sliftutils 1.7.128 → 1.7.130

package/security/machines/dist/machines.ts.cache

@@ -0,0 +1,264 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.isMachineAccepted = exports.setMachines = exports.getMachines = exports.MACHINES_DIR = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const keysRepo_1 = require("../authorizedKeys/keysRepo");
+const repoFiles_1 = require("../authorizedKeys/daemon/repoFiles");
+const repoFiles_2 = require("../authorizedKeys/daemon/repoFiles");
+const revocation_1 = require("../authorizedKeys/daemon/revocation");
+const git_1 = require("../authorizedKeys/daemon/git");
+const repoFiles_3 = require("../authorizedKeys/daemon/repoFiles");
+const trust_1 = require("../authorizedKeys/daemon/trust");
+const revokeSource_1 = require("../authorizedKeys/revokeSource");
+const notify_1 = require("../authorizedKeys/daemon/notify");
+const discord_1 = require("../notifications/discord");
+// Which machines this system talks to, kept in the same repo as the ssh keys. That repo is already
+// signed, already distributed to every machine, and already has somewhere to record a rejection,
+// so a second one would only be a second thing to keep in step.
+exports.MACHINES_DIR = "machines";
+const REVOCATIONS_DIR = "revocations";
+const REVOCATION_REASON = "a machine talked to us from an unapproved IP";
+// The revoke repo is pulled at most this often. A check happens per request, and a request must
+// not cost a round trip to github.
+const REVOKE_SYNC_INTERVAL = 60 * 1000;
+async function pathExists(filePath) {
+    try {
+        await promises_1.default.access(filePath);
+        return true;
+    }
+    catch (e) {
+        return false;
+    }
+}
+function machineFilePath(repoPath, machineId) {
+    return path_1.default.join(repoPath, exports.MACHINES_DIR, `${machineId}.json`);
+}
+/** Every machine a checkout lists. */
+async function getMachines(repoPath) {
+    return [...(await readMachines(repoPath)).values()];
+}
+exports.getMachines = getMachines;
+/** Makes a checkout list exactly these machines: those named are written with the addresses given,
+    and anything not named is removed. So read them, change what you want, and write the result.
+
+    The addresses are part of setting rather than a separate step, because a machine with no
+    address it may talk from is not a machine that would ever be accepted - there is no state where
+    naming one without them means anything.
+
+    Nothing here signs or commits. The signature is what every other machine checks before
+    believing any of this, and it takes the hardware key, so `yarn signfiles git` is still yours to
+    run afterwards. */
+async function setMachines(config) {
+    var _a;
+    let { repoPath, machines } = config;
+    let existing = await readMachines(repoPath);
+    let directory = path_1.default.join(repoPath, exports.MACHINES_DIR);
+    let written = [];
+    for (let machine of machines) {
+        if (!machine.machineId) {
+            throw new Error(`Expected a machineId, was ${JSON.stringify(machine.machineId)}`);
+        }
+        if (!machine.ips.length) {
+            throw new Error(`Expected addresses for ${machine.machineId}, was none. A machine is trusted from`
+                + ` the addresses it may talk from, so leave it out of the list to remove it.`);
+        }
+        let ips = machine.ips.filter((ip, index) => ip && machine.ips.indexOf(ip) === index);
+        let state = {
+            machineId: machine.machineId,
+            // In the order given, without duplicates, so the file reads the way it was set.
+            ips,
+            addedAt: ((_a = existing.get(machine.machineId)) === null || _a === void 0 ? void 0 : _a.addedAt) || new Date().toISOString(),
+        };
+        await promises_1.default.mkdir(directory, { recursive: true });
+        await promises_1.default.writeFile(machineFilePath(repoPath, state.machineId), JSON.stringify(state, undefined, 4) + "\n");
+        written.push(state);
+    }
+    // Whatever the repo had and the caller did not name is no longer trusted.
+    for (let machineId of existing.keys()) {
+        if (!machines.some(machine => machine.machineId === machineId)) {
+            await promises_1.default.rm(machineFilePath(repoPath, machineId), { force: true });
+        }
+    }
+    return written;
+}
+exports.setMachines = setMachines;
+/** Every machine the repo lists. */
+async function readMachines(repoPath) {
+    let machines = new Map();
+    let directory = path_1.default.join(repoPath, exports.MACHINES_DIR);
+    let names = await promises_1.default.readdir(directory).catch(() => []);
+    for (let name of names.sort()) {
+        if (!name.endsWith(".json")) {
+            continue;
+        }
+        try {
+            let parsed = JSON.parse(await promises_1.default.readFile(path_1.default.join(directory, name), "utf8"));
+            let machineId = parsed.machineId || name.replace(/\.json$/, "");
+            machines.set(machineId, { machineId, ips: parsed.ips || [], addedAt: parsed.addedAt || "" });
+        }
+        catch (e) {
+            console.log(`Ignoring unreadable machine file ${name}. ${e}`);
+        }
+    }
+    return machines;
+}
+let lastRevokeSync = 0;
+/** Pulled at most once a REVOKE_SYNC_INTERVAL, because this is asked per request. A sync that
+    fails leaves the checkout we already have, which is the safe direction: revocations we know
+    about stay known. */
+async function syncRevocations(sourceURL) {
+    if (Date.now() - lastRevokeSync < REVOKE_SYNC_INTERVAL) {
+        return;
+    }
+    lastRevokeSync = Date.now();
+    try {
+        await (0, repoFiles_1.syncRepoFiles)((0, repoFiles_1.revokeRepo)(sourceURL));
+    }
+    catch (e) {
+        console.log(`Could not read ${(0, revokeSource_1.revokeRepoURL)(sourceURL)}, using the revocations already here. ${e}`);
+    }
+}
+/** Machine revocations, read out of the revoke repo the same way key revocations are. */
+async function readMachineRevocations(sourceURL) {
+    let repo = (0, repoFiles_1.revokeRepo)(sourceURL);
+    let revocations = [];
+    for (let name of await (0, repoFiles_2.listRepoDir)(repo, REVOCATIONS_DIR)) {
+        if (!name.endsWith(".json")) {
+            continue;
+        }
+        try {
+            let parsed = JSON.parse(await (0, repoFiles_2.readRepoFile)(repo, path_1.default.join(REVOCATIONS_DIR, name)) || "");
+            if (parsed.machineId) {
+                revocations.push({
+                    revocationId: parsed.revocationId || name.replace(/\.json$/, ""),
+                    machineId: parsed.machineId,
+                    ip: parsed.ip || "",
+                });
+            }
+        }
+        catch (e) {
+            console.log(`Ignoring unreadable revocation ${name}. ${e}`);
+        }
+    }
+    return revocations;
+}
+/** Sends the one notification this file is allowed to send, when it can.
+
+    The daemon configures notifications on startup and would simply send. This can also run in some
+    other process, which has not, so the webhook is picked up here if it is readable. A machine
+    with no webhook set up still records the revocation - being unable to tell anyone is not a
+    reason to keep accepting a machine that is being misused. */
+async function notifyBestEffort(headline, body) {
+    try {
+        if (!(0, discord_1.areDiscordNotificationsConfigured)()) {
+            // Read first: configureDiscordNotifications exits the process when the file is missing,
+            // which is right for the daemon at startup and wrong for a library call.
+            await promises_1.default.readFile(discord_1.DEFAULT_WEBHOOK_FILE_PATH, "utf8");
+            await (0, discord_1.configureDiscordNotifications)({ filePath: discord_1.DEFAULT_WEBHOOK_FILE_PATH });
+        }
+        await (0, notify_1.notify)(headline, body);
+    }
+    catch (e) {
+        console.log(`Could not send a notification about this, it is only in the log. ${e}`);
+    }
+}
+/** Records that a machine we accept talked to us from an address it is not allowed from. One per
+    machine and address, so a second address is a second revocation and an unrevoke of the first
+    does not cover it. */
+async function recordMachineRevocation(config) {
+    let { sourceURL, machineId, ip, hostLabel } = config;
+    let repoPath = (0, revokeSource_1.revokeRepoPath)(sourceURL);
+    let keyPath = await (0, repoFiles_3.ensureRevokeKey)(sourceURL);
+    let revocationId = (0, revocation_1.newRevocationId)(machineId);
+    let directory = path_1.default.join(repoPath, REVOCATIONS_DIR);
+    await promises_1.default.mkdir(directory, { recursive: true });
+    await promises_1.default.writeFile(path_1.default.join(directory, `${revocationId}.json`), JSON.stringify({
+        revocationId,
+        machineId,
+        ip,
+        revokedAt: new Date().toISOString(),
+        revokedBy: hostLabel,
+        reason: REVOCATION_REASON,
+    }, undefined, 4) + "\n");
+    await (0, git_1.runGit)({ args: ["add", "-A"], cwd: repoPath, keyPath });
+    await (0, git_1.runGit)({
+        args: ["-c", "user.email=portsecure@localhost", "-c", "user.name=portsecure", "commit", "-m", `revoke ${revocationId}`],
+        cwd: repoPath, keyPath,
+    });
+    let push = await (0, git_1.runGit)({ args: ["push", "origin", "HEAD"], cwd: repoPath, keyPath, allowFailure: true });
+    if (push.status !== 0) {
+        // Another machine most likely recorded the same thing first, and the next read picks it up.
+        console.log(`Could not push the revocation of ${machineId} from ${ip}. ${(push.stdout + push.stderr).trim()}`);
+        return;
+    }
+    console.log(`Revoked ${machineId} from ${ip}, ${revocationId}`);
+    // Said by whoever wrote the revocation, once, the same as for an ssh key. Machines that only
+    // read it later say nothing, or one event would be reported by every machine that saw it.
+    await notifyBestEffort(`SUSPICIOUS IP ${ip} FROZE MACHINE ${machineId}`, `A machine we trust talked to us from ${ip}, which is not an address it is allowed to talk`
+        + ` from. It proved it holds that machine's key, so either someone else has a copy of it,`
+        + ` or that machine's address changed.`
+        + `\n\nIt is frozen everywhere now, and nothing accepts it.`
+        + `\n\nIf this was an attack, remove \`machines/${machineId}.json\` from \`${sourceURL}\` now.`
+        + `\nIf it was legitimate, run \`yarn unrevoke git\` in that repo. It allows ${ip} for that`
+        + ` machine, and takes effect as each machine picks it up.`
+        + `\n\nmachine: \`${machineId}\``
+        + `\nfrozen by: \`${hostLabel}\``);
+}
+async function isMachineAccepted(config) {
+    let { machineId, ip } = config;
+    if (!machineId || !ip) {
+        throw new Error(`Expected a machineId and an ip, was ${JSON.stringify(machineId)} and ${JSON.stringify(ip)}`);
+    }
+    let { repoPath, sourceURL } = await (0, keysRepo_1.resolveKeysRepo)();
+    // Unsigned, or signed over different contents, means the machine list is not evidence of
+    // anything. Same gate the ssh keys go through.
+    await (0, trust_1.verifyCheckout)(repoPath);
+    let machine = (await readMachines(repoPath)).get(machineId);
+    if (!machine) {
+        return { accepted: false, reason: "that machine is not trusted" };
+    }
+    await syncRevocations(sourceURL);
+    let unrevokes = await (0, revocation_1.readUnrevokes)(sourceURL).catch(() => ({ pairs: new Map(), legacyIds: new Map() }));
+    // An unrevoke counts as soon as it is seen. It is signed, so writing one already takes the
+    // hardware key, and anyone holding that can sign anything at all - a wait before honouring it
+    // guards against an attacker who has no need of it.
+    let allowedAgain = (pair) => { var _a; return !!((_a = unrevokes.pairs.get(pair)) === null || _a === void 0 ? void 0 : _a.length); };
+    let revocations = await readMachineRevocations(sourceURL);
+    // Any revocation nothing has undone keeps the machine out, from everywhere, the way a revoked
+    // ssh key is out everywhere rather than only from the address it was misused from.
+    let frozenFrom = "";
+    for (let revocation of revocations) {
+        if (revocation.machineId !== machineId) {
+            continue;
+        }
+        if (!allowedAgain((0, revocation_1.pairKey)({ fingerprint: revocation.machineId, ip: revocation.ip }))) {
+            frozenFrom = revocation.ip;
+        }
+    }
+    if (frozenFrom) {
+        return {
+            accepted: false,
+            reason: `that machine is frozen, it was used from ${frozenFrom} which it is not allowed from`,
+        };
+    }
+    if (machine.ips.includes(ip)) {
+        return { accepted: true, reason: "" };
+    }
+    // Listed, but talking to us from somewhere it should not be. Recorded once for this machine
+    // and address, so being talked to repeatedly does not write repeatedly.
