@mavogel/awscdk-rootmail 0.0.336 → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.codegraph/.gitignore +5 -0
- package/.jsii +460 -8
- package/CLAUDE.md +1 -1
- package/README.md +6 -1
- package/docs/plans/2026-08-09-bump-mvc-projen-cdk-nag-v3.md +199 -0
- package/integ-tests/integ.rootmail-custom-santa.ts +2 -2
- package/integ-tests/integ.rootmail-filter-subject.ts +2 -2
- package/integ-tests/integ.rootmail.ts +2 -2
- package/lib/hosted-zone-dkim-propagation.js +46 -15
- package/lib/hosted-zone-dkim-verification-records.js +47 -12
- package/lib/rootmail-autowire-dns.js +47 -15
- package/lib/rootmail.js +13 -16
- package/lib/ses-receipt-ruleset-activation.js +53 -15
- package/lib/ses-receive.js +12 -12
- package/node_modules/cdk-nag/.jsii +6331 -2945
- package/node_modules/cdk-nag/.jsii.tabl.json +1 -1
- package/node_modules/cdk-nag/API.md +490 -1778
- package/node_modules/cdk-nag/MIGRATION.md +239 -0
- package/node_modules/cdk-nag/README.md +88 -513
- package/node_modules/cdk-nag/lib/index.d.ts +0 -3
- package/node_modules/cdk-nag/lib/index.js +1 -4
- package/node_modules/cdk-nag/lib/nag-logger.d.ts +5 -145
- package/node_modules/cdk-nag/lib/nag-logger.js +4 -199
- package/node_modules/cdk-nag/lib/nag-pack.d.ts +57 -44
- package/node_modules/cdk-nag/lib/nag-pack.js +140 -114
- package/node_modules/cdk-nag/lib/nag-rules.d.ts +0 -2
- package/node_modules/cdk-nag/lib/nag-rules.js +3 -5
- package/node_modules/cdk-nag/lib/packs/aws-solutions.d.ts +4 -15
- package/node_modules/cdk-nag/lib/packs/aws-solutions.js +21 -40
- package/node_modules/cdk-nag/lib/packs/hipaa-security.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/hipaa-security.js +31 -37
- package/node_modules/cdk-nag/lib/packs/nist-800-53-r4.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/nist-800-53-r4.js +29 -35
- package/node_modules/cdk-nag/lib/packs/nist-800-53-r5.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/nist-800-53-r5.js +30 -36
- package/node_modules/cdk-nag/lib/packs/pci-dss-321.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/pci-dss-321.js +29 -35
- package/node_modules/cdk-nag/lib/packs/serverless.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/serverless.js +14 -20
- package/node_modules/cdk-nag/lib/rules/ec2/EC2IMDSv2Enabled.js +5 -1
- package/node_modules/cdk-nag/package.json +5 -5
- package/package.json +16 -17
- package/node_modules/cdk-nag/lib/ignore-suppression-conditions.d.ts +0 -59
- package/node_modules/cdk-nag/lib/ignore-suppression-conditions.js +0 -97
- package/node_modules/cdk-nag/lib/models/nag-suppression.d.ts +0 -30
- package/node_modules/cdk-nag/lib/models/nag-suppression.js +0 -7
- package/node_modules/cdk-nag/lib/nag-suppressions.d.ts +0 -30
- package/node_modules/cdk-nag/lib/nag-suppressions.js +0 -96
- package/node_modules/cdk-nag/lib/utils/nag-suppression-helper.d.ts +0 -20
- package/node_modules/cdk-nag/lib/utils/nag-suppression-helper.js +0 -119
|
@@ -1,96 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
var _a;
|
|
3
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
4
|
-
exports.NagSuppressions = void 0;
|
|
5
|
-
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
|
|
6
|
-
/*
|
|
7
|
-
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
|
8
|
-
SPDX-License-Identifier: Apache-2.0
|
|
9
|
-
*/
|
|
10
|
-
const aws_cdk_lib_1 = require("aws-cdk-lib");
|
|
11
|
-
const nag_suppression_helper_1 = require("./utils/nag-suppression-helper");
|
|
12
|
-
/**
|
|
13
|
-
* Helper class with methods to add cdk-nag suppressions to cdk resources
|
|
14
|
-
*/
|
|
15
|
-
class NagSuppressions {
|
|
16
|
-
/**
|
|
17
|
-
* Apply cdk-nag suppressions to a Stack and optionally nested stacks
|
|
18
|
-
* @param stack The Stack to apply the suppression to
|
|
19
|
-
* @param suppressions A list of suppressions to apply to the stack
|
|
20
|
-
* @param applyToNestedStacks Apply the suppressions to children stacks (default:false)
|
|
21
|
-
*/
|
|
22
|
-
static addStackSuppressions(stack, suppressions, applyToNestedStacks = false) {
|
|
23
|
-
const stacks = applyToNestedStacks
|
|
24
|
-
? stack.node.findAll().filter((x) => x instanceof aws_cdk_lib_1.Stack)
|
|
25
|
-
: [stack];
|
|
26
|
-
stacks.forEach((s) => {
|
|
27
|
-
nag_suppression_helper_1.NagSuppressionHelper.assertSuppressionsAreValid(s.node.id, suppressions);
|
|
28
|
-
let metadata = s.templateOptions.metadata?.cdk_nag ?? {};
|
|
29
|
-
