@oneuptime/common 12.0.4 → 12.0.6

package/build/dist/Server/Utils/DataSource/EgressGuard.js

@@ -0,0 +1,305 @@
+import dns from "dns";
+import net from "net";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { IsBillingEnabled } from "../../EnvironmentConfig";
+const DNS_LOOKUP_TIMEOUT_IN_MS = 5000;
+const ALWAYS_BLOCKED_IPV4_RANGE_SPECS = [
+    ["127.0.0.0", 8, "loopback address"],
+    ["169.254.0.0", 16, "link-local address (cloud metadata range)"],
+    ["0.0.0.0", 8, "unspecified address"],
+    ["224.0.0.0", 4, "multicast address"],
+    ["240.0.0.0", 4, "reserved address"],
+];
+const PRIVATE_IPV4_RANGE_SPECS = [
+    ["10.0.0.0", 8, "private network address"],
+    ["172.16.0.0", 12, "private network address"],
+    ["192.168.0.0", 16, "private network address"],
+    ["100.64.0.0", 10, "carrier-grade NAT address"],
+    ["192.0.0.0", 24, "IETF protocol assignment address"],
+    ["198.18.0.0", 15, "benchmarking address"],
+    ["192.0.2.0", 24, "documentation address"],
+    ["198.51.100.0", 24, "documentation address"],
+    ["203.0.113.0", 24, "documentation address"],
+];
+export default class DataSourceEgressGuard {
+    static shouldBlockPrivateAddresses() {
+        if (process.env["DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES"] === "true") {
+            return true;
+        }
+        return IsBillingEnabled;
+    }
+    static ipv4ToInt(ip) {
+        const parts = ip.split(".");
+        let value = 0;
+        for (const part of parts) {
+            value = value * 256 + parseInt(part, 10);
+        }
+        // >>> 0 keeps the value an unsigned 32-bit int.
+        return value >>> 0;
+    }
+    static buildRanges(specs) {
+        return specs.map((spec) => {
+            return {
+                base: this.ipv4ToInt(spec[0]),
+                maskBits: spec[1],
+                reason: spec[2],
+            };
+        });
+    }
+    static isInRange(ipAsInt, range) {
+        /*
+         * maskBits 0 would shift by 32 (undefined behavior in JS bitwise ops);
+         * no range here uses it, but guard anyway.
+         */
+        if (range.maskBits <= 0) {
+            return true;
+        }
+        const mask = (0xffffffff << (32 - range.maskBits)) >>> 0;
+        return (ipAsInt & mask) >>> 0 === (range.base & mask) >>> 0;
+    }
+    static checkIpv4(ip, blockPrivateAddresses) {
+        const ipAsInt = this.ipv4ToInt(ip);
+        if (ip === "255.255.255.255") {
+            return { blocked: true, reason: "broadcast address" };
+        }
+        for (const range of this.buildRanges(ALWAYS_BLOCKED_IPV4_RANGE_SPECS)) {
+            if (this.isInRange(ipAsInt, range)) {
+                return { blocked: true, reason: range.reason };
+            }
+        }
+        if (blockPrivateAddresses) {
+            for (const range of this.buildRanges(PRIVATE_IPV4_RANGE_SPECS)) {
+                if (this.isInRange(ipAsInt, range)) {
+                    return { blocked: true, reason: range.reason };
+                }
+            }
+        }
+        return { blocked: false };
+    }
+    /*
+     * Expand an IPv6 address to its full 8-group lowercase form so prefix
+     * checks are string-safe ("fe80::1" -> "fe80:0000:...:0001"). Zone ids
+     * (%eth0) are stripped first.
+     */
+    static expandIpv6(ip) {
+        let address = ip.toLowerCase();
+        const zoneIndex = address.indexOf("%");
+        if (zoneIndex !== -1) {
+            address = address.substring(0, zoneIndex);
+        }
+        /*
+         * Convert a trailing embedded IPv4 (::ffff:127.0.0.1) into two hex
+         * groups so the group math below is uniform.
