@webda/azure 0.0.0-stage → 4.0.0-beta.14

package/lib/services/functionserver.service.js

@@ -0,0 +1,232 @@
+import { isIP } from "node:net";
+import { Writable } from "node:stream";
+import { useLog } from "@webda/workout";
+import { CronService, emitCoreEvent, HttpContext, runWithContext, Service, ServiceParameters, traceRequest, useCore, useRouter, WebContext, WebdaError } from "@webda/core";
+/** Azure Functions HTTP adapter settings. */
+export class AzureFunctionServerParameters extends ServiceParameters {
+    constructor() {
+        super(...arguments);
+        /**
+         * Request ID header
+         */
+        this.requestIdHeader = "x-request-id";
+    }
+}
+/** Collect bytes directly, preserving binary responses from write() and streaming routes. */
+class AzureFunctionContext extends WebContext {
+    /**
+     * Initialize the Azure integration.
+     * @param http - HTTP request context
+     */
+    constructor(http) {
+        const chunks = [];
+        super(http, new Writable({
+            /**
+             * Perform write.
+             * @override
+             */
+            write(chunk, _encoding, callback) {
+                chunks.push(Buffer.from(chunk));
+                callback();
+            }
+        }));
+        /**
+         * Saved headers
+         */
+        this.savedHeaders = {};
+        this.chunks = chunks;
+    }
+    /**
+     * Perform write.
+     * @override
+     */
+    write(output, encoding, callback) {
+        if (Buffer.isBuffer(output)) {
+            if (this.statusCode === 204)
+                this.statusCode = 200;
+            return this._stream.write(output);
+        }
+        const result = super.write(output, encoding, callback);
+        if (this._body !== undefined) {
+            this._stream.write(this._body);
+            this._body = undefined;
+        }
+        return result;
+    }
+    /**
+     * Perform reset response.
+     * @override
+     */
+    resetResponse() {
+        super.resetResponse();
+        this.chunks.length = 0;
+        this.savedHeaders = {};
+    }
+    /** Retain headers flushed by streaming routes until the Functions response is returned.
+     * @override
+     */
+    getResponseHeaders() {
+        return (this.savedHeaders = { ...this.savedHeaders, ...super.getResponseHeaders() });
+    }
+}
+/** Run Webda routes and event handlers inside the Azure Functions v4 runtime.
+ * @WebdaModda
+ */
+export class AzureFunctionServer extends Service {
+    /**
+     * Execute an Azure HTTP request through the Webda router.
+     * @param request - Azure Functions HTTP request
+     * @param invocation - Azure invocation metadata
+     * @returns The handle request result
+     */
+    async handleRequest(request, invocation) {
+        const url = new URL(request.url), headers = Object.fromEntries(request.headers.entries());
+        const clientIp = this.getClientIp(headers);
+        const http = new HttpContext(url.host, request.method, url.pathname + url.search, url.protocol === "http:" ? "http" : "https", Number(url.port || (url.protocol === "http:" ? 80 : 443)), headers).setClientIp(clientIp || "");
+        if (!["GET", "HEAD"].includes(request.method))
+            http.setBody(Buffer.from(await request.arrayBuffer()));
+        const context = new AzureFunctionContext(http);
+        await context.init();
+        await emitCoreEvent("Webda.NewContext", { context, info: { http } });
+        return traceRequest({
+            protocol: "http",
+            method: request.method,
+            path: url.pathname,
+            scheme: url.protocol === "http:" ? "http" : "https",
+            headers: Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v])),
+            clientIp
+        }, async (handle) => {
+            const result = await runWithContext(context, async () => {
+                try {
+                    await emitCoreEvent("Webda.Request", { context });
+                    if (this.parameters.requestIdHeader)
+                        context.setHeader(this.parameters.requestIdHeader, invocation.invocationId);
+                    const origin = headers.origin;
+                    if (origin) {
+                        if (!(await useRouter()["checkCORSRequest"](context))) {
+                            // No Access-Control-* for a refused origin, but the answer still depends on it
+                            context.setHeader("Vary", "Origin");
