cdk-serverless 1.1.44 → 2.0.0

package/lib/lambda/auth.d.ts

@@ -0,0 +1,144 @@
+import logger from 'lambda-log';
+/**
+ * A generic JWT authorizer base class, presupposing the presence of an issuer, a number of authorization claims, an
+ * admin permission claim and optionally a separate URL to a JWKS to use if the issuers well-known URL does not
+ * point to it in its metadata.
+ */
+export declare abstract class JwtAuthorizer {
+    protected issuerUrl: string;
+    protected groupClaim: string;
+    protected adminClaim: string;
+    protected jwksUrl?: string | undefined;
+    /**
+     * The claims of the authenticated user.
+     */
+    protected claims?: {
+        [name: string]: string | number | boolean | string[];
+    };
+    protected constructor(issuerUrl: string, groupClaim: string, adminClaim: string, jwksUrl?: string | undefined);
+    /**
+     * Returns an array of groups the user belongs to, or an empty array if the user
+     * is not authenticated or has no groups.
+     */
+    getGroups(): string[];
+    /**
+     * Returns true if the user belongs to the specified group, false otherwise.
+     * @param group The name of the group to check.
+     */
+    hasGroup(group: string): boolean;
+    /**
+     * Authenticates the user and sets the claims.
+     */
+    abstract authenticate(): Promise<void>;
+    /**
+     * Returns true if the user is authenticated, false otherwise.
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Throws an UnauthenticatedError if the user is not authenticated.
+     */
+    assertAuthenticated(): void;
+    /**
+     * Throws a ForbiddenError if the user is not authenticated or does not belong
+     * to the specified group.
+     * @param group The name of the group to check.
+     */
+    assertGroup(group: string): void;
+    /**
+     * Returns true if the user belongs to the 'admin' group, false otherwise.
+     */
+    isAdmin(): boolean;
+    /**
+     * Throws a ForbiddenError if the user is not authenticated or is not an admin.
+     */
+    assertAdmin(): void;
+    /**
+     * Returns the email of the authenticated user.
+     */
+    getEMail(): string;
+    /**
+     * Returns the subject of the authenticated user.
+     */
+    getSubject(): string;
+    /**
+     * Returns the value of the claim with the specified name, or undefined if the
+     * claim does not exist.
+     * @param name The name of the claim to retrieve.
+     */
+    getClaim(name: string): string | number | boolean | string[] | undefined;
+}
+/**
+ * CognitoAuthorizer is an abstract class representing an authorizer
+ * that can be used to authenticate and authorize a user through Cognito.
+ */
+export declare abstract class CognitoAuthorizer extends JwtAuthorizer {
+    protected constructor();
+}
+/**
+ * Implements authorization on API Gateway v1 (Rest API) using JWT.
+ */
+export declare class ApiGatewayv1JwtAuthorizer extends JwtAuthorizer {
+    protected event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent;
+    protected _logger: logger.LambdaLog;
+    constructor(event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent, //FIXME: Learn about possible requestContext.authorizer sources in API gateway
+    adminClaim: string, _logger: logger.LambdaLog);
+    /**
+     * Authenticates the user using the claims provided by the API Gateway event or
+     * by decoding a JWT token from the 'Authorization' header.
+     */
+    authenticate(): Promise<void>;
+}
+/**
+ * Implements JWT Authorization on API Gateway v2 (HTTP API).
+ */
+export declare class ApiGatewayv2JwtAuthorizer extends JwtAuthorizer {
+    protected event: AWSLambda.APIGatewayProxyEventV2WithJWTAuthorizer;
+    protected _logger: logger.LambdaLog;
+    constructor(event: AWSLambda.APIGatewayProxyEventV2WithJWTAuthorizer, _logger: logger.LambdaLog);
+    /**
+     * Authenticates the user using the claims provided by the API Gateway event or
+     * by decoding a JWT token from the 'Authorization' header.
+     */
+    authenticate(): Promise<void>;
+}
+/**
+ * ApiGatewayv1CognitoAuthorizer is a specialization of an ApiGatewayv1JwtAuthorizer
+ * and implements authentication logic for API Gateway v1 requests when using Cognito..
+ */
+export declare class ApiGatewayv1CognitoAuthorizer extends ApiGatewayv1JwtAuthorizer {
+    protected event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent;
+    protected _logger: logger.LambdaLog;
+    /**
+     * The event that triggered the authorization check.
+     */
+    constructor(event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent, _logger: logger.LambdaLog);
+}
+/**
+ * ApiGatewayv2CognitoAuthorizer is a class that extends CognitoAuthorizer
+ * and implements authentication logic for API Gateway v2 requests with a
+ * JWT authorizer.
+ */
+export declare class ApiGatewayv2CognitoAuthorizer extends ApiGatewayv2JwtAuthorizer {
+    protected event: AWSLambda.APIGatewayProxyEventV2WithJWTAuthorizer;
+    protected _logger: logger.LambdaLog;
+    /**
+     * The event that triggered the authorization check.
+     */
+    constructor(event: AWSLambda.APIGatewayProxyEventV2WithJWTAuthorizer, _logger: logger.LambdaLog);
+}
+/**
+ * AppSyncCognitoAuthorizer is a class that extends CognitoAuthorizer
+ * and implements authentication logic for AppSync resolver events with a
+ * Cognito authorizer.
+ */
+export declare class AppSyncCognitoAuthorizer extends CognitoAuthorizer {
+    protected event: AWSLambda.AppSyncResolverEvent<any>;
+    /**
+     * The event that triggered the authorization check.
+     */
+    constructor(event: AWSLambda.AppSyncResolverEvent<any>);
+    /**
+     * Authenticates the user using the claims provided by the AppSync event.
+     */
+    authenticate(): Promise<void>;
+}

package/lib/lambda/auth.js

@@ -0,0 +1,309 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var _a, _b, _c, _d, _e;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppSyncCognitoAuthorizer = exports.ApiGatewayv2CognitoAuthorizer = exports.ApiGatewayv1CognitoAuthorizer = exports.ApiGatewayv2JwtAuthorizer = exports.ApiGatewayv1JwtAuthorizer = exports.CognitoAuthorizer = exports.JwtAuthorizer = void 0;
+const process_1 = require("process");
+const axios_1 = __importDefault(require("axios"));
+const jsonwebtoken_1 = require("jsonwebtoken");
+const jwk_to_pem_1 = __importDefault(require("jwk-to-pem"));
+const errors_1 = require("./errors");
+const cognitoPoolId = (_a = process_1.env.USER_POOL_ID) !== null && _a !== void 0 ? _a : '';
+const cognitoPoolRegion = (_c = (_b = process_1.env.USER_POOL_REGION) !== null && _b !== void 0 ? _b : process_1.env.AWS_REGION) !== null && _c !== void 0 ? _c : 'eu-central-1';
+const jwtIssuerUrl = cognitoPoolId ? `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com/${cognitoPoolId}` : ((_d = process_1.env.JWT_ISSUER_URL) !== null && _d !== void 0 ? _d : '');
+const jwtJwksUrl = cognitoPoolId ? `${jwtIssuerUrl}/.well-known/jwks.json` : process_1.env.JWT_JWKS_URL;
+const jwtGroupClaim = cognitoPoolId ? 'cognito:groups' : ((_e = process_1.env.JWT_GROUP_CLAIM) !== null && _e !== void 0 ? _e : '');
+const jwtAudience = (process_1.env.JWT_AUDIENCE_URL && process_1.env.JWT_AUDIENCE_URL.length > 0) ? process_1.env.JWT_AUDIENCE_URL.split('||') : undefined;
+let cacheKeys;
+const getPublicKeys = async (jwksUrl) => {
+    if (!cacheKeys) {
+        const publicKeys = (await axios_1.default.get(jwksUrl)).data;
+        cacheKeys = publicKeys.keys.reduce((agg, current) => {
+            const pem = (0, jwk_to_pem_1.default)(current);
+            agg[current.kid] = { instance: current, pem };
+            return agg;
+        }, {});
+        return cacheKeys;
+    }
+    else {
+        return cacheKeys;
+    }
+};
+// Grab the JWKS URI from the JWT issuer's metadata
+const getJwksUri = async (discoveryUri, jwksUri) => {
+    if (jwksUri) {
+        return jwksUri;
+    }
+    const wellKnownUri = `${discoveryUri}/.well-known`;
+    const issuerMetadata = (await axios_1.default.get(wellKnownUri)).data;
+    if (!issuerMetadata.jwks_uri) {
+        throw new Error('Issuer does not offer JWKS endpoint');
+    }
+    return issuerMetadata.jwks_uri;
+};
+const promisedVerify = (token, issuerUri, jwksUri) => {
+    return new Promise((resolve, reject) => {
+        (0, jsonwebtoken_1.verify)(token, (header, cb) => {
+            if (!header.kid) {
+                cb(new Error('no key id found'));
+            }
+            getJwksUri(issuerUri, jwksUri).then(getPublicKeys).then((keys) => {
+                cb(null, keys[header.kid].pem);
+            }, cb);
+        }, { issuer: issuerUri, audience: jwtAudience }, (err, decoded) => {
+            if (err) {
+                reject(err);
+            }
+            else {
+                resolve(decoded);
+            }
+        });
+    });
+};
+/**
+ * A generic JWT authorizer base class, presupposing the presence of an issuer, a number of authorization claims, an
+ * admin permission claim and optionally a separate URL to a JWKS to use if the issuers well-known URL does not
+ * point to it in its metadata.
