@webex/internal-plugin-encryption 3.0.0-beta.4 → 3.0.0-beta.400

package/dist/kms.js.map

@@ -1 +1 @@
-{"version":3,"names":["contexts","kmsDetails","partialContexts","consoleDebug","require","KMS","WebexPlugin","extend","oneFlight","keyFactory","uri","onBehalfOf","namespace","children","batcher","KMSBatcher","bindKey","kro","kroUri","key","keyUri","logger","info","reject","Error","request","method","resourceUri","then","res","createResource","userIds","keyUris","keys","reduce","uris","k","push","length","resource","addAuthorization","authIds","concat","authorizations","listAuthorizations","removeAuthorization","authId","userId","querystring","stringify","createUnboundKeys","count","all","map","asKey","fetchPublicKey","assignedOrgId","publicKey","uploadCustomerMasterKey","customerMasterKey","requestId","uuid","v4","listAllCustomerMasterKey","changeCustomerMasterKeyState","keyId","keyState","deleteAllCustomerMasterKeys","useGlobalMasterKey","fetchKey","ping","jose","JWK","jwk","prepareRequest","payload","isECDHRequest","includes","resolve","get","_getContext","context","req","Request","requestContext","_contextOnBehalfOf","wrap","serverKey","process","env","NODE_ENV","util","inspect","JSON","parse","depth","processKmsMessageEvent","event","encryption","kmsMessages","kmsMessage","index","_isECDHEMessage","isECDHMessage","Response","unwrap","catch","reason","error","stack","decryptKmsMessage","body","_getKMSStaticPubKey","kmsStaticPubKey","fields","split","header","base64url","decode","kid","timeout","config","kmsInitialTimeout","webex","internal","mercury","connect","TIMEOUT_SYMBOL","status","statusCode","message","match","warn","KMSError","trigger","ecdhMaxTimeout","nextTimeout","kmsMaxTimeout","delete","_getAuthorization","credentials","getUserToken","token","access_token","promise","_prepareContext","set","expiresIn","ephemeralKey","expirationDate","safeSetTimeout","authorization","clientInfo","credential","bearer","_getKMSCluster","_getKMSDetails","kmsCluster","details","service","device","rsaPublicKey","Context","validateKMS","caroots","clientId","url","serverInfo","createECDHKey","localECDHKey","cluster","toJSON","deriveEphemeralKey","originalContext"],"sources":["kms.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport querystring from 'querystring';\nimport util from 'util';\n\nimport {safeSetTimeout} from '@webex/common-timers';\nimport {oneFlight} from '@webex/common';\nimport {WebexPlugin} from '@webex/webex-core';\nimport {Context, Request, Response} from 'node-kms';\nimport jose from 'node-jose';\nimport {omit} from 'lodash';\nimport uuid from 'uuid';\n\nimport KMSBatcher, {TIMEOUT_SYMBOL} from './kms-batcher';\nimport validateKMS, {KMSError} from './kms-certificate-validation';\n\nconst contexts = new WeakMap();\nconst kmsDetails = new WeakMap();\nconst partialContexts = new WeakMap();\n\nconst consoleDebug = require('debug')('kms');\n\n/**\n * @class\n */\nconst KMS = WebexPlugin.extend({\n  namespace: 'Encryption',\n\n  children: {\n    batcher: KMSBatcher\n  },\n\n  /**\n   * Binds a key to a resource\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro\n   * @param {string} options.kroUri\n   * @param {Key} options.key\n   * @param {string} options.keyUri\n   * @returns {Promise<Key>}\n   */\n  bindKey({\n    kro, kroUri, key, keyUri\n  }) {\n    kroUri = kroUri || kro.uri;\n    keyUri = keyUri || key.uri;\n\n    this.logger.info('kms: binding key to resource');\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    /* istanbul ignore if */\n    if (!keyUri) {\n      return Promise.reject(new Error('`key` or `keyUri` is required'));\n    }\n\n    return this.request({\n      method: 'update',\n      resourceUri: kroUri,\n      uri: keyUri\n    })\n      .then((res) => {\n        this.logger.info('kms: bound key to resource');\n\n        return res.key;\n      });\n  },\n\n  /**\n   * Creates a new KMS Resource\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.keyUris\n   * @param {Key} options.key\n   * @param {Array<Keys>} options.keys\n   * @returns {Promise<KMSResourceObject>}\n   */\n  createResource({\n    userIds, keyUris, key, keys\n  }) {\n    keyUris = keyUris || [];\n    /* istanbul ignore if */\n    if (keys) {\n      keyUris = keys.reduce((uris, k) => {\n        uris.push(k.uri);\n\n        return uris;\n      }, keyUris);\n    }\n\n    /* istanbul ignore else */\n    if (key) {\n      keyUris.push(key.uri);\n    }\n\n    /* istanbul ignore if */\n    if (keyUris.length === 0) {\n      return Promise.reject(new Error('Cannot create KMS Resource without at least one keyUri'));\n    }\n\n    this.logger.info('kms: creating resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/resources',\n      userIds,\n      keyUris\n    })\n      .then((res) => {\n        this.logger.info('kms: created resource');\n\n        return res.resource;\n      });\n  },\n\n  /**\n   * Authorizes a user or KRO to a KRO\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.authIds interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  addAuthorization({\n    userIds, authIds, kro, kroUri\n  }) {\n    userIds = userIds || [];\n    kroUri = kroUri || kro.uri;\n\n    if (authIds) {\n      userIds = userIds.concat(authIds);\n    }\n\n    /* istanbul ignore if */\n    if (userIds.length === 0) {\n      return Promise.reject(new Error('Cannot add authorization without userIds or authIds'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: adding authorization to kms resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/authorizations',\n      resourceUri: kroUri,\n      userIds\n    })\n      .then((res) => {\n        this.logger.info('kms: added authorization');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Retrieve a list of users that have been authorized to the KRO\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Array<authId>}\n   */\n  listAuthorizations({kro, kroUri}) {\n    kroUri = kroUri || kro.uri;\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    return this.request({\n      method: 'retrieve',\n      uri: `${kroUri}/authorizations`\n    })\n      .then((res) => {\n        this.logger.info('kms: retrieved authorization list');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Deauthorizes a user or KRO from a KRO\n   * @param {Object} options\n   * @param {string} options.userId\n   * @param {string} options.authId interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  removeAuthorization({\n    authId, userId, kro, kroUri\n  }) {\n    authId = authId || userId;\n    kroUri = kroUri || kro.uri;\n\n    /* istanbul ignore if */\n    if (!authId) {\n      return Promise.reject(new Error('Cannot remove authorization without authId'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: removing authorization from kms resource');\n\n    return this.request({\n      method: 'delete',\n      uri: `${kroUri}/authorizations?${querystring.stringify({authId})}`\n    })\n      .then((res) => {\n        this.logger.info('kms: removed authorization');\n\n        return res.authorizations;\n      });\n  },\n\n  /**\n   * Requests `count` unbound keys from the kms\n   * @param {Object} options\n   * @param {Number} options.count\n   * @returns {Array<Key>}\n   */\n  createUnboundKeys({count}) {\n    this.logger.info(`kms: request ${count} unbound keys`);\n\n    /* istanbul ignore if */\n    if (!count) {\n      return Promise.reject(new Error('`options.count` is required'));\n    }\n\n    return this.request({\n      method: 'create',\n      uri: '/keys',\n      count\n    })\n      .then((res) => {\n        this.logger.info('kms: received unbound keys');\n\n        return Promise.all(res.keys.map(this.asKey));\n      });\n  },\n\n  /**\n  * @typedef {Object} FetchPublicKeyResponse\n  * @property {number} status 200,400(Bad Request: Request payload missing info),404(Not Found: HSM Public Key not found),501(Not Implemented: This KMS does not support BYOK),502(Bad Gateway: KMS could not communicate with HSM)\n  * @property {UUID} requestId this is should be unique, used for debug.\n  * @property {string} publicKey\n  */\n  /**\n   * get public key from kms\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<FetchPublicKeyResponse>} response of get public key api\n   */\n  fetchPublicKey({assignedOrgId}) {\n    this.logger.info('kms: fetch public key for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: '/publicKey',\n      assignedOrgId\n    })\n      .then((res) => {\n        this.logger.info('kms: received public key');\n\n        return res.publicKey;\n      });\n  },\n\n  /**\n  * @typedef {Object} UploadCmkResponse\n  * @property {number} status\n  * @property {UUID} requestId\n  * @property {string} uri\n  * @property {string} keysState\n  */\n  /**\n   * upload master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {string} options.customerMasterKey the master key\n   * @returns {Promise.<UploadCmkResponse>} response of upload CMK api\n   */\n  uploadCustomerMasterKey({assignedOrgId, customerMasterKey}) {\n    this.logger.info('kms: upload customer master key for byok');\n\n    return this.request({\n      method: 'create',\n      uri: '/cmk',\n      assignedOrgId,\n      customerMasterKey,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to upload customer master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * get all customer master keys for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  listAllCustomerMasterKey({assignedOrgId}) {\n    this.logger.info('kms: get all customer master keys for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to get all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n  * @typedef {Object} ActivateCmkResponse\n  * @property {number} status\n  * @property {UUID} requestId\n  * @property {Array<CMK>} customerMasterKeys\n  */\n  /**\n   *\n   * @typedef {Object} CMK\n   * @property {string} usageState\n   * @property {UUID} assignedOrgId\n   * @property {string} uri\n   * @property {string} source\n   * @property {Date | undefined} stateUpdatedOn\n   * @property {Date | undefined} rotation\n   */\n  /**\n   * change one customer master key state for one org.\n   * delete pending key, then the keyState should be 'removedclean';\n   * active pending key, then the keyState should be 'active';\n   *\n   * @param {Object} options\n   * @param {string} options.keyId the id of one customer master key, it should be a url\n   * @param {string} options.keyState one of the following: PENDING, RECOVERING,ACTIVE,REVOKED,DEACTIVATED,REENCRYPTING,RETIRED,DELETED,DISABLED,REMOVEDCLEAN,REMOVEDDIRTY;\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  changeCustomerMasterKeyState({keyId, keyState, assignedOrgId}) {\n    this.logger.info('kms: change one customer master key state for byok');\n\n    return this.request({\n      method: 'update',\n      uri: keyId,\n      keyState,\n      assignedOrgId,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to change the customer master key state to {}', keyState);\n\n      return res;\n    });\n  },\n\n  /**\n   * this is for test case. it will delete all CMKs, no matter what their status is. This is mainly for test purpose\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<{status, requestId}>}\n   */\n  deleteAllCustomerMasterKeys({assignedOrgId}) {\n    this.logger.info('kms: delete all customer master keys at the same time');\n\n    return this.request({\n      method: 'delete',\n      uri: '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to delete all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n   * return to use global master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of activate CMK api\n   */\n  useGlobalMasterKey({assignedOrgId}) {\n    this.logger.info('kms: return to use global master key');\n\n    return this.request({\n      method: 'update',\n      uri: 'default',\n      keyState: 'ACTIVE',\n      assignedOrgId,\n      requestId: uuid.v4()\n    }).then((res) => {\n      this.logger.info('kms: finish to return to global master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * Fetches the specified key from the kms\n   * @param {Object} options\n   * @param {string} options.uri\n   * @param {string} options.onBehalfOf The id of a user, upon whose behalf, the key is to be retrieved or undefined if retrieval is for the active user\n   * @returns {Promise<Key>}\n   */\n  // Ideally, this would be done via the kms batcher, but other than request id,\n  // there isn't any other userful key in a kms response to match it to a\n  // request. as such, we need the batcher to group requests, but one flight to\n  // make sure we don't make the same request multiple times.