+    let pair = (0, revocation_1.pairKey)({ fingerprint: machineId, ip });
+    let alreadyRecorded = revocations.some(revocation => (0, revocation_1.pairKey)({ fingerprint: revocation.machineId, ip: revocation.ip }) === pair);
+    if (!alreadyRecorded && !allowedAgain(pair)) {
+        await recordMachineRevocation({ sourceURL, machineId, ip, hostLabel: os_1.default.hostname() });
+        return { accepted: false, reason: `that machine is not allowed from ${ip}, so it is now frozen everywhere` };
+    }
+    return { accepted: false, reason: `that machine is not allowed from ${ip}` };
+}
+exports.isMachineAccepted = isMachineAccepted;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFjaGluZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJtYWNoaW5lcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSwyREFBNkI7QUFDN0IsNENBQW9CO0FBQ3BCLGdEQUF3QjtBQUN4Qix5REFBNkQ7QUFDN0Qsa0VBQStFO0FBQy9FLGtFQUErRTtBQUMvRSxvRUFBbUg7QUFDbkgsc0RBQXNEO0FBQ3RELGtFQUFxRTtBQUNyRSwwREFBZ0U7QUFDaEUsaUVBQStFO0FBQy9FLDREQUF5RDtBQUN6RCxzREFBdUk7QUFHdkksbUdBQW1HO0FBQ25HLGlHQUFpRztBQUNqRyxnRUFBZ0U7QUFDbkQsUUFBQSxZQUFZLEdBQUcsVUFBVSxDQUFDO0FBQ3ZDLE1BQU0sZUFBZSxHQUFHLGFBQWEsQ0FBQztBQUN0QyxNQUFNLGlCQUFpQixHQUFHLDhDQUE4QyxDQUFDO0FBQ3pFLGdHQUFnRztBQUNoRyxtQ0FBbUM7QUFDbkMsTUFBTSxvQkFBb0IsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDO0FBU3ZDLEtBQUssVUFBVSxVQUFVLENBQUMsUUFBZ0I7SUFDdEMsSUFBSSxDQUFDO1FBQ0QsTUFBTSxrQkFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMxQixPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDTCxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsUUFBZ0IsRUFBRSxTQUFpQjtJQUN4RCxPQUFPLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLG9CQUFZLEVBQUUsR0FBRyxTQUFTLE9BQU8sQ0FBQyxDQUFDO0FBQ2xFLENBQUM7QUFFRCxzQ0FBc0M7QUFDL0IsS0FBSyxVQUFVLFdBQVcsQ0FBQyxRQUFnQjtJQUM5QyxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUN4RCxDQUFDO0FBRkQsa0NBRUM7QUFFRDs7Ozs7Ozs7O3NCQVNzQjtBQUNmLEtBQUssVUFBVSxXQUFXLENBQUMsTUFHakM7O0lBQ0csSUFBSSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDcEMsSUFBSSxRQUFRLEdBQUcsTUFBTSxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDNUMsSUFBSSxTQUFTLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsb0JBQVksQ0FBQyxDQUFDO0lBQ2xELElBQUksT0FBTyxHQUFtQixFQUFFLENBQUM7SUFDakMsS0FBSyxJQUFJLE9BQU8sSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUMzQixJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDdEIsTUFBTSxJQUFJLEtBQUssQ0FDWCwwQkFBMEIsT0FBTyxDQUFDLFNBQVMsdUNBQXVDO2tCQUNoRiw0RUFBNEUsQ0FDakYsQ0FBQztRQUNOLENBQUM7UUFDRCxJQUFJLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLEVBQUUsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxLQUFLLENBQUMsQ0FBQztRQUNyRixJQUFJLEtBQUssR0FBaUI7WUFDdEIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQzVCLGdGQUFnRjtZQUNoRixHQUFHO1lBQ0gsT0FBTyxFQUFFLENBQUEsTUFBQSxRQUFRLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsMENBQUUsT0FBTyxLQUFJLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFO1NBQ2hGLENBQUM7UUFDRixNQUFNLGtCQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLE1BQU0sa0JBQUUsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDO1FBQzNHLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEIsQ0FBQztJQUVELDBFQUEwRTtJQUMxRSxLQUFLLElBQUksU0FBUyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1FBQ3BDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQzdELE1BQU0sa0JBQUUsQ0FBQyxFQUFFLENBQUMsZUFBZSxDQUFDLFFBQVEsRUFBRSxTQUFTLENBQUMsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7SUFDTCxDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUM7QUFDbkIsQ0FBQztBQXJDRCxrQ0FxQ0M7QUFFRCxvQ0FBb0M7QUFDcEMsS0FBSyxVQUFVLFlBQVksQ0FBQyxRQUFnQjtJQUN4QyxJQUFJLFFBQVEsR0FBRyxJQUFJLEdBQUcsRUFBd0IsQ0FBQztJQUMvQyxJQUFJLFNBQVMsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxvQkFBWSxDQUFDLENBQUM7SUFDbEQsSUFBSSxLQUFLLEdBQUcsTUFBTSxrQkFBRSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsRUFBYyxDQUFDLENBQUM7SUFDcEUsS0FBSyxJQUFJLElBQUksSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztRQUM1QixJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzFCLFNBQVM7UUFDYixDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0QsSUFBSSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7WUFDL0UsSUFBSSxTQUFTLEdBQUcsTUFBTSxDQUFDLFNBQVMsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsQ0FBQztZQUNoRSxRQUFRLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsSUFBSSxFQUFFLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNqRyxDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNULE9BQU8sQ0FBQyxHQUFHLENBQUMsb0NBQW9DLElBQUksS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7SUFDTCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDcEIsQ0FBQztBQUVELElBQUksY0FBYyxHQUFHLENBQUMsQ0FBQztBQUV2Qjs7d0JBRXdCO0FBQ3hCLEtBQUssVUFBVSxlQUFlLENBQUMsU0FBaUI7SUFDNUMsSUFBSSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsY0FBYyxHQUFHLG9CQUFvQixFQUFFLENBQUM7UUFDckQsT0FBTztJQUNYLENBQUM7SUFDRCxjQUFjLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQztRQUNELE1BQU0sSUFBQSx5QkFBYSxFQUFDLElBQUEsc0JBQVUsRUFBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsSUFBQSw0QkFBYSxFQUFDLFNBQVMsQ0FBQyx5Q0FBeUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUN4RyxDQUFDO0FBQ0wsQ0FBQztBQUVELHlGQUF5RjtBQUN6RixLQUFLLFVBQVUsc0JBQXNCLENBQUMsU0FBaUI7SUFDbkQsSUFBSSxJQUFJLEdBQUcsSUFBQSxzQkFBVSxFQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2pDLElBQUksV0FBVyxHQUE4RCxFQUFFLENBQUM7SUFDaEYsS0FBSyxJQUFJLElBQUksSUFBSSxNQUFNLElBQUEsdUJBQVcsRUFBQyxJQUFJLEVBQUUsZUFBZSxDQUFDLEVBQUUsQ0FBQztRQUN4RCxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzFCLFNBQVM7UUFDYixDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0QsSUFBSSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLElBQUEsd0JBQVksRUFBQyxJQUFJLEVBQUUsY0FBSSxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUMxRixJQUFJLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDbkIsV0FBVyxDQUFDLElBQUksQ0FBQztvQkFDYixZQUFZLEVBQUUsTUFBTSxDQUFDLFlBQVksSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUM7b0JBQ2hFLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUztvQkFDM0IsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLElBQUksRUFBRTtpQkFDdEIsQ0FBQyxDQUFDO1lBQ1AsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ1QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQ0FBa0MsSUFBSSxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDaEUsQ0FBQztJQUNMLENBQUM7SUFDRCxPQUFPLFdBQVcsQ0FBQztBQUN2QixDQUFDO0FBRUQ7Ozs7O2dFQUtnRTtBQUNoRSxLQUFLLFVBQVUsZ0JBQWdCLENBQUMsUUFBZ0IsRUFBRSxJQUFZO0lBQzFELElBQUksQ0FBQztRQUNELElBQUksQ0FBQyxJQUFBLDJDQUFpQyxHQUFFLEVBQUUsQ0FBQztZQUN2Qyx3RkFBd0Y7WUFDeEYseUVBQXlFO1lBQ3pFLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsbUNBQXlCLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDckQsTUFBTSxJQUFBLHVDQUE2QixFQUFDLEVBQUUsUUFBUSxFQUFFLG1DQUF5QixFQUFFLENBQUMsQ0FBQztRQUNqRixDQUFDO1FBQ0QsTUFBTSxJQUFBLGVBQU0sRUFBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDakMsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxPQUFPLENBQUMsR0FBRyxDQUFDLG9FQUFvRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pGLENBQUM7QUFDTCxDQUFDO0FBRUQ7O3lCQUV5QjtBQUN6QixLQUFLLFVBQVUsdUJBQXVCLENBQUMsTUFLdEM7SUFDRyxJQUFJLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ3JELElBQUksUUFBUSxHQUFHLElBQUEsNkJBQWMsRUFBQyxTQUFTLENBQUMsQ0FBQztJQUN6QyxJQUFJLE9BQU8sR0FBRyxNQUFNLElBQUEsMkJBQWUsRUFBQyxTQUFTLENBQUMsQ0FBQztJQUMvQyxJQUFJLFlBQVksR0FBRyxJQUFBLDRCQUFlLEVBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUMsSUFBSSxTQUFTLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDckQsTUFBTSxrQkFBRSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUMvQyxNQUFNLGtCQUFFLENBQUMsU0FBUyxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsWUFBWSxPQUFPLENBQUMsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQzVFLFlBQVk7UUFDWixTQUFTO1FBQ1QsRUFBRTtRQUNGLFNBQVMsRUFBRSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTtRQUNuQyxTQUFTLEVBQUUsU0FBUztRQUNwQixNQUFNLEVBQUUsaUJBQWlCO0tBQzVCLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDO0lBRXpCLE1BQU0sSUFBQSxZQUFNLEVBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzlELE1BQU0sSUFBQSxZQUFNLEVBQUM7UUFDVCxJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsaUNBQWlDLEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsVUFBVSxZQUFZLEVBQUUsQ0FBQztRQUN2SCxHQUFHLEVBQUUsUUFBUSxFQUFFLE9BQU87S0FDekIsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxJQUFJLEdBQUcsTUFBTSxJQUFBLFlBQU0sRUFBQyxFQUFFLElBQUksRUFBRSxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDMUcsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3BCLDRGQUE0RjtRQUM1RixPQUFPLENBQUMsR0FBRyxDQUFDLG9DQUFvQyxTQUFTLFNBQVMsRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQy9HLE9BQU87SUFDWCxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLFNBQVMsU0FBUyxFQUFFLEtBQUssWUFBWSxFQUFFLENBQUMsQ0FBQztJQUVoRSw2RkFBNkY7SUFDN0YsMEZBQTBGO0lBQzFGLE1BQU0sZ0JBQWdCLENBQ2xCLGlCQUFpQixFQUFFLGtCQUFrQixTQUFTLEVBQUUsRUFDaEQsd0NBQXdDLEVBQUUsaURBQWlEO1VBQ3pGLHdGQUF3RjtVQUN4RixxQ0FBcUM7VUFDckMsMERBQTBEO1VBQzFELGdEQUFnRCxTQUFTLGtCQUFrQixTQUFTLFNBQVM7VUFDN0YsNkVBQTZFLEVBQUUsV0FBVztVQUMxRix5REFBeUQ7VUFDekQsa0JBQWtCLFNBQVMsSUFBSTtVQUMvQixrQkFBa0IsU0FBUyxJQUFJLENBQ3BDLENBQUM7QUFDTixDQUFDO0FBa0JNLEtBQUssVUFBVSxpQkFBaUIsQ0FBQyxNQUF5QztJQUM3RSxJQUFJLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUMvQixJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDcEIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsUUFBUSxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNsSCxDQUFDO0lBQ0QsSUFBSSxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLElBQUEsMEJBQWUsR0FBRSxDQUFDO0lBQ3RELHlGQUF5RjtJQUN6RiwrQ0FBK0M7SUFDL0MsTUFBTSxJQUFBLHNCQUFjLEVBQUMsUUFBUSxDQUFDLENBQUM7SUFFL0IsSUFBSSxPQUFPLEdBQUcsQ0FBQyxNQUFNLFlBQVksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM1RCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDWCxPQUFPLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsNkJBQTZCLEVBQUUsQ0FBQztJQUN0RSxDQUFDO0lBRUQsTUFBTSxlQUFlLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDakMsSUFBSSxTQUFTLEdBQUcsTUFBTSxJQUFBLDBCQUFhLEVBQUMsU0FBUyxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxHQUFHLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUN6RywyRkFBMkY7SUFDM0YsOEZBQThGO0lBQzlGLG9EQUFvRDtJQUNwRCxJQUFJLFlBQVksR0FBRyxDQUFDLElBQVksRUFBRSxFQUFFLFdBQUMsT0FBQSxDQUFDLENBQUMsQ0FBQSxNQUFBLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQywwQ0FBRSxNQUFNLENBQUEsQ0FBQSxFQUFBLENBQUM7SUFDekUsSUFBSSxXQUFXLEdBQUcsTUFBTSxzQkFBc0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMxRCw4RkFBOEY7SUFDOUYsbUZBQW1GO0lBQ25GLElBQUksVUFBVSxHQUFHLEVBQUUsQ0FBQztJQUNwQixLQUFLLElBQUksVUFBVSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ2pDLElBQUksVUFBVSxDQUFDLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNyQyxTQUFTO1FBQ2IsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsSUFBQSxvQkFBTyxFQUFDLEVBQUUsV0FBVyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNuRixVQUFVLEdBQUcsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMvQixDQUFDO0lBQ0wsQ0FBQztJQUNELElBQUksVUFBVSxFQUFFLENBQUM7UUFDYixPQUFPO1lBQ0gsUUFBUSxFQUFFLEtBQUs7WUFDZixNQUFNLEVBQUUsNENBQTRDLFVBQVUsK0JBQStCO1NBQ2hHLENBQUM7SUFDTixDQUFDO0lBRUQsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQzNCLE9BQU8sRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsQ0FBQztJQUMxQyxDQUFDO0lBRUQsNEZBQTRGO0lBQzVGLHdFQUF3RTtJQUN4RSxJQUFJLElBQUksR0FBRyxJQUFBLG9CQUFPLEVBQUMsRUFBRSxXQUFXLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDbkQsSUFBSSxlQUFlLEdBQUcsV0FBVyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUNoRCxJQUFBLG9CQUFPLEVBQUMsRUFBRSxXQUFXLEVBQUUsVUFBVSxDQUFDLFNBQVMsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLEVBQUUsRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDaEYsSUFBSSxDQUFDLGVBQWUsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzFDLE1BQU0sdUJBQXVCLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsWUFBRSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN0RixPQUFPLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsb0NBQW9DLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQztJQUNqSCxDQUFDO0lBQ0QsT0FBTyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLG9DQUFvQyxFQUFFLEVBQUUsRUFBRSxDQUFDO0FBQ2pGLENBQUM7QUF0REQsOENBc0RDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGZzIGZyb20gXCJmcy9wcm9taXNlc1wiO1xuaW1wb3J0IG9zIGZyb20gXCJvc1wiO1xuaW1wb3J0IHBhdGggZnJvbSBcInBhdGhcIjtcbmltcG9ydCB7IHJlc29sdmVLZXlzUmVwbyB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5cy9rZXlzUmVwb1wiO1xuaW1wb3J0IHsgcmV2b2tlUmVwbywgc3luY1JlcG9GaWxlcyB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5cy9kYWVtb24vcmVwb0ZpbGVzXCI7XG5pbXBvcnQgeyBsaXN0UmVwb0RpciwgcmVhZFJlcG9GaWxlIH0gZnJvbSBcIi4uL2F1dGhvcml6ZWRLZXlzL2RhZW1vbi9yZXBvRmlsZXNcIjtcbmltcG9ydCB7IG5ld1Jldm9jYXRpb25JZCwgcGFpcktleSwgcmVhZFJldm9jYXRpb25GaWxlcywgcmVhZFVucmV2b2tlcyB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5cy9kYWVtb24vcmV2b2NhdGlvblwiO1xuaW1wb3J0IHsgcnVuR2l0IH0gZnJvbSBcIi4uL2F1dGhvcml6ZWRLZXlzL2RhZW1vbi9naXRcIjtcbmltcG9ydCB7IGVuc3VyZVJldm9rZUtleSB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5cy9kYWVtb24vcmVwb0ZpbGVzXCI7XG5pbXBvcnQgeyB2ZXJpZnlDaGVja291dCB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5cy9kYWVtb24vdHJ1c3RcIjtcbmltcG9ydCB7IHJldm9rZVJlcG9QYXRoLCByZXZva2VSZXBvVVJMIH0gZnJvbSBcIi4uL2F1dGhvcml6ZWRLZXlzL3Jldm9rZVNvdXJjZVwiO1xuaW1wb3J0IHsgbm90aWZ5IH0gZnJvbSBcIi4uL2F1dGhvcml6ZWRLZXlzL2RhZW1vbi9ub3RpZnlcIjtcbmltcG9ydCB7IGFyZURpc2NvcmROb3RpZmljYXRpb25zQ29uZmlndXJlZCwgY29uZmlndXJlRGlzY29yZE5vdGlmaWNhdGlvbnMsIERFRkFVTFRfV0VCSE9PS19GSUxFX1BBVEggfSBmcm9tIFwiLi4vbm90aWZpY2F0aW9ucy9kaXNjb3JkXCI7XG5pbXBvcnQgeyBzcGF3blByb21pc2UgfSBmcm9tIFwiLi4vaGVscGVycy9zcGF3blwiO1xuXG4vLyBXaGljaCBtYWNoaW5lcyB0aGlzIHN5c3RlbSB0YWxrcyB0bywga2VwdCBpbiB0aGUgc2FtZSByZXBvIGFzIHRoZSBzc2gga2V5cy4gVGhhdCByZXBvIGlzIGFscmVhZHlcbi8vIHNpZ25lZCwgYWxyZWFkeSBkaXN0cmlidXRlZCB0byBldmVyeSBtYWNoaW5lLCBhbmQgYWxyZWFkeSBoYXMgc29tZXdoZXJlIHRvIHJlY29yZCBhIHJlamVjdGlvbixcbi8vIHNvIGEgc2Vjb25kIG9uZSB3b3VsZCBvbmx5IGJlIGEgc2Vjb25kIHRoaW5nIHRvIGtlZXAgaW4gc3RlcC5cbmV4cG9ydCBjb25zdCBNQUNISU5FU19ESVIgPSBcIm1hY2hpbmVzXCI7XG5jb25zdCBSRVZPQ0FUSU9OU19ESVIgPSBcInJldm9jYXRpb25zXCI7XG5jb25zdCBSRVZPQ0FUSU9OX1JFQVNPTiA9IFwiYSBtYWNoaW5lIHRhbGtlZCB0byB1cyBmcm9tIGFuIHVuYXBwcm92ZWQgSVBcIjtcbi8vIFRoZSByZXZva2UgcmVwbyBpcyBwdWxsZWQgYXQgbW9zdCB0aGlzIG9mdGVuLiBBIGNoZWNrIGhhcHBlbnMgcGVyIHJlcXVlc3QsIGFuZCBhIHJlcXVlc3QgbXVzdFxuLy8gbm90IGNvc3QgYSByb3VuZCB0cmlwIHRvIGdpdGh1Yi5cbmNvbnN0IFJFVk9LRV9TWU5DX0lOVEVSVkFMID0gNjAgKiAxMDAwO1xuXG4vKiogT25lIG1hY2hpbmUgd2UgYXJlIHdpbGxpbmcgdG8gdGFsayB0bywgYW5kIHRoZSBhZGRyZXNzZXMgaXQgbWF5IHRhbGsgdG8gdXMgZnJvbS4gKi9cbmV4cG9ydCB0eXBlIE1hY2hpbmVTdGF0ZSA9IHtcbiAgICBtYWNoaW5lSWQ6IHN0cmluZztcbiAgICBpcHM6IHN0cmluZ1tdO1xuICAgIGFkZGVkQXQ6IHN0cmluZztcbn07XG5cbmFzeW5jIGZ1bmN0aW9uIHBhdGhFeGlzdHMoZmlsZVBhdGg6IHN0cmluZykge1xuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IGZzLmFjY2VzcyhmaWxlUGF0aCk7XG4gICAgICAgIHJldHVybiB0cnVlO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cbn1cblxuZnVuY3Rpb24gbWFjaGluZUZpbGVQYXRoKHJlcG9QYXRoOiBzdHJpbmcsIG1hY2hpbmVJZDogc3RyaW5nKSB7XG4gICAgcmV0dXJuIHBhdGguam9pbihyZXBvUGF0aCwgTUFDSElORVNfRElSLCBgJHttYWNoaW5lSWR9Lmpzb25gKTtcbn1cblxuLyoqIEV2ZXJ5IG1hY2hpbmUgYSBjaGVja291dCBsaXN0cy4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBnZXRNYWNoaW5lcyhyZXBvUGF0aDogc3RyaW5nKTogUHJvbWlzZTxNYWNoaW5lU3RhdGVbXT4ge1xuICAgIHJldHVybiBbLi4uKGF3YWl0IHJlYWRNYWNoaW5lcyhyZXBvUGF0aCkpLnZhbHVlcygpXTtcbn1cblxuLyoqIE1ha2VzIGEgY2hlY2tvdXQgbGlzdCBleGFjdGx5IHRoZXNlIG1hY2hpbmVzOiB0aG9zZSBuYW1lZCBhcmUgd3JpdHRlbiB3aXRoIHRoZSBhZGRyZXNzZXMgZ2l2ZW4sXG4gICAgYW5kIGFueXRoaW5nIG5vdCBuYW1lZCBpcyByZW1vdmVkLiBTbyByZWFkIHRoZW0sIGNoYW5nZSB3aGF0IHlvdSB3YW50LCBhbmQgd3JpdGUgdGhlIHJlc3VsdC5cblxuICAgIFRoZSBhZGRyZXNzZXMgYXJlIHBhcnQgb2Ygc2V0dGluZyByYXRoZXIgdGhhbiBhIHNlcGFyYXRlIHN0ZXAsIGJlY2F1c2UgYSBtYWNoaW5lIHdpdGggbm9cbiAgICBhZGRyZXNzIGl0IG1heSB0YWxrIGZyb20gaXMgbm90IGEgbWFjaGluZSB0aGF0IHdvdWxkIGV2ZXIgYmUgYWNjZXB0ZWQgLSB0aGVyZSBpcyBubyBzdGF0ZSB3aGVyZVxuICAgIG5hbWluZyBvbmUgd2l0aG91dCB0aGVtIG1lYW5zIGFueXRoaW5nLlxuXG4gICAgTm90aGluZyBoZXJlIHNpZ25zIG9yIGNvbW1pdHMuIFRoZSBzaWduYXR1cmUgaXMgd2hhdCBldmVyeSBvdGhlciBtYWNoaW5lIGNoZWNrcyBiZWZvcmVcbiAgICBiZWxpZXZpbmcgYW55IG9mIHRoaXMsIGFuZCBpdCB0YWtlcyB0aGUgaGFyZHdhcmUga2V5LCBzbyBgeWFybiBzaWduZmlsZXMgZ2l0YCBpcyBzdGlsbCB5b3VycyB0b1xuICAgIHJ1biBhZnRlcndhcmRzLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHNldE1hY2hpbmVzKGNvbmZpZzoge1xuICAgIHJlcG9QYXRoOiBzdHJpbmc7XG4gICAgbWFjaGluZXM6IHsgbWFjaGluZUlkOiBzdHJpbmc7IGlwczogc3RyaW5nW10gfVtdO1xufSk6IFByb21pc2U8TWFjaGluZVN0YXRlW10+IHtcbiAgICBsZXQgeyByZXBvUGF0aCwgbWFjaGluZXMgfSA9IGNvbmZpZztcbiAgICBsZXQgZXhpc3RpbmcgPSBhd2FpdCByZWFkTWFjaGluZXMocmVwb1BhdGgpO1xuICAgIGxldCBkaXJlY3RvcnkgPSBwYXRoLmpvaW4ocmVwb1BhdGgsIE1BQ0hJTkVTX0RJUik7XG4gICAgbGV0IHdyaXR0ZW46IE1hY2hpbmVTdGF0ZVtdID0gW107XG4gICAgZm9yIChsZXQgbWFjaGluZSBvZiBtYWNoaW5lcykge1xuICAgICAgICBpZiAoIW1hY2hpbmUubWFjaGluZUlkKSB7XG4gICAgICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgbWFjaGluZUlkLCB3YXMgJHtKU09OLnN0cmluZ2lmeShtYWNoaW5lLm1hY2hpbmVJZCl9YCk7XG4gICAgICAgIH1cbiAgICAgICAgaWYgKCFtYWNoaW5lLmlwcy5sZW5ndGgpIHtcbiAgICAgICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgICAgICBgRXhwZWN0ZWQgYWRkcmVzc2VzIGZvciAke21hY2hpbmUubWFjaGluZUlkfSwgd2FzIG5vbmUuIEEgbWFjaGluZSBpcyB0cnVzdGVkIGZyb21gXG4gICAgICAgICAgICAgICAgKyBgIHRoZSBhZGRyZXNzZXMgaXQgbWF5IHRhbGsgZnJvbSwgc28gbGVhdmUgaXQgb3V0IG9mIHRoZSBsaXN0IHRvIHJlbW92ZSBpdC5gXG4gICAgICAgICAgICApO1xuICAgICAgICB9XG4gICAgICAgIGxldCBpcHMgPSBtYWNoaW5lLmlwcy5maWx0ZXIoKGlwLCBpbmRleCkgPT4gaXAgJiYgbWFjaGluZS5pcHMuaW5kZXhPZihpcCkgPT09IGluZGV4KTtcbiAgICAgICAgbGV0IHN0YXRlOiBNYWNoaW5lU3RhdGUgPSB7XG4gICAgICAgICAgICBtYWNoaW5lSWQ6IG1hY2hpbmUubWFjaGluZUlkLFxuICAgICAgICAgICAgLy8gSW4gdGhlIG9yZGVyIGdpdmVuLCB3aXRob3V0IGR1cGxpY2F0ZXMsIHNvIHRoZSBmaWxlIHJlYWRzIHRoZSB3YXkgaXQgd2FzIHNldC5cbiAgICAgICAgICAgIGlwcyxcbiAgICAgICAgICAgIGFkZGVkQXQ6IGV4aXN0aW5nLmdldChtYWNoaW5lLm1hY2hpbmVJZCk/LmFkZGVkQXQgfHwgbmV3IERhdGUoKS50b0lTT1N0cmluZygpLFxuICAgICAgICB9O1xuICAgICAgICBhd2FpdCBmcy5ta2RpcihkaXJlY3RvcnksIHsgcmVjdXJzaXZlOiB0cnVlIH0pO1xuICAgICAgICBhd2FpdCBmcy53cml0ZUZpbGUobWFjaGluZUZpbGVQYXRoKHJlcG9QYXRoLCBzdGF0ZS5tYWNoaW5lSWQpLCBKU09OLnN0cmluZ2lmeShzdGF0ZSwgdW5kZWZpbmVkLCA0KSArIFwiXFxuXCIpO1xuICAgICAgICB3cml0dGVuLnB1c2goc3RhdGUpO1xuICAgIH1cblxuICAgIC8vIFdoYXRldmVyIHRoZSByZXBvIGhhZCBhbmQgdGhlIGNhbGxlciBkaWQgbm90IG5hbWUgaXMgbm8gbG9uZ2VyIHRydXN0ZWQuXG4gICAgZm9yIChsZXQgbWFjaGluZUlkIG9mIGV4aXN0aW5nLmtleXMoKSkge1xuICAgICAgICBpZiAoIW1hY2hpbmVzLnNvbWUobWFjaGluZSA9PiBtYWNoaW5lLm1hY2hpbmVJZCA9PT0gbWFjaGluZUlkKSkge1xuICAgICAgICAgICAgYXdhaXQgZnMucm0obWFjaGluZUZpbGVQYXRoKHJlcG9QYXRoLCBtYWNoaW5lSWQpLCB7IGZvcmNlOiB0cnVlIH0pO1xuICAgICAgICB9XG4gICAgfVxuICAgIHJldHVybiB3cml0dGVuO1xufVxuXG4vKiogRXZlcnkgbWFjaGluZSB0aGUgcmVwbyBsaXN0cy4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlYWRNYWNoaW5lcyhyZXBvUGF0aDogc3RyaW5nKSB7XG4gICAgbGV0IG1hY2hpbmVzID0gbmV3IE1hcDxzdHJpbmcsIE1hY2hpbmVTdGF0ZT4oKTtcbiAgICBsZXQgZGlyZWN0b3J5ID0gcGF0aC5qb2luKHJlcG9QYXRoLCBNQUNISU5FU19ESVIpO1xuICAgIGxldCBuYW1lcyA9IGF3YWl0IGZzLnJlYWRkaXIoZGlyZWN0b3J5KS5jYXRjaCgoKSA9PiBbXSBhcyBzdHJpbmdbXSk7XG4gICAgZm9yIChsZXQgbmFtZSBvZiBuYW1lcy5zb3J0KCkpIHtcbiAgICAgICAgaWYgKCFuYW1lLmVuZHNXaXRoKFwiLmpzb25cIikpIHtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIHRyeSB7XG4gICAgICAgICAgICBsZXQgcGFyc2VkID0gSlNPTi5wYXJzZShhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4oZGlyZWN0b3J5LCBuYW1lKSwgXCJ1dGY4XCIpKTtcbiAgICAgICAgICAgIGxldCBtYWNoaW5lSWQgPSBwYXJzZWQubWFjaGluZUlkIHx8IG5hbWUucmVwbGFjZSgvXFwuanNvbiQvLCBcIlwiKTtcbiAgICAgICAgICAgIG1hY2hpbmVzLnNldChtYWNoaW5lSWQsIHsgbWFjaGluZUlkLCBpcHM6IHBhcnNlZC5pcHMgfHwgW10sIGFkZGVkQXQ6IHBhcnNlZC5hZGRlZEF0IHx8IFwiXCIgfSk7XG4gICAgICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgICAgIGNvbnNvbGUubG9nKGBJZ25vcmluZyB1bnJlYWRhYmxlIG1hY2hpbmUgZmlsZSAke25hbWV9LiAke2V9YCk7XG4gICAgICAgIH1cbiAgICB9XG4gICAgcmV0dXJuIG1hY2hpbmVzO1xufVxuXG5sZXQgbGFzdFJldm9rZVN5bmMgPSAwO1xuXG4vKiogUHVsbGVkIGF0IG1vc3Qgb25jZSBhIFJFVk9LRV9TWU5DX0lOVEVSVkFMLCBiZWNhdXNlIHRoaXMgaXMgYXNrZWQgcGVyIHJlcXVlc3QuIEEgc3luYyB0aGF0XG4gICAgZmFpbHMgbGVhdmVzIHRoZSBjaGVja291dCB3ZSBhbHJlYWR5IGhhdmUsIHdoaWNoIGlzIHRoZSBzYWZlIGRpcmVjdGlvbjogcmV2b2NhdGlvbnMgd2Uga25vd1xuICAgIGFib3V0IHN0YXkga25vd24uICovXG5hc3luYyBmdW5jdGlvbiBzeW5jUmV2b2NhdGlvbnMoc291cmNlVVJMOiBzdHJpbmcpIHtcbiAgICBpZiAoRGF0ZS5ub3coKSAtIGxhc3RSZXZva2VTeW5jIDwgUkVWT0tFX1NZTkNfSU5URVJWQUwpIHtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBsYXN0UmV2b2tlU3luYyA9IERhdGUubm93KCk7XG4gICAgdHJ5IHtcbiAgICAgICAgYXdhaXQgc3luY1JlcG9GaWxlcyhyZXZva2VSZXBvKHNvdXJjZVVSTCkpO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgY29uc29sZS5sb2coYENvdWxkIG5vdCByZWFkICR7cmV2b2tlUmVwb1VSTChzb3VyY2VVUkwpfSwgdXNpbmcgdGhlIHJldm9jYXRpb25zIGFscmVhZHkgaGVyZS4gJHtlfWApO1xuICAgIH1cbn1cblxuLyoqIE1hY2hpbmUgcmV2b2NhdGlvbnMsIHJlYWQgb3V0IG9mIHRoZSByZXZva2UgcmVwbyB0aGUgc2FtZSB3YXkga2V5IHJldm9jYXRpb25zIGFyZS4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlYWRNYWNoaW5lUmV2b2NhdGlvbnMoc291cmNlVVJMOiBzdHJpbmcpIHtcbiAgICBsZXQgcmVwbyA9IHJldm9rZVJlcG8oc291cmNlVVJMKTtcbiAgICBsZXQgcmV2b2NhdGlvbnM6IHsgcmV2b2NhdGlvbklkOiBzdHJpbmc7IG1hY2hpbmVJZDogc3RyaW5nOyBpcDogc3RyaW5nIH1bXSA9IFtdO1xuICAgIGZvciAobGV0IG5hbWUgb2YgYXdhaXQgbGlzdFJlcG9EaXIocmVwbywgUkVWT0NBVElPTlNfRElSKSkge1xuICAgICAgICBpZiAoIW5hbWUuZW5kc1dpdGgoXCIuanNvblwiKSkge1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgdHJ5IHtcbiAgICAgICAgICAgIGxldCBwYXJzZWQgPSBKU09OLnBhcnNlKGF3YWl0IHJlYWRSZXBvRmlsZShyZXBvLCBwYXRoLmpvaW4oUkVWT0NBVElPTlNfRElSLCBuYW1lKSkgfHwgXCJcIik7XG4gICAgICAgICAgICBpZiAocGFyc2VkLm1hY2hpbmVJZCkge1xuICAgICAgICAgICAgICAgIHJldm9jYXRpb25zLnB1c2goe1xuICAgICAgICAgICAgICAgICAgICByZXZvY2F0aW9uSWQ6IHBhcnNlZC5yZXZvY2F0aW9uSWQgfHwgbmFtZS5yZXBsYWNlKC9cXC5qc29uJC8sIFwiXCIpLFxuICAgICAgICAgICAgICAgICAgICBtYWNoaW5lSWQ6IHBhcnNlZC5tYWNoaW5lSWQsXG4gICAgICAgICAgICAgICAgICAgIGlwOiBwYXJzZWQuaXAgfHwgXCJcIixcbiAgICAgICAgICAgICAgICB9KTtcbiAgICAgICAgICAgIH1cbiAgICAgICAgfSBjYXRjaCAoZSkge1xuICAgICAgICAgICAgY29uc29sZS5sb2coYElnbm9yaW5nIHVucmVhZGFibGUgcmV2b2NhdGlvbiAke25hbWV9LiAke2V9YCk7XG4gICAgICAgIH1cbiAgICB9XG4gICAgcmV0dXJuIHJldm9jYXRpb25zO1xufVxuXG4vKiogU2VuZHMgdGhlIG9uZSBub3RpZmljYXRpb24gdGhpcyBmaWxlIGlzIGFsbG93ZWQgdG8gc2VuZCwgd2hlbiBpdCBjYW4uXG5cbiAgICBUaGUgZGFlbW9uIGNvbmZpZ3VyZXMgbm90aWZpY2F0aW9ucyBvbiBzdGFydHVwIGFuZCB3b3VsZCBzaW1wbHkgc2VuZC4gVGhpcyBjYW4gYWxzbyBydW4gaW4gc29tZVxuICAgIG90aGVyIHByb2Nlc3MsIHdoaWNoIGhhcyBub3QsIHNvIHRoZSB3ZWJob29rIGlzIHBpY2tlZCB1cCBoZXJlIGlmIGl0IGlzIHJlYWRhYmxlLiBBIG1hY2hpbmVcbiAgICB3aXRoIG5vIHdlYmhvb2sgc2V0IHVwIHN0aWxsIHJlY29yZHMgdGhlIHJldm9jYXRpb24gLSBiZWluZyB1bmFibGUgdG8gdGVsbCBhbnlvbmUgaXMgbm90IGFcbiAgICByZWFzb24gdG8ga2VlcCBhY2NlcHRpbmcgYSBtYWNoaW5lIHRoYXQgaXMgYmVpbmcgbWlzdXNlZC4gKi9cbmFzeW5jIGZ1bmN0aW9uIG5vdGlmeUJlc3RFZmZvcnQoaGVhZGxpbmU6IHN0cmluZywgYm9keTogc3RyaW5nKSB7XG4gICAgdHJ5IHtcbiAgICAgICAgaWYgKCFhcmVEaXNjb3JkTm90aWZpY2F0aW9uc0NvbmZpZ3VyZWQoKSkge1xuICAgICAgICAgICAgLy8gUmVhZCBmaXJzdDogY29uZmlndXJlRGlzY29yZE5vdGlmaWNhdGlvbnMgZXhpdHMgdGhlIHByb2Nlc3Mgd2hlbiB0aGUgZmlsZSBpcyBtaXNzaW5nLFxuICAgICAgICAgICAgLy8gd2hpY2ggaXMgcmlnaHQgZm9yIHRoZSBkYWVtb24gYXQgc3RhcnR1cCBhbmQgd3JvbmcgZm9yIGEgbGlicmFyeSBjYWxsLlxuICAgICAgICAgICAgYXdhaXQgZnMucmVhZEZpbGUoREVGQVVMVF9XRUJIT09LX0ZJTEVfUEFUSCwgXCJ1dGY4XCIpO1xuICAgICAgICAgICAgYXdhaXQgY29uZmlndXJlRGlzY29yZE5vdGlmaWNhdGlvbnMoeyBmaWxlUGF0aDogREVGQVVMVF9XRUJIT09LX0ZJTEVfUEFUSCB9KTtcbiAgICAgICAgfVxuICAgICAgICBhd2FpdCBub3RpZnkoaGVhZGxpbmUsIGJvZHkpO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgY29uc29sZS5sb2coYENvdWxkIG5vdCBzZW5kIGEgbm90aWZpY2F0aW9uIGFib3V0IHRoaXMsIGl0IGlzIG9ubHkgaW4gdGhlIGxvZy4gJHtlfWApO1xuICAgIH1cbn1cblxuLyoqIFJlY29yZHMgdGhhdCBhIG1hY2hpbmUgd2UgYWNjZXB0IHRhbGtlZCB0byB1cyBmcm9tIGFuIGFkZHJlc3MgaXQgaXMgbm90IGFsbG93ZWQgZnJvbS4gT25lIHBlclxuICAgIG1hY2hpbmUgYW5kIGFkZHJlc3MsIHNvIGEgc2Vjb25kIGFkZHJlc3MgaXMgYSBzZWNvbmQgcmV2b2NhdGlvbiBhbmQgYW4gdW5yZXZva2Ugb2YgdGhlIGZpcnN0XG4gICAgZG9lcyBub3QgY292ZXIgaXQuICovXG5hc3luYyBmdW5jdGlvbiByZWNvcmRNYWNoaW5lUmV2b2NhdGlvbihjb25maWc6IHtcbiAgICBzb3VyY2VVUkw6IHN0cmluZztcbiAgICBtYWNoaW5lSWQ6IHN0cmluZztcbiAgICBpcDogc3RyaW5nO1xuICAgIGhvc3RMYWJlbDogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IHNvdXJjZVVSTCwgbWFjaGluZUlkLCBpcCwgaG9zdExhYmVsIH0gPSBjb25maWc7XG4gICAgbGV0IHJlcG9QYXRoID0gcmV2b2tlUmVwb1BhdGgoc291cmNlVVJMKTtcbiAgICBsZXQga2V5UGF0aCA9IGF3YWl0IGVuc3VyZVJldm9rZUtleShzb3VyY2VVUkwpO1xuICAgIGxldCByZXZvY2F0aW9uSWQgPSBuZXdSZXZvY2F0aW9uSWQobWFjaGluZUlkKTtcbiAgICBsZXQgZGlyZWN0b3J5ID0gcGF0aC5qb2luKHJlcG9QYXRoLCBSRVZPQ0FUSU9OU19ESVIpO1xuICAgIGF3YWl0IGZzLm1rZGlyKGRpcmVjdG9yeSwgeyByZWN1cnNpdmU6IHRydWUgfSk7XG4gICAgYXdhaXQgZnMud3JpdGVGaWxlKHBhdGguam9pbihkaXJlY3RvcnksIGAke3Jldm9jYXRpb25JZH0uanNvbmApLCBKU09OLnN0cmluZ2lmeSh7XG4gICAgICAgIHJldm9jYXRpb25JZCxcbiAgICAgICAgbWFjaGluZUlkLFxuICAgICAgICBpcCxcbiAgICAgICAgcmV2b2tlZEF0OiBuZXcgRGF0ZSgpLnRvSVNPU3RyaW5nKCksXG4gICAgICAgIHJldm9rZWRCeTogaG9zdExhYmVsLFxuICAgICAgICByZWFzb246IFJFVk9DQVRJT05fUkVBU09OLFxuICAgIH0sIHVuZGVmaW5lZCwgNCkgKyBcIlxcblwiKTtcblxuICAgIGF3YWl0IHJ1bkdpdCh7IGFyZ3M6IFtcImFkZFwiLCBcIi1BXCJdLCBjd2Q6IHJlcG9QYXRoLCBrZXlQYXRoIH0pO1xuICAgIGF3YWl0IHJ1bkdpdCh7XG4gICAgICAgIGFyZ3M6IFtcIi1jXCIsIFwidXNlci5lbWFpbD1wb3J0c2VjdXJlQGxvY2FsaG9zdFwiLCBcIi1jXCIsIFwidXNlci5uYW1lPXBvcnRzZWN1cmVcIiwgXCJjb21taXRcIiwgXCItbVwiLCBgcmV2b2tlICR7cmV2b2NhdGlvbklkfWBdLFxuICAgICAgICBjd2Q6IHJlcG9QYXRoLCBrZXlQYXRoLFxuICAgIH0pO1xuICAgIGxldCBwdXNoID0gYXdhaXQgcnVuR2l0KHsgYXJnczogW1wicHVzaFwiLCBcIm9yaWdpblwiLCBcIkhFQURcIl0sIGN3ZDogcmVwb1BhdGgsIGtleVBhdGgsIGFsbG93RmFpbHVyZTogdHJ1ZSB9KTtcbiAgICBpZiAocHVzaC5zdGF0dXMgIT09IDApIHtcbiAgICAgICAgLy8gQW5vdGhlciBtYWNoaW5lIG1vc3QgbGlrZWx5IHJlY29yZGVkIHRoZSBzYW1lIHRoaW5nIGZpcnN0LCBhbmQgdGhlIG5leHQgcmVhZCBwaWNrcyBpdCB1cC5cbiAgICAgICAgY29uc29sZS5sb2coYENvdWxkIG5vdCBwdXNoIHRoZSByZXZvY2F0aW9uIG9mICR7bWFjaGluZUlkfSBmcm9tICR7aXB9LiAkeyhwdXNoLnN0ZG91dCArIHB1c2guc3RkZXJyKS50cmltKCl9YCk7XG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgY29uc29sZS5sb2coYFJldm9rZWQgJHttYWNoaW5lSWR9IGZyb20gJHtpcH0sICR7cmV2b2NhdGlvbklkfWApO1xuXG4gICAgLy8gU2FpZCBieSB3aG9ldmVyIHdyb3RlIHRoZSByZXZvY2F0aW9uLCBvbmNlLCB0aGUgc2FtZSBhcyBmb3IgYW4gc3NoIGtleS4gTWFjaGluZXMgdGhhdCBvbmx5XG4gICAgLy8gcmVhZCBpdCBsYXRlciBzYXkgbm90aGluZywgb3Igb25lIGV2ZW50IHdvdWxkIGJlIHJlcG9ydGVkIGJ5IGV2ZXJ5IG1hY2hpbmUgdGhhdCBzYXcgaXQuXG4gICAgYXdhaXQgbm90aWZ5QmVzdEVmZm9ydChcbiAgICAgICAgYFNVU1BJQ0lPVVMgSVAgJHtpcH0gRlJPWkUgTUFDSElORSAke21hY2hpbmVJZH1gLFxuICAgICAgICBgQSBtYWNoaW5lIHdlIHRydXN0IHRhbGtlZCB0byB1cyBmcm9tICR7aXB9LCB3aGljaCBpcyBub3QgYW4gYWRkcmVzcyBpdCBpcyBhbGxvd2VkIHRvIHRhbGtgXG4gICAgICAgICsgYCBmcm9tLiBJdCBwcm92ZWQgaXQgaG9sZHMgdGhhdCBtYWNoaW5lJ3Mga2V5LCBzbyBlaXRoZXIgc29tZW9uZSBlbHNlIGhhcyBhIGNvcHkgb2YgaXQsYFxuICAgICAgICArIGAgb3IgdGhhdCBtYWNoaW5lJ3MgYWRkcmVzcyBjaGFuZ2VkLmBcbiAgICAgICAgKyBgXFxuXFxuSXQgaXMgZnJvemVuIGV2ZXJ5d2hlcmUgbm93LCBhbmQgbm90aGluZyBhY2NlcHRzIGl0LmBcbiAgICAgICAgKyBgXFxuXFxuSWYgdGhpcyB3YXMgYW4gYXR0YWNrLCByZW1vdmUgXFxgbWFjaGluZXMvJHttYWNoaW5lSWR9Lmpzb25cXGAgZnJvbSBcXGAke3NvdXJjZVVSTH1cXGAgbm93LmBcbiAgICAgICAgKyBgXFxuSWYgaXQgd2FzIGxlZ2l0aW1hdGUsIHJ1biBcXGB5YXJuIHVucmV2b2tlIGdpdFxcYCBpbiB0aGF0IHJlcG8uIEl0IGFsbG93cyAke2lwfSBmb3IgdGhhdGBcbiAgICAgICAgKyBgIG1hY2hpbmUsIGFuZCB0YWtlcyBlZmZlY3QgYXMgZWFjaCBtYWNoaW5lIHBpY2tzIGl0IHVwLmBcbiAgICAgICAgKyBgXFxuXFxubWFjaGluZTogXFxgJHttYWNoaW5lSWR9XFxgYFxuICAgICAgICArIGBcXG5mcm96ZW4gYnk6IFxcYCR7aG9zdExhYmVsfVxcYGBcbiAgICApO1xufVxuXG4vKiogV2hldGhlciB3ZSB3aWxsIHRhbGsgdG8gdGhpcyBtYWNoaW5lLCBjb21pbmcgZnJvbSB0aGlzIGFkZHJlc3MuXG5cbiAgICBCb3RoIGhhbHZlcyBhcmUgcmVxdWlyZWQgYW5kIG5laXRoZXIgaXMgYSBndWVzczogdGhlIGNhbGxlciBrbm93cyB0aGUgbWFjaGluZSBpZCBiZWNhdXNlIHRoZVxuICAgIGNvbm5lY3Rpb24gcHJvdmVkIGl0LCBhbmQga25vd3MgdGhlIGFkZHJlc3MgYmVjYXVzZSB0aGUgcGFja2V0cyBjYW1lIGZyb20gdGhlcmUuIEEgbWFjaGluZSB3ZVxuICAgIGRvIG5vdCBsaXN0IGlzIHNpbXBseSBub3QgYWNjZXB0ZWQuIEEgbWFjaGluZSB3ZSBkbyBsaXN0LCBhcnJpdmluZyBmcm9tIGFuIGFkZHJlc3MgaXQgZG9lcyBub3RcbiAgICBoYXZlLCBpcyB0cmVhdGVkIGFzIHRoZSBzYW1lIGtpbmQgb2YgZXZlbnQgYXMgYSBzdG9sZW4gc3NoIGtleSAtIGl0IGlzIHJldm9rZWQgZXZlcnl3aGVyZSwgYW5kXG4gICAgc3RheXMgcmV2b2tlZCB1bnRpbCBhbiB1bnJldm9rZSBhbGxvd3MgdGhhdCBtYWNoaW5lIGZyb20gdGhhdCBhZGRyZXNzLlxuXG4gICAgU2F5cyB3aHkgd2hlbiB0aGUgYW5zd2VyIGlzIG5vLCBiZWNhdXNlIHRoZSB0aHJlZSB3YXlzIHRvIGJlIHJlZnVzZWQgYXJlIGVudGlyZWx5IGRpZmZlcmVudFxuICAgIHRoaW5ncyB0byBhIHBlcnNvbiByZWFkaW5nIGl0OiBuZXZlciB0cnVzdGVkIGF0IGFsbCwgdHJ1c3RlZCBidXQgZnJvemVuLCBvciB0cnVzdGVkIGFuZCB0YWxraW5nXG4gICAgZnJvbSBzb21ld2hlcmUgaXQgc2hvdWxkIG5vdCBiZS5cblxuICAgIFRocm93cyB3aGVuIHRoZSByZXBvIGl0c2VsZiBjYW5ub3QgYmUgcmVhZCBvciBpcyBub3Qgc2lnbmVkLCByYXRoZXIgdGhhbiBhbnN3ZXJpbmcgZmFsc2U6IHRoYXRcbiAgICBpcyBhIGJyb2tlbiBpbnN0YWxsYXRpb24sIG5vdCBhIHJlamVjdGVkIG1hY2hpbmUsIGFuZCB0aGUgdHdvIGRlc2VydmUgZGlmZmVyZW50IGhhbmRsaW5nLiAqL1xuZXhwb3J0IHR5cGUgTWFjaGluZVZlcmRpY3QgPSB7IGFjY2VwdGVkOiBib29sZWFuOyByZWFzb246IHN0cmluZyB9O1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gaXNNYWNoaW5lQWNjZXB0ZWQoY29uZmlnOiB7IG1hY2hpbmVJZDogc3RyaW5nOyBpcDogc3RyaW5nIH0pOiBQcm9taXNlPE1hY2hpbmVWZXJkaWN0PiB7XG4gICAgbGV0IHsgbWFjaGluZUlkLCBpcCB9ID0gY29uZmlnO1xuICAgIGlmICghbWFjaGluZUlkIHx8ICFpcCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgbWFjaGluZUlkIGFuZCBhbiBpcCwgd2FzICR7SlNPTi5zdHJpbmdpZnkobWFjaGluZUlkKX0gYW5kICR7SlNPTi5zdHJpbmdpZnkoaXApfWApO1xuICAgIH1cbiAgICBsZXQgeyByZXBvUGF0aCwgc291cmNlVVJMIH0gPSBhd2FpdCByZXNvbHZlS2V5c1JlcG8oKTtcbiAgICAvLyBVbnNpZ25lZCwgb3Igc2lnbmVkIG92ZXIgZGlmZmVyZW50IGNvbnRlbnRzLCBtZWFucyB0aGUgbWFjaGluZSBsaXN0IGlzIG5vdCBldmlkZW5jZSBvZlxuICAgIC8vIGFueXRoaW5nLiBTYW1lIGdhdGUgdGhlIHNzaCBrZXlzIGdvIHRocm91Z2guXG4gICAgYXdhaXQgdmVyaWZ5Q2hlY2tvdXQocmVwb1BhdGgpO1xuXG4gICAgbGV0IG1hY2hpbmUgPSAoYXdhaXQgcmVhZE1hY2hpbmVzKHJlcG9QYXRoKSkuZ2V0KG1hY2hpbmVJZCk7XG4gICAgaWYgKCFtYWNoaW5lKSB7XG4gICAgICAgIHJldHVybiB7IGFjY2VwdGVkOiBmYWxzZSwgcmVhc29uOiBcInRoYXQgbWFjaGluZSBpcyBub3QgdHJ1c3RlZFwiIH07XG4gICAgfVxuXG4gICAgYXdhaXQgc3luY1Jldm9jYXRpb25zKHNvdXJjZVVSTCk7XG4gICAgbGV0IHVucmV2b2tlcyA9IGF3YWl0IHJlYWRVbnJldm9rZXMoc291cmNlVVJMKS5jYXRjaCgoKSA9PiAoeyBwYWlyczogbmV3IE1hcCgpLCBsZWdhY3lJZHM6IG5ldyBNYXAoKSB9KSk7XG4gICAgLy8gQW4gdW5yZXZva2UgY291bnRzIGFzIHNvb24gYXMgaXQgaXMgc2Vlbi4gSXQgaXMgc2lnbmVkLCBzbyB3cml0aW5nIG9uZSBhbHJlYWR5IHRha2VzIHRoZVxuICAgIC8vIGhhcmR3YXJlIGtleSwgYW5kIGFueW9uZSBob2xkaW5nIHRoYXQgY2FuIHNpZ24gYW55dGhpbmcgYXQgYWxsIC0gYSB3YWl0IGJlZm9yZSBob25vdXJpbmcgaXRcbiAgICAvLyBndWFyZHMgYWdhaW5zdCBhbiBhdHRhY2tlciB3aG8gaGFzIG5vIG5lZWQgb2YgaXQuXG4gICAgbGV0IGFsbG93ZWRBZ2FpbiA9IChwYWlyOiBzdHJpbmcpID0+ICEhdW5yZXZva2VzLnBhaXJzLmdldChwYWlyKT8ubGVuZ3RoO1xuICAgIGxldCByZXZvY2F0aW9ucyA9IGF3YWl0IHJlYWRNYWNoaW5lUmV2b2NhdGlvbnMoc291cmNlVVJMKTtcbiAgICAvLyBBbnkgcmV2b2NhdGlvbiBub3RoaW5nIGhhcyB1bmRvbmUga2VlcHMgdGhlIG1hY2hpbmUgb3V0LCBmcm9tIGV2ZXJ5d2hlcmUsIHRoZSB3YXkgYSByZXZva2VkXG4gICAgLy8gc3NoIGtleSBpcyBvdXQgZXZlcnl3aGVyZSByYXRoZXIgdGhhbiBvbmx5IGZyb20gdGhlIGFkZHJlc3MgaXQgd2FzIG1pc3VzZWQgZnJvbS5cbiAgICBsZXQgZnJvemVuRnJvbSA9IFwiXCI7XG4gICAgZm9yIChsZXQgcmV2b2NhdGlvbiBvZiByZXZvY2F0aW9ucykge1xuICAgICAgICBpZiAocmV2b2NhdGlvbi5tYWNoaW5lSWQgIT09IG1hY2hpbmVJZCkge1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgaWYgKCFhbGxvd2VkQWdhaW4ocGFpcktleSh7IGZpbmdlcnByaW50OiByZXZvY2F0aW9uLm1hY2hpbmVJZCwgaXA6IHJldm9jYXRpb24uaXAgfSkpKSB7XG4gICAgICAgICAgICBmcm96ZW5Gcm9tID0gcmV2b2NhdGlvbi5pcDtcbiAgICAgICAgfVxuICAgIH1cbiAgICBpZiAoZnJvemVuRnJvbSkge1xuICAgICAgICByZXR1cm4ge1xuICAgICAgICAgICAgYWNjZXB0ZWQ6IGZhbHNlLFxuICAgICAgICAgICAgcmVhc29uOiBgdGhhdCBtYWNoaW5lIGlzIGZyb3plbiwgaXQgd2FzIHVzZWQgZnJvbSAke2Zyb3plbkZyb219IHdoaWNoIGl0IGlzIG5vdCBhbGxvd2VkIGZyb21gLFxuICAgICAgICB9O1xuICAgIH1cblxuICAgIGlmIChtYWNoaW5lLmlwcy5pbmNsdWRlcyhpcCkpIHtcbiAgICAgICAgcmV0dXJuIHsgYWNjZXB0ZWQ6IHRydWUsIHJlYXNvbjogXCJcIiB9O1xuICAgIH1cblxuICAgIC8vIExpc3RlZCwgYnV0IHRhbGtpbmcgdG8gdXMgZnJvbSBzb21ld2hlcmUgaXQgc2hvdWxkIG5vdCBiZS4gUmVjb3JkZWQgb25jZSBmb3IgdGhpcyBtYWNoaW5lXG4gICAgLy8gYW5kIGFkZHJlc3MsIHNvIGJlaW5nIHRhbGtlZCB0byByZXBlYXRlZGx5IGRvZXMgbm90IHdyaXRlIHJlcGVhdGVkbHkuXG4gICAgbGV0IHBhaXIgPSBwYWlyS2V5KHsgZmluZ2VycHJpbnQ6IG1hY2hpbmVJZCwgaXAgfSk7XG4gICAgbGV0IGFscmVhZHlSZWNvcmRlZCA9IHJldm9jYXRpb25zLnNvbWUocmV2b2NhdGlvbiA9PlxuICAgICAgICBwYWlyS2V5KHsgZmluZ2VycHJpbnQ6IHJldm9jYXRpb24ubWFjaGluZUlkLCBpcDogcmV2b2NhdGlvbi5pcCB9KSA9PT0gcGFpcik7XG4gICAgaWYgKCFhbHJlYWR5UmVjb3JkZWQgJiYgIWFsbG93ZWRBZ2FpbihwYWlyKSkge1xuICAgICAgICBhd2FpdCByZWNvcmRNYWNoaW5lUmV2b2NhdGlvbih7IHNvdXJjZVVSTCwgbWFjaGluZUlkLCBpcCwgaG9zdExhYmVsOiBvcy5ob3N0bmFtZSgpIH0pO1xuICAgICAgICByZXR1cm4geyBhY2NlcHRlZDogZmFsc2UsIHJlYXNvbjogYHRoYXQgbWFjaGluZSBpcyBub3QgYWxsb3dlZCBmcm9tICR7aXB9LCBzbyBpdCBpcyBub3cgZnJvemVuIGV2ZXJ5d2hlcmVgIH07XG4gICAgfVxuICAgIHJldHVybiB7IGFjY2VwdGVkOiBmYWxzZSwgcmVhc29uOiBgdGhhdCBtYWNoaW5lIGlzIG5vdCBhbGxvd2VkIGZyb20gJHtpcH1gIH07XG59XG4iXX0=
