shield360 1.0.1 → 1.2.0

package/dist/rasp/__tests__/code-hook.test.js

@@ -0,0 +1,218 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vm = require("vm");
+const http = require("http");
+const hooks = __importStar(require("../hooks/code"));
+const detect = __importStar(require("../detect"));
+const engine_1 = require("../engine");
+const context_1 = require("../context");
+const types_1 = require("../types");
+const taint = (value, fn) => (0, context_1.runWithInputs)([{ value, key: 'query.q', source: 'request' }], fn, { inRequest: true });
+const mode = (value = 'block') => (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode: value, env: {} });
+beforeEach(() => { mode(); (0, engine_1.setEventSink)({ add: () => undefined }); });
+afterEach(() => {
+    hooks.uninstallCodeHooks();
+    jest.restoreAllMocks();
+    (0, engine_1.setEventSink)(undefined);
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'a', env: {} });
+});
+test('vm blocks before original and monitor evaluates harmless code', () => {
+    const original = jest.spyOn(vm, 'runInNewContext');
+    hooks.installCodeHooks();
+    expect(() => taint('1 + 2', () => vm.runInNewContext('1 + 2'))).toThrow(types_1.RaspBlockedError);
+    expect(original).not.toHaveBeenCalled();
+    mode('monitor');
+    const events = jest.fn();
+    (0, engine_1.setEventSink)({ add: events });
+    expect(taint('1 + 2', () => vm.runInNewContext('1 + 2'))).toBe(3);
+    expect(events).toHaveBeenCalledTimes(1);
+    expect(vm.runInNewContext('2 + 3')).toBe(5);
+});
+test('vm Script and Function preserve prototypes and constructor behavior', () => {
+    const descriptor = Object.getOwnPropertyDescriptor(globalThis, 'Function');
+    hooks.installCodeHooks();
+    expect(new vm.Script('1 + 2')).toBeInstanceOf(vm.Script);
+    expect(() => taint('1 + 2', () => new vm.Script('1 + 2'))).toThrow(types_1.RaspBlockedError);
+    const fn = new Function('a', 'return a + 1');
+    expect(fn).toBeInstanceOf(Function);
+    expect(fn(2)).toBe(3);
+    expect(Function('return 3')()).toBe(3);
+    expect(() => taint('return a + 1', () => new Function('a', 'return a + 1'))).toThrow(types_1.RaspBlockedError);
+    hooks.uninstallCodeHooks();
+    expect(Object.getOwnPropertyDescriptor(globalThis, 'Function')).toEqual(descriptor);
+});
+test('eval is left alone, so direct eval keeps the caller scope', () => {
+    const original = globalThis.eval;
+    hooks.installCodeHooks();
+    expect(globalThis.eval).toBe(original);
+    const local = 41;
+    // Direct eval: only possible while eval is the built-in itself.
+    expect(taint('local + 1', () => eval('local + 1'))).toBe(local + 1);
+});
+test('code run by vm is still checked when it builds code itself', () => {
+    hooks.installCodeHooks();
+    // The vm-run code is untainted; the Function call it makes carries the input.
+    const run = () => vm.runInNewContext('make(body)', { make: (b) => new Function(b), body: 'return a + 1' });
+    expect(() => taint('return a + 1', run)).toThrow(types_1.RaspBlockedError);
+});
+test('response write/end are added on ServerResponse only and removed again', () => {
+    const proto = http.ServerResponse.prototype;
+    expect(Object.prototype.hasOwnProperty.call(proto, 'end')).toBe(false);
+    hooks.installCodeHooks();
+    expect(Object.prototype.hasOwnProperty.call(proto, 'end')).toBe(true);
+    expect(Object.prototype.hasOwnProperty.call(http.ClientRequest.prototype, 'end')).toBe(false);
+    hooks.uninstallCodeHooks();
+    expect(Object.prototype.hasOwnProperty.call(proto, 'write')).toBe(false);
+    expect(Object.prototype.hasOwnProperty.call(proto, 'end')).toBe(false);
+});
+test('node-serialize and funcster are checked before harmless fake originals', () => {
+    const module = { unserialize: jest.fn((..._args) => 'result') };
+    const funcster = { deepDeserialize: jest.fn((..._args) => 'result') };
+    hooks.patchNodeSerialize(module);
+    hooks.patchFuncster(funcster);
+    const data = '{"fixture":"_$$ND_FUNC$$_description only"}';
+    expect(() => taint(data, () => module.unserialize(data))).toThrow(types_1.RaspBlockedError);
+    expect(module.unserialize).not.toHaveBeenCalled();
+    expect(taint('fixture', () => module.unserialize('fixture'))).toBe('result');
+    const object = { __js_function: 'description only' };
