@microsoft/windows-admin-center-sdk 2.128.0 → 2.165.0

package/core/security/authorization-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../packages/core/security/authorization-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3D,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAKjD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AA2EzE;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IA8GzD;;;;OAIG;IACH,YAAoB,SAAmC,EAAE,GAAQ;QAC7D,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QADpB,cAAS,GAAT,SAAS,CAA0B;QAEnD,IAAI,CAAC,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE;YACnB,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE;gBAC/C,IAAI;oBACA,MAAM,UAAU,GAA2B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACxE,iCAAiC;oBACjC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC;oBAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC;oBACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC9C,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,IAAI,EAAE,CAAC;iBAC3E;gBAAC,OAAO,KAAK,EAAE;oBACZ,cAAc,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;iBAC5D;aACJ;SACJ;IACL,CAAC;IAxFD;;;OAGG;IACH,IAAW,aAAa,CAAC,KAAyB;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACrG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAW,aAAa;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAW,UAAU,CAAC,GAAW;QAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE;YAClB,IAAI,CAAC,cAAc,EAAE,CAAC;SACzB;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAYD;;OAEG;IACH,IAAW,UAAU;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,IAAW,WAAW;QAClB,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChD,0BAA0B;YAC1B,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,0BAA0B;QAC1B,OAAO,EAAE,CAA6B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1F,CAAC;IA+BD;;OAEG;IACI,oBAAoB,CAAC,IAAoB,EAAE,KAAgB;QAC9D,kIAAkI;QAClI,OAAO,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,iBAAiB,CACpB,IAAoB,EACpB,OAAoB,EACpB,KAAgB,EAChB,QAAiB;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACtB,+FAA+F;YAC/F,4DAA4D;YAC5D,oDAAoD;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;YACjC,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE;gBAChB,8CAA8C;gBAC9C,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;aACtB;iBAAM;gBACH,mDAAmD;gBACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;aACjE;QACL,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,QAA2B;QACrD,sBAAsB;QACtB,OAAO,QAAQ,CAAC,QAAQ;eACjB,QAAQ,CAAC,QAAQ,CAAC,UAAU,2BAAgC,CAAC;IACxE,CAAC;IAED;;OAEG;IACI,mBAAmB,CACtB,QAAgB,EAChB,OAAyB,EACzB,QAAsD;QACtD,IAAI,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE;YACV,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC7B,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;aAC/B;SACJ;QACD,MAAM,SAAS,GAA+B;YAC1C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;YACxC,SAAS,EAAE,cAAc;YACzB,YAAY,EAAE,OAAO;SACxB,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/B,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,KAAK,EAAE;oBACP,IAAI,OAAO,EAAE;wBACT,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;qBAC7B;yBAAM;wBACH,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;qBAClC;iBACJ;gBAED,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;aACtB;iBAAM;gBACH,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;aAChE;QACL,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAEM,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,OAAO,CAAC,KAAK,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAC9C,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,cAAc,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,QAAQ,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAcM,WAAW,CAAC,SAA6B,EAAE,SAAsC;QACpF,kGAAkG;QAClG,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChD,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,6CAA6C;QAC7C,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YACxC,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;SAC3B;QAED,wDAAwD;QACxD,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,EAA8B,CAAC;QAE9D,qDAAqD;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,iBAEtC,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAC5C,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5B,IAAI,cAAc,EAAE;YAChB,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,6DAA6D;QAC7D,uFAAuF;QACvF,IAAI,SAAS,EAAE;YACX,KAAK,MAAM,IAAI,IAAc,SAAS,EAAE;gBACpC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACnC;SACJ;QAED,kFAAkF;QAClF,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;aAC/B,IAAI,CACD,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,IAAI,WAAW,CAAC,eAAe,EAAE;gBAC7B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,gBACJ,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE;oBACT,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;iBAC/C;aACJ;YAED,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC,CAAC,EACF,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;YACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;aACrD,CAAC,CAAC,IAAI,CACH,GAAG,CAAC,KAAK,CAAC,EAAE;gBACR,OAAmC;oBAC/B,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,SAAS;iBACvB,CAAC;YACN,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC;QACF,mDAAmD;QACnD,+DAA+D;QAC/D,IAAI,CAAC,CAAC,CAAC,CAAC;aACX,SAAS,CACN,MAAM,CAAC,EAAE;YACL,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzG,CAAC,EACD,KAAK,CAAC,EAAE;YACJ,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAClD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACI,WAAW,CAAC,OAAwC,EAAE,wBAAgC,IAAI;QAC7F,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;YACxD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;SAC/E;QACD,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,OAAO;gBACH,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC;SACL;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;SACpD;aAAM;YACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACvG,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,IAAI;SAC3B,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,OAAwC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAE/B,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAC5C,CAAC,OAAO,CAAC,CAAC,CAAC;QACf,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;aAAM;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SACpC;IACL,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,QAAgB;QACrC,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE;YAC3D,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;SACxD;QAED,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,KAAyB,EAAE,SAAoB;QAChE,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAE/B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAC9C,CAAC,KAAK,EAAE,SAAS,CAAC,CACrB,CAAC;QACF,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;QAED,8BAA8B;QAC9B,MAAM,qBAAqB,GAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;YACnE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;SAC9B;aAAM;YACH,qBAAqB,CAAC,SAAS,GAAG,SAAS,CAAC;YAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;SACxF;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,kDAAkD;QAClD,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAE1H,oDAAoD;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAoB,EAAE,QAAiB,EAAE,KAA0B;QACpG,IAAI,CAAC,KAAK,EAAE;YACR,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBAEb,0FAA0F;gBAC1F,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;aACpE;iBAAM;gBAEH,iCAAiC;gBACjC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aACnF;SACJ;IACL,CAAC;IAED;;;;;OAKG;IACI,kBAAkB,CAAC,QAAgB,EAAE,KAA0B;QAClE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBACb,0FAA0F;gBAC1F,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;aAC5D;iBAAM;gBAEH,iCAAiC;gBACjC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrE,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aAC3E;SACJ;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACI,qCAAqC,CAAC,IAAc,EAAE,QAAiB,EAAE,KAA0B;QACtG,IAAI,CAAC,KAAK,EAAE;YACR,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBACb,0FAA0F;gBAC1F,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;aACrE;iBAAM;gBACH,iCAAiC;gBACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,GAAG,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;aACpF;SACJ;IACL,CAAC;IAEM,cAAc;QACjB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAAqC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3H,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;QAED,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACO,qBAAqB,CAAC,IAA4D;QACxF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;YACpB,wDAAwD;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC;SACpB;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACO,aAAa;QACnB,oFAAoF;QACpF,OAAO,EAAE,CAAqC;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACO,gBAAgB,CAAC,IAAyB,EAAE,IAAY,EAAE,IAAW;QAC3E,2BAA2B;QAC3B,IAAI,IAAI,kBAA8B,EAAE;YACpC,QAAQ,IAAI,EAAE;gBACV,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBAC/C,uEAAuE;oBACvE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;yBAC9E,SAAS,CACN,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EACpC,KAAK,CAAC,EAAE;wBACJ,YAAY,CAAC,WAAW,EAAE,CAAC;wBAC3B,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAClD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAChD,CAAC,CAAC,CAAC;oBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;iBACnB;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBAC/C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE;wBACV,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;iBACpC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC3C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE;wBACV,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;iBAChC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,CAAC,KAAK,EAAE;wBACR,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;iBAC3C;aACJ;SACJ;QAED,4BAA4B;QAC5B,IAAI,IAAI,mBAA+B,EAAE;YACrC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE;gBAC3D,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAClC,mDAAmD;gBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACvH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;SACJ;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACO,eAAe,CAAC,IAAyB,EAAE,IAAY,EAAE,KAAU;QACzE,2CAA2C;QAC3C,IAAI,IAAI,mBAA+B,EAAE;YACrC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE;gBACzD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE;gBACxD,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;iBACpF;gBAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACpH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE;gBAC7D,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;iBACzF;gBAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACzH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE;gBACzD,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;iBACrF;gBAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;SACJ;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,OAAwC;QACxD,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;YACxD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;SAC/E;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,OAAO,EAAE,CAAC;gBACN,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC,CAAC;SACN;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;SACpD;aAAM;YACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C;QAED,MAAM,SAAS,GAAG;YACd,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,IAAI;SAC3B,CAAC;QAEF,IAAI,IAAI,CAAC,GAAG,EAAE;YACV,OAAO,GAAG,CAAC,mCAAmC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;iBAC/E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACjB,SAAS,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC;SACX;QAED,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,MAAkC,EAAE,KAAW;QACxE,IAAI,KAAK,EAAE;YACP,IAAI,IAAI,CAAC,YAAY,EAAE;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aACxB;SACJ;aAAM;YACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBACnB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;aACrC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;gBACxC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;oBAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACjE,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,EAAE,CAAC;aACtB;iBAAM;gBACH,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACrE,IAAI,CAAC,WAAW,EAAE,CAAC;aACtB;YAED,IAAI,IAAI,CAAC,YAAY,EAAE;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;aACtB;SACJ;IACL,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,IAAoB,EAAE,KAAgB;QACvD,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;YAChH,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;SAC3C,CAAC;IACN,CAAC;IAED;;OAEG;IACK,WAAW;QACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE;YACpB,sBAAsB;YACtB,OAAO;SACV;QACD,qBAAqB;QACrB,MAAM,SAAS,GAA2B;YACtC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC9B,CAAC;QACF,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;;AA5yBD;;GAEG;AACY,6BAAQ,GAAG,+BAA+B,CAAC;AAE1D;;GAEG;AACW,8CAAyB,GAAG,eAAe,CAAC;AAE3C,gCAAW,GAAG;IACzB,YAAY,EAAE,cAAc;IAC5B,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;CACrB,CAAC","file":"authorization-manager.js","sourcesContent":["\r\nimport { Observable, of, Subject, throwError } from 'rxjs';\r\nimport { AjaxError, AjaxRequest } from 'rxjs/ajax';\r\nimport { map, mergeMap, take } from 'rxjs/operators';\r\nimport { Deprecated } from '../base/decorators/deprecation.decorators';\r\nimport { CimStreamOptions, CimStreamResponse } from '../data/cim-stream';\r\nimport { Crypto } from '../data/crypto';\r\nimport { headerConstants, HttpStatusCode } from '../data/http-constants';\r\nimport { Net } from '../data/net';\r\nimport { PowerShellStreamResponse } from '../data/powershell-stream';\r\nimport { Logging } from '../diagnostics/logging';\r\nimport { Strings } from '../generated/strings';\r\nimport { RpcForwardResponse } from '../rpc/forward/rpc-forward-model';\r\nimport { Rpc } from '../rpc/rpc';\r\nimport { RpcRelationshipType } from '../rpc/rpc-base';\r\nimport { RpcForwarder, RpcServiceForwarder } from '../rpc/rpc-forwarder';\r\n\r\n/**\r\n * Defines the response from an Authorization Handler\r\n */\r\nexport interface AuthorizationCredentials {\r\n    username: string;\r\n    password: string;\r\n    applyToAllNodes?: boolean;\r\n    useLaps?: boolean;\r\n    lapsLocalAdminName?: string;\r\n}\r\n\r\n/**\r\n * Defines the response the AuthorizationManager returns from getToken\r\n */\r\nexport interface AuthorizationTokenResponse {\r\n    token: AuthorizationToken;\r\n    appliesTo?: string | string[];\r\n}\r\n\r\n/**\r\n * Defines an authorizationToken\r\n */\r\nexport interface AuthorizationToken {\r\n    value: string;\r\n    username: string;\r\n    useLaps: boolean;\r\n    lapsLocalAdminName: string;\r\n}\r\n\r\n/**\r\n * The create authorization token options\r\n */\r\nexport interface CreateAuthorizationTokenOptions {\r\n    password?: string;\r\n    username?: string;\r\n    useLaps?: boolean;\r\n    lapsLocalAdminName?: string;\r\n}\r\n\r\n/**\r\n * The extra error data of original cause.