\n  @oneFlight({\n    keyFactory: ({uri, onBehalfOf}) => `${uri}/${onBehalfOf}`\n  })\n  fetchKey({uri, onBehalfOf}) {\n    /* istanbul ignore if */\n    if (!uri) {\n      return Promise.reject(new Error('`options.uri` is required'));\n    }\n\n    this.logger.info('kms: fetching key');\n\n    return this.request({\n      method: 'retrieve',\n      uri\n    }, {onBehalfOf})\n      .then((res) => {\n        this.logger.info('kms: fetched key');\n\n        return this.asKey(res.key);\n      });\n  },\n\n  /**\n   * Pings the kms. Mostly for testing\n   * @returns {Promise}\n   */\n  ping() {\n    return this.request({\n      method: 'update',\n      uri: '/ping'\n    });\n  },\n\n  /**\n   * Ensures a key obect is Key instance\n   * @param {Object} key\n   * @returns {Promise<Key>}\n   */\n  asKey(key) {\n    return jose.JWK.asKey(key.jwk)\n      .then((jwk) => {\n        key.jwk = jwk;\n\n        return key;\n      });\n  },\n\n  /**\n   * Adds appropriate metadata to the KMS request\n   * @param {Object} payload\n   * @param {Object} onBehalfOf Optional parameter to prepare the request on behalf of another user\n   * @returns {Promise<KMS.Request>}\n   */\n  prepareRequest(payload, onBehalfOf) {\n    const isECDHRequest = payload.method === 'create' && payload.uri.includes('/ecdhe');\n\n    return Promise.resolve(isECDHRequest ? partialContexts.get(this) : this._getContext())\n      .then((context) => {\n        this.logger.info(`kms: wrapping ${isECDHRequest ? 'ephemeral key' : 'kms'} request`);\n        const req = new Request(payload);\n        let requestContext = context;\n\n        if (onBehalfOf) {\n          requestContext = this._contextOnBehalfOf(context, onBehalfOf);\n        }\n\n        return req.wrap(requestContext, {serverKey: isECDHRequest})\n          .then(() => {\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: request payload', util.inspect(omit(JSON.parse(JSON.stringify(req)), 'wrapped'), {depth: null}));\n            }\n\n            return req;\n          });\n      });\n  },\n\n  /**\n   * Accepts a kms message event, decrypts it, and passes it to the batcher\n   * @param {Object} event\n   * @returns {Promise<Object>}\n   */\n  processKmsMessageEvent(event) {\n    this.logger.info('kms: received kms message');\n\n    return Promise.all(event.encryption.kmsMessages.map((kmsMessage, index) => this._isECDHEMessage(kmsMessage)\n      .then((isECDHMessage) => {\n        this.logger.info(`kms: received ${isECDHMessage ? 'ecdhe' : 'normal'} message`);\n        const res = new Response(kmsMessage);\n\n        return Promise.resolve(isECDHMessage ? partialContexts.get(this) : contexts.get(this))\n          // eslint-disable-next-line max-nested-callbacks\n          .then((context) => res.unwrap(context))\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => {\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: response payload', util.inspect(omit(JSON.parse(JSON.stringify(res)), 'wrapped'), {depth: null}));\n            }\n          })\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => { event.encryption.kmsMessages[index] = res; })\n          // eslint-disable-next-line max-nested-callbacks\n          .then(() => res);\n      })))\n      .then(() => this.batcher.processKmsMessageEvent(event))\n      .catch((reason) => {\n        this.logger.error('kms: decrypt failed', reason.stack);\n\n        return Promise.reject(reason);\n      })\n      .then(() => event);\n  },\n\n  /**\n   * Decrypts a kms message\n   * @param {Object} kmsMessage\n   * @returns {Promise<Object>}\n   */\n  decryptKmsMessage(kmsMessage) {\n    const res = new Response(kmsMessage);\n\n    return contexts.get(this)\n      .then((context) => res.unwrap(context))\n      .then(() => res.body);\n  },\n\n  /**\n   * Determines if the kms message is an ecdhe message or a normal message\n   * @param {Object} kmsMessage\n   * @returns {Promise<boolean>}\n   */\n  _isECDHEMessage(kmsMessage) {\n    return this._getKMSStaticPubKey()\n      .then((kmsStaticPubKey) => {\n        const fields = kmsMessage.split('.');\n\n        if (fields.length !== 3) {\n          return false;\n        }\n\n        const header = JSON.parse(jose.util.base64url.decode(fields[0]));\n\n        return header.kid === kmsStaticPubKey.kid;\n      });\n  },\n\n  /**\n   * Sends a request to the kms\n   * @param {Object} payload\n   * @param {Object} options\n   * @param {Number} options.timeout (internal)\n   * @param {string} options.onBehalfOf Run the request on behalf of another user (UUID), used in compliance scenarios\n   * @returns {Promise<Object>}\n   */\n  request(payload, {timeout, onBehalfOf} = {}) {\n    timeout = timeout || this.config.kmsInitialTimeout;\n\n    // Note: this should only happen when we're using the async kms batcher;\n    // once we implement the sync batcher, this'll need to be smarter.\n    return this.webex.internal.mercury.connect()\n      .then(() => this.prepareRequest(payload, onBehalfOf))\n      .then((req) => {\n        req[TIMEOUT_SYMBOL] = timeout;\n\n        return this.batcher.request(req);\n      })\n      // High complexity is due to attempt at test mode resiliency\n      // eslint-disable-next-line complexity\n      .catch((reason) => {\n        if (process.env.NODE_ENV === 'test' && (reason.status === 403 || reason.statusCode === 403) && reason.message.match(/Failed to resolve authorization token in KmsMessage request for user/)) {\n          this.logger.warn('kms: rerequested key due to test-mode kms auth failure');\n\n          return this.request(payload, {onBehalfOf});\n        }\n\n        // KMS Error. Notify the user\n        if (reason instanceof KMSError) {\n          this.webex.trigger('client:InvalidRequestError');\n\n          return Promise.reject(reason);\n        }\n\n        // Ideally, most or all of the code below would go in kms-batcher, but\n        // but batching needs at least one more round of refactoring for that to\n        // work.\n        if (!reason.statusCode && !reason.status) {\n          /* istanbul ignore else */\n          if (process.env.NODE_ENV !== 'production') {\n            /* istanbul ignore next: reason.stack vs stack difficult to control in test */\n            this.logger.info('kms: request error', reason.stack || reason);\n          }\n\n          consoleDebug(`timeout ${timeout}`);\n          timeout *= 2;\n\n          if (timeout >= this.config.ecdhMaxTimeout) {\n            this.logger.info('kms: exceeded maximum KMS request retries');\n\n            return Promise.reject(reason);\n          }\n\n          // Peek ahead to make sure we don't reset the timeout if the next timeout\n          // will exceed the maximum timeout for renegotiating ECDH keys.\n          const nextTimeout = timeout * 2;\n\n          if (timeout >= this.config.kmsMaxTimeout && nextTimeout < this.config.ecdhMaxTimeout) {\n            this.logger.info('kms: exceeded maximum KMS request retries; negotiating new ecdh key');\n\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              this.logger.info('kms: timeout/maxtimeout', timeout, this.config.kmsMaxTimeout);\n            }\n\n            contexts.delete(this);\n            timeout = 0;\n          }\n\n          return this.request(payload, {timeout, onBehalfOf});\n        }\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<string>}\n   */\n  _getAuthorization() {\n    return this.webex.credentials.getUserToken('spark:kms')\n      .then((token) => token.access_token);\n  },\n\n  @oneFlight\n  /**\n   * @private\n   * @param {String} onBehalfOf create context on behalf of another user, undefined when this is not necessary\n   * @returns {Promise<Object>}\n   */\n  _getContext() {\n    let promise = contexts.get(this);\n\n    if (!promise) {\n      promise = this._prepareContext();\n      contexts.set(this, promise);\n      promise.then((context) => {\n        const expiresIn = context.ephemeralKey.expirationDate - Date.now() - 30000;\n\n        safeSetTimeout(() => contexts.delete(this), expiresIn);\n      });\n    }\n\n    return Promise.all([\n      promise,\n      this._getAuthorization()\n    ])\n      .then(([context, authorization]) => {\n        context.clientInfo.credential.bearer = authorization;\n\n        return context;\n      });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSCluster() {\n    this.logger.info('kms: retrieving KMS cluster');\n\n    return this._getKMSDetails()\n      .then(({kmsCluster}) => kmsCluster);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSDetails() {\n    let details = kmsDetails.get(this);\n\n    if (!details) {\n      this.logger.info('kms: fetching KMS details');\n      details = this.webex.request({\n        service: 'encryption',\n        resource: `/kms/${this.webex.internal.device.userId}`\n      })\n        .then((res) => {\n          this.logger.info('kms: fetched KMS details');\n          const {body} = res;\n\n          body.rsaPublicKey = JSON.parse(body.rsaPublicKey);\n\n          return body;\n        })\n        .catch((reason) => {\n          this.logger.error('kms: failed to fetch KMS details', reason);\n\n          return Promise.reject(reason);\n        });\n\n      kmsDetails.set(this, details);\n    }\n\n    return details;\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSStaticPubKey() {\n    this.logger.info('kms: retrieving KMS static public key');\n\n    return this._getKMSDetails()\n      .then(({rsaPublicKey}) => rsaPublicKey);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _prepareContext() {\n    this.logger.info('kms: creating context');\n    const context = new Context();\n\n    return Promise.all([\n      this._getKMSStaticPubKey().then(validateKMS(this.config.caroots)),\n      this._getAuthorization()\n    ])\n      .then(([kmsStaticPubKey, authorization]) => {\n        context.clientInfo = {\n          clientId: this.webex.internal.device.url,\n          credential: {\n            userId: this.webex.internal.device.userId,\n            bearer: authorization\n          }\n        };\n\n        context.serverInfo = {\n          key: kmsStaticPubKey\n        };\n\n        this.logger.info('kms: creating local ephemeral key');\n\n        return context.createECDHKey();\n      })\n      .then((localECDHKey) => {\n        context.ephemeralKey = localECDHKey;\n        partialContexts.set(this, context);\n\n        return Promise.all([localECDHKey.asKey(), this._getKMSCluster()]);\n      })\n      .then(([localECDHKey, cluster]) => {\n        this.logger.info('kms: submitting ephemeral key request');\n\n        return this.request({\n          uri: `${cluster}/ecdhe`,\n          method: 'create',\n          jwk: localECDHKey.toJSON()\n        });\n      })\n      .then((res) => {\n        this.logger.info('kms: deriving final ephemeral key');\n\n        return context.deriveEphemeralKey(res.key);\n      })\n      .then((key) => {\n        context.ephemeralKey = key;\n        partialContexts.delete(this);\n        this.logger.info('kms: derived final ephemeral key');\n\n        return context;\n      })\n      .catch((reason) => {\n        this.logger.error('kms: failed to negotiate ephemeral key', reason);\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * KMS 'retrieve' requests can be made on behalf of another user. This is useful\n   * for scenarios such as eDiscovery. i.e. Where an authorized compliance officer is\n   * entitled to retrieve content generated by any organisational user.\n   * As the KMSContext is cached, updating it will affect separate requests. Hence when\n   * making a request onBehalfOf another user create a new context for just this request.\n   * However this context will be 'light' as it only needs to change one field.\n   * @param {Object} originalContext - The base context to 'copy'\n   * @param {String} onBehalfOf - The user specified in the new context\n   * @returns {Context} A 'copy' of the existing context with a new user specified\n   * @private\n   */\n  _contextOnBehalfOf(originalContext, onBehalfOf) {\n    const context = new Context();\n\n    context.clientInfo = context.clientInfo = {\n      clientId: originalContext.clientInfo.clientId,\n      credential: {\n        userId: onBehalfOf,\n        onBehalfOf, // Supports running onBehalfOf self. i.e. A CO which calls onBehalfOf with CO.id.