@webex/internal-plugin-encryption 1.161.0 → 2.2.0

package/dist/encryption.js

@@ -273,7 +273,7 @@ var Encryption = _webexCore.WebexPlugin.extend({
       }));
     });
   },
-  version: "1.161.0"
+  version: "2.2.0"
 });
 /**
  * JSON.stringify replacer that ensures private key data is serialized.

package/dist/kms.js

@@ -46,6 +46,8 @@ var _nodeKms = require("node-kms");
 
 var _nodeJose = _interopRequireDefault(require("node-jose"));
 
+var _uuid = _interopRequireDefault(require("uuid"));
+
 var _kmsBatcher = _interopRequireWildcard(require("./kms-batcher"));
 
 var _kmsCertificateValidation = _interopRequireWildcard(require("./kms-certificate-validation"));
@@ -318,11 +320,193 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
       return _promise.default.all(res.keys.map(_this6.asKey));
     });
   },
-  fetchKey: function fetchKey(_ref8) {
+
+  /**
+  * @typedef {Object} FetchPublicKeyResponse
+  * @property {number} status 200,400(Bad Request: Request payload missing info),404(Not Found: HSM Public Key not found),501(Not Implemented: This KMS does not support BYOK),502(Bad Gateway: KMS could not communicate with HSM)
+  * @property {UUID} requestId this is should be unique, used for debug.
+  * @property {string} publicKey
+  */
+
+  /**
+   * get public key from kms
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<FetchPublicKeyResponse>} response of get public key api
+   */
+  fetchPublicKey: function fetchPublicKey(_ref8) {
     var _this7 = this;
 
-    var uri = _ref8.uri,
-        onBehalfOf = _ref8.onBehalfOf;
+    var assignedOrgId = _ref8.assignedOrgId;
+    this.logger.info('kms: fetch public key for byok');
+    return this.request({
+      method: 'retrieve',
+      uri: '/publicKey',
+      assignedOrgId: assignedOrgId
+    }).then(function (res) {
+      _this7.logger.info('kms: received public key');
+
+      return res.publicKey;
+    });
+  },
+
+  /**
+  * @typedef {Object} UploadCmkResponse
+  * @property {number} status
+  * @property {UUID} requestId
+  * @property {string} uri
+  * @property {string} keysState
+  */
+
+  /**
+   * upload master key for one org.
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @param {string} options.customerMasterKey the master key
+   * @returns {Promise.<UploadCmkResponse>} response of upload CMK api
+   */
+  uploadCustomerMasterKey: function uploadCustomerMasterKey(_ref9) {
+    var _this8 = this;
+
+    var assignedOrgId = _ref9.assignedOrgId,
+        customerMasterKey = _ref9.customerMasterKey;
+    this.logger.info('kms: upload customer master key for byok');
+    return this.request({
+      method: 'create',
+      uri: '/cmk',
+      assignedOrgId: assignedOrgId,
+      customerMasterKey: customerMasterKey,
+      requestId: _uuid.default.v4()
+    }).then(function (res) {
+      _this8.logger.info('kms: finish to upload customer master key');
+
+      return res;
+    });
+  },
+
+  /**
+   * get all customer master keys for one org.
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api
+   */
+  listAllCustomerMasterKey: function listAllCustomerMasterKey(_ref10) {
+    var _this9 = this;
+
+    var assignedOrgId = _ref10.assignedOrgId;
+    this.logger.info('kms: get all customer master keys for byok');
+    return this.request({
+      method: 'retrieve',
+      uri: '/cmk',
+      assignedOrgId: assignedOrgId,
+      requestId: _uuid.default.v4()
+    }).then(function (res) {
+      _this9.logger.info('kms: finish to get all customer master keys');
+
+      return res;
+    });
+  },
+
+  /**
+  * @typedef {Object} ActivateCmkResponse
+  * @property {number} status
+  * @property {UUID} requestId
+  * @property {Array<CMK>} customerMasterKeys
+  */
+
+  /**
+   *
+   * @typedef {Object} CMK
+   * @property {string} usageState
+   * @property {UUID} assignedOrgId
+   * @property {string} uri
+   * @property {string} source
+   * @property {Date | undefined} stateUpdatedOn
+   * @property {Date | undefined} rotation
+   */
+
+  /**
+   * change one customer master key state for one org.
+   * delete pending key, then the keyState should be 'removedclean';
+   * active pending key, then the keyState should be 'active';
+   *
+   * @param {Object} options
+   * @param {string} options.keyId the id of one customer master key, it should be a url
+   * @param {string} options.keyState one of the following: PENDING, RECOVERING,ACTIVE,REVOKED,DEACTIVATED,REENCRYPTING,RETIRED,DELETED,DISABLED,REMOVEDCLEAN,REMOVEDDIRTY;
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api
+   */
+  changeCustomerMasterKeyState: function changeCustomerMasterKeyState(_ref11) {
+    var _this10 = this;
+
+    var keyId = _ref11.keyId,
+        keyState = _ref11.keyState,
+        assignedOrgId = _ref11.assignedOrgId;
+    this.logger.info('kms: change one customer master key state for byok');
+    return this.request({
+      method: 'update',
+      uri: keyId,
+      keyState: keyState,
+      assignedOrgId: assignedOrgId,
+      requestId: _uuid.default.v4()
+    }).then(function (res) {
+      _this10.logger.info('kms: finish to change the customer master key state to {}', keyState);
+
+      return res;
+    });
+  },
+
+  /**
+   * this is for test case. it will delete all CMKs, no matter what their status is. This is mainly for test purpose
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<{status, requestId}>}
+   */
+  deleteAllCustomerMasterKeys: function deleteAllCustomerMasterKeys(_ref12) {
+    var _this11 = this;
+
+    var assignedOrgId = _ref12.assignedOrgId;
+    this.logger.info('kms: delete all customer master keys at the same time');
+    return this.request({
+      method: 'delete',
+      uri: '/cmk',
+      assignedOrgId: assignedOrgId,
+      requestId: _uuid.default.v4()
+    }).then(function (res) {
+      _this11.logger.info('kms: finish to delete all customer master keys');
+
+      return res;
+    });
+  },
+
+  /**
+   * return to use global master key for one org.
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<ActivateCmkResponse>} response of activate CMK api
+   */
+  useGlobalMasterKey: function useGlobalMasterKey(_ref13) {
+    var _this12 = this;
+
+    var assignedOrgId = _ref13.assignedOrgId;
+    this.logger.info('kms: return to use global master key');
+    return this.request({
+      method: 'update',
+      uri: 'default',
+      keyState: 'ACTIVE',
+      assignedOrgId: assignedOrgId,
+      requestId: _uuid.default.v4()
+    }).then(function (res) {
+      _this12.logger.info('kms: finish to return to global master key');
+
+      return res;
+    });
+  },
+  fetchKey: function fetchKey(_ref14) {
+    var _this13 = this;
+
+    var uri = _ref14.uri,
+        onBehalfOf = _ref14.onBehalfOf;
 
     /* istanbul ignore if */
     if (!uri) {
@@ -336,9 +520,9 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
     }, {
       onBehalfOf: onBehalfOf
     }).then(function (res) {
-      _this7.logger.info('kms: fetched key');
+      _this13.logger.info('kms: fetched key');
 
-      return _this7.asKey(res.key);
+      return _this13.asKey(res.key);
     });
   },
 
@@ -372,17 +556,17 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
    * @returns {Promise<KMS.Request>}
    */
   prepareRequest: function prepareRequest(payload, onBehalfOf) {
-    var _this8 = this;
+    var _this14 = this;
 
     var isECDHRequest = payload.method === 'create' && payload.uri.includes('/ecdhe');
     return _promise.default.resolve(isECDHRequest ? partialContexts.get(this) : this._getContext()).then(function (context) {
-      _this8.logger.info("kms: wrapping ".concat(isECDHRequest ? 'ephemeral key' : 'kms', " request"));
+      _this14.logger.info("kms: wrapping ".concat(isECDHRequest ? 'ephemeral key' : 'kms', " request"));
 
       var req = new _nodeKms.Request(payload);
       var requestContext = context;
 
       if (onBehalfOf) {
-        requestContext = _this8._contextOnBehalfOf(context, onBehalfOf);
+        requestContext = _this14._contextOnBehalfOf(context, onBehalfOf);
       }
 
       return req.wrap(requestContext, {
@@ -390,7 +574,7 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
       }).then(function () {
         /* istanbul ignore else */
         if (process.env.NODE_ENV !== 'production') {
-          _this8.logger.info('kms: request payload', _util.default.inspect((0, _omit2.default)(JSON.parse((0, _stringify.default)(req)), 'wrapped'), {
+          _this14.logger.info('kms: request payload', _util.default.inspect((0, _omit2.default)(JSON.parse((0, _stringify.default)(req)), 'wrapped'), {
             depth: null
           }));
         }
@@ -406,21 +590,21 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
    * @returns {Promise<Object>}
    */
   processKmsMessageEvent: function processKmsMessageEvent(event) {
-    var _this9 = this;
+    var _this15 = this;
 
     this.logger.info('kms: received kms message');
     return _promise.default.all(event.encryption.kmsMessages.map(function (kmsMessage, index) {
-      return _this9._isECDHEMessage(kmsMessage).then(function (isECDHMessage) {
-        _this9.logger.info("kms: received ".concat(isECDHMessage ? 'ecdhe' : 'normal', " message"));
+      return _this15._isECDHEMessage(kmsMessage).then(function (isECDHMessage) {
+        _this15.logger.info("kms: received ".concat(isECDHMessage ? 'ecdhe' : 'normal', " message"));
 
         var res = new _nodeKms.Response(kmsMessage);
-        return _promise.default.resolve(isECDHMessage ? partialContexts.get(_this9) : contexts.get(_this9)) // eslint-disable-next-line max-nested-callbacks
+        return _promise.default.resolve(isECDHMessage ? partialContexts.get(_this15) : contexts.get(_this15)) // eslint-disable-next-line max-nested-callbacks
         .then(function (context) {
           return res.unwrap(context);
         }) // eslint-disable-next-line max-nested-callbacks
         .then(function () {
           if (process.env.NODE_ENV !== 'production') {
-            _this9.logger.info('kms: response payload', _util.default.inspect((0, _omit2.default)(JSON.parse((0, _stringify.default)(res)), 'wrapped'), {
+            _this15.logger.info('kms: response payload', _util.default.inspect((0, _omit2.default)(JSON.parse((0, _stringify.default)(res)), 'wrapped'), {
               depth: null
             }));
           }
@@ -433,9 +617,9 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
         });
       });
     })).then(function () {
-      return _this9.batcher.processKmsMessageEvent(event);
+      return _this15.batcher.processKmsMessageEvent(event);
     }).catch(function (reason) {
-      _this9.logger.error('kms: decrypt failed', reason.stack);
+      _this15.logger.error('kms: decrypt failed', reason.stack);
 
       return _promise.default.reject(reason);
     }).then(function () {
@@ -484,34 +668,34 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
    * @returns {Promise<Object>}
    */
   request: function request(payload) {
-    var _this10 = this;
+    var _this16 = this;
 
-    var _ref9 = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {},
-        timeout = _ref9.timeout,
-        onBehalfOf = _ref9.onBehalfOf;
+    var _ref15 = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {},
+        timeout = _ref15.timeout,
+        onBehalfOf = _ref15.onBehalfOf;
 
     timeout = timeout || this.config.kmsInitialTimeout; // Note: this should only happen when we're using the async kms batcher;
     // once we implement the sync batcher, this'll need to be smarter.
 
     return this.webex.internal.mercury.connect().then(function () {
-      return _this10.prepareRequest(payload, onBehalfOf);
+      return _this16.prepareRequest(payload, onBehalfOf);
     }).then(function (req) {
       req[_kmsBatcher.TIMEOUT_SYMBOL] = timeout;
-      return _this10.batcher.request(req);
+      return _this16.batcher.request(req);
     }) // High complexity is due to attempt at test mode resiliency
     // eslint-disable-next-line complexity
     .catch(function (reason) {
       if (process.env.NODE_ENV === 'test' && (reason.status === 403 || reason.statusCode === 403) && reason.message.match(/Failed to resolve authorization token in KmsMessage request for user/)) {
-        _this10.logger.warn('kms: rerequested key due to test-mode kms auth failure');
+        _this16.logger.warn('kms: rerequested key due to test-mode kms auth failure');
 
-        return _this10.request(payload, {
+        return _this16.request(payload, {
           onBehalfOf: onBehalfOf
         });
       } // KMS Error. Notify the user
 
 
       if (reason instanceof _kmsCertificateValidation.KMSError) {
-        _this10.webex.trigger('client:InvalidRequestError');
+        _this16.webex.trigger('client:InvalidRequestError');
 
         return _promise.default.reject(reason);
       } // Ideally, most or all of the code below would go in kms-batcher, but
@@ -523,14 +707,14 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
         /* istanbul ignore else */
         if (process.env.NODE_ENV !== 'production') {
           /* istanbul ignore next: reason.stack vs stack difficult to control in test */
-          _this10.logger.info('kms: request error', reason.stack || reason);
+          _this16.logger.info('kms: request error', reason.stack || reason);
         }
 
         consoleDebug("timeout ".concat(timeout));
         timeout *= 2;
 
-        if (timeout >= _this10.config.ecdhMaxTimeout) {
-          _this10.logger.info('kms: exceeded maximum KMS request retries');
+        if (timeout >= _this16.config.ecdhMaxTimeout) {
+          _this16.logger.info('kms: exceeded maximum KMS request retries');
 
           return _promise.default.reject(reason);
         } // Peek ahead to make sure we don't reset the timeout if the next timeout
@@ -539,20 +723,20 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
 
         var nextTimeout = timeout * 2;
 
-        if (timeout >= _this10.config.kmsMaxTimeout && nextTimeout < _this10.config.ecdhMaxTimeout) {
-          _this10.logger.info('kms: exceeded maximum KMS request retries; negotiating new ecdh key');
+        if (timeout >= _this16.config.kmsMaxTimeout && nextTimeout < _this16.config.ecdhMaxTimeout) {
+          _this16.logger.info('kms: exceeded maximum KMS request retries; negotiating new ecdh key');
           /* istanbul ignore else */
 
 
           if (process.env.NODE_ENV !== 'production') {
-            _this10.logger.info('kms: timeout/maxtimeout', timeout, _this10.config.kmsMaxTimeout);
+            _this16.logger.info('kms: timeout/maxtimeout', timeout, _this16.config.kmsMaxTimeout);
           }
 
-          contexts.delete(_this10);
+          contexts.delete(_this16);
           timeout = 0;
         }
 
-        return _this10.request(payload, {
+        return _this16.request(payload, {
           timeout: timeout,
           onBehalfOf: onBehalfOf
         });
@@ -578,7 +762,7 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
    * @returns {Promise<Object>}
    */
   _getContext: function _getContext() {
-    var _this11 = this;
+    var _this17 = this;
 
     var promise = contexts.get(this);
 
@@ -588,15 +772,15 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
       promise.then(function (context) {
         var expiresIn = context.ephemeralKey.expirationDate - (0, _now.default)() - 30000;
         (0, _commonTimers.safeSetTimeout)(function () {
-          return contexts.delete(_this11);
+          return contexts.delete(_this17);
         }, expiresIn);
       });
     }
 
-    return _promise.default.all([promise, this._getAuthorization()]).then(function (_ref10) {
-      var _ref11 = (0, _slicedToArray2.default)(_ref10, 2),
-          context = _ref11[0],
-          authorization = _ref11[1];
+    return _promise.default.all([promise, this._getAuthorization()]).then(function (_ref16) {
+      var _ref17 = (0, _slicedToArray2.default)(_ref16, 2),
+          context = _ref17[0],
+          authorization = _ref17[1];
 
       context.clientInfo.credential.bearer = authorization;
       return context;
@@ -609,8 +793,8 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
    */
   _getKMSCluster: function _getKMSCluster() {
     this.logger.info('kms: retrieving KMS cluster');
-    return this._getKMSDetails().then(function (_ref12) {
-      var kmsCluster = _ref12.kmsCluster;
+    return this._getKMSDetails().then(function (_ref18) {
+      var kmsCluster = _ref18.kmsCluster;
       return kmsCluster;
     });
   },
@@ -620,7 +804,7 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
    * @returns {Promise<Object>}
    */
   _getKMSDetails: function _getKMSDetails() {
-    var _this12 = this;
+    var _this18 = this;
 
     var details = kmsDetails.get(this);
 
