@opentdf/sdk 0.3.1 → 0.3.2-beta.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/src/access/access-fetch.js +155 -0
- package/dist/cjs/src/access/access-rpc.js +131 -0
- package/dist/cjs/src/access.js +81 -107
- package/dist/cjs/src/auth/oidc.js +2 -2
- package/dist/cjs/src/nanotdf/Client.js +17 -13
- package/dist/cjs/src/nanotdf/models/Header.js +2 -2
- package/dist/cjs/src/nanotdf-crypto/keyAgreement.js +2 -2
- package/dist/cjs/src/opentdf.js +42 -8
- package/dist/cjs/src/platform/authorization/authorization_pb.js +138 -0
- package/dist/cjs/src/platform/buf/validate/validate_pb.js +410 -0
- package/dist/cjs/src/platform/common/common_pb.js +79 -0
- package/dist/cjs/src/platform/entityresolution/entity_resolution_pb.js +49 -0
- package/dist/cjs/src/platform/google/api/annotations_pb.js +30 -0
- package/dist/cjs/src/platform/google/api/http_pb.js +37 -0
- package/dist/cjs/src/platform/kas/kas_pb.js +96 -0
- package/dist/cjs/src/platform/policy/actions/actions_pb.js +70 -0
- package/dist/cjs/src/platform/policy/attributes/attributes_pb.js +240 -0
- package/dist/cjs/src/platform/policy/kasregistry/key_access_server_registry_pb.js +236 -0
- package/dist/cjs/src/platform/policy/keymanagement/key_management_pb.js +70 -0
- package/dist/cjs/src/platform/policy/namespaces/namespaces_pb.js +121 -0
- package/dist/cjs/src/platform/policy/objects_pb.js +395 -0
- package/dist/cjs/src/platform/policy/registeredresources/registered_resources_pb.js +132 -0
- package/dist/cjs/src/platform/policy/resourcemapping/resource_mapping_pb.js +139 -0
- package/dist/cjs/src/platform/policy/selectors_pb.js +67 -0
- package/dist/cjs/src/platform/policy/subjectmapping/subject_mapping_pb.js +146 -0
- package/dist/cjs/src/platform/policy/unsafe/unsafe_pb.js +124 -0
- package/dist/cjs/src/platform/protoc-gen-openapiv2/options/annotations_pb.js +68 -0
- package/dist/cjs/src/platform/protoc-gen-openapiv2/options/openapiv2_pb.js +307 -0
- package/dist/cjs/src/platform/wellknownconfiguration/wellknown_configuration_pb.js +33 -0
- package/dist/cjs/src/platform.js +124 -0
- package/dist/cjs/src/policy/api.js +21 -38
- package/dist/cjs/src/policy/attributes.js +4 -1
- package/dist/cjs/src/policy/granter.js +9 -9
- package/dist/cjs/src/utils.js +31 -1
- package/dist/cjs/src/version.js +2 -2
- package/dist/cjs/tdf3/src/client/index.js +23 -18
- package/dist/cjs/tdf3/src/tdf.js +5 -5
- package/dist/types/src/access/access-fetch.d.ts +21 -0
- package/dist/types/src/access/access-fetch.d.ts.map +1 -0
- package/dist/types/src/access/access-rpc.d.ts +22 -0
- package/dist/types/src/access/access-rpc.d.ts.map +1 -0
- package/dist/types/src/access.d.ts +19 -11
- package/dist/types/src/access.d.ts.map +1 -1
- package/dist/types/src/nanotdf/Client.d.ts +3 -1
- package/dist/types/src/nanotdf/Client.d.ts.map +1 -1
- package/dist/types/src/opentdf.d.ts +5 -1
- package/dist/types/src/opentdf.d.ts.map +1 -1
- package/dist/types/src/platform/authorization/authorization_pb.d.ts +609 -0
- package/dist/types/src/platform/authorization/authorization_pb.d.ts.map +1 -0
- package/dist/types/src/platform/buf/validate/validate_pb.d.ts +4466 -0
- package/dist/types/src/platform/buf/validate/validate_pb.d.ts.map +1 -0
- package/dist/types/src/platform/common/common_pb.d.ts +112 -0
- package/dist/types/src/platform/common/common_pb.d.ts.map +1 -0
- package/dist/types/src/platform/entityresolution/entity_resolution_pb.d.ts +199 -0
- package/dist/types/src/platform/entityresolution/entity_resolution_pb.d.ts.map +1 -0
- package/dist/types/src/platform/google/api/annotations_pb.d.ts +14 -0
- package/dist/types/src/platform/google/api/annotations_pb.d.ts.map +1 -0
- package/dist/types/src/platform/google/api/http_pb.d.ts +441 -0
- package/dist/types/src/platform/google/api/http_pb.d.ts.map +1 -0
- package/dist/types/src/platform/kas/kas_pb.d.ts +404 -0
- package/dist/types/src/platform/kas/kas_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/actions/actions_pb.d.ts +265 -0
- package/dist/types/src/platform/policy/actions/actions_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/attributes/attributes_pb.d.ts +1022 -0
- package/dist/types/src/platform/policy/attributes/attributes_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/kasregistry/key_access_server_registry_pb.d.ts +1306 -0
- package/dist/types/src/platform/policy/kasregistry/key_access_server_registry_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/keymanagement/key_management_pb.d.ts +269 -0
- package/dist/types/src/platform/policy/keymanagement/key_management_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/namespaces/namespaces_pb.d.ts +448 -0
- package/dist/types/src/platform/policy/namespaces/namespaces_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/objects_pb.d.ts +1112 -0
- package/dist/types/src/platform/policy/objects_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/registeredresources/registered_resources_pb.d.ts +539 -0
- package/dist/types/src/platform/policy/registeredresources/registered_resources_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/resourcemapping/resource_mapping_pb.d.ts +558 -0
- package/dist/types/src/platform/policy/resourcemapping/resource_mapping_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/selectors_pb.d.ts +221 -0
- package/dist/types/src/platform/policy/selectors_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/subjectmapping/subject_mapping_pb.d.ts +582 -0
- package/dist/types/src/platform/policy/subjectmapping/subject_mapping_pb.d.ts.map +1 -0
- package/dist/types/src/platform/policy/unsafe/unsafe_pb.d.ts +513 -0
- package/dist/types/src/platform/policy/unsafe/unsafe_pb.d.ts.map +1 -0
- package/dist/types/src/platform/protoc-gen-openapiv2/options/annotations_pb.d.ts +62 -0
- package/dist/types/src/platform/protoc-gen-openapiv2/options/annotations_pb.d.ts.map +1 -0
- package/dist/types/src/platform/protoc-gen-openapiv2/options/openapiv2_pb.d.ts +1441 -0
- package/dist/types/src/platform/protoc-gen-openapiv2/options/openapiv2_pb.d.ts.map +1 -0
- package/dist/types/src/platform/wellknownconfiguration/wellknown_configuration_pb.d.ts +59 -0
- package/dist/types/src/platform/wellknownconfiguration/wellknown_configuration_pb.d.ts.map +1 -0
- package/dist/types/src/platform.d.ts +49 -0
- package/dist/types/src/platform.d.ts.map +1 -0
- package/dist/types/src/policy/api.d.ts +1 -1
- package/dist/types/src/policy/api.d.ts.map +1 -1
- package/dist/types/src/policy/attributes.d.ts +10 -87
- package/dist/types/src/policy/attributes.d.ts.map +1 -1
- package/dist/types/src/policy/granter.d.ts.map +1 -1
- package/dist/types/src/utils.d.ts +10 -0
- package/dist/types/src/utils.d.ts.map +1 -1
- package/dist/types/src/version.d.ts +1 -1
- package/dist/types/tdf3/src/client/index.d.ts +8 -3
- package/dist/types/tdf3/src/client/index.d.ts.map +1 -1
- package/dist/types/tdf3/src/tdf.d.ts.map +1 -1
- package/dist/web/src/access/access-fetch.js +150 -0
- package/dist/web/src/access/access-rpc.js +125 -0
- package/dist/web/src/access.js +82 -110
- package/dist/web/src/auth/oidc.js +2 -2
- package/dist/web/src/nanotdf/Client.js +18 -14
- package/dist/web/src/nanotdf/models/Header.js +2 -2
- package/dist/web/src/nanotdf-crypto/keyAgreement.js +2 -2
- package/dist/web/src/opentdf.js +43 -9
- package/dist/web/src/platform/authorization/authorization_pb.js +135 -0
- package/dist/web/src/platform/buf/validate/validate_pb.js +407 -0
- package/dist/web/src/platform/common/common_pb.js +76 -0
- package/dist/web/src/platform/entityresolution/entity_resolution_pb.js +46 -0
- package/dist/web/src/platform/google/api/annotations_pb.js +27 -0
- package/dist/web/src/platform/google/api/http_pb.js +34 -0
- package/dist/web/src/platform/kas/kas_pb.js +93 -0
- package/dist/web/src/platform/policy/actions/actions_pb.js +67 -0
- package/dist/web/src/platform/policy/attributes/attributes_pb.js +237 -0
- package/dist/web/src/platform/policy/kasregistry/key_access_server_registry_pb.js +233 -0
- package/dist/web/src/platform/policy/keymanagement/key_management_pb.js +67 -0
- package/dist/web/src/platform/policy/namespaces/namespaces_pb.js +118 -0
- package/dist/web/src/platform/policy/objects_pb.js +392 -0
- package/dist/web/src/platform/policy/registeredresources/registered_resources_pb.js +129 -0
- package/dist/web/src/platform/policy/resourcemapping/resource_mapping_pb.js +136 -0
- package/dist/web/src/platform/policy/selectors_pb.js +64 -0
- package/dist/web/src/platform/policy/subjectmapping/subject_mapping_pb.js +143 -0
- package/dist/web/src/platform/policy/unsafe/unsafe_pb.js +121 -0
- package/dist/web/src/platform/protoc-gen-openapiv2/options/annotations_pb.js +65 -0
- package/dist/web/src/platform/protoc-gen-openapiv2/options/openapiv2_pb.js +304 -0
- package/dist/web/src/platform/wellknownconfiguration/wellknown_configuration_pb.js +30 -0
- package/dist/web/src/platform.js +87 -0
- package/dist/web/src/policy/api.js +23 -40
- package/dist/web/src/policy/attributes.js +3 -2
- package/dist/web/src/policy/granter.js +9 -9
- package/dist/web/src/utils.js +29 -1
- package/dist/web/src/version.js +2 -2
- package/dist/web/tdf3/src/client/index.js +25 -20
- package/dist/web/tdf3/src/tdf.js +5 -5
