npm - @microsoft/windows-admin-center-sdk - Versions diffs - 2.186.0 → 2.296.0 - Mend

@microsoft/windows-admin-center-sdk 2.186.0 → 2.296.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (236) hide show

package/core/security/authorization-manager.js CHANGED Viewed

@@ -5,6 +5,7 @@ import { headerConstants } from '../data/http-constants';
 import { Net } from '../data/net';
 import { Logging } from '../diagnostics/logging';
 import { RpcForwarder, RpcServiceForwarder } from '../rpc/rpc-forwarder';
+import { SignOnManager } from './sign-on-manager';
 /**
  * Authorization Manager class. Handles SME authentication for service requests.
  */
@@ -19,6 +20,8 @@ export class AuthorizationManager extends RpcServiceForwarder {
         this.authorize = authorize;
         this.gatewayJwkChangedSubject = new Subject();
         this.gatewayJwkChanged = this.gatewayJwkChangedSubject.asObservable();
+        this.credentialExpirationChangedSubject = new Subject();
+        this.credentialExpirationChanged = this.credentialExpirationChangedSubject.asObservable();
         this.nodeTokens = {};
         this.nodePowershellEndpoints = {};
         if (MsftSme.isShell()) {
@@ -32,12 +35,29 @@ export class AuthorizationManager extends RpcServiceForwarder {
                     this.manageAsToken = cachedData.manageAsToken || null;
                     this.nodeTokens = cachedData.nodeTokens || {};
                     this.nodePowershellEndpoints = cachedData.nodePowershellEndpoints || {};
+                    this.logOnUser = cachedData.logOnUser;
                 }
                 catch (error) {
                     sessionStorage.removeItem(AuthorizationManager.cacheKey);
                 }
             }
         }
+        this.signOnManager = new SignOnManager(() => this.refreshSignOnToken());
+    }
+    /**
+     * Set the admin configured expiration time in milliseconds
+     * If this is not set it will be defaulted to 365 days.
+     */
+    set authExpirationInMs(expirationTimeInMs) {
+        this.credentialsExpirationTimeInMs = expirationTimeInMs;
+        this.credentialExpirationChangedSubject.next(expirationTimeInMs);
+    }
+    /**
+     * Sets logon user and caches the value
+     */
+    set shellLogOnUser(username) {
+        this.logOnUser = username;
+        this.updateCache();
     }
     /**
      * Sets the current manage as token
@@ -121,8 +141,7 @@ export class AuthorizationManager extends RpcServiceForwarder {
      */
     canHandleStreamFailure(response) {
         // access denied case.
-        return response && response.response
-            && response.response.statusCode === 401 /* Unauthorized */;
+        return response && response.response && response.response.statusCode === 401 /* Unauthorized */;
     }
     /**
      * When canHandle returns true for an ajax error, this method can be called to handle that error.
@@ -242,6 +261,37 @@ export class AuthorizationManager extends RpcServiceForwarder {
         });
         return this.tokenAwaiter;
     }
+    refreshSignOnToken() {
+        // if we are already awaiting a token, then hook into the current request and try using that token
+        if (this.signOnTokenAwaiter) {
+            return this.signOnTokenAwaiter;
+        }
+        // define a new subject for multiple requests to wait on
+        this.signOnTokenAwaiter = new Subject();
+        // try to forward execute getSignOnToken from our parent.
+        const now = Date.now();
+        const parentExecuter = this.forwardExecute(0 /* Parent */, AuthorizationManager.rpcCommands.getSignOnToken, [now]);
+        if (parentExecuter) {
+            return this.signOnTokenAwaiter;
+        }
+        // since we could not forward the request We must ask for the signon token ourselves
+        this.signOnManager.requestSignOnRefresh()
+            .subscribe(response => {
+            this.completeSignOnTokenAwaiter(response);
+            this.forwardNotify(1 /* Child */, AuthorizationManager.rpcCommands.setSignOnToken, RpcForwarder.ensureSerializable(response));
+        }, error => {
+            this.completeSignOnTokenAwaiter(null, error);
+            this.forwardNotify(1 /* Child */, AuthorizationManager.rpcCommands.setSignOnTokenError, RpcForwarder.ensureSerializable(error));
+        });
+        return this.signOnTokenAwaiter;
+    }
+    /**
+     * Forward Sign On Token to child frame.
+     */
+    forwardSignOnToken() {
+        const data = { time: Date.now(), token: this.signOnManager.signedHttpRequestToken };
+        this.forwardNotify(1 /* Child */, AuthorizationManager.rpcCommands.setSignOnToken, data);
+    }
     /**
      * @deprecated use createSecureToken() after configured gatewayJwk property.
      *
@@ -429,6 +479,7 @@ export class AuthorizationManager extends RpcServiceForwarder {
         this.manageAsToken = data.result.manageAsToken;
         this.nodeTokens = data.result.nodeTokens;
         this.nodePowershellEndpoints = data.result.nodePowershellEndpoints;
+        this.signOnManager.signedHttpRequestToken = data.result.signOnToken;
     }
     /**
      * Called when a new instance of the service in another window is initialized and needs to synchronize with its parent
@@ -440,7 +491,8 @@ export class AuthorizationManager extends RpcServiceForwarder {
         return of({
             manageAsToken: this.manageAsToken,
             nodeTokens: this.nodeTokens,
-            nodePowershellEndpoints: this.nodePowershellEndpoints
+            nodePowershellEndpoints: this.nodePowershellEndpoints,
+            signOnToken: this.signOnManager.signedHttpRequestToken
         });
     }
     /**
@@ -485,6 +537,14 @@ export class AuthorizationManager extends RpcServiceForwarder {
                     }
                     return this.setNodeTokens(token, nodes);
                 }
+                case AuthorizationManager.rpcCommands.getSignOnToken: {
+                    const subscription = this.refreshSignOnToken()
+                        .subscribe(() => subscription.unsubscribe(), error => {
+                        subscription.unsubscribe(),
+                            this.forwardNotify(1 /* Child */, AuthorizationManager.rpcCommands.setSignOnTokenError, RpcForwarder.ensureSerializable(error));
+                    });
+                    return of(null);
+                }
             }
         }
         // command comes from parent
@@ -543,6 +603,24 @@ export class AuthorizationManager extends RpcServiceForwarder {
                 const forward = this.forwardNotify(1 /* Child */, AuthorizationManager.rpcCommands.setJeaContext, value);
                 return forward || of(null);
             }
+            if (name === AuthorizationManager.rpcCommands.setSignOnToken) {
+                if (!value) {
+                    const message = MsftSme.getStrings().MsftSmeShell.Core.Error.InvalidValue.message;
+                    return throwError(message.format(AuthorizationManager.rpcCommands.setNodeToken));
+                }
+                this.completeSignOnTokenAwaiter(value);
+                const forward = this.forwardNotify(1 /* Child */, AuthorizationManager.rpcCommands.setSignOnToken, value);
+                return forward || of(null);
+            }
+            if (name === AuthorizationManager.rpcCommands.setSignOnTokenError) {
+                if (!value) {
+                    const message = MsftSme.getStrings().MsftSmeShell.Core.Error.InvalidValue.message;
+                    return throwError(message.format(AuthorizationManager.rpcCommands.setNodeTokenError));
+                }
+                this.completeSignOnTokenAwaiter(null, value);
+                const forward = this.forwardNotify(1 /* Child */, AuthorizationManager.rpcCommands.setSignOnTokenError, value);
+                return forward || of(null);
+            }
         }
         return this.nameNotFound(name);
     }
@@ -586,7 +664,7 @@ export class AuthorizationManager extends RpcServiceForwarder {
             lapsLocalAdminName: null
         };
         if (this.jwk) {
-            return Net.createEncryptedAuthenticationHeader(this.jwk, username, options.password)
+            return Net.createEncryptedAuthenticationHeader(this.jwk, username, options.password, this.logOnUser, this.credentialsExpirationTimeInMs)
                 .pipe(map(newToken => {
                 tokenData.value = newToken;
                 return tokenData;
@@ -628,6 +706,31 @@ export class AuthorizationManager extends RpcServiceForwarder {
             }
         }
     }
+    /**
+     * Completes the sign on token awaiter
+     */
+    completeSignOnTokenAwaiter(result, error) {
+        const awaiter = this.signOnTokenAwaiter;
+        if (awaiter) {
+            this.signOnTokenAwaiter = null;
+        }
+        if (error) {
+            if (awaiter) {
+                awaiter.error(error);
+            }
+            return;
+        }
+        if (result.token) {
+            this.signOnManager.signedHttpRequestToken = result.token;
+        }
+        else {
+            Logging.logError('Shell.AuthorizationManager', 'Null token was passed.');
+        }
+        if (awaiter) {
+            awaiter.next(result);
+            awaiter.complete();
+        }
+    }
     /**
      * Gets the error data.
      * @param code the http status code.
@@ -675,7 +778,10 @@ AuthorizationManager.rpcCommands = {
     clearNodeTokens: 'clearNodeTokens',
     getNewToken: 'getNewToken',
     secureToken: 'secureToken',
-    encrypt: 'encrypt'
+    encrypt: 'encrypt',
+    getSignOnToken: 'getSignOnToken',
+    setSignOnToken: 'setSignOnToken',
+    setSignOnTokenError: 'setSignOnTokenError'
 };
 //# sourceMappingURL=authorization-manager.js.map

package/core/security/authorization-manager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../packages/core/security/authorization-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3D,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAKjD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AA2EzE;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IA8GzD;;;;OAIG;IACH,YAAoB,SAAmC,EAAE,GAAQ;QAC7D,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QADpB,cAAS,GAAT,SAAS,CAA0B;QAEnD,IAAI,CAAC,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE;YACnB,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE;gBAC/C,IAAI;oBACA,MAAM,UAAU,GAA2B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACxE,iCAAiC;oBACjC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC;oBAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC;oBACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC9C,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,IAAI,EAAE,CAAC;iBAC3E;gBAAC,OAAO,KAAK,EAAE;oBACZ,cAAc,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;iBAC5D;aACJ;SACJ;IACL,CAAC;IAxFD;;;OAGG;IACH,IAAW,aAAa,CAAC,KAAyB;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACrG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAW,aAAa;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAW,UAAU,CAAC,GAAW;QAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE;YAClB,IAAI,CAAC,cAAc,EAAE,CAAC;SACzB;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAYD;;OAEG;IACH,IAAW,UAAU;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,IAAW,WAAW;QAClB,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChD,0BAA0B;YAC1B,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,0BAA0B;QAC1B,OAAO,EAAE,CAA6B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1F,CAAC;IA+BD;;OAEG;IACI,oBAAoB,CAAC,IAAoB,EAAE,KAAgB;QAC9D,kIAAkI;QAClI,OAAO,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,iBAAiB,CACpB,IAAoB,EACpB,OAAoB,EACpB,KAAgB,EAChB,QAAiB;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACtB,+FAA+F;YAC/F,4DAA4D;YAC5D,oDAAoD;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;YACjC,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE;gBAChB,8CAA8C;gBAC9C,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;aACtB;iBAAM;gBACH,mDAAmD;gBACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;aACjE;QACL,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,QAA2B;QACrD,sBAAsB;QACtB,OAAO,QAAQ,IAAI,QAAQ,CAAC,QAAQ;eAC7B,QAAQ,CAAC,QAAQ,CAAC,UAAU,2BAAgC,CAAC;IACxE,CAAC;IAED;;OAEG;IACI,mBAAmB,CACtB,QAAgB,EAChB,OAAyB,EACzB,QAAsD;QACtD,IAAI,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE;YACV,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC7B,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;aAC/B;SACJ;QACD,MAAM,SAAS,GAA+B;YAC1C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;YACxC,SAAS,EAAE,cAAc;YACzB,YAAY,EAAE,OAAO;SACxB,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/B,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,KAAK,EAAE;oBACP,IAAI,OAAO,EAAE;wBACT,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;qBAC7B;yBAAM;wBACH,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;qBAClC;iBACJ;gBAED,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;aACtB;iBAAM;gBACH,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;aAChE;QACL,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAEM,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,OAAO,CAAC,KAAK,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAC9C,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,cAAc,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,QAAQ,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAcM,WAAW,CAAC,SAA6B,EAAE,SAAsC;QACpF,kGAAkG;QAClG,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChD,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,6CAA6C;QAC7C,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YACxC,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;SAC3B;QAED,wDAAwD;QACxD,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,EAA8B,CAAC;QAE9D,qDAAqD;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,iBAEtC,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAC5C,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5B,IAAI,cAAc,EAAE;YAChB,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,6DAA6D;QAC7D,uFAAuF;QACvF,IAAI,SAAS,EAAE;YACX,KAAK,MAAM,IAAI,IAAc,SAAS,EAAE;gBACpC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACnC;SACJ;QAED,kFAAkF;QAClF,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;aAC/B,IAAI,CACD,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,IAAI,WAAW,CAAC,eAAe,EAAE;gBAC7B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,gBACJ,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE;oBACT,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;iBAC/C;aACJ;YAED,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC,CAAC,EACF,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;YACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;aACrD,CAAC,CAAC,IAAI,CACH,GAAG,CAAC,KAAK,CAAC,EAAE;gBACR,OAAmC;oBAC/B,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,SAAS;iBACvB,CAAC;YACN,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC;QACF,mDAAmD;QACnD,+DAA+D;QAC/D,IAAI,CAAC,CAAC,CAAC,CAAC;aACX,SAAS,CACN,MAAM,CAAC,EAAE;YACL,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzG,CAAC,EACD,KAAK,CAAC,EAAE;YACJ,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAClD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACI,WAAW,CAAC,OAAwC,EAAE,wBAAgC,IAAI;QAC7F,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;YACxD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;SAC/E;QACD,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,OAAO;gBACH,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC;SACL;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;SACpD;aAAM;YACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACvG,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,IAAI;SAC3B,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,OAAwC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAE/B,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAC5C,CAAC,OAAO,CAAC,CAAC,CAAC;QACf,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;aAAM;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SACpC;IACL,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,QAAgB;QACrC,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE;YAC3D,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;SACxD;QAED,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,KAAyB,EAAE,SAAoB;QAChE,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAE/B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAC9C,CAAC,KAAK,EAAE,SAAS,CAAC,CACrB,CAAC;QACF,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;QAED,8BAA8B;QAC9B,MAAM,qBAAqB,GAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;YACnE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;SAC9B;aAAM;YACH,qBAAqB,CAAC,SAAS,GAAG,SAAS,CAAC;YAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;SACxF;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,kDAAkD;QAClD,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAE1H,oDAAoD;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAoB,EAAE,QAAiB,EAAE,KAA0B;QACpG,IAAI,CAAC,KAAK,EAAE;YACR,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBAEb,0FAA0F;gBAC1F,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;aACpE;iBAAM;gBAEH,iCAAiC;gBACjC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aACnF;SACJ;IACL,CAAC;IAED;;;;;OAKG;IACI,kBAAkB,CAAC,QAAgB,EAAE,KAA0B;QAClE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBACb,0FAA0F;gBAC1F,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;aAC5D;iBAAM;gBAEH,iCAAiC;gBACjC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrE,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aAC3E;SACJ;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACI,qCAAqC,CAAC,IAAc,EAAE,QAAiB,EAAE,KAA0B;QACtG,IAAI,CAAC,KAAK,EAAE;YACR,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBACb,0FAA0F;gBAC1F,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;aACrE;iBAAM;gBACH,iCAAiC;gBACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,GAAG,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;aACpF;SACJ;IACL,CAAC;IAEM,cAAc;QACjB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAAqC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3H,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;QAED,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACO,qBAAqB,CAAC,IAA4D;QACxF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;YACpB,wDAAwD;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC;SACpB;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACO,aAAa;QACnB,oFAAoF;QACpF,OAAO,EAAE,CAAqC;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACO,gBAAgB,CAAC,IAAyB,EAAE,IAAY,EAAE,IAAW;QAC3E,2BAA2B;QAC3B,IAAI,IAAI,kBAA8B,EAAE;YACpC,QAAQ,IAAI,EAAE;gBACV,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBAC/C,uEAAuE;oBACvE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;yBAC9E,SAAS,CACN,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EACpC,KAAK,CAAC,EAAE;wBACJ,YAAY,CAAC,WAAW,EAAE,CAAC;wBAC3B,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAClD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAChD,CAAC,CAAC,CAAC;oBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;iBACnB;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBAC/C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE;wBACV,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;iBACpC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC3C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE;wBACV,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;iBAChC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,CAAC,KAAK,EAAE;wBACR,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;iBAC3C;aACJ;SACJ;QAED,4BAA4B;QAC5B,IAAI,IAAI,mBAA+B,EAAE;YACrC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE;gBAC3D,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAClC,mDAAmD;gBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACvH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;SACJ;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACO,eAAe,CAAC,IAAyB,EAAE,IAAY,EAAE,KAAU;QACzE,2CAA2C;QAC3C,IAAI,IAAI,mBAA+B,EAAE;YACrC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE;gBACzD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE;gBACxD,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;iBACpF;gBAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACpH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE;gBAC7D,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;iBACzF;gBAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACzH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE;gBACzD,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;iBACrF;gBAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;SACJ;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,OAAwC;QACxD,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;YACxD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;SAC/E;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,OAAO,EAAE,CAAC;gBACN,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC,CAAC;SACN;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;SACpD;aAAM;YACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C;QAED,MAAM,SAAS,GAAG;YACd,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,IAAI;SAC3B,CAAC;QAEF,IAAI,IAAI,CAAC,GAAG,EAAE;YACV,OAAO,GAAG,CAAC,mCAAmC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;iBAC/E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACjB,SAAS,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC;SACX;QAED,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,MAAkC,EAAE,KAAW;QACxE,IAAI,KAAK,EAAE;YACP,IAAI,IAAI,CAAC,YAAY,EAAE;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aACxB;SACJ;aAAM;YACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBACnB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;aACrC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;gBACxC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;oBAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACjE,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,EAAE,CAAC;aACtB;iBAAM;gBACH,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACrE,IAAI,CAAC,WAAW,EAAE,CAAC;aACtB;YAED,IAAI,IAAI,CAAC,YAAY,EAAE;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;aACtB;SACJ;IACL,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,IAAoB,EAAE,KAAgB;QACvD,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;YAChH,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;SAC3C,CAAC;IACN,CAAC;IAED;;OAEG;IACK,WAAW;QACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE;YACpB,sBAAsB;YACtB,OAAO;SACV;QACD,qBAAqB;QACrB,MAAM,SAAS,GAA2B;YACtC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC9B,CAAC;QACF,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;;AA5yBD;;GAEG;AACY,6BAAQ,GAAG,+BAA+B,CAAC;AAE1D;;GAEG;AACW,8CAAyB,GAAG,eAAe,CAAC;AAE3C,gCAAW,GAAG;IACzB,YAAY,EAAE,cAAc;IAC5B,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;CACrB,CAAC","file":"authorization-manager.js","sourcesContent":["\r\nimport { Observable, of, Subject, throwError } from 'rxjs';\r\nimport { AjaxError, AjaxRequest } from 'rxjs/ajax';\r\nimport { map, mergeMap, take } from 'rxjs/operators';\r\nimport { Deprecated } from '../base/decorators/deprecation.decorators';\r\nimport { CimStreamOptions, CimStreamResponse } from '../data/cim-stream';\r\nimport { Crypto } from '../data/crypto';\r\nimport { headerConstants, HttpStatusCode } from '../data/http-constants';\r\nimport { Net } from '../data/net';\r\nimport { PowerShellStreamResponse } from '../data/powershell-stream';\r\nimport { Logging } from '../diagnostics/logging';\r\nimport { Strings } from '../generated/strings';\r\nimport { RpcForwardResponse } from '../rpc/forward/rpc-forward-model';\r\nimport { Rpc } from '../rpc/rpc';\r\nimport { RpcRelationshipType } from '../rpc/rpc-base';\r\nimport { RpcForwarder, RpcServiceForwarder } from '../rpc/rpc-forwarder';\r\n\r\n/*\r\n Defines the response from an Authorization Handler\r\n /\r\nexport interface AuthorizationCredentials {\r\n username: string;\r\n password: string;\r\n applyToAllNodes?: boolean;\r\n useLaps?: boolean;\r\n lapsLocalAdminName?: string;\r\n}\r\n\r\n/\r\n Defines the response the AuthorizationManager returns from getToken\r\n /\r\nexport interface AuthorizationTokenResponse {\r\n token: AuthorizationToken;\r\n appliesTo?: string \| string[];\r\n}\r\n\r\n/\r\n Defines an authorizationToken\r\n /\r\nexport interface AuthorizationToken {\r\n value: string;\r\n username: string;\r\n useLaps: boolean;\r\n lapsLocalAdminName: string;\r\n}\r\n\r\n/\r\n The create authorization token options\r\n /\r\nexport interface CreateAuthorizationTokenOptions {\r\n password?: string;\r\n username?: string;\r\n useLaps?: boolean;\r\n lapsLocalAdminName?: string;\r\n}\r\n\r\n/\r\n The extra error data of original cause.\r\n /\r\nexport interface NodeAuthorizationErrorData {\r\n statusCode: HttpStatusCode;\r\n errorCode: string;\r\n errorMessage: string;\r\n}\r\n\r\n/\r\n Defines a handler that takes a nodeName and returns authorization credentials\r\n /\r\nexport type NodeAuthorizationHandler =\r\n (nodeName?: string \| string[], errorData?: NodeAuthorizationErrorData) => Observable<AuthorizationCredentials>;\r\n\r\n/\r\n Defines properties that will be provided to child instances on a forward init request\r\n /\r\nexport interface AuthorizationManagerInitProperties {\r\n manageAsToken: AuthorizationToken;\r\n nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n}\r\n\r\n/\r\n Representation of authorization cache data structure\r\n /\r\ninterface AuthorizationCacheData {\r\n jwk?: string;\r\n nodeTokens?: MsftSme.StringMap<AuthorizationToken>;\r\n manageAsToken?: AuthorizationToken;\r\n nodePowershellEndpoints?: MsftSme.StringMap<string>;\r\n}\r\n\r\n/\r\n Authorization Manager class. Handles SME authentication for service requests.\r\n /\r\nexport class AuthorizationManager extends RpcServiceForwarder {\r\n\r\n /\r\n Cache key for session storage of authorization cache\r\n /\r\n private static cacheKey = 'AuthorizationManager.cache.v1';\r\n\r\n /\r\n If no laps local admin name is defined, it will default to 'administrator'\r\n /\r\n public static defaultLapsLocalAdminName = 'administrator';\r\n\r\n private static rpcCommands = {\r\n setNodeToken: 'setNodeToken',\r\n setNodeTokens: 'setNodeTokens',\r\n manageAsToken: 'manageAsToken',\r\n setNodeTokenError: 'setNodeTokenError',\r\n setJeaContext: 'setJeaContext',\r\n clearNodeTokens: 'clearNodeTokens',\r\n getNewToken: 'getNewToken',\r\n secureToken: 'secureToken',\r\n encrypt: 'encrypt'\r\n };\r\n\r\n /\r\n Create a map of nodeNames to token objects to hold node specific tokens.\r\n /\r\n public nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n\r\n /\r\n The backing store fro the manageAsToken\r\n /\r\n private token: AuthorizationToken;\r\n\r\n /\r\n The JSON Web Key. Single string with JSON.stringify format.