metadata = nag_suppression_helper_1.NagSuppressionHelper.addRulesToMetadata(metadata, suppressions);
|
|
30
|
-
if (!s.templateOptions.metadata) {
|
|
31
|
-
s.templateOptions.metadata = {};
|
|
32
|
-
}
|
|
33
|
-
s.templateOptions.metadata.cdk_nag = metadata;
|
|
34
|
-
});
|
|
35
|
-
}
|
|
36
|
-
/**
|
|
37
|
-
* Add cdk-nag suppressions to a CfnResource and optionally its children
|
|
38
|
-
* @param construct The IConstruct(s) to apply the suppression to
|
|
39
|
-
* @param suppressions A list of suppressions to apply to the resource
|
|
40
|
-
* @param applyToChildren Apply the suppressions to children CfnResources (default:false)
|
|
41
|
-
*/
|
|
42
|
-
static addResourceSuppressions(construct, suppressions, applyToChildren = false) {
|
|
43
|
-
const constructArray = Array.isArray(construct)
|
|
44
|
-
? construct
|
|
45
|
-
: [construct];
|
|
46
|
-
if (constructArray.length === 0) {
|
|
47
|
-
throw new Error(`Construct cannot be an empty array.`);
|
|
48
|
-
}
|
|
49
|
-
constructArray.forEach((c) => {
|
|
50
|
-
nag_suppression_helper_1.NagSuppressionHelper.assertSuppressionsAreValid(c.node.id, suppressions);
|
|
51
|
-
const constructs = applyToChildren ? c.node.findAll() : [c];
|
|
52
|
-
for (const child of constructs) {
|
|
53
|
-
const possibleL1 = child.node.defaultChild
|
|
54
|
-
? child.node.defaultChild
|
|
55
|
-
: child;
|
|
56
|
-
if (possibleL1 instanceof aws_cdk_lib_1.CfnResource) {
|
|
57
|
-
const resource = possibleL1;
|
|
58
|
-
let metadata = resource.getMetadata('cdk_nag');
|
|
59
|
-
metadata = nag_suppression_helper_1.NagSuppressionHelper.addRulesToMetadata(metadata, suppressions);
|
|
60
|
-
resource.addMetadata('cdk_nag', metadata);
|
|
61
|
-
}
|
|
62
|
-
}
|
|
63
|
-
});
|
|
64
|
-
}
|
|
65
|
-
/**
|
|
66
|
-
* Add cdk-nag suppressions to a CfnResource and optionally its children via its path
|
|
67
|
-
* @param stack The Stack the construct belongs to
|
|
68
|
-
* @param path The path(s) to the construct in the provided stack
|
|
69
|
-
* @param suppressions A list of suppressions to apply to the resource
|
|
70
|
-
* @param applyToChildren Apply the suppressions to children CfnResources (default:false)
|
|
71
|
-
*/
|
|
72
|
-
static addResourceSuppressionsByPath(stack, path, suppressions, applyToChildren = false) {
|
|
73
|
-
const pathArray = Array.isArray(path) ? path : [path];
|
|
74
|
-
if (pathArray.length === 0) {
|
|
75
|
-
throw new Error(`Path cannot be an empty array.`);
|
|
76
|
-
}
|
|
77
|
-
pathArray.forEach((p) => {
|
|
78
|
-
let added = false;
|
|
79
|
-
for (const child of stack.node.findAll()) {
|
|
80
|
-
const fixedPath = p.replace(/^\//, '');
|
|
81
|
-
if (child.node.path === fixedPath ||
|
|
82
|
-
child.node.path + '/Resource' === fixedPath) {
|
|
83
|
-
NagSuppressions.addResourceSuppressions(child, suppressions, applyToChildren);
|
|
84
|
-
added = true;
|
|
85
|
-
}
|
|
86
|
-
}
|
|
87
|
-
if (!added) {
|
|
88
|
-
throw new Error(`Suppression path "${p}" did not match any resource. This can occur when a resource does not exist or if a suppression is applied before a resource is created.`);
|
|
89
|
-
}
|
|
90
|
-
});
|
|
91
|
-
}
|
|
92
|
-
}
|
|
93
|
-
exports.NagSuppressions = NagSuppressions;
|
|
94
|
-
_a = JSII_RTTI_SYMBOL_1;
|
|
95
|
-
NagSuppressions[_a] = { fqn: "cdk-nag.NagSuppressions", version: "2.38.2" };
|
|
96
|
-
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFnLXN1cHByZXNzaW9ucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9uYWctc3VwcHJlc3Npb25zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUE7OztFQUdFO0FBQ0YsNkNBQWlEO0FBR2pELDJFQUFzRTtBQUV0RTs7R0FFRztBQUNILE1BQWEsZUFBZTtJQUMxQjs7Ozs7T0FLRztJQUNILE1BQU0sQ0FBQyxvQkFBb0IsQ0FDekIsS0FBWSxFQUNaLFlBQWtDLEVBQ2xDLHNCQUErQixLQUFLO1FBRXBDLE1BQU0sTUFBTSxHQUFHLG1CQUFtQjtZQUNoQyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQWMsRUFBRSxDQUFDLENBQUMsWUFBWSxtQkFBSyxDQUFDO1lBQ3BFLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ1osTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFO1lBQ25CLDZDQUFvQixDQUFDLDBCQUEwQixDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQ3pFLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQyxlQUFlLENBQUMsUUFBUSxFQUFFLE9BQU8sSUFBSSxFQUFFLENBQUM7WUFDekQsUUFBUSxHQUFHLDZDQUFvQixDQUFDLGtCQUFrQixDQUNoRCxRQUFRLEVBQ1IsWUFBWSxDQUNiLENBQUM7WUFDRixJQUFJLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztnQkFDaEMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxRQUFRLEdBQUcsRUFBRSxDQUFDO1lBQ2xDLENBQUM7WUFDRCxDQUFDLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEdBQUcsUUFBUSxDQUFDO1FBQ2hELENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsTUFBTSxDQUFDLHVCQUF1QixDQUM1QixTQUFvQyxFQUNwQyxZQUFrQyxFQUNsQyxrQkFBMkIsS0FBSztRQUVoQyxNQUFNLGNBQWMsR0FBaUIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUM7WUFDM0QsQ0FBQyxDQUFDLFNBQVM7WUFDWCxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoQixJQUFJLGNBQWMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDaEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFFRCxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7WUFDM0IsNkNBQW9CLENBQUMsMEJBQTBCLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsWUFBWSxDQUFDLENBQUM7WUFDekUsTUFBTSxVQUFVLEdBQUcsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzVELEtBQUssTUFBTSxLQUFLLElBQUksVUFBVSxFQUFFLENBQUM7Z0JBQy9CLE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWTtvQkFDeEMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWTtvQkFDekIsQ0FBQyxDQUFDLEtBQUssQ0FBQztnQkFDVixJQUFJLFVBQVUsWUFBWSx5QkFBVyxFQUFFLENBQUM7b0JBQ3RDLE1BQU0sUUFBUSxHQUFHLFVBQXlCLENBQUM7b0JBQzNDLElBQUksUUFBUSxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDLENBQUM7b0JBQy9DLFFBQVEsR0FBRyw2Q0FBb0IsQ0FBQyxrQkFBa0IsQ0FDaEQsUUFBUSxFQUNSLFlBQVksQ0FDYixDQUFDO29CQUNGLFFBQVEsQ0FBQyxXQUFXLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUM1QyxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNILE1BQU0sQ0FBQyw2QkFBNkIsQ0FDbEMsS0FBWSxFQUNaLElBQXVCLEVBQ3ZCLFlBQWtDLEVBQ2xDLGtCQUEyQixLQUFLO1FBRWhDLE1BQU0sU0FBUyxHQUFhLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNoRSxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDM0IsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFFRCxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7WUFDdEIsSUFBSSxLQUFLLEdBQUcsS0FBSyxDQUFDO1lBQ2xCLEtBQUssTUFBTSxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO2dCQUN6QyxNQUFNLFNBQVMsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDdkMsSUFDRSxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksS0FBSyxTQUFTO29CQUM3QixLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxXQUFXLEtBQUssU0FBUyxFQUMzQyxDQUFDO29CQUNELGVBQWUsQ0FBQyx1QkFBdUIsQ0FDckMsS0FBSyxFQUNMLFlBQVksRUFDWixlQUFlLENBQ2hCLENBQUM7b0JBQ0YsS0FBSyxHQUFHLElBQUksQ0FBQztnQkFDZixDQUFDO1lBQ0gsQ0FBQztZQUNELElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDWCxNQUFNLElBQUksS0FBSyxDQUNiLHFCQUFxQixDQUFDLDBJQUEwSSxDQUNqSyxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUEzR0gsMENBNEdDIiwic291cmNlc0NvbnRlbnQiOlsiLypcbkNvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcbiovXG5pbXBvcnQgeyBDZm5SZXNvdXJjZSwgU3RhY2sgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBJQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBOYWdQYWNrU3VwcHJlc3Npb24gfSBmcm9tICcuL21vZGVscy9uYWctc3VwcHJlc3Npb24nO1xuaW1wb3J0IHsgTmFnU3VwcHJlc3Npb25IZWxwZXIgfSBmcm9tICcuL3V0aWxzL25hZy1zdXBwcmVzc2lvbi1oZWxwZXInO1xuXG4vKipcbiAqIEhlbHBlciBjbGFzcyB3aXRoIG1ldGhvZHMgdG8gYWRkIGNkay1uYWcgc3VwcHJlc3Npb25zIHRvIGNkayByZXNvdXJjZXNcbiAqL1xuZXhwb3J0IGNsYXNzIE5hZ1N1cHByZXNzaW9ucyB7XG4gIC8qKlxuICAgKiBBcHBseSBjZGstbmFnIHN1cHByZXNzaW9ucyB0byBhIFN0YWNrIGFuZCBvcHRpb25hbGx5IG5lc3RlZCBzdGFja3NcbiAgICogQHBhcmFtIHN0YWNrIFRoZSBTdGFjayB0byBhcHBseSB0aGUgc3VwcHJlc3Npb24gdG9cbiAgICogQHBhcmFtIHN1cHByZXNzaW9ucyBBIGxpc3Qgb2Ygc3VwcHJlc3Npb25zIHRvIGFwcGx5IHRvIHRoZSBzdGFja1xuICAgKiBAcGFyYW0gYXBwbHlUb05lc3RlZFN0YWNrcyBBcHBseSB0aGUgc3VwcHJlc3Npb25zIHRvIGNoaWxkcmVuIHN0YWNrcyAoZGVmYXVsdDpmYWxzZSlcbiAgICovXG4gIHN0YXRpYyBhZGRTdGFja1N1cHByZXNzaW9ucyhcbiAgICBzdGFjazogU3RhY2ssXG4gICAgc3VwcHJlc3Npb25zOiBOYWdQYWNrU3VwcHJlc3Npb25bXSxcbiAgICBhcHBseVRvTmVzdGVkU3RhY2tzOiBib29sZWFuID0gZmFsc2VcbiAgKTogdm9pZCB7XG4gICAgY29uc3Qgc3RhY2tzID0gYXBwbHlUb05lc3RlZFN0YWNrc1xuICAgICAgPyBzdGFjay5ub2RlLmZpbmRBbGwoKS5maWx0ZXIoKHgpOiB4IGlzIFN0YWNrID0+IHggaW5zdGFuY2VvZiBTdGFjaylcbiAgICAgIDogW3N0YWNrXTtcbiAgICBzdGFja3MuZm9yRWFjaCgocykgPT4ge1xuICAgICAgTmFnU3VwcHJlc3Npb25IZWxwZXIuYXNzZXJ0U3VwcHJlc3Npb25zQXJlVmFsaWQocy5ub2RlLmlkLCBzdXBwcmVzc2lvbnMpO1xuICAgICAgbGV0IG1ldGFkYXRhID0gcy50ZW1wbGF0ZU9wdGlvbnMubWV0YWRhdGE/LmNka19uYWcgPz8ge307XG4gICAgICBtZXRhZGF0YSA9IE5hZ1N1cHByZXNzaW9uSGVscGVyLmFkZFJ1bGVzVG9NZXRhZGF0YShcbiAgICAgICAgbWV0YWRhdGEsXG4gICAgICAgIHN1cHByZXNzaW9uc1xuICAgICAgKTtcbiAgICAgIGlmICghcy50ZW1wbGF0ZU9wdGlvbnMubWV0YWRhdGEpIHtcbiAgICAgICAgcy50ZW1wbGF0ZU9wdGlvbnMubWV0YWRhdGEgPSB7fTtcbiAgICAgIH1cbiAgICAgIHMudGVtcGxhdGVPcHRpb25zLm1ldGFkYXRhLmNka19uYWcgPSBtZXRhZGF0YTtcbiAgICB9KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBBZGQgY2RrLW5hZyBzdXBwcmVzc2lvbnMgdG8gYSBDZm5SZXNvdXJjZSBhbmQgb3B0aW9uYWxseSBpdHMgY2hpbGRyZW5cbiAgICogQHBhcmFtIGNvbnN0cnVjdCBUaGUgSUNvbnN0cnVjdChzKSB0byBhcHBseSB0aGUgc3VwcHJlc3Npb24gdG9cbiAgICogQHBhcmFtIHN1cHByZXNzaW9ucyBBIGxpc3Qgb2Ygc3VwcHJlc3Npb25zIHRvIGFwcGx5IHRvIHRoZSByZXNvdXJjZVxuICAgKiBAcGFyYW0gYXBwbHlUb0NoaWxkcmVuIEFwcGx5IHRoZSBzdXBwcmVzc2lvbnMgdG8gY2hpbGRyZW4gQ2ZuUmVzb3VyY2VzICAoZGVmYXVsdDpmYWxzZSlcbiAgICovXG4gIHN0YXRpYyBhZGRSZXNvdXJjZVN1cHByZXNzaW9ucyhcbiAgICBjb25zdHJ1Y3Q6IElDb25zdHJ1Y3QgfCBJQ29uc3RydWN0W10sXG4gICAgc3VwcHJlc3Npb25zOiBOYWdQYWNrU3VwcHJlc3Npb25bXSxcbiAgICBhcHBseVRvQ2hpbGRyZW46IGJvb2xlYW4gPSBmYWxzZVxuICApOiB2b2lkIHtcbiAgICBjb25zdCBjb25zdHJ1Y3RBcnJheTogSUNvbnN0cnVjdFtdID0gQXJyYXkuaXNBcnJheShjb25zdHJ1Y3QpXG4gICAgICA/IGNvbnN0cnVjdFxuICAgICAgOiBbY29uc3RydWN0XTtcbiAgICBpZiAoY29uc3RydWN0QXJyYXkubGVuZ3RoID09PSAwKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYENvbnN0cnVjdCBjYW5ub3QgYmUgYW4gZW1wdHkgYXJyYXkuYCk7XG4gICAgfVxuXG4gICAgY29uc3RydWN0QXJyYXkuZm9yRWFjaCgoYykgPT4ge1xuICAgICAgTmFnU3VwcHJlc3Npb25IZWxwZXIuYXNzZXJ0U3VwcHJlc3Npb25zQXJlVmFsaWQoYy5ub2RlLmlkLCBzdXBwcmVzc2lvbnMpO1xuICAgICAgY29uc3QgY29uc3RydWN0cyA9IGFwcGx5VG9DaGlsZHJlbiA/IGMubm9kZS5maW5kQWxsKCkgOiBbY107XG4gICAgICBmb3IgKGNvbnN0IGNoaWxkIG9mIGNvbnN0cnVjdHMpIHtcbiAgICAgICAgY29uc3QgcG9zc2libGVMMSA9IGNoaWxkLm5vZGUuZGVmYXVsdENoaWxkXG4gICAgICAgICAgPyBjaGlsZC5ub2RlLmRlZmF1bHRDaGlsZFxuICAgICAgICAgIDogY2hpbGQ7XG4gICAgICAgIGlmIChwb3NzaWJsZUwxIGluc3RhbmNlb2YgQ2ZuUmVzb3VyY2UpIHtcbiAgICAgICAgICBjb25zdCByZXNvdXJjZSA9IHBvc3NpYmxlTDEgYXMgQ2ZuUmVzb3VyY2U7XG4gICAgICAgICAgbGV0IG1ldGFkYXRhID0gcmVzb3VyY2UuZ2V0TWV0YWRhdGEoJ2Nka19uYWcnKTtcbiAgICAgICAgICBtZXRhZGF0YSA9IE5hZ1N1cHByZXNzaW9uSGVscGVyLmFkZFJ1bGVzVG9NZXRhZGF0YShcbiAgICAgICAgICAgIG1ldGFkYXRhLFxuICAgICAgICAgICAgc3VwcHJlc3Npb25zXG4gICAgICAgICAgKTtcbiAgICAgICAgICByZXNvdXJjZS5hZGRNZXRhZGF0YSgnY2RrX25hZycsIG1ldGFkYXRhKTtcbiAgICAgICAgfVxuICAgICAgfVxuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIEFkZCBjZGstbmFnIHN1cHByZXNzaW9ucyB0byBhIENmblJlc291cmNlIGFuZCBvcHRpb25hbGx5IGl0cyBjaGlsZHJlbiB2aWEgaXRzIHBhdGhcbiAgICogQHBhcmFtIHN0YWNrIFRoZSBTdGFjayB0aGUgY29uc3RydWN0IGJlbG9uZ3MgdG9cbiAgICogQHBhcmFtIHBhdGggVGhlIHBhdGgocykgdG8gdGhlIGNvbnN0cnVjdCBpbiB0aGUgcHJvdmlkZWQgc3RhY2tcbiAgICogQHBhcmFtIHN1cHByZXNzaW9ucyBBIGxpc3Qgb2Ygc3VwcHJlc3Npb25zIHRvIGFwcGx5IHRvIHRoZSByZXNvdXJjZVxuICAgKiBAcGFyYW0gYXBwbHlUb0NoaWxkcmVuIEFwcGx5IHRoZSBzdXBwcmVzc2lvbnMgdG8gY2hpbGRyZW4gQ2ZuUmVzb3VyY2VzICAoZGVmYXVsdDpmYWxzZSlcbiAgICovXG4gIHN0YXRpYyBhZGRSZXNvdXJjZVN1cHByZXNzaW9uc0J5UGF0aChcbiAgICBzdGFjazogU3RhY2ssXG4gICAgcGF0aDogc3RyaW5nIHwgc3RyaW5nW10sXG4gICAgc3VwcHJlc3Npb25zOiBOYWdQYWNrU3VwcHJlc3Npb25bXSxcbiAgICBhcHBseVRvQ2hpbGRyZW46IGJvb2xlYW4gPSBmYWxzZVxuICApOiB2b2lkIHtcbiAgICBjb25zdCBwYXRoQXJyYXk6IHN0cmluZ1tdID0gQXJyYXkuaXNBcnJheShwYXRoKSA/IHBhdGggOiBbcGF0aF07XG4gICAgaWYgKHBhdGhBcnJheS5sZW5ndGggPT09IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgUGF0aCBjYW5ub3QgYmUgYW4gZW1wdHkgYXJyYXkuYCk7XG4gICAgfVxuXG4gICAgcGF0aEFycmF5LmZvckVhY2goKHApID0+IHtcbiAgICAgIGxldCBhZGRlZCA9IGZhbHNlO1xuICAgICAgZm9yIChjb25zdCBjaGlsZCBvZiBzdGFjay5ub2RlLmZpbmRBbGwoKSkge1xuICAgICAgICBjb25zdCBmaXhlZFBhdGggPSBwLnJlcGxhY2UoL15cXC8vLCAnJyk7XG4gICAgICAgIGlmIChcbiAgICAgICAgICBjaGlsZC5ub2RlLnBhdGggPT09IGZpeGVkUGF0aCB8fFxuICAgICAgICAgIGNoaWxkLm5vZGUucGF0aCArICcvUmVzb3VyY2UnID09PSBmaXhlZFBhdGhcbiAgICAgICAgKSB7XG4gICAgICAgICAgTmFnU3VwcHJlc3Npb25zLmFkZFJlc291cmNlU3VwcHJlc3Npb25zKFxuICAgICAgICAgICAgY2hpbGQsXG4gICAgICAgICAgICBzdXBwcmVzc2lvbnMsXG4gICAgICAgICAgICBhcHBseVRvQ2hpbGRyZW5cbiAgICAgICAgICApO1xuICAgICAgICAgIGFkZGVkID0gdHJ1ZTtcbiAgICAgICAgfVxuICAgICAgfVxuICAgICAgaWYgKCFhZGRlZCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgYFN1cHByZXNzaW9uIHBhdGggXCIke3B9XCIgZGlkIG5vdCBtYXRjaCBhbnkgcmVzb3VyY2UuIFRoaXMgY2FuIG9jY3VyIHdoZW4gYSByZXNvdXJjZSBkb2VzIG5vdCBleGlzdCBvciBpZiBhIHN1cHByZXNzaW9uIGlzIGFwcGxpZWQgYmVmb3JlIGEgcmVzb3VyY2UgaXMgY3JlYXRlZC5gXG4gICAgICAgICk7XG4gICAgICB9XG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==
|
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
import { CfnResource } from 'aws-cdk-lib';
|
|
2
|
-
import { NagPackSuppression, NagPackSuppressionAppliesTo } from '../models/nag-suppression';
|
|
3
|
-
interface NagCfnMetadata {
|
|
4
|
-
rules_to_suppress: NagCfnSuppression[];
|
|
5
|
-
}
|
|
6
|
-
interface NagCfnSuppression extends Omit<NagPackSuppression, 'appliesTo'> {