+                            throw new WebdaError.Unauthorized("Origin not allowed");
+                        }
+                        // Access-Control-Allow-Origin/-Credentials are set by the Router
+                    }
+                    if (url.protocol === "https:")
+                        context.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+                    await useRouter().execute(context);
+                }
+                catch (error) {
+                    if (error instanceof WebdaError.HttpError) {
+                        context.statusCode = error.getResponseCode();
+                        if (error instanceof WebdaError.Redirect)
+                            context.setHeader("Location", error.location);
+                    }
+                    else if (typeof error === "number")
+                        context.statusCode = error;
+                    else {
+                        context.statusCode = 500;
+                        this.log("ERROR", "Azure Function request failed");
+                    }
+                }
+                await emitCoreEvent("Webda.Result", { context });
+                const responseHeaders = { ...context.getResponseHeaders() };
+                await context.end();
+                const merged = { ...responseHeaders, ...context.getResponseHeaders() };
+                const resultHeaders = Object.fromEntries(Object.entries(merged)
+                    .filter(([name, value]) => value !== undefined &&
+                    (name.toLowerCase() !== "set-cookie" || !Object.keys(context.getResponseCookies() ?? {}).length))
+                    .map(([key, value]) => [key, Array.isArray(value) ? value.join(", ") : String(value)]));
+                const cookies = Object.values(context.getResponseCookies() ?? {}).map(cookie => {
+                    const options = cookie.options ?? {};
+                    const sameSite = options.sameSite === true ? "strict" : options.sameSite;
+                    return {
+                        name: cookie.name,
+                        value: cookie.value,
+                        domain: options.domain,
+                        path: options.path,
+                        secure: options.secure,
+                        httpOnly: options.httpOnly,
+                        expires: options.expires,
+                        maxAge: options.maxAge,
+                        sameSite: typeof sameSite === "string"
+                            ? (sameSite[0].toUpperCase() + sameSite.slice(1).toLowerCase())
+                            : undefined
+                    };
+                });
+                const body = Buffer.concat(context.chunks);
+                return {
+                    status: context.getResponseCode(),
+                    headers: resultHeaders,
+                    cookies,
+                    body: request.method === "HEAD" || body.length === 0 ? undefined : body
+                };
+            });
+            try {
+                handle.setStatus(result.status);
+            }
+            catch (err) {
+                useLog("WARN", "Request tracer failed to record the status", err);
+            }
+            return result;
+        });
+    }
+    /**
+     * Resolve the client address from the rightmost X-Forwarded-For entry, without any port. Never throws.
+     * @param headers - the request headers
+     * @returns the address, undefined if unknown or invalid
+     */
+    getClientIp(headers) {
+        try {
+            let last = Object.entries(headers)
+                .find(([name]) => name.toLowerCase() === "x-forwarded-for")?.[1]
+                ?.split(",")
+                .pop()
+                ?.trim();
+            if (!last)
+                return undefined;
+            // [v6]:port, v4:port (a bare v6 contains several colons and is kept as is)
+            const bracketed = last.match(/^\[([^\]]+)\](?::\d+)?$/);
+            if (bracketed)
+                last = bracketed[1];
+            else if (last.split(":").length === 2)
+                last = last.split(":")[0];
+            return isIP(last) ? last : undefined;
+        }
+        catch (err) {
+            useLog("WARN", "Cannot resolve the client address", err);
+            return undefined;
+        }
+    }
+    /**
+     * Dispatch an Azure binding event to configured handler services.
+     * @param source - Azure binding event source
+     * @param event - Received event payload
+     * @param context - Webda or Azure invocation context
+     */
+    async handleEvent(source, event, context) {
+        let handled = false;
+        for (const service of Object.values(useCore().getServices())) {
+            if (typeof service.handleAzureEvent === "function") {
+                handled =
+                    (await service.handleAzureEvent(source, event, context)) || handled;
+            }
+        }
+        if (!handled)
+            throw new WebdaError.NotImplemented(`No Azure ${source} event handler is configured`);
+    }
+    /**
+     * Execute only the declared cron matching the exported identifier, through its operation
+     * @param id - Secret name or exported cron identifier
+     */
+    async handleCron(id) {
+        const crons = CronService.resolveCrons().filter(cron => CronService.getExportId(cron) === id);
+        if (!crons.length)
+            throw new WebdaError.NotFound("Azure timer does not match a declared Webda cron");
+        for (const cron of crons)
+            await CronService.execute(cron, true);
+    }
+}
+/**
+ * Parameters
+ */
+AzureFunctionServer.Parameters = AzureFunctionServerParameters;
+//# sourceMappingURL=functionserver.service.js.map

package/lib/services/functionserver.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"functionserver.service.js","sources":["../../src/services/functionserver.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EACL,WAAW,EACX,aAAa,EACb,WAAW,EAEX,cAAc,EACd,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,aAAa,CAAC;AAcrB,6CAA6C;AAC7C,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAApE;;QACE;;WAEG;QACH,oBAAe,GAAG,cAAc,CAAC;IACnC,CAAC;CAAA;AAED,6FAA6F;AAC7F,MAAM,oBAAqB,SAAQ,UAAU;IAS3C;;;OAGG;IACH,YAAY,IAAiB;QAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CACH,IAAI,EACJ,IAAI,QAAQ,CAAC;YACX;;;eAGG;YACH,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChC,QAAQ,EAAE,CAAC;YACb,CAAC;SACF,CAAC,CACH,CAAC;QAtBJ;;WAEG;QACK,iBAAY,GAAiD,EAAE,CAAC;QAoBtE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,MAAW,EAAE,QAAiB,EAAE,QAAiC;QACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG;gBAAE,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;YACnD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,GAAG,SAAU,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD;;;OAGG;IACH,aAAa;QACX,KAAK,CAAC,aAAa,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,OAAsC;IAM7E;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAoB,EAAE,UAA6B;QACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAC9B,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAC1B,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,MAAwB,EAChC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EACzB,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACzD,OAAO,CACR,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,aAAa,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,YAAY,CACjB;YACE,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACnD,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1F,QAAQ;SACT,EACD,KAAK,EAAC,MAAM,EAAC,EAAE;YACb,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBACtD,IAAI,CAAC;oBACH,MAAM,aAAa,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAClD,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe;wBACjC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;oBAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;oBAC9B,IAAI,MAAM,EAAE,CAAC;wBACX,IAAI,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;4BACtD,+EAA+E;4BAC/E,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;4BACpC,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;wBAC1D,CAAC;wBACD,iEAAiE;oBACnE,CAAC;oBACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;wBAC3B,OAAO,CAAC,SAAS,CAAC,2BAA2B,EAAE,8CAA8C,CAAC,CAAC;oBACjG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,UAAU,CAAC,SAAS,EAAE,CAAC;wBAC1C,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;wBAC7C,IAAI,KAAK,YAAY,UAAU,CAAC,QAAQ;4BAAE,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC1F,CAAC;yBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;yBAC5D,CAAC;wBACJ,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;wBACzB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;gBACD,MAAM,aAAa,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBACjD,MAAM,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBAC5D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBACvE,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CACtC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;qBACnB,MAAM,CACL,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