+ /* _JS_SOURCE_HASH = "4f49b3c9f4a58987204c92820f6aca5ff7cf73325e697e849445299f06638103"; */

package/security/machines/dist/trustClient.ts.cache

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.main = exports.askIfTrusted = void 0;
+const identity_1 = require("./identity");
+// The other half of the demonstration: asks a server whether it trusts this machine. The answer
+// depends on the address this machine reaches the server from, which is why the client cannot
+// work it out alone.
+const TRUST_PATH = "/trusted";
+const USAGE = `Usage: yarn machineclient <url> <domain>
+
+Asks that server whether this machine is trusted, proving which machine it is with a signed packet.
+The server decides using the address we reach it from, so the answer is about how we are talking to
+it, not only about who we are.
+
+The domain is required: this machine has a different identity under each one, and the answer is
+about the identity we sign with.`;
+/** Asks one server whether it trusts this machine, as it is under this domain. */
+async function askIfTrusted(config) {
+    let { baseURL, domain } = config;
+    let packet = await (0, identity_1.signTrustPacket)(domain);
+    let url = `${baseURL.replace(/\/+$/, "")}${TRUST_PATH}`;
+    let response = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(packet),
+    });
+    return await response.json();
+}
+exports.askIfTrusted = askIfTrusted;
+async function main() {
+    let [baseURL, domain] = process.argv.slice(2);
+    if (!baseURL || !domain) {
+        throw new Error(USAGE);
+    }
+    let answer = await askIfTrusted({ baseURL, domain });
+    console.log(`${answer.trusted && "TRUSTED" || "NOT TRUSTED"} by ${baseURL}`);
+    console.log(`  machine ${answer.machineId || "(not established)"}`);
+    console.log(`  seen coming from ${answer.ip || "(unknown)"}`);
+    if (answer.reason) {
+        console.log(`  ${answer.reason}`);
+    }
+    if (!answer.trusted) {
+        process.exitCode = 1;
+    }
+}
+exports.main = main;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJ1c3RDbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ0cnVzdENsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSx5Q0FBNkM7QUFFN0MsZ0dBQWdHO0FBQ2hHLDhGQUE4RjtBQUM5RixxQkFBcUI7QUFDckIsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDO0FBQzlCLE1BQU0sS0FBSyxHQUFHOzs7Ozs7O2lDQU9tQixDQUFDO0FBU2xDLGtGQUFrRjtBQUMzRSxLQUFLLFVBQVUsWUFBWSxDQUFDLE1BQTJDO0lBQzFFLElBQUksRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2pDLElBQUksTUFBTSxHQUFHLE1BQU0sSUFBQSwwQkFBZSxFQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzNDLElBQUksR0FBRyxHQUFHLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLEdBQUcsVUFBVSxFQUFFLENBQUM7SUFDeEQsSUFBSSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsR0FBRyxFQUFFO1FBQzVCLE1BQU0sRUFBRSxNQUFNO1FBQ2QsT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFO1FBQy9DLElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQztLQUMvQixDQUFDLENBQUM7SUFDSCxPQUFPLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBaUIsQ0FBQztBQUNoRCxDQUFDO0FBVkQsb0NBVUM7QUFFTSxLQUFLLFVBQVUsSUFBSTtJQUN0QixJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzlDLElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFDRCxJQUFJLE1BQU0sR0FBRyxNQUFNLFlBQVksQ0FBQyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3JELE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxNQUFNLENBQUMsT0FBTyxJQUFJLFNBQVMsSUFBSSxhQUFhLE9BQU8sT0FBTyxFQUFFLENBQUMsQ0FBQztJQUM3RSxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsTUFBTSxDQUFDLFNBQVMsSUFBSSxtQkFBbUIsRUFBRSxDQUFDLENBQUM7SUFDcEUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxzQkFBc0IsTUFBTSxDQUFDLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQzlELElBQUksTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2hCLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUN0QyxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNsQixPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztJQUN6QixDQUFDO0FBQ0wsQ0FBQztBQWZELG9CQWVDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgc2lnblRydXN0UGFja2V0IH0gZnJvbSBcIi4vaWRlbnRpdHlcIjtcblxuLy8gVGhlIG90aGVyIGhhbGYgb2YgdGhlIGRlbW9uc3RyYXRpb246IGFza3MgYSBzZXJ2ZXIgd2hldGhlciBpdCB0cnVzdHMgdGhpcyBtYWNoaW5lLiBUaGUgYW5zd2VyXG4vLyBkZXBlbmRzIG9uIHRoZSBhZGRyZXNzIHRoaXMgbWFjaGluZSByZWFjaGVzIHRoZSBzZXJ2ZXIgZnJvbSwgd2hpY2ggaXMgd2h5IHRoZSBjbGllbnQgY2Fubm90XG4vLyB3b3JrIGl0IG91dCBhbG9uZS5cbmNvbnN0IFRSVVNUX1BBVEggPSBcIi90cnVzdGVkXCI7XG5jb25zdCBVU0FHRSA9IGBVc2FnZTogeWFybiBtYWNoaW5lY2xpZW50IDx1cmw+IDxkb21haW4+XG5cbkFza3MgdGhhdCBzZXJ2ZXIgd2hldGhlciB0aGlzIG1hY2hpbmUgaXMgdHJ1c3RlZCwgcHJvdmluZyB3aGljaCBtYWNoaW5lIGl0IGlzIHdpdGggYSBzaWduZWQgcGFja2V0LlxuVGhlIHNlcnZlciBkZWNpZGVzIHVzaW5nIHRoZSBhZGRyZXNzIHdlIHJlYWNoIGl0IGZyb20sIHNvIHRoZSBhbnN3ZXIgaXMgYWJvdXQgaG93IHdlIGFyZSB0YWxraW5nIHRvXG5pdCwgbm90IG9ubHkgYWJvdXQgd2hvIHdlIGFyZS5cblxuVGhlIGRvbWFpbiBpcyByZXF1aXJlZDogdGhpcyBtYWNoaW5lIGhhcyBhIGRpZmZlcmVudCBpZGVudGl0eSB1bmRlciBlYWNoIG9uZSwgYW5kIHRoZSBhbnN3ZXIgaXNcbmFib3V0IHRoZSBpZGVudGl0eSB3ZSBzaWduIHdpdGguYDtcblxuZXhwb3J0IHR5cGUgVHJ1c3RBbnN3ZXIgPSB7XG4gICAgdHJ1c3RlZDogYm9vbGVhbjtcbiAgICBtYWNoaW5lSWQ/OiBzdHJpbmc7XG4gICAgaXA/OiBzdHJpbmc7XG4gICAgcmVhc29uPzogc3RyaW5nO1xufTtcblxuLyoqIEFza3Mgb25lIHNlcnZlciB3aGV0aGVyIGl0IHRydXN0cyB0aGlzIG1hY2hpbmUsIGFzIGl0IGlzIHVuZGVyIHRoaXMgZG9tYWluLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGFza0lmVHJ1c3RlZChjb25maWc6IHsgYmFzZVVSTDogc3RyaW5nOyBkb21haW46IHN0cmluZyB9KTogUHJvbWlzZTxUcnVzdEFuc3dlcj4ge1xuICAgIGxldCB7IGJhc2VVUkwsIGRvbWFpbiB9ID0gY29uZmlnO1xuICAgIGxldCBwYWNrZXQgPSBhd2FpdCBzaWduVHJ1c3RQYWNrZXQoZG9tYWluKTtcbiAgICBsZXQgdXJsID0gYCR7YmFzZVVSTC5yZXBsYWNlKC9cXC8rJC8sIFwiXCIpfSR7VFJVU1RfUEFUSH1gO1xuICAgIGxldCByZXNwb25zZSA9IGF3YWl0IGZldGNoKHVybCwge1xuICAgICAgICBtZXRob2Q6IFwiUE9TVFwiLFxuICAgICAgICBoZWFkZXJzOiB7IFwiQ29udGVudC1UeXBlXCI6IFwiYXBwbGljYXRpb24vanNvblwiIH0sXG4gICAgICAgIGJvZHk6IEpTT04uc3RyaW5naWZ5KHBhY2tldCksXG4gICAgfSk7XG4gICAgcmV0dXJuIGF3YWl0IHJlc3BvbnNlLmpzb24oKSBhcyBUcnVzdEFuc3dlcjtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIG1haW4oKSB7XG4gICAgbGV0IFtiYXNlVVJMLCBkb21haW5dID0gcHJvY2Vzcy5hcmd2LnNsaWNlKDIpO1xuICAgIGlmICghYmFzZVVSTCB8fCAhZG9tYWluKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihVU0FHRSk7XG4gICAgfVxuICAgIGxldCBhbnN3ZXIgPSBhd2FpdCBhc2tJZlRydXN0ZWQoeyBiYXNlVVJMLCBkb21haW4gfSk7XG4gICAgY29uc29sZS5sb2coYCR7YW5zd2VyLnRydXN0ZWQgJiYgXCJUUlVTVEVEXCIgfHwgXCJOT1QgVFJVU1RFRFwifSBieSAke2Jhc2VVUkx9YCk7XG4gICAgY29uc29sZS5sb2coYCAgbWFjaGluZSAke2Fuc3dlci5tYWNoaW5lSWQgfHwgXCIobm90IGVzdGFibGlzaGVkKVwifWApO1xuICAgIGNvbnNvbGUubG9nKGAgIHNlZW4gY29taW5nIGZyb20gJHthbnN3ZXIuaXAgfHwgXCIodW5rbm93bilcIn1gKTtcbiAgICBpZiAoYW5zd2VyLnJlYXNvbikge1xuICAgICAgICBjb25zb2xlLmxvZyhgICAke2Fuc3dlci5yZWFzb259YCk7XG4gICAgfVxuICAgIGlmICghYW5zd2VyLnRydXN0ZWQpIHtcbiAgICAgICAgcHJvY2Vzcy5leGl0Q29kZSA9IDE7XG4gICAgfVxufVxuIl19
+ /* _JS_SOURCE_HASH = "51f52913bf4c7fbbeb7e5b3c70a7bc032fcc718b1eba1d8ed233fe7fe01617d2"; */

package/security/machines/dist/trustState.ts.cache

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.unrevokeInEffect = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../authorizedKeys/daemon/paths");
+const sources_1 = require("../authorizedKeys/sources");