- package/package.json +17 -1
- package/src/access/access-fetch.ts +202 -0
- package/src/access/access-rpc.ts +175 -0
- package/src/access.ts +113 -138
- package/src/auth/oidc.ts +1 -1
- package/src/nanotdf/Client.ts +28 -18
- package/src/nanotdf/models/Header.ts +1 -1
- package/src/nanotdf-crypto/keyAgreement.ts +1 -1
- package/src/opentdf.ts +66 -10
- package/src/platform/authorization/authorization_pb.ts +689 -0
- package/src/platform/buf/validate/validate_pb.ts +4626 -0
- package/src/platform/common/common_pb.ts +135 -0
- package/src/platform/entityresolution/entity_resolution_pb.ts +233 -0
- package/src/platform/google/api/annotations_pb.ts +39 -0
- package/src/platform/google/api/http_pb.ts +474 -0
- package/src/platform/kas/kas_pb.ts +484 -0
- package/src/platform/policy/actions/actions_pb.ts +312 -0
- package/src/platform/policy/attributes/attributes_pb.ts +1181 -0
- package/src/platform/policy/kasregistry/key_access_server_registry_pb.ts +1482 -0
- package/src/platform/policy/keymanagement/key_management_pb.ts +316 -0
- package/src/platform/policy/namespaces/namespaces_pb.ts +528 -0
- package/src/platform/policy/objects_pb.ts +1319 -0
- package/src/platform/policy/registeredresources/registered_resources_pb.ts +623 -0
- package/src/platform/policy/resourcemapping/resource_mapping_pb.ts +658 -0
- package/src/platform/policy/selectors_pb.ts +277 -0
- package/src/platform/policy/subjectmapping/subject_mapping_pb.ts +687 -0
- package/src/platform/policy/unsafe/unsafe_pb.ts +593 -0
- package/src/platform/protoc-gen-openapiv2/options/annotations_pb.ts +83 -0
- package/src/platform/protoc-gen-openapiv2/options/openapiv2_pb.ts +1615 -0
- package/src/platform/wellknownconfiguration/wellknown_configuration_pb.ts +78 -0
- package/src/platform.ts +122 -0
- package/src/policy/api.ts +29 -42
- package/src/policy/attributes.ts +12 -108
- package/src/policy/granter.ts +7 -8
- package/src/utils.ts +30 -0
- package/src/version.ts +1 -1
- package/tdf3/src/client/index.ts +40 -19
- package/tdf3/src/tdf.ts +5 -6
- package/src/platform/authorization/authorization_connect.d.ts +0 -44
- package/src/platform/authorization/authorization_connect.js +0 -44
- package/src/platform/authorization/authorization_pb.d.ts +0 -707
- package/src/platform/authorization/authorization_pb.js +0 -372
- package/src/platform/common/common_pb.d.ts +0 -129
- package/src/platform/common/common_pb.js +0 -58
- package/src/platform/entityresolution/entity_resolution_connect.d.ts +0 -35
- package/src/platform/entityresolution/entity_resolution_connect.js +0 -35
- package/src/platform/entityresolution/entity_resolution_pb.d.ts +0 -242
- package/src/platform/entityresolution/entity_resolution_pb.js +0 -139
- package/src/platform/kas/kas_connect.d.ts +0 -59
- package/src/platform/kas/kas_connect.js +0 -59
- package/src/platform/kas/kas_pb.d.ts +0 -200
- package/src/platform/kas/kas_pb.js +0 -84
- package/src/platform/policy/attributes/attributes_connect.d.ts +0 -168
- package/src/platform/policy/attributes/attributes_connect.js +0 -168
- package/src/platform/policy/attributes/attributes_pb.d.ts +0 -929
- package/src/platform/policy/attributes/attributes_pb.js +0 -363
- package/src/platform/policy/kasregistry/key_access_server_registry_connect.d.ts +0 -62
- package/src/platform/policy/kasregistry/key_access_server_registry_connect.js +0 -62
- package/src/platform/policy/kasregistry/key_access_server_registry_pb.d.ts +0 -283
- package/src/platform/policy/kasregistry/key_access_server_registry_pb.js +0 -113
- package/src/platform/policy/namespaces/namespaces_connect.d.ts +0 -62
- package/src/platform/policy/namespaces/namespaces_connect.js +0 -62
- package/src/platform/policy/namespaces/namespaces_pb.d.ts +0 -270
- package/src/platform/policy/namespaces/namespaces_pb.js +0 -110
- package/src/platform/policy/objects_pb.d.ts +0 -725
- package/src/platform/policy/objects_pb.js +0 -288
- package/src/platform/policy/resourcemapping/resource_mapping_connect.d.ts +0 -259
- package/src/platform/policy/resourcemapping/resource_mapping_connect.js +0 -259
- package/src/platform/policy/resourcemapping/resource_mapping_pb.d.ts +0 -314
- package/src/platform/policy/resourcemapping/resource_mapping_pb.js +0 -142
- package/src/platform/policy/selectors_pb.d.ts +0 -269
- package/src/platform/policy/selectors_pb.js +0 -110
- package/src/platform/policy/subjectmapping/subject_mapping_connect.d.ts +0 -118
- package/src/platform/policy/subjectmapping/subject_mapping_connect.js +0 -118
- package/src/platform/policy/subjectmapping/subject_mapping_pb.d.ts +0 -672
- package/src/platform/policy/subjectmapping/subject_mapping_pb.js +0 -260
- package/src/platform/wellknownconfiguration/wellknown_configuration_connect.d.ts +0 -26
- package/src/platform/wellknownconfiguration/wellknown_configuration_connect.js +0 -26
- package/src/platform/wellknownconfiguration/wellknown_configuration_pb.d.ts +0 -75
- package/src/platform/wellknownconfiguration/wellknown_configuration_pb.js +0 -35
|
@@ -0,0 +1,125 @@
|
|
|
1
|
+
import { isPublicKeyAlgorithm, noteInvalidPublicKey, OriginAllowList, } from '../access.js';
|
|
2
|
+
import { ConfigurationError, NetworkError } from '../errors.js';
|
|
3
|
+
import { PlatformClient } from '../platform.js';
|
|
4
|
+
import { extractRpcErrorMessage, getPlatformUrlFromKasEndpoint, pemToCryptoPublicKey, validateSecureUrl, } from '../utils.js';
|
|
5
|
+
/**
|
|
6
|
+
* Get a rewrapped access key to the document, if possible
|
|
7
|
+
* @param url Key access server rewrap endpoint
|
|
8
|
+
* @param requestBody a signed request with an encrypted document key
|
|
9
|
+
* @param authProvider Authorization middleware
|
|
10
|
+
* @param clientVersion
|
|
11
|
+
*/
|
|
12
|
+
export async function fetchWrappedKey(url, signedRequestToken, authProvider) {
|
|
13
|
+
const platformUrl = getPlatformUrlFromKasEndpoint(url);
|
|
14
|
+
const platform = new PlatformClient({ authProvider, platformUrl });
|
|
15
|
+
try {
|
|
16
|
+
return await platform.v1.access.rewrap({
|
|
17
|
+
signedRequestToken,
|
|
18
|
+
});
|
|
19
|
+
}
|
|
20
|
+
catch (e) {
|
|
21
|
+
throw new NetworkError(`[${platformUrl}] [Rewrap] ${extractRpcErrorMessage(e)}`);
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
export async function fetchKeyAccessServers(platformUrl, authProvider) {
|
|
25
|
+
let nextOffset = 0;
|
|
26
|
+
const allServers = [];
|
|
27
|
+
const platform = new PlatformClient({ authProvider, platformUrl });
|
|
28
|
+
do {
|
|
29
|
+
let response;
|
|
30
|
+
try {
|
|
31
|
+
response = await platform.v1.keyAccessServerRegistry.listKeyAccessServers({
|
|
32
|
+
pagination: {
|
|
33
|
+
offset: nextOffset,
|
|
34
|
+
},
|
|
35
|
+
});
|
|
36
|
+
}
|
|
37
|
+
catch (e) {
|
|
38
|
+
throw new NetworkError(`[${platformUrl}] [ListKeyAccessServers] ${extractRpcErrorMessage(e)}`);
|
|
39
|
+
}
|
|
40
|
+
allServers.push(...response.keyAccessServers);
|
|
41
|
+
nextOffset = response?.pagination?.nextOffset || 0;
|
|
42
|
+
} while (nextOffset > 0);
|
|
43
|
+
const serverUrls = allServers.map((server) => server.uri);
|
|
44
|
+
// add base platform kas
|
|
45
|
+
if (!serverUrls.includes(`${platformUrl}/kas`)) {
|
|
46
|
+
serverUrls.push(`${platformUrl}/kas`);
|
|
47
|
+
}
|
|
48
|
+
return new OriginAllowList(serverUrls, false);
|
|
49
|
+
}
|
|
50
|
+
function isBaseKey(baseKey) {
|
|
51
|
+
if (!baseKey) {
|
|
52
|
+
return false;
|
|
53
|
+
}
|
|
54
|
+
const bk = baseKey;
|
|
55
|
+
return (!!bk.kas_uri &&
|
|
56
|
+
!!bk.public_key &&
|
|
57
|
+
typeof bk.public_key === 'object' &&
|
|
58
|
+
!!bk.public_key.pem &&
|
|
59
|
+
!!bk.public_key.algorithm &&
|
|
60
|
+
isPublicKeyAlgorithm(bk.public_key.algorithm));
|
|
61
|
+
}
|
|
62
|
+
export async function fetchKasPubKey(kasEndpoint, algorithm) {
|
|
63
|
+
if (!kasEndpoint) {
|
|
64
|
+
throw new ConfigurationError('KAS definition not found');
|
|
65
|
+
}
|
|
66
|
+
// Logs insecure KAS. Secure is enforced in constructor
|
|
67
|
+
validateSecureUrl(kasEndpoint);
|
|
68
|
+
const platformUrl = getPlatformUrlFromKasEndpoint(kasEndpoint);
|
|
69
|
+
const platform = new PlatformClient({
|
|
70
|
+
platformUrl,
|
|
71
|
+
});
|
|
72
|
+
try {
|
|
73
|
+
const { kid, publicKey } = await platform.v1.access.publicKey({
|
|
74
|
+
algorithm: algorithm || 'rsa:2048',
|
|
75
|
+
v: '2',
|
|
76
|
+
});
|
|
77
|
+
const result = {
|
|
78
|
+
key: noteInvalidPublicKey(new URL(platformUrl), pemToCryptoPublicKey(publicKey)),
|
|
79
|
+
publicKey,
|
|
80
|
+
url: kasEndpoint,
|
|
81
|
+
algorithm: algorithm || 'rsa:2048',
|
|
82
|
+
...(kid && { kid }),
|
|
83
|
+
};
|
|
84
|
+
return result;
|
|
85
|
+
}
|
|
86
|
+
catch (e) {
|
|
87
|
+
throw new NetworkError(`[${platformUrl}] [PublicKey] ${extractRpcErrorMessage(e)}`);
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
/**
|
|
91
|
+
* Fetch the base public key from WellKnownConfiguration of the platform.
|
|
92
|
+
* @param kasEndpoint The KAS endpoint URL.
|
|
93
|
+
* @throws {ConfigurationError} If the KAS endpoint is not defined.
|
|
94
|
+
* @throws {NetworkError} If there is an error fetching the public key from the KAS endpoint.
|
|
95
|
+
* @returns The base public key information for the KAS endpoint.
