PowerCommander

1.1.6

EnterpriseHelpers.ps1

$Script:Keeper_TeamNameCompleter = {
    param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)

    $result = @()
    [Enterprise]$enterprise = $Script:Context.Enterprise
    if (-not $enterprise) {
        return $null
    }
    if ($wordToComplete) {
        $to_complete = $wordToComplete + '*'
    }
    else {
        $to_complete = '*'
    }
    foreach ($team in $enterprise.enterpriseData.Teams) {
        if ($team.Name -like $to_complete) {
            $teamName = $team.Name
            if ($teamName -match '[\s'']') {
                $teamName = $teamName -replace '''', ''''''
                $teamName = "'${teamName}'"
            }

            $result += $teamName
        }
    }
    if ($result.Count -gt 0) {
        return $result
    }
    else {
        return $null
    }
}

$Script:Keeper_ActiveUserCompleter = {
    param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)

    $result = @()
    [Enterprise]$enterprise = $Script:Context.Enterprise
    if (-not $enterprise) {
        return $null
    }
    if ($wordToComplete) {
        $to_complete = '*' + $wordToComplete + '*'
    }
    else {
        $to_complete = '*'
    }
    foreach ($user in $enterprise.enterpriseData.Users) {
        if ($user.UserStatus -in @([KeeperSecurity.Enterprise.UserStatus]::Active, [KeeperSecurity.Enterprise.UserStatus]::Disabled, [KeeperSecurity.Enterprise.UserStatus]::Blocked)) {
            if ($user.Email -like $to_complete) {
                $result += $user.Email
            }
        }
    }
    if ($result.Count -gt 0) {
        return $result
    }
    else {
        return $null
    }
}

$Script:Keeper_LockedUserCompleter = {
    param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)

    $result = @()
    [Enterprise]$enterprise = $Script:Context.Enterprise
    if (-not $enterprise) {
        return $null
    }
    if ($wordToComplete) {
        $to_complete = '*' + $wordToComplete + '*'
    }
    else {
        $to_complete = '*'
    }
    foreach ($user in $enterprise.enterpriseData.Users) {
        if ($user.UserStatus -eq [KeeperSecurity.Enterprise.UserStatus]::Locked) {
            if ($user.Email -like $to_complete) {
                $result += $user.Email
            }
        }
    }
    if ($result.Count -gt 0) {
        return $result
    }
    else {
        return $null
    }
}

$Script:Keeper_EnterpriseUserCompleter = {
    param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)

    $result = @()
    [Enterprise]$enterprise = $Script:Context.Enterprise
    if (-not $enterprise) {
        return $null
    }
    if ($wordToComplete) {
        $to_complete = '*' + $wordToComplete + '*'
    }
    else {
        $to_complete = '*'
    }
    foreach ($user in $enterprise.enterpriseData.Users) {
        if ($user.Email -like $to_complete) {
            $result += $user.Email
        }
    }
    if ($result.Count -gt 0) {
        return $result
    }
    else {
        return $null
    }
}

$Script:Keeper_RoleNameCompleter = {
    param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)

    $result = @()
    [Enterprise]$enterprise = $Script:Context.Enterprise
    if (-not $enterprise) {
        return $null
    }
    if ($wordToComplete) {
        $to_complete = $wordToComplete + '*'
    }
    else {
        $to_complete = '*'
    }
    foreach ($role in $enterprise.roleData.Roles) {
        if ($role.DisplayName -like $to_complete) {
            $roleName = $role.DisplayName
            if ($roleName -match '[\s'']') {
                $roleName = $roleName -replace '''', ''''''
                $roleName = "'${roleName}'"
            }

            $result += $roleName
        }
    }
    if ($result.Count -gt 0) {
        return $result
    }
    else {
        return $null
    }
}

function resolveUser {
    Param (
        $enterpriseData,
        $user,
        $userAliasData = $null
    )
    [KeeperSecurity.Enterprise.EnterpriseUser] $u = $null

    if ($user -is [long]) {
        if ($enterpriseData.TryGetUserById($user, [ref]$u)) {
            return $u
        }
    }
    elseif ($user -is [int]) {
        if ($enterpriseData.TryGetUserById([long]$user, [ref]$u)) {
            return $u
        }
    }
    elseif ($user -is [string]) {
        if ($enterpriseData.TryGetUserByEmail($user, [ref]$u)) {
            return $u
        }
        if ($user -match '^\d+$') {
            if ($enterpriseData.TryGetUserById([long]$user, [ref]$u)) {
                return $u
            }
        }
        if ($userAliasData) {
            $normalizedUserEmail = $user.Trim().ToLowerInvariant()
            foreach ($enterpriseUser in $enterpriseData.Users) {
                foreach ($alias in $userAliasData.GetAliasesForUser($enterpriseUser.Id)) {
                    if ($alias.ToLowerInvariant() -eq $normalizedUserEmail) {
                        if ($enterpriseData.TryGetUserById($enterpriseUser.Id, [ref]$u)) {
                            return $u
                        }
                    }
                }
            }
        }
    }
    elseif ($user -is [KeeperSecurity.Enterprise.EnterpriseUser]) {
        if ($enterpriseData.TryGetUserById($user.Id, [ref]$u)) {
            return $u
        }
    }
    Write-Error "`"${user}`" cannot be resolved as enterprise user" -ErrorAction Stop
}

function resolveSingleNode {
    Param ($node)

    if ($node) {
        $nodes = Get-EnterpriseNode | Where-Object { $_.Id -eq $node }
        if ($nodes.Length -eq 0) {
            $nodes = Get-EnterpriseNode | Where-Object { $_.DisplayName -like $node + '*' }
        }
        if ($nodes.Length -eq 0) {
            Write-Error -Message "Node `"$node`" not found" -ErrorAction Stop
        }
        if ($nodes.Length -gt 1) {
            Write-Error -Message "Node name `"$node`" is not unique. Use Node ID." -ErrorAction Stop
        }
        $nodes[0]
    }
}

function Script:Resolve-EnterpriseNodeFilter {
    param(
        [Parameter(Mandatory = $true)]
        [Enterprise] $Enterprise,

