AzSKPreview.ADO

1.24.2

Framework/Abstracts/ADOSVTBase.ps1

class ADOSVTBase: SVTBase {

    hidden [ControlStateExtension] $ControlStateExt;
    hidden [AzSKSettings] $AzSKSettings;    
    # below variable will be used by SVT's and overriden for each individual resource.
    hidden [bool] $isResourceActive = $true;
    # below variable will contains the inactivity period for resources in days.
    hidden [int] $InactiveFromDays = -1;
    # below variable will contain resources approval & checks settings data.
    static [System.Collections.Generic.List[ResourceApprovalCheck]] $ResourceApprovalChecks = @();
    ADOSVTBase() {

    }

    ADOSVTBase([string] $organizationName):
    Base($organizationName) {
        $this.CreateInstance();
    }
    ADOSVTBase([string] $organizationName, [SVTResource] $svtResource):
    Base($organizationName) {
        $this.CreateInstance($svtResource);
    }
    #Create instance for organization scan
    hidden [void] CreateInstance() {
        [Helpers]::AbstractClass($this, [SVTBase]);
        Write-Host -ForegroundColor Yellow "No mapping!? Do we use this .ctor?"
        #$this.LoadSvtConfig([SVTMapping]::OrganizationMapping.JsonFileName);
        $this.ResourceId = $this.OrganizationContext.Scope;
    }

    #Add PreviewBaselineControls
    hidden [bool] CheckBaselineControl($controlId) {
        if (($null -ne $this.ControlSettings) -and [Helpers]::CheckMember($this.ControlSettings, "BaselineControls.ResourceTypeControlIdMappingList")) {
            $baselineControl = $this.ControlSettings.BaselineControls.ResourceTypeControlIdMappingList | Where-Object { $_.ControlIds -contains $controlId }
            if (($baselineControl | Measure-Object).Count -gt 0 ) {
                return $true
            }
        }
        return $false
    }
    hidden [bool] CheckPreviewBaselineControl($controlId) {
        if (($null -ne $this.ControlSettings) -and [Helpers]::CheckMember($this.ControlSettings, "PreviewBaselineControls.ResourceTypeControlIdMappingList")) {
            $PreviewBaselineControls = $this.ControlSettings.PreviewBaselineControls.ResourceTypeControlIdMappingList | Where-Object { $_.ControlIds -contains $controlId }
            if (($PreviewBaselineControls | Measure-Object).Count -gt 0 ) {
                return $true
            }
        }
        return $false
    }

    hidden [void] UpdateControlStates([SVTEventContext[]] $ControlResults) {
        if ($null -ne $this.ControlStateExt -and $this.ControlStateExt.HasControlStateWriteAccessPermissions() -and ($ControlResults | Measure-Object).Count -gt 0 -and ($this.ResourceState | Measure-Object).Count -gt 0) {
            $effectiveResourceStates = @();
            if (($this.DirtyResourceStates | Measure-Object).Count -gt 0) {
                $this.ResourceState | ForEach-Object {
                    $controlState = $_;
                    if (($this.DirtyResourceStates | Where-Object { $_.InternalId -eq $controlState.InternalId -and $_.ChildResourceName -eq $controlState.ChildResourceName } | Measure-Object).Count -eq 0) {
                        $effectiveResourceStates += $controlState;
                    }
                }
            }
            else {
                #If no dirty states found then no action needed.
                return;
            }

            #get the uniqueid from the first control result. Here we can take first as it would come here for each resource.
            $id = $ControlResults[0].GetUniqueId();
            $resourceType = $ControlResults[0].FeatureName
            $resourceName = $ControlResults[0].ResourceContext.ResourceName

            $this.ControlStateExt.SetControlState($id, $effectiveResourceStates, $true, $resourceType, $resourceName, $ControlResults[0].ResourceContext.ResourceGroupName)
        }
    }

    #isRescan parameter is added to check if method is called from rescan. state data is fetching for rescan
    hidden [ControlState[]] GetResourceState([bool] $isRescan = $false) {
        if ($null -eq $this.ResourceState) {
            $this.ResourceState = @();
            if ($this.ControlStateExt -and $this.ControlStateExt.HasControlStateReadAccessPermissions()) {
                $resourceType = "";
                if ($this.ResourceContext) {
                    $resourceType = $this.ResourceContext.ResourceTypeName
                }
                #Fetch control state for organization only if project is configured for org spesific control attestation (Check for Organization only, for other resource go inside without project check).

                if($resourceType -ne "Organization" -or $this.ControlStateExt.GetProject())
                {
                    $resourceStates = $this.ControlStateExt.GetControlState($this.ResourceId, $resourceType, $this.ResourceContext.ResourceName, $this.ResourceContext.ResourceGroupName, $isRescan)
                    if ($null -ne $resourceStates) {
                        $this.ResourceState += $resourceStates

                    }
                }
            }
        }

        return $this.ResourceState;
    }

    hidden [void] PostProcessData([SVTEventContext] $eventContext) {
        $tempHasRequiredAccess = $true;
        $controlState = @();
        $controlStateValue = @();
        try {
            $resourceStates = $this.GetResourceState($false)
            if (!$this.AzSKSettings)
            {
                $this.AzSKSettings = [ConfigurationManager]::GetAzSKSettings();
            }
            $enableOrgControlAttestation = $this.AzSKSettings.EnableOrgControlAttestation

            if (($resourceStates | Measure-Object).Count -ne 0) {
                $controlStateValue += $resourceStates | Where-Object { $_.InternalId -eq $eventContext.ControlItem.Id };
                $controlStateValue | ForEach-Object {
                    $currentControlStateValue = $_;
                    if ($null -ne $currentControlStateValue) {
                        if ($this.IsStateActive($eventContext, $currentControlStateValue)) {
                            $controlState += $currentControlStateValue;
                        }
                        else {
                            #add to the dirty state list so that it can be removed later
                            $this.DirtyResourceStates += $currentControlStateValue;
                        }
                    }
                }
            }
            # If Project name is not configured in ext storage & policy project parameter is not used or attestation repo is not present in policy project,
            # then 'IsOrgAttestationProjectFound' will be false so that HasRequiredAccess for org controls can be set as false
            elseif (($eventContext.FeatureName -eq "Organization" -and [ControlStateExtension]::IsOrgAttestationProjectFound -eq $false) -and ($enableOrgControlAttestation -eq $true)){
                $tempHasRequiredAccess = $false;
            }
            elseif ($null -eq $resourceStates) {
                $tempHasRequiredAccess = $false;
            }
        }
        catch {
            $this.EvaluationError($_);
        }