|
|
96
|
+
*/
|
|
97
|
+
export async function fetchKasBasePubKey(kasEndpoint) {
|
|
98
|
+
if (!kasEndpoint) {
|
|
99
|
+
throw new ConfigurationError('KAS definition not found');
|
|
100
|
+
}
|
|
101
|
+
validateSecureUrl(kasEndpoint);
|
|
102
|
+
const platformUrl = getPlatformUrlFromKasEndpoint(kasEndpoint);
|
|
103
|
+
const platform = new PlatformClient({
|
|
104
|
+
platformUrl,
|
|
105
|
+
});
|
|
106
|
+
try {
|
|
107
|
+
const { configuration } = await platform.v1.wellknown.getWellKnownConfiguration({});
|
|
108
|
+
const baseKey = configuration?.base_key;
|
|
109
|
+
if (!isBaseKey(baseKey)) {
|
|
110
|
+
throw new NetworkError(`Invalid Platform Configuration: [${kasEndpoint}] is missing BaseKey in WellKnownConfiguration`);
|
|
111
|
+
}
|
|
112
|
+
const result = {
|
|
113
|
+
key: noteInvalidPublicKey(new URL(baseKey.kas_uri), pemToCryptoPublicKey(baseKey.public_key.pem)),
|
|
114
|
+
publicKey: baseKey.public_key.pem,
|
|
115
|
+
url: baseKey.kas_uri,
|
|
116
|
+
algorithm: baseKey.public_key.algorithm,
|
|
117
|
+
kid: baseKey.public_key.kid,
|
|
118
|
+
};
|
|
119
|
+
return result;
|
|
120
|
+
}
|
|
121
|
+
catch (e) {
|
|
122
|
+
throw new NetworkError(`[${platformUrl}] [PublicKey] ${extractRpcErrorMessage(e)}`);
|
|
123
|
+
}
|
|
124
|
+
}
|
|
125
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLXJwYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hY2Nlc3MvYWNjZXNzLXJwYy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsb0JBQW9CLEVBR3BCLG9CQUFvQixFQUNwQixlQUFlLEdBQ2hCLE1BQU0sY0FBYyxDQUFDO0FBRXRCLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxZQUFZLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDaEUsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBR2hELE9BQU8sRUFDTCxzQkFBc0IsRUFDdEIsNkJBQTZCLEVBQzdCLG9CQUFvQixFQUNwQixpQkFBaUIsR0FDbEIsTUFBTSxhQUFhLENBQUM7QUFFckI7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxlQUFlLENBQ25DLEdBQVcsRUFDWCxrQkFBMEIsRUFDMUIsWUFBMEI7SUFFMUIsTUFBTSxXQUFXLEdBQUcsNkJBQTZCLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDdkQsTUFBTSxRQUFRLEdBQUcsSUFBSSxjQUFjLENBQUMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUNuRSxJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sUUFBUSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQ3JDLGtCQUFrQjtTQUNuQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLE1BQU0sSUFBSSxZQUFZLENBQUMsSUFBSSxXQUFXLGNBQWMsc0JBQXNCLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxDQUFDLEtBQUssVUFBVSxxQkFBcUIsQ0FDekMsV0FBbUIsRUFDbkIsWUFBMEI7SUFFMUIsSUFBSSxVQUFVLEdBQUcsQ0FBQyxDQUFDO0lBQ25CLE1BQU0sVUFBVSxHQUFHLEVBQUUsQ0FBQztJQUN0QixNQUFNLFFBQVEsR0FBRyxJQUFJLGNBQWMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBRW5FLEdBQUcsQ0FBQztRQUNGLElBQUksUUFBc0MsQ0FBQztRQUMzQyxJQUFJLENBQUM7WUFDSCxRQUFRLEdBQUcsTUFBTSxRQUFRLENBQUMsRUFBRSxDQUFDLHVCQUF1QixDQUFDLG9CQUFvQixDQUFDO2dCQUN4RSxVQUFVLEVBQUU7b0JBQ1YsTUFBTSxFQUFFLFVBQVU7aUJBQ25CO2FBQ0YsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksWUFBWSxDQUNwQixJQUFJLFdBQVcsNEJBQTRCLHNCQUFzQixDQUFDLENBQUMsQ0FBQyxFQUFFLENBQ3ZFLENBQUM7UUFDSixDQUFDO1FBRUQsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQzlDLFVBQVUsR0FBRyxRQUFRLEVBQUUsVUFBVSxFQUFFLFVBQVUsSUFBSSxDQUFDLENBQUM7SUFDckQsQ0FBQyxRQUFRLFVBQVUsR0FBRyxDQUFDLEVBQUU7SUFFekIsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzFELHdCQUF3QjtJQUN4QixJQUFJLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxHQUFHLFdBQVcsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUMvQyxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVyxNQUFNLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBRUQsT0FBTyxJQUFJLGVBQWUsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7QUFDaEQsQ0FBQztBQVlELFNBQVMsU0FBUyxDQUFDLE9BQWlCO0lBQ2xDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNiLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sRUFBRSxHQUFHLE9BQTBCLENBQUM7SUFDdEMsT0FBTyxDQUNMLENBQUMsQ0FBQyxFQUFFLENBQUMsT0FBTztRQUNaLENBQUMsQ0FBQyxFQUFFLENBQUMsVUFBVTtRQUNmLE9BQU8sRUFBRSxDQUFDLFVBQVUsS0FBSyxRQUFRO1FBQ2pDLENBQUMsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLEdBQUc7UUFDbkIsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsU0FBUztRQUN6QixvQkFBb0IsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUM5QyxDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sQ0FBQyxLQUFLLFVBQVUsY0FBYyxDQUNsQyxXQUFtQixFQUNuQixTQUFpQztJQUVqQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDakIsTUFBTSxJQUFJLGtCQUFrQixDQUFDLDBCQUEwQixDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELHVEQUF1RDtJQUN2RCxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUUvQixNQUFNLFdBQVcsR0FBRyw2QkFBNkIsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUMvRCxNQUFNLFFBQVEsR0FBRyxJQUFJLGNBQWMsQ0FBQztRQUNsQyxXQUFXO0tBQ1osQ0FBQyxDQUFDO0lBQ0gsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQztZQUM1RCxTQUFTLEVBQUUsU0FBUyxJQUFJLFVBQVU7WUFDbEMsQ0FBQyxFQUFFLEdBQUc7U0FDUCxDQUFDLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBcUI7WUFDL0IsR0FBRyxFQUFFLG9CQUFvQixDQUFDLElBQUksR0FBRyxDQUFDLFdBQVcsQ0FBQyxFQUFFLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2hGLFNBQVM7WUFDVCxHQUFHLEVBQUUsV0FBVztZQUNoQixTQUFTLEVBQUUsU0FBUyxJQUFJLFVBQVU7WUFDbEMsR0FBRyxDQUFDLEdBQUcsSUFBSSxFQUFFLEdBQUcsRUFBRSxDQUFDO1NBQ3BCLENBQUM7UUFDRixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLE1BQU0sSUFBSSxZQUFZLENBQUMsSUFBSSxXQUFXLGlCQUFpQixzQkFBc0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztBQUNILENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGtCQUFrQixDQUFDLFdBQW1CO0lBQzFELElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNqQixNQUFNLElBQUksa0JBQWtCLENBQUMsMEJBQTBCLENBQUMsQ0FBQztJQUMzRCxDQUFDO0lBQ0QsaUJBQWlCLENBQUMsV0FBVyxDQUFDLENBQUM7SUFFL0IsTUFBTSxXQUFXLEdBQUcsNkJBQTZCLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDL0QsTUFBTSxRQUFRLEdBQUcsSUFBSSxjQUFjLENBQUM7UUFDbEMsV0FBVztLQUNaLENBQUMsQ0FBQztJQUNILElBQUksQ0FBQztRQUNILE1BQU0sRUFBRSxhQUFhLEVBQUUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLHlCQUF5QixDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3BGLE1BQU0sT0FBTyxHQUFHLGFBQWEsRUFBRSxRQUFzQyxDQUFDO1FBQ3RFLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUN4QixNQUFNLElBQUksWUFBWSxDQUNwQixvQ0FBb0MsV0FBVyxnREFBZ0QsQ0FDaEcsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBcUI7WUFDL0IsR0FBRyxFQUFFLG9CQUFvQixDQUN2QixJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQ3hCLG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQzdDO1lBQ0QsU0FBUyxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsR0FBRztZQUNqQyxHQUFHLEVBQUUsT0FBTyxDQUFDLE9BQU87WUFDcEIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUztZQUN2QyxHQUFHLEVBQUUsT0FBTyxDQUFDLFVBQVUsQ0FBQyxHQUFHO1NBQzVCLENBQUM7UUFDRixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLE1BQU0sSUFBSSxZQUFZLENBQUMsSUFBSSxXQUFXLGlCQUFpQixzQkFBc0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztBQUNILENBQUMifQ==
|
package/dist/web/src/access.js
CHANGED
|
@@ -1,5 +1,11 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import {
|
|
1
|
+
import { ServiceError } from './errors.js';
|
|
2
|
+
import { getPlatformUrlFromKasEndpoint, validateSecureUrl } from './utils.js';
|
|
3
|
+
import { fetchKasBasePubKey, fetchKeyAccessServers as fetchKeyAccessServersRpc, } from './access/access-rpc.js';
|
|
4
|
+
import { fetchKeyAccessServers as fetchKeyAccessServersLegacy } from './access/access-fetch.js';
|
|
5
|
+
import { fetchWrappedKey as fetchWrappedKeysRpc } from './access/access-rpc.js';
|
|
6
|
+
import { fetchWrappedKey as fetchWrappedKeysLegacy } from './access/access-fetch.js';
|
|
7
|
+
import { fetchKasPubKey as fetchKasPubKeyRpc } from './access/access-rpc.js';
|
|
8
|
+
import { fetchKasPubKey as fetchKasPubKeyLegacy } from './access/access-fetch.js';
|
|
3
9
|
/**
|
|
4
10
|
* Get a rewrapped access key to the document, if possible
|
|
5
11
|
* @param url Key access server rewrap endpoint
|
|
@@ -7,69 +13,40 @@ import { pemToCryptoPublicKey, validateSecureUrl } from './utils.js';
|
|
|
7
13
|
* @param authProvider Authorization middleware
|
|
8
14
|
* @param clientVersion
|
|
9
15
|
*/
|
|
10
|
-
export async function fetchWrappedKey(url,
|
|
11
|
-
const
|
|
12
|
-
|
|
13
|
-
method: 'POST',
|
|
14
|
-
headers: {
|
|
15
|
-
'Content-Type': 'application/json',
|
|
16
|
-
},
|
|
17
|
-
body: JSON.stringify(requestBody),
|
|
18
|
-
});
|
|
19
|
-
let response;
|
|
20
|
-
try {
|
|
21
|
-
response = await fetch(req.url, {
|
|
22
|
-
method: req.method,
|
|
23
|
-
mode: 'cors', // no-cors, *cors, same-origin
|
|
24
|
-
cache: 'no-cache', // *default, no-cache, reload, force-cache, only-if-cached
|
|
25
|
-
credentials: 'same-origin', // include, *same-origin, omit
|
|
26
|
-
headers: req.headers,
|
|
27
|
-
redirect: 'follow', // manual, *follow, error
|
|
28
|
-
referrerPolicy: 'no-referrer', // no-referrer, *no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, unsafe-url
|
|
29
|
-
body: req.body,
|
|
30
|
-
});
|
|
31
|
-
}
|
|
32
|
-
catch (e) {
|
|
33
|
-
throw new NetworkError(`unable to fetch wrapped key from [${url}]`, e);
|
|
34
|
-
}
|
|
35
|
-
if (!response.ok) {
|
|
36
|
-
switch (response.status) {
|
|
37
|
-
case 400:
|
|
38
|
-
throw new InvalidFileError(`400 for [${req.url}]: rewrap bad request [${await response.text()}]`);
|
|
39
|
-
case 401:
|
|
40
|
-
throw new UnauthenticatedError(`401 for [${req.url}]; rewrap auth failure`);
|
|
41
|
-
case 403:
|
|
42
|
-
throw new PermissionDeniedError(`403 for [${req.url}]; rewrap permission denied`);
|
|
43
|
-
default:
|
|
44
|
-
if (response.status >= 500) {
|
|
45
|
-
throw new ServiceError(`${response.status} for [${req.url}]: rewrap failure due to service error [${await response.text()}]`);
|
|
46
|
-
}
|
|
47
|
-
throw new NetworkError(`${req.method} ${req.url} => ${response.status} ${response.statusText}`);
|
|
48
|
-
}
|
|
49
|
-
}
|
|
50
|
-
return response.json();
|
|
16
|
+
export async function fetchWrappedKey(url, signedRequestToken, authProvider) {
|
|
17
|
+
const platformUrl = getPlatformUrlFromKasEndpoint(url);
|
|
18
|
+
return await tryPromisesUntilFirstSuccess(() => fetchWrappedKeysRpc(platformUrl, signedRequestToken, authProvider), () => fetchWrappedKeysLegacy(url, { signedRequestToken }, authProvider));
|
|
51
19
|
}
|
|
52
20
|
export const isPublicKeyAlgorithm = (a) => {
|
|
53
21
|
return a === 'ec:secp256r1' || a === 'rsa:2048';
|
|
54
22
|
};
|
|
55
|
-
export const keyAlgorithmToPublicKeyAlgorithm = (
|
|
23
|
+
export const keyAlgorithmToPublicKeyAlgorithm = (k) => {
|
|
24
|
+
const a = k.algorithm;
|
|
56
25
|
if (a.name === 'ECDSA' || a.name === 'ECDH') {
|
|
57
26
|
const eca = a;
|
|
58
|
-
|
|
59
|
-
|
|
27
|
+
switch (eca.namedCurve) {
|
|
28
|
+
case 'P-256':
|
|
29
|
+
return 'ec:secp256r1';
|
|
30
|
+
case 'P-384':
|
|
31
|
+
return 'ec:secp384r1';
|
|
32
|
+
case 'P-521':
|
|
33
|
+
return 'ec:secp521r1';
|
|
34
|
+
default:
|
|
35
|
+
throw new Error(`unsupported EC curve: ${eca.namedCurve}`);
|
|
60
36
|
}
|
|
61
|
-
throw new Error(`unsupported EC curve: ${eca.namedCurve}`);
|
|
62
37
|
}
|
|
63
|
-
if (a.name === 'RSA-OAEP') {
|
|
38
|
+
if (a.name === 'RSA-OAEP' || a.name === 'RSASSA-PKCS1-v1_5') {
|
|
64
39
|
const rsaa = a;
|
|
65
|
-
if (rsaa.