        [Parameter()]
        [string[]] $Nodes
    )

    if (-not $Nodes -or $Nodes.Count -eq 0) {
        return $null
    }

    $resolvedIds = [System.Collections.Generic.HashSet[long]]::new()
    foreach ($nodeInput in $Nodes) {
        if ([string]::IsNullOrWhiteSpace($nodeInput)) {
            continue
        }

        $resolvedNode = resolveSingleNode $nodeInput.Trim()
        if ($null -eq $resolvedNode) {
            continue
        }

        $descendantIds = Get-EnterpriseNodeAndDescendantIds $Enterprise.enterpriseData $resolvedNode.Id
        foreach ($nodeId in $descendantIds) {
            [void]$resolvedIds.Add($nodeId)
        }
    }

    return $resolvedIds
}

function resolveRole {
    Param (
        $roleData,
        $role
    )
    [KeeperSecurity.Enterprise.EnterpriseRole] $r = $null

    if ($role -is [long]) {
        if ($roleData.TryGetRole($role, [ref]$r)) {
            return $r
        }
    }
    elseif ($role -is [string]) {
        $roles = Get-EnterpriseRole | Where-Object { $_.Id -eq $role -or $_.DisplayName -ieq $role }
        if ($roles.Length -eq 1) {
            if ($roleData.TryGetRole($roles[0].Id, [ref]$r)) {
                return $r
            }
        }
        elseif ($roles.Length -gt 1) {
            Write-Error "Role name `"$role`" is not unique. Use Role ID" -ErrorAction Stop
            return $null
        }
    }
    elseif ($role -is [KeeperSecurity.Enterprise.EnterpriseRole]) {
        if ($roleData.TryGetRole($role.Id, [ref]$r)) {
            return $r
        }
    }
    Write-Error "`"${role}`" cannot be resolved as enterprise role" -ErrorAction Stop
    return $null
}

function resolveTeam {
    Param (
        $enterpriseData,
        $team
    )
    [KeeperSecurity.Enterprise.EnterpriseTeam] $t = $null

    if ($team -is [string]) {
        if ($enterpriseData.TryGetTeam($team, [ref]$t)) {
            return $t
        }

        $teams = $enterpriseData.Teams | Where-Object { $_.Name -ieq $team }
        if ($teams.Count -eq 1) {
            if ($enterpriseData.TryGetTeam($teams[0].Uid, [ref]$t)) {
                return $t
            }
        }
        elseif ($teams.Count -gt 1) {
            Write-Error "Team name `"$team`" is not unique. Use Team UID" -ErrorAction Stop
            return $null
        }
    }
    elseif ($team -is [KeeperSecurity.Enterprise.EnterpriseTeam]) {
        if ($enterpriseData.TryGetTeam($team.Uid, [ref]$t)) {
            return $t
        }
    }
    Write-Error "`"${team}`" cannot be resolved as enterprise team" -ErrorAction Stop
    return $null
}

function Script:Get-KeeperNodeName {
    Param (
        [long]$nodeId
    )
    $enterprise = getEnterprise
    [KeeperSecurity.Enterprise.EnterpriseNode]$node = $null
    if ($enterprise.enterpriseData.TryGetNode($nodeId, [ref]$node)) {
        if ($node.ParentNodeId -gt 0) {
            return $node.DisplayName
        }
        else {
            return $enterprise.loader.EnterpriseName
        }
    }
}

function Get-KeeperNodePath {
    <#
    .SYNOPSIS
    Get the path string for an enterprise node (e.g. "Root \ Sales \ EMEA").
    .PARAMETER NodeId
    Enterprise node ID.
    .PARAMETER OmitRoot
    If set, root node name is omitted from the path.
    #>
    [CmdletBinding()]
    Param (
        [Parameter(Mandatory = $true)][long] $NodeId,
        [Parameter()][switch] $OmitRoot
    )
    $enterprise = getEnterprise
    $ed = $enterprise.enterpriseData
    $node = $null
    if (-not $ed.TryGetNode($NodeId, [ref]$node)) { return '' }
    $parts = [System.Collections.Generic.List[string]]::new()
    $current = $node
    while ($null -ne $current) {
        $name = $current.DisplayName
        if ([string]::IsNullOrEmpty($name) -and $current.ParentNodeId -le 0) {
            $name = $enterprise.loader.EnterpriseName
        }
        if (-not [string]::IsNullOrEmpty($name)) {
            $parts.Insert(0, $name)
        }
        if ($current.ParentNodeId -le 0) { break }
        $parent = $null
        if (-not $ed.TryGetNode($current.ParentNodeId, [ref]$parent)) { break }
        $current = $parent
    }
    if ($OmitRoot -and $parts.Count -gt 1) {
        $parts.RemoveAt(0)
    }
    return ($parts -join '\')
}

function Script:Get-KeeperRoleName {
    Param (
        [long]$roleId
    )
    $enterprise = getEnterprise
    [KeeperSecurity.Enterprise.EnterpriseRole]$role = $null
    if ($enterprise.roleData.TryGetRole($roleId, [ref]$role)) {
        return $role.DisplayName
    }
}

function Get-KeeperTeamByNameOrUid {
    param (
        [Parameter(Mandatory = $true)]
        [KeeperSecurity.Enterprise.EnterpriseData] $EnterpriseData,
        
        [Parameter(Mandatory = $true)]
        [string] $TeamInput
    )

    foreach ($t in $EnterpriseData.Teams) {
        if (($t.Uid -eq $TeamInput) -or ($t.Name -and ($t.Name.Trim().ToLower() -eq $TeamInput.Trim().ToLower()))) {
            return $t
        }
    }
    return $null
}

function Resolve-EnterpriseTeamTarget {
    param (
        [Parameter(Mandatory = $true)][Enterprise]$Enterprise,
        [Parameter(Mandatory = $true)][string]$TeamInput
    )

    if ([string]::IsNullOrWhiteSpace($TeamInput)) { return $null }

    $key = $TeamInput.Trim()
    $ed = $Enterprise.enterpriseData
    [KeeperSecurity.Enterprise.EnterpriseTeam]$team = $null

    if ($ed.TryGetTeam($key, [ref]$team)) {
        return [EnterpriseTeamTarget]::FromActiveTeam($team)
    }