+const discord_1 = require("../notifications/discord");
+// When this machine first saw each unrevoke, by unrevoke id.
+//
+// The same rule the ssh keys get, for the same reason: an unrevoke waits an hour before it counts,
+// so a signing key that was itself stolen cannot instantly undo the revocation that shut it out.
+// Counted from when we first saw it, never from a time the file states - whoever wrote the file
+// chooses that, and would choose an hour ago.
+//
+// On disk, because a check runs in whatever process happens to be asking. Measuring from process
+// start would restart the hour on every request and the unrevoke would never arrive. Kept beside
+// the repo keys rather than in the daemon's state, because this has to work on a machine with no
+// daemon, which is most of them.
+const FIRST_SEEN_FILE = "machine-unrevokes.json";
+function firstSeenPath() {
+    return path_1.default.join((0, sources_1.keysDir)(), FIRST_SEEN_FILE);
+}
+async function readFirstSeen() {
+    try {
+        return JSON.parse(await promises_1.default.readFile(firstSeenPath(), "utf8"));
+    }
+    catch (e) {
+        // Never written, or unreadable. Either way nothing has been seen before now.
+        return {};
+    }
+}
+/** Whether an unrevoke has waited out its hour, recording the first sighting if this is one.
+
+    Returns false the first time, which is the point: seeing an unrevoke is not the same as
+    honouring it. */
+async function unrevokeInEffect(unrevokeId) {
+    let firstSeen = await readFirstSeen();
+    let seenAt = firstSeen[unrevokeId];
+    if (!seenAt) {
+        seenAt = Date.now();
+        firstSeen[unrevokeId] = seenAt;
+        await promises_1.default.mkdir(path_1.default.dirname(firstSeenPath()), { recursive: true, mode: 0o700 });
+        await promises_1.default.writeFile(firstSeenPath(), JSON.stringify(firstSeen, undefined, 4) + "\n");
+    }
+    if (Date.now() - seenAt < paths_1.UNREVOKE_DELAY) {
+        console.log(`Holding the unrevoke ${unrevokeId} until ${(0, discord_1.messageTimestamp)(new Date(seenAt + paths_1.UNREVOKE_DELAY))}`);
+        return false;
+    }
+    return true;
+}
+exports.unrevokeInEffect = unrevokeInEffect;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJ1c3RTdGF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInRydXN0U3RhdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUN4QiwwREFBZ0U7QUFDaEUsdURBQW9EO0FBQ3BELHNEQUE0RDtBQUU1RCw2REFBNkQ7QUFDN0QsRUFBRTtBQUNGLG1HQUFtRztBQUNuRyxpR0FBaUc7QUFDakcsZ0dBQWdHO0FBQ2hHLDhDQUE4QztBQUM5QyxFQUFFO0FBQ0YsaUdBQWlHO0FBQ2pHLGlHQUFpRztBQUNqRyxpR0FBaUc7QUFDakcsaUNBQWlDO0FBQ2pDLE1BQU0sZUFBZSxHQUFHLHdCQUF3QixDQUFDO0FBRWpELFNBQVMsYUFBYTtJQUNsQixPQUFPLGNBQUksQ0FBQyxJQUFJLENBQUMsSUFBQSxpQkFBTyxHQUFFLEVBQUUsZUFBZSxDQUFDLENBQUM7QUFDakQsQ0FBQztBQUVELEtBQUssVUFBVSxhQUFhO0lBQ3hCLElBQUksQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCw2RUFBNkU7UUFDN0UsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0FBQ0wsQ0FBQztBQUVEOzs7b0JBR29CO0FBQ2IsS0FBSyxVQUFVLGdCQUFnQixDQUFDLFVBQWtCO0lBQ3JELElBQUksU0FBUyxHQUFHLE1BQU0sYUFBYSxFQUFFLENBQUM7SUFDdEMsSUFBSSxNQUFNLEdBQUcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ25DLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNWLE1BQU0sR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDcEIsU0FBUyxDQUFDLFVBQVUsQ0FBQyxHQUFHLE1BQU0sQ0FBQztRQUMvQixNQUFNLGtCQUFFLENBQUMsS0FBSyxDQUFDLGNBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxFQUFFLENBQUMsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDaEYsTUFBTSxrQkFBRSxDQUFDLFNBQVMsQ0FBQyxhQUFhLEVBQUUsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLE1BQU0sR0FBRyxzQkFBYyxFQUFFLENBQUM7UUFDdkMsT0FBTyxDQUFDLEdBQUcsQ0FDUCx3QkFBd0IsVUFBVSxVQUFVLElBQUEsMEJBQWdCLEVBQUMsSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLHNCQUFjLENBQUMsQ0FBQyxFQUFFLENBQ3BHLENBQUM7UUFDRixPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQztBQWhCRCw0Q0FnQkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgcGF0aCBmcm9tIFwicGF0aFwiO1xuaW1wb3J0IHsgVU5SRVZPS0VfREVMQVkgfSBmcm9tIFwiLi4vYXV0aG9yaXplZEtleXMvZGFlbW9uL3BhdGhzXCI7XG5pbXBvcnQgeyBrZXlzRGlyIH0gZnJvbSBcIi4uL2F1dGhvcml6ZWRLZXlzL3NvdXJjZXNcIjtcbmltcG9ydCB7IG1lc3NhZ2VUaW1lc3RhbXAgfSBmcm9tIFwiLi4vbm90aWZpY2F0aW9ucy9kaXNjb3JkXCI7XG5cbi8vIFdoZW4gdGhpcyBtYWNoaW5lIGZpcnN0IHNhdyBlYWNoIHVucmV2b2tlLCBieSB1bnJldm9rZSBpZC5cbi8vXG4vLyBUaGUgc2FtZSBydWxlIHRoZSBzc2gga2V5cyBnZXQsIGZvciB0aGUgc2FtZSByZWFzb246IGFuIHVucmV2b2tlIHdhaXRzIGFuIGhvdXIgYmVmb3JlIGl0IGNvdW50cyxcbi8vIHNvIGEgc2lnbmluZyBrZXkgdGhhdCB3YXMgaXRzZWxmIHN0b2xlbiBjYW5ub3QgaW5zdGFudGx5IHVuZG8gdGhlIHJldm9jYXRpb24gdGhhdCBzaHV0IGl0IG91dC5cbi8vIENvdW50ZWQgZnJvbSB3aGVuIHdlIGZpcnN0IHNhdyBpdCwgbmV2ZXIgZnJvbSBhIHRpbWUgdGhlIGZpbGUgc3RhdGVzIC0gd2hvZXZlciB3cm90ZSB0aGUgZmlsZVxuLy8gY2hvb3NlcyB0aGF0LCBhbmQgd291bGQgY2hvb3NlIGFuIGhvdXIgYWdvLlxuLy9cbi8vIE9uIGRpc2ssIGJlY2F1c2UgYSBjaGVjayBydW5zIGluIHdoYXRldmVyIHByb2Nlc3MgaGFwcGVucyB0byBiZSBhc2tpbmcuIE1lYXN1cmluZyBmcm9tIHByb2Nlc3Ncbi8vIHN0YXJ0IHdvdWxkIHJlc3RhcnQgdGhlIGhvdXIgb24gZXZlcnkgcmVxdWVzdCBhbmQgdGhlIHVucmV2b2tlIHdvdWxkIG5ldmVyIGFycml2ZS4gS2VwdCBiZXNpZGVcbi8vIHRoZSByZXBvIGtleXMgcmF0aGVyIHRoYW4gaW4gdGhlIGRhZW1vbidzIHN0YXRlLCBiZWNhdXNlIHRoaXMgaGFzIHRvIHdvcmsgb24gYSBtYWNoaW5lIHdpdGggbm9cbi8vIGRhZW1vbiwgd2hpY2ggaXMgbW9zdCBvZiB0aGVtLlxuY29uc3QgRklSU1RfU0VFTl9GSUxFID0gXCJtYWNoaW5lLXVucmV2b2tlcy5qc29uXCI7XG5cbmZ1bmN0aW9uIGZpcnN0U2VlblBhdGgoKSB7XG4gICAgcmV0dXJuIHBhdGguam9pbihrZXlzRGlyKCksIEZJUlNUX1NFRU5fRklMRSk7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIHJlYWRGaXJzdFNlZW4oKTogUHJvbWlzZTx7IFt1bnJldm9rZUlkOiBzdHJpbmddOiBudW1iZXIgfT4ge1xuICAgIHRyeSB7XG4gICAgICAgIHJldHVybiBKU09OLnBhcnNlKGF3YWl0IGZzLnJlYWRGaWxlKGZpcnN0U2VlblBhdGgoKSwgXCJ1dGY4XCIpKTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIC8vIE5ldmVyIHdyaXR0ZW4sIG9yIHVucmVhZGFibGUuIEVpdGhlciB3YXkgbm90aGluZyBoYXMgYmVlbiBzZWVuIGJlZm9yZSBub3cuXG4gICAgICAgIHJldHVybiB7fTtcbiAgICB9XG59XG5cbi8qKiBXaGV0aGVyIGFuIHVucmV2b2tlIGhhcyB3YWl0ZWQgb3V0IGl0cyBob3VyLCByZWNvcmRpbmcgdGhlIGZpcnN0IHNpZ2h0aW5nIGlmIHRoaXMgaXMgb25lLlxuXG4gICAgUmV0dXJucyBmYWxzZSB0aGUgZmlyc3QgdGltZSwgd2hpY2ggaXMgdGhlIHBvaW50OiBzZWVpbmcgYW4gdW5yZXZva2UgaXMgbm90IHRoZSBzYW1lIGFzXG4gICAgaG9ub3VyaW5nIGl0LiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHVucmV2b2tlSW5FZmZlY3QodW5yZXZva2VJZDogc3RyaW5nKSB7XG4gICAgbGV0IGZpcnN0U2VlbiA9IGF3YWl0IHJlYWRGaXJzdFNlZW4oKTtcbiAgICBsZXQgc2VlbkF0ID0gZmlyc3RTZWVuW3VucmV2b2tlSWRdO1xuICAgIGlmICghc2VlbkF0KSB7XG4gICAgICAgIHNlZW5BdCA9IERhdGUubm93KCk7XG4gICAgICAgIGZpcnN0U2Vlblt1bnJldm9rZUlkXSA9IHNlZW5BdDtcbiAgICAgICAgYXdhaXQgZnMubWtkaXIocGF0aC5kaXJuYW1lKGZpcnN0U2VlblBhdGgoKSksIHsgcmVjdXJzaXZlOiB0cnVlLCBtb2RlOiAwbzcwMCB9KTtcbiAgICAgICAgYXdhaXQgZnMud3JpdGVGaWxlKGZpcnN0U2VlblBhdGgoKSwgSlNPTi5zdHJpbmdpZnkoZmlyc3RTZWVuLCB1bmRlZmluZWQsIDQpICsgXCJcXG5cIik7XG4gICAgfVxuICAgIGlmIChEYXRlLm5vdygpIC0gc2VlbkF0IDwgVU5SRVZPS0VfREVMQVkpIHtcbiAgICAgICAgY29uc29sZS5sb2coXG4gICAgICAgICAgICBgSG9sZGluZyB0aGUgdW5yZXZva2UgJHt1bnJldm9rZUlkfSB1bnRpbCAke21lc3NhZ2VUaW1lc3RhbXAobmV3IERhdGUoc2VlbkF0ICsgVU5SRVZPS0VfREVMQVkpKX1gXG4gICAgICAgICk7XG4gICAgICAgIHJldHVybiBmYWxzZTtcbiAgICB9XG4gICAgcmV0dXJuIHRydWU7XG59XG4iXX0=
+ /* _JS_SOURCE_HASH = "eaf8b0fd92f88a8682308f89a16f004ca1c28ff8bfcd90a56c734f63669c2aeb"; */

package/security/machines/identity.ts

@@ -0,0 +1,199 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+import { generateTestCA, getMachineId, identityStorageKey, IdentityStorageType, verifyMachineIdForPublicKey } from "../../misc/https/certs";
+import { runOverSSH, writeRemoteFile } from "../helpers/remoteSSH";
+
+// A machine's identity is the CA it generated for itself, kept in one file in the home directory
+// of whoever runs it. The name carries the domain it belongs to, so a machine can hold one per
+// domain, and the id itself is a hash of that CA's public key - which is why a machine cannot
+// claim to be another one without holding its key.
+const IDENTITY_PREFIX = "keystore_";