+    expect(() => taint(JSON.stringify(object), () => funcster.deepDeserialize(object))).toThrow(types_1.RaspBlockedError);
+});
+test.each(['3.14.0', '4.1.0'])('js-yaml %s checks unsafe schemas, including loadAll', version => {
+    const original = jest.fn((..._args) => 'result');
+    const module = { load: original, loadAll: original, DEFAULT_SCHEMA: {}, DEFAULT_FULL_SCHEMA: {}, CORE_SCHEMA: {}, JSON_SCHEMA: {}, FAILSAFE_SCHEMA: {} };
+    hooks.patchJsYaml(module, version);
+    const text = '!!js/function description-only';
+    const unsafe = version.startsWith('3') ? module.DEFAULT_FULL_SCHEMA : {};
+    expect(() => taint(text, () => module.load(text, { schema: unsafe }))).toThrow(types_1.RaspBlockedError);
+    expect(original).not.toHaveBeenCalled();
+    expect(() => taint(text, () => module.loadAll(text, () => undefined, { schema: unsafe }))).toThrow(types_1.RaspBlockedError);
+    expect(taint(text, () => module.load(text, { schema: module.CORE_SCHEMA }))).toBe('result');
+});
+test.each([hooks.patchLibxmljs, hooks.patchLibxmljs2])('XML resolving parser blocks before fake original', patch => {
+    const original = jest.fn((..._args) => 'result');
+    const module = { parseXml: original, parseXmlString: original };
+    patch(module);
+    const xml = '<!DOCTYPE fixture SYSTEM "file:///srv/app/fixtures/example.txt"><fixture/>';
+    expect(() => taint(xml, () => module.parseXml(xml, { noent: true }))).toThrow(types_1.RaspBlockedError);
+    expect(original).not.toHaveBeenCalled();
+    const detector = jest.spyOn(detect, 'detectXml').mockReturnValue(null);
+    expect(taint(xml, () => module.parseXmlString(xml, {}))).toBe('result');
+    expect(detector).toHaveBeenCalledWith(xml, expect.any(Array), false);
+});
+test('own registry patches under shimmer metadata and disables under a later wrapper', () => {
+    const original = jest.fn((..._args) => 'result');
+    const tracing = Object.assign((...args) => original(...args), { __wrapped: true, __unwrap: jest.fn() });
+    const module = { unserialize: tracing };
+    hooks.patchNodeSerialize(module);
+    const wrapper = module.unserialize;
+    hooks.patchNodeSerialize(module);
+    expect(module.unserialize).toBe(wrapper);
+    expect(wrapper.__wrapped).toBeUndefined();
+    const text = '_$$ND_FUNC$$_description only';
+    expect(() => taint(text, () => module.unserialize(text))).toThrow(types_1.RaspBlockedError);
+    module.unserialize = (...args) => wrapper(...args);
+    const outer = module.unserialize;
+    hooks.unpatchNodeSerialize(module);
+    expect(module.unserialize).toBe(outer);
+    expect(taint(text, () => module.unserialize(text))).toBe('result');
+});
+test('unpatch restores library identity', () => {
+    const original = (..._args) => 'result';
+    const module = { unserialize: original };
+    hooks.patchNodeSerialize(module);
+    hooks.unpatchNodeSerialize(module);
+    expect(module.unserialize).toBe(original);
+});
+test('install and uninstall preserve builtin descriptors exactly', () => {
+    const entries = [
+        ...['runInThisContext', 'runInNewContext', 'runInContext', 'compileFunction', 'Script'].map(key => ({ owner: vm, key })),
+        ...['Function', 'eval'].map(key => ({ owner: globalThis, key })),
+    ].map(entry => ({ ...entry, descriptor: Object.getOwnPropertyDescriptor(entry.owner, entry.key) }));
+    expect(hooks.installCodeHooks()).toBe(true);
+    const wrapper = vm.Script;
+    expect(hooks.installCodeHooks()).toBe(true);
+    expect(vm.Script).toBe(wrapper);
+    hooks.uninstallCodeHooks();
+    hooks.uninstallCodeHooks();
+    for (const { owner, key, descriptor } of entries)
+        expect(Object.getOwnPropertyDescriptor(owner, key)).toEqual(descriptor);
+});
+test.each(['html', 'plain', 'oversize'])('response %s arrives unchanged; XSS is monitor only', async (kind) => {
+    const input = '<script>alert(1)</script>xyz';
+    const body = kind === 'oversize' ? 'a'.repeat(1024 * 1024) + input : input;
+    const events = [];
+    (0, engine_1.setEventSink)({ add: (event) => { events.push(event); } });
+    const server = http.createServer((_req, res) => {
+        taint(input, () => {
+            res.setHeader('content-type', kind === 'plain' ? 'text/plain' : 'text/html');
+            res.write(body.slice(0, 10));
+        });
+        // The hook must use the first write's captured context here.
