parse-server 9.3.0-alpha.2 → 9.3.0-alpha.4

package/README.md

@@ -68,6 +68,7 @@ A big _thank you_ 🙏 to our [sponsors](#sponsors) and [backers](#backers) who
   - [Using Environment Variables](#using-environment-variables)
   - [Available Adapters](#available-adapters)
   - [Configuring File Adapters](#configuring-file-adapters)
+    - [Restricting File URL Domains](#restricting-file-url-domains)
   - [Idempotency Enforcement](#idempotency-enforcement)
   - [Localization](#localization)
     - [Pages](#pages)
@@ -491,6 +492,33 @@ Parse Server allows developers to choose from several options when hosting files
 
 `GridFSBucketAdapter` is used by default and requires no setup, but if you're interested in using Amazon S3, Google Cloud Storage, or local file storage, additional configuration information is available in the [Parse Server guide](http://docs.parseplatform.org/parse-server/guide/#configuring-file-adapters).
 
+### Restricting File URL Domains
+
+Parse objects can reference files by URL. To prevent [SSRF attacks](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery) via crafted file URLs, you can restrict the allowed URL domains using the `fileUpload.allowedFileUrlDomains` option.
+
+This protects against scenarios where an attacker provides a `Parse.File` with an arbitrary URL, for example as a Cloud Function parameter or in a field of type `Object` or `Array`. If Cloud Code or a client calls `getData()` on such a file, the Parse SDK makes an HTTP request to that URL, potentially leaking the server or client IP address and accessing internal services.
+
+> [!NOTE]
+> Fields of type `Parse.File` in the Parse schema are not affected by this attack, because Parse Server discards the URL on write and dynamically generates it on read based on the file adapter configuration.
+
+```javascript
+const parseServer = new ParseServer({
+  ...otherOptions,
+  fileUpload: {
+    allowedFileUrlDomains: ['cdn.example.com', '*.example.com'],
+  },
+});
+```
+
+| Parameter | Optional | Type | Default | Environment Variable |
+|---|---|---|---|---|
+| `fileUpload.allowedFileUrlDomains` | yes | `String[]` | `['*']` | `PARSE_SERVER_FILE_UPLOAD_ALLOWED_FILE_URL_DOMAINS` |
+
+- `['*']` (default) allows file URLs with any domain.
+- `['cdn.example.com']` allows only exact hostname matches.
+- `['*.example.com']` allows any subdomain of `example.com`.
+- `[]` blocks all file URLs; only files referenced by name are allowed.
+
 ## Idempotency Enforcement
 
 **Caution, this is an experimental feature that may not be appropriate for production.**

package/lib/Adapters/Auth/BaseCodeAuthAdapter.js

@@ -62,25 +62,45 @@ class BaseAuthCodeAdapter extends _AuthAdapter.default {
     // abstract method
     throw new Error('getAccessTokenFromCode is not implemented');
   }
+
+  /**
+   * Validates auth data on login. In the standard auth flows (login, signup,
