b#      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJK L M N O P Q R S T U V W XYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~       Trustworthy10Get the current UTC time from the system clock. 2-Get the local time together with a TimeZone. 3.Convert UTC time to local time with TimzeZone 123P !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[123123123 TrustworthyR\]^_`abcdefghijklmnopqrstuvwxyz{|}~ Trustworthy4Authentication function 5Perform basic authentication 6BBasic authentication, that always succeeds. The function uses the  username in the cookie (as in 7), if it is set. If the  cookie is not set, bsicAuth is used. 7;Use an external authentication service that sets a cookie.  The cookie name is  _hails_user, and its contents contain  a string of the form user-name:HMAC-SHA1(user-name). This 9 function simply checks that the cookie exits and the MAC'd A user name is correct. If this is the case, it returns a request A with the cookie removed. Otherwise it retuns a redirect (to the  provided url) response. 4Request 5Authentication function 67456745674567Unsafe8!Lift the underlying monad of an  from  to . 9!Lift the underlying monad of an  from  to . : Lift the underlying monad of an  from  to . 89:;89:;89:;89:; Trustworthy < An HTTP response handler in the  monad. =BA HTTP response, containing the status, headers, and parsed body. ?Response status @Response headers AResponse body BExtract body from response CBPerform a simple HTTP request, given the the request header, body G and SSL context, if any. Note that that request must have the scheme,  host fields set. DSame as C, but uses privileges. ESimple HTTP GET request. FSimple HTTP GET request. GSimple HTTP HEAD request. HSimple HTTP HEAD request. I<An HTTP client that reuses a connection to perform multiple  requests. Note that a wguard% is only performed at the connection  establishment. <=>?@ABCRequest header  Request body D Privilege Request header  Request body E Privilege URL FG Privilege URL HIInitial request Request handler -./<=>?@ABCDEFGHI=>?@ACDFEHGBI</.- <=>?@ABCDEFGHI TrustworthyJGiven a file extension (e.g., "hs") return its MIME type (e.g.,  "text/ x-haskell"0). If there is no recognized MIME type (or none 4 of the default paths exist), this function returns  " application/ octet-stream" JJJJ UnsafeKApplication route. LApplication handler. MApplication configuration. O%User the app is running on behalf of PThe app's name QThe app's privileges. RThe request message SApplication name KLMNOPQRS KLMNOPQRS SMNOPQRLKKLMNOPQRS UnsafeT(Map of file suffixes to mime types (see ) 3Handler to invoke when the URL maps to a directory 2 in the file system. Reasonable options include:  ( mempty)# to do nothing, which results in a  403 forbidden,  ( " index.html") to redirect directory " accesses to an index file, and  a recursive invocation such as (routeFileSys  typemap . (++ "/ index.html")) to re-route the $ request directly to an index file. 0Pathname of directory to serve from file system TTT UnsafeU.Return a server, given a port number and app. UUUU  TrustworthyV-Get the user the app is running on behalf of W,Get the app the app is running on behalf of VWr      !KLTVWLKVWVWUnsafe2XEncodea document YDecode a document ZExport " [Export  \8Simple sum type used to denote a policy-labeled type. A   PolicyLabeled. type can be either labeled (policy applied), & or unabled (policy not yet applied). ]Policy applied ^Policy was not applied _=Haskell types of this class correspond to LBSON value types. bA Value6 is either a standard BSON value, a labeled value, or  a policy-labeled value. cPolicy labeled (LBSON) value dLabeled (LBSON) value eUnlabeled BSON value fA Field is a  'Key'-'Value' pair. j A labeled k kA LBSON document is a list of fs lA l , or attribute is a BSON label. mAValue of field in document, or fail (Nothing) if field not found n7Lookup value of field in document and cast to expected B type. Fail (Nothing) if field not found or value not of expected  type. o.Value of field in