cdk-secure-string-parameter
Version:
SecureStringParameter Custom Resource for CDK. Enables storing encrypted secrets in version control and using those values in creating SSM SecureString Parameters
155 lines • 23.3 kB
JavaScript
"use strict";
var _a;
Object.defineProperty(exports, "__esModule", { value: true });
exports.SecureStringParameter = exports.ValueType = void 0;
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
const crypto_1 = require("crypto");
const aws_cdk_lib_1 = require("aws-cdk-lib");
const aws_iam_1 = require("aws-cdk-lib/aws-iam");
const aws_kms_1 = require("aws-cdk-lib/aws-kms");
const aws_logs_1 = require("aws-cdk-lib/aws-logs");
const aws_ssm_1 = require("aws-cdk-lib/aws-ssm");
const custom_resources_1 = require("aws-cdk-lib/custom-resources");
const secure_string_parameter_handler_function_1 = require("./lambda/secure-string-parameter-handler-function");
const util_1 = require("./util");
/**
* The type of the stringValue.
*/
var ValueType;
(function (ValueType) {
/**
* Indicates that the value of this parameter is encrypted with a kms key.
*/
ValueType["ENCRYPTED"] = "encrypted";
/**
* Indicates that the value of this parameter is in plain text.
*/
ValueType["PLAINTEXT"] = "plaintext";
})(ValueType || (exports.ValueType = ValueType = {}));
/**
* Creates a new SecureString SSM Parameter.
*
* If the valueType property is set to `encrypted`, the actual SSM SecureString Parameter will be created with a decrypted value from the stringValue property.
* @resource Custom::SecureStringParameter
*/
class SecureStringParameter extends aws_cdk_lib_1.Resource {
/**
* Reference object for this parameter (compat with newer CDK).
*/
get parameterRef() {
return {
parameterName: this.parameterName,
};
}
constructor(scope, id, props) {
super(scope, id);
this.tags = new aws_cdk_lib_1.TagManager(aws_cdk_lib_1.TagType.MAP, 'Custom::SecureStringParameter');
// We need to manually add tags from StackProps.
// Tags added with Tags.of(scope).add() are handled automatically.
aws_cdk_lib_1.Stack.of(this).tags.renderTags()?.forEach((tag) => {
this.tags.setTag(tag.Key, tag.Value);
});
this.valueType = props.valueType;
this.encryptionKey = props.encryptionKey;
this.stringValue = props.stringValue;
this.parameterType = 'SecureString';
this.parameterName = props.parameterName ?? (0, crypto_1.randomUUID)();
this.parameterArn = (0, util_1.arnForParameterName)(this, this.parameterName, { simpleName: props.simpleName });
this.eventHandler = this.getOrCreateHandler();
if (this.encryptionKey) {
const isIAlias = (key) => 'aliasTargetKey' in key;
const isAlias = (key) => key instanceof aws_kms_1.Alias;
const getKey = (key) => {
if (isAlias(key))
return key.aliasTargetKey;
if (isIAlias(key))
return aws_kms_1.Key.fromLookup(this, 'key', { aliasName: key.aliasName });
return key;
};
const key = getKey(this.encryptionKey);
this.eventHandler.addToRolePolicy(new aws_iam_1.PolicyStatement({
effect: aws_iam_1.Effect.ALLOW,
resources: [key.keyArn],
actions: ['kms:Decrypt', 'kms:Encrypt'],
}));
}
this.provider = this.getOrCreateProvider();
const properties = {
allowedPattern: props.allowedPattern,
description: props.description,
encryptionKey: this.encryptionKey?.keyId,
name: this.parameterName,
tags: this.tags.renderedTags,
tier: props.tier,
value: this.stringValue,
valueType: this.valueType,
};
new aws_cdk_lib_1.CustomResource(this, id, {
serviceToken: this.provider.serviceToken,
resourceType: 'Custom::SecureStringParameter',
removalPolicy: props.removalPolicy,
properties,
pascalCaseProperties: true,
});
}
grantRead(grantee) {
return this.asStringParameter().grantRead(grantee);
}
grantWrite(grantee) {
return this.asStringParameter().grantWrite(grantee);
}
/**
* Returns this parameter as a native StringParameter.