+         */
+        const lastColon = address.lastIndexOf(":");
+        const tail = address.substring(lastColon + 1);
+        if (tail.includes(".")) {
+            if (net.isIPv4(tail) === false) {
+                return null;
+            }
+            const octets = tail.split(".").map((part) => {
+                return parseInt(part, 10);
+            });
+            const groupA = ((octets[0] << 8) | octets[1]).toString(16);
+            const groupB = ((octets[2] << 8) | octets[3]).toString(16);
+            address = `${address.substring(0, lastColon)}:${groupA}:${groupB}`;
+        }
+        const doubleColonParts = address.split("::");
+        if (doubleColonParts.length > 2) {
+            return null;
+        }
+        let groups;
+        if (doubleColonParts.length === 2) {
+            const head = doubleColonParts[0]
+                ? doubleColonParts[0].split(":")
+                : [];
+            const tailGroups = doubleColonParts[1]
+                ? doubleColonParts[1].split(":")
+                : [];
+            const missing = 8 - head.length - tailGroups.length;
+            if (missing < 0) {
+                return null;
+            }
+            groups = [...head, ...Array(missing).fill("0"), ...tailGroups];
+        }
+        else {
+            groups = address.split(":");
+        }
+        if (groups.length !== 8) {
+            return null;
+        }
+        return groups
+            .map((group) => {
+            return group.padStart(4, "0");
+        })
+            .join(":");
+    }
+    static checkIpv6(ip, blockPrivateAddresses) {
+        const expanded = this.expandIpv6(ip);
+        if (!expanded) {
+            return { blocked: true, reason: "unparseable IPv6 address" };
+        }
+        /*
+         * IPv4-mapped (::ffff:a.b.c.d) and NAT64 (64:ff9b::/96) addresses
+         * reach IPv4 targets — extract the embedded IPv4 and apply the IPv4
+         * policy so mapping can't be used to smuggle a blocked v4 address.
+         */
+        const embeddedV4Prefixes = [
+            "0000:0000:0000:0000:0000:ffff:",
+            "0064:ff9b:0000:0000:0000:0000:",
+        ];
+        for (const prefix of embeddedV4Prefixes) {
+            if (expanded.startsWith(prefix)) {
+                const hexGroups = expanded
+                    .substring(prefix.length)
+                    .split(":");
+                const high = parseInt(hexGroups[0], 16);
+                const low = parseInt(hexGroups[1], 16);
+                const embedded = [
+                    (high >> 8) & 0xff,
+                    high & 0xff,
+                    (low >> 8) & 0xff,
+                    low & 0xff,
+                ].join(".");
+                return this.checkIpv4(embedded, blockPrivateAddresses);
+            }
+        }
+        const allZero = expanded === "0000:".repeat(7) + "0000";
+        if (allZero) {
+            return { blocked: true, reason: "unspecified address" };
+        }
+        if (expanded === "0000:".repeat(7) + "0001") {
+            return { blocked: true, reason: "loopback address" };
+        }
+        const firstGroup = parseInt(expanded.substring(0, 4), 16);
+        // fe80::/10 link-local.
+        if ((firstGroup & 0xffc0) === 0xfe80) {
+            return { blocked: true, reason: "link-local address" };
+        }
+        // ff00::/8 multicast.
+        if ((firstGroup & 0xff00) === 0xff00) {
+            return { blocked: true, reason: "multicast address" };
+        }
+        if (blockPrivateAddresses) {
+            // fc00::/7 unique-local.
+            if ((firstGroup & 0xfe00) === 0xfc00) {
+                return { blocked: true, reason: "private network address" };
+            }
+            // 2001:db8::/32 documentation.
+            if (expanded.startsWith("2001:0db8:")) {
+                return { blocked: true, reason: "documentation address" };
+            }
+        }
+        return { blocked: false };
+    }
+    /*
+     * Verdict for a single literal IP address under the given (or derived)
+     * policy. Exposed for tests and for connectors that receive addresses
+     * from somewhere other than the standard resolve path.
