[ELY-2711] Add support for encrypted expressions in the wildfly-config.xml #2084

PrarthonaPaul · 2024-01-09T20:28:49Z

Issue: https://issues.redhat.com/browse/ELY-2711
Depends on: wildfly/wildfly-client-config#42
Related Thread: https://wildfly.zulipchat.com/#narrow/stream/174184-wildfly-developers/topic/WildFly.20feature.20development.20for.20WildFly.20Client.20config
Note:

This PR will fail CI tests because it depends on some changes on wildfly-client-config that still need to be merged
The code for Encryption client has been moved to org.wildfly.security.encryption.client and org.wildfly.security.encryption has been moved to a folder called base. Module name for this stays the same.

fjuma · 2024-01-09T21:26:00Z

@PrarthonaPaul Since this PR depends on changes in wildfly-client-config that haven't been pushed yet, I think it would be good to mark this as a draft PR.

fjuma

Thanks for the PR, @PrarthonaPaul! I have started going through the analysis document and this PR and am adding some initial feedback. Let me know if you have any questions.

fjuma · 2024-01-09T21:28:21Z

auth/client/pom.xml

-
+        <dependency>
+            <groupId>org.wildfly.core</groupId>
+            <artifactId>wildfly-controller</artifactId>


We need to be a bit careful here. This is a server dependency and it also depends on Elytron. We can't add a dependency on it here. Where it makes sense to do so, we could consider pulling out common pieces of code and adding it to Elytron and then updating the server code to make use of that.

removed core dependency!

fjuma · 2024-01-09T21:29:49Z

auth/client/pom.xml

@@ -138,6 +141,11 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <environmentVariables>
+                        <CREDSTORE_PATH_ENV>PATH/TO/ELYTRON/CLIENT/DIR/target/credstore/mycredstore.cs</CREDSTORE_PATH_ENV>


What is this needed for? Is this for tests?

This is used for tests.
Since the absolute path needs to be specified for the location of the credential store, I added an environment variable to specify the path.
Maybe we can change it to something like what the OIDC tests do to resolve env variables.

fjuma · 2024-01-09T21:31:38Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionConfig.java

@@ -0,0 +1,170 @@
+package org.wildfly.security.auth.client;


Missing copyright header (this can be copied from another .java file and then the year just needs to be updated).

fjuma · 2024-01-09T21:44:24Z

pom.xml

@@ -89,6 +89,7 @@
        <version.org.wildfly.checkstyle-config>1.0.8.Final</version.org.wildfly.checkstyle-config>
        <version.org.wildfly.client.config>1.0.1.Final</version.org.wildfly.client.config>
        <version.org.wildfly.common>1.6.0.Final</version.org.wildfly.common>
+        <version.org.wildfly.core>23.0.0.Beta4</version.org.wildfly.core>


WildFly Core depends on Elytron. We can't add this dependency here (see my comment above).

removed circular dependency. Introduced new exception classes instead and got rid of server specific code/classes.

Skyllarr · 2024-01-23T12:53:12Z

auth/client/src/test/java/org/wildfly/security/auth/client/EncryptedExpressionContextTest.java

+        Assert.assertEquals(clearText, decryptedExpression);
+    }
+}
+


@PrarthonaPaul the tests could later include an wildfly-config.xml file that contains additional schemas that can be included there. You can find them here: https://docs.wildfly.org/30/WildFly_Elytron_Security.html#Configuring_other_clients_using_wildfly-config , there are also links to schema locations

I have added a new test that uses encrypted expression with authentication client.
Please let me know if there are any other clients I should add tests for. So far there are tests for parsing only, but no integrated functionality tests. Please let me know if I should add those and where I can add those.
Thanks!