\n        bearer: originalContext.clientInfo.credential.bearer\n      }\n    };\n    context.serverInfo = originalContext.serverInfo;\n    context.ephemeralKey = originalContext.ephemeralKey;\n\n    return context;\n  }\n});\n\nexport default KMS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;;AACA;;AAEA;;AACA;;AACA;;AACA;;AACA;;AAEA;;AAEA;;AACA;;;;;;;;AAEA,IAAMA,QAAQ,GAAG,sBAAjB;AACA,IAAMC,UAAU,GAAG,sBAAnB;AACA,IAAMC,eAAe,GAAG,sBAAxB;;AAEA,IAAMC,YAAY,GAAGC,OAAO,CAAC,OAAD,CAAP,CAAiB,KAAjB,CAArB;AAEA;AACA;AACA;;;AACA,IAAMC,GAAG,GAAGC,sBAAA,CAAYC,MAAZ,SAiZT,IAAAC,iBAAA,EAAU;EACTC,UAAU,EAAE;IAAA,IAAEC,GAAF,QAAEA,GAAF;IAAA,IAAOC,UAAP,QAAOA,UAAP;IAAA,iBAA0BD,GAA1B,cAAiCC,UAAjC;EAAA;AADH,CAAV,CAjZS,UAAmB;EAC7BC,SAAS,EAAE,YADkB;EAG7BC,QAAQ,EAAE;IACRC,OAAO,EAAEC;EADD,CAHmB;;EAO7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,OAhB6B,0BAkB1B;IAAA;;IAAA,IADDC,GACC,SADDA,GACC;IAAA,IADIC,MACJ,SADIA,MACJ;IAAA,IADYC,GACZ,SADYA,GACZ;IAAA,IADiBC,MACjB,SADiBA,MACjB;IACDF,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IACAU,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACT,GAAvB;IAEA,KAAKW,MAAL,CAAYC,IAAZ,CAAiB,8BAAjB;IAEA;;IACA,IAAI,CAACJ,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACJ,MAAL,EAAa;MACX,OAAO,iBAAQG,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBC,WAAW,EAAET,MAFK;MAGlBR,GAAG,EAAEU;IAHa,CAAb,EAKJQ,IALI,CAKC,UAACC,GAAD,EAAS;MACb,KAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAOO,GAAG,CAACV,GAAX;IACD,CATI,CAAP;EAUD,CA5C4B;;EA8C7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEW,cAvD6B,iCAyD1B;IAAA;;IAAA,IADDC,OACC,SADDA,OACC;IAAA,IADQC,OACR,SADQA,OACR;IAAA,IADiBb,GACjB,SADiBA,GACjB;IAAA,IADsBc,IACtB,SADsBA,IACtB;IACDD,OAAO,GAAGA,OAAO,IAAI,EAArB;IACA;;IACA,IAAIC,IAAJ,EAAU;MACRD,OAAO,GAAGC,IAAI,CAACC,MAAL,CAAY,UAACC,IAAD,EAAOC,CAAP,EAAa;QACjCD,IAAI,CAACE,IAAL,CAAUD,CAAC,CAAC1B,GAAZ;QAEA,OAAOyB,IAAP;MACD,CAJS,EAIPH,OAJO,CAAV;IAKD;IAED;;;IACA,IAAIb,GAAJ,EAAS;MACPa,OAAO,CAACK,IAAR,CAAalB,GAAG,CAACT,GAAjB;IACD;IAED;;;IACA,IAAIsB,OAAO,CAACM,MAAR,KAAmB,CAAvB,EAA0B;MACxB,OAAO,iBAAQf,MAAR,CAAe,IAAIC,KAAJ,CAAU,wDAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,wBAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,YAFa;MAGlBqB,OAAO,EAAPA,OAHkB;MAIlBC,OAAO,EAAPA;IAJkB,CAAb,EAMJJ,IANI,CAMC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB;;MAEA,OAAOO,GAAG,CAACU,QAAX;IACD,CAVI,CAAP;EAWD,CA3F4B;;EA6F7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,gBAtG6B,mCAwG1B;IAAA;;IAAA,IADDT,OACC,SADDA,OACC;IAAA,IADQU,OACR,SADQA,OACR;IAAA,IADiBxB,GACjB,SADiBA,GACjB;IAAA,IADsBC,MACtB,SADsBA,MACtB;IACDa,OAAO,GAAGA,OAAO,IAAI,EAArB;IACAb,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;;IAEA,IAAI+B,OAAJ,EAAa;MACXV,OAAO,GAAGA,OAAO,CAACW,MAAR,CAAeD,OAAf,CAAV;IACD;IAED;;;IACA,IAAIV,OAAO,CAACO,MAAR,KAAmB,CAAvB,EAA0B;MACxB,OAAO,iBAAQf,MAAR,CAAe,IAAIC,KAAJ,CAAU,qDAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACN,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,2CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,iBAFa;MAGlBiB,WAAW,EAAET,MAHK;MAIlBa,OAAO,EAAPA;IAJkB,CAAb,EAMJH,IANI,CAMC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,0BAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CAVI,CAAP;EAWD,CAvI4B;;EAyI7B;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,kBAhJ6B,qCAgJK;IAAA;;IAAA,IAAd3B,GAAc,SAAdA,GAAc;IAAA,IAATC,MAAS,SAATA,MAAS;IAChCA,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IACA;;IACA,IAAI,CAACQ,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,YAAKQ,MAAL;IAFe,CAAb,EAIJU,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CARI,CAAP;EASD,CAhK4B;;EAkK7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEE,mBA3K6B,sCA6K1B;IAAA;;IAAA,IADDC,MACC,SADDA,MACC;IAAA,IADOC,MACP,SADOA,MACP;IAAA,IADe9B,GACf,SADeA,GACf;IAAA,IADoBC,MACpB,SADoBA,MACpB;IACD4B,MAAM,GAAGA,MAAM,IAAIC,MAAnB;IACA7B,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAvB;IAEA;;IACA,IAAI,CAACoC,MAAL,EAAa;MACX,OAAO,iBAAQvB,MAAR,CAAe,IAAIC,KAAJ,CAAU,4CAAV,CAAf,CAAP;IACD;IAED;;;IACA,IAAI,CAACN,MAAL,EAAa;MACX,OAAO,iBAAQK,MAAR,CAAe,IAAIC,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,+CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,YAAKQ,MAAL,6BAA8B8B,oBAAA,CAAYC,SAAZ,CAAsB;QAACH,MAAM,EAANA;MAAD,CAAtB,CAA9B;IAFe,CAAb,EAIJlB,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAOO,GAAG,CAACc,cAAX;IACD,CARI,CAAP;EASD,CAtM4B;;EAwM7B;AACF;AACA;AACA;AACA;AACA;EACEO,iBA9M6B,oCA8MF;IAAA;;IAAA,IAARC,KAAQ,SAARA,KAAQ;IACzB,KAAK9B,MAAL,CAAYC,IAAZ,wBAAiC6B,KAAjC;IAEA;;IACA,IAAI,CAACA,KAAL,EAAY;MACV,OAAO,iBAAQ5B,MAAR,CAAe,IAAIC,KAAJ,CAAU,6BAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKC,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,OAFa;MAGlByC,KAAK,EAALA;IAHkB,CAAb,EAKJvB,IALI,CAKC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4BAAjB;;MAEA,OAAO,iBAAQ8B,GAAR,CAAYvB,GAAG,CAACI,IAAJ,CAASoB,GAAT,CAAa,MAAI,CAACC,KAAlB,CAAZ,CAAP;IACD,CATI,CAAP;EAUD,CAhO4B;;EAkO7B;AACF;AACA;AACA;AACA;AACA;;EACE;AACF;AACA;AACA;AACA;AACA;EACEC,cA9O6B,iCA8OG;IAAA;;IAAA,IAAhBC,aAAgB,SAAhBA,aAAgB;IAC9B,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,gCAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,EAAE,YAFa;MAGlB8C,aAAa,EAAbA;IAHkB,CAAb,EAKJ5B,IALI,CAKC,UAACC,GAAD,EAAS;MACb,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,0BAAjB;;MAEA,OAAOO,GAAG,CAAC4B,SAAX;IACD,CATI,CAAP;EAUD,CA3P4B;;EA6P7B;AACF;AACA;AACA;AACA;AACA;AACA;;EACE;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,uBA3Q6B,0CA2Q+B;IAAA;;IAAA,IAAnCF,aAAmC,SAAnCA,aAAmC;IAAA,IAApBG,iBAAoB,SAApBA,iBAAoB;IAC1D,KAAKtC,MAAL,CAAYC,IAAZ,CAAiB,0CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,MAFa;MAGlB8C,aAAa,EAAbA,aAHkB;MAIlBG,iBAAiB,EAAjBA,iBAJkB;MAKlBC,SAAS,EAAEC,aAAA,CAAKC,EAAL;IALO,CAAb,EAMJlC,IANI,CAMC,UAACC,GAAD,EAAS;MACf,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,2CAAjB;;MAEA,OAAOO,GAAP;IACD,CAVM,CAAP;EAWD,CAzR4B;;EA2R7B;AACF;AACA;AACA;AACA;AACA;EACEkC,wBAjS6B,4CAiSa;IAAA;;IAAA,IAAhBP,aAAgB,UAAhBA,aAAgB;IACxC,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,4CAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,EAAE,MAFa;MAGlB8C,aAAa,EAAbA,aAHkB;MAIlBI,SAAS,EAAEC,aAAA,CAAKC,EAAL;IAJO,CAAb,EAKJlC,IALI,CAKC,UAACC,GAAD,EAAS;MACf,MAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,6CAAjB;;MAEA,OAAOO,GAAP;IACD,CATM,CAAP;EAUD,CA9S4B;;EAgT7B;AACF;AACA;AACA;AACA;AACA;;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEmC,4BA3U6B,gDA2UkC;IAAA;;IAAA,IAAjCC,KAAiC,UAAjCA,KAAiC;IAAA,IAA1BC,QAA0B,UAA1BA,QAA0B;IAAA,IAAhBV,aAAgB,UAAhBA,aAAgB;IAC7D,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,oDAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAEuD,KAFa;MAGlBC,QAAQ,EAARA,QAHkB;MAIlBV,aAAa,EAAbA,aAJkB;MAKlBI,SAAS,EAAEC,aAAA,CAAKC,EAAL;IALO,CAAb,EAMJlC,IANI,CAMC,UAACC,GAAD,EAAS;MACf,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,2DAAjB,EAA8E4C,QAA9E;;MAEA,OAAOrC,GAAP;IACD,CAVM,CAAP;EAWD,CAzV4B;;EA2V7B;AACF;AACA;AACA;AACA;AACA;EACEsC,2BAjW6B,+CAiWgB;IAAA;;IAAA,IAAhBX,aAAgB,UAAhBA,aAAgB;IAC3C,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,uDAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,MAFa;MAGlB8C,aAAa,EAAbA,aAHkB;MAIlBI,SAAS,EAAEC,aAAA,CAAKC,EAAL;IAJO,CAAb,EAKJlC,IALI,CAKC,UAACC,GAAD,EAAS;MACf,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,gDAAjB;;MAEA,OAAOO,GAAP;IACD,CATM,CAAP;EAUD,CA9W4B;;EAgX7B;AACF;AACA;AACA;AACA;AACA;EACEuC,kBAtX6B,sCAsXO;IAAA;;IAAA,IAAhBZ,aAAgB,UAAhBA,aAAgB;IAClC,KAAKnC,MAAL,CAAYC,IAAZ,CAAiB,sCAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE,SAFa;MAGlBwD,QAAQ,EAAE,QAHQ;MAIlBV,aAAa,EAAbA,aAJkB;MAKlBI,SAAS,EAAEC,aAAA,CAAKC,EAAL;IALO,CAAb,EAMJlC,IANI,CAMC,UAACC,GAAD,EAAS;MACf,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,4CAAjB;;MAEA,OAAOO,GAAP;IACD,CAVM,CAAP;EAWD,CApY4B;EAoZ7BwC,QApZ6B,4BAoZD;IAAA;;IAAA,IAAlB3D,GAAkB,UAAlBA,GAAkB;IAAA,IAAbC,UAAa,UAAbA,UAAa;;IAC1B;IACA,IAAI,CAACD,GAAL,EAAU;MACR,OAAO,iBAAQa,MAAR,CAAe,IAAIC,KAAJ,CAAU,2BAAV,CAAf,CAAP;IACD;;IAED,KAAKH,MAAL,CAAYC,IAAZ,CAAiB,mBAAjB;IAEA,OAAO,KAAKG,OAAL,CAAa;MAClBC,MAAM,EAAE,UADU;MAElBhB,GAAG,EAAHA;IAFkB,CAAb,EAGJ;MAACC,UAAU,EAAVA;IAAD,CAHI,EAIJiB,IAJI,CAIC,UAACC,GAAD,EAAS;MACb,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,kBAAjB;;MAEA,OAAO,OAAI,CAACgC,KAAL,CAAWzB,GAAG,CAACV,GAAf,CAAP;IACD,CARI,CAAP;EASD,CAra4B;;EAua7B;AACF;AACA;AACA;EACEmD,IA3a6B,kBA2atB;IACL,OAAO,KAAK7C,OAAL,CAAa;MAClBC,MAAM,EAAE,QADU;MAElBhB,GAAG,EAAE;IAFa,CAAb,CAAP;EAID,CAhb4B;;EAkb7B;AACF;AACA;AACA;AACA;EACE4C,KAvb6B,iBAubvBnC,GAvbuB,EAublB;IACT,OAAOoD,iBAAA,CAAKC,GAAL,CAASlB,KAAT,CAAenC,GAAG,CAACsD,GAAnB,EACJ7C,IADI,CACC,UAAC6C,GAAD,EAAS;MACbtD,GAAG,CAACsD,GAAJ,GAAUA,GAAV;MAEA,OAAOtD,GAAP;IACD,CALI,CAAP;EAMD,CA9b4B;;EAgc7B;AACF;AACA;AACA;AACA;AACA;EACEuD,cAtc6B,0BAscdC,OAtcc,EAscLhE,UAtcK,EAscO;IAAA;;IAClC,IAAMiE,aAAa,GAAGD,OAAO,CAACjD,MAAR,KAAmB,QAAnB,IAA+BiD,OAAO,CAACjE,GAAR,CAAYmE,QAAZ,CAAqB,QAArB,CAArD;IAEA,OAAO,iBAAQC,OAAR,CAAgBF,aAAa,GAAG1E,eAAe,CAAC6E,GAAhB,CAAoB,IAApB,CAAH,GAA+B,KAAKC,WAAL,EAA5D,EACJpD,IADI,CACC,UAACqD,OAAD,EAAa;MACjB,OAAI,CAAC5D,MAAL,CAAYC,IAAZ,yBAAkCsD,aAAa,GAAG,eAAH,GAAqB,KAApE;;MACA,IAAMM,GAAG,GAAG,IAAIC,gBAAJ,CAAYR,OAAZ,CAAZ;MACA,IAAIS,cAAc,GAAGH,OAArB;;MAEA,IAAItE,UAAJ,EAAgB;QACdyE,cAAc,GAAG,OAAI,CAACC,kBAAL,CAAwBJ,OAAxB,EAAiCtE,UAAjC,CAAjB;MACD;;MAED,OAAOuE,GAAG,CAACI,IAAJ,CAASF,cAAT,EAAyB;QAACG,SAAS,EAAEX;MAAZ,CAAzB,EACJhD,IADI,CACC,YAAM;QACV;QACA,IAAI4D,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;UACzC,OAAI,CAACrE,MAAL,CAAYC,IAAZ,CAAiB,sBAAjB,EAAyCqE,aAAA,CAAKC,OAAL,CAAa,oBAAKC,IAAI,CAACC,KAAL,CAAW,wBAAeZ,GAAf,CAAX,CAAL,EAAsC,SAAtC,CAAb,EAA+D;YAACa,KAAK,EAAE;UAAR,CAA/D,CAAzC;QACD;;QAED,OAAOb,GAAP;MACD,CARI,CAAP;IASD,CAnBI,CAAP;EAoBD,CA7d4B;;EA+d7B;AACF;AACA;AACA;AACA;EACEc,sBApe6B,kCAoeNC,KApeM,EAoeC;IAAA;;IAC5B,KAAK5E,MAAL,CAAYC,IAAZ,CAAiB,2BAAjB;IAEA,OAAO,iBAAQ8B,GAAR,CAAY6C,KAAK,CAACC,UAAN,CAAiBC,WAAjB,CAA6B9C,GAA7B,CAAiC,UAAC+C,UAAD,EAAaC,KAAb;MAAA,OAAuB,OAAI,CAACC,eAAL,CAAqBF,UAArB,EACxExE,IADwE,CACnE,UAAC2E,aAAD,EAAmB;QACvB,OAAI,CAAClF,MAAL,CAAYC,IAAZ,yBAAkCiF,aAAa,GAAG,OAAH,GAAa,QAA5D;;QACA,IAAM1E,GAAG,GAAG,IAAI2E,iBAAJ,CAAaJ,UAAb,CAAZ;QAEA,OAAO,iBAAQtB,OAAR,CAAgByB,aAAa,GAAGrG,eAAe,CAAC6E,GAAhB,CAAoB,OAApB,CAAH,GAA+B/E,QAAQ,CAAC+E,GAAT,CAAa,OAAb,CAA5D,EACL;QADK,CAEJnD,IAFI,CAEC,UAACqD,OAAD;UAAA,OAAapD,GAAG,CAAC4E,MAAJ,CAAWxB,OAAX,CAAb;QAAA,CAFD,EAGL;QAHK,CAIJrD,IAJI,CAIC,YAAM;UACV,IAAI4D,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;YACzC,OAAI,CAACrE,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB,EAA0CqE,aAAA,CAAKC,OAAL,CAAa,oBAAKC,IAAI,CAACC,KAAL,CAAW,wBAAejE,GAAf,CAAX,CAAL,EAAsC,SAAtC,CAAb,EAA+D;cAACkE,KAAK,EAAE;YAAR,CAA/D,CAA1C;UACD;QACF,CARI,EASL;QATK,CAUJnE,IAVI,CAUC,YAAM;UAAEqE,KAAK,CAACC,UAAN,CAAiBC,WAAjB,CAA6BE,KAA7B,IAAsCxE,GAAtC;QAA4C,CAVrD,EAWL;QAXK,CAYJD,IAZI,CAYC;UAAA,OAAMC,GAAN;QAAA,CAZD,CAAP;MAaD,CAlBwE,CAAvB;IAAA,CAAjC,CAAZ,EAmBJD,IAnBI,CAmBC;MAAA,OAAM,OAAI,CAACd,OAAL,CAAakF,sBAAb,CAAoCC,KAApC,CAAN;IAAA,CAnBD,EAoBJS,KApBI,CAoBE,UAACC,MAAD,EAAY;MACjB,OAAI,CAACtF,MAAL,CAAYuF,KAAZ,CAAkB,qBAAlB,EAAyCD,MAAM,CAACE,KAAhD;;MAEA,OAAO,iBAAQtF,MAAR,CAAeoF,MAAf,CAAP;IACD,CAxBI,EAyBJ/E,IAzBI,CAyBC;MAAA,OAAMqE,KAAN;IAAA,CAzBD,CAAP;EA0BD,CAjgB4B;;EAmgB7B;AACF;AACA;AACA;AACA;EACEa,iBAxgB6B,6BAwgBXV,UAxgBW,EAwgBC;IAC5B,IAAMvE,GAAG,GAAG,IAAI2E,iBAAJ,CAAaJ,UAAb,CAAZ;IAEA,OAAOpG,QAAQ,CAAC+E,GAAT,CAAa,IAAb,EACJnD,IADI,CACC,UAACqD,OAAD;MAAA,OAAapD,GAAG,CAAC4E,MAAJ,CAAWxB,OAAX,CAAb;IAAA,CADD,EAEJrD,IAFI,CAEC;MAAA,OAAMC,GAAG,CAACkF,IAAV;IAAA,CAFD,CAAP;EAGD,CA9gB4B;;EAghB7B;AACF;AACA;AACA;AACA;EACET,eArhB6B,2BAqhBbF,UArhBa,EAqhBD;IAC1B,OAAO,KAAKY,mBAAL,GACJpF,IADI,CACC,UAACqF,eAAD,EAAqB;MACzB,IAAMC,MAAM,GAAGd,UAAU,CAACe,KAAX,CAAiB,GAAjB,CAAf;;MAEA,IAAID,MAAM,CAAC5E,MAAP,KAAkB,CAAtB,EAAyB;QACvB,OAAO,KAAP;MACD;;MAED,IAAM8E,MAAM,GAAGvB,IAAI,CAACC,KAAL,CAAWvB,iBAAA,CAAKoB,IAAL,CAAU0B,SAAV,CAAoBC,MAApB,CAA2BJ,MAAM,CAAC,CAAD,CAAjC,CAAX,CAAf;MAEA,OAAOE,MAAM,CAACG,GAAP,KAAeN,eAAe,CAACM,GAAtC;IACD,CAXI,CAAP;EAYD,CAliB4B;;EAoiB7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE9F,OA5iB6B,mBA4iBrBkD,OA5iBqB,EA4iBgB;IAAA;;IAAA,iFAAJ,EAAI;IAAA,IAA3B6C,OAA2B,UAA3BA,OAA2B;IAAA,IAAlB7G,UAAkB,UAAlBA,UAAkB;;IAC3C6G,OAAO,GAAGA,OAAO,IAAI,KAAKC,MAAL,CAAYC,iBAAjC,CAD2C,CAG3C;IACA;;IACA,OAAO,KAAKC,KAAL,CAAWC,QAAX,CAAoBC,OAApB,CAA4BC,OAA5B,GACJlG,IADI,CACC;MAAA,OAAM,OAAI,CAAC8C,cAAL,CAAoBC,OAApB,EAA6BhE,UAA7B,CAAN;IAAA,CADD,EAEJiB,IAFI,CAEC,UAACsD,GAAD,EAAS;MACbA,GAAG,CAAC6C,0BAAD,CAAH,GAAsBP,OAAtB;MAEA,OAAO,OAAI,CAAC1G,OAAL,CAAaW,OAAb,CAAqByD,GAArB,CAAP;IACD,CANI,EAOL;IACA;IARK,CASJwB,KATI,CASE,UAACC,MAAD,EAAY;MACjB,IAAInB,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,MAAzB,KAAoCiB,MAAM,CAACqB,MAAP,KAAkB,GAAlB,IAAyBrB,MAAM,CAACsB,UAAP,KAAsB,GAAnF,KAA2FtB,MAAM,CAACuB,OAAP,CAAeC,KAAf,CAAqB,sEAArB,CAA/F,EAA6L;QAC3L,OAAI,CAAC9G,MAAL,CAAY+G,IAAZ,CAAiB,wDAAjB;;QAEA,OAAO,OAAI,CAAC3G,OAAL,CAAakD,OAAb,EAAsB;UAAChE,UAAU,EAAVA;QAAD,CAAtB,CAAP;MACD,CALgB,CAOjB;;;MACA,IAAIgG,MAAM,YAAY0B,kCAAtB,EAAgC;QAC9B,OAAI,CAACV,KAAL,CAAWW,OAAX,CAAmB,4BAAnB;;QAEA,OAAO,iBAAQ/G,MAAR,CAAeoF,MAAf,CAAP;MACD,CAZgB,CAcjB;MACA;MACA;;;MACA,IAAI,CAACA,MAAM,CAACsB,UAAR,IAAsB,CAACtB,MAAM,CAACqB,MAAlC,EAA0C;QACxC;QACA,IAAIxC,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;UACzC;UACA,OAAI,CAACrE,MAAL,CAAYC,IAAZ,CAAiB,oBAAjB,EAAuCqF,MAAM,CAACE,KAAP,IAAgBF,MAAvD;QACD;;QAEDxG,YAAY,mBAAYqH,OAAZ,EAAZ;QACAA,OAAO,IAAI,CAAX;;QAEA,IAAIA,OAAO,IAAI,OAAI,CAACC,MAAL,CAAYc,cAA3B,EAA2C;UACzC,OAAI,CAAClH,MAAL,CAAYC,IAAZ,CAAiB,2CAAjB;;UAEA,OAAO,iBAAQC,MAAR,CAAeoF,MAAf,CAAP;QACD,CAduC,CAgBxC;QACA;;;QACA,IAAM6B,WAAW,GAAGhB,OAAO,GAAG,CAA9B;;QAEA,IAAIA,OAAO,IAAI,OAAI,CAACC,MAAL,CAAYgB,aAAvB,IAAwCD,WAAW,GAAG,OAAI,CAACf,MAAL,CAAYc,cAAtE,EAAsF;UACpF,OAAI,CAAClH,MAAL,CAAYC,IAAZ,CAAiB,qEAAjB;UAEA;;;UACA,IAAIkE,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;YACzC,OAAI,CAACrE,MAAL,CAAYC,IAAZ,CAAiB,yBAAjB,EAA4CkG,OAA5C,EAAqD,OAAI,CAACC,MAAL,CAAYgB,aAAjE;UACD;