+        res.end(body.slice(10));
+    });
+    hooks.installCodeHooks();
+    await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+    try {
+        const received = await new Promise((resolve, reject) => {
+            http.get(`http://127.0.0.1:${server.address().port}/`, response => {
+                const chunks = [];
+                response.on('data', chunk => chunks.push(Buffer.from(chunk)));
+                response.on('end', () => resolve(Buffer.concat(chunks).toString()));
+                response.on('error', reject);
+            }).on('error', reject);
+        });
+        expect(received).toBe(body);
+        const reflected = events.filter(event => event.attrs['shield360.rasp.sink'] === 'http.response');
+        expect(reflected).toHaveLength(kind === 'html' ? 1 : 0);
+        if (kind === 'html')
+            expect(reflected[0].attrs['shield360.rasp.decision']).toBe('monitored');
+    }
+    finally {
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+});
+test('off skips evaluation checks and detector failures fail open', () => {
+    const detector = jest.spyOn(detect, 'detectCode');
+    hooks.installCodeHooks();
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'a', env: {} });
+    expect(taint('1 + 2', () => vm.runInNewContext('1 + 2'))).toBe(3);
+    expect(detector).not.toHaveBeenCalled();
+    mode();
+    detector.mockImplementation(() => { throw new Error('unavailable'); });
+    expect(taint('1 + 2', () => vm.runInNewContext('1 + 2'))).toBe(3);
+});
+//# sourceMappingURL=code-hook.test.js.map

package/dist/rasp/__tests__/code-hook.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-hook.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/code-hook.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yBAA0B;AAC1B,6BAA8B;AAE9B,qDAAuC;AACvC,kDAAoC;AACpC,sCAA0D;AAC1D,wCAA2C;AAC3C,oCAA4C;AAC5C,MAAM,KAAK,GAAG,CAAI,KAAa,EAAE,EAAW,EAAK,EAAE,CAAC,IAAA,uBAAa,EAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3I,MAAM,IAAI,GAAG,CAAC,QAA6B,OAAO,EAAE,EAAE,CAAC,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AACtI,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,CAAC,kBAAkB,EAAE,CAAC;IAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;IACvB,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACnD,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IAC1F,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;IACzB,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3E,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzB,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACrF,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACvG,KAAK,CAAC,kBAAkB,EAAE,CAAC;IAC3B,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;IACjC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,gEAAgE;IAChE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzB,8EAA8E;IAC9E,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACnH,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9F,KAAK,CAAC,kBAAkB,EAAE,CAAC;IAC3B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjF,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,6CAA6C,CAAC;IAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACpF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;AAChH,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,qDAAqD,EAAE,OAAO,CAAC,EAAE;IAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACzJ,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,gCAAgC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACjG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACrH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,kDAAkD,EAAE,KAAK,CAAC,EAAE;IACjH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;IAChE,KAAK,CAAC,MAAM,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,4EAA4E,CAAC;IACzF,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IAChG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,OAA0C,EAAE,CAAC;IAC3E,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC;IACnC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,CAAE,OAA8C,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;IAClF,MAAM,IAAI,GAAG,+BAA+B,CAAC;IAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACpF,MAAM,CAAC,WAAW,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;IACjC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAC7C,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC;IACnD,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACzC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACxH,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;KACjE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpG,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC;IAC1B,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,kBAAkB,EAAE,CAAC;IAC3B,KAAK,CAAC,kBAAkB,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC5H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,oDAAoD,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;IAC1G,MAAM,KAAK,GAAG,8BAA8B,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,KAAwC,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE;YAChB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC7E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,6DAA6D;QAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzB,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,IAAI,CAAC,GAAG,CAAC,oBAAqB,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,GAAG,EAAE,QAAQ,CAAC,EAAE;gBACjF,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACpE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,eAAe,CAAC,CAAC;QACjG,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/F,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,IAAI,EAAE,CAAC;IACP,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/config-client.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/config-client.test.js

@@ -0,0 +1,283 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Signed config client: verified only against a pinned key; the response's
+ * own keys are never trusted unless allowUnpinnedConfig (trust on first use);
+ * JWKS rotation; expiry; ETag; cache re-verification; the kill switch.