\r\n /\r\n private jwk: string;\r\n\r\n /\r\n The mapping of connections to PowershellEndpoints\r\n /\r\n private nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n\r\n /\r\n The token awaiter subject.\r\n /\r\n private tokenAwaiter: Subject<AuthorizationTokenResponse>;\r\n\r\n /\r\n Sets the current manage as token\r\n * If running with an Rpc child, notify of the change\r\n /\r\n public set manageAsToken(token: AuthorizationToken) {\r\n this.token = token;\r\n this.nodePowershellEndpoints = {};\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, token);\r\n this.updateCache();\r\n }\r\n\r\n /\r\n Gets the current manage as token\r\n /\r\n public get manageAsToken(): AuthorizationToken {\r\n return this.token;\r\n }\r\n\r\n /\r\n Sets the gateway encryption certificate JWK.\r\n * If this is not set by Shell/Add-Connection, it will send clear text password.\r\n /\r\n public set gatewayJwk(jwk: string) {\r\n if (this.jwk !== jwk) {\r\n this.resetAllTokens();\r\n }\r\n this.jwk = jwk;\r\n this.gatewayJwkChangedSubject.next(jwk);\r\n this.updateCache();\r\n }\r\n\r\n /\r\n Observable that emits whenever the gateways Jwk has changed\r\n /\r\n public readonly gatewayJwkChanged: Observable<string>;\r\n\r\n /\r\n Underlying implementation subject for gatewayJwkChanged observable\r\n /\r\n private gatewayJwkChangedSubject: Subject<string>;\r\n\r\n /\r\n Gets the gateway encryption certificate JWK.\r\n /\r\n public get gatewayJwk() {\r\n return this.jwk;\r\n }\r\n\r\n /\r\n Gets an observable the emits when the authorization token is ready\r\n /\r\n public get authAwaiter() {\r\n if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n // return the global token\r\n return this.tokenAwaiter;\r\n }\r\n\r\n // return the global token\r\n return of(<AuthorizationTokenResponse>{ appliesTo: null, token: this.manageAsToken });\r\n }\r\n\r\n /\r\n Initializes a new instance of the Authorization Manager class\r\n * @param authorize An AuthorizationHandler with which to retrieve user credentials\r\n * @param rpc The rpc to forward auth requests to a parent window\r\n /\r\n constructor(private authorize: NodeAuthorizationHandler, rpc: Rpc) {\r\n super('authorization-manager', rpc);\r\n this.gatewayJwkChangedSubject = new Subject<string>();\r\n this.gatewayJwkChanged = this.gatewayJwkChangedSubject.asObservable();\r\n this.nodeTokens = {};\r\n this.nodePowershellEndpoints = {};\r\n if (MsftSme.isShell()) {\r\n // attempt to restore from storage if this is a shell instance\r\n const cachedDataString = sessionStorage.getItem(AuthorizationManager.cacheKey);\r\n if (!MsftSme.isNullOrWhiteSpace(cachedDataString)) {\r\n try {\r\n const cachedData: AuthorizationCacheData = JSON.parse(cachedDataString);\r\n // verify data and set properties\r\n this.jwk = cachedData.jwk \|\| null;\r\n this.manageAsToken = cachedData.manageAsToken \|\| null;\r\n this.nodeTokens = cachedData.nodeTokens \|\| {};\r\n this.nodePowershellEndpoints = cachedData.nodePowershellEndpoints \|\| {};\r\n } catch (error) {\r\n sessionStorage.removeItem(AuthorizationManager.cacheKey);\r\n }\r\n }\r\n }\r\n }\r\n\r\n /\r\n defines the conditions under which the AuthorizationManager can handle an ajax error\r\n /\r\n public canHandleAjaxFailure(code: HttpStatusCode, error: AjaxError) {\r\n // we can handle ajax errors if we have a getter defined, and the code is Unauthorized (401) or we get a cim authorization failure\r\n return this.authorize && Net.isUnauthorized(error);\r\n }\r\n\r\n /\r\n When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n /\r\n public handleAjaxFailure(\r\n code: HttpStatusCode,\r\n request: AjaxRequest,\r\n error: AjaxError,\r\n nodeName?: string): Observable<AjaxRequest> {\r\n const errorData = this.getErrorData(code, error);\r\n\r\n return this.getNewToken(nodeName, errorData)\r\n .pipe(mergeMap(response => {\r\n // There may be multiple nodes requesting authentication, but we can only ask the user for one.\r\n // check if the result if for our node, otherwise try again.\r\n // It looks for inside of array only for first name.\r\n const names = response.appliesTo;\r\n const isTokenForNode = !names \|\| names === nodeName \|\| (Array.isArray(names) && names[0] === nodeName);\r\n if (isTokenForNode) {\r\n // this token applies to our node, so continue\r\n this.addAuthorizationRequestHeader(request, nodeName);\r\n return of(request);\r\n } else {\r\n // this token did not apply to our node. Ask again.\r\n return this.handleAjaxFailure(code, request, error, nodeName);\r\n }\r\n }));\r\n }\r\n\r\n /\r\n Check if it can handle the error.\r\n \r\n @param response the response of CIM stream query.\r\n /\r\n public canHandleStreamFailure(response: CimStreamResponse): boolean {\r\n // access denied case.\r\n return response && response.response\r\n && response.response.statusCode === HttpStatusCode.Unauthorized;\r\n }\r\n\r\n /\r\n When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n /\r\n public handleStreamFailure(\r\n nodeName: string,\r\n options: CimStreamOptions,\r\n response: CimStreamResponse \| PowerShellStreamResponse): Observable<CimStreamOptions> {\r\n let message = response.response.error && response.response.error.message;\r\n if (!message) {\r\n const errors = response.response.errors;\r\n if (errors && errors.length > 0) {\r\n message = errors[0].message;\r\n }\r\n }\r\n const errorData: NodeAuthorizationErrorData = {\r\n statusCode: response.response.statusCode,\r\n errorCode: 'Unauthorized',\r\n errorMessage: message\r\n };\r\n return this.getNewToken(nodeName, errorData)\r\n .pipe(mergeMap(result => {\r\n const names = result.appliesTo;\r\n const isTokenForNode = !names \|\| names === nodeName \|\| (Array.isArray(names) && names[0] === nodeName);\r\n if (isTokenForNode) {\r\n const token = this.getSavedNodeToken(nodeName);\r\n if (token) {\r\n if (options) {\r\n options.authToken = token;\r\n } else {\r\n options = { authToken: token };\r\n }\r\n }\r\n\r\n return of(options);\r\n } else {\r\n return this.handleStreamFailure(nodeName, options, response);\r\n }\r\n }));\r\n }\r\n\r\n public saveJeaContext(nodeName: string, endpoint: string) {\r\n Logging.trace({\r\n view: 'sme-ui-control',\r\n instance: 'saveJeaContext',\r\n action: 'command-click',\r\n data: { message: 'Establishing session using JEA endpoint' }\r\n });\r\n this.setJeaEndpoint(nodeName, endpoint);\r\n\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setJeaContext,\r\n { nodeName: nodeName, endpoint: endpoint });\r\n }\r\n\r\n public getJeaEndpoint(nodeName: string): string {\r\n return this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()];\r\n }\r\n\r\n /\r\n Associates a node to use a specified JEA endpoint\r\n /\r\n public setJeaEndpoint(nodeName: string, endpoint: string): void {\r\n this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()] = endpoint;\r\n this.updateCache();\r\n }\r\n\r\n /\r\n Calls the authorize method and gets a new token.\r\n * If running as a child, the token comes from the parent windows service\r\n /\r\n public getNewToken(nodeName: string): Observable<AuthorizationTokenResponse>;\r\n // tslint:disable-next-line:unified-signatures\r\n public getNewToken(nodeNames: string[]): Observable<AuthorizationTokenResponse>;\r\n // tslint:disable-next-line:unified-signatures\r\n public getNewToken(nodeName: string, errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n // tslint:disable-next-line:unified-signatures\r\n public getNewToken(nodeNames: string[], errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n\r\n public getNewToken(nodeNames?: string \| string[], errorData?: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse> {\r\n // if we are already awaiting a token, then hook into the current request and try using that token\r\n if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n return this.tokenAwaiter;\r\n }\r\n\r\n // ensure input is an array only if not null.\r\n if (nodeNames && !Array.isArray(nodeNames)) {\r\n nodeNames = [nodeNames];\r\n }\r\n\r\n // define a new subject for multiple requests to wait on\r\n this.tokenAwaiter = new Subject<AuthorizationTokenResponse>();\r\n\r\n // try to forward execute getNewToken from our parent\r\n const parentExecuter = this.forwardExecute<void>(\r\n RpcRelationshipType.Parent,\r\n AuthorizationManager.rpcCommands.getNewToken,\r\n [nodeNames, errorData]);\r\n\r\n if (parentExecuter) {\r\n return this.tokenAwaiter;\r\n }\r\n\r\n // Need to clear the endpoints before we acquire a new token,\r\n // because we must try new credentials in an admin context before any fallback happens.\r\n if (nodeNames) {\r\n for (const node of <string[]>nodeNames) {\r\n this.setJeaEndpoint(node, null);\r\n }\r\n }\r\n\r\n // since we could not forward the request We must ask for the auth token ourselves\r\n this.authorize(nodeNames, errorData)\r\n .pipe(\r\n mergeMap(credentials => {\r\n if (credentials.applyToAllNodes) {\r\n this.nodeTokens = {};\r\n this.updateCache();\r\n const forward = this.forwardExecute(\r\n RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n if (forward) {\r\n return forward.pipe(map(() => credentials));\r\n }\r\n }\r\n\r\n return of(credentials);\r\n }),\r\n mergeMap(credentials => {\r\n const appliesTo = credentials.applyToAllNodes ? null : nodeNames \|\| null;\r\n return this.createSecureToken({\r\n username: credentials.username,\r\n password: credentials.password,\r\n useLaps: credentials.useLaps,\r\n lapsLocalAdminName: credentials.lapsLocalAdminName\r\n }).pipe(\r\n map(token => {\r\n return <AuthorizationTokenResponse>{\r\n token: token,\r\n appliesTo: appliesTo\r\n };\r\n }));\r\n }),\r\n // take the next 1 result and use it for our token.\r\n // We can now notify anyone waiting for auth and save the token\r\n take(1))\r\n .subscribe(\r\n result => {\r\n this.completeTokenAwaiter(result);\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, result);\r\n },\r\n error => {\r\n this.completeTokenAwaiter(null, error);\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setNodeTokenError,\r\n RpcForwarder.ensureSerializable(error));\r\n });\r\n\r\n return this.tokenAwaiter;\r\n }\r\n\r\n /\r\n @deprecated use createSecureToken() after configured gatewayJwk property.\r\n \r\n Creates a token from the given options that may be used for node authentication\r\n * @param options The token creation options\r\n /\r\n public createToken(options: CreateAuthorizationTokenOptions, passwordEncryptedWith: string = null): AuthorizationToken {\r\n // ensure a valid value for laps local admin name\r\n if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n }\r\n // ensure username has a valid value\r\n if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n options.username = null;\r\n }\r\n if (options.useLaps \|\| !options.username) {\r\n return {\r\n value: null,\r\n username: null,\r\n useLaps: options.useLaps,\r\n lapsLocalAdminName: options.lapsLocalAdminName\r\n };\r\n }\r\n\r\n // ensure password has a valid value\r\n if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n options.password = null;\r\n }\r\n\r\n let username: string[];\r\n if (options.username.indexOf('@') >= 0) {\r\n username = options.username.split('@').reverse();\r\n } else {\r\n username = options.username.split('\\\\');\r\n }\r\n\r\n const token = Net.createEncodedAuthenticationHeader(username, options.password, passwordEncryptedWith);\r\n return {\r\n value: token,\r\n username: options.username,\r\n useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n lapsLocalAdminName: null\r\n };\r\n }\r\n\r\n /\r\n Creates a secure token from the given options that may be used for node authentication\r\n \r\n @param options The token creation options\r\n /\r\n public createSecureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n const forward = this.forwardExecute<AuthorizationToken>(\r\n RpcRelationshipType.Parent,\r\n AuthorizationManager.rpcCommands.secureToken,\r\n [options]);\r\n if (forward) {\r\n return forward;\r\n } else {\r\n return this.secureToken(options);\r\n }\r\n }\r\n\r\n /\r\n Get the saved Auth token for a node.\r\n \r\n @param nodeName The nodeName to get token for.\r\n /\r\n public getSavedNodeToken(nodeName: string): AuthorizationToken {\r\n if (nodeName && this.nodeTokens[nodeName.toLocaleLowerCase()]) {\r\n return this.nodeTokens[nodeName.toLocaleLowerCase()];\r\n }\r\n\r\n return this.manageAsToken;\r\n }\r\n\r\n /\r\n Sets a token on the given nodes\r\n * @param token The token to use for the given nodes\r\n * @param nodeName The names of the nodes to set the token for. If empty or null, the token will be used as the global manageAs token\r\n * @returns an Observable indicating that the token has been set.\r\n /\r\n public setNodeTokens(token: AuthorizationToken, nodeNames?: string[]): Observable<void> {\r\n // if we have a parent instance, just forward it and return the result\r\n const forward = this.forwardExecute<void>(\r\n RpcRelationshipType.Parent,\r\n AuthorizationManager.rpcCommands.setNodeTokens,\r\n [token, nodeNames]\r\n );\r\n if (forward) {\r\n return forward;\r\n }\r\n\r\n // otherwise process the token\r\n const childSetTokenResponse: AuthorizationTokenResponse = { token: token };\r\n if (!nodeNames \|\| !Array.isArray(nodeNames) \|\| nodeNames.length === 0) {\r\n this.manageAsToken = token;\r\n } else {\r\n childSetTokenResponse.appliesTo = nodeNames;\r\n nodeNames.forEach(nodeName => this.nodeTokens[nodeName.toLocaleLowerCase()] = token);\r\n }\r\n this.updateCache();\r\n\r\n // notify all child instances of the token change.