    $nameMatches = @($ed.Teams | Where-Object { $_.Name -ieq $key })
    if ($nameMatches.Count -eq 1) {
        return [EnterpriseTeamTarget]::FromActiveTeam($nameMatches[0])
    }
    if ($nameMatches.Count -gt 1) {
        Write-Warning "Team name `"$key`" is not unique. Use Team UID."
        return $null
    }

    $queuedMatches = @(
        $Enterprise.queuedTeamData.QueuedTeams |
        Where-Object { $_.Uid -ceq $key -or $_.Name -ieq $key }
    )
    if ($queuedMatches.Count -eq 1) {
        return [EnterpriseTeamTarget]::FromQueuedTeam($queuedMatches[0])
    }
    if ($queuedMatches.Count -gt 1) {
        Write-Warning "Queued team name `"$key`" is not unique. Use Team UID."
        return $null
    }

    Write-Warning "Team `"$key`" not found."
    return $null
}

function Resolve-EnterpriseRoleList {
    param (
        [Parameter(Mandatory = $true)]$RoleData,
        [Parameter(Mandatory = $true)][string[]]$Roles
    )

    $resolved = [System.Collections.Generic.List[KeeperSecurity.Enterprise.EnterpriseRole]]::new()
    foreach ($roleInput in $Roles) {
        if ([string]::IsNullOrWhiteSpace($roleInput)) {
            Write-Warning "Skipping empty role value."
            continue
        }
        try {
            $role = resolveRole $RoleData $roleInput.Trim()
            if ($role) { [void]$resolved.Add($role) }
        }
        catch { Write-Warning $_.Exception.Message }
    }
    return $resolved
}

function Get-EnterpriseTeamMemberInputs {
    param (
        [AllowNull()]
        [string[]]$EmailInputs,
        [AllowNull()]
        [string[]]$UserInputs
    )

    $memberInputsList = [System.Collections.Generic.List[string]]::new()
    $seen = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)

    if ($null -ne $EmailInputs) {
        foreach ($email in $EmailInputs) {
            if ([string]::IsNullOrWhiteSpace($email)) {
                Write-Warning "Skipping empty email value."
                continue
            }
            $trimmed = $email.Trim()
            if ($seen.Add($trimmed)) {
                [void]$memberInputsList.Add($trimmed)
            }
        }
    }

    if ($null -ne $UserInputs) {
        foreach ($userInput in $UserInputs) {
            if ([string]::IsNullOrWhiteSpace($userInput)) {
                Write-Warning "Skipping empty user value."
                continue
            }
            $trimmed = $userInput.Trim()
            if ($seen.Add($trimmed)) {
                [void]$memberInputsList.Add($trimmed)
            }
        }
    }

    if ($memberInputsList.Count -eq 0) {
        throw "At least one user must be specified via -Emails or -User."
    }

    # Comma ensures a single user is returned as string[]
    return ,@($memberInputsList.ToArray())
}

function Get-EnterpriseTeamAdminUserTypeFromHideSharedFolders {
    <#
        .SYNOPSIS
        Maps -HideSharedFolders (on/off) to SDK TeamUserType admin values.
    #>
    param (
        [Parameter(Mandatory = $true)]
        [ValidateSet('on', 'off')]
        [string]$HideSharedFolders
    )

    if ($HideSharedFolders -eq 'on') {
        return [int][Enterprise.TeamUserType]::AdminOnly
    }
    return [int][Enterprise.TeamUserType]::Admin
}

function Test-EnterpriseRoleIsAdmin {
    param (
        [Parameter(Mandatory = $true)]$RoleData,
        [Parameter(Mandatory = $true)][long]$RoleId
    )
    return @($RoleData.GetManagedNodes() | Where-Object { $_.RoleId -eq $RoleId }).Count -gt 0
}

function Get-EnterpriseDistinctUserIdsForTeam {
    param (
        [Parameter(Mandatory = $true)]$EnterpriseData,
        [Parameter(Mandatory = $true)][string]$TeamUid
    )

    $seen = [System.Collections.Generic.HashSet[long]]::new()
    $userIds = [System.Collections.Generic.List[long]]::new()
    foreach ($userId in @($EnterpriseData.GetUsersForTeam($TeamUid))) {
        if ($seen.Add($userId)) {
            [void]$userIds.Add($userId)
        }
    }
    return $userIds
}

function Test-EnterpriseUserOnTeam {
    param (
        [Parameter(Mandatory = $true)]$EnterpriseData,
        [Parameter(Mandatory = $true)][string]$TeamUid,
        [Parameter(Mandatory = $true)][long]$UserId
    )
    return @(Get-EnterpriseDistinctUserIdsForTeam -EnterpriseData $EnterpriseData -TeamUid $TeamUid) -contains $UserId
}

function Test-EnterpriseTeamOnRole {
    param (
        [Parameter(Mandatory = $true)]$RoleData,
        [Parameter(Mandatory = $true)][long]$RoleId,
        [Parameter(Mandatory = $true)][string]$TeamUid
    )
    return @($RoleData.GetTeamsForRole($RoleId)) -contains $TeamUid
}

function Test-EnterpriseUserQueuedForTeam {
    param (
        [Parameter(Mandatory = $true)]$QueuedTeamData,
        [Parameter(Mandatory = $true)][string]$TeamUid,
        [Parameter(Mandatory = $true)][long]$UserId
    )
    return @($QueuedTeamData.GetQueuedUsersForTeam($TeamUid)) -contains $UserId
}

function Get-EnterpriseSdkWarningCallback {
    if ($null -eq $script:EnterpriseSdkWarningCallback) {
        $writeLine = [System.Console].GetMethod('WriteLine', [System.Type[]]@([string]))
        $script:EnterpriseSdkWarningCallback = [System.Delegate]::CreateDelegate(
            [System.Action[string]],
            $null,
            $writeLine
        )
    }
    return $script:EnterpriseSdkWarningCallback
}