@@ -630,13 +814,13 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
         service: 'encryption',
         resource: "/kms/".concat(this.webex.internal.device.userId)
       }).then(function (res) {
-        _this12.logger.info('kms: fetched KMS details');
+        _this18.logger.info('kms: fetched KMS details');
 
         var body = res.body;
         body.rsaPublicKey = JSON.parse(body.rsaPublicKey);
         return body;
       }).catch(function (reason) {
-        _this12.logger.error('kms: failed to fetch KMS details', reason);
+        _this18.logger.error('kms: failed to fetch KMS details', reason);
 
         return _promise.default.reject(reason);
       });
@@ -652,8 +836,8 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
    */
   _getKMSStaticPubKey: function _getKMSStaticPubKey() {
     this.logger.info('kms: retrieving KMS static public key');
-    return this._getKMSDetails().then(function (_ref13) {
-      var rsaPublicKey = _ref13.rsaPublicKey;
+    return this._getKMSDetails().then(function (_ref19) {
+      var rsaPublicKey = _ref19.rsaPublicKey;
       return rsaPublicKey;
     });
   },
@@ -663,19 +847,19 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
    * @returns {Promise<Object>}
    */
   _prepareContext: function _prepareContext() {
-    var _this13 = this;
+    var _this19 = this;
 
     this.logger.info('kms: creating context');
     var context = new _nodeKms.Context();
-    return _promise.default.all([this._getKMSStaticPubKey().then((0, _kmsCertificateValidation.default)(this.config.caroots)), this._getAuthorization()]).then(function (_ref14) {
-      var _ref15 = (0, _slicedToArray2.default)(_ref14, 2),
-          kmsStaticPubKey = _ref15[0],
-          authorization = _ref15[1];
+    return _promise.default.all([this._getKMSStaticPubKey().then((0, _kmsCertificateValidation.default)(this.config.caroots)), this._getAuthorization()]).then(function (_ref20) {
+      var _ref21 = (0, _slicedToArray2.default)(_ref20, 2),
+          kmsStaticPubKey = _ref21[0],
+          authorization = _ref21[1];
 
       context.clientInfo = {
-        clientId: _this13.webex.internal.device.url,
+        clientId: _this19.webex.internal.device.url,
         credential: {
-          userId: _this13.webex.internal.device.userId,
+          userId: _this19.webex.internal.device.userId,
           bearer: authorization
         }
       };
@@ -683,38 +867,38 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
         key: kmsStaticPubKey
       };
 
-      _this13.logger.info('kms: creating local ephemeral key');
+      _this19.logger.info('kms: creating local ephemeral key');
 
       return context.createECDHKey();
     }).then(function (localECDHKey) {
       context.ephemeralKey = localECDHKey;
-      partialContexts.set(_this13, context);
-      return _promise.default.all([localECDHKey.asKey(), _this13._getKMSCluster()]);
-    }).then(function (_ref16) {
-      var _ref17 = (0, _slicedToArray2.default)(_ref16, 2),
-          localECDHKey = _ref17[0],
-          cluster = _ref17[1];
+      partialContexts.set(_this19, context);
+      return _promise.default.all([localECDHKey.asKey(), _this19._getKMSCluster()]);
+    }).then(function (_ref22) {
+      var _ref23 = (0, _slicedToArray2.default)(_ref22, 2),
+          localECDHKey = _ref23[0],
+          cluster = _ref23[1];
 
-      _this13.logger.info('kms: submitting ephemeral key request');
+      _this19.logger.info('kms: submitting ephemeral key request');
 
-      return _this13.request({
+      return _this19.request({
         uri: "".concat(cluster, "/ecdhe"),
         method: 'create',
         jwk: localECDHKey.toJSON()
       });
     }).then(function (res) {
-      _this13.logger.info('kms: deriving final ephemeral key');
+      _this19.logger.info('kms: deriving final ephemeral key');
 
       return context.deriveEphemeralKey(res.key);
     }).then(function (key) {
       context.ephemeralKey = key;
-      partialContexts.delete(_this13);
+      partialContexts.delete(_this19);
 
-      _this13.logger.info('kms: derived final ephemeral key');
+      _this19.logger.info('kms: derived final ephemeral key');
 
       return context;
     }).catch(function (reason) {
-      _this13.logger.error('kms: failed to negotiate ephemeral key', reason);
+      _this19.logger.error('kms: failed to negotiate ephemeral key', reason);
 
       return _promise.default.reject(reason);
     });
@@ -747,7 +931,7 @@ var KMS = _webexCore.WebexPlugin.extend((_dec = (0, _common.oneFlight)({
     context.ephemeralKey = originalContext.ephemeralKey;
     return context;
   },
-  version: "1.161.0"
+  version: "2.2.0"
 }, ((0, _applyDecoratedDescriptor2.default)(_obj, "fetchKey", [_dec], (0, _getOwnPropertyDescriptor.default)(_obj, "fetchKey"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "_getContext", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "_getContext"), _obj)), _obj)));
 
 var _default = KMS;

