@pipeline-builder/api-core 4.1.13 → 4.1.14

package/lib/testing/user-tokens.d.ts

@@ -1,75 +0,0 @@
-/**
- * Test helpers for the ES256 user-token chain.
- *
- * Before #5 every suite that needed an authenticated request just signed a JWT
- * with a literal `JWT_SECRET` — one line, and seventeen independent copies of
- * it. User tokens are asymmetric now, which needs a keypair, a `kid` and a JWKS
- * the verifier can fetch, so that per-suite copy-paste would be ~15 lines each.
- * Hence one shared seam, in api-core next to the route-coverage helper, imported
- * by the suites of every package:
- *
- * ```ts
- * import { installTestJwks, signTestUserToken } from '@pipeline-builder/api-core/lib/testing/user-tokens.js';
- *
- * const jwks = installTestJwks();
- * const token = signTestUserToken({ sub: 'u1', role: 'member', ... });
- * ```
- *
- * `installTestJwks` replaces the process-wide JWKS cache with one backed by the
- * generated keys — no HTTP, and it counts fetches so a test can assert the
- * refresh / unknown-`kid` / negative-cache behaviour.
- */
-import { type KeyObject } from 'crypto';
-import { type JwksDocument, type PublicJwk } from '../utils/jwk.js';
-/** A generated signing key, in every form the tests need. */
-export interface TestSigningKey {
-    kid: string;
-    privateKey: KeyObject;
-    publicKey: KeyObject;
-    jwk: PublicJwk;
-}
-/** Generate one EC P-256 signing key, `kid` = its RFC 7638 thumbprint. */
-export declare function generateTestSigningKey(): TestSigningKey;
-/**
- * Sign `payload` as an ES256 JWT with `key`. `expiresIn` seconds (default 300).
- * Synchronous — `crypto.sign` is, and platform's async signer only exists
- * because KMS is a network call — so a suite can mint a token inline wherever it
- * used to call `jwt.sign`.
- */
-export declare function signTestUserToken(payload: Record<string, unknown>, options?: {
-    key: TestSigningKey;
-    expiresIn?: number;
-    issuer?: string;
-    audience?: string;
-    kid?: string;
-    notBefore?: number;
-}): string;
-/** The claim block a USER principal must carry to satisfy `hasValidIdentityClaims`. */
-export declare function testUserIdentityClaims(): Record<string, unknown>;
-/** Handle over the installed test JWKS — lets a test rotate keys and count fetches. */
-export interface TestJwksHandle {
-    /** Keys currently published. */
-    keys: TestSigningKey[];
-    /** The first published key — what `signTestUserToken` uses by default. */
-    primary: TestSigningKey;
-    /** How many times the verifier has fetched the document. */
-    fetchCount(): number;
-    /** Make the next fetch(es) fail, to exercise the negative cache / fail-closed paths. */
-    failNextFetches(count: number): void;
-    /** Replace the published set (a rotation), leaving the cache to notice. */
-    publish(keys: TestSigningKey[]): void;
-    /** The document as the verifier sees it. */
-    document(): JwksDocument;
-}
-/**
- * Install a JWKS cache backed by freshly generated keys (or `keys` when given)
- * as the process-wide one, and return a handle over it. Call in `beforeEach`;
- * `uninstallTestJwks()` restores the real HTTP-backed cache.
- */
-export declare function installTestJwks(keys?: TestSigningKey[], cacheOptions?: {
-    refreshIntervalMs?: number;
-    negativeTtlMs?: number;
-    unknownKidCooldownMs?: number;
-}): TestJwksHandle;
-/** Restore the real (HTTP-backed) JWKS cache. */
-export declare function uninstallTestJwks(): void;

package/lib/testing/user-tokens.js

@@ -1,115 +0,0 @@
-// Copyright 2026 Pipeline Builder Contributors
-// SPDX-License-Identifier: Apache-2.0
-/**
- * Test helpers for the ES256 user-token chain.
