@oneuptime/common 12.0.25 → 12.0.27

package/build/dist/Server/Utils/SecurityEvent/SecurityEventAlerting.js

@@ -0,0 +1,217 @@
+import Alert from "../../../Models/DatabaseModels/Alert";
+import Incident from "../../../Models/DatabaseModels/Incident";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import Includes from "../../../Types/BaseDatabase/Includes";
+import SortOrder from "../../../Types/BaseDatabase/SortOrder";
+import AlertService from "../../Services/AlertService";
+import AlertSeverityService from "../../Services/AlertSeverityService";
+import IncidentService from "../../Services/IncidentService";
+import IncidentSeverityService from "../../Services/IncidentSeverityService";
+import logger from "../Logger";
+export async function openDedupedAlerts(data) {
+    const fingerprints = data.matches.map((match) => {
+        return match.fingerprint;
+    });
+    const openAlerts = await AlertService.findBy({
+        query: {
+            projectId: data.projectId,
+            seriesFingerprint: new Includes(fingerprints),
+            currentAlertState: {
+                isResolvedState: false,
+            },
+        },
+        select: {
+            _id: true,
+            seriesFingerprint: true,
+        },
+        skip: 0,
+        limit: LIMIT_PER_PROJECT,
+        props: {
+            isRoot: true,
+        },
+    });
+    const openFingerprints = new Set(openAlerts
+        .map((alert) => {
+        return alert.seriesFingerprint || "";
+    })
+        .filter((fingerprint) => {
+        return Boolean(fingerprint);
+    }));
+    let created = 0;
+    for (const match of data.matches) {
+        if (openFingerprints.has(match.fingerprint)) {
+            continue;
+        }
+        const alert = new Alert();
+        alert.projectId = data.projectId;
+        alert.title = match.title;
+        alert.description = match.description;
+        alert.alertSeverityId = data.alertSeverityId;
+        alert.seriesFingerprint = match.fingerprint;
+        alert.isCreatedAutomatically = true;
+        alert.rootCause = match.rootCause;
+        try {
+            await AlertService.create({
+                data: alert,
+                props: {
+                    isRoot: true,
+                },
+            });
+            created++;
+        }
+        catch (error) {
+            logger.error(`${data.logLabel}: failed creating alert:`);
+            logger.error(error);
+        }
+    }
+    return created;
+}
+/*
+ * The incident twin. Dedupe runs BEFORE create — incident numbers are
+ * user-visible and consumed per create — and each create is individually
+ * guarded because IncidentService.onBeforeCreate throws when the project
+ * has no "created" incident state, which cannot be pre-checked the way
+ * an empty severity list can.
+ */
+export async function openDedupedIncidents(data) {
+    const fingerprints = data.matches.map((match) => {
+        return match.fingerprint;
+    });
+    const openIncidents = await IncidentService.findBy({
+        query: {
+            projectId: data.projectId,
+            seriesFingerprint: new Includes(fingerprints),
+            currentIncidentState: {
+                isResolvedState: false,
+            },
+        },
+        select: {
+            _id: true,
+            seriesFingerprint: true,
+        },
+        skip: 0,
+        limit: LIMIT_PER_PROJECT,
+        props: {
+            isRoot: true,
+        },
+    });
+    const openFingerprints = new Set(openIncidents
+        .map((incident) => {
+        return incident.seriesFingerprint || "";
+    })
+        .filter((fingerprint) => {
+        return Boolean(fingerprint);
+    }));
+    let created = 0;
+    for (const match of data.matches) {
+        if (openFingerprints.has(match.fingerprint)) {
+            continue;
+        }
+        const incident = new Incident();
+        incident.projectId = data.projectId;
+        incident.title = match.title;
+        incident.description = match.description;
+        incident.incidentSeverityId = data.incidentSeverityId;
+        incident.seriesFingerprint = match.fingerprint;
+        incident.isCreatedAutomatically = true;
+        incident.rootCause = match.rootCause;
+        try {
+            await IncidentService.create({
+                data: incident,
+                props: {
+                    isRoot: true,
+                },
+            });
+            created++;
+        }
+        catch (error) {
+            logger.error(`${data.logLabel}: failed creating incident:`);
+            logger.error(error);
+        }
+    }
+    return created;
+}
+/*
+ * The precedence logic both severity resolvers share. Severities arrive
+ * sorted by order ascending — lowest order is most severe, per the
+ * model's own convention — so "most severe" is the first element and
+ * "least severe" the last. An explicit id that is not in the list
+ * (deleted, or belonging to another project) falls through silently
+ * rather than failing the source.