@PrarthonaPaul we can add an integration tests that verify that the credentials used in SASL authentication are resolved as expected and authentication pass. See for example the MaskedPasswordSaslAuthenticationTest where there is a SASL client and SASL server communication and we test that their authentication is successful. We could add similar integraiton tests that uses encrypted password on the client side

I have added a test for this. Currently looking to see if we need a programmatic one.
But the one for xml config should be good to go.
Thanks @Skyllarr

Skyllarr · 2024-01-29T10:04:20Z

...rc/main/java/org/wildfly/security/auth/client/DefaultEncryptedExpressionContextProvider.java

+                try {
+                    throw new InvalidEncryptedExpressionConfigurationException(t);
+                } catch (InvalidEncryptedExpressionConfigurationException e) {
+                    throw new RuntimeException(e);


@PrarthonaPaul Just a minor, you can make the InvalidEncryptedExpressionConfigurationException extend IllegalArgumentException and then remove the RuntimeException here..similarly as it is done for DefaultAuthenticationContextProvider

Skyllarr · 2024-01-29T10:04:49Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionConfig.java

+ * @author <a href="mailto:[email protected]">Prarthona Paul</a>
+ */
+
+public final class EncryptedExpressionConfig {


Just a total minor, we can name it without shortcut to keep it consistent with the rest of classes : EncryptedExpressionConfiguration

Skyllarr · 2024-01-29T10:05:34Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionConfig.java

+        return new EncryptedExpressionConfig.ClientCallbackHandler(this);
+    }
+
+    static class ClientCallbackHandler implements CallbackHandler {


@PrarthonaPaul just a minor, this callback handler is unused so you can remove it

Skyllarr · 2024-01-29T10:06:39Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionResolver.java

+ */
+
+public class EncryptedExpressionResolver {
+    private static final String CREDENTIAL_STORE_API_CAPABILITY = "org.wildfly.security.credential-store-api";


Just a minor, you can remove the CAPABILITY string

Skyllarr · 2024-01-29T10:06:48Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionResolver.java

+    private static final String CREDENTIAL_STORE_API_CAPABILITY = "org.wildfly.security.credential-store-api";
+    private volatile boolean initialised = false;
+    private final ThreadLocal<String> initialisingFor = new ThreadLocal<>();
+    private volatile ExpressionResolutionException firstFailure = null;


just a minor, these three variables are unused

removed them!

Skyllarr · 2024-01-29T10:07:20Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionResolver.java

+    private String resolveExpressionInternal(String fullExpression, EncryptedExpressionConfig config) {
+        assert config != null;
+
+        if (fullExpression.length() > 3) {


@PrarthonaPaul most code in this class seems the same as in the wildfly-core repo. Can you extract the parts of the code used by both to some Utils class and make both wildfly-elytron-client and wildfly-core use the methods from Utils, so we avoid code duplication?

I am not sure if we could do this (at least for some of the bigger ones, like createExpression or resolveExpressionInternal or resolveExpression since on the core side, they are server dependent).
But some of the smaller functions, like setResolverConfigurations or setDefaultResolver or setPrefix, we can add those to the utility.

@PrarthonaPaul The methods that can be extracted to common Utils should be extracted, so that if a bug is found in the future, we can fix it on a single place. You can also refactor the methods on the server side to be able to introduce common Utils methods where it is possible

@Skyllarr
I have identified the common code between the two classes (ElytronExpressionResolver and the EncryptedExpressionResolver).
There are 3 functions whose contents are the same:

server side: https://github.com/wildfly/wildfly-core/blob/main/elytron/src/main/java/org/wildfly/extension/elytron/expression/ElytronExpressionResolver.java#L169-L186

Client side:

wildfly-elytron/encryption/client/src/main/java/org/wildfly/security/encryption/client/EncryptedExpressionResolver.java

Lines 142 to 161 in a8334dd

public EncryptedExpressionResolver setPrefix(final String prefix) {

this.prefix = prefix;

this.completePrefix = prefix + "::";

return this;

}

public EncryptedExpressionResolver setDefaultResolver(final String defaultResolver) {

if (defaultResolver == null) {

this.defaultResolver = getResolverConfiguration().entrySet().iterator().next().getKey();

} else {

this.defaultResolver = defaultResolver;

}

return this;

}

public EncryptedExpressionResolver setResolverConfigurations(final Map<String, ResolverConfiguration> resolverConfigurations) {

this.resolverConfigurations = Collections.unmodifiableMap(resolverConfigurations);

return this;

}

However, since the objects that invoke these functions, ElytronExpressionResolver and EncryptedExpressionResolver are different, I am not exactly sure how to combine them to use the same function. I could send them as Java Objects and then cast them using instanceof keyword.