\r\n */\r\nexport interface NodeAuthorizationErrorData {\r\n    statusCode: HttpStatusCode;\r\n    errorCode: string;\r\n    errorMessage: string;\r\n}\r\n\r\n/**\r\n * Defines a handler that takes a nodeName and returns authorization credentials\r\n */\r\nexport type NodeAuthorizationHandler =\r\n    (nodeName?: string | string[], errorData?: NodeAuthorizationErrorData) => Observable<AuthorizationCredentials>;\r\n\r\n/**\r\n * Defines properties that will be provided to child instances on a forward init request\r\n */\r\nexport interface AuthorizationManagerInitProperties {\r\n    manageAsToken: AuthorizationToken;\r\n    nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n    nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n}\r\n\r\n/**\r\n * Representation of authorization cache data structure\r\n */\r\ninterface AuthorizationCacheData {\r\n    jwk?: string;\r\n    nodeTokens?: MsftSme.StringMap<AuthorizationToken>;\r\n    manageAsToken?: AuthorizationToken;\r\n    nodePowershellEndpoints?: MsftSme.StringMap<string>;\r\n}\r\n\r\n/**\r\n * Authorization Manager class. Handles SME authentication for service requests.\r\n */\r\nexport class AuthorizationManager extends RpcServiceForwarder {\r\n\r\n    /**\r\n     * Cache key for session storage of authorization cache\r\n     */\r\n    private static cacheKey = 'AuthorizationManager.cache.v1';\r\n\r\n    /**\r\n     * If no laps local admin name is defined, it will default to 'administrator'\r\n     */\r\n    public static defaultLapsLocalAdminName = 'administrator';\r\n\r\n    private static rpcCommands = {\r\n        setNodeToken: 'setNodeToken',\r\n        setNodeTokens: 'setNodeTokens',\r\n        manageAsToken: 'manageAsToken',\r\n        setNodeTokenError: 'setNodeTokenError',\r\n        setJeaContext: 'setJeaContext',\r\n        clearNodeTokens: 'clearNodeTokens',\r\n        getNewToken: 'getNewToken',\r\n        secureToken: 'secureToken',\r\n        encrypt: 'encrypt'\r\n    };\r\n\r\n    /**\r\n     * Create a map of nodeNames to token objects to hold node specific tokens.\r\n     */\r\n    public nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n\r\n    /**\r\n     * The backing store fro the manageAsToken\r\n     */\r\n    private token: AuthorizationToken;\r\n\r\n    /**\r\n     * The JSON Web Key. Single string with JSON.stringify format.\r\n     */\r\n    private jwk: string;\r\n\r\n    /**\r\n     * The mapping of connections to PowershellEndpoints\r\n     */\r\n    private nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n\r\n    /**\r\n     * The token awaiter subject.\r\n     */\r\n    private tokenAwaiter: Subject<AuthorizationTokenResponse>;\r\n\r\n    /**\r\n     * Sets the current manage as token\r\n     * If running with an Rpc child, notify of the change\r\n     */\r\n    public set manageAsToken(token: AuthorizationToken) {\r\n        this.token = token;\r\n        this.nodePowershellEndpoints = {};\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, token);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Gets the current manage as token\r\n     */\r\n    public get manageAsToken(): AuthorizationToken {\r\n        return this.token;\r\n    }\r\n\r\n    /**\r\n     * Sets the gateway encryption certificate JWK.\r\n     * If this is not set by Shell/Add-Connection, it will send clear text password.\r\n     */\r\n    public set gatewayJwk(jwk: string) {\r\n        if (this.jwk !== jwk) {\r\n            this.resetAllTokens();\r\n        }\r\n        this.jwk = jwk;\r\n        this.gatewayJwkChangedSubject.next(jwk);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Observable that emits whenever the gateways Jwk has changed\r\n     */\r\n    public readonly gatewayJwkChanged: Observable<string>;\r\n\r\n    /**\r\n     * Underlying implementation subject for gatewayJwkChanged observable\r\n     */\r\n    private gatewayJwkChangedSubject: Subject<string>;\r\n\r\n    /**\r\n     * Gets the gateway encryption certificate JWK.\r\n     */\r\n    public get gatewayJwk() {\r\n        return this.jwk;\r\n    }\r\n\r\n    /**\r\n     * Gets an observable the emits when the authorization token is ready\r\n     */\r\n    public get authAwaiter() {\r\n        if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n            // return the global token\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // return the global token\r\n        return of(<AuthorizationTokenResponse>{ appliesTo: null, token: this.manageAsToken });\r\n    }\r\n\r\n    /**\r\n     * Initializes a new instance of the Authorization Manager class\r\n     * @param authorize An AuthorizationHandler with which to retrieve user credentials\r\n     * @param rpc The rpc to forward auth requests to a parent window\r\n     */\r\n    constructor(private authorize: NodeAuthorizationHandler, rpc: Rpc) {\r\n        super('authorization-manager', rpc);\r\n        this.gatewayJwkChangedSubject = new Subject<string>();\r\n        this.gatewayJwkChanged = this.gatewayJwkChangedSubject.asObservable();\r\n        this.nodeTokens = {};\r\n        this.nodePowershellEndpoints = {};\r\n        if (MsftSme.isShell()) {\r\n            // attempt to restore from storage if this is a shell instance\r\n            const cachedDataString = sessionStorage.getItem(AuthorizationManager.cacheKey);\r\n            if (!MsftSme.isNullOrWhiteSpace(cachedDataString)) {\r\n                try {\r\n                    const cachedData: AuthorizationCacheData = JSON.parse(cachedDataString);\r\n                    // verify data and set properties\r\n                    this.jwk = cachedData.jwk || null;\r\n                    this.manageAsToken = cachedData.manageAsToken || null;\r\n                    this.nodeTokens = cachedData.nodeTokens || {};\r\n                    this.nodePowershellEndpoints = cachedData.nodePowershellEndpoints || {};\r\n                } catch (error) {\r\n                    sessionStorage.removeItem(AuthorizationManager.cacheKey);\r\n                }\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * defines the conditions under which the AuthorizationManager can handle an ajax error\r\n     */\r\n    public canHandleAjaxFailure(code: HttpStatusCode, error: AjaxError) {\r\n        // we can handle ajax errors if we have a getter defined, and the code is Unauthorized (401) or we get a cim authorization failure\r\n        return this.authorize && Net.isUnauthorized(error);\r\n    }\r\n\r\n    /**\r\n     * When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n     */\r\n    public handleAjaxFailure(\r\n        code: HttpStatusCode,\r\n        request: AjaxRequest,\r\n        error: AjaxError,\r\n        nodeName?: string): Observable<AjaxRequest> {\r\n        const errorData = this.getErrorData(code, error);\r\n\r\n        return this.getNewToken(nodeName, errorData)\r\n            .pipe(mergeMap(response => {\r\n                // There may be multiple nodes requesting authentication, but we can only ask the user for one.\r\n                // check if the result if for our node, otherwise try again.\r\n                // It looks for inside of array only for first name.\r\n                const names = response.appliesTo;\r\n                const isTokenForNode = !names || names === nodeName || (Array.isArray(names) && names[0] === nodeName);\r\n                if (isTokenForNode) {\r\n                    // this token applies to our node, so continue\r\n                    this.addAuthorizationRequestHeader(request, nodeName);\r\n                    return of(request);\r\n                } else {\r\n                    // this token did not apply to our node. Ask again.\r\n                    return this.handleAjaxFailure(code, request, error, nodeName);\r\n                }\r\n            }));\r\n    }\r\n\r\n    /**\r\n     * Check if it can handle the error.\r\n     *\r\n     * @param response the response of CIM stream query.\r\n     */\r\n    public canHandleStreamFailure(response: CimStreamResponse): boolean {\r\n        // access denied case.\r\n        return response.response\r\n            && response.response.statusCode === HttpStatusCode.Unauthorized;\r\n    }\r\n\r\n    /**\r\n     * When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n     */\r\n    public handleStreamFailure(\r\n        nodeName: string,\r\n        options: CimStreamOptions,\r\n        response: CimStreamResponse | PowerShellStreamResponse): Observable<CimStreamOptions> {\r\n        let message = response.response.error && response.response.error.message;\r\n        if (!message) {\r\n            const errors = response.response.errors;\r\n            if (errors && errors.length > 0) {\r\n                message = errors[0].message;\r\n            }\r\n        }\r\n        const errorData: NodeAuthorizationErrorData = {\r\n            statusCode: response.response.statusCode,\r\n            errorCode: 'Unauthorized',\r\n            errorMessage: message\r\n        };\r\n        return this.getNewToken(nodeName, errorData)\r\n            .pipe(mergeMap(result => {\r\n                const names = result.appliesTo;\r\n                const isTokenForNode = !names || names === nodeName || (Array.isArray(names) && names[0] === nodeName);\r\n                if (isTokenForNode) {\r\n                    const token = this.getSavedNodeToken(nodeName);\r\n                    if (token) {\r\n                        if (options) {\r\n                            options.authToken = token;\r\n                        } else {\r\n                            options = { authToken: token };\r\n                        }\r\n                    }\r\n\r\n                    return of(options);\r\n                } else {\r\n                    return this.handleStreamFailure(nodeName, options, response);\r\n                }\r\n            }));\r\n    }\r\n\r\n    public saveJeaContext(nodeName: string, endpoint: string) {\r\n        Logging.trace({\r\n            view: 'sme-ui-control',\r\n            instance: 'saveJeaContext',\r\n            action: 'command-click',\r\n            data: { message: 'Establishing session using JEA endpoint' }\r\n        });\r\n        this.setJeaEndpoint(nodeName, endpoint);\r\n\r\n        this.forwardNotify(\r\n            RpcRelationshipType.Child,\r\n            AuthorizationManager.rpcCommands.setJeaContext,\r\n            { nodeName: nodeName, endpoint: endpoint });\r\n    }\r\n\r\n    public getJeaEndpoint(nodeName: string): string {\r\n        return this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()];\r\n    }\r\n\r\n    /**\r\n     * Associates a node to use a specified JEA endpoint\r\n     */\r\n    public setJeaEndpoint(nodeName: string, endpoint: string): void {\r\n        this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()] = endpoint;\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Calls the authorize method and gets a new token.\r\n     * If running as a child, the token comes from the parent windows service\r\n     */\r\n    public getNewToken(nodeName: string): Observable<AuthorizationTokenResponse>;\r\n    // tslint:disable-next-line:unified-signatures\r\n    public getNewToken(nodeNames: string[]): Observable<AuthorizationTokenResponse>;\r\n    // tslint:disable-next-line:unified-signatures\r\n    public getNewToken(nodeName: string, errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n    // tslint:disable-next-line:unified-signatures\r\n    public getNewToken(nodeNames: string[], errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n\r\n    public getNewToken(nodeNames?: string | string[], errorData?: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse> {\r\n        // if we are already awaiting a token, then hook into the current request and try using that token\r\n        if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // ensure input is an array only if not null.\r\n        if (nodeNames && !Array.isArray(nodeNames)) {\r\n            nodeNames = [nodeNames];\r\n        }\r\n\r\n        // define a new subject for multiple requests to wait on\r\n        this.tokenAwaiter = new Subject<AuthorizationTokenResponse>();\r\n\r\n        // try to forward execute getNewToken from our parent\r\n        const parentExecuter = this.forwardExecute<void>(\r\n            RpcRelationshipType.Parent,\r\n            AuthorizationManager.rpcCommands.getNewToken,\r\n            [nodeNames, errorData]);\r\n\r\n        if (parentExecuter) {\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // Need to clear the endpoints before we acquire a new token,\r\n        // because we must try new credentials in an admin context before any fallback happens.