+ */
+export function pickSeverityByPrecedence(data) {
+    const { severities, explicitSeverityId, severityLabel, isSevere } = data;
+    if (severities.length === 0) {
+        return null;
+    }
+    if (explicitSeverityId) {
+        const explicit = severities.find((severity) => {
+            var _a;
+            return ((_a = severity.id) === null || _a === void 0 ? void 0 : _a.toString()) === explicitSeverityId.toString();
+        });
+        if (explicit && explicit.id) {
+            return explicit.id;
+        }
+    }
+    const nameMatch = severities.find((severity) => {
+        return ((severity.name || "").toLowerCase() === severityLabel.toLowerCase());
+    });
+    if (nameMatch && nameMatch.id) {
+        return nameMatch.id;
+    }
+    const chosen = isSevere
+        ? severities[0]
+        : severities[severities.length - 1];
+    return chosen.id || null;
+}
+export async function resolveAlertSeverityIdForProject(data) {
+    const severities = await AlertSeverityService.findBy({
+        query: {
+            projectId: data.projectId,
+        },
+        select: {
+            _id: true,
+            name: true,
+        },
+        sort: {
+            order: SortOrder.Ascending,
+        },
+        skip: 0,
+        limit: LIMIT_PER_PROJECT,
+        props: {
+            isRoot: true,
+        },
+    });
+    return pickSeverityByPrecedence({
+        severities,
+        explicitSeverityId: data.explicitSeverityId,
+        severityLabel: data.severityLabel,
+        isSevere: data.isSevere,
+    });
+}
+export async function resolveIncidentSeverityIdForProject(data) {
+    const severities = await IncidentSeverityService.findBy({
+        query: {
+            projectId: data.projectId,
+        },
+        select: {
+            _id: true,
+            name: true,
+        },
+        sort: {
+            order: SortOrder.Ascending,
+        },
+        skip: 0,
+        limit: LIMIT_PER_PROJECT,
+        props: {
+            isRoot: true,
+        },
+    });
+    return pickSeverityByPrecedence({
+        severities,
+        explicitSeverityId: data.explicitSeverityId,
+        severityLabel: data.severityLabel,
+        isSevere: data.isSevere,
+    });
+}
+//# sourceMappingURL=SecurityEventAlerting.js.map

package/build/dist/Server/Utils/SecurityEvent/SecurityEventAlerting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityEventAlerting.js","sourceRoot":"","sources":["../../../../../Server/Utils/SecurityEvent/SecurityEventAlerting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,sCAAsC,CAAC;AAEzD,OAAO,QAAQ,MAAM,yCAAyC,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAC5D,OAAO,SAAS,MAAM,uCAAuC,CAAC;AAE9D,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,eAAe,MAAM,gCAAgC,CAAC;AAC7D,OAAO,uBAAuB,MAAM,wCAAwC,CAAC;AAC7E,OAAO,MAAM,MAAM,WAAW,CAAC;AA4B/B,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAMvC;IACC,MAAM,YAAY,GAAkB,IAAI,CAAC,OAAO,CAAC,GAAG,CAClD,CAAC,KAAqB,EAAU,EAAE;QAChC,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,MAAM,UAAU,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;QACzD,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC;YAC7C,iBAAiB,EAAE;gBACjB,eAAe,EAAE,KAAK;aACvB;SACF;QACD,MAAM,EAAE;YACN,GAAG,EAAE,IAAI;YACT,iBAAiB,EAAE,IAAI;SACxB;QACD,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE;YACL,MAAM,EAAE,IAAI;SACb;KACF,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAgB,IAAI,GAAG,CAC3C,UAAU;SACP,GAAG,CAAC,CAAC,KAAY,EAAU,EAAE;QAC5B,OAAO,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACvC,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,WAAmB,EAAW,EAAE;QACvC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC,CAAC,CACL,CAAC;IAEF,IAAI,OAAO,GAAW,CAAC,CAAC;IAExB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAU,IAAI,KAAK,EAAE,CAAC;QACjC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACtC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;QAC5C,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACpC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,MAAM,CAAC;gBACxB,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,0BAA0B,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAK1C;IACC,MAAM,YAAY,GAAkB,IAAI,CAAC,OAAO,CAAC,GAAG,CAClD,CAAC,KAAqB,EAAU,EAAE;QAChC,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,MAAM,aAAa,GAAoB,MAAM,eAAe,CAAC,MAAM,CAAC;QAClE,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC;YAC7C,oBAAoB,EAAE;gBACpB,eAAe,EAAE,KAAK;aACvB;SACF;QACD,MAAM,EAAE;YACN,GAAG,EAAE,IAAI;YACT,iBAAiB,EAAE,IAAI;SACxB;QACD,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE;YACL,MAAM,EAAE,IAAI;SACb;KACF,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAgB,IAAI,GAAG,CAC3C,aAAa;SACV,GAAG,CAAC,CAAC,QAAkB,EAAU,EAAE;QAClC,OAAO,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC1C,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,WAAmB,EAAW,EAAE;QACvC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC,CAAC,CACL,CAAC;IAEF,IAAI,OAAO,GAAW,CAAC,CAAC;IAExB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAa,IAAI,QAAQ,EAAE,CAAC;QAC1C,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACpC,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7B,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACzC,QAAQ,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACtD,QAAQ,CAAC,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC;QAC/C,QAAQ,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACvC,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,MAAM,CAAC;gBAC3B,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,6BAA6B,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAKtC,IAOD;IACC,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,QAAQ,GAA0B,UAAU,CAAC,IAAI,CACrD,CAAC,QAAmB,EAAW,EAAE;;YAC/B,OAAO,CAAA,MAAA,QAAQ,CAAC,EAAE,0CAAE,QAAQ,EAAE,MAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QACnE,CAAC,CACF,CAAC;QAEF,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAA0B,UAAU,CAAC,IAAI,CACtD,CAAC,QAAmB,EAAW,EAAE;QAC/B,OAAO,CACL,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,CACpE,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,IAAI,SAAS,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,GAAc,QAAQ;QAChC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAE;QAChB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAEvC,OAAO,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAKtD;IACC,MAAM,UAAU,GAAyB,MAAM,oBAAoB,CAAC,MAAM,CAAC;QACzE,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,MAAM,EAAE;YACN,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,IAAI;SACX;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,SAAS;SAC3B;QACD,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE;YACL,MAAM,EAAE,IAAI;SACb;KACF,CAAC,CAAC;IAEH,OAAO,wBAAwB,CAAC;QAC9B,UAAU;QACV,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,IAKzD;IACC,MAAM,UAAU,GACd,MAAM,uBAAuB,CAAC,MAAM,CAAC;QACnC,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,MAAM,EAAE;YACN,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,IAAI;SACX;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS,CAAC,SAAS;SAC3B;QACD,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE;YACL,MAAM,EAAE,IAAI;SACb;KACF,CAAC,CAAC;IAEL,OAAO,wBAAwB,CAAC;QAC9B,UAAU;QACV,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC"}

package/build/dist/Server/Utils/SecurityEvent/ThreatIntel/TaxiiClient.js

@@ -0,0 +1,103 @@
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import DataSourceHttpFetch from "../../DataSource/HttpFetch";
+export const TAXII_MEDIA_TYPE = "application/taxii+json;version=2.1";
+export const TAXII_REQUEST_TIMEOUT_IN_MS = 60 * 1000;
+export const TAXII_DATE_ADDED_LAST_HEADER = "x-taxii-date-added-last";
+export default class TaxiiClient {
+    constructor(data) {
+        TaxiiClient.validateApiRootUrl(data.apiRootUrl);
+        TaxiiClient.validateCollectionId(data.collectionId);
+        this.apiRootUrl = data.apiRootUrl.endsWith("/")
+            ? data.apiRootUrl
