From 32caba6a53a4b9824f037dc9093eca6e98fc3d05 Mon Sep 17 00:00:00 2001 From: RPKI Team at RIPE NCC Date: Thu, 27 Feb 2025 11:33:41 +0000 Subject: [PATCH] RIPE NCC has merged 5af977293 * chore(deps): update dependency gradle to v8.13 [7335cafef] * chore(deps): update dependency io.freefair.lombok:io.freefair.lombok.gradle.plugin to v8.12.2 [725ceea24] * Don't say anything about ROA change alert when unsubscribing from general ROA alerts [0a537bfef] * Cleanup [7e82bed33] * Use toList() [c39a9957e] * Make Sonarqube a bit happier [dd9f9a991] * Simplify notifyAboutRoaChanges [f3d3a77ac] * Introduce defaultSubscriptions() methods [662c372d6] * Revert ifs [33a5f8c7c] * Rename to showRoas [cda322492] * Make column nullable [ec22bfe7f] * chore(deps): update dependency io.sentry:sentry-bom to v8.2.0 [861525091] * chore(deps): update dependency io.freefair.lombok:io.freefair.lombok.gradle.plugin to v8.12.1 [2a9ff5814] * chore(deps): update dependency commons-codec:commons-codec to v1.18.0 [e63c18b83] * chore(deps): update dependency com.google.code.gson:gson to v2.12.1 [61cbf3820] * chore(deps): update dependency gradle to v8.12.1 [076df585e] * chore(deps): update dependency io.sentry:sentry-bom to v8 [40b611165] * Don't try to be smart and notify about ROA changes subscription on every email send to the user about alerts. [7f324fd1d] * Adjust template [7d34ef014] * Add logging for a corner case [5a9439903] * Fix UnsubscribeFromRoaAlertCommandHandler [0da9012e9] * More NPE fixes [1ea4f5e3e] * Cleanup [9a0af303b] * Add test for empty case [4cb90fac6] * Fix NPE [dea6f9e2c] * More tests [6e8e7223f] * Remove redundant code, refactor [2142a369e] * Extend email templates with ROA changes stuff [99d212f35] * Don't try to notify for absent configuration [e82f68538] * Another fix [c417d6183] * Fix UpdateRoaChangeAlertCommandHandler [29d270998] * Better templates [723ed6494] * More tests [eef7817b9] * Remove redundant code [21b418bbf] * Fix request validation [9c338c5e6] * Fix broken test [7168e81fe] * Adjust email template [80a05f649] * Fixes and tests [d78685031] * Fix test [6c56d55fc] * Refactor, introduce UpdateRoaChangeAlertCommand and handler for it [ba05030b1] * Cleanup [063fb59ea] * Fix tests again [6693e4b0f] * Better tests [4adafb7ca] * Fix more tests [eab196a4f] * Simplify [fdb0a79e7] * Fix tests [adc30fe3c] * Fix email template, add SSO account to it, better tests. [9779b24f5] * chore(deps): update dependency org.postgresql:postgresql to v42.7.5 [7ab2dddca] * Cleanup [939717d7b] * Add initial test code [cf03d35ca] * Add usage of isNotifyOnRoaChanges [cf2703836] * Add SQL migration [3bed3cbbb] * Fix tests [f1a6d95ab] * Fix typos [bac59c2f4] * Some initial changes for ROA notifications [906c9f8fc] --- build.gradle | 8 +- buildSrc/build.gradle | 2 +- gradle/wrapper/gradle-wrapper.jar | Bin 43583 -> 43705 bytes gradle/wrapper/gradle-wrapper.properties | 2 +- gradlew | 2 +- .../domain/ManagedCertificateAuthority.java | 2 +- .../domain/alerts/RoaAlertConfiguration.java | 18 +- .../roa/RoaConfigurationRepository.java | 10 +- .../ripe/rpki/rest/pojo/Subscriptions.java | 48 ++--- .../ripe/rpki/rest/service/AlertService.java | 133 ++++++++---- .../service/CaRoaConfigurationService.java | 4 +- .../ripe/rpki/rest/service/EmailService.java | 2 +- .../commands/SubscribeToRoaAlertCommand.java | 20 +- .../UnsubscribeFromRoaAlertCommand.java | 11 +- ...RoaAlertIgnoredAnnouncedRoutesCommand.java | 4 +- .../commands/UpdateRoaChangeAlertCommand.java | 21 ++ .../UpdateRoaConfigurationCommand.java | 7 +- .../dto/CertificateAuthorityHistoryItem.java | 11 +- .../api/dto/RoaAlertConfigurationData.java | 22 +- .../api/dto/RoaAlertSubscriptionData.java | 15 +- .../api/security/CertificationUserId.java | 22 +- .../rpki/server/api/security/RunAsUser.java | 10 +- .../background/RoaNotificationService.java | 100 +++++++++ .../rpki/services/impl/email/EmailSender.java | 30 ++- .../services/impl/email/EmailSenderBean.java | 11 +- .../SubscribeToRoaAlertCommandHandler.java | 61 +++--- ...UnsubscribeFromRoaAlertCommandHandler.java | 16 +- .../UpdateRoaChangeAlertCommandHandler.java | 66 ++++++ .../UpdateRoaConfigurationCommandHandler.java | 15 +- .../jpa/JpaRoaConfigurationRepository.java | 7 +- ...__roa_alerts_add_notify_on_roa_changes.sql | 1 + .../roa-change-alert-email.txt | 10 + .../subscribe-confirmation-change.txt | 8 + .../subscribe-confirmation-daily.txt | 2 +- .../subscribe-confirmation-weekly.txt | 2 +- .../unsubscribe-confirmation-change.txt | 3 + .../unsubscribe-confirmation.txt | 5 +- .../impl/CommandAuditServiceBeanTest.java | 2 +- ...ateAuthorityViewServiceStatisticsTest.java | 9 +- .../domain/CertificationDomainTestCase.java | 9 - .../net/ripe/rpki/domain/TestObjects.java | 14 +- .../rpki/rest/service/AlertServiceTest.java | 199 +++++++++++++++--- .../rest/service/AnnouncementServiceTest.java | 2 +- .../SubscribeToRoaAlertCommandTest.java | 20 +- .../UnsubscribeFromRoaAlertCommandTest.java | 14 +- .../UpdateRoaConfigurationCommandTest.java | 9 +- ...oaAlertBackgroundServiceDailyBeanTest.java | 6 +- ...aAlertBackgroundServiceWeeklyBeanTest.java | 7 +- .../RoaNotificationServiceTest.java | 113 ++++++++++ .../impl/email/EmailSenderBeanTest.java | 2 +- .../impl/email/EmailTemplatesTest.java | 1 + ...SubscribeToRoaAlertCommandHandlerTest.java | 71 ++++++- ...bscribeFromRoaAlertCommandHandlerTest.java | 2 +- ...ateRoaConfigurationCommandHandlerTest.java | 35 +-- .../JpaResourceCertificateRepositoryTest.java | 7 +- 55 files changed, 914 insertions(+), 319 deletions(-) create mode 100644 src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaChangeAlertCommand.java create mode 100644 src/main/java/net/ripe/rpki/services/impl/background/RoaNotificationService.java create mode 100644 src/main/java/net/ripe/rpki/services/impl/handlers/UpdateRoaChangeAlertCommandHandler.java create mode 100644 src/main/resources/db/migration/V133__roa_alerts_add_notify_on_roa_changes.sql create mode 100644 src/main/resources/email-templates/roa-change-alert-email.txt create mode 100644 src/main/resources/email-templates/subscribe-confirmation-change.txt create mode 100644 src/main/resources/email-templates/unsubscribe-confirmation-change.txt create mode 100644 src/test/java/net/ripe/rpki/services/impl/background/RoaNotificationServiceTest.java diff --git a/build.gradle b/build.gradle index 3bab61d..77933ce 100644 --- a/build.gradle +++ b/build.gradle @@ -44,7 +44,7 @@ dependencies { implementation "org.thymeleaf:thymeleaf:3.1.2.RELEASE" implementation "org.thymeleaf:thymeleaf-spring6:3.1.3.RELEASE" - implementation platform('io.sentry:sentry-bom:7.20.0') + implementation platform('io.sentry:sentry-bom:8.2.0') implementation 'io.sentry:sentry-spring-boot-starter' implementation 'io.sentry:sentry-logback' @@ -53,12 +53,12 @@ dependencies { implementation 'org.springdoc:springdoc-openapi-ui:1.8.0' runtimeOnly 'io.micrometer:micrometer-registry-prometheus' - implementation 'org.postgresql:postgresql:42.7.4' + implementation 'org.postgresql:postgresql:42.7.5' runtimeOnly 'org.springframework.boot:spring-boot-starter-tomcat' - implementation 'com.google.code.gson:gson:2.11.0' + implementation 'com.google.code.gson:gson:2.12.1' implementation 'com.jamesmurty.utils:java-xmlbuilder:1.3' - implementation 'commons-codec:commons-codec:1.17.2' + implementation 'commons-codec:commons-codec:1.18.0' implementation 'commons-io:commons-io:2.18.0' implementation 'ch.qos.logback.contrib:logback-json-classic:0.1.5' implementation 'ch.qos.logback.contrib:logback-jackson:0.1.5' diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle index eaeb175..3f04d0f 100644 --- a/buildSrc/build.gradle +++ b/buildSrc/build.gradle @@ -9,7 +9,7 @@ repositories { } dependencies { - implementation 'io.freefair.lombok:io.freefair.lombok.gradle.plugin:8.11' + implementation 'io.freefair.lombok:io.freefair.lombok.gradle.plugin:8.12.2' implementation('com.gorylenko.gradle-git-properties:com.gorylenko.gradle-git-properties.gradle.plugin:2.4.2') { exclude group: 'org.eclipse.jgit', module: 'org.eclipse.jgit' } diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar index a4b76b9530d66f5e68d973ea569d8e19de379189..9bbc975c742b298b441bfb90dbc124400a3751b9 100644 GIT binary patch delta 34744 zcmXuJV_+R@)3u$(Y~1X)v28cDZQE*`9qyPrXx!Mg8{4+s*nWFo&-eX5|IMs5>pW(< z=OJ4cAZzeZfy=9lI!r-0aXh8xKdlGq)X)o#ON+mC6t7t0WtgR!HN%?__cvdWdtQC< zrFQ;?l@%CxY55`8y(t7?1P_O7(6pv~(~l!kHB;z2evtUsGHzEDL+y4*no%g#AsI~i zJ%SFMv{j__Yaxnn2NtDK+!1XZX`CB}DGMIT{#8(iAk*`?VagyHx&|p8npkmz=-n!f z3D+^yIjP`D&Lfz500rpq#dJE`vM|-N7=`uN0z86BpiMcCOCS^;6CUG4o1I)W{q6Gv z1vZB6+|7An``GNoG7D!xJGJd_Qv(M-kdVdsIJ?CrXFEH^@Ts83}QX}1%P6KQFNz^-=) z<|qo#qmR!Nonr$p*Uu1Jo2c~KLTrvc*Yw%L+`IL}y|kd+t{NCrXaP=7C00CO?=pgp z!fyr#XFfFXO6z2TP5P1W{H_`$PKzUiGtJd!U52%yAJf}~tgXF`1#}@y`cZl9y{J-A zyUA&-X)+^N?W=2Fm_ce2w$C6>YWp7MgXa{7=kwwy9guBx26=MnPpuSt zB4}vo3{qxa+*{^oHxe7;JMNMp>F`iNv>0!MsFtnb+5eEZ$WI z0M9}rA&cgQ^Q8t_ojofiHaKuhvIB{B9I}3`Dsy3vW8ibigX}Kc912|UZ1uhH?RuHU=i&ePe2w%65)nBkHr7Bx5WwMZj%1B53sUEj0bxI( zEbS%WOUw)3-B0`-m0!{mk7Q%={B#7C^Si>C04@P|qm7$Oxn3ki)G_oNQBTh6CN6d_kt@UKx1Ezdo5)J0Gdf@TcW|{ zdz1V?a>zldA7_5*Pjn6kDj|sbUqt-7X z5+oajeC}*6oi~vxZ#Ac&85cYcC$5OKUnYPv$Y~>H@)mnTtALo*>>5&=0QMr5{5?S; zCDF=RI@94n(!~sa`4Y{JLxgcvRqMM&T!}rRd~Kl#_X4Z&85;})o4W*g>?TaAVXSWB zeY#!8qz^hmC6FERsjTnC)1Xu1UPd7_LfuNvuVqF8(}Jfar=T-K9iChEuZi-FH(P%u zzLrjpq|?}8?g1Vnw^&{eqw~QY0f*9c71&*<5#9f5JlhJmG~IuV*8~nEBLr`KrvOvs zkOLdlZ58K?u>1{vAU0CtT>Il<I{Q8#A!lO7#73V&iN13;oV?Hl?N5xDK63)Rp3%5reb&3n5OQ|9H zDpYEI%JQXcrs^o*SCFY~iYf-VM<`7Tl@+kQS3tfR-fyH_JDaz5SYEMU-bTCLQ=JVG ze?ZPcj95Tci|bVvSZk3^enqQ?pIcZn24V=YT{cf-L|P&{-%%^ql$)^Vu~)Ida=h$bZAMQEi$MM|&b zY8;D;aEba_`W^=VdKfttW)h_zjRA&0A^T*tF*%+}TZQCOvFqKUu=xf1Bx@T?&~S(J zopXniA?s%}Q4p9~F(Ty{8wt$l4oHeT(#U6sAu4>Q+~a;}I>0>??v*wfke}0TwPaeE zj3gWtfNlD{jRgy7;S9PS?su5pnobi%Zoe0LVpw%`<)V=yT~Ht_UUXIna4YUa;p=-T4df6^;bz%;@|$F zK;s9#K@9hqZCST!66N0uPB+FT*kq22%ovtJ%<9ArE%hcX^!(Lz;3?kCZ@Ak*MThjTOKU&t+uJdN*6t$;DDmh zFStdHO>r)8L@qO}K@H~7Z);#f6WU{@Icn7Tc^|IZ`;K^ek9eCWdync`kWCt2s%D-k zE$wyPCui$@gJJ9Q`CtixbMF(GiCCbm`ut(~ce-G|Ji|PZ3~DHlG`Asn;skVhnu0r_ zgGbdmfl|er`87x@uYmd8A+!-3V95GE4&_^9N@hp4SC4 zeFU+Z3Ou&G! zlvZy|iHIIX3X2-Yb7YJ#{SYE9lCoixO+}(|u+H@Z6Rz-l1eZ7{I;vk+Y7kP7ev>hG zv|(I<4?N{EXMSvRgUhbQhDoP1&A;SEUGGep8*!@4u)fNbl3%cts<&=m5<5pi7M-HQ zPS#svbXWu2n&m*K6jL#@xm3VSMJxnxve5J6w1qGv`2>5<6F!uzGVHP1A(_xI7CWlX zm6*wpT@dmQ&pAlm`r~T;)>m5HK^H^cM`pCSoh{;-CE43rMkg<;HnZaCHfMq1LoN0S z%%7|$y~&k6wpiY@rsdCY9ZDh%9W6Pf=2^p=;iv-Ah^ACxwK3VmI}SMNneTa9n%biL z#GoojRHxa}R2zOo!G@<8M-B6vNp?)@_>#mYku#pe{O~t?~}1 zE8`)=BstIRk5W*xZw@2=89@ds?eQ~mxzkrA`y<$oR8bmaUw=rE%lFmzHY&aY8?<-N zp1|bb$(XrOMmiYy{pH#)D1GOmv5aj_?waU~*h~s{VZ&H_PhoXYz`C8Pss{ymY_hPG zt{NY&nPMH#FRvwR+T0(Xo2#T6;=oFmRgA9b-HVY72d|~YF+6v$F%sY0 zS#^LF7sTj>Itvyi!~){Hit*~3imOG*Xh51qLz+!W~`vUBVeZZ5&k34SD%Ha%5#aclSzMfoGWjiq9#rl}j zOf*8NY>VN(`W!DxaBgjBzj3oUAVlLY{R}tiZZ0o>K$vwr?+eggZ!q74m2t?lkvm9z zAmL2=W$jQJL>SSrbIOibe734A(K^B8`M@uao!`E$p+9D!rBea8Oxb|p5r3o4##G8K zMr0I9y&`21{@m=Bi+4tTJ-xy(DB_mG$kYv+qw&VBM(A9^wP9;Yo*6{#5tMpfa;m2FC+%l@ zk_cKXg-d&YUIj3(x{)aNwYGYjSHiOQK2K#yWt$vQomhbnF;Qhkxl`+;i{&+t{PrY` zp5r28&|UvmUK|&Jlv>oX4>XE87Zns?fiE6c;VP7BixT*6n}Zsbv$wd{gXyrE&Sd zhRlv!-{%~xv6yNvx@3^@JEa$={&giRpqZG>`{93 zEjM}YI1i6JSx$DJa&NWcl0M;igxX;est*nz=W16zMfJ0#+s{>Eo>bxmCi)m*43hU1 z;FL43I}nWszjSS%*F1UYt^)4?D6&pDEt1(atK(DKY1pAkNMG`a>_ec;KiT z^xMBBZ9i=;!_hNGlYp^uR0FW^lcBrs_c3ZvhcctW4*T^-DD^OU{{hK8yHahyGyCK& zL0>f0XW|wvi4f`bNTfO+P*Ao^L@8~ezagtl%l z{(2uo71sT3rKTQ-L#Y5Rsy#x)Eo+HQranZmk;r_Hf7WWkRq&QmP{?}do0X=;3U_UYspffJl7v*Y&GnW;M7$C-5ZlL*MU|q*6`Lvx$g^ z6>MRgOZ>~=OyR3>WL0pgh2_ znG)RNd_;ufNwgQ9L6U@`!5=xjzpK_UfYftHOJ)|hrycrpgn-sCKdQ{BY&OEV3`roT|=4I#PT@q`6Lx=Lem2M&k4ghOSjXPH5<%cDd>`!rE} z5;hyRQ|6o>*}@SFEzb7b%5iY}9vOMRGpIQqt%%m)iSpQ@iSAU+A{CmB^&-04fQlV9 z14~oE=?j{b{xE*X^1H)eezKTE27;-=UfNvQZ0kZ+m76{6xqAyTrEB&Oe`Mx{4N;}5 zXp%ojp}JYx6PE}Z`IBO3qWsZEfVPa4EEz0vnsFNkQ!kG8tcec&)k$+s&XmPErROoNxeTh9fATBk)w1g|9*~&S!%r0u6+FTn}dK-qa7cfK~tkJlV zMi{BX!>lQsZhSQUWAf(M6+McPrv>)j<*T&hC!*?qq{@ABJWX z@!~2Y1rhy*Z|x`DZUBuyayz}Kv5Pzrh}1wiHT{9|fh`Wl%ao=lRSwEFl*wy6BZ%vo zrt9Ocbicd1q$a{F6`4#ZQ6vJa@`}IGz+xUr*=6TF^GR?`u{1to&gqJpwf$LN0?G&! zsLNiG+}M+c{*j-Q4I zO!=lj&~{29Os}hgEv`iJ1tU)dx}=ob>DHSHKX|FVu2Y#pO|SsigHRgg4?!FX2>b3W z`m}xI<#_02adGka0TuAIg89kS?>*lKyI)T)Pa)|12XfH;k9}#=dzH6TiciCNO->e9m>!W)l&4B zd74@>_LL9OuJ&v5e0)l7ME@xW)9K@*LUd1RY}Vs_${3YC%+LfSR^H+I=(7Szh2nKB z_8bMoty|M+k9A|hGURVePvMf0XY9NYOiC@h^MLs-X@(8PV4zI7A155!RnZrBE9R1> zuI4E`=JTxyJ#d`!(9_s?T2jxEM*E`){wGI`DBFIz%ouW`Y0cKDfXAGN{};aMpLRvZ zu`PZ-3(+Tsh?UKAr)TQQ;2Jz(kv8{R#!c9Tyeev55@5@Ng*c4-ZQ6vC?o#5>6{;?gVfAIr-+^g>3b$}13U^~?gce6s6k-4ulnzWlFpq}*)2 zd0!wP{2>3U+zYiPaNr+-6O`J;M2Cb`H5hjDXw(1oKK!?dN#Y~ygl{H2|9$( zVg7`gf9*O%Db^Bm6_d808Q!r%K;IUSa(r^hW`w)~)m<)kJ(>{IbCs-LkKJ5Qk~Ujv z|5`OBU>lb7(1IAMvx%~sj+&>%6+_-Pj&OOMzMrkXW}gMmCPOw5zddR}{r9blK&1(w z^6?`m=qMI=B*p~LklFLvlX{LflRXecS#lV$LVwi$+9F8zyE29LgL> zW6R-6z&3x-zL({$nMnbhu|plRO8S_EavN?EKrr+c&Tt;Mk)NC0e|cvyXk%VKb5VIc z;|DN^5)t^}tr&-2q)SbwrF>=k$moYK;yA{Q1!I940KmPvg_Ogb81w$_)i3FgFWG+MS?k=BpkVGk-bRhBF;xJ}wnGN{)?gbry^3=P1@$k^#z9*@tmmB+TZ|L@3#3Z+x z8hJE({GEeEWj#+MnUSN^~c!=G+yW^j=cfN_0!}%(J-f1`G}w^}xi!T8BJDOCri{mGBU? zsKXxeN*=L#<-p_aj6cHtYWMJ+;F`HLeW5cpmeVAhFfy+Y=0rIqqyJ-NRIu-aE*Mvr zVnC-RDR`d1nnQu|^S79I>%9=bPNx1JLOJnB**Y`2WCq zctq<)Cq2^Z%=$*&;QxX30;642;y+=mlMLec6{KA208FQ~_S&tiFQW zp2{C3nyrmgkh+HRmG+$_y19m~0z~b`Mo+m6)Qq82p5)Z6ePn&B=!*twk7Rz%zzm-R z>Qj!PE3XMBY)N-xO(=VpO6=Cky5kpl}fQztM7QzvG#a}5$>2$f5w|}b8=3E)cNQw<%e1xAEwaRHu zhHCGB4Uzs6x3A=7uUBC0({&iNH{!7JgQHVa+ zKfQItwD}sd;587x?M_hzpR|TKtTH^4{`G7*87o_wJrFlmrEjk=jvA z6xBPKYjFB9{0Sj0rBL-z9BuBY_3c||UjVgv2kqw2m<@4#>zfx&8Uhq8u+)q68y+P~ zLT;>P#tv|UD62Nvl`H+UVUXPoFG3>Wt-!sX*=4{XxV|GSC+alg10pP~VaA>^}sRr1I4~ zffa2?H+84k=_w8oc8CQ4Ak-bhjCJIsbX{NQ1Xsi*Ad{!x=^8D6kYup?i~Kr;o`d=$ z*xal=(NL$A?w8d;U8P=`Q;4mh?g@>aqpU}kg5rnx7TExzfX4E=ozb0kFcyc?>p6P# z5=t~3MDR*d{BLI~7ZZG&APgBa4B&r^(9lJO!tGxM7=ng?Py&aN;erj&h``@-V8OA> z=sQ4diM!6K=su^WMbU@R%Tj@%jT5prt8I39 zd3t`Tcw$2G!3;f!#<>>SQ<>g6}Q{xB|sx_%QKm2`NxN|Zl%?Ck6Lu_EMC?*eRxdgS!3zYU#OnO~0&UFei zmP3k9!70^O24j5;G-fH6%T}X{EdO(%*+7ThlNGAh;l?$&{eZ-l`j281o@47x+6Z*DC`R2CkPo{1Behvlt!4${0Q?fBx)iIw$Ky zI#xvxKs1U`uMgeZg5fD>s5AYH*n=+UaRzS?ogn6WwBPK3Gib5@Jj!sZN^tm>M&*r@ zjbBoF7uXJU2MW~JK3%Xa3R}3zsP7qHEqbnC%eKsJ51+% zVAT-eRHwD)0YlfK2&rN549*};CJ8I;dj8rD^PR(>#n?Jccsqx&wF#We;Auv9Vm%-} z3HjpBGp$t5^S$XhJmYAP0q_qM@^#D}NM1FmCCyo;F|wv3_ci@$MA<3An0Aa|>_M&S z%qGjO@w{NI$VKyDF@w5W*6XK~5S`S$@ABWh@uaFIBq~VqOl99dhS}?}3N#JizIfYYt`ZKK0i_e#E;P0)VXh-V!w+qX%^-I0^ok>HAm5)tbBZlYov@XkUL zU}l}NDq{%pc=rmBC>Xi>Y5j9N2WrO58FxmLTZ=$@Fn3>(8~6sbkJ;;Uw!F8zXNoF@ zpW;OS^aL|+aN@xwRNj^&9iX;XxRUuPo`ti>k3Hi3cugt`C(EwuQ&d2lyfO` ze!0fi{eHhU1yN+o%J22|{prPvPOs1S?1eUuGUkR zmzMlCXZtW)ABWasAn53}?BqtPMJ*g>L1i6{$HmoEb@h(kILnMp(2!H!rG?MNH`1V0 zotb`;u#Yz0BZrT1ffVTCV!?{L^z8q11_21ptR0ITbOcaZ!mlWhC_AZb>?2IDV|b_y z9lVt3)0d@W=lNp1ArE;h_;DDQX^_;WtsSIO<;Ly&(#O~Xw$R0~W|xdQk*Y(b2=vLV zt8HX8=;#;$=y}!;Qku2HJbGEzF`2_~&i$&ogHUe5vhx}FLR}K_Mp)J{n*Va2<|pk$ z4tI(7v3A%Z7Z0|ZWw#7%$U#*mv+`Ujlh^N(t63xFt_%*WoJ^oq!U0j+Bx`<>q!J&0sWy4&{@#*BOr-s ztZ68f;l0UT3wf@RRC}_ufMr6rQ69Woa@1sZ50Ww|{yfp8!7rMOh_POTE;|zamq+4OObJ-VeTK|D|h?mfR$^lA{E7pk8DRDz*j&r<&fR>GaG*d zYaJ*q5#n251XIpR6F1o-w>LZ)Cb6Ma^6tCfcOItn1o;$#H?^jqOd(PA)B3HaTlJK zw!~?nh-v-_WBi5*B=IuTZOX2sa{1I!#%VMd5eGe1VcL6 zQ!aDft}>TjlwzEJ9Kr6MWh1MoNNWr$5_?z9BJ=>^_M59+CGj=}Ln)NrZ;Fja%!0oU zAg07?Nw&^fIc9udtYSulVBb-USUpElN!VfpJc>kPV`>B3S$7`SO$B21eH8mymldT} zxRNhSd-uFb&1$^B)%$-O(C$#Ug&+KvM;E9xA=CE*?PIa5wDF_ibV2lMo(Zygl8QK5 zPgH1R(6)1XT9GZ6^ol$p>4UH@5-KV66NF$AH-qOb>-b~+*7)DYsUe&Is0yTx=pn8N zs&2Z4fZ1Wk=dz>AXIfd%>ad=rb-Womi{nVVTfd26+mCx`6ukuQ?gjAROtw&Tuo&w$|&=rEzNzwpuy0 zsqq)r5`=Mst4=HCtEV^^8%+Dv2x+_}4v7qEXSjKf%dOhGh~(FDkBW<~+z&*#4T>r@ z>i7T5TGc96MfD%hr~nK9!%r{Ns9=7fui)N%GN8MvuIrox)(0nNg2{McUIC6nq>dD+ zNvX69vvf=Pw1@x}^K{@%UCL734;&AVta#($&l2E|*VUaKW@h`X*L*;1Kl4tajl}GQ z$K>;*$3y1(<^32Cg8ugi^ZII=I&ina>q@GC&~gQ#Z88(nOj;*j z1{hyEq|R_0v7LZNKB|3jqZPqZOuUG(SuM^Z>0@mzsKqVbRrkTz#TRZ0sTQ|%XiYcE zEE5{9jEB+2Sdga|veYSFZEzOuepHGusAO#pg&R(%Ob@V0Lw;AfQJ{aLUJxnbe`q(m zadg^fXYiWr+mm2akb*J?y`w(!KAL8OfFD!mVWiWrgScgp9^yoh3lNNUxd?YyvgUL z>+!2VXP7Fzq zYQ?(9-r*?N*cJCK&)pbYzuv%R{b;TB_wC1V3nO#12V0ucgp);>!N=;G=l;({KZF>) zNAo=0m|3Zu*PNLa-2v=3r5>-hVI_xYdz0m*f-zUW_=eDqiM3j4MPnS~eIRNdw466? z)yxHI@6d7gL2Qj<_@72W{GDyINBy%X6X&_cF1(##v^}87YGZ87HgfH$&epf>Jlia4 zw53K1M6=Px@YCVTUk!%_MjyBeaWy7c40i47-3B{voi|&|7aXza!(OB~E)U;f>5Wd3&@#UP~gkM*qmK=aeZ zkP}gn%JmKK34}KdEu)4E2~qN)EnAhj>)4dbq&RbLu$BD&kJSoIvr$3A#S%P~l$l1A z!96hNdtFXsta!b+enJ@G;6rv-Rd=IQ_llL#tSGk-mpQi(mhop;lObiTQIARXw~&d> zVuCSG$T&zi?#&PT-fP)`*-d@gc;+tOPDaUA*6>RIrf67& zpZ<1ie#4rJ3HEu>v7sF={4;oXv?_MwEI-^o-Lr@rW%%cd0TR2q`p=rkMOKYzOs&^$ z=xW*e)6p-B(0Ek7w8+!@Cks9>$_#zi44MLyL9X?{sDlihX%V;$%a;wd&RL*XGcb$` zvU}#qxz8wAT)*NQ+lXO>AI`^r7B&IQ3J&{cVNn0aWa)(!fQtV+mm~`vsH24+xI|q{ z4ce$OB1hrqGLn;H#=~Rx%T#b|hN`d6SXt=;Jd=DNX3LO9R8xLX@6p3>SnZO7M+96a z1s=zJKd%qy0#GWLeFgc~?fsCw^$6lG;B*54&@n#>q$#nRSr?2GA4YaSSl5~B2k}R_ zfJE-$C~{O_6Rh6BJbWFuoaeXEI!Q-YSA9EvSG_sjB~-*hf_PM~mJ6BL+IcaF)8$+; z*4A4W&+_Mn6~tF|M8Sz57BxO=W9ZJrNPtdhME>$sS6)etinxj{YkK){@Q${`Vc~dX zLT4UYjwuC>dH8AAjQb{Ji>eMvJ5rH-4a(K{4EyLrCDtta)u#>`V_AvyS?Y(;FRT8L ze`JXZP4s~Quq$m=6NI@}`( z`>o3kbSApxcHP;1Mds3&41!_0r619~@AQr9TW*Swk`Q1JNmIk%nKm(ZbZMHEi z4n%vC0MuAKNz2njKLk~w|6u!|y7FN!SXk5=7>^^p-R4w7R;~G!v<{>H3%SC-?>8jAP&ka=owuQ$sKwU4e8EVyc6V2IpBR56HthbwJ*XdwnwrW4 zcR7oGg7kCmj(q{#ka1d85mRVIo0`1v3+B--4RXv$hGb545y#j7bmu0*>BLnTRZ+mp z29%AP8Id+57Q(6`ep^<tq}GO1dvJ*8~jxjiH0quR*Poy%N3@c8rhlO6YR@LBk%l zux{&bK~LvKYq%d;Tzl|VS=?rkBUD-j$YY-xX)z`zUfH^&($ZYco(Xc1tr|9rwx}=- zk`E2Wwkh*HIVsWej-nJ6HNH)7rWDlB0@`{QG*0)&P+~Ng{m^kG#J*^p`drM(`dnd& z9$U+FH=rXh2py-N$l_0)@|JY;X1hVL`@}qxNi@Zy5hI)@(af%=1cl~L3{fxZWys9G-hLv z*%jvhoba^ePB8YL)`%d%=t6Yh*c5p1S7`+BPjOD*#q4~gv#bn0wOaf_K0SiGC{jp8 zAc_Vk31hKTSUiEU7XNk7`D}S-RUrYb<7%)k+tV0zZ7(}vQN@0C5EI<=$$qW}m7f7I zk>dMLd+kSjN4{OaxBJ^_h?FayJ`Yr)3eC$jdk1@jEzVT=a?{BSjp?&?qPX=xO!ttw zN_s#<#Ve(0i_|cRa=MC2=8MonmoT5)UtF&Wr9-b2ng>>zv{8$*UcIBIXSZ3)x727q zy{r>bdOh?E;ZI(^io=P3`o*tLdsjkjM!rGae!v5QH<3-OBW(XcRhvM!(b)Yas?oK? z$5)Y*YS^_d9H-ZP^_iVooK6EE1(akYvmNkXQGH1`kXg()p94|_F8B@_ABt*7QTmYk z47RyNSjX8nMW&@VZIQ`1WB%-*W4oN#|M}EKDCC_@HQ9!BenOQ{0{i#>IaQkyU-HOT z#8ueeQdKezCP`+p0{|o?!axX6WB@{OJTR;qfs(;uKp@Kjq4Dr)^>R9T+^$ohEYKB= zQx_P+t?e3z}3#W ztf10?br2MbSVn%*3!j2QFu;=K)-ueTmgyYq;%9HjJL_W=dV$#21FIjyv}d3@oIy+c z?IcrTw17F6oYGMQA=66yCh`48DJb}^Q?8r3Lei%QJ!qpxnt5`aP%aJL9ltY7#;qzq)qdoGzpYx=gz7Lz$JJZ4?^Nr`!1MK@k z47M)#_%Bezu?xD<{tFcQ{{@OiDQRGst}MJJdOtp%(wvCymmU}NKvIK%z%RysueJ$h zMe(J;-iblcWW>90Ptma{$`%AUZi8_y>pQy*1GpoiiS>`GK9%)TGXC!$FDO5REO0l^ z&lv``tj^Y#F@DP6&qSkCYO-b8O*XVx^8O@0D}Wv-tbz7`pYOlCS4pVmi!~|4dv-5i^8laoUpk zxH@-rdRED~DyWrZO2290e;bISH8z$=kcmp_ct)+edl012<`vnqx}D^FD$twK8)RpVW@yMvk8CRc&d*ku^a#%~2|u>f%{up2Q6x9Mdt&e&@t?_bEXURy{+@>{ zJjDZB-f~7aGc%-QXc7g4fF1tUfP-hsa@qS*#N2_g3675xMqbzyQnC~pK_jH^3k}w%a6jCW!C?MU zo{9eUxt*=#6(neNmoNf#hiRNdGBu|Q(@9s7|H`J*IMWuCEyE4;3IJtKS-n7f+C1=O z89gY4%6N}DeX%EYz8B!^9f5Sf8V2S}yTJ>r+}=RsLXtADv|&$w!dxTz4oSIuz=8S> ze%G>2|5coCh@K)cA(h6O>kRSfAQt>H_fE#}H@p)v`Tw>aulOfNhyS)7=rI4b9Co$DH=Jd$I?iu%Tq!e%aPW7DXN#iTjDG0TqkpLrhBBzR8`k zD7XbvwV1f*5U7kBxrIxHO}NcgSmCK*P*zt<4FpS5V5@~j2g+wGN-WtIbV``U0-3X< z(0T||f@~2Ebo3UuxzrdG=FuH~6+|7!VsYU$0Z;OEL^Mr^S^zSSbYwE3A~U-vOJDyUDUStXfD%K9;#`BD_z>Zb zYj83mc+8KTgEK6`Y;^Q6ku|@W3|m*M55gt8^^WdrxGslExn_2O8$_a0M&&_Be0KPA zDd|?nYAOvUkTJUXZ7l2Ml&#rK04@AJabu&@g=pIr~b;eo^(8BT(?FunH$AF3j*ZiHB%C({8I)tTa3VRkn) z=9uW|9))}J#GUqRh<&w4yL15QpK%2bM)-YYq2tcqZmh#_)@tYAn7$!Z+6(FhAPs2p z^%a8A6xo5O-hgk)a=r7#iC9Sn=%vgrQsl}WCq)N+4q*=_VT+ac3I+*3lJQ&#epf@`!?G!7S(!aZGWqpGk8(*`ig}*V&iyhzH;xtxA$y_N z>)-lw)z%-mcQ3s#`hcb*fp;U`yikM&{Z0^!k1?*j(d(dK9Vw#6o;HRAhEj6!& zxJ$%z@#hubu+iCATwZBgyl$DO;-%^6*lhP|m`wV*S9e%1oP-d7}LFzNb-nbg&b zLeV~*+>vogxCnjjqMaj6y1jn;s7GQLf{ZSY20O#1YGg;yjg-{KM81iL;0{|;LN@@* z6ST#KrKAJTzEMTb{1d?&eNzE47+;ZFtJ8pB_U~EkOk=`-6MB) zTaU^zm3`7P2kZ;D_=u#Q2t;SHzo8P1xqM5!?7^WSE#u5XoolRV{Q}doTaC)1S08Zy7GJ?pd&8Jjw z`*_`ev(<+Ra2R&CQf7cb97~c^x3voFRhQSEV_1pF(I!QUWEkUh<2Uq?3Cz9FxIKeB|n?CuVkX7tAhr<4Ej#%Cq?uB5e^<(Tu{>54T z!(6b8DmhS=>>S)e9h|J%5}ljxfXIRDVa(%*0*xTQ{+ zUjroY*#_U^>b1Teuc$T-egClH97?IE<0#OhF0Y9ByTKPxej00P`|jMJVCqxQ>44F0 z6StS1JT#Ng(}>CWNb0uNM*qkV5JF(s$Hm`S`+O2LRS#bpUMgwU)x`e2u1#H8woa1YGZIsxydK5$JP$cfI67I1 zBE?jjeY6QO_arp9gg1v9k)(iTssRJl7=WdW!5$tkQ-3&w4c|W=|Bh|HOKy{C>%J3@ zZ|8r+H6nd{{iLE~*`b<}mmrmA{8WRDdlJ%rL%W#To}q01jQ%5ZNy@MC_fzCo_!q8x zb46H1v;|CrZ;mdn-6=g>sqK$5H<)H5rH0*n+c!YnE5YQcu{wHPyVztNP`)K`bv3XO ziFeTQst%KJAd9G3SLmUQ|V9fRRc;+ zPd%sGo1p@XsJh&z8?psQ1@NnY|!@p3%Mm9gi!S*yNThSTSi>xCoEGLx%T*dPC_ zK3J4iwp-OZ&1%b#}32cNRbgvhDTdd7->2vcnO3Mt%o zR22P|KlOg^Lw}@|mzlgUh+KF7hZA-R_k=AFARuTl!02E$Fun#45CtF|+z(y&M--)~ zkX(>sZe#6y_I>oP0}9KH=o`);bPVMO1Tg8k$trp`n2F7Ga^3Z^)#GsOamw&Zg{k!R z#))|f#dP=GU6 zM#KYRBI_eOICiiDR%oBa@n|ggpZJs>v7kQ|)(*x)4xxl6;d76Fl^)QGde*sDZnRit zpWm`UgACR9MH}@~KMp!Y^x#))Vw2>dEk%BKQY#ne{MWqyu__rdoOP0@hS7`G*TR#L zKP;$iLuM2_a){&S^B&D>F@2K;u0F-emkql27M7pe;`+bWflrlI6l9i)&m!9 zKWFwavy<&Bo0Kl4Wl3ARX|f3|khWV=npfMjo3u0yW&5B^b|=Zw-JP&I+cv0p1uCG| z3tkm1a=nURe4rq`*qB%GQMYwPaSWuNfK$rL>_?LeS`IYFZsza~WVW>x%gOxnvRx z*+DI|8n1eKAd%MfOd>si)x&xwi?gu4uHlk~b)mR^xaN%tF_YS3`PXTOwZ^2D9%$Urcby(HWpXn)Q`l!( z7~B_`-0v|36B}x;VwyL(+LqL^S(#KO-+*rJ%orw!fW>yhrco2DwP|GaST2(=ha0EE zZ19qo=BQLbbD5T&9aev)`AlY7yEtL0B7+0ZSiPda4nN~5m_3M9g@G++9U}U;kH`MO+ zQay!Ks-p(j%H||tGzyxHJ2i6Z)>qJ43K#WK*pcaSCRz9rhJS8)X|qkVTTAI)+G?-CUhe%3*J+vM3T=l2Gz?`71c#Z>vkG;A zuZ%vF)I?Bave3%9GUt}zq?{3V&`zQGE16cF8xc#K9>L^p+u?0-go3_WdI?oXJm@Ps6m_FK9%;;epp{iCXIh1z3D?~<4AhPkZ^c-4Z}mO zp@Sa4T#L5>h5BGOn|LS(TA@KB1^r67<@Qp!Vz2yF573JoDBug@iPQ=tr2+7*HcE3(5`Q%{A2 zp%psJG}nJ3lQR>^#z-QI>~|DG_2_261`HHDVmM&*2h2e|uG(OXl?228C|G32{9e%Onc=sVwIVZ=g2{K5s0>v2}V&CZi1_2LA=x)v|&YrWGaH zEe3L=lw}aSiEdWu&2-C5U0O~MpQ2Hj-U8)KQrLg0Wd|XyOt&Gc+g8oC4%@84Q6i;~ zUD^(7ILW`xAcSq1{tW_H3V};43Qpy=%}6HgWDX*C(mPbTgZ`b#A1n`J`|P_^ zx}DxFYEfhc*9DOGsB|m6m#OKsf?;{9-fv{=aPG1$)qI2n`vZ(R8tkySy+d9K1lag&7%F>R(e|_M^wtOmO}n{57Qw z_vv`gm^%s{UN#wnolnujDm_G>W|Bf7g-(AmgR@NtZ2eh!Qb2zWnb$~{NW1qO zOTcT2Y7?BIUmW`dIxST86w{i29$%&}BAXT16@Jl@frJ+a&w-axF1}39sPrZJ3aEbt zugKOG^x537N}*?=(nLD0AKlRpFN5+rz4Uc@PUz|z!k0T|Q|Gq?