@microsoft/windows-admin-center-sdk 6.0.0 → 6.1.0

package/core/security/authorization-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-manager.js","sourceRoot":"","sources":["../../src/security/authorization-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3D,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAKjD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAA0B,aAAa,EAA2C,MAAM,mBAAmB,CAAC;AA4EnH;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAqK7C;IApKZ;;OAEG;IACK,MAAM,CAAC,QAAQ,GAAG,+BAA+B,CAAC;IAE1D;;OAEG;IACI,MAAM,CAAC,yBAAyB,GAAG,eAAe,CAAC;IAElD,MAAM,CAAC,WAAW,GAAG;QACzB,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,eAAe;QAC9B,aAAa,EAAE,eAAe;QAC9B,iBAAiB,EAAE,mBAAmB;QACtC,aAAa,EAAE,eAAe;QAC9B,eAAe,EAAE,iBAAiB;QAClC,WAAW,EAAE,aAAa;QAC1B,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,SAAS;QAClB,cAAc,EAAE,gBAAgB;QAChC,cAAc,EAAE,gBAAgB;QAChC,mBAAmB,EAAE,qBAAqB;KAC7C,CAAC;IAEF;;OAEG;IACI,UAAU,CAAwC;IAEzD;;OAEG;IACI,aAAa,CAAgB;IAEpC;;OAEG;IACK,KAAK,CAAqB;IAElC;;OAEG;IACK,GAAG,CAAS;IAEpB;;OAEG;IACK,6BAA6B,CAAS;IAE9C;;OAEG;IACK,kCAAkC,CAAkB;IAE5D;;OAEG;IACI,2BAA2B,CAAqB;IAEvD;;;OAGG;IACH,IAAW,kBAAkB,CAAC,kBAA0B;QACpD,IAAI,CAAC,6BAA6B,GAAG,kBAAkB,CAAC;QACxD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACK,SAAS,CAAS;IAE1B;;OAEG;IACH,IAAW,cAAc,CAAC,QAAgB;QACtC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,uBAAuB,CAA4B;IAE3D;;OAEG;IACK,YAAY,CAAsC;IAE1D;;OAEG;IACK,kBAAkB,CAA+B;IAEzD;;;OAGG;IACH,IAAW,aAAa,CAAC,KAAyB;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACrG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAW,aAAa;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAW,UAAU,CAAC,GAAW;QAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACa,iBAAiB,CAAqB;IAEtD;;OAEG;IACK,wBAAwB,CAAkB;IAElD;;OAEG;IACH,IAAW,UAAU;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,IAAW,WAAW;QAClB,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACjD,0BAA0B;YAC1B,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QAED,0BAA0B;QAC1B,OAAO,EAAE,CAA6B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACH,YACY,SAAmC,EAC3C,GAAQ;QAER,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAH5B,cAAS,GAAT,SAAS,CAA0B;QAI3C,IAAI,CAAC,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,CAAC;QAEtE,IAAI,CAAC,kCAAkC,GAAG,IAAI,OAAO,EAAU,CAAC;QAChE,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC,kCAAkC,CAAC,YAAY,EAAE,CAAC;QAE1F,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpB,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAE9F,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC;oBACD,MAAM,UAAU,GAA2B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACxE,iCAAiC;oBACjC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC;oBAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC;oBACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC9C,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,IAAI,EAAE,CAAC;oBACxE,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBAC5E,CAAC;YACL,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACI,oBAAoB,CAAC,IAAoB,EAAE,KAAgB;QAC9D,kIAAkI;QAClI,OAAO,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,iBAAiB,CAAC,IAAoB,EAAE,OAAoB,EAAE,KAAgB,EAAE,QAAiB;QACpG,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAChB,+FAA+F;YAC/F,4DAA4D;YAC5D,oDAAoD;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;YACjC,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE,CAAC;gBACjB,8CAA8C;gBAC9C,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,mDAAmD;gBACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,CAAC;QACL,CAAC,CAAC,CACL,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,QAA2B;QACrD,sBAAsB;QACtB,OAAO,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,0CAAgC,CAAC;IACzG,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,QAAgB,EAAE,OAAyB,EAAE,QAAsD;QAC1H,IAAI,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAChC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAA+B;YAC1C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;YACxC,SAAS,EAAE,cAAc;YACzB,YAAY,EAAE,OAAO;SACxB,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/B,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,KAAK,EAAE,CAAC;oBACR,IAAI,OAAO,EAAE,CAAC;wBACV,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;oBAC9B,CAAC;yBAAM,CAAC;wBACJ,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;oBACnC,CAAC;gBACL,CAAC;gBAED,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACjE,CAAC;QACL,CAAC,CAAC,CACL,CAAC;IACN,CAAC;IAEM,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,OAAO,CAAC,KAAK,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9I,CAAC;IAEM,cAAc,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,QAAQ,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAWM,WAAW,CAAC,SAA6B,EAAE,SAAsC;QACpF,kGAAkG;QAClG,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QAED,6CAA6C;QAC7C,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAED,wDAAwD;QACxD,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,EAA8B,CAAC;QAE9D,qDAAqD;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,qCAAmC,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAEnJ,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QAED,6DAA6D;QAC7D,uFAAuF;QACvF,IAAI,SAAS,EAAE,CAAC;YACZ,KAAK,MAAM,IAAI,IAAc,SAAS,EAAE,CAAC;gBACrC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;QACL,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;aAC/B,IAAI,CACD,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;gBACrH,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;gBAChD,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC,CAAC,EACF,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;YACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;aACrD,CAAC,CAAC,IAAI,CACH,GAAG,CAAC,KAAK,CAAC,EAAE;gBACR,OAAmC;oBAC/B,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,SAAS;iBACvB,CAAC;YACN,CAAC,CAAC,CACL,CAAC;QACN,CAAC,CAAC;QACF,mDAAmD;QACnD,+DAA+D;QAC/D,IAAI,CAAC,CAAC,CAAC,CACV;aACA,SAAS,CAAC;YACP,IAAI,EAAE,MAAM,CAAC,EAAE;gBACX,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBAClC,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACzG,CAAC;YACD,KAAK,EAAE,KAAK,CAAC,EAAE;gBACX,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9I,CAAC;SACJ,CAAC,CAAC;QAEP,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAEM,kBAAkB;QACrB,kGAAkG;QAClG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACnC,CAAC;QAED,wDAAwD;QACxD,IAAI,CAAC,kBAAkB,GAAG,IAAI,OAAO,EAAuB,CAAC;QAE7D,yDAAyD;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,qCAAiD,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnJ,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACnC,CAAC;QAED,oFAAoF;QACpF,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC,SAAS,CAAC;YAChD,IAAI,EAAE,QAAQ,CAAC,EAAE;gBACb,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;gBAC1C,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9I,CAAC;YACD,KAAK,EAAE,KAAK,CAAC,EAAE;gBACX,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7C,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAChJ,CAAC;SACJ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACnC,CAAC;IAED;;OAEG;IACI,kBAAkB;QACrB,MAAM,IAAI,GAAwB,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC;QACzG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACzG,CAAC;IAED;;;;;OAKG;IACI,WAAW,CAAC,OAAwC,EAAE,wBAAgC,IAAI;QAC7F,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;QAChF,CAAC;QACD,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO;gBACH,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC;QACN,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,kCAAkC;YAClC,QAAQ,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACvG,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK,EAAE,4EAA4E;YAC5F,kBAAkB,EAAE,IAAI;SAC3B,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,OAAwC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,qCAAiD,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7I,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,OAAO,CAAC;QACnB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,QAAgB;QACrC,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,KAAyB,EAAE,SAAoB;QAChE,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,qCAAmC,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1I,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,8BAA8B;QAC9B,MAAM,qBAAqB,GAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC/B,CAAC;aAAM,CAAC;YACJ,qBAAqB,CAAC,SAAS,GAAG,SAAS,CAAC;YAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,kDAAkD;QAClD,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAE1H,oDAAoD;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAoB,EAAE,QAAiB,EAAE,KAA0B;QACpG,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,0FAA0F;gBACpF,OAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACJ,iCAAiC;gBAC3B,OAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC3D,OAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC3F,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,kBAAkB,CAAC,QAAgB,EAAE,KAA0B;QAClE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,0FAA0F;gBAC1F,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACJ,iCAAiC;gBACjC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrE,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC5E,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACI,qCAAqC,CAAC,IAAc,EAAE,QAAiB,EAAE,KAA0B;QACtG,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,0FAA0F;gBAC1F,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,iCAAiC;gBACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,GAAG,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACrF,CAAC;QACL,CAAC;IACL,CAAC;IAEM,cAAc;QACjB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,qCAAqC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3H,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACO,qBAAqB,CAAC,IAA4D;QACxF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;QACnE,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACO,aAAa;QACnB,oFAAoF;QACpF,OAAO,EAAE,CAAqC;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB;SACzD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACO,gBAAgB,CAAC,IAAyB,EAAE,IAAY,EAAE,IAAW;QAC3E,2BAA2B;QAC3B,IAAI,IAAI,sCAA8B,EAAE,CAAC;YACrC,QAAQ,IAAI,EAAE,CAAC;gBACX,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;oBAChD,uEAAuE;oBACvE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;wBAC1F,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE;wBACtC,KAAK,EAAE,KAAK,CAAC,EAAE;4BACX,YAAY,CAAC,WAAW,EAAE,CAAC;4BAC3B,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC9I,CAAC;qBACJ,CAAC,CAAC;oBACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;oBAChD,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;oBACpB,CAAC;oBAED,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC5C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;oBACpB,CAAC;oBAED,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACjC,CAAC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;oBAClD,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;wBACT,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;oBACpB,CAAC;oBAED,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;oBACnD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC,SAAS,CAAC;wBACrD,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE;wBACtC,KAAK,EAAE,KAAK,CAAC,EAAE;4BACX,CAAC,YAAY,CAAC,WAAW,EAAE;gCACvB,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBACrJ,CAAC;qBACJ,CAAC,CAAC;oBACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACL,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,IAAI,IAAI,uCAA+B,EAAE,CAAC;YACtC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;gBAC5D,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAClC,mDAAmD;gBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACvH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACO,eAAe,CAAC,IAAyB,EAAE,IAAY,EAAE,KAAU;QACzE,2CAA2C;QAC3C,IAAI,IAAI,uCAA+B,EAAE,CAAC;YACtC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC1D,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC3F,CAAC;gBAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACpH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAChG,CAAC;gBAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACzH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC3F,CAAC;gBAED,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;gBACtH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBAChE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAChG,CAAC;gBAED,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBAC3H,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,OAAwC;QACxD,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;QAChF,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,EAAE,CAAC;gBACN,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC,CAAC;QACP,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,kCAAkC;YAClC,QAAQ,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,SAAS,GAAG;YACd,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK,EAAE,4EAA4E;YAC5F,kBAAkB,EAAE,IAAI;SAC3B,CAAC;QAEF,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO,GAAG,CAAC,mCAAmC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC,IAAI,CACzI,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACX,SAAS,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,CACL,CAAC;QACN,CAAC;QAED,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,MAAkC,EAAE,KAAW;QACxE,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;YACtC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;oBAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACjE,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvB,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACK,0BAA0B,CAAC,MAA2B,EAAE,KAAW;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;YAED,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,MAAM,CAAC,KAAK,CAAC;QAC7D,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,QAAQ,CAAC,4BAA4B,EAAE,wBAAwB,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,IAAoB,EAAE,KAAgB;QACvD,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;YAChH,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;SAC3C,CAAC;IACN,CAAC;IAED;;OAEG;IACK,WAAW;QACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,sBAAsB;YACtB,OAAO;QACX,CAAC;QACD,qBAAqB;QACrB,MAAM,SAAS,GAA2B;YACtC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC9B,CAAC;QAEF,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACpG,CAAC","sourcesContent":["import { Observable, of, Subject, throwError } from 'rxjs';\r\nimport { AjaxError, AjaxRequest } from 'rxjs/ajax';\r\nimport { map, mergeMap, take } from 'rxjs/operators';\r\nimport { CimStreamOptions, CimStreamResponse } from '../data/cim-stream';\r\nimport { Crypto } from '../data/crypto';\r\nimport { headerConstants, HttpStatusCode } from '../data/http-constants';\r\nimport { Net } from '../data/net';\r\nimport { PowerShellStreamResponse } from '../data/powershell-stream';\r\nimport { Logging } from '../diagnostics/logging';\r\nimport { Strings } from '../generated/strings';\r\nimport { RpcForwardResponse } from '../rpc/forward/rpc-forward-model';\r\nimport { Rpc } from '../rpc/rpc';\r\nimport { RpcRelationshipType } from '../rpc/rpc-base';\r\nimport { RpcForwarder, RpcServiceForwarder } from '../rpc/rpc-forwarder';\r\nimport { SignedHttpRequestToken, SignOnManager, SignOnTokenRefresh, SignOnTokenResponse } from './sign-on-manager';\r\n\r\n/**\r\n * Defines the response from an Authorization Handler\r\n */\r\nexport interface AuthorizationCredentials {\r\n    username: string;\r\n    password: string;\r\n    applyToAllNodes?: boolean;\r\n    useLaps?: boolean;\r\n    lapsLocalAdminName?: string;\r\n}\r\n\r\n/**\r\n * Defines the response the AuthorizationManager returns from getToken\r\n */\r\nexport interface AuthorizationTokenResponse {\r\n    token: AuthorizationToken;\r\n    appliesTo?: string | string[];\r\n}\r\n\r\n/**\r\n * Defines an authorizationToken\r\n */\r\nexport interface AuthorizationToken {\r\n    value: string;\r\n    username: string;\r\n    useLaps: boolean;\r\n    lapsLocalAdminName: string;\r\n}\r\n\r\n/**\r\n * The create authorization token options\r\n */\r\nexport interface CreateAuthorizationTokenOptions {\r\n    password?: string;\r\n    username?: string;\r\n    useLaps?: boolean;\r\n    lapsLocalAdminName?: string;\r\n}\r\n\r\n/**\r\n * The extra error data of original cause.\r\n */\r\nexport interface NodeAuthorizationErrorData {\r\n    statusCode: HttpStatusCode;\r\n    errorCode: string;\r\n    errorMessage: string;\r\n}\r\n\r\n/**\r\n * Defines a handler that takes a nodeName and returns authorization credentials\r\n */\r\nexport type NodeAuthorizationHandler = (nodeName?: string | string[], errorData?: NodeAuthorizationErrorData) => Observable<AuthorizationCredentials>;\r\n\r\n/**\r\n * Defines properties that will be provided to child instances on a forward init request\r\n */\r\nexport interface AuthorizationManagerInitProperties {\r\n    manageAsToken: AuthorizationToken;\r\n    nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n    nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n    signOnToken: SignedHttpRequestToken;\r\n}\r\n\r\n/**\r\n * Representation of authorization cache data structure\r\n */\r\ninterface AuthorizationCacheData {\r\n    jwk?: string;\r\n    nodeTokens?: MsftSme.StringMap<AuthorizationToken>;\r\n    manageAsToken?: AuthorizationToken;\r\n    nodePowershellEndpoints?: MsftSme.StringMap<string>;\r\n    logOnUser?: string;\r\n}\r\n\r\n/**\r\n * Authorization Manager class. Handles SME authentication for service requests.\r\n */\r\nexport class AuthorizationManager extends RpcServiceForwarder {\r\n    /**\r\n     * Cache key for session storage of authorization cache\r\n     */\r\n    private static cacheKey = 'AuthorizationManager.cache.v1';\r\n\r\n    /**\r\n     * If no laps local admin name is defined, it will default to 'administrator'\r\n     */\r\n    public static defaultLapsLocalAdminName = 'administrator';\r\n\r\n    private static rpcCommands = {\r\n        setNodeToken: 'setNodeToken',\r\n        setNodeTokens: 'setNodeTokens',\r\n        manageAsToken: 'manageAsToken',\r\n        setNodeTokenError: 'setNodeTokenError',\r\n        setJeaContext: 'setJeaContext',\r\n        clearNodeTokens: 'clearNodeTokens',\r\n        getNewToken: 'getNewToken',\r\n        secureToken: 'secureToken',\r\n        encrypt: 'encrypt',\r\n        getSignOnToken: 'getSignOnToken',\r\n        setSignOnToken: 'setSignOnToken',\r\n        setSignOnTokenError: 'setSignOnTokenError'\r\n    };\r\n\r\n    /**\r\n     * Create a map of nodeNames to token objects to hold node specific tokens.\r\n     */\r\n    public nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n\r\n    /**\r\n     * The sign on operation manager.