+            : `${data.apiRootUrl}/`;
+        this.collectionId = data.collectionId;
+        this.apiToken = data.apiToken || undefined;
+        this.basicAuthUsername = data.basicAuthUsername || undefined;
+        this.basicAuthPassword = data.basicAuthPassword || undefined;
+        this.fetchImplementation =
+            data.fetchImplementation ||
+                ((request) => {
+                    return DataSourceHttpFetch.fetch(request);
+                });
+    }
+    static validateApiRootUrl(url) {
+        let parsed;
+        try {
+            parsed = new URL(url || "");
+        }
+        catch (_a) {
+            throw new BadDataException("TAXII API root must be a valid URL, e.g. https://taxii.example.com/api1/");
+        }
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+            throw new BadDataException("TAXII API root must be an http(s) URL.");
+        }
+        if (parsed.search || parsed.hash) {
+            throw new BadDataException("TAXII API root must not carry a query string or fragment.");
+        }
+    }
+    static validateCollectionId(collectionId) {
+        const collectionIdRegex = /^[A-Za-z0-9._~-]{1,256}$/;
+        if (!collectionIdRegex.test(collectionId || "")) {
+            throw new BadDataException("Collection ID must be a plain TAXII collection identifier (letters, digits, dot, dash, underscore).");
+        }
+    }
+    /*
+     * Bearer token wins, else HTTP basic — the same precedence as the Data
+     * Source connectors' buildAuthHeaders. Anonymous collections get only
+     * the TAXII Accept header.
+     */
+    buildHeaders() {
+        const headers = {
+            Accept: TAXII_MEDIA_TYPE,
+        };
+        if (this.apiToken) {
+            headers["Authorization"] = `Bearer ${this.apiToken}`;
+        }
+        else if (this.basicAuthUsername || this.basicAuthPassword) {
+            const encoded = Buffer.from(`${this.basicAuthUsername || ""}:${this.basicAuthPassword || ""}`).toString("base64");
+            headers["Authorization"] = `Basic ${encoded}`;
+        }
+        return headers;
+    }
+    buildObjectsUrl(params) {
+        const searchParams = new URLSearchParams();
+        searchParams.set("match[type]", "indicator");
+        searchParams.set("limit", String(params.limit));
+        if (params.addedAfter) {
+            searchParams.set("added_after", params.addedAfter);
+        }
+        if (params.next) {
+            searchParams.set("next", params.next);
+        }
+        return `${this.apiRootUrl}collections/${this.collectionId}/objects/?${searchParams.toString()}`;
+    }
+    async fetchIndicatorObjects(params) {
+        const response = await this.fetchImplementation({
+            method: "GET",
+            url: this.buildObjectsUrl(params),
+            headers: this.buildHeaders(),
+            timeoutInMs: TAXII_REQUEST_TIMEOUT_IN_MS,
+            egressOptions: {
+                targetLabel: "TAXII server",
+            },
+        });
+        const envelope = response.bodyJson;
+        if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+            throw new BadDataException("TAXII server returned a non-envelope body from the objects endpoint.");
+        }
+        const asObject = envelope;
+        const objects = Array.isArray(asObject["objects"])
+            ? asObject["objects"].filter((item) => {
+                return (typeof item === "object" && item !== null && !Array.isArray(item));
+            })
+            : [];
+        const next = typeof asObject["next"] === "string" ? asObject["next"] : "";
+        return {
+            objects,
+            more: asObject["more"] === true,
+            next: next || null,
+            dateAddedLast: (response.headers || {})[TAXII_DATE_ADDED_LAST_HEADER] || null,
+        };
+    }
+}
+//# sourceMappingURL=TaxiiClient.js.map