,KAAK,KAAK,SAAS;oBACnB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CACnG;qBACA,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACzF,CAAC;gBACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;oBAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;oBACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACzE,OAAO;wBACL,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,QAAQ,EACN,OAAO,QAAQ,KAAK,QAAQ;4BAC1B,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAA+B;4BAC9F,CAAC,CAAC,SAAS;qBAChB,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3C,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE;oBACjC,OAAO,EAAE,aAAa;oBACtB,OAAO;oBACP,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;iBACxE,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,EAAE,4CAA4C,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACO,WAAW,CAAC,OAA+B;QACnD,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;iBAC/B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChE,EAAE,KAAK,CAAC,GAAG,CAAC;iBACX,GAAG,EAAE;gBACN,EAAE,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,2EAA2E;YAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACxD,IAAI,SAAS;gBAAE,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;iBAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,MAAuC,EACvC,KAAc,EACd,OAA0B;QAE1B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,OAAQ,OAAyC,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;gBACtF,OAAO;oBACL,CAAC,MAAO,OAAyC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC;YAC3G,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,MAAM,8BAA8B,CAAC,CAAC;IACtG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;QACrG,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;CACF;AAvKC;;GAEG;AACI,8BAAU,GAAG,6BAA6B,CAAC"}

package/lib/services/keyvault.service.d.ts

@@ -0,0 +1,106 @@
+import { SecretClient } from "@azure/keyvault-secrets";
+import { ConfigurationProvider, SecretString, Service } from "@webda/core";
+import { AzureParameters, AzureServiceParameters } from "./azure-parameters.js";
+import { AzureContributor, AzureDeployerInfo, AzureResourceContribution } from "./contributors.js";
+/** Settings for the Key Vault service and configuration encrypter. */
+export declare class AzureKeyVaultParameters extends AzureParameters {
+    /**
+     * Vault URL
+     */
+    vaultUrl: string;
+    /**
+     * Key ID
+     */
+    keyId?: string;
+}
+/**
+ * Azure encryption options type definition
+ */
+type AzureEncryptionOptions = AzureServiceParameters & {
+    keyId?: string;
+};
+/** Authenticated envelope encryption: only the random AES key leaves this process. */
+export declare const azureEncrypter: {
+    /** Configure the encryption pass before application services are created.
+     * @param options - Azure credential and key settings for this configuration pass
+     */
+    configure(options: AzureEncryptionOptions): void;
+    /**
+     * Encrypt a configuration value with a wrapped AES key.
+     * @param data - Model data or encrypted envelope
+     * @param options - Encryption or packaging options
+     * @returns The encrypt result
+     */
+    encrypt(data: string, options?: string | AzureEncryptionOptions): Promise<string>;
+    /**
+     * Decrypt and authenticate an Azure envelope.
+     * @param data - Model data or encrypted envelope
+     * @param params - Raw configuration parameters
+     * @returns The decrypt result
+     */
+    decrypt(data: string, params?: AzureServiceParameters): Promise<string>;
+};
+/** Key Vault secrets as a configuration source, with Key Vault envelope encryption.
+ * @WebdaModda
+ */
+export declare class AzureKeyVault extends Service<AzureKeyVaultParameters> implements ConfigurationProvider, AzureContributor {
+    /**
+     * Parameters
+     */
+    static Parameters: typeof AzureKeyVaultParameters;
+    /**
+     * Client
+     */
+    protected client: SecretClient;
+    /**
+     * Perform init.
+     * @override
+     */
+    init(): Promise<this>;
+    /**
+     * Key Vault has no push-based configuration subscription; ConfigurationService polls.
+     * @param _id - Configuration source identifier
+     * @param _callback - Unused configuration change callback
+     * @returns The can trigger configuration result
+     */
+    canTriggerConfiguration(_id: string, _callback: () => void): boolean;
+    /**
+     * Retrieve a secret without exposing its value to JSON or logs.
+     * @param id - Secret name or exported cron identifier
+     * @returns Masked secret value
+     */
+    getSecret(id: string): Promise<SecretString>;
+    /**
+     * Load a JSON configuration document. Secret fields can use crypt:azure: values.
