raindancers-cloudfront 0.0.37 → 0.0.39

package/lib/cloudfront/cloudfront-functions/auth-check.js

@@ -142,11 +142,53 @@ function getOriginalPath(request) {
     return request.uri + '?' + qs;
 }
 
-function redirectToAuth(originalPath, host) {
+// A live PKCE sign-in is represented by the pair of cookies (oauth_state +
+// code_verifier) minted on the redirect that started it. The browser drops both
+// at Max-Age=600, so their PRESENCE (with a well-formed, decodable state) is the
+// practical "unexpired flow" signal available to a CloudFront Function — it has
+// no way to read a cookie's own expiry. Reusing an existing pair instead of
+// minting a new one is what stops a redirect provoked mid-sign-in (e.g. a
+// background notification poll from a sibling panel on the shared cookie domain)
+// from overwriting the state the in-flight sign-in carries, which the callback
+// compares strictly and rejects with "400 Invalid state parameter".
+function inflightAuthFlow(cookies) {
+    if (!cookies) { return null; }
+    var stateCookie = cookies.oauth_state;
+    var verifierCookie = cookies.code_verifier;
+    if (!stateCookie || !stateCookie.value || !verifierCookie || !verifierCookie.value) {
+        return null;
+    }
+    try {
+        JSON.parse(base64urlDecode(stateCookie.value));
+    } catch (e) {
+        return null;
+    }
+    return { state: stateCookie.value, codeVerifier: verifierCookie.value };
+}
+
+function redirectToAuth(originalPath, host, cookies) {
+    var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
+
+    // If a sign-in is already in flight, reissue the redirect REUSING its state
+    // and verifier, and set NO cookies — do not clobber the live flow. The
+    // challenge is re-derived from the stored verifier so the authorize URL stays
+    // consistent with the PKCE exchange the callback performs for whichever flow
+    // completes.
+    var inflight = inflightAuthFlow(cookies);
+    if (inflight) {
+        var reusedChallenge = generateCodeChallenge(inflight.codeVerifier);
+        return {
+            statusCode: 302,
+            headers: {
+                location: { value: buildAzureAuthUrl(inflight.state, reusedChallenge, host) },
+                'cache-control': { value: 'no-store' }
+            }
+        };
+    }
+
     var state = generateState(originalPath, host);
     var codeVerifier = generateCodeVerifier();
     var codeChallenge = generateCodeChallenge(codeVerifier);
-    var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
     return {
         statusCode: 302,
         headers: {
@@ -203,13 +245,13 @@ async function handler(event) {
     // Check for session cookie (supports both __Secure- with domain and __Host- without)
     var sessionCookie = cookies['__Secure-auth_session'] || cookies['__Host-auth_session'];
     if (!sessionCookie) {
-        return redirectToAuth(getOriginalPath(request), host);
+        return redirectToAuth(getOriginalPath(request), host, request.cookies);
     }
     
     var token = sessionCookie.value;
     
     if (!token || token.length === 0) {
-        return redirectToAuth(getOriginalPath(request), host);
+        return redirectToAuth(getOriginalPath(request), host, request.cookies);
     }
     
     try {
@@ -217,12 +259,12 @@ async function handler(event) {
         var parts = token.split('.');
         
         if (parts.length !== 3) {
-            return redirectToAuth(originalPath, host);
+            return redirectToAuth(originalPath, host, request.cookies);
         }
         
         var isValid = await validateHmacSignature(token);
         if (!isValid) {
-            return redirectToAuth(originalPath, host);
+            return redirectToAuth(originalPath, host, request.cookies);
         }
         
         var payload = JSON.parse(base64urlDecode(parts[1]));
@@ -232,7 +274,7 @@ async function handler(event) {
             if (ENABLE_REFRESH) {
                 return redirectToRefresh(originalPath, host);
             }
-            return redirectToAuth(originalPath, host);
+            return redirectToAuth(originalPath, host, request.cookies);
         }
         