+ */
+class JwtAuthorizer {
+    constructor(issuerUrl, groupClaim, adminClaim, jwksUrl) {
+        this.issuerUrl = issuerUrl;
+        this.groupClaim = groupClaim;
+        this.adminClaim = adminClaim;
+        this.jwksUrl = jwksUrl;
+    }
+    /**
+     * Returns an array of groups the user belongs to, or an empty array if the user
+     * is not authenticated or has no groups.
+     */
+    getGroups() {
+        if (!this.isAuthenticated() || !this.claims.hasOwnProperty(this.groupClaim)) {
+            return [];
+        }
+        return this.claims[this.groupClaim];
+    }
+    /**
+     * Returns true if the user belongs to the specified group, false otherwise.
+     * @param group The name of the group to check.
+     */
+    hasGroup(group) {
+        // 'cognito:groups': [ 'admin' ],
+        return this.getGroups().includes(group);
+    }
+    /**
+     * Returns true if the user is authenticated, false otherwise.
+     */
+    isAuthenticated() {
+        return this.claims !== undefined;
+    }
+    /**
+     * Throws an UnauthenticatedError if the user is not authenticated.
+     */
+    assertAuthenticated() {
+        if (!this.isAuthenticated()) {
+            throw new errors_1.UnauthenticatedError();
+        }
+    }
+    /**
+     * Throws a ForbiddenError if the user is not authenticated or does not belong
+     * to the specified group.
+     * @param group The name of the group to check.
+     */
+    assertGroup(group) {
+        this.assertAuthenticated();
+        if (!this.hasGroup(group)) {
+            throw new errors_1.ForbiddenError();
+        }
+    }
+    /**
+     * Returns true if the user belongs to the 'admin' group, false otherwise.
+     */
+    isAdmin() {
+        return this.hasGroup(this.adminClaim);
+    }
+    /**
+     * Throws a ForbiddenError if the user is not authenticated or is not an admin.
+     */
+    assertAdmin() {
+        this.assertGroup(this.adminClaim);
+    }
+    /**
+     * Returns the email of the authenticated user.
+     */
+    getEMail() {
+        this.assertAuthenticated();
+        return this.claims.email;
+    }
+    /**
+     * Returns the subject of the authenticated user.
+     */
+    getSubject() {
+        this.assertAuthenticated();
+        return this.claims.sub;
+    }
+    /**
+     * Returns the value of the claim with the specified name, or undefined if the
+     * claim does not exist.
+     * @param name The name of the claim to retrieve.
+     */
+    getClaim(name) {
+        this.assertAuthenticated();
+        return this.claims[name];
+    }
+}
+exports.JwtAuthorizer = JwtAuthorizer;
+/**
+ * CognitoAuthorizer is an abstract class representing an authorizer
+ * that can be used to authenticate and authorize a user through Cognito.
+ */
+class CognitoAuthorizer extends JwtAuthorizer {
+    constructor() {
+        super(jwtIssuerUrl, jwtGroupClaim, 'admin');
+    }
+}
+exports.CognitoAuthorizer = CognitoAuthorizer;
+/**
+ * Implements authorization on API Gateway v1 (Rest API) using JWT.
+ */
+class ApiGatewayv1JwtAuthorizer extends JwtAuthorizer {
+    constructor(event, //FIXME: Learn about possible requestContext.authorizer sources in API gateway
+    adminClaim, _logger) {
+        super(jwtIssuerUrl, jwtGroupClaim, adminClaim, jwtJwksUrl);
+        this.event = event;
+        this._logger = _logger;
+    }
+    /**
+     * Authenticates the user using the claims provided by the API Gateway event or
+     * by decoding a JWT token from the 'Authorization' header.
+     */
+    async authenticate() {
+        // Could be almost the exact same code as Cognito if we can specify our own Authorizer in the event's request context
+        if (this.event.requestContext.authorizer && this.event.requestContext.authorizer.claims) {
+            this.claims = this.event.requestContext.authorizer.claims;
+        }
+        if (this.claims) {
+            return;
+        }
+        const authHeader = this.event.headers.authorization;
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            return;
+        }
+        const token = authHeader.substring('Bearer '.length);
+        // Verify the token and set the claims on the event and this object
+        try {
+            const claims = await promisedVerify(token, this.issuerUrl, this.jwksUrl);
+            this._logger.debug(JSON.stringify(claims));
+            this.event.requestContext.authorizer = { claims };
+            this.claims = claims;
+        }
+        catch (err) {
+            this._logger.error(err);
+        }
+    }
+}
+exports.ApiGatewayv1JwtAuthorizer = ApiGatewayv1JwtAuthorizer;
+/**
+ * Implements JWT Authorization on API Gateway v2 (HTTP API).
+ */
+class ApiGatewayv2JwtAuthorizer extends JwtAuthorizer {
+    constructor(event, _logger) {
+        super(jwtIssuerUrl, 'cognito:groups', 'admin', jwtJwksUrl);
+        this.event = event;
+        this._logger = _logger;
+    }
+    /**
+     * Authenticates the user using the claims provided by the API Gateway event or
+     * by decoding a JWT token from the 'Authorization' header.
+     */
+    async authenticate() {
+        var _a, _b;
+        // Try to get the claims from the event
+        this.claims = (_b = (_a = this.event.requestContext.authorizer) === null || _a === void 0 ? void 0 : _a.jwt) === null || _b === void 0 ? void 0 : _b.claims;
+        // If no pool ID is defined or claims exist, return early
+        if (!cognitoPoolId || this.claims) {
+            return;
+        }
+        // Extract the token from the Authorization header
+        const authHeader = this.event.headers.authorization;
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            return;
+        }
+        const token = authHeader.substring('Bearer '.length);
+        // Verify the token and set the claims on the event and this object
+        try {
+            const claims = await promisedVerify(token, this.issuerUrl, this.jwksUrl);
+            this._logger.debug(JSON.stringify(claims));
+            this.event.requestContext.authorizer = {
+                jwt: {
+                    claims,
+                    scopes: ['openid', 'email'],
+                },
+                integrationLatency: 0,
+                principalId: 'toolbox',
+            };
+            this.claims = claims;
+        }
+        catch (err) {
+            this._logger.error(err);
+        }
+    }
+}
+exports.ApiGatewayv2JwtAuthorizer = ApiGatewayv2JwtAuthorizer;
+/**
+ * ApiGatewayv1CognitoAuthorizer is a specialization of an ApiGatewayv1JwtAuthorizer
+ * and implements authentication logic for API Gateway v1 requests when using Cognito..
+ */
+class ApiGatewayv1CognitoAuthorizer extends ApiGatewayv1JwtAuthorizer {
+    /**
+     * The event that triggered the authorization check.
+     */
+    constructor(event, _logger) {
+        super(event, 'admin', _logger);
+        this.event = event;
+        this._logger = _logger;
+    }
+}
+exports.ApiGatewayv1CognitoAuthorizer = ApiGatewayv1CognitoAuthorizer;
+/**
+ * ApiGatewayv2CognitoAuthorizer is a class that extends CognitoAuthorizer
+ * and implements authentication logic for API Gateway v2 requests with a
+ * JWT authorizer.
+ */
+class ApiGatewayv2CognitoAuthorizer extends ApiGatewayv2JwtAuthorizer {
+    /**
+     * The event that triggered the authorization check.
+     */
+    constructor(event, _logger) {
+        super(event, _logger);
+        this.event = event;
+        this._logger = _logger;
+    }
+}
+exports.ApiGatewayv2CognitoAuthorizer = ApiGatewayv2CognitoAuthorizer;
+/**
+ * AppSyncCognitoAuthorizer is a class that extends CognitoAuthorizer
+ * and implements authentication logic for AppSync resolver events with a
+ * Cognito authorizer.
+ */
+class AppSyncCognitoAuthorizer extends CognitoAuthorizer {
+    /**
+     * The event that triggered the authorization check.
+     */
+    constructor(event) {
+        super();
+        this.event = event;
+    }
+    /**
+     * Authenticates the user using the claims provided by the AppSync event.