\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, childSetTokenResponse, true);\r\n\r\n // return a null observable, indicating we are done.\r\n return of(null);\r\n }\r\n\r\n /\r\n Adds a authorization header to a request given a node with a manageAsToken\r\n * @param request The request to add headers to\r\n * @param nodeName optional. The node to add headers for if not provided, the global token will be used\r\n * @param token optional. The token to use for the headers. if provided, the nodeName is not used.\r\n /\r\n public addAuthorizationRequestHeader(request: AjaxRequest, nodeName?: string, token?: AuthorizationToken) {\r\n if (!token) {\r\n token = this.getSavedNodeToken(nodeName);\r\n }\r\n\r\n if (token) {\r\n if (token.value) {\r\n\r\n // If username and password are explicitly provided, we only add the Authorization header.\r\n request.headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n } else {\r\n\r\n // If not, we add useLaps header.\r\n request.headers[headerConstants.USE_LAPS] = token.useLaps;\r\n request.headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n }\r\n }\r\n }\r\n\r\n /\r\n Create token headers.\r\n \r\n @param nodeName the node name.\r\n * @param token the token to override current setting (optional).\r\n /\r\n public createTokenHeaders(nodeName: string, token?: AuthorizationToken): MsftSme.StringMap<string> {\r\n const headers: MsftSme.StringMap<string> = {};\r\n token = token \|\| this.getSavedNodeToken(nodeName);\r\n if (token) {\r\n if (token.value) {\r\n // If username and password are explicitly provided, we only add the Authorization header.\r\n headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n } else {\r\n\r\n // If not, we add useLaps header.\r\n headers[headerConstants.USE_LAPS] = token.useLaps ? 'true' : 'false';\r\n headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n }\r\n }\r\n\r\n return headers;\r\n }\r\n\r\n /\r\n Adds a authorization header to a request given a node with a manageAsToken\r\n /\r\n public addAuthorizationTokensToMultiPartBody(body: string[], nodeName?: string, token?: AuthorizationToken) {\r\n if (!token) {\r\n token = this.getSavedNodeToken(nodeName);\r\n }\r\n\r\n if (token) {\r\n if (token.value) {\r\n // If username and password are explicitly provided, we only add the Authorization header.\r\n body.push(headerConstants.SME_AUTHORIZATION + ': ' + token.value);\r\n } else {\r\n // If not, we add useLaps header.\r\n body.push(headerConstants.USE_LAPS + ': ' + token.useLaps);\r\n body.push(headerConstants.LAPS_LOCALADMINNAME + ': ' + token.lapsLocalAdminName);\r\n }\r\n }\r\n }\r\n\r\n public resetAllTokens(): void {\r\n this.manageAsToken = null;\r\n this.nodePowershellEndpoints = {};\r\n this.nodeTokens = {};\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, null);\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n this.updateCache();\r\n }\r\n\r\n /\r\n Encrypts a string value using the jwk from the gateway\r\n /\r\n public encrypt(value: string): Observable<string> {\r\n const forward = this.forwardExecute<string>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.encrypt, [value]);\r\n if (forward) {\r\n return forward;\r\n }\r\n\r\n return Crypto.encryptRsaSha1(this.jwk, value);\r\n }\r\n\r\n /\r\n Called on a child service instance when onForwardInit returns from the parent\r\n * @param data The response from the forwardInit call\r\n /\r\n protected onForwardInitResponse(data: RpcForwardResponse<AuthorizationManagerInitProperties>): void {\r\n if (data && data.error) {\r\n // if there is an error, we cannot continue, so throw it\r\n throw data.error;\r\n }\r\n\r\n this.manageAsToken = data.result.manageAsToken;\r\n this.nodeTokens = data.result.nodeTokens;\r\n this.nodePowershellEndpoints = data.result.nodePowershellEndpoints;\r\n }\r\n\r\n /\r\n Called when a new instance of the service in another window is initialized and needs to synchronize with its parent\r\n * @param from The RpcRelationshipType that this request is from\r\n * @returns an observable for the all the values needed to initialize the service\r\n /\r\n protected onForwardInit(): Observable<AuthorizationManagerInitProperties> {\r\n // authorization manager doesn't pass any properties to child services at this time.\r\n return of(<AuthorizationManagerInitProperties>{\r\n manageAsToken: this.manageAsToken,\r\n nodeTokens: this.nodeTokens,\r\n nodePowershellEndpoints: this.nodePowershellEndpoints\r\n });\r\n }\r\n\r\n /\r\n Called when the forwarded services counterpart wants to get data from the parent\r\n * @param from The RpcRelationshipType that this request is from\r\n * @param name The name of the method to forward to\r\n * @param args The arguments of the method\r\n * @returns an observable for the result of the method call\r\n /\r\n protected onForwardExecute(from: RpcRelationshipType, name: string, args: any[]): Observable<any> {\r\n // command comes from child\r\n if (from === RpcRelationshipType.Child) {\r\n switch (name) {\r\n case AuthorizationManager.rpcCommands.getNewToken: {\r\n // start getting the new token, but return immediately to avoid timeout\r\n const subscription = this.getNewToken(args ? args[0] : null, args ? args[1] : null)\r\n .subscribe(\r\n result => subscription.unsubscribe(),\r\n error => {\r\n subscription.unsubscribe();\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setNodeTokenError,\r\n RpcForwarder.ensureSerializable(error));\r\n });\r\n return of(null);\r\n }\r\n case AuthorizationManager.rpcCommands.secureToken: {\r\n const options = args && args[0];\r\n if (!options) {\r\n return of(null);\r\n }\r\n\r\n return this.secureToken(options);\r\n }\r\n case AuthorizationManager.rpcCommands.encrypt: {\r\n const options = args && args[0];\r\n if (!options) {\r\n return of(null);\r\n }\r\n\r\n return this.encrypt(options);\r\n }\r\n case AuthorizationManager.rpcCommands.setNodeTokens: {\r\n const token = args && args[0];\r\n const nodes = args && args[1];\r\n if (!token) {\r\n return of(null);\r\n }\r\n\r\n return this.setNodeTokens(token, nodes);\r\n }\r\n }\r\n }\r\n\r\n // command comes from parent\r\n if (from === RpcRelationshipType.Parent) {\r\n if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {\r\n this.nodeTokens = {};\r\n this.nodePowershellEndpoints = {};\r\n // if we also have children, forward the request on\r\n const forward = this.forwardExecute(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, args);\r\n return forward \|\| of(null);\r\n }\r\n }\r\n\r\n // command not implemented\r\n return this.nameNotFound(name);\r\n }\r\n\r\n /\r\n Called when the forwarded services counterpart sends a notify message\r\n * @param from The RpcRelationshipType that this request is from\r\n * @param name The name of the property to change\r\n * @param value The new value of the property\r\n * @returns an observable that completes when the property has been changed.\r\n /\r\n protected onForwardNotify(from: RpcRelationshipType, name: string, value: any): Observable<void> {\r\n // allow our parent to give us a new token.\r\n if (from === RpcRelationshipType.Parent) {\r\n if (name === AuthorizationManager.rpcCommands.manageAsToken) {\r\n this.manageAsToken = value;\r\n // if we also have children, forward the notification on\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, value);\r\n return forward \|\| of(null);\r\n }\r\n\r\n if (name === AuthorizationManager.rpcCommands.setNodeToken) {\r\n if (!value) {\r\n const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n return throwError(message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n }\r\n\r\n this.completeTokenAwaiter(value);\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, value);\r\n return forward \|\| of(null);\r\n }\r\n\r\n if (name === AuthorizationManager.rpcCommands.setNodeTokenError) {\r\n if (!value) {\r\n const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n return throwError(message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n }\r\n\r\n this.completeTokenAwaiter(null, value);\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, value);\r\n return forward \|\| of(null);\r\n }\r\n\r\n if (name === AuthorizationManager.rpcCommands.setJeaContext) {\r\n if (!value) {\r\n const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n return throwError(message.format(AuthorizationManager.rpcCommands.setJeaContext));\r\n }\r\n\r\n this.saveJeaContext(value.nodeName, value.endpoint);\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setJeaContext, value);\r\n return forward \|\| of(null);\r\n }\r\n }\r\n\r\n return this.nameNotFound(name);\r\n }\r\n\r\n /\r\n Creates a secure token from the given options that may be used for node authentication\r\n \r\n @param options The token creation options\r\n /\r\n private secureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n // ensure a valid value for laps local admin name\r\n if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n }\r\n\r\n // ensure username has a valid value\r\n if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n options.username = null;\r\n }\r\n\r\n if (options.useLaps \|\| !options.username) {\r\n return of({\r\n value: null,\r\n username: null,\r\n useLaps: options.useLaps,\r\n lapsLocalAdminName: options.lapsLocalAdminName\r\n });\r\n }\r\n\r\n // ensure password has a valid value\r\n if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n options.password = null;\r\n }\r\n\r\n let username: string[];\r\n if (options.username.indexOf('@') >= 0) {\r\n username = options.username.split('@').reverse();\r\n } else {\r\n username = options.username.split('\\\\');\r\n }\r\n\r\n const tokenData = {\r\n value: undefined,\r\n username: options.username,\r\n useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n lapsLocalAdminName: null\r\n };\r\n\r\n if (this.jwk) {\r\n return Net.createEncryptedAuthenticationHeader(this.jwk, username, options.password)\r\n .pipe(map(newToken => {\r\n tokenData.value = newToken;\r\n return tokenData;\r\n }));\r\n }\r\n\r\n tokenData.value = Net.createEncodedAuthenticationHeader(username, options.password);\r\n return of(tokenData);\r\n }\r\n\r\n /\r\n Completes the token awaiter\r\n /\r\n private completeTokenAwaiter(result: AuthorizationTokenResponse, error?: any) {\r\n if (error) {\r\n if (this.tokenAwaiter) {\r\n const awaiter = this.tokenAwaiter;\r\n this.tokenAwaiter = null;\r\n awaiter.error(error);\r\n }\r\n } else {\r\n if (!result.appliesTo) {\r\n this.manageAsToken = result.token;\r\n } else if (Array.isArray(result.appliesTo)) {\r\n result.appliesTo.forEach(nodeName => {\r\n this.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;\r\n });\r\n this.updateCache();\r\n } else {\r\n this.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;\r\n this.updateCache();\r\n }\r\n\r\n if (this.tokenAwaiter) {\r\n const awaiter = this.tokenAwaiter;\r\n this.tokenAwaiter = null;\r\n awaiter.next(result);\r\n awaiter.complete();\r\n }\r\n }\r\n }\r\n\r\n /\r\n Gets the error data.\r\n * @param code the http status code.\r\n * @param error the AJAX error object.\r\n /\r\n private getErrorData(code: HttpStatusCode, error: AjaxError): NodeAuthorizationErrorData {\r\n return {\r\n statusCode: code,\r\n errorCode: error && error.xhr && error.xhr.response && error.xhr.response.error && error.xhr.response.error.code,\r\n errorMessage: Net.getErrorMessage(error)\r\n };\r\n }\r\n\r\n /\r\n Updates the authorization cache. Does nothing if we are not running in shell\r\n */\r\n private updateCache(): void {\r\n if (!MsftSme.isShell()) {\r\n // ignore if not shell\r\n return;\r\n }\r\n // update cached data\r\n const cacheData: AuthorizationCacheData = {\r\n jwk: this.jwk,\r\n manageAsToken: this.manageAsToken,\r\n nodePowershellEndpoints: this.nodePowershellEndpoints,\r\n nodeTokens: this.nodeTokens\r\n };\r\n sessionStorage.setItem(AuthorizationManager.cacheKey, JSON.stringify(cacheData));\r\n }\r\n}\r\n"]}