package/build/dist/Server/Utils/SecurityEvent/ThreatIntel/TaxiiClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaxiiClient.js","sourceRoot":"","sources":["../../../../../../Server/Utils/SecurityEvent/ThreatIntel/TaxiiClient.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAG5E,OAAO,mBAGN,MAAM,4BAA4B,CAAC;AAkCpC,MAAM,CAAC,MAAM,gBAAgB,GAAW,oCAAoC,CAAC;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAW,EAAE,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,4BAA4B,GAAW,yBAAyB,CAAC;AAE9E,MAAM,CAAC,OAAO,OAAO,WAAW;IAQ9B,YAAmB,IAOlB;QACC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,SAAS,CAAC;QAC7D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,SAAS,CAAC;QAC7D,IAAI,CAAC,mBAAmB;YACtB,IAAI,CAAC,mBAAmB;gBACxB,CAAC,CAAC,OAA8B,EAAmC,EAAE;oBACnE,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,MAAM,CAAC,kBAAkB,CAAC,GAAW;QAC1C,IAAI,MAAW,CAAC;QAEhB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CACxB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,gBAAgB,CACxB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,oBAAoB,CAAC,YAAoB;QACrD,MAAM,iBAAiB,GAAW,0BAA0B,CAAC;QAE7D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,gBAAgB,CACxB,qGAAqG,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,MAAM,OAAO,GAAuB;YAClC,MAAM,EAAE,gBAAgB;SACzB,CAAC;QAEF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvD,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAW,MAAM,CAAC,IAAI,CACjC,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,IAAI,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAClE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,OAAO,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,eAAe,CAAC,MAItB;QACC,MAAM,YAAY,GAAoB,IAAI,eAAe,EAAE,CAAC;QAE5D,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC7C,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAEhD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,UAAU,eAAe,IAAI,CAAC,YAAY,aAAa,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClG,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAAC,MAIlC;QACC,MAAM,QAAQ,GAA2B,MAAM,IAAI,CAAC,mBAAmB,CAAC;YACtE,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,WAAW,EAAE,2BAA2B;YACxC,aAAa,EAAE;gBACb,WAAW,EAAE,cAAc;aAC5B;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAc,QAAQ,CAAC,QAAqB,CAAC;QAE3D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAe,QAAsB,CAAC;QAEpD,MAAM,OAAO,GAAsB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACnE,CAAC,CAAG,QAAQ,CAAC,SAAS,CAAe,CAAC,MAAM,CACxC,CAAC,IAAe,EAAW,EAAE;gBAC3B,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAClE,CAAC;YACJ,CAAC,CACoB;YACzB,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,IAAI,GACR,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAE3E,OAAO;YACL,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI;YAC/B,IAAI,EAAE,IAAI,IAAI,IAAI;YAClB,aAAa,EACX,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,4BAA4B,CAAC,IAAI,IAAI;SACjE,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/Utils/SecurityEvent/ThreatIntel/ThreatIntelEnricher.js

@@ -0,0 +1,168 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import OneUptimeDate from "../../../../Types/Date";
+import { ENRICHMENT_CONFIDENCE_ATTRIBUTE, ENRICHMENT_FEED_ATTRIBUTE, ENRICHMENT_FEED_ID_ATTRIBUTE, ENRICHMENT_INDICATOR_ID_ATTRIBUTE, ENRICHMENT_INDICATOR_TYPE_ATTRIBUTE, ENRICHMENT_INDICATOR_VALUE_ATTRIBUTE, ENRICHMENT_MATCHED_ATTRIBUTE, ENRICHMENT_MATCHED_VALUE, ENRICHMENT_MATCH_COUNT_ATTRIBUTE, } from "../../../../Types/SecurityEvent/ThreatIntelConstants";
+import InMemoryTTLCache from "../../../Infrastructure/InMemoryTTLCache";
+import ThreatIntelIndicatorService from "../../../Services/ThreatIntelIndicatorService";
+import logger from "../../Logger";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+/*
+ * Ingest-time IOC enrichment: stamp threat.* attributes onto normalized
+ * security events whose observables match an active indicator, BEFORE
+ * the rows are built (buildSecurityEventDbRow derives attributeKeys from
+ * attributes, so stamped keys become filterable everywhere for free).