;UAEDzI,QAAQ,CAAC0I,MAAT,CAAgB,OAAhB;UACAlB,OAAO,GAAG,CAAV;QACD;;QAED,OAAO,OAAI,CAAC/F,OAAL,CAAakD,OAAb,EAAsB;UAAC6C,OAAO,EAAPA,OAAD;UAAU7G,UAAU,EAAVA;QAAV,CAAtB,CAAP;MACD;;MAED,OAAO,iBAAQY,MAAR,CAAeoF,MAAf,CAAP;IACD,CA9DI,CAAP;EA+DD,CAhnB4B;;EAknB7B;AACF;AACA;AACA;EACEgC,iBAtnB6B,+BAsnBT;IAClB,OAAO,KAAKhB,KAAL,CAAWiB,WAAX,CAAuBC,YAAvB,CAAoC,WAApC,EACJjH,IADI,CACC,UAACkH,KAAD;MAAA,OAAWA,KAAK,CAACC,YAAjB;IAAA,CADD,CAAP;EAED,CAznB4B;;EA4nB7B;AACF;AACA;AACA;AACA;EACE/D,WAjoB6B,yBAioBf;IAAA;;IACZ,IAAIgE,OAAO,GAAGhJ,QAAQ,CAAC+E,GAAT,CAAa,IAAb,CAAd;;IAEA,IAAI,CAACiE,OAAL,EAAc;MACZA,OAAO,GAAG,KAAKC,eAAL,EAAV;MACAjJ,QAAQ,CAACkJ,GAAT,CAAa,IAAb,EAAmBF,OAAnB;MACAA,OAAO,CAACpH,IAAR,CAAa,UAACqD,OAAD,EAAa;QACxB,IAAMkE,SAAS,GAAGlE,OAAO,CAACmE,YAAR,CAAqBC,cAArB,GAAsC,mBAAtC,GAAmD,KAArE;QAEA,IAAAC,4BAAA,EAAe;UAAA,OAAMtJ,QAAQ,CAAC0I,MAAT,CAAgB,OAAhB,CAAN;QAAA,CAAf,EAA4CS,SAA5C;MACD,CAJD;IAKD;;IAED,OAAO,iBAAQ/F,GAAR,CAAY,CACjB4F,OADiB,EAEjB,KAAKL,iBAAL,EAFiB,CAAZ,EAIJ/G,IAJI,CAIC,kBAA8B;MAAA;MAAA,IAA5BqD,OAA4B;MAAA,IAAnBsE,aAAmB;;MAClCtE,OAAO,CAACuE,UAAR,CAAmBC,UAAnB,CAA8BC,MAA9B,GAAuCH,aAAvC;MAEA,OAAOtE,OAAP;IACD,CARI,CAAP;EASD,CAvpB4B;;EAypB7B;AACF;AACA;AACA;EACE0E,cA7pB6B,4BA6pBZ;IACf,KAAKtI,MAAL,CAAYC,IAAZ,CAAiB,6BAAjB;IAEA,OAAO,KAAKsI,cAAL,GACJhI,IADI,CACC;MAAA,IAAEiI,UAAF,UAAEA,UAAF;MAAA,OAAkBA,UAAlB;IAAA,CADD,CAAP;EAED,CAlqB4B;;EAoqB7B;AACF;AACA;AACA;EACED,cAxqB6B,4BAwqBZ;IAAA;;IACf,IAAIE,OAAO,GAAG7J,UAAU,CAAC8E,GAAX,CAAe,IAAf,CAAd;;IAEA,IAAI,CAAC+E,OAAL,EAAc;MACZ,KAAKzI,MAAL,CAAYC,IAAZ,CAAiB,2BAAjB;MACAwI,OAAO,GAAG,KAAKnC,KAAL,CAAWlG,OAAX,CAAmB;QAC3BsI,OAAO,EAAE,YADkB;QAE3BxH,QAAQ,iBAAU,KAAKoF,KAAL,CAAWC,QAAX,CAAoBoC,MAApB,CAA2BjH,MAArC;MAFmB,CAAnB,EAIPnB,IAJO,CAIF,UAACC,GAAD,EAAS;QACb,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,0BAAjB;;QACA,IAAOyF,IAAP,GAAelF,GAAf,CAAOkF,IAAP;QAEAA,IAAI,CAACkD,YAAL,GAAoBpE,IAAI,CAACC,KAAL,CAAWiB,IAAI,CAACkD,YAAhB,CAApB;QAEA,OAAOlD,IAAP;MACD,CAXO,EAYPL,KAZO,CAYD,UAACC,MAAD,EAAY;QACjB,OAAI,CAACtF,MAAL,CAAYuF,KAAZ,CAAkB,kCAAlB,EAAsDD,MAAtD;;QAEA,OAAO,iBAAQpF,MAAR,CAAeoF,MAAf,CAAP;MACD,CAhBO,CAAV;MAkBA1G,UAAU,CAACiJ,GAAX,CAAe,IAAf,EAAqBY,OAArB;IACD;;IAED,OAAOA,OAAP;EACD,CAnsB4B;;EAqsB7B;AACF;AACA;AACA;EACE9C,mBAzsB6B,iCAysBP;IACpB,KAAK3F,MAAL,CAAYC,IAAZ,CAAiB,uCAAjB;IAEA,OAAO,KAAKsI,cAAL,GACJhI,IADI,CACC;MAAA,IAAEqI,YAAF,UAAEA,YAAF;MAAA,OAAoBA,YAApB;IAAA,CADD,CAAP;EAED,CA9sB4B;;EAgtB7B;AACF;AACA;AACA;EACEhB,eAptB6B,6BAotBX;IAAA;;IAChB,KAAK5H,MAAL,CAAYC,IAAZ,CAAiB,uBAAjB;IACA,IAAM2D,OAAO,GAAG,IAAIiF,gBAAJ,EAAhB;IAEA,OAAO,iBAAQ9G,GAAR,CAAY,CACjB,KAAK4D,mBAAL,GAA2BpF,IAA3B,CAAgC,IAAAuI,iCAAA,EAAY,KAAK1C,MAAL,CAAY2C,OAAxB,CAAhC,CADiB,EAEjB,KAAKzB,iBAAL,EAFiB,CAAZ,EAIJ/G,IAJI,CAIC,kBAAsC;MAAA;MAAA,IAApCqF,eAAoC;MAAA,IAAnBsC,aAAmB;;MAC1CtE,OAAO,CAACuE,UAAR,GAAqB;QACnBa,QAAQ,EAAE,OAAI,CAAC1C,KAAL,CAAWC,QAAX,CAAoBoC,MAApB,CAA2BM,GADlB;QAEnBb,UAAU,EAAE;UACV1G,MAAM,EAAE,OAAI,CAAC4E,KAAL,CAAWC,QAAX,CAAoBoC,MAApB,CAA2BjH,MADzB;UAEV2G,MAAM,EAAEH;QAFE;MAFO,CAArB;MAQAtE,OAAO,CAACsF,UAAR,GAAqB;QACnBpJ,GAAG,EAAE8F;MADc,CAArB;;MAIA,OAAI,CAAC5F,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAO2D,OAAO,CAACuF,aAAR,EAAP;IACD,CApBI,EAqBJ5I,IArBI,CAqBC,UAAC6I,YAAD,EAAkB;MACtBxF,OAAO,CAACmE,YAAR,GAAuBqB,YAAvB;MACAvK,eAAe,CAACgJ,GAAhB,CAAoB,OAApB,EAA0BjE,OAA1B;MAEA,OAAO,iBAAQ7B,GAAR,CAAY,CAACqH,YAAY,CAACnH,KAAb,EAAD,EAAuB,OAAI,CAACqG,cAAL,EAAvB,CAAZ,CAAP;IACD,CA1BI,EA2BJ/H,IA3BI,CA2BC,kBAA6B;MAAA;MAAA,IAA3B6I,YAA2B;MAAA,IAAbC,OAAa;;MACjC,OAAI,CAACrJ,MAAL,CAAYC,IAAZ,CAAiB,uCAAjB;;MAEA,OAAO,OAAI,CAACG,OAAL,CAAa;QAClBf,GAAG,YAAKgK,OAAL,WADe;QAElBhJ,MAAM,EAAE,QAFU;QAGlB+C,GAAG,EAAEgG,YAAY,CAACE,MAAb;MAHa,CAAb,CAAP;IAKD,CAnCI,EAoCJ/I,IApCI,CAoCC,UAACC,GAAD,EAAS;MACb,OAAI,CAACR,MAAL,CAAYC,IAAZ,CAAiB,mCAAjB;;MAEA,OAAO2D,OAAO,CAAC2F,kBAAR,CAA2B/I,GAAG,CAACV,GAA/B,CAAP;IACD,CAxCI,EAyCJS,IAzCI,CAyCC,UAACT,GAAD,EAAS;MACb8D,OAAO,CAACmE,YAAR,GAAuBjI,GAAvB;MACAjB,eAAe,CAACwI,MAAhB,CAAuB,OAAvB;;MACA,OAAI,CAACrH,MAAL,CAAYC,IAAZ,CAAiB,kCAAjB;;MAEA,OAAO2D,OAAP;IACD,CA/CI,EAgDJyB,KAhDI,CAgDE,UAACC,MAAD,EAAY;MACjB,OAAI,CAACtF,MAAL,CAAYuF,KAAZ,CAAkB,wCAAlB,EAA4DD,MAA5D;;MAEA,OAAO,iBAAQpF,MAAR,CAAeoF,MAAf,CAAP;IACD,CApDI,CAAP;EAqDD,CA7wB4B;;EA+wB7B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEtB,kBA3xB6B,8BA2xBVwF,eA3xBU,EA2xBOlK,UA3xBP,EA2xBmB;IAC9C,IAAMsE,OAAO,GAAG,IAAIiF,gBAAJ,EAAhB;IAEAjF,OAAO,CAACuE,UAAR,GAAqBvE,OAAO,CAACuE,UAAR,GAAqB;MACxCa,QAAQ,EAAEQ,eAAe,CAACrB,UAAhB,CAA2Ba,QADG;MAExCZ,UAAU,EAAE;QACV1G,MAAM,EAAEpC,UADE;QAEVA,UAAU,EAAVA,UAFU;QAEE;QACZ+I,MAAM,EAAEmB,eAAe,CAACrB,UAAhB,CAA2BC,UAA3B,CAAsCC;MAHpC;IAF4B,CAA1C;IAQAzE,OAAO,CAACsF,UAAR,GAAqBM,eAAe,CAACN,UAArC;IACAtF,OAAO,CAACmE,YAAR,GAAuByB,eAAe,CAACzB,YAAvC;IAEA,OAAOnE,OAAP;EACD,CA1yB4B;EAAA;AAAA,CAAnB,oMA2nBTzE,iBA3nBS,+EAAZ;;eA6yBeH,G"}
+{"version":3,"names":["contexts","kmsDetails","partialContexts","consoleDebug","require","KMS","WebexPlugin","extend","oneFlight","keyFactory","uri","onBehalfOf","namespace","children","batcher","KMSBatcher","bindKey","kro","kroUri","key","keyUri","logger","info","reject","Error","request","method","resourceUri","then","res","createResource","userIds","keyUris","keys","reduce","uris","k","push","length","resource","addAuthorization","authIds","concat","authorizations","listAuthorizations","removeAuthorization","authId","userId","querystring","stringify","createUnboundKeys","count","all","map","asKey","fetchPublicKey","assignedOrgId","publicKey","uploadCustomerMasterKey","customerMasterKey","awsKms","requestId","uuid","v4","listAllCustomerMasterKey","changeCustomerMasterKeyState","keyId","keyState","deleteAllCustomerMasterKeys","useGlobalMasterKey","fetchKey","ping","jose","JWK","jwk","prepareRequest","payload","isECDHRequest","includes","resolve","get","_getContext","context","req","Request","requestContext","_contextOnBehalfOf","wrap","serverKey","process","env","NODE_ENV","util","inspect","JSON","parse","depth","processKmsMessageEvent","event","encryption","kmsMessages","kmsMessage","index","_isECDHEMessage","isECDHMessage","Response","unwrap","catch","reason","error","stack","decryptKmsMessage","body","_getKMSStaticPubKey","kmsStaticPubKey","fields","split","header","base64url","decode","kid","timeout","config","kmsInitialTimeout","webex","internal","mercury","connect","TIMEOUT_SYMBOL","status","statusCode","message","match","warn","KMSError","trigger","ecdhMaxTimeout","nextTimeout","kmsMaxTimeout","delete","_getAuthorization","credentials","getUserToken","token","access_token","promise","_prepareContext","set","expiresIn","ephemeralKey","expirationDate","safeSetTimeout","authorization","clientInfo","credential","bearer","_getKMSCluster","_getKMSDetails","kmsCluster","details","service","device","rsaPublicKey","Context","validateKMS","caroots","clientId","url","serverInfo","createECDHKey","localECDHKey","cluster","toJSON","deriveEphemeralKey","originalContext"],"sources":["kms.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport querystring from 'querystring';\nimport util from 'util';\n\nimport {safeSetTimeout} from '@webex/common-timers';\nimport {oneFlight} from '@webex/common';\nimport {WebexPlugin} from '@webex/webex-core';\nimport {Context, Request, Response} from 'node-kms';\nimport jose from 'node-jose';\nimport {omit} from 'lodash';\nimport uuid from 'uuid';\n\nimport KMSBatcher, {TIMEOUT_SYMBOL} from './kms-batcher';\nimport validateKMS, {KMSError} from './kms-certificate-validation';\n\nconst contexts = new WeakMap();\nconst kmsDetails = new WeakMap();\nconst partialContexts = new WeakMap();\n\nconst consoleDebug = require('debug')('kms');\n\n/**\n * @class\n */\nconst KMS = WebexPlugin.extend({\n  namespace: 'Encryption',\n\n  children: {\n    batcher: KMSBatcher,\n  },\n\n  /**\n   * Binds a key to a resource\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro\n   * @param {string} options.kroUri\n   * @param {Key} options.key\n   * @param {string} options.keyUri\n   * @returns {Promise<Key>}\n   */\n  bindKey({kro, kroUri, key, keyUri}) {\n    kroUri = kroUri || kro.uri;\n    keyUri = keyUri || key.uri;\n\n    this.logger.info('kms: binding key to resource');\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    /* istanbul ignore if */\n    if (!keyUri) {\n      return Promise.reject(new Error('`key` or `keyUri` is required'));\n    }\n\n    return this.request({\n      method: 'update',\n      resourceUri: kroUri,\n      uri: keyUri,\n    }).then((res) => {\n      this.logger.info('kms: bound key to resource');\n\n      return res.key;\n    });\n  },\n\n  /**\n   * Creates a new KMS Resource\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.keyUris\n   * @param {Key} options.key\n   * @param {Array<Keys>} options.keys\n   * @returns {Promise<KMSResourceObject>}\n   */\n  createResource({userIds, keyUris, key, keys}) {\n    keyUris = keyUris || [];\n    /* istanbul ignore if */\n    if (keys) {\n      keyUris = keys.reduce((uris, k) => {\n        uris.push(k.uri);\n\n        return uris;\n      }, keyUris);\n    }\n\n    /* istanbul ignore else */\n    if (key) {\n      keyUris.push(key.uri);\n    }\n\n    /* istanbul ignore if */\n    if (keyUris.length === 0) {\n      return Promise.reject(new Error('Cannot create KMS Resource without at least one keyUri'));\n    }\n\n    this.logger.info('kms: creating resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/resources',\n      userIds,\n      keyUris,\n    }).then((res) => {\n      this.logger.info('kms: created resource');\n\n      return res.resource;\n    });\n  },\n\n  /**\n   * Authorizes a user or KRO to a KRO\n   * @param {Object} options\n   * @param {Array<string>} options.userIds\n   * @param {Array<string>} options.authIds interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  addAuthorization({userIds, authIds, kro, kroUri}) {\n    userIds = userIds || [];\n    kroUri = kroUri || kro.uri;\n\n    if (authIds) {\n      userIds = userIds.concat(authIds);\n    }\n\n    /* istanbul ignore if */\n    if (userIds.length === 0) {\n      return Promise.reject(new Error('Cannot add authorization without userIds or authIds'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: adding authorization to kms resource');\n\n    return this.request({\n      method: 'create',\n      uri: '/authorizations',\n      resourceUri: kroUri,\n      userIds,\n    }).then((res) => {\n      this.logger.info('kms: added authorization');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Retrieve a list of users that have been authorized to the KRO\n   * @param {Object} options\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Array<authId>}\n   */\n  listAuthorizations({kro, kroUri}) {\n    kroUri = kroUri || kro.uri;\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    return this.request({\n      method: 'retrieve',\n      uri: `${kroUri}/authorizations`,\n    }).then((res) => {\n      this.logger.info('kms: retrieved authorization list');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Deauthorizes a user or KRO from a KRO\n   * @param {Object} options\n   * @param {string} options.userId\n   * @param {string} options.authId interchangable with userIds\n   * @param {KMSResourceObject} options.kro the target kro\n   * @param {string} options.kroUri\n   * @returns {Promise<KMSAuthorizationObject>}\n   */\n  removeAuthorization({authId, userId, kro, kroUri}) {\n    authId = authId || userId;\n    kroUri = kroUri || kro.uri;\n\n    /* istanbul ignore if */\n    if (!authId) {\n      return Promise.reject(new Error('Cannot remove authorization without authId'));\n    }\n\n    /* istanbul ignore if */\n    if (!kroUri) {\n      return Promise.reject(new Error('`kro` or `kroUri` is required'));\n    }\n\n    this.logger.info('kms: removing authorization from kms resource');\n\n    return this.request({\n      method: 'delete',\n      uri: `${kroUri}/authorizations?${querystring.stringify({authId})}`,\n    }).then((res) => {\n      this.logger.info('kms: removed authorization');\n\n      return res.authorizations;\n    });\n  },\n\n  /**\n   * Requests `count` unbound keys from the kms\n   * @param {Object} options\n   * @param {Number} options.count\n   * @returns {Array<Key>}\n   */\n  createUnboundKeys({count}) {\n    this.logger.info(`kms: request ${count} unbound keys`);\n\n    /* istanbul ignore if */\n    if (!count) {\n      return Promise.reject(new Error('`options.count` is required'));\n    }\n\n    return this.request({\n      method: 'create',\n      uri: '/keys',\n      count,\n    }).then((res) => {\n      this.logger.info('kms: received unbound keys');\n\n      return Promise.all(res.keys.map(this.asKey));\n    });\n  },\n\n  /**\n   * @typedef {Object} FetchPublicKeyResponse\n   * @property {number} status 200,400(Bad Request: Request payload missing info),404(Not Found: HSM Public Key not found),501(Not Implemented: This KMS does not support BYOK),502(Bad Gateway: KMS could not communicate with HSM)\n   * @property {UUID} requestId this is should be unique, used for debug.