+ */
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const config_client_1 = require("../config-client");
+const engine_1 = require("../engine");
+const index_1 = require("../index");
+function keyPair(kid) {
+    const { publicKey, privateKey } = (0, crypto_1.generateKeyPairSync)('ed25519');
+    const jwk = publicKey.export({ format: 'jwk' });
+    return { kid, x: jwk.x, priv: privateKey, pem: publicKey.export({ format: 'pem', type: 'spki' }).toString() };
+}
+const b64 = (o) => Buffer.from(JSON.stringify(o)).toString('base64url');
+const NOW = 1800000000;
+function claims(over = {}) {
+    return { v: 1, app: 'orders-api', iat: NOW, exp: NOW + 3600, version: 'abc123', killSwitch: false, snippets: false, mode: 'monitor', attacks: {}, allow: { commands: [], outboundHosts: [], fileRoots: [] }, rules: null, ...over };
+}
+function jws(key, c, header = {}) {
+    const head = b64({ alg: 'EdDSA', typ: config_client_1.JWS_TYPE, kid: key.kid, ...header });
+    const body = b64(c);
+    return `${head}.${body}.${(0, crypto_1.sign)(null, Buffer.from(`${head}.${body}`), key.priv).toString('base64url')}`;
+}
+const jwkOf = (k) => ({ kty: 'OKP', crv: 'Ed25519', x: k.x, kid: k.kid });
+function fakeFetch(serve) {
+    const calls = [];
+    const impl = (async (url, init) => {
+        calls.push({ url, headers: (init?.headers || {}) });
+        const s = serve();
+        const status = s.status ?? 200;
+        return new Response(status === 304 ? null : JSON.stringify({ config: s.config, keys: s.keys ?? [] }), {
+            status,
+            headers: s.etag ? { ETag: s.etag } : {},
+        });
+    });
+    return { impl, calls };
+}
+describe('verifyConfigJws', () => {
+    const k1 = keyPair('k1');
+    const k2 = keyPair('k2');
+    const pinned = (0, config_client_1.parsePublicKeys)(jwkOf(k1));
+    it('accepts a config signed by the pinned key', () => {
+        const r = (0, config_client_1.verifyConfigJws)(jws(k1, claims()), pinned, 'orders-api', NOW);
+        expect(r.ok && r.claims.version).toBe('abc123');
+    });
+    it('refuses another key, whatever kid it names', () => {
+        expect((0, config_client_1.verifyConfigJws)(jws(k2, claims()), pinned, 'orders-api', NOW)).toEqual({ ok: false, reason: 'signature' });
+        expect((0, config_client_1.verifyConfigJws)(jws({ ...k2, kid: 'k1' }, claims()), pinned, 'orders-api', NOW)).toEqual({ ok: false, reason: 'signature' });
+    });
+    it('refuses a wrong typ, alg, app, version, or an expired config (60 s skew)', () => {
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims(), { typ: 'JWT' }), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'typ' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims(), { alg: 'none' }), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'alg' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims({ app: 'other' })), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'app' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims({ v: 2 })), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'version' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims({ exp: NOW - 61 })), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'expired' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims({ exp: NOW - 30 })), pinned, 'orders-api', NOW).ok).toBe(true);
+    });
+    it('refuses a tampered payload', () => {
+        const [h, , s] = jws(k1, claims()).split('.');
+        expect((0, config_client_1.verifyConfigJws)(`${h}.${b64(claims({ killSwitch: true }))}.${s}`, pinned, 'orders-api', NOW)).toMatchObject({ reason: 'signature' });
+    });
+    it('JWKS rotation: either pinned kid verifies; an unpinned kid does not', () => {
+        const k3 = keyPair('k3');
+        const jwks = (0, config_client_1.parsePublicKeys)(JSON.stringify({ keys: [jwkOf(k1), jwkOf(k2)] }));
+        expect(jwks).toHaveLength(2);
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims()), jwks, 'orders-api', NOW).ok).toBe(true);
+        expect((0, config_client_1.verifyConfigJws)(jws(k2, claims()), jwks, 'orders-api', NOW).ok).toBe(true);
+        expect((0, config_client_1.verifyConfigJws)(jws(k3, claims()), jwks, 'orders-api', NOW).ok).toBe(false);
+    });
+    it('parses the pinned key as a JWK, a JWKS, or the bare base64url x; refuses anything else', () => {
+        expect((0, config_client_1.parsePublicKeys)(k1.x)).toHaveLength(1);
+        expect((0, config_client_1.parsePublicKeys)(JSON.stringify(jwkOf(k1)))[0].kid).toBe('k1');
+        expect((0, config_client_1.parsePublicKeys)({ keys: [jwkOf(k1)] })[0].x).toBe(k1.x);
+        expect((0, config_client_1.parsePublicKeys)(k1.pem)).toEqual([]);
+        expect((0, config_client_1.parsePublicKeys)('not-a-key')).toEqual([]);
+        expect((0, config_client_1.parsePublicKeys)({ kty: 'RSA', crv: 'x', x: k1.x })).toEqual([]);
+        // A bare key (no kid) verifies whatever kid the header names; so does a JWKS when the header's kid is not listed.