+ *
+ * This sits on the hot ingest path, so its cost model is strict:
+ *  - a per-project "has any indicators at all?" probe, cached in-process
+ *    for a minute and invalidated by the poller on ingest, short-circuits
+ *    the overwhelmingly common case of projects with no threat intel;
+ *  - one batched ClickHouse lookup per ingest batch (chunked IN query
+ *    over the batch's distinct observables), never a per-event query;
+ *  - any failure logs and leaves the batch unenriched — enrichment must
+ *    never cost a customer their events.
+ *
+ * Events ingested BEFORE an indicator arrives are never retro-stamped
+ * (ClickHouse rows are immutable in practice); the scheduled matcher
+ * covers intel that lands before the event's match window closes, and
+ * intel arriving later than that only affects future events.
+ */
+const HAS_INDICATORS_CACHE_TTL_IN_MS = 60 * 1000;
+// IN-list chunk per lookup query.
+const MAX_VALUES_PER_LOOKUP_QUERY = 5000;
+/*
+ * Safety valve for pathological batches: at most this many distinct
+ * observables are looked up per batch; the rest go unenriched (the
+ * scheduled matcher still sees those events).
+ */
+const MAX_DISTINCT_VALUES_PER_BATCH = 50000;
+class ThreatIntelEnricher {
+    /*
+     * Called by the feed poller after ingesting new indicator rows so the
+     * next batch's probe sees them instead of a cached "no".
+     */
+    static invalidateProjectCache(projectId) {
+        this.hasIndicatorsCache.delete(projectId.toString());
+    }
+    // Test seam.
+    static clearCaches() {
+        this.hasIndicatorsCache.clear();
+    }
+    static async enrichNormalizedEvents(data) {
+        const result = {
+            eventsMatched: 0,
+            valuesLookedUp: 0,
+        };
+        try {
+            if (data.events.length === 0) {
+                return result;
+            }
+            if (!(await this.projectHasIndicators(data.projectId))) {
+                return result;
+            }
+            /*
+             * Distinct canonical (lowercased) observables across the batch,
+             * plus each event's own canonical set for the stamping pass.
+             */
+            const distinctValues = [];
+            const seenValues = new Set();
+            const canonicalPerEvent = [];
+            for (const event of data.events) {
+                const canonicalValues = [];
+                for (const observable of event.observables || []) {
+                    const canonical = (observable || "").trim().toLowerCase();
+                    if (!canonical) {
+                        continue;
+                    }
+                    canonicalValues.push(canonical);
+                    if (!seenValues.has(canonical) &&
+                        seenValues.size < MAX_DISTINCT_VALUES_PER_BATCH) {
+                        seenValues.add(canonical);
+                        distinctValues.push(canonical);
+                    }
+                }
+                canonicalPerEvent.push(canonicalValues);
+            }
+            if (distinctValues.length === 0) {
+                return result;
+            }
+            result.valuesLookedUp = distinctValues.length;
+            const now = OneUptimeDate.getCurrentDate();
+            /*
+             * One winner per value: the service returns one row per (feed,
+             * value) identity, and when several feeds carry the same value the
+             * highest confidence wins the stamp.