\r\n     */\r\n    public signOnManager: SignOnManager;\r\n\r\n    /**\r\n     * The backing store fro the manageAsToken\r\n     */\r\n    private token: AuthorizationToken;\r\n\r\n    /**\r\n     * The JSON Web Key. Single string with JSON.stringify format.\r\n     */\r\n    private jwk: string;\r\n\r\n    /**\r\n     * Credentials expiration time, used to determine the lifetime of new tokens. Value in milliseconds.\r\n     */\r\n    private credentialsExpirationTimeInMs: number;\r\n\r\n    /**\r\n     * Underlying implementation subject for credentialExpiration observable\r\n     */\r\n    private credentialExpirationChangedSubject: Subject<number>;\r\n\r\n    /**\r\n     * Observable that emits whenever the credentials expiration has changed\r\n     */\r\n    public credentialExpirationChanged: Observable<number>;\r\n\r\n    /**\r\n     * Set the admin configured expiration time in milliseconds\r\n     * If this is not set it will be defaulted to 365 days.\r\n     */\r\n    public set authExpirationInMs(expirationTimeInMs: number) {\r\n        this.credentialsExpirationTimeInMs = expirationTimeInMs;\r\n        this.credentialExpirationChangedSubject.next(expirationTimeInMs);\r\n    }\r\n\r\n    /**\r\n     * The logon user returned by gateway's api/user\r\n     */\r\n    private logOnUser: string;\r\n\r\n    /**\r\n     * Sets logon user and caches the value\r\n     */\r\n    public set shellLogOnUser(username: string) {\r\n        this.logOnUser = username;\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * The mapping of connections to PowershellEndpoints\r\n     */\r\n    private nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n\r\n    /**\r\n     * The token awaiter subject.\r\n     */\r\n    private tokenAwaiter: Subject<AuthorizationTokenResponse>;\r\n\r\n    /**\r\n     * The subject observable of sign on token awaiter.\r\n     */\r\n    private signOnTokenAwaiter: Subject<SignOnTokenResponse>;\r\n\r\n    /**\r\n     * Sets the current manage as token\r\n     * If running with an Rpc child, notify of the change\r\n     */\r\n    public set manageAsToken(token: AuthorizationToken) {\r\n        this.token = token;\r\n        this.nodePowershellEndpoints = {};\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, token);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Gets the current manage as token\r\n     */\r\n    public get manageAsToken(): AuthorizationToken {\r\n        return this.token;\r\n    }\r\n\r\n    /**\r\n     * Sets the gateway encryption certificate JWK.\r\n     * If this is not set by Shell/Add-Connection, it will send clear text password.\r\n     */\r\n    public set gatewayJwk(jwk: string) {\r\n        if (this.jwk !== jwk) {\r\n            this.resetAllTokens();\r\n        }\r\n        this.jwk = jwk;\r\n        this.gatewayJwkChangedSubject.next(jwk);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Observable that emits whenever the gateways Jwk has changed\r\n     */\r\n    public readonly gatewayJwkChanged: Observable<string>;\r\n\r\n    /**\r\n     * Underlying implementation subject for gatewayJwkChanged observable\r\n     */\r\n    private gatewayJwkChangedSubject: Subject<string>;\r\n\r\n    /**\r\n     * Gets the gateway encryption certificate JWK.\r\n     */\r\n    public get gatewayJwk() {\r\n        return this.jwk;\r\n    }\r\n\r\n    /**\r\n     * Gets an observable the emits when the authorization token is ready\r\n     */\r\n    public get authAwaiter() {\r\n        if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n            // return the global token\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // return the global token\r\n        return of(<AuthorizationTokenResponse>{ appliesTo: null, token: this.manageAsToken });\r\n    }\r\n\r\n    /**\r\n     * Initializes a new instance of the Authorization Manager class\r\n     * @param authorize An AuthorizationHandler with which to retrieve user credentials\r\n     * @param rpc The rpc to forward auth requests to a parent window\r\n     */\r\n    constructor(\r\n        private authorize: NodeAuthorizationHandler,\r\n        rpc: Rpc\r\n    ) {\r\n        super('authorization-manager', rpc);\r\n        this.gatewayJwkChangedSubject = new Subject<string>();\r\n        this.gatewayJwkChanged = this.gatewayJwkChangedSubject.asObservable();\r\n\r\n        this.credentialExpirationChangedSubject = new Subject<number>();\r\n        this.credentialExpirationChanged = this.credentialExpirationChangedSubject.asObservable();\r\n\r\n        this.nodeTokens = {};\r\n        this.nodePowershellEndpoints = {};\r\n        if (MsftSme.isShell()) {\r\n            // attempt to restore from storage if this is a shell instance\r\n            const cachedDataString = MsftSme.SessionStorageHandler.getItem(AuthorizationManager.cacheKey);\r\n\r\n            if (!MsftSme.isNullOrWhiteSpace(cachedDataString)) {\r\n                try {\r\n                    const cachedData: AuthorizationCacheData = JSON.parse(cachedDataString);\r\n                    // verify data and set properties\r\n                    this.jwk = cachedData.jwk || null;\r\n                    this.manageAsToken = cachedData.manageAsToken || null;\r\n                    this.nodeTokens = cachedData.nodeTokens || {};\r\n                    this.nodePowershellEndpoints = cachedData.nodePowershellEndpoints || {};\r\n                    this.logOnUser = cachedData.logOnUser;\r\n                } catch (error) {\r\n                    MsftSme.SessionStorageHandler.removeItem(AuthorizationManager.cacheKey);\r\n                }\r\n            }\r\n        }\r\n\r\n        this.signOnManager = new SignOnManager(() => this.refreshSignOnToken());\r\n    }\r\n\r\n    /**\r\n     * defines the conditions under which the AuthorizationManager can handle an ajax error\r\n     */\r\n    public canHandleAjaxFailure(code: HttpStatusCode, error: AjaxError) {\r\n        // we can handle ajax errors if we have a getter defined, and the code is Unauthorized (401) or we get a cim authorization failure\r\n        return this.authorize && Net.isUnauthorized(error);\r\n    }\r\n\r\n    /**\r\n     * When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n     */\r\n    public handleAjaxFailure(code: HttpStatusCode, request: AjaxRequest, error: AjaxError, nodeName?: string): Observable<AjaxRequest> {\r\n        const errorData = this.getErrorData(code, error);\r\n\r\n        return this.getNewToken(nodeName, errorData).pipe(\r\n            mergeMap(response => {\r\n                // There may be multiple nodes requesting authentication, but we can only ask the user for one.\r\n                // check if the result if for our node, otherwise try again.\r\n                // It looks for inside of array only for first name.\r\n                const names = response.appliesTo;\r\n                const isTokenForNode = !names || names === nodeName || (Array.isArray(names) && names[0] === nodeName);\r\n                if (isTokenForNode) {\r\n                    // this token applies to our node, so continue\r\n                    this.addAuthorizationRequestHeader(request, nodeName);\r\n                    return of(request);\r\n                } else {\r\n                    // this token did not apply to our node. Ask again.\r\n                    return this.handleAjaxFailure(code, request, error, nodeName);\r\n                }\r\n            })\r\n        );\r\n    }\r\n\r\n    /**\r\n     * Check if it can handle the error.\r\n     *\r\n     * @param response the response of CIM stream query.\r\n     */\r\n    public canHandleStreamFailure(response: CimStreamResponse): boolean {\r\n        // access denied case.\r\n        return response && response.response && response.response.statusCode === HttpStatusCode.Unauthorized;\r\n    }\r\n\r\n    /**\r\n     * When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n     */\r\n    public handleStreamFailure(nodeName: string, options: CimStreamOptions, response: CimStreamResponse | PowerShellStreamResponse): Observable<CimStreamOptions> {\r\n        let message = response.response.error && response.response.error.message;\r\n        if (!message) {\r\n            const errors = response.response.errors;\r\n            if (errors && errors.length > 0) {\r\n                message = errors[0].message;\r\n            }\r\n        }\r\n        const errorData: NodeAuthorizationErrorData = {\r\n            statusCode: response.response.statusCode,\r\n            errorCode: 'Unauthorized',\r\n            errorMessage: message\r\n        };\r\n        return this.getNewToken(nodeName, errorData).pipe(\r\n            mergeMap(result => {\r\n                const names = result.appliesTo;\r\n                const isTokenForNode = !names || names === nodeName || (Array.isArray(names) && names[0] === nodeName);\r\n                if (isTokenForNode) {\r\n                    const token = this.getSavedNodeToken(nodeName);\r\n                    if (token) {\r\n                        if (options) {\r\n                            options.authToken = token;\r\n                        } else {\r\n                            options = { authToken: token };\r\n                        }\r\n                    }\r\n\r\n                    return of(options);\r\n                } else {\r\n                    return this.handleStreamFailure(nodeName, options, response);\r\n                }\r\n            })\r\n        );\r\n    }\r\n\r\n    public saveJeaContext(nodeName: string, endpoint: string) {\r\n        Logging.trace({\r\n            view: 'sme-ui-control',\r\n            instance: 'saveJeaContext',\r\n            action: 'command-click',\r\n            data: { message: 'Establishing session using JEA endpoint' }\r\n        });\r\n        this.setJeaEndpoint(nodeName, endpoint);\r\n\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setJeaContext, { nodeName: nodeName, endpoint: endpoint });\r\n    }\r\n\r\n    public getJeaEndpoint(nodeName: string): string {\r\n        return this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()];\r\n    }\r\n\r\n    /**\r\n     * Associates a node to use a specified JEA endpoint\r\n     */\r\n    public setJeaEndpoint(nodeName: string, endpoint: string): void {\r\n        this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()] = endpoint;\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Calls the authorize method and gets a new token.\r\n     * If running as a child, the token comes from the parent windows service\r\n     */\r\n    public getNewToken(nodeName: string): Observable<AuthorizationTokenResponse>;\r\n    public getNewToken(nodeNames: string[]): Observable<AuthorizationTokenResponse>;\r\n    public getNewToken(nodeName: string, errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n    public getNewToken(nodeNames: string[], errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n\r\n    public getNewToken(nodeNames?: string | string[], errorData?: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse> {\r\n        // if we are already awaiting a token, then hook into the current request and try using that token\r\n        if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // ensure input is an array only if not null.\r\n        if (nodeNames && !Array.isArray(nodeNames)) {\r\n            nodeNames = [nodeNames];\r\n        }\r\n\r\n        // define a new subject for multiple requests to wait on\r\n        this.tokenAwaiter = new Subject<AuthorizationTokenResponse>();\r\n\r\n        // try to forward execute getNewToken from our parent\r\n        const parentExecuter = this.forwardExecute<void>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.getNewToken, [nodeNames, errorData]);\r\n\r\n        if (parentExecuter) {\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // Need to clear the endpoints before we acquire a new token,\r\n        // because we must try new credentials in an admin context before any fallback happens.\r\n        if (nodeNames) {\r\n            for (const node of <string[]>nodeNames) {\r\n                this.setJeaEndpoint(node, null);\r\n            }\r\n        }\r\n\r\n        // since we could not forward the request We must ask for the auth token ourselves\r\n        this.authorize(nodeNames, errorData)\r\n            .pipe(\r\n                mergeMap(credentials => {\r\n                    if (credentials.applyToAllNodes) {\r\n                        this.nodeTokens = {};\r\n                        this.updateCache();\r\n                        const forward = this.forwardExecute(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n                        if (forward) {\r\n                            return forward.pipe(map(() => credentials));\r\n                        }\r\n                    }\r\n\r\n                    return of(credentials);\r\n                }),\r\n                mergeMap(credentials => {\r\n                    const appliesTo = credentials.applyToAllNodes ? null : nodeNames || null;\r\n                    return this.createSecureToken({\r\n                        username: credentials.username,\r\n                        password: credentials.password,\r\n                        useLaps: credentials.useLaps,\r\n                        lapsLocalAdminName: credentials.lapsLocalAdminName\r\n                    }).pipe(\r\n                        map(token => {\r\n                            return <AuthorizationTokenResponse>{\r\n                                token: token,\r\n                                appliesTo: appliesTo\r\n                            };\r\n                        })\r\n                    );\r\n                }),\r\n                // take the next 1 result and use it for our token.\r\n                // We can now notify anyone waiting for auth and save the token\r\n                take(1)\r\n            )\r\n            .subscribe({\r\n                next: result => {\r\n                    this.completeTokenAwaiter(result);\r\n                    this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, result);\r\n                },\r\n                error: error => {\r\n                    this.completeTokenAwaiter(null, error);\r\n                    this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, RpcForwarder.ensureSerializable(error));\r\n                }\r\n            });\r\n\r\n        return this.tokenAwaiter;\r\n    }\r\n\r\n    public refreshSignOnToken(): Observable<SignOnTokenResponse> {\r\n        // if we are already awaiting a token, then hook into the current request and try using that token\r\n        if (this.signOnTokenAwaiter) {\r\n            return this.signOnTokenAwaiter;\r\n        }\r\n\r\n        // define a new subject for multiple requests to wait on\r\n        this.signOnTokenAwaiter = new Subject<SignOnTokenResponse>();\r\n\r\n        // try to forward execute getSignOnToken from our parent.\r\n        const now = Date.now();\r\n        const parentExecuter = this.forwardExecute<SignOnTokenRefresh>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.getSignOnToken, [now]);\r\n\r\n        if (parentExecuter) {\r\n            return this.signOnTokenAwaiter;\r\n        }\r\n\r\n        // since we could not forward the request We must ask for the signon token ourselves\r\n        this.signOnManager.requestSignOnRefresh().subscribe({\r\n            next: response => {\r\n                this.completeSignOnTokenAwaiter(response);\r\n                this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnToken, RpcForwarder.ensureSerializable(response));\r\n            },\r\n            error: error => {\r\n                this.completeSignOnTokenAwaiter(null, error);\r\n                this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnTokenError, RpcForwarder.ensureSerializable(error));\r\n            }\r\n        });\r\n\r\n        return this.signOnTokenAwaiter;\r\n    }\r\n\r\n    /**\r\n     * Forward Sign On Token to child frame.\r\n     */\r\n    public forwardSignOnToken(): void {\r\n        const data: SignOnTokenResponse = { time: Date.now(), token: this.signOnManager.signedHttpRequestToken };\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnToken, data);\r\n    }\r\n\r\n    /**\r\n     * @deprecated use createSecureToken() after configured gatewayJwk property.\r\n     *\r\n     * Creates a token from the given options that may be used for node authentication\r\n     * @param options The token creation options\r\n     */\r\n    public createToken(options: CreateAuthorizationTokenOptions, passwordEncryptedWith: string = null): AuthorizationToken {\r\n        // ensure a valid value for laps local admin name\r\n        if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n            options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n        }\r\n        // ensure username has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n            options.username = null;\r\n        }\r\n        if (options.useLaps || !options.username) {\r\n            return {\r\n                value: null,\r\n                username: null,\r\n                useLaps: options.useLaps,\r\n                lapsLocalAdminName: options.lapsLocalAdminName\r\n            };\r\n        }\r\n\r\n        // ensure password has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n            options.password = null;\r\n        }\r\n\r\n        let username: string[];\r\n        if (options.username.indexOf('@') >= 0) {\r\n            // domain is empty if UPN is used.\r\n            username = ['', options.username];\r\n        } else {\r\n            username = options.username.split('\\\\');\r\n        }\r\n\r\n        const token = Net.createEncodedAuthenticationHeader(username, options.password, passwordEncryptedWith);\r\n        return {\r\n            value: token,\r\n            username: options.username,\r\n            useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n            lapsLocalAdminName: null\r\n        };\r\n    }\r\n\r\n    /**\r\n     * Creates a secure token from the given options that may be used for node authentication\r\n     *\r\n     * @param options The token creation options\r\n     */\r\n    public createSecureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n        const forward = this.forwardExecute<AuthorizationToken>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.secureToken, [options]);\r\n        if (forward) {\r\n            return forward;\r\n        } else {\r\n            return this.secureToken(options);\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Get the saved Auth token for a node.\r\n     *\r\n     * @param nodeName The nodeName to get token for.