\n   * @property {string} publicKey\n   */\n  /**\n   * get public key from kms\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<FetchPublicKeyResponse>} response of get public key api\n   */\n  fetchPublicKey({assignedOrgId}) {\n    this.logger.info('kms: fetch public key for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: '/publicKey',\n      assignedOrgId,\n    }).then((res) => {\n      this.logger.info('kms: received public key');\n\n      return res.publicKey;\n    });\n  },\n\n  /**\n   * @typedef {Object} UploadCmkResponse\n   * @property {number} status\n   * @property {UUID} requestId\n   * @property {string} uri\n   * @property {string} keysState\n   */\n  /**\n   * upload master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {string} options.customerMasterKey the master key\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<UploadCmkResponse>} response of upload CMK api\n   */\n  uploadCustomerMasterKey({assignedOrgId, customerMasterKey, awsKms = false}) {\n    this.logger.info('kms: upload customer master key for byok');\n\n    return this.request({\n      method: 'create',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      customerMasterKey,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to upload customer master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * get all customer master keys for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  listAllCustomerMasterKey({assignedOrgId, awsKms = false}) {\n    this.logger.info('kms: get all customer master keys for byok');\n\n    return this.request({\n      method: 'retrieve',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to get all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n   * @typedef {Object} ActivateCmkResponse\n   * @property {number} status\n   * @property {UUID} requestId\n   * @property {Array<CMK>} customerMasterKeys\n   */\n  /**\n   *\n   * @typedef {Object} CMK\n   * @property {string} usageState\n   * @property {UUID} assignedOrgId\n   * @property {string} uri\n   * @property {string} source\n   * @property {Date | undefined} stateUpdatedOn\n   * @property {Date | undefined} rotation\n   */\n  /**\n   * change one customer master key state for one org.\n   * delete pending key, then the keyState should be 'removedclean';\n   * active pending key, then the keyState should be 'active';\n   *\n   * @param {Object} options\n   * @param {string} options.keyId the id of one customer master key, it should be a url\n   * @param {string} options.keyState one of the following: PENDING, RECOVERING,ACTIVE,REVOKED,DEACTIVATED,REENCRYPTING,RETIRED,DELETED,DISABLED,REMOVEDCLEAN,REMOVEDDIRTY;\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of list CMKs api\n   */\n  changeCustomerMasterKeyState({keyId, keyState, assignedOrgId}) {\n    this.logger.info('kms: change one customer master key state for byok');\n\n    return this.request({\n      method: 'update',\n      uri: keyId,\n      keyState,\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to change the customer master key state to {}', keyState);\n\n      return res;\n    });\n  },\n\n  /**\n   * this is for test case. it will delete all CMKs, no matter what their status is. This is mainly for test purpose\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @param {boolean} options.awsKms enable amazon aws keys\n   * @returns {Promise.<{status, requestId}>}\n   */\n  deleteAllCustomerMasterKeys({assignedOrgId, awsKms = false}) {\n    this.logger.info('kms: delete all customer master keys at the same time');\n\n    return this.request({\n      method: 'delete',\n      uri: awsKms ? '/awsKmsCmk' : '/cmk',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to delete all customer master keys');\n\n      return res;\n    });\n  },\n\n  /**\n   * return to use global master key for one org.\n   * @param {Object} options\n   * @param {UUID} options.assignedOrgId the orgId\n   * @returns {Promise.<ActivateCmkResponse>} response of activate CMK api\n   */\n  useGlobalMasterKey({assignedOrgId}) {\n    this.logger.info('kms: return to use global master key');\n\n    return this.request({\n      method: 'update',\n      uri: 'default',\n      keyState: 'ACTIVE',\n      assignedOrgId,\n      requestId: uuid.v4(),\n    }).then((res) => {\n      this.logger.info('kms: finish to return to global master key');\n\n      return res;\n    });\n  },\n\n  /**\n   * Fetches the specified key from the kms\n   * @param {Object} options\n   * @param {string} options.uri\n   * @param {string} options.onBehalfOf The id of a user, upon whose behalf, the key is to be retrieved or undefined if retrieval is for the active user\n   * @returns {Promise<Key>}\n   */\n  // Ideally, this would be done via the kms batcher, but other than request id,\n  // there isn't any other userful key in a kms response to match it to a\n  // request. as such, we need the batcher to group requests, but one flight to\n  // make sure we don't make the same request multiple times.\n  @oneFlight({\n    keyFactory: ({uri, onBehalfOf}) => `${uri}/${onBehalfOf}`,\n  })\n  fetchKey({uri, onBehalfOf}) {\n    /* istanbul ignore if */\n    if (!uri) {\n      return Promise.reject(new Error('`options.uri` is required'));\n    }\n\n    this.logger.info('kms: fetching key');\n\n    return this.request(\n      {\n        method: 'retrieve',\n        uri,\n      },\n      {onBehalfOf}\n    ).then((res) => {\n      this.logger.info('kms: fetched key');\n\n      return this.asKey(res.key);\n    });\n  },\n\n  /**\n   * Pings the kms. Mostly for testing\n   * @returns {Promise}\n   */\n  ping() {\n    return this.request({\n      method: 'update',\n      uri: '/ping',\n    });\n  },\n\n  /**\n   * Ensures a key obect is Key instance\n   * @param {Object} key\n   * @returns {Promise<Key>}\n   */\n  asKey(key) {\n    return jose.JWK.asKey(key.jwk).then((jwk) => {\n      key.jwk = jwk;\n\n      return key;\n    });\n  },\n\n  /**\n   * Adds appropriate metadata to the KMS request\n   * @param {Object} payload\n   * @param {Object} onBehalfOf Optional parameter to prepare the request on behalf of another user\n   * @returns {Promise<KMS.Request>}\n   */\n  prepareRequest(payload, onBehalfOf) {\n    const isECDHRequest = payload.method === 'create' && payload.uri.includes('/ecdhe');\n\n    return Promise.resolve(isECDHRequest ? partialContexts.get(this) : this._getContext()).then(\n      (context) => {\n        this.logger.info(`kms: wrapping ${isECDHRequest ? 'ephemeral key' : 'kms'} request`);\n        const req = new Request(payload);\n        let requestContext = context;\n\n        if (onBehalfOf) {\n          requestContext = this._contextOnBehalfOf(context, onBehalfOf);\n        }\n\n        return req.wrap(requestContext, {serverKey: isECDHRequest}).then(() => {\n          /* istanbul ignore else */\n          if (process.env.NODE_ENV !== 'production') {\n            this.logger.info(\n              'kms: request payload',\n              util.inspect(omit(JSON.parse(JSON.stringify(req)), 'wrapped'), {depth: null})\n            );\n          }\n\n          return req;\n        });\n      }\n    );\n  },\n\n  /**\n   * Accepts a kms message event, decrypts it, and passes it to the batcher\n   * @param {Object} event\n   * @returns {Promise<Object>}\n   */\n  processKmsMessageEvent(event) {\n    this.logger.info('kms: received kms message');\n\n    return Promise.all(\n      event.encryption.kmsMessages.map((kmsMessage, index) =>\n        this._isECDHEMessage(kmsMessage).then((isECDHMessage) => {\n          this.logger.info(`kms: received ${isECDHMessage ? 'ecdhe' : 'normal'} message`);\n          const res = new Response(kmsMessage);\n\n          return (\n            Promise.resolve(isECDHMessage ? partialContexts.get(this) : contexts.get(this))\n              // eslint-disable-next-line max-nested-callbacks\n              .then((context) => res.unwrap(context))\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => {\n                if (process.env.NODE_ENV !== 'production') {\n                  this.logger.info(\n                    'kms: response payload',\n                    util.inspect(omit(JSON.parse(JSON.stringify(res)), 'wrapped'), {depth: null})\n                  );\n                }\n              })\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => {\n                event.encryption.kmsMessages[index] = res;\n              })\n              // eslint-disable-next-line max-nested-callbacks\n              .then(() => res)\n          );\n        })\n      )\n    )\n      .then(() => this.batcher.processKmsMessageEvent(event))\n      .catch((reason) => {\n        this.logger.error('kms: decrypt failed', reason.stack);\n\n        return Promise.reject(reason);\n      })\n      .then(() => event);\n  },\n\n  /**\n   * Decrypts a kms message\n   * @param {Object} kmsMessage\n   * @returns {Promise<Object>}\n   */\n  decryptKmsMessage(kmsMessage) {\n    const res = new Response(kmsMessage);\n\n    return contexts\n      .get(this)\n      .then((context) => res.unwrap(context))\n      .then(() => res.body);\n  },\n\n  /**\n   * Determines if the kms message is an ecdhe message or a normal message\n   * @param {Object} kmsMessage\n   * @returns {Promise<boolean>}\n   */\n  _isECDHEMessage(kmsMessage) {\n    return this._getKMSStaticPubKey().then((kmsStaticPubKey) => {\n      const fields = kmsMessage.split('.');\n\n      if (fields.length !== 3) {\n        return false;\n      }\n\n      const header = JSON.parse(jose.util.base64url.decode(fields[0]));\n\n      return header.kid === kmsStaticPubKey.kid;\n    });\n  },\n\n  /**\n   * Sends a request to the kms\n   * @param {Object} payload\n   * @param {Object} options\n   * @param {Number} options.timeout (internal)\n   * @param {string} options.onBehalfOf Run the request on behalf of another user (UUID), used in compliance scenarios\n   * @returns {Promise<Object>}\n   */\n  request(payload, {timeout, onBehalfOf} = {}) {\n    timeout = timeout || this.config.kmsInitialTimeout;\n\n    // Note: this should only happen when we're using the async kms batcher;\n    // once we implement the sync batcher, this'll need to be smarter.\n    return (\n      this.webex.internal.mercury\n        .connect()\n        .then(() => this.prepareRequest(payload, onBehalfOf))\n        .then((req) => {\n          req[TIMEOUT_SYMBOL] = timeout;\n\n          return this.batcher.request(req);\n        })\n        // High complexity is due to attempt at test mode resiliency\n        // eslint-disable-next-line complexity\n        .catch((reason) => {\n          if (\n            process.env.NODE_ENV === 'test' &&\n            (reason.status === 403 || reason.statusCode === 403) &&\n            reason.message.match(\n              /Failed to resolve authorization token in KmsMessage request for user/\n            )\n          ) {\n            this.logger.warn('kms: rerequested key due to test-mode kms auth failure');\n\n            return this.request(payload, {onBehalfOf});\n          }\n\n          // KMS Error. Notify the user\n          if (reason instanceof KMSError) {\n            this.webex.trigger('client:InvalidRequestError');\n\n            return Promise.reject(reason);\n          }\n\n          // Ideally, most or all of the code below would go in kms-batcher, but\n          // but batching needs at least one more round of refactoring for that to\n          // work.\n          if (!reason.statusCode && !reason.status) {\n            /* istanbul ignore else */\n            if (process.env.NODE_ENV !== 'production') {\n              /* istanbul ignore next: reason.stack vs stack difficult to control in test */\n              this.logger.info('kms: request error', reason.stack || reason);\n            }\n\n            consoleDebug(`timeout ${timeout}`);\n            timeout *= 2;\n\n            if (timeout >= this.config.ecdhMaxTimeout) {\n              this.logger.info('kms: exceeded maximum KMS request retries');\n\n              return Promise.reject(reason);\n            }\n\n            // Peek ahead to make sure we don't reset the timeout if the next timeout\n            // will exceed the maximum timeout for renegotiating ECDH keys.\n            const nextTimeout = timeout * 2;\n\n            if (timeout >= this.config.kmsMaxTimeout && nextTimeout < this.config.ecdhMaxTimeout) {\n              this.logger.info(\n                'kms: exceeded maximum KMS request retries; negotiating new ecdh key'\n              );\n\n              /* istanbul ignore else */\n              if (process.env.NODE_ENV !