function Invoke-EnterpriseAddUsersToTeams {
    param(
        [Parameter(Mandatory = $true)]$EnterpriseData,
        [Parameter(Mandatory = $true)][string[]]$Emails,
        [Parameter(Mandatory = $true)][string[]]$TeamUids
    )

    try {
        $callback = Get-EnterpriseSdkWarningCallback
        $EnterpriseData.AddUsersToTeams($Emails, $TeamUids, $callback).GetAwaiter().GetResult() | Out-Null
    }
    catch {
        $message = if ($_.Exception.InnerException) { $_.Exception.InnerException.Message } else { $_.Exception.Message }
        if ($message -match 'AddUsersToTeams' -and $message -match 'argument count') {
            $EnterpriseData.AddUsersToTeams($Emails, $TeamUids).GetAwaiter().GetResult() | Out-Null
        }
        else {
            throw
        }
    }
}

function Invoke-EnterpriseRemoveUsersFromTeams {
    param(
        [Parameter(Mandatory = $true)]$EnterpriseData,
        [Parameter(Mandatory = $true)][string[]]$Emails,
        [Parameter(Mandatory = $true)][string[]]$TeamUids
    )

    try {
        $callback = Get-EnterpriseSdkWarningCallback
        $EnterpriseData.RemoveUsersFromTeams($Emails, $TeamUids, $callback).GetAwaiter().GetResult() | Out-Null
    }
    catch {
        $message = if ($_.Exception.InnerException) { $_.Exception.InnerException.Message } else { $_.Exception.Message }
        if ($message -match 'RemoveUsersFromTeams' -and $message -match 'argument count') {
            $EnterpriseData.RemoveUsersFromTeams($Emails, $TeamUids).GetAwaiter().GetResult() | Out-Null
        }
        else {
            throw
        }
    }
}

function Add-EnterpriseUserToTeamMembership {
    param (
        [Parameter(Mandatory = $true)][EnterpriseTeamMembershipRequest]$Request
    )

    $Enterprise = $Request.Enterprise
    $User = $Request.User
    $TeamTarget = $Request.TeamTarget
    $HideSharedFolders = $Request.HideSharedFolders

    $ed = $Enterprise.enterpriseData
    $teamUid = $TeamTarget.Uid
    $teamName = $TeamTarget.Name
    $teamObject = $TeamTarget.Team

    if ($User.UserStatus -eq [KeeperSecurity.Enterprise.UserStatus]::Active) {
        if (-not $teamObject) {
            Write-Warning "Team `"$teamName`" is queued only. Active users cannot be added until the team is approved."
            return
        }

        $existingMember = Test-EnterpriseUserOnTeam -EnterpriseData $ed -TeamUid $teamUid -UserId $User.Id
        if ($existingMember) {
            Write-Warning "User `"$($User.Email)`" is already a member of team `"$teamName`"."
            if (-not [string]::IsNullOrWhiteSpace($HideSharedFolders)) {
                $userType = Get-EnterpriseTeamAdminUserTypeFromHideSharedFolders -HideSharedFolders $HideSharedFolders
                $ed.TeamEnterpriseUserUpdate($teamObject, $User, $userType).GetAwaiter().GetResult() | Out-Null
                Write-Output "Admin type updated for user `"$($User.Email)`" in team `"$teamName`"."
            }
            return
        }

        Invoke-EnterpriseAddUsersToTeams -EnterpriseData $ed -Emails @($User.Email) -TeamUids @($teamUid)
        $Enterprise.loader.Load().GetAwaiter().GetResult() | Out-Null

        if (-not [string]::IsNullOrWhiteSpace($HideSharedFolders)) {
            $userType = Get-EnterpriseTeamAdminUserTypeFromHideSharedFolders -HideSharedFolders $HideSharedFolders
            $ed.TeamEnterpriseUserUpdate($teamObject, $User, $userType).GetAwaiter().GetResult() | Out-Null
        }

        Write-Output "User `"$($User.Email)`" added to team `"$teamName`"."
        return
    }

    # Commander queues inactive users via team_queue_user (no admin-type field on that API).
    # HideSharedFolders applies after the user is active and on the team (TeamEnterpriseUserUpdate).
    if (Test-EnterpriseUserQueuedForTeam -QueuedTeamData $Enterprise.queuedTeamData -TeamUid $teamUid -UserId $User.Id) {
        Write-Warning "User `"$($User.Email)`" is already queued for team `"$teamName`"."
        return
    }

    if (-not [string]::IsNullOrWhiteSpace($HideSharedFolders)) {
        Write-Warning "HideSharedFolders is not applied when queueing inactive user `"$($User.Email)`" to team `"$teamName`". Set admin type after the user is active."
    }

    $rq = New-Object KeeperSecurity.Commands.TeamQueueUserCommand
    $rq.TeamUid = $teamUid
    $rq.EnterpriseUserId = $User.Id
    $Enterprise.loader.Auth.ExecuteAuthCommand($rq).GetAwaiter().GetResult() | Out-Null
    $Enterprise.loader.Load().GetAwaiter().GetResult() | Out-Null
    Write-Output "User `"$($User.Email)`" queued to team `"$teamName`"."
}


<#
.SYNOPSIS
    Parses an enforcement type string (from API or user) to RoleEnforcementPolicies enum.
.DESCRIPTION
    Tries the original string first, then underscore-removed, so both "REQUIRE_TWO_FACTOR" and "requiretwofactor" work.
    Used when reading enforcements from GetEnforcementsForRole (API) or when normalizing user input.
#>
function ConvertTo-RoleEnforcementPolicy {
    param([string]$EnforcementType)
    if ([string]::IsNullOrWhiteSpace($EnforcementType)) { return $null }
    $key = $EnforcementType.Trim()
    try {
        return [Enum]::Parse([KeeperSecurity.Enterprise.RoleEnforcementPolicies], $key, $true)
    }
    catch {
        $norm = $key -replace '_', ''
        try {
            return [Enum]::Parse([KeeperSecurity.Enterprise.RoleEnforcementPolicies], $norm, $true)
        }
        catch {
            return $null
        }
    }
}