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims()), (0, config_client_1.parsePublicKeys)(k1.x), 'orders-api', NOW).ok).toBe(true);
+        expect((0, config_client_1.verifyConfigJws)(jws({ ...k1, kid: 'unlisted' }, claims()), (0, config_client_1.parsePublicKeys)({ keys: [jwkOf(k2), jwkOf(k1)] }), 'orders-api', NOW).ok).toBe(true);
+    });
+});
+describe('RaspConfigClient', () => {
+    const k1 = keyPair('k1');
+    const k2 = keyPair('k2');
+    let dir;
+    let applied;
+    let warnings;
+    let now;
+    beforeEach(() => {
+        dir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'rasp-config-'));
+        applied = [];
+        warnings = [];
+        now = NOW * 1000;
+    });
+    afterEach(() => (0, fs_1.rmSync)(dir, { recursive: true, force: true }));
+    const client = (serve, over = {}) => {
+        const f = fakeFetch(serve);
+        const c = new config_client_1.RaspConfigClient({
+            url: 'https://shield.example.com/',
+            apiKey: 'test-api-key',
+            app: 'orders-api',
+            pinned: (0, config_client_1.parsePublicKeys)(jwkOf(k1)),
+            cacheDir: dir,
+            onConfig: (x) => applied.push(x),
+            onWarning: (w) => warnings.push(w),
+            fetchImpl: f.impl,
+            now: () => now,
+            ...over,
+        });
+        return { c, calls: f.calls };
+    };
+    it('pinned: fetches with the API key and applies a verified config', async () => {
+        const { c, calls } = client(() => ({ config: jws(k1, claims()), keys: [jwkOf(k1)], etag: '"e1"' }));
+        expect(await c.poll()).toBe('updated');
+        expect(calls[0].url).toBe('https://shield.example.com/api/rasp/config?app=orders-api');
+        expect(calls[0].headers.Authorization).toBe('Bearer test-api-key');
+        expect(applied[0]?.version).toBe('abc123');
+    });
+    it('a poll still in flight when the client stops applies and caches nothing', async () => {
+        let release;
+        const gate = new Promise((r) => (release = r));
+        const f = fakeFetch(() => ({ config: jws(k1, claims({ killSwitch: true })), keys: [jwkOf(k1)] }));
+        const { c } = client(() => ({}), {
+            fetchImpl: (async (url, init) => {
+                await gate;
+                return f.impl(url, init);
+            }),
+        });
+        const pending = c.poll();
+        // RASP re-initialized (another app or key) while the request was out.