== 'production') {\n                this.logger.info('kms: timeout/maxtimeout', timeout, this.config.kmsMaxTimeout);\n              }\n\n              contexts.delete(this);\n              timeout = 0;\n            }\n\n            return this.request(payload, {timeout, onBehalfOf});\n          }\n\n          return Promise.reject(reason);\n        })\n    );\n  },\n\n  /**\n   * @private\n   * @returns {Promise<string>}\n   */\n  _getAuthorization() {\n    return this.webex.credentials.getUserToken('spark:kms').then((token) => token.access_token);\n  },\n\n  @oneFlight\n  /**\n   * @private\n   * @param {String} onBehalfOf create context on behalf of another user, undefined when this is not necessary\n   * @returns {Promise<Object>}\n   */\n  _getContext() {\n    let promise = contexts.get(this);\n\n    if (!promise) {\n      promise = this._prepareContext();\n      contexts.set(this, promise);\n      promise.then((context) => {\n        const expiresIn = context.ephemeralKey.expirationDate - Date.now() - 30000;\n\n        safeSetTimeout(() => contexts.delete(this), expiresIn);\n      });\n    }\n\n    return Promise.all([promise, this._getAuthorization()]).then(([context, authorization]) => {\n      context.clientInfo.credential.bearer = authorization;\n\n      return context;\n    });\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSCluster() {\n    this.logger.info('kms: retrieving KMS cluster');\n\n    return this._getKMSDetails().then(({kmsCluster}) => kmsCluster);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSDetails() {\n    let details = kmsDetails.get(this);\n\n    if (!details) {\n      this.logger.info('kms: fetching KMS details');\n      details = this.webex\n        .request({\n          service: 'encryption',\n          resource: `/kms/${this.webex.internal.device.userId}`,\n        })\n        .then((res) => {\n          this.logger.info('kms: fetched KMS details');\n          const {body} = res;\n\n          body.rsaPublicKey = JSON.parse(body.rsaPublicKey);\n\n          return body;\n        })\n        .catch((reason) => {\n          this.logger.error('kms: failed to fetch KMS details', reason);\n\n          return Promise.reject(reason);\n        });\n\n      kmsDetails.set(this, details);\n    }\n\n    return details;\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _getKMSStaticPubKey() {\n    this.logger.info('kms: retrieving KMS static public key');\n\n    return this._getKMSDetails().then(({rsaPublicKey}) => rsaPublicKey);\n  },\n\n  /**\n   * @private\n   * @returns {Promise<Object>}\n   */\n  _prepareContext() {\n    this.logger.info('kms: creating context');\n    const context = new Context();\n\n    return Promise.all([\n      this._getKMSStaticPubKey().then(validateKMS(this.config.caroots)),\n      this._getAuthorization(),\n    ])\n      .then(([kmsStaticPubKey, authorization]) => {\n        context.clientInfo = {\n          clientId: this.webex.internal.device.url,\n          credential: {\n            userId: this.webex.internal.device.userId,\n            bearer: authorization,\n          },\n        };\n\n        context.serverInfo = {\n          key: kmsStaticPubKey,\n        };\n\n        this.logger.info('kms: creating local ephemeral key');\n\n        return context.createECDHKey();\n      })\n      .then((localECDHKey) => {\n        context.ephemeralKey = localECDHKey;\n        partialContexts.set(this, context);\n\n        return Promise.all([localECDHKey.asKey(), this._getKMSCluster()]);\n      })\n      .then(([localECDHKey, cluster]) => {\n        this.logger.info('kms: submitting ephemeral key request');\n\n        return this.request({\n          uri: `${cluster}/ecdhe`,\n          method: 'create',\n          jwk: localECDHKey.toJSON(),\n        });\n      })\n      .then((res) => {\n        this.logger.info('kms: deriving final ephemeral key');\n\n        return context.deriveEphemeralKey(res.key);\n      })\n      .then((key) => {\n        context.ephemeralKey = key;\n        partialContexts.delete(this);\n        this.logger.info('kms: derived final ephemeral key');\n\n        return context;\n      })\n      .catch((reason) => {\n        this.logger.error('kms: failed to negotiate ephemeral key', reason);\n\n        return Promise.reject(reason);\n      });\n  },\n\n  /**\n   * KMS 'retrieve' requests can be made on behalf of another user. This is useful\n   * for scenarios such as eDiscovery. i.e. Where an authorized compliance officer is\n   * entitled to retrieve content generated by any organisational user.\n   * As the KMSContext is cached, updating it will affect separate requests. Hence when\n   * making a request onBehalfOf another user create a new context for just this request.\n   * However this context will be 'light' as it only needs to change one field.\n   * @param {Object} originalContext - The base context to 'copy'\n   * @param {String} onBehalfOf - The user specified in the new context\n   * @returns {Context} A 'copy' of the existing context with a new user specified\n   * @private\n   */\n  _contextOnBehalfOf(originalContext, onBehalfOf) {\n    const context = new Context();\n\n    context.clientInfo = context.clientInfo = {\n      clientId: originalContext.clientInfo.clientId,\n      credential: {\n        userId: onBehalfOf,\n        onBehalfOf, // Supports running onBehalfOf self. i.e. A CO which calls onBehalfOf with CO.id.\n        bearer: originalContext.clientInfo.credential.bearer,\n      },\n    };\n    context.serverInfo = originalContext.serverInfo;\n    context.ephemeralKey = originalContext.ephemeralKey;\n\n    return context;\n  },\n});\n\nexport default KMS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAIA;AACA;AAEA;AACA;AACA;AACA;AACA;AAEA;AAEA;AACA;AAAmE;AAAA;AAAA;AAEnE,IAAMA,QAAQ,GAAG,sBAAa;AAC9B,IAAMC,UAAU,GAAG,sBAAa;AAChC,IAAMC,eAAe,GAAG,sBAAa;AAErC,IAAMC,YAAY,GAAGC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;;AAE5C;AACA;AACA;AACA,IAAMC,GAAG,GAAGC,sBAAW,CAACC,MAAM,SAqY3B,IAAAC,iBAAS,EAAC;EACTC,UAAU,EAAE;IAAA,IAAEC,GAAG,QAAHA,GAAG;MAAEC,UAAU,QAAVA,UAAU;IAAA,iBAASD,GAAG,cAAIC,UAAU;EAAA;AACzD,CAAC,CAAC,UAvY2B;EAC7BC,SAAS,EAAE,YAAY;EAEvBC,QAAQ,EAAE;IACRC,OAAO,EAAEC;EACX,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,OAAO,0BAA6B;IAAA;IAAA,IAA3BC,GAAG,SAAHA,GAAG;MAAEC,MAAM,SAANA,MAAM;MAAEC,GAAG,SAAHA,GAAG;MAAEC,MAAM,SAANA,MAAM;IAC/BF,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAG;IAC1BU,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACT,GAAG;IAE1B,IAAI,CAACW,MAAM,CAACC,IAAI,CAAC,8BAA8B,CAAC;;IAEhD;IACA,IAAI,CAACJ,MAAM,EAAE;MACX,OAAO,iBAAQK,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;;IAEA;IACA,IAAI,CAACJ,MAAM,EAAE;MACX,OAAO,iBAAQG,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBC,WAAW,EAAET,MAAM;MACnBR,GAAG,EAAEU;IACP,CAAC,CAAC,CAACQ,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,KAAI,CAACR,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAOO,GAAG,CAACV,GAAG;IAChB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEW,cAAc,iCAAgC;IAAA;IAAA,IAA9BC,OAAO,SAAPA,OAAO;MAAEC,OAAO,SAAPA,OAAO;MAAEb,GAAG,SAAHA,GAAG;MAAEc,IAAI,SAAJA,IAAI;IACzCD,OAAO,GAAGA,OAAO,IAAI,EAAE;IACvB;IACA,IAAIC,IAAI,EAAE;MACRD,OAAO,GAAGC,IAAI,CAACC,MAAM,CAAC,UAACC,IAAI,EAAEC,CAAC,EAAK;QACjCD,IAAI,CAACE,IAAI,CAACD,CAAC,CAAC1B,GAAG,CAAC;QAEhB,OAAOyB,IAAI;MACb,CAAC,EAAEH,OAAO,CAAC;IACb;;IAEA;IACA,IAAIb,GAAG,EAAE;MACPa,OAAO,CAACK,IAAI,CAAClB,GAAG,CAACT,GAAG,CAAC;IACvB;;IAEA;IACA,IAAIsB,OAAO,CAACM,MAAM,KAAK,CAAC,EAAE;MACxB,OAAO,iBAAQf,MAAM,CAAC,IAAIC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5F;IAEA,IAAI,CAACH,MAAM,CAACC,IAAI,CAAC,wBAAwB,CAAC;IAE1C,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,EAAE,YAAY;MACjBqB,OAAO,EAAPA,OAAO;MACPC,OAAO,EAAPA;IACF,CAAC,CAAC,CAACJ,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,MAAI,CAACR,MAAM,CAACC,IAAI,CAAC,uBAAuB,CAAC;MAEzC,OAAOO,GAAG,CAACU,QAAQ;IACrB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,gBAAgB,mCAAkC;IAAA;IAAA,IAAhCT,OAAO,SAAPA,OAAO;MAAEU,OAAO,SAAPA,OAAO;MAAExB,GAAG,SAAHA,GAAG;MAAEC,MAAM,SAANA,MAAM;IAC7Ca,OAAO,GAAGA,OAAO,IAAI,EAAE;IACvBb,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAG;IAE1B,IAAI+B,OAAO,EAAE;MACXV,OAAO,GAAGA,OAAO,CAACW,MAAM,CAACD,OAAO,CAAC;IACnC;;IAEA;IACA,IAAIV,OAAO,CAACO,MAAM,KAAK,CAAC,EAAE;MACxB,OAAO,iBAAQf,MAAM,CAAC,IAAIC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzF;;IAEA;IACA,IAAI,CAACN,MAAM,EAAE;MACX,OAAO,iBAAQK,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,IAAI,CAACH,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;IAE7D,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,EAAE,iBAAiB;MACtBiB,WAAW,EAAET,MAAM;MACnBa,OAAO,EAAPA;IACF,CAAC,CAAC,CAACH,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,MAAI,CAACR,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;MAE5C,OAAOO,GAAG,CAACc,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,kBAAkB,qCAAgB;IAAA;IAAA,IAAd3B,GAAG,SAAHA,GAAG;MAAEC,MAAM,SAANA,MAAM;IAC7BA,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAG;IAC1B;IACA,IAAI,CAACQ,MAAM,EAAE;MACX,OAAO,iBAAQK,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBhB,GAAG,YAAKQ,MAAM;IAChB,CAAC,CAAC,CAACU,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,MAAI,CAACR,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAOO,GAAG,CAACc,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEE,mBAAmB,sCAAgC;IAAA;IAAA,IAA9BC,MAAM,SAANA,MAAM;MAAEC,MAAM,SAANA,MAAM;MAAE9B,GAAG,SAAHA,GAAG;MAAEC,MAAM,SAANA,MAAM;IAC9C4B,MAAM,GAAGA,MAAM,IAAIC,MAAM;IACzB7B,MAAM,GAAGA,MAAM,IAAID,GAAG,CAACP,GAAG;;IAE1B;IACA,IAAI,CAACoC,MAAM,EAAE;MACX,OAAO,iBAAQvB,MAAM,CAAC,IAAIC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF;;IAEA;IACA,IAAI,CAACN,MAAM,EAAE;MACX,OAAO,iBAAQK,MAAM,CAAC,IAAIC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,IAAI,CAACH,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;IAEjE,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,YAAKQ,MAAM,6BAAmB8B,oBAAW,CAACC,SAAS,CAAC;QAACH,MAAM,EAANA;MAAM,CAAC,CAAC;IAClE,CAAC,CAAC,CAAClB,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,MAAI,CAACR,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAOO,GAAG,CAACc,cAAc;IAC3B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEO,iBAAiB,oCAAU;IAAA;IAAA,IAARC,KAAK,SAALA,KAAK;IACtB,IAAI,CAAC9B,MAAM,CAACC,IAAI,wBAAiB6B,KAAK,mBAAgB;;IAEtD;IACA,IAAI,CAACA,KAAK,EAAE;MACV,OAAO,iBAAQ5B,MAAM,CAAC,IAAIC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjE;IAEA,OAAO,IAAI,CAACC,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,EAAE,OAAO;MACZyC,KAAK,EAALA;IACF,CAAC,CAAC,CAACvB,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,MAAI,CAACR,MAAM,CAACC,IAAI,CAAC,4BAA4B,CAAC;MAE9C,OAAO,iBAAQ8B,GAAG,CAACvB,GAAG,CAACI,IAAI,CAACoB,GAAG,CAAC,MAAI,CAACC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;EACEC,cAAc,iCAAkB;IAAA;IAAA,IAAhBC,aAAa,SAAbA,aAAa;IAC3B,IAAI,CAACnC,MAAM,CAACC,IAAI,CAAC,gCAAgC,CAAC;IAElD,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBhB,GAAG,EAAE,YAAY;MACjB8C,aAAa,EAAbA;IACF,CAAC,CAAC,CAAC5B,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,MAAI,CAACR,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;MAE5C,OAAOO,GAAG,CAAC4B,SAAS;IACtB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,uBAAuB,0CAAqD;IAAA;IAAA,IAAnDF,aAAa,SAAbA,aAAa;MAAEG,iBAAiB,SAAjBA,iBAAiB;MAAA,qBAAEC,MAAM;MAANA,MAAM,6BAAG,KAAK;IACvE,IAAI,CAACvC,MAAM,CAACC,IAAI,CAAC,0CAA0C,CAAC;IAE5D,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,EAAEkD,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCJ,aAAa,EAAbA,aAAa;MACbG,iBAAiB,EAAjBA,iBAAiB;MACjBE,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACnC,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,MAAI,CAACR,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;MAE7D,OAAOO,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEmC,wBAAwB,4CAAkC;IAAA;IAAA,IAAhCR,aAAa,UAAbA,aAAa;MAAA,uBAAEI,MAAM;MAANA,MAAM,8BAAG,KAAK;IACrD,IAAI,CAACvC,MAAM,CAACC,IAAI,CAAC,4CAA4C,CAAC;IAE9D,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,UAAU;MAClBhB,GAAG,EAAEkD,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCJ,aAAa,EAAbA,aAAa;MACbK,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACnC,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,MAAI,CAACR,MAAM,CAACC,IAAI,CAAC,6CAA6C,CAAC;MAE/D,OAAOO,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEoC,4BAA4B,gDAAmC;IAAA;IAAA,IAAjCC,KAAK,UAALA,KAAK;MAAEC,QAAQ,UAARA,QAAQ;MAAEX,aAAa,UAAbA,aAAa;IAC1D,IAAI,CAACnC,MAAM,CAACC,IAAI,CAAC,oDAAoD,CAAC;IAEtE,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,EAAEwD,KAAK;MACVC,QAAQ,EAARA,QAAQ;MACRX,aAAa,EAAbA,aAAa;MACbK,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACnC,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,OAAI,CAACR,MAAM,CAACC,IAAI,CAAC,2DAA2D,EAAE6C,QAAQ,CAAC;MAEvF,OAAOtC,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEuC,2BAA2B,+CAAkC;IAAA;IAAA,IAAhCZ,aAAa,UAAbA,aAAa;MAAA,uBAAEI,MAAM;MAANA,MAAM,8BAAG,KAAK;IACxD,IAAI,CAACvC,MAAM,CAACC,IAAI,CAAC,uDAAuD,CAAC;IAEzE,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,EAAEkD,MAAM,GAAG,YAAY,GAAG,MAAM;MACnCJ,aAAa,EAAbA,aAAa;MACbK,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACnC,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,OAAI,CAACR,MAAM,CAACC,IAAI,CAAC,gDAAgD,CAAC;MAElE,OAAOO,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEwC,kBAAkB,sCAAkB;IAAA;IAAA,IAAhBb,aAAa,UAAbA,aAAa;IAC/B,IAAI,CAACnC,MAAM,CAACC,IAAI,CAAC,sCAAsC,CAAC;IAExD,OAAO,IAAI,CAACG,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,EAAE,SAAS;MACdyD,QAAQ,EAAE,QAAQ;MAClBX,aAAa,EAAbA,aAAa;MACbK,SAAS,EAAEC,aAAI,CAACC,EAAE;IACpB,CAAC,CAAC,CAACnC,IAAI,CAAC,UAACC,GAAG,EAAK;MACf,OAAI,CAACR,MAAM,CAACC,IAAI,CAAC,4CAA4C,CAAC;MAE9D,OAAOO,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAgBDyC,QAAQ,4BAAoB;IAAA;IAAA,IAAlB5D,GAAG,UAAHA,GAAG;MAAEC,UAAU,UAAVA,UAAU;IACvB;IACA,IAAI,CAACD,GAAG,EAAE;MACR,OAAO,iBAAQa,MAAM,CAAC,IAAIC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/D;IAEA,IAAI,CAACH,MAAM,CAACC,IAAI,CAAC,mBAAmB,CAAC;IAErC,OAAO,IAAI,CAACG,OAAO,CACjB;MACEC,MAAM,EAAE,UAAU;MAClBhB,GAAG,EAAHA;IACF,CAAC,EACD;MAACC,UAAU,EAAVA;IAAU,CAAC,CACb,CAACiB,IAAI,CAAC,UAACC,GAAG,EAAK;MACd,OAAI,CAACR,MAAM,CAACC,IAAI,CAAC,kBAAkB,CAAC;MAEpC,OAAO,OAAI,CAACgC,KAAK,CAACzB,GAAG,CAACV,GAAG,CAAC;IAC5B,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;EACEoD,IAAI,kBAAG;IACL,OAAO,IAAI,CAAC9C,OAAO,CAAC;MAClBC,MAAM,EAAE,QAAQ;MAChBhB,GAAG,EAAE;IACP,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;EACE4C,KAAK,iBAACnC,GAAG,EAAE;IACT,OAAOqD,iBAAI,CAACC,GAAG,CAACnB,KAAK,CAACnC,GAAG,CAACuD,GAAG,CAAC,CAAC9C,IAAI,CAAC,UAAC8C,GAAG,EAAK;MAC3CvD,GAAG,CAACuD,GAAG,GAAGA,GAAG;MAEb,OAAOvD,GAAG;IACZ,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;EACEwD,cAAc,0BAACC,OAAO,EAAEjE,UAAU,EAAE;IAAA;IAClC,IAAMkE,aAAa,GAAGD,OAAO,CAAClD,MAAM,KAAK,QAAQ,IAAIkD,OAAO,CAAClE,GAAG,CAACoE,QAAQ,CAAC,QAAQ,CAAC;IAEnF,OAAO,iBAAQC,OAAO,CAACF,aAAa,GAAG3E,eAAe,CAAC8E,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAACC,WAAW,EAAE,CAAC,CAACrD,IAAI,CACzF,UAACsD,OAAO,EAAK;MACX,OAAI,CAAC7D,MAAM,CAACC,IAAI,yBAAkBuD,aAAa,GAAG,eAAe,GAAG,KAAK,cAAW;MACpF,IAAMM,GAAG,GAAG,IAAIC,gBAAO,CAACR,OAAO,CAAC;MAChC,IAAIS,cAAc,GAAGH,OAAO;MAE5B,IAAIvE,UAAU,EAAE;QACd0E,cAAc,GAAG,OAAI,CAACC,kBAAkB,CAACJ,OAAO,EAAEvE,UAAU,CAAC;MAC/D;MAEA,OAAOwE,GAAG,CAACI,IAAI,CAACF,cAAc,EAAE;QAACG,SAAS,EAAEX;MAAa,CAAC,CAAC,CAACjD,IAAI,CAAC,YAAM;QACrE;QACA,IAAI6D,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;UACzC,OAAI,CAACtE,MAAM,CAACC,IAAI,CACd,sBAAsB,EACtBsE,aAAI,CAACC,OAAO,CAAC,oBAAKC,IAAI,CAACC,KAAK,CAAC,wBAAeZ,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;YAACa,KAAK,EAAE;UAAI,CAAC,CAAC,CAC9E;QACH;QAEA,OAAOb,GAAG;MACZ,CAAC,CAAC;IACJ,CAAC,CACF;EACH,CAAC;EAED;AACF;AACA;AACA;AACA;EACEc,sBAAsB,kCAACC,KAAK,EAAE;IAAA;IAC5B,IAAI,CAAC7E,MAAM,CAACC,IAAI,CAAC,2BAA2B,CAAC;IAE7C,OAAO,iBAAQ8B,GAAG,CAChB8C,KAAK,CAACC,UAAU,CAACC,WAAW,CAAC/C,GAAG,CAAC,UAACgD,UAAU,EAAEC,KAAK;MAAA,OACjD,OAAI,CAACC,eAAe,CAACF,UAAU,CAAC,CAACzE,IAAI,CAAC,UAAC4E,aAAa,EAAK;QACvD,OAAI,CAACnF,MAAM,CAACC,IAAI,yBAAkBkF,aAAa,GAAG,OAAO,GAAG,QAAQ,cAAW;QAC/E,IAAM3E,GAAG,GAAG,IAAI4E,iBAAQ,CAACJ,UAAU,CAAC;QAEpC,OACE,iBAAQtB,OAAO,CAACyB,aAAa,GAAGtG,eAAe,CAAC8E,GAAG,CAAC,OAAI,CAAC,GAAGhF,QAAQ,CAACgF,GAAG,CAAC,OAAI,CAAC;QAC5E;QAAA,CACCpD,IAAI,CAAC,UAACsD,OAAO;UAAA,OAAKrD,GAAG,CAAC6E,MAAM,CAACxB,OAAO,CAAC;QAAA;QACtC;QAAA,CACCtD,IAAI,CAAC,YAAM;UACV,IAAI6D,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;YACzC,OAAI,CAACtE,MAAM,CAACC,IAAI,CACd,uBAAuB,EACvBsE,aAAI,CAACC,OAAO,CAAC,oBAAKC,IAAI,CAACC,KAAK,CAAC,wBAAelE,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;cAACmE,KAAK,EAAE;YAAI,CAAC,CAAC,CAC9E;UACH;QACF,CAAC;QACD;QAAA,CACCpE,IAAI,CAAC,YAAM;UACVsE,KAAK,CAACC,UAAU,CAACC,WAAW,CAACE,KAAK,CAAC,GAAGzE,GAAG;QAC3C,CAAC;QACD;QAAA,CACCD,IAAI,CAAC;UAAA,OAAMC,GAAG;QAAA,EAAC;MAEtB,CAAC,CAAC;IAAA,EACH,CACF,CACED,IAAI,CAAC;MAAA,OAAM,OAAI,CAACd,OAAO,CAACmF,sBAAsB,CAACC,KAAK,CAAC;IAAA,EAAC,CACtDS,KAAK,CAAC,UAACC,MAAM,EAAK;MACjB,OAAI,CAACvF,MAAM,CAACwF,KAAK,CAAC,qBAAqB,EAAED,MAAM,CAACE,KAAK,CAAC;MAEtD,OAAO,iBAAQvF,MAAM,CAACqF,MAAM,CAAC;IAC/B,CAAC,CAAC,CACDhF,IAAI,CAAC;MAAA,OAAMsE,KAAK;IAAA,EAAC;EACtB,CAAC;EAED;AACF;AACA;AACA;AACA;EACEa,iBAAiB,6BAACV,UAAU,EAAE;IAC5B,IAAMxE,GAAG,GAAG,IAAI4E,iBAAQ,CAACJ,UAAU,CAAC;IAEpC,OAAOrG,QAAQ,CACZgF,GAAG,CAAC,IAAI,CAAC,CACTpD,IAAI,CAAC,UAACsD,OAAO;MAAA,OAAKrD,GAAG,CAAC6E,MAAM,CAACxB,OAAO,CAAC;IAAA,EAAC,CACtCtD,IAAI,CAAC;MAAA,OAAMC,GAAG,CAACmF,IAAI;IAAA,EAAC;EACzB,CAAC;EAED;AACF;AACA;AACA;AACA;EACET,eAAe,2BAACF,UAAU,EAAE;IAC1B,OAAO,IAAI,CAACY,mBAAmB,EAAE,CAACrF,IAAI,CAAC,UAACsF,eAAe,EAAK;MAC1D,IAAMC,MAAM,GAAGd,UAAU,CAACe,KAAK,CAAC,GAAG,CAAC;MAEpC,IAAID,MAAM,CAAC7E,MAAM,KAAK,CAAC,EAAE;QACvB,OAAO,KAAK;MACd;MAEA,IAAM+E,MAAM,GAAGvB,IAAI,CAACC,KAAK,CAACvB,iBAAI,CAACoB,IAAI,CAAC0B,SAAS,CAACC,MAAM,CAACJ,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;MAEhE,OAAOE,MAAM,CAACG,GAAG,KAAKN,eAAe,CAACM,GAAG;IAC3C,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE/F,OAAO,mBAACmD,OAAO,EAA8B;IAAA;IAAA,iFAAJ,CAAC,CAAC;MAAzB6C,OAAO,UAAPA,OAAO;MAAE9G,UAAU,UAAVA,UAAU;IACnC8G,OAAO,GAAGA,OAAO,IAAI,IAAI,CAACC,MAAM,CAACC,iBAAiB;;IAElD;IACA;IACA,OACE,IAAI,CAACC,KAAK,CAACC,QAAQ,CAACC,OAAO,CACxBC,OAAO,EAAE,CACTnG,IAAI,CAAC;MAAA,OAAM,OAAI,CAAC+C,cAAc,CAACC,OAAO,EAAEjE,UAAU,CAAC;IAAA,EAAC,CACpDiB,IAAI,CAAC,UAACuD,GAAG,EAAK;MACbA,GAAG,CAAC6C,0BAAc,CAAC,GAAGP,OAAO;MAE7B,OAAO,OAAI,CAAC3G,OAAO,CAACW,OAAO,CAAC0D,GAAG,CAAC;IAClC,CAAC;IACD;IACA;IAAA,CACCwB,KAAK,CAAC,UAACC,MAAM,EAAK;MACjB,IACEnB,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,MAAM,KAC9BiB,MAAM,CAACqB,MAAM,KAAK,GAAG,IAAIrB,MAAM,CAACsB,UAAU,KAAK,GAAG,CAAC,IACpDtB,MAAM,CAACuB,OAAO,CAACC,KAAK,CAClB,sEAAsE,CACvE,EACD;QACA,OAAI,CAAC/G,MAAM,CAACgH,IAAI,CAAC,wDAAwD,CAAC;QAE1E,OAAO,OAAI,CAAC5G,OAAO,CAACmD,OAAO,EAAE;UAACjE,UAAU,EAAVA;QAAU,CAAC,CAAC;MAC5C;;MAEA;MACA,IAAIiG,MAAM,YAAY0B,kCAAQ,EAAE;QAC9B,OAAI,CAACV,KAAK,CAACW,OAAO,CAAC,4BAA4B,CAAC;QAEhD,OAAO,iBAAQhH,MAAM,CAACqF,MAAM,CAAC;MAC/B;;MAEA;MACA;MACA;MACA,IAAI,CAACA,MAAM,CAACsB,UAAU,IAAI,CAACtB,MAAM,CAACqB,MAAM,EAAE;QACxC;QACA,IAAIxC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;UACzC;UACA,OAAI,CAACtE,MAAM,CAACC,IAAI,CAAC,oBAAoB,EAAEsF,MAAM,CAACE,KAAK,IAAIF,MAAM,CAAC;QAChE;QAEAzG,YAAY,mBAAYsH,OAAO,EAAG;QAClCA,OAAO,IAAI,CAAC;QAEZ,IAAIA,OAAO,IAAI,OAAI,CAACC,MAAM,CAACc,cAAc,EAAE;UACzC,OAAI,CAACnH,MAAM,CAACC,IAAI,CAAC,2CAA2C,CAAC;UAE7D,OAAO,iBAAQC,MAAM,CAACqF,MAAM,CAAC;QAC/B;;QAEA;QACA;QACA,IAAM6B,WAAW,GAAGhB,OAAO,GAAG,CAAC;QAE/B,IAAIA,OAAO,IAAI,OAAI,CAACC,MAAM,CAACgB,aAAa,IAAID,WAAW,GAAG,OAAI,CAACf,MAAM,CAACc,cAAc,EAAE;UACpF,OAAI,CAACnH,MAAM,CAACC,IAAI,CACd,qEAAqE,CACtE;;UAED;UACA,IAAImE,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;YACzC,OAAI,CAACtE,MAAM,CAACC,IAAI,CAAC,yBAAyB,EAAEmG,OAAO,EAAE,OAAI,CAACC,MAAM,CAACgB,aAAa,CAAC;UACjF;UAEA1I,QAAQ,CAAC2I,MAAM,CAAC,OAAI,CAAC;UACrBlB,OAAO,GAAG,CAAC;QACb;QAEA,OAAO,OAAI,CAAChG,OAAO,CAACmD,OAAO,EAAE;UAAC6C,OAAO,EAAPA,OAAO;UAAE9G,UAAU,EAAVA;QAAU,CAAC,CAAC;MACrD;MAEA,OAAO,iBAAQY,MAAM,CAACqF,MAAM,CAAC;IAC/B,CAAC,CAAC;EAER,CAAC;EAED;AACF;AACA;AACA;EACEgC,iBAAiB,+BAAG;IAClB,OAAO,IAAI,CAAChB,KAAK,CAACiB,WAAW,CAACC,YAAY,CAAC,WAAW,CAAC,CAAClH,IAAI,CAAC,UAACmH,KAAK;MAAA,OAAKA,KAAK,CAACC,YAAY;IAAA,EAAC;EAC7F,CAAC;EAGD;AACF;AACA;AACA;AACA;EACE/D,WAAW,yBAAG;IAAA;IACZ,IAAIgE,OAAO,GAAGjJ,QAAQ,CAACgF,GAAG,CAAC,IAAI,CAAC;IAEhC,IAAI,CAACiE,OAAO,EAAE;MACZA,OAAO,GAAG,IAAI,CAACC,eAAe,EAAE;MAChClJ,QAAQ,CAACmJ,GAAG,CAAC,IAAI,EAAEF,OAAO,CAAC;MAC3BA,OAAO,CAACrH,IAAI,CAAC,UAACsD,OAAO,EAAK;QACxB,IAAMkE,SAAS,GAAGlE,OAAO,CAACmE,YAAY,CAACC,cAAc,GAAG,mBAAU,GAAG,KAAK;QAE1E,IAAAC,4BAAc,EAAC;UAAA,OAAMvJ,QAAQ,CAAC2I,MAAM,CAAC,OAAI,CAAC;QAAA,GAAES,SAAS,CAAC;MACxD,CAAC,CAAC;IACJ;IAEA,OAAO,iBAAQhG,GAAG,CAAC,CAAC6F,OAAO,EAAE,IAAI,CAACL,iBAAiB,EAAE,CAAC,CAAC,CAAChH,IAAI,CAAC,kBAA8B;MAAA;QAA5BsD,OAAO;QAAEsE,aAAa;MACnFtE,OAAO,CAACuE,UAAU,CAACC,UAAU,CAACC,MAAM,GAAGH,aAAa;MAEpD,OAAOtE,OAAO;IAChB,CAAC,CAAC;EACJ,CAAC;EAED;AACF;AACA;AACA;EACE0E,cAAc,4BAAG;IACf,IAAI,CAACvI,MAAM,CAACC,IAAI,CAAC,6BAA6B,CAAC;IAE/C,OAAO,IAAI,CAACuI,cAAc,EAAE,CAACjI,IAAI,CAAC;MAAA,IAAEkI,UAAU,UAAVA,UAAU;MAAA,OAAMA,UAAU;IAAA,EAAC;EACjE,CAAC;EAED;AACF;AACA;AACA;EACED,cAAc,4BAAG;IAAA;IACf,IAAIE,OAAO,GAAG9J,UAAU,CAAC+E,GAAG,CAAC,IAAI,CAAC;IAElC,IAAI,CAAC+E,OAAO,EAAE;MACZ,IAAI,CAAC1I,MAAM,CAACC,IAAI,CAAC,2BAA2B,CAAC;MAC7CyI,OAAO,GAAG,IAAI,CAACnC,KAAK,CACjBnG,OAAO,CAAC;QACPuI,OAAO,EAAE,YAAY;QACrBzH,QAAQ,iBAAU,IAAI,CAACqF,KAAK,CAACC,QAAQ,CAACoC,MAAM,CAAClH,MAAM;MACrD,CAAC,CAAC,CACDnB,IAAI,CAAC,UAACC,GAAG,EAAK;QACb,OAAI,CAACR,MAAM,CAACC,IAAI,CAAC,0BAA0B,CAAC;QAC5C,IAAO0F,IAAI,GAAInF,GAAG,CAAXmF,IAAI;QAEXA,IAAI,CAACkD,YAAY,GAAGpE,IAAI,CAACC,KAAK,CAACiB,IAAI,CAACkD,YAAY,CAAC;QAEjD,OAAOlD,IAAI;MACb,CAAC,CAAC,CACDL,KAAK,CAAC,UAACC,MAAM,EAAK;QACjB,OAAI,CAACvF,MAAM,CAACwF,KAAK,CAAC,kCAAkC,EAAED,MAAM,CAAC;QAE7D,OAAO,iBAAQrF,MAAM,CAACqF,MAAM,CAAC;MAC/B,CAAC,CAAC;MAEJ3G,UAAU,CAACkJ,GAAG,CAAC,IAAI,EAAEY,OAAO,CAAC;IAC/B;IAEA,OAAOA,OAAO;EAChB,CAAC;EAED;AACF;AACA;AACA;EACE9C,mBAAmB,iCAAG;IACpB,IAAI,CAAC5F,MAAM,CAACC,IAAI,CAAC,uCAAuC,CAAC;IAEzD,OAAO,IAAI,CAACuI,cAAc,EAAE,CAACjI,IAAI,CAAC;MAAA,IAAEsI,YAAY,UAAZA,YAAY;MAAA,OAAMA,YAAY;IAAA,EAAC;EACrE,CAAC;EAED;AACF;AACA;AACA;EACEhB,eAAe,6BAAG;IAAA;IAChB,IAAI,CAAC7H,MAAM,CAACC,IAAI,CAAC,uBAAuB,CAAC;IACzC,IAAM4D,OAAO,GAAG,IAAIiF,gBAAO,EAAE;IAE7B,OAAO,iBAAQ/G,GAAG,CAAC,CACjB,IAAI,CAAC6D,mBAAmB,EAAE,CAACrF,IAAI,CAAC,IAAAwI,iCAAW,EAAC,IAAI,CAAC1C,MAAM,CAAC2C,OAAO,CAAC,CAAC,EACjE,IAAI,CAACzB,iBAAiB,EAAE,CACzB,CAAC,CACChH,IAAI,CAAC,kBAAsC;MAAA;QAApCsF,eAAe;QAAEsC,aAAa;MACpCtE,OAAO,CAACuE,UAAU,GAAG;QACnBa,QAAQ,EAAE,OAAI,CAAC1C,KAAK,CAACC,QAAQ,CAACoC,MAAM,CAACM,GAAG;QACxCb,UAAU,EAAE;UACV3G,MAAM,EAAE,OAAI,CAAC6E,KAAK,CAACC,QAAQ,CAACoC,MAAM,CAAClH,MAAM;UACzC4G,MAAM,EAAEH;QACV;MACF,CAAC;MAEDtE,OAAO,CAACsF,UAAU,GAAG;QACnBrJ,GAAG,EAAE+F;MACP,CAAC;MAED,OAAI,CAAC7F,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAO4D,OAAO,CAACuF,aAAa,EAAE;IAChC,CAAC,CAAC,CACD7I,IAAI,CAAC,UAAC8I,YAAY,EAAK;MACtBxF,OAAO,CAACmE,YAAY,GAAGqB,YAAY;MACnCxK,eAAe,CAACiJ,GAAG,CAAC,OAAI,EAAEjE,OAAO,CAAC;MAElC,OAAO,iBAAQ9B,GAAG,CAAC,CAACsH,YAAY,CAACpH,KAAK,EAAE,EAAE,OAAI,CAACsG,cAAc,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CACDhI,IAAI,CAAC,kBAA6B;MAAA;QAA3B8I,YAAY;QAAEC,OAAO;MAC3B,OAAI,CAACtJ,MAAM,CAACC,IAAI,CAAC,uCAAuC,CAAC;MAEzD,OAAO,OAAI,CAACG,OAAO,CAAC;QAClBf,GAAG,YAAKiK,OAAO,WAAQ;QACvBjJ,MAAM,EAAE,QAAQ;QAChBgD,GAAG,EAAEgG,YAAY,CAACE,MAAM;MAC1B,CAAC,CAAC;IACJ,CAAC,CAAC,CACDhJ,IAAI,CAAC,UAACC,GAAG,EAAK;MACb,OAAI,CAACR,MAAM,CAACC,IAAI,CAAC,mCAAmC,CAAC;MAErD,OAAO4D,OAAO,CAAC2F,kBAAkB,CAAChJ,GAAG,CAACV,GAAG,CAAC;IAC5C,CAAC,CAAC,CACDS,IAAI,CAAC,UAACT,GAAG,EAAK;MACb+D,OAAO,CAACmE,YAAY,GAAGlI,GAAG;MAC1BjB,eAAe,CAACyI,MAAM,CAAC,OAAI,CAAC;MAC5B,OAAI,CAACtH,MAAM,CAACC,IAAI,CAAC,kCAAkC,CAAC;MAEpD,OAAO4D,OAAO;IAChB,CAAC,CAAC,CACDyB,KAAK,CAAC,UAACC,MAAM,EAAK;MACjB,OAAI,CAACvF,MAAM,CAACwF,KAAK,CAAC,wCAAwC,EAAED,MAAM,CAAC;MAEnE,OAAO,iBAAQrF,MAAM,CAACqF,MAAM,CAAC;IAC/B,CAAC,CAAC;EACN,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEtB,kBAAkB,8BAACwF,eAAe,EAAEnK,UAAU,EAAE;IAC9C,IAAMuE,OAAO,GAAG,IAAIiF,gBAAO,EAAE;IAE7BjF,OAAO,CAACuE,UAAU,GAAGvE,OAAO,CAACuE,UAAU,GAAG;MACxCa,QAAQ,EAAEQ,eAAe,CAACrB,UAAU,CAACa,QAAQ;MAC7CZ,UAAU,EAAE;QACV3G,MAAM,EAAEpC,UAAU;QAClBA,UAAU,EAAVA,UAAU;QAAE;QACZgJ,MAAM,EAAEmB,eAAe,CAACrB,UAAU,CAACC,UAAU,CAACC;MAChD;IACF,CAAC;IACDzE,OAAO,CAACsF,UAAU,GAAGM,eAAe,CAACN,UAAU;IAC/CtF,OAAO,CAACmE,YAAY,GAAGyB,eAAe,CAACzB,YAAY;IAEnD,OAAOnE,OAAO;EAChB,CAAC;EAAA;AACH,CAAC,oMA3KE1E,iBAAS,+EA2KV;AAAC,eAEYH,GAAG;AAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webex/internal-plugin-encryption",
-  "version": "3.0.0-beta.4",
+  "version": "3.0.0-beta.400",
   "description": "",
   "license": "MIT",
   "main": "dist/index.js",
@@ -24,27 +24,27 @@
     ]
   },
   "devDependencies": {
-    "@webex/test-helper-chai": "3.0.0-beta.4",
-    "@webex/test-helper-make-local-url": "3.0.0-beta.4",
-    "@webex/test-helper-mocha": "3.0.0-beta.4",
-    "@webex/test-helper-mock-webex": "3.0.0-beta.4",
-    "@webex/test-helper-test-users": "3.0.0-beta.4",
+    "@webex/test-helper-chai": "3.0.0-beta.400",
+    "@webex/test-helper-make-local-url": "3.0.0-beta.400",
+    "@webex/test-helper-mocha": "3.0.0-beta.400",
+    "@webex/test-helper-mock-webex": "3.0.0-beta.400",
+    "@webex/test-helper-test-users": "3.0.0-beta.400",
     "sinon": "^9.2.4"
   },
   "dependencies": {
-    "@webex/common": "3.0.0-beta.4",
-    "@webex/common-timers": "3.0.0-beta.4",
-    "@webex/http-core": "3.0.0-beta.4",
-    "@webex/internal-plugin-device": "3.0.0-beta.4",
-    "@webex/internal-plugin-encryption": "3.0.0-beta.4",
-    "@webex/internal-plugin-mercury": "3.0.0-beta.4",
-    "@webex/test-helper-file": "3.0.0-beta.4",
-    "@webex/webex-core": "3.0.0-beta.4",
+    "@webex/common": "3.0.0-beta.400",
+    "@webex/common-timers": "3.0.0-beta.400",
+    "@webex/http-core": "3.0.0-beta.400",
+    "@webex/internal-plugin-device": "3.0.0-beta.400",
+    "@webex/internal-plugin-encryption": "3.0.0-beta.400",
+    "@webex/internal-plugin-mercury": "3.0.0-beta.400",
+    "@webex/test-helper-file": "3.0.0-beta.400",
+    "@webex/webex-core": "3.0.0-beta.400",
     "asn1js": "^2.0.26",
     "debug": "^4.3.4",
     "isomorphic-webcrypto": "^2.3.8",
     "lodash": "^4.17.21",
-    "node-jose": "^2.0.0",
+    "node-jose": "^2.2.0",
     "node-kms": "^0.4.0",
     "node-scr": "^0.3.0",
     "pkijs": "^2.1.84",