<#
.SYNOPSIS
    Builds a dictionary of RoleEnforcementPolicies -> value from a role's enforcements.
.PARAMETER RoleData
    RoleData instance (from enterprise.roleData).
.PARAMETER RoleId
    Role ID to read enforcements for.
#>
function Get-RoleEnforcementDictionary {
    param(
        [Parameter(Mandatory = $true)]
        [KeeperSecurity.Enterprise.RoleData]$RoleData,
        [Parameter(Mandatory = $true)]
        [long]$RoleId
    )
    $dict = [System.Collections.Generic.Dictionary[KeeperSecurity.Enterprise.RoleEnforcementPolicies, string]]::new()
    foreach ($re in $RoleData.GetEnforcementsForRole($RoleId)) {
        $policy = ConvertTo-RoleEnforcementPolicy $re.EnforcementType
        if ($null -ne $policy) {
            $dict[$policy] = if ($re.Value) { $re.Value } else { '' }
        }
    }
    return $dict
}

# SIG # Begin signature block
# MIInvgYJKoZIhvcNAQcCoIInrzCCJ6sCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAw1K/asD6jfJWv
# RCRo5YpbdViIllwh1jTPw1YL7yi1IKCCITswggWNMIIEdaADAgECAhAOmxiO+dAt
# 5+/bUOIIQBhaMA0GCSqGSIb3DQEBDAUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQK
# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNV
# BAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0yMjA4MDEwMDAwMDBa
# Fw0zMTExMDkyMzU5NTlaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy
# dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD
# ZXJ0IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
# ggIBAL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3E
# MB/zG6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKy
# unWZanMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsF
# xl7sWxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU1
# 5zHL2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJB
# MtfbBHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObUR
# WBf3JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6
# nj3cAORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxB
# YKqxYxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5S
# UUd0viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+x
# q4aLT8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjggE6MIIB
# NjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTs1+OC0nFdZEzfLmc/57qYrhwP
# TzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzAOBgNVHQ8BAf8EBAMC
# AYYweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp
# Y2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNv
# bS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcnQwRQYDVR0fBD4wPDA6oDigNoY0
# aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENB
# LmNybDARBgNVHSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQEMBQADggEBAHCgv0Nc
# Vec4X6CjdBs9thbX979XB72arKGHLOyFXqkauyL4hxppVCLtpIh3bb0aFPQTSnov
# Lbc47/T/gLn4offyct4kvFIDyE7QKt76LVbP+fT3rDB6mouyXtTP0UNEm0Mh65Zy
# oUi0mcudT6cGAxN3J0TU53/oWajwvy8LpunyNDzs9wPHh6jSTEAZNUZqaVSwuKFW
# juyk1T3osdz9HNj0d1pcVIxv76FQPfx2CWiEn2/K2yCNNWAcAgPLILCsWKAOQGPF
# mCLBsln1VWvPJ6tsds5vIy30fnFqI2si/xK4VC0nftg62fC2h5b9W9FcrBjDTZ9z
# twGpn1eqXijiuZQwggawMIIEmKADAgECAhAIrUCyYNKcTJ9ezam9k67ZMA0GCSqG
# SIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMx
# GTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRy
# dXN0ZWQgUm9vdCBHNDAeFw0yMTA0MjkwMDAwMDBaFw0zNjA0MjgyMzU5NTlaMGkx
# CzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UEAxM4
# RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEzODQg
# MjAyMSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDVtC9C0Cit
# eLdd1TlZG7GIQvUzjOs9gZdwxbvEhSYwn6SOaNhc9es0JAfhS0/TeEP0F9ce2vnS
# 1WcaUk8OoVf8iJnBkcyBAz5NcCRks43iCH00fUyAVxJrQ5qZ8sU7H/Lvy0daE6ZM
# swEgJfMQ04uy+wjwiuCdCcBlp/qYgEk1hz1RGeiQIXhFLqGfLOEYwhrMxe6TSXBC
# Mo/7xuoc82VokaJNTIIRSFJo3hC9FFdd6BgTZcV/sk+FLEikVoQ11vkunKoAFdE3
# /hoGlMJ8yOobMubKwvSnowMOdKWvObarYBLj6Na59zHh3K3kGKDYwSNHR7OhD26j