         // Check if session is revoked (denylist approach)
@@ -242,7 +284,7 @@ async function handler(event) {
                 var isRevoked = await kvsHandle.get('revoked:' + jti);
                 if (isRevoked) {
                     console.log('Session revoked: ' + jti);
-                    return redirectToAuth(originalPath, host);
+                    return redirectToAuth(originalPath, host, request.cookies);
                 }
             } catch (e) {
                 console.log('KVS error checking revocation: ' + e);
@@ -265,6 +307,6 @@ async function handler(event) {
         
         return request;
     } catch (e) {
-        return redirectToAuth(getOriginalPath(request), host);
+        return redirectToAuth(getOriginalPath(request), host, request.cookies);
     }
 }

package/lib/cloudfront/cloudfront-functions/modules/auth-check.js

@@ -140,7 +140,33 @@ function getOriginalPath(request) {
   return request.uri + '?' + qs;
 }
 
-function redirectToAuth(originalPath, host) {
+// A live PKCE sign-in is represented by the pair of cookies (oauth_state +
+// code_verifier) minted on the redirect that started it. The browser drops both
+// at Max-Age=600, so their PRESENCE (with a well-formed, decodable state) is the
+// practical "unexpired flow" signal available to a CloudFront Function — it has
+// no way to read a cookie's own expiry. Reusing an existing pair instead of
+// minting a new one is what stops a redirect provoked mid-sign-in (e.g. a
+// background notification poll from a sibling panel on the shared cookie domain)
+// from overwriting the state the in-flight sign-in carries, which the callback
+// compares strictly and rejects with "400 Invalid state parameter".
+function inflightAuthFlow(cookies) {
+  if (!cookies) { return null; }
+  var stateCookie = cookies.oauth_state;
+  var verifierCookie = cookies.code_verifier;
+  if (!stateCookie || !stateCookie.value || !verifierCookie || !verifierCookie.value) {
+    return null;
+  }
+  // Require the state to be decodable — a malformed value is not a flow we can
+  // reissue against, so fall through to minting a fresh one.
+  try {
+    JSON.parse(base64urlDecode(stateCookie.value));
+  } catch (e) {
+    return null;
+  }
+  return { state: stateCookie.value, codeVerifier: verifierCookie.value };
+}
+
+function redirectToAuth(originalPath, host, cookies) {
   // Custom-UI mode: redirect to a first-party login page. No IdP redirect and
   // no PKCE state/verifier cookies — the login page performs SRP client-side and
   // POSTs the resulting tokens to the session-issuance endpoint.
@@ -153,10 +179,27 @@ function redirectToAuth(originalPath, host) {
       }
     };
   }
+  var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
+
+  // If a sign-in is already in flight, reissue the redirect REUSING its state and
+  // verifier, and set NO cookies — do not clobber the live flow. The challenge is
+  // re-derived from the stored verifier so the authorize URL stays consistent with
+  // the PKCE exchange the callback will perform for whichever flow completes.
+  var inflight = inflightAuthFlow(cookies);
+  if (inflight) {
+    var reusedChallenge = generateCodeChallenge(inflight.codeVerifier);
+    return {
+      statusCode: 302,
+      headers: {
+        location: { value: buildAzureAuthUrl(inflight.state, reusedChallenge, host) },
+        'cache-control': { value: 'no-store' }
+      }
+    };
+  }
+
   var state = generateState(originalPath, host);
   var codeVerifier = generateCodeVerifier();
   var codeChallenge = generateCodeChallenge(codeVerifier);
-  var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
   return {
     statusCode: 302,
     headers: {
@@ -213,14 +256,14 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
   if (!sessionCookie) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath, host)
+      response: redirectToAuth(originalPath, host, request.cookies)
     };
   }
   var token = sessionCookie.value;
   if (!token || token.length === 0) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath, host)
+      response: redirectToAuth(originalPath, host, request.cookies)
     };
   }
   try {
@@ -228,14 +271,14 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
     if (parts.length !== 3) {
       return {
         pass: false,
-        response: redirectToAuth(originalPath, host)
+        response: redirectToAuth(originalPath, host, request.cookies)
       };
     }
     var isValid = await validateHmacSignature(token);
     if (!isValid) {
       return {
         pass: false,
-        response: redirectToAuth(originalPath, host)
+        response: redirectToAuth(originalPath, host, request.cookies)
       };
     }
     var payload = JSON.parse(base64urlDecode(parts[1]));
@@ -250,7 +293,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
       }
       return {
         pass: false,
-        response: redirectToAuth(originalPath, host)
+        response: redirectToAuth(originalPath, host, request.cookies)
       };
     }
     var jti = payload.jti;
@@ -260,7 +303,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
         if (isRevoked) {
           return {
             pass: false,
-            response: redirectToAuth(originalPath, host)
+            response: redirectToAuth(originalPath, host, request.cookies)
           };
         }
       } catch (e) {}
@@ -304,7 +347,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
   } catch (e) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath, host)
+      response: redirectToAuth(originalPath, host, request.cookies)
     };
   }
 }