package/dist/kms.js.map

@@ -1 +1 @@
-{"version":3,"names":["contexts","kmsDetails","partialContexts","consoleDebug","require","KMS","WebexPlugin","extend","keyFactory","uri","onBehalfOf","namespace","children","batcher","KMSBatcher","bindKey","kro","kroUri","key","keyUri","logger","info","reject","Error","request","method","resourceUri","then","res","createResource","userIds","keyUris","keys","reduce","uris","k","push","length","resource","addAuthorization","authIds","concat","authorizations","listAuthorizations","removeAuthorization","authId","userId","querystring","stringify","createUnboundKeys","count","all","map","asKey","fetchKey","ping","jose","JWK","jwk","prepareRequest","payload","isECDHRequest","includes","resolve","get","_getContext","context","req","Request","requestContext","_contextOnBehalfOf","wrap","serverKey","process","env","NODE_ENV","util","inspect","JSON","parse","depth","processKmsMessageEvent","event","encryption","kmsMessages","kmsMessage","index","_isECDHEMessage","isECDHMessage","Response","unwrap","catch","reason","error","stack","decryptKmsMessage","body","_getKMSStaticPubKey","kmsStaticPubKey","fields","split","header","base64url","decode","kid","timeout","config","kmsInitialTimeout","webex","internal","mercury","connect","TIMEOUT_SYMBOL","status","statusCode","message","match","warn","KMSError","trigger","ecdhMaxTimeout","nextTimeout","kmsMaxTimeout","delete","_getAuthorization","credentials","getUserToken","token","access_token","promise","_prepareContext","set","expiresIn","ephemeralKey","expirationDate","authorization","clientInfo","credential","bearer","_getKMSCluster","_getKMSDetails","kmsCluster","details","service","device","rsaPublicKey","Context","caroots","clientId","url","serverInfo","createECDHKey","localECDHKey","cluster","toJSON","deriveEphemeralKey","originalContext","oneFlight"],"sources":["kms.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport querystring from 'querystring';\nimport util from 'util';\n\nimport {safeSetTimeout} from '@webex/common-timers';\nimport {oneFlight} from '@webex/common';\nimport {WebexPlugin} from '@webex/webex-core';\nimport {Context, Request, Response} from 'node-kms';\nimport jose from 'node-jose';\nimport {omit} from 'lodash';\n\nimport KMSBatcher, {TIMEOUT_SYMBOL} from './kms-batcher';\nimport validateKMS, {KMSError} from './kms-certificate-validation';\n\nconst contexts = new WeakMap();\nconst kmsDetails = new WeakMap();\nconst partialContexts = new WeakMap();\n\nconst consoleDebug = require('debug')('kms');\n\n/**\n * @class\n */\nconst KMS = WebexPlugin.extend({\n  namespace: 'Encryption',\n\n  children: {\n    batcher: KMSBatcher\n  },\n\n  /**\n   * Binds a key to a resource\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro\n   * @param {string} options.kroUri\n   * @param {Key} options.key\n   * @param {string} options.keyUri\n   * @returns {Promise<Key>}\n   */\n  bindKey({\n    kro, kroUri, key, keyUri\n  }) {\n    kroUri = kroUri || kro.uri;\n    keyUri = keyUri || key.uri;\n\n    this.logger.info('kms: binding key to resource');\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    /* istanbul ignore if */\n    if (!keyUri) {\n      return Promise.reject(new Error('`key` or `keyUri` is required'));\n    }\n\n    return this.request({\n      method: 'update',\n      resourceUri: kroUri,\n      uri: keyUri\n    })\n      .then((res) => {\n        this.logger.info('kms: bound key to resource');\n\n        return res.key;\n      });\n  },\n\n  /**\n   * Creates a new KMS Resource\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.keyUris\n   * @param {Key} options.key\n   * @param {Array<Keys>} options.keys\n   * @returns {Promise<KMSResourceObject>}\n   */\n  createResource({\n    userIds, keyUris, key, keys\n  }) {\n    keyUris = keyUris || [];\n    /* istanbul ignore if */\n    if (keys) {\n      keyUris = keys.reduce((uris, k) => {\n        uris.push(k.uri);\n\n        return uris;\n      }, keyUris);\n    }\n\n    /* istanbul ignore else */\n    if (key) {\n      keyUris.push(key.uri);\n    }\n\n    /* istanbul ignore if */\n    if (keyUris.length === 0) {\n      return Promise.reject(new Error('Cannot create KMS Resource without at least one keyUri'));\n    }\n\n    this.logger.info('kms: creating resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/resources',\n      userIds,\n      keyUris\n    })\n      .then((res) => {\n        this.logger.info('kms: created resource');\n\n        return res.resource;\n      });\n  },\n\n  /**\n   * Authorizes a user or KRO to a KRO\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.authIds interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  addAuthorization({\n    userIds, authIds, kro, kroUri\n  }) {\n    userIds = userIds || [];\n    kroUri = kroUri || kro.uri;\n\n    if (authIds) {\n      userIds = userIds.concat(authIds);\n    }\n\n    /* istanbul ignore if */\n    if (userIds.length === 0) {\n      return Promise.reject(new Error('Cannot add authorization without userIds or authIds'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: adding authorization to kms resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/authorizations',\n      resourceUri: kroUri,\n      userIds\n    })\n      .then((res) => {\n        this.logger.info('kms: added authorization');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Retrieve a list of users that have been authorized to the KRO\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Array<authId>}\n   */\n  listAuthorizations({kro, kroUri}) {\n    kroUri = kroUri || kro.uri;\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    return this.request({\n      method: 'retrieve',\n      uri: `${kroUri}/authorizations`\n    })\n      .then((res) => {\n        this.logger.info('kms: retrieved authorization list');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Deauthorizes a user or KRO from a KRO\n   * @param {Object} options\n   * @param {string} options.userId\n   * @param {string} options.authId interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  removeAuthorization({\n    authId, userId, kro, kroUri\n  }) {\n    authId = authId || userId;\n    kroUri = kroUri || kro.uri;\n\n    /* istanbul ignore if */\n    if (!authId) {\n      return Promise.reject(new Error('Cannot remove authorization without authId'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: removing authorization from kms resource');\n\n    return this.request({\n      method: 'delete',\n      uri: `${kroUri}/authorizations?${querystring.stringify({authId})}`\n    })\n      .then((res) => {\n        this.logger.info('kms: removed authorization');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Requests `count` unbound keys from the kms\n   * @param {Object} options\n   * @param {Number} options.count\n   * @returns {Array<Key>}\n   */\n  createUnboundKeys({count}) {\n    this.logger.info(`kms: request ${count} unbound keys`);\n\n    /* istanbul ignore if */\n    if (!count) {\n      return Promise.reject(new Error('`options.count` is required'));\n    }\n\n    return this.request({\n      method: 'create',\n      uri: '/keys',\n      count\n    })\n      .then((res) => {\n        this.logger.info('kms: received unbound keys');\n\n        return Promise.all(res.keys.map(this.asKey));\n      });\n  },\n\n  /**\n   * Fetches the specified key from the kms\n   * @param {Object} options\n   * @param {string} options.uri\n   * @param {string} options.onBehalfOf The id of a user, upon whose behalf, the key is to be retrieved or undefined if retrieval is for the active user\n   * @returns {Promise<Key>}\n   */\n  // Ideally, this would be done via the kms batcher, but other than request id,\n  // there isn't any other userful key in a kms response to match it to a\n  // request. as such, we need the batcher to group requests, but one flight to\n  // make sure we don't make the same request multiple times.\n  @oneFlight({\n    keyFactory: ({uri, onBehalfOf}) => `${uri}/${onBehalfOf}`\n  })\n  fetchKey({uri, onBehalfOf}) {\n    /* istanbul ignore if */\n    if (!uri) {\n      return Promise.reject(new Error('`options.uri` is required'));\n    }\n\n    this.logger.info('kms: fetching key');\n\n    return this.request({\n      method: 'retrieve',\n      uri\n    }, {onBehalfOf})\n      .then((res) => {\n        this.logger.info('kms: fetched key');\n\n        return this.asKey(res.key);\n      });\n  },\n\n  /**\n   * Pings the kms. Mostly for testing\n   * @returns {Promise}\n   */\n  ping() {\n    return this.request({\n      method: 'update',\n      uri: '/ping'\n    });\n  },\n\n  /**\n   * Ensures a key obect is Key instance\n   * @param {Object} key\n   * @returns {Promise<Key>}\n   */\n  asKey(key) {\n    return jose.JWK.asKey(key.jwk)\n      .then((jwk) => {\n        key.jwk = jwk;\n\n        return key;\n      });\n  },\n\n  /**\n   * Adds appropriate metadata to the KMS request\n   * @param {Object} payload\n   * @param {Object} onBehalfOf Optional parameter to prepare the request on behalf of another user\n   * @returns {Promise<KMS.Request>}\n   */\n  prepareRequest(payload, onBehalfOf) {\n    const isECDHRequest = payload.method === 'create' && payload.uri.includes('/ecdhe');\n\n    return Promise.resolve(isECDHRequest ? partialContexts.get(this) : this._getContext())\n      .then((context) => {\n        this.logger.info(`kms: wrapping ${isECDHRequest ? 'ephemeral key' : 'kms'} request`);\n        const req = new Request(payload);\n        let requestContext = context;\n\n        if (onBehalfOf) {\n          requestContext = this._contextOnBehalfOf(context, onBehalfOf);\n        }\n\n        return req.wrap(requestContext, {serverKey: isECDHRequest})\n          .then(() => {\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: request payload', util.inspect(omit(JSON.parse(JSON.stringify(req)), 'wrapped'), {depth: null}));\n            }\n\n            return req;\n          });\n      });\n  },\n\n  /**\n   * Accepts a kms message event, decrypts it, and passes it to the batcher\n   * @param {Object} event\n   * @returns {Promise<Object>}\n   */\n  processKmsMessageEvent(event) {\n    this.logger.info('kms: received kms message');\n\n    return Promise.all(event.encryption.kmsMessages.map((kmsMessage, index) => this._isECDHEMessage(kmsMessage)\n      .then((isECDHMessage) => {\n        this.logger.info(`kms: received ${isECDHMessage ? 'ecdhe' : 'normal'} message`);\n        const res = new Response(kmsMessage);\n\n        return Promise.resolve(isECDHMessage ? partialContexts.get(this) : contexts.get(this))\n          // eslint-disable-next-line max-nested-callbacks\n          .then((context) => res.unwrap(context))\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => {\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: response payload', util.inspect(omit(JSON.parse(JSON.stringify(res)), 'wrapped'), {depth: null}));\n            }\n          })\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => { event.encryption.kmsMessages[index] = res; })\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => res);\n      })))\n      .then(() => this.batcher.processKmsMessageEvent(event))\n      .catch((reason) => {\n        this.logger.error('kms: decrypt failed', reason.stack);\n\n        return Promise.reject(reason);\n      })\n      .then(() => event);\n  },\n\n  /**\n   * Decrypts a kms message\n   * @param {Object} kmsMessage\n   * @returns {Promise<Object>}\n   */\n  decryptKmsMessage(kmsMessage) {\n    const res = new Response(kmsMessage);\n\n    return contexts.get(this)\n      .then((context) => res.unwrap(context))\n      .then(() => res.body);\n  },\n\n  /**\n   * Determines if the kms message is an ecdhe message or a normal message\n   * @param {Object} kmsMessage\n   * @returns {Promise<boolean>}\n   */\n  _isECDHEMessage(kmsMessage) {\n    return this._getKMSStaticPubKey()\n      .then((kmsStaticPubKey) => {\n        const fields = kmsMessage.split('.');\n\n        if (fields.length !== 3) {\n          return false;\n        }\n\n        const header = JSON.parse(jose.util.base64url.decode(fields[0]));\n\n        return header.kid === kmsStaticPubKey.kid;\n      });\n  },\n\n  /**\n   * Sends a request to the kms\n   * @param {Object} payload\n   * @param {Object} options\n   * @param {Number} options.timeout (internal)\n   * @param {string} options.onBehalfOf Run the request on behalf of another user (UUID), used in compliance scenarios\n   * @returns {Promise<Object>}\n   */\n  request(payload, {timeout, onBehalfOf} = {}) {\n    timeout = timeout || this.config.kmsInitialTimeout;\n\n    // Note: this should only happen when we're using the async kms batcher;\n    // once we implement the sync batcher, this'll need to be smarter.\n    return this.webex.internal.mercury.connect()\n      .then(() => this.prepareRequest(payload, onBehalfOf))\n      .then((req) => {\n        req[TIMEOUT_SYMBOL] = timeout;\n\n        return this.batcher.request(req);\n      })\n      // High complexity is due to attempt at test mode resiliency\n      // eslint-disable-next-line complexity\n      .catch((reason) => {\n        if (process.env.NODE_ENV === 'test' && (reason.status === 403 || reason.statusCode === 403) && reason.message.match(/Failed to resolve authorization token in KmsMessage request for user/)) {\n          this.logger.warn('kms: rerequested key due to test-mode kms auth failure');\n\n          return this.request(payload, {onBehalfOf});\n        }\n\n        // KMS Error. Notify the user\n        if (reason instanceof KMSError) {\n          this.webex.trigger('client:InvalidRequestError');\n\n          return Promise.reject(reason);\n        }\n\n        // Ideally, most or all of the code below would go in kms-batcher, but\n        // but batching needs at least one more round of refactoring for that to\n        // work.\n        if (!reason.statusCode && !reason.status) {\n          /* istanbul ignore else */\n          if (process.env.NODE_ENV !== 'production') {\n            /* istanbul ignore next: reason.stack vs stack difficult to control in test */\n            this.logger.info('kms: request error', reason.stack || reason);\n          }\n\n          consoleDebug(`timeout ${timeout}`);\n          timeout *= 2;\n\n          if (timeout >= this.config.ecdhMaxTimeout) {\n            this.logger.info('kms: exceeded maximum KMS request retries');\n\n            return Promise.reject(reason);\n          }\n\n          // Peek ahead to make sure we don't reset the timeout if the next timeout\n          // will exceed the maximum timeout for renegotiating ECDH keys.