25940 support credentials issuance through oid4vci #27931

wistefan · 2024-03-15T12:33:32Z

Implements the OID4VCI endpoints and the Pre-Authorized Code Grant to allow issuance of verifiable credentials

closes #25940

services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialIssuer.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/SupportedCredential.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/PreAuthorizedCode.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorResponse.java

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCMapper.java

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCContextMapper.java

...ces/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCStaticClaimMapper.java

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCContextMapper.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/OID4VCClient.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/Role.java

services/src/main/java/org/keycloak/protocol/oid4vc/model/SupportedCredential.java

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2024-03-18T16:11:28Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromHttp

Keycloak CI - FIPS IT (strict)

java.lang.RuntimeException: Could not create statement
	at org.jboss.arquillian.junit.Arquillian.methodBlock(Arquillian.java:307)
	at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
...

Report flaky test

org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithInvalidSignatureCRL

Keycloak CI - FIPS IT (strict)

java.lang.RuntimeException: Could not create statement
	at org.jboss.arquillian.junit.Arquillian.methodBlock(Arquillian.java:307)
	at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
...

Report flaky test

org.keycloak.testsuite.x509.X509BrowserCRLTest#loginWithMultipleRevocationLists

Keycloak CI - FIPS IT (strict)

java.lang.RuntimeException: Could not create statement
	at org.jboss.arquillian.junit.Arquillian.methodBlock(Arquillian.java:307)
	at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
...

Report flaky test

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

wistefan · 2024-04-08T13:54:21Z

Hi,
I have run OID4VCIssuerEndpointTest on “25940-support-credentials-issuance-through-oid4vci” branch. I found out something wrong, so let me share that here.
OID4VCIssuerEndpointTest , as it is committed, goes well actually. But I have tried to dig deeper and added some assert statement(*) in requestOffer method for checking inside vc. Then it looked something going wrong.
Here is what happens: Some claims, which is supposed to be in vc object, is missing like below.

{
"nbf" : 1712172643,
"jti" : "urn:uuid:b9ca7966-5841-4087-b9ee-526e19bad68b",
"iss" : "did:web:test.org",
"vc" : {
"type" : [ "VerifiableCredential" ],
"issuer" : "did:web:test.org",
"issuanceDate" : 1712172643192,
"credentialSubject" : { }
}

Maybe it is because mapper is not called properly, where it should be.
OID4VCIssuerEndpoint with getCredential method tries to fetch OID4VCMapper from session with “session.getAllProviders(OID4VCMapper.class)”. But actually it gets empty object and as a result no mapper gets called there.
(*) FYI, added assert statements are something like below at the very last of the requestOffer method in OID4VCIssuerEndpointTest.
        JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialResponse.getCredential(), JsonWebToken.class).getToken();
        assertEquals("did:web:test.org", jsonWebToken.getIssuer());

        VerifiableCredential credential = new ObjectMapper().convertValue(jsonWebToken.getOtherClaims().get("vc"), VerifiableCredential.class);
        assertEquals(List.of("VerifiableCredential"), credential.getType());
        assertEquals(URI.create("did:web:test.org"), credential.getIssuer());
        assertEquals("john@email.cz", credential.getCredentialSubject().getClaims().get("email"));
Hi, thank you, I will check whats happening.

@bucchi
I fixed it in 7beca5e and added your assertions.

ahus1 · 2024-04-08T20:55:01Z

@wistefan - thank, now I understand you situation better. If you run into problems running the test locally, I'm happy to lend a hand for that. Sorry for my comment here which was more harsh than it should have been.

To use the GitHub actions to run the tests, you can start a PR as "draft" and then only those people you mention will get notifications. The notifications to all code owners are then sent out only once you mark it "ready for review".

If you start it as "read to review", and then later switch it to "draft", maintainers will still get notifications, but they can unsubscribe until you switch it to "read for review again".

Best,
Alexander

wistefan · 2024-04-09T05:51:20Z

@wistefan Thank you for your work. Some CI tests failed. Before reviewing the PR, could you revise codes to pass these tests?