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
40
|
+
if (rsaa.publicExponent.toString() !== '1,0,1') {
|
|
41
|
+
throw new Error(`unsupported RSA public exponent: ${rsaa.publicExponent}`);
|
|
42
|
+
}
|
|
43
|
+
switch (rsaa.modulusLength) {
|
|
44
|
+
case 2048:
|
|
45
|
+
return 'rsa:2048';
|
|
46
|
+
case 4096:
|
|
47
|
+
return 'rsa:4096';
|
|
48
|
+
default:
|
|
49
|
+
throw new Error(`unsupported RSA modulus length: ${rsaa.modulusLength}`);
|
|
73
50
|
}
|
|
74
51
|
}
|
|
75
52
|
throw new Error(`unsupported key algorithm: ${a.name}`);
|
|
@@ -80,9 +57,17 @@ export const publicKeyAlgorithmToJwa = (a) => {
|
|
|
80
57
|
return 'ES256';
|
|
81
58
|
case 'rsa:2048':
|
|
82
59
|
return 'RS256';
|
|
60
|
+
case 'rsa:4096':
|
|
61
|
+
return 'RS512';
|
|
62
|
+
case 'ec:secp384r1':
|
|
63
|
+
return 'ES384';
|
|
64
|
+
case 'ec:secp521r1':
|
|
65
|
+
return 'ES512';
|
|
66
|
+
default:
|
|
67
|
+
throw new Error(`unsupported public key algorithm: ${a}`);
|
|
83
68
|
}
|
|
84
69
|
};
|
|
85
|
-
async function noteInvalidPublicKey(url, r) {
|
|
70
|
+
export async function noteInvalidPublicKey(url, r) {
|
|
86
71
|
try {
|
|
87
72
|
return await r;
|
|
88
73
|
}
|
|
@@ -93,68 +78,35 @@ async function noteInvalidPublicKey(url, r) {
|
|
|
93
78
|
throw e;
|
|
94
79
|
}
|
|
95
80
|
}
|
|
81
|
+
export async function fetchKeyAccessServers(platformUrl, authProvider) {
|
|
82
|
+
return await tryPromisesUntilFirstSuccess(() => fetchKeyAccessServersRpc(platformUrl, authProvider), () => fetchKeyAccessServersLegacy(platformUrl, authProvider));
|
|
83
|
+
}
|
|
96
84
|
/**
|
|
97
|
-
*
|
|
98
|
-
*
|
|
85
|
+
* Fetch the EC (secp256r1) public key for a KAS endpoint.
|
|
86
|
+
* @param kasEndpoint The KAS endpoint URL.
|
|
87
|
+
* @returns The public key information for the KAS endpoint.
|
|
99
88
|
*/
|
|
100
89
|
export async function fetchECKasPubKey(kasEndpoint) {
|
|
101
90
|
return fetchKasPubKey(kasEndpoint, 'ec:secp256r1');
|
|
102
91
|
}
|
|
92
|
+
/**
|
|
93
|
+
* Fetch the public key for a KAS endpoint.
|
|
94
|
+
* This function will first try to fetch the base public key,
|
|
95
|
+
* then it will try to fetch the public key using the RPC method,
|
|
96
|
+
* and finally it will try to fetch the public key using the legacy method.
|
|
97
|
+
* If all attempts fail, it will return the error from RPC Public Key fetch.
|
|
98
|
+
* @param kasEndpoint The KAS endpoint URL.
|
|
99
|
+
* @param algorithm Optional algorithm to fetch the public key for.
|
|
100
|
+
* @returns The public key information.
|
|
101
|
+
*/
|
|
103
102
|
export async function fetchKasPubKey(kasEndpoint, algorithm) {
|
|
104
|
-
if (!kasEndpoint) {
|
|
105
|
-
throw new ConfigurationError('KAS definition not found');
|
|
106
|
-
}
|
|
107
|
-
// Logs insecure KAS. Secure is enforced in constructor
|
|
108
|
-
validateSecureUrl(kasEndpoint);
|
|
109
|
-
// Parse kasEndpoint to URL, then append to its path and update its query parameters
|
|
110
|
-
let pkUrlV2;
|
|
111
103
|
try {
|
|
112
|
-
|
|
104
|
+
return await fetchKasBasePubKey(kasEndpoint);
|
|
113
105
|
}
|
|
114
106
|
catch (e) {
|
|
115
|
-
|
|
116
|
-
}
|
|
117
|
-
if (!pkUrlV2.pathname.endsWith('kas_public_key')) {
|
|
118
|
-
if (!pkUrlV2.pathname.endsWith('/')) {
|
|
119
|
-
pkUrlV2.pathname += '/';
|
|
120
|
-
}
|
|
121
|
-
pkUrlV2.pathname += 'v2/kas_public_key';
|
|
122
|
-
}
|
|
123
|
-
pkUrlV2.searchParams.set('algorithm', algorithm || 'rsa:2048');
|
|
124
|
-
if (!pkUrlV2.searchParams.get('v')) {
|
|
125
|
-
pkUrlV2.searchParams.set('v', '2');
|
|
107
|
+
console.log(e);
|
|
126
108
|
}
|
|
127
|
-
|
|
128
|
-
try {
|
|
129
|
-
kasPubKeyResponseV2 = await fetch(pkUrlV2);
|
|
130
|
-
}
|
|
131
|
-
catch (e) {
|
|
132
|
-
throw new NetworkError(`unable to fetch public key from [${pkUrlV2}]`, e);
|
|
133
|
-
}
|
|
134
|
-
if (!kasPubKeyResponseV2.ok) {
|
|
135
|
-
switch (kasPubKeyResponseV2.status) {
|
|
136
|
-
case 404:
|
|
137
|
-
throw new ConfigurationError(`404 for [${pkUrlV2}]`);
|
|
138
|
-
case 401:
|
|
139
|
-
throw new UnauthenticatedError(`401 for [${pkUrlV2}]`);
|
|
140
|
-
case 403:
|
|
141
|
-
throw new PermissionDeniedError(`403 for [${pkUrlV2}]`);
|
|
142
|
-
default:
|
|
143
|
-
throw new NetworkError(`${pkUrlV2} => ${kasPubKeyResponseV2.status} ${kasPubKeyResponseV2.statusText}`);
|
|
144
|
-
}
|
|
145
|
-
}
|
|
146
|
-
const jsonContent = await kasPubKeyResponseV2.json();
|
|
147
|
-
const { publicKey, kid } = jsonContent;
|
|
148
|
-
if (!publicKey) {
|
|
149
|
-
throw new NetworkError(`invalid response from public key endpoint [${JSON.stringify(jsonContent)}]`);
|
|
150
|
-
}
|
|
151
|
-
return {
|
|
152
|
-
key: noteInvalidPublicKey(pkUrlV2, pemToCryptoPublicKey(publicKey)),
|
|
153
|
-
publicKey,
|
|
154
|
-
url: kasEndpoint,
|
|
155
|
-
algorithm: algorithm || 'rsa:2048',
|
|
156
|
-
...(kid && { kid }),
|
|
157
|
-
};
|
|
109
|
+
return await tryPromisesUntilFirstSuccess(() => fetchKasPubKeyRpc(kasEndpoint, algorithm), () => fetchKasPubKeyLegacy(kasEndpoint, algorithm));
|
|
158
110
|
}
|
|
159
111
|
const origin = (u) => {
|
|
160
112
|
try {
|
|
@@ -178,4 +130,24 @@ export class OriginAllowList {
|
|
|
178
130
|
return this.origins.includes(origin(url));
|
|
179
131
|
}
|
|
180
132
|
}
|
|
181
|
-
|
|
133
|
+
/**
|
|
134
|
+
* Tries two promise-returning functions in order and returns the first successful result.
|
|
135
|
+
* If both fail, throws the error from the second.
|
|
136
|
+
* @param first First function returning a promise to try.
|
|
137
|
+
* @param second Second function returning a promise to try if the first fails.
|
|
138
|
+
*/
|
|
139
|
+
async function tryPromisesUntilFirstSuccess(first, second) {
|
|
140
|
+
try {
|
|
141
|
+
return await first();
|
|
142
|
+
}
|
|
143
|
+
catch (e1) {
|
|
144
|
+
console.info('v2 request error', e1);
|
|
145
|
+
try {
|
|
146
|
+
return await second();
|
|
147
|
+
}
|
|
148
|
+
catch (err) {
|
|
149
|
+
throw err;
|
|
150
|
+
}
|
|
151
|
+
}
|
|
152
|
+
}
|
|
153
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2FjY2Vzcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBRTNDLE9BQU8sRUFBRSw2QkFBNkIsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLFlBQVksQ0FBQztBQUU5RSxPQUFPLEVBQ0wsa0JBQWtCLEVBQ2xCLHFCQUFxQixJQUFJLHdCQUF3QixHQUNsRCxNQUFNLHdCQUF3QixDQUFDO0FBQ2hDLE9BQU8sRUFBRSxxQkFBcUIsSUFBSSwyQkFBMkIsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQ2hHLE9BQU8sRUFBRSxlQUFlLElBQUksbUJBQW1CLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNoRixPQUFPLEVBQUUsZUFBZSxJQUFJLHNCQUFzQixFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDckYsT0FBTyxFQUFFLGNBQWMsSUFBSSxpQkFBaUIsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQzdFLE9BQU8sRUFBRSxjQUFjLElBQUksb0JBQW9CLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQU1sRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGVBQWUsQ0FDbkMsR0FBVyxFQUNYLGtCQUEwQixFQUMxQixZQUEwQjtJQUUxQixNQUFNLFdBQVcsR0FBRyw2QkFBNkIsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUV2RCxPQUFPLE1BQU0sNEJBQTRCLENBQ3ZDLEdBQUcsRUFBRSxDQUFDLG1CQUFtQixDQUFDLFdBQVcsRUFBRSxrQkFBa0IsRUFBRSxZQUFZLENBQUMsRUFDeEUsR0FBRyxFQUFFLENBQ0gsc0JBQXNCLENBQ3BCLEdBQUcsRUFDSCxFQUFFLGtCQUFrQixFQUFFLEVBQ3RCLFlBQVksQ0FDeUIsQ0FDMUMsQ0FBQztBQUNKLENBQUM7QUFTRCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLENBQVMsRUFBOEIsRUFBRTtJQUM1RSxPQUFPLENBQUMsS0FBSyxjQUFjLElBQUksQ0FBQyxLQUFLLFVBQVUsQ0FBQztBQUNsRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxDQUFDLENBQVksRUFBeUIsRUFBRTtJQUN0RixNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ3RCLElBQUksQ0FBQyxDQUFDLElBQUksS0FBSyxPQUFPLElBQUksQ0FBQyxDQUFDLElBQUksS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUM1QyxNQUFNLEdBQUcsR0FBRyxDQUFtQixDQUFDO1FBQ2hDLFFBQVEsR0FBRyxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3ZCLEtBQUssT0FBTztnQkFDVixPQUFPLGNBQWMsQ0FBQztZQUN4QixLQUFLLE9BQU87Z0JBQ1YsT0FBTyxjQUFjLENBQUM7WUFDeEIsS0FBSyxPQUFPO2dCQUNWLE9BQU8sY0FBYyxDQUFDO1lBQ3hCO2dCQUNFLE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLEdBQUcsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsSUFBSSxDQUFDLENBQUMsSUFBSSxLQUFLLG1CQUFtQixFQUFFLENBQUM7UUFDNUQsTUFBTSxJQUFJLEdBQUcsQ0FBMEIsQ0FBQztRQUN4QyxJQUFJLElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxFQUFFLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDL0MsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDLENBQUM7UUFDN0UsQ0FBQztRQUNELFFBQVEsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQzNCLEtBQUssSUFBSTtnQkFDUCxPQUFPLFVBQVUsQ0FBQztZQUNwQixLQUFLLElBQUk7Z0JBQ1AsT0FBTyxVQUFVLENBQUM7WUFDcEI7Z0JBQ0UsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDN0UsQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztBQUMxRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLENBQXdCLEVBQVUsRUFBRTtJQUMxRSxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ1YsS0FBSyxjQUFjO1lBQ2pCLE9BQU8sT0FBTyxDQUFDO1FBQ2pCLEtBQUssVUFBVTtZQUNiLE9BQU8sT0FBTyxDQUFDO1FBQ2pCLEtBQUssVUFBVTtZQUNiLE9BQU8sT0FBTyxDQUFDO1FBQ2pCLEtBQUssY0FBYztZQUNqQixPQUFPLE9BQU8sQ0FBQztRQUNqQixLQUFLLGNBQWM7WUFDakIsT0FBTyxPQUFPLENBQUM7UUFDakI7WUFDRSxNQUFNLElBQUksS0FBSyxDQUFDLHFDQUFxQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzlELENBQUM7QUFDSCxDQUFDLENBQUM7QUF5QkYsTUFBTSxDQUFDLEtBQUssVUFBVSxvQkFBb0IsQ0FBQyxHQUFRLEVBQUUsQ0FBcUI7SUFDeEUsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLENBQUMsQ0FBQztJQUNqQixDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLElBQUksQ0FBQyxZQUFZLFNBQVMsRUFBRSxDQUFDO1lBQzNCLE1BQU0sSUFBSSxZQUFZLENBQUMsNEJBQTRCLEdBQUcsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxNQUFNLENBQUMsQ0FBQztJQUNWLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxDQUFDLEtBQUssVUFBVSxxQkFBcUIsQ0FDekMsV0FBbUIsRUFDbkIsWUFBMEI7SUFFMUIsT0FBTyxNQUFNLDRCQUE0QixDQUN2QyxHQUFHLEVBQUUsQ0FBQyx3QkFBd0IsQ0FBQyxXQUFXLEVBQUUsWUFBWSxDQUFDLEVBQ3pELEdBQUcsRUFBRSxDQUFDLDJCQUEyQixDQUFDLFdBQVcsRUFBRSxZQUFZLENBQUMsQ0FDN0QsQ0FBQztBQUNKLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxXQUFtQjtJQUN4RCxPQUFPLGNBQWMsQ0FBQyxXQUFXLEVBQUUsY0FBYyxDQUFDLENBQUM7QUFDckQsQ0FBQztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsY0FBYyxDQUNsQyxXQUFtQixFQUNuQixTQUFpQztJQUVqQyxJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sa0JBQWtCLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDWCxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pCLENBQUM7SUFFRCxPQUFPLE1BQU0sNEJBQTRCLENBQ3ZDLEdBQUcsRUFBRSxDQUFDLGlCQUFpQixDQUFDLFdBQVcsRUFBRSxTQUFTLENBQUMsRUFDL0MsR0FBRyxFQUFFLENBQUMsb0JBQW9CLENBQUMsV0FBVyxFQUFFLFNBQVMsQ0FBQyxDQUNuRCxDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sTUFBTSxHQUFHLENBQUMsQ0FBUyxFQUFVLEVBQUU7SUFDbkMsSUFBSSxDQUFDO1FBQ0gsT0FBTyxJQUFJLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDM0IsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDWCxPQUFPLENBQUMsR0FBRyxDQUFDLHFCQUFxQixDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxDQUFDO0lBQ1YsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sT0FBTyxlQUFlO0lBRzFCLFlBQVksSUFBYyxFQUFFLFFBQWtCO1FBQzVDLElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNoQyxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDaEMsSUFBSSxDQUFDLFFBQVEsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDO0lBQzdCLENBQUM7SUFDRCxNQUFNLENBQUMsR0FBVztRQUNoQixJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVDLENBQUM7Q0FDRjtBQUVEOzs7OztHQUtHO0FBQ0gsS0FBSyxVQUFVLDRCQUE0QixDQUN6QyxLQUF1QixFQUN2QixNQUF3QjtJQUV4QixJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sS0FBSyxFQUFFLENBQUM7SUFDdkIsQ0FBQztJQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDWixPQUFPLENBQUMsSUFBSSxDQUFDLGtCQUFrQixFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3JDLElBQUksQ0FBQztZQUNILE9BQU8sTUFBTSxNQUFNLEVBQUUsQ0FBQztRQUN4QixDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLE1BQU0sR0FBRyxDQUFDO1FBQ1osQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDIn0=
|
|
@@ -142,7 +142,7 @@ export class AccessToken {
|
|
|
142
142
|
}
|
|
143
143
|
catch (e) {
|
|
144
144
|
console.log('access_token fails on user_info endpoint; attempting to renew', e);
|
|
145
|
-
if (this.data
|
|
145
|
+
if (this.data?.refresh_token) {
|
|
146
146
|
// Prefer the latest refresh_token if present over creds passed in
|
|
147
147
|
// to constructor
|
|
148
148
|
this.config = {
|
|
@@ -212,4 +212,4 @@ export class AccessToken {
|
|
|
212
212
|
return withHeaders(httpReq, { Authorization: `Bearer ${accessToken}` });
|
|
213
213
|
}
|
|
214
214
|
}
|
|
215
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
215
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2lkYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hdXRoL29pZGMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLE9BQU8sSUFBSSxNQUFNLEVBQUUsTUFBTSxNQUFNLENBQUM7QUFDekMsT0FBTyxFQUFlLFdBQVcsRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUNyRCxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDL0MsT0FBTyxFQUFFLGtCQUFrQixFQUFFLFFBQVEsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUM1RCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBa0R4RCxNQUFNLFVBQVUsR0FBRyxDQUFDLEdBQTJCLEVBQUUsRUFBRSxDQUFDLElBQUksZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDO0FBT3hGOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FxQkc7QUFDSCxNQUFNLE9BQU8sV0FBVztJQWV0QixZQUFZLEdBQW9CLEVBQUUsT0FBc0I7UUFKeEQsaUJBQVksR0FBMkIsRUFBRSxDQUFDO1FBS3hDLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLGtCQUFrQixDQUMxQiw0RUFBNEUsQ0FDN0UsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLEdBQUcsQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsR0FBRyxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ25ELE1BQU0sSUFBSSxrQkFBa0IsQ0FDMUIsNEVBQTRFLENBQzdFLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxHQUFHLENBQUMsUUFBUSxLQUFLLFNBQVMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNwRCxNQUFNLElBQUksa0JBQWtCLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUM3RixDQUFDO1FBQ0QsSUFBSSxHQUFHLENBQUMsUUFBUSxLQUFLLFVBQVUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNwRCxNQUFNLElBQUksa0JBQWtCLENBQUMsbURBQW1ELENBQUMsQ0FBQztRQUNwRixDQUFDO1FBQ0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixNQUFNLElBQUksa0JBQWtCLENBQUMsNEJBQTRCLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFDbEIsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLE9BQU8sR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUMzQyxJQUFJLENBQUMsVUFBVSxHQUFHLEdBQUcsQ0FBQyxVQUFVLENBQUM7SUFDbkMsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxLQUFLLENBQUMsSUFBSSxDQUFDLFdBQW1CO1FBQzVCLE1BQU0sR0FBRyxHQUFHLEdBQUcsSUFBSSxDQUFDLE9BQU8sbUNBQW1DLENBQUM7UUFDL0QsTUFBTSxPQUFPLEdBQUc7WUFDZCxHQUFHLElBQUksQ0FBQyxZQUFZO1lBQ3BCLGFBQWEsRUFBRSxVQUFVLFdBQVcsRUFBRTtTQUNiLENBQUM7UUFDNUIsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsSUFBSSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDL0MsT0FBTyxDQUFDLElBQUksR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLElBQUksS0FBSyxDQUFDLENBQUMsR0FBRyxFQUFFO1lBQ2xELE9BQU87U0FDUixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ2pCLE9BQU8sQ0FBQyxLQUFLLENBQUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNyQyxNQUFNLElBQUksUUFBUSxDQUNoQix3QkFBd0IsR0FBRyxRQUFRLFFBQVEsQ0FBQyxNQUFNLElBQUksUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUM1RSxDQUFDO1FBQ0osQ0FBQztRQUVELE9BQU8sQ0FBQyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBWSxDQUFDO0lBQzVDLENBQUM7SUFFRCxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQVcsRUFBRSxDQUF5QjtRQUNqRCxNQUFNLE9BQU8sR0FBMkI7WUFDdEMsY0FBYyxFQUFFLG1DQUFtQztZQUNuRCxNQUFNLEVBQUUsa0JBQWtCO1NBQzNCLENBQUM7UUFDRixpQ0FBaUM7UUFDakMsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzVCLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ3JCLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1lBQzFELENBQUM7WUFDRCxNQUFNLFlBQVksR0FBRyxNQUFNLGlCQUFpQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDeEUsT0FBTyxDQUFDLGdCQUFnQixDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUN4RCxPQUFPLENBQUMsSUFBSSxHQUFHLE1BQU0sTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFDRCxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUU7WUFDbEMsTUFBTSxFQUFFLE1BQU07WUFDZCxPQUFPO1lBQ1AsSUFBSSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7U0FDcEIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxHQUFvQjtRQUMxQyxNQUFNLEdBQUcsR0FBRyxHQUFHLElBQUksQ0FBQyxPQUFPLGdDQUFnQyxDQUFDO1FBQzVELElBQUksSUFBSSxDQUFDO1FBQ1QsUUFBUSxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDckIsS0FBSyxRQUFRO2dCQUNYLElBQUksR0FBRztvQkFDTCxVQUFVLEVBQUUsb0JBQW9CO29CQUNoQyxTQUFTLEVBQUUsR0FBRyxDQUFDLFFBQVE7b0JBQ3ZCLGFBQWEsRUFBRSxHQUFHLENBQUMsWUFBWTtpQkFDaEMsQ0FBQztnQkFDRixNQUFNO1lBQ1IsS0FBSyxVQUFVO2dCQUNiLElBQUksR0FBRztvQkFDTCxVQUFVLEVBQUUsaURBQWlEO29CQUM3RCxhQUFhLEVBQUUsR0FBRyxDQUFDLFdBQVc7b0JBQzlCLGtCQUFrQixFQUFFLHNDQUFzQztvQkFDMUQsUUFBUSxFQUFFLEdBQUcsQ0FBQyxRQUFRO29CQUN0QixTQUFTLEVBQUUsR0FBRyxDQUFDLFFBQVE7aUJBQ3hCLENBQUM7Z0JBQ0YsTUFBTTtZQUNSLEtBQUssU0FBUztnQkFDWixJQUFJLEdBQUc7b0JBQ0wsVUFBVSxFQUFFLGVBQWU7b0JBQzNCLGFBQWEsRUFBRSxHQUFHLENBQUMsWUFBWTtvQkFDL0IsU0FBUyxFQUFFLEdBQUcsQ0FBQyxRQUFRO2lCQUN4QixDQUFDO2dCQUNGLE1BQU07UUFDVixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM5QyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ2pCLE9BQU8sQ0FBQyxLQUFLLENBQUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNyQyxNQUFNLElBQUksUUFBUSxDQUNoQixtQ0FBbUMsR0FBRyxRQUFRLFFBQVEsQ0FBQyxNQUFNLElBQUksUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUN2RixDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFRDs7OztPQUlHO0lBQ0gsS0FBSyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEdBQUcsSUFBSTtRQUN2QixJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLENBQUM7WUFDNUIsSUFBSSxDQUFDO2dCQUNILElBQUksUUFBUSxFQUFFLENBQUM7b0JBQ2IsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUM7Z0JBQzFDLENBQUM7Z0JBQ0QsT0FBTyxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQztZQUNoQyxDQUFDO1lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDWCxPQUFPLENBQUMsR0FBRyxDQUFDLCtEQUErRCxFQUFFLENBQUMsQ0FBQyxDQUFDO2dCQUNoRixJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFLENBQUM7b0JBQzdCLGtFQUFrRTtvQkFDbEUsaUJBQWlCO29CQUNqQixJQUFJLENBQUMsTUFBTSxHQUFHO3dCQUNaLEdBQUcsSUFBSSxDQUFDLE1BQU07d0JBQ2QsUUFBUSxFQUFFLFNBQVM7d0JBQ25CLFlBQVksRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWE7cUJBQ3RDLENBQUM7Z0JBQ0osQ0FBQztnQkFDRCxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUM7WUFDbkIsQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDOUUsT0FBTyxhQUFhLENBQUMsWUFBWSxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxLQUFLLENBQUMsMENBQTBDLENBQUMsVUFBeUI7UUFDeEUsc0RBQXNEO1FBQ3RELDZDQUE2QztRQUM3QywyREFBMkQ7UUFDM0QsSUFBSSxJQUFJLENBQUMsa0JBQWtCLElBQUksVUFBVSxLQUFLLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUM5RCxPQUFPO1FBQ1QsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLGtCQUFrQixDQUFDO1FBQy9CLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDO0lBQy9CLENBQUM7SUFFRDs7T0FFRztJQUNILEtBQUssQ0FBQyx1QkFBdUI7UUFDM0IsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUN4QixJQUFJLEdBQUcsQ0FBQyxRQUFRLElBQUksVUFBVSxJQUFJLEdBQUcsQ0FBQyxRQUFRLElBQUksU0FBUyxFQUFFLENBQUM7WUFDNUQsTUFBTSxJQUFJLGtCQUFrQixDQUFDLDRCQUE0QixDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUNELE1BQU0sYUFBYSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUM5RSxJQUFJLENBQUMsYUFBYSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ2pDLE9BQU8sQ0FBQyxHQUFHLENBQUMsMkJBQTJCLENBQUMsQ0FBQztZQUN6QyxPQUFPLENBQ0wsQ0FBQyxHQUFHLENBQUMsUUFBUSxJQUFJLFNBQVMsSUFBSSxHQUFHLENBQUMsWUFBWSxDQUFDO2dCQUMvQyxDQUFDLEdBQUcsQ0FBQyxRQUFRLElBQUksVUFBVSxJQUFJLEdBQUcsQ0FBQyxXQUFXLENBQUM7Z0JBQy9DLEVBQUUsQ0FDSCxDQUFDO1FBQ0osQ0FBQztRQUNELGtFQUFrRTtRQUNsRSxpQkFBaUI7UUFDakIsSUFBSSxDQUFDLE1BQU0sR0FBRztZQUNaLEdBQUcsSUFBSSxDQUFDLE1BQU07WUFDZCxRQUFRLEVBQUUsU0FBUztZQUNuQixZQUFZLEVBQUUsYUFBYSxDQUFDLGFBQWE7U0FDMUMsQ0FBQztRQUNGLE9BQU8sYUFBYSxDQUFDLFlBQVksQ0FBQztJQUNwQyxDQUFDO0lBRUQsS0FBSyxDQUFDLFNBQVMsQ0FBQyxPQUFvQjtRQUNsQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSxrQkFBa0IsQ0FDMUIsMElBQTBJLENBQzNJLENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLEtBQUssTUFBTSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUNuRSxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxJQUFJLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUMvQyxNQUFNLFNBQVMsR0FBRyxNQUFNLE1BQU0sQ0FDNUIsSUFBSSxDQUFDLFVBQVUsRUFDZixPQUFPLENBQUMsR0FBRyxFQUNYLE9BQU8sQ0FBQyxNQUFNO1lBQ2QsV0FBVyxDQUFDLFNBQVMsRUFDckIsV0FBVyxDQUNaLENBQUM7WUFDRix1RUFBdUU7WUFDdkUsT0FBTyxXQUFXLENBQUMsT0FBTyxFQUFFLEVBQUUsYUFBYSxFQUFFLFVBQVUsV0FBVyxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7UUFDM0YsQ0FBQztRQUNELE9BQU8sV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLGFBQWEsRUFBRSxVQUFVLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUMxRSxDQUFDO0NBQ0YifQ==
|
|
@@ -2,7 +2,7 @@ import * as base64 from '../encodings/base64.js';
|
|
|
2
2
|
import { generateKeyPair, keyAgreement } from '../nanotdf-crypto/index.js';
|
|
3
3
|
import getHkdfSalt from './helpers/getHkdfSalt.js';
|
|
4
4
|
import DefaultParams from './models/DefaultParams.js';
|
|
5
|
-
import { fetchWrappedKey, OriginAllowList } from '../access.js';
|
|
5
|
+
import { fetchKeyAccessServers, fetchWrappedKey, OriginAllowList, } from '../access.js';
|
|
6
6
|
import { isAuthProvider, reqSignature } from '../auth/providers.js';
|
|
7
7
|
import { ConfigurationError, DecryptError, TdfError, UnsafeUrlError } from '../errors.js';
|
|
8
8
|
import { cryptoPublicToPem, pemToCryptoPublicKey, validateSecureUrl } from '../utils.js';
|
|
@@ -108,7 +108,6 @@ class Client {
|
|
|
108
108
|
// TODO Disallow http KAS. For now just log as error
|
|
109
109
|
validateSecureUrl(kasUrl);
|
|
110
110
|
this.kasUrl = kasUrl;
|
|
111
|
-
this.allowedKases = new OriginAllowList([kasUrl]);
|
|
112
111
|
this.dpopEnabled = dpopEnabled;
|
|
113
112
|
if (ephemeralKeyPair) {
|
|
114
113
|
this.ephemeralKeyPair = Promise.resolve(ephemeralKeyPair);
|
|
@@ -119,12 +118,15 @@ class Client {
|
|
|
119
118
|
this.iv = 1;
|
|
120
119
|
}
|
|
121
120
|
else {
|
|
122
|
-
const { allowedKases, ignoreAllowList, authProvider, dpopEnabled, dpopKeys, ephemeralKeyPair, kasEndpoint, } = optsOrOldAuthProvider;
|
|
121
|
+
const { allowedKases, ignoreAllowList, authProvider, dpopEnabled, dpopKeys, ephemeralKeyPair, kasEndpoint, platformUrl, } = optsOrOldAuthProvider;
|
|
123
122
|
this.authProvider = enwrapAuthProvider(authProvider);
|
|
124
123
|
// TODO Disallow http KAS. For now just log as error
|
|
125
124
|
validateSecureUrl(kasEndpoint);
|
|
126
125
|
this.kasUrl = kasEndpoint;
|
|
127
|
-
this.
|
|
126
|
+
this.platformUrl = platformUrl;
|
|
127
|
+
if (allowedKases?.length || ignoreAllowList) {
|
|
128
|
+
this.allowedKases = new OriginAllowList(allowedKases || [], ignoreAllowList);
|
|
129
|
+
}
|
|
128
130
|
this.dpopEnabled = !!dpopEnabled;
|
|
129
131
|
if (dpopKeys) {
|
|
130
132
|
this.requestSignerKeyPair = dpopKeys;
|
|
@@ -159,8 +161,12 @@ class Client {
|
|
|
159
161
|
* @param clientVersion version of the client, as SemVer
|
|
160
162
|
*/
|
|
161
163
|
async rewrapKey(nanoTdfHeader, kasRewrapUrl, magicNumberVersion, clientVersion) {
|
|
162
|
-
|
|
163
|
-
|
|
164
|
+
let allowedKases = this.allowedKases;
|
|
165
|
+
if (!allowedKases) {
|
|
166
|
+
allowedKases = await fetchKeyAccessServers(this.platformUrl, this.authProvider);
|
|
167
|
+
}
|
|
168
|
+
if (!allowedKases.allows(kasRewrapUrl)) {
|
|
169
|
+
throw new UnsafeUrlError(`request URL ∉ ${allowedKases.origins};`, kasRewrapUrl);
|
|
164
170
|
}
|
|
165
171
|
const ephemeralKeyPair = await this.ephemeralKeyPair;
|
|
166
172
|
const requestSignerKeyPair = await this.requestSignerKeyPair;
|
|
@@ -183,15 +189,13 @@ class Client {
|
|
|
183
189
|
clientPublicKey: await cryptoPublicToPem(ephemeralKeyPair.publicKey),
|
|
184
190
|
});
|
|
185
191
|
const jwtPayload = { requestBody: requestBodyStr };
|
|
186
|
-
const
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
}),
|
|
190
|
-
};
|
|
192
|
+
const signedRequestToken = await reqSignature(jwtPayload, requestSignerKeyPair.privateKey, {
|
|
193
|
+
alg: toJWSAlg(requestSignerKeyPair.publicKey),
|
|
194
|
+
});
|
|
191
195
|
// Wrapped
|
|
192
|
-
const wrappedKey = await fetchWrappedKey(kasRewrapUrl,
|
|
196
|
+
const wrappedKey = await fetchWrappedKey(kasRewrapUrl, signedRequestToken, this.authProvider);
|
|
193
197
|
// Extract the iv and ciphertext
|
|
194
|
-
const entityWrappedKey =
|
|
198
|
+
const entityWrappedKey = wrappedKey.entityWrappedKey;
|
|
195
199
|
const ivLength = clientVersion == Client.SDK_INITIAL_RELEASE ? Client.INITIAL_RELEASE_IV_SIZE : Client.IV_SIZE;
|
|
196
200
|
const iv = entityWrappedKey.subarray(0, ivLength);
|
|
197
201
|
const encryptedSharedKey = entityWrappedKey.subarray(ivLength);
|
|
@@ -260,4 +264,4 @@ Client.SDK_INITIAL_RELEASE = '0.0.0';
|
|
|
260
264
|
Client.INITIAL_RELEASE_IV_SIZE = 3;
|
|
261
265
|
Client.IV_SIZE = 12;
|
|
262
266
|
export default Client;
|
|
263
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
267