document. Error if missing. pBTyped value of field in document. Error if missing or wrong type. q,Only include fields of document in key list r)Exclude fields from document in key list s=Merge documents with preference given to first one when both ? have the same key. I.e. for every (k := v) in first argument, ? if k exists in second argument then replace its value with v, , otherwise add (k := v) to second argument. t'Field with given label and typed value uIf Just1 value then return one field document, otherwise  return empty document vFConvert Value to expected type, or fail (Nothing) if not of that type w8Convert Value to expected type. Error if not that type. xGenerate fresh ,. yWrap an unlabeled value by \. z!Wrap an already-labeled value by \. {Safely convert from a b to a [. |Safely convert from a [ to a b. }Safe version of . ~Safe version of .  Convert a k to a Bson Document. It is an error to call  this function with malformed ks (i.e., those for which  a policy has not been applied. Convert a Bson Document to a k. This implementation is ? relaxed and omits any fields that were not converted. Use the   for a strict conversion. Same as , but fails (returns Nothing ) if any of , the field values failed to be serialized. Check if a key is unsafe. 4If value is a document, remove any fields that have  ) as a prefix, otherwise return the value " unchanged. This is equivilant to # except it 8 operates on BSON values as opposed to Hails Documents. AThis prefix is reserved for HAILS keys. It should not be used by  arbitrary code. $$Necessary instance that just fails. %$Necessary instance that just fails. &$Necessary instance that just fails. '$Necessary instance that just fails. (AConvert between a policy-labeled value and a labeled BSON value. ):Convert between a labeled value and a labeled BSON value. *Every b is a _. +=Every type that is an instance of BSON Val is an instance of % LBSON Val. This requires the use of OverlappingInstances  extension. , Instance for Eq(, only comparing unlabeled BSON values. - Instance for Show&, only showing unlabeled BSON values. :XYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~./$%&'()*+,-0H1 !"#$%&'()*+,23XYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~Ekjmnopqrsfghitulbedc_`avw\^]yz! #"%$'&*(),+x[{|Z}~XY.Z[\^]_`abedcfghijklmnopqrstuvwxyz{|}~./$%&'()*+,-0Unsafe0=A labeled cursor. The cursor is labeled with the join of the ( database and collection it reads from.  Cursorlabel Actual cursor Projector from query Collection policy #An LIO action with MongoDB access. /Since it would be a security violation to make  an instance  of MonadIO+, we create a Mongo-specific, wrapper for   that is instance of MonadIO. NOTE: IT IS IMPORTANT THAT  UnsafeLIO NEVER BE EXPOSED BY MODULES  THAT ARE NOT Unsafe. Field/'column policies are required for every  PolicyLabled value  in a document. Policy has been violated 0Searchable fields cannot contain labeled values :Field with associated policy is not of PolicyLabeled type $Policy for Collection not specified Policy application invalid Policy for field not specified A  FieldPolicy) specifies the policy-generated label of  a field. SearchabelField! specifies that the field can be ) referenced in the selection clause of a Query, and therefore * the document label does not apply to it. A  RawPolicy$ encodes a document policy, and all 8 field policies. It is required that all fields of type   PolicyLabled have a field/$column policy -- if using only this ? low-level interface a runtime-error will occur if this is not  satisfied. -A row (document) policy is a function from a k to a . -A column (field) policy is a function from a k to a  , for each field of type \. @A database has a label, which is used for controlling access to F the database, an internal identifier corresponding to the underlying  MongoDB database, and a set of s protected by a label. Actual MongoDB Label of database %Collections associated with databsae  A labeled  map. Name of database Name of collection 6Labels and policies associated