\n          const nextTimeout = timeout * 2;\n\n          if (timeout >= this.config.kmsMaxTimeout && nextTimeout < this.config.ecdhMaxTimeout) {\n            this.logger.info('kms: exceeded maximum KMS request retries; negotiating new ecdh key');\n\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: timeout/maxtimeout', timeout, this.config.kmsMaxTimeout);\n            }\n\n            contexts.delete(this);\n            timeout = 0;\n          }\n\n          return this.request(payload, {timeout, onBehalfOf});\n        }\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<string>}\n   */\n  _getAuthorization() {\n    return this.webex.credentials.getUserToken('spark:kms')\n      .then((token) => token.access_token);\n  },\n\n  @oneFlight\n  /**\n   * @private\n   * @param {String} onBehalfOf create context on behalf of another user, undefined when this is not necessary\n   * @returns {Promise<Object>}\n   */\n  _getContext() {\n    let promise = contexts.get(this);\n\n    if (!promise) {\n      promise = this._prepareContext();\n      contexts.set(this, promise);\n      promise.then((context) => {\n        const expiresIn = context.ephemeralKey.expirationDate - Date.now() - 30000;\n\n        safeSetTimeout(() => contexts.delete(this), expiresIn);\n      });\n    }\n\n    return Promise.all([\n      promise,\n      this._getAuthorization()\n    ])\n      .then(([context, authorization]) => {\n        context.clientInfo.credential.bearer = authorization;\n\n        return context;\n      });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSCluster() {\n    this.logger.info('kms: retrieving KMS cluster');\n\n    return this._getKMSDetails()\n      .then(({kmsCluster}) => kmsCluster);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSDetails() {\n    let details = kmsDetails.get(this);\n\n    if (!details) {\n      this.logger.info('kms: fetching KMS details');\n      details = this.webex.request({\n        service: 'encryption',\n        resource: `/kms/${this.webex.internal.device.userId}`\n      })\n        .then((res) => {\n          this.logger.info('kms: fetched KMS details');\n          const {body} = res;\n\n          body.rsaPublicKey = JSON.parse(body.rsaPublicKey);\n\n          return body;\n        })\n        .catch((reason) => {\n          this.logger.error('kms: failed to fetch KMS details', reason);\n\n          return Promise.reject(reason);\n        });\n\n      kmsDetails.set(this, details);\n    }\n\n    return details;\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSStaticPubKey() {\n    this.logger.info('kms: retrieving KMS static public key');\n\n    return this._getKMSDetails()\n      .then(({rsaPublicKey}) => rsaPublicKey);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _prepareContext() {\n    this.logger.info('kms: creating context');\n    const context = new Context();\n\n    return Promise.all([\n      this._getKMSStaticPubKey().then(validateKMS(this.config.caroots)),\n      this._getAuthorization()\n    ])\n      .then(([kmsStaticPubKey, authorization]) => {\n        context.clientInfo = {\n          clientId: this.webex.internal.device.url,\n          credential: {\n            userId: this.webex.internal.device.userId,\n            bearer: authorization\n          }\n        };\n\n        context.serverInfo = {\n          key: kmsStaticPubKey\n        };\n\n        this.logger.info('kms: creating local ephemeral key');\n\n        return context.createECDHKey();\n      })\n      .then((localECDHKey) => {\n        context.ephemeralKey = localECDHKey;\n        partialContexts.set(this, context);\n\n        return Promise.all([localECDHKey.asKey(), this._getKMSCluster()]);\n      })\n      .then(([localECDHKey, cluster]) => {\n        this.logger.info('kms: submitting ephemeral key request');\n\n        return this.request({\n          uri: `${cluster}/ecdhe`,\n          method: 'create',\n          jwk: localECDHKey.toJSON()\n        });\n      })\n      .then((res) => {\n        this.logger.info('kms: deriving final ephemeral key');\n\n        return context.deriveEphemeralKey(res.key);\n      })\n      .then((key) => {\n        context.ephemeralKey = key;\n        partialContexts.delete(this);\n        this.logger.info('kms: derived final ephemeral key');\n\n        return context;\n      })\n      .catch((reason) => {\n        this.logger.error('kms: failed to negotiate ephemeral key', reason);\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * KMS 'retrieve' requests can be made on behalf of another user. This is useful\n   * for scenarios such as eDiscovery. i.e. Where an authorized compliance officer is\n   * entitled to retrieve content generated by any organisational user.\n   * As the KMSContext is cached, updating it will affect separate requests. Hence when\n   * making a request onBehalfOf another user create a new context for just this request.\n   * However this context will be 'light' as it only needs to change one field.\n   * @param {Object} originalContext - The base context to 'copy'\n   * @param {String} onBehalfOf - The user specified in the new context\n   * @returns {Context} A 'copy' of the existing context with a new user specified\n   * @private\n   */\n  _contextOnBehalfOf(originalContext, onBehalfOf) {\n    const context = new Context();\n\n    context.clientInfo = context.clientInfo = {\n      clientId: originalContext.clientInfo.clientId,\n      credential: {\n        userId: onBehalfOf,\n        onBehalfOf, // Supports running onBehalfOf self. i.e. A CO which calls onBehalfOf with CO.id.\n        bearer: originalContext.clientInfo.credential.bearer\n      }\n    };\n    context.serverInfo = originalContext.serverInfo;\n    context.ephemeralKey = originalContext.ephemeralKey;\n\n    return context;\n  }\n});\n\nexport default KMS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;;AACA;;AAEA;;AACA;;AACA;;AACA;;AACA;;AAGA;;AACA;;;;;;;;AAEA,IAAMA,QAAQ,GAAG,sBAAjB;AACA,IAAMC,UAAU,GAAG,sBAAnB;AACA,IAAMC,eAAe,GAAG,sBAAxB;;AAEA,IAAMC,YAAY,GAAGC,OAAO,CAAC,OAAD,CAAP,CAAiB,KAAjB,CAArB;AAEA;AACA;AACA;;;AACA,IAAMC,GAAG,GAAGC,uBAAYC,MAAZ,SA6OT,uBAAU;EACTC,UAAU,EAAE;IAAA,IAAEC,GAAF,QAAEA,GAAF;IAAA,IAAOC,UAAP,QAAOA,UAAP;IAAA,iBAA0BD,GAA1B,cAAiCC,UAAjC;EAAA;AADH,CAAV,CA7OS,UAAmB;EAC7BC,SAAS,EAAE,YADkB;EAG7BC,QAAQ,EAAE;IACRC,OAAO,EAAEC;EADD,CAHmB;;EAO7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,OAhB6B,0BAkB1B;IAAA;;IAAA,IADDC,GACC,SADDA,GACC;IAAA,IADIC,MACJ,SADIA,MACJ;IAAA,IADYC,GACZ,SADYA,GACZ;IAAA,IADiBC,MACjB,SADiBA,MACjB;IACDF,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IACAU,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACT,GAAvB;IAEA,KAAKW,MAAL,CAAYC,IAAZ,CAAiB,8BAAjB;IAEA;;IACA,IAAI,CAACJ,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACJ,MAAL,EAAa;MACX,OAAO,iBAAQG,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBC,WAAW,EAAET,MAFK;MAGlBR,GAAG,EAAEU;IAHa,CAAb,EAKJQ,IALI,CAKC,UAACC,GAAD,EAAS;MACb,KAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAOO,GAAG,CAACV,GAAX;IACD,CATI,CAAP;EAUD,CA5C4B;;EA8C7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEW,cAvD6B,iCAyD1B;IAAA;;IAAA,IADDC,OACC,SADDA,OACC;IAAA,IADQC,OACR,SADQA,OACR;IAAA,IADiBb,GACjB,SADiBA,GACjB;IAAA,IADsBc,IACtB,SADsBA,IACtB;IACDD,OAAO,GAAGA,OAAO,IAAI,EAArB;IACA;;IACA,IAAIC,IAAJ,EAAU;MACRD,OAAO,GAAGC,IAAI,CAACC,MAAL,CAAY,UAACC,IAAD,EAAOC,CAAP,EAAa;QACjCD,IAAI,CAACE,IAAL,CAAUD,CAAC,CAAC1B,GAAZ;QAEA,OAAOyB,IAAP;MACD,CAJS,EAIPH,OAJO,CAAV;IAKD;IAED;;;IACA,IAAIb,GAAJ,EAAS;MACPa,OAAO,CAACK,IAAR,CAAalB,GAAG,CAACT,GAAjB;IACD;IAED;;;IACA,IAAIsB,OAAO,CAACM,MAAR,KAAmB,CAAvB,EAA0B;MACxB,OAAO,iBAAQf,MAAR,CAAe,IAAIC,KAAJ,CAAU,wDAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,wBAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,YAFa;MAGlBqB,OAAO,EAAPA,OAHkB;MAIlBC,OAAO,EAAPA;IAJkB,CAAb,EAMJJ,IANI,CAMC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB;;MAEA,OAAOO,GAAG,CAACU,QAAX;IACD,CAVI,CAAP;EAWD,CA3F4B;;EA6F7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,gBAtG6B,mCAwG1B;IAAA;;IAAA,IADDT,OACC,SADDA,OACC;IAAA,IADQU,OACR,SADQA,OACR;IAAA,IADiBxB,GACjB,SADiBA,GACjB;IAAA,IADsBC,MACtB,SADsBA,MACtB;IACDa,OAAO,GAAGA,OAAO,IAAI,EAArB;IACAb,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;;IAEA,IAAI+B,OAAJ,EAAa;MACXV,OAAO,GAAGA,OAAO,CAACW,MAAR,CAAeD,OAAf,CAAV;IACD;IAED;;;IACA,IAAIV,OAAO,CAACO,MAAR,KAAmB,CAAvB,EAA0B;MACxB,OAAO,iBAAQf,MAAR,CAAe,IAAIC,KAAJ,CAAU,qDAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACN,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,2CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,iBAFa;MAGlBiB,WAAW,EAAET,MAHK;MAIlBa,OAAO,EAAPA;IAJkB,CAAb,EAMJH,IANI,CAMC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,0BAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CAVI,CAAP;EAWD,CAvI4B;;EAyI7B;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,kBAhJ6B,qCAgJK;IAAA;;IAAA,IAAd3B,GAAc,SAAdA,GAAc;IAAA,IAATC,MAAS,SAATA,MAAS;IAChCA,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IACA;;IACA,IAAI,CAACQ,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,YAAKQ,MAAL;IAFe,CAAb,EAIJU,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CARI,CAAP;EASD,CAhK4B;;EAkK7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEE,mBA3K6B,sCA6K1B;IAAA;;IAAA,IADDC,MACC,SADDA,MACC;IAAA,IADOC,MACP,SADOA,MACP;IAAA,IADe9B,GACf,SADeA,GACf;IAAA,IADoBC,MACpB,SADoBA,MACpB;IACD4B,MAAM,GAAGA,MAAM,IAAIC,MAAnB;IACA7B,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IAEA;;IACA,IAAI,CAACoC,MAAL,EAAa;MACX,OAAO,iBAAQvB,MAAR,CAAe,IAAIC,KAAJ,CAAU,4CAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACN,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,+CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,YAAKQ,MAAL,6BAA8B8B,qBAAYC,SAAZ,CAAsB;QAACH,MAAM,EAANA;MAAD,CAAtB,CAA9B;IAFe,CAAb,EAIJlB,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CARI,CAAP;EASD,CAtM4B;;EAwM7B;AACF;AACA;AACA;AACA;AACA;EACEO,iBA9M6B,oCA8MF;IAAA;;IAAA,IAARC,KAAQ,SAARA,KAAQ;IACzB,KAAK9B,MAAL,CAAYC,IAAZ,wBAAiC6B,KAAjC;IAEA;;IACA,IAAI,CAACA,KAAL,EAAY;MACV,OAAO,iBAAQ5B,MAAR,CAAe,IAAIC,KAAJ,CAAU,6BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,OAFa;MAGlByC,KAAK,EAALA;IAHkB,CAAb,EAKJvB,IALI,CAKC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAO,iBAAQ8B,GAAR,CAAYvB,GAAG,CAACI,IAAJ,CAASoB,GAAT,CAAa,MAAI,CAACC,KAAlB,CAAZ,CAAP;IACD,CATI,CAAP;EAUD,CAhO4B;EAgP7BC,QAhP6B,2BAgPD;IAAA;;IAAA,IAAlB7C,GAAkB,SAAlBA,GAAkB;IAAA,IAAbC,UAAa,SAAbA,UAAa;;IAC1B;IACA,IAAI,CAACD,GAAL,EAAU;MACR,OAAO,iBAAQa,MAAR,CAAe,IAAIC,KAAJ,CAAU,2BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,mBAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,EAAHA;IAFkB,CAAb,EAGJ;MAACC,UAAU,EAAVA;IAAD,CAHI,EAIJiB,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,kBAAjB;;MAEA,OAAO,MAAI,CAACgC,KAAL,CAAWzB,GAAG,CAACV,GAAf,CAAP;IACD,CARI,CAAP;EASD,CAjQ4B;;EAmQ7B;AACF;AACA;AACA;EACEqC,IAvQ6B,kBAuQtB;IACL,OAAO,KAAK/B,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE;IAFa,CAAb,CAAP;EAID,CA5Q4B;;EA8Q7B;AACF;AACA;AACA;AACA;EACE4C,KAnR6B,iBAmRvBnC,GAnRuB,EAmRlB;IACT,OAAOsC,kBAAKC,GAAL,CAASJ,KAAT,CAAenC,GAAG,CAACwC,GAAnB,EACJ/B,IADI,CACC,UAAC+B,GAAD,EAAS;MACbxC,GAAG,CAACwC,GAAJ,GAAUA,GAAV;MAEA,OAAOxC,GAAP;IACD,CALI,CAAP;EAMD,CA1R4B;;EA4R7B;AACF;AACA;AACA;AACA;AACA;EACEyC,cAlS6B,0BAkSdC,OAlSc,EAkSLlD,UAlSK,EAkSO;IAAA;;IAClC,IAAMmD,aAAa,GAAGD,OAAO,CAACnC,MAAR,KAAmB,QAAnB,IAA+BmC,OAAO,CAACnD,GAAR,CAAYqD,QAAZ,CAAqB,QAArB,CAArD;IAEA,OAAO,iBAAQC,OAAR,CAAgBF,aAAa,GAAG3D,eAAe,CAAC8D,GAAhB,CAAoB,IAApB,CAAH,GAA+B,KAAKC,WAAL,EAA5D,EACJtC,IADI,CACC,UAACuC,OAAD,EAAa;MACjB,MAAI,CAAC9C,MAAL,CAAYC,IAAZ,yBAAkCwC,aAAa,GAAG,eAAH,GAAqB,KAApE;;MACA,IAAMM,GAAG,GAAG,IAAIC,gBAAJ,CAAYR,OAAZ,CAAZ;MACA,IAAIS,cAAc,GAAGH,OAArB;;MAEA,IAAIxD,UAAJ,EAAgB;QACd2D,cAAc,GAAG,MAAI,CAACC,kBAAL,CAAwBJ,OAAxB,EAAiCxD,UAAjC,CAAjB;MACD;;MAED,OAAOyD,GAAG,CAACI,IAAJ,CAASF,cAAT,EAAyB;QAACG,SAAS,EAAEX;MAAZ,CAAzB,EACJlC,IADI,CACC,YAAM;QACV;QACA,IAAI8C,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;UACzC,MAAI,CAACvD,MAAL,CAAYC,IAAZ,CAAiB,sBAAjB,EAAyCuD,cAAKC,OAAL,CAAa,oBAAKC,IAAI,CAACC,KAAL,CAAW,wBAAeZ,GAAf,CAAX,CAAL,EAAsC,SAAtC,CAAb,EAA+D;YAACa,KAAK,EAAE;UAAR,CAA/D,CAAzC;QACD;;QAED,OAAOb,GAAP;MACD,CARI,CAAP;IASD,CAnBI,CAAP;EAoBD,CAzT4B;;EA2T7B;AACF;AACA;AACA;AACA;EACEc,sBAhU6B,kCAgUNC,KAhUM,EAgUC;IAAA;;IAC5B,KAAK9D,MAAL,CAAYC,IAAZ,CAAiB,2BAAjB;IAEA,OAAO,iBAAQ8B,GAAR,CAAY+B,KAAK,CAACC,UAAN,CAAiBC,WAAjB,CAA6BhC,GAA7B,CAAiC,UAACiC,UAAD,EAAaC,KAAb;MAAA,OAAuB,MAAI,CAACC,eAAL,CAAqBF,UAArB,EACxE1D,IADwE,CACnE,UAAC6D,aAAD,EAAmB;QACvB,MAAI,CAACpE,MAAL,CAAYC,IAAZ,yBAAkCmE,aAAa,GAAG,OAAH,GAAa,QAA5D;;QACA,IAAM5D,GAAG,GAAG,IAAI6D,iBAAJ,CAAaJ,UAAb,CAAZ;QAEA,OAAO,iBAAQtB,OAAR,CAAgByB,aAAa,GAAGtF,eAAe,CAAC8D,GAAhB,CAAoB,MAApB,CAAH,GAA+BhE,QAAQ,CAACgE,GAAT,CAAa,MAAb,CAA5D,EACL;QADK,CAEJrC,IAFI,CAEC,UAACuC,OAAD;UAAA,OAAatC,GAAG,CAAC8D,MAAJ,CAAWxB,OAAX,CAAb;QAAA,CAFD,EAGL;QAHK,CAIJvC,IAJI,CAIC,YAAM;UACV,IAAI8C,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;YACzC,MAAI,CAACvD,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB,EAA0CuD,cAAKC,OAAL,CAAa,oBAAKC,IAAI,CAACC,KAAL,CAAW,wBAAenD,GAAf,CAAX,CAAL,EAAsC,SAAtC,CAAb,EAA+D;cAACoD,KAAK,EAAE;YAAR,CAA/D,CAA1C;UACD;QACF,CARI,EASL;QATK,CAUJrD,IAVI,CAUC,YAAM;UAAEuD,KAAK,CAACC,UAAN,CAAiBC,WAAjB,CAA6BE,KAA7B,IAAsC1D,GAAtC;QAA4C,CAVrD,EAWL;QAXK,CAYJD,IAZI,CAYC;UAAA,OAAMC,GAAN;QAAA,CAZD,CAAP;MAaD,CAlBwE,CAAvB;IAAA,CAAjC,CAAZ,EAmBJD,IAnBI,CAmBC;MAAA,OAAM,MAAI,CAACd,OAAL,CAAaoE,sBAAb,CAAoCC,KAApC,CAAN;IAAA,CAnBD,EAoBJS,KApBI,CAoBE,UAACC,MAAD,EAAY;MACjB,MAAI,CAACxE,MAAL,CAAYyE,KAAZ,CAAkB,qBAAlB,EAAyCD,MAAM,CAACE,KAAhD;;MAEA,OAAO,iBAAQxE,MAAR,CAAesE,MAAf,CAAP;IACD,CAxBI,EAyBJjE,IAzBI,CAyBC;MAAA,OAAMuD,KAAN;IAAA,CAzBD,CAAP;EA0BD,CA7V4B;;EA+V7B;AACF;AACA;AACA;AACA;EACEa,iBApW6B,6BAoWXV,UApWW,EAoWC;IAC5B,IAAMzD,GAAG,GAAG,IAAI6D,iBAAJ,CAAaJ,UAAb,CAAZ;IAEA,OAAOrF,QAAQ,CAACgE,GAAT,CAAa,IAAb,EACJrC,IADI,CACC,UAACuC,OAAD;MAAA,OAAatC,GAAG,CAAC8D,MAAJ,CAAWxB,OAAX,CAAb;IAAA,CADD,EAEJvC,IAFI,CAEC;MAAA,OAAMC,GAAG,CAACoE,IAAV;IAAA,CAFD,CAAP;EAGD,CA1W4B;;EA4W7B;AACF;AACA;AACA;AACA;EACET,eAjX6B,2BAiXbF,UAjXa,EAiXD;IAC1B,OAAO,KAAKY,mBAAL,GACJtE,IADI,CACC,UAACuE,eAAD,EAAqB;MACzB,IAAMC,MAAM,GAAGd,UAAU,CAACe,KAAX,CAAiB,GAAjB,CAAf;;MAEA,IAAID,MAAM,CAAC9D,MAAP,KAAkB,CAAtB,EAAyB;QACvB,OAAO,KAAP;MACD;;MAED,IAAMgE,MAAM,GAAGvB,IAAI,CAACC,KAAL,CAAWvB,kBAAKoB,IAAL,CAAU0B,SAAV,CAAoBC,MAApB,CAA2BJ,MAAM,CAAC,CAAD,CAAjC,CAAX,CAAf;MAEA,OAAOE,MAAM,CAACG,GAAP,KAAeN,eAAe,CAACM,GAAtC;IACD,CAXI,CAAP;EAYD,CA9X4B;;EAgY7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEhF,OAxY6B,mBAwYrBoC,OAxYqB,EAwYgB;IAAA;;IAAA,gFAAJ,EAAI;IAAA,IAA3B6C,OAA2B,SAA3BA,OAA2B;IAAA,IAAlB/F,UAAkB,SAAlBA,UAAkB;;IAC3C+F,OAAO,GAAGA,OAAO,IAAI,KAAKC,MAAL,CAAYC,iBAAjC,CAD2C,CAG3C;IACA;;IACA,OAAO,KAAKC,KAAL,CAAWC,QAAX,CAAoBC,OAApB,CAA4BC,OAA5B,GACJpF,IADI,CACC;MAAA,OAAM,OAAI,CAACgC,cAAL,CAAoBC,OAApB,EAA6BlD,UAA7B,CAAN;IAAA,CADD,EAEJiB,IAFI,CAEC,UAACwC,GAAD,EAAS;MACbA,GAAG,CAAC6C,0BAAD,CAAH,GAAsBP,OAAtB;MAEA,OAAO,OAAI,CAAC5F,OAAL,CAAaW,OAAb,CAAqB2C,GAArB,CAAP;IACD,CANI,EAOL;IACA;IARK,CASJwB,KATI,CASE,UAACC,MAAD,EAAY;MACjB,IAAInB,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,MAAzB,KAAoCiB,MAAM,CAACqB,MAAP,KAAkB,GAAlB,IAAyBrB,MAAM,CAACsB,UAAP,KAAsB,GAAnF,KAA2FtB,MAAM,CAACuB,OAAP,CAAeC,KAAf,CAAqB,sEAArB,CAA/F,EAA6L;QAC3L,OAAI,CAAChG,MAAL,CAAYiG,IAAZ,CAAiB,wDAAjB;;QAEA,OAAO,OAAI,CAAC7F,OAAL,CAAaoC,OAAb,EAAsB;UAAClD,UAAU,EAAVA;QAAD,CAAtB,CAAP;MACD,CALgB,CAOjB;;;MACA,IAAIkF,MAAM,YAAY0B,kCAAtB,EAAgC;QAC9B,OAAI,CAACV,KAAL,CAAWW,OAAX,CAAmB,4BAAnB;;QAEA,OAAO,iBAAQjG,MAAR,CAAesE,MAAf,CAAP;MACD,CAZgB,CAcjB;MACA;MACA;;;MACA,IAAI,CAACA,MAAM,CAACsB,UAAR,IAAsB,CAACtB,MAAM,CAACqB,MAAlC,EAA0C;QACxC;QACA,IAAIxC,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;UACzC;UACA,OAAI,CAACvD,MAAL,CAAYC,IAAZ,CAAiB,oBAAjB,EAAuCuE,MAAM,CAACE,KAAP,IAAgBF,MAAvD;QACD;;QAEDzF,YAAY,mBAAYsG,OAAZ,EAAZ;QACAA,OAAO,IAAI,CAAX;;QAEA,IAAIA,OAAO,IAAI,OAAI,CAACC,MAAL,CAAYc,cAA3B,EAA2C;UACzC,OAAI,CAACpG,MAAL,CAAYC,IAAZ,CAAiB,2CAAjB;;UAEA,OAAO,iBAAQC,MAAR,CAAesE,MAAf,CAAP;QACD,CAduC,CAgBxC;QACA;;;QACA,IAAM6B,WAAW,GAAGhB,OAAO,GAAG,CAA9B;;QAEA,IAAIA,OAAO,IAAI,OAAI,CAACC,MAAL,CAAYgB,aAAvB,IAAwCD,WAAW,GAAG,OAAI,CAACf,MAAL,CAAYc,cAAtE,EAAsF;UACpF,OAAI,CAACpG,MAAL,CAAYC,IAAZ,CAAiB,qEAAjB;UAEA;;;UACA,IAAIoD,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;YACzC,OAAI,CAACvD,MAAL,CAAYC,IAAZ,CAAiB,yBAAjB,EAA4CoF,OAA5C,EAAqD,OAAI,CAACC,MAAL,CAAYgB,aAAjE;UACD;;UAED1H,QAAQ,CAAC2H,MAAT,CAAgB,OAAhB;UACAlB,OAAO,GAAG,CAAV;QACD;;QAED,OAAO,OAAI,CAACjF,OAAL,CAAaoC,OAAb,EAAsB;UAAC6C,OAAO,EAAPA,OAAD;UAAU/F,UAAU,EAAVA;QAAV,CAAtB,CAAP;MACD;;MAED,OAAO,iBAAQY,MAAR,CAAesE,MAAf,CAAP;IACD,CA9DI,CAAP;EA+DD,CA5c4B;;EA8c7B;AACF;AACA;AACA;EACEgC,iBAld6B,+BAkdT;IAClB,OAAO,KAAKhB,KAAL,CAAWiB,WAAX,CAAuBC,YAAvB,CAAoC,WAApC,EACJnG,IADI,CACC,UAACoG,KAAD;MAAA,OAAWA,KAAK,CAACC,YAAjB;IAAA,CADD,CAAP;EAED,CArd4B;;EAwd7B;AACF;AACA;AACA;AACA;EACE/D,WA7d6B,yBA6df;IAAA;;IACZ,IAAIgE,OAAO,GAAGjI,QAAQ,CAACgE,GAAT,CAAa,IAAb,CAAd;;IAEA,IAAI,CAACiE,OAAL,EAAc;MACZA,OAAO,GAAG,KAAKC,eAAL,EAAV;MACAlI,QAAQ,CAACmI,GAAT,CAAa,IAAb,EAAmBF,OAAnB;MACAA,OAAO,CAACtG,IAAR,CAAa,UAACuC,OAAD,EAAa;QACxB,IAAMkE,SAAS,GAAGlE,OAAO,CAACmE,YAAR,CAAqBC,cAArB,GAAsC,mBAAtC,GAAmD,KAArE;QAEA,kCAAe;UAAA,OAAMtI,QAAQ,CAAC2H,MAAT,CAAgB,OAAhB,CAAN;QAAA,CAAf,EAA4CS,SAA5C;MACD,CAJD;IAKD;;IAED,OAAO,iBAAQjF,GAAR,CAAY,CACjB8E,OADiB,EAEjB,KAAKL,iBAAL,EAFiB,CAAZ,EAIJjG,IAJI,CAIC,kBAA8B;MAAA;MAAA,IAA5BuC,OAA4B;MAAA,IAAnBqE,aAAmB;;MAClCrE,OAAO,CAACsE,UAAR,CAAmBC,UAAnB,CAA8BC,MAA9B,GAAuCH,aAAvC;MAEA,OAAOrE,OAAP;IACD,CARI,CAAP;EASD,CAnf4B;;EAqf7B;AACF;AACA;AACA;EACEyE,cAzf6B,4BAyfZ;IACf,KAAKvH,MAAL,CAAYC,IAAZ,CAAiB,6BAAjB;IAEA,OAAO,KAAKuH,cAAL,GACJjH,IADI,CACC;MAAA,IAAEkH,UAAF,UAAEA,UAAF;MAAA,OAAkBA,UAAlB;IAAA,CADD,CAAP;EAED,CA9f4B;;EAggB7B;AACF;AACA;AACA;EACED,cApgB6B,4BAogBZ;IAAA;;IACf,IAAIE,OAAO,GAAG7I,UAAU,CAAC+D,GAAX,CAAe,IAAf,CAAd;;IAEA,IAAI,CAAC8E,OAAL,EAAc;MACZ,KAAK1H,MAAL,CAAYC,IAAZ,CAAiB,2BAAjB;MACAyH,OAAO,GAAG,KAAKlC,KAAL,CAAWpF,OAAX,CAAmB;QAC3BuH,OAAO,EAAE,YADkB;QAE3BzG,QAAQ,iBAAU,KAAKsE,KAAL,CAAWC,QAAX,CAAoBmC,MAApB,CAA2BlG,MAArC;MAFmB,CAAnB,EAIPnB,IAJO,CAIF,UAACC,GAAD,EAAS;QACb,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,0BAAjB;;QACA,IAAO2E,IAAP,GAAepE,GAAf,CAAOoE,IAAP;QAEAA,IAAI,CAACiD,YAAL,GAAoBnE,IAAI,CAACC,KAAL,CAAWiB,IAAI,CAACiD,YAAhB,CAApB;QAEA,OAAOjD,IAAP;MACD,CAXO,EAYPL,KAZO,CAYD,UAACC,MAAD,EAAY;QACjB,OAAI,CAACxE,MAAL,CAAYyE,KAAZ,CAAkB,kCAAlB,EAAsDD,MAAtD;;QAEA,OAAO,iBAAQtE,MAAR,CAAesE,MAAf,CAAP;MACD,CAhBO,CAAV;MAkBA3F,UAAU,CAACkI,GAAX,CAAe,IAAf,EAAqBW,OAArB;IACD;;IAED,OAAOA,OAAP;EACD,CA/hB4B;;EAiiB7B;AACF;AACA;AACA;EACE7C,mBAriB6B,iCAqiBP;IACpB,KAAK7E,MAAL,CAAYC,IAAZ,CAAiB,uCAAjB;IAEA,OAAO,KAAKuH,cAAL,GACJjH,IADI,CACC;MAAA,IAAEsH,YAAF,UAAEA,YAAF;MAAA,OAAoBA,YAApB;IAAA,CADD,CAAP;EAED,CA1iB4B;;EA4iB7B;AACF;AACA;AACA;EACEf,eAhjB6B,6BAgjBX;IAAA;;IAChB,KAAK9G,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB;IACA,IAAM6C,OAAO,GAAG,IAAIgF,gBAAJ,EAAhB;IAEA,OAAO,iBAAQ/F,GAAR,CAAY,CACjB,KAAK8C,mBAAL,GAA2BtE,IAA3B,CAAgC,uCAAY,KAAK+E,MAAL,CAAYyC,OAAxB,CAAhC,CADiB,EAEjB,KAAKvB,iBAAL,EAFiB,CAAZ,EAIJjG,IAJI,CAIC,kBAAsC;MAAA;MAAA,IAApCuE,eAAoC;MAAA,IAAnBqC,aAAmB;;MAC1CrE,OAAO,CAACsE,UAAR,GAAqB;QACnBY,QAAQ,EAAE,OAAI,CAACxC,KAAL,CAAWC,QAAX,CAAoBmC,MAApB,CAA2BK,GADlB;QAEnBZ,UAAU,EAAE;UACV3F,MAAM,EAAE,OAAI,CAAC8D,KAAL,CAAWC,QAAX,CAAoBmC,MAApB,CAA2BlG,MADzB;UAEV4F,MAAM,EAAEH;QAFE;MAFO,CAArB;MAQArE,OAAO,CAACoF,UAAR,GAAqB;QACnBpI,GAAG,EAAEgF;MADc,CAArB;;MAIA,OAAI,CAAC9E,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAO6C,OAAO,CAACqF,aAAR,EAAP;IACD,CApBI,EAqBJ5H,IArBI,CAqBC,UAAC6H,YAAD,EAAkB;MACtBtF,OAAO,CAACmE,YAAR,GAAuBmB,YAAvB;MACAtJ,eAAe,CAACiI,GAAhB,CAAoB,OAApB,EAA0BjE,OAA1B;MAEA,OAAO,iBAAQf,GAAR,CAAY,CAACqG,YAAY,CAACnG,KAAb,EAAD,EAAuB,OAAI,CAACsF,cAAL,EAAvB,CAAZ,CAAP;IACD,CA1BI,EA2BJhH,IA3BI,CA2BC,kBAA6B;MAAA;MAAA,IAA3B6H,YAA2B;MAAA,IAAbC,OAAa;;MACjC,OAAI,CAACrI,MAAL,CAAYC,IAAZ,CAAiB,uCAAjB;;MAEA,OAAO,OAAI,CAACG,OAAL,CAAa;QAClBf,GAAG,YAAKgJ,OAAL,WADe;QAElBhI,MAAM,EAAE,QAFU;QAGlBiC,GAAG,EAAE8F,YAAY,CAACE,MAAb;MAHa,CAAb,CAAP;IAKD,CAnCI,EAoCJ/H,IApCI,CAoCC,UAACC,GAAD,EAAS;MACb,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAO6C,OAAO,CAACyF,kBAAR,CAA2B/H,GAAG,CAACV,GAA/B,CAAP;IACD,CAxCI,EAyCJS,IAzCI,CAyCC,UAACT,GAAD,EAAS;MACbgD,OAAO,CAACmE,YAAR,GAAuBnH,GAAvB;MACAhB,eAAe,CAACyH,MAAhB,CAAuB,OAAvB;;MACA,OAAI,CAACvG,MAAL,CAAYC,IAAZ,CAAiB,kCAAjB;;MAEA,OAAO6C,OAAP;IACD,CA/CI,EAgDJyB,KAhDI,CAgDE,UAACC,MAAD,EAAY;MACjB,OAAI,CAACxE,MAAL,CAAYyE,KAAZ,CAAkB,wCAAlB,EAA4DD,MAA5D;;MAEA,OAAO,iBAAQtE,MAAR,CAAesE,MAAf,CAAP;IACD,CApDI,CAAP;EAqDD,CAzmB4B;;EA2mB7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEtB,kBAvnB6B,8BAunBVsF,eAvnBU,EAunBOlJ,UAvnBP,EAunBmB;IAC9C,IAAMwD,OAAO,GAAG,IAAIgF,gBAAJ,EAAhB;IAEAhF,OAAO,CAACsE,UAAR,GAAqBtE,OAAO,CAACsE,UAAR,GAAqB;MACxCY,QAAQ,EAAEQ,eAAe,CAACpB,UAAhB,CAA2BY,QADG;MAExCX,UAAU,EAAE;QACV3F,MAAM,EAAEpC,UADE;QAEVA,UAAU,EAAVA,UAFU;QAEE;QACZgI,MAAM,EAAEkB,eAAe,CAACpB,UAAhB,CAA2BC,UAA3B,CAAsCC;MAHpC;IAF4B,CAA1C;IAQAxE,OAAO,CAACoF,UAAR,GAAqBM,eAAe,CAACN,UAArC;IACApF,OAAO,CAACmE,YAAR,GAAuBuB,eAAe,CAACvB,YAAvC;IAEA,OAAOnE,OAAP;EACD,CAtoB4B;EAAA;AAAA,CAAnB,oMAudT2F,iBAvdS,+EAAZ;;eAyoBexJ,G"}
+{"version":3,"names":["contexts","kmsDetails","partialContexts","consoleDebug","require","KMS","WebexPlugin","extend","keyFactory","uri","onBehalfOf","namespace","children","batcher","KMSBatcher","bindKey","kro","kroUri","key","keyUri","logger","info","reject","Error","request","method","resourceUri","then","res","createResource","userIds","keyUris","keys","reduce","uris","k","push","length","resource","addAuthorization","authIds","concat","authorizations","listAuthorizations","removeAuthorization","authId","userId","querystring","stringify","createUnboundKeys","count","all","map","asKey","fetchPublicKey","assignedOrgId","publicKey","uploadCustomerMasterKey","customerMasterKey","requestId","uuid","v4","listAllCustomerMasterKey","changeCustomerMasterKeyState","keyId","keyState","deleteAllCustomerMasterKeys","useGlobalMasterKey","fetchKey","ping","jose","JWK","jwk","prepareRequest","payload","isECDHRequest","includes","resolve","get","_getContext","context","req","Request","requestContext","_contextOnBehalfOf","wrap","serverKey","process","env","NODE_ENV","util","inspect","JSON","parse","depth","processKmsMessageEvent","event","encryption","kmsMessages","kmsMessage","index","_isECDHEMessage","isECDHMessage","Response","unwrap","catch","reason","error","stack","decryptKmsMessage","body","_getKMSStaticPubKey","kmsStaticPubKey","fields","split","header","base64url","decode","kid","timeout","config","kmsInitialTimeout","webex","internal","mercury","connect","TIMEOUT_SYMBOL","status","statusCode","message","match","warn","KMSError","trigger","ecdhMaxTimeout","nextTimeout","kmsMaxTimeout","delete","_getAuthorization","credentials","getUserToken","token","access_token","promise","_prepareContext","set","expiresIn","ephemeralKey","expirationDate","authorization","clientInfo","credential","bearer","_getKMSCluster","_getKMSDetails","kmsCluster","details","service","device","rsaPublicKey","Context","caroots","clientId","url","serverInfo","createECDHKey","localECDHKey","cluster","toJSON","deriveEphemeralKey","originalContext","oneFlight"],"sources":["kms.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport querystring from 'querystring';\nimport util from 'util';\n\nimport {safeSetTimeout} from '@webex/common-timers';\nimport {oneFlight} from '@webex/common';\nimport {WebexPlugin} from '@webex/webex-core';\nimport {Context, Request, Response} from 'node-kms';\nimport jose from 'node-jose';\nimport {omit} from 'lodash';\nimport uuid from 'uuid';\n\nimport KMSBatcher, {TIMEOUT_SYMBOL} from './kms-batcher';\nimport validateKMS, {KMSError} from './kms-certificate-validation';\n\nconst contexts = new WeakMap();\nconst kmsDetails = new WeakMap();\nconst partialContexts = new WeakMap();\n\nconst consoleDebug = require('debug')('kms');\n\n/**\n * @class\n */\nconst KMS = WebexPlugin.extend({\n  namespace: 'Encryption',\n\n  children: {\n    batcher: KMSBatcher\n  },\n\n  /**\n   * Binds a key to a resource\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro\n   * @param {string} options.kroUri\n   * @param {Key} options.key\n   * @param {string} options.keyUri\n   * @returns {Promise<Key>}\n   */\n  bindKey({\n    kro, kroUri, key, keyUri\n  }) {\n    kroUri = kroUri || kro.uri;\n    keyUri = keyUri || key.uri;\n\n    this.logger.info('kms: binding key to resource');\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    /* istanbul ignore if */\n    if (!keyUri) {\n      return Promise.reject(new Error('`key` or `keyUri` is required'));\n    }\n\n    return this.request({\n      method: 'update',\n      resourceUri: kroUri,\n      uri: keyUri\n    })\n      .then((res) => {\n        this.logger.info('kms: bound key to resource');\n\n        return res.key;\n      });\n  },\n\n  /**\n   * Creates a new KMS Resource\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.keyUris\n   * @param {Key} options.key\n   * @param {Array<Keys>} options.keys\n   * @returns {Promise<KMSResourceObject>}\n   */\n  createResource({\n    userIds, keyUris, key, keys\n  }) {\n    keyUris = keyUris || [];\n    /* istanbul ignore if */\n    if (keys) {\n      keyUris = keys.reduce((uris, k) => {\n        uris.push(k.uri);\n\n        return uris;\n      }, keyUris);\n    }\n\n    /* istanbul ignore else */\n    if (key) {\n      keyUris.push(key.uri);\n    }\n\n    /* istanbul ignore if */\n    if (keyUris.length === 0) {\n      return Promise.reject(new Error('Cannot create KMS Resource without at least one keyUri'));\n    }\n\n    this.logger.info('kms: creating resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/resources',\n      userIds,\n      keyUris\n    })\n      .then((res) => {\n        this.logger.info('kms: created resource');\n\n        return res.resource;\n      });\n  },\n\n  /**\n   * Authorizes a user or KRO to a KRO\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.authIds interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  addAuthorization({\n    userIds, authIds, kro, kroUri\n  }) {\n    userIds = userIds || [];\n    kroUri = kroUri || kro.uri;\n\n    if (authIds) {\n      userIds = userIds.concat(authIds);\n    }\n\n    /* istanbul ignore if */\n    if (userIds.length === 0) {\n      return Promise.reject(new Error('Cannot add authorization without userIds or authIds'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: adding authorization to kms resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/authorizations',\n      resourceUri: kroUri,\n      userIds\n    })\n      .then((res) => {\n        this.logger.info('kms: added authorization');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Retrieve a list of users that have been authorized to the KRO\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Array<authId>}\n   */\n  listAuthorizations({kro, kroUri}) {\n    kroUri = kroUri || kro.uri;\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    return this.request({\n      method: 'retrieve',\n      uri: `${kroUri}/authorizations`\n    })\n      .then((res) => {\n        this.logger.info('kms: retrieved authorization list');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Deauthorizes a user or KRO from a KRO\n   * @param {Object} options\n   * @param {string} options.userId\n   * @param {string} options.authId interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  removeAuthorization({\n    authId, userId, kro, kroUri\n  }) {\n    authId = authId || userId;\n    kroUri = kroUri || kro.uri;\n\n    /* istanbul ignore if */\n    if (!authId) {\n      return Promise.reject(new Error('Cannot remove authorization without authId'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: removing authorization from kms resource');\n\n    return this.request({\n      method: 'delete',\n      uri: `${kroUri}/authorizations?${querystring.stringify({authId})}`\n    })\n      .then((res) => {\n        this.logger.info('kms: removed authorization');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Requests `count` unbound keys from the kms\n   * @param {Object} options\n   * @param {Number} options.count\n   * @returns {Array<Key>}\n   */\n  createUnboundKeys({count}) {\n    this.logger.info(`kms: request ${count} unbound keys`);\n\n    /* istanbul ignore if */\n    if (!count) {\n      return Promise.reject(new Error('`options.count` is required'));\n    }\n\n    return this.request({\n      method: 'create',\n      uri: '/keys',\n      count\n    })\n      .then((res) => {\n        this.logger.info('kms: received unbound keys');\n\n        return Promise.all(res.keys.map(this.asKey));\n      });\n  },\n\n  /**\n  * @typedef {Object} FetchPublicKeyResponse\n  * @property {number} status 200,400(Bad Request: Request payload missing info),404(Not Found: HSM Public Key not found),501(Not Implemented: This KMS does not support BYOK),502(Bad Gateway: KMS could not communicate with HSM)\n  * @property {UUID} requestId this is should be unique, used for debug.\n  * @property {string} publicKey\n  */\n  /**\n   * get public key from kms\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<FetchPublicKeyResponse>} response of get public key api\n   */\n  fetchPublicKey({assignedOrgId}) {\n    this.logger.info('kms: fetch public key for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: '/publicKey',\n      assignedOrgId\n    })\n      .then((res) => {\n        this.logger.info('kms: received public key');\n\n        return res.publicKey;\n      });\n  },\n\n  /**\n  * @typedef {Object} UploadCmkResponse\n  * @property {number} status\n  * @property {UUID} requestId\n  * @property {string} uri\n  * @property {string} keysState\n  */\n  /**\n   * upload master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {string} options.customerMasterKey the master key\n   * @returns {Promise.<UploadCmkResponse>} response of upload CMK api\n   */\n  uploadCustomerMasterKey({assignedOrgId, customerMasterKey}) {\n    this.logger.info('kms: upload customer master key for byok');\n\n    return this.request({\n      method: 'create',\n      uri: '/cmk',\n      assignedOrgId,\n      customerMasterKey,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to upload customer master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * get all customer master keys for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  listAllCustomerMasterKey({assignedOrgId}) {\n    this.logger.info('kms: get all customer master keys for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to get all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n  * @typedef {Object} ActivateCmkResponse\n  * @property {number} status\n  * @property {UUID} requestId\n  * @property {Array<CMK>} customerMasterKeys\n  */\n  /**\n   *\n   * @typedef {Object} CMK\n   * @property {string} usageState\n   * @property {UUID} assignedOrgId\n   * @property {string} uri\n   * @property {string} source\n   * @property {Date | undefined} stateUpdatedOn\n   * @property {Date | undefined} rotation\n   */\n  /**\n   * change one customer master key state for one org.\n   * delete pending key, then the keyState should be 'removedclean';\n   * active pending key, then the keyState should be 'active';\n   *\n   * @param {Object} options\n   * @param {string} options.keyId the id of one customer master key, it should be a url\n   * @param {string} options.keyState one of the following: PENDING, RECOVERING,ACTIVE,REVOKED,DEACTIVATED,REENCRYPTING,RETIRED,DELETED,DISABLED,REMOVEDCLEAN,REMOVEDDIRTY;\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  changeCustomerMasterKeyState({keyId, keyState, assignedOrgId}) {\n    this.logger.info('kms: change one customer master key state for byok');\n\n    return this.request({\n      method: 'update',\n      uri: keyId,\n      keyState,\n      assignedOrgId,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to change the customer master key state to {}', keyState);\n\n      return res;\n    });\n  },\n\n  /**\n   * this is for test case. it will delete all CMKs, no matter what their status is. This is mainly for test purpose\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<{status, requestId}>}\n   */\n  deleteAllCustomerMasterKeys({assignedOrgId}) {\n    this.logger.info('kms: delete all customer master keys at the same time');\n\n    return this.request({\n      method: 'delete',\n      uri: '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to delete all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n   * return to use global master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of activate CMK api\n   */\n  useGlobalMasterKey({assignedOrgId}) {\n    this.logger.info('kms: return to use global master key');\n\n    return this.request({\n      method: 'update',\n      uri: 'default',\n      keyState: 'ACTIVE',\n      assignedOrgId,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to return to global master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * Fetches the specified key from the kms\n   * @param {Object} options\n   * @param {string} options.uri\n   * @param {string} options.onBehalfOf The id of a user, upon whose behalf, the key is to be retrieved or undefined if retrieval is for the active user\n   * @returns {Promise<Key>}\n   */\n  // Ideally, this would be done via the kms batcher, but other than request id,\n  // there isn't any other userful key in a kms response to match it to a\n  // request. as such, we need the batcher to group requests, but one flight to\n  // make sure we don't make the same request multiple times.