$bX?pHPS7GG|tpo z&U5}*Zofm%3vR!Q0%370n6-F)0oiLg>VhceaHsY}R>WW2OFytn+z*ke3mBmT0^!HS z{?Ov5rHI*)$%ugasY*W+rL!Vtq)mS`qS@{Gu$O)=8mc?!f0)jjE=p@Ik&KJ_`%4rb z1i-IUdQr3{Zqa|IQA0yz#h--?B>gS@PLTLt6F=3=v*e6s_6w`a%Y2=WmZ&nvqvZtioX0@ykkZ- zm~1cDi>knLm|k~oI5N*eLWoQ&$b|xXCok~ue6B1u&ZPh{SE*bray2(AeBLZMQN#*k zfT&{(5Tr1M2FFltdRtjY)3bk;{gPbHOBtiZ9gNYUs+?A3#)#p@AuY)y3dz(8Dk?cL zCoks}DlcP97juU)dKR8D(GN~9{-WS|ImophC>G;}QVazzTZ6^z91{5<+mRYFhrQeg z|Kn=LOySHXZqU8F1`dXWOJ?NViPE%&FB1@$8!ntuI?)geXh|#JJC1+G^n$h4F)g-P z4WJMPQn{p=fQtw0)}uk;u*&O2z+G5?iW_=1kTy(!AJzj}de{a9WHY+*SqJ7`={VTi)3NK|)*W3PUT#5a$D6oyqH%5zjdO$5 zICHx_V;1Z)4A(rT6aasvZ{{r`HnxK7^fMLS1{;H{o<8j5hz*F@WkKQmDI*Q%Kf$Mo!EpQ)=HV^lsj9KSz->ROVIrXAI0!Q?WUosf8t6CR*rl382^sU3q@($L~E zC(AoyIjS&2(el|I$ za*8oAtqGQs+O~huhBCOFw(^b&bol)FWsp15Sra3v%&#wXz*!kSi!sV>mhe(I=_Zxmz&E1>i6=yB*_X4M#ktdNg7_G}MVRGQ z7^zX=+mQ}1xtg7JN9E(QI&?4}=tP2#z2<7N%zf9rxzynL~!MgNpRvXaU69c*^X2(c?$=h&o~Fvv z06*{JdsM!gF$KALcW(}@Q&Alo`@3h!H3j^@5rFMp8l6-q!cb?1iS$oZfU+}A2< z)&2ZoL34kkSnbf=4>qd%guV7zM1p=amds@nhpkK7mRJlb?9zYI&?4ftd8+RvAYdk~CGE?#q!Bv= zbv1U(iVppMjz8~#Q+|Qzg4qLZ`D&RlZDh_GOr@SyE+h)n%I=lThPD;HsPfbNCEF{k zD;(61l99D=ufxyqS5%Vut1xOqGImJeufdwBLvf7pUVhHb`8`+K+G9 z>llAJ&Yz^XE0;ErC#SR#-@%O3X5^A_t2Kyaba-4~$hvC_#EaAd{YEAr)E*E92q=tk zV;;C}>B}0)oT=NEeZjg^LHx}p zic<&Fy$hApNZFROZbBJ@g_Jp>@Gn*Vg{XhVs!-LSmQL#^6Bh-iT+7Dn)vRT+0ti(1 zYyOQu{Vmgyvx3Tuxk5HG!x2a+(#>q7#Xji%f&ZxT@A*$m8~z`DDl?{&1=gKHThhqt zSBmSpx#kQc$Dh6W76k!dHlhS6V2(R4jj!#3(W?oQfEJB+-dxZOV?gj++sK_7-?qEM1^V z=Sxex)M5X+P{^{c^h3!k*jCU>7pYQ}gsEf>>V^n1+ji40tL#-AxLjHx42bchIx9Z< zz`>51CG4Iboc%m0DAfvd3@b}vv4%oRoYZpZ*dW?+yTcduQlxreAz&6V(Tac9Xw3_` zNotT9g&r{F_{!Xb%hDPJqn`CWqDwai4M@7F4CQ?@C{H~rqxXwD(MFpB4!uljQmH~( zTXJJj3MEVHkt7r8!^R;bp!H=&%-OG&ONKIOgLJtng(VD0u9%2LuXKe7h$?9lQ^#cL zOo}gOx^+ixt2Izmb6{J`u0VexU0j}8Is+?LWLGvQ66Pg0ax4n^G+xW-rwp&fIZ0}l zI?y~wn^6o3{jj*VSEQ}tBVn1#sVTQB(l&Gf(sriC0DKR8#{);Sgb5%k`%l#BfM#W| zfN5C8APnl5w%nrNi{BWrDgudYAZLGEQKTzz^rV(Bst!UI7|8?nB_w}@?_pYX_G?9i zgK?yo0}({MC^6DiO!bB88kijN>+BCQ8v!rg{Y zz$`Hf$tB*WdxSPHMMkJ{&p0(l zyXx|^X_VUQBdh9)?_2P1TViiYqy+91$zg%3%OjzWyY=X^f7I)2-34bDVCEhECAi z^YqS9x@(kD(Bto;VDKfgIo z-)s_q)d2mr4O;DTUTgjOe4f51kd6T9`xa6_AUP*N{jz%!Z0E!Dqq}JlfPZ2EyGN*E zoPHJ^rT;z^0vaI03Z(WcdHTh1suHxs?;>yWLj~GlkAQ#jSWq|nUE}m()bBZ1`Rh^o zO`d+Ar$33kry+En{&JjrML}&gUj3pUFE58(t|p~g@k3p&-uvoFzpGktUMnQ6RxDA& zibYl_A!{@9au^_fB@6;1XHLORS}C(Hi&J8=@>Kw66&QJD@w>_I1XJuBW3_vn?f~bb zTv3_J^W1+E?921QNo!MQiLHISD9?+dP0BsAK+yB?l009uXXMOteoGX;?5I|RG_v#B zf~l?TPy3zGkT`N>WlZRa=k7Vdbz-66IQ979fX!i7Wen@lu-oEcweu$76ZXrc&JWRf z!tLRg2JqNG{;`-H@L` zKHfgY-Lve@vsPT7B0@716|Z$Z-Z{!WV;qGHV!`h!S>b)rZpc`9J))^79ey;7@-=zZ zjys+j=U6maKhDddqZ}XQffIbFYn)R657nRGEG#j`M-Gni4deWVXcr=HoNok4SKTPT zIW&LDw*WrceS&Wj^l1|q_VHWu{Pt**e2;MKxqf%Gt#e^JAKy{jQz4T)LUa6XN40EO zCKLskF@9&B?+PnEe(xB+KN|M<@$&ZP{jM;DemSl!tAG2{Iisge|}6`>*BENm!G2E!s_XsaUit2`a&pfn!ggt)wG<~No zFFD~p(1PRvhIRZaPhi})MXmEm6+(X?Aw+GxB}7gAxHKo)H7d=m&r6ljuG2KX{&D9A zNUe9Q=^7yych#S!-Q!YKbbka8)p==Am-8`N5_Qz~j7dxLQeaeCHYTma$)Fy}ORKS4 z5sf%}(j`4U=~Aq(!-|ZRRXvQijeGJ^%cq3itmW;FI)JsU8k4pNmCazDyH9@=bqwS9 zq)y8?KhH}MpVTd^>?u+Cs!&l|6KH<*pikOqr$wK%YZ7(>z%vWLb^+m&cCQ+h_MDo+ zaXmPW7CD|K$-d&cg$&GVPEi#)hPjGYx|SBxatca)&Ig?*6~uiQKE)tF7l+ci4JvbZ>vQo}1mB?m;{w?j6>1xBD9F+2p#Y zP3U>vfnMicQVHdhK1yDCfacJHG?$*GdGs93XO$LkB~?nFAfNOoRY`xRs9JiG7CM&D zd5!=ra;zY~qn6HhG|^&58(rYoNlP4qwA7KN3mvymz;PR0%5d!IoDF1vxVxNS5wG&fEt`JYIGi>i=Fq;YUc>8aXv_wIKNAm zI$xs8oUc$5M((w)<+NMQ6{7X7iz)2tqz$eebh#@<&91|=(KSq0xZX>fTn|!v{~LlTjaOXR{3kxDZfD5rHpl>gbmAU z@|wOa$t%grx`7}nA|ePPsN0Y)k&2=Mc4?uE@gW0-f>S_2bO;VnKt&W3k$KKdvZh@& z*WWKa@7#~`b#Kuyw9kqd zj%CMuQ9ESPc-)MbM#7}YUL)ZP_L{+siDWcU?e8%n3A4VsFYJpNeLjn2bT>CI3NCJ< zwecm{{XNM@ga#75hHnwEW-M&QOfzo9!Zfi7EH$DX3S}9p>0NY#8jZt#!W_KUc?R>k@Ky-w6=+Da+_s0GJldl zF|P?(31@{B7bweeajQGYky;y%9NZK$oyN7RTWNn&2`?k9Jytjwmk||M(3Z!M&NOYw zT}t~sPOp`iw~(CAw<+U2uUl%xEN7WOyk@N3`M9ikM-q9|HZC|6CJ8jAUA zst!H<<<&6(6Zvbpj!BrzUo!>VHN3A3vo$EF5-6b1Q~ajXENB~lhUA@|>x6=N0u#cf zv&w(qgG`^+5=HoNur`2lvR~b&P zjumO|P8X;=d`c+z1YJlY7&H@Dz-Rts$X0IYE9kSIlqGZ7utSx^+ z2hOEC-eXviWZXQ9;$Va+WlHlU%y|f~w(|)o@(5J0o|3MQ2O@+B<@r*H4*65)(r^JT zq+<*b06XMGclsEElst5dEfFJ;AQfYhRt}O0CVKdGh4Tk3-(^-{kukZb*3oM$ZffpG zMs;jtk2ZjAsn%mND4R~OS73JDbj^Q440{oS&4<@VUYMInc0xxy?FE@$J_^n)b|gY+ zOj;8Pk^)6$w9nbnMms3RSr6q(9wP_)v01|=P}UbkXoS_1#FCl?>&9cjCHOS!yEJqiGd`83Nj00{X6dHFN84%)I^*MZ=*Ihw5FxD0YSJHV{j!9v(DT#k7##q~$ z87Dig!k3EiMO;k|9XhYz8cGVPukGe$N5@yNtQgngIs(U-9QZ2c^1uxg$A}#co1|!Z zzB|+=CrR6lxT%N&|8??u1*Z?CRaGbp6;&#}$uQEzu(M6Tdss;dZl=hPN*%ZG@^9f* zig-F9Wi2cjmjWEC+i?dU`nP`xymRwO$9K3IY`|SvRL^9Jg6|TlJNEL9me$rRD1MJ| z>27?VB1%1i)w5-V-5-nCMyMszfCx0@xjILKpFhA4*}fl9HYZ~jTYYU@{12DS2OXo0 z_u+ot_~UfZNaN>@w4Es$Ye>i&qhgqtxJf9xi6El-@UNPeQ>aXcYVxOUA--x3v1 z3e=7+%#m@}QuMTjN3n--=-{@rNtyYdYS@LJ(G?*np*HILbUeo)+l8N#+F-;^(8w>i z8Q6til8Y^NG7_qa*-n2|4}(k<-HF~R0v*cP7bxlTWNJ1s6#Rz!N zCYesAbm(}4qp%-;B%AF-LyS5Q6@Q|V&Y2ar$uWn(?UstqXy;5$ZOCC_?L$F z@o#dk--?Co{)CGEP^73Kb_^>`G8sAN)M@iNKQLBj>QAcHjIw0!1 zl6{UYd;|bA+CcC#3IGYysWLa4!KA}CsEV#c)JpJcF~NX9mrX2WwItXv+s%I2>x#v) zy%5xDSB`&bU!9COR@6LwbI|OQ&5mf&L^GGZnOXEOLshxOs;Y;ikp^M(l-^>J(o0NIdbt5`(fTq>p%?cG z;%aHXhv=-@!20#xf*q)++kt8IJ5cG{ff?Sy9hfzQIroA8N>Git>3xOUNhe8nUspSV z`GL0DK}<_w!3gRCwOvD~m+Zn6jxTMde<_?egr$S1OySh6XsS!0Wh)wJPX+xd11YQ= zMq7X2tU;U;Xx|ObfO}%y{pchi>ryaM2zAy50_$ltt(ew6h#CF@+U74D#H@hdQ=dX_ z=OChf#oerWnu~l=x>~Mog;wwL7Nl^Iw=e}~8;XZ%co+bp)3O z{Mryc`*3ryyIC*S%Zu;8Y_D3bFAn%8NTYv?y_%Q4zR-DvE(Q*~>ec+JSA76q7D#_w zFR&HI@z>V`9-)xr*ME%7~<$Ykd?U8uZ~EqUe&AlGDqP{uUvna zvy#q%0y2VKf%UxO(ZC2ECkuzLyY#6cJTru6Q`qZQQ+VF1`jr8+bHIwcJg}=iko8FE zDt(bW8pbOr>?{5KLASE=YFFv&(&IM|P6@wK(5#jhxh@Pe7u_QKd{x@L_-HM=1`rX8`BDds3pf+|$)DBqpXrDP>JcOxubC$Dy60;8(mfG^6yXE(+N*UWMW? zA~?H-#B7S@URtmlHC|7dnB!Lqc0vjGi`-tNgQ8uO67%USUuhq}WcpRIpksgNqrx{V z>QkbTfi6_2l0TUk5SXdbPt}D^kwXm^fm04 z^i66Xn0`pLmnhX(P0|TezLiFcQ{E0~v*cmmAR2|PETl7Ls>OakCexUmie^yDw3ccuqd5(wV_6?YM+ zegsV{M=^n{F2a}~qL}DfhDok9nC!X$C9WV!U15~DF2xl0YLvS#K!rPqsqS7(b8m## zZA(3F3H0v&0Z>Z^2u=i$A;aa9-FaPq+e!m55QhI)wY9F+db;s$6+CraswhRp8$lEl zK|$~`-A=dB?15xkFT_5GZ{dXqUibh$lsH=z5gEwL{Q2fjNZvnQ-vDf4Uf{9czi8aM zO&Q!$+;Vr_pzYS&Ac<0?Wu}tYi;@J__n)1+zBq-Wa3ZrY|-n%;+_{BHn|APLH8qfZ}ZXXee!oA>_rzc+m4JD1L)i(VEV-##+;VR(`_BX|7?J@w}DMF>dQQU2}9yj%!XlJ+7xu zIfcB_n#gK7M~}5mjK%ZXMBLy#M!UMUrMK^dti7wUK3mA;FyM@9@onhp=9ppXx^0+a z7(K1q4$i{(u8tiYyW$!Bbn6oV5`vTwt6-<~`;D9~Xq{z`b&lCuCZ~6vv9*bR3El1- zFdbLR<^1FowCbdGTI=6 z$L96-7^dOw5%h5Q7W&>&!&;Mn2Q_!R$8q%hXb#KUj|lRF+m8fk1+7xZPmO|he;<1L zsac`b)EJ~7EpH$ntqD?q8u;tBAStwrzt+K>nq0Mc>(;G;#%f-$?9kmw=}g1wDm#OQM0@K7K=BR+dhUV`*uus`*ND&2x<wG1HL5>74*j@^8Jn_YA_uTKbCF<(bN-6P0vID7dbLE1xY%jjOZPtc z2-(JHfiJCYX>+!y8B2Fm({k0cWxASSs+u_ov64=P?sTYo&rYDDXH?fxvxb>b^|M;q z%}uJ?X5}V30@O1vluQ2hQy*NBwd}kGo8BE>42WYjZn#(~NPFpjeuet!0YO{7M+Et4 zK+vY}8zNGM)1X58C@IM67?0@^Gy_2zq62KcgNW)S%~!UX1LIg~{{L&cVH^pxv&RS8 z7h5Dqhv+b?!UT{rMg#O##tHOouVIW{%W|QnHnAUyjkuZ(R@l7FPsbEG&X{YTZxd6? zGc~wOFg0-e2%mI+LeRc9Mi3vb*?iSmEU7hC;l7%nHAo*ucCtc$edXLFXlD(Sys;Aj z`;iBG;@fw21qcpYFGU6D0@j_)KD&L`tcGuKP_k_u+uZ@Sh<3$bA}GmGrYql z`YBOYe}rLeq-7bVTG?6wpk_57A#-P&*=D9tDbG+8N86Ovlm%$~Fhhg1!#<%uJPW4P+L>rOa{&N2gbFd3Fh-nnA8 zlL@IrHd6K33HFYag|7^pP;EZ&_CU5|tx*P)T5w<3xsYB7C+*ZJvZ7o_)pdFg0Mq37s%lo=)Pp+u-bBo85|bFx@z znXN$P1N#N~1jF)^LHc?61qH?2r$7+}^DzU=b4Sh0ILA`+DkZGwe8`w6RaaLOy2{+; z*G-qRoS@LWVrj2g$m_QBE_9ft8J2%>-hNdge!7N;!t-RmW$Sx$dLFwX06)v6%V+3+ zI_SpK&${J_g&{nfAAf~@mBoJzd1aB-d!go}pMC=xBXEb1?t=6Z2khtQWf04f1vH2D zAzR~Tj#erum;iqZ)uy9mW#IE(g6{gBs0m8`Hho^9SLk>6WYl=|`BSI?aM#~0G0T@g zhZQIE7P486_X7pDDlh!Lpxdh5G=KJg4;1hc2-bl zI9c0tmCMY}Qn=5b(4Vqv{|sKKb)cXA9B?~>}U6*`p`RQ9+ELmfJLHahw z(?8R{AQudS8<=zg^lz2qD}8im+_uhWqYUr=fMT#sIo${8zZfe2N&j7)tPfNL^8Z2} z6)v8;x|<$fDzHr5?L0g@AOmYTwm%3~HQmw+c~!W5LEVM>2|z;BF)jd7U&jQ>xPb5h zeEn5a91wogI=6UL`b7g^&v-q5Y#V}Z4=>PWem5wViJ&4Bv3xeU=0-BSSJgLq4+X0GzB+;^$X5GmqzaR*xhkIN?DGhN6_q3Am7=yuN- zb_|MEpaRpI;Cvp9%i(}%s}RtlP5ojEwsLfL7&QhevV-Nsj0eq<1@D5yAlgMl5n&O9 zX|Vqp%RY4oNyRFF7sWu6%!Dt0yWz|+d4`L7CrbsM*o^`YllRPf2_m#~2I3w7AEh+I zzBIIu%uA#2wR>--P{=o&yasGhV$95c?|JRlO>qdUDA33j5IN=@U7M#9+aa>fFb^X45 z?2QBBpdyCETfk(qrO_G9QH{AF(1{Qg6c9(jWVU>`9kPNV#kqZxKsnG@ z%?+|N3y9-DUAf>)sBX#CYB(Ss;o`eS>0TYtk8(ugt>(!)?E#S%6uC82XIZqAYlIHH zMHZAe8xkWHvSk$;54;FuF~4*RSLzf()!C1J`J>iHkKBN2e70b?Xqa3NOvAB(w2*)%usxAitdXR zXsosCjl0P-*iH$V%MrP>2!E3ZHl@yU_+CN1fffNwny;LnWvPf(q;(3vd z)}hwfgz-(OR5H?(nx==K>;(!(<@t9;uhDT<@L}{HO(kEVmC@_oXQ(0S**-;H@pAPM zql=DME;|u{PV`eSkr1cw8-cy+VdH~Tho_^5PQzI5hn0Vy#^@BR|0?|QZJ6^W2bop9*@$1i0N4&+iqmgc&o1yom5?K6W zxbL!%ch!H^B7N{Ew#U$ikDm9zAzzB|J{M9$Mf%ALP$`-!(j_?i*`%M1k~*I7dLkp< z=!h>iQXd~_`k9coWTEF$u+PukkXqb;1zKnw?ZnMCAU$*2j^CZL_F4f6AMEu3*y|O1 zH*on~MrSW(JZQTj(qC~jzsPRd?74SC6t~&Ho{fJ*H*AMvXXx@p@_Al3UkBY^gXE8Bdj+ z^csKuPu+aSU<4<E+ z*bM#6<ud+wQMn*g0ivOoLF2sMG zMX|YA+;yTTVpqi0qIi@1?JkN$!q*sv^Y<6UyZ3E5ufmiwQi z%d*cc_c?mG&n@>~qR-1dx7`0aeM9!S<^Jm^0J+aC`obd`xi4Gp$3(a6bIbj-cuMM7 zii;+o|1H4kBUC4nix*$<2{av@xW8pXsPUVs;6 zJVT3+(1xAt?9Q3@Iqyu)%%8u%egjy8DR6vr^rrerZ%S*Q{Fc6`FJH6}@8{p6nQo%F$e3uUKnOSQ}Q)_}#>H zIS{p_QQ;x^w&N3pj&F1Hkiv+)I9^?SyjnF{bf|wGg%C(Lf+V!)h2xUId=T2E9mcN1L$QF^ z5g2*u_)h#xV5qoL+7?I^OWPS_a6JtT*$mPcAHy(mJmUtoz)Z1zp0^RJebf|pVGWIs zQB0nO8D@fneP+6d6PT}AA2UVLt7UKlb7PprygKtn-5>!^V1XRwIrG!}4+mn=`W zBk<_rS~lAZls_hOj;GnnAs;L$9u zaRbuj_dhXN_<^afP)`ndO!qW}o+exVj;Uj$zv1Tc32vVWmrHP`CoJ`Zxvp@$E4=rv z{Dp%8tK5(97c5fP{T{ZAA#Omvi%lqOVetgT%V6phEDiQ6oM7cL#+QIm<(v8kP)i30 z>q=X}6rk(Ww~ zN);x^iv)>V)F>R%WhPu8Gn7lW${nB1g?2dLWg6t73{<@%o=iq^d`ejx{msu;S`%=Y z2!BRo(WJ^CT4hqAYqXBuA|4G-hEb5yvQw2Bx7zVRpD;RR2ccOu@PhR3faoc zzJIZ5StRhvJT*c`VV6u>2x;0SlCBHsQ7n>YhA$6iQU$Rd`#A*0pf5UAX^2~Qi`Ky%f6RGsoueIc_WKEcM!=sZzkijF|}LFs~GM=v-1aFc3dl?tifz zSiqvXmL+l|5-?ahOL%3?PG<>&D{-(~{sG3$mZG!I^`lqCHWOSn}?5JWosiW?}R7Hz45Z6M; z|I3ZkC#9f+gJwObwvJ7+lKPKs9)HS$N-3eNAWZc~d`TP=sY$X_md=Li)LwW?#|kR6 zy$#RzQ>|l?27Kf`O2bZM(f5 zT<@B@DC9-<3~{+a6@$%* zbtze+^?#(ya}=}LbSblhT0Q6Rm4>3=gi)o*G!B_6$tq*ItV%e0&U6FU!uj0%!h9}S zX6NEZ9}oimg4WPW?76Hk0#QwuQj$)~3QJw+v|eX=>YZgbHMJs34ZXEzFL($9Pw6>L zDO8nGd&N^$GQH4GKq$+GsmsL%*AWQpwp1!JQ-AyUofV|o;~RKj0^!|%nF=P~ai{JL zHLCol`|FQ7a$D7+PR6Mx&`hnhg>;JWrBjTd0T_>aUBJK||PoA}xw zjpy>>3&$74TY?_p_n~D4+YZ_`VA~C};yEAv@pMP)u1z-biGn_klvcL6s zU`UFOa5WKV3&fLwP#~_QGqNI?vZjX9e_Ddmyv`La8Jre}B_kXk=J63Dn>GS%Nl7ty zD3D2o(^4iZ3mZc%E$ibOHj%F0n#U)zib4~{uoPZTL$0P|m2+KIQ#3oub%T7-d~5T@ z=GJh6j|NV-!5BPIEvv`*E?MCW0ZmUuQo58-cw|hMG8wK%_B(RtIFDydO?RP^e__!P zX;g|RlA4P24jtif(}ij>mC-fQG-YluEa|d!vZky=`ljZ$Ff1r&IZhWinz9xVW74RO zYid$XF*J6~9#4m@lhthw1!$|R%I2dC^$n%=%E!^TkD;QWai13pu*d@!Y6y9c-dw2l zpbj-&crkx2s<6ZhH|C13WnOqNe@}d^VDJ{l;le5kl8?)VY1pm@y|@qed$1aQ;y}@) zL?Jvc0$AuFD-SZv*SVC~K`>q0t1Aq34UJs|`lF_(@D?xDV66bu6ClOSK1t`Q>F~QK z56Cm(MI(a3aT7ypQO-6;vTAZ&m6Uwuwr6=LD-tLFL&h0P zIO1GPDmNp0`#UM72-bPfjP(o)4PIiAp{Ai!ThwhM9u`&DL*e7r45@}qS>??T@1^nnVwqpqQ|k{%dq*L zC>flElRbiyesX2Z>T19VbuXQiV{#@+&4oMF+fTiOA{>-6PSIjcOoKFS6iq+l;13qz z9r6xO;T=vS2R}50ccv2#o=Q|h+CAJH)AW%6InA}KX&=!}FH#s5e>yTlWkaW!*oqO6 z8SU{JVB)Hl0v zvZTX1MRnmt>R(Ase@{zh`Mq(VYx=EF{=B@5S3GzLuQCMxe}@eW>)Mz!MD4@r)31AQ z0&md9FQ^oyd75EqanI>gGg*_2aw+Y?TZJByZ%K~Lw>>z6cc`nDyCqzBkH{8`(LOG~ zi!9q#KEQ__ypNCak(H{r@CidzT+zgq{Y+dopW-YvxkPDIf8F?;VQslqQT}{=AzZ6F zxnZyS=YB7*X}^!B6yLBv)PF1Vi?pQN^vOp4KT@~m?Cor>*}GrNCrA8Eop<;|;99Y} zKl%=)R=@D=O1lzz203Idf@c;Io*aod|N(Ldvd&;<#t}{mYn$t?;DCw($YAa`5v;U*>3p2K6PL7 zys(f}dR3lZQ!YEl$O}x4oh@DO@qatRvqM}Vm)_j>J-94ELt=Krd$CtZ8|QKA>}ys5b|I0wKk~(gw@WTg-gz-E z-n{phQ@gf~i|(7xw!Vj%cOG@#m!2tdzIT#XUxY_=#kr=;#50FJdPiKX;<6g%q5bcD(S^wB;}3Jp@7< zZ8SLqRYg^%-#s)lqC8l`qOsgr%x+u3JE@b!)d9qQ{Pr~%n=KFw@&Ec@m*Rq_0JbiJ-FiiY_(H~OychZCO!23^?kxr zsb6t9-n)(!fBU=h#GNC%a*MbEeJ^QR$1+>KO}iv^@kf((?fv)jjy!#k$T;iB`fx9s zvzxcKJl2e6tM1)!{qv34mp6vCtlhS;y6DDUlXXfveK%ZiQ8{u;>;0mt%BNQ^#D=u4 zTW8me!45Xh8a%S}8iHk*; zc34jqTp|rTRNYt_aaJ*KIuAv!@??P}v9jPJZ-M46271&EMPA8~VY0rX2RK?0r?4_G z=%c8Lbe^oZLUeMavnp62{G3T(ETUTH>k3u~IlNU5tQh%hJ`)sE-+Mq6Yk?H9f)CP} zY_Lp}$-xIK5$7WgHUV@9%T1u`HvwI*i(Pa>H^(8RR7~s8;^31S^uMk^xyMjTmQSU{F9Y?c8LA z6*jEkA*0EOD@2*(y1`E9U7;!i9~1$43N=S==mjf!yh29?-XUURV9-M`*{~m^2y+-k vO&Z*)1cp)oP!FoJdnQj@>B$Ny9`3IcWx78NY!UY=EiM6G;6aIVL4^VU&1=uc delta 34727 zcmXV%Ra6`cvxO5Z$lx}3aCi6M?oM!bCpZ&qa2?#;f(LgPoZ#+m!6j&boByo)(og-+ zYgN^*s&7}fEx`25!_*O>gBqKvn~dOCN!``g&ecy%t0`n>G*p;ir0B{<{sUU9M>#WqH4lTN!~PgB@D;`rIdQ#hRw z?T|`wO^O=zovKDMVjuZHAeratT0Q-HK<95;BTTtc%A5Bo>Z{jfiz& z$W5u4#(O_eLYQDY_i&xqzVd#y&cR>MOQU@-w1GN((w{b+PM;=Y3ndBGVv|>|_=ZIC zB^E2+XVovHYl%!I#}4)Pma4)hM2Ly6E;&R5LmOnMf-Qz43>#K*j*LSWoYxxIR5Csm zuHXA8{`YgmqApC|BgY0wGwj-im6rmS^jrAbN8^PEIHj1WH#AVVuUA2HXj&Vm*QD^# zWX8+sR14XM!@6HrfzFpcC$ZXlhjA{{oq5cs&VRBUX2VwX$fdjO~`3n~1})#Bxr5Vh%KwFov=k zW;Jy5qsvC$lw>?*BsoPIo}YgJN>u)C^4Abbjx$NW@n5S8aN_T0BeAXWjz#dQ=3v*# zRQrjH1%R&krxBrfITop};aQdE=ZRgLN%n%+^y5BOs|pO6lg|I3prX{gSgQuRK%177 zlE#t+nHbT~VSO995imTaX&SCB&pgp`Izkg}-NV zI%~Z42T+^_9-gw;yOI&!oZf=H(Cot~)w4^gX&q(zg`7ekm4un&?FuaJQKIrLF$<_% zR;ok9K%L!NlTYgW8?uhX&TS?ojtu~oLm(`7iY<5Ci@V)7+gRHbb!o0OipVh)`vKW) zp9OVLDkaP@Sn!ZRa zpfwY36ct~JlEsS7_Dr%e0UL8^zRSsSv3K)+n$b@Xq9*^-p|AFj(*#}L-%5Z}D@Zl%y2gokn7l;Zr z3CK}pP8BDR1$L~R{R^BwKH~@v9m;O_$00a5MMXTe!u0FG^=2=_f-XZR!DQeQ`5S_$ zO>mOUF8Y-Wfl3P|Mk-VDsBp`X&=kMQl<>nt9$C)^A<4v@xtW>qn@`Z)`|gCedb?$A z^S(N0{?3!oy|^tx0p&<-D62OWo$gVhEodpMi;O#DM7P>i6bnTf$_=~8)PdQ+^h30pu>DfM=LQT20!&5)= zGdR6}f=YHb45NFG9?dd44$Dm~B6k3w1%E%atidmZ`Kaw4q&8yb+5=wqe`pXWH0J%);cCo710p3&(EMuAI{aKjT^Z!u)Eq~b?HpnrSE9ftF4Ibs#HFpuPR zyT$g5JIX12nSw?q!}IY^iHMikUh8V)gjx{JN@8Am6<$2Mz^mHY*_n$LNj)%w6Vs2|Kwpq;J=(VFf`y)>|;A@J@8mL zpw=k%oRd`%OdUL*1^Bd27^<|sYM9NqMxOfyc56FSDcG3u;oJKCAOsBvw)JlyBt5jT zQZ;fkKI1}9MJMtnCEG?ZUph^R-lV{%Av1S91fH#pacM-EI@93$Z)d@UUxu6ruJMHVl=>YjT8reRi0SjW8t!4qJkSw2EWvi_K%!>35@JDfw9#W$~G@9?4ubk&}M9<~>f3`r6~|Hun&D&#w^ zZ2xrK!I3O(3uNXz*JhWWdgESs3jPCOS_W_J;0ggAduavgNUuLi`PfS*0$=1$q$C-# z>ca0l=Pm+p9&+rJQNFKvb%8vn0!qW9SGnIO&tjv!kv980`FquGKanhc(YAwQTGx)(9c1fRnojjxST~<*=y|?=9V1w`t~7Ag$5h)P#FwB7FM=E`e^youj?Nh^d}|GOC7mPW z_H&16WtD5M9H)i@@=Vzo^f`%yIQZ-qGuCko?CP8h^B$X|UkaKazJe>9C00F82u$Iz zFOjPU5)>;*KBg9UezT$OL$aW(Ogut^COwjSO2!@-ZbW#lHVfb_k?7DlEGcbl^tn{p z#+go${sx^TPB3R5272wadT(x2lACj6Y4~LktAm z<+#pEqlksdo%9?Q29%rP9C+LM*WZM-N-e*wX85OOu}J7Zrt%9iGjxN358Fy5GGaNA zlr-b*b{4zqiK)A~_jjEnJhRaVOdID52{6I%oS^X6)EYS(>ZE6NKd-S?F}lIJNYkBz zX=;apb)xyAi#nMFCj#Ex($CGiR?oF|gei))16?8E-mB*}o2=$UtMDZxq+&Q?liP(n z&Ni8pBpgnCai7%!7$wG2n4{^JeW)f-h&_$4648~!d7<~p8apf5f~7e0n$lV_qbrLM zH6T|df(D0@=>WA5f5yN)2BIZFqObOK5I*vhD*2~PZSt*83>fM))aLjXIEokDF;KGw zZ_75?2$lhYW)I_!@r8QpYKr4p27lOeG~ESg#8)LE@pH;oozO*hv19;A7iT#2eow_h z8?gZtDstc~s|f{hFXH|~d~zQ~z_94FB&hp$n~Uv_DB!2y<6&VqZs>-fmUU^yuJGdJ zNCHP?2Q+FZr?J{^_M3`92rOWnrL2vymWZ&0dYxz>Kv&GXWgwxTKz)<+J43r&!q}II z1DmfLl8nu-xGa?TgsrX45d}j{QAC!m8iO1JU=|Pb8D@9FE-V0hJEA?F)srec5$GqD z8(`^KQozt$N;6ts8^+R_uiy|d8MO=#Jvd3z_#2aHXjF94XkEdq3myI_UvT|r>1&LP zU*Mm7Fk}T$qbutLyH`@m{L57Mlkq!hAMe>2-o(8*axogLh^b!!{|amH_{Hrdu!4kWol?jSB%l2>w;Jry$!mf_nbz9_B1#8bWJwL@w!No42F zZ!YAr(^WO;wuxHb`%ZD(qKIOW&)L%j)eAUf-WERo1D?D~FV`np( z5x$@RPj8}2Rbm<>mRjfuPFJ`nN>>ltyp;oE9#K9IU>+pE$;Cq!IYr!NXvc_-MDFXBXW=Z9LZM(k9}OKqEKn5 zMk4%l_POO{UM$2M+YvQV#N~$?Ycqe>LbTz9ur0(-Wp!^8a^GDh7h{U~8h980RG|9E z6RPnEU0ccY1fEIdJfnZ?3Nl4X0Ag>*m6>|oajhbexf9~a8(K`2Ys~o)z{jnuOj93V zg4L4K@x2Dewt5Bok=03M@JIhBSWy2hwxcxRv7ukj`8uYPGrMdH0q!`qHJ^xDQ_bLG ze*?ZCvMv^t`JI7rlqLPEo^WJ0b^>d@C~mI!Zv)-ljBg#u;uvw%ZXMqZsz8Mxdtvbh zbK^eGn90ynsgjzKUOl)O`l3#-uY%L?tj;+Edgz+awV132>9Z-?mj*}u ziM4~P{Pc$s;}v&zYF)Te5J7W2!$o`EH|~F3NfA2NjF&~?@K5S*f_mv2@wT};{Sj`b z%#^~iJN17>qQ6aej~{ubsrhkBAD`C(j7{y)+hU@!^SU03F0Vu6vU3+>!lN@MLR}42 zLOtGS+@f@~=id z8&aK=-2+Pz*y)te)kF3xgyS?qgp@L;G(tM1&#!4p&Z$yX2<+lj>VWT1tiO4`_h^}* zQ@WGd`H9t~sH>+NT2d{O5(~BeYjG#5=s&k0J)iACkpC8u;rFz@_E-w@s0bAs_;b>+ zeR6?5n@}4wjy}GSL@%#%!-~chg|$Q=CE38#Hj0u5P4^Y-V?j(=38#%L#%l4={T(Rq z=x*H|^!EG)+e-leqrbec5?(g)@Op(cHsVg4*>F$Xb=BheCE*5LdSmdwZ-MSJs@@i{5t){y; zxAVyon;`>Rns;YH^`c&M3QdxzNaJl(Byct8a9v38fkXaJ_<=8oe=(6%mZ}CJAQ}2r z#oHZ)q;H0pGydy~@02e)oeVW*rQaD_OLr+)29*|p(gAHd<9*JxBnu0W61lNr+cO_= zX$B`VmPwyz9?FV9j3-@v0D7Z1Z}O;#KZ!@Gm7ZeKORcLQsPN8= zAZRd8VWqow?b1Kp8!AiYk8acC$>6xHuUZWkNk~?EqKsUr2$iixV=zYwM9laPwn)(W z7b-$PlwKh6n5^&Rs$#s&98P1ch#7FGNN6yU!Nwzcesp2Ylw~C1F@G^YA!PF|a$MJ+ z{!r?468ju$sWQLL=o~SYP|CBJ7(3`;c^t;TL4ScL$Pvv>N+5iugRLdmL zaD(CzY&3J+N)7MS)Jw`U8u*IevtEAUKN4~AiL82B$4Bl5oK#No3jGEW-o4`>c%G#8 z!h<$iX*efTk1lnM-d*7Db6h_94Y@IcQg@UJ1-g76_d9@vHWB%F55WG&!4DAy{K)Xv zz~7iiiq(J#G*Jdb2F>RKFnc3y>bIwlQ_Jhzoc4h(EOVm|0C}@X1v`lf-*wuaH5_H)kg%$_&tAkc`-Mk_04t+f0A_7=y20O8`7#X)4WDMOUpG*Z~n ziH5Zevf@*c28LS>z60h(QH92FxJHOKTj&>ep>z##ag+Tm*{QU<#Sk`f3)1y<#hgNV zkGRx3`qggo)?FK!Vd`6U+lA@MVk3QlsjDj#M*^!8JsEqK;p+%l%NyiKg#EX^3GBuk zlh2;u`5~mtZgY!005*{*dmF!OsrxVg*Rpvf{ieqF1ZPV6Mm4vb&^x06M8jn4XO#a* zXJhi$qNRT@M;;!sLq`lbqmcnAsSvSakQ{XcfmP-CU5_ini_P>t3m1P+(5I3tq028F zE8xAnu-M!FQ{&(q8oC{RXMCqw5&ri5tvt$=P|_J!+#m6Iz;U2BaX7}7%E%i{`jgjM^OfP1@K6wN+iSJ-2z7%MfLBS2$+zC|(5j4tu zq@N1d5n}UyXF>Bz{_%qT2O=&{@hkb|g++>5oZPMe%j~Ee^;OCr)Y7u{V4m&Qf@%WD zEUKEu%teX>pmF5DMIP1!>pm1D);32{D-N5>U4W*9kTO|z(Tb#n-@+j!vWj-S8aRy<(xvQm zwZ-#hyB%RQf|G(r&oI7iZhf^pG13lCEWA>mk}rI8IFlm%*!~#7;2xQps>NS2$f@g2 z1EoM!1ML(HjM)=bp>Z>u=jEM5{Ir>yFJ{m8hLv-$1jxB4a{4HNUhk+Rj5-H8}G za~r&Uoh}bQzyC)f6#o3mEkwFNhaD8_~{CW03Dv2Tbl4{ zAFamTS$i&ZYWmae1aCxVNIKrj+u4g3%D96}iqw8~HBu+gFA&*oRP5Z`MikjjDgYjq zkf0&#_Xj->@bJ>!}JGl=t1|~ zGIx9!u63fRtm^?=^0z=^H2SZA43p1deVixbphteFyrqycaRq6DLy2$x4nxgB;-Dug zzoN<>vK7~UxLPDR{wE0ps6mN9MKC>dWM{~@#F)ne0*ExL**#VrA^|@km1xCtF`2N( ze{G#meS3J5(rIs2)mwi>518)j5=wQ+Q`|O{br)MyktYd}-u+5QYQmrBU2ckYE7#Z$ z>MgHjknqi-2`)(Z+pJ?ah4UMg*D%PFgHFMnKg?{GSZZ*f3V+g@129FH@79v%&$&v32_So*G$-3SIp6 zYTlLgF2}s>)U;QtdWf5P&xikI0p1eg2{G!w0+xXNuYf%n#X#fou8}EYvAw$zmrjK&OZkS!$REMr$*aG zyPPjsYd_SXp#Vt9NGI*R;-*4~Gz)&7!zq>hh7)i?8PzCAAv(pNcUGlPNf^OXS$=bx(V#ji2eMF6q{U@ z9?ldp%YEsl;)d%}_Qs81OX>!2>kyChh!-n0Xd@2C1cI2qkRk&b4)(?@KY|?%qMoYb zEi7l}n$O`v+T31;YZF(;FEwj`I8Dz*9fbKrE)8#&?joolVY~3YbZuJwfRt4-kCOM; zcm34HXKH>;a?joGLqjIBG|B??@rS`LSU(l!vxSyfKmGa^x5&S$gvrsrlVT0@Yw#bP z-3#zdbm1;n!DpT@>AnxkZ4llVa;h^fj?R3uN5?-F)SLb}a%TBE=HM5_U*{K=ddu;L7kJ## zqyyGh;WY5rpvMm)$*xZHv!CUlc{zU8huQp`KmQT*yq*ugOu_#Kt-kRa+ODx`Va(;{ zLMO*lsSV`U%+u>-R9GmwqgWulP#>jO9|V60TBE z5ONjntHY2V_MmDJHr3CyuL5X%IlQKbDRch~>EBrwAM? zvOJj&z#NzlWa*K*VEZgjP#cAQ-HRG&mC)aqyjY19GP$U zSKm`d_gXzrLE_^a!9R<~vT9n;>{y3F`!rB%M5psN(yv*%*}F{akxIj9`XBf6jg8a| z^a*Bnpt%;w7P)rXQ8ZkhEt)_RlV=QxL5Ub(IPe9H%T>phrx_UNUT(Tx_Ku09G2}!K($6 zk&bmp@^oUdf8qZpAqrEe`R@M|WEk$lzm$X=&;cRF7^D#Nd;~}a8z$(h7q%A88yb=# zVd1n3r|vPZuhe!9QR*ZtnjELX5i*NoXH%d1E1O1wmebT~HX0F~DbFxk=J^<v|BCiebRdAHYXxOo$YS#BHYecz?S6CX@AcF_k;#_IF+JIV*5|%lV=Y;Ql?=b^ zt}1qN)~qaKnz~KZRf9Aa7U5S&Opz~;SF2ojOSD3HP8WYTbvlEyYK~);#wr+UO8_Sl z$-Yx3B~JYU!uChjzf0v1TKYAtsRkH`QZeF8Q$_`7iPJ79{8V(jbX4T=-LF59vw>au zY6LS|t!~Zz>*ops1&9o5w z3lQx+lhgdg^4d0r-%q!s(A$J%XYhUx~)v|ptx_cU#?44pnz*s$G%3=wh_01 z5l7f$uM;P6oqhM8F|$4h0me5--syUE%vI)HuhLv@kL`s1eP@buw&}80Umf5QOXBlP zAY(8r9}paD1p*&Bir^3<@3Cc4Mr>EpoDHghr{U$hcD8$^OZ6bZS{UYhl_*Otp}Be} z-P^9U7tc!@aodKCp{~TV6o}?M9xG$hN$Kr>|7e~E4mJK>_yjrqF@Kk1;fHw1PP`UI z1Aoa$7yGRMrUVO0M9$rM;=Glzi>SO8!lqon9E_1^0b)CsR0%Nv-$st+be?a*qJkqI zUNaqi*6Y^E>qlHH+*M=aj?)y2r>RGkG?X;Rv!7JG6Uz=^g7B`jEKEvgUq)s3Fw|zFMdak((XwlUaSRN4hGMrH zn2xFaLH!t8txnTiQW;qUWd^m#<3zgCp(=5~i~xw9lU{R~o1qSo#Sh1_4W5(^hL%O9 zOauMH!uGL}u?hV!4V~#?F-<;)X<)4B$u1F4 zf=%}>{b#f`$Ixo^Du_42V6Wir?Muh`(!izQSV9Y3d-MCQT|9bs zIlCtJP7*;A%^1-=u(Laj97hG}uP6Hq0+DzAjB^|$CG(?e_adMTiO&^_9WwrW4H!ju zWEYrjLw<{fSyh-yiPOP{O;c|453fxkp`E;k&)d^wYK=ipbD_kG$u*Ro!kQJOppV5* zP4o#ab%r@RITbag_zHMKF5$z8fJd1L+D8G@m^`*H->XyF$E{x;d;A+T`A zR!1#O!ed)ai|TF054f1+K6 zTDH=fps}vL7=Yl3_R)o948I{CP*`f1v{E~-xX#PaLvb?#qQRElOF-pVuL>d8_�{ zSCu|?z-R)71@L#eM!y^Z6p;ZjzlW@gZzHJC3~O?Pk5QEa0q(aFy!-~pFZ%vBM{a0B zOfAZFmYc{!vg!PSF@l2U zJK`=N@CTmAO4Wuqv6k{SNl?~rs-CcW0VFIdAj^B2Wacs>M@3N&63=c06V6Rf2sR|QLucLaU zKEq5=F9zA=+3ZT|OlY$lIrFmvTV4H!iv+MxhtKJ%j}wlD3qAoT@g^}Cw`#0dsQnXX zETbS9p{IGl{fkz7ld(7^$~HEkkh7pv3NYi8<1qwOw!a|xaQ$TntGU7;01Z4?b9D8N zBh&aOYgatY!f;X<$(oO>v=8iOcEG%aUvS8Uu1du6!YK*G&VLOXlHRCKu=FF(IkNo_ z!128k!z=B?9(@872S5v{*=6WjNH3gAJAUYkC%^7Y;H4r>$kZZC%?&3E-qa#4n-YG$ z{5tlV`bCK=X~Idzr7&v8p)y!whKx;pP;V!X^4&igR1g*2j}8HyVC+>KqbPFthf}+i z5*V2^NBvmwfWIU)3;IBGEwFtYFWVWUoB2RyvL7S*E#d%FT_ytxM895Q4V_PCQh+>< zlu~L{SuQcQ?il+AeFdE87H!P8>HgIJjkGW8@`{o5wNd6uVn=dNX5$aDi14$pTSR=` z!YTmifM=Cy`Z=%xX-u&9>1bJBw3nKr0@mO&YfAp~^V^fzVJyvwMY(hM5 z=T^FaQL~&c{7fIT@FE@vI;GbS=Go0=v=3x<1AaB@b>U z;-hwvu#U||CUj!>9G3YgO6yQX+H)L6*ozXXaV=U_b`_DQWq#`f$?cZ;??y9(AcTLq zHrc9U_$w&NRKgWZ>e};_T#tf-g1TX#Ttj{JjKjCJqlf63U8$=~02ty9Nn3p2WX;CqqYS% zz5QZEArIj!d6Y0VI^JFWKudu=NFUPF=6TxRR|reQB5_2vIn)qBV}S3;MX1}04E3Mt z#5d$zK8z>OW^i7tXPB6e%UCqcK(le)>M}pUp6H17YHZ$`4urRAwERt6^`Bj>zwymc z6H+f|4zhQjlg1Gy%93Sw`uMScxrA;vQE~ta!zM?jz@&c;IxYkrPHXB+h4)S0@SIgF zdm{UTZqxJaxzBR!!`71;K*uco18U~X>AK&Pu-C&`R?B-Aj0=_$cxPzn{MlJK>ywJq zsw-Yj{^>7%vDCYw^iw(od$~o-Pz6ks8aQ}A1JFWnE@Ez_SYh@cOMFVY`?D$Y&Z~a1 zd>zg|c6+o8_xSfEUIvTsdiN&WOe=n|xS;8X;CYLvf)|=u($YtOu_6J z0tW_ukuKXj2f=f}eva;=T4k7`&zTqf{?>lGm&{Fe_;9R2b^^i}Krru0>ta|4^_A$H z7DO?PFho!p4A2C|$W~JYbWN&eW(4R;;Tmhz zkr;EbZ4D?Birca@{afZpp_|p2YAInGJ`1Fkz7A$droV0#{h=lZdX+xO4B%I?B_3ac z=7FCkf`P*_R`SaCnBPG1Jd|Abx!brVL zIt?Rv1@qnIGKpG7W-M54@Oi;BujL}Xdacfmc_9q?u&4#P2hPg`({??ZOOjRFnps_D z-f(IqU)UUW`f&U}`A@568jBEz<~CX~Yv+1et@-+dsV3RVrNTx?H9ht?VAAS0D1{G? zJbr4_B_Tqy_Ag;Xppzr)KXQ9QX}21eoMW|m_{|BBHJ*=OjhvNq(4HgLp`u-X3tw>X z9A?^?H5zIU4r9K*QM+{?cdUL9B5b=rk!&F@Nffz-w_pG9&x+7;!Am0;Llsa02xfYC z*PtggCwO@a;vLXCgarLHOaCqh;)QBGzd)|oeVtn=&wvyz)rOR3B)bLn=ZqpwZHq0G z#6YvZtco3reVEzgsfMR6A16B&XJA|n?MuIu8bp_){SA_{zu;H?8${rR&r^T3v9C(nb5F3yeC zBCfU1>1a`bLUbS{A0x;?CCtvBD58$7u3>y2A_P9vigNVLI2|Lin+b~C-EytjMOHW0NTui}pkxXdFdIJ$-J+Bm$%CN%mac~u zc65u)RMsVt!-|8Ysv6BvqDBlFKElp~B6L!lpd@XpeV9f#ZPtB*A?b!2cQ>(0KpkD3 zcX2g{WebJL!6EmdE>s!+V>?WUff2Qb1G0)SgHlNwmhKjxqoM~UZ>S=G#3}dZqbOgm zLQr$%IH~rG-VibZjQxA+wx_MOF@JC7m(z5WFp@?e-&dnA^W!f5(1q_mx7SHG&7Mjz zJ*FkzBLiO~YXM}_WN$-^LB=)#9j0}Ig(60{oTJ7L{`hY&|LX}pO&lXsa+ZJY)@FOggOhohsSKci~64T#~a*U>?#ib&8;moQD4mX2U+S(Fg|)$9R86W zITbI3PGBmng{xAMx7@wkfPyHgTBnY--U-MN(8g4;hg*?%-H-2y9+fMsROmUruu~DJ zD`y+zHt;&kEmb0pX<5f>5axt7b!mHhGZrk)cPJl8fFV}4Hof{DHc?nmlNe4OZlh%Hw~gDORC9fFH@ z(dp|iOIbEM2+*ogN5G5IIj5N6dcX2{rbl=|y=_lReUu(wdD=vfPY1!pN@X;H)!7M& zsVSTH?G;8EjqWqJgt8F#raa9{%Ig46>|d7k@)*edY9u$q-2MD_g(YtesUb(fF@ zeIca^`q$v%I*l@1*pSA^WwV15>IOc#+Fmv`%pKtg3<1=cn#Ja|#i_eqW9ZRn2w?3Zu_&o>0hrKEWdq=wCF&fL1pI33H z5NrC$5!