+     */
+    static checkAddress(address, options) {
+        var _a;
+        const blockPrivateAddresses = (_a = options === null || options === void 0 ? void 0 : options.blockPrivateAddresses) !== null && _a !== void 0 ? _a : this.shouldBlockPrivateAddresses();
+        const family = net.isIP(address);
+        if (family === 4) {
+            return this.checkIpv4(address, blockPrivateAddresses);
+        }
+        if (family === 6) {
+            return this.checkIpv6(address, blockPrivateAddresses);
+        }
+        return { blocked: true, reason: "not a valid IP address" };
+    }
+    static async defaultResolve(hostname) {
+        /*
+         * dns.lookup (getaddrinfo) rather than dns.resolve so /etc/hosts and
+         * container DNS behave exactly as the eventual socket connect would —
+         * we must validate what would actually be dialed.
+         */
+        const lookupPromise = dns.promises
+            .lookup(hostname, { all: true })
+            .then((results) => {
+            return results.map((result) => {
+                return { address: result.address, family: result.family };
+            });
+        });
+        let timeoutHandle = undefined;
+        const timeoutPromise = new Promise((_resolve, reject) => {
+            timeoutHandle = setTimeout(() => {
+                reject(new BadDataException(`DNS lookup timed out for ${hostname}`));
+            }, DNS_LOOKUP_TIMEOUT_IN_MS);
+        });
+        try {
+            return await Promise.race([lookupPromise, timeoutPromise]);
+        }
+        finally {
+            if (timeoutHandle) {
+                clearTimeout(timeoutHandle);
+            }
+        }
+    }
+    /*
+     * Resolve a hostname (or accept a literal IP) and assert every address it
+     * can reach is allowed. Returns the validated addresses so HTTP callers
+     * can pin them into the socket lookup. Throws BadDataException when any
+     * address is blocked — ALL must pass, otherwise a multi-record DNS answer
+     * could mix one public decoy with a private target.
+     */
+    static async assertHostnameAllowed(hostname, options) {
+        if (!hostname) {
+            throw new BadDataException("Data source host is required.");
+        }
+        // Literal [::1] style hosts arrive with brackets from URL parsing.
+        const bareHostname = hostname.replace(/^\[|\]$/g, "");
+        if (net.isIP(bareHostname) !== 0) {
+            const verdict = this.checkAddress(bareHostname, options);
+            if (verdict.blocked) {
+                throw new BadDataException(`Data source host ${bareHostname} is not allowed: ${verdict.reason}.`);
+            }
+            return [{ address: bareHostname, family: net.isIP(bareHostname) }];
+        }
+        const resolveFunction = (options === null || options === void 0 ? void 0 : options.resolveFunction) ||
+            ((host) => {
+                return this.defaultResolve(host);
+            });
+        let addresses = [];
+        try {
+            addresses = await resolveFunction(bareHostname);
+        }
+        catch (error) {
+            throw new BadDataException(`Could not resolve data source host ${bareHostname}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (addresses.length === 0) {
+            throw new BadDataException(`Could not resolve data source host ${bareHostname}.`);
+        }
+        for (const resolved of addresses) {
+            const verdict = this.checkAddress(resolved.address, options);
+            if (verdict.blocked) {
+                throw new BadDataException(`Data source host ${bareHostname} resolves to ${resolved.address}, which is not allowed: ${verdict.reason}.`);
+            }
+        }
+        return addresses;
+    }
+    /*
+     * Validate a full HTTP(S) URL: scheme must be http/https and the host
+     * must pass address validation. Returns the parsed URL plus the pinned
+     * addresses for the HTTP client.