+const IDENTITY_SUFFIX = `_${identityStorageKey}.json`;
+// How stale a signed packet may be. Long enough for clock skew between two machines, short enough
+// that a captured packet is not worth replaying.
+export const PACKET_LIFETIME = 2 * 60 * 1000;
+
+export type Identity = {
+    machineId: string;
+    domain: string;
+    fullDomain: string;
+    fileName: string;
+};
+
+function identityFileName(domain: string) {
+    return `${IDENTITY_PREFIX}${domain}${IDENTITY_SUFFIX}`;
+}
+
+/** The domain out of an identity file's name, or "" if it is not one. */
+function domainOfFileName(fileName: string) {
+    if (!fileName.startsWith(IDENTITY_PREFIX) || !fileName.endsWith(IDENTITY_SUFFIX)) {
+        return "";
+    }
+    return fileName.slice(IDENTITY_PREFIX.length, -IDENTITY_SUFFIX.length);
+}
+
+function describeIdentity(config: { domain: string; stored: IdentityStorageType }) {
+    let { domain, stored } = config;
+    return {
+        machineId: getMachineId(stored.domain, domain),
+        domain,
+        fullDomain: stored.domain,
+        fileName: identityFileName(domain),
+    };
+}
+
+/** Every domain this machine holds an identity under. A machine has one identity per domain, and
+    they are different machine ids, so which one is meant is a real question rather than a detail. */
+export async function localDomains() {
+    let domains: string[] = [];
+    for (let name of (await fs.readdir(os.homedir()).catch(() => [] as string[])).sort()) {
+        let domain = domainOfFileName(name);
+        if (domain) {
+            domains.push(domain);
+        }
+    }
+    return domains;
+}
+
+/** This machine's identity under one domain. Undefined when it has none under that one.
+
+    The domain is required everywhere it appears. A machine has a different identity, and so a
+    different machine id, under every domain it runs under, so "this machine" on its own does not
+    name anything: answering under the wrong one means answering as a machine we are not. */
+export async function localIdentity(domain: string): Promise<Identity | undefined> {
+    if (!domain) {
+        throw new Error(`Expected a domain, was ${JSON.stringify(domain)}`);
+    }
+    let contents = await fs.readFile(path.join(os.homedir(), identityFileName(domain)), "utf8").catch(() => "");
+    if (!contents) {
+        return undefined;
+    }
+    return describeIdentity({ domain, stored: JSON.parse(contents) });
+}
+
+/** This machine's identity and its keys, for signing. */
+export async function localIdentityKeys(domain: string) {
+    let identity = await localIdentity(domain);
+    if (!identity) {
+        throw new Error(
+            `Expected an identity for ${domain} at ${path.join(os.homedir(), identityFileName(domain))},`
+            + ` there is none.\n`
+            + `This machine has: ${(await localDomains()).join(", ") || "no identities at all"}`
+        );
+    }
+    let stored: IdentityStorageType = JSON.parse(
+        await fs.readFile(path.join(os.homedir(), identity.fileName), "utf8")
+    );
+    return { identity, stored };
+}
+
+/** The identity of another machine under one domain, over ssh. Undefined when it has none under
+    that domain, whatever else it may have under others. */
+export async function remoteIdentity(host: string, domain: string): Promise<Identity | undefined> {
+    if (!domain) {
+        throw new Error(`Expected a domain, was ${JSON.stringify(domain)}`);
+    }
+    let home = (await runOverSSH({ host, script: `echo $HOME` })).stdout.trim();
+    if (!home) {
+        throw new Error(`Expected ${host} to report a home directory, it reported nothing`);
+    }
+    let contents = await runOverSSH({
+        host,
+        script: `cat ${home}/${identityFileName(domain)} 2>/dev/null || true`,
+    });
+    if (!contents.stdout.trim()) {
+        return undefined;
+    }
+    return describeIdentity({ domain, stored: JSON.parse(contents.stdout) });
+}
+
+/** Gives a machine an identity it does not have yet, by generating one here and writing it there.
+
+    The CA is self signed and never leaves that machine afterwards, so generating it here is only a
+    convenience: what matters is that the private key ends up in one place and the id is the hash
+    of its public half. */
+export async function createRemoteIdentity(config: { host: string; domain: string }) {
+    let { host, domain } = config;
+    let generated = generateTestCA(domain);
+    let stored: IdentityStorageType = {
+        domain: generated.domain,
+        certB64: generated.cert.toString("base64"),
+        keyB64: generated.key.toString("base64"),
+    };
+    let home = (await runOverSSH({ host, script: `echo $HOME` })).stdout.trim();
+    await writeRemoteFile({
+        host,
+        filePath: `${home}/${identityFileName(domain)}`,
+        contents: JSON.stringify(stored),
+        fileMode: "600",
+        // The home directory is already there, this is only what it is created with if it is not.
+        directoryMode: "700",
+    });
+    return describeIdentity({ domain, stored });
+}
+
+/** The raw ed25519 public key out of a certificate, which is what the machine id is a hash of. */
+function publicKeyBytes(certPEM: string) {
+    let spki = new crypto.X509Certificate(certPEM).publicKey.export({ type: "spki", format: "der" });
+    // An ed25519 SPKI is a fixed 12 byte header followed by the 32 byte key.
+    return spki.subarray(spki.length - 32);
+}
+
+export type TrustPacket = {
+    machineId: string;
+    certB64: string;
+    signedAt: number;
+    signatureB64: string;
+};
+
+/** Proves we hold the private key behind our machine id, right now. The signature covers the id
+    and the time, so the packet cannot be replayed later or reused for another id. */
+export async function signTrustPacket(domain: string): Promise<TrustPacket> {
+    let { identity, stored } = await localIdentityKeys(domain);
+    let signedAt = Date.now();
+    let signature = crypto.sign(
+        null,
+        Buffer.from(`${identity.machineId} ${signedAt}`),
+        crypto.createPrivateKey(Buffer.from(stored.keyB64, "base64").toString())
+    );
+    return {
+        machineId: identity.machineId,
+        certB64: stored.certB64,
+        signedAt,
+        signatureB64: signature.toString("base64"),
+    };
+}
+
+/** Whether a packet really came from the machine it names. Says why when it did not, because
+    "this is not that machine" and "this arrived too late" are different problems. */
+export function verifyTrustPacket(packet: TrustPacket) {
+    if (!packet || !packet.machineId || !packet.certB64 || !packet.signatureB64) {
+        return { valid: false, problem: "the packet is missing fields" };
+    }
+    if (Math.abs(Date.now() - packet.signedAt) > PACKET_LIFETIME) {
+        return { valid: false, problem: `it was signed ${Math.round((Date.now() - packet.signedAt) / 1000)}s ago` };
+    }
+    let certPEM = Buffer.from(packet.certB64, "base64").toString();
+    let publicKey: crypto.KeyObject;
+    try {
+        publicKey = new crypto.X509Certificate(certPEM).publicKey;
+    } catch (e) {
+        return { valid: false, problem: `its certificate could not be read, ${e}` };
+    }
+    // The id is a hash of the public key, so this is what stops a machine claiming another's id.
+    if (!verifyMachineIdForPublicKey({ machineId: packet.machineId, publicKey: publicKeyBytes(certPEM) })) {
+        return { valid: false, problem: "the machine id does not belong to that certificate" };
+    }
+    let signed = crypto.verify(
+        null,
+        Buffer.from(`${packet.machineId} ${packet.signedAt}`),
+        publicKey,
+        Buffer.from(packet.signatureB64, "base64")
+    );
+    if (!signed) {
+        return { valid: false, problem: "the signature does not check out" };
+    }
+    return { valid: true, problem: "" };
+}