\r\n        if (nodeNames) {\r\n            for (const node of <string[]>nodeNames) {\r\n                this.setJeaEndpoint(node, null);\r\n            }\r\n        }\r\n\r\n        // since we could not forward the request We must ask for the auth token ourselves\r\n        this.authorize(nodeNames, errorData)\r\n            .pipe(\r\n                mergeMap(credentials => {\r\n                    if (credentials.applyToAllNodes) {\r\n                        this.nodeTokens = {};\r\n                        this.updateCache();\r\n                        const forward = this.forwardExecute(\r\n                            RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n                        if (forward) {\r\n                            return forward.pipe(map(() => credentials));\r\n                        }\r\n                    }\r\n\r\n                    return of(credentials);\r\n                }),\r\n                mergeMap(credentials => {\r\n                    const appliesTo = credentials.applyToAllNodes ? null : nodeNames || null;\r\n                    return this.createSecureToken({\r\n                        username: credentials.username,\r\n                        password: credentials.password,\r\n                        useLaps: credentials.useLaps,\r\n                        lapsLocalAdminName: credentials.lapsLocalAdminName\r\n                    }).pipe(\r\n                        map(token => {\r\n                            return <AuthorizationTokenResponse>{\r\n                                token: token,\r\n                                appliesTo: appliesTo\r\n                            };\r\n                        }));\r\n                }),\r\n                // take the next 1 result and use it for our token.\r\n                // We can now notify anyone waiting for auth and save the token\r\n                take(1))\r\n            .subscribe(\r\n                result => {\r\n                    this.completeTokenAwaiter(result);\r\n                    this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, result);\r\n                },\r\n                error => {\r\n                    this.completeTokenAwaiter(null, error);\r\n                    this.forwardNotify(\r\n                        RpcRelationshipType.Child,\r\n                        AuthorizationManager.rpcCommands.setNodeTokenError,\r\n                        RpcForwarder.ensureSerializable(error));\r\n                });\r\n\r\n        return this.tokenAwaiter;\r\n    }\r\n\r\n    /**\r\n     * @deprecated use createSecureToken() after configured gatewayJwk property.\r\n     *\r\n     * Creates a token from the given options that may be used for node authentication\r\n     * @param options The token creation options\r\n     */\r\n    public createToken(options: CreateAuthorizationTokenOptions, passwordEncryptedWith: string = null): AuthorizationToken {\r\n        // ensure a valid value for laps local admin name\r\n        if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n            options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n        }\r\n        // ensure username has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n            options.username = null;\r\n        }\r\n        if (options.useLaps || !options.username) {\r\n            return {\r\n                value: null,\r\n                username: null,\r\n                useLaps: options.useLaps,\r\n                lapsLocalAdminName: options.lapsLocalAdminName\r\n            };\r\n        }\r\n\r\n        // ensure password has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n            options.password = null;\r\n        }\r\n\r\n        let username: string[];\r\n        if (options.username.indexOf('@') >= 0) {\r\n            username = options.username.split('@').reverse();\r\n        } else {\r\n            username = options.username.split('\\\\');\r\n        }\r\n\r\n        const token = Net.createEncodedAuthenticationHeader(username, options.password, passwordEncryptedWith);\r\n        return {\r\n            value: token,\r\n            username: options.username,\r\n            useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n            lapsLocalAdminName: null\r\n        };\r\n    }\r\n\r\n    /**\r\n     * Creates a secure token from the given options that may be used for node authentication\r\n     *\r\n     * @param options The token creation options\r\n     */\r\n    public createSecureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n        const forward = this.forwardExecute<AuthorizationToken>(\r\n            RpcRelationshipType.Parent,\r\n            AuthorizationManager.rpcCommands.secureToken,\r\n            [options]);\r\n        if (forward) {\r\n            return forward;\r\n        } else {\r\n            return this.secureToken(options);\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Get the saved Auth token for a node.\r\n     *\r\n     * @param nodeName The nodeName to get token for.\r\n     */\r\n    public getSavedNodeToken(nodeName: string): AuthorizationToken {\r\n        if (nodeName && this.nodeTokens[nodeName.toLocaleLowerCase()]) {\r\n            return this.nodeTokens[nodeName.toLocaleLowerCase()];\r\n        }\r\n\r\n        return this.manageAsToken;\r\n    }\r\n\r\n    /**\r\n     * Sets a token on the given nodes\r\n     * @param token The token to use for the given nodes\r\n     * @param nodeName The names of the nodes to set the token for. If empty or null, the token will be used as the global manageAs token\r\n     * @returns an Observable indicating that the token has been set.\r\n     */\r\n    public setNodeTokens(token: AuthorizationToken, nodeNames?: string[]): Observable<void> {\r\n        // if we have a parent instance, just forward it and return the result\r\n        const forward = this.forwardExecute<void>(\r\n            RpcRelationshipType.Parent,\r\n            AuthorizationManager.rpcCommands.setNodeTokens,\r\n            [token, nodeNames]\r\n        );\r\n        if (forward) {\r\n            return forward;\r\n        }\r\n\r\n        // otherwise process the token\r\n        const childSetTokenResponse: AuthorizationTokenResponse = { token: token };\r\n        if (!nodeNames || !Array.isArray(nodeNames) || nodeNames.length === 0) {\r\n            this.manageAsToken = token;\r\n        } else {\r\n            childSetTokenResponse.appliesTo = nodeNames;\r\n            nodeNames.forEach(nodeName => this.nodeTokens[nodeName.toLocaleLowerCase()] = token);\r\n        }\r\n        this.updateCache();\r\n\r\n        // notify all child instances of the token change.\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, childSetTokenResponse, true);\r\n\r\n        // return a null observable, indicating we are done.\r\n        return of(null);\r\n    }\r\n\r\n    /**\r\n     * Adds a authorization header to a request given a node with a manageAsToken\r\n     * @param request The request to add headers to\r\n     * @param nodeName optional. The node to add headers for if not provided, the global token will be used\r\n     * @param token optional. The token to use for the headers. if provided, the nodeName is not used.\r\n     */\r\n    public addAuthorizationRequestHeader(request: AjaxRequest, nodeName?: string, token?: AuthorizationToken) {\r\n        if (!token) {\r\n            token = this.getSavedNodeToken(nodeName);\r\n        }\r\n\r\n        if (token) {\r\n            if (token.value) {\r\n\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                request.headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n            } else {\r\n\r\n                // If not, we add useLaps header.\r\n                request.headers[headerConstants.USE_LAPS] = token.useLaps;\r\n                request.headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Create token headers.\r\n     *\r\n     * @param nodeName the node name.\r\n     * @param token the token to override current setting (optional).\r\n     */\r\n    public createTokenHeaders(nodeName: string, token?: AuthorizationToken): MsftSme.StringMap<string> {\r\n        const headers: MsftSme.StringMap<string> = {};\r\n        token = token || this.getSavedNodeToken(nodeName);\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n            } else {\r\n\r\n                // If not, we add useLaps header.\r\n                headers[headerConstants.USE_LAPS] = token.useLaps ? 'true' : 'false';\r\n                headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n            }\r\n        }\r\n\r\n        return headers;\r\n    }\r\n\r\n    /**\r\n     * Adds a authorization header to a request given a node with a manageAsToken\r\n     */\r\n    public addAuthorizationTokensToMultiPartBody(body: string[], nodeName?: string, token?: AuthorizationToken) {\r\n        if (!token) {\r\n            token = this.getSavedNodeToken(nodeName);\r\n        }\r\n\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                body.push(headerConstants.SME_AUTHORIZATION + ': ' + token.value);\r\n            } else {\r\n                // If not, we add useLaps header.\r\n                body.push(headerConstants.USE_LAPS + ': ' + token.useLaps);\r\n                body.push(headerConstants.LAPS_LOCALADMINNAME + ': ' + token.lapsLocalAdminName);\r\n            }\r\n        }\r\n    }\r\n\r\n    public resetAllTokens(): void {\r\n        this.manageAsToken = null;\r\n        this.nodePowershellEndpoints = {};\r\n        this.nodeTokens = {};\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, null);\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Encrypts a string value using the jwk from the gateway\r\n     */\r\n    public encrypt(value: string): Observable<string> {\r\n        const forward = this.forwardExecute<string>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.encrypt, [value]);\r\n        if (forward) {\r\n            return forward;\r\n        }\r\n\r\n        return Crypto.encryptRsaSha1(this.jwk, value);\r\n    }\r\n\r\n    /**\r\n     * Called on a child service instance when onForwardInit returns from the parent\r\n     * @param data The response from the forwardInit call\r\n     */\r\n    protected onForwardInitResponse(data: RpcForwardResponse<AuthorizationManagerInitProperties>): void {\r\n        if (data && data.error) {\r\n            // if there is an error, we cannot continue, so throw it\r\n            throw data.error;\r\n        }\r\n\r\n        this.manageAsToken = data.result.manageAsToken;\r\n        this.nodeTokens = data.result.nodeTokens;\r\n        this.nodePowershellEndpoints = data.result.nodePowershellEndpoints;\r\n    }\r\n\r\n    /**\r\n     * Called when a new instance of the service in another window is initialized and needs to synchronize with its parent\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @returns an observable for the all the values needed to initialize the service\r\n     */\r\n    protected onForwardInit(): Observable<AuthorizationManagerInitProperties> {\r\n        // authorization manager doesn't pass any properties to child services at this time.\r\n        return of(<AuthorizationManagerInitProperties>{\r\n            manageAsToken: this.manageAsToken,\r\n            nodeTokens: this.nodeTokens,\r\n            nodePowershellEndpoints: this.nodePowershellEndpoints\r\n        });\r\n    }\r\n\r\n    /**\r\n     * Called when the forwarded services counterpart wants to get data from the parent\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @param name The name of the method to forward to\r\n     * @param args The arguments of the method\r\n     * @returns an observable for the result of the method call\r\n     */\r\n    protected onForwardExecute(from: RpcRelationshipType, name: string, args: any[]): Observable<any> {\r\n        // command comes from child\r\n        if (from === RpcRelationshipType.Child) {\r\n            switch (name) {\r\n                case AuthorizationManager.rpcCommands.getNewToken: {\r\n                    // start getting the new token, but return immediately to avoid timeout\r\n                    const subscription = this.getNewToken(args ? args[0] : null, args ? args[1] : null)\r\n                        .subscribe(\r\n                            result => subscription.unsubscribe(),\r\n                            error => {\r\n                                subscription.unsubscribe();\r\n                                this.forwardNotify(\r\n                                    RpcRelationshipType.Child,\r\n                                    AuthorizationManager.rpcCommands.setNodeTokenError,\r\n                                    RpcForwarder.ensureSerializable(error));\r\n                            });\r\n                    return of(null);\r\n                }\r\n                case AuthorizationManager.rpcCommands.secureToken: {\r\n                    const options = args && args[0];\r\n                    if (!options) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.secureToken(options);\r\n                }\r\n                case AuthorizationManager.rpcCommands.encrypt: {\r\n                    const options = args && args[0];\r\n                    if (!options) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.encrypt(options);\r\n                }\r\n                case AuthorizationManager.rpcCommands.setNodeTokens: {\r\n                    const token = args && args[0];\r\n                    const nodes = args && args[1];\r\n                    if (!token) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.setNodeTokens(token, nodes);\r\n                }\r\n            }\r\n        }\r\n\r\n        // command comes from parent\r\n        if (from === RpcRelationshipType.Parent) {\r\n            if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {\r\n                this.nodeTokens = {};\r\n                this.nodePowershellEndpoints = {};\r\n                // if we also have children, forward the request on\r\n                const forward = this.forwardExecute(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, args);\r\n                return forward || of(null);\r\n            }\r\n        }\r\n\r\n        // command not implemented\r\n        return this.nameNotFound(name);\r\n    }\r\n\r\n    /**\r\n     * Called when the forwarded services counterpart sends a notify message\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @param name The name of the property to change\r\n     * @param value The new value of the property\r\n     * @returns an observable that completes when the property has been changed.