with a collection. See . Collection label Collection clearance Collection labeling policy #A collection policy is is a label, G clearance and labeling policy. The label specifies who can write to a E collection (i.e., only computatoin whose current label flows to the G label of the collection). The clearance limits the sensitivity of the E data written to the collection (i.e., the labels of all data in the H collection must flow to the clearance). Note that the collection label  does not7 impose a restriction on the data (i.e., data can have C high integrity). The collection policy specifies the policies for - labeling documents and fields of documents. Collection name -Collection secutiry policies: access control  and labeling policies @Create a collection given a collection name, label, clearance, B and policy. Note that the collection label and clearance must be : above the current label and below the current clearance. Same as ), but uses privileges when comparing the F collection label and clearance with the current label and clearance. Same as , but ignores IFC.  Create a -. Given a set of privileges, the name of the @ database, the database label, and set of collections, create a @ database. Note that this does not restrict an application from ? creating arbitrary databases and collections---this should be  handled by a shim layer. Sameas , but ignores IFC checks. Same as -, but does not use privileges when comparing E the current label (and clearance) with the supplied database label. 5Associate a collection with the underlying database. Same as #, but does not use privileges when % writing to database collection map. Same as , but ignores IFC. 5Returns True if the policy is for a searchable field Returns a list of the SearchableFields speicified in a   RawPolicy Get underlying database. Lift a MongoDB action into  monad. 4UNSAFE: Instance of MonadBaseControl IO. B NOTE: This instance is a hack. I got this to work by tweaking Bas' A Annex example, but should spend time actually understanding the  details. 5UNSAFE: Instance of  MonadBase IO. 6UNSAFE: Instance of MonadIO. FCollection name Collection label Collection clearance Collection policy  Privileges Collection name Collection label Collection clearance Collection policy Collection name Collection label Collection clearance Collection policy  Privileges Name of database Label of database Labeled colleciton map 789456:;<==0=0%789456:;<=  Trustworthy!Trusted transformer that takes a  tuple with >  and the request body as a ? and returns a   k7 with keys and values corresponding to the form fields $ from the request. The label on the Labeled result is the same as E input. Arguments values are parsed in to BSON Strings except if the  key is of the form " key_name[]"" in which case all such arguments , will be combined into an array of Strings. UnsafeApply a raw field/(column policy to all the fields of type  \!, and then apply the raw document/row policy. It A must be that every labeled value in the document (including the > document itself) have a label that is below the clearance of 1 the collection. However, this is not checked by applyRawPolicyP.  Instead insert. (and similar operators) performs this check. Same as applyRawPolicy$, but ignores the current label and # clearance when applying policies. @Run action against database on server at other end of pipe. Use . access mode for any reads and writes. Return @ on connection  failure or read/write failure. C The current label is raised to the the join of the database label  and current label. Unsafe/Insert document into collection and return its _id value, E which is created automatically if not supplied. It is required that D the current label flow to the label of the collection and database B (and vice versa). Additionally, the document must be well-formed @ with respect to the collection policy. In other words, all the ? labeled values must be below the collection clearance and the ! policy be applied successfully. Same as  except it does not return _id Same as (, but uses privileges when applying the 3 collection policies, and doing label comparisons. Same as  except it does not return _id Update a document based on the _id value. The IFC requirements  subsume those of *. Specifically, in addition to being able E to apply all the policies and requiring that the current label flow - to the label of the collection and database save requires that F the current label flow to the label of the existing database record. Like ,, but uses privileges when performing label  comparisons.  