\n  @oneFlight({\n    keyFactory: ({uri, onBehalfOf}) => `${uri}/${onBehalfOf}`\n  })\n  fetchKey({uri, onBehalfOf}) {\n    /* istanbul ignore if */\n    if (!uri) {\n      return Promise.reject(new Error('`options.uri` is required'));\n    }\n\n    this.logger.info('kms: fetching key');\n\n    return this.request({\n      method: 'retrieve',\n      uri\n    }, {onBehalfOf})\n      .then((res) => {\n        this.logger.info('kms: fetched key');\n\n        return this.asKey(res.key);\n      });\n  },\n\n  /**\n   * Pings the kms. Mostly for testing\n   * @returns {Promise}\n   */\n  ping() {\n    return this.request({\n      method: 'update',\n      uri: '/ping'\n    });\n  },\n\n  /**\n   * Ensures a key obect is Key instance\n   * @param {Object} key\n   * @returns {Promise<Key>}\n   */\n  asKey(key) {\n    return jose.JWK.asKey(key.jwk)\n      .then((jwk) => {\n        key.jwk = jwk;\n\n        return key;\n      });\n  },\n\n  /**\n   * Adds appropriate metadata to the KMS request\n   * @param {Object} payload\n   * @param {Object} onBehalfOf Optional parameter to prepare the request on behalf of another user\n   * @returns {Promise<KMS.Request>}\n   */\n  prepareRequest(payload, onBehalfOf) {\n    const isECDHRequest = payload.method === 'create' && payload.uri.includes('/ecdhe');\n\n    return Promise.resolve(isECDHRequest ? partialContexts.get(this) : this._getContext())\n      .then((context) => {\n        this.logger.info(`kms: wrapping ${isECDHRequest ? 'ephemeral key' : 'kms'} request`);\n        const req = new Request(payload);\n        let requestContext = context;\n\n        if (onBehalfOf) {\n          requestContext = this._contextOnBehalfOf(context, onBehalfOf);\n        }\n\n        return req.wrap(requestContext, {serverKey: isECDHRequest})\n          .then(() => {\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: request payload', util.inspect(omit(JSON.parse(JSON.stringify(req)), 'wrapped'), {depth: null}));\n            }\n\n            return req;\n          });\n      });\n  },\n\n  /**\n   * Accepts a kms message event, decrypts it, and passes it to the batcher\n   * @param {Object} event\n   * @returns {Promise<Object>}\n   */\n  processKmsMessageEvent(event) {\n    this.logger.info('kms: received kms message');\n\n    return Promise.all(event.encryption.kmsMessages.map((kmsMessage, index) => this._isECDHEMessage(kmsMessage)\n      .then((isECDHMessage) => {\n        this.logger.info(`kms: received ${isECDHMessage ? 'ecdhe' : 'normal'} message`);\n        const res = new Response(kmsMessage);\n\n        return Promise.resolve(isECDHMessage ? partialContexts.get(this) : contexts.get(this))\n          // eslint-disable-next-line max-nested-callbacks\n          .then((context) => res.unwrap(context))\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => {\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: response payload', util.inspect(omit(JSON.parse(JSON.stringify(res)), 'wrapped'), {depth: null}));\n            }\n          })\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => { event.encryption.kmsMessages[index] = res; })\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => res);\n      })))\n      .then(() => this.batcher.processKmsMessageEvent(event))\n      .catch((reason) => {\n        this.logger.error('kms: decrypt failed', reason.stack);\n\n        return Promise.reject(reason);\n      })\n      .then(() => event);\n  },\n\n  /**\n   * Decrypts a kms message\n   * @param {Object} kmsMessage\n   * @returns {Promise<Object>}\n   */\n  decryptKmsMessage(kmsMessage) {\n    const res = new Response(kmsMessage);\n\n    return contexts.get(this)\n      .then((context) => res.unwrap(context))\n      .then(() => res.body);\n  },\n\n  /**\n   * Determines if the kms message is an ecdhe message or a normal message\n   * @param {Object} kmsMessage\n   * @returns {Promise<boolean>}\n   */\n  _isECDHEMessage(kmsMessage) {\n    return this._getKMSStaticPubKey()\n      .then((kmsStaticPubKey) => {\n        const fields = kmsMessage.split('.');\n\n        if (fields.length !== 3) {\n          return false;\n        }\n\n        const header = JSON.parse(jose.util.base64url.decode(fields[0]));\n\n        return header.kid === kmsStaticPubKey.kid;\n      });\n  },\n\n  /**\n   * Sends a request to the kms\n   * @param {Object} payload\n   * @param {Object} options\n   * @param {Number} options.timeout (internal)\n   * @param {string} options.onBehalfOf Run the request on behalf of another user (UUID), used in compliance scenarios\n   * @returns {Promise<Object>}\n   */\n  request(payload, {timeout, onBehalfOf} = {}) {\n    timeout = timeout || this.config.kmsInitialTimeout;\n\n    // Note: this should only happen when we're using the async kms batcher;\n    // once we implement the sync batcher, this'll need to be smarter.\n    return this.webex.internal.mercury.connect()\n      .then(() => this.prepareRequest(payload, onBehalfOf))\n      .then((req) => {\n        req[TIMEOUT_SYMBOL] = timeout;\n\n        return this.batcher.request(req);\n      })\n      // High complexity is due to attempt at test mode resiliency\n      // eslint-disable-next-line complexity\n      .catch((reason) => {\n        if (process.env.NODE_ENV === 'test' && (reason.status === 403 || reason.statusCode === 403) && reason.message.match(/Failed to resolve authorization token in KmsMessage request for user/)) {\n          this.logger.warn('kms: rerequested key due to test-mode kms auth failure');\n\n          return this.request(payload, {onBehalfOf});\n        }\n\n        // KMS Error. Notify the user\n        if (reason instanceof KMSError) {\n          this.webex.trigger('client:InvalidRequestError');\n\n          return Promise.reject(reason);\n        }\n\n        // Ideally, most or all of the code below would go in kms-batcher, but\n        // but batching needs at least one more round of refactoring for that to\n        // work.\n        if (!reason.statusCode && !reason.status) {\n          /* istanbul ignore else */\n          if (process.env.NODE_ENV !== 'production') {\n            /* istanbul ignore next: reason.stack vs stack difficult to control in test */\n            this.logger.info('kms: request error', reason.stack || reason);\n          }\n\n          consoleDebug(`timeout ${timeout}`);\n          timeout *= 2;\n\n          if (timeout >= this.config.ecdhMaxTimeout) {\n            this.logger.info('kms: exceeded maximum KMS request retries');\n\n            return Promise.reject(reason);\n          }\n\n          // Peek ahead to make sure we don't reset the timeout if the next timeout\n          // will exceed the maximum timeout for renegotiating ECDH keys.\n          const nextTimeout = timeout * 2;\n\n          if (timeout >= this.config.kmsMaxTimeout && nextTimeout < this.config.ecdhMaxTimeout) {\n            this.logger.info('kms: exceeded maximum KMS request retries; negotiating new ecdh key');\n\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: timeout/maxtimeout', timeout, this.config.kmsMaxTimeout);\n            }\n\n            contexts.delete(this);\n            timeout = 0;\n          }\n\n          return this.request(payload, {timeout, onBehalfOf});\n        }\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<string>}\n   */\n  _getAuthorization() {\n    return this.webex.credentials.getUserToken('spark:kms')\n      .then((token) => token.access_token);\n  },\n\n  @oneFlight\n  /**\n   * @private\n   * @param {String} onBehalfOf create context on behalf of another user, undefined when this is not necessary\n   * @returns {Promise<Object>}\n   */\n  _getContext() {\n    let promise = contexts.get(this);\n\n    if (!promise) {\n      promise = this._prepareContext();\n      contexts.set(this, promise);\n      promise.then((context) => {\n        const expiresIn = context.ephemeralKey.expirationDate - Date.now() - 30000;\n\n        safeSetTimeout(() => contexts.delete(this), expiresIn);\n      });\n    }\n\n    return Promise.all([\n      promise,\n      this._getAuthorization()\n    ])\n      .then(([context, authorization]) => {\n        context.clientInfo.credential.bearer = authorization;\n\n        return context;\n      });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSCluster() {\n    this.logger.info('kms: retrieving KMS cluster');\n\n    return this._getKMSDetails()\n      .then(({kmsCluster}) => kmsCluster);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSDetails() {\n    let details = kmsDetails.get(this);\n\n    if (!details) {\n      this.logger.info('kms: fetching KMS details');\n      details = this.webex.request({\n        service: 'encryption',\n        resource: `/kms/${this.webex.internal.device.userId}`\n      })\n        .then((res) => {\n          this.logger.info('kms: fetched KMS details');\n          const {body} = res;\n\n          body.rsaPublicKey = JSON.parse(body.rsaPublicKey);\n\n          return body;\n        })\n        .catch((reason) => {\n          this.logger.error('kms: failed to fetch KMS details', reason);\n\n          return Promise.reject(reason);\n        });\n\n      kmsDetails.set(this, details);\n    }\n\n    return details;\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSStaticPubKey() {\n    this.logger.info('kms: retrieving KMS static public key');\n\n    return this._getKMSDetails()\n      .then(({rsaPublicKey}) => rsaPublicKey);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _prepareContext() {\n    this.logger.info('kms: creating context');\n    const context = new Context();\n\n    return Promise.all([\n      this._getKMSStaticPubKey().then(validateKMS(this.config.caroots)),\n      this._getAuthorization()\n    ])\n      .then(([kmsStaticPubKey, authorization]) => {\n        context.clientInfo = {\n          clientId: this.webex.internal.device.url,\n          credential: {\n            userId: this.webex.internal.device.userId,\n            bearer: authorization\n          }\n        };\n\n        context.serverInfo = {\n          key: kmsStaticPubKey\n        };\n\n        this.logger.info('kms: creating local ephemeral key');\n\n        return context.createECDHKey();\n      })\n      .then((localECDHKey) => {\n        context.ephemeralKey = localECDHKey;\n        partialContexts.set(this, context);\n\n        return Promise.all([localECDHKey.asKey(), this._getKMSCluster()]);\n      })\n      .then(([localECDHKey, cluster]) => {\n        this.logger.info('kms: submitting ephemeral key request');\n\n        return this.request({\n          uri: `${cluster}/ecdhe`,\n          method: 'create',\n          jwk: localECDHKey.toJSON()\n        });\n      })\n      .then((res) => {\n        this.logger.info('kms: deriving final ephemeral key');\n\n        return context.deriveEphemeralKey(res.key);\n      })\n      .then((key) => {\n        context.ephemeralKey = key;\n        partialContexts.delete(this);\n        this.logger.info('kms: derived final ephemeral key');\n\n        return context;\n      })\n      .catch((reason) => {\n        this.logger.error('kms: failed to negotiate ephemeral key', reason);\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * KMS 'retrieve' requests can be made on behalf of another user. This is useful\n   * for scenarios such as eDiscovery. i.e. Where an authorized compliance officer is\n   * entitled to retrieve content generated by any organisational user.\n   * As the KMSContext is cached, updating it will affect separate requests. Hence when\n   * making a request onBehalfOf another user create a new context for just this request.\n   * However this context will be 'light' as it only needs to change one field.\n   * @param {Object} originalContext - The base context to 'copy'\n   * @param {String} onBehalfOf - The user specified in the new context\n   * @returns {Context} A 'copy' of the existing context with a new user specified\n   * @private\n   */\n  _contextOnBehalfOf(originalContext, onBehalfOf) {\n    const context = new Context();\n\n    context.clientInfo = context.clientInfo = {\n      clientId: originalContext.clientInfo.clientId,\n      credential: {\n        userId: onBehalfOf,\n        onBehalfOf, // Supports running onBehalfOf self. i.e. A CO which calls onBehalfOf with CO.id.\n        bearer: originalContext.clientInfo.credential.bearer\n      }\n    };\n    context.serverInfo = originalContext.serverInfo;\n    context.ephemeralKey = originalContext.ephemeralKey;\n\n    return context;\n  }\n});\n\nexport default KMS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;;AACA;;AAEA;;AACA;;AACA;;AACA;;AACA;;AAEA;;AAEA;;AACA;;;;;;;;AAEA,IAAMA,QAAQ,GAAG,sBAAjB;AACA,IAAMC,UAAU,GAAG,sBAAnB;AACA,IAAMC,eAAe,GAAG,sBAAxB;;AAEA,IAAMC,YAAY,GAAGC,OAAO,CAAC,OAAD,CAAP,CAAiB,KAAjB,CAArB;AAEA;AACA;AACA;;;AACA,IAAMC,GAAG,GAAGC,uBAAYC,MAAZ,SAiZT,uBAAU;EACTC,UAAU,EAAE;IAAA,IAAEC,GAAF,QAAEA,GAAF;IAAA,IAAOC,UAAP,QAAOA,UAAP;IAAA,iBAA0BD,GAA1B,cAAiCC,UAAjC;EAAA;AADH,CAAV,CAjZS,UAAmB;EAC7BC,SAAS,EAAE,YADkB;EAG7BC,QAAQ,EAAE;IACRC,OAAO,EAAEC;EADD,CAHmB;;EAO7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,OAhB6B,0BAkB1B;IAAA;;IAAA,IADDC,GACC,SADDA,GACC;IAAA,IADIC,MACJ,SADIA,MACJ;IAAA,IADYC,GACZ,SADYA,GACZ;IAAA,IADiBC,MACjB,SADiBA,MACjB;IACDF,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IACAU,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACT,GAAvB;IAEA,KAAKW,MAAL,CAAYC,IAAZ,CAAiB,8BAAjB;IAEA;;IACA,IAAI,CAACJ,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACJ,MAAL,EAAa;MACX,OAAO,iBAAQG,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBC,WAAW,EAAET,MAFK;MAGlBR,GAAG,EAAEU;IAHa,CAAb,EAKJQ,IALI,CAKC,UAACC,GAAD,EAAS;MACb,KAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAOO,GAAG,CAACV,GAAX;IACD,CATI,CAAP;EAUD,CA5C4B;;EA8C7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEW,cAvD6B,iCAyD1B;IAAA;;IAAA,IADDC,OACC,SADDA,OACC;IAAA,IADQC,OACR,SADQA,OACR;IAAA,IADiBb,GACjB,SADiBA,GACjB;IAAA,IADsBc,IACtB,SADsBA,IACtB;IACDD,OAAO,GAAGA,OAAO,IAAI,EAArB;IACA;;IACA,IAAIC,IAAJ,EAAU;MACRD,OAAO,GAAGC,IAAI,CAACC,MAAL,CAAY,UAACC,IAAD,EAAOC,CAAP,EAAa;QACjCD,IAAI,CAACE,IAAL,CAAUD,CAAC,CAAC1B,GAAZ;QAEA,OAAOyB,IAAP;MACD,CAJS,EAIPH,OAJO,CAAV;IAKD;IAED;;;IACA,IAAIb,GAAJ,EAAS;MACPa,OAAO,CAACK,IAAR,CAAalB,GAAG,CAACT,GAAjB;IACD;IAED;;;IACA,IAAIsB,OAAO,CAACM,MAAR,KAAmB,CAAvB,EAA0B;MACxB,OAAO,iBAAQf,MAAR,CAAe,IAAIC,KAAJ,CAAU,wDAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,wBAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,YAFa;MAGlBqB,OAAO,EAAPA,OAHkB;MAIlBC,OAAO,EAAPA;IAJkB,CAAb,EAMJJ,IANI,CAMC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB;;MAEA,OAAOO,GAAG,CAACU,QAAX;IACD,CAVI,CAAP;EAWD,CA3F4B;;EA6F7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,gBAtG6B,mCAwG1B;IAAA;;IAAA,IADDT,OACC,SADDA,OACC;IAAA,IADQU,OACR,SADQA,OACR;IAAA,IADiBxB,GACjB,SADiBA,GACjB;IAAA,IADsBC,MACtB,SADsBA,MACtB;IACDa,OAAO,GAAGA,OAAO,IAAI,EAArB;IACAb,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;;IAEA,IAAI+B,OAAJ,EAAa;MACXV,OAAO,GAAGA,OAAO,CAACW,MAAR,CAAeD,OAAf,CAAV;IACD;IAED;;;IACA,IAAIV,OAAO,CAACO,MAAR,KAAmB,CAAvB,EAA0B;MACxB,OAAO,iBAAQf,MAAR,CAAe,IAAIC,KAAJ,CAAU,qDAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACN,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,2CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,iBAFa;MAGlBiB,WAAW,EAAET,MAHK;MAIlBa,OAAO,EAAPA;IAJkB,CAAb,EAMJH,IANI,CAMC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,0BAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CAVI,CAAP;EAWD,CAvI4B;;EAyI7B;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,kBAhJ6B,qCAgJK;IAAA;;IAAA,IAAd3B,GAAc,SAAdA,GAAc;IAAA,IAATC,MAAS,SAATA,MAAS;IAChCA,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