+        c.stop();
+        release();
+        await pending;
+        expect(applied).toEqual([]);
+        expect((0, fs_1.readdirSync)(dir)).toEqual([]);
+    });
+    it("pinned: the response's own key is not trusted", async () => {
+        const { c } = client(() => ({ config: jws(k2, claims()), keys: [jwkOf(k2)] }));
+        expect(await c.poll()).toBe('rejected');
+        expect(applied).toEqual([]);
+        expect(warnings).toEqual(['signature']);
+    });
+    it('unpinned: refused without fetching; nothing applied', async () => {
+        const { c, calls } = client(() => ({ config: jws(k1, claims()), keys: [jwkOf(k1)] }), { pinned: [] });
+        expect(await c.poll()).toBe('rejected');
+        expect(calls).toHaveLength(0);
+        expect(applied).toEqual([]);
+        expect(warnings).toEqual(['unpinned']);
+    });
+    it('allowUnpinnedConfig: trusts the first key, then refuses a different one', async () => {
+        let key = k1;
+        const { c } = client(() => ({ config: jws(key, claims()), keys: [jwkOf(key)] }), { pinned: [], allowUnpinned: true });
+        expect(await c.poll()).toBe('updated');
+        expect(warnings).toContain('trust_on_first_use');
+        key = k2;
+        expect(await c.poll()).toBe('rejected');
+    });
+    it('ETag: sends If-None-Match and keeps the config on 304', async () => {
+        let status = 200;
+        const { c, calls } = client(() => ({ status, config: jws(k1, claims()), etag: '"e1"' }));
+        await c.poll();
+        status = 304;
+        expect(await c.poll()).toBe('unchanged');
+        expect(calls[1].headers['If-None-Match']).toBe('"e1"');
+        expect(c.current?.version).toBe('abc123');
+    });
+    it('expiry: an expired config is refused; the one in force is dropped once it expires', async () => {
+        const { c: stale } = client(() => ({ config: jws(k1, claims({ exp: NOW - 3600 })) }));
+        expect(await stale.poll()).toBe('rejected');
+        let up = true;
+        const { c } = client(() => (up ? { config: jws(k1, claims({ exp: NOW + 120 })) } : { status: 503 }));
+        await c.poll();
+        up = false;
+        now += 600000;
+        expect(await c.poll()).toBe('failed');
+        expect(applied[applied.length - 1]).toBeUndefined();
+        expect(c.current).toBeUndefined();
+    });
+    it('failures back off to 5 minutes; success polls about every minute', () => {
+        const { c } = client(() => ({}), { random: () => 1 });
+        expect(c.nextDelay('failed')).toBe(config_client_1.BACKOFF_MS);
+        expect(c.nextDelay('rejected')).toBe(config_client_1.BACKOFF_MS);
+        expect(c.nextDelay('updated')).toBe(70000);
+    });
+    it('cache: the last verified config is re-verified on load; a tampered cache is refused', async () => {
+        const { c } = client(() => ({ config: jws(k1, claims({ version: 'cached' })) }));
+        await c.poll();
+        const { c: fresh } = client(() => ({ status: 503 }));
+        expect(fresh.loadCache()).toBe(true);
+        expect(fresh.current?.version).toBe('cached');
+        (0, fs_1.writeFileSync)(fresh.cacheFile(), JSON.stringify({ config: jws(k2, claims({ version: 'forged' })), tofu: [jwkOf(k2)] }));
+        const { c: other } = client(() => ({ status: 503 }));
+        expect(other.loadCache()).toBe(false);
+        expect(other.current).toBeUndefined();
+    });
+    it('never throws on a network error or a malformed body', async () => {
+        const boom = new config_client_1.RaspConfigClient({
+            url: 'https://shield.example.com',
+            apiKey: 'k',
+            app: 'orders-api',
+            pinned: (0, config_client_1.parsePublicKeys)(jwkOf(k1)),
+            cacheDir: dir,
+            onConfig: () => undefined,
+            fetchImpl: (async () => {
+                throw new Error('offline');
+            }),
+        });
+        expect(await boom.poll()).toBe('failed');
+        const { c } = client(() => ({ config: 'not.a.jws' }));
+        expect(await c.poll()).toBe('rejected');
+    });
+});
+describe('initRasp and the signed config', () => {
+    const k1 = keyPair('k1');
+    let warn;
+    beforeEach(() => {
+        warn = jest.spyOn(console, 'warn').mockImplementation(() => undefined);
+    });
+    afterEach(async () => {
+        warn.mockRestore();
+        await (0, index_1.shutdownRasp)();
+        (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+    });
+    it('without a pin: no config fetch, built-in defaults in monitor mode, one log line per process, no reported event', async () => {
+        (0, index_1.resetRaspWarnings)();
+        const urls = [];
+        const fetchImpl = (async (url) => {
+            urls.push(String(url));
+            return new Response('{}', { status: 200 });
+        });
+        const ctx = { applicationName: 'orders-api', url: 'https://shield.example.com', apiKey: 'k', env: {}, fetchImpl };
+        expect((0, index_1.initRasp)({ enabled: true, mode: 'block', attacks: { ssrf: 'off' }, components: false }, ctx)).toBe(true);
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('monitor');
+        expect((0, engine_1.modeFor)('ssrf')).toBe('off');
+        (0, index_1.initRasp)({ enabled: true, components: false }, ctx);
+        await (0, index_1.shutdownRasp)();
+        expect(urls.filter((u) => u.includes('/api/rasp/config'))).toEqual([]);
+        expect(urls.filter((u) => u.includes('/api/guard/events'))).toEqual([]);