or 1 that selects documents in collection that match B selector. The choice of end type depends on use, for example, in   select sel col is a , but in delete it is a . CSelects documents in specified collection that match the selector.  Selector Collection operaing %Filter for a query, analogous to the WHERE clause in  SQL. []& matches all documents in collection. [x =: a,  y =: b] is analogous to WHERE x = a AND y = b in SQL. Note;: all labeld (including policy-labeled) values are removed  from the Selector. AUse select to create a basic query with defaults, then modify if  desired. Example: (select sel col) {limit =: 10}. Note that unlike  MongoDB'4s query functionality, our queries do not allow for E projections (since policies may need a field that is not projects). E Both the selection and sorting are restricted to searchable fields. TODO: add snapshot. Query options, default []. WHERE clause,default []. (Number of documents to skip, default 0. /Max number of documents to return. Default, 0,  means no limit. $Sort result by given order, default []. )The number of document to return in each ) batch response from the server. 0 means  Mongo default. )Force mongoDB to use this index (must be " only searchable fields). Default [] , no hint. ,Fetch documents satisfying query. A labeled  is returned, * which can be used to retrieve the actual ks. Current label 8 is raised to the join of the collection, database, and  ccollection-policy label. Same as /, but uses privileges when raising the current  label .Fetch the first document satisfying query, or Nothing if not  documents matched the query. Same as ,, but uses privileges when performing label  comparisons. )Return next document in query result, or Nothing if finished. > The current label is raised to join of the current label and  1 label. The document is labeled according to the  underlying 'Collection'\' s policies. Same as 2, but usess privileges raising the current label. @Given a query, delete first object in selection. In addition to F being able to read the object, write to the database and collection, E it must be that the current label flow to the label of the existing  document. Same as ,, but uses privileges when performing label  comparisons. !ABCDABCD TrustworthyG1EFGHIJKLMNOPQR"STUVW XYZ !"#$%&'()*+,23 Trustworthy   Trustworthy[\]^1_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,23XYZ[_`abfghijklmnopqrstuvwxyz{|}~:kjmnopqrsfghitulb_`avwyz! #"%$'&*(),+x[{|Z}~XYSafe[\]^1_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,23XYZ[_`abfghijklmnopqrstuvwxyz{|}~Unsafe=Class used to define policy-specifi privilege granting gate. Request the policy's privilege-granting gate. 9Class used to define groups in a policy-specific manner.  Expands a principal of the form "# group_name" into a list of   Principals Relabeles the  value by using the policy' s privilege B to downgrade the label and optionally re-taint in an application 0 specific way, e.g. exanding groups of the form "# group_name" 6 to a policy specified disjuction of real principals. =Policies are expected to implement this function by wrapping  ( using their privilege and implementing  , which is called by . @Policy modules are instances of this class. In particular, when 9 an application accesses a database, the runtime invokes  createDatabasePolicy# in the appropriate policy module. Given a  generate an instance of this  DatabasePolicy*. This is the main entry point for policy 5 modules. Policies should, in general, ether discard DBConf or A store it in such a way that it is inaccessible to other modules 1 since it contains the priviledge of the policy. Get the actual underlying Database instance for this policy. 