Another thing is that I was thinking of adding it to org.wildfly.security.utils, but it turns out that would lead to a circular dependency. I could fix that using a service loader or add it to another module (maybe create org.wildfly.security.encryption.util and add it there)?

Another thing I realized is that the server side resolver lives inside WF-core and client side resolver is inside elytron. I think if we wanted to access the server-side resolver class from org.wildfly.security.utils, we would need to use a service loader. Or maybe we can place the util class for encryptedexoressionresolution inside the org.wildfly.common dependency?

Skyllarr · 2024-01-29T10:08:01Z

auth/client/src/main/java/org/wildfly/security/auth/client/XMLParserUtils.java

+        return t -> second.apply(first.apply(t));
+    }
+
+    public static void configureExpressionResolver(EncryptedExpressionConfig encryptedExpressionConfig, EncryptedExpressionResolver resolver) {


Is this method unused?

yes, I have removed it.

Skyllarr · 2024-01-29T10:08:16Z

auth/client/src/main/java/org/wildfly/security/auth/client/_private/ElytronMessages.java

@@ -213,4 +214,32 @@ ConfigXMLParseException xmlUnableToIdentifyProvider(@Param Location location, St

    @Message(id = 14008, value = "WildFlyElytronClientDefaultSSLContextProvider could not obtain client default SSLContext")
    NoSuchAlgorithmException couldNotObtainClientDefaultSSLContext();
+
+    @Message(id = 14009, value = "The resolver does not exist.")
+    IllegalArgumentException resolverNotFound();


Just a minor, this exception is unused

Skyllarr · 2024-01-29T10:08:26Z

auth/client/src/main/resources/schema/encrypted-expression-1_0.xsd

+    <xsd:complexType name="encrypted-expression-type">
+        <xsd:annotation>
+            <xsd:documentation>
+                Configuration for encrypted expressions and expression-resolvers to be used across different client configurations.


Just a total minor, I would rename the file to encrypted-expressions-1_0.xsd

@Skyllarr @PrarthonaPaul To be consistent with the other clients, just wondering if this should be encrypted-expressions-client-1_0.xsd or encryption-client-1_0.xsd with the root element updated accordingly as well.

@fjuma Yes that is a good idea!

sure! I can make changes to the schema and the elements.

Skyllarr · 2024-01-29T10:08:49Z

.../client/src/test/java/org/wildfly/security/auth/client/EncryptedExpressionXMLParserTest.java

+
+        SecurityFactory<AuthenticationContext> authClientConfiguration = ElytronXmlParser.parseAuthenticationClientConfiguration(config.toURI());
+        Assert.assertNotNull(clientConfiguration);
+        Assert.assertNotNull(authClientConfiguration);


can we add some test that verifies that the resolved expression is as expected?

Looking into this now

Skyllarr · 2024-01-30T14:41:56Z

auth/client/src/main/resources/schema/encrypted-expression-1_0.xsd

+        </xsd:sequence>
+    </xsd:complexType>
+
+    <xsd:complexType name="credential-store-type">


@PrarthonaPaul Just wondering, is it possible for this new schema to reference the types from the existing elytron-client xsd schema? With some include?

Are there any examples of this?
If we can reuse credential-store-type from the elytron schema, it would make it much simpler.

@PrarthonaPaul I do not know of any examples, but maybe it is possible to do https://stackoverflow.com/questions/8194112/basics-of-referencing-a-xsd-schema-from-another-schema ? It needs some investigations of the schema possibilities

I have added a reference to the elytron schema using the method mentioned in the post you shared. Thanks!

PrarthonaPaul · 2024-02-05T18:04:39Z

Thanks, @Skyllarr for the comments!
I have addressed some of the comments and for the others, I have added some questions.

fjuma · 2024-02-05T22:28:10Z

...rc/main/java/org/wildfly/security/auth/client/DefaultEncryptedExpressionContextProvider.java

+ *
+ * @author <a href="mailto:[email protected]">Prarthona Paul</a>
+ */
+class DefaultEncryptedExpressionContextProvider {


Very minor but some classes have EncryptedExpressions in the class name and others have just EncryptedExpression. We need to make sure that we are consistent with the schema throughout.