+             */
+            const bestByValue = new Map();
+            for (let offset = 0; offset < distinctValues.length; offset += MAX_VALUES_PER_LOOKUP_QUERY) {
+                const chunk = distinctValues.slice(offset, offset + MAX_VALUES_PER_LOOKUP_QUERY);
+                const indicators = await ThreatIntelIndicatorService.findActiveIndicatorsByValues({
+                    projectId: data.projectId,
+                    values: chunk,
+                    now,
+                });
+                for (const indicator of indicators) {
+                    const existing = bestByValue.get(indicator.indicatorValue);
+                    if (!existing || indicator.confidence > existing.confidence) {
+                        bestByValue.set(indicator.indicatorValue, indicator);
+                    }
+                }
+            }
+            if (bestByValue.size === 0) {
+                return result;
+            }
+            for (let index = 0; index < data.events.length; index++) {
+                const event = data.events[index];
+                const canonicalValues = canonicalPerEvent[index];
+                let best = null;
+                let matchedValueCount = 0;
+                for (const canonical of canonicalValues) {
+                    const indicator = bestByValue.get(canonical);
+                    if (!indicator) {
+                        continue;
+                    }
+                    matchedValueCount++;
+                    if (!best || indicator.confidence > best.confidence) {
+                        best = indicator;
+                    }
+                }
+                if (!best) {
+                    continue;
+                }
+                event.attributes = Object.assign(Object.assign({}, event.attributes), { [ENRICHMENT_MATCHED_ATTRIBUTE]: ENRICHMENT_MATCHED_VALUE, [ENRICHMENT_INDICATOR_ID_ATTRIBUTE]: best.stixId, [ENRICHMENT_INDICATOR_TYPE_ATTRIBUTE]: best.indicatorType, [ENRICHMENT_INDICATOR_VALUE_ATTRIBUTE]: best.indicatorValue, [ENRICHMENT_FEED_ATTRIBUTE]: best.feedName, [ENRICHMENT_FEED_ID_ATTRIBUTE]: best.feedId, [ENRICHMENT_CONFIDENCE_ATTRIBUTE]: String(best.confidence), [ENRICHMENT_MATCH_COUNT_ATTRIBUTE]: String(matchedValueCount) });
+                result.eventsMatched++;
+            }
+            return result;
+        }
+        catch (error) {
+            logger.error(`ThreatIntelEnricher: enrichment failed for project ${data.projectId.toString()}; events continue unenriched.`);
+            logger.error(error);
+            return result;
+        }
+    }
+    static async projectHasIndicators(projectId) {
+        const cacheKey = projectId.toString();
+        const cached = this.hasIndicatorsCache.get(cacheKey);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const hasIndicators = await ThreatIntelIndicatorService.hasIndicatorsForProject(projectId);
+        this.hasIndicatorsCache.set(cacheKey, hasIndicators, HAS_INDICATORS_CACHE_TTL_IN_MS);
+        return hasIndicators;
+    }
+}
+ThreatIntelEnricher.hasIndicatorsCache = new InMemoryTTLCache();
+export default ThreatIntelEnricher;
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ThreatIntelEnricher, "enrichNormalizedEvents", null);
+//# sourceMappingURL=ThreatIntelEnricher.js.map