#iQpC~h3&=-FwKV0nX1y6cWqW7`fBi39 zRr%M}*B_mXH{5;YJwIOwK9T9bU^f*OUt#~R;VnR}qpl2)y`p76Dk90bpUnmP%jt$sr^*lRURZhg{Jc|t% zzJ@`+8sVJPXQ1iJ<*|KHnVaNh6Bw9w7(H5d@A2z)pFDaQHfA+~;ft*Wl5TXgXt$X+ zw>HuHuNiPuH}l);i?tm23b}z`d*)Fc#9aSTR0**x64KPFxH=waD^aF`<3*U+;u(Jl z%Vml|ibUgNPW@Mu(3F&xqqX`Ywa;f)vz@_@ai=KchFb+T#v=)>bVeCp(|;s8%R{-yG(vI#MB|PpTf%;Q_dytxihYgUEEp*4UnBD2i zFzwhlAsbs^rvyOn1@$Y4a#xL*#mfe*-%9pKM;rMxBrQ{x6g=Z)-ac6r2QHFaIB3Cb z)MlIq>|a&HnWt;JF7aNioc_56#kOM7`*3HQOh2zj587o#jVvMmd0^Lq^}+G*kE4L@ zyr1bonUrLt{25*}164@vq#vyAHWXa=#coq+BP`G?NvJ{D6iI(?WK_#=?Sghj z1PAobWSn&T1JN2+aDKWLzLa-vkU}op+rSMu-^54o|YB$BNlXsc4)Pk+N;1Zjv_2G@*gdMul2v zus9!wq9-nM_j*C2j*4}T#EOpQH+mG;>6M45k1Bv!l)vdjfmgsSe9%ze*37SC0>9_L zi$J!Ziite+mT#sPW;8{9EdmpRcM_V2yctTOVr}V45Ya@X%iVpnLr%`<6JxcpQZJW7 z8cdPFktXB1WhRl~Hl4PUPw4E0+n*{!yDCO9mjal(#n-SeE6ATb`3BWpmcOoQtW0YC&i_4DFt9eMt#<$YtDl1dXA!$_EIQN?X#w1#3P}!YVg2_+D)GMjl zY@_EZ_ZKP?D)_w?>J6RZnB*Q7Ruv~$QHEOp7abg-XyAe)|FAORoics58~_N@dE!`8kvn*VMyv=fg8F zE;Y1gK-hU9#R`_&5n`$v&+@j=#2b-LIZsY&v=}NAOjfOB3*&2UItP}{OqgRpGh>_f zh%mJf#U&@U;;T#cyP}$M2?X^}$+%Xb$hdUMG3A`>ty6>%4yuP<(Yi8VcxH+@{t9(T zEf55zdju@GID-2&%(4Va<|Ra3khy_F5iqDnK(rPsYx`73WPueFWRJV)QFt_0MR4ew z^AAwRM+u8@ln#u7JFYkT)O+ zi#|KR&In+^((C^Qz6W~{byGrm-eEQBwWk;Gru$Vq&12PTBnehngdy#zSGdTlw| zntnZVw0Zw8@x6+gX%7C`9GLL`vpHbla6TX+B7XSrfgEy0hYHbGenBTju?E1^# zcPx@a{i?zW3ISa;V@%Kjgr2)Vx3UHv;v0j#v5i!do{bld!wDqWoiXLi;bP20NC_Q1 zWmLa5QI~_)A`d}#*aQ+SfANbQB7Qd!Ncl(>6 zheiX141UI3v(dtiSKg*zR;+|a*Uv_OU@_I@u$Sw%+tp%rqDxg~Va^*|OD%zXAYe6! z!Osuw69pNHQ-?@qEDa7bt^Ga?Xa(5g6(KJGSSDy#r$D2V;~$a?q6O+}b4^#6wsf5E zX_GK0Km%Z@vtZr~zNs08B zzlMH4(M*)#G5 zynvFiw~srA#@cLNhHk`!r@!W}8-+5UBM7C2P^oZ%kc0uzbTp>FHRO=xYa=v)0aQul z9UgNxrY#bF^%AFxsI;{sv#0ekRc8}5bc+e-tghcK-OU0FGl`O!q9lk-bQK3kz*s7? zV*U~Q9=~-fem_OJizGL{$4*=a7|@ZKwLY%#p@2?FP3Q>15nTl#b(ZW{k6q`Nx zOMonpItf;aZ4(|66znCH7E27N)R9I&GsIJ z*ClS8kTkcOvZ{S>Fv|`^GkxEX=rkW1(MQX6IyC;Za75_)p3!=|BF|6pLRsYUq@}YIj4k#cwM<(2dKCeZZpd6cJ$fz6 zXU8ca+ou~;k@S379zHDD8S5)O*BT7~{)Dj3LCoshK9dt=*UEKo$P_!yxozT=ZtBkj zev^`G~ zc4AoF3d|9i#^@>JywzuSvW7krJ{v(4IX&@ZU5})Jy)F_p647?_s=B2@mHHAWI5l=- znNFit0x5-AIV}8zv2z;Y-K9McGGqK{hU0@PjRaEJG*_X4Jo*Ua=DamQ8b7f09*Mazbhhn6LBj%&=C`Zw8uz@XoMbA z%j)N=G34Q-&zQal!IQE=*PWyC%Nzbkc?SQz^J9l> z3}_mkctbvtd6Vvr=Tx5dQ|k=lg-=zHk76OjP=g9IPH_%tWed^LXiY9Cazf??c$snr zz!4}Hl4G4@_xpkYJf2FXoKOO9-6J)oiWYVXuSJAY&Q`aFnV)5L@nU~x9O9VuEbZmm zRJHYpRyw?}bQVa47oYcRa)$0@{Whq+Eszd#|A;H146&zmxR5#?^3=Qdiij=KX-Bvd zk&plq0|^#&B~AjImXrDvvJ40$v(^a!JSp>w3$@6tFc)7&spiek=YVmKkS2(%uo;S; zqBCrWkh+zGsP=MQ_NEL>&43-zSnE7k>kbEB)jJWqRV5}k>J?*Rcn)jx=c`6*MZ~|i z%~^le&(UQK^+n_>?xxUQts<>aPR-TgOJSE6Uvk5ZUkP+>VveCD#mghIG(nOynL#Rs z2$vVgxk2{9-OsO=D`|Z%@x3w)&CjCgeKN0P_V|BE-c%IL`c-nXVk9#S-YNj3*P!-C z^7XvFA|Fc zQxCIu-q?|)UMe%sa3wKx=4brU5@->gWRLT4CltHUIy;}a|KrUJ{a?72odi_$Jtv~g zkQWC&u|Ui#HMR{#IS~nXxMkhhGSf zY@Od4)>#^qTHlZOA6ih(()g<+OnN3wb6{Q^(N3|JFQ>wk@M>uhX) zr)h?8eW=WL#|vUm?PV9~lwWnXh-FzzJ%!x>#?s)dgZwur=+ie)NL%H#f~c%;e2_O? ztRDfj%ldcOwjk(ny5_GYpz}QMZ&YY${hM|O2AyZWre5QzFI62O!>~tkqcDdtBY{-$ zuP(XeSh@3Xk*0o^Wa)qAsTKNxZe}ik_%)PtKt<$f>wWvxMo*99^R)3&;*5cJd|r=q^}Qw~=ZGkr7Dg^@4b4T-b$ zv#R2Xe!$2km%(4C))AfZ26hixuAF}-+f zZwfDSoMo+1_8Bu$7xPtlaoSMSxTLFO1~#1+>uc(Djj`l$TpKz(SF{%R8g%NC7!}{IaPsNc}&S&M`WZu4&tu*tTukwv8*!#C9^# z72CG$WMbR4ZQGgo=6>GqNB3UctM{K?)xCF}Rdo~rsc4{MqGT*X7Wi1f9D7k%cwP1a?U&RIrc`PKXV&fRKgI#_d$X(&SXS1O&!lRovJGQJQVg60S*AF9wDZ zh9=X$yV0h)E%*z&CuydVyRSQ+JH9@TQ=dpevf`7)2Bn*IUCx&ilfbHu<}m{SoElh7 z39m})DpJWpAR!Qp@x3%)%4JbzWB4LPxVLQRSboj0EXO)iCbQ->>+)1T{T~oy%}-k zZPiD;=v1*g?z+0TArLF-QXVcw-NDyEHfrSgjtgkt>ep=3P%Q6WnvrJt z+4RwtdR4Q#RUS7xS~!Qbs=E;lje z53Oy>LXWHQ$2v+95NE2^FeUsgp1y4FyvUw1VadDrg*G_B4otGbMYIlWq>so@%yJ!C zV+>DAk}AXSYO|>TXO$oecP3UZixgcI-#ccF znJq7up8Zjx1AN0)D-mL!udb@{XsbvCrCnAgur+f+WxIfw{$K!o4 zfn|*egR+@Cqfbd)SeHLedNl(erm}_}Clq=82-p7cA`8%vq@&iJlk<}*b;&T@mm@wX z}1cA((mK@yos zPW0ZW@JX#qtMNijTe@pH1gG4`^<{AR@h;s(T} z&3#(~u$Qi#%j!zW{ss#Xsm|DQOrmKNB0cK9N~^$rZJLyDEKoClR=V$R;aujtgT#1b zA`U4#ht`VKoHWuito?@~br1x@B1L^j>cuo=exM!L_g$Gz0SpZ^`C+o-yaA}LPlf0= z^n~1R7J(vVSULvS{$R8709Q#R@ZbWBjZyY(AbHaC(7|(oHtzZ@NbtoHn;_g=+H3fa zy!pe)r}Lf|tftQ|FMWp`rny9HZ;N&8jH3-LHf6@ zM&!|x^O%ZcPJiq#EK4mpID>Rd469b;u>zA+kvrUva9OQIDXPl_*T6IGn29GAYKQ0n zASA;!l#^KpqRw`sb%#}-2}Ud`ZK&<)htt;RIog2CA2(DI+sP*f^;yl%Jzz6%{0}^a#h=NyKLgPR? z+h)#g+PQn_^B*+snviZU(joHWllOKpV9D$p5IwQbsoi6pC_`)m%$bm~s>3~@oHT|MFt~;^&e$k z`!AZ@c$^%MzW3|Jt;kr?yNKC`4g;qphv-mowYqO~qxIDHG&T*1Il;sp@iK|H~; zRY8%8d5`6`s8oac%2s^AFKN^&{3cN##QttYZ`4w%O1kG)vS3r_nko@(3WSWY^hy%k zD_xZkb0hmkTBJdfu$mY-P*DN?TlRxM-eP1OB3FiJK5ogaE%S@t)Zzn*d&`8NQU6AL zC9qU0aDA(=vpOu~8PPvMOGiOGcbw0;i&OIZa_^2(khD z;&117LsI_yz=<&pOSpyG0=nv1z6nB$uqp6DxHM4~*{6ytIT39}>Z<;BowyqFU@THt z9tvb``MojCN=M7LPJs?9k>}02!$N}>-Hdf5sj+7zPsGcEpJ72v5=@DHxVbShM znTCaXY66l$r(TQRo{5JpXcn1GZ4$yFyu=I%t%@xcR3pUKP%~9_4y2j%Q(-)PkDfn} z9I;eUk*#9=IplZ{KjMiWV(J5dk%FI*g!Mq0g2h}Kb^c8wfG~@54Ml|sRB_zCI<@{6 z^>GrT2@cGf?mzHC4F8I^S9r33+|on(dnh|1Z>%)RxVYT~j~E*AoAP*jexWIP76myS zPmxHAcOLo4+KFvX7leBb75ClA;yi&nJL{!SU3@ zWMvA{qx5Pu{sRs@9^q`F3_ray9*Q&n76E5u$F_G0Tl}P{sn+HS)^78+pUqFXayKO{ zi^~-OJkHkEj&_t9g1Y0<`H^--_8B+x!zqT9=#17`5WUA@RUk-mPwZ;c+8RhB+N`=K znJs*ymvdg07$&iKn$G*Mk6>^D1*zhr9ipPUJ%R8Yk{s78rc=2jq zx?!bk{FtF%6OeF@OlMxwiOa{3JZqSunUzIK$Krxk3j28$=JhtBUVAPyC$e(tOs@2&>aIiai+vP@s~9CD!K+B*cxuJH5{ZoroEdkOb07;B!(&?FM&tYiDzMEi^#Kvu)$>mUMf_&sIXt9V z1`|{6PuR}`LE+?M@z!%&B1y|M_RaF73@U??hm`07>sJ^Y!2lLnd(8Vpp>y1ny1lr3 zl!y`Wp!J+)z{ok;P0$-LP(J+_fL&p*f0=;J+-ts3-7_(rS04#pN+)SQz)n%tOxR6_ z@iS9s7}z{TeV+AZUSI^TvB)a<)51kpw?}19ciIMhgxJi+fk$dzsUIxLVQ}Nw6>zz% zYtr38Z538+YKBWeW51rNm{Tpg2qKiX&!^s#!ve?C(NY6ft*#v{M7+r!kFvwni9Vg9 zVE>1ImnPXi@nY&lD&bwEzxTI{dNtF18pL$JC~#UVZdYp;{nAd(+?7ql2-I0p0a3h^ zdE7VU7KJ)trJ-z)KsCRt^QH%e#W!F~rPh@w4+*$@ zK4)>+_gDsG){RQP2XFWefCz@LxK4qr#%x=WmPy&Qi9cIKa_7gh__E4y=^U1@#vNfA=^ut28X2_ieyr<^WqKZ6Z-Or8MH|Ad<`?oNVuOc^D;a300H_ zM@89Pv5h{>T$*iPbD?^mIOFe&5u_Bf2CQ{5|AFdS+Fwi*XSv_QuaOXm*g$E@V6`8E zQRKWE^)Z_$Y0gO|a~q&cE+vcV=jv9uS%8|>#SnVFD4{g@06WNT*HBsw>2!tC0{d{{ z-?m)$6BB^p0Jsu~0e@^&+QoxKB>XGk((rAyZ?!zC_Y&)X*aR~{dd)P4=tBS}&bgS2 z{qy^PL8LkzJ@}LlCE)1?0?Rcsi(8&_kltfWR6M$DM zB@k7TLP~t7P?uK;Ts)*HwZe_wZDjbBZM%!6b?Jhxe7&{7sfsC;9!MX@l+!aDwGefQ z4x^TY#)Apr3tC6_!dw?x(%AL$?5VUr|4VvE0UoX+_onVuhyG zjno6xQ`GYfpa&yn`;1$$&NDY>HXLD&54al2@3A?CO|q4u_Avv9^NpXV^|y@IoDy42y31Z)~eiGpE6 zjFQWawJp?DvP0va!#N^er>_g=QN4?!$QgS^+?fbZUO$e-pB_^&i#<6xi*}@zikhr) zQ3p!O-n4OUat{Ysi^*BT_O2f8jyx#;l8S9XRMCoMZ2A)_ zX({EoS{qBU0kjhm%{)Y@gbA}dPEho2-^nP_{xyxl3R{(C!oi@~ily18z0RaLa0~`Q z-}?ov&mj*bb++L+Cn&la1{QW6ioeY&-ik0^fbt>FeFp7$E%vk?b`~WsQnvbzyglt2 z9`}pj;QLZOF2GfJW`1Ani=s|17tLg$8U+`!R+s>XANYrUg=l>KXV@4VJI=(f0lM4q zc{QF7gEfqt;%le{C3*5Z;l{WC zFSAqZwN$9H)7C|NkiQGy?ue@E(A}7Xg?|NcL2!wKV2fX9dAtshHJ||p-F=%=!ny8q z6#06TOF*fvSQIa|E4OQ!zt_m$j8YEAXLb#*=)p7dhKLDe#O1>ypGw~Mhuiss4SE&o zUCOJU9zDRJ%X0NAEI1iD47H_vlSGZkF~C$89(cGGOkm&MeNlaq=G0Z^LGoC#&+(5; zaLHJmE~eLwe)P>Soonm@y#9COv=j>${%>Y)XCS}#)W(vgsSVQX`2E(M^D$y3#n~@U zgV@DGaFc@HzP4;aOZH2b_Z$V?;5?hCMg* zn!6cCC{y}g^m+AoL?$;eAC=f(GWM_EJYNcPYf@{mDE%^ugN=T0ugCc2Ib$OHbSS~)R(7Omi zjZ9k3U(d1-{M$k<#<4`~+j1kbgN}?&yxq;C&cE~NugdUGNRR`qr}^`}2t-ziw}9Yu zND&z4NgN_teN~?NfvUpDyi>c_B^0D$$U%w_9IM8HxQLYy){J#zv$J|XC2k3T=4g!TR3r2+)_P(#EJsgpZU#ejJ820y9k*w+P@sqnB zl9o~obFSN-5jU6z9D=9cynbWie^HJCnF-Ek_hYH71W5_lcLsNLo|gKJBcNoqk5c#` ze{rg+LtS})^(X{gJxq+Am1Jg{hJ6adCBk8!+}{d>I_;u1kC3In1Oy{5Hv>zNHJZs5 znjAml*}FNZQo=Ul=BGBKuJg#6S6ZrlZyojk7hV6B@O&_H#+`Ni^H}s&=v1+EevijAm=O*FaVtKKpajjc} ztaO=b1DMn~BYxd*1Ljzw4}l3A@`qiyNuq=mV%qB(#Sat#fi05rT^EFLO~bNLgjSc> zSJeJCu>K0517vo(tmJk=ys?J>M|?&{ev!nS5H~cObS#1rSXcN(j8<2c>5`D6w2tf7 zjkvK{8I{la@AP+{l|PZ5ymZ+vIZ)x*a@lgzr?3`tKDAD@YKBNf+PeRun(}CTCE(QK$%Jyv^`vksei?l5pL8gQ{6s0E?fw#I?&W!G9 z+C)pZbxWvq8L3$`GAe}p$97nO+37R48}bxo#dEr&Qg2J#ZMnsBo=g#@IeASh%rv$3 zCyobcB()INWZIHZD`1NqVUEe;JpLx>!$#$~`lfTHjZNvIt*&KmP29<5qHD)>(a~>x zDT_5fVT~3K%Ybc3xNBC1#@T$N^+~ISZ6!Z%293?xQi>N0^`8#KfX@*0`rA@o@8FAT zsB`&GEUOCN_|)~=lHXT#bL%f2XZWAqP55N5u%n`YbLctRQH>0A*QR;vQFGqagnY+W1#k`J)!VJdJRaXokyH%~~(F{OUSN8mX&?MrQyK$stRrJN_8j?Wp zkvR4O{4Z^Vqxx%u2m=IUj^=*~`lcNV5Y9)}4C60QCd=D9OJJjRd!f6-KB(4iLqL0d z06RKXrX;z+KDpkwUBP~_lcJsC)qGnR83P3c9A(LFOs=@F++QC+{gdCcPuUTcIvlZ| z1hzapkd$@yJ+ayMyfQFU1*rdhojeGzLl{LMmVJLfqNj@w~3XBub!DJCFknUoW~z8qjLV2$^@+>HX1 zzkSZ4A3OtiiMH9G)F{x8-`pxn7O@+>p8bL7A}3@y3{7A@M8Vy*CAVFWIF!T1DH%dJu5FlvnwyLF0#cSdT1$M6# zZ18qzTQfAt9;sl^A2aK%_~@pCg>_Qp()DFxmpa6s=1SZ4*=uzdMYCjqo;X(5oMhv{ z(dB(zEBvvp#a1pisvEaXUh>{EKF)%>rO~fl_8B-_Ime(8ne*WlnsG* z=ur;WDhz}R_=p6&Me__0Dnqa)Vm(Gjshb;d)FwR&H(;EMbdzAFeKFCT-Ig4E$-4aK zGi-#-;?EInxP?iXbRq=$>IBkhmhdo$FOD!Kejf)(j0kQ2kZL;=o?Rn5)dp>0x9TTa zCPh;SH*Hd8zFU~s1yV6Aqabc3g)G)YP&0~_iN4(1;c@Mm-(~T@_R?w9F6{(DUIimi zp3cI_mO`0P?HWD-gKBwij}GDE1U1oqsx#4xf_P&!$(ge3=p}rPpg(z7QtSLwVp%wr z)b0###i4ADrG59KZ8H5jrgmQYIGWL*j+|7cc$#s65id0@KZnq(3&wC@I#!RvrVJD` zc}=SdM#lo1wY7qQ?%8r4UAkOF5s^!cBg2nM=0e+U=;dHNa8Rk z6OSdR1P^6%75kui(xcdvAns#PwNEUe)W6QKvx++Gk|I@P=%B{I!M1%mN#BD~Z&~S> z$J6!HZEokW811c=}jB3iJ%ga)vN0pvV7DdI!MQ|gk(^k^%8^T$}3nBR>8|jLy4Kc zE=NuJDc;yGJK4Q)RVO0FMbi#2d?W{tqrvP2@CjY;agYympLu+8SM^1Bm^UyXv=)A) z$BGy?QAf}MC3Q9vaj5ue2ht+%CG->!2?Xo*aAjdD>+D7_N2BVDezDXJyMf0#@!V-l zodn=f$EwhwvPjP_`FNCTC?>YxIjNyQ{JA`OmQ^H@t*Ugyq^(rOx@Jb)%18SEeuX)K#ChVAWHY=G3=!Nw39B8L}Up9V)+ma4^A&pH?m z!ZxP?A|Ow92k*S%zgJf&B;)6NY_3^}60 zB^*Tq4Y^#YePB|#FBZNY8^FhrqL)yz@kIB=2}87#%Sz7pTM@ebhNF*?h-zOlGaGfv zZQ6P7qKX#@;EeeS%nI0kqiA2Vr6}63Y&%v5y0ML^&*z*~kj@ok`vxQmDwUd}iS^e} z-?Z%5Rm&l#PM70=N&Wo!2i0KZ&gRQpo@dtJqbT)p_hI@y$KO)UOh{V+3hcj2VhIFR)|`=Pg4tx(@};;bTtOsuNyB$QXe9pmHv*L z1ben*Fi>HnWoMC*FSQmeJ=SCE7~L=5TdT2brdx>Lpwa+1d|$6We068K6Wxxe&F!baQ|&s7pR zl$NXuC6`oi3J}9TYEA17G5kP5aP5fSaDISnI#xzANK&8QAygL9p|IKcF>Js?yRHxU zXvzf=6iuHcb=PWBZ^DVxxF3fDUpU6wevU*hwgyKVtY3u>XIdUCa0x^aO19CqYHPS9 zu`dYUXsTy$uB%DR^04ViJd4h7l#|9UlYmL0#XJR0%{SPhqaVrB&z{5U&dg+Rrx@9o zO385wN^)BuxZOicKQ)$`=k7N#;9Rnz+VF@5%Y`gGshFy8Hw5qg1W|DShA!yJt9nJq z$TD$(FaiuiWu6WUWb_!WUy*ZE@V4svwd&C@-1t~Z{HSQZ`B<(gJ*A@AOX3QZPVwMQNTn>MiKs)cfbC0;XP9g$wQ(ssw*!|cIBS)~BQVg{XNM;6Q z;Z4vGuyho7&kMD)b8KPy{I)E0CA9=YS*^)sySa<+o{t^_`#Wr&9lM#6YQ7DV>6?p(hnyN`!Gj7pUlUK!ybM`VhCQNEdRJw0Ukd^J@oN^+6;{FFz;7a!3hiE!Py)C;^8Cbt>|>vA@hw*yV9$+*+F}_|C^C{ z^$4FY6yp6QXa@b-Xbg5FDP(X<&GfJpd+IZhw5H3X1pyX`UgqephJAD<7@yKcmyak{ zBe-1l&h}3?t;+`H{Z5<-0A-Ed?nmf4oZn+6q=JKLD0`|9;b#lCP+P-NR`c8`gG}~o za_Wop;jix$On;U>r}s_Z#~q-fxnlbMCTVSaw6-|ETsY)HQi$+ZohweoYG;J!#MmYU zJ-&E}<7=c5?zK`~6X1y;X3s^0gnjdu`^z8PyA=m4zB2}%OVJ>2-(KV1!c_UG5tvz;-b<-P>67PMe-{!%S$+ge-~q#h{~r!iBIm0yR$+-JIM$&8J3`IN$zZby7XCwIYN&KX**xR?3#I`P@$25sP73{J~Fr{&VSx zWjo4(!WZY0!WRLG+&5_hs+36ennIRCGszV{g{c&nVv<_CY*JB76~&P_B3|dIkxj~o zswLyq+@`s3IgBXdfGL(JNd6+zp~TOG2=b5kop^*4-kRP~>$H7FNTn$aAkWn2(`%K@ zrFm>^ze(m-JNeWHOSG8y%D)sDXEXClyF~dn{9#!|`|qY&trq!g^80r!*MCE+{w?so ziMQ>7@&6_Yxnljhy1zm7fOt$qRr3GE8*nPAj(P{1Ed#RkgKMS8Kldx-Y36B97IYsk z|9}y6IW9i}gPJn_ITCs#0(+!0^=F_B17!!Ja0Fejsus9etsKjEH{|gRobo=RabqWx z+E&({i>_*%E@=1X|NH^2N9Z7gBRCL{zZm~NrH23ixJRLXwVMH>*4=hnF@c(Vhz6L? zfp{Y5=prJH88g|6MHz78O^o71L#>V^fpA29VW_j}65@zQ*^j4uK+%Uk_aBf(U@o9> zNJyvCe618gc(S4%qX--Jg9r=UYJd}3g)VM{2sg3JVv3zB=}QO#SbJNpmK#M~YdHii zU{sg3c`hw~d2=^L3ugw$bl$tWmJOz@l-DIhqBt!HD{X}KbwYy==H+zrbaN?|>TEYr z0CKrru|C>d!2)@Ga^_fEG(5+9tE4#&&R_0^_9d@-J|c81x}VBM4}h2AIy2OFiy9l) z2iDN_TbnQHnDsiZ1q<~HtUsOfO(hHZK(R8@n&|X&-gme5v8YW}j;=D)lv_A@`oA1+ zNUKZ`vXjqpP>7Wn$t?Ru;6+8)qSGP}KP5OAm_7UIg5B&VzSzLZ|8a+!1NZ5<@uMGk zC%5@!@%x4*mY3luwenb&Jx8X{=A`6&qZX+C^T;Z}lVq*`rMsN|JN}nXopeTxk#y!Q z1;nHgX~8#Wp%Il5CkUX>H2{TkrZ7rd*OxBTr?aAamEB~ISQMB2*=}#sQIjND1HPa_ z`VzU_VYSd?wZLZglgn%4^}vuEa|9P^noEhB(MO`zY_m{qND#(h`HJd6D$kG_kme5{oszd&i( zEO$uPV&<4Nk5pW9Y~0A>hUeCvz*EBZtGT4R@XC&cP9DRNGq&SM(;Fuyixh&|s@)*| z@R`oGyCdd^huhWJ8piCIg>D{fJaRF-E(BkVkmZr9$R)jZlgrWyD^K@hc1=v&CD8pe z|GW*rcuG~5uTj?g8(^WxCdG#oo4vAFn|A@Rd|ExPvW?j!sPofTRq+M|eN6jwD!arC z+^(8p%`i9gjQ87zSIaT_w`yIkE5IZBJF{Y3?WWGaHoew93sB1j*FTe;A{Yecfk@wu zpS8McksjKqHCMF1dFHK)V52~|0NiRI9G!n8tyZOz2fMkVdBpl=JIpar9_Zchau!WviRC`DxWD%D3h_317BbUl44j1a4&^ zGs$RKV+L}b>ga6jc(uQI1uWd|5+t!4_96Io%_HvJhrg2uY)acmo&SFF&mSd9q|{jTx^fJvbGU$-P~^aGpDRPn#1$1;sIRL24$V+`egtex zE0k}VA5-#zF0nBs%l&y#BhpJ~zUqR^xco=d$&7V*PH zZ=(514Nu-@FP;;Wg?->1LF)jYHi}1_6XDz?5r0lRq0^lXaH8k<3vAvt#)oP8Jqopn zrAsa?bw*t^03OdK3HpRM0`p{7XB=%X>0D6C*+UeG(3y##xz;tUM1{^fo^F%pfTlLd z#?dCv%;ETjo#!e$C)Lv`iA+?t?z5~zU%{cd-;DX>v_MGiYDW9< zxgX|zu<79r0gb4~B!MrWUytBX=pu9m7rpvVIlw0`O1cN41Fb?v&Z6_1mp2eH4{GvQB3CrHZWyrJ;VnXLHO@%E zN}Lo;kSiq2fzh`?=X#gM-#%8;q(d{1S4eY6v`^npV%ZZaTx~x^K8$(CSiZ=xP0G{T zc0(O^50=d&>c_p$N43*lVIrBX3n(=G{Ivvw*be|0`dVQ&l^=&sB&pxb7BL=}$~X|` ztZcSIzQG9LxDz1?LIBcJ3y2zUcP~kNIxR=HnK=Z z$Wk>Vx#^8P+vXHHZAm8UFFR3!#hHtX@Y<}(s$-Omy#$v~zLk0N7ajAJ`o~JX()PFc zWrpRbuu*pK0Y{Qv34&GzdRHoS@k8)D4bmvj40_&)M`F5^D#&F=t-fRWF}}{L+uiU-6_d--48;;BRMD~TQn3cBij`+7B^`ye zsH$AndXoEoe5G+SztfZ>ycU7WwiDI7j(Hy<<)HI8pVpN-D@n?jWThZq|4u{WT}l92 zgM;60dekYz?-Rl2H}NbCJEz1jbe>FP6mCEO|JH z3_(<5pMGGP-K>)xQsP2Z@yxwywe=+~J8hr?y<61l@QJh!w3q+x(#_Sz9{Bx!pLVXL z{iT(lg=r-K!a?=*bUB9|;0w>|#mOz~OgdS&|qCbH}A(#|zMe z6uhN4%e@WH%s+CNx4`g<@yk+@jM2&i3I*YUczoxe{`UFds_i7|K$3OrDWvUK^)PS? z(^0gc@Mr-vEMRId6m`k1!K4hmkN3)Qk5^@QXnC&?+bWtOgAP#?ryk z-yqkXeE_ZvHcB`Ny#azmP1R>8^$}PRZmr+)@s90MQEgqYX4H|wG8~Ib$fDbyeKRg zCr8v{0HDv)uS^-HK1K0?s1#GqxSF3QK#JA|7|!-3K+AsTY$58G27<7Yzi!9C&IH3NshKKtMbEHyh%yHtJl3+Aey;Lh59(yqb??B4IeD zm9F)fMrB^tbIcgRMuM#3d^gvtS4S7aPR#7$h;)>PH|;*1>MMn6A&JiwkKa5Ur9(F% zL1dS_1Db1u`Yo_*JP-F_C^XB9Z1L%C4q+orHgXL8I1Qzx`W4jrt?5EU|8G;!NSzWeNG&Hjli{v-u-D zK|+c?Ehk)<>H{WSI-Kn-rf=uD{+^_AaB*JD!npc%U;;R6;)=QgB=CEuocaaljF4O^ zzh3^FZZYf2_(J=uj?=7+#$yjMqav7#SK`)IPa+SN+=qlo_e!s_>W_|fWSCEG>IbO+ z4~)$s6yV~rwtl@A73o)$Yk~A`&@)zpUu5o!>pQ^bK5JG@s%yBlD8XJoz4WyhRr{-` z?Y1%AV;Q(Y+WnWiWpoZI&hV+9#4!9`FijOI@(C?1UzJ^>n9lL#QAP-l!i{zRSv<6R z-q_H#O;B*_X_3TXT$HKUC@(K30Wj4E%Fq<+eqfFlpWALXdOM@zUE?2&^x{Qy^^Dtt z*Y?F&^c#zfut^`~ypB85(1^?KWviDYa?{pmRuWi<*D~0!==#k1&d;P@9dzR${4gPB zwpXZ4yV+KSPcXZie_65QSFS_9K!xMM7Tp>3_QvsJ%!ks=-y`(=P~s!T>LVL`=9Fn( zwrA;<@ShpH%kZK^?dCHz9;K;XWzc*$k8w!=)r;%MyJB`A{(L~!RKHz5kLw!7l}#vm zfdT(gIdpqd2PW;L{|mA*)jiC@ld6k!y~x7Vq+SD5%{FE28WGgeY&{kY))D6f*D25Q zZIKpb)^m&1>KPLxb=G4OC^kX6rCPowoo~yKCR>iMApU@GvgktHya9$ou^;6|xY1)2 z77Yy*2*QhNRl*Z61(u(lX+Cs`!LhAByn$as6T5%IiG(Yp|Eglf-rG+vBMiH zNSRL~4z>Ds_`*DKHWA$IFyjUaiNWXB=oRPVpNREz~ zJdb0>;6p5v6{Ap$$6i?8IF(M#@^o+V%BY6TpW3(m|8$-~te>WSGA)dn=IQI+0JCc+ z1Y5UG&yN3{fgyr)pIgpUQ2yMG@mf>~r-@em=hB4Fs zPb*keoJx*#qEzubR$|G;*rVNlJ}u6i+w3bM2#6>C|3n4uC`O>oe;pP>cTvtnX++y$ zFws|ab+tA7kWz5b7Keh1RemB!_9(Q5T@M&c7%-2FA?<6G&u6~%6Ya&Z<`zguZ-j1N zUEO57^4w-*X9xj--;nh%YI{#dM+)aj25BoK?+CuStuN0U+pt}!hZAcsK7(+$L-+A| zi75A`YLcPLxgP>|q589cvPj-(Q-~QFwVzNdrq#xNZy(E{6RzPeFY#v$sNQj|a;fsnxzI(QS z{VxM!EhB2fwQ1s@ODoItDdL!WmT2NhHhUwuspBfFUp5T@DIKRY>vG>{lLz)G7BuoJ zwpEerKA-82becp1o*+DJ>_L7^2=fnU_9O77RM<8@$jNktpD?X$roUS71EkVyD%j1m zi;9B(0p=z`tb2#kAf~F~b4j)G>2^Cov%uDKasoo}w8VVriKr*Tw%&Zqj7~!Sy7;1^ zYXoZCSciBN^qHn`ZBGtWsl93LukGbpBV!*@Rb@_{ngsW#*s99n=UBvfoEUa;`FK47AVK3Z(Kk(`VMK%yB0isQfAzy_3+`v+SvC`vx<*mRenZ{rYe)+FRhOGb8<>o1JfoC4lLp|Q8h!ZVWpYp z07yBY#DyLjqm#Ft%nC9?=7gD;Q5ew0z{kR7g;rohjNHvfHj3lzM9_A+B0g#t*@*@9 z{}HX0C=Zbt-1H1+v=)mJxzxka&}Zhp+WrDpM_JLG{nPm;I$-s3wqsAM49srLc&@FG zsSi5S^wPxDXRWkHj_AgJiOi0$SLF4XOF4+)uII;p@9csmNs#=Xu4Mh=zwZ!?83ZP2 zzXTmw?U#$InVqt;gQJO)TX9nQFNFeHunGU#0U(YKcfCc z84#4Am^@i|WI`3q8)xJJ+WL)Ocu)OW2EQ`trvMLoSx7zacwbm6zN#CgSZU@pQ&aCR zzPAo}yMO;2Yk{QA8Ljy|n6|eiR65#dv@I{WPE?jW&`jF2*oHy1oZ>3f(Lw{$22i%J z$ZZ{W>v0DF&zlND9Quc`Ob->B+m;Wh#&kr5&d1KptP&lKZ9ffd_z-{i1>s?(MC!Kc zlN4XC!04kblxYWJQI%0fNorJ=_(cb@oSD@zFgPu`gNv;sJ&Wo;RFc77Cbj}ZF(=}_ zh1nhC;t&HEzIbjDwXMUM;e~)lHeGv;tp?ha{OFqb#^J_IjDbO#@TZH90(P5p*I5hvP54 zxh0t^54jbYv)5d@)6zndct=vo?){V~T9*+g0?@lE_Ss9^nBNUh9nOK$dv>AWhxfFD z6#^xKpSd@D+*JeQIFJmZj}rJa8ls@5H2WI&ZSG5fxHg^_xoapOW%| zOow14uOw#3p6V1%SNXsjPT39#z4-#;Op=pZXA{=Qs?W9GHMIeh)t^7o0(woLngo8H z4+<`;3k_TF3ii8&u70}@15*aHJ6uf>^L}bt?G_vGHDOJ#Bov{K;>*h3QRG}&gQA@e z9uuwy{Gu;!pid-0$Sm*--v8_BhG$5_$izneQaowLRi9<@l0X3jTqMppT7(t&mgqZd zDr(dm2mtDIXaq9!9H6->&ZG}aZPHH0aT{I$=!SpgV87(Dkm)+bc$OZ3T-qn z!OMiD!w1mEJvir zW2aB4yS38ZKex_!?|*;5l|zc^%zwxkMacgz)ng?gr$HrASK=q_C1C*z{EtQAsZzj) zn*sykJ8fjxA4I<3d*+5lhOqoVgp!?FJjzN0Y?J=AZu#rr?qUAAdP^kq z!-%j2#;2oW!dx)?7og3^T15{9j>1Wj-ZG`KT3Kyn$y9=lHG4H9e)>KgFRGv=@ zc=wADdn#VCmndt<5**Fy^goF*{V1TuD`h;j(UT&s-&L=ek|zL~ziK8}$2jZC2=^h57nb&+Xj0;6SK0M{Not zdZz(j4-L_ilW$;OzN@|ih7mQU2i-~jJ|$tSoAseoPDM>*%W1v2)MgWKlT^6ZZHGNF z8c*EwJ6_0X#_|qDK*Y&GQL+Wb5n00*6lHD1u^afa915W- zT?Loj+aB5k@$jc%8FKd!@1QnC~E88_D_bL04aMukP?cxyVom601|3fVoQoI-RZwN7@6Q2ln#~spKR=Ry(6IxzC zF#%G+G2D|id5_3Z6hUrCG9IDR-DvGwThMI#;US{nZ6p)-TOnW1-kx0TTX2w&(1xm(aP0F71hR_K*TMY<5a+Phx^w{W=@t17gH^mSK(im&ZG=( zHY+&j8`#KC*)CXO1mRNQ2prSNvye;Fm5%5KQCx; z+dA2~9tVLR*2#}wl3kX<%G~y*mW&hYC(@b49;C3o^Z~v_7$_x*N|I|v`&i45IX|B1=4vaVd3PpNY;;~A ztC*Q@XS!v7{8;phXUsnbA-TMXmOWsCxte$qib6tBnljH_wrg(qy)J~r(YKJKiI^@L z32i1FU~UBL+>rPfVS4sWYUk4F-yrQH&d^$snQ+bh=Grrl*yp_Y6P_G42ksY7{XDy!@BpD zR7o?eFWUQz?llUyQc1AcFyYNn=wV8H2Y518w=C)>qG}Dt!QVs|`{G*hTt>yKL6|Aws-73L-7Tq6n*O^57tyDvcRy5%UYtiLUv~R9V`;&h>u37{T3v< zEBXKCudNlzz882L^h?Hd@5OHmzJA%W>qTRDqg3I?%i+B{zU6xQGfmPHm>A*ke=Wu%L&yh?jK4PyH&G0^GizJmh0C&7taf*Z*5)C+PrUhW`)J}iYwoBdLQi! zymZKrJCpl-q=9Zvghi#~YAfIYXmtHkldpVts$g2*daUr-xl%9PhOn4}vooBx z>sA*WndWYo;?1g_Qz?|5Q#tKlD@&m0iOKa%0)at}MK@K>9kr5nK3KR%deeuEts7sf z9Dg_AUd*L9mK#SdF{`(~aW#FXyi>J;`E;$gPED!!y#?=?Rxim}-+3Z4@##G+!MZhz z50xuMN%s8Om$^jdSm8%LMah3l>iHvAE_{D<+mdXX^!xL>&-kvnt+rg?s><9=mrW;J z&Qr=2>`l|(aq0Wtdz>+x-?%TZ)a{LWl(}xNs*L|lqZ_YV_D(#0Z&u%0rJSw3cc&kg zTTm!^QnsnpO-XUv+E03`riaII-*pXraqE>~$i|mBB|)aSMoyPc3anhatYF66U$rZK z@Pj%~f{}?Yf+zRPUCBB*p(;Xgvemp~mc!G9W=>u>PmIY$U~=F*naQ;RqLUx26kvti zt^R+WC=uynoD+HdCGWoQ!JlHzW4QPvi zy~J8z4dn~9WW=t+?#W_cFh)`QKm$p!HY@l>rpW?}M47_1;Syepv}BO) z$+1T4#Ch@z3~DGQ#h6Y$uviIrMFm75 z_%L*!57z*(4vNChmOzE>vXH}}85rgOPp3!q)hcU-$qx2Xliyn_gY1-rpH~bFEJqZh zgzZ5py}_#B$KL`~*`cTsa%7ln@8|(`KjI`-1_pf;RUXchA1oD}+`rUR8gbAhx`j5A z?=OvI1)s+^*>RaD(_NscOXVhOdMbiVM;w*|Je&{3bX^~yLfOd=mdVS&4_g5`R2N0j zt5C2L43-axH1|&#=Wr3=B#r3YSm5zuZm+d94eoZBHsE zKUgk1*`f-PT@V9^3=9e=25qVaDwLVLbA`MNVnm36K^{dBLpRu2{@vi5DT5dWK~EIW&pHfkaU4roNf6g>=uCr>T__Rcg`=}3c15@4P_ a%EQ2*fnt2> keyPairs = new HashSet<>(); /** - * The last time the ASPA or ROA configuration was updated. This can bever be equal to {@link #configurationAppliedAt}. + * The last time the ASPA or ROA configuration was updated. This can never be equal to {@link #configurationAppliedAt}. */ @Column(name = "configuration_updated_at") @NonNull diff --git a/src/main/java/net/ripe/rpki/domain/alerts/RoaAlertConfiguration.java b/src/main/java/net/ripe/rpki/domain/alerts/RoaAlertConfiguration.java index 4e37afe..a4647b2 100644 --- a/src/main/java/net/ripe/rpki/domain/alerts/RoaAlertConfiguration.java +++ b/src/main/java/net/ripe/rpki/domain/alerts/RoaAlertConfiguration.java @@ -2,6 +2,7 @@ import com.google.common.collect.Sets; import lombok.Getter; +import lombok.Setter; import net.ripe.rpki.commons.validation.roa.AnnouncedRoute; import net.ripe.rpki.commons.validation.roa.RouteValidityState; import net.ripe.rpki.domain.CertificateAuthority; @@ -34,7 +35,6 @@ import java.util.List; import java.util.Locale; import java.util.Set; -import java.util.UUID; import java.util.stream.Collectors; @Entity @@ -44,6 +44,7 @@ public class RoaAlertConfiguration extends EntitySupport { @Id @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "roa_alert_conf_seq") + @Getter private Long id; @Getter @@ -68,6 +69,11 @@ public class RoaAlertConfiguration extends EntitySupport { @CollectionTable(name = "roa_alert_configuration_ignored", joinColumns = @JoinColumn(name = "roa_alert_configuration_id")) private Set ignored = new HashSet<>(); + @Basic(optional=false) + @Getter + @Setter + private boolean notifyOnRoaChanges; + private static final String EMAIL_SEPARATOR = ","; public RoaAlertConfiguration() { @@ -81,12 +87,7 @@ public RoaAlertConfiguration(CertificateAuthority certificateAuthority) { public RoaAlertConfiguration(CertificateAuthority certificateAuthority, String email, Collection routeValidityStates, RoaAlertFrequency frequency) { this(certificateAuthority); - setSubscription(new RoaAlertSubscriptionData(email, routeValidityStates, frequency)); - } - - @Override - public Object getId() { - return id; + setSubscription(new RoaAlertSubscriptionData(List.of(email), routeValidityStates, frequency, false)); } public void clearSubscription() { @@ -100,6 +101,7 @@ public void setSubscription(RoaAlertSubscriptionData subscription) { addEmails(subscription); routeValidityStates = StringUtils.join(subscription.getRouteValidityStates(), ","); frequency = subscription.getFrequency(); + notifyOnRoaChanges = subscription.isNotifyOnRoaChanges(); } private void addEmails(RoaAlertSubscriptionData subscription) { @@ -124,7 +126,7 @@ public RoaAlertSubscriptionData getSubscriptionOrNull() { if (email.isEmpty()) { return null; } - return new RoaAlertSubscriptionData(Arrays.asList(email.split(",")), getRouteValidityStates(), frequency); + return new RoaAlertSubscriptionData(Arrays.asList(email.split(",")), getRouteValidityStates(), frequency, notifyOnRoaChanges); } public Set getIgnored() { diff --git a/src/main/java/net/ripe/rpki/domain/roa/RoaConfigurationRepository.java b/src/main/java/net/ripe/rpki/domain/roa/RoaConfigurationRepository.java index e5c1a76..e46684c 100644 --- a/src/main/java/net/ripe/rpki/domain/roa/RoaConfigurationRepository.java +++ b/src/main/java/net/ripe/rpki/domain/roa/RoaConfigurationRepository.java @@ -1,15 +1,11 @@ package net.ripe.rpki.domain.roa; -import net.ripe.ipresource.Asn; -import net.ripe.ipresource.IpResourceRange; import net.ripe.rpki.domain.ManagedCertificateAuthority; import net.ripe.rpki.server.api.dto.RoaConfigurationPrefixData; -import net.ripe.rpki.server.api.support.objects.CaName; import java.time.Instant; import java.util.Collection; import java.util.Collections; -import java.util.List; import java.util.Optional; public interface RoaConfigurationRepository { @@ -40,7 +36,7 @@ default void removePrefixes(RoaConfiguration roaConfiguration, Collection prefixesToAdd, - Collection prefixesToRemove); + RoaConfiguration.PrefixDiff mergePrefixes(RoaConfiguration configuration, + Collection prefixesToAdd, + Collection prefixesToRemove); } diff --git a/src/main/java/net/ripe/rpki/rest/pojo/Subscriptions.java b/src/main/java/net/ripe/rpki/rest/pojo/Subscriptions.java index b812f86..562c741 100644 --- a/src/main/java/net/ripe/rpki/rest/pojo/Subscriptions.java +++ b/src/main/java/net/ripe/rpki/rest/pojo/Subscriptions.java @@ -1,28 +1,31 @@ package net.ripe.rpki.rest.pojo; +import com.google.common.collect.Sets; +import lombok.