+        expect(warn).toHaveBeenCalledTimes(1);
+        expect(String(warn.mock.calls[0][0])).toContain('configPublicKey');
+    });
+    it('trust on first use: only with the opt-in, never in production', async () => {
+        expect((0, index_1.tofuAllowed)(true, {})).toBe(true);
+        expect((0, index_1.tofuAllowed)(undefined, { SHIELD360_CONFIG_TOFU: 'dev' })).toBe(true);
+        expect((0, index_1.tofuAllowed)(undefined, {})).toBe(false);
+        expect((0, index_1.tofuAllowed)(true, { NODE_ENV: 'production' })).toBe(false);
+        expect((0, index_1.tofuAllowed)(undefined, { SHIELD360_CONFIG_TOFU: 'dev', ENVIRONMENT: 'production' })).toBe(false);
+        (0, index_1.resetRaspWarnings)();
+        const fetchImpl = (async () => new Response('{}', { status: 503 }));
+        (0, index_1.initRasp)({ enabled: true, mode: 'block', allowUnpinnedConfig: true, components: false }, { applicationName: 'a', url: 'https://s.example.com', apiKey: 'k', env: { NODE_ENV: 'production' }, fetchImpl });
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('monitor');
+        const dir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'rasp-tofu-'));
+        (0, index_1.initRasp)({ enabled: true, mode: 'block', components: false, cacheDir: dir }, { applicationName: 'a', url: 'https://s.example.com', apiKey: 'k', env: { SHIELD360_CONFIG_TOFU: 'dev' }, fetchImpl });
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('block');
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    });
+    it('with a pin from SHIELD360_CONFIG_PUBLIC_KEY: the signed kill switch turns checks off', async () => {
+        const fetchImpl = (async (url) => String(url).includes('/api/rasp/config')
+            ? new Response(JSON.stringify({ config: jws(k1, claims({ exp: Math.floor(Date.now() / 1000) + 600, killSwitch: true })) }), { status: 200 })
+            : new Response('{}'));
+        const cacheDir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'rasp-init-'));
+        (0, index_1.initRasp)({ enabled: true, components: false, cacheDir }, { applicationName: 'orders-api', url: 'https://shield.example.com', apiKey: 'k', env: { SHIELD360_CONFIG_PUBLIC_KEY: JSON.stringify({ keys: [jwkOf(k1)] }) }, fetchImpl });
+        expect((0, engine_1.isActive)()).toBe(true);
+        await new Promise((r) => setTimeout(r, 50));
+        expect((0, engine_1.isActive)()).toBe(false);
+        (0, fs_1.rmSync)(cacheDir, { recursive: true, force: true });
+    });
+    it('SHIELD360_RASP=off wins over enabled: true; no URL means local options only', () => {
+        expect((0, index_1.initRasp)({ enabled: true }, { applicationName: 'a', env: { SHIELD360_RASP: 'off' } })).toBe(false);
+        expect((0, index_1.initRasp)({ enabled: true, mode: 'block' }, { applicationName: 'a', env: {} })).toBe(true);
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('block');
+        expect((0, index_1.initRasp)(undefined, { applicationName: 'a', env: { SHIELD360_RASP: 'monitor' } })).toBe(true);
+        expect((0, index_1.initRasp)(undefined, { applicationName: 'a', env: {} })).toBe(false);
+        (0, engine_1.setRemoteConfig)(undefined);
+    });
+});
+//# sourceMappingURL=config-client.test.js.map

package/dist/rasp/__tests__/config-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-client.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/config-client.test.ts"],"names":[],"mappings":";;AAAA;;;;GAIG;AACH,mCAAmE;AACnE,2BAAqE;AACrE,2BAA4B;AAC5B,+BAA4B;AAC5B,oDAA6H;AAC7H,sCAAgF;AAChF,oCAAkF;AAIlF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,4BAAmB,EAAC,SAAS,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAkB,CAAC;IACjE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjF,MAAM,GAAG,GAAG,UAAa,CAAC;AAE1B,SAAS,MAAM,CAAC,OAA4B,EAAE;IAC5C,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AACtO,CAAC;AAED,SAAS,GAAG,CAAC,GAAS,EAAE,CAAa,EAAE,SAAkC,EAAE;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,wBAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,IAAA,aAAI,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAIhF,SAAS,SAAS,CAAC,KAAmB;IACpC,MAAM,KAAK,GAAuD,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,IAAkB,EAAE,EAAE;QACtD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAA2B,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;QAC/B,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE;YACpG,MAAM;YACN,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SACxC,CAAC,CAAC;IACL,CAAC,CAA4B,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAA,+BAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1C,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAClH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACtI,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACxH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5H,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,CAAC,EAAE,AAAD,EAAG,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9I,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,IAAA,+BAAe,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,CAAC,IAAA,+BAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAA,+BAAe,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,IAAA,+BAAe,EAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAA,+BAAe,EAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAA,+BAAe,EAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,IAAA,+BAAe,EAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