\r\n     */\r\n    protected onForwardNotify(from: RpcRelationshipType, name: string, value: any): Observable<void> {\r\n        // allow our parent to give us a new token.\r\n        if (from === RpcRelationshipType.Parent) {\r\n            if (name === AuthorizationManager.rpcCommands.manageAsToken) {\r\n                this.manageAsToken = value;\r\n                // if we also have children, forward the notification on\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setNodeToken) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n                }\r\n\r\n                this.completeTokenAwaiter(value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setNodeTokenError) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n                }\r\n\r\n                this.completeTokenAwaiter(null, value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setJeaContext) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(message.format(AuthorizationManager.rpcCommands.setJeaContext));\r\n                }\r\n\r\n                this.saveJeaContext(value.nodeName, value.endpoint);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setJeaContext, value);\r\n                return forward || of(null);\r\n            }\r\n        }\r\n\r\n        return this.nameNotFound(name);\r\n    }\r\n\r\n    /**\r\n     * Creates a secure token from the given options that may be used for node authentication\r\n     *\r\n     * @param options The token creation options\r\n     */\r\n    private secureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n        // ensure a valid value for laps local admin name\r\n        if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n            options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n        }\r\n\r\n        // ensure username has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n            options.username = null;\r\n        }\r\n\r\n        if (options.useLaps || !options.username) {\r\n            return of({\r\n                value: null,\r\n                username: null,\r\n                useLaps: options.useLaps,\r\n                lapsLocalAdminName: options.lapsLocalAdminName\r\n            });\r\n        }\r\n\r\n        // ensure password has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n            options.password = null;\r\n        }\r\n\r\n        let username: string[];\r\n        if (options.username.indexOf('@') >= 0) {\r\n            username = options.username.split('@').reverse();\r\n        } else {\r\n            username = options.username.split('\\\\');\r\n        }\r\n\r\n        const tokenData = {\r\n            value: undefined,\r\n            username: options.username,\r\n            useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n            lapsLocalAdminName: null\r\n        };\r\n\r\n        if (this.jwk) {\r\n            return Net.createEncryptedAuthenticationHeader(this.jwk, username, options.password)\r\n                .pipe(map(newToken => {\r\n                    tokenData.value = newToken;\r\n                    return tokenData;\r\n                }));\r\n        }\r\n\r\n        tokenData.value = Net.createEncodedAuthenticationHeader(username, options.password);\r\n        return of(tokenData);\r\n    }\r\n\r\n    /**\r\n     * Completes the token awaiter\r\n     */\r\n    private completeTokenAwaiter(result: AuthorizationTokenResponse, error?: any) {\r\n        if (error) {\r\n            if (this.tokenAwaiter) {\r\n                const awaiter = this.tokenAwaiter;\r\n                this.tokenAwaiter = null;\r\n                awaiter.error(error);\r\n            }\r\n        } else {\r\n            if (!result.appliesTo) {\r\n                this.manageAsToken = result.token;\r\n            } else if (Array.isArray(result.appliesTo)) {\r\n                result.appliesTo.forEach(nodeName => {\r\n                    this.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;\r\n                });\r\n                this.updateCache();\r\n            } else {\r\n                this.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;\r\n                this.updateCache();\r\n            }\r\n\r\n            if (this.tokenAwaiter) {\r\n                const awaiter = this.tokenAwaiter;\r\n                this.tokenAwaiter = null;\r\n                awaiter.next(result);\r\n                awaiter.complete();\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Gets the error data.\r\n     * @param code the http status code.\r\n     * @param error the AJAX error object.\r\n     */\r\n    private getErrorData(code: HttpStatusCode, error: AjaxError): NodeAuthorizationErrorData {\r\n        return {\r\n            statusCode: code,\r\n            errorCode: error && error.xhr && error.xhr.response && error.xhr.response.error && error.xhr.response.error.code,\r\n            errorMessage: Net.getErrorMessage(error)\r\n        };\r\n    }\r\n\r\n    /**\r\n     * Updates the authorization cache. Does nothing if we are not running in shell\r\n     */\r\n    private updateCache(): void {\r\n        if (!MsftSme.isShell()) {\r\n            // ignore if not shell\r\n            return;\r\n        }\r\n        // update cached data\r\n        const cacheData: AuthorizationCacheData = {\r\n            jwk: this.jwk,\r\n            manageAsToken: this.manageAsToken,\r\n            nodePowershellEndpoints: this.nodePowershellEndpoints,\r\n            nodeTokens: this.nodeTokens\r\n        };\r\n        sessionStorage.setItem(AuthorizationManager.cacheKey, JSON.stringify(cacheData));\r\n    }\r\n}\r\n"]}
+{"version":3,"sources":["../../../packages/core/security/authorization-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3D,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAKjD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AA2EzE;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IA8GzD;;;;OAIG;IACH,YAAoB,SAAmC,EAAE,GAAQ;QAC7D,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QADpB,cAAS,GAAT,SAAS,CAA0B;QAEnD,IAAI,CAAC,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE;YACnB,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE;gBAC/C,IAAI;oBACA,MAAM,UAAU,GAA2B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACxE,iCAAiC;oBACjC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC;oBAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC;oBACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC9C,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,IAAI,EAAE,CAAC;iBAC3E;gBAAC,OAAO,KAAK,EAAE;oBACZ,cAAc,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;iBAC5D;aACJ;SACJ;IACL,CAAC;IAxFD;;;OAGG;IACH,IAAW,aAAa,CAAC,KAAyB;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACrG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAW,aAAa;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAW,UAAU,CAAC,GAAW;QAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE;YAClB,IAAI,CAAC,cAAc,EAAE,CAAC;SACzB;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAYD;;OAEG;IACH,IAAW,UAAU;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,IAAW,WAAW;QAClB,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChD,0BAA0B;YAC1B,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,0BAA0B;QAC1B,OAAO,EAAE,CAA6B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1F,CAAC;IA+BD;;OAEG;IACI,oBAAoB,CAAC,IAAoB,EAAE,KAAgB;QAC9D,kIAAkI;QAClI,OAAO,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,iBAAiB,CACpB,IAAoB,EACpB,OAAoB,EACpB,KAAgB,EAChB,QAAiB;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACtB,+FAA+F;YAC/F,4DAA4D;YAC5D,oDAAoD;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;YACjC,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE;gBAChB,8CAA8C;gBAC9C,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;aACtB;iBAAM;gBACH,mDAAmD;gBACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;aACjE;QACL,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,QAA2B;QACrD,sBAAsB;QACtB,OAAO,QAAQ,IAAI,QAAQ,CAAC,QAAQ;eAC7B,QAAQ,CAAC,QAAQ,CAAC,UAAU,2BAAgC,CAAC;IACxE,CAAC;IAED;;OAEG;IACI,mBAAmB,CACtB,QAAgB,EAChB,OAAyB,EACzB,QAAsD;QACtD,IAAI,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE;YACV,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC7B,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;aAC/B;SACJ;QACD,MAAM,SAAS,GAA+B;YAC1C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;YACxC,SAAS,EAAE,cAAc;YACzB,YAAY,EAAE,OAAO;SACxB,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/B,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,KAAK,EAAE;oBACP,IAAI,OAAO,EAAE;wBACT,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;qBAC7B;yBAAM;wBACH,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;qBAClC;iBACJ;gBAED,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;aACtB;iBAAM;gBACH,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;aAChE;QACL,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAEM,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,OAAO,CAAC,KAAK,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAC9C,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,cAAc,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,QAAQ,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAcM,WAAW,CAAC,SAA6B,EAAE,SAAsC;QACpF,kGAAkG;QAClG,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChD,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,6CAA6C;QAC7C,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YACxC,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;SAC3B;QAED,wDAAwD;QACxD,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,EAA8B,CAAC;QAE9D,qDAAqD;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,iBAEtC,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAC5C,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5B,IAAI,cAAc,EAAE;YAChB,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,6DAA6D;QAC7D,uFAAuF;QACvF,IAAI,SAAS,EAAE;YACX,KAAK,MAAM,IAAI,IAAc,SAAS,EAAE;gBACpC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACnC;SACJ;QAED,kFAAkF;QAClF,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;aAC/B,IAAI,CACD,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,IAAI,WAAW,CAAC,eAAe,EAAE;gBAC7B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,gBACJ,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE;oBACT,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;iBAC/C;aACJ;YAED,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC,CAAC,EACF,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;YACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;aACrD,CAAC,CAAC,IAAI,CACH,GAAG,CAAC,KAAK,CAAC,EAAE;gBACR,OAAmC;oBAC/B,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,SAAS;iBACvB,CAAC;YACN,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC;QACF,mDAAmD;QACnD,+DAA+D;QAC/D,IAAI,CAAC,CAAC,CAAC,CAAC;aACX,SAAS,CACN,MAAM,CAAC,EAAE;YACL,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzG,CAAC,EACD,KAAK,CAAC,EAAE;YACJ,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAClD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACI,WAAW,CAAC,OAAwC,EAAE,wBAAgC,IAAI;QAC7F,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;YACxD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;SAC/E;QACD,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,OAAO;gBACH,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC;SACL;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;SACpD;aAAM;YACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACvG,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,IAAI;SAC3B,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,OAAwC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAE/B,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAC5C,CAAC,OAAO,CAAC,CAAC,CAAC;QACf,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;aAAM;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SACpC;IACL,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,QAAgB;QACrC,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE;YAC3D,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;SACxD;QAED,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,KAAyB,EAAE,SAAoB;QAChE,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAE/B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAC9C,CAAC,KAAK,EAAE,SAAS,CAAC,CACrB,CAAC;QACF,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;QAED,8BAA8B;QAC9B,MAAM,qBAAqB,GAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;YACnE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;SAC9B;aAAM;YACH,qBAAqB,CAAC,SAAS,GAAG,SAAS,CAAC;YAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;SACxF;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,kDAAkD;QAClD,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAE1H,oDAAoD;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAoB,EAAE,QAAiB,EAAE,KAA0B;QACpG,IAAI,CAAC,KAAK,EAAE;YACR,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBAEb,0FAA0F;gBAC1F,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;aACpE;iBAAM;gBAEH,iCAAiC;gBACjC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aACnF;SACJ;IACL,CAAC;IAED;;;;;OAKG;IACI,kBAAkB,CAAC,QAAgB,EAAE,KAA0B;QAClE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBACb,0FAA0F;gBAC1F,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;aAC5D;iBAAM;gBAEH,iCAAiC;gBACjC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrE,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aAC3E;SACJ;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACI,qCAAqC,CAAC,IAAc,EAAE,QAAiB,EAAE,KAA0B;QACtG,IAAI,CAAC,KAAK,EAAE;YACR,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBACb,0FAA0F;gBAC1F,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;aACrE;iBAAM;gBACH,iCAAiC;gBACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,GAAG,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;aACpF;SACJ;IACL,CAAC;IAEM,cAAc;QACjB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAAqC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3H,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;QAED,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACO,qBAAqB,CAAC,IAA4D;QACxF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;YACpB,wDAAwD;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC;SACpB;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACO,aAAa;QACnB,oFAAoF;QACpF,OAAO,EAAE,CAAqC;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACO,gBAAgB,CAAC,IAAyB,EAAE,IAAY,EAAE,IAAW;QAC3E,2BAA2B;QAC3B,IAAI,IAAI,kBAA8B,EAAE;YACpC,QAAQ,IAAI,EAAE;gBACV,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBAC/C,uEAAuE;oBACvE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;yBAC9E,SAAS,CACN,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EACpC,KAAK,CAAC,EAAE;wBACJ,YAAY,CAAC,WAAW,EAAE,CAAC;wBAC3B,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAClD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAChD,CAAC,CAAC,CAAC;oBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;iBACnB;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBAC/C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE;wBACV,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;iBACpC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC3C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE;wBACV,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;iBAChC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,CAAC,KAAK,EAAE;wBACR,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;iBAC3C;aACJ;SACJ;QAED,4BAA4B;QAC5B,IAAI,IAAI,mBAA+B,EAAE;YACrC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE;gBAC3D,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAClC,mDAAmD;gBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACvH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;SACJ;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACO,eAAe,CAAC,IAAyB,EAAE,IAAY,EAAE,KAAU;QACzE,2CAA2C;QAC3C,IAAI,IAAI,mBAA+B,EAAE;YACrC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE;gBACzD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE;gBACxD,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;iBACpF;gBAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACpH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE;gBAC7D,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;iBACzF;gBAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACzH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE;gBACzD,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;iBACrF;gBAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;SACJ;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,OAAwC;QACxD,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;YACxD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;SAC/E;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,OAAO,EAAE,CAAC;gBACN,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC,CAAC;SACN;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;SACpD;aAAM;YACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C;QAED,MAAM,SAAS,GAAG;YACd,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,IAAI;SAC3B,CAAC;QAEF,IAAI,IAAI,CAAC,GAAG,EAAE;YACV,OAAO,GAAG,CAAC,mCAAmC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;iBAC/E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACjB,SAAS,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC;SACX;QAED,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,MAAkC,EAAE,KAAW;QACxE,IAAI,KAAK,EAAE;YACP,IAAI,IAAI,CAAC,YAAY,EAAE;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aACxB;SACJ;aAAM;YACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBACnB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;aACrC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;gBACxC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;oBAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACjE,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,EAAE,CAAC;aACtB;iBAAM;gBACH,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACrE,IAAI,CAAC,WAAW,EAAE,CAAC;aACtB;YAED,IAAI,IAAI,CAAC,YAAY,EAAE;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;aACtB;SACJ;IACL,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,IAAoB,EAAE,KAAgB;QACvD,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;YAChH,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;SAC3C,CAAC;IACN,CAAC;IAED;;OAEG;IACK,WAAW;QACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE;YACpB,sBAAsB;YACtB,OAAO;SACV;QACD,qBAAqB;QACrB,MAAM,SAAS,GAA2B;YACtC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC9B,CAAC;QACF,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;;AA5yBD;;GAEG;AACY,6BAAQ,GAAG,+BAA+B,CAAC;AAE1D;;GAEG;AACW,8CAAyB,GAAG,eAAe,CAAC;AAE3C,gCAAW,GAAG;IACzB,YAAY,EAAE,cAAc;IAC5B,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;CACrB,CAAC","file":"authorization-manager.js","sourcesContent":["\r\nimport { Observable, of, Subject, throwError } from 'rxjs';\r\nimport { AjaxError, AjaxRequest } from 'rxjs/ajax';\r\nimport { map, mergeMap, take } from 'rxjs/operators';\r\nimport { Deprecated } from '../base/decorators/deprecation.decorators';\r\nimport { CimStreamOptions, CimStreamResponse } from '../data/cim-stream';\r\nimport { Crypto } from '../data/crypto';\r\nimport { headerConstants, HttpStatusCode } from '../data/http-constants';\r\nimport { Net } from '../data/net';\r\nimport { PowerShellStreamResponse } from '../data/powershell-stream';\r\nimport { Logging } from '../diagnostics/logging';\r\nimport { Strings } from '../generated/strings';\r\nimport { RpcForwardResponse } from '../rpc/forward/rpc-forward-model';\r\nimport { Rpc } from '../rpc/rpc';\r\nimport { RpcRelationshipType } from '../rpc/rpc-base';\r\nimport { RpcForwarder, RpcServiceForwarder } from '../rpc/rpc-forwarder';\r\n\r\n/**\r\n * Defines the response from an Authorization Handler\r\n */\r\nexport interface AuthorizationCredentials {\r\n    username: string;\r\n    password: string;\r\n    applyToAllNodes?: boolean;\r\n    useLaps?: boolean;\r\n    lapsLocalAdminName?: string;\r\n}\r\n\r\n/**\r\n * Defines the response the AuthorizationManager returns from getToken\r\n */\r\nexport interface AuthorizationTokenResponse {\r\n    token: AuthorizationToken;\r\n    appliesTo?: string | string[];\r\n}\r\n\r\n/**\r\n * Defines an authorizationToken\r\n */\r\nexport interface AuthorizationToken {\r\n    value: string;\r\n    username: string;\r\n    useLaps: boolean;\r\n    lapsLocalAdminName: string;\r\n}\r\n\r\n/**\r\n * The create authorization token options\r\n */\r\nexport interface CreateAuthorizationTokenOptions {\r\n    password?: string;\r\n    username?: string;\r\n    useLaps?: boolean;\r\n    lapsLocalAdminName?: string;\r\n}\r\n\r\n/**\r\n * The extra error data of original cause.\r\n */\r\nexport interface NodeAuthorizationErrorData {\r\n    statusCode: HttpStatusCode;\r\n    errorCode: string;\r\n    errorMessage: string;\r\n}\r\n\r\n/**\r\n * Defines a handler that takes a nodeName and returns authorization credentials\r\n */\r\nexport type NodeAuthorizationHandler =\r\n    (nodeName?: string | string[], errorData?: NodeAuthorizationErrorData) => Observable<AuthorizationCredentials>;\r\n\r\n/**\r\n * Defines properties that will be provided to child instances on a forward init request\r\n */\r\nexport interface AuthorizationManagerInitProperties {\r\n    manageAsToken: AuthorizationToken;\r\n    nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n    nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n}\r\n\r\n/**\r\n * Representation of authorization cache data structure\r\n */\r\ninterface AuthorizationCacheData {\r\n    jwk?: string;\r\n    nodeTokens?: MsftSme.StringMap<AuthorizationToken>;\r\n    manageAsToken?: AuthorizationToken;\r\n    nodePowershellEndpoints?: MsftSme.StringMap<string>;\r\n}\r\n\r\n/**\r\n * Authorization Manager class. Handles SME authentication for service requests.\r\n */\r\nexport class AuthorizationManager extends RpcServiceForwarder {\r\n\r\n    /**\r\n     * Cache key for session storage of authorization cache\r\n     */\r\n    private static cacheKey = 'AuthorizationManager.cache.v1';\r\n\r\n    /**\r\n     * If no laps local admin name is defined, it will default to 'administrator'\r\n     */\r\n    public static defaultLapsLocalAdminName = 'administrator';\r\n\r\n    private static rpcCommands = {\r\n        setNodeToken: 'setNodeToken',\r\n        setNodeTokens: 'setNodeTokens',\r\n        manageAsToken: 'manageAsToken',\r\n        setNodeTokenError: 'setNodeTokenError',\r\n        setJeaContext: 'setJeaContext',\r\n        clearNodeTokens: 'clearNodeTokens',\r\n        getNewToken: 'getNewToken',\r\n        secureToken: 'secureToken',\r\n        encrypt: 'encrypt'\r\n    };\r\n\r\n    /**\r\n     * Create a map of nodeNames to token objects to hold node specific tokens.\r\n     */\r\n    public nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n\r\n    /**\r\n     * The backing store fro the manageAsToken\r\n     */\r\n    private token: AuthorizationToken;\r\n\r\n    /**\r\n     * The JSON Web Key. Single string with JSON.stringify format.\r\n     */\r\n    private jwk: string;\r\n\r\n    /**\r\n     * The mapping of connections to PowershellEndpoints\r\n     */\r\n    private nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n\r\n    /**\r\n     * The token awaiter subject.\r\n     */\r\n    private tokenAwaiter: Subject<AuthorizationTokenResponse>;\r\n\r\n    /**\r\n     * Sets the current manage as token\r\n     * If running with an Rpc child, notify of the change\r\n     */\r\n    public set manageAsToken(token: AuthorizationToken) {\r\n        this.token = token;\r\n        this.nodePowershellEndpoints = {};\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, token);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Gets the current manage as token\r\n     */\r\n    public get manageAsToken(): AuthorizationToken {\r\n        return this.token;\r\n    }\r\n\r\n    /**\r\n     * Sets the gateway encryption certificate JWK.\r\n     * If this is not set by Shell/Add-Connection, it will send clear text password.\r\n     */\r\n    public set gatewayJwk(jwk: string) {\r\n        if (this.jwk !== jwk) {\r\n            this.resetAllTokens();\r\n        }\r\n        this.jwk = jwk;\r\n        this.gatewayJwkChangedSubject.next(jwk);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Observable that emits whenever the gateways Jwk has changed\r\n     */\r\n    public readonly gatewayJwkChanged: Observable<string>;\r\n\r\n    /**\r\n     * Underlying implementation subject for gatewayJwkChanged observable\r\n     */\r\n    private gatewayJwkChangedSubject: Subject<string>;\r\n\r\n    /**\r\n     * Gets the gateway encryption certificate JWK.\r\n     */\r\n    public get gatewayJwk() {\r\n        return this.jwk;\r\n    }\r\n\r\n    /**\r\n     * Gets an observable the emits when the authorization token is ready\r\n     */\r\n    public get authAwaiter() {\r\n        if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n            // return the global token\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // return the global token\r\n        return of(<AuthorizationTokenResponse>{ appliesTo: null, token: this.manageAsToken });\r\n    }\r\n\r\n    /**\r\n     * Initializes a new instance of the Authorization Manager class\r\n     * @param authorize An AuthorizationHandler with which to retrieve user credentials\r\n     * @param rpc The rpc to forward auth requests to a parent window\r\n     */\r\n    constructor(private authorize: NodeAuthorizationHandler, rpc: Rpc) {\r\n        super('authorization-manager', rpc);\r\n        this.gatewayJwkChangedSubject = new Subject<string>();\r\n        this.gatewayJwkChanged = this.gatewayJwkChangedSubject.asObservable();\r\n        this.nodeTokens = {};\r\n        this.nodePowershellEndpoints = {};\r\n        if (MsftSme.isShell()) {\r\n            // attempt to restore from storage if this is a shell instance\r\n            const cachedDataString = sessionStorage.getItem(AuthorizationManager.cacheKey);\r\n            if (!MsftSme.isNullOrWhiteSpace(cachedDataString)) {\r\n                try {\r\n                    const cachedData: AuthorizationCacheData = JSON.parse(cachedDataString);\r\n                    // verify data and set properties\r\n                    this.jwk = cachedData.jwk || null;\r\n                    this.manageAsToken = cachedData.manageAsToken || null;\r\n                    this.nodeTokens = cachedData.nodeTokens || {};\r\n                    this.nodePowershellEndpoints = cachedData.nodePowershellEndpoints || {};\r\n                } catch (error) {\r\n                    sessionStorage.removeItem(AuthorizationManager.cacheKey);\r\n                }\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * defines the conditions under which the AuthorizationManager can handle an ajax error\r\n     */\r\n    public canHandleAjaxFailure(code: HttpStatusCode, error: AjaxError) {\r\n        // we can handle ajax errors if we have a getter defined, and the code is Unauthorized (401) or we get a cim authorization failure\r\n        return this.authorize && Net.isUnauthorized(error);\r\n    }\r\n\r\n    /**\r\n     * When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n     */\r\n    public handleAjaxFailure(\r\n        code: HttpStatusCode,\r\n        request: AjaxRequest,\r\n        error: AjaxError,\r\n        nodeName?: string): Observable<AjaxRequest> {\r\n        const errorData = this.getErrorData(code, error);\r\n\r\n        return this.getNewToken(nodeName, errorData)\r\n            .pipe(mergeMap(response => {\r\n                // There may be multiple nodes requesting authentication, but we can only ask the user for one.