IACA;;IACA,IAAI,CAACQ,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,YAAKQ,MAAL;IAFe,CAAb,EAIJU,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CARI,CAAP;EASD,CAhK4B;;EAkK7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEE,mBA3K6B,sCA6K1B;IAAA;;IAAA,IADDC,MACC,SADDA,MACC;IAAA,IADOC,MACP,SADOA,MACP;IAAA,IADe9B,GACf,SADeA,GACf;IAAA,IADoBC,MACpB,SADoBA,MACpB;IACD4B,MAAM,GAAGA,MAAM,IAAIC,MAAnB;IACA7B,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IAEA;;IACA,IAAI,CAACoC,MAAL,EAAa;MACX,OAAO,iBAAQvB,MAAR,CAAe,IAAIC,KAAJ,CAAU,4CAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACN,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,+CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,YAAKQ,MAAL,6BAA8B8B,qBAAYC,SAAZ,CAAsB;QAACH,MAAM,EAANA;MAAD,CAAtB,CAA9B;IAFe,CAAb,EAIJlB,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CARI,CAAP;EASD,CAtM4B;;EAwM7B;AACF;AACA;AACA;AACA;AACA;EACEO,iBA9M6B,oCA8MF;IAAA;;IAAA,IAARC,KAAQ,SAARA,KAAQ;IACzB,KAAK9B,MAAL,CAAYC,IAAZ,wBAAiC6B,KAAjC;IAEA;;IACA,IAAI,CAACA,KAAL,EAAY;MACV,OAAO,iBAAQ5B,MAAR,CAAe,IAAIC,KAAJ,CAAU,6BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,OAFa;MAGlByC,KAAK,EAALA;IAHkB,CAAb,EAKJvB,IALI,CAKC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAO,iBAAQ8B,GAAR,CAAYvB,GAAG,CAACI,IAAJ,CAASoB,GAAT,CAAa,MAAI,CAACC,KAAlB,CAAZ,CAAP;IACD,CATI,CAAP;EAUD,CAhO4B;;EAkO7B;AACF;AACA;AACA;AACA;AACA;;EACE;AACF;AACA;AACA;AACA;AACA;EACEC,cA9O6B,iCA8OG;IAAA;;IAAA,IAAhBC,aAAgB,SAAhBA,aAAgB;IAC9B,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,gCAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,EAAE,YAFa;MAGlB8C,aAAa,EAAbA;IAHkB,CAAb,EAKJ5B,IALI,CAKC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,0BAAjB;;MAEA,OAAOO,GAAG,CAAC4B,SAAX;IACD,CATI,CAAP;EAUD,CA3P4B;;EA6P7B;AACF;AACA;AACA;AACA;AACA;AACA;;EACE;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,uBA3Q6B,0CA2Q+B;IAAA;;IAAA,IAAnCF,aAAmC,SAAnCA,aAAmC;IAAA,IAApBG,iBAAoB,SAApBA,iBAAoB;IAC1D,KAAKtC,MAAL,CAAYC,IAAZ,CAAiB,0CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,MAFa;MAGlB8C,aAAa,EAAbA,aAHkB;MAIlBG,iBAAiB,EAAjBA,iBAJkB;MAKlBC,SAAS,EAAEC,cAAKC,EAAL;IALO,CAAb,EAMJlC,IANI,CAMC,UAACC,GAAD,EAAS;MACf,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,2CAAjB;;MAEA,OAAOO,GAAP;IACD,CAVM,CAAP;EAWD,CAzR4B;;EA2R7B;AACF;AACA;AACA;AACA;AACA;EACEkC,wBAjS6B,4CAiSa;IAAA;;IAAA,IAAhBP,aAAgB,UAAhBA,aAAgB;IACxC,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,4CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,EAAE,MAFa;MAGlB8C,aAAa,EAAbA,aAHkB;MAIlBI,SAAS,EAAEC,cAAKC,EAAL;IAJO,CAAb,EAKJlC,IALI,CAKC,UAACC,GAAD,EAAS;MACf,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,6CAAjB;;MAEA,OAAOO,GAAP;IACD,CATM,CAAP;EAUD,CA9S4B;;EAgT7B;AACF;AACA;AACA;AACA;AACA;;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEmC,4BA3U6B,gDA2UkC;IAAA;;IAAA,IAAjCC,KAAiC,UAAjCA,KAAiC;IAAA,IAA1BC,QAA0B,UAA1BA,QAA0B;IAAA,IAAhBV,aAAgB,UAAhBA,aAAgB;IAC7D,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,oDAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAEuD,KAFa;MAGlBC,QAAQ,EAARA,QAHkB;MAIlBV,aAAa,EAAbA,aAJkB;MAKlBI,SAAS,EAAEC,cAAKC,EAAL;IALO,CAAb,EAMJlC,IANI,CAMC,UAACC,GAAD,EAAS;MACf,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,2DAAjB,EAA8E4C,QAA9E;;MAEA,OAAOrC,GAAP;IACD,CAVM,CAAP;EAWD,CAzV4B;;EA2V7B;AACF;AACA;AACA;AACA;AACA;EACEsC,2BAjW6B,+CAiWgB;IAAA;;IAAA,IAAhBX,aAAgB,UAAhBA,aAAgB;IAC3C,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,uDAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,MAFa;MAGlB8C,aAAa,EAAbA,aAHkB;MAIlBI,SAAS,EAAEC,cAAKC,EAAL;IAJO,CAAb,EAKJlC,IALI,CAKC,UAACC,GAAD,EAAS;MACf,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,gDAAjB;;MAEA,OAAOO,GAAP;IACD,CATM,CAAP;EAUD,CA9W4B;;EAgX7B;AACF;AACA;AACA;AACA;AACA;EACEuC,kBAtX6B,sCAsXO;IAAA;;IAAA,IAAhBZ,aAAgB,UAAhBA,aAAgB;IAClC,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,sCAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,SAFa;MAGlBwD,QAAQ,EAAE,QAHQ;MAIlBV,aAAa,EAAbA,aAJkB;MAKlBI,SAAS,EAAEC,cAAKC,EAAL;IALO,CAAb,EAMJlC,IANI,CAMC,UAACC,GAAD,EAAS;MACf,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4CAAjB;;MAEA,OAAOO,GAAP;IACD,CAVM,CAAP;EAWD,CApY4B;EAoZ7BwC,QApZ6B,4BAoZD;IAAA;;IAAA,IAAlB3D,GAAkB,UAAlBA,GAAkB;IAAA,IAAbC,UAAa,UAAbA,UAAa;;IAC1B;IACA,IAAI,CAACD,GAAL,EAAU;MACR,OAAO,iBAAQa,MAAR,CAAe,IAAIC,KAAJ,CAAU,2BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,mBAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,EAAHA;IAFkB,CAAb,EAGJ;MAACC,UAAU,EAAVA;IAAD,CAHI,EAIJiB,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,kBAAjB;;MAEA,OAAO,OAAI,CAACgC,KAAL,CAAWzB,GAAG,CAACV,GAAf,CAAP;IACD,CARI,CAAP;EASD,CAra4B;;EAua7B;AACF;AACA;AACA;EACEmD,IA3a6B,kBA2atB;IACL,OAAO,KAAK7C,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE;IAFa,CAAb,CAAP;EAID,CAhb4B;;EAkb7B;AACF;AACA;AACA;AACA;EACE4C,KAvb6B,iBAubvBnC,GAvbuB,EAublB;IACT,OAAOoD,kBAAKC,GAAL,CAASlB,KAAT,CAAenC,GAAG,CAACsD,GAAnB,EACJ7C,IADI,CACC,UAAC6C,GAAD,EAAS;MACbtD,GAAG,CAACsD,GAAJ,GAAUA,GAAV;MAEA,OAAOtD,GAAP;IACD,CALI,CAAP;EAMD,CA9b4B;;EAgc7B;AACF;AACA;AACA;AACA;AACA;EACEuD,cAtc6B,0BAscdC,OAtcc,EAscLhE,UAtcK,EAscO;IAAA;;IAClC,IAAMiE,aAAa,GAAGD,OAAO,CAACjD,MAAR,KAAmB,QAAnB,IAA+BiD,OAAO,CAACjE,GAAR,CAAYmE,QAAZ,CAAqB,QAArB,CAArD;IAEA,OAAO,iBAAQC,OAAR,CAAgBF,aAAa,GAAGzE,eAAe,CAAC4E,GAAhB,CAAoB,IAApB,CAAH,GAA+B,KAAKC,WAAL,EAA5D,EACJpD,IADI,CACC,UAACqD,OAAD,EAAa;MACjB,OAAI,CAAC5D,MAAL,CAAYC,IAAZ,yBAAkCsD,aAAa,GAAG,eAAH,GAAqB,KAApE;;MACA,IAAMM,GAAG,GAAG,IAAIC,gBAAJ,CAAYR,OAAZ,CAAZ;MACA,IAAIS,cAAc,GAAGH,OAArB;;MAEA,IAAItE,UAAJ,EAAgB;QACdyE,cAAc,GAAG,OAAI,CAACC,kBAAL,CAAwBJ,OAAxB,EAAiCtE,UAAjC,CAAjB;MACD;;MAED,OAAOuE,GAAG,CAACI,IAAJ,CAASF,cAAT,EAAyB;QAACG,SAAS,EAAEX;MAAZ,CAAzB,EACJhD,IADI,CACC,YAAM;QACV;QACA,IAAI4D,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;UACzC,OAAI,CAACrE,MAAL,CAAYC,IAAZ,CAAiB,sBAAjB,EAAyCqE,cAAKC,OAAL,CAAa,oBAAKC,IAAI,CAACC,KAAL,CAAW,wBAAeZ,GAAf,CAAX,CAAL,EAAsC,SAAtC,CAAb,EAA+D;YAACa,KAAK,EAAE;UAAR,CAA/D,CAAzC;QACD;;QAED,OAAOb,GAAP;MACD,CARI,CAAP;IASD,CAnBI,CAAP;EAoBD,CA7d4B;;EA+d7B;AACF;AACA;AACA;AACA;EACEc,sBApe6B,kCAoeNC,KApeM,EAoeC;IAAA;;IAC5B,KAAK5E,MAAL,CAAYC,IAAZ,CAAiB,2BAAjB;IAEA,OAAO,iBAAQ8B,GAAR,CAAY6C,KAAK,CAACC,UAAN,CAAiBC,WAAjB,CAA6B9C,GAA7B,CAAiC,UAAC+C,UAAD,EAAaC,KAAb;MAAA,OAAuB,OAAI,CAACC,eAAL,CAAqBF,UAArB,EACxExE,IADwE,CACnE,UAAC2E,aAAD,EAAmB;QACvB,OAAI,CAAClF,MAAL,CAAYC,IAAZ,yBAAkCiF,aAAa,GAAG,OAAH,GAAa,QAA5D;;QACA,IAAM1E,GAAG,GAAG,IAAI2E,iBAAJ,CAAaJ,UAAb,CAAZ;QAEA,OAAO,iBAAQtB,OAAR,CAAgByB,aAAa,GAAGpG,eAAe,CAAC4E,GAAhB,CAAoB,OAApB,CAAH,GAA+B9E,QAAQ,CAAC8E,GAAT,CAAa,OAAb,CAA5D,EACL;QADK,CAEJnD,IAFI,CAEC,UAACqD,OAAD;UAAA,OAAapD,GAAG,CAAC4E,MAAJ,CAAWxB,OAAX,CAAb;QAAA,CAFD,EAGL;QAHK,CAIJrD,IAJI,CAIC,YAAM;UACV,IAAI4D,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;YACzC,OAAI,CAACrE,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB,EAA0CqE,cAAKC,OAAL,CAAa,oBAAKC,IAAI,CAACC,KAAL,CAAW,wBAAejE,GAAf,CAAX,CAAL,EAAsC,SAAtC,CAAb,EAA+D;cAACkE,KAAK,EAAE;YAAR,CAA/D,CAA1C;UACD;QACF,CARI,EASL;QATK,CAUJnE,IAVI,CAUC,YAAM;UAAEqE,KAAK,CAACC,UAAN,CAAiBC,WAAjB,CAA6BE,KAA7B,IAAsCxE,GAAtC;QAA4C,CAVrD,EAWL;QAXK,CAYJD,IAZI,CAYC;UAAA,OAAMC,GAAN;QAAA,CAZD,CAAP;MAaD,CAlBwE,CAAvB;IAAA,CAAjC,CAAZ,EAmBJD,IAnBI,CAmBC;MAAA,OAAM,OAAI,CAACd,OAAL,CAAakF,sBAAb,CAAoCC,KAApC,CAAN;IAAA,CAnBD,EAoBJS,KApBI,CAoBE,UAACC,MAAD,EAAY;MACjB,OAAI,CAACtF,MAAL,CAAYuF,KAAZ,CAAkB,qBAAlB,EAAyCD,MAAM,CAACE,KAAhD;;MAEA,OAAO,iBAAQtF,MAAR,CAAeoF,MAAf,CAAP;IACD,CAxBI,EAyBJ/E,IAzBI,CAyBC;MAAA,OAAMqE,KAAN;IAAA,CAzBD,CAAP;EA0BD,CAjgB4B;;EAmgB7B;AACF;AACA;AACA;AACA;EACEa,iBAxgB6B,6BAwgBXV,UAxgBW,EAwgBC;IAC5B,IAAMvE,GAAG,GAAG,IAAI2E,iBAAJ,CAAaJ,UAAb,CAAZ;IAEA,OAAOnG,QAAQ,CAAC8E,GAAT,CAAa,IAAb,EACJnD,IADI,CACC,UAACqD,OAAD;MAAA,OAAapD,GAAG,CAAC4E,MAAJ,CAAWxB,OAAX,CAAb;IAAA,CADD,EAEJrD,IAFI,CAEC;MAAA,OAAMC,GAAG,CAACkF,IAAV;IAAA,CAFD,CAAP;EAGD,CA9gB4B;;EAghB7B;AACF;AACA;AACA;AACA;EACET,eArhB6B,2BAqhBbF,UArhBa,EAqhBD;IAC1B,OAAO,KAAKY,mBAAL,GACJpF,IADI,CACC,UAACqF,eAAD,EAAqB;MACzB,IAAMC,MAAM,GAAGd,UAAU,CAACe,KAAX,CAAiB,GAAjB,CAAf;;MAEA,IAAID,MAAM,CAAC5E,MAAP,KAAkB,CAAtB,EAAyB;QACvB,OAAO,KAAP;MACD;;MAED,IAAM8E,MAAM,GAAGvB,IAAI,CAACC,KAAL,CAAWvB,kBAAKoB,IAAL,CAAU0B,SAAV,CAAoBC,MAApB,CAA2BJ,MAAM,CAAC,CAAD,CAAjC,CAAX,CAAf;MAEA,OAAOE,MAAM,CAACG,GAAP,KAAeN,eAAe,CAACM,GAAtC;IACD,CAXI,CAAP;EAYD,CAliB4B;;EAoiB7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE9F,OA5iB6B,mBA4iBrBkD,OA5iBqB,EA4iBgB;IAAA;;IAAA,iFAAJ,EAAI;IAAA,IAA3B6C,OAA2B,UAA3BA,OAA2B;IAAA,IAAlB7G,UAAkB,UAAlBA,UAAkB;;IAC3C6G,OAAO,GAAGA,OAAO,IAAI,KAAKC,MAAL,CAAYC,iBAAjC,CAD2C,CAG3C;IACA;;IACA,OAAO,KAAKC,KAAL,CAAWC,QAAX,CAAoBC,OAApB,CAA4BC,OAA5B,GACJlG,IADI,CACC;MAAA,OAAM,OAAI,CAAC8C,cAAL,CAAoBC,OAApB,EAA6BhE,UAA7B,CAAN;IAAA,CADD,EAEJiB,IAFI,CAEC,UAACsD,GAAD,EAAS;MACbA,GAAG,CAAC6C,0BAAD,CAAH,GAAsBP,OAAtB;MAEA,OAAO,OAAI,CAAC1G,OAAL,CAAaW,OAAb,CAAqByD,GAArB,CAAP;IACD,CANI,EAOL;IACA;IARK,CASJwB,KATI,CASE,UAACC,MAAD,EAAY;MACjB,IAAInB,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,MAAzB,KAAoCiB,MAAM,CAACqB,MAAP,KAAkB,GAAlB,IAAyBrB,MAAM,CAACsB,UAAP,KAAsB,GAAnF,KAA2FtB,MAAM,CAACuB,OAAP,CAAeC,KAAf,CAAqB,sEAArB,CAA/F,EAA6L;QAC3L,OAAI,CAAC9G,MAAL,CAAY+G,IAAZ,CAAiB,wDAAjB;;QAEA,OAAO,OAAI,CAAC3G,OAAL,CAAakD,OAAb,EAAsB;UAAChE,UAAU,EAAVA;QAAD,CAAtB,CAAP;MACD,CALgB,CAOjB;;;MACA,IAAIgG,MAAM,YAAY0B,kCAAtB,EAAgC;QAC9B,OAAI,CAACV,KAAL,CAAWW,OAAX,CAAmB,4BAAnB;;QAEA,OAAO,iBAAQ/G,MAAR,CAAeoF,MAAf,CAAP;MACD,CAZgB,CAcjB;MACA;MACA;;;MACA,IAAI,CAACA,MAAM,CAACsB,UAAR,IAAsB,CAACtB,MAAM,CAACqB,MAAlC,EAA0C;QACxC;QACA,IAAIxC,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;UACzC;UACA,OAAI,CAACrE,MAAL,CAAYC,IAAZ,CAAiB,oBAAjB,EAAuCqF,MAAM,CAACE,KAAP,IAAgBF,MAAvD;QACD;;QAEDvG,YAAY,mBAAYoH,OAAZ,EAAZ;QACAA,OAAO,IAAI,CAAX;;QAEA,IAAIA,OAAO,IAAI,OAAI,CAACC,MAAL,CAAYc,cAA3B,EAA2C;UACzC,OAAI,CAAClH,MAAL,CAAYC,IAAZ,CAAiB,2CAAjB;;UAEA,OAAO,iBAAQC,MAAR,CAAeoF,MAAf,CAAP;QACD,CAduC,CAgBxC;QACA;;;QACA,IAAM6B,WAAW,GAAGhB,OAAO,GAAG,CAA9B;;QAEA,IAAIA,OAAO,IAAI,OAAI,CAACC,MAAL,CAAYgB,aAAvB,IAAwCD,WAAW,GAAG,OAAI,CAACf,MAAL,CAAYc,cAAtE,EAAsF;UACpF,OAAI,CAAClH,MAAL,CAAYC,IAAZ,CAAiB,qEAAjB;UAEA;;;UACA,IAAIkE,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;YACzC,OAAI,CAACrE,MAAL,CAAYC,IAAZ,CAAiB,yBAAjB,EAA4CkG,OAA5C,EAAqD,OAAI,CAACC,MAAL,CAAYgB,aAAjE;UACD;;UAEDxI,QAAQ,CAACyI,MAAT,CAAgB,OAAhB;UACAlB,OAAO,GAAG,CAAV;QACD;;QAED,OAAO,OAAI,CAAC/F,OAAL,CAAakD,OAAb,EAAsB;UAAC6C,OAAO,EAAPA,OAAD;UAAU7G,UAAU,EAAVA;QAAV,CAAtB,CAAP;MACD;;MAED,OAAO,iBAAQY,MAAR,CAAeoF,MAAf,CAAP;IACD,CA9DI,CAAP;EA+DD,CAhnB4B;;EAknB7B;AACF;AACA;AACA;EACEgC,iBAtnB6B,+BAsnBT;IAClB,OAAO,KAAKhB,KAAL,CAAWiB,WAAX,CAAuBC,YAAvB,CAAoC,WAApC,EACJjH,IADI,CACC,UAACkH,KAAD;MAAA,OAAWA,KAAK,CAACC,YAAjB;IAAA,CADD,CAAP;EAED,CAznB4B;;EA4nB7B;AACF;AACA;AACA;AACA;EACE/D,WAjoB6B,yBAioBf;IAAA;;IACZ,IAAIgE,OAAO,GAAG/I,QAAQ,CAAC8E,GAAT,CAAa,IAAb,CAAd;;IAEA,IAAI,CAACiE,OAAL,EAAc;MACZA,OAAO,GAAG,KAAKC,eAAL,EAAV;MACAhJ,QAAQ,CAACiJ,GAAT,CAAa,IAAb,EAAmBF,OAAnB;MACAA,OAAO,CAACpH,IAAR,CAAa,UAACqD,OAAD,EAAa;QACxB,IAAMkE,SAAS,GAAGlE,OAAO,CAACmE,YAAR,CAAqBC,cAArB,GAAsC,mBAAtC,GAAmD,KAArE;QAEA,kCAAe;UAAA,OAAMpJ,QAAQ,CAACyI,MAAT,CAAgB,OAAhB,CAAN;QAAA,CAAf,EAA4CS,SAA5C;MACD,CAJD;IAKD;;IAED,OAAO,iBAAQ/F,GAAR,CAAY,CACjB4F,OADiB,EAEjB,KAAKL,iBAAL,EAFiB,CAAZ,EAIJ/G,IAJI,CAIC,kBAA8B;MAAA;MAAA,IAA5BqD,OAA4B;MAAA,IAAnBqE,aAAmB;;MAClCrE,OAAO,CAACsE,UAAR,CAAmBC,UAAnB,CAA8BC,MAA9B,GAAuCH,aAAvC;MAEA,OAAOrE,OAAP;IACD,CARI,CAAP;EASD,CAvpB4B;;EAypB7B;AACF;AACA;AACA;EACEyE,cA7pB6B,4BA6pBZ;IACf,KAAKrI,MAAL,CAAYC,IAAZ,CAAiB,6BAAjB;IAEA,OAAO,KAAKqI,cAAL,GACJ/H,IADI,CACC;MAAA,IAAEgI,UAAF,UAAEA,UAAF;MAAA,OAAkBA,UAAlB;IAAA,CADD,CAAP;EAED,CAlqB4B;;EAoqB7B;AACF;AACA;AACA;EACED,cAxqB6B,4BAwqBZ;IAAA;;IACf,IAAIE,OAAO,GAAG3J,UAAU,CAAC6E,GAAX,CAAe,IAAf,CAAd;;IAEA,IAAI,CAAC8E,OAAL,EAAc;MACZ,KAAKxI,MAAL,CAAYC,IAAZ,CAAiB,2BAAjB;MACAuI,OAAO,GAAG,KAAKlC,KAAL,CAAWlG,OAAX,CAAmB;QAC3BqI,OAAO,EAAE,YADkB;QAE3BvH,QAAQ,iBAAU,KAAKoF,KAAL,CAAWC,QAAX,CAAoBmC,MAApB,CAA2BhH,MAArC;MAFmB,CAAnB,EAIPnB,IAJO,CAIF,UAACC,GAAD,EAAS;QACb,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,0BAAjB;;QACA,IAAOyF,IAAP,GAAelF,GAAf,CAAOkF,IAAP;QAEAA,IAAI,CAACiD,YAAL,GAAoBnE,IAAI,CAACC,KAAL,CAAWiB,IAAI,CAACiD,YAAhB,CAApB;QAEA,OAAOjD,IAAP;MACD,CAXO,EAYPL,KAZO,CAYD,UAACC,MAAD,EAAY;QACjB,OAAI,CAACtF,MAAL,CAAYuF,KAAZ,CAAkB,kCAAlB,EAAsDD,MAAtD;;QAEA,OAAO,iBAAQpF,MAAR,CAAeoF,MAAf,CAAP;MACD,CAhBO,CAAV;MAkBAzG,UAAU,CAACgJ,GAAX,CAAe,IAAf,EAAqBW,OAArB;IACD;;IAED,OAAOA,OAAP;EACD,CAnsB4B;;EAqsB7B;AACF;AACA;AACA;EACE7C,mBAzsB6B,iCAysBP;IACpB,KAAK3F,MAAL,CAAYC,IAAZ,CAAiB,uCAAjB;IAEA,OAAO,KAAKqI,cAAL,GACJ/H,IADI,CACC;MAAA,IAAEoI,YAAF,UAAEA,YAAF;MAAA,OAAoBA,YAApB;IAAA,CADD,CAAP;EAED,CA9sB4B;;EAgtB7B;AACF;AACA;AACA;EACEf,eAptB6B,6BAotBX;IAAA;;IAChB,KAAK5H,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB;IACA,IAAM2D,OAAO,GAAG,IAAIgF,gBAAJ,EAAhB;IAEA,OAAO,iBAAQ7G,GAAR,CAAY,CACjB,KAAK4D,mBAAL,GAA2BpF,IAA3B,CAAgC,uCAAY,KAAK6F,MAAL,CAAYyC,OAAxB,CAAhC,CADiB,EAEjB,KAAKvB,iBAAL,EAFiB,CAAZ,EAIJ/G,IAJI,CAIC,kBAAsC;MAAA;MAAA,IAApCqF,eAAoC;MAAA,IAAnBqC,aAAmB;;MAC1CrE,OAAO,CAACsE,UAAR,GAAqB;QACnBY,QAAQ,EAAE,OAAI,CAACxC,KAAL,CAAWC,QAAX,CAAoBmC,MAApB,CAA2BK,GADlB;QAEnBZ,UAAU,EAAE;UACVzG,MAAM,EAAE,OAAI,CAAC4E,KAAL,CAAWC,QAAX,CAAoBmC,MAApB,CAA2BhH,MADzB;UAEV0G,MAAM,EAAEH;QAFE;MAFO,CAArB;MAQArE,OAAO,CAACoF,UAAR,GAAqB;QACnBlJ,GAAG,EAAE8F;MADc,CAArB;;MAIA,OAAI,CAAC5F,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAO2D,OAAO,CAACqF,aAAR,EAAP;IACD,CApBI,EAqBJ1I,IArBI,CAqBC,UAAC2I,YAAD,EAAkB;MACtBtF,OAAO,CAACmE,YAAR,GAAuBmB,YAAvB;MACApK,eAAe,CAAC+I,GAAhB,CAAoB,OAApB,EAA0BjE,OAA1B;MAEA,OAAO,iBAAQ7B,GAAR,CAAY,CAACmH,YAAY,CAACjH,KAAb,EAAD,EAAuB,OAAI,CAACoG,cAAL,EAAvB,CAAZ,CAAP;IACD,CA1BI,EA2BJ9H,IA3BI,CA2BC,kBAA6B;MAAA;MAAA,IAA3B2I,YAA2B;MAAA,IAAbC,OAAa;;MACjC,OAAI,CAACnJ,MAAL,CAAYC,IAAZ,CAAiB,uCAAjB;;MAEA,OAAO,OAAI,CAACG,OAAL,CAAa;QAClBf,GAAG,YAAK8J,OAAL,WADe;QAElB9I,MAAM,EAAE,QAFU;QAGlB+C,GAAG,EAAE8F,YAAY,CAACE,MAAb;MAHa,CAAb,CAAP;IAKD,CAnCI,EAoCJ7I,IApCI,CAoCC,UAACC,GAAD,EAAS;MACb,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAO2D,OAAO,CAACyF,kBAAR,CAA2B7I,GAAG,CAACV,GAA/B,CAAP;IACD,CAxCI,EAyCJS,IAzCI,CAyCC,UAACT,GAAD,EAAS;MACb8D,OAAO,CAACmE,YAAR,GAAuBjI,GAAvB;MACAhB,eAAe,CAACuI,MAAhB,CAAuB,OAAvB;;MACA,OAAI,CAACrH,MAAL,CAAYC,IAAZ,CAAiB,kCAAjB;;MAEA,OAAO2D,OAAP;IACD,CA/CI,EAgDJyB,KAhDI,CAgDE,UAACC,MAAD,EAAY;MACjB,OAAI,CAACtF,MAAL,CAAYuF,KAAZ,CAAkB,wCAAlB,EAA4DD,MAA5D;;MAEA,OAAO,iBAAQpF,MAAR,CAAeoF,MAAf,CAAP;IACD,CApDI,CAAP;EAqDD,CA7wB4B;;EA+wB7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEtB,kBA3xB6B,8BA2xBVsF,eA3xBU,EA2xBOhK,UA3xBP,EA2xBmB;IAC9C,IAAMsE,OAAO,GAAG,IAAIgF,gBAAJ,EAAhB;IAEAhF,OAAO,CAACsE,UAAR,GAAqBtE,OAAO,CAACsE,UAAR,GAAqB;MACxCY,QAAQ,EAAEQ,eAAe,CAACpB,UAAhB,CAA2BY,QADG;MAExCX,UAAU,EAAE;QACVzG,MAAM,EAAEpC,UADE;QAEVA,UAAU,EAAVA,UAFU;QAEE;QACZ8I,MAAM,EAAEkB,eAAe,CAACpB,UAAhB,CAA2BC,UAA3B,CAAsCC;MAHpC;IAF4B,CAA1C;IAQAxE,OAAO,CAACoF,UAAR,GAAqBM,eAAe,CAACN,UAArC;IACApF,OAAO,CAACmE,YAAR,GAAuBuB,eAAe,CAACvB,YAAvC;IAEA,OAAOnE,OAAP;EACD,CA1yB4B;EAAA;AAAA,CAAnB,oMA2nBT2F,iBA3nBS,+EAAZ;;eA6yBetK,G"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webex/internal-plugin-encryption",
-  "version": "1.161.0",
+  "version": "2.2.0",
   "description": "",
   "license": "MIT",
   "author": "Ian W. Remmel <iremmel@cisco.com>",
@@ -22,21 +22,22 @@
   "dependencies": {
     "@babel/runtime-corejs2": "^7.14.8",
     "lodash": "^4.17.21",
-    "@webex/webex-core": "1.161.0",
-    "@webex/common": "1.161.0",
+    "@webex/webex-core": "2.2.0",
+    "@webex/common": "2.2.0",
     "node-jose": "^2.0.0",
     "node-scr": "^0.3.0",
-    "@webex/common-timers": "1.161.0",
+    "@webex/common-timers": "2.2.0",
     "node-kms": "^0.4.0",
+    "uuid": "^3.3.2",
     "valid-url": "^1.0.9",
     "asn1js": "^2.0.26",
     "pkijs": "^2.1.84",
     "isomorphic-webcrypto": "^2.3.8",
     "safe-buffer": "^5.2.0",
     "debug": "^3.2.6",
-    "@webex/internal-plugin-device": "1.161.0",
-    "@webex/internal-plugin-mercury": "1.161.0",
-    "@webex/http-core": "1.161.0",
+    "@webex/internal-plugin-device": "2.2.0",
+    "@webex/internal-plugin-mercury": "2.2.0",
+    "@webex/http-core": "2.2.0",
     "envify": "^4.1.0"
   }
 }