*/
asStringParameter() {
if (!this.stringParameter) {
this.stringParameter = aws_ssm_1.StringParameter.fromSecureStringParameterAttributes(this, 'StringParameter', {
parameterName: this.parameterName,
});
}
return this.stringParameter;
}
getOrCreateHandler() {
const id = 'SecureStringParameterCustomResourceHandler';
const stack = aws_cdk_lib_1.Stack.of(this);
const existing = stack.node.tryFindChild(id);
if (existing)
return existing;
const eventHandler = new secure_string_parameter_handler_function_1.SecureStringParameterHandlerFunction(stack, id, {
initialPolicy: [new aws_iam_1.PolicyStatement({
effect: aws_iam_1.Effect.ALLOW,
resources: ['*'], // Must allow * to handle parameter name changes
actions: [
'ssm:PutParameter',
'ssm:DeleteParameter',
'ssm:GetParameters',
'ssm:ListTagsForResource',
'ssm:AddTagsToResource',
'ssm:RemoveTagsFromResource',
],
})],
logGroup: new aws_logs_1.LogGroup(this, 'SecureStringParameterHandlerLogGroup', {
retention: aws_logs_1.RetentionDays.ONE_WEEK,
}),
});
return eventHandler;
}
getOrCreateProvider() {
const id = 'SecureStringParameterCustomResourceProvider';
const stack = aws_cdk_lib_1.Stack.of(this);
const existing = stack.node.tryFindChild(id);
if (existing)
return existing;
const provider = new custom_resources_1.Provider(stack, id, {
onEventHandler: this.eventHandler,
logGroup: new aws_logs_1.LogGroup(this, 'SecureStringParameterProviderLogGroup', {
retention: aws_logs_1.RetentionDays.ONE_WEEK,
}),
});
return provider;
}
}
exports.SecureStringParameter = SecureStringParameter;
_a = JSII_RTTI_SYMBOL_1;
SecureStringParameter[_a] = { fqn: "cdk-secure-string-parameter.SecureStringParameter", version: "0.0.22" };
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjdXJlLXN0cmluZy1wYXJhbWV0ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvc2VjdXJlLXN0cmluZy1wYXJhbWV0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxtQ0FBb0M7QUFDcEMsNkNBQTZHO0FBQzdHLGlEQUFpRjtBQUNqRixpREFBK0Q7QUFFL0QsbURBQStEO0FBQy9ELGlEQUFpSTtBQUNqSSxtRUFBd0Q7QUFFeEQsZ0hBQXlHO0FBRXpHLGlDQUE2QztBQUU3Qzs7R0FFRztBQUNILElBQVksU0FTWDtBQVRELFdBQVksU0FBUztJQUNuQjs7T0FFRztJQUNILG9DQUF1QixDQUFBO0lBQ3ZCOztPQUVHO0lBQ0gsb0NBQXVCLENBQUE7QUFDekIsQ0FBQyxFQVRXLFNBQVMseUJBQVQsU0FBUyxRQVNwQjtBQTRERDs7Ozs7R0FLRztBQUNILE1BQWEscUJBQXNCLFNBQVEsc0JBQVE7SUFlakQ7O09BRUc7SUFDSCxJQUFJLFlBQVk7UUFDZCxPQUFPO1lBQ0wsYUFBYSxFQUFFLElBQUksQ0FBQyxhQUFhO1NBQ2xDLENBQUM7SUFDSixDQUFDO0lBTUQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFpQztRQUN6RSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRWpCLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSx3QkFBVSxDQUFDLHFCQUFPLENBQUMsR0FBRyxFQUFFLCtCQUErQixDQUFDLENBQUM7UUFDekUsZ0RBQWdEO1FBQ2hELGtFQUFrRTtRQUNsRSxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLEVBQUUsT0FBTyxDQUFDLENBQUMsR0FBYSxFQUFFLEVBQUU7WUFDMUQsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkMsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsU0FBUyxHQUFHLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDakMsSUFBSSxDQUFDLGFBQWEsR0FBRyxLQUFLLENBQUMsYUFBYSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxXQUFXLEdBQUcsS0FBSyxDQUFDLFdBQVcsQ0FBQztRQUNyQyxJQUFJLENBQUMsYUFBYSxHQUFHLGNBQWMsQ0FBQztRQUNwQyxJQUFJLENBQUMsYUFBYSxHQUFHLEtBQUssQ0FBQyxhQUFhLElBQUksSUFBQSxtQkFBVSxHQUFFLENBQUM7UUFDekQsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFBLDBCQUFtQixFQUFDLElBQUksRUFBRSxJQUFJLENBQUMsYUFBYSxFQUFFLEVBQUUsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBRXBHLElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFFOUMsSUFBSSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDdkIsTUFBTSxRQUFRLEdBQUcsQ0FBQyxHQUFTLEVBQWlCLEVBQUUsQ0FBQyxnQkFBZ0IsSUFBSSxHQUFHLENBQUM7WUFDdkUsTUFBTSxPQUFPLEdBQUcsQ0FBQyxHQUFTLEVBQWdCLEVBQUUsQ0FBQyxHQUFHLFlBQVksZUFBSyxDQUFDO1lBQ2xFLE1BQU0sTUFBTSxHQUFHLENBQUMsR0FBUyxFQUFRLEVBQUU7Z0JBQ2pDLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQztvQkFBRSxPQUFPLEdBQUcsQ0FBQyxjQUFjLENBQUM7Z0JBQzVDLElBQUksUUFBUSxDQUFDLEdBQUcsQ0FBQztvQkFBRSxPQUFPLGFBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxHQUFHLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztnQkFDcEYsT0FBTyxHQUFHLENBQUM7WUFDYixDQUFDLENBQUM7WUFDRixNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQ3ZDLElBQUksQ0FBQyxZQUFZLENBQUMsZUFBZSxDQUMvQixJQUFJLHlCQUFlLENBQUM7Z0JBQ2xCLE1BQU0sRUFBRSxnQkFBTSxDQUFDLEtBQUs7Z0JBQ3BCLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUM7Z0JBQ3ZCLE9BQU8sRUFBRSxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUM7YUFDeEMsQ0FBQyxDQUNILENBQUM7UUFDSixDQUFDO1FBRUQsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztRQUUzQyxNQUFNLFVBQVUsR0FBdUQ7WUFDckUsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjO1lBQ3BDLFdBQVcsRUFBRSxLQUFLLENBQUMsV0FBVztZQUM5QixhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWEsRUFBRSxLQUFLO1lBQ3hDLElBQUksRUFBRSxJQUFJLENBQUMsYUFBYTtZQUN4QixJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUE2RDtZQUM3RSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7WUFDaEIsS0FBSyxFQUFFLElBQUksQ0FBQyxXQUFXO1lBQ3ZCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztTQUMxQixDQUFDO1FBRUYsSUFBSSw0QkFBYyxDQUFDLElBQUksRUFBRSxFQUFFLEVBQUU7WUFDM0IsWUFBWSxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsWUFBWTtZQUN4QyxZQUFZLEVBQUUsK0JBQStCO1lBQzdDLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYTtZQUNsQyxVQUFVO1lBQ1Ysb0JBQW9CLEVBQUUsSUFBSTtTQUMzQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsU0FBUyxDQUFDLE9BQW1CO1FBQzNCLE9BQU8sSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFFRCxVQUFVLENBQUMsT0FBbUI7UUFDNUIsT0FBTyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdEQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsaUJBQWlCO1FBQ2YsSUFBSSxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsZUFBZSxHQUFHLHlCQUFlLENBQUMsbUNBQW1DLENBQUMsSUFBSSxFQUFFLGlCQUFpQixFQUFFO2dCQUNsRyxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWE7YUFDbEMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQztJQUM5QixDQUFDO0lBRU8sa0JBQWtCO1FBQ3hCLE1BQU0sRUFBRSxHQUFHLDRDQUE0QyxDQUFDO1FBQ3hELE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdCLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLElBQUksUUFBUTtZQUFFLE9BQU8sUUFBcUIsQ0FBQztRQUMzQyxNQUFNLFlBQVksR0FBRyxJQUFJLCtFQUFvQyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDdkUsYUFBYSxFQUFFLENBQUMsSUFBSSx5QkFBZSxDQUFDO29CQUNsQyxNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO29CQUNwQixTQUFTLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxnREFBZ0Q7b0JBQ2xFLE9BQU8sRUFBRTt3QkFDUCxrQkFBa0I7d0JBQ2xCLHFCQUFxQjt3QkFDckIsbUJBQW1CO3dCQUNuQix5QkFBeUI7d0JBQ3pCLHVCQUF1Qjt3QkFDdkIsNEJBQTRCO3FCQUM3QjtpQkFDRixDQUFDLENBQUM7WUFDSCxRQUFRLEVBQUUsSUFBSSxtQkFBUSxDQUFDLElBQUksRUFBRSxzQ0FBc0MsRUFBRTtnQkFDbkUsU0FBUyxFQUFFLHdCQUFhLENBQUMsUUFBUTthQUNsQyxDQUFDO1NBQ0gsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVPLG1CQUFtQjtRQUN6QixNQUFNLEVBQUUsR0FBRyw2Q0FBNkMsQ0FBQztRQUN6RCxNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QixNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3QyxJQUFJLFFBQVE7WUFBRSxPQUFPLFFBQW9CLENBQUM7UUFDMUMsTUFBTSxRQUFRLEdBQUcsSUFBSSwyQkFBUSxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDdkMsY0FBYyxFQUFFLElBQUksQ0FBQyxZQUFZO1lBQ2pDLFFBQVEsRUFBRSxJQUFJLG1CQUFRLENBQUMsSUFBSSxFQUFFLHVDQUF1QyxFQUFFO2dCQUNwRSxTQUFTLEVBQUUsd0JBQWEsQ0FBQyxRQUFRO2FBQ2xDLENBQUM7U0FDSCxDQUFDLENBQUM7UUFDSCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDOztBQWhKSCxzREFpSkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyByYW5kb21VVUlEIH0gZnJvbSAnY3J5cHRvJztcbmltcG9ydCB7IEN1c3RvbVJlc291cmNlLCBJVGFnZ2FibGUsIFJlbW92YWxQb2xpY3ksIFJlc291cmNlLCBTdGFjaywgVGFnTWFuYWdlciwgVGFnVHlwZSB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IEVmZmVjdCwgR3JhbnQsIElHcmFudGFibGUsIFBvbGljeVN0YXRlbWVudCB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0IHsgQWxpYXMsIElBbGlhcywgSUtleSwgS2V5IH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWttcyc7XG5pbXBvcnQgeyBJRnVuY3Rpb24gfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtbGFtYmRhJztcbmltcG9ydCB7IExvZ0dyb3VwLCBSZXRlbnRpb25EYXlzIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWxvZ3MnO1xuaW1wb3J0IHsgSVN0cmluZ1BhcmFtZXRlciwgUGFyYW1ldGVyRGF0YVR5cGUsIFBhcmFtZXRlck9wdGlvbnMsIFBhcmFtZXRlclJlZmVyZW5jZSwgU3RyaW5nUGFyYW1ldGVyIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLXNzbSc7XG5pbXBvcnQgeyBQcm92aWRlciB9IGZyb20gJ2F3cy1jZGstbGliL2N1c3RvbS1yZXNvdXJjZXMnO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBTZWN1cmVTdHJpbmdQYXJhbWV0ZXJIYW5kbGVyRnVuY3Rpb24gfSBmcm9tICcuL2xhbWJkYS9zZWN1cmUtc3RyaW5nLXBhcmFtZXRlci1oYW5kbGVyLWZ1bmN0aW9uJztcbmltcG9ydCB7IFNlY3VyZVN0cmluZ1BhcmFtZXRlclJlc291cmNlUHJvcGVydGllcyB9IGZyb20gJy4vbGFtYmRhL3NlY3VyZS1zdHJpbmctcGFyYW1ldGVyLWhhbmRsZXIubGFtYmRhJztcbmltcG9ydCB7IGFybkZvclBhcmFtZXRlck5hbWUgfSBmcm9tICcuL3V0aWwnO1xuXG4vKipcbiAqIFRoZSB0eXBlIG9mIHRoZSBzdHJpbmdWYWx1ZS5cbiAqL1xuZXhwb3J0IGVudW0gVmFsdWVUeXBlIHtcbiAgLyoqXG4gICAqIEluZGljYXRlcyB0aGF0IHRoZSB2YWx1ZSBvZiB0aGlzIHBhcmFtZXRlciBpcyBlbmNyeXB0ZWQgd2l0aCBhIGttcyBrZXkuXG4gICAqL1xuICBFTkNSWVBURUQgPSAnZW5jcnlwdGVkJyxcbiAgLyoqXG4gICAqIEluZGljYXRlcyB0aGF0IHRoZSB2YWx1ZSBvZiB0aGlzIHBhcmFtZXRlciBpcyBpbiBwbGFpbiB0ZXh0LlxuICAgKi9cbiAgUExBSU5URVhUID0gJ3BsYWludGV4dCcsXG59XG5cbmV4cG9ydCB0eXBlIENhbWVsQ2FzZTxUPiA9IHsgW0sgaW4ga2V5b2YgVCBhcyBVbmNhcGl0YWxpemU8SyAmIHN0cmluZz5dOiBUW0tdOyB9O1xuXG5pbnRlcmZhY2UgU3RhY2tUYWcge1xuICBLZXk6IHN0cmluZztcbiAgVmFsdWU6IHN0cmluZztcbn1cblxuaW50ZXJmYWNlIEJhc2VQcm9wcyBleHRlbmRzIFBhcmFtZXRlck9wdGlvbnMge1xuICAvKipcbiAgICogVGhlIHZhbHVlIG9mIHRoZSBwYXJhbWV0ZXIuIEl0IG1heSBub3QgcmVmZXJlbmNlIGFub3RoZXIgcGFyYW1ldGVyIGFuZCBgYHt7fX1gYCBjYW5ub3QgYmUgdXNlZCBpbiB0aGUgdmFsdWUuXG4gICAqL1xuICByZWFkb25seSBzdHJpbmdWYWx1ZTogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIGRhdGEgdHlwZSBvZiB0aGUgcGFyYW1ldGVyIHZhbHVlLiBPbmx5IGB0ZXh0YCBpcyBhbGxvd2VkLlxuICAgKiBAZGVmYXVsdCBQYXJhbWV0ZXJEYXRhVHlwZS5URVhUXG4gICAqL1xuICByZWFkb25seSBkYXRhVHlwZT86IFBhcmFtZXRlckRhdGFUeXBlLlRFWFQ7XG4gIC8qKlxuICAgKiBUaGUgdHlwZSBvZiB0aGUgcGFyYW1ldGVyLiBPbmx5IGBTZWN1cmVTdHJpbmdgIGlzIGFsbG93ZWQuXG4gICAqIEBkZWZhdWx0ICdTZWN1cmVTdHJpbmcnXG4gICAqL1xuICByZWFkb25seSB0eXBlPzogc3RyaW5nO1xuICAvKipcbiAgICogUG9saWN5IHRvIGFwcGx5IHdoZW4gdGhlIHBhcmFtZXRlciBpcyByZW1vdmVkIGZyb20gdGhpcyBzdGFjay5cbiAgICogQGRlZmF1bHQgUmVtb3ZhbFBvbGljeS5ERVNUUk9ZXG4gICAqL1xuICByZWFkb25seSByZW1vdmFsUG9saWN5PzogUmVtb3ZhbFBvbGljeTtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBFbmNyeXB0ZWRTZWN1cmVTdHJpbmdQYXJhbWV0ZXJQcm9wcyBleHRlbmRzIEJhc2VQcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgZW5jcnlwdGlvbiBrZXkgdGhhdCBpcyB1c2VkIHRvIGVuY3J5cHQgdGhpcyBwYXJhbWV0ZXIuXG4gICAqICovXG4gIHJlYWRvbmx5IGVuY3J5cHRpb25LZXk6IElLZXk7XG4gIC8qKlxuICAgKiBUaGUgdHlwZSBvZiB0aGUgc3RyaW5nVmFsdWUuIFVzZSB0eXBlIGBlbmNyeXB0ZWRgIGlmIHRoZSB2YWx1ZSBpcyBlbmNyeXB0ZWQgd2l0aCBhIGttcyBrZXkuXG4gICAqXG4gICAqICoqV0FSTklORzoqKiBJZiB5b3UgdXNlIGBwbGFpbnRleHRgLCB0aGUgdW5lY3J5cHRlZCB2YWx1ZSBvZiB0aGUgcGFyYW1ldGVyIGlzIHZpc2libGUgdG8gYW55b25lIHdobyBoYXMgYWNjZXNzIHRvIGNsb3VkZm9ybWF0aW9uIG9yIGRlcGxveSBhcnRpZmFjdHMuXG4gICAqL1xuICByZWFkb25seSB2YWx1ZVR5cGU6IFZhbHVlVHlwZS5FTkNSWVBURUQ7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgUGxhaW5UZXh0U2VjdXJlU3RyaW5nUGFyYW1ldGVyUHJvcHMgZXh0ZW5kcyBCYXNlUHJvcHMge1xuICAvKipcbiAgICogVGhlIGVuY3J5cHRpb24ga2V5IHRoYXQgaXMgdXNlZCB0byBlbmNyeXB0IHRoaXMgcGFyYW1ldGVyLlxuICAgKiBAZGVmYXVsdCBhbGlhcy9hd3Mvc3NtXG4gICAqICovXG4gIHJlYWRvbmx5IGVuY3J5cHRpb25LZXk/OiBJS2V5O1xuICAvKipcbiAgICogVGhlIHR5cGUgb2YgdGhlIHN0cmluZ1ZhbHVlLiBVc2UgdHlwZSBgZW5jcnlwdGVkYCBpZiB0aGUgdmFsdWUgaXMgZW5jcnlwdGVkIHdpdGggYSBrbXMga2V5LlxuICAgKlxuICAgKiAqKldBUk5JTkc6KiogSWYgeW91IHVzZSBgcGxhaW50ZXh0YCwgdGhlIHVuZWNyeXB0ZWQgdmFsdWUgb2YgdGhlIHBhcmFtZXRlciBpcyB2aXNpYmxlIHRvIGFueW9uZSB3aG8gaGFzIGFjY2VzcyB0byBjbG91ZGZvcm1hdGlvbiBvciBkZXBsb3kgYXJ0aWZhY3RzLlxuICAgKi9cbiAgcmVhZG9ubHkgdmFsdWVUeXBlOiBWYWx1ZVR5cGUuUExBSU5URVhUO1xufVxuXG5leHBvcnQgdHlwZSBTZWN1cmVTdHJpbmdQYXJhbWV0ZXJQcm9wcyA9IEVuY3J5cHRlZFNlY3VyZVN0cmluZ1BhcmFtZXRlclByb3BzIHwgUGxhaW5UZXh0U2VjdXJlU3RyaW5nUGFyYW1ldGVyUHJvcHM7XG5cbi8qKlxuICogQ3JlYXRlcyBhIG5ldyBTZWN1cmVTdHJpbmcgU1NNIFBhcmFtZXRlci5cbiAqXG4gKiBJZiB0aGUgdmFsdWVUeXBlIHByb3BlcnR5IGlzIHNldCB0byBgZW5jcnlwdGVkYCwgdGhlIGFjdHVhbCBTU00gU2VjdXJlU3RyaW5nIFBhcmFtZXRlciB3aWxsIGJlIGNyZWF0ZWQgd2l0aCBhIGRlY3J5cHRlZCB2YWx1ZSBmcm9tIHRoZSBzdHJpbmdWYWx1ZSBwcm9wZXJ0eS5cbiAqIEByZXNvdXJjZSBDdXN0b206OlNlY3VyZVN0cmluZ1BhcmFtZXRlclxuICovXG5leHBvcnQgY2xhc3MgU2VjdXJlU3RyaW5nUGFyYW1ldGVyIGV4dGVuZHMgUmVzb3VyY2UgaW1wbGVtZW50cyBJU3RyaW5nUGFyYW1ldGVyLCBJVGFnZ2FibGUge1xuICBwcml2YXRlIHJlYWRvbmx5IGV2ZW50SGFuZGxlcjogSUZ1bmN0aW9uO1xuICBwcml2YXRlIHJlYWRvbmx5IHByb3ZpZGVyOiBQcm92aWRlcjtcbiAgcHJpdmF0ZSBzdHJpbmdQYXJhbWV0ZXI/OiBJU3RyaW5nUGFyYW1ldGVyO1xuICByZWFkb25seSB0YWdzOiBUYWdNYW5hZ2VyO1xuICAvKipcbiAgICogVGhlIGVuY3J5cHRpb24ga2V5IHRoYXQgaXMgdXNlZCB0byBlbmNyeXB0IHRoaXMgcGFyYW1ldGVyLlxuICAgKlxuICAgKiBAYXR0cmlidXRlXG4gICAqL1xuICByZWFkb25seSBlbmNyeXB0aW9uS2V5PzogSUtleTtcbiAgcmVhZG9ubHkgcGFyYW1ldGVyQXJuOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHBhcmFtZXRlck5hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgcGFyYW1ldGVyVHlwZTogc3RyaW5nO1xuICByZWFkb25seSBzdHJpbmdWYWx1ZTogc3RyaW5nO1xuICAvKipcbiAgICogUmVmZXJlbmNlIG9iamVjdCBmb3IgdGhpcyBwYXJhbWV0ZXIgKGNvbXBhdCB3aXRoIG5ld2VyIENESykuXG4gICAqL1xuICBnZXQgcGFyYW1ldGVyUmVmKCk6IFBhcmFtZXRlclJlZmVyZW5jZSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIHBhcmFtZXRlck5hbWU6IHRoaXMucGFyYW1ldGVyTmFtZSxcbiAgICB9O1xuICB9XG4gIC8qKlxuICAgKiBUaGUgdHlwZSBvZiB0aGUgc3RyaW5nVmFsdWUuXG4gICAqL1xuICByZWFkb25seSB2YWx1ZVR5cGU6IFZhbHVlVHlwZTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogU2VjdXJlU3RyaW5nUGFyYW1ldGVyUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuXG4gICAgdGhpcy50YWdzID0gbmV3IFRhZ01hbmFnZXIoVGFnVHlwZS5NQVAsICdDdXN0b206OlNlY3VyZVN0cmluZ1BhcmFtZXRlcicpO1xuICAgIC8vIFdlIG5lZWQgdG8gbWFudWFsbHkgYWRkIHRhZ3MgZnJvbSBTdGFja1Byb3BzLlxuICAgIC8vIFRhZ3MgYWRkZWQgd2l0aCBUYWdzLm9mKHNjb3BlKS5hZGQoKSBhcmUgaGFuZGxlZCBhdXRvbWF0aWNhbGx5LlxuICAgIFN0YWNrLm9mKHRoaXMpLnRhZ3MucmVuZGVyVGFncygpPy5mb3JFYWNoKCh0YWc6IFN0YWNrVGFnKSA9PiB7XG4gICAgICB0aGlzLnRhZ3Muc2V0VGFnKHRhZy5LZXksIHRhZy5WYWx1ZSk7XG4gICAgfSk7XG5cbiAgICB0aGlzLnZhbHVlVHlwZSA9IHByb3BzLnZhbHVlVHlwZTtcbiAgICB0aGlzLmVuY3J5cHRpb25LZXkgPSBwcm9wcy5lbmNyeXB0aW9uS2V5O1xuICAgIHRoaXMuc3RyaW5nVmFsdWUgPSBwcm9wcy5zdHJpbmdWYWx1ZTtcbiAgICB0aGlzLnBhcmFtZXRlclR5cGUgPSAnU2VjdXJlU3RyaW5nJztcbiAgICB0aGlzLnBhcmFtZXRlck5hbWUgPSBwcm9wcy5wYXJhbWV0ZXJOYW1lID8/IHJhbmRvbVVVSUQoKTtcbiAgICB0aGlzLnBhcmFtZXRlckFybiA9IGFybkZvclBhcmFtZXRlck5hbWUodGhpcywgdGhpcy5wYXJhbWV0ZXJOYW1lLCB7IHNpbXBsZU5hbWU6IHByb3BzLnNpbXBsZU5hbWUgfSk7XG5cbiAgICB0aGlzLmV2ZW50SGFuZGxlciA9IHRoaXMuZ2V0T3JDcmVhdGVIYW5kbGVyKCk7XG5cbiAgICBpZiAodGhpcy5lbmNyeXB0aW9uS2V5KSB7XG4gICAgICBjb25zdCBpc0lBbGlhcyA9IChrZXk6IElLZXkpOiBrZXkgaXMgSUFsaWFzID0+ICdhbGlhc1RhcmdldEtleScgaW4ga2V5O1xuICAgICAgY29uc3QgaXNBbGlhcyA9IChrZXk6IElLZXkpOiBrZXkgaXMgQWxpYXMgPT4ga2V5IGluc3RhbmNlb2YgQWxpYXM7XG4gICAgICBjb25zdCBnZXRLZXkgPSAoa2V5OiBJS2V5KTogSUtleSA9PiB7XG4gICAgICAgIGlmIChpc0FsaWFzKGtleSkpIHJldHVybiBrZXkuYWxpYXNUYXJnZXRLZXk7XG4gICAgICAgIGlmIChpc0lBbGlhcyhrZXkpKSByZXR1cm4gS2V5LmZyb21Mb29rdXAodGhpcywgJ2tleScsIHsgYWxpYXNOYW1lOiBrZXkuYWxpYXNOYW1lIH0pO1xuICAgICAgICByZXR1cm4ga2V5O1xuICAgICAgfTtcbiAgICAgIGNvbnN0IGtleSA9IGdldEtleSh0aGlzLmVuY3J5cHRpb25LZXkpO1xuICAgICAgdGhpcy5ldmVudEhhbmRsZXIuYWRkVG9Sb2xlUG9saWN5KFxuICAgICAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgICAgICByZXNvdXJjZXM6IFtrZXkua2V5QXJuXSxcbiAgICAgICAgICBhY3Rpb25zOiBbJ2ttczpEZWNyeXB0JywgJ2ttczpFbmNyeXB0J10sXG4gICAgICAgIH0pLFxuICAgICAgKTtcbiAgICB9XG5cbiAgICB0aGlzLnByb3ZpZGVyID0gdGhpcy5nZXRPckNyZWF0ZVByb3ZpZGVyKCk7XG5cbiAgICBjb25zdCBwcm9wZXJ0aWVzOiBDYW1lbENhc2U8U2VjdXJlU3RyaW5nUGFyYW1ldGVyUmVzb3VyY2VQcm9wZXJ0aWVzPiA9IHtcbiAgICAgIGFsbG93ZWRQYXR0ZXJuOiBwcm9wcy5hbGxvd2VkUGF0dGVybixcbiAgICAgIGRlc2NyaXB0aW9uOiBwcm9wcy5kZXNjcmlwdGlvbixcbiAgICAgIGVuY3J5cHRpb25LZXk6IHRoaXMuZW5jcnlwdGlvbktleT8ua2V5SWQsXG4gICAgICBuYW1lOiB0aGlzLnBhcmFtZXRlck5hbWUsXG4gICAgICB0YWdzOiB0aGlzLnRhZ3MucmVuZGVyZWRUYWdzIGFzIHVua25vd24gYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nPiB8IHVuZGVmaW5lZCxcbiAgICAgIHRpZXI6IHByb3BzLnRpZXIsXG4gICAgICB2YWx1ZTogdGhpcy5zdHJpbmdWYWx1ZSxcbiAgICAgIHZhbHVlVHlwZTogdGhpcy52YWx1ZVR5cGUsXG4gICAgfTtcblxuICAgIG5ldyBDdXN0b21SZXNvdXJjZSh0aGlzLCBpZCwge1xuICAgICAgc2VydmljZVRva2VuOiB0aGlzLnByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICAgIHJlc291cmNlVHlwZTogJ0N1c3RvbTo6U2VjdXJlU3RyaW5nUGFyYW1ldGVyJyxcbiAgICAgIHJlbW92YWxQb2xpY3k6IHByb3BzLnJlbW92YWxQb2xpY3ksXG4gICAgICBwcm9wZXJ0aWVzLFxuICAgICAgcGFzY2FsQ2FzZVByb3BlcnRpZXM6IHRydWUsXG4gICAgfSk7XG4gIH1cblxuICBncmFudFJlYWQoZ3JhbnRlZTogSUdyYW50YWJsZSk6IEdyYW50IHtcbiAgICByZXR1cm4gdGhpcy5hc1N0cmluZ1BhcmFtZXRlcigpLmdyYW50UmVhZChncmFudGVlKTtcbiAgfVxuXG4gIGdyYW50V3JpdGUoZ3JhbnRlZTogSUdyYW50YWJsZSk6IEdyYW50IHtcbiAgICByZXR1cm4gdGhpcy5hc1N0cmluZ1BhcmFtZXRlcigpLmdyYW50V3JpdGUoZ3JhbnRlZSk7XG4gIH1cblxuICAvKipcbiAgICogUmV0dXJucyB0aGlzIHBhcmFtZXRlciBhcyBhIG5hdGl2ZSBTdHJpbmdQYXJhbWV0ZXIuXG4gICAqL1xuICBhc1N0cmluZ1BhcmFtZXRlcigpOiBJU3RyaW5nUGFyYW1ldGVyIHtcbiAgICBpZiAoIXRoaXMuc3RyaW5nUGFyYW1ldGVyKSB7XG4gICAgICB0aGlzLnN0cmluZ1BhcmFtZXRlciA9IFN0cmluZ1BhcmFtZXRlci5mcm9tU2VjdXJlU3RyaW5nUGFyYW1ldGVyQXR0cmlidXRlcyh0aGlzLCAnU3RyaW5nUGFyYW1ldGVyJywge1xuICAgICAgICBwYXJhbWV0ZXJOYW1lOiB0aGlzLnBhcmFtZXRlck5hbWUsXG4gICAgICB9KTtcbiAgICB9XG4gICAgcmV0dXJuIHRoaXMuc3RyaW5nUGFyYW1ldGVyO1xuICB9XG5cbiAgcHJpdmF0ZSBnZXRPckNyZWF0ZUhhbmRsZXIoKTogSUZ1bmN0aW9uIHtcbiAgICBjb25zdCBpZCA9ICdTZWN1cmVTdHJpbmdQYXJhbWV0ZXJDdXN0b21SZXNvdXJjZUhhbmRsZXInO1xuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3QgZXhpc3RpbmcgPSBzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChpZCk7XG4gICAgaWYgKGV4aXN0aW5nKSByZXR1cm4gZXhpc3RpbmcgYXMgSUZ1bmN0aW9uO1xuICAgIGNvbnN0IGV2ZW50SGFuZGxlciA9IG5ldyBTZWN1cmVTdHJpbmdQYXJhbWV0ZXJIYW5kbGVyRnVuY3Rpb24oc3RhY2ssIGlkLCB7XG4gICAgICBpbml0aWFsUG9saWN5OiBbbmV3IFBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgIGVmZmVjdDogRWZmZWN0LkFMTE9XLFxuICAgICAgICByZXNvdXJjZXM6IFsnKiddLCAvLyBNdXN0IGFsbG93ICogdG8gaGFuZGxlIHBhcmFtZXRlciBuYW1lIGNoYW5nZXNcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzc206UHV0UGFyYW1ldGVyJyxcbiAgICAgICAgICAnc3NtOkRlbGV0ZVBhcmFtZXRlcicsXG4gICAgICAgICAgJ3NzbTpHZXRQYXJhbWV0ZXJzJyxcbiAgICAgICAgICAnc3NtOkxpc3RUYWdzRm9yUmVzb3VyY2UnLFxuICAgICAgICAgICdzc206QWRkVGFnc1RvUmVzb3VyY2UnLFxuICAgICAgICAgICdzc206UmVtb3ZlVGFnc0Zyb21SZXNvdXJjZScsXG4gICAgICAgIF0sXG4gICAgICB9KV0sXG4gICAgICBsb2dHcm91cDogbmV3IExvZ0dyb3VwKHRoaXMsICdTZWN1cmVTdHJpbmdQYXJhbWV0ZXJIYW5kbGVyTG9nR3JvdXAnLCB7XG4gICAgICAgIHJldGVudGlvbjogUmV0ZW50aW9uRGF5cy5PTkVfV0VFSyxcbiAgICAgIH0pLFxuICAgIH0pO1xuICAgIHJldHVybiBldmVudEhhbmRsZXI7XG4gIH1cblxuICBwcml2YXRlIGdldE9yQ3JlYXRlUHJvdmlkZXIoKTogUHJvdmlkZXIge1xuICAgIGNvbnN0IGlkID0gJ1NlY3VyZVN0cmluZ1BhcmFtZXRlckN1c3RvbVJlc291cmNlUHJvdmlkZXInO1xuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3QgZXhpc3RpbmcgPSBzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChpZCk7XG4gICAgaWYgKGV4aXN0aW5nKSByZXR1cm4gZXhpc3RpbmcgYXMgUHJvdmlkZXI7XG4gICAgY29uc3QgcHJvdmlkZXIgPSBuZXcgUHJvdmlkZXIoc3RhY2ssIGlkLCB7XG4gICAgICBvbkV2ZW50SGFuZGxlcjogdGhpcy5ldmVudEhhbmRsZXIsXG4gICAgICBsb2dHcm91cDogbmV3IExvZ0dyb3VwKHRoaXMsICdTZWN1cmVTdHJpbmdQYXJhbWV0ZXJQcm92aWRlckxvZ0dyb3VwJywge1xuICAgICAgICByZXRlbnRpb246IFJldGVudGlvbkRheXMuT05FX1dFRUssXG4gICAgICB9KSxcbiAgICB9KTtcbiAgICByZXR1cm4gcHJvdmlkZXI7XG4gIH1cbn1cbiJdfQ==