@tnorimat I fixed the tests in 3372d3c. The issue happend, because enabling the OID4VCI feature for the test worked on the default test environment(with undertow) but on quarkus(the auth server used in the CI) requires a restart.

tnorimat · 2024-04-15T07:14:24Z

@wistefan Hello, I am back from my business trip in Europe. I will review the PR in this week.

mposolda

@wistefan This is great stuff!

The PR is a bit bigger and I did not reviewed extensively all the aspects of the protocol. Relying on the review of @tnorimat, @francis-pouatcha and @babisRoutis for that. Thanks to all of you for the review!

But overally, seems to me as great stuff. I've added some comments inline (none of them is probably blocker of this PR and some are more a questions, but if you can address them, it can be nice).

Besides that, I hope to merge once @tnorimat reviews and approves this PR.

...s/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java

services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCLoginProtocolFactory.java

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCMapper.java

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

tnorimat

@wistefan Hello,
I partially reviewed the PR and add some comments Could you check them?

Also, I need more time to complete the PR because the size of codes of the PR is big as @mposolda said. I will do my best for it in the week.

tnorimat · 2024-04-17T01:30:20Z

...A-INF/services/org.keycloak.protocol.oid4vc.issuance.signing.VCSigningServiceProviderFactory

@@ -0,0 +1,19 @@
+#
+# Copyright 2016 Red Hat, Inc. and/or its affiliates


2016 might be 2024

Fixed in bbdb87f

tnorimat · 2024-04-17T02:02:40Z

services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java

+     *
+     * @param session                    - keycloak session to be used
+     * @param authenticatedClientSession - client session to be persisted
+     * @param expirationTime             - expiration time of the code, the code should be short-lifed


short-lifed might be short-lived

Fixed in bbdb87f

tnorimat · 2024-04-17T02:03:15Z

services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java

+import org.keycloak.events.EventType;
+import org.keycloak.models.AuthenticatedClientSessionModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.OID4VCClientRegistrationProvider;


OID4VCClientRegistrationProvider might not be used in the class.

Fixed in bbdb87f

tnorimat · 2024-04-17T02:04:46Z

services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java

+        session.getContext().setClient(result.getClientSession().getClient());
+
+
+        // set the client as retrieved from the pre-authorized session


L79-80 mighit be the same as L75-76. Is this duplication needed?

Fixed in bbdb87f

tnorimat · 2024-04-17T02:09:38Z

services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java

+                    Response.Status.BAD_REQUEST);
+        }
+        AuthenticatedClientSessionModel clientSession = result.getClientSession();
+        DefaultClientSessionContext sessionContext = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession,


ClientSessionContext might be better instead of DefaultClientSessionContext

Fixed in bbdb87f

tnorimat · 2024-04-17T08:22:29Z

...arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java

+import static org.junit.Assert.assertEquals;
+
+@EnableFeature(value = Profile.Feature.OID4VC_VCI, skipRestart = true)
+public class PreAuthorizedGrantTest extends AbstractTestRealmKeycloakTest {


It seems that tests do not access Credential Endpoint to get a verifiable credential in return for an access token. I think we need to test this point.

Would you intend not to do such the tests in the PR, but do suche tests in the follwoing PR after the PR is mereged?

I see the actual credential retrieval rather as part of the OID4VCIssuerEndpointTest(where I do test exactly what you mentioned).

Thank you for the clarification.

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

tnorimat

@wistefan I completed the review of the PR. I added some comments. Could you check them?

tnorimat · 2024-04-18T00:04:45Z

services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProvider.java

+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class OID4VCClientRegistrationProvider extends AbstractClientRegistrationProvider {


Could you tell me why OID4VCI specific client OID4VCClient is needed? Compared with a normal client OIDCClientRepresentation, OID4VCClient' adds the following field:

/** * Comma-separated list of supported credentials types */ private List<SupportedCredentialConfiguration> supportedVCTypes;
If so, adding it onto OIDCClientRepresentation is also an option.

Hi, I´m not sure if I fully understand. Beside the supportedVCTypes, it also adds the did of the client. Its used to provide the ability to create credentials focused for clients supporting OID4VC standards, not neccessarily OIDC. Mixing both might be confusing, especially if one only supports one of them.