\r\n                // check if the result if for our node, otherwise try again.\r\n                // It looks for inside of array only for first name.\r\n                const names = response.appliesTo;\r\n                const isTokenForNode = !names || names === nodeName || (Array.isArray(names) && names[0] === nodeName);\r\n                if (isTokenForNode) {\r\n                    // this token applies to our node, so continue\r\n                    this.addAuthorizationRequestHeader(request, nodeName);\r\n                    return of(request);\r\n                } else {\r\n                    // this token did not apply to our node. Ask again.\r\n                    return this.handleAjaxFailure(code, request, error, nodeName);\r\n                }\r\n            }));\r\n    }\r\n\r\n    /**\r\n     * Check if it can handle the error.\r\n     *\r\n     * @param response the response of CIM stream query.\r\n     */\r\n    public canHandleStreamFailure(response: CimStreamResponse): boolean {\r\n        // access denied case.\r\n        return response && response.response\r\n            && response.response.statusCode === HttpStatusCode.Unauthorized;\r\n    }\r\n\r\n    /**\r\n     * When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n     */\r\n    public handleStreamFailure(\r\n        nodeName: string,\r\n        options: CimStreamOptions,\r\n        response: CimStreamResponse | PowerShellStreamResponse): Observable<CimStreamOptions> {\r\n        let message = response.response.error && response.response.error.message;\r\n        if (!message) {\r\n            const errors = response.response.errors;\r\n            if (errors && errors.length > 0) {\r\n                message = errors[0].message;\r\n            }\r\n        }\r\n        const errorData: NodeAuthorizationErrorData = {\r\n            statusCode: response.response.statusCode,\r\n            errorCode: 'Unauthorized',\r\n            errorMessage: message\r\n        };\r\n        return this.getNewToken(nodeName, errorData)\r\n            .pipe(mergeMap(result => {\r\n                const names = result.appliesTo;\r\n                const isTokenForNode = !names || names === nodeName || (Array.isArray(names) && names[0] === nodeName);\r\n                if (isTokenForNode) {\r\n                    const token = this.getSavedNodeToken(nodeName);\r\n                    if (token) {\r\n                        if (options) {\r\n                            options.authToken = token;\r\n                        } else {\r\n                            options = { authToken: token };\r\n                        }\r\n                    }\r\n\r\n                    return of(options);\r\n                } else {\r\n                    return this.handleStreamFailure(nodeName, options, response);\r\n                }\r\n            }));\r\n    }\r\n\r\n    public saveJeaContext(nodeName: string, endpoint: string) {\r\n        Logging.trace({\r\n            view: 'sme-ui-control',\r\n            instance: 'saveJeaContext',\r\n            action: 'command-click',\r\n            data: { message: 'Establishing session using JEA endpoint' }\r\n        });\r\n        this.setJeaEndpoint(nodeName, endpoint);\r\n\r\n        this.forwardNotify(\r\n            RpcRelationshipType.Child,\r\n            AuthorizationManager.rpcCommands.setJeaContext,\r\n            { nodeName: nodeName, endpoint: endpoint });\r\n    }\r\n\r\n    public getJeaEndpoint(nodeName: string): string {\r\n        return this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()];\r\n    }\r\n\r\n    /**\r\n     * Associates a node to use a specified JEA endpoint\r\n     */\r\n    public setJeaEndpoint(nodeName: string, endpoint: string): void {\r\n        this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()] = endpoint;\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Calls the authorize method and gets a new token.\r\n     * If running as a child, the token comes from the parent windows service\r\n     */\r\n    public getNewToken(nodeName: string): Observable<AuthorizationTokenResponse>;\r\n    // tslint:disable-next-line:unified-signatures\r\n    public getNewToken(nodeNames: string[]): Observable<AuthorizationTokenResponse>;\r\n    // tslint:disable-next-line:unified-signatures\r\n    public getNewToken(nodeName: string, errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n    // tslint:disable-next-line:unified-signatures\r\n    public getNewToken(nodeNames: string[], errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n\r\n    public getNewToken(nodeNames?: string | string[], errorData?: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse> {\r\n        // if we are already awaiting a token, then hook into the current request and try using that token\r\n        if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // ensure input is an array only if not null.\r\n        if (nodeNames && !Array.isArray(nodeNames)) {\r\n            nodeNames = [nodeNames];\r\n        }\r\n\r\n        // define a new subject for multiple requests to wait on\r\n        this.tokenAwaiter = new Subject<AuthorizationTokenResponse>();\r\n\r\n        // try to forward execute getNewToken from our parent\r\n        const parentExecuter = this.forwardExecute<void>(\r\n            RpcRelationshipType.Parent,\r\n            AuthorizationManager.rpcCommands.getNewToken,\r\n            [nodeNames, errorData]);\r\n\r\n        if (parentExecuter) {\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // Need to clear the endpoints before we acquire a new token,\r\n        // because we must try new credentials in an admin context before any fallback happens.\r\n        if (nodeNames) {\r\n            for (const node of <string[]>nodeNames) {\r\n                this.setJeaEndpoint(node, null);\r\n            }\r\n        }\r\n\r\n        // since we could not forward the request We must ask for the auth token ourselves\r\n        this.authorize(nodeNames, errorData)\r\n            .pipe(\r\n                mergeMap(credentials => {\r\n                    if (credentials.applyToAllNodes) {\r\n                        this.nodeTokens = {};\r\n                        this.updateCache();\r\n                        const forward = this.forwardExecute(\r\n                            RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n                        if (forward) {\r\n                            return forward.pipe(map(() => credentials));\r\n                        }\r\n                    }\r\n\r\n                    return of(credentials);\r\n                }),\r\n                mergeMap(credentials => {\r\n                    const appliesTo = credentials.applyToAllNodes ? null : nodeNames || null;\r\n                    return this.createSecureToken({\r\n                        username: credentials.username,\r\n                        password: credentials.password,\r\n                        useLaps: credentials.useLaps,\r\n                        lapsLocalAdminName: credentials.lapsLocalAdminName\r\n                    }).pipe(\r\n                        map(token => {\r\n                            return <AuthorizationTokenResponse>{\r\n                                token: token,\r\n                                appliesTo: appliesTo\r\n                            };\r\n                        }));\r\n                }),\r\n                // take the next 1 result and use it for our token.\r\n                // We can now notify anyone waiting for auth and save the token\r\n                take(1))\r\n            .subscribe(\r\n                result => {\r\n                    this.completeTokenAwaiter(result);\r\n                    this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, result);\r\n                },\r\n                error => {\r\n                    this.completeTokenAwaiter(null, error);\r\n                    this.forwardNotify(\r\n                        RpcRelationshipType.Child,\r\n                        AuthorizationManager.rpcCommands.setNodeTokenError,\r\n                        RpcForwarder.ensureSerializable(error));\r\n                });\r\n\r\n        return this.tokenAwaiter;\r\n    }\r\n\r\n    /**\r\n     * @deprecated use createSecureToken() after configured gatewayJwk property.\r\n     *\r\n     * Creates a token from the given options that may be used for node authentication\r\n     * @param options The token creation options\r\n     */\r\n    public createToken(options: CreateAuthorizationTokenOptions, passwordEncryptedWith: string = null): AuthorizationToken {\r\n        // ensure a valid value for laps local admin name\r\n        if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n            options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n        }\r\n        // ensure username has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n            options.username = null;\r\n        }\r\n        if (options.useLaps || !options.username) {\r\n            return {\r\n                value: null,\r\n                username: null,\r\n                useLaps: options.useLaps,\r\n                lapsLocalAdminName: options.lapsLocalAdminName\r\n            };\r\n        }\r\n\r\n        // ensure password has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n            options.password = null;\r\n        }\r\n\r\n        let username: string[];\r\n        if (options.username.indexOf('@') >= 0) {\r\n            username = options.username.split('@').reverse();\r\n        } else {\r\n            username = options.username.split('\\\\');\r\n        }\r\n\r\n        const token = Net.createEncodedAuthenticationHeader(username, options.password, passwordEncryptedWith);\r\n        return {\r\n            value: token,\r\n            username: options.username,\r\n            useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n            lapsLocalAdminName: null\r\n        };\r\n    }\r\n\r\n    /**\r\n     * Creates a secure token from the given options that may be used for node authentication\r\n     *\r\n     * @param options The token creation options\r\n     */\r\n    public createSecureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n        const forward = this.forwardExecute<AuthorizationToken>(\r\n            RpcRelationshipType.Parent,\r\n            AuthorizationManager.rpcCommands.secureToken,\r\n            [options]);\r\n        if (forward) {\r\n            return forward;\r\n        } else {\r\n            return this.secureToken(options);\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Get the saved Auth token for a node.\r\n     *\r\n     * @param nodeName The nodeName to get token for.\r\n     */\r\n    public getSavedNodeToken(nodeName: string): AuthorizationToken {\r\n        if (nodeName && this.nodeTokens[nodeName.toLocaleLowerCase()]) {\r\n            return this.nodeTokens[nodeName.toLocaleLowerCase()];\r\n        }\r\n\r\n        return this.manageAsToken;\r\n    }\r\n\r\n    /**\r\n     * Sets a token on the given nodes\r\n     * @param token The token to use for the given nodes\r\n     * @param nodeName The names of the nodes to set the token for. If empty or null, the token will be used as the global manageAs token\r\n     * @returns an Observable indicating that the token has been set.\r\n     */\r\n    public setNodeTokens(token: AuthorizationToken, nodeNames?: string[]): Observable<void> {\r\n        // if we have a parent instance, just forward it and return the result\r\n        const forward = this.forwardExecute<void>(\r\n            RpcRelationshipType.Parent,\r\n            AuthorizationManager.rpcCommands.setNodeTokens,\r\n            [token, nodeNames]\r\n        );\r\n        if (forward) {\r\n            return forward;\r\n        }\r\n\r\n        // otherwise process the token\r\n        const childSetTokenResponse: AuthorizationTokenResponse = { token: token };\r\n        if (!nodeNames || !Array.isArray(nodeNames) || nodeNames.length === 0) {\r\n            this.manageAsToken = token;\r\n        } else {\r\n            childSetTokenResponse.appliesTo = nodeNames;\r\n            nodeNames.forEach(nodeName => this.nodeTokens[nodeName.toLocaleLowerCase()] = token);\r\n        }\r\n        this.updateCache();\r\n\r\n        // notify all child instances of the token change.