\r\n     */\r\n    public getSavedNodeToken(nodeName: string): AuthorizationToken {\r\n        if (nodeName && this.nodeTokens[nodeName.toLocaleLowerCase()]) {\r\n            return this.nodeTokens[nodeName.toLocaleLowerCase()];\r\n        }\r\n\r\n        return this.manageAsToken;\r\n    }\r\n\r\n    /**\r\n     * Sets a token on the given nodes\r\n     * @param token The token to use for the given nodes\r\n     * @param nodeName The names of the nodes to set the token for. If empty or null, the token will be used as the global manageAs token\r\n     * @returns an Observable indicating that the token has been set.\r\n     */\r\n    public setNodeTokens(token: AuthorizationToken, nodeNames?: string[]): Observable<void> {\r\n        // if we have a parent instance, just forward it and return the result\r\n        const forward = this.forwardExecute<void>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.setNodeTokens, [token, nodeNames]);\r\n        if (forward) {\r\n            return forward;\r\n        }\r\n\r\n        // otherwise process the token\r\n        const childSetTokenResponse: AuthorizationTokenResponse = { token: token };\r\n        if (!nodeNames || !Array.isArray(nodeNames) || nodeNames.length === 0) {\r\n            this.manageAsToken = token;\r\n        } else {\r\n            childSetTokenResponse.appliesTo = nodeNames;\r\n            nodeNames.forEach(nodeName => (this.nodeTokens[nodeName.toLocaleLowerCase()] = token));\r\n        }\r\n        this.updateCache();\r\n\r\n        // notify all child instances of the token change.\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, childSetTokenResponse, true);\r\n\r\n        // return a null observable, indicating we are done.\r\n        return of(null);\r\n    }\r\n\r\n    /**\r\n     * Adds a authorization header to a request given a node with a manageAsToken\r\n     * @param request The request to add headers to\r\n     * @param nodeName optional. The node to add headers for if not provided, the global token will be used\r\n     * @param token optional. The token to use for the headers. if provided, the nodeName is not used.\r\n     */\r\n    public addAuthorizationRequestHeader(request: AjaxRequest, nodeName?: string, token?: AuthorizationToken) {\r\n        if (!token) {\r\n            token = this.getSavedNodeToken(nodeName);\r\n        }\r\n\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                (<any>request).headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n            } else {\r\n                // If not, we add useLaps header.\r\n                (<any>request).headers[headerConstants.USE_LAPS] = token.useLaps;\r\n                (<any>request).headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Create token headers.\r\n     *\r\n     * @param nodeName the node name.\r\n     * @param token the token to override current setting (optional).\r\n     */\r\n    public createTokenHeaders(nodeName: string, token?: AuthorizationToken): MsftSme.StringMap<string> {\r\n        const headers: MsftSme.StringMap<string> = {};\r\n        token = token || this.getSavedNodeToken(nodeName);\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n            } else {\r\n                // If not, we add useLaps header.\r\n                headers[headerConstants.USE_LAPS] = token.useLaps ? 'true' : 'false';\r\n                headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n            }\r\n        }\r\n\r\n        return headers;\r\n    }\r\n\r\n    /**\r\n     * Adds a authorization header to a request given a node with a manageAsToken\r\n     */\r\n    public addAuthorizationTokensToMultiPartBody(body: string[], nodeName?: string, token?: AuthorizationToken) {\r\n        if (!token) {\r\n            token = this.getSavedNodeToken(nodeName);\r\n        }\r\n\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                body.push(headerConstants.SME_AUTHORIZATION + ': ' + token.value);\r\n            } else {\r\n                // If not, we add useLaps header.\r\n                body.push(headerConstants.USE_LAPS + ': ' + token.useLaps);\r\n                body.push(headerConstants.LAPS_LOCALADMINNAME + ': ' + token.lapsLocalAdminName);\r\n            }\r\n        }\r\n    }\r\n\r\n    public resetAllTokens(): void {\r\n        this.manageAsToken = null;\r\n        this.nodePowershellEndpoints = {};\r\n        this.nodeTokens = {};\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, null);\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Encrypts a string value using the jwk from the gateway\r\n     */\r\n    public encrypt(value: string): Observable<string> {\r\n        const forward = this.forwardExecute<string>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.encrypt, [value]);\r\n        if (forward) {\r\n            return forward;\r\n        }\r\n\r\n        return Crypto.encryptRsaSha1(this.jwk, value);\r\n    }\r\n\r\n    /**\r\n     * Called on a child service instance when onForwardInit returns from the parent\r\n     * @param data The response from the forwardInit call\r\n     */\r\n    protected onForwardInitResponse(data: RpcForwardResponse<AuthorizationManagerInitProperties>): void {\r\n        if (data && data.error) {\r\n            // if there is an error, we cannot continue, so throw it\r\n            throw data.error;\r\n        }\r\n\r\n        this.manageAsToken = data.result.manageAsToken;\r\n        this.nodeTokens = data.result.nodeTokens;\r\n        this.nodePowershellEndpoints = data.result.nodePowershellEndpoints;\r\n        this.signOnManager.signedHttpRequestToken = data.result.signOnToken;\r\n    }\r\n\r\n    /**\r\n     * Called when a new instance of the service in another window is initialized and needs to synchronize with its parent\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @returns an observable for the all the values needed to initialize the service\r\n     */\r\n    protected onForwardInit(): Observable<AuthorizationManagerInitProperties> {\r\n        // authorization manager doesn't pass any properties to child services at this time.\r\n        return of(<AuthorizationManagerInitProperties>{\r\n            manageAsToken: this.manageAsToken,\r\n            nodeTokens: this.nodeTokens,\r\n            nodePowershellEndpoints: this.nodePowershellEndpoints,\r\n            signOnToken: this.signOnManager.signedHttpRequestToken\r\n        });\r\n    }\r\n\r\n    /**\r\n     * Called when the forwarded services counterpart wants to get data from the parent\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @param name The name of the method to forward to\r\n     * @param args The arguments of the method\r\n     * @returns an observable for the result of the method call\r\n     */\r\n    protected onForwardExecute(from: RpcRelationshipType, name: string, args: any[]): Observable<any> {\r\n        // command comes from child\r\n        if (from === RpcRelationshipType.Child) {\r\n            switch (name) {\r\n                case AuthorizationManager.rpcCommands.getNewToken: {\r\n                    // start getting the new token, but return immediately to avoid timeout\r\n                    const subscription = this.getNewToken(args ? args[0] : null, args ? args[1] : null).subscribe({\r\n                        next: () => subscription.unsubscribe(),\r\n                        error: error => {\r\n                            subscription.unsubscribe();\r\n                            this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, RpcForwarder.ensureSerializable(error));\r\n                        }\r\n                    });\r\n                    return of(null);\r\n                }\r\n                case AuthorizationManager.rpcCommands.secureToken: {\r\n                    const options = args && args[0];\r\n                    if (!options) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.secureToken(options);\r\n                }\r\n                case AuthorizationManager.rpcCommands.encrypt: {\r\n                    const options = args && args[0];\r\n                    if (!options) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.encrypt(options);\r\n                }\r\n                case AuthorizationManager.rpcCommands.setNodeTokens: {\r\n                    const token = args && args[0];\r\n                    const nodes = args && args[1];\r\n                    if (!token) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.setNodeTokens(token, nodes);\r\n                }\r\n                case AuthorizationManager.rpcCommands.getSignOnToken: {\r\n                    const subscription = this.refreshSignOnToken().subscribe({\r\n                        next: () => subscription.unsubscribe(),\r\n                        error: error => {\r\n                            (subscription.unsubscribe(),\r\n                                this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnTokenError, RpcForwarder.ensureSerializable(error)));\r\n                        }\r\n                    });\r\n                    return of(null);\r\n                }\r\n            }\r\n        }\r\n\r\n        // command comes from parent\r\n        if (from === RpcRelationshipType.Parent) {\r\n            if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {\r\n                this.nodeTokens = {};\r\n                this.nodePowershellEndpoints = {};\r\n                // if we also have children, forward the request on\r\n                const forward = this.forwardExecute(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, args);\r\n                return forward || of(null);\r\n            }\r\n        }\r\n\r\n        // command not implemented\r\n        return this.nameNotFound(name);\r\n    }\r\n\r\n    /**\r\n     * Called when the forwarded services counterpart sends a notify message\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @param name The name of the property to change\r\n     * @param value The new value of the property\r\n     * @returns an observable that completes when the property has been changed.\r\n     */\r\n    protected onForwardNotify(from: RpcRelationshipType, name: string, value: any): Observable<void> {\r\n        // allow our parent to give us a new token.\r\n        if (from === RpcRelationshipType.Parent) {\r\n            if (name === AuthorizationManager.rpcCommands.manageAsToken) {\r\n                this.manageAsToken = value;\r\n                // if we also have children, forward the notification on\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setNodeToken) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n                }\r\n\r\n                this.completeTokenAwaiter(value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setNodeTokenError) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n                }\r\n\r\n                this.completeTokenAwaiter(null, value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setJeaContext) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setJeaContext));\r\n                }\r\n\r\n                this.saveJeaContext(value.nodeName, value.endpoint);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setJeaContext, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setSignOnToken) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n                }\r\n\r\n                this.completeSignOnTokenAwaiter(value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setSignOnTokenError) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n                }\r\n\r\n                this.completeSignOnTokenAwaiter(null, value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnTokenError, value);\r\n                return forward || of(null);\r\n            }\r\n        }\r\n\r\n        return this.nameNotFound(name);\r\n    }\r\n\r\n    /**\r\n     * Creates a secure token from the given options that may be used for node authentication\r\n     *\r\n     * @param options The token creation options\r\n     */\r\n    private secureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n        // ensure a valid value for laps local admin name\r\n        if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n            options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n        }\r\n\r\n        // ensure username has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n            options.username = null;\r\n        }\r\n\r\n        if (options.useLaps || !options.username) {\r\n            return of({\r\n                value: null,\r\n                username: null,\r\n                useLaps: options.useLaps,\r\n                lapsLocalAdminName: options.lapsLocalAdminName\r\n            });\r\n        }\r\n\r\n        // ensure password has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n            options.password = null;\r\n        }\r\n\r\n        let username: string[];\r\n        if (options.username.indexOf('@') >= 0) {\r\n            // domain is empty if UPN is used.\r\n            username = ['', options.username];\r\n        } else {\r\n            username = options.username.split('\\\\');\r\n        }\r\n\r\n        const tokenData = {\r\n            value: undefined,\r\n            username: options.username,\r\n            useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n            lapsLocalAdminName: null\r\n        };\r\n\r\n        if (this.jwk) {\r\n            return Net.createEncryptedAuthenticationHeader(this.jwk, username, options.password, this.logOnUser, this.credentialsExpirationTimeInMs).pipe(\r\n                map(newToken => {\r\n                    tokenData.value = newToken;\r\n                    return tokenData;\r\n                })\r\n            );\r\n        }\r\n\r\n        tokenData.value = Net.createEncodedAuthenticationHeader(username, options.password);\r\n        return of(tokenData);\r\n    }\r\n\r\n    /**\r\n     * Completes the token awaiter\r\n     */\r\n    private completeTokenAwaiter(result: AuthorizationTokenResponse, error?: any) {\r\n        if (error) {\r\n            if (this.tokenAwaiter) {\r\n                const awaiter = this.tokenAwaiter;\r\n                this.tokenAwaiter = null;\r\n                awaiter.error(error);\r\n            }\r\n        } else {\r\n            if (!result.appliesTo) {\r\n                this.manageAsToken = result.token;\r\n            } else if (Array.isArray(result.appliesTo)) {\r\n                result.appliesTo.forEach(nodeName => {\r\n                    this.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;\r\n                });\r\n                this.updateCache();\r\n            } else {\r\n                this.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;\r\n                this.updateCache();\r\n            }\r\n\r\n            if (this.tokenAwaiter) {\r\n                const awaiter = this.tokenAwaiter;\r\n                this.tokenAwaiter = null;\r\n                awaiter.next(result);\r\n                awaiter.complete();\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Completes the sign on token awaiter\r\n     */\r\n    private completeSignOnTokenAwaiter(result: SignOnTokenResponse, error?: any) {\r\n        const awaiter = this.signOnTokenAwaiter;\r\n        if (awaiter) {\r\n            this.signOnTokenAwaiter = null;\r\n        }\r\n\r\n        if (error) {\r\n            if (awaiter) {\r\n                awaiter.error(error);\r\n            }\r\n\r\n            return;\r\n        }\r\n\r\n        if (result.token) {\r\n            this.signOnManager.signedHttpRequestToken = result.token;\r\n        } else {\r\n            Logging.logError('Shell.AuthorizationManager', 'Null token was passed.');\r\n        }\r\n\r\n        if (awaiter) {\r\n            awaiter.next(result);\r\n            awaiter.complete();\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Gets the error data.\r\n     * @param code the http status code.\r\n     * @param error the AJAX error object.\r\n     */\r\n    private getErrorData(code: HttpStatusCode, error: AjaxError): NodeAuthorizationErrorData {\r\n        return {\r\n            statusCode: code,\r\n            errorCode: error && error.xhr && error.xhr.response && error.xhr.response.error && error.xhr.response.error.code,\r\n            errorMessage: Net.getErrorMessage(error)\r\n        };\r\n    }\r\n\r\n    /**\r\n     * Updates the authorization cache. Does nothing if we are not running in shell\r\n     */\r\n    private updateCache(): void {\r\n        if (!MsftSme.isShell()) {\r\n            // ignore if not shell\r\n            return;\r\n        }\r\n        // update cached data\r\n        const cacheData: AuthorizationCacheData = {\r\n            jwk: this.jwk,\r\n            manageAsToken: this.manageAsToken,\r\n            nodePowershellEndpoints: this.nodePowershellEndpoints,\r\n            nodeTokens: this.nodeTokens\r\n        };\r\n\r\n        MsftSme.SessionStorageHandler.setItem(AuthorizationManager.cacheKey, JSON.stringify(cacheData));\r\n    }\r\n}\r\n"]}