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ2xpZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL25hbm90ZGYvQ2xpZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxNQUFNLE1BQU0sd0JBQXdCLENBQUM7QUFDakQsT0FBTyxFQUFFLGVBQWUsRUFBRSxZQUFZLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUMzRSxPQUFPLFdBQVcsTUFBTSwwQkFBMEIsQ0FBQztBQUNuRCxPQUFPLGFBQWEsTUFBTSwyQkFBMkIsQ0FBQztBQUN0RCxPQUFPLEVBQ0wscUJBQXFCLEVBQ3JCLGVBQWUsRUFFZixlQUFlLEdBQ2hCLE1BQU0sY0FBYyxDQUFDO0FBQ3RCLE9BQU8sRUFBZ0IsY0FBYyxFQUFFLFlBQVksRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQ2xGLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxZQUFZLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUMxRixPQUFPLEVBQUUsaUJBQWlCLEVBQUUsb0JBQW9CLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFhekYsU0FBUyxRQUFRLENBQUMsQ0FBWTtJQUM1QixNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQ3hCLFFBQVEsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3ZCLEtBQUssbUJBQW1CLENBQUM7UUFDekIsS0FBSyxTQUFTLENBQUM7UUFDZixLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUM7WUFDaEIsTUFBTSxDQUFDLEdBQUcsU0FBa0MsQ0FBQztZQUM3QyxRQUFRLENBQUMsQ0FBQyxhQUFhLEVBQUUsQ0FBQztnQkFDeEIsS0FBSyxJQUFJO29CQUNQLE9BQU8sT0FBTyxDQUFDO2dCQUNqQixLQUFLLElBQUk7b0JBQ1AsT0FBTyxPQUFPLENBQUM7Z0JBQ2pCLEtBQUssSUFBSTtvQkFDUCxPQUFPLE9BQU8sQ0FBQztZQUNuQixDQUFDO1lBQ0QsTUFBTTtRQUNSLENBQUM7UUFDRCxLQUFLLE9BQU8sQ0FBQztRQUNiLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQztZQUNaLE9BQU8sT0FBTyxDQUFDO1FBQ2pCLENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxJQUFJLGtCQUFrQixDQUFDLDZCQUE2QixJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUN6RixDQUFDO0FBRUQsS0FBSyxVQUFVLHdCQUF3QjtJQUNyQyxNQUFNLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxHQUFHLE1BQU0sZUFBZSxFQUFFLENBQUM7SUFDMUQsSUFBSSxDQUFDLFVBQVUsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQzlCLE1BQU0sS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELE9BQU8sRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLENBQUM7QUFDbkMsQ0FBQztBQUVELEtBQUssVUFBVSxxQkFBcUI7SUFDbEMsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FDOUI7UUFDRSxJQUFJLEVBQUUsbUJBQW1CO1FBQ3pCLElBQUksRUFBRSxTQUFTO1FBQ2YsYUFBYSxFQUFFLElBQUk7UUFDbkIsY0FBYyxFQUFFLElBQUksVUFBVSxDQUFDLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztLQUNuRCxFQUNELElBQUksRUFDSixDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FDbkIsQ0FBQztBQUNKLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQTRCRztBQUNILE1BQXFCLE1BQU07SUF1QnpCOzs7Ozs7T0FNRztJQUNILFlBQ0UscUJBQWtELEVBQ2xELE1BQWUsRUFDZixnQkFBZ0MsRUFDaEMsV0FBVyxHQUFHLEtBQUs7UUFqQnJCLFlBQU8sR0FBYSxFQUFFLENBQUM7UUFDdkIsbUJBQWMsR0FBYSxFQUFFLENBQUM7UUFrQjVCLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxDQUFlLEVBQWdCLEVBQUU7WUFDM0QsT0FBTztnQkFDTCxxQkFBcUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLEVBQUU7b0JBQzFDLE1BQU0sQ0FBQyxDQUFDLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxDQUFDO2dCQUM1QyxDQUFDO2dCQUNELFNBQVMsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7b0JBQzNCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLG9CQUFvQixDQUFDO29CQUMvQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7d0JBQ1osTUFBTSxJQUFJLGtCQUFrQixDQUFDLCtDQUErQyxDQUFDLENBQUM7b0JBQ2hGLENBQUM7b0JBQ0QsTUFBTSxDQUFDLENBQUMscUJBQXFCLENBQUMsTUFBTSxDQUFDLENBQUM7b0JBQ3RDLE9BQU8sQ0FBQyxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDOUIsQ0FBQzthQUNGLENBQUM7UUFDSixDQUFDLENBQUM7UUFDRixJQUFJLGNBQWMsQ0FBQyxxQkFBcUIsQ0FBQyxFQUFFLENBQUM7WUFDMUMsSUFBSSxDQUFDLFlBQVksR0FBRyxrQkFBa0IsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1lBQzlELElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDWixNQUFNLElBQUksa0JBQWtCLENBQUMsNEJBQTRCLENBQUMsQ0FBQztZQUM3RCxDQUFDO1lBQ0Qsb0RBQW9EO1lBQ3BELGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzFCLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO1lBQ3JCLElBQUksQ0FBQyxXQUFXLEdBQUcsV0FBVyxDQUFDO1lBRS9CLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztnQkFDckIsSUFBSSxDQUFDLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUM1RCxDQUFDO2lCQUFNLENBQUM7Z0JBQ04sSUFBSSxDQUFDLGdCQUFnQixHQUFHLHdCQUF3QixFQUFFLENBQUM7WUFDckQsQ0FBQztZQUNELElBQUksQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ2QsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLEVBQ0osWUFBWSxFQUNaLGVBQWUsRUFDZixZQUFZLEVBQ1osV0FBVyxFQUNYLFFBQVEsRUFDUixnQkFBZ0IsRUFDaEIsV0FBVyxFQUNYLFdBQVcsR0FDWixHQUFHLHFCQUFxQixDQUFDO1lBQzFCLElBQUksQ0FBQyxZQUFZLEdBQUcsa0JBQWtCLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDckQsb0RBQW9EO1lBQ3BELGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQy9CLElBQUksQ0FBQyxNQUFNLEdBQUcsV0FBVyxDQUFDO1lBQzFCLElBQUksQ0FBQyxXQUFXLEdBQUcsV0FBVyxDQUFDO1lBQy9CLElBQUksWUFBWSxFQUFFLE1BQU0sSUFBSSxlQUFlLEVBQUUsQ0FBQztnQkFDNUMsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLGVBQWUsQ0FBQyxZQUFZLElBQUksRUFBRSxFQUFFLGVBQWUsQ0FBQyxDQUFDO1lBQy9FLENBQUM7WUFDRCxJQUFJLENBQUMsV0FBVyxHQUFHLENBQUMsQ0FBQyxXQUFXLENBQUM7WUFDakMsSUFBSSxRQUFRLEVBQUUsQ0FBQztnQkFDYixJQUFJLENBQUMsb0JBQW9CLEdBQUcsUUFBUSxDQUFDO1lBQ3ZDLENBQUM7aUJBQU0sQ0FBQztnQkFDTixJQUFJLENBQUMsb0JBQW9CLEdBQUcscUJBQXFCLEVBQUUsQ0FBQztZQUN0RCxDQUFDO1lBRUQsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO2dCQUNyQixJQUFJLENBQUMsZ0JBQWdCLEdBQUcsZ0JBQWdCLENBQUM7WUFDM0MsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyx3QkFBd0IsRUFBRSxDQUFDO1lBQ3JELENBQUM7WUFDRCxJQUFJLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNILFlBQVksQ0FBQyxTQUFpQjtRQUM1QixJQUFJLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUN0QyxDQUFDO0lBRUQ7Ozs7Ozs7O09BUUc7SUFDSCxLQUFLLENBQUMsU0FBUyxDQUNiLGFBQThCLEVBQzlCLFlBQW9CLEVBQ3BCLGtCQUFtQyxFQUNuQyxhQUFxQjtRQUVyQixJQUFJLFlBQVksR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDO1FBRXJDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNsQixZQUFZLEdBQUcsTUFBTSxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNsRixDQUFDO1FBRUQsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUN2QyxNQUFNLElBQUksY0FBYyxDQUFDLGlCQUFpQixZQUFZLENBQUMsT0FBTyxHQUFHLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDbkYsQ0FBQztRQUVELE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQUM7UUFDckQsTUFBTSxvQkFBb0IsR0FBRyxNQUFNLElBQUksQ0FBQyxvQkFBb0IsQ0FBQztRQUU3RCxrRkFBa0Y7UUFDbEYsSUFBSSxDQUFDLGdCQUFnQixFQUFFLFVBQVUsRUFBRSxDQUFDO1lBQ2xDLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFFRCxJQUFJLENBQUMsb0JBQW9CLEVBQUUsVUFBVSxFQUFFLENBQUM7WUFDdEMsTUFBTSxJQUFJLGtCQUFrQixDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDM0UsQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDcEMsU0FBUyxFQUFFLGFBQWEsQ0FBQyxrQkFBa0I7WUFDM0Msa0RBQWtEO1lBQ2xELFNBQVMsRUFBRTtnQkFDVCxJQUFJLEVBQUUsTUFBTSxDQUFDLGlCQUFpQjtnQkFDOUIsR0FBRyxFQUFFLEVBQUU7Z0JBQ1AsUUFBUSxFQUFFLE1BQU0sQ0FBQyxZQUFZO2dCQUM3QixNQUFNLEVBQUUsTUFBTSxDQUFDLGlCQUFpQixDQUFDLGFBQWEsQ0FBQzthQUNoRDtZQUNELGVBQWUsRUFBRSxNQUFNLGlCQUFpQixDQUFDLGdCQUFnQixDQUFDLFNBQVMsQ0FBQztTQUNyRSxDQUFDLENBQUM7UUFFSCxNQUFNLFVBQVUsR0FBRyxFQUFFLFdBQVcsRUFBRSxjQUFjLEVBQUUsQ0FBQztRQUVuRCxNQUFNLGtCQUFrQixHQUFHLE1BQU0sWUFBWSxDQUFDLFVBQVUsRUFBRSxvQkFBb0IsQ0FBQyxVQUFVLEVBQUU7WUFDekYsR0FBRyxFQUFFLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxTQUFTLENBQUM7U0FDOUMsQ0FBQyxDQUFDO1FBRUgsVUFBVTtRQUNWLE1BQU0sVUFBVSxHQUFHLE1BQU0sZUFBZSxDQUFDLFlBQVksRUFBRSxrQkFBa0IsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUM7UUFFOUYsZ0NBQWdDO1FBQ2hDLE1BQU0sZ0JBQWdCLEdBQUcsVUFBVSxDQUFDLGdCQUFnQixDQUFDO1FBQ3JELE1BQU0sUUFBUSxHQUNaLGFBQWEsSUFBSSxNQUFNLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUNoRyxNQUFNLEVBQUUsR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ2xELE1BQU0sa0JBQWtCLEdBQUcsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRS9ELElBQUksWUFBWSxDQUFDO1FBQ2pCLElBQUksQ0FBQztZQUNILG1EQUFtRDtZQUNuRCxZQUFZLEdBQUcsTUFBTSxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxrQkFBa0IsQ0FDMUIsY0FBYyxZQUFZLDJFQUEyRSxFQUNyRyxLQUFLLENBQ04sQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLFFBQVEsQ0FBQztRQUNiLElBQUksQ0FBQztZQUNILDJCQUEyQjtZQUMzQixRQUFRLEdBQUcsTUFBTSxXQUFXLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNYLE1BQU0sSUFBSSxRQUFRLENBQUMscUJBQXFCLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDL0MsQ0FBQztRQUNELE1BQU0sRUFBRSxVQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztRQUVuRCx5QkFBeUI7UUFDekIsSUFBSSxhQUFhLENBQUM7UUFDbEIsSUFBSSxDQUFDO1lBQ0gsYUFBYSxHQUFHLE1BQU0sWUFBWTtZQUNoQyx3QkFBd0I7WUFDeEIsVUFBVSxFQUNWLFlBQVksRUFDWixRQUFRLENBQ1QsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ1gsSUFBSSxDQUFDLENBQUMsSUFBSSxJQUFJLG9CQUFvQixJQUFJLENBQUMsQ0FBQyxJQUFJLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztnQkFDakUsTUFBTSxJQUFJLFlBQVksQ0FBQywrQkFBK0IsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUM3RCxDQUFDO2lCQUFNLElBQUksQ0FBQyxDQUFDLElBQUksSUFBSSxjQUFjLEVBQUUsQ0FBQztnQkFDcEMsTUFBTSxJQUFJLGtCQUFrQixDQUFDLCtCQUErQixFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ25FLENBQUM7WUFDRCxNQUFNLElBQUksUUFBUSxDQUFDLDJCQUEyQixFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3JELENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxVQUFVLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDL0QsSUFBSSxZQUFZLENBQUM7UUFDakIsSUFBSSxDQUFDO1lBQ0gsMEJBQTBCO1lBQzFCLFlBQVksR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUN4QyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsRUFDakQsYUFBYSxFQUNiLGtCQUFrQixDQUNuQixDQUFDO1FBQ0osQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksWUFBWSxDQUNwQiwwRUFBMEUsRUFDMUUsS0FBSyxDQUNOLENBQUM7UUFDSixDQUFDO1FBRUQsZUFBZTtRQUNmLElBQUksWUFBWSxDQUFDO1FBQ2pCLElBQUksQ0FBQztZQUNILFlBQVksR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUMxQyxLQUFLLEVBQ0wsWUFBWSxFQUNaLFNBQVM7WUFDVCx3RUFBd0U7WUFDeEUsMEVBQTBFO1lBQzFFLHdFQUF3RTtZQUN4RSxJQUFJO1lBQ0osOEVBQThFO1lBQzlFLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUN2QixDQUFDO1FBQ0osQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksWUFBWSxDQUFDLDJCQUEyQixFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFFRCxPQUFPLFlBQVksQ0FBQztJQUN0QixDQUFDOztBQXhQZSx3QkFBaUIsR0FBRyxRQUFRLEFBQVgsQ0FBWTtBQUM3QixtQkFBWSxHQUFHLEtBQUssQUFBUixDQUFTO0FBQ3JCLDBCQUFtQixHQUFHLE9BQU8sQUFBVixDQUFXO0FBQzlCLDhCQUF1QixHQUFHLENBQUMsQUFBSixDQUFLO0FBQzVCLGNBQU8sR0FBRyxFQUFFLEFBQUwsQ0FBTTtlQUxWLE1BQU0ifQ==