package/build/dist/Server/Utils/SecurityEvent/ThreatIntel/ThreatIntelEnricher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreatIntelEnricher.js","sourceRoot":"","sources":["../../../../../../Server/Utils/SecurityEvent/ThreatIntel/ThreatIntelEnricher.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,aAAa,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,mCAAmC,EACnC,oCAAoC,EACpC,4BAA4B,EAC5B,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,sDAAsD,CAAC;AAC9D,OAAO,gBAAgB,MAAM,0CAA0C,CAAC;AACxE,OAAO,2BAEN,MAAM,+CAA+C,CAAC;AACvD,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,WAAW,MAAM,6BAA6B,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,8BAA8B,GAAW,EAAE,GAAG,IAAI,CAAC;AAEzD,kCAAkC;AAClC,MAAM,2BAA2B,GAAW,IAAI,CAAC;AAEjD;;;;GAIG;AACH,MAAM,6BAA6B,GAAW,KAAK,CAAC;AAOpD,MAAqB,mBAAmB;IAItC;;;OAGG;IACI,MAAM,CAAC,sBAAsB,CAAC,SAAmB;QACtD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,aAAa;IACN,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAG1C;QACC,MAAM,MAAM,GAAqB;YAC/B,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;SAClB,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED;;;eAGG;YACH,MAAM,cAAc,GAAkB,EAAE,CAAC;YACzC,MAAM,UAAU,GAAgB,IAAI,GAAG,EAAU,CAAC;YAClD,MAAM,iBAAiB,GAAyB,EAAE,CAAC;YAEnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,eAAe,GAAkB,EAAE,CAAC;gBAE1C,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;oBACjD,MAAM,SAAS,GAAW,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAElE,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,SAAS;oBACX,CAAC;oBAED,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAEhC,IACE,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;wBAC1B,UAAU,CAAC,IAAI,GAAG,6BAA6B,EAC/C,CAAC;wBACD,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;wBAC1B,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;gBAED,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC;YAE9C,MAAM,GAAG,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;YAEjD;;;;eAIG;YACH,MAAM,WAAW,GAAiC,IAAI,GAAG,EAGtD,CAAC;YAEJ,KACE,IAAI,MAAM,GAAW,CAAC,EACtB,MAAM,GAAG,cAAc,CAAC,MAAM,EAC9B,MAAM,IAAI,2BAA2B,EACrC,CAAC;gBACD,MAAM,KAAK,GAAkB,cAAc,CAAC,KAAK,CAC/C,MAAM,EACN,MAAM,GAAG,2BAA2B,CACrC,CAAC;gBAEF,MAAM,UAAU,GACd,MAAM,2BAA2B,CAAC,4BAA4B,CAAC;oBAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,MAAM,EAAE,KAAK;oBACb,GAAG;iBACJ,CAAC,CAAC;gBAEL,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;oBACnC,MAAM,QAAQ,GAAgC,WAAW,CAAC,GAAG,CAC3D,SAAS,CAAC,cAAc,CACzB,CAAC;oBAEF,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;wBAC5D,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,KAAK,IAAI,KAAK,GAAW,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAChE,MAAM,KAAK,GAA4B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;gBAC3D,MAAM,eAAe,GAAkB,iBAAiB,CAAC,KAAK,CAAE,CAAC;gBAEjE,IAAI,IAAI,GAA2B,IAAI,CAAC;gBACxC,IAAI,iBAAiB,GAAW,CAAC,CAAC;gBAElC,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;oBACxC,MAAM,SAAS,GACb,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAE7B,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,SAAS;oBACX,CAAC;oBAED,iBAAiB,EAAE,CAAC;oBAEpB,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;wBACpD,IAAI,GAAG,SAAS,CAAC;oBACnB,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,UAAU,mCACX,KAAK,CAAC,UAAU,KACnB,CAAC,4BAA4B,CAAC,EAAE,wBAAwB,EACxD,CAAC,iCAAiC,CAAC,EAAE,IAAI,CAAC,MAAM,EAChD,CAAC,mCAAmC,CAAC,EAAE,IAAI,CAAC,aAAa,EACzD,CAAC,oCAAoC,CAAC,EAAE,IAAI,CAAC,cAAc,EAC3D,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,QAAQ,EAC1C,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,MAAM,EAC3C,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAC1D,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,GAC9D,CAAC;gBAEF,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,sDAAsD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,+BAA+B,CAC/G,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEpB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,oBAAoB,CACvC,SAAmB;QAEnB,MAAM,QAAQ,GAAW,SAAS,CAAC,QAAQ,EAAE,CAAC;QAE9C,MAAM,MAAM,GAAwB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE1E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,aAAa,GACjB,MAAM,2BAA2B,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAEvE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CACzB,QAAQ,EACR,aAAa,EACb,8BAA8B,CAC/B,CAAC;QAEF,OAAO,aAAa,CAAC;IACvB,CAAC;;AA9Lc,sCAAkB,GAC/B,IAAI,gBAAgB,EAAW,CAAC;eAFf,mBAAmB;AAkBlB;IADnB,WAAW,EAAE;;;;uDAuJb"}