# q22YBoMbt2pnLdK9RBqSEIGPsDsJ18ebMlrC/2pgVItJwZPt4bRc4G/rJvmM1bL5
# OBDm6s6R9b7T+2+TYTRcvJNFKIM2KmYoX7BzzosmJQayg9Rc9hUZTO1i4F4z8ujo
# 7AqnsAMrkbI2eb73rQgedaZlzLvjSFDzd5Ea/ttQokbIYViY9XwCFjyDKK05huzU
# tw1T0PhH5nUwjewwk3YUpltLXXRhTT8SkXbev1jLchApQfDVxW0mdmgRQRNYmtwm
# KwH0iU1Z23jPgUo+QEdfyYFQc4UQIyFZYIpkVMHMIRroOBl8ZhzNeDhFMJlP/2NP
# TLuqDQhTQXxYPUez+rbsjDIJAsxsPAxWEQIDAQABo4IBWTCCAVUwEgYDVR0TAQH/
# BAgwBgEB/wIBADAdBgNVHQ4EFgQUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHwYDVR0j
# BBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1Ud
# JQQMMAoGCCsGAQUFBwMDMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0
# cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0
# cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8E
# PDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVz
# dGVkUm9vdEc0LmNybDAcBgNVHSAEFTATMAcGBWeBDAEDMAgGBmeBDAEEATANBgkq
# hkiG9w0BAQwFAAOCAgEAOiNEPY0Idu6PvDqZ01bgAhql+Eg08yy25nRm95RysQDK
# r2wwJxMSnpBEn0v9nqN8JtU3vDpdSG2V1T9J9Ce7FoFFUP2cvbaF4HZ+N3HLIvda
# qpDP9ZNq4+sg0dVQeYiaiorBtr2hSBh+3NiAGhEZGM1hmYFW9snjdufE5BtfQ/g+
# lP92OT2e1JnPSt0o618moZVYSNUa/tcnP/2Q0XaG3RywYFzzDaju4ImhvTnhOE7a
# brs2nfvlIVNaw8rpavGiPttDuDPITzgUkpn13c5UbdldAhQfQDN8A+KVssIhdXNS
# y0bYxDQcoqVLjc1vdjcshT8azibpGL6QB7BDf5WIIIJw8MzK7/0pNVwfiThV9zeK
# iwmhywvpMRr/LhlcOXHhvpynCgbWJme3kuZOX956rEnPLqR0kq3bPKSchh/jwVYb
# KyP/j7XqiHtwa+aguv06P0WmxOgWkVKLQcBIhEuWTatEQOON8BUozu3xGFYHKi8Q
# xAwIZDwzj64ojDzLj4gLDb879M4ee47vtevLt/B3E+bnKD+sEq6lLyJsQfmCXBVm
# zGwOysWGw/YmMwwHS6DTBwJqakAwSEs0qFEgu60bhQjiWQ1tygVQK+pKHJ6l/aCn
# HwZ05/LWUpD9r4VIIflXO7ScA+2GRfS0YW6/aOImYIbqyK+p/pQd52MbOoZWeE4w
# gga0MIIEnKADAgECAhANx6xXBf8hmS5AQyIMOkmGMA0GCSqGSIb3DQEBCwUAMGIx
# CzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3
# dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBH
# NDAeFw0yNTA1MDcwMDAwMDBaFw0zODAxMTQyMzU5NTlaMGkxCzAJBgNVBAYTAlVT
# MRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UEAxM4RGlnaUNlcnQgVHJ1
# c3RlZCBHNCBUaW1lU3RhbXBpbmcgUlNBNDA5NiBTSEEyNTYgMjAyNSBDQTEwggIi
# MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC0eDHTCphBcr48RsAcrHXbo0Zo
# dLRRF51NrY0NlLWZloMsVO1DahGPNRcybEKq+RuwOnPhof6pvF4uGjwjqNjfEvUi
# 6wuim5bap+0lgloM2zX4kftn5B1IpYzTqpyFQ/4Bt0mAxAHeHYNnQxqXmRinvuNg
# xVBdJkf77S2uPoCj7GH8BLuxBG5AvftBdsOECS1UkxBvMgEdgkFiDNYiOTx4OtiF
# cMSkqTtF2hfQz3zQSku2Ws3IfDReb6e3mmdglTcaarps0wjUjsZvkgFkriK9tUKJ
# m/s80FiocSk1VYLZlDwFt+cVFBURJg6zMUjZa/zbCclF83bRVFLeGkuAhHiGPMvS
# GmhgaTzVyhYn4p0+8y9oHRaQT/aofEnS5xLrfxnGpTXiUOeSLsJygoLPp66bkDX1
# ZlAeSpQl92QOMeRxykvq6gbylsXQskBBBnGy3tW/AMOMCZIVNSaz7BX8VtYGqLt9
# MmeOreGPRdtBx3yGOP+rx3rKWDEJlIqLXvJWnY0v5ydPpOjL6s36czwzsucuoKs7
# Yk/ehb//Wx+5kMqIMRvUBDx6z1ev+7psNOdgJMoiwOrUG2ZdSoQbU2rMkpLiQ6bG
# RinZbI4OLu9BMIFm1UUl9VnePs6BaaeEWvjJSjNm2qA+sdFUeEY0qVjPKOWug/G6
# X5uAiynM7Bu2ayBjUwIDAQABo4IBXTCCAVkwEgYDVR0TAQH/BAgwBgEB/wIBADAd
# BgNVHQ4EFgQU729TSunkBnx6yuKQVvYv1Ensy04wHwYDVR0jBBgwFoAU7NfjgtJx
# XWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF
# BwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGln
# aWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5j
# b20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8EPDA6MDigNqA0hjJo
# dHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNy
# bDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgBhv1sBwEwDQYJKoZIhvcNAQEL
# BQADggIBABfO+xaAHP4HPRF2cTC9vgvItTSmf83Qh8WIGjB/T8ObXAZz8OjuhUxj
# aaFdleMM0lBryPTQM2qEJPe36zwbSI/mS83afsl3YTj+IQhQE7jU/kXjjytJgnn0
# hvrV6hqWGd3rLAUt6vJy9lMDPjTLxLgXf9r5nWMQwr8Myb9rEVKChHyfpzee5kH0
# F8HABBgr0UdqirZ7bowe9Vj2AIMD8liyrukZ2iA/wdG2th9y1IsA0QF8dTXqvcnT
# mpfeQh35k5zOCPmSNq1UH410ANVko43+Cdmu4y81hjajV/gxdEkMx1NKU4uHQcKf
# ZxAvBAKqMVuqte69M9J6A47OvgRaPs+2ykgcGV00TYr2Lr3ty9qIijanrUR3anzE
# wlvzZiiyfTPjLbnFRsjsYg39OlV8cipDoq7+qNNjqFzeGxcytL5TTLL4ZaoBdqbh