+   * update), `beforeFind` runs first and validates credentials, so no
+   * additional credential check is needed here.
+   */
   validateLogin(authData) {
-    // User validation is already done in beforeFind
     return {
       id: authData.id
     };
   }
+
+  /**
+   * Validates auth data on first setup or when linking a new provider.
+   * In the standard auth flows, `beforeFind` runs first and validates
+   * credentials, so no additional credential check is needed here.
+   */
   validateSetUp(authData) {
-    // User validation is already done in beforeFind
     return {
       id: authData.id
     };
   }
+
+  /**
+   * Returns the auth data to expose to the client after a query.
+   */
   afterFind(authData) {
     return {
       id: authData.id
     };
   }
+
+  /**
+   * Validates auth data on update. In the standard auth flows, `beforeFind`
+   * runs first for any changed auth data and validates credentials, so no
+   * additional credential check is needed here. Unchanged (echoed-back) data
+   * skips both `beforeFind` and validation entirely.
+   */
   validateUpdate(authData) {
-    // User validation is already done in beforeFind
     return {
       id: authData.id
     };
@@ -96,4 +116,4 @@ class BaseAuthCodeAdapter extends _AuthAdapter.default {
   }
 }
 exports.default = BaseAuthCodeAdapter;
-//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJfQXV0aEFkYXB0ZXIiLCJfaW50ZXJvcFJlcXVpcmVEZWZhdWx0IiwicmVxdWlyZSIsImUiLCJfX2VzTW9kdWxlIiwiZGVmYXVsdCIsIkJhc2VBdXRoQ29kZUFkYXB0ZXIiLCJBdXRoQWRhcHRlciIsImNvbnN0cnVjdG9yIiwiYWRhcHRlck5hbWUiLCJ2YWxpZGF0ZU9wdGlvbnMiLCJvcHRpb25zIiwiRXJyb3IiLCJlbmFibGVJbnNlY3VyZUF1dGgiLCJjbGllbnRJZCIsImNsaWVudFNlY3JldCIsImJlZm9yZUZpbmQiLCJhdXRoRGF0YSIsImNvZGUiLCJhY2Nlc3NfdG9rZW4iLCJQYXJzZSIsIk9CSkVDVF9OT1RfRk9VTkQiLCJ1c2VyIiwiZ2V0VXNlckZyb21BY2Nlc3NUb2tlbiIsImlkIiwiVkFMSURBVElPTl9FUlJPUiIsImdldEFjY2Vzc1Rva2VuRnJvbUNvZGUiLCJyZWRpcmVjdF91cmkiLCJ2YWxpZGF0ZUxvZ2luIiwidmFsaWRhdGVTZXRVcCIsImFmdGVyRmluZCIsInZhbGlkYXRlVXBkYXRlIiwicGFyc2VSZXNwb25zZURhdGEiLCJkYXRhIiwic3RhcnRQb3MiLCJpbmRleE9mIiwiZW5kUG9zIiwianNvbkRhdGEiLCJzdWJzdHJpbmciLCJKU09OIiwicGFyc2UiLCJleHBvcnRzIl0sInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL0FkYXB0ZXJzL0F1dGgvQmFzZUNvZGVBdXRoQWRhcHRlci5qcyJdLCJzb3VyY2VzQ29udGVudCI6WyIvLyBhYnN0cmFjdCBjbGFzcyBmb3IgYXV0aCBjb2RlIGFkYXB0ZXJzXG5pbXBvcnQgQXV0aEFkYXB0ZXIgZnJvbSAnLi9BdXRoQWRhcHRlcic7XG5leHBvcnQgZGVmYXVsdCBjbGFzcyBCYXNlQXV0aENvZGVBZGFwdGVyIGV4dGVuZHMgQXV0aEFkYXB0ZXIge1xuICBjb25zdHJ1Y3RvcihhZGFwdGVyTmFtZSkge1xuICAgIHN1cGVyKCk7XG4gICAgdGhpcy5hZGFwdGVyTmFtZSA9IGFkYXB0ZXJOYW1lO1xuICB9XG4gIHZhbGlkYXRlT3B0aW9ucyhvcHRpb25zKSB7XG5cbiAgICBpZiAoIW9wdGlvbnMpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgJHt0aGlzLmFkYXB0ZXJOYW1lfSBvcHRpb25zIGFyZSByZXF1aXJlZC5gKTtcbiAgICB9XG5cbiAgICB0aGlzLmVuYWJsZUluc2VjdXJlQXV0aCA9IG9wdGlvbnMuZW5hYmxlSW5zZWN1cmVBdXRoO1xuICAgIGlmICh0aGlzLmVuYWJsZUluc2VjdXJlQXV0aCkge1xuICAgICAgcmV0dXJuO1xuICAgIH1cblxuICAgIHRoaXMuY2xpZW50SWQgPSBvcHRpb25zLmNsaWVudElkO1xuICAgIHRoaXMuY2xpZW50U2VjcmV0ID0gb3B0aW9ucy5jbGllbnRTZWNyZXQ7XG5cbiAgICBpZiAoIXRoaXMuY2xpZW50SWQpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgJHt0aGlzLmFkYXB0ZXJOYW1lfSBjbGllbnRJZCBpcyByZXF1aXJlZC5gKTtcbiAgICB9XG5cbiAgICBpZiAoIXRoaXMuY2xpZW50U2VjcmV0KSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7dGhpcy5hZGFwdGVyTmFtZX0gY2xpZW50U2VjcmV0IGlzIHJlcXVpcmVkLmApO1xuICAgIH1cbiAgfVxuXG4gIGFzeW5jIGJlZm9yZUZpbmQoYXV0aERhdGEpIHtcbiAgICBpZiAodGhpcy5lbmFibGVJbnNlY3VyZUF1dGggJiYgIWF1dGhEYXRhPy5jb2RlKSB7XG4gICAgICBpZiAoIWF1dGhEYXRhPy5hY2Nlc3NfdG9rZW4pIHtcbiAgICAgICAgdGhyb3cgbmV3IFBhcnNlLkVycm9yKFBhcnNlLkVycm9yLk9CSkVDVF9OT1RfRk9VTkQsIGAke3RoaXMuYWRhcHRlck5hbWV9IGF1dGggaXMgaW52YWxpZCBmb3IgdGhpcyB1c2VyLmApO1xuICAgICAgfVxuXG4gICAgICBjb25zdCB1c2VyID0gYXdhaXQgdGhpcy5nZXRVc2VyRnJvbUFjY2Vzc1Rva2VuKGF1dGhEYXRhLmFjY2Vzc190b2tlbiwgYXV0aERhdGEpO1xuXG4gICAgICBpZiAodXNlci5pZCAhPT0gYXV0aERhdGEuaWQpIHtcbiAgICAgICAgdGhyb3cgbmV3IFBhcnNlLkVycm9yKFBhcnNlLkVycm9yLk9CSkVDVF9OT1RfRk9VTkQsIGAke3RoaXMuYWRhcHRlck5hbWV9IGF1dGggaXMgaW52YWxpZCBmb3IgdGhpcyB1c2VyLmApO1xuICAgICAgfVxuXG4gICAgICByZXR1cm47XG4gICAgfVxuXG4gICAgaWYgKCFhdXRoRGF0YT8uY29kZSkge1xuICAgICAgdGhyb3cgbmV3IFBhcnNlLkVycm9yKFBhcnNlLkVycm9yLlZBTElEQVRJT05fRVJST1IsIGAke3RoaXMuYWRhcHRlck5hbWV9IGNvZGUgaXMgcmVxdWlyZWQuYCk7XG4gICAgfVxuXG4gICAgY29uc3QgYWNjZXNzX3Rva2VuID0gYXdhaXQgdGhpcy5nZXRBY2Nlc3NUb2tlbkZyb21Db2RlKGF1dGhEYXRhKTtcbiAgICBjb25zdCB1c2VyID0gYXdhaXQgdGhpcy5nZXRVc2VyRnJvbUFjY2Vzc1Rva2VuKGFjY2Vzc190b2tlbiwgYXV0aERhdGEpO1xuXG4gICAgaWYgKGF1dGhEYXRhLmlkICYmIHVzZXIuaWQgIT09IGF1dGhEYXRhLmlkKSB7XG4gICAgICB0aHJvdyBuZXcgUGFyc2UuRXJyb3IoUGFyc2UuRXJyb3IuT0JKRUNUX05PVF9GT1VORCwgYCR7dGhpcy5hZGFwdGVyTmFtZX0gYXV0aCBpcyBpbnZhbGlkIGZvciB0aGlzIHVzZXIuYCk7XG4gICAgfVxuXG4gICAgYXV0aERhdGEuYWNjZXNzX3Rva2VuID0gYWNjZXNzX3Rva2VuO1xuICAgIGF1dGhEYXRhLmlkID0gdXNlci5pZDtcblxuICAgIGRlbGV0ZSBhdXRoRGF0YS5jb2RlO1xuICAgIGRlbGV0ZSBhdXRoRGF0YS5yZWRpcmVjdF91cmk7XG5cbiAgfVxuXG4gIGFzeW5jIGdldFVzZXJGcm9tQWNjZXNzVG9rZW4oKSB7XG4gICAgLy8gYWJzdHJhY3QgbWV0aG9kXG4gICAgdGhyb3cgbmV3IEVycm9yKCdnZXRVc2VyRnJvbUFjY2Vzc1Rva2VuIGlzIG5vdCBpbXBsZW1lbnRlZCcpO1xuICB9XG5cbiAgYXN5bmMgZ2V0QWNjZXNzVG9rZW5Gcm9tQ29kZSgpIHtcbiAgICAvLyBhYnN0cmFjdCBtZXRob2RcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2dldEFjY2Vzc1Rva2VuRnJvbUNvZGUgaXMgbm90IGltcGxlbWVudGVkJyk7XG4gIH1cblxuICB2YWxpZGF0ZUxvZ2luKGF1dGhEYXRhKSB7XG4gICAgLy8gVXNlciB2YWxpZGF0aW9uIGlzIGFscmVhZHkgZG9uZSBpbiBiZWZvcmVGaW5kXG4gICAgcmV0dXJuIHtcbiAgICAgIGlkOiBhdXRoRGF0YS5pZCxcbiAgICB9XG4gIH1cblxuICB2YWxpZGF0ZVNldFVwKGF1dGhEYXRhKSB7XG4gICAgLy8gVXNlciB2YWxpZGF0aW9uIGlzIGFscmVhZHkgZG9uZSBpbiBiZWZvcmVGaW5kXG4gICAgcmV0dXJuIHtcbiAgICAgIGlkOiBhdXRoRGF0YS5pZCxcbiAgICB9XG4gIH1cblxuICBhZnRlckZpbmQoYXV0aERhdGEpIHtcbiAgICByZXR1cm4ge1xuICAgICAgaWQ6IGF1dGhEYXRhLmlkLFxuICAgIH1cbiAgfVxuXG4gIHZhbGlkYXRlVXBkYXRlKGF1dGhEYXRhKSB7XG4gICAgLy8gVXNlciB2YWxpZGF0aW9uIGlzIGFscmVhZHkgZG9uZSBpbiBiZWZvcmVGaW5kXG4gICAgcmV0dXJuIHtcbiAgICAgIGlkOiBhdXRoRGF0YS5pZCxcbiAgICB9XG5cbiAgfVxuXG4gIHBhcnNlUmVzcG9uc2VEYXRhKGRhdGEpIHtcbiAgICBjb25zdCBzdGFydFBvcyA9IGRhdGEuaW5kZXhPZignKCcpO1xuICAgIGNvbnN0IGVuZFBvcyA9IGRhdGEuaW5kZXhPZignKScpO1xuICAgIGlmIChzdGFydFBvcyA9PT0gLTEgfHwgZW5kUG9zID09PSAtMSkge1xuICAgICAgdGhyb3cgbmV3IFBhcnNlLkVycm9yKFBhcnNlLkVycm9yLk9CSkVDVF9OT1RfRk9VTkQsIGAke3RoaXMuYWRhcHRlck5hbWV9IGF1dGggaXMgaW52YWxpZCBmb3IgdGhpcyB1c2VyLmApO1xuICAgIH1cbiAgICBjb25zdCBqc29uRGF0YSA9IGRhdGEuc3Vic3RyaW5nKHN0YXJ0UG9zICsgMSwgZW5kUG9zKTtcbiAgICByZXR1cm4gSlNPTi5wYXJzZShqc29uRGF0YSk7XG4gIH1cbn1cbiJdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQ0EsSUFBQUEsWUFBQSxHQUFBQyxzQkFBQSxDQUFBQyxPQUFBO0FBQXdDLFNBQUFELHVCQUFBRSxDQUFBLFdBQUFBLENBQUEsSUFBQUEsQ0FBQSxDQUFBQyxVQUFBLEdBQUFELENBQUEsS0FBQUUsT0FBQSxFQUFBRixDQUFBO0FBRHhDOztBQUVlLE1BQU1HLG1CQUFtQixTQUFTQyxvQkFBVyxDQUFDO0VBQzNEQyxXQUFXQSxDQUFDQyxXQUFXLEVBQUU7SUFDdkIsS0FBSyxDQUFDLENBQUM7SUFDUCxJQUFJLENBQUNBLFdBQVcsR0FBR0EsV0FBVztFQUNoQztFQUNBQyxlQUFlQSxDQUFDQyxPQUFPLEVBQUU7SUFFdkIsSUFBSSxDQUFDQSxPQUFPLEVBQUU7TUFDWixNQUFNLElBQUlDLEtBQUssQ0FBQyxHQUFHLElBQUksQ0FBQ0gsV0FBVyx3QkFBd0IsQ0FBQztJQUM5RDtJQUVBLElBQUksQ0FBQ0ksa0JBQWtCLEdBQUdGLE9BQU8sQ0FBQ0Usa0JBQWtCO0lBQ3BELElBQUksSUFBSSxDQUFDQSxrQkFBa0IsRUFBRTtNQUMzQjtJQUNGO0lBRUEsSUFBSSxDQUFDQyxRQUFRLEdBQUdILE9BQU8sQ0FBQ0csUUFBUTtJQUNoQyxJQUFJLENBQUNDLFlBQVksR0FBR0osT0FBTyxDQUFDSSxZQUFZO0lBRXhDLElBQUksQ0FBQyxJQUFJLENBQUNELFFBQVEsRUFBRTtNQUNsQixNQUFNLElBQUlGLEtBQUssQ0FBQyxHQUFHLElBQUksQ0FBQ0gsV0FBVyx3QkFBd0IsQ0FBQztJQUM5RDtJQUVBLElBQUksQ0FBQyxJQUFJLENBQUNNLFlBQVksRUFBRTtNQUN0QixNQUFNLElBQUlILEtBQUssQ0FBQyxHQUFHLElBQUksQ0FBQ0gsV0FBVyw0QkFBNEIsQ0FBQztJQUNsRTtFQUNGO0VBRUEsTUFBTU8sVUFBVUEsQ0FBQ0MsUUFBUSxFQUFFO0lBQ3pCLElBQUksSUFBSSxDQUFDSixrQkFBa0IsSUFBSSxDQUFDSSxRQUFRLEVBQUVDLElBQUksRUFBRTtNQUM5QyxJQUFJLENBQUNELFFBQVEsRUFBRUUsWUFBWSxFQUFFO1FBQzNCLE1BQU0sSUFBSUMsS0FBSyxDQUFDUixLQUFLLENBQUNRLEtBQUssQ0FBQ1IsS0FBSyxDQUFDUyxnQkFBZ0IsRUFBRSxHQUFHLElBQUksQ0FBQ1osV0FBVyxpQ0FBaUMsQ0FBQztNQUMzRztNQUVBLE1BQU1hLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQ0Msc0JBQXNCLENBQUNOLFFBQVEsQ0FBQ0UsWUFBWSxFQUFFRixRQUFRLENBQUM7TUFFL0UsSUFBSUssSUFBSSxDQUFDRSxFQUFFLEtBQUtQLFFBQVEsQ0FBQ08sRUFBRSxFQUFFO1FBQzNCLE1BQU0sSUFBSUosS0FBSyxDQUFDUixLQUFLLENBQUNRLEtBQUssQ0FBQ1IsS0FBSyxDQUFDUyxnQkFBZ0IsRUFBRSxHQUFHLElBQUksQ0FBQ1osV0FBVyxpQ0FBaUMsQ0FBQztNQUMzRztNQUVBO0lBQ0Y7SUFFQSxJQUFJLENBQUNRLFFBQVEsRUFBRUMsSUFBSSxFQUFFO01BQ25CLE1BQU0sSUFBSUUsS0FBSyxDQUFDUixLQUFLLENBQUNRLEtBQUssQ0FBQ1IsS0FBSyxDQUFDYSxnQkFBZ0IsRUFBRSxHQUFHLElBQUksQ0FBQ2hCLFdBQVcsb0JBQW9CLENBQUM7SUFDOUY7SUFFQSxNQUFNVSxZQUFZLEdBQUcsTUFBTSxJQUFJLENBQUNPLHNCQUFzQixDQUFDVCxRQUFRLENBQUM7SUFDaEUsTUFBTUssSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDQyxzQkFBc0IsQ0FBQ0osWUFBWSxFQUFFRixRQUFRLENBQUM7SUFFdEUsSUFBSUEsUUFBUSxDQUFDTyxFQUFFLElBQUlGLElBQUksQ0FBQ0UsRUFBRSxLQUFLUCxRQUFRLENBQUNPLEVBQUUsRUFBRTtNQUMxQyxNQUFNLElBQUlKLEtBQUssQ0FBQ1IsS0FBSyxDQUFDUSxLQUFLLENBQUNSLEtBQUssQ0FBQ1MsZ0JBQWdCLEVBQUUsR0FBRyxJQUFJLENBQUNaLFdBQVcsaUNBQWlDLENBQUM7SUFDM0c7SUFFQVEsUUFBUSxDQUFDRSxZQUFZLEdBQUdBLFlBQVk7SUFDcENGLFFBQVEsQ0FBQ08sRUFBRSxHQUFHRixJQUFJLENBQUNFLEVBQUU7SUFFckIsT0FBT1AsUUFBUSxDQUFDQyxJQUFJO0lBQ3BCLE9BQU9ELFFBQVEsQ0FBQ1UsWUFBWTtFQUU5QjtFQUVBLE1BQU1KLHNCQUFzQkEsQ0FBQSxFQUFHO0lBQzdCO0lBQ0EsTUFBTSxJQUFJWCxLQUFLLENBQUMsMkNBQTJDLENBQUM7RUFDOUQ7RUFFQSxNQUFNYyxzQkFBc0JBLENBQUEsRUFBRztJQUM3QjtJQUNBLE1BQU0sSUFBSWQsS0FBSyxDQUFDLDJDQUEyQyxDQUFDO0VBQzlEO0VBRUFnQixhQUFhQSxDQUFDWCxRQUFRLEVBQUU7SUFDdEI7SUFDQSxPQUFPO01BQ0xPLEVBQUUsRUFBRVAsUUFBUSxDQUFDTztJQUNmLENBQUM7RUFDSDtFQUVBSyxhQUFhQSxDQUFDWixRQUFRLEVBQUU7SUFDdEI7SUFDQSxPQUFPO01BQ0xPLEVBQUUsRUFBRVAsUUFBUSxDQUFDTztJQUNmLENBQUM7RUFDSDtFQUVBTSxTQUFTQSxDQUFDYixRQUFRLEVBQUU7SUFDbEIsT0FBTztNQUNMTyxFQUFFLEVBQUVQLFFBQVEsQ0FBQ087SUFDZixDQUFDO0VBQ0g7RUFFQU8sY0FBY0EsQ0FBQ2QsUUFBUSxFQUFFO0lBQ3ZCO0lBQ0EsT0FBTztNQUNMTyxFQUFFLEVBQUVQLFFBQVEsQ0FBQ087SUFDZixDQUFDO0VBRUg7RUFFQVEsaUJBQWlCQSxDQUFDQyxJQUFJLEVBQUU7SUFDdEIsTUFBTUMsUUFBUSxHQUFHRCxJQUFJLENBQUNFLE9BQU8sQ0FBQyxHQUFHLENBQUM7SUFDbEMsTUFBTUMsTUFBTSxHQUFHSCxJQUFJLENBQUNFLE9BQU8sQ0FBQyxHQUFHLENBQUM7SUFDaEMsSUFBSUQsUUFBUSxLQUFLLENBQUMsQ0FBQyxJQUFJRSxNQUFNLEtBQUssQ0FBQyxDQUFDLEVBQUU7TUFDcEMsTUFBTSxJQUFJaEIsS0FBSyxDQUFDUixLQUFLLENBQUNRLEtBQUssQ0FBQ1IsS0FBSyxDQUFDUyxnQkFBZ0IsRUFBRSxHQUFHLElBQUksQ0FBQ1osV0FBVyxpQ0FBaUMsQ0FBQztJQUMzRztJQUNBLE1BQU00QixRQUFRLEdBQUdKLElBQUksQ0FBQ0ssU0FBUyxDQUFDSixRQUFRLEdBQUcsQ0FBQyxFQUFFRSxNQUFNLENBQUM7SUFDckQsT0FBT0csSUFBSSxDQUFDQyxLQUFLLENBQUNILFFBQVEsQ0FBQztFQUM3QjtBQUNGO0FBQUNJLE9BQUEsQ0FBQXBDLE9BQUEsR0FBQUMsbUJBQUEiLCJpZ25vcmVMaXN0IjpbXX0=
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJfQXV0aEFkYXB0ZXIiLCJfaW50ZXJvcFJlcXVpcmVEZWZhdWx0IiwicmVxdWlyZSIsImUiLCJfX2VzTW9kdWxlIiwiZGVmYXVsdCIsIkJhc2VBdXRoQ29kZUFkYXB0ZXIiLCJBdXRoQWRhcHRlciIsImNvbnN0cnVjdG9yIiwiYWRhcHRlck5hbWUiLCJ2YWxpZGF0ZU9wdGlvbnMiLCJvcHRpb25zIiwiRXJyb3IiLCJlbmFibGVJbnNlY3VyZUF1dGgiLCJjbGllbnRJZCIsImNsaWVudFNlY3JldCIsImJlZm9yZUZpbmQiLCJhdXRoRGF0YSIsImNvZGUiLCJhY2Nlc3NfdG9rZW4iLCJQYXJzZSIsIk9CSkVDVF9OT1RfRk9VTkQiLCJ1c2VyIiwiZ2V0VXNlckZyb21BY2Nlc3NUb2tlbiIsImlkIiwiVkFMSURBVElPTl9FUlJPUiIsImdldEFjY2Vzc1Rva2VuRnJvbUNvZGUiLCJyZWRpcmVjdF91cmkiLCJ2YWxpZGF0ZUxvZ2luIiwidmFsaWRhdGVTZXRVcCIsImFmdGVyRmluZCIsInZhbGlkYXRlVXBkYXRlIiwicGFyc2VSZXNwb25zZURhdGEiLCJkYXRhIiwic3RhcnRQb3MiLCJpbmRleE9mIiwiZW5kUG9zIiwianNvbkRhdGEiLCJzdWJzdHJpbmciLCJKU09OIiwicGFyc2UiLCJleHBvcnRzIl0sInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL0FkYXB0ZXJzL0F1dGgvQmFzZUNvZGVBdXRoQWRhcHRlci5qcyJdLCJzb3VyY2VzQ29udGVudCI6WyIvLyBhYnN0cmFjdCBjbGFzcyBmb3IgYXV0aCBjb2RlIGFkYXB0ZXJzXG5pbXBvcnQgQXV0aEFkYXB0ZXIgZnJvbSAnLi9BdXRoQWRhcHRlcic7XG5leHBvcnQgZGVmYXVsdCBjbGFzcyBCYXNlQXV0aENvZGVBZGFwdGVyIGV4dGVuZHMgQXV0aEFkYXB0ZXIge1xuICBjb25zdHJ1Y3RvcihhZGFwdGVyTmFtZSkge1xuICAgIHN1cGVyKCk7XG4gICAgdGhpcy5hZGFwdGVyTmFtZSA9IGFkYXB0ZXJOYW1lO1xuICB9XG4gIHZhbGlkYXRlT3B0aW9ucyhvcHRpb25zKSB7XG5cbiAgICBpZiAoIW9wdGlvbnMpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgJHt0aGlzLmFkYXB0ZXJOYW1lfSBvcHRpb25zIGFyZSByZXF1aXJlZC5gKTtcbiAgICB9XG5cbiAgICB0aGlzLmVuYWJsZUluc2VjdXJlQXV0aCA9IG9wdGlvbnMuZW5hYmxlSW5zZWN1cmVBdXRoO1xuICAgIGlmICh0aGlzLmVuYWJsZUluc2VjdXJlQXV0aCkge1xuICAgICAgcmV0dXJuO1xuICAgIH1cblxuICAgIHRoaXMuY2xpZW50SWQgPSBvcHRpb25zLmNsaWVudElkO1xuICAgIHRoaXMuY2xpZW50U2VjcmV0ID0gb3B0aW9ucy5jbGllbnRTZWNyZXQ7XG5cbiAgICBpZiAoIXRoaXMuY2xpZW50SWQpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgJHt0aGlzLmFkYXB0ZXJOYW1lfSBjbGllbnRJZCBpcyByZXF1aXJlZC5gKTtcbiAgICB9XG5cbiAgICBpZiAoIXRoaXMuY2xpZW50U2VjcmV0KSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7dGhpcy5hZGFwdGVyTmFtZX0gY2xpZW50U2VjcmV0IGlzIHJlcXVpcmVkLmApO1xuICAgIH1cbiAgfVxuXG4gIGFzeW5jIGJlZm9yZUZpbmQoYXV0aERhdGEpIHtcbiAgICBpZiAodGhpcy5lbmFibGVJbnNlY3VyZUF1dGggJiYgIWF1dGhEYXRhPy5jb2RlKSB7XG4gICAgICBpZiAoIWF1dGhEYXRhPy5hY2Nlc3NfdG9rZW4pIHtcbiAgICAgICAgdGhyb3cgbmV3IFBhcnNlLkVycm9yKFBhcnNlLkVycm9yLk9CSkVDVF9OT1RfRk9VTkQsIGAke3RoaXMuYWRhcHRlck5hbWV9IGF1dGggaXMgaW52YWxpZCBmb3IgdGhpcyB1c2VyLmApO1xuICAgICAgfVxuXG4gICAgICBjb25zdCB1c2VyID0gYXdhaXQgdGhpcy5nZXRVc2VyRnJvbUFjY2Vzc1Rva2VuKGF1dGhEYXRhLmFjY2Vzc190b2tlbiwgYXV0aERhdGEpO1xuXG4gICAgICBpZiAodXNlci5pZCAhPT0gYXV0aERhdGEuaWQpIHtcbiAgICAgICAgdGhyb3cgbmV3IFBhcnNlLkVycm9yKFBhcnNlLkVycm9yLk9CSkVDVF9OT1RfRk9VTkQsIGAke3RoaXMuYWRhcHRlck5hbWV9IGF1dGggaXMgaW52YWxpZCBmb3IgdGhpcyB1c2VyLmApO1xuICAgICAgfVxuXG4gICAgICByZXR1cm47XG4gICAgfVxuXG4gICAgaWYgKCFhdXRoRGF0YT8uY29kZSkge1xuICAgICAgdGhyb3cgbmV3IFBhcnNlLkVycm9yKFBhcnNlLkVycm9yLlZBTElEQVRJT05fRVJST1IsIGAke3RoaXMuYWRhcHRlck5hbWV9IGNvZGUgaXMgcmVxdWlyZWQuYCk7XG4gICAgfVxuXG4gICAgY29uc3QgYWNjZXNzX3Rva2VuID0gYXdhaXQgdGhpcy5nZXRBY2Nlc3NUb2tlbkZyb21Db2RlKGF1dGhEYXRhKTtcbiAgICBjb25zdCB1c2VyID0gYXdhaXQgdGhpcy5nZXRVc2VyRnJvbUFjY2Vzc1Rva2VuKGFjY2Vzc190b2tlbiwgYXV0aERhdGEpO1xuXG4gICAgaWYgKGF1dGhEYXRhLmlkICYmIHVzZXIuaWQgIT09IGF1dGhEYXRhLmlkKSB7XG4gICAgICB0aHJvdyBuZXcgUGFyc2UuRXJyb3IoUGFyc2UuRXJyb3IuT0JKRUNUX05PVF9GT1VORCwgYCR7dGhpcy5hZGFwdGVyTmFtZX0gYXV0aCBpcyBpbnZhbGlkIGZvciB0aGlzIHVzZXIuYCk7XG4gICAgfVxuXG4gICAgYXV0aERhdGEuYWNjZXNzX3Rva2VuID0gYWNjZXNzX3Rva2VuO1xuICAgIGF1dGhEYXRhLmlkID0gdXNlci5pZDtcblxuICAgIGRlbGV0ZSBhdXRoRGF0YS5jb2RlO1xuICAgIGRlbGV0ZSBhdXRoRGF0YS5yZWRpcmVjdF91cmk7XG5cbiAgfVxuXG4gIGFzeW5jIGdldFVzZXJGcm9tQWNjZXNzVG9rZW4oKSB7XG4gICAgLy8gYWJzdHJhY3QgbWV0aG9kXG4gICAgdGhyb3cgbmV3IEVycm9yKCdnZXRVc2VyRnJvbUFjY2Vzc1Rva2VuIGlzIG5vdCBpbXBsZW1lbnRlZCcpO1xuICB9XG5cbiAgYXN5bmMgZ2V0QWNjZXNzVG9rZW5Gcm9tQ29kZSgpIHtcbiAgICAvLyBhYnN0cmFjdCBtZXRob2RcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2dldEFjY2Vzc1Rva2VuRnJvbUNvZGUgaXMgbm90IGltcGxlbWVudGVkJyk7XG4gIH1cblxuICAvKipcbiAgICogVmFsaWRhdGVzIGF1dGggZGF0YSBvbiBsb2dpbi4gSW4gdGhlIHN0YW5kYXJkIGF1dGggZmxvd3MgKGxvZ2luLCBzaWdudXAsXG4gICAqIHVwZGF0ZSksIGBiZWZvcmVGaW5kYCBydW5zIGZpcnN0IGFuZCB2YWxpZGF0ZXMgY3JlZGVudGlhbHMsIHNvIG5vXG4gICAqIGFkZGl0aW9uYWwgY3JlZGVudGlhbCBjaGVjayBpcyBuZWVkZWQgaGVyZS5cbiAgICovXG4gIHZhbGlkYXRlTG9naW4oYXV0aERhdGEpIHtcbiAgICByZXR1cm4ge1xuICAgICAgaWQ6IGF1dGhEYXRhLmlkLFxuICAgIH1cbiAgfVxuXG4gIC8qKlxuICAgKiBWYWxpZGF0ZXMgYXV0aCBkYXRhIG9uIGZpcnN0IHNldHVwIG9yIHdoZW4gbGlua2luZyBhIG5ldyBwcm92aWRlci5cbiAgICogSW4gdGhlIHN0YW5kYXJkIGF1dGggZmxvd3MsIGBiZWZvcmVGaW5kYCBydW5zIGZpcnN0IGFuZCB2YWxpZGF0ZXNcbiAgICogY3JlZGVudGlhbHMsIHNvIG5vIGFkZGl0aW9uYWwgY3JlZGVudGlhbCBjaGVjayBpcyBuZWVkZWQgaGVyZS5cbiAgICovXG4gIHZhbGlkYXRlU2V0VXAoYXV0aERhdGEpIHtcbiAgICByZXR1cm4ge1xuICAgICAgaWQ6IGF1dGhEYXRhLmlkLFxuICAgIH1cbiAgfVxuXG4gIC8qKlxuICAgKiBSZXR1cm5zIHRoZSBhdXRoIGRhdGEgdG8gZXhwb3NlIHRvIHRoZSBjbGllbnQgYWZ0ZXIgYSBxdWVyeS5cbiAgICovXG4gIGFmdGVyRmluZChhdXRoRGF0YSkge1xuICAgIHJldHVybiB7XG4gICAgICBpZDogYXV0aERhdGEuaWQsXG4gICAgfVxuICB9XG5cbiAgLyoqXG4gICAqIFZhbGlkYXRlcyBhdXRoIGRhdGEgb24gdXBkYXRlLiBJbiB0aGUgc3RhbmRhcmQgYXV0aCBmbG93cywgYGJlZm9yZUZpbmRgXG4gICAqIHJ1bnMgZmlyc3QgZm9yIGFueSBjaGFuZ2VkIGF1dGggZGF0YSBhbmQgdmFsaWRhdGVzIGNyZWRlbnRpYWxzLCBzbyBub1xuICAgKiBhZGRpdGlvbmFsIGNyZWRlbnRpYWwgY2hlY2sgaXMgbmVlZGVkIGhlcmUuIFVuY2hhbmdlZCAoZWNob2VkLWJhY2spIGRhdGFcbiAgICogc2tpcHMgYm90aCBgYmVmb3JlRmluZGAgYW5kIHZhbGlkYXRpb24gZW50aXJlbHkuXG4gICAqL1xuICB2YWxpZGF0ZVVwZGF0ZShhdXRoRGF0YSkge1xuICAgIHJldHVybiB7XG4gICAgICBpZDogYXV0aERhdGEuaWQsXG4gICAgfVxuICB9XG5cbiAgcGFyc2VSZXNwb25zZURhdGEoZGF0YSkge1xuICAgIGNvbnN0IHN0YXJ0UG9zID0gZGF0YS5pbmRleE9mKCcoJyk7XG4gICAgY29uc3QgZW5kUG9zID0gZGF0YS5pbmRleE9mKCcpJyk7XG4gICAgaWYgKHN0YXJ0UG9zID09PSAtMSB8fCBlbmRQb3MgPT09IC0xKSB7XG4gICAgICB0aHJvdyBuZXcgUGFyc2UuRXJyb3IoUGFyc2UuRXJyb3IuT0JKRUNUX05PVF9GT1VORCwgYCR7dGhpcy5hZGFwdGVyTmFtZX0gYXV0aCBpcyBpbnZhbGlkIGZvciB0aGlzIHVzZXIuYCk7XG4gICAgfVxuICAgIGNvbnN0IGpzb25EYXRhID0gZGF0YS5zdWJzdHJpbmcoc3RhcnRQb3MgKyAxLCBlbmRQb3MpO1xuICAgIHJldHVybiBKU09OLnBhcnNlKGpzb25EYXRhKTtcbiAgfVxufVxuIl0sIm1hcHBpbmdzIjoiOzs7Ozs7QUFDQSxJQUFBQSxZQUFBLEdBQUFDLHNCQUFBLENBQUFDLE9BQUE7QUFBd0MsU0FBQUQsdUJBQUFFLENBQUEsV0FBQUEsQ0FBQSxJQUFBQSxDQUFBLENBQUFDLFVBQUEsR0FBQUQsQ0FBQSxLQUFBRSxPQUFBLEVBQUFGLENBQUE7QUFEeEM7O0FBRWUsTUFBTUcsbUJBQW1CLFNBQVNDLG9CQUFXLENBQUM7RUFDM0RDLFdBQVdBLENBQUNDLFdBQVcsRUFBRTtJQUN2QixLQUFLLENBQUMsQ0FBQztJQUNQLElBQUksQ0FBQ0EsV0FBVyxHQUFHQSxXQUFXO0VBQ2hDO0VBQ0FDLGVBQWVBLENBQUNDLE9BQU8sRUFBRTtJQUV2QixJQUFJLENBQUNBLE9BQU8sRUFBRTtNQUNaLE1BQU0sSUFBSUMsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDSCxXQUFXLHdCQUF3QixDQUFDO0lBQzlEO0lBRUEsSUFBSSxDQUFDSSxrQkFBa0IsR0FBR0YsT0FBTyxDQUFDRSxrQkFBa0I7SUFDcEQsSUFBSSxJQUFJLENBQUNBLGtCQUFrQixFQUFFO01BQzNCO0lBQ0Y7SUFFQSxJQUFJLENBQUNDLFFBQVEsR0FBR0gsT0FBTyxDQUFDRyxRQUFRO0lBQ2hDLElBQUksQ0FBQ0MsWUFBWSxHQUFHSixPQUFPLENBQUNJLFlBQVk7SUFFeEMsSUFBSSxDQUFDLElBQUksQ0FBQ0QsUUFBUSxFQUFFO01BQ2xCLE1BQU0sSUFBSUYsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDSCxXQUFXLHdCQUF3QixDQUFDO0lBQzlEO0lBRUEsSUFBSSxDQUFDLElBQUksQ0FBQ00sWUFBWSxFQUFFO01BQ3RCLE1BQU0sSUFBSUgsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDSCxXQUFXLDRCQUE0QixDQUFDO0lBQ2xFO0VBQ0Y7RUFFQSxNQUFNTyxVQUFVQSxDQUFDQyxRQUFRLEVBQUU7SUFDekIsSUFBSSxJQUFJLENBQUNKLGtCQUFrQixJQUFJLENBQUNJLFFBQVEsRUFBRUMsSUFBSSxFQUFFO01BQzlDLElBQUksQ0FBQ0QsUUFBUSxFQUFFRSxZQUFZLEVBQUU7UUFDM0IsTUFBTSxJQUFJQyxLQUFLLENBQUNSLEtBQUssQ0FBQ1EsS0FBSyxDQUFDUixLQUFLLENBQUNTLGdCQUFnQixFQUFFLEdBQUcsSUFBSSxDQUFDWixXQUFXLGlDQUFpQyxDQUFDO01BQzNHO01BRUEsTUFBTWEsSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDQyxzQkFBc0IsQ0FBQ04sUUFBUSxDQUFDRSxZQUFZLEVBQUVGLFFBQVEsQ0FBQztNQUUvRSxJQUFJSyxJQUFJLENBQUNFLEVBQUUsS0FBS1AsUUFBUSxDQUFDTyxFQUFFLEVBQUU7UUFDM0IsTUFBTSxJQUFJSixLQUFLLENBQUNSLEtBQUssQ0FBQ1EsS0FBSyxDQUFDUixLQUFLLENBQUNTLGdCQUFnQixFQUFFLEdBQUcsSUFBSSxDQUFDWixXQUFXLGlDQUFpQyxDQUFDO01BQzNHO01BRUE7SUFDRjtJQUVBLElBQUksQ0FBQ1EsUUFBUSxFQUFFQyxJQUFJLEVBQUU7TUFDbkIsTUFBTSxJQUFJRSxLQUFLLENBQUNSLEtBQUssQ0FBQ1EsS0FBSyxDQUFDUixLQUFLLENBQUNhLGdCQUFnQixFQUFFLEdBQUcsSUFBSSxDQUFDaEIsV0FBVyxvQkFBb0IsQ0FBQztJQUM5RjtJQUVBLE1BQU1VLFlBQVksR0FBRyxNQUFNLElBQUksQ0FBQ08sc0JBQXNCLENBQUNULFFBQVEsQ0FBQztJQUNoRSxNQUFNSyxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUNDLHNCQUFzQixDQUFDSixZQUFZLEVBQUVGLFFBQVEsQ0FBQztJQUV0RSxJQUFJQSxRQUFRLENBQUNPLEVBQUUsSUFBSUYsSUFBSSxDQUFDRSxFQUFFLEtBQUtQLFFBQVEsQ0FBQ08sRUFBRSxFQUFFO01BQzFDLE1BQU0sSUFBSUosS0FBSyxDQUFDUixLQUFLLENBQUNRLEtBQUssQ0FBQ1IsS0FBSyxDQUFDUyxnQkFBZ0IsRUFBRSxHQUFHLElBQUksQ0FBQ1osV0FBVyxpQ0FBaUMsQ0FBQztJQUMzRztJQUVBUSxRQUFRLENBQUNFLFlBQVksR0FBR0EsWUFBWTtJQUNwQ0YsUUFBUSxDQUFDTyxFQUFFLEdBQUdGLElBQUksQ0FBQ0UsRUFBRTtJQUVyQixPQUFPUCxRQUFRLENBQUNDLElBQUk7SUFDcEIsT0FBT0QsUUFBUSxDQUFDVSxZQUFZO0VBRTlCO0VBRUEsTUFBTUosc0JBQXNCQSxDQUFBLEVBQUc7SUFDN0I7SUFDQSxNQUFNLElBQUlYLEtBQUssQ0FBQywyQ0FBMkMsQ0FBQztFQUM5RDtFQUVBLE1BQU1jLHNCQUFzQkEsQ0FBQSxFQUFHO0lBQzdCO0lBQ0EsTUFBTSxJQUFJZCxLQUFLLENBQUMsMkNBQTJDLENBQUM7RUFDOUQ7O0VBRUE7QUFDRjtBQUNBO0FBQ0E7QUFDQTtFQUNFZ0IsYUFBYUEsQ0FBQ1gsUUFBUSxFQUFFO0lBQ3RCLE9BQU87TUFDTE8sRUFBRSxFQUFFUCxRQUFRLENBQUNPO0lBQ2YsQ0FBQztFQUNIOztFQUVBO0FBQ0Y7QUFDQTtBQUNBO0FBQ0E7RUFDRUssYUFBYUEsQ0FBQ1osUUFBUSxFQUFFO0lBQ3RCLE9BQU87TUFDTE8sRUFBRSxFQUFFUCxRQUFRLENBQUNPO0lBQ2YsQ0FBQztFQUNIOztFQUVBO0FBQ0Y7QUFDQTtFQUNFTSxTQUFTQSxDQUFDYixRQUFRLEVBQUU7SUFDbEIsT0FBTztNQUNMTyxFQUFFLEVBQUVQLFFBQVEsQ0FBQ087SUFDZixDQUFDO0VBQ0g7O0VBRUE7QUFDRjtBQUNBO0FBQ0E7QUFDQTtBQUNBO0VBQ0VPLGNBQWNBLENBQUNkLFFBQVEsRUFBRTtJQUN2QixPQUFPO01BQ0xPLEVBQUUsRUFBRVAsUUFBUSxDQUFDTztJQUNmLENBQUM7RUFDSDtFQUVBUSxpQkFBaUJBLENBQUNDLElBQUksRUFBRTtJQUN0QixNQUFNQyxRQUFRLEdBQUdELElBQUksQ0FBQ0UsT0FBTyxDQUFDLEdBQUcsQ0FBQztJQUNsQyxNQUFNQyxNQUFNLEdBQUdILElBQUksQ0FBQ0UsT0FBTyxDQUFDLEdBQUcsQ0FBQztJQUNoQyxJQUFJRCxRQUFRLEtBQUssQ0FBQyxDQUFDLElBQUlFLE1BQU0sS0FBSyxDQUFDLENBQUMsRUFBRTtNQUNwQyxNQUFNLElBQUloQixLQUFLLENBQUNSLEtBQUssQ0FBQ1EsS0FBSyxDQUFDUixLQUFLLENBQUNTLGdCQUFnQixFQUFFLEdBQUcsSUFBSSxDQUFDWixXQUFXLGlDQUFpQyxDQUFDO0lBQzNHO0lBQ0EsTUFBTTRCLFFBQVEsR0FBR0osSUFBSSxDQUFDSyxTQUFTLENBQUNKLFFBQVEsR0FBRyxDQUFDLEVBQUVFLE1BQU0sQ0FBQztJQUNyRCxPQUFPRyxJQUFJLENBQUNDLEtBQUssQ0FBQ0gsUUFBUSxDQUFDO0VBQzdCO0FBQ0Y7QUFBQ0ksT0FBQSxDQUFBcEMsT0FBQSxHQUFBQyxtQkFBQSIsImlnbm9yZUxpc3QiOltdfQ==