        $eventContext.ControlResults |
        ForEach-Object {
            try {
                $currentItem = $_;
                # Copy the current result to Actual Result field
                $currentItem.ActualVerificationResult = $currentItem.VerificationResult;

                # override the default value with current status
                $currentItem.IsResourceActive = $this.IsResourceActive;
                $currentItem.InactiveFromDays = $this.InactiveFromDays;
                #Logic to append the control result with the permissions metadata
                [SessionContext] $sc = $currentItem.CurrentSessionContext;
                $sc.Permissions.HasAttestationWritePermissions = $this.ControlStateExt.HasControlStateWriteAccessPermissions();
                $sc.Permissions.HasAttestationReadPermissions = $this.ControlStateExt.HasControlStateReadAccessPermissions();
                # marking the required access as false if there was any error reading the attestation data
                $sc.Permissions.HasRequiredAccess = $sc.Permissions.HasRequiredAccess -and $tempHasRequiredAccess;

                # Disable the fix control feature
                if (-not $this.GenerateFixScript) {
                    $currentItem.EnableFixControl = $false;
                }

                if ($currentItem.StateManagement.CurrentStateData -and $currentItem.StateManagement.CurrentStateData.DataObject -and $eventContext.ControlItem.DataObjectProperties) {
                    $currentItem.StateManagement.CurrentStateData.DataObject = [Helpers]::SelectMembers($currentItem.StateManagement.CurrentStateData.DataObject, $eventContext.ControlItem.DataObjectProperties);
                }

                if ($controlState.Count -ne 0) {
                    # Process the state if its available
                    $childResourceState = $controlState | Where-Object { $_.ChildResourceName -eq $currentItem.ChildResourceName } | Select-Object -First 1;
                    if ($childResourceState) {
                        $validatePreviousAttestation = $true
                        # if EnforceApprovedException is true and controls is not attested with exception id, based on configuration, invalidate the previous attestation
                        if ([Helpers]::CheckMember($this.ControlSettings, "EnforceApprovedException") -and $this.ControlSettings.EnforceApprovedException -eq $true -and (-not [Helpers]::CheckMember($childResourceState.state, "ApprovedExceptionID") -or [string]::IsNullOrWhiteSpace($childResourceState.state.ApprovedExceptionID))) {
                            $attestationExpiryDays = ""
                            # check if InvalidatePreviousAttestations is set to true to invalidate previous attestation
                            if ([Helpers]::CheckMember($this.ControlSettings, "ApprovedExceptionSettings") -and $this.ControlSettings.ApprovedExceptionSettings.InvalidatePreviousAttestations -eq $true) {
                                $approvedExceptionsControlList = $this.ControlSettings.ApprovedExceptionSettings.ControlsList
                                # verify if the control attested is in the list of approved exception enabled controls
                                if ($approvedExceptionsControlList -contains $controlState.ControlId) {
                                    $validatePreviousAttestation = $false
                                    Write-Host "Per your org policy, this control now requires an associated approved exception id. Previous attestation has been invalidated." -ForegroundColor Yellow
                                    #add to the dirty state list so that it can be removed later
                                    $this.DirtyResourceStates += $childResourceState
                                }
                            }
                        }
                        # Skip passed ones from State Management
                        # Skip the validation if invalidatePreviousAttestations is enabled to true in control settings
                        if ($currentItem.ActualVerificationResult -ne [VerificationResult]::Passed) {
                            #compare the states
                            if (($childResourceState.ActualVerificationResult -eq $currentItem.ActualVerificationResult) -and $childResourceState.State) {

                                $currentItem.StateManagement.AttestedStateData = $childResourceState.State;

                                # Compare dataobject property of State
                                if ($null -ne $childResourceState.State.DataObject) {
                                    if ($currentItem.StateManagement.CurrentStateData -and $null -ne $currentItem.StateManagement.CurrentStateData.DataObject) {
                                        $currentStateDataObject = [JsonHelper]::ConvertToJsonCustom($currentItem.StateManagement.CurrentStateData.DataObject) | ConvertFrom-Json

                                        try {
                                            # Objects match, change result based on attestation status
                                            if ($eventContext.ControlItem.AttestComparisionType -and $eventContext.ControlItem.AttestComparisionType -eq [ComparisionType]::NumLesserOrEqual) {
                                                $dataObjMatched = $false
                                                if ([Helpers]::CompareObject($childResourceState.State.DataObject, $currentStateDataObject, $true, $eventContext.ControlItem.AttestComparisionType)) {
                                                    $dataObjMatched = $true
                                                }
                                                if (-not $dataObjMatched)
                                                {
                                                    #In Linux env base24 encoding is different from that in Windows. Therefore doing a comparison of decoded data object as fallback
                                                    $decodedAttestedDataObj = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($childResourceState.State.DataObject))  | ConvertFrom-Json
                                                    $decodedCurrentDataObj = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($currentStateDataObject))  | ConvertFrom-Json
                                                    if ([Helpers]::CompareObject($decodedAttestedDataObj, $decodedCurrentDataObj, $true))
                                                    {
                                                        $dataObjMatched = $true
                                                    }