- *
- * Before #5 every suite that needed an authenticated request just signed a JWT
- * with a literal `JWT_SECRET` — one line, and seventeen independent copies of
- * it. User tokens are asymmetric now, which needs a keypair, a `kid` and a JWKS
- * the verifier can fetch, so that per-suite copy-paste would be ~15 lines each.
- * Hence one shared seam, in api-core next to the route-coverage helper, imported
- * by the suites of every package:
- *
- * ```ts
- * import { installTestJwks, signTestUserToken } from '@pipeline-builder/api-core/lib/testing/user-tokens.js';
- *
- * const jwks = installTestJwks();
- * const token = signTestUserToken({ sub: 'u1', role: 'member', ... });
- * ```
- *
- * `installTestJwks` replaces the process-wide JWKS cache with one backed by the
- * generated keys — no HTTP, and it counts fetches so a test can assert the
- * refresh / unknown-`kid` / negative-cache behaviour.
- */
-import crypto, {} from 'crypto';
-import { JwksCache, setPlatformJwksCache } from '../services/jwks-cache.js';
-import { USER_TOKEN_ALGORITHM, publicJwkFrom } from '../utils/jwk.js';
-/** Generate one EC P-256 signing key, `kid` = its RFC 7638 thumbprint. */
-export function generateTestSigningKey() {
-    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
-    const jwk = publicJwkFrom(publicKey);
-    return { kid: jwk.kid, privateKey, publicKey, jwk };
-}
-/**
- * Sign `payload` as an ES256 JWT with `key`. `expiresIn` seconds (default 300).
- * Synchronous — `crypto.sign` is, and platform's async signer only exists
- * because KMS is a network call — so a suite can mint a token inline wherever it
- * used to call `jwt.sign`.
- */
-export function signTestUserToken(payload, options = {
-    key: defaultKey(),
-}) {
-    const key = options.key ?? defaultKey();
-    const now = Math.floor(Date.now() / 1000);
-    const body = {
-        ...payload,
-        iat: payload.iat ?? now,
-        exp: payload.exp ?? now + (options.expiresIn ?? 300),
-        ...(options.notBefore !== undefined ? { nbf: now + options.notBefore } : {}),
-        ...(options.issuer ? { iss: options.issuer } : {}),
-        ...(options.audience ? { aud: options.audience } : {}),
-    };
-    const b64 = (value) => Buffer.from(JSON.stringify(value), 'utf-8').toString('base64url');
-    const signingInput = `${b64({ alg: USER_TOKEN_ALGORITHM, typ: 'JWT', kid: options.kid ?? key.kid })}.${b64(body)}`;
-    const signature = crypto.sign('sha256', Buffer.from(signingInput, 'utf-8'), {
-        key: key.privateKey,
-        dsaEncoding: 'ieee-p1363',
-    });
-    return `${signingInput}.${signature.toString('base64url')}`;
-}
-/** The claim block a USER principal must carry to satisfy `hasValidIdentityClaims`. */
-export function testUserIdentityClaims() {
-    return {
-        type: 'access',
-        principalType: 'user',
-        token_use: 'access',
-        amr: ['pwd'],
-        aal: 1,
-        auth_time: Math.floor(Date.now() / 1000),
-    };
-}
-let installed;
-function defaultKey() {
-    if (!installed)
-        throw new Error('installTestJwks() must be called before signing a test user token');
-    return installed.primary;
-}
-/**
- * Install a JWKS cache backed by freshly generated keys (or `keys` when given)
- * as the process-wide one, and return a handle over it. Call in `beforeEach`;
- * `uninstallTestJwks()` restores the real HTTP-backed cache.