'Database configuration, used to invoke withDB %Open a pipe to a supplied server, or  localhost. / TODO: add support for connecting to replicas. The withDB- functions should use this function to label  their databases.  TODO (DS/,AL(: make every searchable field indexable. A wrapper around  that drops the current : privileges and restores them after getting a result from  . =Looks for disjuctions the privilege is able to downgrade and  rewrites them by invoking  on each principle in the 9 disjuction. Using the result, the function relabels the  ? value. Clients should not call this directly, instead clients  should call ! which policies may implement by  wrapping this function. AGiven a set of privileges, a labeled document and computaiton on K the (unlabeled version of the) documnet, downgrade the current label with H the supplied privileges execute (only integrity), unlabel the document N and apply the computation to it. The result is then labeled with the current E label and the current label is reset to the original (if possible). AGiven a set of privileges, a desired label and action. Lower the E current label as close tothe desired label as possible, execute the % action and raise the current label. Policy App principal Database configuratoin Label of collection policies Database label   Trustworthy Create a DatabasePolicy( with the appropriate underline databse C name and privileges, determined by the actual instance requested. @Given a database name and a database action, execute the action  on the database.  Trustworthy[\]^1_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,230XYZ[_`abfghijklmnopqrstuvwxyz{|}~J0 Trustworthyo[\^1_`acefghiklmnpqrstuvwxyz{|}~  !"#$%&'()*+,23      !0XYZ[_`abfgijklmnopqrstuvwxyz{|}~SafeBClasse used by a database policy to translate a labeled record to  a labeled document. @Given a policy, return a function that can be used to translate C labeled records to labeled documents. It is recommended to simply ! create the instance by defining  mkToDocumentP as: 7 mkToDocumentP (Policy ... priv ..) = toDocumentP priv 0Class for inserting and saving labeled records. *Insert a labeled record into the database *Insert a labeled record into the database Same as !, but using explicit privileges. Same as !, but using explicit privileges. Class for converting from " structured" records to documents  (and vice versa). Convert a document to a record Convert a record to a document 'Get the collection name for the record <Find an object with mathing value for the given key. If the > object does exist but cannot be read (above clearance), this  returns .  Find an object with given query "Insert a record into the database "Insert a record into the database =Delete a record from the database given a matching value for , given key. The deleted record is returned. +Delete an object matching the given query. ! The deleted record is returned. Same as !, but using explicit privileges.  Same as !, but using explicit privileges.  Same as !, but using explicit privileges.  Same as !, but using explicit privileges.  Same as !, but using explicit privileges.  Same as !, but using explicit privileges. Same as  but for uses the policy's privileges to 2 convert a labeled record to a labeled document.                      !"#$%&'()*+,-./0112233445566778899:;<=>?@A?@B?@CDEFGHIJKLMNOPQRSSTUVWXYZ[\]^_ ` a b b c d e f g h i j klmnopqrstu0vwxyz{|}~       !"!#!$!%!&!'!(!)!*!*!+!,!-!-./.0.1.2.3.4.5.6.7.8.9.:.;.;<=<><?<@<A<B<C<D<E<F<G<GHIHJKLKMKNKNKOPQPRPSPTPUPVPWPXPYZ[\]\^\_\`\abcdedfdgdhdidjklmklnkloklpklqklrklskltkluklvklwklxklyklzkl{kl|kl}kl~klklklklklklklklklklklklklklklklklklklklklklkl?????      !"#$%&'()*+,-./0123456789:;<=>?