package/src/config.js

@@ -7,7 +7,7 @@ export default {
     joseOptions: {
       compact: true,
       contentAlg: 'A256GCM',
-      protect: '*'
+      protect: '*',
     },
 
     /**
@@ -45,6 +45,6 @@ export default {
      * Debounce max wait before sending a kms metric
      * @type {Number}
      */
-    batcherMaxWait: 150
-  }
+    batcherMaxWait: 150,
+  },
 };

package/src/constants.js

@@ -0,0 +1,3 @@
+export const KMS_KEY_REVOKE_FAILURE = 'event:kms:key:revoke:encryption:failure';
+export const KMS_KEY_REVOKE_ERROR_STATUS = 405;
+export const KMS_KEY_REVOKE_ERROR_CODES = [405005, 405006];

package/src/encryption.js

@@ -15,7 +15,7 @@ import KMS from './kms';
 
 const Encryption = WebexPlugin.extend({
   children: {
-    kms: KMS
+    kms: KMS,
   },
 
   namespace: 'Encryption',
@@ -25,15 +25,14 @@ const Encryption = WebexPlugin.extend({
   },
 
   decryptBinary(scr, buffer) {
-    return ensureBuffer(buffer)
-      .then((b) => {
-        /* istanbul ignore if */
-        if (buffer.length === 0 || buffer.byteLength === 0) {
-          return Promise.reject(new Error('Attempted to decrypt zero-length buffer'));
-        }
-
-        return scr.decrypt(b);
-      });
+    return ensureBuffer(buffer).then((b) => {
+      /* istanbul ignore if */
+      if (buffer.length === 0 || buffer.byteLength === 0) {
+        return Promise.reject(new Error('Attempted to decrypt zero-length buffer'));
+      }
+
+      return scr.decrypt(b);
+    });
   },
 
   /**
@@ -46,8 +45,7 @@ const Encryption = WebexPlugin.extend({
    * @returns {Object} Decrypted SCR
    */
   decryptScr(key, cipherScr, options) {
-    return this.getKey(key, options)
-      .then((k) => SCR.fromJWE(k.jwk, cipherScr));
+    return this.getKey(key, options).then((k) => SCR.fromJWE(k.jwk, cipherScr));
   },
 
   /**
@@ -60,33 +58,34 @@ const Encryption = WebexPlugin.extend({
    * @returns {string} Decrypted plaintext
    */
   decryptText(key, ciphertext, options) {
-    return this.getKey(key, options)
-      .then((k) => jose.JWE
-        .createDecrypt(k.jwk)
+    return this.getKey(key, options).then((k) =>
+      jose.JWE.createDecrypt(k.jwk)
         .decrypt(ciphertext)
-        .then((result) => result.plaintext.toString()));
+        .then((result) => result.plaintext.toString())
+    );
   },
 
   /**
    * Validate and initiate a Download request for requested file
-   *
+   * @param {Object} fileUrl - Plaintext
    * @param {Object} scr - Plaintext
    * @param {Object} options - optional parameters to download a file
    * @returns {promise}
    */
-  download(scr, options) {
+  download(fileUrl, scr, options) {
     /* istanbul ignore if */
-    if (!scr.loc) {
-      return Promise.reject(new Error('`scr.loc` is required'));
+    if (!fileUrl || !scr) {
+      return Promise.reject(new Error('`scr` and `fileUrl` are required'));
     }
 
     const shunt = new EventEmitter();
-    const promise = this._fetchDownloadUrl(scr, options)
+    const promise = this._fetchDownloadUrl(fileUrl, options)
       .then((uri) => {
+        // eslint-disable-next-line no-shadow
         const options = {
           method: 'GET',
           uri,
-          responseType: 'buffer'
+          responseType: 'buffer',
         };
 
         const ret = this.request(options);
@@ -104,24 +103,25 @@ const Encryption = WebexPlugin.extend({
 
   /**
    * Fetch Download URL for the requested file
-   *
-   * @param {Object} scr - Plaintext
+   * @param {Object} fileUrl - Plaintext
    * @param {Object} options - optional parameters to download a file
    * @returns {promise} url of the downloadable file
    */
-  _fetchDownloadUrl(scr, options) {
+  _fetchDownloadUrl(fileUrl, options) {
     this.logger.info('encryption: retrieving download url for encrypted file');
 
-    if (process.env.NODE_ENV !== 'production' && scr.loc.includes('localhost')) {
-      this.logger.info('encryption: bypassing webex files because this looks to be a test file on localhost');
+    if (process.env.NODE_ENV !== 'production' && fileUrl.includes('localhost')) {
+      this.logger.info(
+        'encryption: bypassing webex files because this looks to be a test file on localhost'
+      );
 
-      return Promise.resolve(scr.loc);
+      return Promise.resolve(fileUrl);
     }
 
     const inputBody = {
-      endpoints: [scr.loc]
+      endpoints: [fileUrl],
     };
-    const endpointUrl = url.parse(scr.loc);
+    const endpointUrl = url.parse(fileUrl);
 
     // hardcode the url to use 'https' and the file service '/v1/download/endpoints' api
     endpointUrl.protocol = 'https';
@@ -130,32 +130,47 @@ const Encryption = WebexPlugin.extend({
     return this.request({
       method: 'POST',
       uri: url.format(endpointUrl),
-      body: options ? {
-        ...inputBody,
-        allow: options.params.allow
-      } : inputBody
+      body: options
+        ? {
+            ...inputBody,
+            allow: options.params.allow,
+          }
+        : inputBody,
     })
       .then((res) => {
-        const url = res.body.endpoints[scr.loc];
+        // eslint-disable-next-line no-shadow
+        const url = res.body.endpoints[fileUrl];
 
         if (!url) {
-          this.logger.warn('encryption: could not determine download url for `scr.loc`; attempting to download `scr.loc` directly');
+          this.logger.warn(
+            'encryption: could not determine download url for `fileUrl`; attempting to download `fileUrl` directly'
+          );
 
-          return scr.loc;
+          return fileUrl;
         }
         this.logger.info('encryption: retrieved download url for encrypted file');
 
         return url;
+      })
+      .catch((err) => {
+        this.logger.warn(
+          `encryption: ${err} could not determine download url for ${fileUrl}; attempting to download ${fileUrl} directly`
+        );
+
+        return fileUrl;
       });
   },
 
   encryptBinary(file) {
-    return ensureBuffer(file)
-      .then((buffer) => SCR.create()
-        .then((scr) => scr.encrypt(buffer)
+    return ensureBuffer(file).then((buffer) =>
+      SCR.create().then((scr) =>
+        scr
+          .encrypt(buffer)
           .then(ensureBuffer)
           // eslint-disable-next-line max-nested-callbacks
-          .then((cdata) => ({scr, cdata}))));
+          .then((cdata) => ({scr, cdata}))
+      )
+    );
   },
 
   /**
@@ -173,8 +188,7 @@ const Encryption = WebexPlugin.extend({
       return Promise.reject(new Error('Cannot encrypt `scr` without first setting `loc`'));
     }
 
-    return this.getKey(key, options)
-      .then((k) => scr.toJWE(k.jwk));
+    return this.getKey(key, options).then((k) => scr.toJWE(k.jwk));
   },
 
   /**
@@ -187,16 +201,15 @@ const Encryption = WebexPlugin.extend({
    * @returns {string} Encrypted text
    */
   encryptText(key, plaintext, options) {
-    return this.getKey(key, options)
-      .then((k) => jose.JWE
-        .createEncrypt(this.config.joseOptions, {
-          key: k.jwk,
-          header: {
-            alg: 'dir'
-          },
-          reference: null
-        })
-        .final(plaintext, 'utf8'));
+    return this.getKey(key, options).then((k) =>
+      jose.JWE.createEncrypt(this.config.joseOptions, {
+        key: k.jwk,
+        header: {
+          alg: 'dir',
+        },
+        reference: null,
+      }).final(plaintext, 'utf8')
+    );
   },
 
   /**
@@ -218,12 +231,16 @@ const Encryption = WebexPlugin.extend({
       storageKey += `/onBehalfOf/${onBehalfOf}`;
     }
 
-    return this.unboundedStorage.get(storageKey)
+    return this.unboundedStorage
+      .get(storageKey)
       .then((keyString) => JSON.parse(keyString))
       .then((keyObject) => this.kms.asKey(keyObject))
-      .catch(() => this.kms.fetchKey({uri, onBehalfOf})
-        .then(tap((key) => this.unboundedStorage.put(storageKey, JSON.stringify(key, replacer)))));
-  }
+      .catch(() =>
+        this.kms
+          .fetchKey({uri, onBehalfOf})
+          .then(tap((key) => this.unboundedStorage.put(storageKey, JSON.stringify(key, replacer))))
+      );
+  },
 });
 
 /**

package/src/ensure-buffer.browser.js

@@ -3,7 +3,6 @@
  */
 
 /* eslint-env: browser */
-/* global FileReader */
 
 /**
  * Ensures the provider buffer is, indeed, an ArrayBuffer; converts File and

package/src/ensure-buffer.js

@@ -5,11 +5,11 @@
 import {isBuffer} from '@webex/common';
 
 /**
-* Ensures the provider Buffer is, indeed, a Buffer; sometimes, they seem to be
-* byte-arrays instead of proper Buffer objects.
-* @param {mixed} buffer
-* @returns {Promise<Buffer>}
-*/
+ * Ensures the provider Buffer is, indeed, a Buffer; sometimes, they seem to be
+ * byte-arrays instead of proper Buffer objects.
+ * @param {mixed} buffer
+ * @returns {Promise<Buffer>}
+ */
 export default function ensureBuffer(buffer) {
   /* istanbul ignore if */
   if (!isBuffer(buffer)) {