*; +import net.ripe.rpki.domain.alerts.RoaAlertFrequency; + +import java.util.Collection; import java.util.Collections; import java.util.Objects; import java.util.Set; import java.util.stream.Collectors; -import net.ripe.rpki.domain.alerts.RoaAlertFrequency; - +@ToString +@NoArgsConstructor +@AllArgsConstructor public class Subscriptions { + @Setter private Set emails; + @Setter private Set routeValidityStates; + @Getter private RoaAlertFrequency frequency; - - public Subscriptions() { - } - - public Subscriptions(Set emails, Set routeValidityStates, RoaAlertFrequency frequency) { - this.routeValidityStates = routeValidityStates; - this.emails = emails; - this.frequency = frequency; - } + @Getter + @Setter + private boolean notifyOnRoaChanges = false; public Subscriptions(Set emails, Set routeValidityStates) { - this(emails, routeValidityStates, RoaAlertFrequency.DAILY); + this(emails, routeValidityStates, RoaAlertFrequency.DAILY, false); } public Set getRouteValidityStates() { @@ -31,30 +34,17 @@ public Set getRouteValidityStates() { routeValidityStates.stream().filter(Objects::nonNull).collect(Collectors.toSet()); } - public void setRouteValidityStates(Set routeValidityStates) { - this.routeValidityStates = routeValidityStates; - } - public Set getEmails() { return emails == null ? Collections.emptySet() : emails.stream().filter(Objects::nonNull).collect(Collectors.toSet()); } - public void setEmails(Set emails) { - this.emails = emails; - } - - public RoaAlertFrequency getFrequency() { - return frequency; + public static Subscriptions defaultSubscriptions(Collection emails, Set validityStates) { + return new Subscriptions(Sets.newHashSet(emails), validityStates); } - @Override - public String toString() { - return "Subscriptions{" + - "emails=" + emails + - ", routeValidityStates=" + routeValidityStates + - ", frequency=" + frequency + - '}'; + public static Subscriptions defaultSubscriptions() { + return new Subscriptions(Collections.emptySet(), Collections.emptySet()); } } diff --git a/src/main/java/net/ripe/rpki/rest/service/AlertService.java b/src/main/java/net/ripe/rpki/rest/service/AlertService.java index ae94deb..9ae5023 100644 --- a/src/main/java/net/ripe/rpki/rest/service/AlertService.java +++ b/src/main/java/net/ripe/rpki/rest/service/AlertService.java @@ -15,6 +15,7 @@ import net.ripe.rpki.server.api.commands.SubscribeToRoaAlertCommand; import net.ripe.rpki.server.api.commands.UnsubscribeFromRoaAlertCommand; import net.ripe.rpki.server.api.commands.UpdateRoaAlertIgnoredAnnouncedRoutesCommand; +import net.ripe.rpki.server.api.commands.UpdateRoaChangeAlertCommand; import net.ripe.rpki.server.api.dto.HostedCertificateAuthorityData; import net.ripe.rpki.server.api.dto.RoaAlertConfigurationData; import net.ripe.rpki.server.api.services.command.CommandService; @@ -55,70 +56,42 @@ public ResponseEntity getAlertsForCa(@PathVariable("caName") fina final HostedCertificateAuthorityData ca = getCa(HostedCertificateAuthorityData.class, caName); final RoaAlertConfigurationData configuration = roaAlertConfigurationViewService.findRoaAlertSubscription(ca.getId()); if (configuration == null) { - return ok(new Subscriptions(Collections.emptySet(), Collections.emptySet())); + return ok(Subscriptions.defaultSubscriptions()); } final Set validityStates = configuration.getRouteValidityStates().stream() .map(RouteValidityState::name) .collect(Collectors.toSet()); - final RoaAlertFrequency frequency = configuration.getSubscription() == null ? - RoaAlertFrequency.DAILY : configuration.getSubscription().getFrequency(); - - return ok(new Subscriptions(Sets.newHashSet(configuration.getEmails()), validityStates, frequency)); + var subscription = configuration.getSubscription(); + if (subscription == null) { + return ok(Subscriptions.defaultSubscriptions(configuration.getEmails(), validityStates)); + } + return ok(new Subscriptions(Sets.newHashSet(configuration.getEmails()), + validityStates, + subscription.getFrequency(), + subscription.isNotifyOnRoaChanges())); } @PostMapping(consumes = {APPLICATION_JSON}) @Operation(summary = "Subscribe/Unsubscribe for alerts about invalid or unknown announcements") - public ResponseEntity subscribe(@PathVariable("caName") final CaName caName, @RequestBody final Subscriptions newSubscription) { + public ResponseEntity subscribe(@PathVariable("caName") final CaName caName, + @RequestBody final Subscriptions newSubscription) { log.info("Subscribing to alerts about invalid or unknown announcement caName[{}], subscription {}", caName, newSubscription); if (newSubscription == null) { return badRequest("No valid subscription provided"); } - - final Set newValidityStates = newSubscription.getRouteValidityStates().stream() - .map(RouteValidityState::valueOf) - .collect(Collectors.toSet()); - - final Set newEmails = newSubscription.getEmails(); - - final HostedCertificateAuthorityData ca = getCa(HostedCertificateAuthorityData.class, caName); - final RoaAlertConfigurationData currentConfiguration = roaAlertConfigurationViewService.findRoaAlertSubscription(ca.getId()); - final Set currentEmails = currentConfiguration == null || currentConfiguration.getEmails() == null ? - Collections.emptySet() : new HashSet<>(currentConfiguration.getEmails()); - final Set currentValidityStates = currentConfiguration == null || currentConfiguration.getRouteValidityStates() == null ? - Collections.emptySet() : currentConfiguration.getRouteValidityStates(); - final RoaAlertFrequency currentFrequency = currentConfiguration == null || currentConfiguration.getSubscription() == null ? - null : currentConfiguration.getSubscription().getFrequency(); - - if (newValidityStates.isEmpty()) { - currentEmails.forEach(email -> - commandService.execute(new UnsubscribeFromRoaAlertCommand(ca.getVersionedId(), email))); - } else { - // Unsubscribe addresses that are no longer in the new subscription list. - currentEmails.stream() - .filter(object -> !newEmails.contains(object)) - .forEach(email -> commandService.execute(new UnsubscribeFromRoaAlertCommand(ca.getVersionedId(), email))); - - // If both validity and frequency remains, only subscribe additional email. - if (newValidityStates.equals(currentValidityStates) && newSubscription.getFrequency().equals(currentFrequency)) { - newEmails.stream() - .filter(email -> !currentEmails.contains(email)) - .forEach(email -> - commandService.execute(new SubscribeToRoaAlertCommand(ca.getVersionedId(), email, newValidityStates, newSubscription.getFrequency()))); - - } else { - // Either validity or frequency changes so these guys have to be subscribed. - newEmails.forEach(email -> - commandService.execute(new SubscribeToRoaAlertCommand(ca.getVersionedId(), email, newValidityStates, newSubscription.getFrequency()))); - } + if (newSubscription.getFrequency() == null) { + return badRequest("No valid subscription frequency provided"); } + doSubscribe(caName, newSubscription); return ok(); } @PostMapping(path = "/suppress", consumes = {APPLICATION_JSON}) @Operation(summary = "Suppress alerts for announcements") - public ResponseEntity suppress(@PathVariable("caName") final CaName caName, @RequestBody final List announcements) { + public ResponseEntity suppress(@PathVariable("caName") final CaName caName, + @RequestBody final List announcements) { log.info("Suppress alerts for announcements for CA: {}", caName); HostedCertificateAuthorityData ca = getCa(HostedCertificateAuthorityData.class, caName); return processMuteOrUnMute(ca, getAnnouncedRoutes(announcements), Collections.emptySet()); @@ -126,13 +99,16 @@ public ResponseEntity suppress(@PathVariable("caName") final CaName caName, @ @PostMapping(path = "/unsuppress", consumes = {APPLICATION_JSON}) @Operation(summary = "Enable alerts for announcements") - public ResponseEntity enable(@PathVariable("caName") final CaName caName, @RequestBody final List announcements) { + public ResponseEntity enable(@PathVariable("caName") final CaName caName, + @RequestBody final List announcements) { log.info("Enable alerts for announcements for CA: {}", caName); HostedCertificateAuthorityData ca = getCa(HostedCertificateAuthorityData.class, caName); return processMuteOrUnMute(ca, Collections.emptySet(), getAnnouncedRoutes(announcements)); } - private ResponseEntity processMuteOrUnMute(final HostedCertificateAuthorityData ca, final Collection toMute, final Collection toUnmute) { + private ResponseEntity processMuteOrUnMute(final HostedCertificateAuthorityData ca, + final Collection toMute, + final Collection toUnmute) { commandService.execute(new UpdateRoaAlertIgnoredAnnouncedRoutesCommand(ca.getVersionedId(), toMute, toUnmute)); return created(); } @@ -142,4 +118,69 @@ private Collection getAnnouncedRoutes(List anno .map(bgp -> new AnnouncedRoute(Asn.parse(bgp.getAsn()), IpRange.parse(bgp.getPrefix()))).toList(); } + private void doSubscribe(CaName caName, Subscriptions newSubscription) { + + final Set newEmails = newSubscription.getEmails(); + final Set newValidityStates = newSubscription.getRouteValidityStates().stream() + .map(RouteValidityState::valueOf) + .collect(Collectors.toSet()); + + final HostedCertificateAuthorityData ca = getCa(HostedCertificateAuthorityData.class, caName); + final RoaAlertConfigurationData currentConfiguration = roaAlertConfigurationViewService.findRoaAlertSubscription(ca.getId()); + + if (currentConfiguration == null) { + if (newValidityStates.isEmpty() && newSubscription.isNotifyOnRoaChanges()) { + commandService.execute(new UpdateRoaChangeAlertCommand(ca.getVersionedId(), true)); + } else { + newEmails.forEach(email -> + commandService.execute(new SubscribeToRoaAlertCommand(ca.getVersionedId(), + email, newValidityStates, + newSubscription.getFrequency(), + newSubscription.isNotifyOnRoaChanges()))); + } + } else { + final Set currentEmails = currentConfiguration.getEmails() == null ? + Collections.emptySet() : new HashSet<>(currentConfiguration.getEmails()); + final Set currentValidityStates = currentConfiguration.getRouteValidityStates() == null ? + Collections.emptySet() : currentConfiguration.getRouteValidityStates(); + final RoaAlertFrequency currentFrequency = currentConfiguration.getSubscription() == null ? + null : currentConfiguration.getSubscription().getFrequency(); + + currentEmails.stream() + .filter(object -> !newEmails.contains(object)) + .forEach(email -> + commandService.execute(new UnsubscribeFromRoaAlertCommand(ca.getVersionedId(), + email, newSubscription.isNotifyOnRoaChanges()))); + + // If both validity and frequency stay the same, only subscribe additional email. + if (Objects.equals(newValidityStates, currentValidityStates) && Objects.equals(newSubscription.getFrequency(), currentFrequency)) { + if (newEmails.equals(currentEmails)) { + // if emails also stay the same, the only thing that can change is notifyOnRoaChanges flag. + // In this case issue special command updating only this flag. + if (newSubscription.isNotifyOnRoaChanges() != currentConfiguration.isNotifyOnRoaChanges()) { + commandService.execute(new UpdateRoaChangeAlertCommand(ca.getVersionedId(), newSubscription.isNotifyOnRoaChanges())); + } + } else { + newEmails.stream() + .filter(email -> !currentEmails.contains(email)) + .forEach(email -> + commandService.execute(new SubscribeToRoaAlertCommand(ca.getVersionedId(), + email, newValidityStates, + newSubscription.getFrequency(), + newSubscription.isNotifyOnRoaChanges()))); + } + } else { + if (!newValidityStates.isEmpty() && newSubscription.getFrequency() != null) { + // Either validity or frequency changes so these guys have to be subscribed. + newEmails.forEach(email -> + commandService.execute(new SubscribeToRoaAlertCommand(ca.getVersionedId(), + email, newValidityStates, + newSubscription.getFrequency(), + newSubscription.isNotifyOnRoaChanges()))); + } + } + } + } + + } diff --git a/src/main/java/net/ripe/rpki/rest/service/CaRoaConfigurationService.java b/src/main/java/net/ripe/rpki/rest/service/CaRoaConfigurationService.java index 745bf25..1101da5 100644 --- a/src/main/java/net/ripe/rpki/rest/service/CaRoaConfigurationService.java +++ b/src/main/java/net/ripe/rpki/rest/service/CaRoaConfigurationService.java @@ -15,6 +15,7 @@ import net.ripe.rpki.rest.pojo.ROAWithAnnouncementStatus; import net.ripe.rpki.server.api.commands.UpdateRoaConfigurationCommand; import net.ripe.rpki.server.api.dto.*; +import net.ripe.rpki.server.api.security.RunAsUserHolder; import net.ripe.rpki.server.api.services.command.CommandService; import net.ripe.rpki.server.api.services.read.BgpRisEntryViewService; import net.ripe.rpki.server.api.services.read.RoaAlertConfigurationViewService; @@ -293,7 +294,8 @@ public ResponseEntity publishROAs(@PathVariable("caName") final CaName caName ca.getVersionedId(), Optional.ofNullable(ifMatch), getRoaConfigurationPrefixDatas(publishSet.getAdded()), - getRoaConfigurationPrefixDatas(publishSet.getDeleted()) + getRoaConfigurationPrefixDatas(publishSet.getDeleted()), + RunAsUserHolder.get().getCertificationUserId() )); return noContent(); } catch (Exception e) { diff --git a/src/main/java/net/ripe/rpki/rest/service/EmailService.java b/src/main/java/net/ripe/rpki/rest/service/EmailService.java index 4821b55..4d2233b 100644 --- a/src/main/java/net/ripe/rpki/rest/service/EmailService.java +++ b/src/main/java/net/ripe/rpki/rest/service/EmailService.java @@ -66,7 +66,7 @@ public ResponseEntity unsubscribe( if (subscriptionOrNull != null && subscriptionOrNull.getEmails().contains(email) && token.equals(configurationToken)) { - commandService.execute(new UnsubscribeFromRoaAlertCommand(ca.getVersionedId(), email)); + commandService.execute(new UnsubscribeFromRoaAlertCommand(ca.getVersionedId(), email, configuration.isNotifyOnRoaChanges())); unsubscribedAnyone.set(true); } }); diff --git a/src/main/java/net/ripe/rpki/server/api/commands/SubscribeToRoaAlertCommand.java b/src/main/java/net/ripe/rpki/server/api/commands/SubscribeToRoaAlertCommand.java index bd0abcf..5791572 100644 --- a/src/main/java/net/ripe/rpki/server/api/commands/SubscribeToRoaAlertCommand.java +++ b/src/main/java/net/ripe/rpki/server/api/commands/SubscribeToRoaAlertCommand.java @@ -19,33 +19,35 @@ public class SubscribeToRoaAlertCommand extends CertificateAuthorityCommand { private final String email; private final Collection routeValidityStates; private final RoaAlertFrequency frequency; + private final boolean notifyOnRoaChanges; public SubscribeToRoaAlertCommand(VersionedId certificateAuthorityId, String email, Collection routeValidityStates) { - this(certificateAuthorityId, email, routeValidityStates, RoaAlertFrequency.DAILY); + this(certificateAuthorityId, email, routeValidityStates, RoaAlertFrequency.DAILY, false); } public SubscribeToRoaAlertCommand(VersionedId certificateAuthorityId, String email, Collection routeValidityStates, - RoaAlertFrequency frequency) { + RoaAlertFrequency frequency, + boolean notifyOnRoaChanges) { super(certificateAuthorityId, CertificateAuthorityCommandGroup.USER); Validate.notEmpty(email, "email is required"); Validate.notEmpty(routeValidityStates, "routeValidityStates is required"); this.email = email; this.routeValidityStates = EnumSet.copyOf(routeValidityStates); this.frequency = frequency; + this.notifyOnRoaChanges = notifyOnRoaChanges; } - // Let's make this conform to human repre - private String validitySummary(){ - if(routeValidityStates.contains(RouteValidityState.UNKNOWN)) - return "invalid and unknown announcements."; - else - return "invalid announcements only."; + // Let's make this conform to human representation + private String roaSummary() { + var stateMessage = routeValidityStates.contains(RouteValidityState.UNKNOWN) ? "invalid and unknown announcements" : "invalid announcements"; + var roaMessage = notifyOnRoaChanges ? " and ROA changes." : "."; + return stateMessage + roaMessage; } @Override public String getCommandSummary() { - return "Subscribed " + email + " to " + frequency.toString().toLowerCase() + " ROA alerts for "+validitySummary(); + return "Subscribed " + email + " to " + frequency.toString().toLowerCase() + " ROA alerts for " + roaSummary(); } } diff --git a/src/main/java/net/ripe/rpki/server/api/commands/UnsubscribeFromRoaAlertCommand.java b/src/main/java/net/ripe/rpki/server/api/commands/UnsubscribeFromRoaAlertCommand.java index f2a728e..b494236 100644 --- a/src/main/java/net/ripe/rpki/server/api/commands/UnsubscribeFromRoaAlertCommand.java +++ b/src/main/java/net/ripe/rpki/server/api/commands/UnsubscribeFromRoaAlertCommand.java @@ -5,20 +5,23 @@ /** * UN-Subscribe an email address to alerts about BGP updates seen by RIS - * that are invalidated by the CA's ROAs. + * that are invalidated by the CA's ROAs. */ +@Getter public class UnsubscribeFromRoaAlertCommand extends CertificateAuthorityCommand { - @Getter private final String email; + private final boolean notifyOnRoaChanges; - public UnsubscribeFromRoaAlertCommand(VersionedId certificateAuthorityId, String email) { + public UnsubscribeFromRoaAlertCommand(VersionedId certificateAuthorityId, String email, boolean notifyOnRoaChanges) { super(certificateAuthorityId, CertificateAuthorityCommandGroup.USER); this.email = email; + this.notifyOnRoaChanges = notifyOnRoaChanges; } @Override public String getCommandSummary() { - return "Unsubscribed " + email + " from ROA alerts."; + var roaSummary = notifyOnRoaChanges ? " and ROA changes." : "."; + return "Unsubscribed " + email + " from ROA alerts" + roaSummary; } } diff --git a/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaAlertIgnoredAnnouncedRoutesCommand.java b/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaAlertIgnoredAnnouncedRoutesCommand.java index 889b80a..4c3506c 100644 --- a/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaAlertIgnoredAnnouncedRoutesCommand.java +++ b/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaAlertIgnoredAnnouncedRoutesCommand.java @@ -17,7 +17,9 @@ public class UpdateRoaAlertIgnoredAnnouncedRoutesCommand extends CertificateAuth private final List deletions; - public UpdateRoaAlertIgnoredAnnouncedRoutesCommand(VersionedId certificateAuthorityId, Collection added, Collection deleted) { + public UpdateRoaAlertIgnoredAnnouncedRoutesCommand(VersionedId certificateAuthorityId, + Collection added, + Collection deleted) { super(certificateAuthorityId, CertificateAuthorityCommandGroup.USER); this.additions = new ArrayList<>(added); this.additions.sort(RouteData.ROUTE_DATA_COMPARATOR); diff --git a/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaChangeAlertCommand.java b/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaChangeAlertCommand.java new file mode 100644 index 0000000..fa4c9e4 --- /dev/null +++ b/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaChangeAlertCommand.java @@ -0,0 +1,21 @@ +package net.ripe.rpki.server.api.commands; + +import lombok.Getter; +import net.ripe.rpki.commons.util.VersionedId; + +@Getter +public class UpdateRoaChangeAlertCommand extends CertificateAuthorityCommand { + + private final boolean notifyOnRoaChanges; + + public UpdateRoaChangeAlertCommand(VersionedId certificateAuthorityId, boolean notifyOnRoaChanges) { + super(certificateAuthorityId, CertificateAuthorityCommandGroup.USER); + this.notifyOnRoaChanges = notifyOnRoaChanges; + } + + @Override + public String getCommandSummary() { + var action = notifyOnRoaChanges ? "Subscribed " : "Unsubscribed "; + return action + " from ROA change alerts."; + } +} diff --git a/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaConfigurationCommand.java b/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaConfigurationCommand.java index aa86504..c6c6ceb 100644 --- a/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaConfigurationCommand.java +++ b/src/main/java/net/ripe/rpki/server/api/commands/UpdateRoaConfigurationCommand.java @@ -4,6 +4,7 @@ import net.ripe.rpki.commons.util.VersionedId; import net.ripe.rpki.commons.validation.roa.RoaPrefixData; import net.ripe.rpki.server.api.dto.RoaConfigurationPrefixData; +import net.ripe.rpki.server.api.security.CertificationUserId; import org.apache.commons.lang.StringUtils; import java.util.*; @@ -21,17 +22,21 @@ public class UpdateRoaConfigurationCommand extends CertificateAuthorityModificat private final List additions; private final List deletions; + @Getter + private final CertificationUserId userId; public UpdateRoaConfigurationCommand(VersionedId certificateAuthorityId, Optional ifMatch, Collection added, - Collection deleted) { + Collection deleted, + CertificationUserId certificationUserId) { super(certificateAuthorityId, CertificateAuthorityCommandGroup.USER); this.ifMatch = ifMatch; this.additions = new ArrayList<>(added); this.additions.sort(RoaPrefixData.ROA_PREFIX_DATA_COMPARATOR); this.deletions = new ArrayList<>(deleted); this.deletions.sort(RoaPrefixData.ROA_PREFIX_DATA_COMPARATOR); + this.userId = certificationUserId; } public List getAdditions() { diff --git a/src/main/java/net/ripe/rpki/server/api/dto/CertificateAuthorityHistoryItem.java b/src/main/java/net/ripe/rpki/server/api/dto/CertificateAuthorityHistoryItem.java index 9158461..655283a 100644 --- a/src/main/java/net/ripe/rpki/server/api/dto/CertificateAuthorityHistoryItem.java +++ b/src/main/java/net/ripe/rpki/server/api/dto/CertificateAuthorityHistoryItem.java @@ -1,5 +1,6 @@ package net.ripe.rpki.server.api.dto; +import lombok.Getter; import net.ripe.rpki.server.api.support.objects.ValueObjectSupport; import org.joda.time.DateTime; @@ -7,7 +8,9 @@ public abstract class CertificateAuthorityHistoryItem extends ValueObjectSupport implements Serializable { + @Getter private final DateTime executionTime; + @Getter private final String principal; private final String commandSummary; @@ -17,14 +20,6 @@ protected CertificateAuthorityHistoryItem(DateTime executionTime, String princip this.commandSummary = commandSummary; } - public DateTime getExecutionTime() { - return executionTime; - } - - public String getPrincipal() { - return principal; - } - public String getSummary() { return commandSummary; } diff --git a/src/main/java/net/ripe/rpki/server/api/dto/RoaAlertConfigurationData.java b/src/main/java/net/ripe/rpki/server/api/dto/RoaAlertConfigurationData.java index 93d3c6c..678f4f0 100644 --- a/src/main/java/net/ripe/rpki/server/api/dto/RoaAlertConfigurationData.java +++ b/src/main/java/net/ripe/rpki/server/api/dto/RoaAlertConfigurationData.java @@ -1,5 +1,6 @@ package net.ripe.rpki.server.api.dto; +import lombok.Getter; import lombok.ToString; import net.ripe.rpki.commons.validation.roa.AnnouncedRoute; import net.ripe.rpki.commons.validation.roa.RouteValidityState; @@ -8,6 +9,7 @@ import java.util.