@ABCDE~FGHIJKLMNOPQRSTUVWXWYZ[\]^_`abc?defghijklmnop|%zy8utsTUqTUrTUTUsTUtTUuTUvTUwTUxTUyTUzTU{TU|TU}TU~TUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTUTU hails-0.1.1Hails.Data.LBson.TCBHails.Data.LBson.RexportsHails.IterIO.HttpClient Hails.Database.MongoDB.TCB.Types LIO.Data.TimeHails.HttpServer.AuthHails.IterIO.ConversionsHails.IterIO.MimeHails.TCB.TypesHails.IterIO.HailsRouteHails.HttpServer Hails.App"Hails.Database.MongoDB.TCB.Convert!Hails.Database.MongoDB.TCB.Access Hails.Database.MongoDB.TCB.Query#Hails.Database.MongoDB.TCB.DCAccessHails.Database!Hails.Database.MongoDB.Structured Hails.CryptoHails.Data.LBson.Rexports.BsonHails.Data.LBson.SafeHails.Data.LBsonHails.Database.MongoDB Hails.Policy bson-0.1.7 Data.Bson timestampFloatStringDocArrayBinFunUuidMd5UserDefObjIdBoolUTCNullRegExJavaScrSymInt32Int64StampMinMaxValueBinaryFunctionUUIDMD5 UserDefinedRegex JavascriptSymbol MongoStampMinKeyMaxKey MinMaxKeyOidObjectId iterIO-0.2.2Data.IterIO.HttpClient postRequest getRequest headRequest mongoDB-1.2.0Database.MongoDB.QueryFailuregetCurrentTime getZonedTimeutcToLocalZonedTime AuthFunction basicAuth basicNoAuth externalAuthiterIOtoIterLIO ioIterRtoLIOonumIOtoOnumLIOinumIOtoInumLIODCHttpResponseHandler HttpRespDC respStatusDC respHeadersDC respBodyDC extractBody simpleHttp simpleHttpPsimpleGetHttpP simpleGetHttpsimpleHeadHttpPsimpleHeadHttp multiHttp systemMimeMapAppRoute AppReqHandlerAppConfappUserappNameappPrivappReqAppName routeFileSyssecureHttpServer getHailsUser getHailsApp encodeDoc decodeDoc BsonDocument BsonValue PolicyLabeledPLPUValvalcast'PolicyLabeledVal LabeledValBsonValField:=keyvalueLabeledDocumentDocumentKeylooklookupvalueAtatincludeexcludemerge=:=?casttyped genObjectIdpuplsafeToBsonValuesafeFromBsonValue safeToBsonDocsafeFromBsonDoc toBsonDoc fromBsonDocfromBsonDocStrict isUnsafeKeysanitizeBsonValuehailsInternalKeyPrefixCursorcurLabel curIntern curProject curPolicyAction LIOAction unLIOAction UnsafeLIO unUnsafeLIONoSuchDatabaseErrorNoSuchDatabase PolicyErrorPolicyViolationInvalidSearchableTypeInvalidFieldPolicyType NoColPolicy InvalidPolicy NoFieldPolicy FieldPolicySearchableField RawPolicy rawDocPolicyrawFieldPoliciesDatabasedbInterndbLabel dbColPolicies CollectionMap DatabaseNameCollectionNameCollectionPolicycolLabelcolClear colPolicy Collection colInterncolSec collection collectionP collectionTCB databaseP databaseTCBdatabaseassocCollectionPassocCollectionassocCollectionTCBisSearchableFieldsearchableFields getDatabase liftAction labeledDocIapplyRawPolicyPapplyRawPolicyTCB accessTCBinsertinsert_insertPinsertP_savesavePselect SelectionselectorcollSelectorQueryoptions selectionskiplimitsort batchSizehintfindfindPfindOnefindOnePnextnextP deleteOne deleteOnePPrivilegeGrantGate grantPriv PolicyGroup expandGroup relabelGroupsDatabasePolicycreateDatabasePolicypolicyDBDCActionDBConf dbConfName dbConfPrivdcAccess labelDatabaserelabelGroupsSaferelabelGroupsP gateToLabeled withLabelmkPolicywithDBMkToLabeledDocumentmkToLabeledDocumentDCLabeledRecordinsertLabeledRecordsaveLabeledRecordinsertLabeledRecordPsaveLabeledRecordPDCRecord fromDocument toDocumentcollectionNamefindBy findWhere insertRecord saveRecorddeleteBy deleteWherefindByP findWhereP insertRecordP saveRecordP deleteByP deleteWhereP toDocumentPtime-1.4Data.Time.Format formatTimeformatCharacter FormatTimeData.Time.Format.Parse readsTimereadTime parseTime buildTime ParseTimeData.Time.LocalTime.LocalTimezonedTimeToUTCutcToZonedTimelocalTimeToUT1ut1ToLocalTimelocalTimeToUTCutcToLocalTimelocalTimeOfDaylocalDay LocalTime zonedTimeZonezonedTimeToLocalTime ZonedTimeData.Time.LocalTime.TimeOfDaytimeOfDayToDayFractiondayFractionToTimeOfDaytimeOfDayToTimetimeToTimeOfDaylocalToUTCTimeOfDayutcToLocalTimeOfDaymakeTimeOfDayValidmiddaymidnighttodSectodMintodHour TimeOfDayData.Time.LocalTime.TimeZonegetCurrentTimeZone getTimeZoneutctimeZoneOffsetStringtimeZoneOffsetString'hoursToTimeZoneminutesToTimeZone timeZoneNametimeZoneSummerOnlytimeZoneMinutesTimeZoneData.Time.Clock.UTCDiff diffUTCTime addUTCTimeData.Time.Clock.UTC utctDayTimeutctDayUTCTimeNominalDiffTimeData.Time.Calendar.GregorianaddGregorianYearsRollOveraddGregorianYearsClipaddGregorianMonthsRollOveraddGregorianMonthsClipgregorianMonthLength