+     * @param id - Secret name or exported cron identifier
+     * @returns Resolved configuration object
+     */
+    getConfiguration(id: string): Promise<Record<string, any>>;
+    /**
+     * Resolve whole-value ${keyvault:secret-name} references in a configuration document.
+     * @param configuration - Configuration tree to resolve
+     * @returns Configuration with secret references resolved
+     */
+    resolveReferences<T>(configuration: T): Promise<T>;
+    /**
+     * Encrypt a configuration value with a wrapped AES key.
+     * @param data - Model data or encrypted envelope
+     * @param keyId - key id
+     * @returns The encrypt result
+     */
+    encrypt(data: string, keyId?: string | undefined): Promise<string>;
+    /**
+     * Decrypt and authenticate an Azure envelope.
+     * @param data - Model data or encrypted envelope
+     * @returns The decrypt result
+     */
+    decrypt(data: string): Promise<SecretString>;
+    /**
+     * Describe the Azure resources and identity permissions required by this service.
+     * @param deployer - Deployment scope and identity helpers
+     * @returns The azure resources result
+     */
+    getAzureResources(deployer: AzureDeployerInfo): AzureResourceContribution;
+}
+export {};
+//# sourceMappingURL=keyvault.service.d.ts.map

package/lib/services/keyvault.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyvault.service.d.ts","sources":["../../src/services/keyvault.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAiB,YAAY,EAAE,OAAO,EAAc,MAAM,aAAa,CAAC;AAEtG,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAsB,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEnG,sEAAsE;AACtE,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D;;OAEG;IACH,QAAQ,EAAG,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgCD;;GAEG;AACH,KAAK,sBAAsB,GAAG,sBAAsB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAmB1E,sFAAsF;AACtF,eAAO,MAAM,cAAc;IACzB;;OAEG;IACH,SAAS,UAAU,sBAAsB,GAAG,IAAI;IAGhD;;;;;OAKG;IACG,OAAO,OAAO,MAAM,YAAW,MAAM,GAAG,sBAAsB,GAA0B,OAAO,CAAC,MAAM,CAAC;IA8B7G;;;;;OAKG;IACG,OAAO,OAAO,MAAM,WAAU,sBAAsB,GAA0B,OAAO,CAAC,MAAM,CAAC;CAiCpG,CAAC;AAIF;;GAEG;AACH,qBAAa,aAAc,SAAQ,OAAO,CAAC,uBAAuB,CAAE,YAAW,qBAAqB,EAAE,gBAAgB;IACpH;;OAEG;IACH,MAAM,CAAC,UAAU,iCAA2B;IAC5C;;OAEG;IACH,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAI1B;IAED;;;;;OAKG;IACH,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,OAAO,CAEnE;IAED;;;;OAIG;IACG,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAWjD;IAED;;;;OAIG;IACG,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAY/D;IAED;;;;OAIG;IACG,iBAAiB,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAevD;IAED;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,qBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;IAED;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjD;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,yBAAyB,CASxE;CACF"}

package/lib/services/keyvault.service.js

@@ -0,0 +1,228 @@
+import { CryptographyClient } from "@azure/keyvault-keys";
+import { SecretClient } from "@azure/keyvault-secrets";
+import { CryptoService, SecretString, Service, WebdaError } from "@webda/core";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { AzureParameters, getAzureCredential } from "./azure-parameters.js";
+/** Settings for the Key Vault service and configuration encrypter. */
+export class AzureKeyVaultParameters extends AzureParameters {
+}
+let configuredEncryption = {};
+/**
+ * Validate key identifiers before sending credentials or wrapped keys to their endpoints.