                                                    # Don't fail attestation if current state data object is a subset of attested state data object
                                                    if (($decodedCurrentDataObj | Measure-Object).Count -lt ($decodedAttestedDataObj | Measure-Object).Count) {
                                                        if ([Helpers]::CompareObject($decodedAttestedDataObj, $decodedCurrentDataObj, $false, $eventContext.ControlItem.AttestComparisionType))
                                                        {
                                                            $dataObjMatched = $true
                                                        }
                                                    }
                                                }
                                                if ($dataObjMatched)
                                                {
                                                    $this.ModifyControlResult($currentItem, $childResourceState);
                                                }

                                            }
                                            else {
                                                $dataObjMatched = $false
                                                if ([Helpers]::CompareObject($childResourceState.State.DataObject, $currentStateDataObject, $true)) {
                                                    #$this.ModifyControlResult($currentItem, $childResourceState);
                                                    $dataObjMatched = $true
                                                }
                                                if (-not $dataObjMatched)
                                                {
                                                    #In Linux env base24 encoding is different from that in Windows. Therefore doing a comparison of decoded data object as fallback
                                                    $decodedAttestedDataObj = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($childResourceState.State.DataObject))  | ConvertFrom-Json
                                                    $decodedCurrentDataObj = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($currentStateDataObject))  | ConvertFrom-Json
                                                    if ([Helpers]::CompareObject($decodedAttestedDataObj, $decodedCurrentDataObj, $true) -and [Helpers]::CompareObject($decodedCurrentDataObj, $decodedAttestedDataObj, $true))
                                                    {
                                                        $dataObjMatched = $true
                                                    }
                                                    
                                                    # Don't fail attestation if current state data object is a subset of attested state data object
                                                    if (($decodedCurrentDataObj | Measure-Object).Count -lt ($decodedAttestedDataObj | Measure-Object).Count) {
                                                        if ([Helpers]::CompareObject($decodedCurrentDataObj, $decodedAttestedDataObj, $false))
                                                        {
                                                            $dataObjMatched = $true
                                                        }
                                                    }
                                                    elseif ($decodedCurrentDataObj.GetType() -eq [Int] -and $decodedAttestedDataObj.GetType() -eq [Int]) {
                                                        if ($decodedCurrentDataObj -lt $decodedAttestedDataObj) {
                                                            $dataObjMatched = $true
                                                        }
                                                    }
                                                }
                                                if ($dataObjMatched)
                                                {
                                                    $this.ModifyControlResult($currentItem, $childResourceState);
                                                }
                                            }
                                        }
                                        catch {
                                            $this.EvaluationError($_);
                                        }
                                    }
                                }
                                else {
                                    if ($currentItem.StateManagement.CurrentStateData) {
                                        if ($null -eq $currentItem.StateManagement.CurrentStateData.DataObject) {
                                            # No object is persisted, change result based on attestation status
                                            $this.ModifyControlResult($currentItem, $childResourceState);
                                        }
                                    }
                                    else {
                                        # No object is persisted, change result based on attestation status
                                        $this.ModifyControlResult($currentItem, $childResourceState);
                                    }
                                }
                            }
                        }
                        else {
                            #add to the dirty state list so that it can be removed later
                            $this.DirtyResourceStates += $childResourceState
                        }
                    }
                }
            }
            catch {
                $this.EvaluationError($_);
            }
        };
    }

    # State Machine implementation of modifying verification result
    hidden [void] ModifyControlResult([ControlResult] $controlResult, [ControlState] $controlState) {
        # No action required if Attestation status is None OR verification result is Passed
        if ($controlState.AttestationStatus -ne [AttestationStatus]::None -or $controlResult.VerificationResult -ne [VerificationResult]::Passed) {
            $controlResult.AttestationStatus = $controlState.AttestationStatus;
            $controlResult.VerificationResult = [Helpers]::EvaluateVerificationResult($controlResult.VerificationResult, $controlState.AttestationStatus);
        }
    }

    #Function to validate attestation data expiry validation
    hidden [bool] IsStateActive([SVTEventContext] $eventcontext, [ControlState] $controlState) {
        try {
            $expiryIndays = $this.CalculateExpirationInDays([SVTEventContext] $eventcontext, [ControlState] $controlState);
            #Validate if expiry period is passed
            #Added a condition so as to expire attested controls that were in 'Error' state.
            if (($expiryIndays -ne -1 -and $controlState.State.AttestedDate.AddDays($expiryIndays) -lt [DateTime]::UtcNow) -or ($controlState.ActualVerificationResult -eq [VerificationResult]::Error)) {
                return $false
            }
            else {
                $controlState.State.ExpiryDate = ($controlState.State.AttestedDate.AddDays($expiryIndays)).ToString("MM/dd/yyyy");
                return $true
            }
        }
        catch {
            #if any exception occurs while getting/validating expiry period, return true.
            $this.EvaluationError($_);
            return $true
        }
    }

    hidden [int] CalculateExpirationInDays([SVTEventContext] $eventcontext, [ControlState] $controlState) {
        try {
            #For exempt controls, either the no. of days for expiry were provided at the time of attestation or a default of 6 motnhs was already considered,
            #therefore skipping this flow and calculating days directly using the expiry date already saved.
            $isApprovedExceptionEnforced = $false
            $approvedExceptionControlsList = @();
            if ([Helpers]::CheckMember($this.ControlSettings, "EnforceApprovedException") -and ($this.ControlSettings.EnforceApprovedException -eq $true)) {
                if ([Helpers]::CheckMember($this.ControlSettings, "ApprovedExceptionSettings") -and (($this.ControlSettings.ApprovedExceptionSettings.ControlsList | Measure-Object).Count -gt 0)) {
                    $isApprovedExceptionEnforced = $true
                    $approvedExceptionControlsList = $this.ControlSettings.ApprovedExceptionSettings.ControlsList
                }
            }
            
            if ($controlState.AttestationStatus -ne [AttestationStatus]::ApprovedException) {
                #Get controls expiry period. Default value is zero
                $controlAttestationExpiry = $eventcontext.controlItem.AttestationExpiryPeriodInDays
                $controlSeverity = $eventcontext.controlItem.ControlSeverity
                $controlSeverityExpiryPeriod = 0
                $defaultAttestationExpiryInDays = [Constants]::DefaultControlExpiryInDays;
                $expiryInDays = -1;