- */
-export function installTestJwks(keys = [generateTestSigningKey()], cacheOptions = {}) {
-    let published = keys;
-    let fetches = 0;
-    let failures = 0;
-    const handle = {
-        get keys() { return published; },
-        get primary() { return published[0]; },
-        fetchCount: () => fetches,
-        failNextFetches: (count) => { failures = count; },
-        publish: (next) => { published = next; },
-        document: () => ({ keys: published.map((k) => k.jwk) }),
-    };
-    const cache = new JwksCache({
-        source: 'test',
-        fetch: async () => {
-            fetches += 1;
-            if (failures > 0) {
-                failures -= 1;
-                throw new Error('test JWKS fetch failure');
-            }
-            return handle.document();
-        },
-        ...cacheOptions,
-    });
-    setPlatformJwksCache(cache);
-    installed = handle;
-    return handle;
-}
-/** Restore the real (HTTP-backed) JWKS cache. */
-export function uninstallTestJwks() {
-    setPlatformJwksCache(undefined);
-    installed = undefined;
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXNlci10b2tlbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdGVzdGluZy91c2VyLXRva2Vucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDOzs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW9CRztBQUVILE9BQU8sTUFBTSxFQUFFLEVBQWtCLE1BQU0sUUFBUSxDQUFDO0FBQ2hELE9BQU8sRUFBRSxTQUFTLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUM1RSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsYUFBYSxFQUFxQyxNQUFNLGlCQUFpQixDQUFDO0FBVXpHLDBFQUEwRTtBQUMxRSxNQUFNLFVBQVUsc0JBQXNCO0lBQ3BDLE1BQU0sRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxDQUFDLG1CQUFtQixDQUFDLElBQUksRUFBRSxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDO0lBQ2pHLE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNyQyxPQUFPLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxHQUFHLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQztBQUN0RCxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUsaUJBQWlCLENBQy9CLE9BQWdDLEVBQ2hDLE9BQU8sR0FBc0g7SUFDM0gsR0FBRyxFQUFFLFVBQVUsRUFBRTtDQUNsQjtJQUVELE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLElBQUksVUFBVSxFQUFFLENBQUM7SUFDeEMsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDMUMsTUFBTSxJQUFJLEdBQTRCO1FBQ3BDLEdBQUcsT0FBTztRQUNWLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRyxJQUFJLEdBQUc7UUFDdkIsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHLElBQUksR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLFNBQVMsSUFBSSxHQUFHLENBQUM7UUFDcEQsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxHQUFHLEdBQUcsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDNUUsR0FBRyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2xELEdBQUcsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztLQUN2RCxDQUFDO0lBQ0YsTUFBTSxHQUFHLEdBQUcsQ0FBQyxLQUFjLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDbEcsTUFBTSxZQUFZLEdBQUcsR0FBRyxHQUFHLENBQUMsRUFBRSxHQUFHLEVBQUUsb0JBQW9CLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztJQUNuSCxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsRUFBRTtRQUMxRSxHQUFHLEVBQUUsR0FBRyxDQUFDLFVBQVU7UUFDbkIsV0FBVyxFQUFFLFlBQVk7S0FDMUIsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxHQUFHLFlBQVksSUFBSSxTQUFTLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7QUFDOUQsQ0FBQztBQUVELHVGQUF1RjtBQUN2RixNQUFNLFVBQVUsc0JBQXNCO0lBQ3BDLE9BQU87UUFDTCxJQUFJLEVBQUUsUUFBUTtRQUNkLGFBQWEsRUFBRSxNQUFNO1FBQ3JCLFNBQVMsRUFBRSxRQUFRO1FBQ25CLEdBQUcsRUFBRSxDQUFDLEtBQUssQ0FBQztRQUNaLEdBQUcsRUFBRSxDQUFDO1FBQ04sU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztLQUN6QyxDQUFDO0FBQ0osQ0FBQztBQWtCRCxJQUFJLFNBQXFDLENBQUM7QUFFMUMsU0FBUyxVQUFVO0lBQ2pCLElBQUksQ0FBQyxTQUFTO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO0lBQ3JHLE9BQU8sU0FBUyxDQUFDLE9BQU8sQ0FBQztBQUMzQixDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxlQUFlLENBQzdCLElBQUksR0FBcUIsQ0FBQyxzQkFBc0IsRUFBRSxDQUFDLEVBQ25ELFlBQVksR0FBMEYsRUFBRTtJQUV4RyxJQUFJLFNBQVMsR0FBRyxJQUFJLENBQUM7SUFDckIsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDO0lBQ2hCLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztJQUVqQixNQUFNLE1BQU0sR0FBbUI7UUFDN0IsSUFBSSxJQUFJLEtBQUssT0FBTyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ2hDLElBQUksT0FBTyxLQUFLLE9BQU8sU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0QyxVQUFVLEVBQUUsR0FBRyxFQUFFLENBQUMsT0FBTztRQUN6QixlQUFlLEVBQUUsQ0FBQyxLQUFhLEVBQUUsRUFBRSxHQUFHLFFBQVEsR