*; @ToString +@Getter public class RoaAlertConfigurationData extends ValueObjectSupport { private final CertificateAuthorityData certificateAuthority; @@ -18,24 +20,14 @@ public RoaAlertConfigurationData(CertificateAuthorityData certificateAuthority, this(certificateAuthority, subscription, Collections.emptySet()); } - public RoaAlertConfigurationData(CertificateAuthorityData certificateAuthority, RoaAlertSubscriptionData subscription, Collection ignoredAnnouncements) { + public RoaAlertConfigurationData(CertificateAuthorityData certificateAuthority, + RoaAlertSubscriptionData subscription, + Collection ignoredAnnouncements) { this.certificateAuthority = certificateAuthority; this.subscription = subscription; this.ignoredAnnouncements = new HashSet<>(ignoredAnnouncements); } - public CertificateAuthorityData getCertificateAuthority() { - return certificateAuthority; - } - - public RoaAlertSubscriptionData getSubscription() { - return subscription; - } - - public Set getIgnoredAnnouncements() { - return ignoredAnnouncements; - } - public List getEmails() { return subscription == null ? Collections.emptyList() : subscription.getEmails(); } @@ -44,6 +36,10 @@ public Set getRouteValidityStates() { return subscription == null ? Collections.emptySet() : subscription.getRouteValidityStates(); } + public boolean isNotifyOnRoaChanges() { + return subscription != null && subscription.isNotifyOnRoaChanges(); + } + public boolean hasSubscription() { return subscription != null; } diff --git a/src/main/java/net/ripe/rpki/server/api/dto/RoaAlertSubscriptionData.java b/src/main/java/net/ripe/rpki/server/api/dto/RoaAlertSubscriptionData.java index 5799825..63e3ef9 100644 --- a/src/main/java/net/ripe/rpki/server/api/dto/RoaAlertSubscriptionData.java +++ b/src/main/java/net/ripe/rpki/server/api/dto/RoaAlertSubscriptionData.java @@ -5,7 +5,10 @@ import net.ripe.rpki.domain.alerts.RoaAlertFrequency; import net.ripe.rpki.server.api.support.objects.ValueObjectSupport; -import java.util.*; +import java.util.ArrayList; +import java.util.Collection; +import java.util.EnumSet; +import java.util.List; @Getter public class RoaAlertSubscriptionData extends ValueObjectSupport { @@ -13,15 +16,19 @@ public class RoaAlertSubscriptionData extends ValueObjectSupport { private final List emails; private final RoaAlertFrequency frequency; private final EnumSet routeValidityStates; + private final boolean notifyOnRoaChanges; - public RoaAlertSubscriptionData(String email, Collection routeValidityStates, RoaAlertFrequency frequency) { - this(List.of(email), routeValidityStates, frequency); + public RoaAlertSubscriptionData(String email, Collection routeValidityStates, + RoaAlertFrequency frequency, boolean notifyOnRoaChanges) { + this(List.of(email), routeValidityStates, frequency, notifyOnRoaChanges); } public RoaAlertSubscriptionData(List emails, Collection routeValidityStates, - RoaAlertFrequency frequency) { + RoaAlertFrequency frequency, + boolean notifyOnRoaChanges) { this.emails = new ArrayList<>(emails); this.routeValidityStates = EnumSet.copyOf(routeValidityStates); this.frequency = frequency; + this.notifyOnRoaChanges = notifyOnRoaChanges; } } diff --git a/src/main/java/net/ripe/rpki/server/api/security/CertificationUserId.java b/src/main/java/net/ripe/rpki/server/api/security/CertificationUserId.java index 993eb63..78e6db5 100644 --- a/src/main/java/net/ripe/rpki/server/api/security/CertificationUserId.java +++ b/src/main/java/net/ripe/rpki/server/api/security/CertificationUserId.java @@ -1,25 +1,17 @@ package net.ripe.rpki.server.api.security; +import lombok.AllArgsConstructor; +import lombok.Getter; import net.ripe.rpki.server.api.support.objects.ValueObjectSupport; import java.util.UUID; +@AllArgsConstructor public class CertificationUserId extends ValueObjectSupport { - private static final UUID SYSTEM_ID = UUID.fromString("3b22801d-c151-4bcc-9298-a93df3f365d9"); - public static final CertificationUserId SYSTEM = new CertificationUserId(SYSTEM_ID); - - private final UUID id; + private static final UUID SYSTEM_ID = UUID.fromString("3b22801d-c151-4bcc-9298-a93df3f365d9"); + public static final CertificationUserId SYSTEM = new CertificationUserId(SYSTEM_ID); - public CertificationUserId(UUID id) { - this.id = id; - } - - public CertificationUserId(String id) { - this.id = UUID.fromString(id); - } - - public UUID getId() { - return id; - } + @Getter + private final UUID id; } diff --git a/src/main/java/net/ripe/rpki/server/api/security/RunAsUser.java b/src/main/java/net/ripe/rpki/server/api/security/RunAsUser.java index c9509ea..88a17cc 100644 --- a/src/main/java/net/ripe/rpki/server/api/security/RunAsUser.java +++ b/src/main/java/net/ripe/rpki/server/api/security/RunAsUser.java @@ -1,5 +1,6 @@ package net.ripe.rpki.server.api.security; +import lombok.Getter; import net.ripe.rpki.server.api.support.objects.ValueObjectSupport; import org.apache.commons.lang.Validate; @@ -10,7 +11,9 @@ public final class RunAsUser extends ValueObjectSupport { private final CertificationUserId userId; + @Getter private final String friendlyName; + @Getter private final List roles; /** @@ -37,11 +40,4 @@ public CertificationUserId getCertificationUserId() { return userId; } - public String getFriendlyName() { - return friendlyName; - } - - public List getRoles() { - return roles; - } } diff --git a/src/main/java/net/ripe/rpki/services/impl/background/RoaNotificationService.java b/src/main/java/net/ripe/rpki/services/impl/background/RoaNotificationService.java new file mode 100644 index 0000000..38152f0 --- /dev/null +++ b/src/main/java/net/ripe/rpki/services/impl/background/RoaNotificationService.java @@ -0,0 +1,100 @@ +package net.ripe.rpki.services.impl.background; + +import lombok.extern.slf4j.Slf4j; +import net.ripe.ipresource.Asn; +import net.ripe.ipresource.IpRange; +import net.ripe.rpki.domain.ManagedCertificateAuthority; +import net.ripe.rpki.domain.alerts.RoaAlertConfiguration; +import net.ripe.rpki.domain.alerts.RoaAlertConfigurationRepository; +import net.ripe.rpki.domain.roa.RoaConfigurationPrefix; +import net.ripe.rpki.server.api.dto.RoaAlertSubscriptionData; +import net.ripe.rpki.server.api.ports.InternalNamePresenter; +import net.ripe.rpki.server.api.security.CertificationUserId; +import net.ripe.rpki.services.impl.email.EmailSender; +import net.ripe.rpki.services.impl.email.EmailTokens; +import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.tuple.Triple; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.stereotype.Service; + +import java.util.Collections; +import java.util.Comparator; +import java.util.List; +import java.util.Map; +import java.util.function.BiFunction; +import java.util.stream.Collectors; +import java.util.stream.Stream; + +@Slf4j +@Service +public class RoaNotificationService { + + private final RoaAlertConfigurationRepository roaAlertConfigurationRepository; + private final EmailSender emailSender; + private final InternalNamePresenter internalNamePresenter; + + @Autowired + public RoaNotificationService(RoaAlertConfigurationRepository roaAlertConfigurationRepository, + EmailSender emailSender, + InternalNamePresenter internalNamePresenter) { + this.roaAlertConfigurationRepository = roaAlertConfigurationRepository; + this.emailSender = emailSender; + this.internalNamePresenter = internalNamePresenter; + } + + public List notifyAboutRoaChanges(ManagedCertificateAuthority ca, + CertificationUserId userId, + List added, + List removed) { + RoaAlertConfiguration configuration = roaAlertConfigurationRepository.findByCertificateAuthorityIdOrNull(ca.getId()); + if (configuration == null || !configuration.isNotifyOnRoaChanges() || (added.isEmpty() && removed.isEmpty())) { + return Collections.emptyList(); + } + RoaAlertSubscriptionData subscriptionOrNull = configuration.getSubscriptionOrNull(); + if (subscriptionOrNull == null) { + return Collections.emptyList(); + } + var humanizedCaName = internalNamePresenter.humanizeCaName(ca.getName()); + var ssoEmail = internalNamePresenter.humanizeUserPrincipal(userId.getId().toString()); + + var parameters = Map.of( + "humanizedCaName", humanizedCaName, + "roas", showRoas(added, removed), + "ssoEmail", ssoEmail + ); + + return subscriptionOrNull.getEmails().stream() + .map(email -> emailSender.sendEmail( + email, + String.format(EmailSender.EmailTemplates.ROA_CHANGE_ALERT.templateSubject, humanizedCaName), + EmailSender.EmailTemplates.ROA_CHANGE_ALERT, + parameters, + EmailTokens.uniqueId(ca.getUuid()))) + .toList(); + } + + public record Roa(String asn, String prefix, String maxLength, char operation) { + } + + private List showRoas(List added, List removed) { + BiFunction padded = (o, size) -> + StringUtils.rightPad(o.toString(), size); + + BiFunction textRoa = (r, operation) -> { + IpRange ip = r.getPrefix(); + return new Roa( + padded.apply(r.getAsn().longValue(), 10), + padded.apply(ip, 50), + padded.apply(r.getMaximumLength(), 12), operation); + }; + + return Stream.concat( + added.stream().map(r -> Triple.of(r.getAsn(), r.getPrefix(), textRoa.apply(r, 'A'))), + removed.stream().map(r -> Triple.of(r.getAsn(), r.getPrefix(), textRoa.apply(r, 'D'))) + ) + .sorted(Comparator.comparing((Triple t) -> t.getLeft()).thenComparing(Triple::getMiddle)) + .map(Triple::getRight) + .toList(); + } + +} diff --git a/src/main/java/net/ripe/rpki/services/impl/email/EmailSender.java b/src/main/java/net/ripe/rpki/services/impl/email/EmailSender.java index 97038b3..7624341 100644 --- a/src/main/java/net/ripe/rpki/services/impl/email/EmailSender.java +++ b/src/main/java/net/ripe/rpki/services/impl/email/EmailSender.java @@ -4,24 +4,38 @@ public interface EmailSender { - void sendEmail(String emailTo, String subject, EmailTemplates template, Map parameters, String uniqueId); + ResultingEmail sendEmail(String emailTo, String subject, EmailTemplates template, Map parameters, String uniqueId); // Limit the number of possible inputs to allow us to check all templates in tests. enum EmailTemplates { - ROA_ALERT_SUBSCRIBE_CONFIRMATION_WEEKLY("email-templates/subscribe-confirmation-weekly.txt", "Your Resource Certification (RPKI) alerts subscription", true), - ROA_ALERT_SUBSCRIBE_CONFIRMATION_DAILY("email-templates/subscribe-confirmation-daily.txt", "Your Resource Certification (RPKI) alerts subscription", true), - ROA_ALERT_UNSUBSCRIBE("email-templates/unsubscribe-confirmation.txt", "Unsubscribe from Resource Certification (RPKI) alerts", false), - ROA_ALERT("email-templates/roa-alert-email.txt", "Resource Certification (RPKI) alerts for %s", true); + ROA_ALERT_SUBSCRIBE_CONFIRMATION_WEEKLY("email-templates/subscribe-confirmation-weekly.txt", + "Your Resource Certification (RPKI) alerts subscription"), + ROA_ALERT_SUBSCRIBE_CONFIRMATION_DAILY("email-templates/subscribe-confirmation-daily.txt", + "Your Resource Certification (RPKI) alerts subscription"), + ROA_ALERT_UNSUBSCRIBE("email-templates/unsubscribe-confirmation.txt", + "Unsubscribe from Resource Certification (RPKI) alerts", false), + ROA_ALERT("email-templates/roa-alert-email.txt", "Resource Certification (RPKI) alerts for %s"), + ROA_CHANGE_ALERT("email-templates/roa-change-alert-email.txt", "ROAs changed for %s"), + ROA_CHANGE_ALERT_SUBSCRIBE_CONFIRMATION("email-templates/subscribe-confirmation-change.txt", + "Your Resource Certification (RPKI) ROA change alerts subscription"), + ROA_CHANGE_ALERT_UNSUBSCRIBE_CONFIRMATION("email-templates/unsubscribe-confirmation-change.txt", + "Your Resource Certification (RPKI) ROA change alerts subscription"); public final String templateName; public final String templateSubject; - public final boolean generateUnsubcribeUrl; + public final boolean generateUnsubscribeUrl; - EmailTemplates(String templateName, String subject, boolean generateUnsubcribeUrl) { + EmailTemplates(String templateName, String subject) { + this(templateName, subject, true); + } + + EmailTemplates(String templateName, String subject, boolean generateUnsubscribeUrl) { this.templateName = templateName; this.templateSubject = subject; - this.generateUnsubcribeUrl = generateUnsubcribeUrl; + this.generateUnsubscribeUrl = generateUnsubscribeUrl; } } + record ResultingEmail(String email, String subject, String body) {} + } diff --git a/src/main/java/net/ripe/rpki/services/impl/email/EmailSenderBean.java b/src/main/java/net/ripe/rpki/services/impl/email/EmailSenderBean.java index 8ffa7a3..3419d3f 100644 --- a/src/main/java/net/ripe/rpki/services/impl/email/EmailSenderBean.java +++ b/src/main/java/net/ripe/rpki/services/impl/email/EmailSenderBean.java @@ -61,10 +61,10 @@ protected static ITemplateResolver textTemplateResolver() { } @Override - public void sendEmail(String emailTo, String subject, EmailTemplates template, Map parameters, String uniqueId) { + public ResultingEmail sendEmail(String emailTo, String subject, EmailTemplates template, Map parameters, String uniqueId) { if (!(mailSender instanceof JavaMailSenderImpl)) { log.error("mailSender is not configured properly, {}", mailSender.getClass()); - return; + return null; } try { @@ -75,7 +75,7 @@ public void sendEmail(String emailTo, String subject, EmailTemplates template, M message.setRecipient(Message.RecipientType.TO, new InternetAddress(emailTo)); message.setSubject(subject); var parametersUpdated = parameters; - if (template.generateUnsubcribeUrl) { + if (template.generateUnsubscribeUrl) { var unsubscribeUri = emailTokens.makeUnsubscribeUrl(uniqueId, emailTo); message.addHeader("List-Unsubscribe", "<" + unsubscribeUri + ">"); message.addHeader("List-Unsubscribe-Post", "List-Unsubscribe=One-Click"); @@ -83,7 +83,8 @@ public void sendEmail(String emailTo, String subject, EmailTemplates template, M } log.info("Rendering Email template {}", template.templateName); - message.setText(renderTemplate(template.templateName, parametersUpdated)); + var body = renderTemplate(template.templateName, parametersUpdated); + message.setText(body); if (!Environment.isLocal()) { try { @@ -95,8 +96,10 @@ public void sendEmail(String emailTo, String subject, EmailTemplates template, M } else { log.info("Not sending message in DEVELOPMENT mode:\n" + message); } + return new ResultingEmail(emailTo, subject, body); } catch (Exception e) { log.error("Failed to send email", e); + return null; } } diff --git a/src/main/java/net/ripe/rpki/services/impl/handlers/SubscribeToRoaAlertCommandHandler.java b/src/main/java/net/ripe/rpki/services/impl/handlers/SubscribeToRoaAlertCommandHandler.java index 4ae3609..d5c9ae4 100644 --- a/src/main/java/net/ripe/rpki/services/impl/handlers/SubscribeToRoaAlertCommandHandler.java +++ b/src/main/java/net/ripe/rpki/services/impl/handlers/SubscribeToRoaAlertCommandHandler.java @@ -1,6 +1,6 @@ package net.ripe.rpki.services.impl.handlers; -import com.google.common.collect.Sets; +import jakarta.inject.Inject; import net.ripe.rpki.domain.CertificateAuthorityRepository; import net.ripe.rpki.domain.ManagedCertificateAuthority; import net.ripe.rpki.domain.alerts.RoaAlertConfiguration; @@ -10,18 +10,17 @@ import net.ripe.rpki.server.api.dto.RoaAlertSubscriptionData; import net.ripe.rpki.server.api.services.command.CommandStatus; import net.ripe.rpki.services.impl.email.EmailSender; - -import jakarta.inject.Inject; import net.ripe.rpki.services.impl.email.EmailTokens; -import java.util.Collections; +import java.util.HashMap; +import java.util.List; +import java.util.Map; import java.util.Set; import java.util.stream.Collectors; @Handler public class SubscribeToRoaAlertCommandHandler extends AbstractCertificateAuthorityCommandHandler { - public static final String SUBSCRIPTION = "subscription"; private final RoaAlertConfigurationRepository repository; @@ -54,52 +53,50 @@ private void createConfigurationAndSendConfirmation(SubscribeToRoaAlertCommand c var emailTemplate = getConfirmationTemplate(configuration); emailSender.sendEmail(command.getEmail(), emailTemplate.templateSubject, emailTemplate, - Collections.singletonMap(SUBSCRIPTION, configuration.toData()), + makeParameters(configuration.toData()), EmailTokens.uniqueId(configuration.getCertificateAuthority().getUuid())); } private EmailSender.EmailTemplates getConfirmationTemplate(RoaAlertConfiguration configuration) { - switch (configuration.getFrequency()) { - case DAILY: - return EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_DAILY; - case WEEKLY: - return EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_WEEKLY; - default: - throw new IllegalStateException("Frequency should not be null"); - } + return switch (configuration.getFrequency()) { + case DAILY -> EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_DAILY; + case WEEKLY -> EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_WEEKLY; + }; } private void updateConfigurationAndSendConfirmation(RoaAlertConfiguration configuration, SubscribeToRoaAlertCommand command) { RoaAlertConfigurationData oldConfiguration = configuration.toData(); - configuration.setSubscription(new RoaAlertSubscriptionData(command.getEmail(), command.getRouteValidityStates(), command.getFrequency())); + configuration.setSubscription(new RoaAlertSubscriptionData(List.of(command.getEmail()), + command.getRouteValidityStates(), command.getFrequency(), command.isNotifyOnRoaChanges())); RoaAlertConfigurationData newConfiguration = configuration.toData(); - final Set oldEmailAddress = oldConfiguration.getEmails().stream().map(RoaAlertConfiguration::normEmail).collect(Collectors.toSet()); - final Set newEmailAddress = newConfiguration.getEmails().stream().map(RoaAlertConfiguration::normEmail).collect(Collectors.toSet()); - - if (oldEmailAddress.equals(newEmailAddress)) - return; + var oldEmailAddress = oldConfiguration.getEmails() + .stream().map(RoaAlertConfiguration::normEmail).collect(Collectors.toSet()); - // elements LHS not in RHS - Sets.difference(newEmailAddress, oldEmailAddress).forEach(email -> { + var normNewEmail = RoaAlertConfiguration.normEmail(command.getEmail()); + if (!oldEmailAddress.contains(normNewEmail)) { + var parametersSubscribe = makeParameters(newConfiguration, command.isNotifyOnRoaChanges()); var emailTemplate = getConfirmationTemplate(configuration); - emailSender.sendEmail(email, emailTemplate.templateSubject, emailTemplate, - Collections.singletonMap(SUBSCRIPTION, newConfiguration), + emailSender.sendEmail(normNewEmail, emailTemplate.templateSubject, emailTemplate, parametersSubscribe, EmailTokens.uniqueId(configuration.getCertificateAuthority().getUuid())); - }); + } + } + + public static Map makeParameters(RoaAlertConfigurationData configuration) { + return makeParameters(configuration, false); + } - Sets.difference(oldEmailAddress, newEmailAddress).forEach(email -> - emailSender.sendEmail(email, EmailSender.EmailTemplates.ROA_ALERT_UNSUBSCRIBE.templateSubject, - EmailSender.EmailTemplates.ROA_ALERT_UNSUBSCRIBE, - Collections.singletonMap(SUBSCRIPTION, oldConfiguration), - EmailTokens.uniqueId(configuration.getCertificateAuthority().getUuid()))); + public static Map makeParameters(RoaAlertConfigurationData configuration, boolean notifyOnChange) { + return Map.of("subscription", configuration, + "roaChangeSubscription", notifyOnChange ? + "Also you are subscribed to alerts about ROA changes." : ""); } private RoaAlertConfiguration createConfiguration(SubscribeToRoaAlertCommand command) { ManagedCertificateAuthority certificateAuthority = lookupManagedCa(command.getCertificateAuthorityId()); RoaAlertConfiguration configuration = new RoaAlertConfiguration(certificateAuthority); - configuration.setSubscription(new RoaAlertSubscriptionData(command.getEmail(), - command.getRouteValidityStates(), command.getFrequency())); + configuration.setSubscription(new RoaAlertSubscriptionData(List.of(command.getEmail()), + command.getRouteValidityStates(), command.getFrequency(), command.isNotifyOnRoaChanges())); repository.add(configuration); return configuration; } diff --git a/src/main/java/net/ripe/rpki/services/impl/handlers/UnsubscribeFromRoaAlertCommandHandler.java b/src/main/java/net/ripe/rpki/services/impl/handlers/UnsubscribeFromRoaAlertCommandHandler.java index fcc6f51..ba59aaf 100644 --- a/src/main/java/net/ripe/rpki/services/impl/handlers/UnsubscribeFromRoaAlertCommandHandler.java +++ b/src/main/java/net/ripe/rpki/services/impl/handlers/UnsubscribeFromRoaAlertCommandHandler.java @@ -1,5 +1,7 @@ package net.ripe.rpki.services.impl.handlers; +import jakarta.inject.Inject; +import lombok.extern.slf4j.Slf4j; import net.ripe.rpki.domain.CertificateAuthorityRepository; import net.ripe.rpki.domain.alerts.RoaAlertConfiguration; import net.ripe.rpki.domain.alerts.RoaAlertConfigurationRepository; @@ -7,16 +9,12 @@ import net.ripe.rpki.server.api.dto.RoaAlertSubscriptionData; import net.ripe.rpki.server.api.services.command.CommandStatus; import net.ripe.rpki.services.impl.email.EmailSender; - -import jakarta.inject.Inject; import