiAoIW0pIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKCk7XG4gICAgICB9XG4gICAgICByZXR1cm4gbmV3IFJlZ0V4cChtWzFdLCBtWzJdIHx8ICcnKTtcbiAgICB9IGNhdGNoIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgSW52YWxpZCByZWd1bGFyIGV4cHJlc3Npb24gWyR7c31dYCk7XG4gICAgfVxuICB9XG59XG4iXX0=