+     */
+    static async assertUrlAllowed(urlString, options) {
+        if (!urlString) {
+            throw new BadDataException("Data source URL is required.");
+        }
+        let url;
+        try {
+            url = new URL(urlString);
+        }
+        catch (_a) {
+            throw new BadDataException(`Invalid data source URL: ${urlString}`);
+        }
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            throw new BadDataException(`Data source URL must use http or https (got ${url.protocol.replace(":", "")}).`);
+        }
+        const addresses = await this.assertHostnameAllowed(url.hostname, options);
+        return { url, addresses };
+    }
+}
+//# sourceMappingURL=EgressGuard.js.map

package/build/dist/Server/Utils/DataSource/EgressGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EgressGuard.js","sourceRoot":"","sources":["../../../../../Server/Utils/DataSource/EgressGuard.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAyD3D,MAAM,wBAAwB,GAAW,IAAI,CAAC;AAU9C,MAAM,+BAA+B,GAAqB;IACxD,CAAC,WAAW,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACpC,CAAC,aAAa,EAAE,EAAE,EAAE,2CAA2C,CAAC;IAChE,CAAC,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC;IACrC,CAAC,WAAW,EAAE,CAAC,EAAE,mBAAmB,CAAC;IACrC,CAAC,WAAW,EAAE,CAAC,EAAE,kBAAkB,CAAC;CACrC,CAAC;AAEF,MAAM,wBAAwB,GAAqB;IACjD,CAAC,UAAU,EAAE,CAAC,EAAE,yBAAyB,CAAC;IAC1C,CAAC,YAAY,EAAE,EAAE,EAAE,yBAAyB,CAAC;IAC7C,CAAC,aAAa,EAAE,EAAE,EAAE,yBAAyB,CAAC;IAC9C,CAAC,YAAY,EAAE,EAAE,EAAE,2BAA2B,CAAC;IAC/C,CAAC,WAAW,EAAE,EAAE,EAAE,kCAAkC,CAAC;IACrD,CAAC,YAAY,EAAE,EAAE,EAAE,sBAAsB,CAAC;IAC1C,CAAC,WAAW,EAAE,EAAE,EAAE,uBAAuB,CAAC;IAC1C,CAAC,cAAc,EAAE,EAAE,EAAE,uBAAuB,CAAC;IAC7C,CAAC,aAAa,EAAE,EAAE,EAAE,uBAAuB,CAAC;CAC7C,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,qBAAqB;IACjC,MAAM,CAAC,2BAA2B;QACvC,IAAI,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,KAAK,MAAM,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,EAAU;QACjC,MAAM,KAAK,GAAkB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,GAAW,CAAC,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,gDAAgD;QAChD,OAAO,KAAK,KAAK,CAAC,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,KAAuB;QAChD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE;YACnC,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7B,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;aAChB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,OAAe,EAAE,KAAgB;QACxD;;;WAGG;QACH,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAW,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,EAAU,EACV,qBAA8B;QAE9B,MAAM,OAAO,GAAW,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAE3C,IAAI,EAAE,KAAK,iBAAiB,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,+BAA+B,CAAC,EAAE,CAAC;YACtE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;QAED,IAAI,qBAAqB,EAAE,CAAC;YAC1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;oBACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,UAAU,CAAC,EAAU;QAClC,IAAI,OAAO,GAAW,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,SAAS,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED;;;WAGG;QACH,MAAM,SAAS,GAAW,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,IAAI,GAAW,OAAO,CAAC,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;gBACjE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,GAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,gBAAgB,GAAkB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAqB,CAAC;QAC1B,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAkB,gBAAgB,CAAC,CAAC,CAAC;gBAC7C,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBAChC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,UAAU,GAAkB,gBAAgB,CAAC,CAAC,CAAC;gBACnD,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBAChC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,OAAO,GAAW,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YAC5D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE;YACrB,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,EAAU,EACV,qBAA8B;QAE9B,MAAM,QAAQ,GAAkB,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC/D,CAAC;QAED;;;;WAIG;QACH,MAAM