Do we need "Context" in the class name? Just wondering if this was a copy/paste from DefaultAuthenticationContextProvider or if there is a reason to include it in the name here too.

I see now there's a corresponding EncryptedExpressionContext class.

I have changed classes related to encryption client to have names like EncryptionClientContext

fjuma · 2024-02-05T22:29:41Z

...rc/main/java/org/wildfly/security/auth/client/DefaultEncryptedExpressionContextProvider.java

+
+/**
+ * A lazily-initialized holder for the default encrypted expression context.
+ * If an error occurs setting up the default identity


"default identity context" -> This is likely a copy/paste from something else, should be reworded

fjuma · 2024-02-05T22:32:52Z

auth/client/src/main/java/org/wildfly/security/auth/client/XMLParserUtils.java

+import static org.wildfly.security.auth.client._private.ElytronMessages.xmlLog;
+
+/**
+ * An interface to get and check information about attributes in XML file.


s/interface/utility class

Since this is just a utility class with helper methods, this shouldn't be public API. Currently, this is a public class in the org.wildfly.security.auth.client package and that is public API.

Thanks for pointing out!
Which of the following do you think would be the best approach:

move it to org.wildfly.security.auth.util?

keep it in the same directory and change the class and its functions to private or

change the functions to protected and keep the class public or

something else

fjuma · 2024-02-05T22:38:06Z

.../client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionConfiguration.java

+         } else {
+             this.defaultResolverName = original.defaultResolverName;
+         }
+         if (what == SET_USER_CALLBACK_HANDLER) {


Is this needed?

nope, I think i was trying to use it for something else but did not need it.
Should be removed now.

fjuma · 2024-02-05T22:38:19Z

.../client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionConfiguration.java

+    private static final int REMOVE_CREDENTIAL_STORE = 3;
+    private static final int SET_RESOLVER = 4;
+    private static final int SET_DEFAULT_RESOLVER = 5;
+    private static final int SET_USER_CALLBACK_HANDLER = 6;


Is this used?

fjuma · 2024-02-05T22:41:36Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionContext.java

+     *
+     * @return the current thread's captured authentication context
+     */
+    public static EncryptedExpressionContext captureCurrent() {


"authentication context" references above

PrarthonaPaul · 2024-02-06T21:43:44Z

auth/client/src/main/java/org/wildfly/security/auth/client/AuthenticationConfiguration.java

+     * password to authenticate. The current encryption client configuration is loaded and is used to decrypt
+     * the encrypted password. If one does not exist, appropriate exception is thrown.
+     *
+     * @param encryptedPassword the password to use


I added this function to decrypt a password before adding it so if users want to programmatically configure an auth client with encrypted expressions, they can do that.

To make it more general, we can replace it with a function called decryptAndUseValue() that takes in the expression to decrypt and the function to call afterwards. However, I am not sure if that is something we can do with templates (not sure if that's what they are called in java. But here is what I am talking about https://cplusplus.com/doc/oldtutorial/templates/).

If this is not supported, then we can send enumerated values like this function is doing. So, based on the enum value, we can call the appropriate function with the decrypted value.

@Skyllarr @fjuma please let me know what you think.

fjuma · 2024-02-07T22:53:42Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptionClientConfiguration.java

+        return value != null ? value : defVal;
+    }
+
+    private static int getOrDefault(int value, int defVal) {


Are these getOrDefault methods used?

fjuma · 2024-02-07T23:02:09Z

auth/client/src/main/java/org/wildfly/security/auth/client/ExpressionResolutionException.java

+ * @author <a href="mailto:[email protected]">Prarthona Paul</a>
+ */
+
+public class ExpressionResolutionException extends RuntimeException {


Is this thrown specifically for issues with encrypted expressions? If so, would be good to update the class name to reflect that.

Updated the name to EncryptedExpressionResolutionException

fjuma · 2024-02-07T23:03:44Z

auth/client/src/main/java/org/wildfly/security/auth/client/WildFlyClientResolverProvider.java

+ */
+
+@MetaInfServices(value = ResolverProvider.class)
+public class WildFlyClientResolverProvider implements ResolverProvider{


Can you provide some more details on what this class is used for?