+{"version":3,"file":"authorization-manager.js","sourceRoot":"","sources":["../../src/security/authorization-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3D,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAIpE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAA0B,aAAa,EAA2C,MAAM,mBAAmB,CAAC;AAkInH;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAgN7C;IAEA;IAjNZ;;OAEG;IACK,MAAM,CAAC,QAAQ,GAAG,+BAA+B,CAAC;IAE1D;;OAEG;IACI,MAAM,CAAC,yBAAyB,GAAG,eAAe,CAAC;IAElD,MAAM,CAAC,WAAW,GAAG;QACzB,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,eAAe;QAC9B,aAAa,EAAE,eAAe;QAC9B,iBAAiB,EAAE,mBAAmB;QACtC,aAAa,EAAE,eAAe;QAC9B,eAAe,EAAE,iBAAiB;QAClC,iBAAiB,EAAE,mBAAmB;QACtC,WAAW,EAAE,aAAa;QAC1B,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,SAAS;QAClB,cAAc,EAAE,gBAAgB;QAChC,cAAc,EAAE,gBAAgB;QAChC,mBAAmB,EAAE,qBAAqB;KAC7C,CAAC;IAEF;;OAEG;IACI,UAAU,CAAwC;IAEzD;;OAEG;IACI,aAAa,CAAgB;IAEpC;;OAEG;IACK,KAAK,CAAqB;IAElC;;OAEG;IACK,GAAG,CAAS;IAEpB;;OAEG;IACK,aAAa,CAAS;IAE9B;;OAEG;IACK,6BAA6B,CAAS;IAE9C;;OAEG;IACK,kCAAkC,CAAkB;IAE5D;;OAEG;IACI,2BAA2B,CAAqB;IAEvD;;;OAGG;IACH,IAAW,kBAAkB,CAAC,kBAA0B;QACpD,IAAI,CAAC,6BAA6B,GAAG,kBAAkB,CAAC;QACxD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACK,SAAS,CAAS;IAE1B;;OAEG;IACH,IAAW,cAAc,CAAC,QAAgB;QACtC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,uBAAuB,CAA4B;IAE3D;;OAEG;IACK,YAAY,CAAsC;IAE1D,kFAAkF;IAC1E,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAElD;;;OAGG;IACK,sBAAsB,GAAG,IAAI,GAAG,EAA+C,CAAC;IAExF;;OAEG;IACK,YAAY,GAA6C,EAAE,CAAC;IAEpE,gHAAgH;IACxG,gBAAgB,GAA0B,IAAI,CAAC;IAEvD,qGAAqG;IAC7F,gBAAgB,GAA0B,IAAI,CAAC;IAEvD;;OAEG;IACK,kBAAkB,CAA+B;IAEzD;;;OAGG;IACH,IAAW,aAAa,CAAC,KAAyB;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACrG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAW,aAAa;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAW,UAAU,CAAC,GAAW;QAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACa,iBAAiB,CAAqB;IAEtD;;OAEG;IACK,wBAAwB,CAAkB;IAElD;;OAEG;IACH,IAAW,UAAU;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAED;;;OAGG;IACI,gBAAgB,CAAC,MAAc;QAClC,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO;QACX,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAW,WAAW;QAClB,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACjD,0BAA0B;YAC1B,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QAED,0BAA0B;QAC1B,OAAO,EAAE,CAA6B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;OAKG;IACH,YACY,SAAmC,EAC3C,GAAQ,EACA,UAAuC,EAAE;QAEjD,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAJ5B,cAAS,GAAT,SAAS,CAA0B;QAEnC,YAAO,GAAP,OAAO,CAAkC;QAGjD,IAAI,CAAC,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,CAAC;QAEtE,IAAI,CAAC,kCAAkC,GAAG,IAAI,OAAO,EAAU,CAAC;QAChE,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC,kCAAkC,CAAC,YAAY,EAAE,CAAC;QAE1F,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpB,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAE9F,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC;oBACD,MAAM,UAAU,GAA2B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACxE,iCAAiC;oBACjC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC;oBACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC;oBAClC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;oBAClD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC;oBACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC9C,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,IAAI,EAAE,CAAC;oBACxE,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBAC5E,CAAC;YACL,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,iBAAiB,CAAC,SAAqC,EAAE,UAAkB;QACrF,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,OAAO,EAAE,GAAG,CAAC,SAAS,IAAgC,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;IAC3F,CAAC;IAED;;OAEG;IACI,oBAAoB,CAAC,IAAoB,EAAE,KAAgB;QAC9D,kIAAkI;QAClI,OAAO,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,iBAAiB,CAAC,IAAoB,EAAE,OAAoB,EAAE,KAAgB,EAAE,QAAiB;QACpG,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAChB,+FAA+F;YAC/F,4DAA4D;YAC5D,oDAAoD;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;YACjC,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE,CAAC;gBACjB,8CAA8C;gBAC9C,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,mDAAmD;gBACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,CAAC;QACL,CAAC,CAAC,CACL,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,QAA2B;QACrD,sBAAsB;QACtB,OAAO,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,0CAAgC,CAAC;IACzG,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,QAAgB,EAAE,OAAyB,EAAE,QAAsD;QAC1H,IAAI,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAChC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAA+B;YAC1C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;YACxC,SAAS,EAAE,cAAc;YACzB,YAAY,EAAE,OAAO;SACxB,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/B,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvG,IAAI,cAAc,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,KAAK,EAAE,CAAC;oBACR,IAAI,OAAO,EAAE,CAAC;wBACV,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;oBAC9B,CAAC;yBAAM,CAAC;wBACJ,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;oBACnC,CAAC;gBACL,CAAC;gBAED,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACjE,CAAC;QACL,CAAC,CAAC,CACL,CAAC;IACN,CAAC;IAEM,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,OAAO,CAAC,KAAK,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9I,CAAC;IAEM,cAAc,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACpD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,QAAQ,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAWM,WAAW,CAAC,SAA6B,EAAE,SAAsC;QACpF,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9F,CAAC;IAEO,eAAe,CACnB,SAA4B,EAC5B,SAAqC,EACrC,YAAoB,EACpB,UAAmB;QAEnB,kGAAkG;QAClG,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClB,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;YACvC,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACb,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,CAAC;QACL,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QAC1B,CAAC;QAED,6CAA6C;QAC7C,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAAG,IAAI,OAAO,EAA8B,CAAC;QAC1D,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAE9C,qDAAqD;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,qCAAmC,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAEnJ,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,6DAA6D;QAC7D,uFAAuF;QACvF,IAAI,SAAS,EAAE,CAAC;YACZ,KAAK,MAAM,IAAI,IAAc,SAAS,EAAE,CAAC;gBACrC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;QACL,CAAC;QAED,kFAAkF;QAClF,MAAM,kBAAkB,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,IAAgC,EAAE,CAAC,EAAE,cAAc,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrK,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC;aACxC,IAAI,CACD,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,wEAAwE;YACxE,IAAI,WAAW,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;gBACrF,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;gBACrH,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;gBAChD,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC,CAAC,EACF,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;YACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;aACrD,CAAC,CAAC,IAAI,CACH,GAAG,CAAC,KAAK,CAAC,EAAE;gBACR,MAAM,QAAQ,GAA+B;oBACzC,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,SAAS;iBACvB,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACR,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;gBAC3B,CAAC;gBAED,OAAO,QAAQ,CAAC;YACpB,CAAC,CAAC,CACL,CAAC;QACN,CAAC,CAAC,EACF,QAAQ,CAAC,MAAM,CAAC,EAAE;YACd,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACpC,oFAAoF;gBACpF,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAO,MAAM,CAAC,KAAK,EAAE,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;gBACxH,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3C,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,mDAAmD;QACnD,+DAA+D;QAC/D,IAAI,CAAC,CAAC,CAAC,CACV;aACA,SAAS,CAAC;YACP,IAAI,EAAE,MAAM,CAAC,EAAE;gBACX,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;oBAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBAC9D,IAAI,OAAO,EAAE,CAAC;wBACV,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;wBACjD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACvB,CAAC;oBACD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,EAAE,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAClG,OAAO;gBACX,CAAC;gBAED,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;gBACtD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzE,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC1F,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAC/G,CAAC;YACD,KAAK,EAAE,KAAK,CAAC,EAAE;gBACX,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBAChE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;gBACrD,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACjE,CAAC;SACJ,CAAC,CAAC;QAEP,OAAO,OAAO,CAAC;IACnB,CAAC;IAEM,kBAAkB;QACrB,kGAAkG;QAClG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACnC,CAAC;QAED,wDAAwD;QACxD,IAAI,CAAC,kBAAkB,GAAG,IAAI,OAAO,EAAuB,CAAC;QAE7D,yDAAyD;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,qCAAiD,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnJ,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACnC,CAAC;QAED,oFAAoF;QACpF,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC,SAAS,CAAC;YAChD,IAAI,EAAE,QAAQ,CAAC,EAAE;gBACb,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;gBAC1C,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9I,CAAC;YACD,KAAK,EAAE,KAAK,CAAC,EAAE;gBACX,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7C,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAChJ,CAAC;SACJ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACnC,CAAC;IAED;;OAEG;IACI,kBAAkB;QACrB,MAAM,IAAI,GAAwB,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC;QACzG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACzG,CAAC;IAED;;;;;OAKG;IACI,WAAW,CAAC,OAAwC,EAAE,wBAAgC,IAAI;QAC7F,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;QAChF,CAAC;QACD,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO;gBACH,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC;QACN,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,kCAAkC;YAClC,QAAQ,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACvG,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK,EAAE,4EAA4E;YAC5F,kBAAkB,EAAE,IAAI;SAC3B,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,OAAwC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,qCAAiD,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7I,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,OAAO,CAAC;QACnB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,QAAgB;QACrC,MAAM,kBAAkB,GAAG,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,IAAI,kBAAkB,IAAI,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7E,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YAChE,CAAC;YAED,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAC/C,CAAC;QACL,CAAC;QAED,IAAI,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,KAAyB,EAAE,SAAoB;QAChE,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,qCAAmC,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1I,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,8BAA8B;QAC9B,MAAM,qBAAqB,GAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC/B,CAAC;aAAM,CAAC;YACJ,qBAAqB,CAAC,SAAS,GAAG,SAAS,CAAC;YAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,kDAAkD;QAClD,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAE1H,oDAAoD;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAoB,EAAE,QAAiB,EAAE,KAA0B;QACpG,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,0FAA0F;gBACpF,OAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACJ,iCAAiC;gBAC3B,OAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC3D,OAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC3F,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,kBAAkB,CAAC,QAAgB,EAAE,KAA0B;QAClE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,0FAA0F;gBAC1F,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACJ,iCAAiC;gBACjC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrE,OAAO,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC5E,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACI,qCAAqC,CAAC,IAAc,EAAE,QAAiB,EAAE,KAA0B;QACtG,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,0FAA0F;gBAC1F,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,iCAAiC;gBACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,GAAG,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACrF,CAAC;QACL,CAAC;IACL,CAAC;IAEM,cAAc;QACjB,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACxG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,qCAAqC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3H,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACO,qBAAqB,CAAC,IAA4D;QACxF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;QACnE,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACpE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACpE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB;YACzC,CAAC,CAAC;gBACI,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,UAAU,EAAE,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE;aAC7C;YACH,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACO,aAAa,CAAC,UAAmB;QACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChI,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QACnG,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1F,OAAO,EAAE,CAAqC;YAC1C,aAAa,EAAE,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,mBAAmB;YACtE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YACxI,YAAY,EAAE,MAAM;gBAChB,CAAC,CAAC;oBACI,aAAa,EAAE,mBAAmB;oBAClC,UAAU,EAAE,gBAAgB;iBAC/B;gBACH,CAAC,CAAC,SAAS;YACf,iGAAiG;YACjG,uBAAuB,EAAE,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB;YAC3F,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB;YACtD,YAAY,EAAE,MAAM,IAAI,IAAI;SAC/B,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACO,gBAAgB,CAAC,IAAyB,EAAE,IAAY,EAAE,IAAW,EAAE,UAAmB;QAChG,2BAA2B;QAC3B,IAAI,IAAI,sCAA8B,EAAE,CAAC;YACrC,QAAQ,IAAI,EAAE,CAAC;gBACX,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;oBAChD,MAAM,SAAS,GAAG,oBAAoB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;oBAC5F,2GAA2G;oBAC3G,MAAM,iBAAiB,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,UAAU,CAAC;oBAChF,MAAM,YAAY,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrF,uEAAuE;oBACvE,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC;wBAC5G,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE;wBACtC,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE;qBAC1C,CAAC,CAAC;oBACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;oBAChD,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;oBACpB,CAAC;oBAED,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC5C,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;oBACpB,CAAC;oBAED,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACjC,CAAC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;oBAClD,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;wBACT,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;oBACpB,CAAC;oBAED,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBACD,KAAK,oBAAoB,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;oBACnD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC,SAAS,CAAC;wBACrD,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE;wBACtC,KAAK,EAAE,KAAK,CAAC,EAAE;4BACX,CAAC,YAAY,CAAC,WAAW,EAAE;gCACvB,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBACrJ,CAAC;qBACJ,CAAC,CAAC;oBACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACL,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,IAAI,IAAI,uCAA+B,EAAE,CAAC;YACtC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;gBAC5D,kFAAkF;gBAClF,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACxB,IAAI,CAAC,gBAAgB,CAAC,UAAU,GAAG,EAAE,CAAC;oBACtC,IAAI,CAAC,4BAA4B,EAAE,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACzB,CAAC;gBACD,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAClC,mDAAmD;gBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACvH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACO,eAAe,CAAC,IAAyB,EAAE,IAAY,EAAE,KAAU;QACzE,2CAA2C;QAC3C,IAAI,IAAI,uCAA+B,EAAE,CAAC;YACtC,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC1D,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACxB,IAAI,CAAC,gBAAgB,CAAC,aAAa,GAAG,KAAK,CAAC;oBAC5C,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;oBAClC,IAAI,CAAC,4BAA4B,EAAE,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;gBAC/B,CAAC;gBACD,wDAAwD;gBACxD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;gBAC9D,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACzH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,iGAAiG;YACjG,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;gBAC5D,kFAAkF;gBAClF,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACxB,IAAI,CAAC,gBAAgB,CAAC,UAAU,GAAG,EAAE,CAAC;oBACtC,IAAI,CAAC,4BAA4B,EAAE,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;gBACzB,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;gBACvH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC3F,CAAC;gBAED,MAAM,QAAQ,GAA+B,KAAK,CAAC;gBACnD,IAAI,QAAQ,CAAC,iBAAiB,IAAI,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzG,yFAAyF;oBACzF,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBACxB,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;4BACtB,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;wBACxC,CAAC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC3C,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gCAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;4BACnE,CAAC,CAAC,CAAC;4BACH,IAAI,CAAC,WAAW,EAAE,CAAC;wBACvB,CAAC;6BAAM,CAAC;4BACJ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;4BACzE,IAAI,CAAC,WAAW,EAAE,CAAC;wBACvB,CAAC;oBACL,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBACxC,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACpH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAChG,CAAC;gBAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACzH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACrH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC3F,CAAC;gBAED,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;gBACtH,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,IAAI,KAAK,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBAChE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;oBAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAChG,CAAC;gBAED,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBAC3H,OAAO,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,OAAwC;QACxD,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,CAAC,yBAAyB,CAAC;QAChF,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,EAAE,CAAC;gBACN,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aACjD,CAAC,CAAC;QACP,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,kCAAkC;YAClC,QAAQ,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,SAAS,GAAG;YACd,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK,EAAE,4EAA4E;YAC5F,kBAAkB,EAAE,IAAI;SAC3B,CAAC;QAEF,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO,GAAG,CAAC,mCAAmC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC,IAAI,CACzI,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACX,SAAS,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,CACL,CAAC;QACN,CAAC;QAED,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,MAAkC,EAAE,KAAW,EAAE,YAAY,GAAG,EAAE;QAC3F,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;YACjG,IAAI,OAAO,EAAE,CAAC;gBACV,IAAI,YAAY,EAAE,CAAC;oBACf,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC7B,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACxC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBACzB,IAAI,CAAC,gBAAgB,GAAG;4BACpB,aAAa,EAAE,IAAI,CAAC,KAAK;4BACzB,UAAU,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE;yBAC7C,CAAC;wBACF,IAAI,CAAC,gBAAgB,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;oBAC/C,CAAC;oBACD,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;oBAC/D,IAAI,CAAC,4BAA4B,EAAE,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;gBAC/C,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBACpB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;gBACtC,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;wBAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;oBACjE,CAAC,CAAC,CAAC;oBACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;oBACrE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvB,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;YACjG,IAAI,OAAO,EAAE,CAAC;gBACV,IAAI,YAAY,EAAE,CAAC;oBACf,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC7B,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvB,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CAAC,MAA6B,EAAE,MAAkC;QACvF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;YACpC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1F,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YACzB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACnE,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,MAAkC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACrE,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;QACzC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,4BAA4B;QAChC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACzB,OAAO;QACX,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,IAAI,WAAW,CAAC,aAAa,CAAC;QAC9E,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;IACzK,CAAC;IAED;;OAEG;IACK,kBAAkB;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC1C,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO;QACX,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC;IACpD,CAAC;IAED;;OAEG;IACK,6BAA6B,CAAC,MAAkC;QACpE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACpB,WAAW,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAChC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;YACxE,CAAC,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QAChF,CAAC;QAED,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,SAAqC;QAChE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAEO,yBAAyB;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC;QACzE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,WAAqC,EAAE,YAAoB;QAClF,OAAO,WAAW,IAAI,WAAW,CAAC,gBAAgB,IAAI,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,CAAC;IAEO,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;QACjG,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAEO,iBAAiB,CAAC,YAAoB,EAAE,OAA4C;QACxF,IAAI,YAAY,EAAE,CAAC;YACf,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAChC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,YAAoB,EAAE,KAAU,EAAE,gBAA0B;QACjF,MAAM,KAAK,GAAG,YAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,YAAY,EAAE,CAAC;YACf,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC1G,CAAC;aAAM,IAAI,IAAI,CAAC,yBAAyB,EAAE,EAAE,CAAC;YAC1C,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,UAAU,EAAE,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;QAChJ,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,aAAa,oCAA4B,oBAAoB,CAAC,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC7G,CAAC;IACL,CAAC;IAED;;OAEG;IACK,0BAA0B,CAAC,MAA2B,EAAE,KAAW;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;YAED,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,MAAM,CAAC,KAAK,CAAC;QAC7D,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,QAAQ,CAAC,4BAA4B,EAAE,wBAAwB,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,IAAoB,EAAE,KAAgB;QACvD,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;YAChH,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;SAC3C,CAAC;IACN,CAAC;IAED;;OAEG;IACK,WAAW;QACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,sBAAsB;YACtB,OAAO;QACX,CAAC;QACD,qBAAqB;QACrB,MAAM,SAAS,GAA2B;YACtC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;SAClC,CAAC;QAEF,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACpG,CAAC","sourcesContent":["import { Observable, of, Subject, throwError } from 'rxjs';\r\nimport { AjaxError, AjaxRequest } from 'rxjs/ajax';\r\nimport { map, mergeMap, take } from 'rxjs/operators';\r\nimport { CimStreamOptions, CimStreamResponse } from '../data/cim-stream';\r\nimport { Crypto } from '../data/crypto';\r\nimport { headerConstants, HttpStatusCode } from '../data/http-constants';\r\nimport { Net } from '../data/net';\r\nimport { PowerShellStreamResponse } from '../data/powershell-stream';\r\nimport { Logging } from '../diagnostics/logging';\r\nimport { Strings } from '../generated/strings';\r\nimport { EnvironmentModule } from '../manifest/environment-modules';\r\nimport { RpcForwardResponse } from '../rpc/forward/rpc-forward-model';\r\nimport { Rpc } from '../rpc/rpc';\r\nimport { RpcRelationshipType } from '../rpc/rpc-base';\r\nimport { RpcForwarder, RpcServiceForwarder } from '../rpc/rpc-forwarder';\r\nimport { SignedHttpRequestToken, SignOnManager, SignOnTokenRefresh, SignOnTokenResponse } from './sign-on-manager';\r\n\r\n/**\r\n * Defines the response from an Authorization Handler\r\n */\r\nexport interface AuthorizationCredentials {\r\n    username: string;\r\n    password: string;\r\n    applyToAllNodes?: boolean;\r\n    useLaps?: boolean;\r\n    lapsLocalAdminName?: string;\r\n    /**\r\n     * When true, the credentials apply only to the RPC requester identified by errorData.requesterName,\r\n     * instead of to every tool. Honored only when requester scoping is enabled on the AuthorizationManager.\r\n     */\r\n    scopeToRequester?: boolean;\r\n}\r\n\r\n/**\r\n * Defines the response the AuthorizationManager returns from getToken\r\n */\r\nexport interface AuthorizationTokenResponse {\r\n    token: AuthorizationToken;\r\n    appliesTo?: string | string[];\r\n    /**\r\n     * The requester name the token is scoped to. When set, only child frames with that RPC name receive the token.\r\n     */\r\n    scope?: string;\r\n    /**\r\n     * Set by the shell on shared tokens sent to child frames: the names of requesters whose own credential request is still pending.\r\n     * Those child instances save the shared token but keep waiting for their own result.\r\n     */\r\n    pendingRequesters?: string[];\r\n}\r\n\r\n/**\r\n * Defines an authorizationToken\r\n */\r\nexport interface AuthorizationToken {\r\n    value: string;\r\n    username: string;\r\n    useLaps: boolean;\r\n    lapsLocalAdminName: string;\r\n}\r\n\r\n/**\r\n * The create authorization token options\r\n */\r\nexport interface CreateAuthorizationTokenOptions {\r\n    password?: string;\r\n    username?: string;\r\n    useLaps?: boolean;\r\n    lapsLocalAdminName?: string;\r\n}\r\n\r\n/**\r\n * The extra error data of original cause.\r\n */\r\nexport interface NodeAuthorizationErrorData {\r\n    statusCode: HttpStatusCode;\r\n    errorCode: string;\r\n    errorMessage: string;\r\n    /**\r\n     * The RPC name of the child that originated the credential request.\r\n     * Set by the shell-side AuthorizationManager from the RPC source; values supplied by the child itself are ignored.\r\n     */\r\n    requesterName?: string;\r\n    /**\r\n     * Effective requester scope supplied to the authorize callback by this manager.\r\n     * Null when the request cannot be scoped. Only populated by shells that enable requester scoping.\r\n     */\r\n    requesterScope?: string | null;\r\n}\r\n\r\n/**\r\n * Defines a handler that takes a nodeName and returns authorization credentials\r\n */\r\nexport type NodeAuthorizationHandler = (nodeName?: string | string[], errorData?: NodeAuthorizationErrorData) => Observable<AuthorizationCredentials>;\r\n\r\n/**\r\n * A global token and node-specific tokens that form one authorization state layer.\r\n */\r\nexport interface AuthorizationTokenSet {\r\n    manageAsToken?: AuthorizationToken;\r\n    nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n}\r\n\r\n/**\r\n * Options for the AuthorizationManager.\r\n */\r\nexport interface AuthorizationManagerOptions {\r\n    /**\r\n     * Returns true when credential requests from child frames are tracked separately per requester,\r\n     * so that credentials returned with scopeToRequester apply only to that requester.\r\n     * Evaluated on each request. Defaults to off.\r\n     */\r\n    isRequesterScopingEnabled?: () => boolean;\r\n}\r\n\r\n/**\r\n * Defines properties that will be provided to child instances on a forward init request\r\n */\r\nexport interface AuthorizationManagerInitProperties {\r\n    manageAsToken: AuthorizationToken;\r\n    nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n    /**\r\n     * Shared credentials retained by scoped-aware child instances so they can be restored when scoped credentials clear.\r\n     */\r\n    sharedTokens?: AuthorizationTokenSet;\r\n    nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n    signOnToken: SignedHttpRequestToken;\r\n    /**\r\n     * The credentials scoped to the initializing child.\r\n     */\r\n    scopedTokens?: AuthorizationTokenSet;\r\n}\r\n\r\n/**\r\n * Representation of authorization cache data structure\r\n */\r\ninterface AuthorizationCacheData {\r\n    gatewayOrigin?: string;\r\n    jwk?: string;\r\n    nodeTokens?: MsftSme.StringMap<AuthorizationToken>;\r\n    manageAsToken?: AuthorizationToken;\r\n    nodePowershellEndpoints?: MsftSme.StringMap<string>;\r\n    logOnUser?: string;\r\n    scopedTokens?: MsftSme.StringMap<AuthorizationTokenSet>;\r\n}\r\n\r\n/**\r\n * Authorization Manager class. Handles SME authentication for service requests.\r\n */\r\nexport class AuthorizationManager extends RpcServiceForwarder {\r\n    /**\r\n     * Cache key for session storage of authorization cache\r\n     */\r\n    private static cacheKey = 'AuthorizationManager.cache.v1';\r\n\r\n    /**\r\n     * If no laps local admin name is defined, it will default to 'administrator'\r\n     */\r\n    public static defaultLapsLocalAdminName = 'administrator';\r\n\r\n    private static rpcCommands = {\r\n        setNodeToken: 'setNodeToken',\r\n        setNodeTokens: 'setNodeTokens',\r\n        manageAsToken: 'manageAsToken',\r\n        setNodeTokenError: 'setNodeTokenError',\r\n        setJeaContext: 'setJeaContext',\r\n        clearNodeTokens: 'clearNodeTokens',\r\n        clearScopedTokens: 'clearScopedTokens',\r\n        getNewToken: 'getNewToken',\r\n        secureToken: 'secureToken',\r\n        encrypt: 'encrypt',\r\n        getSignOnToken: 'getSignOnToken',\r\n        setSignOnToken: 'setSignOnToken',\r\n        setSignOnTokenError: 'setSignOnTokenError'\r\n    };\r\n\r\n    /**\r\n     * Create a map of nodeNames to token objects to hold node specific tokens.\r\n     */\r\n    public nodeTokens: MsftSme.StringMap<AuthorizationToken>;\r\n\r\n    /**\r\n     * The sign on operation manager.\r\n     */\r\n    public signOnManager: SignOnManager;\r\n\r\n    /**\r\n     * The backing store fro the manageAsToken\r\n     */\r\n    private token: AuthorizationToken;\r\n\r\n    /**\r\n     * The JSON Web Key. Single string with JSON.stringify format.\r\n     */\r\n    private jwk: string;\r\n\r\n    /**\r\n     * The canonical origin that owns the cached credentials.\r\n     */\r\n    private gatewayOrigin: string;\r\n\r\n    /**\r\n     * Credentials expiration time, used to determine the lifetime of new tokens. Value in milliseconds.\r\n     */\r\n    private credentialsExpirationTimeInMs: number;\r\n\r\n    /**\r\n     * Underlying implementation subject for credentialExpiration observable\r\n     */\r\n    private credentialExpirationChangedSubject: Subject<number>;\r\n\r\n    /**\r\n     * Observable that emits whenever the credentials expiration has changed\r\n     */\r\n    public credentialExpirationChanged: Observable<number>;\r\n\r\n    /**\r\n     * Set the admin configured expiration time in milliseconds\r\n     * If this is not set it will be defaulted to 365 days.\r\n     */\r\n    public set authExpirationInMs(expirationTimeInMs: number) {\r\n        this.credentialsExpirationTimeInMs = expirationTimeInMs;\r\n        this.credentialExpirationChangedSubject.next(expirationTimeInMs);\r\n    }\r\n\r\n    /**\r\n     * The logon user returned by gateway's api/user\r\n     */\r\n    private logOnUser: string;\r\n\r\n    /**\r\n     * Sets logon user and caches the value\r\n     */\r\n    public set shellLogOnUser(username: string) {\r\n        this.logOnUser = username;\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * The mapping of connections to PowershellEndpoints\r\n     */\r\n    private nodePowershellEndpoints: MsftSme.StringMap<string>;\r\n\r\n    /**\r\n     * The token awaiter subject.\r\n     */\r\n    private tokenAwaiter: Subject<AuthorizationTokenResponse>;\r\n\r\n    /** Direct child frames participating in the current shared credential request. */\r\n    private sharedTokenRequesters = new Set<string>();\r\n\r\n    /**\r\n     * Token awaiters for credential requests from specific child requesters, keyed by requester RPC name.\r\n     * Used only when requester scoping is enabled, so one requester's prompt is never shared with another.\r\n     */\r\n    private requesterTokenAwaiters = new Map<string, Subject<AuthorizationTokenResponse>>();\r\n\r\n    /**\r\n     * Shell instance only: credentials that apply to a single requester, keyed by requester RPC name.\r\n     */\r\n    private scopedTokens: MsftSme.StringMap<AuthorizationTokenSet> = {};\r\n\r\n    /** Child-only scoped tokens that currently take precedence over shared tokens in the effective public state. */\r\n    private scopedTokenState: AuthorizationTokenSet = null;\r\n\r\n    /** Child-only shared tokens retained beneath scoped tokens and restored when scoped state clears. */\r\n    private sharedTokenState: AuthorizationTokenSet = null;\r\n\r\n    /**\r\n     * The subject observable of sign on token awaiter.\r\n     */\r\n    private signOnTokenAwaiter: Subject<SignOnTokenResponse>;\r\n\r\n    /**\r\n     * Sets the current manage as token\r\n     * If running with an Rpc child, notify of the change\r\n     */\r\n    public set manageAsToken(token: AuthorizationToken) {\r\n        this.token = token;\r\n        this.nodePowershellEndpoints = {};\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, token);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Gets the current manage as token\r\n     */\r\n    public get manageAsToken(): AuthorizationToken {\r\n        return this.token;\r\n    }\r\n\r\n    /**\r\n     * Sets the gateway encryption certificate JWK.\r\n     * If this is not set by Shell/Add-Connection, it will send clear text password.\r\n     */\r\n    public set gatewayJwk(jwk: string) {\r\n        if (this.jwk !== jwk) {\r\n            this.resetAllTokens();\r\n        }\r\n        this.jwk = jwk;\r\n        this.gatewayJwkChangedSubject.next(jwk);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Observable that emits whenever the gateways Jwk has changed\r\n     */\r\n    public readonly gatewayJwkChanged: Observable<string>;\r\n\r\n    /**\r\n     * Underlying implementation subject for gatewayJwkChanged observable\r\n     */\r\n    private gatewayJwkChangedSubject: Subject<string>;\r\n\r\n    /**\r\n     * Gets the gateway encryption certificate JWK.\r\n     */\r\n    public get gatewayJwk() {\r\n        return this.jwk;\r\n    }\r\n\r\n    /**\r\n     * Binds cached credentials to a canonical gateway origin.\r\n     * Credentials and gateway encryption state are cleared before a changed origin is recorded.\r\n     */\r\n    public setGatewayOrigin(origin: string): void {\r\n        if (this.gatewayOrigin === origin) {\r\n            return;\r\n        }\r\n\r\n        this.resetAllTokens();\r\n        this.jwk = null;\r\n        this.gatewayJwkChangedSubject.next(null);\r\n        this.gatewayOrigin = origin;\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Gets an observable the emits when the authorization token is ready\r\n     */\r\n    public get authAwaiter() {\r\n        if (this.tokenAwaiter && !this.tokenAwaiter.closed) {\r\n            // return the global token\r\n            return this.tokenAwaiter;\r\n        }\r\n\r\n        // return the global token\r\n        return of(<AuthorizationTokenResponse>{ appliesTo: null, token: this.manageAsToken });\r\n    }\r\n\r\n    /**\r\n     * Initializes a new instance of the Authorization Manager class\r\n     * @param authorize An AuthorizationHandler with which to retrieve user credentials\r\n     * @param rpc The rpc to forward auth requests to a parent window\r\n     * @param options Optional behavior switches\r\n     */\r\n    constructor(\r\n        private authorize: NodeAuthorizationHandler,\r\n        rpc: Rpc,\r\n        private options: AuthorizationManagerOptions = {}\r\n    ) {\r\n        super('authorization-manager', rpc);\r\n        this.gatewayJwkChangedSubject = new Subject<string>();\r\n        this.gatewayJwkChanged = this.gatewayJwkChangedSubject.asObservable();\r\n\r\n        this.credentialExpirationChangedSubject = new Subject<number>();\r\n        this.credentialExpirationChanged = this.credentialExpirationChangedSubject.asObservable();\r\n\r\n        this.nodeTokens = {};\r\n        this.nodePowershellEndpoints = {};\r\n        if (MsftSme.isShell()) {\r\n            // attempt to restore from storage if this is a shell instance\r\n            const cachedDataString = MsftSme.SessionStorageHandler.getItem(AuthorizationManager.cacheKey);\r\n\r\n            if (!MsftSme.isNullOrWhiteSpace(cachedDataString)) {\r\n                try {\r\n                    const cachedData: AuthorizationCacheData = JSON.parse(cachedDataString);\r\n                    // verify data and set properties\r\n                    this.gatewayOrigin = cachedData.gatewayOrigin || null;\r\n                    this.jwk = cachedData.jwk || null;\r\n                    this.scopedTokens = cachedData.scopedTokens || {};\r\n                    this.manageAsToken = cachedData.manageAsToken || null;\r\n                    this.nodeTokens = cachedData.nodeTokens || {};\r\n                    this.nodePowershellEndpoints = cachedData.nodePowershellEndpoints || {};\r\n                    this.logOnUser = cachedData.logOnUser;\r\n                } catch (error) {\r\n                    MsftSme.SessionStorageHandler.removeItem(AuthorizationManager.cacheKey);\r\n                }\r\n            }\r\n        }\r\n\r\n        this.signOnManager = new SignOnManager(() => this.refreshSignOnToken());\r\n    }\r\n\r\n    /**\r\n     * Attributes requests to direct children, preserving requester names relayed by hosted shells.\r\n     * Creates requester-only error data when the caller supplies none.\r\n     *\r\n     * @param errorData the error data received from the child, if any.\r\n     * @param sourceName the RPC name of the direct child that sent the request.\r\n     */\r\n    public static withRequesterName(errorData: NodeAuthorizationErrorData, sourceName: string): NodeAuthorizationErrorData {\r\n        if (!sourceName || EnvironmentModule.isShellName(sourceName)) {\r\n            return errorData;\r\n        }\r\n\r\n        return { ...