net.ripe.rpki.services.impl.email.EmailTokens; -import java.util.Collections; - import static net.ripe.rpki.domain.alerts.RoaAlertConfiguration.normEmail; - @Handler +@Slf4j public class UnsubscribeFromRoaAlertCommandHandler extends AbstractCertificateAuthorityCommandHandler { private final RoaAlertConfigurationRepository repository; @@ -43,12 +41,18 @@ public void handle(UnsubscribeFromRoaAlertCommand command, CommandStatus command if (subscription == null) { return; } + configuration.setNotifyOnRoaChanges(command.isNotifyOnRoaChanges()); + if (!subscription.getEmails().contains(normEmail(command.getEmail()))) { + log.info("Trying to unsubscribe the address {} that is not amongst subscribed addresses {}", command.getEmail(), subscription.getEmails()); + return; + } configuration.removeEmail(command.getEmail()); + var parameters = SubscribeToRoaAlertCommandHandler.makeParameters(configuration.toData()); emailSender.sendEmail(normEmail(command.getEmail()), EmailSender.EmailTemplates.ROA_ALERT_UNSUBSCRIBE.templateSubject, EmailSender.EmailTemplates.ROA_ALERT_UNSUBSCRIBE, - Collections.singletonMap("subscription", configuration.toData()), + parameters, EmailTokens.uniqueId(configuration.getCertificateAuthority().getUuid())); } } diff --git a/src/main/java/net/ripe/rpki/services/impl/handlers/UpdateRoaChangeAlertCommandHandler.java b/src/main/java/net/ripe/rpki/services/impl/handlers/UpdateRoaChangeAlertCommandHandler.java new file mode 100644 index 0000000..6ca9ecc --- /dev/null +++ b/src/main/java/net/ripe/rpki/services/impl/handlers/UpdateRoaChangeAlertCommandHandler.java @@ -0,0 +1,66 @@ +package net.ripe.rpki.services.impl.handlers; + +import jakarta.inject.Inject; +import net.ripe.rpki.domain.CertificateAuthorityRepository; +import net.ripe.rpki.domain.ManagedCertificateAuthority; +import net.ripe.rpki.domain.alerts.RoaAlertConfiguration; +import net.ripe.rpki.domain.alerts.RoaAlertConfigurationRepository; +import net.ripe.rpki.server.api.commands.UpdateRoaChangeAlertCommand; +import net.ripe.rpki.server.api.services.command.CommandStatus; +import net.ripe.rpki.services.impl.email.EmailSender; +import net.ripe.rpki.services.impl.email.EmailTokens; + +import java.util.Collections; + + +@Handler +public class UpdateRoaChangeAlertCommandHandler extends AbstractCertificateAuthorityCommandHandler { + + private final RoaAlertConfigurationRepository repository; + + private final EmailSender emailSender; + + @Inject + public UpdateRoaChangeAlertCommandHandler(CertificateAuthorityRepository certificateAuthorityRepository, + RoaAlertConfigurationRepository repository, + EmailSender emailSender) { + super(certificateAuthorityRepository); + this.repository = repository; + this.emailSender = emailSender; + } + + @Override + public Class commandType() { + return UpdateRoaChangeAlertCommand.class; + } + + @Override + public void handle(UpdateRoaChangeAlertCommand command, CommandStatus commandStatus) { + final RoaAlertConfiguration configuration = repository.findByCertificateAuthorityIdOrNull(command.getCertificateAuthorityId()); + if (configuration == null) { + createNewAlertConfiguration(command, command.isNotifyOnRoaChanges()); + // there wasn't any configuration, so no emails to notify + } else if (command.isNotifyOnRoaChanges() != configuration.isNotifyOnRoaChanges()) { + configuration.setNotifyOnRoaChanges(command.isNotifyOnRoaChanges()); + EmailSender.EmailTemplates template = command.isNotifyOnRoaChanges() ? + EmailSender.EmailTemplates.ROA_CHANGE_ALERT_SUBSCRIBE_CONFIRMATION : + EmailSender.EmailTemplates.ROA_CHANGE_ALERT_UNSUBSCRIBE_CONFIRMATION; + sendEmails(configuration, template); + } + } + + private void sendEmails(RoaAlertConfiguration newConfiguration, EmailSender.EmailTemplates template) { + newConfiguration.getSubscriptionOrNull().getEmails().forEach(email -> + emailSender.sendEmail(email, + template.templateSubject, template, + Collections.singletonMap("subscription", newConfiguration), + EmailTokens.uniqueId(newConfiguration.getCertificateAuthority().getUuid()))); + } + + private void createNewAlertConfiguration(UpdateRoaChangeAlertCommand command, boolean notifyOnRoaChanges) { + ManagedCertificateAuthority certificateAuthority = lookupManagedCa(command.getCertificateAuthorityId()); + RoaAlertConfiguration configuration = new RoaAlertConfiguration(certificateAuthority); + configuration.setNotifyOnRoaChanges(notifyOnRoaChanges); + repository.add(configuration); + } +} diff --git a/src/main/java/net/ripe/rpki/services/impl/handlers/UpdateRoaConfigurationCommandHandler.java b/src/main/java/net/ripe/rpki/services/impl/handlers/UpdateRoaConfigurationCommandHandler.java index 43986fb..1380a24 100644 --- a/src/main/java/net/ripe/rpki/services/impl/handlers/UpdateRoaConfigurationCommandHandler.java +++ b/src/main/java/net/ripe/rpki/services/impl/handlers/UpdateRoaConfigurationCommandHandler.java @@ -7,6 +7,7 @@ import net.ripe.ipresource.IpResourceType; import net.ripe.rpki.domain.CertificateAuthorityRepository; import net.ripe.rpki.domain.ManagedCertificateAuthority; +import net.ripe.rpki.domain.alerts.RoaAlertConfigurationRepository; import net.ripe.rpki.domain.roa.RoaConfiguration; import net.ripe.rpki.domain.roa.RoaConfigurationPrefix; import net.ripe.rpki.domain.roa.RoaConfigurationRepository; @@ -17,6 +18,7 @@ import net.ripe.rpki.server.api.services.command.NotHolderOfResourcesException; import net.ripe.rpki.server.api.services.command.PrivateAsnsUsedException; import net.ripe.rpki.services.impl.background.RoaMetricsService; +import net.ripe.rpki.services.impl.background.RoaNotificationService; import org.springframework.beans.factory.annotation.Value; import jakarta.inject.Inject; @@ -30,18 +32,23 @@ public class UpdateRoaConfigurationCommandHandler extends AbstractCertificateAut private final RoaConfigurationRepository roaConfigurationRepository; private final ImmutableResourceSet privateAsnRanges; private final RoaMetricsService roaMetricsService; + private final RoaNotificationService roaNotificationService; @Inject public UpdateRoaConfigurationCommandHandler(CertificateAuthorityRepository certificateAuthorityRepository, RoaConfigurationRepository roaConfigurationRepository, @Value("${private.asns.ranges}") String privateASNS, - RoaMetricsService roaMetricsService) { + RoaMetricsService roaMetricsService, + RoaNotificationService roaNotificationService) { super(certificateAuthorityRepository); this.roaConfigurationRepository = roaConfigurationRepository; this.roaMetricsService = roaMetricsService; this.privateAsnRanges = ImmutableResourceSet.parse(privateASNS); - Preconditions.checkArgument(privateAsnRanges.stream().allMatch(a -> a.getType() == IpResourceType.ASN), "Only ASNs allowed for private ASN ranges: %s", privateAsnRanges); + this.roaNotificationService = roaNotificationService; + + Preconditions.checkArgument(privateAsnRanges.stream().allMatch(a -> a.getType() == IpResourceType.ASN), + "Only ASNs allowed for private ASN ranges: %s", privateAsnRanges); } @Override @@ -58,12 +65,14 @@ public void handle(@NonNull UpdateRoaConfigurationCommand command, CommandStatus validateAsns(command); validateAddedPrefixes(ca, command.getAdditions()); - roaConfigurationRepository.mergePrefixes(configuration, + RoaConfiguration.PrefixDiff prefixDiff = roaConfigurationRepository.mergePrefixes(configuration, RoaConfigurationPrefix.fromData(command.getAdditions()), RoaConfigurationPrefix.fromData(command.getDeletions())); ca.markConfigurationUpdated(); + roaNotificationService.notifyAboutRoaChanges(ca, command.getUserId(), prefixDiff.added(), prefixDiff.removed()); + roaMetricsService.countAdded(command.getAdditions().size()); roaMetricsService.countDeleted(command.getDeletions().size()); } diff --git a/src/main/java/net/ripe/rpki/services/impl/jpa/JpaRoaConfigurationRepository.java b/src/main/java/net/ripe/rpki/services/impl/jpa/JpaRoaConfigurationRepository.java index 3a45e93..ad74083 100644 --- a/src/main/java/net/ripe/rpki/services/impl/jpa/JpaRoaConfigurationRepository.java +++ b/src/main/java/net/ripe/rpki/services/impl/jpa/JpaRoaConfigurationRepository.java @@ -84,11 +84,12 @@ public Optional lastModified() { } @Override - public void mergePrefixes(RoaConfiguration configuration, - Collection prefixesToAdd, - Collection prefixesToRemove) { + public RoaConfiguration.PrefixDiff mergePrefixes(RoaConfiguration configuration, + Collection prefixesToAdd, + Collection prefixesToRemove) { var diff = configuration.mergePrefixes(prefixesToAdd, prefixesToRemove); applyDiff(configuration, diff); + return diff; } public void applyDiff(RoaConfiguration configuration, diff --git a/src/main/resources/db/migration/V133__roa_alerts_add_notify_on_roa_changes.sql b/src/main/resources/db/migration/V133__roa_alerts_add_notify_on_roa_changes.sql new file mode 100644 index 0000000..194681a --- /dev/null +++ b/src/main/resources/db/migration/V133__roa_alerts_add_notify_on_roa_changes.sql @@ -0,0 +1 @@ +ALTER TABLE roa_alert_configuration ADD COLUMN notify_on_roa_changes BOOLEAN NOT NULL DEFAULT FALSE; diff --git a/src/main/resources/email-templates/roa-change-alert-email.txt b/src/main/resources/email-templates/roa-change-alert-email.txt new file mode 100644 index 0000000..46a0cb3 --- /dev/null +++ b/src/main/resources/email-templates/roa-change-alert-email.txt @@ -0,0 +1,10 @@ +This is an automated email to inform you that user [[${ssoEmail}]] made changes +to one or more ROAs for your organisation [[${humanizedCaName}]]. + +ASN Prefix Max Length (A)dd/(D)elete +=============================================================================== +[# th:each="roa : ${roas}" ][(${roa.asn})][( ${roa.prefix})][( ${roa.maxLength})][( ${roa.operation})] +[/] + +You can review and change your ROAs at: [[${rpkiDashboardUri}]] +You can unsubscribe from these alerts at: [(${unsubscribeUri})] \ No newline at end of file diff --git a/src/main/resources/email-templates/subscribe-confirmation-change.txt b/src/main/resources/email-templates/subscribe-confirmation-change.txt new file mode 100644 index 0000000..71102a1 --- /dev/null +++ b/src/main/resources/email-templates/subscribe-confirmation-change.txt @@ -0,0 +1,8 @@ +Thank you for subscribing. + +You will receive email alerts from the RIPE NCC Resource +Certification (RPKI) service for every ROA change for your CA. + +You are able to fix and ignore reported issues, change your alert +settings, or unsubscribe by visiting [[${rpkiDashboardUri}]] or +directly using [(${unsubscribeUri})]. diff --git a/src/main/resources/email-templates/subscribe-confirmation-daily.txt b/src/main/resources/email-templates/subscribe-confirmation-daily.txt index 135e932..3850f98 100644 --- a/src/main/resources/email-templates/subscribe-confirmation-daily.txt +++ b/src/main/resources/email-templates/subscribe-confirmation-daily.txt @@ -1,7 +1,7 @@ Thank you for subscribing. Once every 24 hours, you will receive email alerts from the RIPE NCC -Resource Certification (RPKI) service. +Resource Certification (RPKI) service. [(${roaChangeSubscription})] You are able to fix and ignore reported issues, change your alert settings, or unsubscribe by visiting [[${rpkiDashboardUri}]] or diff --git a/src/main/resources/email-templates/subscribe-confirmation-weekly.txt b/src/main/resources/email-templates/subscribe-confirmation-weekly.txt index e63cfb3..e005d8b 100644 --- a/src/main/resources/email-templates/subscribe-confirmation-weekly.txt +++ b/src/main/resources/email-templates/subscribe-confirmation-weekly.txt @@ -1,7 +1,7 @@ Thank you for subscribing. Every week (on Mondays), you will receive email alerts from the RIPE NCC -Resource Certification (RPKI) service. +Resource Certification (RPKI) service. [(${roaChangeSubscription})] You are able to fix and ignore reported issues, change your alert settings, or unsubscribe by visiting [[${rpkiDashboardUri}]] or diff --git a/src/main/resources/email-templates/unsubscribe-confirmation-change.txt b/src/main/resources/email-templates/unsubscribe-confirmation-change.txt new file mode 100644 index 0000000..22e1011 --- /dev/null +++ b/src/main/resources/email-templates/unsubscribe-confirmation-change.txt @@ -0,0 +1,3 @@ +You have been unsubscribed from Resource Certification (RPKI) ROA changes alerts. + +Please visit [[${rpkiDashboardUri}]] to change your alert settings. diff --git a/src/main/resources/email-templates/unsubscribe-confirmation.txt b/src/main/resources/email-templates/unsubscribe-confirmation.txt index f1946d2..b8b8e92 100644 --- a/src/main/resources/email-templates/unsubscribe-confirmation.txt +++ b/src/main/resources/email-templates/unsubscribe-confirmation.txt @@ -1,4 +1,3 @@ -You have been unsubscribed from Resource Certification (RPKI) alerts. +You have been unsubscribed from Resource Certification (RPKI) alerts. [(${roaChangeSubscription})] -Please visit [[${rpkiDashboardUri}]] to change your alert -settings. +Please visit [[${rpkiDashboardUri}]] to change your alert settings. diff --git a/src/test/java/net/ripe/rpki/application/impl/CommandAuditServiceBeanTest.java b/src/test/java/net/ripe/rpki/application/impl/CommandAuditServiceBeanTest.java index 127a14b..b640263 100644 --- a/src/test/java/net/ripe/rpki/application/impl/CommandAuditServiceBeanTest.java +++ b/src/test/java/net/ripe/rpki/application/impl/CommandAuditServiceBeanTest.java @@ -96,7 +96,7 @@ public void should_extract_emails_from_subscribe_command_summary() { String email = "user_some.email+ripe.net@gmail.com"; recordCommand(new SubscribeToRoaAlertCommand(ca.getVersionedId(), email, List.of(RouteValidityState.INVALID_ASN)), "some event"); - recordCommand(new UnsubscribeFromRoaAlertCommand(ca.getVersionedId(), email), "some event 2"); + recordCommand(new UnsubscribeFromRoaAlertCommand(ca.getVersionedId(), email, false), "some event 2"); entityManager.flush(); Map emailMentions = subject.findMentionsInSummary(email); diff --git a/src/test/java/net/ripe/rpki/core/read/services/ca/CertificateAuthorityViewServiceStatisticsTest.java b/src/test/java/net/ripe/rpki/core/read/services/ca/CertificateAuthorityViewServiceStatisticsTest.java index 741a998..e26d2ee 100644 --- a/src/test/java/net/ripe/rpki/core/read/services/ca/CertificateAuthorityViewServiceStatisticsTest.java +++ b/src/test/java/net/ripe/rpki/core/read/services/ca/CertificateAuthorityViewServiceStatisticsTest.java @@ -24,7 +24,6 @@ import javax.security.auth.x500.X500Principal; import java.security.SecureRandom; -import java.util.Collections; import java.util.List; import java.util.Optional; import java.util.UUID; @@ -32,7 +31,7 @@ import java.util.stream.IntStream; import static net.ripe.ipresource.ImmutableResourceSet.parse; -import static org.assertj.core.api.Assertions.as; +import static net.ripe.rpki.server.api.security.RunAsUser.ADMIN; import static org.assertj.core.api.Assertions.assertThat; @Transactional @@ -138,7 +137,8 @@ public void testGetCaStatEvents() { commandService.execute(new UpdateRoaConfigurationCommand( child.getVersionedId(), Optional.empty(), List.of(), - ALL_ROA_CONFIGURATIONS.stream().map(ca -> ca.toData()).collect(Collectors.toList())) + ALL_ROA_CONFIGURATIONS.stream().map(ca -> ca.toData()).toList(), + ADMIN.getCertificationUserId()) ); assertThat(subject.getCaStatEvents()) @@ -151,7 +151,8 @@ public void testGetCaStatEvents() { commandService.execute(new UpdateRoaConfigurationCommand( child.getVersionedId(), Optional.empty(), ALL_ROA_CONFIGURATIONS.stream().map(ca -> ca.toData()).collect(Collectors.toList()), - List.of()) + List.of(), + ADMIN.getCertificationUserId()) ); assertThat(subject.getCaStatEvents()) .asInstanceOf(InstanceOfAssertFactories.list(CaStatRoaEvent.class)) diff --git a/src/test/java/net/ripe/rpki/domain/CertificationDomainTestCase.java b/src/test/java/net/ripe/rpki/domain/CertificationDomainTestCase.java index 674887a..80d1506 100644 --- a/src/test/java/net/ripe/rpki/domain/CertificationDomainTestCase.java +++ b/src/test/java/net/ripe/rpki/domain/CertificationDomainTestCase.java @@ -163,15 +163,6 @@ protected T withTx(Supplier c) { return transactionTemplate.execute(transactionStatus -> c.get()); } - protected CertificateAuthority createCaIfDoesntExist(CertificateAuthority ca) { - final CertificateAuthority existing = certificateAuthorityRepository.find(ca.getId()); - if (existing == null) { - certificateAuthorityRepository.add(ca); - return certificateAuthorityRepository.find(ca.getId()); - } - return existing; - } - protected CommandStatus execute(CertificateAuthorityCommand command) { try { return commandService.execute(command); diff --git a/src/test/java/net/ripe/rpki/domain/TestObjects.java b/src/test/java/net/ripe/rpki/domain/TestObjects.java index 190e828..87a0ce6 100644 --- a/src/test/java/net/ripe/rpki/domain/TestObjects.java +++ b/src/test/java/net/ripe/rpki/domain/TestObjects.java @@ -182,14 +182,20 @@ public static ProductionCertificateAuthority createInitialisedProdCaWithRipeReso return createInitialisedProdCaWithRipeResources(new InMemoryCertificateAuthorityRepository(), new InMemoryResourceCertificateRepository(), certificationConfiguration); } - public static ProductionCertificateAuthority createInitialisedProdCaWithRipeResources(CertificateAuthorityRepository certificateAuthorityRepository, ResourceCertificateRepository resourceCertificateRepository, RepositoryConfiguration certificationConfiguration) { + public static ProductionCertificateAuthority createInitialisedProdCaWithRipeResources(CertificateAuthorityRepository certificateAuthorityRepository, + ResourceCertificateRepository resourceCertificateRepository, + RepositoryConfiguration certificationConfiguration) { ProductionCertificateAuthority ca = new ProductionCertificateAuthority(CA_ID, PRODUCTION_CA_NAME, UUID.randomUUID(), null); createInitialisedKeyPair(certificateAuthorityRepository, resourceCertificateRepository, certificationConfiguration, ca, "TEST-KEY"); Validate.isTrue(ca.hasCurrentKeyPair()); return ca; } - static KeyPairEntity createInitialisedKeyPair(CertificateAuthorityRepository certificateAuthorityRepository, ResourceCertificateRepository resourceCertificateRepository, RepositoryConfiguration certificationConfiguration, ProductionCertificateAuthority ca, String name) { + static KeyPairEntity createInitialisedKeyPair(CertificateAuthorityRepository certificateAuthorityRepository, + ResourceCertificateRepository resourceCertificateRepository, + RepositoryConfiguration certificationConfiguration, + ProductionCertificateAuthority ca, + String name) { KeyPairEntity kp = createTestKeyPair(name); ca.addKeyPair(kp); // Implicitly persists the keypair before it is used in a outgoing resource certificate @@ -198,7 +204,9 @@ static KeyPairEntity createInitialisedKeyPair(CertificateAuthorityRepository cer return kp; } - static void issueSelfSignedCertificates(ResourceCertificateRepository resourceCertificateRepository, RepositoryConfiguration certificationConfiguration, ProductionCertificateAuthority ca) { + static void issueSelfSignedCertificates(ResourceCertificateRepository resourceCertificateRepository, + RepositoryConfiguration certificationConfiguration, + ProductionCertificateAuthority ca) { for (KeyPairEntity kp : ca.getKeyPairs()) { if (kp.findCurrentIncomingCertificate().isEmpty()) { ResourceCertificateInformationAccessStrategy ias = new ResourceCertificateInformationAccessStrategyBean(); diff --git a/src/test/java/net/ripe/rpki/rest/service/AlertServiceTest.java b/src/test/java/net/ripe/rpki/rest/service/AlertServiceTest.java index 658bf36..cca0731 100644 --- a/src/test/java/net/ripe/rpki/rest/service/AlertServiceTest.java +++ b/src/test/java/net/ripe/rpki/rest/service/AlertServiceTest.java @@ -7,10 +7,7 @@ import net.ripe.rpki.commons.util.VersionedId; import net.ripe.rpki.commons.validation.roa.RouteValidityState; import net.ripe.rpki.domain.alerts.RoaAlertFrequency; -import net.ripe.rpki.server.api.commands.CertificateAuthorityCommand; -import net.ripe.rpki.server.api.commands.SubscribeToRoaAlertCommand; -import net.ripe.rpki.server.api.commands.UnsubscribeFromRoaAlertCommand; -import net.ripe.rpki.server.api.commands.UpdateRoaAlertIgnoredAnnouncedRoutesCommand; +import net.ripe.rpki.server.api.commands.*; import net.ripe.rpki.server.api.dto.CertificateAuthorityData; import net.ripe.rpki.server.api.dto.HostedCertificateAuthorityData; import net.ripe.rpki.server.api.dto.RoaAlertConfigurationData; @@ -39,8 +36,7 @@ import static jakarta.ws.rs.core.MediaType.APPLICATION_JSON; import static net.ripe.rpki.rest.service.AbstractCaRestService.API_URL_PREFIX; -import static org.junit.Assert.assertEquals; -import static org.junit.Assert.assertTrue; +import static org.junit.Assert.*; import static org.mockito.Mockito.*; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; @@ -78,14 +74,28 @@ public void init() { } @Test - public void shouldGetExistingAlerts() throws Exception { + public void shouldNotCrashWithEmptySubscription() throws Exception { + CertificateAuthorityData caData = mock(CertificateAuthorityData.class); + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn( + new RoaAlertConfigurationData(caData, null)); + + mockMvc.perform(Rest.get(API_URL_PREFIX + "/123/alerts")) + .andExpect(status().isOk()) + .andExpect(content().contentType(APPLICATION_JSON)) + .andExpect(jsonPath("$.frequency").value("DAILY")) + .andExpect(jsonPath("$.notifyOnRoaChanges").value("false")); + } + @Test + public void shouldGetExistingAlerts() throws Exception { CertificateAuthorityData caData = mock(CertificateAuthorityData.class); RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( Arrays.asList("festeban@ripe.net", "bad@ripe.net"), - Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY); + Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), + RoaAlertFrequency.WEEKLY, true); - when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn( + new RoaAlertConfigurationData(caData, roaSubscriptionData)); mockMvc.perform(Rest.get(API_URL_PREFIX + "/123/alerts")) .andExpect(status().isOk()) @@ -94,7 +104,8 @@ public void shouldGetExistingAlerts() throws Exception { .andExpect(jsonPath("$.routeValidityStates[1]").value("UNKNOWN")) .andExpect(jsonPath("$.emails[0]").value("festeban@ripe.net")) .andExpect(jsonPath("$.emails[1]").value("bad@ripe.net")) - .andExpect(jsonPath("$.frequency").value("WEEKLY")); + .andExpect(jsonPath("$.frequency").value("WEEKLY")) + .andExpect(jsonPath("$.notifyOnRoaChanges").value("true")); } @Test @@ -105,20 +116,24 @@ public void shouldSubscribeToAlerts() throws Exception { CertificateAuthorityData caData = mock(CertificateAuthorityData.class); RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( Arrays.asList("festeban@ripe.net", "bad@ripe.net"), - Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), RoaAlertFrequency.DAILY); - when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); + Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), + RoaAlertFrequency.DAILY, true); + + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)) + .thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); ArgumentCaptor commandArgument = ArgumentCaptor.forClass(CertificateAuthorityCommand.class); mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", - "{\"routeValidityStates\" : [\"INVALID_LENGTH\"], \"emails\" : [\"bad1@ripe.net\"]}")) + "{\"routeValidityStates\" : [\"INVALID_LENGTH\"], " + + "\"emails\" : [\"bad1@ripe.net\"]," + + "\"frequency\" : \"WEEKLY\"}")) .andExpect(status().isOk()) .andExpect(content().contentType(APPLICATION_JSON)); verify(commandService, times(3)).execute(commandArgument.capture()); List commands = commandArgument.getAllValues(); - UnsubscribeFromRoaAlertCommand unsubscribe1 = (UnsubscribeFromRoaAlertCommand) commands.get(0); UnsubscribeFromRoaAlertCommand unsubscribe2 = (UnsubscribeFromRoaAlertCommand) commands.get(1); SubscribeToRoaAlertCommand subscribe = (SubscribeToRoaAlertCommand) commands.get(2); @@ -134,19 +149,34 @@ public void shouldSubscribeToAlerts() throws Exception { Sets.newHashSet(unsubscribe1.getEmail(), unsubscribe2.getEmail())); } + @Test + public void shouldRejectNoFrequency() throws Exception { + mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", + "{\"routeValidityStates\" : [\"INVALID_LENGTH\"], " + + "\"emails\" : [\"bad1@ripe.net\"]}")) + .andExpect(status().isBadRequest()) + .andExpect(content().string("{\"error\":\"No valid subscription frequency provided\"}")); + } + @Test public void shouldSubscribeToAlertsWhenOnlyValidityStatusChanges() throws Exception { CertificateAuthorityData caData = mock(CertificateAuthorityData.class); RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( Collections.singletonList("bad@ripe.net"), - Collections.singletonList(RouteValidityState.INVALID_ASN), RoaAlertFrequency.DAILY); - when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); + Collections.singletonList(RouteValidityState.INVALID_ASN), + RoaAlertFrequency.DAILY, true); + + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn( + new RoaAlertConfigurationData(caData, roaSubscriptionData)); ArgumentCaptor commandArgument = ArgumentCaptor.forClass(CertificateAuthorityCommand.class); mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", - "{\"routeValidityStates\" : [\"INVALID_LENGTH\", \"INVALID_ASN\"], \"emails\" : [\"bad@ripe.net\"], \"frequency\":\"WEEKLY\"}")) + "{\"routeValidityStates\" : [\"INVALID_LENGTH\", \"INVALID_ASN\"], " + + "\"emails\" : [\"bad@ripe.net\"], " + + "\"notifyOnRoaChanges\" : \"false\", " + + "\"frequency\" : \"WEEKLY\"}")) .andExpect(status().isOk()) .andExpect(content().contentType(APPLICATION_JSON)); @@ -156,6 +186,7 @@ public void shouldSubscribeToAlertsWhenOnlyValidityStatusChanges() throws Except SubscribeToRoaAlertCommand subscribe = (SubscribeToRoaAlertCommand) commands.get(0); assertEquals("bad@ripe.net", subscribe.getEmail()); assertEquals(RoaAlertFrequency.WEEKLY, subscribe.getFrequency()); + assertFalse(subscribe.isNotifyOnRoaChanges()); assertEquals( Sets.newHashSet(RouteValidityState.INVALID_LENGTH, RouteValidityState.INVALID_ASN), @@ -168,14 +199,19 @@ public void subscribeOnlyAdditionalEmailsWhenValidityAndFrequencyUnchanged() thr CertificateAuthorityData caData = mock(CertificateAuthorityData.class); RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( Arrays.asList("badweekly@ripe.net"), - Collections.singletonList(RouteValidityState.INVALID_ASN), RoaAlertFrequency.WEEKLY); - when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); + Collections.singletonList(RouteValidityState.INVALID_ASN), + RoaAlertFrequency.WEEKLY, false); + + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)) + .thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); ArgumentCaptor commandArgument = ArgumentCaptor.forClass(CertificateAuthorityCommand.class); mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", - "{\"routeValidityStates\" : [\"INVALID_ASN\"], \"emails\" : [\"badweekly@ripe.net\",\"boyweekly@ripe.net\"], " + - "\"frequency\":\"WEEKLY\"}")) + "{\"routeValidityStates\" : [\"INVALID_ASN\"], " + + "\"emails\" : [\"badweekly@ripe.net\",\"boyweekly@ripe.net\"], " + + "\"notifyOnRoaChanges\" : \"true\", " + + "\"frequency\" : \"WEEKLY\"}")) .andExpect(status().isOk()) .andExpect(content().contentType(APPLICATION_JSON)); @@ -186,6 +222,7 @@ public void subscribeOnlyAdditionalEmailsWhenValidityAndFrequencyUnchanged() thr SubscribeToRoaAlertCommand subscribe = (SubscribeToRoaAlertCommand) commands.get(0); assertEquals("boyweekly@ripe.net", subscribe.getEmail()); assertEquals(RoaAlertFrequency.WEEKLY, subscribe.getFrequency()); + assertTrue(subscribe.isNotifyOnRoaChanges()); assertEquals( Sets.newHashSet(RouteValidityState.INVALID_ASN), @@ -198,14 +235,19 @@ public void resubscribeEveryoneWhenFrequencyChanges() throws Exception { CertificateAuthorityData caData = mock(CertificateAuthorityData.class); RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( Arrays.asList("bad@ripe.net","boy@ripe.net"), - Collections.singletonList(RouteValidityState.INVALID_ASN), RoaAlertFrequency.WEEKLY); - when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); + Collections.singletonList(RouteValidityState.INVALID_ASN), + RoaAlertFrequency.WEEKLY, true); + + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)) + .thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); ArgumentCaptor commandArgument = ArgumentCaptor.forClass(CertificateAuthorityCommand.class); mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", - "{\"routeValidityStates\" : [\"INVALID_ASN\"], \"emails\" : [\"bad@ripe.net\",\"boy@ripe.net\"], " + - "\"frequency\":\"DAILY\"}")) + "{\"routeValidityStates\" : [\"INVALID_ASN\"], " + + "\"emails\" : [\"bad@ripe.net\",\"boy@ripe.net\"], " + + "\"notifyOnRoaChanges\" : \"true\", " + + "\"frequency\":\"DAILY\"}")) .andExpect(status().isOk()) .andExpect(content().contentType(APPLICATION_JSON)); @@ -218,13 +260,12 @@ public void resubscribeEveryoneWhenFrequencyChanges() throws Exception { assertTrue(emails.contains("boy@ripe.net")); Set frequencies = commands.stream().map(c -> ((SubscribeToRoaAlertCommand) c).getFrequency().toString()).collect(Collectors.toSet()); - assertTrue(frequencies.size() == 1); + assertEquals(1, frequencies.size()); assertTrue(frequencies.contains("DAILY")); Set validities = commands.stream().map(c -> ((SubscribeToRoaAlertCommand) c).getRouteValidityStates().toString()).collect(Collectors.toSet()); - assertTrue(validities.size() == 1); + assertEquals(1, validities.size()); assertTrue(validities.contains("[INVALID_ASN]")); - } @Test @@ -234,13 +275,15 @@ public void shouldUnsubscribeAnyoneWhenStatusesAreEmpty() throws Exception { RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( Arrays.asList("festeban@ripe.net", "bad@ripe.net"), Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), - RoaAlertFrequency.DAILY); + RoaAlertFrequency.DAILY, false); when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)).thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); ArgumentCaptor commandArgument = ArgumentCaptor.forClass(CertificateAuthorityCommand.class); mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", - "{\"routeValidityStates\" : [], \"emails\" : [\"bad1@ripe.net\"]}")) + "{\"routeValidityStates\" : [], " + + "\"emails\" : [\"bad1@ripe.net\"], " + + "\"frequency\":\"DAILY\"}")) .andExpect(status().isOk()) .andExpect(content().contentType(APPLICATION_JSON)); @@ -255,6 +298,102 @@ public void shouldUnsubscribeAnyoneWhenStatusesAreEmpty() throws Exception { Sets.newHashSet(unsubscribe1.getEmail(), unsubscribe2.getEmail())); } + @Test + public void shouldSubscribeOrUnsubscribeToRoaChanges() throws Exception { + + CertificateAuthorityData caData = mock(CertificateAuthorityData.class); + RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( + Arrays.asList("festeban@ripe.net", "bad@ripe.net"), + Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), + RoaAlertFrequency.DAILY, true); + + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)) + .thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); + + ArgumentCaptor commandArgument = ArgumentCaptor.forClass(CertificateAuthorityCommand.class); + + mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", + "{\"routeValidityStates\" : [], " + + "\"emails\" : [\"bad1@ripe.net\"]," + + "\"frequency\":\"DAILY\"}")) + .andExpect(status().isOk()) + .andExpect(content().contentType(APPLICATION_JSON)); + + verify(commandService, times(2)).execute(commandArgument.capture()); + List commands = commandArgument.getAllValues(); + + UnsubscribeFromRoaAlertCommand unsubscribe1 = (UnsubscribeFromRoaAlertCommand) commands.get(0); + UnsubscribeFromRoaAlertCommand unsubscribe2 = (UnsubscribeFromRoaAlertCommand) commands.get(1); + assertFalse(unsubscribe1.isNotifyOnRoaChanges()); + assertFalse(unsubscribe2.isNotifyOnRoaChanges()); + + assertEquals( + Sets.newHashSet("bad@ripe.net", "festeban@ripe.net"), + Sets.newHashSet(unsubscribe1.getEmail(), unsubscribe2.getEmail())); + } + + + @Test + public void shouldOnlySubscribeOrUnsubscribeToRoaChangesAndNothingElse() throws Exception { + + CertificateAuthorityData caData = mock(CertificateAuthorityData.class); + RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( + Arrays.asList("festeban@ripe.net", "bad@ripe.net"), + Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), + RoaAlertFrequency.DAILY, true); + + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)) + .thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); + + ArgumentCaptor commandArgument = ArgumentCaptor.forClass(CertificateAuthorityCommand.class); + + // Change nothing except for notifyOnRoaChanges + mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", + "{\"routeValidityStates\" : [\"INVALID_ASN\", \"UNKNOWN\"], " + + "\"notifyOnRoaChanges\" : \"false\", " + + "\"emails\" : [\"festeban@ripe.net\", \"bad@ripe.net\"], " + + "\"frequency\" : \"DAILY\"}")) + .andExpect(status().isOk()) + .andExpect(content().contentType(APPLICATION_JSON)); + + verify(commandService, times(1)).execute(commandArgument.capture()); + List commands = commandArgument.getAllValues(); + + UpdateRoaChangeAlertCommand roaChangeUpdate = (UpdateRoaChangeAlertCommand) commands.get(0); + assertFalse(roaChangeUpdate.isNotifyOnRoaChanges()); + } + + + @Test + public void shouldSubscribeToRoaChangesWhenSubscribing() throws Exception { + + CertificateAuthorityData caData = mock(CertificateAuthorityData.class); + RoaAlertSubscriptionData roaSubscriptionData = new RoaAlertSubscriptionData( + Arrays.asList("bad@ripe.net"), + Arrays.asList(RouteValidityState.INVALID_ASN), + RoaAlertFrequency.DAILY, true); + + when(roaAlertConfigurationViewService.findRoaAlertSubscription(CA_ID)) + .thenReturn(new RoaAlertConfigurationData(caData, roaSubscriptionData)); + + ArgumentCaptor commandArgument = ArgumentCaptor.forClass(CertificateAuthorityCommand.class); + + mockMvc.perform(Rest.post(API_URL_PREFIX + "/123/alerts", + "{\"routeValidityStates\" : [\"INVALID_ASN\"], " + + "\"emails\" : [\"bad@ripe.net\", \"festeban@ripe.net\"]," + + "\"frequency\":\"DAILY\"}")) + .andExpect(status().isOk()) + .andExpect(content().contentType(APPLICATION_JSON)); + + verify(commandService, times(1)).execute(commandArgument.capture()); + List commands = commandArgument.getAllValues(); + + SubscribeToRoaAlertCommand subscribe = (SubscribeToRoaAlertCommand) commands.get(0); + assertFalse(subscribe.isNotifyOnRoaChanges()); + + assertEquals("festeban@ripe.net", subscribe.getEmail()); + } + @Test public void shouldMuteAnnouncements() throws Exception { diff --git a/src/test/java/net/ripe/rpki/rest/service/AnnouncementServiceTest.java b/src/test/java/net/ripe/rpki/rest/service/AnnouncementServiceTest.java index 89dd81c..3f1fa5b 100644 --- a/src/test/java/net/ripe/rpki/rest/service/AnnouncementServiceTest.java +++ b/src/test/java/net/ripe/rpki/rest/service/AnnouncementServiceTest.java @@ -396,7 +396,7 @@ private RoaAlertConfigurationData getRoaAlertConfigurationData(Asn asn, IpRange final List routeValidityStates = Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN); final RoaAlertSubscriptionData subscription = new RoaAlertSubscriptionData("joe@example.com", - routeValidityStates, RoaAlertFrequency.DAILY); + routeValidityStates, RoaAlertFrequency.DAILY, false); return new RoaAlertConfigurationData(caData, subscription, ignoredAnnouncements); } diff --git a/src/test/java/net/ripe/rpki/server/api/commands/SubscribeToRoaAlertCommandTest.java b/src/test/java/net/ripe/rpki/server/api/commands/SubscribeToRoaAlertCommandTest.java index 51c7359..b12b192 100644 --- a/src/test/java/net/ripe/rpki/server/api/commands/SubscribeToRoaAlertCommandTest.java +++ b/src/test/java/net/ripe/rpki/server/api/commands/SubscribeToRoaAlertCommandTest.java @@ -17,12 +17,24 @@ public class SubscribeToRoaAlertCommandTest { @Test public void shouldHaveDescriptiveLogEntryForInvalidOnly() { subject = new SubscribeToRoaAlertCommand(new VersionedId(1), "bob@example.net", Collections.singletonList(RouteValidityState.INVALID_ASN)); - assertEquals("Subscribed bob@example.net to daily ROA alerts for invalid announcements only.", subject.getCommandSummary()); + assertEquals("Subscribed bob@example.net to daily ROA alerts for invalid announcements.", subject.getCommandSummary()); } @Test - public void shouldHaveDescriptiveLogEntryForInvalidAndUnknown() { - subject = new SubscribeToRoaAlertCommand(new VersionedId(1), "bob@example.net", Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY); - assertEquals("Subscribed bob@example.net to weekly ROA alerts for invalid and unknown announcements.", subject.getCommandSummary()); + public void shouldHaveDescriptiveLogEntryForInvalidAndUnknownWithRoaChanges() { + subject = new SubscribeToRoaAlertCommand(new VersionedId(1), "bob@example.net", + Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), + RoaAlertFrequency.WEEKLY, true); + assertEquals("Subscribed bob@example.net to weekly ROA alerts for invalid and unknown announcements and ROA changes.", + subject.getCommandSummary()); + } + + @Test + public void shouldHaveDescriptiveLogEntryForInvalidAndUnknownNoRoaChanges() { + subject = new SubscribeToRoaAlertCommand(new VersionedId(1), "bob@example.net", + Arrays.asList(RouteValidityState.INVALID_ASN, RouteValidityState.UNKNOWN), + RoaAlertFrequency.WEEKLY, false); + assertEquals("Subscribed bob@example.net to weekly ROA alerts for invalid and unknown announcements.", + subject.getCommandSummary()); } } diff --git a/src/test/java/net/ripe/rpki/server/api/commands/UnsubscribeFromRoaAlertCommandTest.java b/src/test/java/net/ripe/rpki/server/api/commands/UnsubscribeFromRoaAlertCommandTest.java index c3cc845..2bee7a1 100644 --- a/src/test/java/net/ripe/rpki/server/api/commands/UnsubscribeFromRoaAlertCommandTest.java +++ b/src/test/java/net/ripe/rpki/server/api/commands/UnsubscribeFromRoaAlertCommandTest.java @@ -1,22 +1,18 @@ package net.ripe.rpki.server.api.commands; import net.ripe.rpki.commons.util.VersionedId; -import org.junit.Before; import org.junit.Test; +import java.util.function.Function; + import static org.junit.Assert.assertEquals; public class UnsubscribeFromRoaAlertCommandTest { - private UnsubscribeFromRoaAlertCommand subject; - - @Before - public void setUp() { - subject = new UnsubscribeFromRoaAlertCommand(new VersionedId(1), "bob@example.net"); - } - @Test public void shouldHaveDescriptiveLogEntry() { - assertEquals("Unsubscribed bob@example.net from ROA alerts.", subject.getCommandSummary()); + Function makeCommand = notify -> new UnsubscribeFromRoaAlertCommand(new VersionedId(1), "bob@example.net", notify); + assertEquals("Unsubscribed bob@example.net from ROA alerts.", makeCommand.apply(false).getCommandSummary()); + assertEquals("Unsubscribed bob@example.net from ROA alerts and ROA changes.", makeCommand.apply(true).getCommandSummary()); } } diff --git a/src/test/java/net/ripe/rpki/server/api/commands/UpdateRoaConfigurationCommandTest.java b/src/test/java/net/ripe/rpki/server/api/commands/UpdateRoaConfigurationCommandTest.java index 8a6bdc4..8de92ba 100644 --- a/src/test/java/net/ripe/rpki/server/api/commands/UpdateRoaConfigurationCommandTest.java +++ b/src/test/java/net/ripe/rpki/server/api/commands/UpdateRoaConfigurationCommandTest.java @@ -12,6 +12,7 @@ import java.util.List; import java.util.Optional; +import static net.ripe.rpki.server.api.security.RunAsUser.ADMIN; import static org.junit.Assert.assertEquals; public class UpdateRoaConfigurationCommandTest { @@ -20,8 +21,12 @@ public class UpdateRoaConfigurationCommandTest { @Before public void setUp() { - List added = Arrays.asList(new RoaConfigurationPrefixData(Asn.parse("123"), IpRange.parse("10.64.0.0/12"), 24), new RoaConfigurationPrefixData(Asn.parse("123"), IpRange.parse("10.32.0.0/12"), null)); - subject = new UpdateRoaConfigurationCommand(new VersionedId(1), Optional.empty(), added, Collections.emptyList()); + List added = Arrays.asList( + new RoaConfigurationPrefixData(Asn.parse("123"), IpRange.parse("10.64.0.0/12"), 24), + new RoaConfigurationPrefixData(Asn.parse("123"), IpRange.parse("10.32.0.0/12"), null)); + + subject = new UpdateRoaConfigurationCommand( + new VersionedId(1), Optional.empty(), added, Collections.emptyList(), ADMIN.getCertificationUserId()); } @Test diff --git a/src/test/java/net/ripe/rpki/services/impl/background/RoaAlertBackgroundServiceDailyBeanTest.java b/src/test/java/net/ripe/rpki/services/impl/background/RoaAlertBackgroundServiceDailyBeanTest.java index d3bac33..3322471 100644 --- a/src/test/java/net/ripe/rpki/services/impl/background/RoaAlertBackgroundServiceDailyBeanTest.java +++ b/src/test/java/net/ripe/rpki/services/impl/background/RoaAlertBackgroundServiceDailyBeanTest.java @@ -39,12 +39,12 @@ public class RoaAlertBackgroundServiceDailyBeanTest { ImmutableResourceSet.ALL_PRIVATE_USE_RESOURCES, Collections.emptyList()); public static final RoaAlertConfigurationData ALERT_SUBSCRIPTION_DATA = new RoaAlertConfigurationData(CA_DATA, - new RoaAlertSubscriptionData(List.of("joeok@example.com"), Arrays.asList(RouteValidityState.INVALID_ASN, - RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN), RoaAlertFrequency.DAILY)); + new RoaAlertSubscriptionData("joeok@example.com", Arrays.asList(RouteValidityState.INVALID_ASN, + RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN), RoaAlertFrequency.DAILY, false)); private static final RoaAlertConfigurationData ALERT_SUBSCRIPTION_ERROR = new RoaAlertConfigurationData(CA_DATA, new RoaAlertSubscriptionData("errorjohn@example.com", Arrays.asList(RouteValidityState.INVALID_ASN, - RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN), RoaAlertFrequency.DAILY)); + RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN), RoaAlertFrequency.DAILY, true)); @Mock private ActiveNodeService activeNodeService; diff --git a/src/test/java/net/ripe/rpki/services/impl/background/RoaAlertBackgroundServiceWeeklyBeanTest.java b/src/test/java/net/ripe/rpki/services/impl/background/RoaAlertBackgroundServiceWeeklyBeanTest.java index e7cccf6..9f0eee3 100644 --- a/src/test/java/net/ripe/rpki/services/impl/background/RoaAlertBackgroundServiceWeeklyBeanTest.java +++ b/src/test/java/net/ripe/rpki/services/impl/background/RoaAlertBackgroundServiceWeeklyBeanTest.java @@ -39,11 +39,11 @@ public class RoaAlertBackgroundServiceWeeklyBeanTest { private static final RoaAlertConfigurationData ALERT_SUBSCRIPTION_ERROR = new RoaAlertConfigurationData(CA_DATA, new RoaAlertSubscriptionData("errorjohn@example.com", Arrays.asList(RouteValidityState.INVALID_ASN, - RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY)); + RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY, false)); private static final RoaAlertConfigurationData ALERT_SUBSCRIPTION_WEEKLY = new RoaAlertConfigurationData(CA_DATA, new RoaAlertSubscriptionData("weeklyjoe@example.com", Arrays.asList(RouteValidityState.INVALID_ASN, - RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY)); + RouteValidityState.INVALID_LENGTH, RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY, true)); @Mock private ActiveNodeService activeNodeService; @@ -56,7 +56,8 @@ public class RoaAlertBackgroundServiceWeeklyBeanTest { @Before public void setup() { - subject = new RoaAlertBackgroundServiceWeeklyBean(new BackgroundTaskRunner(activeNodeService, new SimpleMeterRegistry()), roaAlertConfigurationViewService, roaAlertChecker); + subject = new RoaAlertBackgroundServiceWeeklyBean(new BackgroundTaskRunner( + activeNodeService, new SimpleMeterRegistry()), roaAlertConfigurationViewService, roaAlertChecker); } @Test diff --git a/src/test/java/net/ripe/rpki/services/impl/background/RoaNotificationServiceTest.java b/src/test/java/net/ripe/rpki/services/impl/background/RoaNotificationServiceTest.java new file mode 100644 index 0000000..58e1683 --- /dev/null +++ b/src/test/java/net/ripe/rpki/services/impl/background/RoaNotificationServiceTest.java @@ -0,0 +1,113 @@ +package net.ripe.rpki.services.impl.background; + +import jakarta.transaction.Transactional; +import net.ripe.ipresource.Asn; +import net.ripe.ipresource.IpRange; +import net.ripe.rpki.commons.validation.roa.RouteValidityState; +import net.ripe.rpki.domain.CertificateAuthorityRepository; +import net.ripe.rpki.domain.CertificationDomainTestCase; +import net.ripe.rpki.domain.HostedCertificateAuthority; +import net.ripe.rpki.domain.alerts.RoaAlertConfiguration; +import net.ripe.rpki.domain.alerts.RoaAlertConfigurationRepository; +import net.ripe.rpki.domain.alerts.RoaAlertFrequency; +import net.ripe.rpki.domain.roa.RoaConfigurationPrefix; +import net.ripe.rpki.server.api.ports.InternalNamePresenter; +import net.ripe.rpki.server.api.security.CertificationUserId; +import net.ripe.rpki.services.impl.email.EmailSender; +import org.junit.Before; +import org.junit.