|
|
7
|
-
applies_to?: NagPackSuppressionAppliesTo[];
|
|
8
|
-
is_reason_encoded?: boolean;
|
|
9
|
-
}
|
|
10
|
-
export declare class NagSuppressionHelper {
|
|
11
|
-
static toCfnFormat(suppression: NagPackSuppression): NagCfnSuppression;
|
|
12
|
-
static toApiFormat(suppression: NagCfnSuppression): NagPackSuppression;
|
|
13
|
-
static addRulesToMetadata(metadata: NagCfnMetadata, rules: NagPackSuppression[]): NagCfnMetadata;
|
|
14
|
-
static getSuppressions(node: CfnResource): NagPackSuppression[];
|
|
15
|
-
static assertSuppressionsAreValid(id: string, suppressions: NagPackSuppression[]): void;
|
|
16
|
-
static doesApply(suppression: NagPackSuppression, ruleId: string, findingId: string): boolean;
|
|
17
|
-
private static getSuppressionFormatError;
|
|
18
|
-
private static toRegEx;
|
|
19
|
-
}
|
|
20
|
-
export {};
|
|
@@ -1,119 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.NagSuppressionHelper = void 0;
|
|
4
|
-
/*
|
|
5
|
-
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
|
6
|
-
SPDX-License-Identifier: Apache-2.0
|
|
7
|
-
*/
|
|
8
|
-
const buffer_1 = require("buffer");
|
|
9
|
-
const aws_cdk_lib_1 = require("aws-cdk-lib");
|
|
10
|
-
class NagSuppressionHelper {
|
|
11
|
-
static toCfnFormat(suppression) {
|
|
12
|
-
const { appliesTo, reason, ...result } = suppression;
|
|
13
|
-
if (appliesTo) {
|
|
14
|
-
result.applies_to = appliesTo;
|
|
15
|
-
}
|
|
16
|
-
if ([...reason].some((c) => c.codePointAt(0) === undefined ? false : c.codePointAt(0) > 255)) {
|
|
17
|
-
result.is_reason_encoded = true;
|
|
18
|
-
return { reason: buffer_1.Buffer.from(reason).toString('base64'), ...result };
|
|
19
|
-
}
|
|
20
|
-
return { reason, ...result };
|
|
21
|
-
}
|
|
22
|
-
static toApiFormat(suppression) {
|
|
23
|
-
const { applies_to, reason, is_reason_encoded, ...result } = suppression;
|
|
24
|
-
if (applies_to) {
|
|
25
|
-
result.appliesTo = applies_to;
|
|
26
|
-
}
|
|
27
|
-
if (is_reason_encoded) {
|
|
28
|
-
return { reason: buffer_1.Buffer.from(reason, 'base64').toString(), ...result };
|
|
29
|
-
}
|
|
30
|
-
return { reason, ...result };
|
|
31
|
-
}
|
|
32
|
-
static addRulesToMetadata(metadata, rules) {
|
|
33
|
-
const { rules_to_suppress } = metadata ?? {};
|
|
34
|
-
const serialisedRules = [
|
|
35
|
-
...(rules_to_suppress ?? []).map((r) => JSON.stringify(r)),
|
|
36
|
-
...rules
|
|
37
|
-
.map(NagSuppressionHelper.toCfnFormat)
|
|
38
|
-
.map((r) => JSON.stringify(r)),
|
|
39
|
-
];
|
|
40
|
-
const deduplicatedRules = Array.from(new Set(serialisedRules));
|
|
41
|
-
return { rules_to_suppress: deduplicatedRules.map((r) => JSON.parse(r)) };
|
|
42
|
-
}
|
|
43
|
-
static getSuppressions(node) {
|
|
44
|
-
const resourceIgnores = node.getMetadata('cdk_nag')?.rules_to_suppress ?? [];
|
|
45
|
-
const stackIgnores = aws_cdk_lib_1.Stack.of(node).templateOptions.metadata?.cdk_nag?.rules_to_suppress ?? [];
|
|
46
|
-
const result = [...resourceIgnores, ...stackIgnores].map(NagSuppressionHelper.toApiFormat);
|
|
47
|
-
NagSuppressionHelper.assertSuppressionsAreValid(node.node.id, result);
|
|
48
|
-
return result;
|
|
49
|
-
}
|
|
50
|
-
static assertSuppressionsAreValid(id, suppressions) {
|
|
51
|
-
const errors = suppressions
|
|
52
|
-
.map(NagSuppressionHelper.getSuppressionFormatError)
|
|
53
|
-
.filter((errorMessage) => !!errorMessage);
|
|
54
|
-
if (errors.length) {
|
|
55
|
-
throw Error(`${id}: ${errors.join('')}\nSee https://github.com/cdklabs/cdk-nag#suppressing-a-rule for information on suppressing a rule.`);
|
|
56
|
-
}
|
|
57
|
-
}
|
|
58
|
-
static doesApply(suppression, ruleId, findingId) {
|
|
59
|
-
if (ruleId !== suppression.id) {
|
|
60
|
-
return false;
|
|
61
|
-
}
|
|
62
|
-
if (!suppression.appliesTo) {
|
|
63
|
-
// the rule is not granular so it always applies
|
|
64
|
-
return true;
|
|
65
|
-
}
|
|
66
|
-
if (findingId &&
|
|
67
|
-
suppression.appliesTo.some((appliesTo) => {
|
|
68
|
-
if (typeof appliesTo === 'string') {
|
|
69
|
-
return appliesTo === findingId;
|
|
70
|
-
}
|
|
71
|
-
else {
|
|
72
|
-
const regex = NagSuppressionHelper.toRegEx(appliesTo.regex);
|
|
73
|
-
return regex.test(findingId);
|
|
74
|
-
}
|
|
75
|
-
})) {
|
|
76
|
-
return true;
|
|
77
|
-
}
|
|
78
|
-
return false;
|
|
79
|
-
}
|
|
80
|
-
static getSuppressionFormatError(suppression) {
|
|
81
|
-
let errors = '';
|
|
82
|
-
const finding = suppression.id.match(/\[.*\]/);