\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, childSetTokenResponse, true);\r\n\r\n        // return a null observable, indicating we are done.\r\n        return of(null);\r\n    }\r\n\r\n    /**\r\n     * Adds a authorization header to a request given a node with a manageAsToken\r\n     * @param request The request to add headers to\r\n     * @param nodeName optional. The node to add headers for if not provided, the global token will be used\r\n     * @param token optional. The token to use for the headers. if provided, the nodeName is not used.\r\n     */\r\n    public addAuthorizationRequestHeader(request: AjaxRequest, nodeName?: string, token?: AuthorizationToken) {\r\n        if (!token) {\r\n            token = this.getSavedNodeToken(nodeName);\r\n        }\r\n\r\n        if (token) {\r\n            if (token.value) {\r\n\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                request.headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n            } else {\r\n\r\n                // If not, we add useLaps header.\r\n                request.headers[headerConstants.USE_LAPS] = token.useLaps;\r\n                request.headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Create token headers.\r\n     *\r\n     * @param nodeName the node name.\r\n     * @param token the token to override current setting (optional).\r\n     */\r\n    public createTokenHeaders(nodeName: string, token?: AuthorizationToken): MsftSme.StringMap<string> {\r\n        const headers: MsftSme.StringMap<string> = {};\r\n        token = token || this.getSavedNodeToken(nodeName);\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n            } else {\r\n\r\n                // If not, we add useLaps header.\r\n                headers[headerConstants.USE_LAPS] = token.useLaps ? 'true' : 'false';\r\n                headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n            }\r\n        }\r\n\r\n        return headers;\r\n    }\r\n\r\n    /**\r\n     * Adds a authorization header to a request given a node with a manageAsToken\r\n     */\r\n    public addAuthorizationTokensToMultiPartBody(body: string[], nodeName?: string, token?: AuthorizationToken) {\r\n        if (!token) {\r\n            token = this.getSavedNodeToken(nodeName);\r\n        }\r\n\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                body.push(headerConstants.SME_AUTHORIZATION + ': ' + token.value);\r\n            } else {\r\n                // If not, we add useLaps header.\r\n                body.push(headerConstants.USE_LAPS + ': ' + token.useLaps);\r\n                body.push(headerConstants.LAPS_LOCALADMINNAME + ': ' + token.lapsLocalAdminName);\r\n            }\r\n        }\r\n    }\r\n\r\n    public resetAllTokens(): void {\r\n        this.manageAsToken = null;\r\n        this.nodePowershellEndpoints = {};\r\n        this.nodeTokens = {};\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, null);\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Encrypts a string value using the jwk from the gateway\r\n     */\r\n    public encrypt(value: string): Observable<string> {\r\n        const forward = this.forwardExecute<string>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.encrypt, [value]);\r\n        if (forward) {\r\n            return forward;\r\n        }\r\n\r\n        return Crypto.encryptRsaSha1(this.jwk, value);\r\n    }\r\n\r\n    /**\r\n     * Called on a child service instance when onForwardInit returns from the parent\r\n     * @param data The response from the forwardInit call\r\n     */\r\n    protected onForwardInitResponse(data: RpcForwardResponse<AuthorizationManagerInitProperties>): void {\r\n        if (data && data.error) {\r\n            // if there is an error, we cannot continue, so throw it\r\n            throw data.error;\r\n        }\r\n\r\n        this.manageAsToken = data.result.manageAsToken;\r\n        this.nodeTokens = data.result.nodeTokens;\r\n        this.nodePowershellEndpoints = data.result.nodePowershellEndpoints;\r\n    }\r\n\r\n    /**\r\n     * Called when a new instance of the service in another window is initialized and needs to synchronize with its parent\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @returns an observable for the all the values needed to initialize the service\r\n     */\r\n    protected onForwardInit(): Observable<AuthorizationManagerInitProperties> {\r\n        // authorization manager doesn't pass any properties to child services at this time.\r\n        return of(<AuthorizationManagerInitProperties>{\r\n            manageAsToken: this.manageAsToken,\r\n            nodeTokens: this.nodeTokens,\r\n            nodePowershellEndpoints: this.nodePowershellEndpoints\r\n        });\r\n    }\r\n\r\n    /**\r\n     * Called when the forwarded services counterpart wants to get data from the parent\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @param name The name of the method to forward to\r\n     * @param args The arguments of the method\r\n     * @returns an observable for the result of the method call\r\n     */\r\n    protected onForwardExecute(from: RpcRelationshipType, name: string, args: any[]): Observable<any> {\r\n        // command comes from child\r\n        if (from === RpcRelationshipType.Child) {\r\n            switch (name) {\r\n                case AuthorizationManager.rpcCommands.getNewToken: {\r\n                    // start getting the new token, but return immediately to avoid timeout\r\n                    const subscription = this.getNewToken(args ? args[0] : null, args ? args[1] : null)\r\n                        .subscribe(\r\n                            result => subscription.unsubscribe(),\r\n                            error => {\r\n                                subscription.unsubscribe();\r\n                                this.forwardNotify(\r\n                                    RpcRelationshipType.Child,\r\n                                    AuthorizationManager.rpcCommands.setNodeTokenError,\r\n                                    RpcForwarder.ensureSerializable(error));\r\n                            });\r\n                    return of(null);\r\n                }\r\n                case AuthorizationManager.rpcCommands.secureToken: {\r\n                    const options = args && args[0];\r\n                    if (!options) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.secureToken(options);\r\n                }\r\n                case AuthorizationManager.rpcCommands.encrypt: {\r\n                    const options = args && args[0];\r\n                    if (!options) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.encrypt(options);\r\n                }\r\n                case AuthorizationManager.rpcCommands.setNodeTokens: {\r\n                    const token = args && args[0];\r\n                    const nodes = args && args[1];\r\n                    if (!token) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.setNodeTokens(token, nodes);\r\n                }\r\n            }\r\n        }\r\n\r\n        // command comes from parent\r\n        if (from === RpcRelationshipType.Parent) {\r\n            if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {\r\n                this.nodeTokens = {};\r\n                this.nodePowershellEndpoints = {};\r\n                // if we also have children, forward the request on\r\n                const forward = this.forwardExecute(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, args);\r\n                return forward || of(null);\r\n            }\r\n        }\r\n\r\n        // command not implemented\r\n        return this.nameNotFound(name);\r\n    }\r\n\r\n    /**\r\n     * Called when the forwarded services counterpart sends a notify message\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @param name The name of the property to change\r\n     * @param value The new value of the property\r\n     * @returns an observable that completes when the property has been changed.\r\n     */\r\n    protected onForwardNotify(from: RpcRelationshipType, name: string, value: any): Observable<void> {\r\n        // allow our parent to give us a new token.\r\n        if (from === RpcRelationshipType.Parent) {\r\n            if (name === AuthorizationManager.rpcCommands.manageAsToken) {\r\n                this.manageAsToken = value;\r\n                // if we also have children, forward the notification on\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setNodeToken) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n                }\r\n\r\n                this.completeTokenAwaiter(value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setNodeTokenError) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n                }\r\n\r\n                this.completeTokenAwaiter(null, value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setJeaContext) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(message.format(AuthorizationManager.rpcCommands.setJeaContext));\r\n                }\r\n\r\n                this.saveJeaContext(value.nodeName, value.endpoint);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setJeaContext, value);\r\n                return forward || of(null);\r\n            }\r\n        }\r\n\r\n        return this.nameNotFound(name);\r\n    }\r\n\r\n    /**\r\n     * Creates a secure token from the given options that may be used for node authentication\r\n     *\r\n     * @param options The token creation options\r\n     */\r\n    private secureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n        // ensure a valid value for laps local admin name\r\n        if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n            options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n        }\r\n\r\n        // ensure username has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n            options.username = null;\r\n        }\r\n\r\n        if (options.useLaps || !options.username) {\r\n            return of({\r\n                value: null,\r\n                username: null,\r\n                useLaps: options.useLaps,\r\n                lapsLocalAdminName: options.lapsLocalAdminName\r\n            });\r\n        }\r\n\r\n        // ensure password has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n            options.password = null;\r\n        }\r\n\r\n        let username: string[];\r\n        if (options.username.indexOf('@') >= 0) {\r\n            username = options.username.split('@').reverse();\r\n        } else {\r\n            username = options.username.split('\\\\');\r\n        }\r\n\r\n        const tokenData = {\r\n            value: undefined,\r\n            username: options.username,\r\n            useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n            lapsLocalAdminName: null\r\n        };\r\n\r\n        if (this.jwk) {\r\n            return Net.createEncryptedAuthenticationHeader(this.jwk, username, options.password)\r\n                .pipe(map(newToken => {\r\n                    tokenData.value = newToken;\r\n                    return tokenData;\r\n                }));\r\n        }\r\n\r\n        tokenData.value = Net.createEncodedAuthenticationHeader(username, options.password);\r\n        return of(tokenData);\r\n    }\r\n\r\n    /**\r\n     * Completes the token awaiter\r\n     */\r\n    private completeTokenAwaiter(result: AuthorizationTokenResponse, error?: any) {\r\n        if (error) {\r\n            if (this.tokenAwaiter) {\r\n                const awaiter = this.tokenAwaiter;\r\n                this.tokenAwaiter = null;\r\n                awaiter.error(error);\r\n            }\r\n        } else {\r\n            if (!result.appliesTo) {\r\n                this.manageAsToken = result.token;\r\n            } else if (Array.isArray(result.appliesTo)) {\r\n                result.appliesTo.forEach(nodeName => {\r\n                    this.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;\r\n                });\r\n                this.updateCache();\r\n            } else {\r\n                this.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;\r\n                this.updateCache();\r\n            }\r\n\r\n            if (this.tokenAwaiter) {\r\n                const awaiter = this.tokenAwaiter;\r\n                this.tokenAwaiter = null;\r\n                awaiter.next(result);\r\n                awaiter.complete();\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Gets the error data.\r\n     * @param code the http status code.\r\n     * @param error the AJAX error object.\r\n     */\r\n    private getErrorData(code: HttpStatusCode, error: AjaxError): NodeAuthorizationErrorData {\r\n        return {\r\n            statusCode: code,\r\n            errorCode: error && error.xhr && error.xhr.response && error.xhr.response.error && error.xhr.response.error.code,\r\n            errorMessage: Net.getErrorMessage(error)\r\n        };\r\n    }\r\n\r\n    /**\r\n     * Updates the authorization cache. Does nothing if we are not running in shell\r\n     */\r\n    private updateCache(): void {\r\n        if (!MsftSme.isShell()) {\r\n            // ignore if not shell\r\n            return;\r\n        }\r\n        // update cached data\r\n        const cacheData: AuthorizationCacheData = {\r\n            jwk: this.jwk,\r\n            manageAsToken: this.manageAsToken,\r\n            nodePowershellEndpoints: this.nodePowershellEndpoints,\r\n            nodeTokens: this.nodeTokens\r\n        };\r\n        sessionStorage.setItem(AuthorizationManager.cacheKey, JSON.stringify(cacheData));\r\n    }\r\n}\r\n"]}

package/core/security/credssp-manager.d.ts

@@ -18,39 +18,45 @@ export declare class CredSSPManager {
      * New Enable CredSSP on the passed in server.