                if (($eventcontext.ControlResults | Measure-Object).Count -gt 0) {
                    $isControlInGrace = $eventcontext.ControlResults.IsControlInGrace;
                }
                else {
                    $isControlInGrace = $true;
                }
                if ([Helpers]::CheckMember($this.ControlSettings, "AttestationExpiryPeriodInDays") `
                        -and [Helpers]::CheckMember($this.ControlSettings.AttestationExpiryPeriodInDays, "Default") `
                        -and $this.ControlSettings.AttestationExpiryPeriodInDays.Default -gt 0) {
                    $defaultAttestationExpiryInDays = $this.ControlSettings.AttestationExpiryPeriodInDays.Default
                }
                #Expiry in the case of WillFixLater or StateConfirmed/Recurring Attestation state will be based on Control Severity.
                # Checking if the resource id is present in extended expiry list of control settings
                if ($controlState.AttestationStatus -eq [AttestationStatus]::NotAnIssue -or $controlState.AttestationStatus -eq [AttestationStatus]::NotApplicable) {
                    $expiryInDays = $defaultAttestationExpiryInDays;
                }
                else {
                    # Expire WillFixLater if GracePeriod has expired
                    if (-not($isControlInGrace) -and $controlState.AttestationStatus -eq [AttestationStatus]::WillFixLater) {
                        $expiryInDays = 0;
                    }
                    else {
                        if ($controlAttestationExpiry -ne 0) {
                            $expiryInDays = $controlAttestationExpiry
                        }
                        elseif ([Helpers]::CheckMember($this.ControlSettings, "AttestationExpiryPeriodInDays")) {
                            $controlsev = $this.ControlSettings.ControlSeverity.PSobject.Properties | Where-Object Value -eq $controlSeverity | Select-Object -First 1
                            $controlSeverity = $controlsev.name
                            #Check if control severity has expiry period
                            if ([Helpers]::CheckMember($this.ControlSettings.AttestationExpiryPeriodInDays.ControlSeverity, $controlSeverity) ) {
                                $expiryInDays = $this.ControlSettings.AttestationExpiryPeriodInDays.ControlSeverity.$controlSeverity
                            }
                            #If control item and severity does not contain expiry period, assign default value
                            else {
                                $expiryInDays = $defaultAttestationExpiryInDays
                            }
                        }
                        #Return -1 when expiry is not defined
                        else {
                            $expiryInDays = -1
                        }
                    }
                }
            }
            else {
                #Calculating the expiry in days for exempt controls
                if ([String]::IsNullOrEmpty($controlState.State.ExpiryDate))
                {
                    $expiryPeriod = $this.ControlSettings.DefaultAttestationPeriodForExemptControl
                    $expiryDate = ($controlState.State.AttestedDate).AddDays($expiryPeriod)
                }
                else
                {
                    $expiryDate = [DateTime]$controlState.State.ExpiryDate
                }
                # #Adding 1 explicitly to the days since the differnce below excludes the expiryDate and that also needs to be taken into account.
                # $expiryInDays = ($expiryDate - $controlState.State.AttestedDate).Days + 1
                # #Calculating the expiry in days for exempt controls

                # $expiryDate = [DateTime]$controlState.State.ExpiryDate
                # #Adding 1 explicitly to the days since the differnce below excludes the expiryDate and that also needs to be taken into account.
                $expiryInDays = ($expiryDate - $controlState.State.AttestedDate).Days + 1
            }

            if (($controlState.AttestationStatus -eq [AttestationStatus]::ApprovedException) -or ( $isApprovedExceptionEnforced -and $approvedExceptionControlsList -contains $controlState.ControlId)) {
                $expiryInDays = $this.ControlSettings.DefaultAttestationPeriodForExemptControl
            }
            elseif([Helpers]::CheckMember($this.ControlSettings, "ExtendedAttestationExpiryResources") -and [Helpers]::CheckMember($this.ControlSettings, "ExtendedAttestationExpiryDuration")){
                # Checking if the resource id is present in extended expiry list of control settings
                if(($this.ControlSettings.ExtendedAttestationExpiryResources | Get-Member "ResourceType") -and ($this.ControlSettings.ExtendedAttestationExpiryResources | Get-Member "ResourceIds")) {
                    $extendedResources = $this.ControlSettings.ExtendedAttestationExpiryResources | Where { $_.ResourceType -match $eventcontext.FeatureName }
                    # type null check
                    if(($extendedResources | Measure-Object).Count -gt 0 -and [Helpers]::CheckMember($extendedResources, "ResourceIds") -and $controlState.ResourceId -in $extendedResources.ResourceIds){
                        $expiryInDays = $this.ControlSettings.ExtendedAttestationExpiryDuration;
                    }
                }
            }
        }
        catch {
            #if any exception occurs while getting/validating expiry period, return -1.
            $this.EvaluationError($_);
            $expiryInDays = -1
        }
        return $expiryInDays
    }

    [SVTEventContext[]] FetchStateOfAllControls() {
        [SVTEventContext[]] $resourceSecurityResult = @();
        if (-not $this.ValidateMaintenanceState()) {
            if ($this.GetApplicableControls().Count -eq 0) {
                $this.PublishCustomMessage("No security controls match the input criteria specified", [MessageType]::Warning);
            }
            else {
                $this.EvaluationStarted();
                $resourceSecurityResult += $this.GetControlsStateResult();
                if (($resourceSecurityResult | Measure-Object).Count -gt 0) {
                    $this.EvaluationCompleted($resourceSecurityResult);
                }
            }
        }
        return $resourceSecurityResult;
    }

    hidden [SVTEventContext[]] GetControlsStateResult() {
        [SVTEventContext[]] $automatedControlsResult = @();
        $this.DirtyResourceStates = @();
        try {
            $this.GetApplicableControls() |
            ForEach-Object {
                $eventContext = $this.FetchControlState($_);
                #filter controls if there is no state found
                if ($eventContext) {
                    $eventContext.ControlResults = $eventContext.ControlResults | Where-Object { $_.AttestationStatus -ne [AttestationStatus]::None }
                    if ($eventContext.ControlResults) {
                        $automatedControlsResult += $eventContext;
                    }
                }
            };
        }
        catch {
            $this.EvaluationError($_);
        }

        return $automatedControlsResult;
    }
 #isRescan parameter is added to check if method is called from rescan.
    hidden [SVTEventContext] FetchControlState([ControlItem] $controlItem, $isRescan = $false) {
        [SVTEventContext] $singleControlResult = $this.CreateSVTEventContextObject();
        $singleControlResult.ControlItem = $controlItem;

