@icure/api 5.0.1 → 5.0.4

package/icc-x-api/icc-crypto-x-api.d.ts

@@ -326,8 +326,9 @@ export declare class IccCryptoXApi {
             rawKey: string;
         }[];
     }, masterId: string): Promise<Array<string>>;
+    getPublicKeyFromPrivateKey(privateKey: JsonWebKey, dataOwner: Patient | Device | HealthcareParty): string;
     loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId: string, privateKey: Uint8Array): Promise<void>;
-    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId: string, privKey: JsonWebKey): Promise<void>;
+    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId: string, privateKey: JsonWebKey): Promise<void>;
     loadKeyPairsInBrowserLocalStorage(healthcarePartyId: string, file: Blob): Promise<void>;
     saveKeychainInBrowserLocalStorage(id: string, keychain: number): void;
     saveKeychainInBrowserLocalStorageAsBase64(id: string, keyChainB64: string): void;
@@ -368,9 +369,10 @@ export declare class IccCryptoXApi {
      * loads the RSA key pair (hcparty) in JWK from local storage, not imported
      *
      * @param id  doc id - hcpartyId
+     * @param publicKeyFingerPrint the 32 last characters of public key this private key is associated with
      * @returns {Object} it is in JWK - not imported
      */
-    loadKeyPairNotImported(id: string): {
+    loadKeyPairNotImported(id: string, publicKeyFingerPrint?: string): {
         publicKey: JsonWebKey;
         privateKey: JsonWebKey;
     };