# OhZ3ZRDUphPvSRmMThi0vw9vODRzW6AxnJll38F0cuJG7uEBYTptMSbhdhGQDpOX
# gpIUsWTjd6xpR6oaQf/DJbg3s6KCLPAlZ66RzIg9sC+NJpud/v4+7RWsWCiKi9EO
# LLHfMR2ZyJ/+xhCx9yHbxtl5TPau1j/1MIDpMPx0LckTetiSuEtQvLsNz3Qbp7wG
# WqbIiOWCnb5WqxL3/BAPvIXKUjPSxyZsq8WhbaM2tszWkPZPubdcMIIG7TCCBNWg
# AwIBAgIQCoDvGEuN8QWC0cR2p5V0aDANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQG
# EwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0
# IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0Ex
# MB4XDTI1MDYwNDAwMDAwMFoXDTM2MDkwMzIzNTk1OVowYzELMAkGA1UEBhMCVVMx
# FzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdpQ2VydCBTSEEy
# NTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVzcG9uZGVyIDIwMjUgMTCCAiIwDQYJKoZI
# hvcNAQEBBQADggIPADCCAgoCggIBANBGrC0Sxp7Q6q5gVrMrV7pvUf+GcAoB38o3
# zBlCMGMyqJnfFNZx+wvA69HFTBdwbHwBSOeLpvPnZ8ZN+vo8dE2/pPvOx/Vj8Tch
# TySA2R4QKpVD7dvNZh6wW2R6kSu9RJt/4QhguSssp3qome7MrxVyfQO9sMx6ZAWj
# FDYOzDi8SOhPUWlLnh00Cll8pjrUcCV3K3E0zz09ldQ//nBZZREr4h/GI6Dxb2Uo
# yrN0ijtUDVHRXdmncOOMA3CoB/iUSROUINDT98oksouTMYFOnHoRh6+86Ltc5zjP
# KHW5KqCvpSduSwhwUmotuQhcg9tw2YD3w6ySSSu+3qU8DD+nigNJFmt6LAHvH3KS
# uNLoZLc1Hf2JNMVL4Q1OpbybpMe46YceNA0LfNsnqcnpJeItK/DhKbPxTTuGoX7w
# JNdoRORVbPR1VVnDuSeHVZlc4seAO+6d2sC26/PQPdP51ho1zBp+xUIZkpSFA8vW
# doUoHLWnqWU3dCCyFG1roSrgHjSHlq8xymLnjCbSLZ49kPmk8iyyizNDIXj//cOg
# rY7rlRyTlaCCfw7aSUROwnu7zER6EaJ+AliL7ojTdS5PWPsWeupWs7NpChUk555K
# 096V1hE0yZIXe+giAwW00aHzrDchIc2bQhpp0IoKRR7YufAkprxMiXAJQ1XCmnCf
# gPf8+3mnAgMBAAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTkO/zy
# Me39/dfzkXFjGVBDz2GM6DAfBgNVHSMEGDAWgBTvb1NK6eQGfHrK4pBW9i/USezL
# TjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwgZUGCCsG
# AQUFBwEBBIGIMIGFMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5j
# b20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdp
# Q2VydFRydXN0ZWRHNFRpbWVTdGFtcGluZ1JTQTQwOTZTSEEyNTYyMDI1Q0ExLmNy
# dDBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGln
# aUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBpbmdSU0E0MDk2U0hBMjU2MjAyNUNBMS5j
# cmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEB
# CwUAA4ICAQBlKq3xHCcEua5gQezRCESeY0ByIfjk9iJP2zWLpQq1b4URGnwWBdEZ
# D9gBq9fNaNmFj6Eh8/YmRDfxT7C0k8FUFqNh+tshgb4O6Lgjg8K8elC4+oWCqnU/
# ML9lFfim8/9yJmZSe2F8AQ/UdKFOtj7YMTmqPO9mzskgiC3QYIUP2S3HQvHG1FDu
# +WUqW4daIqToXFE/JQ/EABgfZXLWU0ziTN6R3ygQBHMUBaB5bdrPbF6MRYs03h4o
# bEMnxYOX8VBRKe1uNnzQVTeLni2nHkX/QqvXnNb+YkDFkxUGtMTaiLR9wjxUxu2h
# ECZpqyU1d0IbX6Wq8/gVutDojBIFeRlqAcuEVT0cKsb+zJNEsuEB7O7/cuvTQasn
# M9AWcIQfVjnzrvwiCZ85EE8LUkqRhoS3Y50OHgaY7T/lwd6UArb+BOVAkg2oOvol
# /DJgddJ35XTxfUlQ+8Hggt8l2Yv7roancJIFcbojBcxlRcGG0LIhp6GvReQGgMgY
# xQbV1S3CrWqZzBt1R9xJgKf47CdxVRd/ndUlQ05oxYy2zRWVFjF7mcr4C34Mj3oc
# CVccAvlKV9jEnstrniLvUxxVZE/rptb7IRE2lskKPIJgbaP5t2nGj/ULLi49xTcB
# ZU8atufk+EMF/cWuiC7POGT75qaL6vdCvHlshtjdNXOCIUjsarfNZzCCB0kwggUx
# oAMCAQICEAHdzU+FVN9jCMv0HhHagNUwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UE
# BhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2Vy
# dCBUcnVzdGVkIEc0IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENB
# MTAeFw0yNjA2MDUwMDAwMDBaFw0yNzA2MDQyMzU5NTlaMIHRMRMwEQYLKwYBBAGC
# NzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMR0wGwYDVQQPDBRQ
# cml2YXRlIE9yZ2FuaXphdGlvbjEQMA4GA1UEBRMHMzQwNzk4NTELMAkGA1UEBhMC
# VVMxETAPBgNVBAgTCElsbGlub2lzMRAwDgYDVQQHEwdDaGljYWdvMR0wGwYDVQQK
# ExRLZWVwZXIgU2VjdXJpdHkgSW5jLjEdMBsGA1UEAxMUS2VlcGVyIFNlY3VyaXR5
# IEluYy4wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCb4DRTV0sNQsa1
# 0YRh+bliabmLOVYr6S0+BSVvRJAN3SHP6x52i1Dkpki5xVDIH06ZnnsToVrgvTv+
# QxGwsn9SAPHEZ/PIJRFxbMR4ShDaptYyL4f0u4k/3HwRzIleWE4mTUonYH8BdgLw
# /F53B7wa7VTDHtxXltYTibEOwJxYCOi4Zr2FYQhjw14/CHcqS3FSMs6YYU2T56+g
# w819hQM3K0YlwTNOFoIm1v7/ZZZiJGH8uGDsvy1makh1Xyyo/wN8EbQ1nbslmePT