(errorData || <NodeAuthorizationErrorData>{}), requesterName: sourceName };\r\n    }\r\n\r\n    /**\r\n     * defines the conditions under which the AuthorizationManager can handle an ajax error\r\n     */\r\n    public canHandleAjaxFailure(code: HttpStatusCode, error: AjaxError) {\r\n        // we can handle ajax errors if we have a getter defined, and the code is Unauthorized (401) or we get a cim authorization failure\r\n        return this.authorize && Net.isUnauthorized(error);\r\n    }\r\n\r\n    /**\r\n     * When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n     */\r\n    public handleAjaxFailure(code: HttpStatusCode, request: AjaxRequest, error: AjaxError, nodeName?: string): Observable<AjaxRequest> {\r\n        const errorData = this.getErrorData(code, error);\r\n\r\n        return this.getNewToken(nodeName, errorData).pipe(\r\n            mergeMap(response => {\r\n                // There may be multiple nodes requesting authentication, but we can only ask the user for one.\r\n                // check if the result if for our node, otherwise try again.\r\n                // It looks for inside of array only for first name.\r\n                const names = response.appliesTo;\r\n                const isTokenForNode = !names || names === nodeName || (Array.isArray(names) && names[0] === nodeName);\r\n                if (isTokenForNode) {\r\n                    // this token applies to our node, so continue\r\n                    this.addAuthorizationRequestHeader(request, nodeName);\r\n                    return of(request);\r\n                } else {\r\n                    // this token did not apply to our node. Ask again.\r\n                    return this.handleAjaxFailure(code, request, error, nodeName);\r\n                }\r\n            })\r\n        );\r\n    }\r\n\r\n    /**\r\n     * Check if it can handle the error.\r\n     *\r\n     * @param response the response of CIM stream query.\r\n     */\r\n    public canHandleStreamFailure(response: CimStreamResponse): boolean {\r\n        // access denied case.\r\n        return response && response.response && response.response.statusCode === HttpStatusCode.Unauthorized;\r\n    }\r\n\r\n    /**\r\n     * When canHandle returns true for an ajax error, this method can be called to handle that error.\r\n     */\r\n    public handleStreamFailure(nodeName: string, options: CimStreamOptions, response: CimStreamResponse | PowerShellStreamResponse): Observable<CimStreamOptions> {\r\n        let message = response.response.error && response.response.error.message;\r\n        if (!message) {\r\n            const errors = response.response.errors;\r\n            if (errors && errors.length > 0) {\r\n                message = errors[0].message;\r\n            }\r\n        }\r\n        const errorData: NodeAuthorizationErrorData = {\r\n            statusCode: response.response.statusCode,\r\n            errorCode: 'Unauthorized',\r\n            errorMessage: message\r\n        };\r\n        return this.getNewToken(nodeName, errorData).pipe(\r\n            mergeMap(result => {\r\n                const names = result.appliesTo;\r\n                const isTokenForNode = !names || names === nodeName || (Array.isArray(names) && names[0] === nodeName);\r\n                if (isTokenForNode) {\r\n                    const token = this.getSavedNodeToken(nodeName);\r\n                    if (token) {\r\n                        if (options) {\r\n                            options.authToken = token;\r\n                        } else {\r\n                            options = { authToken: token };\r\n                        }\r\n                    }\r\n\r\n                    return of(options);\r\n                } else {\r\n                    return this.handleStreamFailure(nodeName, options, response);\r\n                }\r\n            })\r\n        );\r\n    }\r\n\r\n    public saveJeaContext(nodeName: string, endpoint: string) {\r\n        Logging.trace({\r\n            view: 'sme-ui-control',\r\n            instance: 'saveJeaContext',\r\n            action: 'command-click',\r\n            data: { message: 'Establishing session using JEA endpoint' }\r\n        });\r\n        this.setJeaEndpoint(nodeName, endpoint);\r\n\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setJeaContext, { nodeName: nodeName, endpoint: endpoint });\r\n    }\r\n\r\n    public getJeaEndpoint(nodeName: string): string {\r\n        return this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()];\r\n    }\r\n\r\n    /**\r\n     * Associates a node to use a specified JEA endpoint\r\n     */\r\n    public setJeaEndpoint(nodeName: string, endpoint: string): void {\r\n        this.nodePowershellEndpoints[nodeName.toLocaleLowerCase()] = endpoint;\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Calls the authorize method and gets a new token.\r\n     * If running as a child, the token comes from the parent windows service\r\n     */\r\n    public getNewToken(nodeName: string): Observable<AuthorizationTokenResponse>;\r\n    public getNewToken(nodeNames: string[]): Observable<AuthorizationTokenResponse>;\r\n    public getNewToken(nodeName: string, errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n    public getNewToken(nodeNames: string[], errorData: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse>;\r\n\r\n    public getNewToken(nodeNames?: string | string[], errorData?: NodeAuthorizationErrorData): Observable<AuthorizationTokenResponse> {\r\n        return this.requestNewToken(nodeNames, errorData, this.getRequesterAwaiterKey(errorData));\r\n    }\r\n\r\n    private requestNewToken(\r\n        nodeNames: string | string[],\r\n        errorData: NodeAuthorizationErrorData,\r\n        requesterKey: string,\r\n        sourceName?: string\r\n    ): Observable<AuthorizationTokenResponse> {\r\n        // if we are already awaiting a token, then hook into the current request and try using that token\r\n        const pendingAwaiter = this.getPendingAwaiter(requesterKey);\r\n        if (!requesterKey) {\r\n            if (!pendingAwaiter) {\r\n                this.sharedTokenRequesters.clear();\r\n            }\r\n            if (sourceName) {\r\n                this.sharedTokenRequesters.add(sourceName);\r\n            }\r\n        }\r\n        if (pendingAwaiter) {\r\n            return pendingAwaiter;\r\n        }\r\n\r\n        // ensure input is an array only if not null.\r\n        if (nodeNames && !Array.isArray(nodeNames)) {\r\n            nodeNames = [nodeNames];\r\n        }\r\n\r\n        // define a new subject for multiple requests to wait on\r\n        const awaiter = new Subject<AuthorizationTokenResponse>();\r\n        this.setPendingAwaiter(requesterKey, awaiter);\r\n\r\n        // try to forward execute getNewToken from our parent\r\n        const parentExecuter = this.forwardExecute<void>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.getNewToken, [nodeNames, errorData]);\r\n\r\n        if (parentExecuter) {\r\n            return awaiter;\r\n        }\r\n\r\n        // Need to clear the endpoints before we acquire a new token,\r\n        // because we must try new credentials in an admin context before any fallback happens.\r\n        if (nodeNames) {\r\n            for (const node of <string[]>nodeNames) {\r\n                this.setJeaEndpoint(node, null);\r\n            }\r\n        }\r\n\r\n        // since we could not forward the request We must ask for the auth token ourselves\r\n        const authorizeErrorData = this.isRequesterScopingEnabled() ? { ...(errorData || <NodeAuthorizationErrorData>{}), requesterScope: requesterKey || null } : errorData;\r\n        this.authorize(nodeNames, authorizeErrorData)\r\n            .pipe(\r\n                mergeMap(credentials => {\r\n                    // scoped credentials never replace the credentials shared by every tool\r\n                    if (credentials.applyToAllNodes && !this.getCredentialScope(credentials, requesterKey)) {\r\n                        this.nodeTokens = {};\r\n                        this.updateCache();\r\n                        const forward = this.forwardExecute(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n                        if (forward) {\r\n                            return forward.pipe(map(() => credentials));\r\n                        }\r\n                    }\r\n\r\n                    return of(credentials);\r\n                }),\r\n                mergeMap(credentials => {\r\n                    const scope = this.getCredentialScope(credentials, requesterKey);\r\n                    const appliesTo = credentials.applyToAllNodes ? null : nodeNames || null;\r\n                    return this.createSecureToken({\r\n                        username: credentials.username,\r\n                        password: credentials.password,\r\n                        useLaps: credentials.useLaps,\r\n                        lapsLocalAdminName: credentials.lapsLocalAdminName\r\n                    }).pipe(\r\n                        map(token => {\r\n                            const response: AuthorizationTokenResponse = {\r\n                                token: token,\r\n                                appliesTo: appliesTo\r\n                            };\r\n                            if (scope) {\r\n                                response.scope = scope;\r\n                            }\r\n\r\n                            return response;\r\n                        })\r\n                    );\r\n                }),\r\n                mergeMap(result => {\r\n                    if (result.scope && !result.appliesTo) {\r\n                        // Older core prefers node tokens over a global token and does not understand scope.\r\n                        const forward = this.forwardExecuteToChildren<void>(result.scope, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n                        if (forward) {\r\n                            return forward.pipe(map(() => result));\r\n                        }\r\n                    }\r\n\r\n                    return of(result);\r\n                }),\r\n                // take the next 1 result and use it for our token.\r\n                // We can now notify anyone waiting for auth and save the token\r\n                take(1)\r\n            )\r\n            .subscribe({\r\n                next: result => {\r\n                    if (result.scope) {\r\n                        this.saveScopedToken(result);\r\n                        const awaiter = this.requesterTokenAwaiters.get(requesterKey);\r\n                        if (awaiter) {\r\n                            this.requesterTokenAwaiters.delete(requesterKey);\r\n                            awaiter.next(result);\r\n                            awaiter.complete();\r\n                        }\r\n                        this.forwardNotifyToChildren(result.scope, AuthorizationManager.rpcCommands.setNodeToken, result);\r\n                        return;\r\n                    }\r\n\r\n                    this.completeTokenAwaiter(result, null, requesterKey);\r\n                    const pendingRequesters = Array.from(this.requesterTokenAwaiters.keys());\r\n                    const notification = pendingRequesters.length ? { ...result, pendingRequesters } : result;\r\n                    this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, notification);\r\n                },\r\n                error: error => {\r\n                    const sharedRequesters = Array.from(this.sharedTokenRequesters);\r\n                    this.completeTokenAwaiter(null, error, requesterKey);\r\n                    this.notifyTokenError(requesterKey, error, sharedRequesters);\r\n                }\r\n            });\r\n\r\n        return awaiter;\r\n    }\r\n\r\n    public refreshSignOnToken(): Observable<SignOnTokenResponse> {\r\n        // if we are already awaiting a token, then hook into the current request and try using that token\r\n        if (this.signOnTokenAwaiter) {\r\n            return this.signOnTokenAwaiter;\r\n        }\r\n\r\n        // define a new subject for multiple requests to wait on\r\n        this.signOnTokenAwaiter = new Subject<SignOnTokenResponse>();\r\n\r\n        // try to forward execute getSignOnToken from our parent.\r\n        const now = Date.now();\r\n        const parentExecuter = this.forwardExecute<SignOnTokenRefresh>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.getSignOnToken, [now]);\r\n\r\n        if (parentExecuter) {\r\n            return this.signOnTokenAwaiter;\r\n        }\r\n\r\n        // since we could not forward the request We must ask for the signon token ourselves\r\n        this.signOnManager.requestSignOnRefresh().subscribe({\r\n            next: response => {\r\n                this.completeSignOnTokenAwaiter(response);\r\n                this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnToken, RpcForwarder.ensureSerializable(response));\r\n            },\r\n            error: error => {\r\n                this.completeSignOnTokenAwaiter(null, error);\r\n                this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnTokenError, RpcForwarder.ensureSerializable(error));\r\n            }\r\n        });\r\n\r\n        return this.signOnTokenAwaiter;\r\n    }\r\n\r\n    /**\r\n     * Forward Sign On Token to child frame.\r\n     */\r\n    public forwardSignOnToken(): void {\r\n        const data: SignOnTokenResponse = { time: Date.now(), token: this.signOnManager.signedHttpRequestToken };\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnToken, data);\r\n    }\r\n\r\n    /**\r\n     * @deprecated use createSecureToken() after configured gatewayJwk property.\r\n     *\r\n     * Creates a token from the given options that may be used for node authentication\r\n     * @param options The token creation options\r\n     */\r\n    public createToken(options: CreateAuthorizationTokenOptions, passwordEncryptedWith: string = null): AuthorizationToken {\r\n        // ensure a valid value for laps local admin name\r\n        if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n            options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n        }\r\n        // ensure username has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n            options.username = null;\r\n        }\r\n        if (options.useLaps || !options.username) {\r\n            return {\r\n                value: null,\r\n                username: null,\r\n                useLaps: options.useLaps,\r\n                lapsLocalAdminName: options.lapsLocalAdminName\r\n            };\r\n        }\r\n\r\n        // ensure password has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n            options.password = null;\r\n        }\r\n\r\n        let username: string[];\r\n        if (options.username.indexOf('@') >= 0) {\r\n            // domain is empty if UPN is used.\r\n            username = ['', options.username];\r\n        } else {\r\n            username = options.username.split('\\\\');\r\n        }\r\n\r\n        const token = Net.createEncodedAuthenticationHeader(username, options.password, passwordEncryptedWith);\r\n        return {\r\n            value: token,\r\n            username: options.username,\r\n            useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n            lapsLocalAdminName: null\r\n        };\r\n    }\r\n\r\n    /**\r\n     * Creates a secure token from the given options that may be used for node authentication\r\n     *\r\n     * @param options The token creation options\r\n     */\r\n    public createSecureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n        const forward = this.forwardExecute<AuthorizationToken>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.secureToken, [options]);\r\n        if (forward) {\r\n            return forward;\r\n        } else {\r\n            return this.secureToken(options);\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Get the saved Auth token for a node.\r\n     *\r\n     * @param nodeName The nodeName to get token for.\r\n     */\r\n    public getSavedNodeToken(nodeName: string): AuthorizationToken {\r\n        const normalizedNodeName = nodeName && nodeName.toLocaleLowerCase();\r\n        if (this.scopedTokenState) {\r\n            if (normalizedNodeName && this.scopedTokenState.nodeTokens[normalizedNodeName]) {\r\n                return this.scopedTokenState.nodeTokens[normalizedNodeName];\r\n            }\r\n\r\n            if (this.scopedTokenState.manageAsToken) {\r\n                return this.scopedTokenState.manageAsToken;\r\n            }\r\n        }\r\n\r\n        if (normalizedNodeName && this.nodeTokens[normalizedNodeName]) {\r\n            return this.nodeTokens[normalizedNodeName];\r\n        }\r\n\r\n        return this.manageAsToken;\r\n    }\r\n\r\n    /**\r\n     * Sets a token on the given nodes\r\n     * @param token The token to use for the given nodes\r\n     * @param nodeName The names of the nodes to set the token for. If empty or null, the token will be used as the global manageAs token\r\n     * @returns an Observable indicating that the token has been set.\r\n     */\r\n    public setNodeTokens(token: AuthorizationToken, nodeNames?: string[]): Observable<void> {\r\n        // if we have a parent instance, just forward it and return the result\r\n        const forward = this.forwardExecute<void>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.setNodeTokens, [token, nodeNames]);\r\n        if (forward) {\r\n            return forward;\r\n        }\r\n\r\n        // otherwise process the token\r\n        const childSetTokenResponse: AuthorizationTokenResponse = { token: token };\r\n        if (!nodeNames || !Array.isArray(nodeNames) || nodeNames.length === 0) {\r\n            this.manageAsToken = token;\r\n        } else {\r\n            childSetTokenResponse.appliesTo = nodeNames;\r\n            nodeNames.forEach(nodeName => (this.nodeTokens[nodeName.toLocaleLowerCase()] = token));\r\n        }\r\n        this.updateCache();\r\n\r\n        // notify all child instances of the token change.\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, childSetTokenResponse, true);\r\n\r\n        // return a null observable, indicating we are done.\r\n        return of(null);\r\n    }\r\n\r\n    /**\r\n     * Adds a authorization header to a request given a node with a manageAsToken\r\n     * @param request The request to add headers to\r\n     * @param nodeName optional. The node to add headers for if not provided, the global token will be used\r\n     * @param token optional. The token to use for the headers. if provided, the nodeName is not used.\r\n     */\r\n    public addAuthorizationRequestHeader(request: AjaxRequest, nodeName?: string, token?: AuthorizationToken) {\r\n        if (!token) {\r\n            token = this.getSavedNodeToken(nodeName);\r\n        }\r\n\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                (<any>request).headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n            } else {\r\n                // If not, we add useLaps header.