+ * @param keyId - key id
+ * @returns The validate key id result
+ */
+function validateKeyId(keyId) {
+    if (!/^https:\/\/[a-zA-Z0-9-]+\.vault\.(?:azure\.net|azure\.cn|usgovcloudapi\.net)\/keys\/[a-zA-Z0-9-]+(?:\/[a-zA-Z0-9-]+)?$/.test(keyId)) {
+        throw new WebdaError.CodeError("AZURE_KEY_ID", "A full Azure Key Vault key URL is required");
+    }
+    return keyId;
+}
+/** Authenticated envelope encryption: only the random AES key leaves this process. */
+export const azureEncrypter = {
+    /** Configure the encryption pass before application services are created.
+     * @param options - Azure credential and key settings for this configuration pass
+     */
+    configure(options) {
+        configuredEncryption = { ...options };
+    },
+    /**
+     * Encrypt a configuration value with a wrapped AES key.
+     * @param data - Model data or encrypted envelope
+     * @param options - Encryption or packaging options
+     * @returns The encrypt result
+     */
+    async encrypt(data, options = configuredEncryption) {
+        const params = typeof options === "string" ? { keyId: options } : options;
+        const keyId = validateKeyId(params.keyId ?? process.env.WEBDA_AZURE_KEY_ID ?? "");
+        const key = randomBytes(32);
+        try {
+            const client = new CryptographyClient(keyId, getAzureCredential(params));
+            const wrapped = await client.wrapKey("RSA-OAEP-256", key);
+            // Pin the actual key version so rotating the vault key does not break existing values.
+            const resolvedKeyId = validateKeyId(wrapped.keyID ?? keyId);
+            if (new URL(resolvedKeyId).origin !== new URL(keyId).origin || resolvedKeyId.split("/").length !== 6) {
+                throw new WebdaError.CodeError("AZURE_KEY_VERSION", "Key Vault must return a versioned key identifier");
+            }
+            const iv = randomBytes(12);
+            const cipher = createCipheriv("aes-256-gcm", key, iv);
+            cipher.setAAD(Buffer.from(`1:${resolvedKeyId}`));
+            const ciphertext = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
+            const envelope = {
+                version: 1,
+                keyId: resolvedKeyId,
+                wrappedKey: Buffer.from(wrapped.result).toString("base64url"),
+                iv: iv.toString("base64url"),
+                tag: cipher.getAuthTag().toString("base64url"),
+                ciphertext: ciphertext.toString("base64url")
+            };
+            return Buffer.from(JSON.stringify(envelope)).toString("base64url");
+        }
+        finally {
+            key.fill(0);
+        }
+    },
+    /**
+     * Decrypt and authenticate an Azure envelope.
+     * @param data - Model data or encrypted envelope
+     * @param params - Raw configuration parameters
+     * @returns The decrypt result
+     */
+    async decrypt(data, params = configuredEncryption) {
+        let key;
+        try {
+            const envelope = JSON.parse(Buffer.from(data, "base64url").toString());
+            if (envelope.version !== 1)
+                throw new Error();
+            validateKeyId(envelope.keyId);
+            const decode = (value, size) => {
+                if (typeof value !== "string" || !/^[\w-]*$/.test(value))
+                    throw new Error();
+                const bytes = Buffer.from(value, "base64url");
+                if (bytes.toString("base64url") !== value || (size !== undefined && bytes.length !== size))
+                    throw new Error();
+                return bytes;
+            };
+            const iv = decode(envelope.iv, 12), tag = decode(envelope.tag, 16);
+            const ciphertext = decode(envelope.ciphertext), wrappedKey = decode(envelope.wrappedKey);
+            if (!wrappedKey.length || envelope.keyId.split("/").length !== 6)
+                throw new Error();
+            const client = new CryptographyClient(envelope.keyId, getAzureCredential(params));
+            const unwrapped = await client.unwrapKey("RSA-OAEP-256", wrappedKey);
+            key = Buffer.from(unwrapped.result);
+            unwrapped.result.fill(0);
+            if (key.length !== 32)
+                throw new Error();
+            const decipher = createDecipheriv("aes-256-gcm", key, iv);
+            decipher.setAAD(Buffer.from(`1:${envelope.keyId}`));
+            decipher.setAuthTag(tag);
+            return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+        }
+        catch {
+            // SDK exceptions can contain requests; never expose them with configuration secrets.