,kHAAkH;QAClH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAA,+BAAe,EAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnG,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAA,+BAAe,EAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,GAAW,CAAC;IAChB,IAAI,OAAmC,CAAC;IACxC,IAAI,QAAkB,CAAC;IACvB,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QAClD,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,EAAE,CAAC;QACd,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE,CAAC,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,OAAmE,EAAE,EAAE,EAAE;QAC5G,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAI,gCAAgB,CAAC;YAC7B,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,cAAc;YACtB,GAAG,EAAE,YAAY;YACjB,MAAM,EAAE,IAAA,+BAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,GAAG;YACb,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAChC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,IAAI;YACjB,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG;YACd,GAAG,IAAI;SACR,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACpG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,IAAI,OAAoB,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;YAC/B,SAAS,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,IAAkB,EAAE,EAAE;gBACpD,MAAM,IAAI,CAAC;gBACX,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC,CAA4B;SAC9B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,sEAAsE;QACtE,CAAC,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,MAAM,OAAO,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAA,gBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACjD,GAAG,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,IAAI,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACrG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,EAAE,GAAG,KAAK,CAAC;QACX,GAAG,IAAI,MAAO,CAAC;QACf,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,0BAAU,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,0BAAU,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAA,kBAAa,EAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxH,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,IAAI,gCAAgB,CAAC;YAChC,GAAG,EAAE,4BAA4B;YACjC,MAAM,EAAE,GAAG;YACX,GAAG,EAAE,YAAY;YACjB,MAAM,EAAE,IAAA,+BAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,GAAG;YACb,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;YACzB,SAAS,EAAE,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC,CAA4B;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,IAAsB,CAAC;IAC3B,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,IAAA,oBAAY,GAAE,CAAC;QACrB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gHAAgH,EAAE,KAAK,IAAI,EAAE;QAC9H,IAAA,yBAAiB,GAAE,CAAC;QACpB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC,CAA4B,CAAC;QAC9B,MAAM,GAAG,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;QAClH,MAAM,CAAC,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,CAAC,IAAA,gBAAO,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,IAAA,oBAAY,GAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,CAAC,IAAA,mBAAW,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,IAAA,mBAAW,EAAC,SAAS,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAA,mBAAW,EAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAA,mBAAW,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,IAAA,mBAAW,EAAC,SAAS,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAExG,IAAA,yBAAiB,GAAE,CAAC;QACpB,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;QAC/F,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1M,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpM,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CACvC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACtC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC5I,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAA4B,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3D,IAAA,gBAAQ,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAC9C,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,CAC1K,CAAC;QACF,MAAM,CAAC,IAAA,iBAAQ,GAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAA,iBAAQ,GAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAA,WAAM,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1G,MAAM,CAAC,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjG,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAA,gBAAQ,EAAC,SAAS,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrG,MAAM,CAAC,IAAA,gBAAQ,EAAC,SAAS,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/corpus.d.ts

@@ -0,0 +1,13 @@
+import type { Finding, RaspInput } from '../types';
+import { type VirtualPatch, type VpRequest } from '../vpatch';
+export declare const RASP_DIR: string;
+export declare const loadJson: (rel: string) => any;
+export declare const SECTIONS: readonly ["sql", "nosql", "command", "path", "ssrf", "code", "template", "xml", "deser", "xss", "requests"];
+export type Section = (typeof SECTIONS)[number];
+export declare function normalise(raw: RaspInput[] | undefined): RaspInput[];
+/** Node versions the request cases run under: this one, and one inside each runtimeVersions range. */
+export declare function nodeVersions(): string[];
+/** Runs one case; returns the first finding (null = nothing fired). */
+export declare function runCase(section: Section, c: any): Finding | null;
+/** A request that satisfies a rule's clauses, built from the rule itself. */
+export declare function requestFor(rule: VirtualPatch): VpRequest;