        $controlState = @();
        $controlStateValue = @();
        try {
            $resourceStates = $this.GetResourceState($isRescan);
            if (($resourceStates | Measure-Object).Count -ne 0) {
                $controlStateValue += $resourceStates | Where-Object { $_.InternalId -eq $singleControlResult.ControlItem.Id };
                $controlStateValue | ForEach-Object {
                    $currentControlStateValue = $_;
                    if ($null -ne $currentControlStateValue) {
                        #assign expiry date
                        $expiryIndays = $this.CalculateExpirationInDays($singleControlResult, $currentControlStateValue);
                        if ($expiryIndays -ne -1) {
                            $currentControlStateValue.State.ExpiryDate = ($currentControlStateValue.State.AttestedDate.AddDays($expiryIndays)).ToString("MM/dd/yyyy");
                        }
                        $controlState += $currentControlStateValue;
                    }
                }
            }
        }
        catch {
            $this.EvaluationError($_);
        }
        if (($controlState | Measure-Object).Count -gt 0) {
        #Added check to resolve duplicate log issue in rescan
            if (!$isRescan) {
               $this.ControlStarted($singleControlResult);
            }
            if ($controlItem.Enabled -eq $false) {
                $this.ControlDisabled($singleControlResult);
            }
            else {
                $controlResult = $this.CreateControlResult($controlItem.FixControl);
                $singleControlResult.ControlResults += $controlResult;
                $singleControlResult.ControlResults |
                ForEach-Object {
                    try {
                        $currentItem = $_;

                        if ($controlState.Count -ne 0) {
                            # Process the state if it's available
                            $childResourceState = $controlState | Where-Object { $_.ChildResourceName -eq $currentItem.ChildResourceName } | Select-Object -First 1;
                            if ($childResourceState) {
                                $currentItem.StateManagement.AttestedStateData = $childResourceState.State;
                                $currentItem.AttestationStatus = $childResourceState.AttestationStatus;
                                $currentItem.ActualVerificationResult = $childResourceState.ActualVerificationResult;
                                $currentItem.VerificationResult = [VerificationResult]::NotScanned
                            }
                        }
                    }
                    catch {
                        $this.EvaluationError($_);
                    }
                };

            }
            #Added check to resolve duplicate log issue in rescan
            if (!$isRescan) {
               $this.ControlCompleted($singleControlResult);
            }
        }

        return $singleControlResult;
    }

    hidden [void] GetManualSecurityStatusExt($arg) {
        $this.PostProcessData($arg);
    }

    hidden [void] RunControlExt($singleControlResult) {
        $this.PostProcessData($singleControlResult);
    }

    hidden [void] EvaluateAllControlsExt($resourceSecurityResult) {
        $this.PostEvaluationCompleted($resourceSecurityResult);
    }

    hidden [void] PostEvaluationCompleted([SVTEventContext[]] $ControlResults) {
        $this.UpdateControlStates($ControlResults);

        $BugLogParameterValue =$this.InvocationContext.BoundParameters["AutoBugLog"]
        #perform bug logging after control scans for the current resource
        if ($BugLogParameterValue)
        {
            # using checkmember without null check, if field is present in control settings but no value has been set then allow bug logging for inactive resources.
            if([Helpers]::CheckMember($this.ControlSettings.BugLogging, "LogBugsForInactiveResources", $false))
            {
                # if bug logging is enabled for inactive resources, then only bug will be logged for inactive resources.
                if ($this.ControlSettings.BugLogging.LogBugsForInactiveResources -eq $false)
                {
                    $logBugsForInactiveResources = $this.isResourceActive;
                }
                # if bug logging is not enabled or its value has not been set in control setting, then treat bug logging is active for all resources.
                else
                {
                    $logBugsForInactiveResources = $true;
                }
            }
            # if required field is not present in the controlSettings,json then follow the older approach
            else
            {
                $logBugsForInactiveResources = $true;
            }
            #added check azuretable check here, if ((azuretable is used for storing bug info and scan mode is CA) OR azuretable bug info is disabed) then only allow bug logging
            $scanSource = [AzSKSettings]::GetInstance().GetScanSource();
            $isAzureTableEnabled = [Helpers]::CheckMember($this.ControlSettings.BugLogging, "UseAzureStorageAccount");
            if (!$isAzureTableEnabled -or ($isAzureTableEnabled -and ($scanSource -eq "CA")) )
            {
                if ($logBugsForInactiveResources) {
                    if (($ControlResults.ControlResults.VerificationResult -contains "Failed") -or ($ControlResults.ControlResults.VerificationResult -contains "Verify")) {
                        $this.BugLoggingPostEvaluation($ControlResults, $BugLogParameterValue)
                    }
                }
                else {
                    $this.PublishCustomMessage("The current resource is inactive. Bug logging is disabled for inactive resources.", [MessageType]::Warning);
                }
            }