+            throw new WebdaError.CodeError("AZURE_DECRYPT_FAILED", "Unable to decrypt Azure configuration value");
+        }
+        finally {
+            key?.fill(0);
+        }
+    }
+};
+CryptoService.registerEncrypter("azure", azureEncrypter);
+/** Key Vault secrets as a configuration source, with Key Vault envelope encryption.
+ * @WebdaModda
+ */
+export class AzureKeyVault extends Service {
+    /**
+     * Perform init.
+     * @override
+     */
+    async init() {
+        await super.init();
+        this.client = new SecretClient(this.parameters.vaultUrl, getAzureCredential(this.parameters));
+        return this;
+    }
+    /**
+     * Key Vault has no push-based configuration subscription; ConfigurationService polls.
+     * @param _id - Configuration source identifier
+     * @param _callback - Unused configuration change callback
+     * @returns The can trigger configuration result
+     */
+    canTriggerConfiguration(_id, _callback) {
+        return false;
+    }
+    /**
+     * Retrieve a secret without exposing its value to JSON or logs.
+     * @param id - Secret name or exported cron identifier
+     * @returns Masked secret value
+     */
+    async getSecret(id) {
+        let secret;
+        try {
+            secret = await this.client.getSecret(id);
+        }
+        catch (error) {
+            if (error.statusCode === 404)
+                throw new WebdaError.NotFound("Key Vault secret was not found");
+            throw new WebdaError.ServiceUnavailable("Unable to retrieve Key Vault secret");
+        }
+        if (secret.value === undefined)
+            throw new WebdaError.NotFound("Key Vault secret has no value");
+        return new SecretString(secret.value, "azure");
+    }
+    /**
+     * Load a JSON configuration document. Secret fields can use crypt:azure: values.
+     * @param id - Secret name or exported cron identifier
+     * @returns Resolved configuration object
+     */
+    async getConfiguration(id) {
+        const value = await this.getSecret(id);
+        let configuration;
+        try {
+            configuration = JSON.parse(value.getValue());
+        }
+        catch {
+            throw new WebdaError.BadRequest("Key Vault configuration must be a JSON object");
+        }
+        if (!configuration || typeof configuration !== "object" || Array.isArray(configuration)) {
+            throw new WebdaError.BadRequest("Key Vault configuration must be a JSON object");
+        }
+        return this.resolveReferences(configuration);
+    }
+    /**
+     * Resolve whole-value ${keyvault:secret-name} references in a configuration document.
+     * @param configuration - Configuration tree to resolve
+     * @returns Configuration with secret references resolved
+     */
+    async resolveReferences(configuration) {
+        const resolve = async (value) => {
+            if (typeof value === "string") {
+                const match = /^\$\{keyvault:([a-zA-Z0-9-]+)\}$/.exec(value);
+                return match ? this.getSecret(match[1]) : value;
+            }
+            if (Array.isArray(value))
+                return Promise.all(value.map(resolve));
+            if (value && typeof value === "object" && !(value instanceof SecretString)) {
+                return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, child]) => [key, await resolve(child)])));
+            }
+            return value;
+        };
+        return (await resolve(configuration));
+    }
+    /**
+     * Encrypt a configuration value with a wrapped AES key.
+     * @param data - Model data or encrypted envelope
+     * @param keyId - key id
+     * @returns The encrypt result
+     */
+    encrypt(data, keyId = this.parameters.keyId) {
+        return azureEncrypter.encrypt(data, { ...this.parameters, keyId });
+    }
+    /**
+     * Decrypt and authenticate an Azure envelope.