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sRUFBRSxDQUFDLElBQXNCLEVBQUUsRUFBRSxHQUFHLFNBQVMsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQzFELFFBQVEsRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO0tBQ3hELENBQUM7SUFFRixNQUFNLEtBQUssR0FBRyxJQUFJLFNBQVMsQ0FBQztRQUMxQixNQUFNLEVBQUUsTUFBTTtRQUNkLEtBQUssRUFBRSxLQUFLLElBQUksRUFBRTtZQUNoQixPQUFPLElBQUksQ0FBQyxDQUFDO1lBQ2IsSUFBSSxRQUFRLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ2pCLFFBQVEsSUFBSSxDQUFDLENBQUM7Z0JBQ2QsTUFBTSxJQUFJLEtBQUssQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1lBQzdDLENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUMzQixDQUFDO1FBQ0QsR0FBRyxZQUFZO0tBQ2hCLENBQUMsQ0FBQztJQUNILG9CQUFvQixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzVCLFNBQVMsR0FBRyxNQUFNLENBQUM7SUFDbkIsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELGlEQUFpRDtBQUNqRCxNQUFNLFVBQVUsaUJBQWlCO0lBQy9CLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2hDLFNBQVMsR0FBRyxTQUFTLENBQUM7QUFDeEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIFRlc3QgaGVscGVycyBmb3IgdGhlIEVTMjU2IHVzZXItdG9rZW4gY2hhaW4uXG4gKlxuICogQmVmb3JlICM1IGV2ZXJ5IHN1aXRlIHRoYXQgbmVlZGVkIGFuIGF1dGhlbnRpY2F0ZWQgcmVxdWVzdCBqdXN0IHNpZ25lZCBhIEpXVFxuICogd2l0aCBhIGxpdGVyYWwgYEpXVF9TRUNSRVRgIOKAlCBvbmUgbGluZSwgYW5kIHNldmVudGVlbiBpbmRlcGVuZGVudCBjb3BpZXMgb2ZcbiAqIGl0LiBVc2VyIHRva2VucyBhcmUgYXN5bW1ldHJpYyBub3csIHdoaWNoIG5lZWRzIGEga2V5cGFpciwgYSBga2lkYCBhbmQgYSBKV0tTXG4gKiB0aGUgdmVyaWZpZXIgY2FuIGZldGNoLCBzbyB0aGF0IHBlci1zdWl0ZSBjb3B5LXBhc3RlIHdvdWxkIGJlIH4xNSBsaW5lcyBlYWNoLlxuICogSGVuY2Ugb25lIHNoYXJlZCBzZWFtLCBpbiBhcGktY29yZSBuZXh0IHRvIHRoZSByb3V0ZS1jb3ZlcmFnZSBoZWxwZXIsIGltcG9ydGVkXG4gKiBieSB0aGUgc3VpdGVzIG9mIGV2ZXJ5IHBhY2thZ2U6XG4gKlxuICogYGBgdHNcbiAqIGltcG9ydCB7IGluc3RhbGxUZXN0Sndrcywgc2lnblRlc3RVc2VyVG9rZW4gfSBmcm9tICdAcGlwZWxpbmUtYnVpbGRlci9hcGktY29yZS9saWIvdGVzdGluZy91c2VyLXRva2Vucy5qcyc7XG4gKlxuICogY29uc3QgandrcyA9IGluc3RhbGxUZXN0SndrcygpO1xuICogY29uc3QgdG9rZW4gPSBzaWduVGVzdFVzZXJUb2tlbih7IHN1YjogJ3UxJywgcm9sZTogJ21lbWJlcicsIC4uLiB9KTtcbiAqIGBgYFxuICpcbiAqIGBpbnN0YWxsVGVzdEp3a3NgIHJlcGxhY2VzIHRoZSBwcm9jZXNzLXdpZGUgSldLUyBjYWNoZSB3aXRoIG9uZSBiYWNrZWQgYnkgdGhlXG4gKiBnZW5lcmF0ZWQga2V5cyDigJQgbm8gSFRUUCwgYW5kIGl0IGNvdW50cyBmZXRjaGVzIHNvIGEgdGVzdCBjYW4gYXNzZXJ0IHRoZVxuICogcmVmcmVzaCAvIHVua25vd24tYGtpZGAgLyBuZWdhdGl2ZS1jYWNoZSBiZWhhdmlvdXIuXG4gKi9cblxuaW1wb3J0IGNyeXB0bywgeyB0eXBlIEtleU9iamVjdCB9IGZyb20gJ2NyeXB0byc7XG5pbXBvcnQgeyBKd2tzQ2FjaGUsIHNldFBsYXRmb3JtSndrc0NhY2hlIH0gZnJvbSAnLi4vc2VydmljZXMvandrcy1jYWNoZS5qcyc7XG5pbXBvcnQgeyBVU0VSX1RPS0VOX0FMR09SSVRITSwgcHVibGljSndrRnJvbSwgdHlwZSBKd2tzRG9jdW1lbnQsIHR5cGUgUHVibGljSndrIH0gZnJvbSAnLi4vdXRpbHMvandrLmpzJztcblxuLyoqIEEgZ2VuZXJhdGVkIHNpZ25pbmcga2V5LCBpbiBldmVyeSBmb3JtIHRoZSB0ZXN0cyBuZWVkLiAqL1xuZXhwb3J0IGludGVyZmFjZSBUZXN0U2lnbmluZ0tleSB7XG4gIGtpZDogc3RyaW5nO1xuICBwcml2YXRlS2V5OiBLZXlPYmplY3Q7XG4gIHB1YmxpY0tleTogS2V5T2JqZWN0O1xuICBqd2s6IFB1YmxpY0p3aztcbn1cblxuLyoqIEdlbmVyYXRlIG9uZSBFQyBQLTI1NiBzaWduaW5nIGtleSwgYGtpZGAgPSBpdHMgUkZDIDc2MzggdGh1bWJwcmludC4gKi9cbmV4cG9ydCBmdW5jdGlvbiBnZW5lcmF0ZVRlc3RTaWduaW5nS2V5KCk6IFRlc3RTaWduaW5nS2V5IHtcbiAgY29uc3QgeyBwcml2YXRlS2V5LCBwdWJsaWNLZXkgfSA9IGNyeXB0by5nZW5lcmF0ZUtleVBhaXJTeW5jKCdlYycsIHsgbmFtZWRDdXJ2ZTogJ3ByaW1lMjU2djEnIH0pO1xuICBjb25zdCBqd2sgPSBwdWJsaWNKd2tGcm9tKHB1YmxpY0tleSk7XG4gIHJldHVybiB7IGtpZDogandrLmtpZCwgcHJpdmF0ZUtleSwgcHVibGljS2V5LCBqd2sgfTtcbn1cblxuLyoqXG4gKiBTaWduIGBwYXlsb2FkYCBhcyBhbiBFUzI1NiBKV1Qgd2l0aCBga2V5YC4gYGV4cGlyZXNJbmAgc2Vjb25kcyAoZGVmYXVsdCAzMDApLlxuICogU3luY2hyb25vdXMg4oCUIGBjcnlwdG8uc2lnbmAgaXMsIGFuZCBwbGF0Zm9ybSdzIGFzeW5jIHNpZ25lciBvbmx5IGV4aXN0c1xuICogYmVjYXVzZSBLTVMgaXMgYSBuZXR3b3JrIGNhbGwg4oCUIHNvIGEgc3VpdGUgY2FuIG1pbnQgYSB0b2tlbiBpbmxpbmUgd2hlcmV2ZXIgaXRcbiAqIHVzZWQgdG8gY2FsbCBgand0LnNpZ25gLlxuICovXG5leHBvcnQgZnVuY3Rpb24gc2lnblRlc3RVc2VyVG9rZW4oXG4gIHBheWxvYWQ6IFJlY29yZDxzdHJpbmcsIHVua25vd24+LFxuICBvcHRpb25zOiB7IGtleTogVGVzdFNpZ25pbmdLZXk7IGV4cGlyZXNJbj86IG51bWJlcjsgaXNzdWVyPzogc3RyaW5nOyBhdWRpZW5jZT86IHN0cmluZzsga2lkPzogc3RyaW5nOyBub3RCZWZvcmU/OiBudW1iZXIgfSA9IHtcbiAgICBrZXk6IGRlZmF1bHRLZXkoKSxcbiAgfSxcbik6IHN0cmluZyB7XG4gIGNvbnN0IGtleSA9IG9wdGlvbnMua2V5ID8/IGRlZmF1bHRLZXkoKTtcbiAgY29uc3Qgbm93ID0gTWF0aC5mbG9vcihEYXRlLm5vdygpIC8gMTAwMCk7XG4gIGNvbnN0IGJvZHk6IFJlY29yZDxzdHJpbmcsIHVua25vd24+ID0ge1xuICAgIC4uLnBheWxvYWQsXG4gICAgaWF0OiBwYXlsb2FkLmlhdCA/PyBub3csXG4gICAgZXhwOiBwYXlsb2FkLmV4cCA/PyBub3cgKyAob3B0aW9ucy5leHBpcmVzSW4gPz8gMzAwKSxcbiAgICAuLi4ob3B0aW9ucy5ub3RCZWZvcmUgIT09IHVuZGVmaW5lZCA/IHsgbmJmOiBub3cgKyBvcHRpb25zLm5vdEJlZm9yZSB9IDoge30pLFxuICAgIC4uLihvcHRpb25zLmlzc3VlciA/IHsgaXNzOiBvcHRpb25zLmlzc3VlciB9IDoge30pLFxuICAgIC4uLihvcHRpb25zLmF1ZGllbmNlID8geyBhdWQ6IG9wdGlvbnMuYXVkaWVuY2UgfSA6IHt9KSxcbiAgfTtcbiAgY29uc3QgYjY0ID0gKHZhbHVlOiB1bmtub3duKSA9PiBCdWZmZXIuZnJvbShKU09OLnN0cmluZ2lmeSh2YWx1ZSksICd1dGYtOCcpLnRvU3RyaW5nKCdiYXNlNjR1cmwnKTtcbiAgY29uc3Qgc2lnbmluZ0lucHV0ID0gYCR7YjY0KHsgYWxnOiBVU0VSX1RPS0VOX0FMR09SSVRITSwgdHlwOiAnSldUJywga2lkOiBvcHRpb25zLmtpZCA/PyBrZXkua2lkIH0pfS4ke2I2NChib2R5KX1gO1xuICBjb25zdCBzaWduYXR1cmUgPSBjcnlwdG8uc2lnbignc2hhMjU2JywgQnVmZmVyLmZyb20oc2lnbmluZ0lucHV0LCAndXRmLTgnKSwge1xuICAgIGtleToga2V5LnByaXZhdGVLZXksXG4gICAgZHNhRW5jb2Rpbmc6ICdpZWVlLXAxMzYzJyxcbiAgfSk7XG4gIHJldHVybiBgJHtzaWduaW5nSW5wdXR9LiR7c2lnbmF0dXJlLnRvU3RyaW5nKCdiYXNlNjR1cmwnKX1gO1xufVxuXG4vKiogVGhlIGNsYWltIGJsb2NrIGEgVVNFUiBwcmluY2lwYWwgbXVzdCBjYXJyeSB0byBzYXRpc2Z5IGBoYXNWYWxpZElkZW50aXR5Q2xhaW1zYC4gKi9cbmV4cG9ydCBmdW5jdGlvbiB0ZXN0VXNlcklkZW50aXR5Q2xhaW1zKCk6IFJlY29yZDxzdHJpbmcsIHVua25vd24+IHtcbiAgcmV0dXJuIHtcbiAgICB0eXBlOiAnYWNjZXNzJyxcbiAgICBwcmluY2lwYWxUeXBlOiAndXNlcicsXG4gICAgdG9rZW5fdXNlOiAnYWNjZXNzJyxcbiAgICBhbXI6IFsncHdkJ10sXG4gICAgYWFsOiAxLFxuICAgIGF1dGhfdGltZTogTWF0aC5mbG9vcihEYXRlLm5vdygpIC8gMTAwMCksXG4gIH07XG59XG5cbi8qKiBIYW5kbGUgb3ZlciB0aGUgaW5zdGFsbGVkIHRlc3QgSldLUyDigJQgbGV0cyBhIHRlc3Qgcm90YXRlIGtleXMgYW5kIGNvdW50IGZldGNoZXMuICovXG5leHBvcnQgaW50ZXJmYWNlIFRlc3RKd2tzSGFuZGxlIHtcbiAgLyoqIEtleXMgY3VycmVudGx5IHB1Ymxpc2hlZC4gKi9cbiAga2V5czogVGVzdFNpZ25pbmdLZXlbXTtcbiAgLyoqIFRoZSBmaXJzdCBwdWJsaXNoZWQga2V5IOKAlCB3aGF0IGBzaWduVGVzdFVzZXJUb2tlbmAgdXNlcyBieSBkZWZhdWx0LiAqL1xuICBwcmltYXJ5OiBUZXN0U2lnbmluZ0tleTtcbiAgLyoqIEhvdyBtYW55IHRpbWVzIHRoZSB2ZXJpZmllciBoYXMgZmV0Y2hlZCB0aGUgZG9jdW1lbnQuICovXG4gIGZldGNoQ291bnQoKTogbnVtYmVyO1xuICAvKiogTWFrZSB0aGUgbmV4dCBmZXRjaChlcykgZmFpbCwgdG8gZXhlcmNpc2UgdGhlIG5lZ2F0aXZlIGNhY2hlIC8gZmFpbC1jbG9zZWQgcGF0aHMuICovXG4gIGZhaWxOZXh0RmV0Y2hlcyhjb3VudDogbnVtYmVyKTogdm9pZDtcbiAgLyoqIFJlcGxhY2UgdGhlIHB1Ymxpc2hlZCBzZXQgKGEgcm90YXRpb24pLCBsZWF2aW5nIHRoZSBjYWNoZSB0byBub3RpY2UuICovXG4gIHB1Ymxpc2goa2V5czogVGVzdFNpZ25pbmdLZXlbXSk6IHZvaWQ7XG4gIC8qKiBUaGUgZG9jdW1lbnQgYXMgdGhlIHZlcmlmaWVyIHNlZXMgaXQuICovXG4gIGRvY3VtZW50KCk6IEp3a3NEb2N1bWVudDtcbn1cblxubGV0IGluc3RhbGxlZDogVGVzdEp3a3NIYW5kbGUgfCB1bmRlZmluZWQ7XG5cbmZ1bmN0aW9uIGRlZmF1bHRLZXkoKTogVGVzdFNpZ25pbmdLZXkge1xuICBpZiAoIWluc3RhbGxlZCkgdGhyb3cgbmV3IEVycm9yKCdpbnN0YWxsVGVzdEp3a3MoKSBtdXN0IGJlIGNhbGxlZCBiZWZvcmUgc2lnbmluZyBhIHRlc3QgdXNlciB0b2tlbicpO1xuICByZXR1cm4gaW5zdGFsbGVkLnByaW1hcnk7XG59XG5cbi8qKlxuICogSW5zdGFsbCBhIEpXS1MgY2FjaGUgYmFja2VkIGJ5IGZyZXNobHkgZ2VuZXJhdGVkIGtleXMgKG9yIGBrZXlzYCB3aGVuIGdpdmVuKVxuICogYXMgdGhlIHByb2Nlc3Mtd2lkZSBvbmUsIGFuZCByZXR1cm4gYSBoYW5kbGUgb3ZlciBpdC4gQ2FsbCBpbiBgYmVmb3JlRWFjaGA7XG4gKiBgdW5pbnN0YWxsVGVzdEp3a3MoKWAgcmVzdG9yZXMgdGhlIHJlYWwgSFRUUC1iYWNrZWQgY2FjaGUuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpbnN0YWxsVGVzdEp3a3MoXG4gIGtleXM6IFRlc3RTaWduaW5nS2V5W10gPSBbZ2VuZXJhdGVUZXN0U2lnbmluZ0tleSgpXSxcbiAgY2FjaGVPcHRpb25zOiB7IHJlZnJlc2hJbnRlcnZhbE1zPzogbnVtYmVyOyBuZWdhdGl2ZVR0bE1zPzogbnVtYmVyOyB1bmtub3duS2lkQ29vbGRvd25Ncz86IG51bWJlciB9ID0ge30sXG4pOiBUZXN0Sndrc0hhbmRsZSB7XG4gIGxldCBwdWJsaXNoZWQgPSBrZXlzO1xuICBsZXQgZmV0Y2hlcyA9IDA7XG4gIGxldCBmYWlsdXJlcyA9IDA7XG5cbiAgY29uc3QgaGFuZGxlOiBUZXN0Sndrc0hhbmRsZSA9IHtcbiAgICBnZXQga2V5cygpIHsgcmV0dXJuIHB1Ymxpc2hlZDsgfSxcbiAgICBnZXQgcHJpbWFyeSgpIHsgcmV0dXJuIHB1Ymxpc2hlZFswXTsgfSxcbiAgICBmZXRjaENvdW50OiAoKSA9PiBmZXRjaGVzLFxuICAgIGZhaWxOZXh0RmV0Y2hlczogKGNvdW50OiBudW1iZXIpID0+IHsgZmFpbHVyZXMgPSBjb3VudDsgfSxcbiAgICBwdWJsaXNoOiAobmV4dDogVGVzdFNpZ25pbmdLZXlbXSkgPT4geyBwdWJsaXNoZWQgPSBuZXh0OyB9LFxuICAgIGRvY3VtZW50OiAoKSA9PiAoeyBrZXlzOiBwdWJsaXNoZWQubWFwKChrKSA9PiBrLmp3aykgfSksXG4gIH07XG5cbiAgY29uc3QgY2FjaGUgPSBuZXcgSndrc0NhY2hlKHtcbiAgICBzb3VyY2U6ICd0ZXN0JyxcbiAgICBmZXRjaDogYXN5bmMgKCkgPT4ge1xuICAgICAgZmV0Y2hlcyArPSAxO1xuICAgICAgaWYgKGZhaWx1cmVzID4gMCkge1xuICAgICAgICBmYWlsdXJlcyAtPSAxO1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoJ3Rlc3QgSldLUyBmZXRjaCBmYWlsdXJlJyk7XG4gICAgICB9XG4gICAgICByZXR1cm4gaGFuZGxlLmRvY3VtZW50KCk7XG4gICAgfSxcbiAgICAuLi5jYWNoZU9wdGlvbnMsXG4gIH0pO1xuICBzZXRQbGF0Zm9ybUp3a3NDYWNoZShjYWNoZSk7XG4gIGluc3RhbGxlZCA9IGhhbmRsZTtcbiAgcmV0dXJuIGhhbmRsZTtcbn1cblxuLyoqIFJlc3RvcmUgdGhlIHJlYWwgKEhUVFAtYmFja2VkKSBKV0tTIGNhY2hlLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHVuaW5zdGFsbFRlc3RKd2tzKCk6IHZvaWQge1xuICBzZXRQbGF0Zm9ybUp3a3NDYWNoZSh1bmRlZmluZWQpO1xuICBpbnN0YWxsZWQgPSB1bmRlZmluZWQ7XG59XG4iXX0=