        }
    }

    #function to call AutoBugLog class for performing bug logging
    hidden [void] BugLoggingPostEvaluation([SVTEventContext []] $ControlResults,[string] $BugLogParameterValue)
    {
        $AutoBugLog = [AutoBugLog]::AutoBugInstance
        if (!$AutoBugLog) {
            #Settting initial value true so will evaluate in all different cmds.(Powershell keeping static variables in memory in next command also.)
            [BugLogPathManager]::checkValidPathFlag = $true;
            $AutoBugLog = [AutoBugLog]::GetInstance($this.OrganizationContext.OrganizationName, $this.InvocationContext, $this.ControlStateExt, $BugLogParameterValue);
        }
        $AutoBugLog.LogBugInADO($ControlResults)
    }

    #function to Get Approval & Check details of resource
    hidden [psobject]GetResourceApprovalCheck()
    {        
            $resourceType = $this.ResourceContext.ResourceTypeName;
            if($resourceType -eq 'AgentPool'){
                $name=$this.ResourceContext.ResourceName;
                $resourceId = $this.AgentPoolId;
            }
            else{
                $name = $this.ResourceContext.ResourceDetails.Name; 
                $resourceId = $this.ResourceContext.ResourceDetails.Id;    
            }        
            if($resourceType -eq 'ServiceConnection'){
                $resourceType = 'endpoint'
            }
            if($resourceType -eq 'AgentPool'){
                $resourceType = 'queue'
            }            
            $approvalChecks = [ADOSVTBase]::ResourceApprovalChecks | Where-Object {($_.ResourceId -eq $($resourceId)) -and ($_.ResourceType -eq $($resourceType))}  
            
            if(!$approvalChecks){    
                $url = "https://dev.azure.com/{0}/{1}/_apis/pipelines/checks/queryconfigurations?`$expand=settings&api-version=6.1-preview.1" -f $this.OrganizationContext.OrganizationName, $this.ResourceContext.ResourceGroupName;
                #using ps invoke web request instead of helper method, as post body (json array) not supported in helper method
                $rmContext = [ContextHelper]::GetCurrentContext();
                $user = "";
                $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $user,$rmContext.AccessToken))) 
                $body = "[{'name': '$($name)','id': '$($resourceId)','type': '$($resourceType)'}]" 
                if($resourceType -eq 'Repository'){
                    $projectId = ($this.ResourceContext.ResourceId -split "project/")[-1].Split('/')[0]
                    $body = "[{'name': '$($name)','id': '$($projectId +"."+$resourceId)','type': 'repository'}]"
                }                                       
                $response = @(Invoke-RestMethod -Uri $url -Method Post -ContentType "application/json" -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -Body $body)
                $yamlTemplateControl = @()
                if([Helpers]::CheckMember($response, "count") -and $response[0].count -gt 0){                                                         
                    try{
                        $yamlTemplateControl = @($response.value | Where-Object {$_.PSObject.Properties.Name -contains "settings"})
                    } catch{
                        $yamlTemplateControl = @()
                    }
                }
                $svtResourceApprovalCheck = [ResourceApprovalCheck]::new();
                $svtResourceApprovalCheck.ResourceType = $resourceType;
                $svtResourceApprovalCheck.ResourceId = $resourceId;
                $svtResourceApprovalCheck.ApprovalCheckObj = $yamlTemplateControl;
                [ADOSVTBase]::ResourceApprovalChecks.add($svtResourceApprovalCheck);  
            }     
            
            $approvalChecks = [ADOSVTBase]::ResourceApprovalChecks | Where-Object {($_.ResourceId -eq $($resourceId)) -and ($_.ResourceType -eq $($resourceType))} 
            return $approvalChecks;
    }