+     * @param data - Model data or encrypted envelope
+     * @returns The decrypt result
+     */
+    async decrypt(data) {
+        return new SecretString(await azureEncrypter.decrypt(data, this.parameters), "azure");
+    }
+    /**
+     * Describe the Azure resources and identity permissions required by this service.
+     * @param deployer - Deployment scope and identity helpers
+     * @returns The azure resources result
+     */
+    getAzureResources(deployer) {
+        const name = new URL(this.parameters.vaultUrl).hostname.split(".")[0];
+        const scope = `/subscriptions/${deployer.resources.subscriptionId}/resourceGroups/${deployer.resources.resourceGroup}/providers/Microsoft.KeyVault/vaults/${name}`;
+        return {
+            roleAssignments: ["4633458b-17de-408a-b874-0445c86b69e6", "12338af0-0e69-4776-bea7-57ae8d297424"].map(role => ({
+                scope,
+                roleDefinitionId: `/subscriptions/${deployer.resources.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${role}`
+            }))
+        };
+    }
+}
+/**
+ * Parameters
+ */
+AzureKeyVault.Parameters = AzureKeyVaultParameters;
+//# sourceMappingURL=keyvault.service.js.map

package/lib/services/keyvault.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyvault.service.js","sources":["../../src/services/keyvault.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAyB,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,eAAe,EAA0B,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAGpG,sEAAsE;AACtE,MAAM,OAAO,uBAAwB,SAAQ,eAAe;CAS3D;AAoCD,IAAI,oBAAoB,GAA2B,EAAE,CAAC;AAEtD;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,IACE,CAAC,wHAAwH,CAAC,IAAI,CAC5H,KAAK,CACN,EACD,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,4CAA4C,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B;;OAEG;IACH,SAAS,CAAC,OAA+B;QACvC,oBAAoB,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACxC,CAAC;IACD;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAO,GAAoC,oBAAoB;QACzF,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1E,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAC1D,uFAAuF;YACvF,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;YAC5D,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrG,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,mBAAmB,EAAE,kDAAkD,CAAC,CAAC;YAC1G,CAAC;YACD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChF,MAAM,QAAQ,GAAa;gBACzB,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC7D,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC5B,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC9C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;aAC7C,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAM,GAA2B,oBAAoB;QAC/E,IAAI,GAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjF,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC9C,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAa,EAAE,EAAE;gBAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC9G,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAChC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC5C,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACpF,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;YAClF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACrE,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACpD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;YACrF,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,sBAAsB,EAAE,6CAA6C,CAAC,CAAC;QACxG,CAAC;gBAAS,CAAC;YACT,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC;AAEF,aAAa,CAAC,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AAEzD;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,OAAgC;IAUjE;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,uBAAuB,CAAC,GAAW,EAAE,SAAqB;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAiC,CAAC,UAAU,KAAK,GAAG;gBACvD,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;YAClE,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QAC/F,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,aAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,+CAA+C,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,+CAA+C,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAoC,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAI,aAAgB;QACzC,MAAM,OAAO,GAAG,KAAK,EAAE,KAAc,EAAoB,EAAE;YACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClD,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACjE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,EAAE,CAAC;gBAC3E,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAClG,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,CAAM,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,IAAY,EAAE,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK;QACjD,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,OAAO,IAAI,YAAY,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAA2B;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,kBAAkB,QAAQ,CAAC,SAAS,CAAC,cAAc,mBAAmB,QAAQ,CAAC,SAAS,CAAC,aAAa,wCAAwC,IAAI,EAAE,CAAC;QACnK,OAAO;YACL,eAAe,EAAE,CAAC,sCAAsC,EAAE,sCAAsC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC7G,KAAK;gBACL,gBAAgB,EAAE,kBAAkB,QAAQ,CAAC,SAAS,CAAC,cAAc,sDAAsD,IAAI,EAAE;aAClI,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF;AA1HC;;GAEG;AACI,wBAAU,GAAG,uBAAuB,CAAC"}