,kBAAkB,GAAkB;YACxC,gCAAgC;YAChC,gCAAgC;SACjC,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACxC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,SAAS,GAAkB,QAAQ;qBACtC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;qBACxB,KAAK,CAAC,GAAG,CAAC,CAAC;gBACd,MAAM,IAAI,GAAW,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;gBACjD,MAAM,GAAG,GAAW,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;gBAChD,MAAM,QAAQ,GAAW;oBACvB,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI;oBAClB,IAAI,GAAG,IAAI;oBACX,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI;oBACjB,GAAG,GAAG,IAAI;iBACX,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAY,QAAQ,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACjE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvD,CAAC;QAED,MAAM,UAAU,GAAW,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,wBAAwB;QACxB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACzD,CAAC;QACD,sBAAsB;QACtB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,qBAAqB,EAAE,CAAC;YAC1B,yBAAyB;YACzB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;gBACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;YAC9D,CAAC;YACD,+BAA+B;YAC/B,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,YAAY,CACxB,OAAe,EACf,OAA4B;;QAE5B,MAAM,qBAAqB,GACzB,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,qBAAqB,mCAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEvE,MAAM,MAAM,GAAW,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7D,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,cAAc,CACjC,QAAgB;QAEhB;;;;WAIG;QACH,MAAM,aAAa,GAAoC,GAAG,CAAC,QAAQ;aAChE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aAC/B,IAAI,CAAC,CAAC,OAAmD,EAAE,EAAE;YAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAA2C,EAAE,EAAE;gBACjE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,IAAI,aAAa,GAA8C,SAAS,CAAC;QACzE,MAAM,cAAc,GAAmB,IAAI,OAAO,CAChD,CAAC,QAAgC,EAAE,MAA8B,EAAE,EAAE;YACnE,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,MAAM,CAAC,IAAI,gBAAgB,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,aAAa,EAAE,CAAC;gBAClB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CACvC,QAAgB,EAChB,OAA4B;QAE5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QAC9D,CAAC;QAED,mEAAmE;QACnE,MAAM,YAAY,GAAW,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAmB,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACzE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,YAAY,oBAAoB,OAAO,CAAC,MAAM,GAAG,CACtE,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,eAAe,GACnB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;YACxB,CAAC,CAAC,IAAY,EAAE,EAAE;gBAChB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QAEL,IAAI,SAAS,GAA2B,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,YAAY,KAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,YAAY,GAAG,CACtD,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAmB,IAAI,CAAC,YAAY,CAC/C,QAAQ,CAAC,OAAO,EAChB,OAAO,CACR,CAAC;YACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,YAAY,gBAAgB,QAAQ,CAAC,OAAO,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAClC,SAAiB,EACjB,OAA4B;QAE5B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,GAAG,CAAC,QAAQ,CAAC,OAAO,CACjE,GAAG,EACH,EAAE,CACH,IAAI,CACN,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAA2B,MAAM,IAAI,CAAC,qBAAqB,CACxE,GAAG,CAAC,QAAQ,EACZ,OAAO,CACR,CAAC;QAEF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;CACF"}

package/build/dist/Server/Utils/DataSource/HttpFetch.js

@@ -0,0 +1,134 @@
+import http from "http";
+import https from "https";
+import axios from "axios";
+import API from "../../../Utils/API";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { DATA_SOURCE_MAX_RESPONSE_SIZE_IN_BYTES, DATA_SOURCE_QUERY_TIMEOUT_IN_MS, } from "../../../Types/DataSource/DataSourceLimits";
+import DataSourceEgressGuard from "./EgressGuard";
+export default class DataSourceHttpFetch {
+    /*
+     * Standard auth headers for a data source: Bearer token wins, else HTTP
+     * basic from username/password; custom headers are applied last so an
+     * explicit Authorization header in customHeaders takes precedence.