Sure! This is part of the service loader process.
The ResolverProvider interface lives inside the wildfly-client-config project and the WildFlyClientResolverProvider class implements that class in wildfly-elytron to give access to the classes and functions needed to resolve and decrypt the encrypted expression.

PrarthonaPaul · 2024-02-13T19:35:54Z

auth/client/src/main/java/org/wildfly/security/auth/client/AuthenticationConfiguration.java

+//     * @param encryptedPassword the password to use
+//     * @return the new configuration
+//     */
+//    public AuthenticationConfiguration decryptAndUsePassword(String encryptedPassword) {


This function is here temporarily and will be uncommented if we decide to add support for programmatic configuration with encrypted expressions.

PrarthonaPaul · 2024-02-13T20:34:22Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionResolver.java

+    private String resolveExpressionInternal(String fullExpression, EncryptedExpressionConfig config) {
+        assert config != null;
+
+        if (fullExpression.length() > 3) {


@Skyllarr
I have identified the common code between the two classes (ElytronExpressionResolver and the EncryptedExpressionResolver).
There are 3 functions whose contents are the same:

server side: https://github.com/wildfly/wildfly-core/blob/main/elytron/src/main/java/org/wildfly/extension/elytron/expression/ElytronExpressionResolver.java#L169-L186

Client side:

wildfly-elytron/encryption/client/src/main/java/org/wildfly/security/encryption/client/EncryptedExpressionResolver.java

Lines 142 to 161 in a8334dd

public EncryptedExpressionResolver setPrefix(final String prefix) {

this.prefix = prefix;

this.completePrefix = prefix + "::";

return this;

}

public EncryptedExpressionResolver setDefaultResolver(final String defaultResolver) {

if (defaultResolver == null) {

this.defaultResolver = getResolverConfiguration().entrySet().iterator().next().getKey();

} else {

this.defaultResolver = defaultResolver;

}

return this;

}

public EncryptedExpressionResolver setResolverConfigurations(final Map<String, ResolverConfiguration> resolverConfigurations) {

this.resolverConfigurations = Collections.unmodifiableMap(resolverConfigurations);

return this;

}

However, since the objects that invoke these functions, ElytronExpressionResolver and EncryptedExpressionResolver are different, I am not exactly sure how to combine them to use the same function. I could send them as Java Objects and then cast them using instanceof keyword.

Another thing is that I was thinking of adding it to org.wildfly.security.utils, but it turns out that would lead to a circular dependency. I could fix that using a service loader or add it to another module (maybe create org.wildfly.security.encryption.util and add it there)?

PrarthonaPaul · 2024-02-13T20:52:29Z

auth/client/src/main/java/org/wildfly/security/auth/client/EncryptedExpressionResolver.java

+    private String resolveExpressionInternal(String fullExpression, EncryptedExpressionConfig config) {
+        assert config != null;
+
+        if (fullExpression.length() > 3) {


Another thing I realized is that the server side resolver lives inside WF-core and client side resolver is inside elytron. I think if we wanted to access the server-side resolver class from org.wildfly.security.utils, we would need to use a service loader. Or maybe we can place the util class for encryptedexoressionresolution inside the org.wildfly.common dependency?

ropalka · 2024-04-15T10:24:00Z

Just a friendly remainder @PrarthonaPaul there's a change required to move this PR forward.

PrarthonaPaul · 2024-04-15T13:27:35Z

Just a friendly remainder @PrarthonaPaul there's a change required to move this PR forward.

Thanks @ropalka
I will resolve these conflicts and push soon.

rsearls · 2024-08-09T14:12:08Z

...client/src/main/java/org/wildfly/security/encryption/client/EncryptedExpressionResolver.java

+        if (fullExpression.length() > 3) {
+            String expression = fullExpression.substring(2, fullExpression.length() - 1);
+
+            if (expression.startsWith(completePrefix)) {


If completePrefix has not been set a NullPointerException will be thrown.

fixed!
Thanks @rsearls

…g.xml

PrarthonaPaul requested review from fjuma and Skyllarr as code owners January 9, 2024 20:28

fjuma requested changes Jan 9, 2024

View reviewed changes

PrarthonaPaul marked this pull request as draft January 10, 2024 15:44

PrarthonaPaul force-pushed the WFLY-14984 branch from 7445682 to 1ea050f Compare January 12, 2024 18:18