|
|
@@ -222,7 +222,7 @@ class Header {
|
|
|
222
222
|
*/
|
|
223
223
|
getKasRewrapUrl() {
|
|
224
224
|
try {
|
|
225
|
-
return `${rstrip(this.kas.url, '/')}
|
|
225
|
+
return `${rstrip(this.kas.url, '/')}`;
|
|
226
226
|
}
|
|
227
227
|
catch (e) {
|
|
228
228
|
throw new ConfigurationError(`cannot construct KAS Rewrap URL: ${e.message}`);
|
|
@@ -247,4 +247,4 @@ Header.SIGNATURE_ECC_CURVE_NAME_BIT_LEN = 3;
|
|
|
247
247
|
Header.SYMMETRIC_CIPHER_BIT_OFF = 4;
|
|
248
248
|
Header.SYMMETRIC_CIPHER_BIT_LEN = 4;
|
|
249
249
|
export default Header;
|
|
250
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
250
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiSGVhZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL25hbm90ZGYvbW9kZWxzL0hlYWRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxTQUFTO0FBQ1QsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUM1QyxPQUFPLGVBQWUsTUFBTSxzQkFBc0IsQ0FBQztBQUNuRCxPQUFPLGFBQWEsTUFBTSwyQkFBMkIsQ0FBQztBQU10RCxVQUFVO0FBQ1YsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDbkUsT0FBTyxhQUFhLE1BQU0sb0JBQW9CLENBQUM7QUFDL0MsT0FBTyxFQUFFLGtCQUFrQixFQUFFLGdCQUFnQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDdkUsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBRXhDOzs7Ozs7Ozs7Ozs7Ozs7R0FlRztBQUNILE1BQXFCLE1BQU07SUE0Q3pCLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBZ0I7UUFDM0IsSUFBSSxNQUFNLEdBQUcsQ0FBQyxDQUFDO1FBRWY7Ozs7V0FJRztRQUNILG1CQUFtQjtRQUNuQixNQUFNLGtCQUFrQixHQUFHLElBQUksQ0FBQyxRQUFRLENBQ3RDLE1BQU0sQ0FBQyw2QkFBNkIsRUFDcEMsTUFBTSxDQUFDLDZCQUE2QixDQUNyQyxDQUFDO1FBQ0YsTUFBTSxJQUFJLE1BQU0sQ0FBQyw2QkFBNkIsQ0FBQztRQUUvQzs7Ozs7OztXQU9HO1FBQ0gsTUFBTSxHQUFHLEdBQUcsZUFBZSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDekQsTUFBTSxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUM7UUFFckI7Ozs7Ozs7Ozs7Ozs7OztXQWVHO1FBQ0gsTUFBTSxnQkFBZ0IsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsTUFBTSxDQUFDLHlCQUF5QixDQUFDLENBQUM7UUFDMUYsTUFBTSxlQUFlLEdBQUcsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFdBQVc7UUFDbkUsTUFBTSxrQkFBa0IsR0FBRyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxlQUFlO1FBQ3JFLE1BQU0sSUFBSSxNQUFNLENBQUMseUJBQXlCLENBQUM7UUFFM0M7Ozs7Ozs7Ozs7Ozs7O1dBY0c7UUFDSCxNQUFNLGtCQUFrQixHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxNQUFNLENBQUMseUJBQXlCLENBQUMsQ0FBQztRQUM1RixNQUFNLFlBQVksR0FBRyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsV0FBVztRQUNsRSxNQUFNLGtCQUFrQixHQUFHLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsZ0JBQWdCO1FBQy9FLE1BQU0sZUFBZSxHQUFHLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLGVBQWU7UUFDcEUsTUFBTSxJQUFJLE1BQU0sQ0FBQyxpQ0FBaUMsQ0FBQztRQUVuRDs7Ozs7Ozs7Ozs7Ozs7Ozs7V0FpQkc7UUFDSCxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsR0FBRyxhQUFhLENBQUMsS0FBSyxDQUN4RCxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUNyQixlQUFlLEVBQ2Ysa0JBQWtCLENBQ25CLENBQUM7UUFDRixNQUFNLElBQUksVUFBVSxDQUFDO1FBRXJCOzs7Ozs7V0FNRztRQUNILGlEQUFpRDtRQUNqRCxNQUFNLHdCQUF3QixHQUFHLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzNFLE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLHdCQUF3QixDQUFDLENBQUM7UUFDcEYsTUFBTSxJQUFJLHdCQUF3QixDQUFDO1FBRW5DLGtFQUFrRTtRQUNsRSxJQUFJLGtCQUFrQixDQUFDLFVBQVUsS0FBSyx3QkFBd0IsRUFBRSxDQUFDO1lBQy9ELE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO1FBQy9FLENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBRyxJQUFJLE1BQU0sQ0FDdkIsa0JBQWtCLEVBQ2xCLEdBQUcsRUFDSCxlQUFlLEVBQ2Ysa0JBQWtCLEVBQ2xCLFlBQVksRUFDWixrQkFBa0IsRUFDbEIsZUFBZSxFQUNmLE1BQU0sRUFDTixrQkFBa0IsQ0FDbkIsQ0FBQztRQUVGLE9BQU87WUFDTCxNQUFNO1lBQ04sTUFBTTtTQUNQLENBQUM7SUFDSixDQUFDO0lBRUQsc0JBQXNCO0lBQ3RCLHVEQUF1RDtJQUV2RCxZQUNFLGtCQUE4QixFQUM5QixHQUFvQixFQUNwQixlQUF3QixFQUN4QixrQkFBaUMsRUFDakMsWUFBcUIsRUFDckIsa0JBQWlDLEVBQ2pDLGVBQTJCLEVBQzNCLE1BQXVCLEVBQ3ZCLGtCQUE4QjtRQW5LaEMseUJBQXlCO1FBQ2xCLHVCQUFrQixHQUFlLGFBQWEsQ0FBQyxrQkFBa0IsQ0FBQztRQUt6RSxxQkFBcUI7UUFDZCxvQkFBZSxHQUFZLGFBQWEsQ0FBQyxZQUFZLENBQUM7UUFDdEQsdUJBQWtCLEdBQWtCLGFBQWEsQ0FBQyxrQkFBa0IsQ0FBQztRQUU1RSw2QkFBNkI7UUFDdEIsaUJBQVksR0FBWSxhQUFhLENBQUMsU0FBUyxDQUFDO1FBQ2hELHVCQUFrQixHQUFrQixhQUFhLENBQUMsa0JBQWtCLENBQUM7UUFDckUsb0JBQWUsR0FBZSxhQUFhLENBQUMsZUFBZSxDQUFDO1FBd0pqRSxJQUFJLENBQUMsa0JBQWtCLEdBQUcsa0JBQWtCLENBQUM7UUFDN0MsSUFBSSxDQUFDLEdBQUcsR0FBRyxHQUFHLENBQUM7UUFDZixJQUFJLENBQUMsZUFBZSxHQUFHLGVBQWUsQ0FBQztRQUN2QyxJQUFJLENBQUMsa0JBQWtCLEdBQUcsa0JBQWtCLENBQUM7UUFDN0MsSUFBSSxDQUFDLFlBQVksR0FBRyxZQUFZLENBQUM7UUFDakMsSUFBSSxDQUFDLGtCQUFrQixHQUFHLGtCQUFrQixDQUFDO1FBQzdDLElBQUksQ0FBQyxlQUFlLEdBQUcsZUFBZSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxrQkFBa0IsR0FBRyxrQkFBa0IsQ0FBQztRQUU3QyxnREFBZ0Q7UUFDaEQsSUFBSSxDQUFDLGFBQWEsR0FBRyxZQUFZLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFRDs7T0FFRztJQUNILFlBQVksQ0FBQyxNQUFrQjtRQUM3QixJQUFJLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ2hDLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFFRCxJQUFJLE1BQU0sR0FBRyxDQUFDLENBQUM7UUFFZixpQ0FBaUM7UUFDakMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDdkMsTUFBTSxJQUFJLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxNQUFNLENBQUM7UUFFekMsNkJBQTZCO1FBQzdCLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsR0FBRyxDQUFDLHFCQUFxQixFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzFDLE1BQU0sSUFBSSxxQkFBcUIsQ0FBQyxNQUFNLENBQUM7UUFFdkMsMkJBQTJCO1FBQzNCLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xELE1BQU0sY0FBYyxHQUFHLENBQUMsWUFBWSxJQUFJLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztRQUNyRSxNQUFNLG9CQUFvQixHQUFHLElBQUksVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQy9DLG9CQUFvQixDQUFDLENBQUMsQ0FBQyxHQUFHLGNBQWMsQ0FBQztRQUN6QyxNQUFNLENBQUMsR0FBRyxDQUFDLG9CQUFvQixFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3pDLE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxNQUFNLENBQUM7UUFFdEMsbUNBQW1DO1FBQ25DLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDcEQsTUFBTSxzQkFBc0IsR0FDMUIsQ0FBQyxpQkFBaUIsSUFBSSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsa0JBQWtCLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQztRQUM1RSxNQUFNLDRCQUE0QixHQUFHLElBQUksVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZELDRCQUE0QixDQUFDLENBQUMsQ0FBQyxHQUFHLHNCQUFzQixDQUFDO1FBQ3pELE1BQU0sQ0FBQyxHQUFHLENBQUMsNEJBQTRCLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDakQsTUFBTSxJQUFJLDRCQUE0QixDQUFDLE1BQU0sQ0FBQztRQUU5QyxtQkFBbUI7UUFDbkIsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUM1QyxNQUFNLENBQUMsR0FBRyxDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNqQyxNQUFNLElBQUksWUFBWSxDQUFDLE1BQU0sQ0FBQztRQUU5QixpQ0FBaUM7UUFDakMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxJQUFJLE1BQU07UUFDUixPQUFPO1FBQ0wseUNBQXlDO1FBQ3pDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxNQUFNO1lBQzlCLHFDQUFxQztZQUNyQyxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU07WUFDZiwrQkFBK0I7WUFDL0IsQ0FBQztZQUNELHVDQUF1QztZQUN2QyxDQUFDO1lBQ0QsdUJBQXVCO1lBQ3ZCLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFO1lBQ3ZCLHFDQUFxQztZQUNyQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsTUFBTSxDQUMvQixDQUFDO0lBQ0osQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsUUFBUTtRQUNOLE1BQU0sV0FBVyxHQUFHLElBQUksV0FBVyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNqRCxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUMzQyxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzFCLE9BQU8sV0FBVyxDQUFDO0lBQ3JCLENBQUM7SUFFRDs7T0FFRztJQUNILGVBQWU7UUFDYixJQUFJLENBQUM7WUFDSCxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEMsQ0FBQztRQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksa0JBQWtCLENBQUMsb0NBQW9DLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7SUFDSCxDQUFDOztBQWhTRCx5QkFBeUI7QUFDVCxvQ0FBNkIsR0FBRyxDQUFDLEFBQUosQ0FBSztBQUNsQyxvQ0FBNkIsR0FBRyxDQUFDLEFBQUosQ0FBSztBQUNsQywwQkFBbUIsR0FBRyxDQUFDLEFBQUosQ0FBSztBQUN4QiwwQkFBbUIsR0FBRyxFQUFFLEFBQUwsQ0FBTTtBQUV6QyxxQkFBcUI7QUFDTCxnQ0FBeUIsR0FBRyxDQUFDLEFBQUosQ0FBSztBQUM5QixnQ0FBeUIsR0FBRyxDQUFDLEFBQUosQ0FBSztBQUM5Qix1Q0FBZ0MsR0FBRyxDQUFDLENBQUMsQUFBTCxDQUFNO0FBRXRELDZCQUE2QjtBQUNiLHdDQUFpQyxHQUFHLENBQUMsQUFBSixDQUFLO0FBQ3RDLDRCQUFxQixHQUFHLENBQUMsQUFBSixDQUFLO0FBQzFCLDRCQUFxQixHQUFHLENBQUMsQUFBSixDQUFLO0FBQzFCLHVDQUFnQyxHQUFHLENBQUMsQUFBSixDQUFLO0FBQ3JDLHVDQUFnQyxHQUFHLENBQUMsQUFBSixDQUFLO0FBQ3JDLCtCQUF3QixHQUFHLENBQUMsQUFBSixDQUFLO0FBQzdCLCtCQUF3QixHQUFHLENBQUMsQUFBSixDQUFLO2VBbkIxQixNQUFNIn0=
|