package/lib/cloudfront/cloudfront-functions/modules/cognito-auth-check.js

@@ -121,7 +121,47 @@ function getOriginalPath(request) {
   return request.uri + '?' + qs;
 }
 
-function redirectToAuth(originalPath) {
+// A live PKCE sign-in is represented by the pair of cookies (oauth_state +
+// code_verifier) minted on the redirect that started it. The browser drops both
+// at Max-Age=600, so their PRESENCE (with a well-formed, decodable state) is the
+// practical "unexpired flow" signal available to a CloudFront Function — it has
+// no way to read a cookie's own expiry. Reusing an existing pair instead of
+// minting a new one is what stops a redirect provoked mid-sign-in (e.g. a
+// background notification poll from a sibling panel on the shared cookie domain)
+// from overwriting the state the in-flight sign-in carries, which the callback
+// compares strictly and rejects with "400 Invalid state parameter".
+function inflightAuthFlow(cookies) {
+  if (!cookies) { return null; }
+  var stateCookie = cookies.oauth_state;
+  var verifierCookie = cookies.code_verifier;
+  if (!stateCookie || !stateCookie.value || !verifierCookie || !verifierCookie.value) {
+    return null;
+  }
+  try {
+    JSON.parse(base64urlDecode(stateCookie.value));
+  } catch (e) {
+    return null;
+  }
+  return { state: stateCookie.value, codeVerifier: verifierCookie.value };
+}
+
+function redirectToAuth(originalPath, cookies) {
+  // If a sign-in is already in flight, reissue the redirect REUSING its state and
+  // verifier, and set NO cookies — do not clobber the live flow. The challenge is
+  // re-derived from the stored verifier so the authorize URL stays consistent with
+  // the PKCE exchange the callback performs for whichever flow completes.
+  var inflight = inflightAuthFlow(cookies);
+  if (inflight) {
+    var reusedChallenge = generateCodeChallenge(inflight.codeVerifier);
+    return {
+      statusCode: 302,
+      headers: {
+        location: { value: buildCognitoAuthUrl(inflight.state, reusedChallenge) },
+        'cache-control': { value: 'no-store' }
+      }
+    };
+  }
+
   var state = generateState(originalPath);
   var codeVerifier = generateCodeVerifier();
   var codeChallenge = generateCodeChallenge(codeVerifier);
@@ -155,32 +195,32 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
   var cookies = request.cookies;
   var originalPath = getOriginalPath(request);
   if (!cookies['__Host-auth_session']) {
-    return { pass: false, response: redirectToAuth(originalPath) };
+    return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
   }
   var token = cookies['__Host-auth_session'].value;
   if (!token || token.length === 0) {
-    return { pass: false, response: redirectToAuth(originalPath) };
+    return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
   }
   try {
     var parts = token.split('.');
     if (parts.length !== 3) {
-      return { pass: false, response: redirectToAuth(originalPath) };
+      return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
     }
     var isValid = await validateHmacSignature(token);
     if (!isValid) {
-      return { pass: false, response: redirectToAuth(originalPath) };
+      return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
     }
     var payload = JSON.parse(base64urlDecode(parts[1]));
     var now = Math.floor(Date.now() / 1000);
     if (payload.exp && payload.exp < now) {
-      return { pass: false, response: redirectToAuth(originalPath) };
+      return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
     }
     var jti = payload.jti;
     if (jti) {
       try {
         var isRevoked = await kvsHandle.get('revoked:' + jti);
         if (isRevoked) {
-          return { pass: false, response: redirectToAuth(originalPath) };
+          return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
         }
       } catch (e) {}
     }
@@ -218,6 +258,6 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
 