showGregorianfromGregorianValid fromGregorian toGregorianData.Time.Calendar.OrdinalDate isLeapYearData.Time.Calendar.DaysdiffDaysaddDaystoModifiedJulianDayModifiedJulianDayDayData.Time.Calendar.PrivateNumericPadOptionData.Time.Clock.ScalepicosecondsToDiffTimesecondsToDiffTimegetModJulianDate ModJulianDate UniversalTimeDiffTime RSA-1.2.0.0Codec.Crypto.RSA ha_SHA512 ha_SHA384 ha_SHA256ha_SHA1ha_MD5 generate_MGF1rsassa_pkcs1_v1_5_verifyrsassa_pkcs1_v1_5_signrsaes_pkcs1_v1_5_decryptrsaes_pkcs1_v1_5_encryptrsaes_oaep_decryptrsaes_oaep_encryptdecrypt'encrypt'verifysigndecryptencryptgenerateKeyPairpublic_epublic_n public_size PublicKey private_d private_n private_size PrivateKey HashFunction hashFunctionalgorithmIdentHashInfoMGF oaep_labeloaep_mgf oaep_hashUseOAEP UsePKCS1_v1_5EncryptionOptions SHA-1.5.0.1Data.Digest.Pure.SHAbytestringDigest integerDigest showDigest hmacSha512 hmacSha384 hmacSha256 hmacSha224hmacSha1sha512sha384sha256sha224sha1DigestSimpleAES-0.4.2Codec.Crypto.SimpleAEScrypt decryptMsg' decryptMsg encryptMsg' encryptMsg randomKeynewIVIVCodec.Crypto.AES.IOEncryptDecrypt DirectionECBCBCModecrypto-api-0.10.1Crypto.Classesfinalize updateCtx initialCtx blockLength outputLengthHashpureMD5-2.1.0.3Data.Digest.Pure.MD5 md5Update md5Finalizemd5md5InitialContext MD5Context MD5DigestData.IterIO.IterIterghc-prim GHC.TypesIO lio-0.1.3LIO.TCBLIOIterRData.IterIO.InumInum LIO.DCLabelDCData.IterIO.HttpRoute mimeTypesIbaseGHC.BaseconstdirRedir dclabel-0.0.6DCLabel.NanoEDSL><<> singleton.\/../\.newDC newTCBPrivnewPrivNewPriv DCLabel.CorecomponentToListlistToComponentnoPriv delegatePrivdisjMkDisjDisjconjMkConjConj canflowtoMkComponentAll component MkComponent Component integritysecrecy MkDCLabelDCLabelname Principal principalprivTCBPriv canflowto_p canDelegateowns disjToList listToDisj LIO.MonadLIOliftIOliftLIOMonadLIOlpubevalDCWithRootevalDCDCCatSetDCPriv DCPrivTCB DCLabeledDCGatecallGatemkGatePmkGateevaluatebracketP onExceptionPhandlePcatchPaguardPaguardwguardPwguardtaintPtaintdiscardPdiscard toLabeledP toLabeledrelabelPuntaintLabeledPuntaintLabeled taintLabeledunlabelPunlabellabelPlabellabelOf withClearance lowerClrPlowerClr setLabelPdropPrivilegeswithCombinedPrivswithPrivileges getPrivileges getClearancegetLabelevalLIOnoPrivsleqglblubltoplbotLabellostarleqpPriv LabelStateLabeledLerrLowLerrHigh LerrClearanceLerrPriv LerrInval LabelFaultPrivDescGateexceptInternal$fEqPolicyLabeled$fShowPolicyLabeled $fEqLabeled $fShowLabeled$fVallPolicyLabeled $fVallLabeled $fVallValue$fValla $fEqValue $fShowValue$fBsonDocSerialize[]$fBsonDocSerialize[]0 $fShowFieldcompact-string-fix-0.3.2Data.CompactString.UTF8unpack Data.UStringuUString$fMonadBaseControlIOUnsafeLIO$fMonadBaseIOUnsafeLIO$fMonadIOUnsafeLIO$fMonadLIOActionlps$fMonadLIOLIOActionlps$fMonadLIOUnsafeLIOlps$fExceptionNoSuchDatabaseError$fShowNoSuchDatabaseError$fExceptionPolicyError$fShowPolicyErrorData.IterIO.HttpHttpReqbytestring-0.9.2.1Data.ByteString.Lazy.Internal ByteString Data.EitherLeft$fInsertlpsLabeled $fInsertlps[] $fSelectQuery$fSelectSelection typeOfValfval CompactStringemptypackconssnocappendheadlasttailinitheadViewlastViewnulllengthmapreverse intersperse intercalate transposefoldlfoldl'foldl1foldl1'foldrfoldr'foldr1foldr1'concat concatMapanyallmaximumminimumscanlscanl1scanrscanr1 mapAccumL mapAccumR mapIndexed replicateunfoldrunfoldrNtakedropsplitAt takeWhile dropWhilespanspanEndbreakbreakEndgroupgroupByinitstailssplit splitWithlinesunlineswordsunwords isPrefixOf isSuffixOf isInfixOf findSubstringfindSubstringselemnotElemfilter partitionindex elemIndex elemIndices elemIndexEnd findIndex findIndexEnd findIndicescountzipzipWithzipWith'unzip toByteStringfromByteStringfromByteString_validate validate_encodeencode_decodedecode_ encodeBOM encodeBOM_ decodeBOM decodeBOM_getLine getContentsputStrputStrLninteractreadFile readFile' writeFile writeFile' appendFile appendFile'hGetLine hGetContents hGetContents'hGethGetNonBlockinghPuthPutStr hPutStrLnData.Typeable.InternalTypeabletypeOf Data.MaybeNothing