}
#Class used to create Resource Approval Check list inside resolver
class ResourceApprovalCheck
{
    [string] $ResourceId = "";        
    [string] $ResourceType = "";    
    [PSObject] $ApprovalCheckObj;        
}
# SIG # Begin signature block
# MIIoKgYJKoZIhvcNAQcCoIIoGzCCKBcCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBS9r3YK77uU/wP
# tXtZllVe6F0ebMvLdtq9upcriVBr9KCCDXYwggX0MIID3KADAgECAhMzAAADrzBA
# DkyjTQVBAAAAAAOvMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p
# bmcgUENBIDIwMTEwHhcNMjMxMTE2MTkwOTAwWhcNMjQxMTE0MTkwOTAwWjB0MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
# AQDOS8s1ra6f0YGtg0OhEaQa/t3Q+q1MEHhWJhqQVuO5amYXQpy8MDPNoJYk+FWA
# hePP5LxwcSge5aen+f5Q6WNPd6EDxGzotvVpNi5ve0H97S3F7C/axDfKxyNh21MG
# 0W8Sb0vxi/vorcLHOL9i+t2D6yvvDzLlEefUCbQV/zGCBjXGlYJcUj6RAzXyeNAN
# xSpKXAGd7Fh+ocGHPPphcD9LQTOJgG7Y7aYztHqBLJiQQ4eAgZNU4ac6+8LnEGAL
# go1ydC5BJEuJQjYKbNTy959HrKSu7LO3Ws0w8jw6pYdC1IMpdTkk2puTgY2PDNzB
# tLM4evG7FYer3WX+8t1UMYNTAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE
# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQURxxxNPIEPGSO8kqz+bgCAQWGXsEw
# RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW
# MBQGA1UEBRMNMjMwMDEyKzUwMTgyNjAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci
# tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG
# CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu
# Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0
# MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAISxFt/zR2frTFPB45Yd
# mhZpB2nNJoOoi+qlgcTlnO4QwlYN1w/vYwbDy/oFJolD5r6FMJd0RGcgEM8q9TgQ
# 2OC7gQEmhweVJ7yuKJlQBH7P7Pg5RiqgV3cSonJ+OM4kFHbP3gPLiyzssSQdRuPY
# 1mIWoGg9i7Y4ZC8ST7WhpSyc0pns2XsUe1XsIjaUcGu7zd7gg97eCUiLRdVklPmp
# XobH9CEAWakRUGNICYN2AgjhRTC4j3KJfqMkU04R6Toyh4/Toswm1uoDcGr5laYn
# TfcX3u5WnJqJLhuPe8Uj9kGAOcyo0O1mNwDa+LhFEzB6CB32+wfJMumfr6degvLT
# e8x55urQLeTjimBQgS49BSUkhFN7ois3cZyNpnrMca5AZaC7pLI72vuqSsSlLalG
# OcZmPHZGYJqZ0BacN274OZ80Q8B11iNokns9Od348bMb5Z4fihxaBWebl8kWEi2O
# PvQImOAeq3nt7UWJBzJYLAGEpfasaA3ZQgIcEXdD+uwo6ymMzDY6UamFOfYqYWXk
# ntxDGu7ngD2ugKUuccYKJJRiiz+LAUcj90BVcSHRLQop9N8zoALr/1sJuwPrVAtx
# HNEgSW+AKBqIxYWM4Ev32l6agSUAezLMbq5f3d8x9qzT031jMDT+sUAoCw0M5wVt
# CUQcqINPuYjbS1WgJyZIiEkBMIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq
# hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x
# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv
# bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5
# IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG
# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG
# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg
# Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
# CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03
# a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr
# rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg
# OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy
# 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9
# sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh
# dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k
# A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB
# w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn
# Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90
# lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w
# ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o
# ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD
# VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa
# BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny
# bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG
# AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t
# L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV
# HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3
# dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG
# AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl
# AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb
# C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l
# hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6
# I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0
# wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560
# STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam
# ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa
# J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah
# XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA
# 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt
# Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr
# /Xmfwb1tbWrJUnMTDXpQzTGCGgowghoGAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw
# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN
# aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp
# Z25pbmcgUENBIDIwMTECEzMAAAOvMEAOTKNNBUEAAAAAA68wDQYJYIZIAWUDBAIB
# BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO
# MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIIxcZC6A+TtvbgDH18I5nWow
# GInA+zpkT0jJT6eIb/8oMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A
# cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB
# BQAEggEAOm0YA9EaF0DoyfKyDc3Zghgv35UGM4583P3ospjzaOYne+d+slqFw0nT
# 4Jiz3x0O9P1MNBDeIEFzm0oRZaQ4Cv9/4O0a4s45/jdOILWJRMUJJ7Z6+BnHsawN
# K3iwcJV3DUGJtT3iBox/uHZPVOTs2lWRKmLGrq/Bcw1NarzNat51j51igrZd2kj+
# 1iQR9AQJe4LLmEg1JIeeVkZxJ68AU/tHXeBl3llkKfEcYw1XqebsL1hb9uFDi+11
# B6YmO4zTobRTV1lK+k3b4L1/XRhg3IzyxUq9F4ZbNWpgJ66opNg7WdXUgCak5ruD
# /MjU+hrshE2Mvpy8bzBG7f39OOMaSKGCF5QwgheQBgorBgEEAYI3AwMBMYIXgDCC
# F3wGCSqGSIb3DQEHAqCCF20wghdpAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsq
# hkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl
# AwQCAQUABCCWA5quOgL3inc+2EUzeTSd40eDAsN4MoZPekc0seA6swIGZeentBeL
# GBMyMDI0MDMwNzA3Mzc0OC44MjlaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJV
# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE
# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l
# cmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTQwMC0w
# NUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Wg
# ghHqMIIHIDCCBQigAwIBAgITMwAAAezgK6SC0JFSgAABAAAB7DANBgkqhkiG9w0B
# AQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE
# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYD
# VQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAeFw0yMzEyMDYxODQ1
# MzhaFw0yNTAzMDUxODQ1MzhaMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz
# aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv
# cnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25z
# MScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTQwMC0wNUUwLUQ5NDcxJTAjBgNV
# BAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEB
# AQUAA4ICDwAwggIKAoICAQCwR/RuCTbgxUWVm/Vdul22uwdEZm0IoAFs6oIr39VK
# /ItP80cn+8TmtP67iabB4DmAKJ9GH6dJGhEPJpY4vTKRSOwrRNxVIKoPPeUF3f4V
# yHEco/u1QUadlwD132NuZCxbnh6Mi2lLG7pDvszZqMG7S3MCi2bk2nvtGKdeAIL+
# H77gL4r01TSWb7rsE2Jb1P/N6Y/W1CqDi1/Ib3/zRqWXt4zxvdIGcPjS4ZKyQEF3
# SEZAq4XIjiyowPHaqNbZxdf2kWO/ajdfTU85t934CXAinb0o+uQ9KtaKNLVVcNf5
# QpS4f6/MsXOvIFuCYMRdKDjpmvowAeL+1j27bCxCBpDQHrWkfPzZp/X+bt9C7E5h
# PP6HVRoqBYR7u1gUf5GEq+5r1HA0jajn0Q6OvfYckE0HdOv6KWa+sAmJG7PDvTZa
# e77homzx6IPqggVpNZuCk79SfVmnKu9F58UAnU58TqDHEzGsQnMUQKstS3zjn6SU
# 0NLEFNCetluaKkqWDRVLEWbu329IEh3tqXPXfy6Rh/wCbwe9SCJIoqtBexBrPyQY
# A2Xaz1fK9ysTsx0kA9V1JwVV44Ia9c+MwtAR6sqKdAgRo/bs/Xu8gua8LDe6KWyu
# 974e9mGW7ZO8narDFrAT1EXGHDueygSKvv2K7wB8lAgMGJj73CQvr+jqoWwx6Xdy
# eQIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFPRa0Edk/iv1whYQsV8UgEf4TIWGMB8G
# A1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCG
# Tmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUy
# MFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4w
# XAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2Vy
# dHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwG
# A1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQD
# AgeAMA0GCSqGSIb3DQEBCwUAA4ICAQCSvMSkMSrvjlDPag8ARb0OFrAQtSLMDpN0
# UY3FjvPhwGKDrrixmnuMfjrmVjRq1u8IhkDvGF/bffbFTr+IAnDSeg8TB9zfG/4y
# bknuopklbeGjbt7MLxpfholCERyEc20PMZKJz9SvzfuO1n5xrrLOL8m0nmv5kBcv
# +y1AXJ5QcLicmhe2Ip3/D67Ed6oPqQI03mDjYaS1NQhBNtu57wPKXZ1EoNToBk8b
# A6839w119b+a9WToqIskdRGoP5xjDIv+mc0vBHhZGkJVvfIhm4Ap8zptC7xVAly0
# jeOv5dUGMCYgZjvoTmgd45bqAwundmPlGur7eleWYedLQf7s3L5+qfaY/xEh/9uo
# 17SnM/gHVSGAzvnreGhOrB2LtdKoVSe5LbYpihXctDe76iYtL+mhxXPEpzda3bJl
# hPTOQ3KOEZApVERBo5yltWjPCWlXxyCpl5jj9nY0nfd071bemnou8A3rUZrdgKIa
# utsH7SHOiOebZGqNu+622vJta3eAYsCAaxAcB9BiJPla7Xad9qrTYdT45VlCYTtB
# SY4oVRsedSADv99jv/iYIAGy1bCytua0o/Qqv9erKmzQCTVMXaDc25DTLcMGJrRu
# a3K0xivdtnoBexzVJr6yXqM+Ba2whIVRvGcriBkKX0FJFeW7r29XX+k0e4DnG6iB
# HKQjec6VNzCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZI
# hvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw
# DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x
# MjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAy
# MDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMC
# VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV
# BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp
# bWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
# AQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25Phdg
# M/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPF
# dvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6
# GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBp
# Dco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50Zu
# yjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3E
# XzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0
# lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1q
# GFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ
# +QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PA
# PBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkw
# EgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxG
# NSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARV
# MFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWlj
# cm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAK
# BggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMC
# AYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvX
# zpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20v
# cGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYI
# KwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG
# 9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0x
# M7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmC
# VgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449
# xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wM
# nosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDS
# PeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2d
# Y3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxn
# GSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+Crvs
# QWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokL
# jzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL
# 6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNN
# MIICNQIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp
# bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw
# b3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEn
# MCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOkE0MDAtMDVFMC1EOTQ3MSUwIwYDVQQD
# ExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQCO
# HPtgVdz9EW0iPNL/BXqJoqVMf6CBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w
# IFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA6ZN3njAiGA8yMDI0MDMwNjIzMTU0
# MloYDzIwMjQwMzA3MjMxNTQyWjB0MDoGCisGAQQBhFkKBAExLDAqMAoCBQDpk3ee
# AgEAMAcCAQACAgF1MAcCAQACAhBlMAoCBQDplMkeAgEAMDYGCisGAQQBhFkKBAIx
# KDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZI
# hvcNAQELBQADggEBADeoTfobqqaprnb0DbDX7BW7GZ49LGI9xgyo5r8UzoMNvegH
# 7DVKWW61yqBeybXtnSL5sXPqyZ7QHojqgQlC2TFh24ynUzZSu4M6S5F5RkAZ0cfU
# 0236PdbkZpSwAktMJWxOwSlGKmxFJPXMu6fFNEOxgaxscwapGgqGYQUQRdc6O7sE
# mp8BQQaDTmB40nCyzDUnQL/Ev4nWO5d+QVwD+SAZE30mA8sWFphNMrMZnU/P7/2H
# EW3zCBwIcGgrREFoJAvmMu5PFB1bZwdNpqvz4Iq5Udz+tZHb+e2dht/jFClhF54P
# hiwL1lPPckeuoOuVeyaXmZblNlRpKnWVSAUlr8UxggQNMIIECQIBATCBkzB8MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy
# b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAezgK6SC0JFSgAABAAAB7DAN
# BglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8G
# CSqGSIb3DQEJBDEiBCBckj7ArhGBQMFr8P4szBLypHZOI1HaRxKEO0wxMlpi4TCB
# +gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EICcJ5vVqfTfIhx21QBBbKyo/xciQ
# IXaoMWULejAE1QqDMIGYMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh
# c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD
# b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw
# MTACEzMAAAHs4CukgtCRUoAAAQAAAewwIgQgSzE0eTFf/GJQhDknqkymQSiNlh7e
# Io3YyqFKxB04IVowDQYJKoZIhvcNAQELBQAEggIAneqmN9MHi3w1TPY2DgmYaEt6
# /6gvSdMNnWjBYEACf/wyYllLk56MSlKpKIvegGZchCpO7f88avN2Blhg5gtW+ep2
# usW6euLGWBTxaG9ZVwYfOWb8q8tm9HPpcnm1fT8gW/jAUks/nBmYSBB0B5XNkwSq
# DZPiER56s9znrEVzQeCh0IrfdQiYtPI7XtdSThvUCq41QKR6WrixfZ/75OksVpd5
# TT6ART2/VzGXkyorkro6csZJbt96MEWprO7ZlxqDdF/UBAmz+UFfy2hs/SqdFITh
# VTnfJdIKKlnPqyUpDgauSd8ZMKJb0WqWIjTWgf/w5uHHqoOnAJn4YEh8SBRZZsdm
# MY2NK1zxYUwj7sdq/mutnbf65rY7wRoUAT3ieiHHXznSZ8TNOSa+EEyyeyPXIz30
# 8KWoppjNZNwdSkWkfawWG4yM1wKTS88OcORiX3PB/F6GoPylRr5fi98yVcNrRcH3
# pIqh7ZF51oEx+CayHT4xno9g8Znqsv8ejGpmBhrJTpQFr86VEyk5sMB1ItgQyQTN
# w6NB7C7kgKoJ2GFz2XQSJp0wbIKqtv1HSuvygX0jILSf8UU3IHgIlBF2YcWubuPh
# 6L0UV6PeiRToe0WBITK3L3ECIGCaKd8mBAqVCS0PGKFu9nWWjbCBaUEoh3bdDH8T
# 21LHs6/7u54AJCYxO7A=
# SIG # End signature block