Thank you for the clarification.

tnorimat · 2024-04-18T00:06:16Z

...ices/src/main/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProviderFactory.java

+
+/**
+ * Implementation of the {@link ClientRegistrationProviderFactory} to integrate the OID4VC protocols with
+ * Keycloaks client-registration.


Keycloaks might be Keycloak's

Fixed in 940c4af

tnorimat · 2024-04-18T00:20:23Z

services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCLoginProtocolFactory.java

+
+    @Override
+    public LoginProtocol create(KeycloakSession session) {
+        return null;


OIDCLoginProtocolFactory returns an instance of OIDCLoginProtocol.
Is it OK to return null here?

We currently support to login with oid4vp in keycloak, thus no such protocl is implemented. As far as I understand this means returning null here is ok.

Thank you for the clarification.

tnorimat · 2024-04-18T04:10:07Z

services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialOfferURI.java

+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class CredentialOfferURI {


According to https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-4.1.3 ,
The format of credential_offer_uri is String.
Could you tell me why the PR defines credential_offer_uri as the class (issuer, nonce). ?

I decided to build it that way, since the retrieval endpoint for that credential_offer_uri is not defined in the spec, just the way how it should be shown to a wallet(from my understanding). We use it to generate the string in the frontend for the qr from it. However, we could add a plain/text endpoint, too, if you think its valuable

Thank you for the clarification.

tnorimat · 2024-04-18T07:02:16Z

services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorType.java

+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public enum ErrorType {


According to https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-7.3.1.2 , error types are as follows:

invalid_credential_request
unsupported_credential_type
unsupported_credential_format
invalid_proof
invalid_encryption_parameters

Probably something changed to an older draft again, I'll updated 940c4af

tnorimat · 2024-04-18T08:13:02Z

...integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/OAuthClient.java

@@ -58,6 +58,8 @@
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
+import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantType;


It seems that it is not used.

Fixed in 42f5903

tnorimat · 2024-04-18T08:14:55Z

...integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/OAuthClient.java

@@ -790,6 +793,27 @@ public AccessTokenResponse doClientCredentialsGrantAccessTokenRequest(String cli
        }
    }

+    public AccessTokenResponse doPreauthorizedTokenRequest(String preAuthorizedCode) throws Exception {


Why it is not used in PreAuthorizedGrantTest ?

Because I wanted to make the usage of the api and its parameters more explicit in the test. E.g. for testing the PreAuthorizedToken Feature, I build the requests in the test, for using the feature in other tests(e.g. the OID4VCI tests), I use the helper method here.

Thank you for the clarification.

tnorimat · 2024-04-18T08:21:21Z

...base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JwtSigningServiceTest.java

@@ -53,7 +52,7 @@
 import static org.junit.Assert.fail;


-public class JwtSigningServiceTest extends SigningServiceTest {
+public class JwtSigningServiceTest extends OID4VCTest {


L76 and L78 are opposite.

Amazing, how are you able to spot such thing!?:) Fixed in 42f5903

tnorimat · 2024-04-18T08:23:52Z

...lian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCTest.java

 import org.keycloak.common.util.CertificateUtils;
 import org.keycloak.common.util.KeyUtils;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.crypto.KeyUse;
 import org.keycloak.crypto.KeyWrapper;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.oid4vc.OID4VCClientRegistrationProviderFactory;


It seems that it is not used.

Fixed in 42f5903

tnorimat · 2024-04-18T08:24:05Z

...lian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCTest.java

 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.util.RoleBuilder;


It seems that it is not used.

Fixed in 42f5903

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

tnorimat

LGTM.

tnorimat · 2024-04-20T06:04:25Z

@wistefan Thank you very much for your work.
@mposolda Could you re-check the PR and merge it if it is OK?

mposolda

@wistefan @tnorimat @francis-pouatcha @babisRoutis Thanks everyone for the update and review of this PR!

wistefan force-pushed the 25940-support-credentials-issuance-through-oid4vci branch from ebf4d68 to f0f5a3d Compare March 15, 2024 12:34

wistefan marked this pull request as ready for review March 15, 2024 12:34

wistefan requested review from a team as code owners March 15, 2024 12:34

keycloak-github-bot bot added team/cloud-native team/core-clients team/core-iam flaky-test labels Mar 15, 2024

keycloak-github-bot bot mentioned this pull request Mar 15, 2024

Flaky test: org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithCRLSignedWithIntermediateCA3FromTruststore #25204