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.test.mock.mockito.MockBean; + +import javax.security.auth.x500.X500Principal; +import java.time.Instant; +import java.util.Collections; +import java.util.List; +import java.util.UUID; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; +import static org.mockito.Mockito.when; + +@Transactional +public class RoaNotificationServiceTest extends CertificationDomainTestCase { + + private static final long HOSTED_CA_ID = 454L; + private static final X500Principal CHILD_CA_NAME = new X500Principal("CN=child"); + + private static final String ADMIN_RIPE_NET = "admin@ripe.net"; + private static final CertificationUserId USER_ID = new CertificationUserId(UUID.randomUUID()); + + @Autowired + private EmailSender emailSender; + + @Autowired + private RoaAlertConfigurationRepository roaAlertConfigurationRepository; + + @Autowired + private CertificateAuthorityRepository certificateAuthorityRepository; + + @MockBean + private InternalNamePresenter internalNamePresenter; + + private RoaNotificationService roaNotificationService; + + private HostedCertificateAuthority childCa; + + @Before + @Override + public void setupTest() { + clearDatabase(); + var parent = createInitialisedProdCaWithRipeResources(); + certificateAuthorityRepository.add(parent); + childCa = new HostedCertificateAuthority(HOSTED_CA_ID, CHILD_CA_NAME, UUID.randomUUID(), parent); + certificateAuthorityRepository.add(childCa); + when(internalNamePresenter.humanizeCaName(CHILD_CA_NAME)).thenReturn("Better name"); + when(internalNamePresenter.humanizeUserPrincipal(USER_ID.getId().toString())).thenReturn(ADMIN_RIPE_NET); + roaNotificationService = new RoaNotificationService(roaAlertConfigurationRepository, emailSender, internalNamePresenter); + } + + @Test + public void testNotifyNobodyBasedOnFlag() { + RoaAlertConfiguration r = new RoaAlertConfiguration(childCa, "bad@ripe.net", List.of(RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY); + r.setNotifyOnRoaChanges(false); + roaAlertConfigurationRepository.add(r); + var messages = roaNotificationService.notifyAboutRoaChanges(childCa, USER_ID, Collections.emptyList(), Collections.emptyList()); + assertEquals(0, messages.size()); + } + + @Test + public void testNoNotifyIfNothingChanges() { + var email = "bad@ripe.net"; + RoaAlertConfiguration r = new RoaAlertConfiguration(childCa, email, List.of(RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY); + r.setNotifyOnRoaChanges(true); + roaAlertConfigurationRepository.add(r); + var messages = roaNotificationService.notifyAboutRoaChanges(childCa, USER_ID, Collections.emptyList(), Collections.emptyList()); + assertEquals(0, messages.size()); + } + + @Test + public void testNotifyRoas() { + var email = "bad@ripe.net"; + RoaAlertConfiguration r = new RoaAlertConfiguration(childCa, email, List.of(RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY); + r.setNotifyOnRoaChanges(true); + roaAlertConfigurationRepository.add(r); + + var now = Instant.now(); + var roa1 = new RoaConfigurationPrefix(Asn.parse("AS64396"), IpRange.parse("192.0.2.0/24"), null, now); + var roa2 = new RoaConfigurationPrefix(Asn.parse("AS64397"), IpRange.parse("198.51.100.0/24"), 32, now); + var roa3 = new RoaConfigurationPrefix(Asn.parse("AS123"), IpRange.parse("fd00:550:ffff:ffff:ffff:ffff:ffff:ffff/128"), 128, now); + + var messages = roaNotificationService.notifyAboutRoaChanges(childCa, USER_ID, List.of(roa1, roa3), List.of(roa2)); + assertEquals(1, messages.size()); + + var message = messages.iterator().next(); + assertTrue(message.body().contains("123 fd00:550:ffff:ffff:ffff:ffff:ffff:ffff/128 128 A")); + assertTrue(message.body().contains("64396 192.0.2.0/24 24 A")); + assertTrue(message.body().contains("64397 198.51.100.0/24 32 D")); + assertTrue(message.body().contains( + "This is an automated email to inform you that user admin@ripe.net made changes\n" + + "to one or more ROAs for your organisation Better name.")); + } + +} \ No newline at end of file diff --git a/src/test/java/net/ripe/rpki/services/impl/email/EmailSenderBeanTest.java b/src/test/java/net/ripe/rpki/services/impl/email/EmailSenderBeanTest.java index 1e71d30..e115d10 100644 --- a/src/test/java/net/ripe/rpki/services/impl/email/EmailSenderBeanTest.java +++ b/src/test/java/net/ripe/rpki/services/impl/email/EmailSenderBeanTest.java @@ -99,7 +99,7 @@ private Map variablesFor(EmailSender.EmailTemplates template) { ); var configuration = new RoaAlertConfigurationData( ca, - new RoaAlertSubscriptionData("user@example.org", List.of(RouteValidityState.values()), RoaAlertFrequency.DAILY) + new RoaAlertSubscriptionData("user@example.org", List.of(RouteValidityState.values()), RoaAlertFrequency.DAILY, false) ); return Map.of( "humanizedCaName", RandomStringUtils.randomAlphabetic(12), diff --git a/src/test/java/net/ripe/rpki/services/impl/email/EmailTemplatesTest.java b/src/test/java/net/ripe/rpki/services/impl/email/EmailTemplatesTest.java index 5606885..a57116a 100644 --- a/src/test/java/net/ripe/rpki/services/impl/email/EmailTemplatesTest.java +++ b/src/test/java/net/ripe/rpki/services/impl/email/EmailTemplatesTest.java @@ -18,6 +18,7 @@ public void setUp() { templateEngine = new TemplateEngine(); templateEngine.addTemplateResolver(EmailSenderBean.textTemplateResolver()); } + @Test public void testTemplateForSyntacticValdidity() { // Add required variables (i.e. those that are dereferenced) here diff --git a/src/test/java/net/ripe/rpki/services/impl/handlers/SubscribeToRoaAlertCommandHandlerTest.java b/src/test/java/net/ripe/rpki/services/impl/handlers/SubscribeToRoaAlertCommandHandlerTest.java index 322fa15..5c13fcb 100644 --- a/src/test/java/net/ripe/rpki/services/impl/handlers/SubscribeToRoaAlertCommandHandlerTest.java +++ b/src/test/java/net/ripe/rpki/services/impl/handlers/SubscribeToRoaAlertCommandHandlerTest.java @@ -17,7 +17,10 @@ import org.mockito.Mock; import org.mockito.junit.MockitoJUnitRunner; -import java.util.*; +import java.util.Collection; +import java.util.EnumSet; +import java.util.List; +import java.util.Map; import static org.junit.Assert.*; import static org.mockito.Mockito.*; @@ -45,6 +48,8 @@ public class SubscribeToRoaAlertCommandHandlerTest { private ArgumentCaptor alertCapture; + private ArgumentCaptor> parametersCapture; + private SubscribeToRoaAlertCommandHandler subject; @Before @@ -52,6 +57,7 @@ public void setUp() { certificateAuthority = TestObjects.createInitialisedProdCaWithRipeResources(); emailCapture = ArgumentCaptor.forClass(String.class); alertCapture = ArgumentCaptor.forClass(RoaAlertConfiguration.class); + parametersCapture = ArgumentCaptor.captor(); subject = new SubscribeToRoaAlertCommandHandler(certificateAuthorityRepository, repository, emailSender); } @@ -70,13 +76,68 @@ public void shouldCreateRoaAlertSubscriptionAndSendConfirmationEmail() { subject.handle(new SubscribeToRoaAlertCommand(TEST_VERSIONED_CA_ID, email, EnumSet.of(RouteValidityState.INVALID_ASN, RouteValidityState.INVALID_LENGTH, - RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY)); + RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY, true)); verify(repository).add(alertCapture.capture()); verify(emailSender).sendEmail(emailCapture.capture(), isA(String.class), - eq(EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_WEEKLY), isA(Map.class), isA(String.class)); + eq(EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_WEEKLY), + parametersCapture.capture(), + isA(String.class)); assertEquals(RoaAlertFrequency.WEEKLY, alertCapture.getValue().getFrequency()); + assertTrue(alertCapture.getValue().isNotifyOnRoaChanges()); + assertEquals(email, emailCapture.getValue()); + assertEquals("", parametersCapture.getValue().get("roaChangeSubscription")); + } + + @Test + public void shouldCreateRoaAlertSubscriptionAndSendConfirmationEmailWithROAChangesUnsubscribed() { + final String email = "joe@example.com"; + final String email2 = "festeban@ripe.net"; + when(certificateAuthorityRepository.findManagedCa(TEST_CA_ID)).thenReturn(certificateAuthority); + + RoaAlertConfiguration configuration = new RoaAlertConfiguration(certificateAuthority, email2, + EnumSet.of(RouteValidityState.INVALID_ASN), RoaAlertFrequency.DAILY); + configuration.setNotifyOnRoaChanges(true); + + when(repository.findByCertificateAuthorityIdOrNull(TEST_CA_ID)).thenReturn(configuration); + + subject.handle(new SubscribeToRoaAlertCommand(TEST_VERSIONED_CA_ID, email, + EnumSet.of(RouteValidityState.INVALID_ASN, RouteValidityState.INVALID_LENGTH, + RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY, false)); + + verify(emailSender).sendEmail(emailCapture.capture(), isA(String.class), + eq(EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_WEEKLY), + parametersCapture.capture(), + isA(String.class)); + + assertEquals(email, emailCapture.getValue()); + assertEquals("", parametersCapture.getValue().get("roaChangeSubscription")); + } + + @Test + public void shouldCreateRoaAlertSubscriptionAndSendConfirmationEmailWithROAChangesSubscribed() { + final String email = "joe@example.com"; + final String email2 = "festeban@ripe.net"; + when(certificateAuthorityRepository.findManagedCa(TEST_CA_ID)).thenReturn(certificateAuthority); + + RoaAlertConfiguration configuration = new RoaAlertConfiguration(certificateAuthority, email2, + EnumSet.of(RouteValidityState.INVALID_ASN), RoaAlertFrequency.DAILY); + configuration.setNotifyOnRoaChanges(false); + + when(repository.findByCertificateAuthorityIdOrNull(TEST_CA_ID)).thenReturn(configuration); + + subject.handle(new SubscribeToRoaAlertCommand(TEST_VERSIONED_CA_ID, email, + EnumSet.of(RouteValidityState.INVALID_ASN, RouteValidityState.INVALID_LENGTH, + RouteValidityState.UNKNOWN), RoaAlertFrequency.WEEKLY, true)); + + verify(emailSender).sendEmail(emailCapture.capture(), isA(String.class), + eq(EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_WEEKLY), + parametersCapture.capture(), + isA(String.class)); + assertEquals(email, emailCapture.getValue()); + assertEquals("Also you are subscribed to alerts about ROA changes.", + parametersCapture.getValue().get("roaChangeSubscription")); } @SuppressWarnings("unchecked") @@ -88,7 +149,6 @@ public void shouldUpdateRoaAlertSubscriptionAndNotSendConfirmationEmail() { RoaAlertConfiguration configuration = new RoaAlertConfiguration(certificateAuthority, email, oldValidityStates, RoaAlertFrequency.DAILY); -// when(certificateAuthorityRepository.findHostedCa(TEST_CA_ID)).thenReturn(certificateAuthority); when(repository.findByCertificateAuthorityIdOrNull(TEST_CA_ID)).thenReturn(configuration); subject.handle(new SubscribeToRoaAlertCommand(TEST_VERSIONED_CA_ID, email, newValidityStates)); @@ -108,7 +168,8 @@ public void shouldUpdateRoaAlertSubscriptionAndSendConfirmationEmails() { when(repository.findByCertificateAuthorityIdOrNull(TEST_CA_ID)).thenReturn(configuration); - subject.handle(new SubscribeToRoaAlertCommand(TEST_VERSIONED_CA_ID, newEmail, EnumSet.of(RouteValidityState.INVALID_ASN, RouteValidityState.INVALID_LENGTH))); + subject.handle(new SubscribeToRoaAlertCommand(TEST_VERSIONED_CA_ID, newEmail, + EnumSet.of(RouteValidityState.INVALID_ASN, RouteValidityState.INVALID_LENGTH))); verify(emailSender, times(1)).sendEmail(eq(newEmail), eq(EmailSender.EmailTemplates.ROA_ALERT_SUBSCRIBE_CONFIRMATION_DAILY.templateSubject), diff --git a/src/test/java/net/ripe/rpki/services/impl/handlers/UnsubscribeFromRoaAlertCommandHandlerTest.java b/src/test/java/net/ripe/rpki/services/impl/handlers/UnsubscribeFromRoaAlertCommandHandlerTest.java index 9480d59..9c12243 100644 --- a/src/test/java/net/ripe/rpki/services/impl/handlers/UnsubscribeFromRoaAlertCommandHandlerTest.java +++ b/src/test/java/net/ripe/rpki/services/impl/handlers/UnsubscribeFromRoaAlertCommandHandlerTest.java @@ -68,7 +68,7 @@ public void shouldUpdateRoaSpecificationAndSendConfirmationEmail() { RouteValidityState.UNKNOWN), RoaAlertFrequency.DAILY); when(repository.findByCertificateAuthorityIdOrNull(TEST_CA_ID)).thenReturn(configuration); - subject.handle(new UnsubscribeFromRoaAlertCommand(TEST_VERSIONED_CA_ID, email)); + subject.handle(new UnsubscribeFromRoaAlertCommand(TEST_VERSIONED_CA_ID, email, false)); verify(emailSender).sendEmail(emailCapture.capture(), eq(EmailSender.EmailTemplates.ROA_ALERT_UNSUBSCRIBE.templateSubject), diff --git a/src/test/java/net/ripe/rpki/services/impl/handlers/UpdateRoaConfigurationCommandHandlerTest.java b/src/test/java/net/ripe/rpki/services/impl/handlers/UpdateRoaConfigurationCommandHandlerTest.java index 4d71766..5d8001a 100644 --- a/src/test/java/net/ripe/rpki/services/impl/handlers/UpdateRoaConfigurationCommandHandlerTest.java +++ b/src/test/java/net/ripe/rpki/services/impl/handlers/UpdateRoaConfigurationCommandHandlerTest.java @@ -14,6 +14,7 @@ import net.ripe.rpki.server.api.services.command.NotHolderOfResourcesException; import net.ripe.rpki.server.api.services.command.PrivateAsnsUsedException; import net.ripe.rpki.services.impl.background.RoaMetricsService; +import net.ripe.rpki.services.impl.background.RoaNotificationService; import org.junit.Before; import org.junit.Test; import org.springframework.beans.factory.annotation.Autowired; @@ -22,11 +23,10 @@ import java.util.Collections; import java.util.Optional; +import static net.ripe.rpki.server.api.security.RunAsUser.ADMIN; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatThrownBy; -import static org.mockito.Mockito.mock; -import static org.mockito.Mockito.verify; -import static org.mockito.Mockito.verifyNoMoreInteractions; +import static org.mockito.Mockito.*; @Transactional @Commit // don't rollback, we want all constrains to be checked @@ -39,7 +39,6 @@ public class UpdateRoaConfigurationCommandHandlerTest extends CertificationDomai private static final IpRange PREFIX1 = IpRange.parse("10.0.0.0/8"); private static final IpRange PREFIX2 = IpRange.parse("172.16.0.0/12"); - private static final IpRange PREFIX3 = IpRange.parse("192.168.0.0/16"); private ManagedCertificateAuthority certificateAuthority; @@ -55,8 +54,9 @@ public void setUp() { clearDatabase(); certificateAuthority = createInitialisedProdCaWithRipeResources(); roaMetricsService = mock(RoaMetricsService.class); + var roaNotificationService = mock(RoaNotificationService.class); subject = new UpdateRoaConfigurationCommandHandler(certificateAuthorityRepository, - roaConfigurationRepository, PRIVATE_ASNS, roaMetricsService); + roaConfigurationRepository, PRIVATE_ASNS, roaMetricsService, roaNotificationService); } @Test @@ -66,7 +66,7 @@ public void should_add_new_additions() { certificateAuthority.getVersionedId(), Optional.of(configuration.convertToData().entityTag()), Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)), - Collections.emptyList())); + Collections.emptyList(), ADMIN.getCertificationUserId())); var config = roaConfigurationRepository.getOrCreateByCertificateAuthority(certificateAuthority); assertThat(config.getPrefixes()).hasSize(1); @@ -85,8 +85,8 @@ public void should_reject_if_etag_does_not_match_current_configuration() { certificateAuthority.getVersionedId(), Optional.of("bad-etag"), Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)), - Collections.emptyList() - ); + Collections.emptyList(), + ADMIN.getCertificationUserId()); assertThatThrownBy(() -> subject.handle(command)).isInstanceOf(EntityTagDoesNotMatchException.class); } @@ -97,7 +97,8 @@ public void should_reject_new_additions_of_private_ASN() { certificateAuthority.getVersionedId(), Optional.empty(), Collections.singletonList(new RoaConfigurationPrefixData(PRIVATE_ASN, PREFIX1, null)), - Collections.emptyList())); + Collections.emptyList(), + ADMIN.getCertificationUserId())); verifyNoMoreInteractions(roaMetricsService); } @@ -107,8 +108,8 @@ public void should_reject_uncertified_prefixes() { certificateAuthority.getVersionedId(), Optional.empty(), Collections.singletonList(new RoaConfigurationPrefixData(ASN, IpRange.parse("1.0.0.0/8"), null)), - Collections.emptyList() - ); + Collections.emptyList(), + ADMIN.getCertificationUserId()); assertThatThrownBy(() -> subject.handle(command)).isInstanceOf(NotHolderOfResourcesException.class); } @@ -121,7 +122,7 @@ public void should_remove_deletions() { certificateAuthority.getVersionedId(), Optional.empty(), Collections.emptyList(), - Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)))); + Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)), ADMIN.getCertificationUserId())); var config = roaConfigurationRepository.getOrCreateByCertificateAuthority(certificateAuthority); assertThat(config.getPrefixes()).isEmpty(); @@ -138,7 +139,7 @@ public void should_notify_roa_entity_service_on_configuration_change() { certificateAuthority.getVersionedId(), Optional.empty(), Collections.emptyList(), - Collections.emptyList())); + Collections.emptyList(), ADMIN.getCertificationUserId())); assertThat(certificateAuthority.isConfigurationCheckNeeded()).isTrue(); } @@ -150,13 +151,13 @@ public void should_replace_roa_prefix() { certificateAuthority.getVersionedId(), Optional.of(configuration.convertToData().entityTag()), Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)), - Collections.emptyList())); + Collections.emptyList(), ADMIN.getCertificationUserId())); subject.handle(new UpdateRoaConfigurationCommand( certificateAuthority.getVersionedId(), Optional.of(roaConfigurationRepository.getOrCreateByCertificateAuthority(certificateAuthority).convertToData().entityTag()), Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX2, null)), - Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)))); + Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)), ADMIN.getCertificationUserId())); var config = roaConfigurationRepository.getOrCreateByCertificateAuthority(certificateAuthority); assertThat(config.getPrefixes()).hasSize(1); @@ -174,13 +175,13 @@ public void should_replace_roa_max_len() { certificateAuthority.getVersionedId(), Optional.of(configuration.convertToData().entityTag()), Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)), - Collections.emptyList())); + Collections.emptyList(), ADMIN.getCertificationUserId())); subject.handle(new UpdateRoaConfigurationCommand( certificateAuthority.getVersionedId(), Optional.of(roaConfigurationRepository.getOrCreateByCertificateAuthority(certificateAuthority).convertToData().entityTag()), Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, 17)), - Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)))); + Collections.singletonList(new RoaConfigurationPrefixData(ASN, PREFIX1, null)), ADMIN.getCertificationUserId())); var config = roaConfigurationRepository.getOrCreateByCertificateAuthority(certificateAuthority); assertThat(config.getPrefixes()).hasSize(1); diff --git a/src/test/java/net/ripe/rpki/services/impl/jpa/JpaResourceCertificateRepositoryTest.java b/src/test/java/net/ripe/rpki/services/impl/jpa/JpaResourceCertificateRepositoryTest.java index 54f33af..ae4596f 100644 --- a/src/test/java/net/ripe/rpki/services/impl/jpa/JpaResourceCertificateRepositoryTest.java +++ b/src/test/java/net/ripe/rpki/services/impl/jpa/JpaResourceCertificateRepositoryTest.java @@ -1,5 +1,7 @@ package net.ripe.rpki.services.impl.jpa; +import jakarta.inject.Inject; +import jakarta.transaction.Transactional; import net.ripe.ipresource.Asn; import net.ripe.ipresource.ImmutableResourceSet; import net.ripe.ipresource.IpRange; @@ -17,9 +19,7 @@ import org.junit.Before; import org.junit.Test; -import jakarta.inject.Inject; import javax.security.auth.x500.X500Principal; -import jakarta.transaction.Transactional; import java.util.Collections; import java.util.Map; import java.util.Optional; @@ -27,6 +27,7 @@ import static net.ripe.rpki.commons.crypto.util.KeyPairFactoryTest.TEST_KEY_PAIR; import static net.ripe.rpki.domain.TestObjects.PRODUCTION_CA_NAME; import static net.ripe.rpki.domain.TestObjects.PRODUCTION_CA_RESOURCES; +import static net.ripe.rpki.server.api.security.RunAsUser.ADMIN; import static org.assertj.core.api.Assertions.assertThat; public class JpaResourceCertificateRepositoryTest extends CertificationDomainTestCase { @@ -63,7 +64,7 @@ public void outgoing_resource_certificate_should_change_to_expired_after_not_val ca.getVersionedId(), Optional.empty(), Collections.singleton(new RoaConfigurationPrefixData(Asn.parse("AS3333"), IpRange.parse("10.0.0.0/8"), null)), - Collections.emptyList())); + Collections.emptyList(), ADMIN.getCertificationUserId())); commandService.execute(new IssueUpdatedManifestAndCrlCommand(ca.getVersionedId())); // CA certificate, EE certificate for ROA, EE certificate for manifest