     return { pass: true, payload: payload };
   } catch (e) {
-    return { pass: false, response: redirectToAuth(originalPath) };
+    return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
   }
 }

package/lib/cloudfront/edgeAssetHash.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Compute a deterministic content hash for a Lambda@Edge asset bundle.
+ *
+ * Why this exists: `cloudfront.experimental.EdgeFunction` publishes a new
+ * `AWS::Lambda::Version` whenever the asset hash changes. When the asset is
+ * created via `lambda.Code.fromAsset(dir, { bundling })` WITHOUT an explicit
+ * `assetHash`, CDK falls back to hashing the bundling OUTPUT — and the local
+ * bundler here copies files with `fs.cpSync`, which does not reproduce a
+ * byte-identical tree across synths (mtimes/ordering drift). The result is a
+ * fresh edge-Lambda version on EVERY deploy even when the code is unchanged,
+ * each of which forces a global CloudFront re-association + propagation and
+ * locks the prior version from deletion (it also slowly fills the regional
+ * Lambda storage quota).
+ *
+ * This helper produces a hash from the actual INPUTS — the source directory
+ * contents, the generated config, and the optional pre-bundled deps directory —
+ * so an unchanged input yields an unchanged hash and no new version. Pass the
+ * result as `assetHash` with `assetHashType: AssetHashType.CUSTOM`.
+ *
+ * Files are hashed in sorted order for determinism. `requirements.txt` is
+ * excluded because it is not shipped in the bundle (the bundler skips it).
+ */
+export declare function computeEdgeAssetHash(sourceDir: string, generatedConfig: string, bundledDepsDir?: string): string;