+     */
+    async authenticate() {
+        // Try to get the claims from the event
+        if (this.event.identity) {
+            this.claims = this.event.identity.claims;
+        }
+    }
+}
+exports.AppSyncCognitoAuthorizer = AppSyncCognitoAuthorizer;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9sYW1iZGEvYXV0aC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7O0FBQUEscUNBQThCO0FBQzlCLGtEQUEwQjtBQUMxQiwrQ0FBcUU7QUFDckUsNERBQWtDO0FBRWxDLHFDQUFnRTtBQUVoRSxNQUFNLGFBQWEsR0FBRyxNQUFBLGFBQUcsQ0FBQyxZQUFZLG1DQUFJLEVBQUUsQ0FBQztBQUM3QyxNQUFNLGlCQUFpQixHQUFHLE1BQUEsTUFBQSxhQUFHLENBQUMsZ0JBQWdCLG1DQUFJLGFBQUcsQ0FBQyxVQUFVLG1DQUFJLGNBQWMsQ0FBQztBQUVuRixNQUFNLFlBQVksR0FBRyxhQUFhLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixpQkFBaUIsa0JBQWtCLGFBQWEsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQUEsYUFBRyxDQUFDLGNBQWMsbUNBQUksRUFBRSxDQUFDLENBQUM7QUFDNUksTUFBTSxVQUFVLEdBQUcsYUFBYSxDQUFDLENBQUMsQ0FBQyxHQUFHLFlBQVksd0JBQXdCLENBQUMsQ0FBQyxDQUFDLGFBQUcsQ0FBQyxZQUFZLENBQUM7QUFDOUYsTUFBTSxhQUFhLEdBQUcsYUFBYSxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFBLGFBQUcsQ0FBQyxlQUFlLG1DQUFJLEVBQUUsQ0FBQyxDQUFDO0FBQ3JGLE1BQU0sV0FBVyxHQUFHLENBQUMsYUFBRyxDQUFDLGdCQUFnQixJQUFJLGFBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLGFBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQTZCN0gsSUFBSSxTQUEwQyxDQUFDO0FBRS9DLE1BQU0sYUFBYSxHQUFHLEtBQUssRUFBRSxPQUFlLEVBQWdDLEVBQUU7SUFDNUUsSUFBSSxDQUFDLFNBQVMsRUFBRTtRQUNkLE1BQU0sVUFBVSxHQUFlLENBQUMsTUFBTSxlQUFLLENBQUMsR0FBRyxDQUFhLE9BQU8sQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQzNFLFNBQVMsR0FBRyxVQUFVLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxPQUFPLEVBQUUsRUFBRTtZQUNsRCxNQUFNLEdBQUcsR0FBRyxJQUFBLG9CQUFRLEVBQUMsT0FBdUIsQ0FBQyxDQUFDO1lBQzlDLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDO1lBQzlDLE9BQU8sR0FBRyxDQUFDO1FBQ2IsQ0FBQyxFQUFFLEVBQXlCLENBQUMsQ0FBQztRQUM5QixPQUFPLFNBQVMsQ0FBQztLQUNsQjtTQUFNO1FBQ0wsT0FBTyxTQUFTLENBQUM7S0FDbEI7QUFDSCxDQUFDLENBQUM7QUFFRixtREFBbUQ7QUFDbkQsTUFBTSxVQUFVLEdBQUcsS0FBSyxFQUFFLFlBQW9CLEVBQUUsT0FBZ0IsRUFBbUIsRUFBRTtJQUNuRixJQUFJLE9BQU8sRUFBRTtRQUNYLE9BQU8sT0FBTyxDQUFDO0tBQ2hCO0lBQ0QsTUFBTSxZQUFZLEdBQUcsR0FBRyxZQUFZLGNBQWMsQ0FBQztJQUNuRCxNQUFNLGNBQWMsR0FBRyxDQUFDLE1BQU0sZUFBSyxDQUFDLEdBQUcsQ0FBaUIsWUFBWSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDNUUsSUFBSSxDQUFDLGNBQWMsQ0FBQyxRQUFRLEVBQUU7UUFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO0tBQ3hEO0lBQ0QsT0FBTyxjQUFjLENBQUMsUUFBUSxDQUFDO0FBQ2pDLENBQUMsQ0FBQztBQUVGLE1BQU0sY0FBYyxHQUFHLENBQUMsS0FBYSxFQUFFLFNBQWlCLEVBQUUsT0FBZ0IsRUFBdUMsRUFBRTtJQUNqSCxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1FBQ3JDLElBQUEscUJBQU0sRUFBQyxLQUFLLEVBQUUsQ0FBQyxNQUFpQixFQUFFLEVBQXNCLEVBQUUsRUFBRTtZQUMxRCxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsRUFBRTtnQkFDZixFQUFFLENBQUMsSUFBSSxLQUFLLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO2FBQ2xDO1lBQ0QsVUFBVSxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUU7Z0JBQy9ELEVBQUUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNsQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDVCxDQUFDLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsRUFBRSxDQUFDLEdBQUcsRUFBRSxPQUFPLEVBQUUsRUFBRTtZQUNoRSxJQUFJLEdBQUcsRUFBRTtnQkFDUCxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7YUFDYjtpQkFBTTtnQkFDTCxPQUFPLENBQUMsT0FBcUMsQ0FBQyxDQUFDO2FBQ2hEO1FBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFzQixhQUFhO0lBT2pDLFlBQ1ksU0FBaUIsRUFDakIsVUFBa0IsRUFDbEIsVUFBa0IsRUFDbEIsT0FBZ0I7UUFIaEIsY0FBUyxHQUFULFNBQVMsQ0FBUTtRQUNqQixlQUFVLEdBQVYsVUFBVSxDQUFRO1FBQ2xCLGVBQVUsR0FBVixVQUFVLENBQVE7UUFDbEIsWUFBTyxHQUFQLE9BQU8sQ0FBUztJQUU1QixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksU0FBUztRQUNkLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTyxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUU7WUFDNUUsT0FBTyxFQUFFLENBQUM7U0FDWDtRQUNELE9BQU8sSUFBSSxDQUFDLE1BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUF3QixDQUFDO0lBQzlELENBQUM7SUFFRDs7O09BR0c7SUFDSSxRQUFRLENBQUMsS0FBYTtRQUMzQixpQ0FBaUM7UUFDakMsT0FBTyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFPRDs7T0FFRztJQUNJLGVBQWU7UUFDcEIsT0FBTyxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQztJQUNuQyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxtQkFBbUI7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsRUFBRTtZQUMzQixNQUFNLElBQUksNkJBQW9CLEVBQUUsQ0FBQztTQUNsQztJQUNILENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksV0FBVyxDQUFDLEtBQWE7UUFDOUIsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUM7UUFDM0IsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUU7WUFDekIsTUFBTSxJQUFJLHVCQUFjLEVBQUUsQ0FBQztTQUM1QjtJQUNILENBQUM7SUFFRDs7T0FFRztJQUNJLE9BQU87UUFDWixPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRDs7T0FFRztJQUNJLFdBQVc7UUFDaEIsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksUUFBUTtRQUNiLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQzNCLE9BQU8sSUFBSSxDQUFDLE1BQU8sQ0FBQyxLQUFlLENBQUM7SUFDdEMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksVUFBVTtRQUNmLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQzNCLE9BQU8sSUFBSSxDQUFDLE1BQU8sQ0FBQyxHQUFhLENBQUM7SUFDcEMsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxRQUFRLENBQUMsSUFBWTtRQUMxQixJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztRQUMzQixPQUFPLElBQUksQ0FBQyxNQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDNUIsQ0FBQztDQUNGO0FBM0dELHNDQTJHQztBQUVEOzs7R0FHRztBQUNILE1BQXNCLGlCQUFrQixTQUFRLGFBQWE7SUFFM0Q7UUFDRSxLQUFLLENBQUMsWUFBWSxFQUFFLGFBQWEsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM5QyxDQUFDO0NBQ0Y7QUFMRCw4Q0FLQztBQUVEOztHQUVHO0FBQ0gsTUFBYSx5QkFBMEIsU0FBUSxhQUFhO0lBRTFELFlBQ1ksS0FBMEQsRUFBRSw4RUFBOEU7SUFDcEosVUFBa0IsRUFDUixPQUF5QjtRQUVuQyxLQUFLLENBQUMsWUFBWSxFQUFFLGFBQWEsRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFKakQsVUFBSyxHQUFMLEtBQUssQ0FBcUQ7UUFFMUQsWUFBTyxHQUFQLE9BQU8sQ0FBa0I7SUFHckMsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxZQUFZO1FBRXZCLHFIQUFxSDtRQUNySCxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLFVBQVUsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFO1lBQ3ZGLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztTQUMzRDtRQUVELElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRTtZQUNmLE9BQU87U0FDUjtRQUVELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQztRQUNwRCxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRTtZQUNwRCxPQUFPO1NBQ1I7UUFDRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUVyRCxtRUFBbUU7UUFDbkUsSUFBSTtZQUNGLE1BQU0sTUFBTSxHQUErQixNQUFNLGNBQWMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDckcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBRTNDLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLFVBQVUsR0FBRyxFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQ2xELElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO1NBQ3RCO1FBQUMsT0FBTyxHQUFRLEVBQUU7WUFDakIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7U0FDekI7SUFDSCxDQUFDO0NBQ0Y7QUExQ0QsOERBMENDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLHlCQUEwQixTQUFRLGFBQWE7SUFDMUQsWUFBc0IsS0FBd0QsRUFBWSxPQUF5QjtRQUNqSCxLQUFLLENBQUMsWUFBWSxFQUFFLGdCQUFnQixFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQztRQUR2QyxVQUFLLEdBQUwsS0FBSyxDQUFtRDtRQUFZLFlBQU8sR0FBUCxPQUFPLENBQWtCO0lBRW5ILENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsWUFBWTs7UUFDdkIsdUNBQXVDO1FBQ3ZDLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBQSxNQUFBLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLFVBQVUsMENBQUUsR0FBRywwQ0FBRSxNQUFNLENBQUM7UUFFaEUseURBQXlEO1FBQ3pELElBQUksQ0FBQyxhQUFhLElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRTtZQUNqQyxPQUFPO1NBQ1I7UUFFRCxrREFBa0Q7UUFDbEQsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1FBQ3BELElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFO1lBQ3BELE9BQU87U0FDUjtRQUNELE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRXJELG1FQUFtRTtRQUNuRSxJQUFJO1lBQ0YsTUFBTSxNQUFNLEdBQStCLE1BQU0sY0FBYyxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUNyRyxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7WUFFM0MsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsVUFBVSxHQUFHO2dCQUNyQyxHQUFHLEVBQUU7b0JBQ0gsTUFBTTtvQkFDTixNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDO2lCQUM1QjtnQkFDRCxrQkFBa0IsRUFBRSxDQUFDO2dCQUNyQixXQUFXLEVBQUUsU0FBUzthQUN2QixDQUFDO1lBQ0YsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7U0FDdEI7UUFBQyxPQUFPLEdBQVEsRUFBRTtZQUNqQixJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztTQUN6QjtJQUNILENBQUM7Q0FDRjtBQTNDRCw4REEyQ0M7QUFFRDs7O0dBR0c7QUFDSCxNQUFhLDZCQUE4QixTQUFRLHlCQUF5QjtJQUUxRTs7T0FFRztJQUNILFlBQXNCLEtBQTBELEVBQVksT0FBeUI7UUFDbkgsS0FBSyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFEWCxVQUFLLEdBQUwsS0FBSyxDQUFxRDtRQUFZLFlBQU8sR0FBUCxPQUFPLENBQWtCO0lBRXJILENBQUM7Q0FDRjtBQVJELHNFQVFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQWEsNkJBQThCLFNBQVEseUJBQXlCO0lBRTFFOztPQUVHO0lBQ0gsWUFBc0IsS0FBd0QsRUFBWSxPQUF5QjtRQUNqSCxLQUFLLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBREYsVUFBSyxHQUFMLEtBQUssQ0FBbUQ7UUFBWSxZQUFPLEdBQVAsT0FBTyxDQUFrQjtJQUVuSCxDQUFDO0NBQ0Y7QUFSRCxzRUFRQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFhLHdCQUF5QixTQUFRLGlCQUFpQjtJQUU3RDs7T0FFRztJQUNILFlBQXNCLEtBQTBDO1FBQzlELEtBQUssRUFBRSxDQUFDO1FBRFksVUFBSyxHQUFMLEtBQUssQ0FBcUM7SUFFaEUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFlBQVk7UUFDdkIsdUNBQXVDO1FBQ3ZDLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUU7WUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQTZDLENBQUMsTUFBTSxDQUFDO1NBQ2hGO0lBQ0gsQ0FBQztDQUVGO0FBbkJELDREQW1CQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGVudiB9IGZyb20gJ3Byb2Nlc3MnO1xuaW1wb3J0IEF4aW9zIGZyb20gJ2F4aW9zJztcbmltcG9ydCB7IHZlcmlmeSwgSnd0SGVhZGVyLCBTaWduaW5nS2V5Q2FsbGJhY2sgfSBmcm9tICdqc29ud2VidG9rZW4nO1xuaW1wb3J0IGp3a1RvUGVtIGZyb20gJ2p3ay10by1wZW0nO1xuaW1wb3J0IGxvZ2dlciBmcm9tICdsYW1iZGEtbG9nJztcbmltcG9ydCB7IEZvcmJpZGRlbkVycm9yLCBVbmF1dGhlbnRpY2F0ZWRFcnJvciB9IGZyb20gJy4vZXJyb3JzJztcblxuY29uc3QgY29nbml0b1Bvb2xJZCA9IGVudi5VU0VSX1BPT0xfSUQgPz8gJyc7XG5jb25zdCBjb2duaXRvUG9vbFJlZ2lvbiA9IGVudi5VU0VSX1BPT0xfUkVHSU9OID8/IGVudi5BV1NfUkVHSU9OID8/ICdldS1jZW50cmFsLTEnO1xuXG5jb25zdCBqd3RJc3N1ZXJVcmwgPSBjb2duaXRvUG9vbElkID8gYGh0dHBzOi8vY29nbml0by1pZHAuJHtjb2duaXRvUG9vbFJlZ2lvbn0uYW1hem9uYXdzLmNvbS8ke2NvZ25pdG9Qb29sSWR9YCA6IChlbnYuSldUX0lTU1VFUl9VUkwgPz8gJycpO1xuY29uc3Qgand0Sndrc1VybCA9IGNvZ25pdG9Qb29sSWQgPyBgJHtqd3RJc3N1ZXJVcmx9Ly53ZWxsLWtub3duL2p3a3MuanNvbmAgOiBlbnYuSldUX0pXS1NfVVJMO1xuY29uc3Qgand0R3JvdXBDbGFpbSA9IGNvZ25pdG9Qb29sSWQgPyAnY29nbml0bzpncm91cHMnIDogKGVudi5KV1RfR1JPVVBfQ0xBSU0gPz8gJycpO1xuY29uc3Qgand0QXVkaWVuY2UgPSAoZW52LkpXVF9BVURJRU5DRV9VUkwgJiYgZW52LkpXVF9BVURJRU5DRV9VUkwubGVuZ3RoID4gMCkgPyBlbnYuSldUX0FVRElFTkNFX1VSTC5zcGxpdCgnfHwnKSA6IHVuZGVmaW5lZDtcblxuaW50ZXJmYWNlIFB1