Skyllarr reviewed Jan 23, 2024

View reviewed changes

PrarthonaPaul force-pushed the WFLY-14984 branch from 85746de to 30fb3d5 Compare January 25, 2024 15:52

This was referenced Jan 25, 2024

[WFLY-14984] Add support for encrypted expressions in the wildfly-config.xml wildfly/wildfly-client-config#42

Closed

[WFLY-14984] Add support for encrypted expressions in the wildfly-config.xml wildfly/wildfly#17562

Draft

PrarthonaPaul force-pushed the WFLY-14984 branch from 30fb3d5 to c79951a Compare January 26, 2024 16:33

Skyllarr reviewed Jan 29, 2024

View reviewed changes

Skyllarr reviewed Jan 30, 2024

View reviewed changes

fjuma reviewed Feb 5, 2024

View reviewed changes

PrarthonaPaul commented Feb 6, 2024

View reviewed changes

PrarthonaPaul force-pushed the WFLY-14984 branch 3 times, most recently from e00f3a8 to b19e179 Compare February 7, 2024 15:30

fjuma reviewed Feb 7, 2024

View reviewed changes

PrarthonaPaul force-pushed the WFLY-14984 branch 3 times, most recently from a8334dd to 2e3748e Compare February 13, 2024 20:41

PrarthonaPaul commented Feb 13, 2024

View reviewed changes

PrarthonaPaul force-pushed the WFLY-14984 branch 2 times, most recently from 44121d9 to 1aa0ed1 Compare February 14, 2024 15:30

ropalka mentioned this pull request Mar 1, 2024

[WFLY-14984] Add support for encrypted expressions in the wildfly-config.xml wildfly/wildfly-client-config#45

Merged

PrarthonaPaul force-pushed the WFLY-14984 branch from 1aa0ed1 to 7c65720 Compare April 22, 2024 15:23

rsearls reviewed Aug 9, 2024

View reviewed changes

rsearls approved these changes Aug 9, 2024

View reviewed changes

PrarthonaPaul force-pushed the WFLY-14984 branch 2 times, most recently from c7b4764 to 11a9b4f Compare August 19, 2024 15:11

Prarthona Paul added 2 commits August 19, 2024 12:19

[ELY-2711] Add support for encrypted expressions in the wildfly-confi…

32f8315

…g.xml

[squash] rename schema to include the stability level

8b15cc3

PrarthonaPaul force-pushed the WFLY-14984 branch from 11a9b4f to 8b15cc3 Compare August 19, 2024 16:19

darranl added the Feature Request label Sep 15, 2024

	public EncryptedExpressionResolver setPrefix(final String prefix) {
	this.prefix = prefix;
	this.completePrefix = prefix + "::";
	return this;
	}

	public EncryptedExpressionResolver setDefaultResolver(final String defaultResolver) {
	if (defaultResolver == null) {
	this.defaultResolver = getResolverConfiguration().entrySet().iterator().next().getKey();
	} else {
	this.defaultResolver = defaultResolver;
	}
	return this;
	}

	public EncryptedExpressionResolver setResolverConfigurations(final Map<String, ResolverConfiguration> resolverConfigurations) {
	this.resolverConfigurations = Collections.unmodifiableMap(resolverConfigurations);

	return this;
	}

[ELY-2711] Add support for encrypted expressions in the wildfly-config.xml #2084

Are you sure you want to change the base?

[ELY-2711] Add support for encrypted expressions in the wildfly-config.xml #2084

Conversation

PrarthonaPaul commented Jan 9, 2024 • edited Loading

fjuma commented Jan 9, 2024

fjuma left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Skyllarr Feb 6, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

PrarthonaPaul commented Feb 5, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fjuma Feb 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fjuma Feb 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ropalka commented Apr 15, 2024

PrarthonaPaul commented Jan 9, 2024 •

edited

Loading

Skyllarr Feb 6, 2024 •

edited

Loading

fjuma Feb 5, 2024 •

edited

Loading

fjuma Feb 5, 2024 •

edited

Loading