package/lib/cloudfront/edgeAssetHash.js

@@ -0,0 +1,97 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeEdgeAssetHash = computeEdgeAssetHash;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Compute a deterministic content hash for a Lambda@Edge asset bundle.
+ *
+ * Why this exists: `cloudfront.experimental.EdgeFunction` publishes a new
+ * `AWS::Lambda::Version` whenever the asset hash changes. When the asset is
+ * created via `lambda.Code.fromAsset(dir, { bundling })` WITHOUT an explicit
+ * `assetHash`, CDK falls back to hashing the bundling OUTPUT — and the local
+ * bundler here copies files with `fs.cpSync`, which does not reproduce a
+ * byte-identical tree across synths (mtimes/ordering drift). The result is a
+ * fresh edge-Lambda version on EVERY deploy even when the code is unchanged,
+ * each of which forces a global CloudFront re-association + propagation and
+ * locks the prior version from deletion (it also slowly fills the regional
+ * Lambda storage quota).
+ *
+ * This helper produces a hash from the actual INPUTS — the source directory
+ * contents, the generated config, and the optional pre-bundled deps directory —
+ * so an unchanged input yields an unchanged hash and no new version. Pass the
+ * result as `assetHash` with `assetHashType: AssetHashType.CUSTOM`.
+ *
+ * Files are hashed in sorted order for determinism. `requirements.txt` is
+ * excluded because it is not shipped in the bundle (the bundler skips it).
+ */
+function computeEdgeAssetHash(sourceDir, generatedConfig, bundledDepsDir) {
+    const hash = crypto.createHash('sha256');
+    hash.update('config\0');
+    hash.update(generatedConfig);
+    hashDir(hash, sourceDir, 'src', (file) => file === 'requirements.txt');
+    if (bundledDepsDir && fs.existsSync(bundledDepsDir)) {
+        hashDir(hash, bundledDepsDir, 'dep');
+    }
+    return hash.digest('hex');
+}
+/**
+ * Fold every regular file under `dir` (recursively, sorted) into `hash`. Each
+ * file contributes its relative path and its bytes under a namespace prefix so
+ * that two directories cannot collide and file moves change the hash.
+ */
+function hashDir(hash, dir, namespace, skip) {
+    const walk = (current, rel) => {
+        const entries = fs.readdirSync(current).sort();
+        for (const name of entries) {
+            const abs = path.join(current, name);
+            const relPath = rel ? `${rel}/${name}` : name;
+            const stat = fs.statSync(abs);
+            if (stat.isDirectory()) {
+                walk(abs, relPath);
+            }
+            else if (stat.isFile()) {
+                if (skip && skip(relPath))
+                    continue;
+                hash.update(`${namespace}\0${relPath}\0`);
+                hash.update(fs.readFileSync(abs));
+            }
+        }
+    };