1	+ {"version":3,"sources":["../../../packages/core/security/authorization-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3D,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAKjD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAA0B,aAAa,EAA2C,MAAM,mBAAmB,CAAC;AA6EnH;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAgKzD;;;;OAIG;IACH,YAAoB,SAAmC,EAAE,GAAQ;QAC7D,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QADpB,cAAS,GAAT,SAAS,CAA0B;QAEnD,IAAI,CAAC,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,CAAC;QAEtE,IAAI,CAAC,kCAAkC,GAAG,IAAI,OAAO,EAAU,CAAC;QAChE,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC,kCAAkC,CAAC,YAAY,EAAE,CAAC;QAE1F,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE;YACnB,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE;gBAC/C,IAAI;oBACA,MAAM,UAAU,GAA2B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACxE,iCAAiC;oBACjC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC;oBAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC;oBACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC9C,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,IAAI,EAAE,CAAC;oBACxE,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;iBACzC;gBAAC,OAAO,KAAK,EAAE;oBACZ,cAAc,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;iBAC5D;aACJ;SACJ;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5E,CAAC;IApID;;;OAGG;IACH,IAAW,kBAAkB,CAAC,kBAA0B;QACpD,IAAI,CAAC,6BAA6B,GAAG,kBAAkB,CAAC;QACxD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAOD;;OAEG;IACH,IAAW,cAAc,CAAC,QAAgB;QACtC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAiBD;;;OAGG;IACH,IAAW,aAAa,CAAC,KAAyB;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACrG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAW,aAAa;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAW,UAAU,CAAC,GAAW;QAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE;YAClB,IAAI,CAAC,cAAc,EAAE,CAAC;SACzB;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAYD;;OAEG;IACH,IAAW,UAAU;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,IAAW,WAAW;QAClB,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChD,0BAA0B;YAC1B,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,0BAA0B;QAC1B,OAAO,EAAE,CAA6B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1F,CAAC;IAsCD;;OAEG;IACI,oBAAoB,CAAC,IAAoB,EAAE,KAAgB;QAC9D,kIAAkI;QAClI,OAAO,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,iBAAiB,CACpB,IAAoB,EACpB,OAAoB,EACpB,KAAgB,EAChB,QAAiB;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACtB,+FAA+F;YAC/F,4DAA4D;YAC5D,oDAAoD;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;YACjC,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE;gBAChB,8CAA8C;gBAC9C,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;aACtB;iBAAM;gBACH,mDAAmD;gBACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;aACjE;QACL,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,QAA2B;QACrD,sBAAsB;QACtB,OAAO,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,2BAAgC,CAAC;IACzG,CAAC;IAED;;OAEG;IACI,mBAAmB,CACtB,QAAgB,EAChB,OAAyB,EACzB,QAAsD;QACtD,IAAI,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE;YACV,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC7B,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;aAC/B;SACJ;QACD,MAAM,SAAS,GAA+B;YAC1C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;YACxC,SAAS,EAAE,cAAc;YACzB,YAAY,EAAE,OAAO;SACxB,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/B,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,KAAK,EAAE;oBACP,IAAI,OAAO,EAAE;wBACT,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;qBAC7B;yBAAM;wBACH,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;qBAClC;iBACJ;gBAED,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;aACtB;iBAAM;gBACH,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;aAChE;QACL,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAEM,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,OAAO,CAAC,KAAK,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAC9C,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,cAAc,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,QAAQ,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAcM,WAAW,CAAC,SAA6B,EAAE,SAAsC;QACpF,kGAAkG;QAClG,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAChD,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,6CAA6C;QAC7C,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YACxC,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;SAC3B;QAED,wDAAwD;QACxD,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,EAA8B,CAAC;QAE9D,qDAAqD;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,iBAEtC,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAC5C,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5B,IAAI,cAAc,EAAE;YAChB,OAAO,IAAI,CAAC,YAAY,CAAC;SAC5B;QAED,6DAA6D;QAC7D,uFAAuF;QACvF,IAAI,SAAS,EAAE;YACX,KAAK,MAAM,IAAI,IAAc,SAAS,EAAE;gBACpC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACnC;SACJ;QAED,kFAAkF;QAClF,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;aAC/B,IAAI,CACD,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,IAAI,WAAW,CAAC,eAAe,EAAE;gBAC7B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,gBACJ,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE;oBACT,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;iBAC/C;aACJ;YAED,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC,CAAC,EACF,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;YACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;aACrD,CAAC,CAAC,IAAI,CACH,GAAG,CAAC,KAAK,CAAC,EAAE;gBACR,OAAmC;oBAC/B,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,SAAS;iBACvB,CAAC;YACN,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC;QACF,mDAAmD;QACnD,+DAA+D;QAC/D,IAAI,CAAC,CAAC,CAAC,CAAC;aACX,SAAS,CACN,MAAM,CAAC,EAAE;YACL,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzG,CAAC,EACD,KAAK,CAAC,EAAE;YACJ,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAClD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAEM,kBAAkB;QACrB,kGAAkG;QAClG,IAAI,IAAI,CAAC,kBAAkB,EAAE;YACzB,OAAO,IAAI,CAAC,kBAAkB,CAAC;SAClC;QAED,wDAAwD;QACxD,IAAI,CAAC,kBAAkB,GAAG,IAAI,OAAO,EAAuB,CAAC;QAE7D,yDAAyD;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,iBAEtC,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAC/C,CAAC,GAAG,CAAC,CAAC,CAAC;QAEX,IAAI,cAAc,EAAE;YAChB,OAAO,IAAI,CAAC,kBAAkB,CAAC;SAClC;QAED,oFAAoF;QACpF,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE;aACpC,SAAS,CACN,QAAQ,CAAC,EAAE;YACP,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAC/C,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,CAAC,EACD,KAAK,CAAC,EAAE;YACJ,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EACpD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEX,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACnC,CAAC;IAED;;OAEG;IACI,kBAAkB;QACrB,MAAM,IAAI,GAAwB,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAG,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC;QAC1G,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACzG,CAAC;IAED;;;;;OAKG;IACI,WAAW,CAAC,OAAwC,EAAE,wBAAgC,IAAI;QAC7F,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;YACxD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;SAC/E;QACD,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,OAAO;gBACH,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC;SACL;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;SACpD;aAAM;YACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACvG,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,IAAI;SAC3B,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,OAAwC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAE/B,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAC5C,CAAC,OAAO,CAAC,CAAC,CAAC;QACf,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;aAAM;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SACpC;IACL,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,QAAgB;QACrC,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE;YAC3D,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;SACxD;QAED,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,KAAyB,EAAE,SAAoB;QAChE,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAE/B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAC9C,CAAC,KAAK,EAAE,SAAS,CAAC,CACrB,CAAC;QACF,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;QAED,8BAA8B;QAC9B,MAAM,qBAAqB,GAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;YACnE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;SAC9B;aAAM;YACH,qBAAqB,CAAC,SAAS,GAAG,SAAS,CAAC;YAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;SACxF;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,kDAAkD;QAClD,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAE1H,oDAAoD;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAoB,EAAE,QAAiB,EAAE,KAA0B;QACpG,IAAI,CAAC,KAAK,EAAE;YACR,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBAEb,0FAA0F;gBAC1F,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;aACpE;iBAAM;gBAEH,iCAAiC;gBACjC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aACnF;SACJ;IACL,CAAC;IAED;;;;;OAKG;IACI,kBAAkB,CAAC,QAAgB,EAAE,KAA0B;QAClE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBACb,0FAA0F;gBAC1F,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;aAC5D;iBAAM;gBAEH,iCAAiC;gBACjC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrE,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aAC3E;SACJ;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACI,qCAAqC,CAAC,IAAc,EAAE,QAAiB,EAAE,KAA0B;QACtG,IAAI,CAAC,KAAK,EAAE;YACR,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,KAAK,EAAE;gBACb,0FAA0F;gBAC1F,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;aACrE;iBAAM;gBACH,iCAAiC;gBACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,GAAG,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;aACpF;SACJ;IACL,CAAC;IAEM,cAAc;QACjB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,iBAAqC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3H,IAAI,OAAO,EAAE;YACT,OAAO,OAAO,CAAC;SAClB;QAED,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACO,qBAAqB,CAAC,IAA4D;QACxF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;YACpB,wDAAwD;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC;SACpB;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;QACnE,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACO,aAAa;QACnB,oFAAoF;QACpF,OAAO,EAAE,CAAqC;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB;SACzD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACO,gBAAgB,CAAC,IAAyB,EAAE,IAAY,EAAE,IAAW;QAC3E,2BAA2B;QAC3B,IAAI,IAAI,kBAA8B,EAAE;YACpC,QAAQ,IAAI,EAAE;gBACV,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBAC/C,uEAAuE;oBACvE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;yBAC9E,SAAS,CACN,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EACpC,KAAK,CAAC,EAAE;wBACJ,YAAY,CAAC,WAAW,EAAE,CAAC;wBAC3B,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAClD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAChD,CAAC,CAAC,CAAC;oBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;iBACnB;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBAC/C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE;wBACV,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;iBACpC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC3C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE;wBACV,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;iBAChC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,CAAC,KAAK,EAAE;wBACR,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;qBACnB;oBAED,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;iBAC3C;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;oBAClD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE;yBACzC,SAAS,CACN,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EAChC,KAAK,CAAC,EAAE;wBACJ,YAAY,CAAC,WAAW,EAAE;4BAC1B,IAAI,CAAC,aAAa,gBAEd,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EACpD,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACzC,CAAC;oBACN,CAAC,CAAC,CAAC;oBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;iBACnB;aACJ;SACJ;QAED,4BAA4B;QAC5B,IAAI,IAAI,mBAA+B,EAAE;YACrC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE;gBAC3D,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAClC,mDAAmD;gBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACvH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;SACJ;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACO,eAAe,CAAC,IAAyB,EAAE,IAAY,EAAE,KAAU;QACzE,2CAA2C;QAC3C,IAAI,IAAI,mBAA+B,EAAE;YACrC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE;gBACzD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE;gBACxD,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;iBACpF;gBAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACpH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE;gBAC7D,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;iBACzF;gBAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACzH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE;gBACzD,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;iBACrF;gBAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE;gBAC1D,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;iBACpF;gBAED,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;gBACtH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE;gBAC/D,IAAI,CAAC,KAAK,EAAE;oBACR,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;iBACzF;gBAED,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,gBAA4B,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBAC3H,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;aAC9B;SACJ;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,OAAwC;QACxD,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;YACxD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;SAC/E;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,OAAO,EAAE,CAAC;gBACN,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC,CAAC;SACN;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;SAC3B;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;SACpD;aAAM;YACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C;QAED,MAAM,SAAS,GAAG;YACd,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,IAAI;SAC3B,CAAC;QAEF,IAAI,IAAI,CAAC,GAAG,EAAE;YACV,OAAO,GAAG,CAAC,mCAAmC,CAC1C,IAAI,CAAC,GAAG,EACR,QAAQ,EACR,OAAO,CAAC,QAAQ,EAChB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,6BAA6B,CACrC;iBACI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACjB,SAAS,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC;SACX;QAED,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,MAAkC,EAAE,KAAW;QACxE,IAAI,KAAK,EAAE;YACP,IAAI,IAAI,CAAC,YAAY,EAAE;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aACxB;SACJ;aAAM;YACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBACnB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;aACrC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;gBACxC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;oBAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACjE,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,EAAE,CAAC;aACtB;iBAAM;gBACH,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACrE,IAAI,CAAC,WAAW,EAAE,CAAC;aACtB;YAED,IAAI,IAAI,CAAC,YAAY,EAAE;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;aACtB;SACJ;IACL,CAAC;IAED;;OAEG;IACM,0BAA0B,CAAC,MAA2B,EAAE,KAAW;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,OAAO,EAAE;YACT,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;SAClC;QAED,IAAI,KAAK,EAAE;YACP,IAAI,OAAO,EAAE;gBACT,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aACxB;YAED,OAAO;SACV;QAED,IAAI,MAAM,CAAC,KAAK,EAAE;YACd,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,MAAM,CAAC,KAAK,CAAC;SAC5D;aAAM;YACH,OAAO,CAAC,QAAQ,CAAC,4BAA4B,EAAE,wBAAwB,CAAC,CAAC;SAC5E;QAED,IAAI,OAAO,EAAE;YACT,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;SACtB;IACL,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,IAAoB,EAAE,KAAgB;QACvD,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;YAChH,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;SAC3C,CAAC;IACN,CAAC;IAED;;OAEG;IACK,WAAW;QACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE;YACpB,sBAAsB;YACtB,OAAO;SACV;QACD,qBAAqB;QACrB,MAAM,SAAS,GAA2B;YACtC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC9B,CAAC;QACF,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;;AA99BD;;GAEG;AACY,6BAAQ,GAAG,+BAA+B,CAAC;AAE1D;;GAEG;AACW,8CAAyB,GAAG,eAAe,CAAC;AAE3C,gCAAW,GAAG;IACzB,YAAY,EAAE,cAAc;IAC5B,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,mBAAmB,EAAE,qBAAqB;CAC7C,CAAC","file":"authorization-manager.js","sourcesContent":["\r\nimport { Observable, of, Subject, throwError } from 'rxjs';\r\nimport { AjaxError, AjaxRequest } from 'rxjs/ajax';\r\nimport { map, mergeMap, take } from 'rxjs/operators';\r\nimport { CimStreamOptions, CimStreamResponse } from '../data/cim-stream';\r\nimport { Crypto } from '../data/crypto';\r\nimport { headerConstants, HttpStatusCode } from '../data/http-constants';\r\nimport { Net } from '../data/net';\r\nimport { PowerShellStreamResponse } from '../data/powershell-stream';\r\nimport { Logging } from '../diagnostics/logging';\r\nimport { Strings } from '../generated/strings';\r\nimport { RpcForwardResponse } from '../rpc/forward/rpc-forward-model';\r\nimport { Rpc } from '../rpc/rpc';\r\nimport { RpcRelationshipType } from '../rpc/rpc-base';\r\nimport { RpcForwarder, RpcServiceForwarder } from '../rpc/rpc-forwarder';\r\nimport { SignedHttpRequestToken, SignOnManager, SignOnTokenRefresh, SignOnTokenResponse } from './sign-on-manager';\r\n\r\n/*\r\n Defines the response from an Authorization Handler\r\n /\r\nexport interface AuthorizationCredentials {\r\n username: string;\r\n password: string;\r\n applyToAllNodes?: boolean;\r\n useLaps?: boolean;\r\n lapsLocalAdminName?: string;\r\n}\r\n\r\n/\r\n Defines the response the AuthorizationManager returns from getToken\r\n /\r\nexport interface AuthorizationTokenResponse {\r\n token: AuthorizationToken;\r\n appliesTo?: string \| string[];\r\n}\r\n\r\n/\r\n Defines an authorizationToken\r\n /\r\nexport interface AuthorizationToken {\r\n value: string;\r\n username: string;\r\n useLaps: boolean;\r\n lapsLocalAdminName: string;\r\n}\r\n\r\n/\r\n The create authorization token options\r\n /\r\nexport interface CreateAuthorizationTokenOptions {\r\n password?: string;\r\n username?: string;\r\n useLaps?: boolean;\r\n lapsLocalAdminName?: string;\r\n}\r\n\r\n/\r\n The extra error data of original cause.\r\n /\r\nexport interface NodeAuthorizationErrorData {\r\n statusCode: HttpStatusCode;\r\n errorCode: string;\r\n errorMessage: string;\r\n}\r\n\r\n/\r\n Defines a handler that takes a nodeName and returns authorization credentials\r\n /\r\nexport type NodeAuthorizationHandler =\r\n (nodeName?: string \| string[], errorData?: NodeAuthorizationErrorData) => Observable<AuthorizationCredentials>;\r\n\r\n/\r\n Defines properties that will be provided to child instances on a forward init request\r\n /\r\nexport interface AuthorizationManagerInitProperties {\r\n manageAsToken: AuthorizationToken;\r\n nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n signOnToken: SignedHttpRequestToken;\r\n}\r\n\r\n/\r\n Representation of authorization cache data structure\r\n /\r\ninterface AuthorizationCacheData {\r\n jwk?: string;\r\n nodeTokens?: MsftSme.StringMap<AuthorizationToken>;\r\n manageAsToken?: AuthorizationToken;\r\n nodePowershellEndpoints?: MsftSme.StringMap<string>;\r\n logOnUser?: string;\r\n}\r\n\r\n/\r\n Authorization Manager class. Handles SME authentication for service requests.\r\n /\r\nexport class AuthorizationManager extends RpcServiceForwarder {\r\n\r\n /\r\n Cache key for session storage of authorization cache\r\n /\r\n private static cacheKey = 'AuthorizationManager.cache.v1';\r\n\r\n /\r\n If no laps local admin name is defined, it will default to 'administrator'\r\n /\r\n public static defaultLapsLocalAdminName = 'administrator';\r\n\r\n private static rpcCommands = {\r\n setNodeToken: 'setNodeToken',\r\n setNodeTokens: 'setNodeTokens',\r\n manageAsToken: 'manageAsToken',\r\n setNodeTokenError: 'setNodeTokenError',\r\n setJeaContext: 'setJeaContext',\r\n clearNodeTokens: 'clearNodeTokens',\r\n getNewToken: 'getNewToken',\r\n secureToken: 'secureToken',\r\n encrypt: 'encrypt',\r\n getSignOnToken: 'getSignOnToken',\r\n setSignOnToken: 'setSignOnToken',\r\n setSignOnTokenError: 'setSignOnTokenError'\r\n };\r\n\r\n /\r\n Create a map of nodeNames to token objects to hold node specific tokens.\r\n /\r\n public nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n\r\n /\r\n The sign on operation manager.\r\n /\r\n public signOnManager: SignOnManager;\r\n\r\n /\r\n The backing store fro the manageAsToken\r\n /\r\n private token: AuthorizationToken;\r\n\r\n /\r\n The JSON Web Key. Single string with JSON.stringify format.\r\n /\r\n private jwk: string;\r\n\r\n /\r\n Credentials expiration time, used to determine the lifetime of new tokens. Value in milliseconds.\r\n /\r\n private credentialsExpirationTimeInMs: number;\r\n\r\n /\r\n Underlying implementation subject for credentialExpiration observable\r\n /\r\n private credentialExpirationChangedSubject: Subject<number>;\r\n\r\n /\r\n Observable that emits whenever the credentials expiration has changed\r\n /\r\n public credentialExpirationChanged: Observable<number>;\r\n\r\n /\r\n Set the admin configured expiration time in milliseconds\r\n * If this is not set it will be defaulted to 365 days.\r\n /\r\n public set authExpirationInMs(expirationTimeInMs: number) {\r\n this.credentialsExpirationTimeInMs = expirationTimeInMs;\r\n this.credentialExpirationChangedSubject.next(expirationTimeInMs);\r\n }\r\n\r\n /\r\n The logon user returned by gateway's api/user\r\n /\r\n private logOnUser: string;\r\n\r\n /\r\n Sets logon user and caches the value\r\n /\r\n public set shellLogOnUser(username: string) {\r\n this.logOnUser = username;\r\n this.updateCache();\r\n }\r\n\r\n /\r\n The mapping of connections to PowershellEndpoints\r\n /\r\n private nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n\r\n /\r\n The token awaiter subject.\r\n /\r\n private tokenAwaiter: Subject<AuthorizationTokenResponse>;\r\n\r\n /\r\n The subject observable of sign on token awaiter.\r\n /\r\n private signOnTokenAwaiter: Subject<SignOnTokenResponse>;\r\n\r\n /\r\n Sets the current manage as token\r\n * If running with an Rpc child, notify of the change\r\n /\r\n public set manageAsToken(token: AuthorizationToken) {\r\n this.token = token;\r\n this.nodePowershellEndpoints = {};\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, token);\r\n this.updateCache();\r\n }\r\n\r\n /\r\n Gets the current manage as token\r\n /\r\n public get manageAsToken(): AuthorizationToken {\r\n return this.token;\r\n }\r\n\r\n /\r\n Sets the gateway encryption certificate JWK.\r\n * If this is not set by Shell/Add-Connection, it will send clear text password.\r\n /\r\n public set gatewayJwk(jwk: string) {\r\n if (this.jwk !== jwk) {\r\n this.resetAllTokens();\r\n }\r\n this.jwk = jwk;\r\n this.gatewayJwkChangedSubject.next(jwk);\r\n this.updateCache();\r\n }\r\n\r\n /\r\n Observable that emits whenever the gateways Jwk has changed\r\n /\r\n public readonly gatewayJwkChanged: Observable<string>;\r\n\r\n /\r\n Underlying implementation subject for gatewayJwkChanged observable\r\n /\r\n private gatewayJwkChangedSubject: Subject<string>;\r\n\r\n /\r\n Gets the gateway encryption certificate JWK.\r\n /\r\n public get gatewayJwk() {\r\n return this.jwk;\r\n }\r\n\r\n /\r\n Gets an observable the emits when the authorization token is ready\r\n /\r\n public get authAwaiter() {\r\n if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n // return the global token\r\n return this.tokenAwaiter;\r\n }\r\n\r\n // return the global token\r\n return of(<AuthorizationTokenResponse>{ appliesTo: null, token: this.manageAsToken });\r\n }\r\n\r\n /\r\n Initializes a new instance of the Authorization Manager class\r\n * @param authorize An AuthorizationHandler with which to retrieve user credentials\r\n * @param rpc The rpc to forward auth requests to a parent window\r\n /\r\n constructor(private authorize: NodeAuthorizationHandler, rpc: Rpc) {\r\n super('authorization-manager', rpc);\r\n this.gatewayJwkChangedSubject = new Subject<string>();\r\n this.gatewayJwkChanged = this.gatewayJwkChangedSubject.asObservable();\r\n\r\n this.credentialExpirationChangedSubject = new Subject<number>();\r\n this.credentialExpirationChanged = this.credentialExpirationChangedSubject.asObservable();\r\n\r\n this.nodeTokens = {};\r\n this.nodePowershellEndpoints = {};\r\n if (MsftSme.isShell()) {\r\n // attempt to restore from storage if this is a shell instance\r\n const cachedDataString = sessionStorage.getItem(AuthorizationManager.cacheKey);\r\n if (!MsftSme.isNullOrWhiteSpace(cachedDataString)) {\r\n try {\r\n const cachedData: AuthorizationCacheData = JSON.parse(cachedDataString);\r\n // verify data and set properties\r\n this.jwk = cachedData.jwk \|\| null;\r\n this.manageAsToken = cachedData.manageAsToken \|\| null;\r\n this.nodeTokens = cachedData.nodeTokens \|\| {};\r\n this.nodePowershellEndpoints = cachedData.nodePowershellEndpoints \|\| {};\r\n this.logOnUser = cachedData.logOnUser;\r\n } catch (error) {\r\n sessionStorage.removeItem(AuthorizationManager.cacheKey);\r\n }\r\n }\r\n }\r\n\r\n this.signOnManager = new SignOnManager(() => this.refreshSignOnToken());\r\n }\r\n\r\n /\r\n defines the conditions under which the AuthorizationManager can handle an ajax error\r\n /\r\n public canHandleAjaxFailure(code: HttpStatusCode, error: AjaxError) {\r\n // we can handle ajax errors if we have a getter defined, and the code is Unauthorized (401) or we get a cim authorization failure\r\n return this.authorize && Net.isUnauthorized(error);\r\n }\r\n\r\n /\r\n When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n /\r\n public handleAjaxFailure(\r\n code: HttpStatusCode,\r\n request: AjaxRequest,\r\n error: AjaxError,\r\n nodeName?: string): Observable<AjaxRequest> {\r\n const errorData = this.getErrorData(code, error);\r\n\r\n return this.getNewToken(nodeName, errorData)\r\n .pipe(mergeMap(response => {\r\n // There may be multiple nodes requesting authentication, but we can only ask the user for one.\r\n // check if the result if for our node, otherwise try again.\r\n // It looks for inside of array only for first name.\r\n const names = response.appliesTo;\r\n const isTokenForNode = !names \|\| names === nodeName \|\| (Array.isArray(names) && names[0] === nodeName);\r\n if (isTokenForNode) {\r\n // this token applies to our node, so continue\r\n this.addAuthorizationRequestHeader(request, nodeName);\r\n return of(request);\r\n } else {\r\n // this token did not apply to our node. Ask again.\r\n return this.handleAjaxFailure(code, request, error, nodeName);\r\n }\r\n }));\r\n }\r\n\r\n /\r\n Check if it can handle the error.\r\n \r\n @param response the response of CIM stream query.\r\n /\r\n public canHandleStreamFailure(response: CimStreamResponse): boolean {\r\n // access denied case.