Open

wistefan force-pushed the 25940-support-credentials-issuance-through-oid4vci branch from f0f5a3d to 623a01f Compare March 15, 2024 14:53

babisRoutis reviewed Mar 15, 2024

View reviewed changes

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Outdated Show resolved Hide resolved

babisRoutis reviewed Mar 15, 2024

View reviewed changes

services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java Show resolved Hide resolved

francis-pouatcha suggested changes Mar 18, 2024

View reviewed changes

wistefan force-pushed the 25940-support-credentials-issuance-through-oid4vci branch 3 times, most recently from 640ec67 to f1326dc Compare March 18, 2024 09:06

This was referenced Mar 18, 2024

Flaky test: org.keycloak.testsuite.x509.X509BrowserLoginTest#loginWithRevalidateCertEnabledCertIsTrusted #25444

Open

Flaky test: org.keycloak.testsuite.webauthn.account.WebAuthnTransportLocaleTest#multipleTransports #23884

Closed

wistefan force-pushed the 25940-support-credentials-issuance-through-oid4vci branch 3 times, most recently from f741176 to d527b5e Compare March 18, 2024 14:03

keycloak-github-bot bot mentioned this pull request Mar 18, 2024

Flaky test: org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromFile #25674

Open

keycloak-github-bot bot reviewed Mar 18, 2024

View reviewed changes

wistefan added 12 commits April 8, 2024 14:07

implement oid4vci endpoint

5f32992

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

implement tests

9b62a61

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

implement tests

035a83b

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

add documentation and update tests

d2d3708

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

add documentation and update tests

2275871

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

update pojos, make collections immutable

b82e13c

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

fix mapper initialization

d7b1c64

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

fix merge conflicts

9a2040c

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

fix test

08fbfab

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

fix proof related values

f8467c2

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

fix dependency issues

a85a2fe

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

fix mapper instantiation, add comments

7beca5e

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

wistefan force-pushed the 25940-support-credentials-issuance-through-oid4vci branch from 456ebc0 to 7beca5e Compare April 8, 2024 12:07

restart test after feature activation

3372d3c

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

mposolda reviewed Apr 16, 2024

View reviewed changes

minor improvements

a65798d

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

tnorimat reviewed Apr 17, 2024

View reviewed changes

fix header doc, use ClientSessionContext, code cleanups

bbdb87f

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

tnorimat reviewed Apr 18, 2024

View reviewed changes

wistefan added 3 commits April 19, 2024 10:16

update error types

940c4af

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

cleanups

42f5903

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

more cleanups

0d88edc

Signed-off-by: Stefan Wiedemann <wistefan@googlemail.com>

tnorimat approved these changes Apr 20, 2024

View reviewed changes

mposolda approved these changes Apr 22, 2024

View reviewed changes

mposolda merged commit b08c644 into keycloak:main Apr 22, 2024
65 checks passed

		@@ -0,0 +1,19 @@
		#
		# Copyright 2016 Red Hat, Inc. and/or its affiliates

		session.getContext().setClient(result.getClientSession().getClient());


		// set the client as retrieved from the pre-authorized session

25940 support credentials issuance through oid4vci #27931

25940 support credentials issuance through oid4vci #27931

Conversation

wistefan commented Mar 15, 2024

keycloak-github-bot bot left a comment

Choose a reason for hiding this comment

keycloak-github-bot bot commented Mar 18, 2024

Unreported flaky test detected

org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromHttp

org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithInvalidSignatureCRL

org.keycloak.testsuite.x509.X509BrowserCRLTest#loginWithMultipleRevocationLists

wistefan commented Apr 8, 2024

ahus1 commented Apr 8, 2024

wistefan commented Apr 9, 2024

tnorimat commented Apr 15, 2024

mposolda left a comment

Choose a reason for hiding this comment

tnorimat left a comment • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tnorimat left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tnorimat left a comment

Choose a reason for hiding this comment

tnorimat commented Apr 20, 2024

mposolda left a comment

Choose a reason for hiding this comment

tnorimat left a comment •

edited