+    walk(dir, '');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZWRnZUFzc2V0SGFzaC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jbG91ZGZyb250L2VkZ2VBc3NldEhhc2gudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUEwQkEsb0RBZ0JDO0FBMUNELCtDQUFpQztBQUNqQyx1Q0FBeUI7QUFDekIsMkNBQTZCO0FBRTdCOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FxQkc7QUFDSCxTQUFnQixvQkFBb0IsQ0FDbEMsU0FBaUIsRUFDakIsZUFBdUIsRUFDdkIsY0FBdUI7SUFFdkIsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN6QyxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hCLElBQUksQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLENBQUM7SUFFN0IsT0FBTyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLEtBQUssa0JBQWtCLENBQUMsQ0FBQztJQUV2RSxJQUFJLGNBQWMsSUFBSSxFQUFFLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDcEQsT0FBTyxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDdkMsQ0FBQztJQUVELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUM1QixDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQVMsT0FBTyxDQUNkLElBQWlCLEVBQ2pCLEdBQVcsRUFDWCxTQUFpQixFQUNqQixJQUFtQztJQUVuQyxNQUFNLElBQUksR0FBRyxDQUFDLE9BQWUsRUFBRSxHQUFXLEVBQVEsRUFBRTtRQUNsRCxNQUFNLE9BQU8sR0FBRyxFQUFFLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQy9DLEtBQUssTUFBTSxJQUFJLElBQUksT0FBTyxFQUFFLENBQUM7WUFDM0IsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDckMsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO1lBQzlDLE1BQU0sSUFBSSxHQUFHLEVBQUUsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDOUIsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztnQkFDdkIsSUFBSSxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztZQUNyQixDQUFDO2lCQUFNLElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7Z0JBQ3pCLElBQUksSUFBSSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUM7b0JBQUUsU0FBUztnQkFDcEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLFNBQVMsS0FBSyxPQUFPLElBQUksQ0FBQyxDQUFDO2dCQUMxQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztZQUNwQyxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUMsQ0FBQztJQUNGLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDaEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGNyeXB0byBmcm9tICdjcnlwdG8nO1xuaW1wb3J0ICogYXMgZnMgZnJvbSAnZnMnO1xuaW1wb3J0ICogYXMgcGF0aCBmcm9tICdwYXRoJztcblxuLyoqXG4gKiBDb21wdXRlIGEgZGV0ZXJtaW5pc3RpYyBjb250ZW50IGhhc2ggZm9yIGEgTGFtYmRhQEVkZ2UgYXNzZXQgYnVuZGxlLlxuICpcbiAqIFdoeSB0aGlzIGV4aXN0czogYGNsb3VkZnJvbnQuZXhwZXJpbWVudGFsLkVkZ2VGdW5jdGlvbmAgcHVibGlzaGVzIGEgbmV3XG4gKiBgQVdTOjpMYW1iZGE6OlZlcnNpb25gIHdoZW5ldmVyIHRoZSBhc3NldCBoYXNoIGNoYW5nZXMuIFdoZW4gdGhlIGFzc2V0IGlzXG4gKiBjcmVhdGVkIHZpYSBgbGFtYmRhLkNvZGUuZnJvbUFzc2V0KGRpciwgeyBidW5kbGluZyB9KWAgV0lUSE9VVCBhbiBleHBsaWNpdFxuICogYGFzc2V0SGFzaGAsIENESyBmYWxscyBiYWNrIHRvIGhhc2hpbmcgdGhlIGJ1bmRsaW5nIE9VVFBVVCDigJQgYW5kIHRoZSBsb2NhbFxuICogYnVuZGxlciBoZXJlIGNvcGllcyBmaWxlcyB3aXRoIGBmcy5jcFN5bmNgLCB3aGljaCBkb2VzIG5vdCByZXByb2R1Y2UgYVxuICogYnl0ZS1pZGVudGljYWwgdHJlZSBhY3Jvc3Mgc3ludGhzIChtdGltZXMvb3JkZXJpbmcgZHJpZnQpLiBUaGUgcmVzdWx0IGlzIGFcbiAqIGZyZXNoIGVkZ2UtTGFtYmRhIHZlcnNpb24gb24gRVZFUlkgZGVwbG95IGV2ZW4gd2hlbiB0aGUgY29kZSBpcyB1bmNoYW5nZWQsXG4gKiBlYWNoIG9mIHdoaWNoIGZvcmNlcyBhIGdsb2JhbCBDbG91ZEZyb250IHJlLWFzc29jaWF0aW9uICsgcHJvcGFnYXRpb24gYW5kXG4gKiBsb2NrcyB0aGUgcHJpb3IgdmVyc2lvbiBmcm9tIGRlbGV0aW9uIChpdCBhbHNvIHNsb3dseSBmaWxscyB0aGUgcmVnaW9uYWxcbiAqIExhbWJkYSBzdG9yYWdlIHF1b3RhKS5cbiAqXG4gKiBUaGlzIGhlbHBlciBwcm9kdWNlcyBhIGhhc2ggZnJvbSB0aGUgYWN0dWFsIElOUFVUUyDigJQgdGhlIHNvdXJjZSBkaXJlY3RvcnlcbiAqIGNvbnRlbnRzLCB0aGUgZ2VuZXJhdGVkIGNvbmZpZywgYW5kIHRoZSBvcHRpb25hbCBwcmUtYnVuZGxlZCBkZXBzIGRpcmVjdG9yeSDigJRcbiAqIHNvIGFuIHVuY2hhbmdlZCBpbnB1dCB5aWVsZHMgYW4gdW5jaGFuZ2VkIGhhc2ggYW5kIG5vIG5ldyB2ZXJzaW9uLiBQYXNzIHRoZVxuICogcmVzdWx0IGFzIGBhc3NldEhhc2hgIHdpdGggYGFzc2V0SGFzaFR5cGU6IEFzc2V0SGFzaFR5cGUuQ1VTVE9NYC5cbiAqXG4gKiBGaWxlcyBhcmUgaGFzaGVkIGluIHNvcnRlZCBvcmRlciBmb3IgZGV0ZXJtaW5pc20uIGByZXF1aXJlbWVudHMudHh0YCBpc1xuICogZXhjbHVkZWQgYmVjYXVzZSBpdCBpcyBub3Qgc2hpcHBlZCBpbiB0aGUgYnVuZGxlICh0aGUgYnVuZGxlciBza2lwcyBpdCkuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjb21wdXRlRWRnZUFzc2V0SGFzaChcbiAgc291cmNlRGlyOiBzdHJpbmcsXG4gIGdlbmVyYXRlZENvbmZpZzogc3RyaW5nLFxuICBidW5kbGVkRGVwc0Rpcj86IHN0cmluZyxcbik6IHN0cmluZyB7XG4gIGNvbnN0IGhhc2ggPSBjcnlwdG8uY3JlYXRlSGFzaCgnc2hhMjU2Jyk7XG4gIGhhc2gudXBkYXRlKCdjb25maWdcXDAnKTtcbiAgaGFzaC51cGRhdGUoZ2VuZXJhdGVkQ29uZmlnKTtcblxuICBoYXNoRGlyKGhhc2gsIHNvdXJjZURpciwgJ3NyYycsIChmaWxlKSA9PiBmaWxlID09PSAncmVxdWlyZW1lbnRzLnR4dCcpO1xuXG4gIGlmIChidW5kbGVkRGVwc0RpciAmJiBmcy5leGlzdHNTeW5jKGJ1bmRsZWREZXBzRGlyKSkge1xuICAgIGhhc2hEaXIoaGFzaCwgYnVuZGxlZERlcHNEaXIsICdkZXAnKTtcbiAgfVxuXG4gIHJldHVybiBoYXNoLmRpZ2VzdCgnaGV4Jyk7XG59XG5cbi8qKlxuICogRm9sZCBldmVyeSByZWd1bGFyIGZpbGUgdW5kZXIgYGRpcmAgKHJlY3Vyc2l2ZWx5LCBzb3J0ZWQpIGludG8gYGhhc2hgLiBFYWNoXG4gKiBmaWxlIGNvbnRyaWJ1dGVzIGl0cyByZWxhdGl2ZSBwYXRoIGFuZCBpdHMgYnl0ZXMgdW5kZXIgYSBuYW1lc3BhY2UgcHJlZml4IHNvXG4gKiB0aGF0IHR3byBkaXJlY3RvcmllcyBjYW5ub3QgY29sbGlkZSBhbmQgZmlsZSBtb3ZlcyBjaGFuZ2UgdGhlIGhhc2guXG4gKi9cbmZ1bmN0aW9uIGhhc2hEaXIoXG4gIGhhc2g6IGNyeXB0by5IYXNoLFxuICBkaXI6IHN0cmluZyxcbiAgbmFtZXNwYWNlOiBzdHJpbmcsXG4gIHNraXA/OiAocmVsUGF0aDogc3RyaW5nKSA9PiBib29sZWFuLFxuKTogdm9pZCB7XG4gIGNvbnN0IHdhbGsgPSAoY3VycmVudDogc3RyaW5nLCByZWw6IHN0cmluZyk6IHZvaWQgPT4ge1xuICAgIGNvbnN0IGVudHJpZXMgPSBmcy5yZWFkZGlyU3luYyhjdXJyZW50KS5zb3J0KCk7XG4gICAgZm9yIChjb25zdCBuYW1lIG9mIGVudHJpZXMpIHtcbiAgICAgIGNvbnN0IGFicyA9IHBhdGguam9pbihjdXJyZW50LCBuYW1lKTtcbiAgICAgIGNvbnN0IHJlbFBhdGggPSByZWwgPyBgJHtyZWx9LyR7bmFtZX1gIDogbmFtZTtcbiAgICAgIGNvbnN0IHN0YXQgPSBmcy5zdGF0U3luYyhhYnMpO1xuICAgICAgaWYgKHN0YXQuaXNEaXJlY3RvcnkoKSkge1xuICAgICAgICB3YWxrKGFicywgcmVsUGF0aCk7XG4gICAgICB9IGVsc2UgaWYgKHN0YXQuaXNGaWxlKCkpIHtcbiAgICAgICAgaWYgKHNraXAgJiYgc2tpcChyZWxQYXRoKSkgY29udGludWU7XG4gICAgICAgIGhhc2gudXBkYXRlKGAke25hbWVzcGFjZX1cXDAke3JlbFBhdGh9XFwwYCk7XG4gICAgICAgIGhhc2gudXBkYXRlKGZzLnJlYWRGaWxlU3luYyhhYnMpKTtcbiAgICAgIH1cbiAgICB9XG4gIH07XG4gIHdhbGsoZGlyLCAnJyk7XG59XG4iXX0=