|
|
83
|
-
if (finding) {
|
|
84
|
-
errors += `The suppression 'id' contains a finding '${finding}. A finding must be suppressed using 'applies_to'.`;
|
|
85
|
-
}
|
|
86
|
-
if (suppression.reason.length < 10) {
|
|
87
|
-
errors +=
|
|
88
|
-
"The suppression must have a 'reason' of 10 characters or more.";
|
|
89
|
-
}
|
|
90
|
-
(suppression.appliesTo ?? []).forEach((appliesTo) => {
|
|
91
|
-
if (typeof appliesTo !== 'string') {
|
|
92
|
-
try {
|
|
93
|
-
NagSuppressionHelper.toRegEx(appliesTo.regex);
|
|
94
|
-
}
|
|
95
|
-
catch (err) {
|
|
96
|
-
errors += err.message;
|
|
97
|
-
}
|
|
98
|
-
}
|
|
99
|
-
});
|
|
100
|
-
return errors
|
|
101
|
-
? `\n\tError(s) detected in suppression with 'id' ${suppression.id}. ${errors}`
|
|
102
|
-
: '';
|
|
103
|
-
}
|
|
104
|
-
static toRegEx(s) {
|
|
105
|
-
try {
|
|
106
|
-
// verify that the regex is correctly formatted
|
|
107
|
-
const m = s.match(/\/(.*)\/(.*)?/);
|
|
108
|
-
if (!m) {
|
|
109
|
-
throw new Error();
|
|
110
|
-
}
|
|
111
|
-
return new RegExp(m[1], m[2] || '');
|
|
112
|
-
}
|
|
113
|
-
catch {
|
|
114
|
-
throw new Error(`Invalid regular expression [${s}]`);
|
|
115
|
-
}
|
|
116
|
-
}
|
|
117
|
-
}
|
|
118
|
-
exports.NagSuppressionHelper = NagSuppressionHelper;
|
|
119
|
-
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFnLXN1cHByZXNzaW9uLWhlbHBlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9uYWctc3VwcHJlc3Npb24taGVscGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7RUFHRTtBQUNGLG1DQUFnQztBQUNoQyw2Q0FBaUQ7QUFlakQsTUFBYSxvQkFBb0I7SUFDL0IsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUErQjtRQUNoRCxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sRUFBRSxHQUFHLFdBQVcsQ0FBQztRQUVyRCxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQ2IsTUFBNEIsQ0FBQyxVQUFVLEdBQUcsU0FBUyxDQUFDO1FBQ3ZELENBQUM7UUFDRCxJQUNFLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUNyQixDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBRSxHQUFHLEdBQUcsQ0FDakUsRUFDRCxDQUFDO1lBQ0EsTUFBNEIsQ0FBQyxpQkFBaUIsR0FBRyxJQUFJLENBQUM7WUFDdkQsT0FBTyxFQUFFLE1BQU0sRUFBRSxlQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxDQUFDO1FBQ3ZFLENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxFQUFFLENBQUM7SUFDL0IsQ0FBQztJQUVELE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBOEI7UUFDL0MsTUFBTSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsaUJBQWlCLEVBQUUsR0FBRyxNQUFNLEVBQUUsR0FBRyxXQUFXLENBQUM7UUFFekUsSUFBSSxVQUFVLEVBQUUsQ0FBQztZQUNkLE1BQWMsQ0FBQyxTQUFTLEdBQUcsVUFBVSxDQUFDO1FBQ3pDLENBQUM7UUFDRCxJQUFJLGlCQUFpQixFQUFFLENBQUM7WUFDdEIsT0FBTyxFQUFFLE1BQU0sRUFBRSxlQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxHQUFHLE1BQU0sRUFBRSxDQUFDO1FBQ3pFLENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxFQUFFLENBQUM7SUFDL0IsQ0FBQztJQUVELE1BQU0sQ0FBQyxrQkFBa0IsQ0FDdkIsUUFBd0IsRUFDeEIsS0FBMkI7UUFFM0IsTUFBTSxFQUFFLGlCQUFpQixFQUFFLEdBQUcsUUFBUSxJQUFJLEVBQUUsQ0FBQztRQUM3QyxNQUFNLGVBQWUsR0FBRztZQUN0QixHQUFHLENBQUMsaUJBQWlCLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzFELEdBQUcsS0FBSztpQkFDTCxHQUFHLENBQUMsb0JBQW9CLENBQUMsV0FBVyxDQUFDO2lCQUNyQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7U0FDakMsQ0FBQztRQUNGLE1BQU0saUJBQWlCLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDO1FBQy9ELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzVFLENBQUM7SUFFRCxNQUFNLENBQUMsZUFBZSxDQUFDLElBQWlCO1FBQ3RDLE1BQU0sZUFBZSxHQUNuQixJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxFQUFFLGlCQUFpQixJQUFJLEVBQUUsQ0FBQztRQUN2RCxNQUFNLFlBQVksR0FDaEIsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsZUFBZSxDQUFDLFFBQVEsRUFBRSxPQUFPLEVBQUUsaUJBQWlCLElBQUksRUFBRSxDQUFDO1FBQzVFLE1BQU0sTUFBTSxHQUFHLENBQUMsR0FBRyxlQUFlLEVBQUUsR0FBRyxZQUFZLENBQUMsQ0FBQyxHQUFHLENBQ3RELG9CQUFvQixDQUFDLFdBQVcsQ0FDakMsQ0FBQztRQUNGLG9CQUFvQixDQUFDLDBCQUEwQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3RFLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFRCxNQUFNLENBQUMsMEJBQTBCLENBQy9CLEVBQVUsRUFDVixZQUFrQztRQUVsQyxNQUFNLE1BQU0sR0FBRyxZQUFZO2FBQ3hCLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQyx5QkFBeUIsQ0FBQzthQUNuRCxNQUFNLENBQUMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUU1QyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNsQixNQUFNLEtBQUssQ0FDVCxHQUFHLEVBQUUsS0FBSyxNQUFNLENBQUMsSUFBSSxDQUNuQixFQUFFLENBQ0gsb0dBQW9HLENBQ3RHLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVELE1BQU0sQ0FBQyxTQUFTLENBQ2QsV0FBK0IsRUFDL0IsTUFBYyxFQUNkLFNBQWlCO1FBRWpCLElBQUksTUFBTSxLQUFLLFdBQVcsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUM5QixPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFFRCxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQzNCLGdEQUFnRDtZQUNoRCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFFRCxJQUNFLFNBQVM7WUFDVCxXQUFXLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFO2dCQUN2QyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsRUFBRSxDQUFDO29CQUNsQyxPQUFPLFNBQVMsS0FBSyxTQUFTLENBQUM7Z0JBQ2pDLENBQUM7cUJBQU0sQ0FBQztvQkFDTixNQUFNLEtBQUssR0FBRyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUM1RCxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQy9CLENBQUM7WUFDSCxDQUFDLENBQUMsRUFDRixDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBRUQsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRU8sTUFBTSxDQUFDLHlCQUF5QixDQUN0QyxXQUErQjtRQUUvQixJQUFJLE1BQU0sR0FBRyxFQUFFLENBQUM7UUFDaEIsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDL0MsSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUNaLE1BQU0sSUFBSSw0Q0FBNEMsT0FBTyxvREFBb0QsQ0FBQztRQUNwSCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUNuQyxNQUFNO2dCQUNKLGdFQUFnRSxDQUFDO1FBQ3JFLENBQUM7UUFDRCxDQUFDLFdBQVcsQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUU7WUFDbEQsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztnQkFDbEMsSUFBSSxDQUFDO29CQUNILG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ2hELENBQUM7Z0JBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztvQkFDYixNQUFNLElBQUssR0FBYSxDQUFDLE9BQU8sQ0FBQztnQkFDbkMsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUNILE9BQU8sTUFBTTtZQUNYLENBQUMsQ0FBQyxrREFBa0QsV0FBVyxDQUFDLEVBQUUsS0FBSyxNQUFNLEVBQUU7WUFDL0UsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNULENBQUM7SUFFTyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQVM7UUFDOUIsSUFBSSxDQUFDO1lBQ0gsK0NBQStDO1lBQy9DLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDbkMsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUNQLE1BQU0sSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNwQixDQUFDO1lBQ0QsT0FBTyxJQUFJLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3RDLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUEvSUQsb0RBK0lDIiwic291cmNlc0NvbnRlbnQiOlsiLypcbkNvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcbiovXG5pbXBvcnQgeyBCdWZmZXIgfSBmcm9tICdidWZmZXInO1xuaW1wb3J0IHsgQ2ZuUmVzb3VyY2UsIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHtcbiAgTmFnUGFja1N1cHByZXNzaW9uLFxuICBOYWdQYWNrU3VwcHJlc3Npb25BcHBsaWVzVG8sXG59IGZyb20gJy4uL21vZGVscy9uYWctc3VwcHJlc3Npb24nO1xuXG5pbnRlcmZhY2UgTmFnQ2ZuTWV0YWRhdGEge1xuICBydWxlc190b19zdXBwcmVzczogTmFnQ2ZuU3VwcHJlc3Npb25bXTtcbn1cblxuaW50ZXJmYWNlIE5hZ0NmblN1cHByZXNzaW9uIGV4dGVuZHMgT21pdDxOYWdQYWNrU3VwcHJlc3Npb24sICdhcHBsaWVzVG8nPiB7XG4gIGFwcGxpZXNfdG8/OiBOYWdQYWNrU3VwcHJlc3Npb25BcHBsaWVzVG9bXTtcbiAgaXNfcmVhc29uX2VuY29kZWQ/OiBib29sZWFuO1xufVxuXG5leHBvcnQgY2xhc3MgTmFnU3VwcHJlc3Npb25IZWxwZXIge1xuICBzdGF0aWMgdG9DZm5Gb3JtYXQoc3VwcHJlc3Npb246IE5hZ1BhY2tTdXBwcmVzc2lvbik6IE5hZ0NmblN1cHByZXNzaW9uIHtcbiAgICBjb25zdCB7IGFwcGxpZXNUbywgcmVhc29uLCAuLi5yZXN1bHQgfSA9IHN1cHByZXNzaW9uO1xuXG4gICAgaWYgKGFwcGxpZXNUbykge1xuICAgICAgKHJlc3VsdCBhcyBOYWdDZm5TdXBwcmVzc2lvbikuYXBwbGllc190byA9IGFwcGxpZXNUbztcbiAgICB9XG4gICAgaWYgKFxuICAgICAgWy4uLnJlYXNvbl0uc29tZSgoYykgPT5cbiAgICAgICAgYy5jb2RlUG9pbnRBdCgwKSA9PT0gdW5kZWZpbmVkID8gZmFsc2UgOiBjLmNvZGVQb2ludEF0KDApISA+IDI1NVxuICAgICAgKVxuICAgICkge1xuICAgICAgKHJlc3VsdCBhcyBOYWdDZm5TdXBwcmVzc2lvbikuaXNfcmVhc29uX2VuY29kZWQgPSB0cnVlO1xuICAgICAgcmV0dXJuIHsgcmVhc29uOiBCdWZmZXIuZnJvbShyZWFzb24pLnRvU3RyaW5nKCdiYXNlNjQnKSwgLi4ucmVzdWx0IH07XG4gICAgfVxuICAgIHJldHVybiB7IHJlYXNvbiwgLi4ucmVzdWx0IH07XG4gIH1cblxuICBzdGF0aWMgdG9BcGlGb3JtYXQoc3VwcHJlc3Npb246IE5hZ0NmblN1cHByZXNzaW9uKTogTmFnUGFja1N1cHByZXNzaW9uIHtcbiAgICBjb25zdCB7IGFwcGxpZXNfdG8sIHJlYXNvbiwgaXNfcmVhc29uX2VuY29kZWQsIC4uLnJlc3VsdCB9ID0gc3VwcHJlc3Npb247XG5cbiAgICBpZiAoYXBwbGllc190bykge1xuICAgICAgKHJlc3VsdCBhcyBhbnkpLmFwcGxpZXNUbyA9IGFwcGxpZXNfdG87XG4gICAgfVxuICAgIGlmIChpc19yZWFzb25fZW5jb2RlZCkge1xuICAgICAgcmV0dXJuIHsgcmVhc29uOiBCdWZmZXIuZnJvbShyZWFzb24sICdiYXNlNjQnKS50b1N0cmluZygpLCAuLi5yZXN1bHQgfTtcbiAgICB9XG4gICAgcmV0dXJuIHsgcmVhc29uLCAuLi5yZXN1bHQgfTtcbiAgfVxuXG4gIHN0YXRpYyBhZGRSdWxlc1RvTWV0YWRhdGEoXG4gICAgbWV0YWRhdGE6IE5hZ0Nmbk1ldGFkYXRhLFxuICAgIHJ1bGVzOiBOYWdQYWNrU3VwcHJlc3Npb25bXVxuICApOiBOYWdDZm5NZXRhZGF0YSB7XG4gICAgY29uc3QgeyBydWxlc190b19zdXBwcmVzcyB9ID0gbWV0YWRhdGEgPz8ge307XG4gICAgY29uc3Qgc2VyaWFsaXNlZFJ1bGVzID