# roPm9w7WqiP/yiq+CZHiuTk9JK5bEgkWG3ns+v25cI251WidJx3SU7IZnX0OTd6/
# ZdKhprD5Gcfy5GBbJdcYw2WycQRW0PT5BEt55xRE0heufkpDaTUN6RdOuJdXbkl0
# hV91IZIuhueEMCk3h5mDTlU5gImxqj0R/TbAxjSSGTKCeuYFkQIRqytSabdrZZ48
# kW5hOIZMVDY1f4kpPJa8UeEvDZXT3vrtj36aSJrwez2uh4FMNlkCAwEAAaOCAgIw
# ggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBT1
# SmCYU/7Yrz1fX66Ur5nSzlSYOzA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYB
# BQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMC
# B4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0
# cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25p
# bmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRp
# Z2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNI
# QTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYY
# aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2Fj
# ZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JT
# QTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUA
# A4ICAQBcavcUHNFEg872HDRq2+hRlnvaghCXv7X/6h9HSzjAQP3rt95BZty3ASqi
# 2MYyGQLGdDl4DToe/WhajtEOBOYa83agW6tBvrfcKRrDrwJOMPTbwNYvn+GuiL4T
# CKzXaytWiJJbrc5odc7Ecat2ZvJylpPmNainr4Q0LzzH23Gea/Mm/hIJTN4IGgrH
# hrXiTIIW/ZUzrY6g8b3RZB4BA497n43wNdSqP+C3ntFw6NiGB4Z25SW4YntIxYPv
# Kf37OVhF0xqxLC1sK/XxgK0EGQ6iaj8Ncpr2C5vSNZqfW2MndxOA1W67pgDpg83k
# UWG+/YJeGhqOTF82/0kIzQXeI/lIqbnL/IJAJqSm/ROSpsGUKVbzk03cpTD55ZQX
# WjM0fLirypBqY05T8gnh1L0fSwxr/SwJZ8OddivgyK1YOMn02nnsEG5kxBt9cMX4
# JCYABhypmAVDRvyYifEVdoFWv2gAXXW+PPRvlNa6E4aMCZrVcoKHiyeMAXOi1IC9
# mHvC2+foTSMFueq3AdnYfeKnZnAiKXKRhXcdHbQYcR2A7AIzIcqahPYr4FNEgb/E
# /y/kypAkf0rMHlYl1kNqLs2Nv1UnMEHYT5YmDVLO63+1Trcw4zTZ70zuqIqeID/d
# nbOlgtyG6DSRCL7f0E7kP18f4RoX5i1PkfeO4VJHsAuCeNG1qjGCBdkwggXVAgEB
# MH0waTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYD
# VQQDEzhEaWdpQ2VydCBUcnVzdGVkIEc0IENvZGUgU2lnbmluZyBSU0E0MDk2IFNI
# QTM4NCAyMDIxIENBMQIQAd3NT4VU32MIy/QeEdqA1TANBglghkgBZQMEAgEFAKCB
# hDAYBgorBgEEAYI3AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEE
# AYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJ
# BDEiBCDDOn+IV4LAZ10KHoC9632hI/RO7zNuZrq8LrUAAXPMXDANBgkqhkiG9w0B
# AQEFAASCAYBLvmOGKqYlS09116/twCDzsx2vTryQu5/oYmZ2vh+ZeigEnmZCfNFs
# +yLdg+57kDOhrFkrat57qmKAKzItGi30TTlSCffjjMxAtVCwmvd3o53ltMYnQMCb
# GSkO6j9NWcAjDUOQqrEPWkzeJ0wET4oD1ZxohcT3VoO/dDzDzq2wNFe6Pna9FTcQ
# w7Khbv3sSmXYDct49Ic+5tC5Psh0Cw7din/CJEMXvfXJ42h48kVuMEiBJF+zsfGh
# USSDIP0XQKj0zSB/gAth5XcsAVt42blFJRsmScoQRAEjZ1fRfCuSURQFlcY4iN9L
# 22/IDmrM7f9eTM02iPaB4YETCvaj+LLIOUz7WczKRfoUc3oEuFT4e6uEflOsfen/
# sL3/TJ/6v5ygjrcD4uFh2+5++noY8d+ql+sC2woG34bi8+PcdVmhOcOCbyipfhtP
# irXnXRC2Zsdmn9YwlCjYx/wPg9SO+VOvDgnpYzfqEEYYD0xN1LVilfxTNk4Z9C+h
# AiLldjMwsnOhggMmMIIDIgYJKoZIhvcNAQkGMYIDEzCCAw8CAQEwfTBpMQswCQYD
# VQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lD
# ZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUg
# Q0ExAhAKgO8YS43xBYLRxHanlXRoMA0GCWCGSAFlAwQCAQUAoGkwGAYJKoZIhvcN
# AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjYwODE0MjExOTExWjAv
# BgkqhkiG9w0BCQQxIgQgsXmhny68rMPEuK1aUpb49Xo5+rl821SsLG2n6Ngv1SMw
# DQYJKoZIhvcNAQEBBQAEggIADLQEeI4NkvNZpLF2hkayHAjJhUbZd/LiGsrZglqj
# 2Ov5lpmiX8aPMnt85B0VBMw0xH8CaOLK9vfM2keLK9+mod8wblZQizWI2iYRZkyc
# YwzYMJ+V3k38dKg6+b5OkmDF/FpUlNCpUZ6dLG7bX2Eitf4VxwTEhLYX6UsXCcmx
# SIhxM5EF+IZ/dj3yc6U5vNzGkcac3MFCDQKCIHIRP/AxWHFEhExzlpar0sg7diyn
# K7+niZTSGPArlbZhgJbcUlijyiRsuPEzDJsgHslYnSV83rCCTDPzcpx+4vP0RQWu
# a2Y9opP7M1OFabu5K0yKxPI1iJzYh8RkRDTkZOmb/CK0ik6ZLxnlwxXJjEacrb6L
# Y4ZSrKa8WP7+xJ6v9ArBTkoz2W8UTVMp3na+C7a7SRxbHEA7S4W2gbS36TLKKaKg
# xlamgEWpmsUGwZ7N7B8CWLXg/tdAR/K2kLUniyEX5FuEUJGQB+Pphxz1w72c91gr
# o40wHQJWnfTetxUPAmqZINtxUwTCAJ8YsxYmXIruuIH6Moikx7K+EV4uMuyPGCcS
# FLztF05/HtbS4MwNM4NMPrqlUulCgpv//xvlQVKIrlX6rolSLPnj81aGQl+SZqPS
# 2Fy2do5hkGzOIVulcNsA/IEVl2xKuvh7RpLH1xyb9xcyAJ4Cuhaxh3goMYyuxTsX
# Yus=
# SIG # End signature block