\r\n return response && response.response && response.response.statusCode === HttpStatusCode.Unauthorized;\r\n }\r\n\r\n /\r\n When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n /\r\n public handleStreamFailure(\r\n nodeName: string,\r\n options: CimStreamOptions,\r\n response: CimStreamResponse \| PowerShellStreamResponse): Observable<CimStreamOptions> {\r\n let message = response.response.error && response.response.error.message;\r\n if (!message) {\r\n const errors = response.response.errors;\r\n if (errors && errors.length > 0) {\r\n message = errors[0].message;\r\n }\r\n }\r\n const errorData: NodeAuthorizationErrorData = {\r\n statusCode: response.response.statusCode,\r\n errorCode: 'Unauthorized',\r\n errorMessage: message\r\n };\r\n return this.getNewToken(nodeName, errorData)\r\n .pipe(mergeMap(result => {\r\n const names = result.appliesTo;\r\n const isTokenForNode = !names \|\| names === nodeName \|\| (Array.isArray(names) && names[0] === nodeName);\r\n if (isTokenForNode) {\r\n const token = this.getSavedNodeToken(nodeName);\r\n if (token) {\r\n if (options) {\r\n options.authToken = token;\r\n } else {\r\n options = { authToken: token };\r\n }\r\n }\r\n\r\n return of(options);\r\n } else {\r\n return this.handleStreamFailure(nodeName, options, response);\r\n }\r\n }));\r\n }\r\n\r\n public saveJeaContext(nodeName: string, endpoint: string) {\r\n Logging.trace({\r\n view: 'sme-ui-control',\r\n instance: 'saveJeaContext',\r\n action: 'command-click',\r\n data: { message: 'Establishing session using JEA endpoint' }\r\n });\r\n this.setJeaEndpoint(nodeName, endpoint);\r\n\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setJeaContext,\r\n { nodeName: nodeName, endpoint: endpoint });\r\n }\r\n\r\n public getJeaEndpoint(nodeName: string): string {\r\n return this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()];\r\n }\r\n\r\n /\r\n Associates a node to use a specified JEA endpoint\r\n /\r\n public setJeaEndpoint(nodeName: string, endpoint: string): void {\r\n this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()] = endpoint;\r\n this.updateCache();\r\n }\r\n\r\n /\r\n Calls the authorize method and gets a new token.\r\n * If running as a child, the token comes from the parent windows service\r\n /\r\n public getNewToken(nodeName: string): Observable<AuthorizationTokenResponse>;\r\n // tslint:disable-next-line:unified-signatures\r\n public getNewToken(nodeNames: string[]): Observable<AuthorizationTokenResponse>;\r\n // tslint:disable-next-line:unified-signatures\r\n public getNewToken(nodeName: string, errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n // tslint:disable-next-line:unified-signatures\r\n public getNewToken(nodeNames: string[], errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n\r\n public getNewToken(nodeNames?: string \| string[], errorData?: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse> {\r\n // if we are already awaiting a token, then hook into the current request and try using that token\r\n if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n return this.tokenAwaiter;\r\n }\r\n\r\n // ensure input is an array only if not null.\r\n if (nodeNames && !Array.isArray(nodeNames)) {\r\n nodeNames = [nodeNames];\r\n }\r\n\r\n // define a new subject for multiple requests to wait on\r\n this.tokenAwaiter = new Subject<AuthorizationTokenResponse>();\r\n\r\n // try to forward execute getNewToken from our parent\r\n const parentExecuter = this.forwardExecute<void>(\r\n RpcRelationshipType.Parent,\r\n AuthorizationManager.rpcCommands.getNewToken,\r\n [nodeNames, errorData]);\r\n\r\n if (parentExecuter) {\r\n return this.tokenAwaiter;\r\n }\r\n\r\n // Need to clear the endpoints before we acquire a new token,\r\n // because we must try new credentials in an admin context before any fallback happens.\r\n if (nodeNames) {\r\n for (const node of <string[]>nodeNames) {\r\n this.setJeaEndpoint(node, null);\r\n }\r\n }\r\n\r\n // since we could not forward the request We must ask for the auth token ourselves\r\n this.authorize(nodeNames, errorData)\r\n .pipe(\r\n mergeMap(credentials => {\r\n if (credentials.applyToAllNodes) {\r\n this.nodeTokens = {};\r\n this.updateCache();\r\n const forward = this.forwardExecute(\r\n RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n if (forward) {\r\n return forward.pipe(map(() => credentials));\r\n }\r\n }\r\n\r\n return of(credentials);\r\n }),\r\n mergeMap(credentials => {\r\n const appliesTo = credentials.applyToAllNodes ? null : nodeNames \|\| null;\r\n return this.createSecureToken({\r\n username: credentials.username,\r\n password: credentials.password,\r\n useLaps: credentials.useLaps,\r\n lapsLocalAdminName: credentials.lapsLocalAdminName\r\n }).pipe(\r\n map(token => {\r\n return <AuthorizationTokenResponse>{\r\n token: token,\r\n appliesTo: appliesTo\r\n };\r\n }));\r\n }),\r\n // take the next 1 result and use it for our token.\r\n // We can now notify anyone waiting for auth and save the token\r\n take(1))\r\n .subscribe(\r\n result => {\r\n this.completeTokenAwaiter(result);\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, result);\r\n },\r\n error => {\r\n this.completeTokenAwaiter(null, error);\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setNodeTokenError,\r\n RpcForwarder.ensureSerializable(error));\r\n });\r\n\r\n return this.tokenAwaiter;\r\n }\r\n\r\n public refreshSignOnToken(): Observable<SignOnTokenResponse> {\r\n // if we are already awaiting a token, then hook into the current request and try using that token\r\n if (this.signOnTokenAwaiter) {\r\n return this.signOnTokenAwaiter;\r\n }\r\n\r\n // define a new subject for multiple requests to wait on\r\n this.signOnTokenAwaiter = new Subject<SignOnTokenResponse>();\r\n\r\n // try to forward execute getSignOnToken from our parent.\r\n const now = Date.now();\r\n const parentExecuter = this.forwardExecute<SignOnTokenRefresh>(\r\n RpcRelationshipType.Parent,\r\n AuthorizationManager.rpcCommands.getSignOnToken,\r\n [now]);\r\n\r\n if (parentExecuter) {\r\n return this.signOnTokenAwaiter;\r\n }\r\n\r\n // since we could not forward the request We must ask for the signon token ourselves\r\n this.signOnManager.requestSignOnRefresh()\r\n .subscribe(\r\n response => {\r\n this.completeSignOnTokenAwaiter(response);\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setSignOnToken,\r\n RpcForwarder.ensureSerializable(response));\r\n },\r\n error => {\r\n this.completeSignOnTokenAwaiter(null, error);\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setSignOnTokenError,\r\n RpcForwarder.ensureSerializable(error));\r\n });\r\n\r\n return this.signOnTokenAwaiter;\r\n }\r\n\r\n /\r\n Forward Sign On Token to child frame.\r\n /\r\n public forwardSignOnToken(): void {\r\n const data: SignOnTokenResponse = { time: Date.now(), token: this.signOnManager.signedHttpRequestToken };\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnToken, data);\r\n }\r\n\r\n /\r\n @deprecated use createSecureToken() after configured gatewayJwk property.\r\n \r\n Creates a token from the given options that may be used for node authentication\r\n * @param options The token creation options\r\n /\r\n public createToken(options: CreateAuthorizationTokenOptions, passwordEncryptedWith: string = null): AuthorizationToken {\r\n // ensure a valid value for laps local admin name\r\n if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n }\r\n // ensure username has a valid value\r\n if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n options.username = null;\r\n }\r\n if (options.useLaps \|\| !options.username) {\r\n return {\r\n value: null,\r\n username: null,\r\n useLaps: options.useLaps,\r\n lapsLocalAdminName: options.lapsLocalAdminName\r\n };\r\n }\r\n\r\n // ensure password has a valid value\r\n if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n options.password = null;\r\n }\r\n\r\n let username: string[];\r\n if (options.username.indexOf('@') >= 0) {\r\n username = options.username.split('@').reverse();\r\n } else {\r\n username = options.username.split('\\\\');\r\n }\r\n\r\n const token = Net.createEncodedAuthenticationHeader(username, options.password, passwordEncryptedWith);\r\n return {\r\n value: token,\r\n username: options.username,\r\n useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n lapsLocalAdminName: null\r\n };\r\n }\r\n\r\n /\r\n Creates a secure token from the given options that may be used for node authentication\r\n \r\n @param options The token creation options\r\n /\r\n public createSecureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n const forward = this.forwardExecute<AuthorizationToken>(\r\n RpcRelationshipType.Parent,\r\n AuthorizationManager.rpcCommands.secureToken,\r\n [options]);\r\n if (forward) {\r\n return forward;\r\n } else {\r\n return this.secureToken(options);\r\n }\r\n }\r\n\r\n /\r\n Get the saved Auth token for a node.\r\n \r\n @param nodeName The nodeName to get token for.\r\n /\r\n public getSavedNodeToken(nodeName: string): AuthorizationToken {\r\n if (nodeName && this.nodeTokens[nodeName.toLocaleLowerCase()]) {\r\n return this.nodeTokens[nodeName.toLocaleLowerCase()];\r\n }\r\n\r\n return this.manageAsToken;\r\n }\r\n\r\n /\r\n Sets a token on the given nodes\r\n * @param token The token to use for the given nodes\r\n * @param nodeName The names of the nodes to set the token for. If empty or null, the token will be used as the global manageAs token\r\n * @returns an Observable indicating that the token has been set.\r\n /\r\n public setNodeTokens(token: AuthorizationToken, nodeNames?: string[]): Observable<void> {\r\n // if we have a parent instance, just forward it and return the result\r\n const forward = this.forwardExecute<void>(\r\n RpcRelationshipType.Parent,\r\n AuthorizationManager.rpcCommands.setNodeTokens,\r\n [token, nodeNames]\r\n );\r\n if (forward) {\r\n return forward;\r\n }\r\n\r\n // otherwise process the token\r\n const childSetTokenResponse: AuthorizationTokenResponse = { token: token };\r\n if (!nodeNames \|\| !Array.isArray(nodeNames) \|\| nodeNames.length === 0) {\r\n this.manageAsToken = token;\r\n } else {\r\n childSetTokenResponse.appliesTo = nodeNames;\r\n nodeNames.forEach(nodeName => this.nodeTokens[nodeName.toLocaleLowerCase()] = token);\r\n }\r\n this.updateCache();\r\n\r\n // notify all child instances of the token change.\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, childSetTokenResponse, true);\r\n\r\n // return a null observable, indicating we are done.\r\n return of(null);\r\n }\r\n\r\n /\r\n Adds a authorization header to a request given a node with a manageAsToken\r\n * @param request The request to add headers to\r\n * @param nodeName optional. The node to add headers for if not provided, the global token will be used\r\n * @param token optional. The token to use for the headers. if provided, the nodeName is not used.\r\n /\r\n public addAuthorizationRequestHeader(request: AjaxRequest, nodeName?: string, token?: AuthorizationToken) {\r\n if (!token) {\r\n token = this.getSavedNodeToken(nodeName);\r\n }\r\n\r\n if (token) {\r\n if (token.value) {\r\n\r\n // If username and password are explicitly provided, we only add the Authorization header.\r\n request.headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n } else {\r\n\r\n // If not, we add useLaps header.\r\n request.headers[headerConstants.USE_LAPS] = token.useLaps;\r\n request.headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n }\r\n }\r\n }\r\n\r\n /\r\n Create token headers.\r\n \r\n @param nodeName the node name.\r\n * @param token the token to override current setting (optional).\r\n /\r\n public createTokenHeaders(nodeName: string, token?: AuthorizationToken): MsftSme.StringMap<string> {\r\n const headers: MsftSme.StringMap<string> = {};\r\n token = token \|\| this.getSavedNodeToken(nodeName);\r\n if (token) {\r\n if (token.value) {\r\n // If username and password are explicitly provided, we only add the Authorization header.\r\n headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n } else {\r\n\r\n // If not, we add useLaps header.\r\n headers[headerConstants.USE_LAPS] = token.useLaps ? 'true' : 'false';\r\n headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n }\r\n }\r\n\r\n return headers;\r\n }\r\n\r\n /\r\n Adds a authorization header to a request given a node with a manageAsToken\r\n /\r\n public addAuthorizationTokensToMultiPartBody(body: string[], nodeName?: string, token?: AuthorizationToken) {\r\n if (!token) {\r\n token = this.getSavedNodeToken(nodeName);\r\n }\r\n\r\n if (token) {\r\n if (token.value) {\r\n // If username and password are explicitly provided, we only add the Authorization header.\r\n body.push(headerConstants.SME_AUTHORIZATION + ': ' + token.value);\r\n } else {\r\n // If not, we add useLaps header.\r\n body.push(headerConstants.USE_LAPS + ': ' + token.useLaps);\r\n body.push(headerConstants.LAPS_LOCALADMINNAME + ': ' + token.lapsLocalAdminName);\r\n }\r\n }\r\n }\r\n\r\n public resetAllTokens(): void {\r\n this.manageAsToken = null;\r\n this.nodePowershellEndpoints = {};\r\n this.nodeTokens = {};\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, null);\r\n this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n this.updateCache();\r\n }\r\n\r\n /\r\n Encrypts a string value using the jwk from the gateway\r\n /\r\n public encrypt(value: string): Observable<string> {\r\n const forward = this.forwardExecute<string>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.encrypt, [value]);\r\n if (forward) {\r\n return forward;\r\n }\r\n\r\n return Crypto.encryptRsaSha1(this.jwk, value);\r\n }\r\n\r\n /\r\n Called on a child service instance when onForwardInit returns from the parent\r\n * @param data The response from the forwardInit call\r\n /\r\n protected onForwardInitResponse(data: RpcForwardResponse<AuthorizationManagerInitProperties>): void {\r\n if (data && data.error) {\r\n // if there is an error, we cannot continue, so throw it\r\n throw data.error;\r\n }\r\n\r\n this.manageAsToken = data.result.manageAsToken;\r\n this.nodeTokens = data.result.nodeTokens;\r\n this.nodePowershellEndpoints = data.result.nodePowershellEndpoints;\r\n this.signOnManager.signedHttpRequestToken = data.result.signOnToken;\r\n }\r\n\r\n /\r\n Called when a new instance of the service in another window is initialized and needs to synchronize with its parent\r\n * @param from The RpcRelationshipType that this request is from\r\n * @returns an observable for the all the values needed to initialize the service\r\n /\r\n protected onForwardInit(): Observable<AuthorizationManagerInitProperties> {\r\n // authorization manager doesn't pass any properties to child services at this time.