+     */
+    static buildAuthHeaders(settings) {
+        const headers = {};
+        if (settings.apiToken) {
+            headers["Authorization"] = `Bearer ${settings.apiToken}`;
+        }
+        else if (settings.username || settings.password) {
+            const encoded = Buffer.from(`${settings.username || ""}:${settings.password || ""}`).toString("base64");
+            headers["Authorization"] = `Basic ${encoded}`;
+        }
+        if (settings.customHeaders) {
+            for (const key of Object.keys(settings.customHeaders)) {
+                headers[key] = settings.customHeaders[key];
+            }
+        }
+        return headers;
+    }
+    static async fetch(request) {
+        var _a;
+        const { url, addresses } = await DataSourceEgressGuard.assertUrlAllowed(request.url, request.egressOptions);
+        /*
+         * Pin the validated addresses: whatever getaddrinfo said at validation
+         * time is what the socket dials, even if DNS answers differently a
+         * millisecond later.
+         */
+        const pinnedLookup = (_hostname, options, callback) => {
+            const first = addresses[0];
+            if (options && options.all) {
+                callback(null, addresses.map((resolved) => {
+                    return { address: resolved.address, family: resolved.family };
+                }));
+                return;
+            }
+            callback(null, first.address, first.family);
+        };
+        const httpAgent = new http.Agent({
+            lookup: pinnedLookup,
+        });
+        const httpsAgent = new https.Agent({
+            lookup: pinnedLookup,
+        });
+        const headers = Object.assign({}, (request.headers || {}));
+        let data = undefined;
+        if (request.method === "POST" && request.body !== undefined) {
+            if (typeof request.body === "string") {
+                data = request.body;
+                if (!headers["Content-Type"]) {
+                    headers["Content-Type"] = "application/json";
+                }
+            }
+            else if (request.formUrlEncoded) {
+                data = new URLSearchParams(request.body);
+                headers["Content-Type"] = "application/x-www-form-urlencoded";
+            }
+            else {
+                data = JSON.stringify(request.body);
+                headers["Content-Type"] = "application/json";
+            }
+        }
+        const axiosOptions = {
+            method: request.method,
+            url: url.toString(),
+            headers: headers,
+            data: data,
+            timeout: request.timeoutInMs || DATA_SOURCE_QUERY_TIMEOUT_IN_MS,
+            maxRedirects: 0,
+            maxContentLength: DATA_SOURCE_MAX_RESPONSE_SIZE_IN_BYTES,
+            maxBodyLength: DATA_SOURCE_MAX_RESPONSE_SIZE_IN_BYTES,
+            /*
+             * Keep the raw body so connectors can produce useful errors for
+             * non-JSON responses; status handling is ours, not axios'.
+             */
+            responseType: "text",
+            transformResponse: [
+                (body) => {
+                    return body;
+                },
+            ],
+            validateStatus: (status) => {
+                // 3xx must throw — redirects are refused by policy, not followed.
+                return status < 300;
+            },
+            httpAgent: httpAgent,
+            httpsAgent: httpsAgent,
+        };
+        try {
+            const response = await axios(axiosOptions);
+            const bodyText = response.data || "";
+            let bodyJson = undefined;
+            try {
+                bodyJson = JSON.parse(bodyText);
+            }
+            catch (_b) {
+                bodyJson = undefined;
+            }
+            return {
+                statusCode: response.status,
+                bodyText: bodyText,
+                bodyJson: bodyJson,
+            };
+        }
+        catch (error) {
+            if (axios.isAxiosError(error) && error.response) {
+                /*
+                 * The server answered with an error status. Surface status + a
+                 * trimmed body excerpt — Prometheus/Elasticsearch put the real
+                 * reason ("parse error at char 5") in the body.