YmxpY0tleSB7XG4gIGFsZzogc3RyaW5nO1xuICBlOiBzdHJpbmc7XG4gIGtpZDogc3RyaW5nO1xuICBrdHk6IHN0cmluZztcbiAgbjogc3RyaW5nO1xuICB1c2U6IHN0cmluZztcbn1cblxuaW50ZXJmYWNlIFB1YmxpY0tleU1ldGEge1xuICBpbnN0YW5jZTogUHVibGljS2V5O1xuICBwZW06IHN0cmluZztcbn1cblxuaW50ZXJmYWNlIFB1YmxpY0tleXMge1xuICBrZXlzOiBQdWJsaWNLZXlbXTtcbn1cblxuaW50ZXJmYWNlIElzc3Vlck1ldGFkYXRhIHtcbiAgandrc191cmk/OiBzdHJpbmc7XG4gIFtrZXk6IHN0cmluZ106IHVua25vd247XG59XG5cbmludGVyZmFjZSBNYXBPZktpZFRvUHVibGljS2V5IHtcbiAgW2tleTogc3RyaW5nXTogUHVibGljS2V5TWV0YTtcbn1cblxubGV0IGNhY2hlS2V5czogTWFwT2ZLaWRUb1B1YmxpY0tleSB8IHVuZGVmaW5lZDtcblxuY29uc3QgZ2V0UHVibGljS2V5cyA9IGFzeW5jIChqd2tzVXJsOiBzdHJpbmcpOiBQcm9taXNlPE1hcE9mS2lkVG9QdWJsaWNLZXk+ID0+IHtcbiAgaWYgKCFjYWNoZUtleXMpIHtcbiAgICBjb25zdCBwdWJsaWNLZXlzOiBQdWJsaWNLZXlzID0gKGF3YWl0IEF4aW9zLmdldDxQdWJsaWNLZXlzPihqd2tzVXJsKSkuZGF0YTtcbiAgICBjYWNoZUtleXMgPSBwdWJsaWNLZXlzLmtleXMucmVkdWNlKChhZ2csIGN1cnJlbnQpID0+IHtcbiAgICAgIGNvbnN0IHBlbSA9IGp3a1RvUGVtKGN1cnJlbnQgYXMgandrVG9QZW0uSldLKTtcbiAgICAgIGFnZ1tjdXJyZW50LmtpZF0gPSB7IGluc3RhbmNlOiBjdXJyZW50LCBwZW0gfTtcbiAgICAgIHJldHVybiBhZ2c7XG4gICAgfSwge30gYXMgTWFwT2ZLaWRUb1B1YmxpY0tleSk7XG4gICAgcmV0dXJuIGNhY2hlS2V5cztcbiAgfSBlbHNlIHtcbiAgICByZXR1cm4gY2FjaGVLZXlzO1xuICB9XG59O1xuXG4vLyBHcmFiIHRoZSBKV0tTIFVSSSBmcm9tIHRoZSBKV1QgaXNzdWVyJ3MgbWV0YWRhdGFcbmNvbnN0IGdldEp3a3NVcmkgPSBhc3luYyAoZGlzY292ZXJ5VXJpOiBzdHJpbmcsIGp3a3NVcmk/OiBzdHJpbmcpOiBQcm9taXNlPHN0cmluZz4gPT4ge1xuICBpZiAoandrc1VyaSkge1xuICAgIHJldHVybiBqd2tzVXJpO1xuICB9XG4gIGNvbnN0IHdlbGxLbm93blVyaSA9IGAke2Rpc2NvdmVyeVVyaX0vLndlbGwta25vd25gO1xuICBjb25zdCBpc3N1ZXJNZXRhZGF0YSA9IChhd2FpdCBBeGlvcy5nZXQ8SXNzdWVyTWV0YWRhdGE+KHdlbGxLbm93blVyaSkpLmRhdGE7XG4gIGlmICghaXNzdWVyTWV0YWRhdGEuandrc191cmkpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ0lzc3VlciBkb2VzIG5vdCBvZmZlciBKV0tTIGVuZHBvaW50Jyk7XG4gIH1cbiAgcmV0dXJuIGlzc3Vlck1ldGFkYXRhLmp3a3NfdXJpO1xufTtcblxuY29uc3QgcHJvbWlzZWRWZXJpZnkgPSAodG9rZW46IHN0cmluZywgaXNzdWVyVXJpOiBzdHJpbmcsIGp3a3NVcmk/OiBzdHJpbmcpOiBQcm9taXNlPHsgW25hbWU6IHN0cmluZ106IHN0cmluZyB9PiA9PiB7XG4gIHJldHVybiBuZXcgUHJvbWlzZSgocmVzb2x2ZSwgcmVqZWN0KSA9PiB7XG4gICAgdmVyaWZ5KHRva2VuLCAoaGVhZGVyOiBKd3RIZWFkZXIsIGNiOiBTaWduaW5nS2V5Q2FsbGJhY2spID0+IHtcbiAgICAgIGlmICghaGVhZGVyLmtpZCkge1xuICAgICAgICBjYihuZXcgRXJyb3IoJ25vIGtleSBpZCBmb3VuZCcpKTtcbiAgICAgIH1cbiAgICAgIGdldEp3a3NVcmkoaXNzdWVyVXJpLCBqd2tzVXJpKS50aGVuKGdldFB1YmxpY0tleXMpLnRoZW4oKGtleXMpID0+IHtcbiAgICAgICAgY2IobnVsbCwga2V5c1toZWFkZXIua2lkIV0ucGVtKTtcbiAgICAgIH0sIGNiKTtcbiAgICB9LCB7IGlzc3VlcjogaXNzdWVyVXJpLCBhdWRpZW5jZTogand0QXVkaWVuY2UgfSwgKGVyciwgZGVjb2RlZCkgPT4ge1xuICAgICAgaWYgKGVycikge1xuICAgICAgICByZWplY3QoZXJyKTtcbiAgICAgIH0gZWxzZSB7XG4gICAgICAgIHJlc29sdmUoZGVjb2RlZCBhcyB7IFtuYW1lOiBzdHJpbmddOiBzdHJpbmcgfSk7XG4gICAgICB9XG4gICAgfSk7XG4gIH0pO1xufTtcblxuLyoqXG4gKiBBIGdlbmVyaWMgSldUIGF1dGhvcml6ZXIgYmFzZSBjbGFzcywgcHJlc3VwcG9zaW5nIHRoZSBwcmVzZW5jZSBvZiBhbiBpc3N1ZXIsIGEgbnVtYmVyIG9mIGF1dGhvcml6YXRpb24gY2xhaW1zLCBhblxuICogYWRtaW4gcGVybWlzc2lvbiBjbGFpbSBhbmQgb3B0aW9uYWxseSBhIHNlcGFyYXRlIFVSTCB0byBhIEpXS1MgdG8gdXNlIGlmIHRoZSBpc3N1ZXJzIHdlbGwta25vd24gVVJMIGRvZXMgbm90XG4gKiBwb2ludCB0byBpdCBpbiBpdHMgbWV0YWRhdGEuXG4gKi9cbmV4cG9ydCBhYnN0cmFjdCBjbGFzcyBKd3RBdXRob3JpemVyIHtcblxuICAvKipcbiAgICogVGhlIGNsYWltcyBvZiB0aGUgYXV0aGVudGljYXRlZCB1c2VyLlxuICAgKi9cbiAgcHJvdGVjdGVkIGNsYWltcz86IHsgW25hbWU6IHN0cmluZ106IHN0cmluZyB8IG51bWJlciB8IGJvb2xlYW4gfCBzdHJpbmdbXSB9O1xuXG4gIHByb3RlY3RlZCBjb25zdHJ1Y3RvcihcbiAgICBwcm90ZWN0ZWQgaXNzdWVyVXJsOiBzdHJpbmcsXG4gICAgcHJvdGVjdGVkIGdyb3VwQ2xhaW06IHN0cmluZyxcbiAgICBwcm90ZWN0ZWQgYWRtaW5DbGFpbTogc3RyaW5nLFxuICAgIHByb3RlY3RlZCBqd2tzVXJsPzogc3RyaW5nLFxuICApIHtcbiAgfVxuXG4gIC8qKlxuICAgKiBSZXR1cm5zIGFuIGFycmF5IG9mIGdyb3VwcyB0aGUgdXNlciBiZWxvbmdzIHRvLCBvciBhbiBlbXB0eSBhcnJheSBpZiB0aGUgdXNlclxuICAgKiBpcyBub3QgYXV0aGVudGljYXRlZCBvciBoYXMgbm8gZ3JvdXBzLlxuICAgKi9cbiAgcHVibGljIGdldEdyb3VwcygpOiBzdHJpbmdbXSB7XG4gICAgaWYgKCF0aGlzLmlzQXV0aGVudGljYXRlZCgpIHx8ICF0aGlzLmNsYWltcyEuaGFzT3duUHJvcGVydHkodGhpcy5ncm91cENsYWltKSkge1xuICAgICAgcmV0dXJuIFtdO1xuICAgIH1cbiAgICByZXR1cm4gdGhpcy5jbGFpbXMhW3RoaXMuZ3JvdXBDbGFpbV0gYXMgdW5rbm93biBhcyBzdHJpbmdbXTtcbiAgfVxuXG4gIC8qKlxuICAgKiBSZXR1cm5zIHRydWUgaWYgdGhlIHVzZXIgYmVsb25ncyB0byB0aGUgc3BlY2lmaWVkIGdyb3VwLCBmYWxzZSBvdGhlcndpc2UuXG4gICAqIEBwYXJhbSBncm91cCBUaGUgbmFtZSBvZiB0aGUgZ3JvdXAgdG8gY2hlY2suXG4gICAqL1xuICBwdWJsaWMgaGFzR3JvdXAoZ3JvdXA6IHN0cmluZyk6IGJvb2xlYW4ge1xuICAgIC8vICdjb2duaXRvOmdyb3Vwcyc6IFsgJ2FkbWluJyBdLFxuICAgIHJldHVybiB0aGlzLmdldEdyb3VwcygpLmluY2x1ZGVzKGdyb3VwKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBBdXRoZW50aWNhdGVzIHRoZSB1c2VyIGFuZCBzZXRzIHRoZSBjbGFpbXMuXG4gICAqL1xuICBwdWJsaWMgYWJzdHJhY3QgYXV0aGVudGljYXRlKCk6IFByb21pc2U8dm9pZD47XG5cbiAgLyoqXG4gICAqIFJldHVybnMgdHJ1ZSBpZiB0aGUgdXNlciBpcyBhdXRoZW50aWNhdGVkLCBmYWxzZSBvdGhlcndpc2UuXG4gICAqL1xuICBwdWJsaWMgaXNBdXRoZW50aWNhdGVkKCk6IGJvb2xlYW4ge1xuICAgIHJldHVybiB0aGlzLmNsYWltcyAhPT0gdW5kZWZpbmVkO1xuICB9XG5cbiAgLyoqXG4gICAqIFRocm93cyBhbiBVbmF1dGhlbnRpY2F0ZWRFcnJvciBpZiB0aGUgdXNlciBpcyBub3QgYXV0aGVudGljYXRlZC5cbiAgICovXG4gIHB1YmxpYyBhc3NlcnRBdXRoZW50aWNhdGVkKCk6IHZvaWQge1xuICAgIGlmICghdGhpcy5pc0F1dGhlbnRpY2F0ZWQoKSkge1xuICAgICAgdGhyb3cgbmV3IFVuYXV0aGVudGljYXRlZEVycm9yKCk7XG4gICAgfVxuICB9XG5cbiAgLyoqXG4gICAqIFRocm93cyBhIEZvcmJpZGRlbkVycm9yIGlmIHRoZSB1c2VyIGlzIG5vdCBhdXRoZW50aWNhdGVkIG9yIGRvZXMgbm90IGJlbG9uZ1xuICAgKiB0byB0aGUgc3BlY2lmaWVkIGdyb3VwLlxuICAgKiBAcGFyYW0gZ3JvdXAgVGhlIG5hbWUgb2YgdGhlIGdyb3VwIHRvIGNoZWNrLlxuICAgKi9cbiAgcHVibGljIGFzc2VydEdyb3VwKGdyb3VwOiBzdHJpbmcpOiB2b2lkIHtcbiAgICB0aGlzLmFzc2VydEF1dGhlbnRpY2F0ZWQoKTtcbiAgICBpZiAoIXRoaXMuaGFzR3JvdXAoZ3JvdXApKSB7XG4gICAgICB0aHJvdyBuZXcgRm9yYmlkZGVuRXJyb3IoKTtcbiAgICB9XG4gIH1cblxuICAvKipcbiAgICogUmV0dXJucyB0cnVlIGlmIHRoZSB1c2VyIGJlbG9uZ3MgdG8gdGhlICdhZG1pbicgZ3JvdXAsIGZhbHNlIG90aGVyd2lzZS5cbiAgICovXG4gIHB1YmxpYyBpc0FkbWluKCk6IGJvb2xlYW4ge1xuICAgIHJldHVybiB0aGlzLmhhc0dyb3VwKHRoaXMuYWRtaW5DbGFpbSk7XG4gIH1cblxuICAvKipcbiAgICogVGhyb3dzIGEgRm9yYmlkZGVuRXJyb3IgaWYgdGhlIHVzZXIgaXMgbm90IGF1dGhlbnRpY2F0ZWQgb3IgaXMgbm90IGFuIGFkbWluLlxuICAgKi9cbiAgcHVibGljIGFzc2VydEFkbWluKCk6IHZvaWQge1xuICAgIHRoaXMuYXNzZXJ0R3JvdXAodGhpcy5hZG1pbkNsYWltKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBSZXR1cm5zIHRoZSBlbWFpbCBvZiB0aGUgYXV0aGVudGljYXRlZCB1c2VyLlxuICAgKi9cbiAgcHVibGljIGdldEVNYWlsKCk6IHN0cmluZyB7XG4gICAgdGhpcy5hc3NlcnRBdXRoZW50aWNhdGVkKCk7XG4gICAgcmV0dXJuIHRoaXMuY2xhaW1zIS5lbWFpbCBhcyBzdHJpbmc7XG4gIH1cblxuICAvKipcbiAgICogUmV0dXJucyB0aGUgc3ViamVjdCBvZiB0aGUgYXV0aGVudGljYXRlZCB1c2VyLlxuICAgKi9cbiAgcHVibGljIGdldFN1YmplY3QoKTogc3RyaW5nIHtcbiAgICB0aGlzLmFzc2VydEF1dGhlbnRpY2F0ZWQoKTtcbiAgICByZXR1cm4gdGhpcy5jbGFpbXMhLnN1YiBhcyBzdHJpbmc7XG4gIH1cblxuICAvKipcbiAgICogUmV0dXJucyB0aGUgdmFsdWUgb2YgdGhlIGNsYWltIHdpdGggdGhlIHNwZWNpZmllZCBuYW1lLCBvciB1bmRlZmluZWQgaWYgdGhlXG4gICAqIGNsYWltIGRvZXMgbm90IGV4aXN0LlxuICAgKiBAcGFyYW0gbmFtZSBUaGUgbmFtZSBvZiB0aGUgY2xhaW0gdG8gcmV0cmlldmUuXG4gICAqL1xuICBwdWJsaWMgZ2V0Q2xhaW0obmFtZTogc3RyaW5nKTogc3RyaW5nIHwgbnVtYmVyIHwgYm9vbGVhbiB8IHN0cmluZ1tdIHwgdW5kZWZpbmVkIHtcbiAgICB0aGlzLmFzc2VydEF1dGhlbnRpY2F0ZWQoKTtcbiAgICByZXR1cm4gdGhpcy5jbGFpbXMhW25hbWVdO1xuICB9XG59XG5cbi8qKlxuICogQ29nbml0b0F1dGhvcml6ZXIgaXMgYW4gYWJzdHJhY3QgY2xhc3MgcmVwcmVzZW50aW5nIGFuIGF1dGhvcml6ZXJcbiAqIHRoYXQgY2FuIGJlIHVzZWQgdG8gYXV0aGVudGljYXRlIGFuZCBhdXRob3JpemUgYSB1c2VyIHRocm91Z2ggQ29nbml0by5cbiAqL1xuZXhwb3J0IGFic3RyYWN0IGNsYXNzIENvZ25pdG9BdXRob3JpemVyIGV4dGVuZHMgSnd0QXV0aG9yaXplciB7XG5cbiAgcHJvdGVjdGVkIGNvbnN0cnVjdG9yKCkge1xuICAgIHN1cGVyKGp3dElzc3VlclVybCwgand0R3JvdXBDbGFpbSwgJ2FkbWluJyk7XG4gIH1cbn1cblxuLyoqXG4gKiBJbXBsZW1lbnRzIGF1dGhvcml6YXRpb24gb24gQVBJIEdhdGV3YXkgdjEgKFJlc3QgQVBJKSB1c2luZyBKV1QuXG4gKi9cbmV4cG9ydCBjbGFzcyBBcGlHYXRld2F5djFKd3RBdXRob3JpemVyIGV4dGVuZHMgSnd0QXV0aG9yaXplciB7XG5cbiAgY29uc3RydWN0b3IoXG4gICAgcHJvdGVjdGVkIGV2ZW50OiBBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5V2l0aENvZ25pdG9BdXRob3JpemVyRXZlbnQsIC8vRklYTUU6IExlYXJuIGFib3V0IHBvc3NpYmxlIHJlcXVlc3RDb250ZXh0LmF1dGhvcml6ZXIgc291cmNlcyBpbiBBUEkgZ2F0ZXdheVxuICAgIGFkbWluQ2xhaW06IHN0cmluZyxcbiAgICBwcm90ZWN0ZWQgX2xvZ2dlcjogbG9nZ2VyLkxhbWJkYUxvZyxcbiAgKSB7XG4gICAgc3VwZXIoand0SXNzdWVyVXJsLCBqd3RHcm91cENsYWltLCBhZG1pbkNsYWltLCBqd3RKd2tzVXJsKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBBdXRoZW50aWNhdGVzIHRoZSB1c2VyIHVzaW5nIHRoZSBjbGFpbXMgcHJvdmlkZWQgYnkgdGhlIEFQSSBHYXRld2F5IGV2ZW50IG9yXG4gICAqIGJ5IGRlY29kaW5nIGEgSldUIHRva2VuIGZyb20gdGhlICdBdXRob3JpemF0aW9uJyBoZWFkZXIuXG4gICAqL1xuICBwdWJsaWMgYXN5bmMgYXV0aGVudGljYXRlKCk6IFByb21pc2U8dm9pZD4ge1xuXG4gICAgLy8gQ291bGQgYmUgYWxtb3N0IHRoZSBleGFjdCBzYW1lIGNvZGUgYXMgQ29nbml0byBpZiB3ZSBjYW4gc3BlY2lmeSBvdXIgb3duIEF1dGhvcml6ZXIgaW4gdGhlIGV2ZW50J3MgcmVxdWVzdCBjb250ZXh0XG4gICAgaWYgKHRoaXMuZXZlbnQucmVxdWVzdENvbnRleHQuYXV0aG9yaXplciAmJiB0aGlzLmV2ZW50LnJlcXVlc3RDb250ZXh0LmF1dGhvcml6ZXIuY2xhaW1zKSB7XG4gICAgICB0aGlzLmNsYWltcyA9IHRoaXMuZXZlbnQucmVxdWVzdENvbnRleHQuYXV0aG9yaXplci5jbGFpbXM7XG4gICAgfVxuXG4gICAgaWYgKHRoaXMuY2xhaW1zKSB7XG4gICAgICByZXR1cm47XG4gICAgfVxuXG4gICAgY29uc3QgYXV0aEhlYWRlciA9IHRoaXMuZXZlbnQuaGVhZGVycy5hdXRob3JpemF0aW9uO1xuICAgIGlmICghYXV0aEhlYWRlciB8fCAhYXV0aEhlYWRlci5zdGFydHNXaXRoKCdCZWFyZXIgJykpIHtcbiAgICAgIHJldHVybjtcbiAgICB9XG4gICAgY29uc3QgdG9rZW4gPSBhdXRoSGVhZGVyLnN1YnN0cmluZygnQmVhcmVyICcubGVuZ3RoKTtcblxuICAgIC8vIFZlcmlmeSB0aGUgdG9rZW4gYW5kIHNldCB0aGUgY2xhaW1zIG9uIHRoZSBldmVudCBhbmQgdGhpcyBvYmplY3RcbiAgICB0cnkge1xuICAgICAgY29uc3QgY2xhaW1zOiB7IFtuYW1lOiBzdHJpbmddOiBzdHJpbmcgfSA9IGF3YWl0IHByb21pc2VkVmVyaWZ5KHRva2VuLCB0aGlzLmlzc3VlclVybCwgdGhpcy5qd2tzVXJsKTtcbiAgICAgIHRoaXMuX2xvZ2dlci5kZWJ1ZyhKU09OLnN0cmluZ2lmeShjbGFpbXMpKTtcblxuICAgICAgdGhpcy5ldmVudC5yZXF1ZXN0Q29udGV4dC5hdXRob3JpemVyID0geyBjbGFpbXMgfTtcbiAgICAgIHRoaXMuY2xhaW1zID0gY2xhaW1zO1xuICAgIH0gY2F0Y2ggKGVycjogYW55KSB7XG4gICAgICB0aGlzLl9sb2dnZXIuZXJyb3IoZXJyKTtcbiAgICB9XG4gIH1cbn1cblxuLyoqXG4gKiBJbXBsZW1lbnRzIEpXVCBBdXRob3JpemF0aW9uIG9uIEFQSSBHYXRld2F5IHYyIChIVFRQIEFQSSkuXG4gKi9cbmV4cG9ydCBjbGFzcyBBcGlHYXRld2F5djJKd3RBdXRob3JpemVyIGV4dGVuZHMgSnd0QXV0aG9yaXplciB7XG4gIGNvbnN0cnVjdG9yKHByb3RlY3RlZCBldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eUV2ZW50VjJXaXRoSldUQXV0aG9yaXplciwgcHJvdGVjdGVkIF9sb2dnZXI6IGxvZ2dlci5MYW1iZGFMb2cpIHtcbiAgICBzdXBlcihqd3RJc3N1ZXJVcmwsICdjb2duaXRvOmdyb3VwcycsICdhZG1pbicsIGp3dEp3a3NVcmwpO1xuICB9XG5cbiAgLyoqXG4gICAqIEF1dGhlbnRpY2F0ZXMgdGhlIHVzZXIgdXNpbmcgdGhlIGNsYWltcyBwcm92aWRlZCBieSB0aGUgQVBJIEdhdGV3YXkgZXZlbnQgb3JcbiAgICogYnkgZGVjb2RpbmcgYSBKV1QgdG9rZW4gZnJvbSB0aGUgJ0F1dGhvcml6YXRpb24nIGhlYWRlci5cbiAgICovXG4gIHB1YmxpYyBhc3luYyBhdXRoZW50aWNhdGUoKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgLy8gVHJ5IHRvIGdldCB0aGUgY2xhaW1zIGZyb20gdGhlIGV2ZW50XG4gICAgdGhpcy5jbGFpbXMgPSB0aGlzLmV2ZW50LnJlcXVlc3RDb250ZXh0LmF1dGhvcml6ZXI/Lmp3dD8uY2xhaW1zO1xuXG4gICAgLy8gSWYgbm8gcG9vbCBJRCBpcyBkZWZpbmVkIG9yIGNsYWltcyBleGlzdCwgcmV0dXJuIGVhcmx5XG4gICAgaWYgKCFjb2duaXRvUG9vbElkIHx8IHRoaXMuY2xhaW1zKSB7XG4gICAgICByZXR1cm47XG4gICAgfVxuXG4gICAgLy8gRXh0cmFjdCB0aGUgdG9rZW4gZnJvbSB0aGUgQXV0aG9yaXphdGlvbiBoZWFkZXJcbiAgICBjb25zdCBhdXRoSGVhZGVyID0gdGhpcy5ldmVudC5oZWFkZXJzLmF1dGhvcml6YXRpb247XG4gICAgaWYgKCFhdXRoSGVhZGVyIHx8ICFhdXRoSGVhZGVyLnN0YXJ0c1dpdGgoJ0JlYXJlciAnKSkge1xuICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBjb25zdCB0b2tlbiA9IGF1dGhIZWFkZXIuc3Vic3RyaW5nKCdCZWFyZXIgJy5sZW5ndGgpO1xuXG4gICAgLy8gVmVyaWZ5IHRoZSB0b2tlbiBhbmQgc2V0IHRoZSBjbGFpbXMgb24gdGhlIGV2ZW50IGFuZCB0aGlzIG9iamVjdFxuICAgIHRyeSB7XG4gICAgICBjb25zdCBjbGFpbXM6IHsgW25hbWU6IHN0cmluZ106IHN0cmluZyB9ID0gYXdhaXQgcHJvbWlzZWRWZXJpZnkodG9rZW4sIHRoaXMuaXNzdWVyVXJsLCB0aGlzLmp3a3NVcmwpO1xuICAgICAgdGhpcy5fbG9nZ2VyLmRlYnVnKEpTT04uc3RyaW5naWZ5KGNsYWltcykpO1xuXG4gICAgICB0aGlzLmV2ZW50LnJlcXVlc3RDb250ZXh0LmF1dGhvcml6ZXIgPSB7XG4gICAgICAgIGp3dDoge1xuICAgICAgICAgIGNsYWltcyxcbiAgICAgICAgICBzY29wZXM6IFsnb3BlbmlkJywgJ2VtYWlsJ10sXG4gICAgICAgIH0sXG4gICAgICAgIGludGVncmF0aW9uTGF0ZW5jeTogMCxcbiAgICAgICAgcHJpbmNpcGFsSWQ6ICd0b29sYm94JyxcbiAgICAgIH07XG4gICAgICB0aGlzLmNsYWltcyA9IGNsYWltcztcbiAgICB9IGNhdGNoIChlcnI6IGFueSkge1xuICAgICAgdGhpcy5fbG9nZ2VyLmVycm9yKGVycik7XG4gICAgfVxuICB9XG59XG5cbi8qKlxuICogQXBpR2F0ZXdheXYxQ29nbml0b0F1dGhvcml6ZXIgaXMgYSBzcGVjaWFsaXphdGlvbiBvZiBhbiBBcGlHYXRld2F5djFKd3RBdXRob3JpemVyXG4gKiBhbmQgaW1wbGVtZW50cyBhdXRoZW50aWNhdGlvbiBsb2dpYyBmb3IgQVBJIEdhdGV3YXkgdjEgcmVxdWVzdHMgd2hlbiB1c2luZyBDb2duaXRvLi5cbiAqL1xuZXhwb3J0IGNsYXNzIEFwaUdhdGV3YXl2MUNvZ25pdG9BdXRob3JpemVyIGV4dGVuZHMgQXBpR2F0ZXdheXYxSnd0QXV0aG9yaXplciB7XG5cbiAgLyoqXG4gICAqIFRoZSBldmVudCB0aGF0IHRyaWdnZXJlZCB0aGUgYXV0aG9yaXphdGlvbiBjaGVjay5cbiAgICovXG4gIGNvbnN0cnVjdG9yKHByb3RlY3RlZCBldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eVdpdGhDb2duaXRvQXV0aG9yaXplckV2ZW50LCBwcm90ZWN0ZWQgX2xvZ2dlcjogbG9nZ2VyLkxhbWJkYUxvZykge1xuICAgIHN1cGVyKGV2ZW50LCAnYWRtaW4nLCBfbG9nZ2VyKTtcbiAgfVxufVxuXG4vKipcbiAqIEFwaUdhdGV3YXl2MkNvZ25pdG9BdXRob3JpemVyIGlzIGEgY2xhc3MgdGhhdCBleHRlbmRzIENvZ25pdG9BdXRob3JpemVyXG4gKiBhbmQgaW1wbGVtZW50cyBhdXRoZW50aWNhdGlvbiBsb2dpYyBmb3IgQVBJIEdhdGV3YXkgdjIgcmVxdWVzdHMgd2l0aCBhXG4gKiBKV1QgYXV0aG9yaXplci5cbiAqL1xuZXhwb3J0IGNsYXNzIEFwaUdhdGV3YXl2MkNvZ25pdG9BdXRob3JpemVyIGV4dGVuZHMgQXBpR2F0ZXdheXYySnd0QXV0aG9yaXplciB7XG5cbiAgLyoqXG4gICAqIFRoZSBldmVudCB0aGF0IHRyaWdnZXJlZCB0aGUgYXV0aG9yaXphdGlvbiBjaGVjay5cbiAgICovXG4gIGNvbnN0cnVjdG9yKHByb3RlY3RlZCBldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eUV2ZW50VjJXaXRoSldUQXV0aG9yaXplciwgcHJvdGVjdGVkIF9sb2dnZXI6IGxvZ2dlci5MYW1iZGFMb2cpIHtcbiAgICBzdXBlcihldmVudCwgX2xvZ2dlcik7XG4gIH1cbn1cblxuLyoqXG4gKiBBcHBTeW5jQ29nbml0b0F1dGhvcml6ZXIgaXMgYSBjbGFzcyB0aGF0IGV4dGVuZHMgQ29nbml0b0F1dGhvcml6ZXJcbiAqIGFuZCBpbXBsZW1lbnRzIGF1dGhlbnRpY2F0aW9uIGxvZ2ljIGZvciBBcHBTeW5jIHJlc29sdmVyIGV2ZW50cyB3aXRoIGFcbiAqIENvZ25pdG8gYXV0aG9yaXplci5cbiAqL1xuZXhwb3J0IGNsYXNzIEFwcFN5bmNDb2duaXRvQXV0aG9yaXplciBleHRlbmRzIENvZ25pdG9BdXRob3JpemVyIHtcblxuICAvKipcbiAgICogVGhlIGV2ZW50IHRoYXQgdHJpZ2dlcmVkIHRoZSBhdXRob3JpemF0aW9uIGNoZWNrLlxuICAgKi9cbiAgY29uc3RydWN0b3IocHJvdGVjdGVkIGV2ZW50OiBBV1NMYW1iZGEuQXBwU3luY1Jlc29sdmVyRXZlbnQ8YW55Pikge1xuICAgIHN1cGVyKCk7XG4gIH1cblxuICAvKipcbiAgICogQXV0aGVudGljYXRlcyB0aGUgdXNlciB1c2luZyB0aGUgY2xhaW1zIHByb3ZpZGVkIGJ5IHRoZSBBcHBTeW5jIGV2ZW50LlxuICAgKi9cbiAgcHVibGljIGFzeW5jIGF1dGhlbnRpY2F0ZSgpOiBQcm9taXNlPHZvaWQ+IHtcbiAgICAvLyBUcnkgdG8gZ2V0IHRoZSBjbGFpbXMgZnJvbSB0aGUgZXZlbnRcbiAgICBpZiAodGhpcy5ldmVudC5pZGVudGl0eSkge1xuICAgICAgdGhpcy5jbGFpbXMgPSAodGhpcy5ldmVudC5pZGVudGl0eSBhcyBBV1NMYW1iZGEuQXBwU3luY0lkZW50aXR5Q29nbml0bykuY2xhaW1zO1xuICAgIH1cbiAgfVxuXG59XG4iXX0=

package/lib/lambda/errors.d.ts

@@ -0,0 +1,16 @@
+export declare class HttpError extends Error {
+    readonly statusCode: number;
+    constructor(statusCode: number, message?: string);
+}
+export declare class BadRequestError extends HttpError {
+    constructor(message?: string);
+}
+export declare class UnauthenticatedError extends HttpError {
+    constructor(message?: string);
+}
+export declare class ForbiddenError extends HttpError {
+    constructor(message?: string);
+}
+export declare class NotFoundError extends HttpError {
+    constructor(message?: string);
+}

package/lib/lambda/errors.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotFoundError = exports.ForbiddenError = exports.UnauthenticatedError = exports.BadRequestError = exports.HttpError = void 0;
+class HttpError extends Error {
+    constructor(statusCode, message) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+exports.HttpError = HttpError;
+class BadRequestError extends HttpError {
+    constructor(message) {
+        super(400, message);
+    }
+}
+exports.BadRequestError = BadRequestError;
+class UnauthenticatedError extends HttpError {
+    constructor(message) {
+        super(401, message);
+    }
+}
+exports.UnauthenticatedError = UnauthenticatedError;
+class ForbiddenError extends HttpError {
+    constructor(message) {
+        super(403, message);
+    }
+}
+exports.ForbiddenError = ForbiddenError;
+class NotFoundError extends HttpError {
+    constructor(message) {
+        super(404, message);
+    }
+}
+exports.NotFoundError = NotFoundError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2xhbWJkYS9lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQ0EsTUFBYSxTQUFVLFNBQVEsS0FBSztJQUNsQyxZQUE0QixVQUFrQixFQUFFLE9BQWdCO1FBQzlELEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQURXLGVBQVUsR0FBVixVQUFVLENBQVE7SUFFOUMsQ0FBQztDQUNGO0FBSkQsOEJBSUM7QUFFRCxNQUFhLGVBQWdCLFNBQVEsU0FBUztJQUM1QyxZQUFZLE9BQWdCO1FBQzFCLEtBQUssQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDdEIsQ0FBQztDQUNGO0FBSkQsMENBSUM7QUFFRCxNQUFhLG9CQUFxQixTQUFRLFNBQVM7SUFDakQsWUFBWSxPQUFnQjtRQUMxQixLQUFLLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ3RCLENBQUM7Q0FDRjtBQUpELG9EQUlDO0FBRUQsTUFBYSxjQUFlLFNBQVEsU0FBUztJQUMzQyxZQUFZLE9BQWdCO1FBQzFCLEtBQUssQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDdEIsQ0FBQztDQUNGO0FBSkQsd0NBSUM7QUFFRCxNQUFhLGFBQWMsU0FBUSxTQUFTO0lBQzFDLFlBQVksT0FBZ0I7UUFDMUIsS0FBSyxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUN0QixDQUFDO0NBQ0Y7QUFKRCxzQ0FJQyIsInNvdXJjZXNDb250ZW50IjpbIlxuZXhwb3J0IGNsYXNzIEh0dHBFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgY29uc3RydWN0b3IocHVibGljIHJlYWRvbmx5IHN0YXR1c0NvZGU6IG51bWJlciwgbWVzc2FnZT86IHN0cmluZykge1xuICAgIHN1cGVyKG1lc3NhZ2UpO1xuICB9XG59XG5cbmV4cG9ydCBjbGFzcyBCYWRSZXF1ZXN0RXJyb3IgZXh0ZW5kcyBIdHRwRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlPzogc3RyaW5nKSB7XG4gICAgc3VwZXIoNDAwLCBtZXNzYWdlKTtcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgVW5hdXRoZW50aWNhdGVkRXJyb3IgZXh0ZW5kcyBIdHRwRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlPzogc3RyaW5nKSB7XG4gICAgc3VwZXIoNDAxLCBtZXNzYWdlKTtcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgRm9yYmlkZGVuRXJyb3IgZXh0ZW5kcyBIdHRwRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlPzogc3RyaW5nKSB7XG4gICAgc3VwZXIoNDAzLCBtZXNzYWdlKTtcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgTm90Rm91bmRFcnJvciBleHRlbmRzIEh0dHBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKG1lc3NhZ2U/OiBzdHJpbmcpIHtcbiAgICBzdXBlcig0MDQsIG1lc3NhZ2UpO1xuICB9XG59XG4iXX0=

package/lib/lambda/handler.d.ts

@@ -0,0 +1,90 @@
+import logger from 'lambda-log';
+import { CognitoAuthorizer, JwtAuthorizer } from './auth';
+/**
+ * An object containing the properties for an HTTP response.
+ */
+export interface HttpResponseContext {
+    statusCode?: number;
+    headers: {
+        [name: string]: string;
+    };
+    json: boolean;
+}
+/**
+ * An object containing the properties for an HTTP request handler.
+ */
+export interface HttpHandlerContext {
+    event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent;
+    lambdaContext: AWSLambda.Context;
+    logger: logger.LambdaLog;
+    response: HttpResponseContext;
+    auth: JwtAuthorizer;
+}
+/**
+ * A type definition for an HTTP handler.
+ */
+export type HttpHandler<T, R> = (context: HttpHandlerContext, body: T) => Promise<R>;
+/**
+ * An object containing the properties for an OpenAPI operation.
+ */
+export interface Operation {
+    responses: {
+        [statusCode: number]: {
+            content: {
+                'application/json': any;
+            };
+        } | any;
+    };
+}
+/**
+ * A type definition for an API Gateway v1 request handler.
+ */
+export type APIGatewayv1Handler = AWSLambda.Handler<AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent, AWSLambda.APIGatewayProxyResult | undefined>;
+/**
+ * An object containing the properties for an OpenAPI operation with a request body.
+ */
+export interface OperationWithRequestBody extends Operation {
+    requestBody: {
+        content: {
+            'application/json': any;
+        };
+    };
+}
+/**
+ * A factory function that creates an HTTP request handler for an OpenAPI operation with a request body.
+ */
+export declare const createOpenApiHandlerWithRequestBody: <OP extends OperationWithRequestBody, SC extends number = 200>(handler: HttpHandler<OP["requestBody"]["content"]["application/json"], OP["responses"][SC]["content"]["application/json"]>) => APIGatewayv1Handler;
+/**
+ * A factory function that creates an HTTP request handler for an OpenAPI operation with a request body and no response.
+ */
+export declare const createOpenApiHandlerWithRequestBodyNoResponse: <OP extends OperationWithRequestBody>(handler: HttpHandler<OP["requestBody"]["content"]["application/json"], void>) => APIGatewayv1Handler;
+/**
+ * A factory function that creates an HTTP request handler for an OpenAPI operation.
+ */
+export declare const createOpenApiHandler: <OP extends Operation, SC extends number = 200>(handler: HttpHandler<any, OP["responses"][SC]["content"]["application/json"]>) => APIGatewayv1Handler;
+/**
+ * A factory function that creates an HTTP request handler.
+ */
+export declare const createHttpHandler: <T, R>(handler: HttpHandler<T, R>) => APIGatewayv1Handler;
+/**
+ * The context for the AppSync resolver function.
+ * Contains information about the event, lambda context, logger, and Cognito authorizer.
+ */
+export interface AppSyncHandlerContext<T> {
+    event: AWSLambda.AppSyncResolverEvent<T>;
+    lambdaContext: AWSLambda.Context;
+    logger: logger.LambdaLog;
+    cognitoAuth: CognitoAuthorizer;
+}
+/**
+ * A function that handles an AppSync resolver event.
+ * Receives the context object and returns the response.
+ */
+export type AppSyncHandler<T, R> = (context: AppSyncHandlerContext<T>) => Promise<R>;
+/**
+ * Creates an AppSync resolver handler from the given AppSyncHandler.
+ * Returns a function that can be used as an AppSync resolver.
+ *
+ * @param handler The AppSyncHandler to use as the resolver.
+ */
+export declare const createAppSyncHandler: <T, R>(handler: AppSyncHandler<T, R>) => import("aws-lambda").AppSyncResolverHandler<T, R, Record<string, any> | null>;