\r\n return of(<AuthorizationManagerInitProperties>{\r\n manageAsToken: this.manageAsToken,\r\n nodeTokens: this.nodeTokens,\r\n nodePowershellEndpoints: this.nodePowershellEndpoints,\r\n signOnToken: this.signOnManager.signedHttpRequestToken\r\n });\r\n }\r\n\r\n /\r\n Called when the forwarded services counterpart wants to get data from the parent\r\n * @param from The RpcRelationshipType that this request is from\r\n * @param name The name of the method to forward to\r\n * @param args The arguments of the method\r\n * @returns an observable for the result of the method call\r\n /\r\n protected onForwardExecute(from: RpcRelationshipType, name: string, args: any[]): Observable<any> {\r\n // command comes from child\r\n if (from === RpcRelationshipType.Child) {\r\n switch (name) {\r\n case AuthorizationManager.rpcCommands.getNewToken: {\r\n // start getting the new token, but return immediately to avoid timeout\r\n const subscription = this.getNewToken(args ? args[0] : null, args ? args[1] : null)\r\n .subscribe(\r\n result => subscription.unsubscribe(),\r\n error => {\r\n subscription.unsubscribe();\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setNodeTokenError,\r\n RpcForwarder.ensureSerializable(error));\r\n });\r\n return of(null);\r\n }\r\n case AuthorizationManager.rpcCommands.secureToken: {\r\n const options = args && args[0];\r\n if (!options) {\r\n return of(null);\r\n }\r\n\r\n return this.secureToken(options);\r\n }\r\n case AuthorizationManager.rpcCommands.encrypt: {\r\n const options = args && args[0];\r\n if (!options) {\r\n return of(null);\r\n }\r\n\r\n return this.encrypt(options);\r\n }\r\n case AuthorizationManager.rpcCommands.setNodeTokens: {\r\n const token = args && args[0];\r\n const nodes = args && args[1];\r\n if (!token) {\r\n return of(null);\r\n }\r\n\r\n return this.setNodeTokens(token, nodes);\r\n }\r\n case AuthorizationManager.rpcCommands.getSignOnToken: {\r\n const subscription = this.refreshSignOnToken()\r\n .subscribe(\r\n () => subscription.unsubscribe(),\r\n error => {\r\n subscription.unsubscribe(),\r\n this.forwardNotify(\r\n RpcRelationshipType.Child,\r\n AuthorizationManager.rpcCommands.setSignOnTokenError,\r\n RpcForwarder.ensureSerializable(error)\r\n );\r\n });\r\n return of(null);\r\n }\r\n }\r\n }\r\n\r\n // command comes from parent\r\n if (from === RpcRelationshipType.Parent) {\r\n if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {\r\n this.nodeTokens = {};\r\n this.nodePowershellEndpoints = {};\r\n // if we also have children, forward the request on\r\n const forward = this.forwardExecute(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, args);\r\n return forward \|\| of(null);\r\n }\r\n }\r\n\r\n // command not implemented\r\n return this.nameNotFound(name);\r\n }\r\n\r\n /\r\n Called when the forwarded services counterpart sends a notify message\r\n * @param from The RpcRelationshipType that this request is from\r\n * @param name The name of the property to change\r\n * @param value The new value of the property\r\n * @returns an observable that completes when the property has been changed.\r\n /\r\n protected onForwardNotify(from: RpcRelationshipType, name: string, value: any): Observable<void> {\r\n // allow our parent to give us a new token.\r\n if (from === RpcRelationshipType.Parent) {\r\n if (name === AuthorizationManager.rpcCommands.manageAsToken) {\r\n this.manageAsToken = value;\r\n // if we also have children, forward the notification on\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, value);\r\n return forward \|\| of(null);\r\n }\r\n\r\n if (name === AuthorizationManager.rpcCommands.setNodeToken) {\r\n if (!value) {\r\n const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n return throwError(message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n }\r\n\r\n this.completeTokenAwaiter(value);\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, value);\r\n return forward \|\| of(null);\r\n }\r\n\r\n if (name === AuthorizationManager.rpcCommands.setNodeTokenError) {\r\n if (!value) {\r\n const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n return throwError(message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n }\r\n\r\n this.completeTokenAwaiter(null, value);\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, value);\r\n return forward \|\| of(null);\r\n }\r\n\r\n if (name === AuthorizationManager.rpcCommands.setJeaContext) {\r\n if (!value) {\r\n const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n return throwError(message.format(AuthorizationManager.rpcCommands.setJeaContext));\r\n }\r\n\r\n this.saveJeaContext(value.nodeName, value.endpoint);\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setJeaContext, value);\r\n return forward \|\| of(null);\r\n }\r\n\r\n if (name === AuthorizationManager.rpcCommands.setSignOnToken) {\r\n if (!value) {\r\n const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n return throwError(message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n }\r\n\r\n this.completeSignOnTokenAwaiter(value);\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnToken, value);\r\n return forward \|\| of(null);\r\n }\r\n\r\n if (name === AuthorizationManager.rpcCommands.setSignOnTokenError) {\r\n if (!value) {\r\n const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n return throwError(message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n }\r\n\r\n this.completeSignOnTokenAwaiter(null, value);\r\n const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnTokenError, value);\r\n return forward \|\| of(null);\r\n }\r\n }\r\n\r\n return this.nameNotFound(name);\r\n }\r\n\r\n /\r\n Creates a secure token from the given options that may be used for node authentication\r\n \r\n @param options The token creation options\r\n /\r\n private secureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n // ensure a valid value for laps local admin name\r\n if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n }\r\n\r\n // ensure username has a valid value\r\n if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n options.username = null;\r\n }\r\n\r\n if (options.useLaps \|\| !options.username) {\r\n return of({\r\n value: null,\r\n username: null,\r\n useLaps: options.useLaps,\r\n lapsLocalAdminName: options.lapsLocalAdminName\r\n });\r\n }\r\n\r\n // ensure password has a valid value\r\n if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n options.password = null;\r\n }\r\n\r\n let username: string[];\r\n if (options.username.indexOf('@') >= 0) {\r\n username = options.username.split('@').reverse();\r\n } else {\r\n username = options.username.split('\\\\');\r\n }\r\n\r\n const tokenData = {\r\n value: undefined,\r\n username: options.username,\r\n useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n lapsLocalAdminName: null\r\n };\r\n\r\n if (this.jwk) {\r\n return Net.createEncryptedAuthenticationHeader(\r\n this.jwk,\r\n username,\r\n options.password,\r\n this.logOnUser,\r\n this.credentialsExpirationTimeInMs\r\n )\r\n .pipe(map(newToken => {\r\n tokenData.value = newToken;\r\n return tokenData;\r\n }));\r\n }\r\n\r\n tokenData.value = Net.createEncodedAuthenticationHeader(username, options.password);\r\n return of(tokenData);\r\n }\r\n\r\n /\r\n Completes the token awaiter\r\n /\r\n private completeTokenAwaiter(result: AuthorizationTokenResponse, error?: any) {\r\n if (error) {\r\n if (this.tokenAwaiter) {\r\n const awaiter = this.tokenAwaiter;\r\n this.tokenAwaiter = null;\r\n awaiter.error(error);\r\n }\r\n } else {\r\n if (!result.appliesTo) {\r\n this.manageAsToken = result.token;\r\n } else if (Array.isArray(result.appliesTo)) {\r\n result.appliesTo.forEach(nodeName => {\r\n this.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;\r\n });\r\n this.updateCache();\r\n } else {\r\n this.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;\r\n this.updateCache();\r\n }\r\n\r\n if (this.tokenAwaiter) {\r\n const awaiter = this.tokenAwaiter;\r\n this.tokenAwaiter = null;\r\n awaiter.next(result);\r\n awaiter.complete();\r\n }\r\n }\r\n }\r\n\r\n /\r\n Completes the sign on token awaiter\r\n /\r\n private completeSignOnTokenAwaiter(result: SignOnTokenResponse, error?: any) {\r\n const awaiter = this.signOnTokenAwaiter;\r\n if (awaiter) {\r\n this.signOnTokenAwaiter = null;\r\n }\r\n\r\n if (error) {\r\n if (awaiter) {\r\n awaiter.error(error);\r\n }\r\n\r\n return;\r\n }\r\n\r\n if (result.token) {\r\n this.signOnManager.signedHttpRequestToken = result.token;\r\n } else {\r\n Logging.logError('Shell.AuthorizationManager', 'Null token was passed.');\r\n }\r\n\r\n if (awaiter) {\r\n awaiter.next(result);\r\n awaiter.complete();\r\n }\r\n }\r\n\r\n /\r\n Gets the error data.\r\n * @param code the http status code.\r\n * @param error the AJAX error object.\r\n /\r\n private getErrorData(code: HttpStatusCode, error: AjaxError): NodeAuthorizationErrorData {\r\n return {\r\n statusCode: code,\r\n errorCode: error && error.xhr && error.xhr.response && error.xhr.response.error && error.xhr.response.error.code,\r\n errorMessage: Net.getErrorMessage(error)\r\n };\r\n }\r\n\r\n /\r\n Updates the authorization cache. Does nothing if we are not running in shell\r\n */\r\n private updateCache(): void {\r\n if (!MsftSme.isShell()) {\r\n // ignore if not shell\r\n return;\r\n }\r\n // update cached data\r\n const cacheData: AuthorizationCacheData = {\r\n jwk: this.jwk,\r\n manageAsToken: this.manageAsToken,\r\n nodePowershellEndpoints: this.nodePowershellEndpoints,\r\n nodeTokens: this.nodeTokens\r\n };\r\n sessionStorage.setItem(AuthorizationManager.cacheKey, JSON.stringify(cacheData));\r\n }\r\n}\r\n"]}

package/core/security/sign-on-manager.d.ts ADDED Viewed

@@ -0,0 +1,109 @@
+import { Observable, Subject } from 'rxjs';
+import { AjaxError, AjaxRequest } from 'rxjs/ajax';
+import { CimStreamOptions, CimStreamResponse } from '../data/cim-stream';
+import { HttpStatusCode } from '../data/http-constants';
+import { PowerShellStreamResponse } from '../data/powershell-stream';
+/**
+ * Defines an signed http request token
+ */
+export interface SignedHttpRequestToken {
+    /**
+     * JSON Web Token (string).
+     */
+    jwt: string;
+    /**
+     * User name.
+     */
+    username: string;
+}
+export interface SignOnTokenResponse {
+    /**
+     * The time aquired.
+     */
+    time: number;
+    /**
+     * The signed http request token.
+     */
+    token: SignedHttpRequestToken;
+}
+export interface SignOnTokenRefresh {
+    /**
+     * The time aquired.
+     */
+    time: number;
+}
+/**
+ * Manage Signed HTTP Request token (Proof of possession token) handling.
+ */
+export declare class SignOnManager {
+    /**
+     * Wait for one minute to respond by the portal.
+     */
+    private portalMaxWaitTimeout;
+    /**
+     * The PoP Authorization Token.
+     */
+    signedHttpRequestToken: SignedHttpRequestToken;
+    /**
+     * The sign on token awaiter subject.
+     */
+    signOnTokenAwaiter: Subject<SignOnTokenResponse>;
+    /**
+     * The sign on token requester subject.
+     */
+    private signOnTokenRefresh;
+    /**
+     * The refresh request to the authorization manager.
+     */
+    private refreshCall;
+    /**
+     * Initializes a new instance of the SignOnManager class.
+     */
+    constructor(refreshCall: () => Observable<SignOnTokenResponse>);
+    /**
+     * Gets a valude indicating whethere sign on token is active and configured.
+     */
+    get isSignOnTokenEnabled(): boolean;
+    /**
+     * Gets the sign on token request observable by Shell.
+     */
+    get signOnTokenRefreshTarget(): Observable<SignOnTokenRefresh>;
+    /**
+     * Apply signed http request token.
+     */
+    applySignedHttpRequestToken(token: SignedHttpRequestToken): void;
+    /**
+     * Request sign on token to refresh.
+     * @returns success void.
+     */
+    requestSignOnRefresh(): Observable<SignOnTokenResponse>;
+    /**
+     * Check if it can handle unauthorized login case.
+     * @param code the error code.
+     * @param error the ajax error response.
+     * @returns ture if it can handle.
+     */
+    canHandleUnauthorizedLogin(code: HttpStatusCode, error: AjaxError): boolean;
+    /**
+     * Handles the unauthorized login case.
+     * @param code the error code.
+     * @param request the ajax request.
+     * @param error the ajex error reponse.
+     * @returns success if it could handled.
+     */
+    handleUnauthorizedLogin(code: HttpStatusCode, request: AjaxRequest, error: AjaxError): Observable<AjaxRequest>;
+    /**
+     * Check if it can handle unauthorized login case.
+     * @param response the response of CIM stream query.
+     */
+    canHandleStreamUnauthorizedLogin(response: CimStreamResponse): boolean;
+    /**
+     * Handle returns true for an ajax error, this method can be called to handle that error.
+     */
+    handleStreamUnauthorizedLogin(options: CimStreamOptions, response: CimStreamResponse | PowerShellStreamResponse): Observable<CimStreamOptions>;
+    /**
+     * Set AAD authorization header.
+     * @param headers the headers.
+     */
+    SetAadAuthorizationHeader(headers?: any): void;
+}