package/src/kms.js

@@ -11,6 +11,7 @@ import {WebexPlugin} from '@webex/webex-core';
 import {Context, Request, Response} from 'node-kms';
 import jose from 'node-jose';
 import {omit} from 'lodash';
+import uuid from 'uuid';
 
 import KMSBatcher, {TIMEOUT_SYMBOL} from './kms-batcher';
 import validateKMS, {KMSError} from './kms-certificate-validation';
@@ -250,6 +251,170 @@ const KMS = WebexPlugin.extend({
       });
   },
 
+  /**
+  * @typedef {Object} FetchPublicKeyResponse
+  * @property {number} status 200,400(Bad Request: Request payload missing info),404(Not Found: HSM Public Key not found),501(Not Implemented: This KMS does not support BYOK),502(Bad Gateway: KMS could not communicate with HSM)
+  * @property {UUID} requestId this is should be unique, used for debug.
+  * @property {string} publicKey
+  */
+  /**
+   * get public key from kms
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<FetchPublicKeyResponse>} response of get public key api
+   */
+  fetchPublicKey({assignedOrgId}) {
+    this.logger.info('kms: fetch public key for byok');
+
+    return this.request({
+      method: 'retrieve',
+      uri: '/publicKey',
+      assignedOrgId
+    })
+      .then((res) => {
+        this.logger.info('kms: received public key');
+
+        return res.publicKey;
+      });
+  },
+
+  /**
+  * @typedef {Object} UploadCmkResponse
+  * @property {number} status
+  * @property {UUID} requestId
+  * @property {string} uri
+  * @property {string} keysState
+  */
+  /**
+   * upload master key for one org.
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @param {string} options.customerMasterKey the master key
+   * @returns {Promise.<UploadCmkResponse>} response of upload CMK api
+   */
+  uploadCustomerMasterKey({assignedOrgId, customerMasterKey}) {
+    this.logger.info('kms: upload customer master key for byok');
+
+    return this.request({
+      method: 'create',
+      uri: '/cmk',
+      assignedOrgId,
+      customerMasterKey,
+      requestId: uuid.v4()
+    }).then((res) => {
+      this.logger.info('kms: finish to upload customer master key');
+
+      return res;
+    });
+  },
+
+  /**
+   * get all customer master keys for one org.
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api
+   */
+  listAllCustomerMasterKey({assignedOrgId}) {
+    this.logger.info('kms: get all customer master keys for byok');
+
+    return this.request({
+      method: 'retrieve',
+      uri: '/cmk',
+      assignedOrgId,
+      requestId: uuid.v4()
+    }).then((res) => {
+      this.logger.info('kms: finish to get all customer master keys');
+
+      return res;
+    });
+  },
+
+  /**
+  * @typedef {Object} ActivateCmkResponse
+  * @property {number} status
+  * @property {UUID} requestId
+  * @property {Array<CMK>} customerMasterKeys
+  */
+  /**
+   *
+   * @typedef {Object} CMK
+   * @property {string} usageState
+   * @property {UUID} assignedOrgId
+   * @property {string} uri
+   * @property {string} source
+   * @property {Date | undefined} stateUpdatedOn
+   * @property {Date | undefined} rotation
+   */
+  /**
+   * change one customer master key state for one org.
+   * delete pending key, then the keyState should be 'removedclean';
+   * active pending key, then the keyState should be 'active';
+   *
+   * @param {Object} options
+   * @param {string} options.keyId the id of one customer master key, it should be a url
+   * @param {string} options.keyState one of the following: PENDING, RECOVERING,ACTIVE,REVOKED,DEACTIVATED,REENCRYPTING,RETIRED,DELETED,DISABLED,REMOVEDCLEAN,REMOVEDDIRTY;
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api
+   */
+  changeCustomerMasterKeyState({keyId, keyState, assignedOrgId}) {
+    this.logger.info('kms: change one customer master key state for byok');
+
+    return this.request({
+      method: 'update',
+      uri: keyId,
+      keyState,
+      assignedOrgId,
+      requestId: uuid.v4()
+    }).then((res) => {
+      this.logger.info('kms: finish to change the customer master key state to {}', keyState);
+
+      return res;
+    });
+  },
+
+  /**
+   * this is for test case. it will delete all CMKs, no matter what their status is. This is mainly for test purpose
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<{status, requestId}>}
+   */
+  deleteAllCustomerMasterKeys({assignedOrgId}) {
+    this.logger.info('kms: delete all customer master keys at the same time');
+
+    return this.request({
+      method: 'delete',
+      uri: '/cmk',
+      assignedOrgId,
+      requestId: uuid.v4()
+    }).then((res) => {
+      this.logger.info('kms: finish to delete all customer master keys');
+
+      return res;
+    });
+  },
+
+  /**
+   * return to use global master key for one org.
+   * @param {Object} options
+   * @param {UUID} options.assignedOrgId the orgId
+   * @returns {Promise.<ActivateCmkResponse>} response of activate CMK api
+   */
+  useGlobalMasterKey({assignedOrgId}) {
+    this.logger.info('kms: return to use global master key');
+
+    return this.request({
+      method: 'update',
+      uri: 'default',
+      keyState: 'ACTIVE',
+      assignedOrgId,
+      requestId: uuid.v4()
+    }).then((res) => {
+      this.logger.info('kms: finish to return to global master key');
+
+      return res;
+    });
+  },
+
   /**
    * Fetches the specified key from the kms
    * @param {Object} options

package/test/integration/spec/kms.js

@@ -1,3 +1,4 @@
+/* eslint-env browser */
 /*!
  * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
  */
@@ -9,6 +10,7 @@ import sinon from 'sinon';
 import WebexCore from '@webex/webex-core';
 import testUsers from '@webex/test-helper-test-users';
 import uuid from 'uuid';
+import {skipInBrowser} from '@webex/test-helper-mocha';
 
 const debug = require('debug')('kms');
 
@@ -17,7 +19,30 @@ describe('Encryption', function () {
   describe('KMS', () => {
     let mccoy, webex, spock;
 
-    before('create test user', () => testUsers.create({count: 2})
+    function str2ab(str) {
+      const buf = new ArrayBuffer(str.length);
+      const bufView = new Uint8Array(buf);
+
+      for (let i = 0, strLen = str.length; i < strLen; i += 1) {
+        bufView[i] = str.charCodeAt(i);
+      }
+
+      return buf;
+    }
+
+    function arrayBufferToBase64(buffer) {
+      let binary = '';
+      const bytes = new Uint8Array(buffer);
+      const len = bytes.byteLength;
+
+      for (let i = 0; i < len; i += 1) {
+        binary += String.fromCharCode(bytes[i]);
+      }
+
+      return window.btoa(binary);
+    }
+
+    before('create test user', () => testUsers.create({count: 2, config: {roles: [{name: 'id_full_admin'}]}})
       .then((users) => {
         spock = users[0];
         webex = new WebexCore({
@@ -314,6 +339,65 @@ describe('Encryption', function () {
         }));
     });
 
+    describe('upload customer master key', () => {
+      let uploadedkeyId;
+
+      /* eslint-disable no-unused-expressions */
+      skipInBrowser(it)('upload customer master key', () => (webex.internal.encryption.kms.deleteAllCustomerMasterKeys({assignedOrgId: spock.orgId})
+        .then(() => webex.internal.encryption.kms.fetchPublicKey({assignedOrgId: spock.orgId}))
+        .then((publicKey) => {
+          assert.isNotEmpty(publicKey);
+          const pemHeader = '-----BEGIN PUBLIC KEY-----';
+          const pemFooter = '-----END PUBLIC KEY-----';
+          const publicContent = publicKey.substring(pemHeader.length, publicKey.length - pemFooter.length);
+          const binaryDerString = window.atob(publicContent);
+          // convert from a binary string to an ArrayBuffer
+          const binaryDer = str2ab(binaryDerString);
+
+          return window.crypto.subtle.importKey(
+            'spki',
+            binaryDer,
+            {
+              name: 'RSA-OAEP',
+              hash: 'SHA-256'
+            },
+            true,
+            ['encrypt']
+          );
+        })
+        .then((publicKey) => {
+          const buf = window.crypto.getRandomValues(new Uint8Array(16));
+
+          return window.crypto.subtle.encrypt(
+            {
+              name: 'RSA-OAEP'
+            },
+            publicKey,
+            buf
+          );
+        })
+        .then((encryptedData) => webex.internal.encryption.kms.uploadCustomerMasterKey({assignedOrgId: spock.orgId, customerMasterKey: arrayBufferToBase64(encryptedData)}))
+        .then((uploadRes) => {
+          uploadedkeyId = uploadRes.customerMasterKeys[0].uri;
+
+          return webex.internal.encryption.kms.listAllCustomerMasterKey({assignedOrgId: spock.orgId});
+        })
+        .then((listCmksRes) => {
+          const cmks = listCmksRes.customerMasterKeys;
+          const uploadedCmk = cmks.find((cmk) => cmk.uri === uploadedkeyId);
+
+          expect(uploadedCmk).to.not.be.null;
+
+          return webex.internal.encryption.kms.changeCustomerMasterKeyState({keyId: uploadedkeyId, keyState: 'ACTIVE', assignedOrgId: spock.orgId});
+        })
+        .then((activeRes) => {
+          expect(activeRes.customerMasterKeys[0].usageState).to.have.string('ACTIVE');
+
+          // return webex.internal.encryption.kms.useGlobalMasterKey({assignedOrgId: spock.orgId});
+          return webex.internal.encryption.kms.deleteAllCustomerMasterKeys({assignedOrgId: spock.orgId});
+        })));
+    });
+
     describe('#fetchKey()', () => {
       let key;