0gW1xuICAgICAgLi4uKHJ1bGVzX3RvX3N1cHByZXNzID8/IFtdKS5tYXAoKHIpID0+IEpTT04uc3RyaW5naWZ5KHIpKSxcbiAgICAgIC4uLnJ1bGVzXG4gICAgICAgIC5tYXAoTmFnU3VwcHJlc3Npb25IZWxwZXIudG9DZm5Gb3JtYXQpXG4gICAgICAgIC5tYXAoKHIpID0+IEpTT04uc3RyaW5naWZ5KHIpKSxcbiAgICBdO1xuICAgIGNvbnN0IGRlZHVwbGljYXRlZFJ1bGVzID0gQXJyYXkuZnJvbShuZXcgU2V0KHNlcmlhbGlzZWRSdWxlcykpO1xuICAgIHJldHVybiB7IHJ1bGVzX3RvX3N1cHByZXNzOiBkZWR1cGxpY2F0ZWRSdWxlcy5tYXAoKHIpID0+IEpTT04ucGFyc2UocikpIH07XG4gIH1cblxuICBzdGF0aWMgZ2V0U3VwcHJlc3Npb25zKG5vZGU6IENmblJlc291cmNlKTogTmFnUGFja1N1cHByZXNzaW9uW10ge1xuICAgIGNvbnN0IHJlc291cmNlSWdub3JlcyA9XG4gICAgICBub2RlLmdldE1ldGFkYXRhKCdjZGtfbmFnJyk/LnJ1bGVzX3RvX3N1cHByZXNzID8/IFtdO1xuICAgIGNvbnN0IHN0YWNrSWdub3JlcyA9XG4gICAgICBTdGFjay5vZihub2RlKS50ZW1wbGF0ZU9wdGlvbnMubWV0YWRhdGE/LmNka19uYWc/LnJ1bGVzX3RvX3N1cHByZXNzID8/IFtdO1xuICAgIGNvbnN0IHJlc3VsdCA9IFsuLi5yZXNvdXJjZUlnbm9yZXMsIC4uLnN0YWNrSWdub3Jlc10ubWFwKFxuICAgICAgTmFnU3VwcHJlc3Npb25IZWxwZXIudG9BcGlGb3JtYXRcbiAgICApO1xuICAgIE5hZ1N1cHByZXNzaW9uSGVscGVyLmFzc2VydFN1cHByZXNzaW9uc0FyZVZhbGlkKG5vZGUubm9kZS5pZCwgcmVzdWx0KTtcbiAgICByZXR1cm4gcmVzdWx0O1xuICB9XG5cbiAgc3RhdGljIGFzc2VydFN1cHByZXNzaW9uc0FyZVZhbGlkKFxuICAgIGlkOiBzdHJpbmcsXG4gICAgc3VwcHJlc3Npb25zOiBOYWdQYWNrU3VwcHJlc3Npb25bXVxuICApOiB2b2lkIHtcbiAgICBjb25zdCBlcnJvcnMgPSBzdXBwcmVzc2lvbnNcbiAgICAgIC5tYXAoTmFnU3VwcHJlc3Npb25IZWxwZXIuZ2V0U3VwcHJlc3Npb25Gb3JtYXRFcnJvcilcbiAgICAgIC5maWx0ZXIoKGVycm9yTWVzc2FnZSkgPT4gISFlcnJvck1lc3NhZ2UpO1xuXG4gICAgaWYgKGVycm9ycy5sZW5ndGgpIHtcbiAgICAgIHRocm93IEVycm9yKFxuICAgICAgICBgJHtpZH06ICR7ZXJyb3JzLmpvaW4oXG4gICAgICAgICAgJydcbiAgICAgICAgKX1cXG5TZWUgaHR0cHM6Ly9naXRodWIuY29tL2Nka2xhYnMvY2RrLW5hZyNzdXBwcmVzc2luZy1hLXJ1bGUgZm9yIGluZm9ybWF0aW9uIG9uIHN1cHByZXNzaW5nIGEgcnVsZS5gXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIHN0YXRpYyBkb2VzQXBwbHkoXG4gICAgc3VwcHJlc3Npb246IE5hZ1BhY2tTdXBwcmVzc2lvbixcbiAgICBydWxlSWQ6IHN0cmluZyxcbiAgICBmaW5kaW5nSWQ6IHN0cmluZ1xuICApOiBib29sZWFuIHtcbiAgICBpZiAocnVsZUlkICE9PSBzdXBwcmVzc2lvbi5pZCkge1xuICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cblxuICAgIGlmICghc3VwcHJlc3Npb24uYXBwbGllc1RvKSB7XG4gICAgICAvLyB0aGUgcnVsZSBpcyBub3QgZ3JhbnVsYXIgc28gaXQgYWx3YXlzIGFwcGxpZXNcbiAgICAgIHJldHVybiB0cnVlO1xuICAgIH1cblxuICAgIGlmIChcbiAgICAgIGZpbmRpbmdJZCAmJlxuICAgICAgc3VwcHJlc3Npb24uYXBwbGllc1RvLnNvbWUoKGFwcGxpZXNUbykgPT4ge1xuICAgICAgICBpZiAodHlwZW9mIGFwcGxpZXNUbyA9PT0gJ3N0cmluZycpIHtcbiAgICAgICAgICByZXR1cm4gYXBwbGllc1RvID09PSBmaW5kaW5nSWQ7XG4gICAgICAgIH0gZWxzZSB7XG4gICAgICAgICAgY29uc3QgcmVnZXggPSBOYWdTdXBwcmVzc2lvbkhlbHBlci50b1JlZ0V4KGFwcGxpZXNUby5yZWdleCk7XG4gICAgICAgICAgcmV0dXJuIHJlZ2V4LnRlc3QoZmluZGluZ0lkKTtcbiAgICAgICAgfVxuICAgICAgfSlcbiAgICApIHtcbiAgICAgIHJldHVybiB0cnVlO1xuICAgIH1cblxuICAgIHJldHVybiBmYWxzZTtcbiAgfVxuXG4gIHByaXZhdGUgc3RhdGljIGdldFN1cHByZXNzaW9uRm9ybWF0RXJyb3IoXG4gICAgc3VwcHJlc3Npb246IE5hZ1BhY2tTdXBwcmVzc2lvblxuICApOiBzdHJpbmcge1xuICAgIGxldCBlcnJvcnMgPSAnJztcbiAgICBjb25zdCBmaW5kaW5nID0gc3VwcHJlc3Npb24uaWQubWF0Y2goL1xcWy4qXFxdLyk7XG4gICAgaWYgKGZpbmRpbmcpIHtcbiAgICAgIGVycm9ycyArPSBgVGhlIHN1cHByZXNzaW9uICdpZCcgY29udGFpbnMgYSBmaW5kaW5nICcke2ZpbmRpbmd9LiBBIGZpbmRpbmcgbXVzdCBiZSBzdXBwcmVzc2VkIHVzaW5nICdhcHBsaWVzX3RvJy5gO1xuICAgIH1cbiAgICBpZiAoc3VwcHJlc3Npb24ucmVhc29uLmxlbmd0aCA8IDEwKSB7XG4gICAgICBlcnJvcnMgKz1cbiAgICAgICAgXCJUaGUgc3VwcHJlc3Npb24gbXVzdCBoYXZlIGEgJ3JlYXNvbicgb2YgMTAgY2hhcmFjdGVycyBvciBtb3JlLlwiO1xuICAgIH1cbiAgICAoc3VwcHJlc3Npb24uYXBwbGllc1RvID8/IFtdKS5mb3JFYWNoKChhcHBsaWVzVG8pID0+IHtcbiAgICAgIGlmICh0eXBlb2YgYXBwbGllc1RvICE9PSAnc3RyaW5nJykge1xuICAgICAgICB0cnkge1xuICAgICAgICAgIE5hZ1N1cHByZXNzaW9uSGVscGVyLnRvUmVnRXgoYXBwbGllc1RvLnJlZ2V4KTtcbiAgICAgICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICAgICAgZXJyb3JzICs9IChlcnIgYXMgRXJyb3IpLm1lc3NhZ2U7XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICB9KTtcbiAgICByZXR1cm4gZXJyb3JzXG4gICAgICA/IGBcXG5cXHRFcnJvcihzKSBkZXRlY3RlZCBpbiBzdXBwcmVzc2lvbiB3aXRoICdpZCcgJHtzdXBwcmVzc2lvbi5pZH0uICR7ZXJyb3JzfWBcbiAgICAgIDogJyc7XG4gIH1cblxuICBwcml2YXRlIHN0YXRpYyB0b1JlZ0V4KHM6IHN0cmluZyk6IFJlZ0V4cCB7XG4gICAgdHJ5IHtcbiAgICAgIC8vIHZlcmlmeSB0aGF0IHRoZSByZWdleCBpcyBjb3JyZWN0bHkgZm9ybWF0dGVkXG4gICAgICBjb25zdCBtID0gcy5tYXRjaCgvXFwvKC4qKVxcLyguKik/Lyk7XG4gICAgICBpZiAoIW0pIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKCk7XG4gICAgICB9XG4gICAgICByZXR1cm4gbmV3IFJlZ0V4cChtWzFdLCBtWzJdIHx8ICcnKTtcbiAgICB9IGNhdGNoIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgSW52YWxpZCByZWd1bGFyIGV4cHJlc3Npb24gWyR7c31dYCk7XG4gICAgfVxuICB9XG59XG4iXX0=
|