package/icc-x-api/icc-crypto-x-api.js

@@ -200,7 +200,7 @@ class IccCryptoXApi {
                     return delegatorAndKeys;
                 }
                 const fingerprint = pk.slice(-32);
-                const keyPair = (_b = this.rsaKeyPairs[fingerprint]) !== null && _b !== void 0 ? _b : (yield this.cacheKeyPair(this.loadKeyPairNotImported(loggedHcPartyId)));
+                const keyPair = (_b = this.rsaKeyPairs[fingerprint]) !== null && _b !== void 0 ? _b : (yield this.cacheKeyPair(this.loadKeyPairNotImported(loggedHcPartyId, fingerprint)));
                 if (!keyPair) {
                     return;
                 }
@@ -918,38 +918,48 @@ class IccCryptoXApi {
             return Promise.all(decryptPromises).then((genericSecretId) => genericSecretId.filter((id) => !!id));
         });
     }
+    getPublicKeyFromPrivateKey(privateKey, dataOwner) {
+        var _a;
+        if (!privateKey.n || !privateKey.e) {
+            throw new Error('No public key can be deduced from incomplete private key');
+        }
+        const publicKeyFromPrivateKey = (0, utils_1.jwk2spki)(privateKey);
+        const publicKeys = [dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x);
+        if (!publicKeys.length) {
+            throw new Error('No public key has been defined for hcp');
+        }
+        const publicKey = publicKeys.find((it) => it === publicKeyFromPrivateKey);
+        if (!publicKey) {
+            throw new Error('No public key can be found for this private key');
+        }
+        return publicKey;
+    }
     loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, privateKey) {
-        return this.getDataOwner(healthcarePartyId)
-            .then(({ dataOwner }) => __awaiter(this, void 0, void 0, function* () {
-            const publicKey = yield dataOwner.publicKey;
-            if (!publicKey) {
-                throw new Error('No public key has been defined for hcp');
-            }
-            return this._RSA.importKeyPair('jwk', (0, utils_1.pkcs8ToJwk)(privateKey), 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
-        }))
-            .then((keyPair) => {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
+            const privateKeyInJwk = (0, utils_1.pkcs8ToJwk)(privateKey);
+            const publicKey = this.getPublicKeyFromPrivateKey(privateKeyInJwk, dataOwner);
+            const keyPair = yield this._RSA.importKeyPair('jwk', privateKeyInJwk, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
             this.rsaKeyPairs[healthcarePartyId] = keyPair;
-            return this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-        })
-            .then((exportedKeyPair) => {
-            return this.storeKeyPair(healthcarePartyId, exportedKeyPair);
+            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
+            return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
         });
     }
-    // noinspection JSUnusedGlobalSymbols
-    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privKey) {
-        return this.getDataOwner(healthcarePartyId)
-            .then(({ dataOwner }) => {
-            const pubKey = (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(dataOwner.publicKey));
-            privKey.n = pubKey.n;
-            privKey.e = pubKey.e;
-            return this._RSA.importKeyPair('jwk', privKey, 'jwk', pubKey);
-        })
-            .then((keyPair) => {
+    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privateKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
+            if ((!privateKey.n || !privateKey.e) && dataOwner.publicKey) {
+                //Fallback on default publicKey
+                console.warn('An incomplete key has been completed using the default public key of the data owner');
+                const publicKeyInJwk = (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(dataOwner.publicKey));
+                privateKey.n = publicKeyInJwk.n;
+                privateKey.e = publicKeyInJwk.e;
+            }
+            const publicKey = this.getPublicKeyFromPrivateKey(privateKey, dataOwner);
+            const keyPair = yield this._RSA.importKeyPair('jwk', privateKey, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
             this.rsaKeyPairs[healthcarePartyId] = keyPair;
-            return this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-        })
-            .then((exportedKeyPair) => {
-            return this.storeKeyPair(healthcarePartyId, exportedKeyPair);
+            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
+            return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
         });
     }
     // noinspection JSUnusedGlobalSymbols
@@ -1116,15 +1126,21 @@ class IccCryptoXApi {
      * loads the RSA key pair (hcparty) in JWK from local storage, not imported
      *
      * @param id  doc id - hcpartyId
+     * @param publicKeyFingerPrint the 32 last characters of public key this private key is associated with
      * @returns {Object} it is in JWK - not imported
      */
-    loadKeyPairNotImported(id) {
+    loadKeyPairNotImported(id, publicKeyFingerPrint) {
+        var _a;
         if (typeof Storage === 'undefined') {
             console.log('Your browser does not support HTML5 Browser Local Storage !');
             throw 'Your browser does not support HTML5 Browser Local Storage !';
         }
         //TODO decryption
-        return JSON.parse(localStorage.getItem(this.rsaLocalStoreIdPrefix + id) || '{}');
+        const item = (_a = (publicKeyFingerPrint && localStorage.getItem(this.rsaLocalStoreIdPrefix + id + '.' + publicKeyFingerPrint))) !== null && _a !== void 0 ? _a : localStorage.getItem(this.rsaLocalStoreIdPrefix + id);
+        if (!item) {
+            console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`);
+        }
+        return JSON.parse(item);
     }
     /**
      * Loads and imports the RSA key pair (hcparty) from local storage
@@ -1415,22 +1431,28 @@ class IccCryptoXApi {
     }
     // noinspection JSUnusedGlobalSymbols
     checkPrivateKeyValidity(dataOwner) {
-        return new Promise((resolve) => {
-            this._RSA
-                .importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(dataOwner.publicKey)), ['encrypt'])
-                .then((k) => this._RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth')))
-                .then((cipher) => {
-                const kp = this.loadKeyPairNotImported(dataOwner.id);
-                return this._RSA
-                    .importKeyPair('jwk', kp.privateKey, 'jwk', kp.publicKey)
-                    .then((ikp) => this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)));
-            })
-                .then((plainText) => {
-                const pt = (0, binary_utils_1.ua2utf8)(plainText);
-                console.log(pt);
-                resolve(pt === 'shibboleth');
-            })
-                .catch(() => resolve(false));
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = Array.from(new Set([dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x)));
+            return yield publicKeys.reduce((pres, publicKey) => __awaiter(this, void 0, void 0, function* () {
+                const res = yield pres;
+                if (res) {
+                    return true;
+                }
+                try {
+                    const k = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)), ['encrypt']);
+                    const cipher = yield this._RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth'));
+                    const kp = this.loadKeyPairNotImported(dataOwner.id, publicKey.slice(-32));
+                    const plainText = yield this._RSA
+                        .importKeyPair('jwk', kp.privateKey, 'jwk', kp.publicKey)
+                        .then((ikp) => this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)))
+                        .then((x) => (0, binary_utils_1.ua2utf8)(x));
+                    return plainText === 'shibboleth';
+                }
+                catch (e) {
+                    return false;
+                }
+            }), Promise.resolve(false));
         });
     }
     throwDetailedExceptionForInvalidParameter(argName, argValue, methodName, methodArgs) {