+                 */
+                const responseBody = typeof error.response.data === "string"
+                    ? error.response.data
+                    : JSON.stringify((_a = error.response.data) !== null && _a !== void 0 ? _a : "");
+                throw new BadDataException(`Data source responded with HTTP ${error.response.status}: ${responseBody.substring(0, 500)}`);
+            }
+            throw new BadDataException(`Could not reach data source: ${API.getFriendlyErrorMessage(error)}`);
+        }
+        finally {
+            httpAgent.destroy();
+            httpsAgent.destroy();
+        }
+    }
+}
+//# sourceMappingURL=HttpFetch.js.map

package/build/dist/Server/Utils/DataSource/HttpFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpFetch.js","sourceRoot":"","sources":["../../../../../Server/Utils/DataSource/HttpFetch.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAA4C,MAAM,OAAO,CAAC;AACjE,OAAO,GAAG,MAAM,oBAAoB,CAAC;AAErC,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,EACL,sCAAsC,EACtC,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,OAAO,qBAGN,MAAM,eAAe,CAAC;AAiDvB,MAAM,CAAC,OAAO,OAAO,mBAAmB;IACtC;;;;OAIG;IACI,MAAM,CAAC,gBAAgB,CAC5B,QAAsC;QAEtC,MAAM,OAAO,GAAuB,EAAE,CAAC;QAEvC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,OAAO,GAAW,MAAM,CAAC,IAAI,CACjC,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CACxD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,OAAO,EAAE,CAAC;QAChD,CAAC;QAED,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAW,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,KAAK,CACvB,OAA8B;;QAE9B,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,CAAC,gBAAgB,CACrE,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,aAAa,CACtB,CAAC;QAEF;;;;WAIG;QACH,MAAM,YAAY,GAIN,CACV,SAAiB,EACjB,OAA0B,EAC1B,QAAwB,EAClB,EAAE;YACR,MAAM,KAAK,GAAoB,SAAS,CAAC,CAAC,CAAE,CAAC;YAC7C,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC3B,QAAQ,CACN,IAAI,EACJ,SAAS,CAAC,GAAG,CAAC,CAAC,QAAyB,EAAE,EAAE;oBAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAChE,CAAC,CAAC,CACH,CAAC;gBACF,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,SAAS,GAAe,IAAI,IAAI,CAAC,KAAK,CAAC;YAC3C,MAAM,EAAE,YAAqB;SAC9B,CAAC,CAAC;QACH,MAAM,UAAU,GAAgB,IAAI,KAAK,CAAC,KAAK,CAAC;YAC9C,MAAM,EAAE,YAAqB;SAC9B,CAAC,CAAC;QAEH,MAAM,OAAO,qBAA4B,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAE,CAAC;QAEnE,IAAI,IAAI,GAAyC,SAAS,CAAC;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5D,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC7B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC/C,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAClC,IAAI,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACzC,OAAO,CAAC,cAAc,CAAC,GAAG,mCAAmC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAuB;YACvC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,+BAA+B;YAC/D,YAAY,EAAE,CAAC;YACf,gBAAgB,EAAE,sCAAsC;YACxD,aAAa,EAAE,sCAAsC;YACrD;;;eAGG;YACH,YAAY,EAAE,MAAM;YACpB,iBAAiB,EAAE;gBACjB,CAAC,IAAY,EAAU,EAAE;oBACvB,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;YACD,cAAc,EAAE,CAAC,MAAc,EAAW,EAAE;gBAC1C,kEAAkE;gBAClE,OAAO,MAAM,GAAG,GAAG,CAAC;YACtB,CAAC;YACD,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,UAAU;SACvB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAA0B,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAW,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;YAE7C,IAAI,QAAQ,GAAY,SAAS,CAAC;YAClC,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YAAC,WAAM,CAAC;gBACP,QAAQ,GAAG,SAAS,CAAC;YACvB,CAAC;YAED,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAChD;;;;mBAIG;gBACH,MAAM,YAAY,GAChB,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;oBACrC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;oBACrB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAA,KAAK,CAAC,QAAQ,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC;gBAChD,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9F,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,gBAAgB,CACxB,gCAAgC,GAAG,CAAC,uBAAuB,CACzD,KAAc,CACf,EAAE,CACJ,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}