\r\n                (<any>request).headers[headerConstants.USE_LAPS] = token.useLaps;\r\n                (<any>request).headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Create token headers.\r\n     *\r\n     * @param nodeName the node name.\r\n     * @param token the token to override current setting (optional).\r\n     */\r\n    public createTokenHeaders(nodeName: string, token?: AuthorizationToken): MsftSme.StringMap<string> {\r\n        const headers: MsftSme.StringMap<string> = {};\r\n        token = token || this.getSavedNodeToken(nodeName);\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                headers[headerConstants.SME_AUTHORIZATION] = token.value;\r\n            } else {\r\n                // If not, we add useLaps header.\r\n                headers[headerConstants.USE_LAPS] = token.useLaps ? 'true' : 'false';\r\n                headers[headerConstants.LAPS_LOCALADMINNAME] = token.lapsLocalAdminName;\r\n            }\r\n        }\r\n\r\n        return headers;\r\n    }\r\n\r\n    /**\r\n     * Adds a authorization header to a request given a node with a manageAsToken\r\n     */\r\n    public addAuthorizationTokensToMultiPartBody(body: string[], nodeName?: string, token?: AuthorizationToken) {\r\n        if (!token) {\r\n            token = this.getSavedNodeToken(nodeName);\r\n        }\r\n\r\n        if (token) {\r\n            if (token.value) {\r\n                // If username and password are explicitly provided, we only add the Authorization header.\r\n                body.push(headerConstants.SME_AUTHORIZATION + ': ' + token.value);\r\n            } else {\r\n                // If not, we add useLaps header.\r\n                body.push(headerConstants.USE_LAPS + ': ' + token.useLaps);\r\n                body.push(headerConstants.LAPS_LOCALADMINNAME + ': ' + token.lapsLocalAdminName);\r\n            }\r\n        }\r\n    }\r\n\r\n    public resetAllTokens(): void {\r\n        this.scopedTokens = {};\r\n        this.scopedTokenState = null;\r\n        this.sharedTokenState = null;\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearScopedTokens, null);\r\n        this.manageAsToken = null;\r\n        this.nodePowershellEndpoints = {};\r\n        this.nodeTokens = {};\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, null);\r\n        this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, []);\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Encrypts a string value using the jwk from the gateway\r\n     */\r\n    public encrypt(value: string): Observable<string> {\r\n        const forward = this.forwardExecute<string>(RpcRelationshipType.Parent, AuthorizationManager.rpcCommands.encrypt, [value]);\r\n        if (forward) {\r\n            return forward;\r\n        }\r\n\r\n        return Crypto.encryptRsaSha1(this.jwk, value);\r\n    }\r\n\r\n    /**\r\n     * Called on a child service instance when onForwardInit returns from the parent\r\n     * @param data The response from the forwardInit call\r\n     */\r\n    protected onForwardInitResponse(data: RpcForwardResponse<AuthorizationManagerInitProperties>): void {\r\n        if (data && data.error) {\r\n            // if there is an error, we cannot continue, so throw it\r\n            throw data.error;\r\n        }\r\n\r\n        this.manageAsToken = data.result.manageAsToken;\r\n        this.nodeTokens = data.result.nodeTokens;\r\n        this.nodePowershellEndpoints = data.result.nodePowershellEndpoints;\r\n        this.signOnManager.signedHttpRequestToken = data.result.signOnToken;\r\n        this.scopedTokenState = data.result.scopedTokens || null;\r\n        const sharedTokens = data.result.sharedTokens || { nodeTokens: {} };\r\n        this.sharedTokenState = this.scopedTokenState\r\n            ? {\r\n                  manageAsToken: sharedTokens.manageAsToken,\r\n                  nodeTokens: { ...sharedTokens.nodeTokens }\r\n              }\r\n            : null;\r\n        this.recomputeEffectiveTokenState();\r\n    }\r\n\r\n    /**\r\n     * Called when a new instance of the service in another window is initialized and needs to synchronize with its parent\r\n     * @param sourceName The RPC name of the initializing child, used to include the credentials scoped to it\r\n     * @returns an observable for the all the values needed to initialize the service\r\n     */\r\n    protected onForwardInit(sourceName?: string): Observable<AuthorizationManagerInitProperties> {\r\n        const sharedTokenState = this.scopedTokenState ? this.sharedTokenState : null;\r\n        const scoped = this.scopedTokenState || (sourceName && this.isRequesterScopingEnabled() ? this.scopedTokens[sourceName] : null);\r\n        const sharedManageAsToken = sharedTokenState ? sharedTokenState.manageAsToken : this.manageAsToken;\r\n        const sharedNodeTokens = sharedTokenState ? sharedTokenState.nodeTokens : this.nodeTokens;\r\n        return of(<AuthorizationManagerInitProperties>{\r\n            manageAsToken: (scoped && scoped.manageAsToken) || sharedManageAsToken,\r\n            nodeTokens: scoped ? (scoped.manageAsToken ? { ...scoped.nodeTokens } : { ...sharedNodeTokens, ...scoped.nodeTokens }) : this.nodeTokens,\r\n            sharedTokens: scoped\r\n                ? {\r\n                      manageAsToken: sharedManageAsToken,\r\n                      nodeTokens: sharedNodeTokens\r\n                  }\r\n                : undefined,\r\n            // Shared JEA fallbacks may belong to a different identity than the scoped all-connections token.\r\n            nodePowershellEndpoints: scoped && scoped.manageAsToken ? {} : this.nodePowershellEndpoints,\r\n            signOnToken: this.signOnManager.signedHttpRequestToken,\r\n            scopedTokens: scoped || null\r\n        });\r\n    }\r\n\r\n    /**\r\n     * Called when the forwarded services counterpart wants to get data from the parent\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @param name The name of the method to forward to\r\n     * @param args The arguments of the method\r\n     * @returns an observable for the result of the method call\r\n     */\r\n    protected onForwardExecute(from: RpcRelationshipType, name: string, args: any[], sourceName?: string): Observable<any> {\r\n        // command comes from child\r\n        if (from === RpcRelationshipType.Child) {\r\n            switch (name) {\r\n                case AuthorizationManager.rpcCommands.getNewToken: {\r\n                    const errorData = AuthorizationManager.withRequesterName(args ? args[1] : null, sourceName);\r\n                    // only a direct child can be scoped, because scoped tokens are delivered to the direct child frame by name\r\n                    const isDirectRequester = !!errorData && errorData.requesterName === sourceName;\r\n                    const requesterKey = isDirectRequester ? this.getRequesterAwaiterKey(errorData) : '';\r\n                    // start getting the new token, but return immediately to avoid timeout\r\n                    const subscription = this.requestNewToken(args ? args[0] : null, errorData, requesterKey, sourceName).subscribe({\r\n                        next: () => subscription.unsubscribe(),\r\n                        error: () => subscription.unsubscribe()\r\n                    });\r\n                    return of(null);\r\n                }\r\n                case AuthorizationManager.rpcCommands.secureToken: {\r\n                    const options = args && args[0];\r\n                    if (!options) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.secureToken(options);\r\n                }\r\n                case AuthorizationManager.rpcCommands.encrypt: {\r\n                    const options = args && args[0];\r\n                    if (!options) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.encrypt(options);\r\n                }\r\n                case AuthorizationManager.rpcCommands.setNodeTokens: {\r\n                    const token = args && args[0];\r\n                    const nodes = args && args[1];\r\n                    if (!token) {\r\n                        return of(null);\r\n                    }\r\n\r\n                    return this.setNodeTokens(token, nodes);\r\n                }\r\n                case AuthorizationManager.rpcCommands.getSignOnToken: {\r\n                    const subscription = this.refreshSignOnToken().subscribe({\r\n                        next: () => subscription.unsubscribe(),\r\n                        error: error => {\r\n                            (subscription.unsubscribe(),\r\n                                this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnTokenError, RpcForwarder.ensureSerializable(error)));\r\n                        }\r\n                    });\r\n                    return of(null);\r\n                }\r\n            }\r\n        }\r\n\r\n        // command comes from parent\r\n        if (from === RpcRelationshipType.Parent) {\r\n            if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {\r\n                // Clear shared node-specific credentials without removing requester-scoped state.\r\n                if (this.scopedTokenState) {\r\n                    this.sharedTokenState.nodeTokens = {};\r\n                    this.recomputeEffectiveTokenState();\r\n                } else {\r\n                    this.nodeTokens = {};\r\n                }\r\n                this.nodePowershellEndpoints = {};\r\n                // if we also have children, forward the request on\r\n                const forward = this.forwardExecute(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, args);\r\n                return forward || of(null);\r\n            }\r\n        }\r\n\r\n        // command not implemented\r\n        return this.nameNotFound(name);\r\n    }\r\n\r\n    /**\r\n     * Called when the forwarded services counterpart sends a notify message\r\n     * @param from The RpcRelationshipType that this request is from\r\n     * @param name The name of the property to change\r\n     * @param value The new value of the property\r\n     * @returns an observable that completes when the property has been changed.\r\n     */\r\n    protected onForwardNotify(from: RpcRelationshipType, name: string, value: any): Observable<void> {\r\n        // allow our parent to give us a new token.\r\n        if (from === RpcRelationshipType.Parent) {\r\n            if (name === AuthorizationManager.rpcCommands.manageAsToken) {\r\n                if (this.scopedTokenState) {\r\n                    this.sharedTokenState.manageAsToken = value;\r\n                    this.nodePowershellEndpoints = {};\r\n                    this.recomputeEffectiveTokenState();\r\n                } else {\r\n                    this.manageAsToken = value;\r\n                }\r\n                // if we also have children, forward the notification on\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.manageAsToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.clearScopedTokens) {\r\n                this.clearScopedOverlay();\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearScopedTokens, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            // resetAllTokens sends clearNodeTokens as a notification; applyToAllNodes sends it as an execute\r\n            if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {\r\n                // Clear shared node-specific credentials without removing requester-scoped state.\r\n                if (this.scopedTokenState) {\r\n                    this.sharedTokenState.nodeTokens = {};\r\n                    this.recomputeEffectiveTokenState();\r\n                } else {\r\n                    this.nodeTokens = {};\r\n                }\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.clearNodeTokens, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setNodeToken) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n                }\r\n\r\n                const response = <AuthorizationTokenResponse>value;\r\n                if (response.pendingRequesters && response.pendingRequesters.indexOf(MsftSme.self().Environment.name) >= 0) {\r\n                    // this requester is still waiting for its own credentials, so only save the shared token\r\n                    if (this.scopedTokenState) {\r\n                        this.applyChildSharedTokenResponse(response);\r\n                    } else {\r\n                        if (!response.appliesTo) {\r\n                            this.manageAsToken = response.token;\r\n                        } else if (Array.isArray(response.appliesTo)) {\r\n                            response.appliesTo.forEach(nodeName => {\r\n                                this.nodeTokens[nodeName.toLocaleLowerCase()] = response.token;\r\n                            });\r\n                            this.updateCache();\r\n                        } else {\r\n                            this.nodeTokens[response.appliesTo.toLocaleLowerCase()] = response.token;\r\n                            this.updateCache();\r\n                        }\r\n                    }\r\n                } else {\r\n                    this.completeTokenAwaiter(response);\r\n                }\r\n\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setNodeTokenError) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n                }\r\n\r\n                this.completeTokenAwaiter(null, value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setJeaContext) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setJeaContext));\r\n                }\r\n\r\n                this.saveJeaContext(value.nodeName, value.endpoint);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setJeaContext, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setSignOnToken) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeToken));\r\n                }\r\n\r\n                this.completeSignOnTokenAwaiter(value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnToken, value);\r\n                return forward || of(null);\r\n            }\r\n\r\n            if (name === AuthorizationManager.rpcCommands.setSignOnTokenError) {\r\n                if (!value) {\r\n                    const message = MsftSme.getStrings<Strings>().MsftSmeShell.Core.Error.InvalidValue.message;\r\n                    return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeTokenError));\r\n                }\r\n\r\n                this.completeSignOnTokenAwaiter(null, value);\r\n                const forward = this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setSignOnTokenError, value);\r\n                return forward || of(null);\r\n            }\r\n        }\r\n\r\n        return this.nameNotFound(name);\r\n    }\r\n\r\n    /**\r\n     * Creates a secure token from the given options that may be used for node authentication\r\n     *\r\n     * @param options The token creation options\r\n     */\r\n    private secureToken(options: CreateAuthorizationTokenOptions): Observable<AuthorizationToken> {\r\n        // ensure a valid value for laps local admin name\r\n        if (MsftSme.isNullOrWhiteSpace(options.lapsLocalAdminName)) {\r\n            options.lapsLocalAdminName = AuthorizationManager.defaultLapsLocalAdminName;\r\n        }\r\n\r\n        // ensure username has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.username)) {\r\n            options.username = null;\r\n        }\r\n\r\n        if (options.useLaps || !options.username) {\r\n            return of({\r\n                value: null,\r\n                username: null,\r\n                useLaps: options.useLaps,\r\n                lapsLocalAdminName: options.lapsLocalAdminName\r\n            });\r\n        }\r\n\r\n        // ensure password has a valid value\r\n        if (MsftSme.isNullOrWhiteSpace(options.password)) {\r\n            options.password = null;\r\n        }\r\n\r\n        let username: string[];\r\n        if (options.username.indexOf('@') >= 0) {\r\n            // domain is empty if UPN is used.\r\n            username = ['', options.username];\r\n        } else {\r\n            username = options.username.split('\\\\');\r\n        }\r\n\r\n        const tokenData = {\r\n            value: undefined,\r\n            username: options.username,\r\n            useLaps: false, // UseLaps must be false when user provides explicit username and password.,\r\n            lapsLocalAdminName: null\r\n        };\r\n\r\n        if (this.jwk) {\r\n            return Net.createEncryptedAuthenticationHeader(this.jwk, username, options.password, this.logOnUser, this.credentialsExpirationTimeInMs).pipe(\r\n                map(newToken => {\r\n                    tokenData.value = newToken;\r\n                    return tokenData;\r\n                })\r\n            );\r\n        }\r\n\r\n        tokenData.value = Net.createEncodedAuthenticationHeader(username, options.password);\r\n        return of(tokenData);\r\n    }\r\n\r\n    /**\r\n     * Completes the token awaiter\r\n     */\r\n    private completeTokenAwaiter(result: AuthorizationTokenResponse, error?: any, requesterKey = '') {\r\n        if (!requesterKey) {\r\n            this.sharedTokenRequesters.clear();\r\n        }\r\n        if (error) {\r\n            const awaiter = requesterKey ? this.requesterTokenAwaiters.get(requesterKey) : this.tokenAwaiter;\r\n            if (awaiter) {\r\n                if (requesterKey) {\r\n                    this.requesterTokenAwaiters.delete(requesterKey);\r\n                } else {\r\n                    this.tokenAwaiter = null;\r\n                }\r\n                awaiter.error(error);\r\n            }\r\n        } else {\r\n            if (result.scope || this.scopedTokenState) {\r\n                if (result.scope) {\r\n                    if (!this.scopedTokenState) {\r\n                        this.sharedTokenState = {\r\n                            manageAsToken: this.token,\r\n                            nodeTokens: { ...(this.nodeTokens || {}) }\r\n                        };\r\n                        this.scopedTokenState = { nodeTokens: {} };\r\n                    }\r\n                    AuthorizationManager.addToScope(this.scopedTokenState, result);\r\n                    this.recomputeEffectiveTokenState();\r\n                } else {\r\n                    this.applyChildSharedTokenResponse(result);\r\n                }\r\n            } else {\r\n                if (!result.appliesTo) {\r\n                    this.manageAsToken = result.token;\r\n                } else if (Array.isArray(result.appliesTo)) {\r\n                    result.appliesTo.forEach(nodeName => {\r\n                        this.