      *
      * @param serverName This server on which CredSSP should be enabled
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanEnableManagedServer(serverName: string): Observable<boolean>;
+    wsmanEnableManagedServer(serverName: string, verbose?: boolean): Observable<boolean>;
     /**
      * New Disable CredSSP for the passed in server.
      *
      * @param serverName This server on which CredSSP should be disabled
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanDisableManagedServer(serverName: string): Observable<boolean>;
+    wsmanDisableManagedServer(serverName: string, verbose?: boolean): Observable<boolean>;
     /**
      * New Enable CredSSP client role for the gateway and delegate to the list of servers.
      *
      * @param serverNames This list of servers where CredSSP should be enabled.
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanEnableClientRole(serverNames: string[]): Observable<boolean>;
+    wsmanEnableClientRole(serverNames: string[], verbose?: boolean): Observable<boolean>;
     /**
      * New Disable CredSSP client role for the gateway and remove all delegated servers.
      *
      * @param serverNames This list of servers where CredSSP should be disabled.
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanDisableClientRole(serverNames: string[]): Observable<boolean>;
+    wsmanDisableClientRole(serverNames: string[], verbose?: boolean): Observable<boolean>;
     /**
      * New Enable the server as a CredSSP server, and enable the gateway as a CredSSP client of the server.
      *
      * @param serverName The sever where CredSSP delegation should be enabled.
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanEnableDelegation(serverName: string): Observable<boolean>;
+    wsmanEnableDelegation(serverName: string, verbose?: boolean): Observable<boolean>;
     /**
      * Test WSMan CredSSP connection from gateway to server(s)
      * @param serverNames the servers to test connection to from gateway
      * @param credentials explicit credentials(username and password) to be used to WSMan CredSSP test
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      * @returns true if we can safely connect to all server without isssues otherwise returns false
      */
-    testCredSSP(serverNames: string[], credentials: Credentials): Observable<boolean>;
+    testCredSSP(serverNames: string[], credentials: Credentials, verbose?: boolean): Observable<boolean>;
     /**
      * @deprecated
      * Notification message wouldn't be displayed from this call. Display the notification by own code,
@@ -126,6 +132,7 @@ export declare class CredSSPManager {
     /**
      * The RPC request to the CredSSPManagerShellService.
      * @param request The requested CredSSP manager operation
+     * @param verbose Specify whether a solution (if any) should be returned if CredSSP errored
      */
     private sendRequest;
     /**

package/core/security/credssp-manager.js

@@ -1,5 +1,6 @@
 import { from, of, Subject, throwError } from 'rxjs';
 import { filter, mergeMap, take } from 'rxjs/operators';
+import { ErrorExtended } from '../data/error-extended';
 import { Logging } from '../diagnostics/logging';
 import { RpcCredSSPOperationType, RpcCredSspResponseKey } from '../rpc/credssp/rpc-credssp-model';
 import { RpcCredSspRequestClient } from '../rpc/credssp/rpc-credssp-request-client';
@@ -26,8 +27,9 @@ export class CredSSPManager {
      * New Enable CredSSP on the passed in server.
      *
      * @param serverName This server on which CredSSP should be enabled
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanEnableManagedServer(serverName) {
+    wsmanEnableManagedServer(serverName, verbose = false) {
         if (this.rpc.isShell) {
             throw new Error('Not supported on the shell environment.');
         }
@@ -40,14 +42,15 @@ export class CredSSPManager {
             serverNames: [serverName],
             notificationTitle: null,
             notificationId: null
-        });
+        }, verbose);
     }
     /**
      * New Disable CredSSP for the passed in server.
      *
      * @param serverName This server on which CredSSP should be disabled
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanDisableManagedServer(serverName) {
+    wsmanDisableManagedServer(serverName, verbose = false) {
         if (this.rpc.isShell) {
             throw new Error('Not supported on the shell environment.');
         }
@@ -60,14 +63,15 @@ export class CredSSPManager {
             serverNames: [serverName],
             notificationTitle: null,
             notificationId: null
-        });
+        }, verbose);
     }
     /**
      * New Enable CredSSP client role for the gateway and delegate to the list of servers.
      *
      * @param serverNames This list of servers where CredSSP should be enabled.
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanEnableClientRole(serverNames) {
+    wsmanEnableClientRole(serverNames, verbose = false) {
         if (this.rpc.isShell) {
             throw new Error('Not supported on the shell environment.');
         }
@@ -80,14 +84,15 @@ export class CredSSPManager {
             serverNames: serverNames,
             notificationTitle: null,
             notificationId: null
-        });
+        }, verbose);
     }
     /**
      * New Disable CredSSP client role for the gateway and remove all delegated servers.
      *
      * @param serverNames This list of servers where CredSSP should be disabled.
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanDisableClientRole(serverNames) {
+    wsmanDisableClientRole(serverNames, verbose = false) {
         if (this.rpc.isShell) {
             throw new Error('Not supported on the shell environment.');
         }
@@ -100,14 +105,15 @@ export class CredSSPManager {
             serverNames,
             notificationTitle: null,
             notificationId: null
-        });
+        }, verbose);
     }
     /**
      * New Enable the server as a CredSSP server, and enable the gateway as a CredSSP client of the server.
      *
      * @param serverName The sever where CredSSP delegation should be enabled.
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    wsmanEnableDelegation(serverName) {
+    wsmanEnableDelegation(serverName, verbose = false) {
         if (this.rpc.isShell) {
             throw new Error('Not supported on the shell environment.');
         }
@@ -120,15 +126,16 @@ export class CredSSPManager {
             serverNames: [serverName],
             notificationTitle: null,
             notificationId: null
-        });
+        }, verbose);
     }
     /**
      * Test WSMan CredSSP connection from gateway to server(s)
      * @param serverNames the servers to test connection to from gateway
      * @param credentials explicit credentials(username and password) to be used to WSMan CredSSP test
+     * @param verbose (Optional) Specify whether a solution (if any) should be returned if CredSSP errored
      * @returns true if we can safely connect to all server without isssues otherwise returns false
      */
-    testCredSSP(serverNames, credentials) {
+    testCredSSP(serverNames, credentials, verbose = false) {
         if (this.rpc.isShell) {
             throw new Error('Not supported on the shell environment.');
         }
@@ -145,7 +152,7 @@ export class CredSSPManager {
             credentials,
             notificationTitle: null,
             notificationId: null
-        });
+        }, verbose);
     }
     /**
      * @deprecated
@@ -171,7 +178,7 @@ export class CredSSPManager {
             serverNames: [serverName],
             notificationTitle: alertTitle,
             notificationId: alertId
-        });
+        }, false);
     }
     /**
      * @deprecated
@@ -197,7 +204,7 @@ export class CredSSPManager {
             serverNames: [serverName],
             notificationTitle: alertTitle,
             notificationId: alertId
-        });
+        }, false);
     }
     /**
      * @deprecated
@@ -223,7 +230,7 @@ export class CredSSPManager {
             serverNames: serverNames,
             notificationTitle: alertTitle,
             notificationId: alertId
-        });
+        }, false);
     }
     /**
      * @deprecated
@@ -249,7 +256,7 @@ export class CredSSPManager {
             serverNames,
             notificationTitle: alertTitle,
             notificationId: alertId
-        });
+        }, false);
     }
     /**
      * @deprecated
@@ -276,7 +283,7 @@ export class CredSSPManager {
             serverNames: [serverName],
             notificationTitle: alertTitle,
             notificationId: alertId
-        });
+        }, false);
     }
     /**
      * @deprecated
@@ -294,15 +301,24 @@ export class CredSSPManager {
     /**
      * The RPC request to the CredSSPManagerShellService.
      * @param request The requested CredSSP manager operation
+     * @param verbose Specify whether a solution (if any) should be returned if CredSSP errored
      */
-    sendRequest(request) {
+    sendRequest(request, verbose) {
         Logging.logDebug('CredSSPManager', 'Sending request to CredSSPManagerService. Request:{0}'.format(JSON.stringify(request)));
         return from(RpcCredSspRequestClient.credSspRequest(this.rpc, request))
             .pipe(mergeMap(() => this.watcher), filter(result => result.requestId === request.requestId), take(1), mergeMap(result => {
+            // shell reports 'error' property originated from the CredSSP operation.
+            // the client using this API should get this error message to display to user.
             if (result.error) {
-                // shell reports 'error' property originated from the CredSSP operation.
-                // the client using this API should get this error message to display to user.
-                return throwError(new Error(result.error));
+                if (verbose) {
+                    const error = new ErrorExtended(result.error);
+                    error.extendedSource = `${request.operation}-credSSPError`;
+                    error.extended = { solutionMessage: result.solutionMessage };
+                    return throwError(error);
+                }
+                else {
+                    return throwError(new Error(result.error));
+                }
             }
             return of(result.succeeded);
         }));