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;\r\n                    });\r\n                    this.updateCache();\r\n                } else {\r\n                    this.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;\r\n                    this.updateCache();\r\n                }\r\n            }\r\n\r\n            const awaiter = requesterKey ? this.requesterTokenAwaiters.get(requesterKey) : this.tokenAwaiter;\r\n            if (awaiter) {\r\n                if (requesterKey) {\r\n                    this.requesterTokenAwaiters.delete(requesterKey);\r\n                } else {\r\n                    this.tokenAwaiter = null;\r\n                }\r\n                awaiter.next(result);\r\n                awaiter.complete();\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Adds a token response to a set of scoped credentials.\r\n     */\r\n    private static addToScope(scoped: AuthorizationTokenSet, result: AuthorizationTokenResponse): void {\r\n        if (!result.appliesTo) {\r\n            scoped.manageAsToken = result.token;\r\n            scoped.nodeTokens = {};\r\n            return;\r\n        }\r\n\r\n        const nodeNames = Array.isArray(result.appliesTo) ? result.appliesTo : [result.appliesTo];\r\n        nodeNames.forEach(nodeName => {\r\n            scoped.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;\r\n        });\r\n    }\r\n\r\n    /**\r\n     * Shell instance: saves a token that applies only to the requester named by result.scope.\r\n     * The tokens shared by every tool are left unchanged.\r\n     */\r\n    private saveScopedToken(result: AuthorizationTokenResponse): void {\r\n        const scoped = this.scopedTokens[result.scope] || { nodeTokens: {} };\r\n        AuthorizationManager.addToScope(scoped, result);\r\n        this.scopedTokens[result.scope] = scoped;\r\n        this.updateCache();\r\n    }\r\n\r\n    /**\r\n     * Child instance: re-applies requester-scoped credentials over the shared ones.\r\n     */\r\n    private recomputeEffectiveTokenState(): void {\r\n        if (!this.scopedTokenState) {\r\n            return;\r\n        }\r\n\r\n        const sharedState = this.sharedTokenState;\r\n        this.token = this.scopedTokenState.manageAsToken || sharedState.manageAsToken;\r\n        this.nodeTokens = this.scopedTokenState.manageAsToken ? { ...this.scopedTokenState.nodeTokens } : { ...sharedState.nodeTokens, ...this.scopedTokenState.nodeTokens };\r\n    }\r\n\r\n    /**\r\n     * Child instance: forgets requester-scoped credentials.\r\n     */\r\n    private clearScopedOverlay(): void {\r\n        const sharedState = this.sharedTokenState;\r\n        this.scopedTokenState = null;\r\n        this.sharedTokenState = null;\r\n        if (!sharedState) {\r\n            return;\r\n        }\r\n\r\n        this.token = sharedState.manageAsToken;\r\n        this.nodeTokens = { ...sharedState.nodeTokens };\r\n    }\r\n\r\n    /**\r\n     * Child instance: saves a shared token update without allowing it to replace scoped effective credentials.\r\n     */\r\n    private applyChildSharedTokenResponse(result: AuthorizationTokenResponse): void {\r\n        const sharedState = this.sharedTokenState;\r\n        if (!result.appliesTo) {\r\n            sharedState.manageAsToken = result.token;\r\n        } else if (Array.isArray(result.appliesTo)) {\r\n            result.appliesTo.forEach(nodeName => {\r\n                sharedState.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;\r\n            });\r\n        } else {\r\n            sharedState.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;\r\n        }\r\n\r\n        this.recomputeEffectiveTokenState();\r\n    }\r\n\r\n    /**\r\n     * Returns the key of the token awaiter for a request: the requester RPC name when requester scoping is\r\n     * enabled on this shell instance, otherwise an empty string for the shared awaiter.\r\n     */\r\n    private getRequesterAwaiterKey(errorData: NodeAuthorizationErrorData): string {\r\n        if (!errorData || !errorData.requesterName) {\r\n            return '';\r\n        }\r\n\r\n        return this.isRequesterScopingEnabled() ? errorData.requesterName : '';\r\n    }\r\n\r\n    private isRequesterScopingEnabled(): boolean {\r\n        const isEnabled = this.options && this.options.isRequesterScopingEnabled;\r\n        return MsftSme.isShell() && !!isEnabled && isEnabled();\r\n    }\r\n\r\n    /**\r\n     * Returns the scope for authorized credentials, or null when they apply to every tool.\r\n     */\r\n    private getCredentialScope(credentials: AuthorizationCredentials, requesterKey: string): string {\r\n        return credentials && credentials.scopeToRequester && requesterKey ? requesterKey : null;\r\n    }\r\n\r\n    private getPendingAwaiter(requesterKey: string): Subject<AuthorizationTokenResponse> {\r\n        const awaiter = requesterKey ? this.requesterTokenAwaiters.get(requesterKey) : this.tokenAwaiter;\r\n        return awaiter && !awaiter.closed ? awaiter : null;\r\n    }\r\n\r\n    private setPendingAwaiter(requesterKey: string, awaiter: Subject<AuthorizationTokenResponse>): void {\r\n        if (requesterKey) {\r\n            this.requesterTokenAwaiters.set(requesterKey, awaiter);\r\n        } else {\r\n            this.tokenAwaiter = awaiter;\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Routes failures to the requesting frames. Legacy shells retain shared error broadcasts.\r\n     */\r\n    private notifyTokenError(requesterKey: string, error: any, sharedRequesters: string[]): void {\r\n        const value = RpcForwarder.ensureSerializable(error);\r\n        if (requesterKey) {\r\n            this.forwardNotifyToChildren(requesterKey, AuthorizationManager.rpcCommands.setNodeTokenError, value);\r\n        } else if (this.isRequesterScopingEnabled()) {\r\n            sharedRequesters.forEach(sourceName => this.forwardNotifyToChildren(sourceName, AuthorizationManager.rpcCommands.setNodeTokenError, value));\r\n        } else {\r\n            this.forwardNotify(RpcRelationshipType.Child, AuthorizationManager.rpcCommands.setNodeTokenError, value);\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Completes the sign on token awaiter\r\n     */\r\n    private completeSignOnTokenAwaiter(result: SignOnTokenResponse, error?: any) {\r\n        const awaiter = this.signOnTokenAwaiter;\r\n        if (awaiter) {\r\n            this.signOnTokenAwaiter = null;\r\n        }\r\n\r\n        if (error) {\r\n            if (awaiter) {\r\n                awaiter.error(error);\r\n            }\r\n\r\n            return;\r\n        }\r\n\r\n        if (result.token) {\r\n            this.signOnManager.signedHttpRequestToken = result.token;\r\n        } else {\r\n            Logging.logError('Shell.AuthorizationManager', 'Null token was passed.');\r\n        }\r\n\r\n        if (awaiter) {\r\n            awaiter.next(result);\r\n            awaiter.complete();\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Gets the error data.\r\n     * @param code the http status code.\r\n     * @param error the AJAX error object.\r\n     */\r\n    private getErrorData(code: HttpStatusCode, error: AjaxError): NodeAuthorizationErrorData {\r\n        return {\r\n            statusCode: code,\r\n            errorCode: error && error.xhr && error.xhr.response && error.xhr.response.error && error.xhr.response.error.code,\r\n            errorMessage: Net.getErrorMessage(error)\r\n        };\r\n    }\r\n\r\n    /**\r\n     * Updates the authorization cache. Does nothing if we are not running in shell\r\n     */\r\n    private updateCache(): void {\r\n        if (!MsftSme.isShell()) {\r\n            // ignore if not shell\r\n            return;\r\n        }\r\n        // update cached data\r\n        const cacheData: AuthorizationCacheData = {\r\n            gatewayOrigin: this.gatewayOrigin,\r\n            jwk: this.jwk,\r\n            manageAsToken: this.manageAsToken,\r\n            nodePowershellEndpoints: this.nodePowershellEndpoints,\r\n            nodeTokens: this.nodeTokens,\r\n            scopedTokens: this.scopedTokens\r\n        };\r\n\r\n        MsftSme.SessionStorageHandler.setItem(AuthorizationManager.cacheKey, JSON.stringify(cacheData));\r\n    }\r\n}\r\n"]}

package/core/security/connection-manager.d.ts

@@ -76,7 +76,7 @@ export declare class ConnectionManager extends RpcServiceForwarder implements Co
      */
     private restoreInProgress;
     /**
-     * Indicates that restoring connections has started and shouldnt call the gateway again
+     * Whether the gateway restore has finished, independently of local connection initialization.
      */
     private restoreCompleted;
     /**
@@ -84,6 +84,7 @@ export declare class ConnectionManager extends RpcServiceForwarder implements Co
      */
     private connectionSettings;
     constructor(rpc: Rpc, gatewayConnection: GatewayConnection);
+    /** Waits for the gateway restore in the shell, or for forwarded initialization in a child frame. */
     restoreConnections(refresh?: boolean): Observable<Connection[]>;
     /**
      * Gets all connections

package/core/security/connection-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection-manager.d.ts","sourceRoot":"","sources":["../../src/security/connection-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,UAAU,EAAM,aAAa,EAAE,OAAO,EAAc,MAAM,MAAM,CAAC;AAElF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAK/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAA8C,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AAGpG,MAAM,WAAW,+BAA+B;IAC5C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,gBAAgB,EAAE,UAAU,CAAC;CAChC;AAED,oBAAY,oBAAoB;IAC5B,WAAW,IAAI;IACf,SAAS,IAAI;IACb,KAAK,IAAI;IACT,OAAO,IAAI;CACd;AAED,MAAM,WAAW,uBAAuB;IACpC,IAAI,EAAE,oBAAoB,CAAC;CAC9B;AACD,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACnE,UAAU,EAAE,UAAU,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IACxE,WAAW,EAAE,UAAU,EAAE,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,qBAAa,iBAAkB,SAAQ,mBAAoB,YAAW,+BAA+B;IAqD7F,OAAO,CAAC,iBAAiB;IApD7B,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAsB;IACjE,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAiB;IACvD,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAoB;IAC3D,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAqB;IAC7D,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAsB;IAE/D,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAiB;IAEpD,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,qBAAqB,CAAM;IAEnC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB,CAAmC;IAE/D;;OAEG;IACH,OAAO,CAAC,mBAAmB,CAA2C;IAEtE;;OAEG;IACI,sBAAsB,8BAAsC;IAEnE;;;OAGG;IACI,kBAAkB,mCAA0C;IAEnE;;OAEG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAElC;;OAEG;IACH,OAAO,CAAC,gBAAgB,CAAS;IAEjC;;OAEG;IACH,OAAO,CAAC,kBAAkB,CAA4C;gBAGlE,GAAG,EAAE,GAAG,EACA,iBAAiB,EAAE,iBAAiB;IAKzC,kBAAkB,CAAC,OAAO,UAAQ,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC;IAqDpE;;OAEG;IACH,IAAW,WAAW,IAAI,UAAU,EAAE,CAErC;IAED;;OAEG;IACH,IAAW,gBAAgB,IAAI,UAAU,CAExC;IAED;;OAEG;IACH,IAAW,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAiBjD;IAED;;OAEG;IACI,qBAAqB,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,GAAE,OAAc,EAAE,KAAK,UAAQ,GAAG,MAAM;IAoCjG;;OAEG;IACI,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC;IAgCzD,gCAAgC,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;IAyB5E,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC;IAiC9D;;;OAGG;IACI,eAAe,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;IAyBlE;;;;OAIG;IACI,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;IAkB1E;;;OAGG;IACH,SAAS,CAAC,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,CAAC,+BAA+B,CAAC,GAAG,IAAI;IAehG;;;;OAIG;IACH,SAAS,CAAC,aAAa,IAAI,UAAU,CAAC,+BAA+B,CAAC;IAOtE;;;;;;OAMG;IACH,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;IAkBjG;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC;IAiBhG;;;;;OAKG;IACI,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM;IA+BlF;;;;;OAKG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IA+B/C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,WAAW;IAsBnB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IA4B5B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;OAIG;IACI,2BAA2B,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC,wBAAwB,CAAC;IAejG;;;OAGG;IACI,8BAA8B,CAAC,CAAC,SAAS,eAAe,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAWpH;;;;OAIG;IACI,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAU7G;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAuB7B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;CAKhC"}
+{"version":3,"file":"connection-manager.d.ts","sourceRoot":"","sources":["../../src/security/connection-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,UAAU,EAAM,aAAa,EAAE,OAAO,EAAc,MAAM,MAAM,CAAC;AAElF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAK/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAA8C,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AAGpG,MAAM,WAAW,+BAA+B;IAC5C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,gBAAgB,EAAE,UAAU,CAAC;CAChC;AAED,oBAAY,oBAAoB;IAC5B,WAAW,IAAI;IACf,SAAS,IAAI;IACb,KAAK,IAAI;IACT,OAAO,IAAI;CACd;AAED,MAAM,WAAW,uBAAuB;IACpC,IAAI,EAAE,oBAAoB,CAAC;CAC9B;AACD,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACnE,UAAU,EAAE,UAAU,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IACxE,WAAW,EAAE,UAAU,EAAE,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,qBAAa,iBAAkB,SAAQ,mBAAoB,YAAW,+BAA+B;IAqD7F,OAAO,CAAC,iBAAiB;IApD7B,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAsB;IACjE,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAiB;IACvD,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAoB;IAC3D,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAqB;IAC7D,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAsB;IAE/D,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAiB;IAEpD,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,qBAAqB,CAAM;IAEnC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB,CAAmC;IAE/D;;OAEG;IACH,OAAO,CAAC,mBAAmB,CAA2C;IAEtE;;OAEG;IACI,sBAAsB,8BAAsC;IAEnE;;;OAGG;IACI,kBAAkB,mCAA0C;IAEnE;;OAEG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAElC;;OAEG;IACH,OAAO,CAAC,gBAAgB,CAAS;IAEjC;;OAEG;IACH,OAAO,CAAC,kBAAkB,CAA4C;gBAGlE,GAAG,EAAE,GAAG,EACA,iBAAiB,EAAE,iBAAiB;IAKhD,oGAAoG;IAC7F,kBAAkB,CAAC,OAAO,UAAQ,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC;IAwDpE;;OAEG;IACH,IAAW,WAAW,IAAI,UAAU,EAAE,CAErC;IAED;;OAEG;IACH,IAAW,gBAAgB,IAAI,UAAU,CAExC;IAED;;OAEG;IACH,IAAW,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAiBjD;IAED;;OAEG;IACI,qBAAqB,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,GAAE,OAAc,EAAE,KAAK,UAAQ,GAAG,MAAM;IAoCjG;;OAEG;IACI,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC;IAgCzD,gCAAgC,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;IAyB5E,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC;IAiC9D;;;OAGG;IACI,eAAe,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;IAyBlE;;;;OAIG;IACI,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;IAkB1E;;;OAGG;IACH,SAAS,CAAC,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,CAAC,+BAA+B,CAAC,GAAG,IAAI;IAehG;;;;OAIG;IACH,SAAS,CAAC,aAAa,IAAI,UAAU,CAAC,+BAA+B,CAAC;IAOtE;;;;;;OAMG;IACH,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;IAkBjG;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC;IAiBhG;;;;;OAKG;IACI,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM;IA+BlF;;;;;OAKG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IA+B/C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,WAAW;IAsBnB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IA4B5B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;OAIG;IACI,2BAA2B,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC,wBAAwB,CAAC;IAejG;;;OAGG;IACI,8BAA8B,CAAC,CAAC,SAAS,eAAe,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAWpH;;;;OAIG;IACI,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAU7G;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAuB7B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;CAKhC"}

package/core/security/connection-manager.js

@@ -1,5 +1,5 @@
 import { concat, of, ReplaySubject, Subject, throwError } from 'rxjs';
-import { catchError, map, mergeMap, take, tap } from 'rxjs/operators';
+import { catchError, filter, map, mergeMap, take, tap } from 'rxjs/operators';
 import { VersionedObject } from '../base/versioned-object';
 import { Net } from '../data/net';
 import { LogLevel } from '../diagnostics/log-level';
@@ -49,7 +49,7 @@ export class ConnectionManager extends RpcServiceForwarder {
      */
     restoreInProgress = false;
     /**
-     * Indicates that restoring connections has started and shouldnt call the gateway again
+     * Whether the gateway restore has finished, independently of local connection initialization.
      */
     restoreCompleted = false;
     /**
@@ -60,9 +60,12 @@ export class ConnectionManager extends RpcServiceForwarder {
         super('connection-manager', rpc);
         this.gatewayConnection = gatewayConnection;
     }
+    /** Waits for the gateway restore in the shell, or for forwarded initialization in a child frame. */
     restoreConnections(refresh = false) {
-        if (!this.canForward(0 /* RpcRelationshipType.Parent */) && (refresh || (!this.restoreCompleted && !this.restoreInProgress))) {
+        const hasParent = this.canForward(0 /* RpcRelationshipType.Parent */);
+        if (!hasParent && (refresh || (!this.restoreCompleted && !this.restoreInProgress))) {
             this.restoreInProgress = true;
+            this.restoreCompleted = false;
             this.gatewayConnection
                 .get(ConnectionManager.gatewayConnectionApi)
                 .pipe(map(data => {
@@ -92,17 +95,18 @@ export class ConnectionManager extends RpcServiceForwarder {
                 return of(this.allConnections);
             }))
                 .subscribe(() => {
+                this.restoreInProgress = false;
+                this.restoreCompleted = true;
                 this.forwardNotify(1 /* RpcRelationshipType.Child */, ConnectionManager.connectionsPropertyName, this.allConnections);
                 this.connectionsChanged.next({
                     type: ConnectionChangeType.Initialized,
                     connections: this.allConnections
                 });
                 this.connectionsInitialized.next(this.allConnections);
-                this.restoreInProgress = false;
-                this.restoreCompleted = true;
             });
         }
-        return this.connectionsInitialized;
+        // Local additions also seed this replay subject; they do not mean the gateway records have loaded.
+        return hasParent ? this.connectionsInitialized : this.connectionsInitialized.pipe(filter(() => this.restoreCompleted));
     }
     /**
      * Gets all connections