@icure/api 5.0.23 → 5.0.25

package/icc-x-api/icc-crypto-x-api.js

@@ -879,7 +879,8 @@ class IccCryptoXApi {
     extractKeysFromDelegationsForHcpHierarchy(
     //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
     dataOwnerId, objectId, delegations) {
-        return this.getDataOwner(dataOwnerId).then(({ dataOwner: hcp }) => (delegations[dataOwnerId] && delegations[dataOwnerId].length
+        return this.getDataOwner(dataOwnerId)
+            .then(({ dataOwner: hcp }) => (delegations[dataOwnerId] && delegations[dataOwnerId].length
             ? this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
                 const collatedAesKeysFromDelegatorToHcpartyId = {};
                 decryptedAndImportedAesHcPartyKeys.forEach((k) => {
@@ -889,11 +890,74 @@ class IccCryptoXApi {
                 });
                 return this.decryptKeyInDelegationLikes(delegations[dataOwnerId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
             })
-            : Promise.resolve([])).then((extractedKeys) => hcp.parentId
-            ? this.extractKeysFromDelegationsForHcpHierarchy(hcp.parentId, objectId, delegations).then((parentResponse) => _.assign(parentResponse, {
-                extractedKeys: parentResponse.extractedKeys.concat(extractedKeys),
-            }))
-            : { extractedKeys: extractedKeys, hcpartyId: dataOwnerId }));
+            : Promise.resolve([]))
+            .then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
+            if (extractedKeys.length == 0) {
+                return yield this._extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(hcp, delegations, objectId);
+            }
+            return extractedKeys;
+        }))
+            .then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const parentExtractedKeys = hcp.parentId
+                ? yield this.extractKeysFromDelegationsForHcpHierarchy(hcp.parentId, objectId, delegations)
+                : { extractedKeys: [], hcpartyId: undefined };
+            return { extractedKeys: extractedKeys.concat(parentExtractedKeys.extractedKeys), hcpartyId: (_a = parentExtractedKeys.hcpartyId) !== null && _a !== void 0 ? _a : dataOwnerId };
+        })))
+            .catch((e) => {
+            console.error(`Dataowner with id ${dataOwnerId} cannot be resolved`);
+            throw e;
+        });
+    }
+    /**
+     * This method covers the use case when a DataOwner found back access to its data, and needs to use the delegations of its delegates instead
+     * of its own ones
+     *
+     * @param dataOwner The current data owner from whom we want to decrypt the aesExchangeKeys
+     * @param delegations The object delegations to decrypt
+     * @param objectId The object to decrypt id
+     * @private
+     */
+    _extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(dataOwner, delegations, objectId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Find other keys through aesExchangeKeys
+            const dataOwnerPubKeys = yield this.getPublicKeys();
+            const keysToDecrypt = (0, utils_1.fold)(Object.entries(dataOwner.aesExchangeKeys), {}, (acc, [pub, aesForPub]) => {
+                Object.entries(aesForPub).forEach(([delegateId, aesKeys]) => {
+                    if (delegateId != dataOwner.id) {
+                        const aesAcc = {};
+                        Object.entries(aesKeys)
+                            .filter(([encrPubKey]) => dataOwnerPubKeys.some((pubKey) => pubKey.slice(-32) == encrPubKey))
+                            .forEach(([pubKeyFingerprint, aesEncr]) => {
+                            aesAcc[pubKeyFingerprint] = aesEncr;
+                        });
+                        if (acc[delegateId] == undefined) {
+                            acc[delegateId] = {};
+                        }
+                        acc[delegateId][pub] = aesAcc;
+                    }
+                });
+                return acc;
+            });
+            const decryptedAndImportedAesHcPartyKeys = yield (0, utils_1.foldAsync)(Object.entries(keysToDecrypt), [], (delKeysAcc, [delegateId, keysForDelegate]) => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    delKeysAcc.push(yield this.decryptAnyAesExchangeKeyForOwner(keysForDelegate, dataOwner.id, dataOwner.id, delegateId, dataOwnerPubKeys));
+                }
+                catch (e) {
+                    console.log(`Could not decrypt aesExchangeKeys for delegate ${delegateId}`);
+                }
+                return delKeysAcc;
+            }));
+            const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce((map, k) => { var _a; return (Object.assign(Object.assign({}, map), { [k.delegatorId]: ((_a = map[k.delegatorId]) !== null && _a !== void 0 ? _a : []).concat([k]) })); }, {});
+            const delegateIdsWithNewExtractedAesKeys = Object.keys(keysToDecrypt);
+            const delegationsToDecrypt = (0, utils_1.fold)(Object.entries(delegations), [], (acc, [delegateId, del]) => {
+                if (delegateIdsWithNewExtractedAesKeys.find((id) => id == delegateId) != undefined) {
+                    acc.push(...delegations[delegateId]);
+                }
+                return acc;
+            });
+            return this.decryptKeyInDelegationLikes(delegationsToDecrypt, collatedAesKeysFromDelegatorToHcpartyId, objectId);
+        });
     }
     /**
      * Gets an array of generic secret IDs decrypted from a list of generic delegations (SPKs, CFKs, EKs) `delegationsArray`
@@ -990,7 +1054,7 @@ class IccCryptoXApi {
             }
             const publicKey = this.getPublicKeyFromPrivateKey(privateKey, dataOwner);
             const keyPair = yield this._RSA.importKeyPair('jwk', privateKey, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
-            this.rsaKeyPairs[healthcarePartyId] = keyPair;
+            this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
             const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
             return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
         });
@@ -1210,6 +1274,66 @@ class IccCryptoXApi {
             }
         });
     }
+    /**
+     * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
+     * AES key using the new user public key.
+     *
+     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
+     * @param ownerId Id of the data owner to which we would like to give access back
+     * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
+     *
+     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
+     */
+    giveAccessBackTo(delegateUser, ownerId, ownerNewPublicKey) {
+        var _a, _b, _c, _d;
+        return __awaiter(this, void 0, void 0, function* () {
+            const delegateId = (_b = (_a = delegateUser.healthcarePartyId) !== null && _a !== void 0 ? _a : delegateUser.patientId) !== null && _b !== void 0 ? _b : delegateUser.deviceId;
+            if (!delegateId) {
+                throw new Error(`DelegateUser ${delegateUser.id} must be a data Owner`);
+            }
+            const delegatePublicKeys = yield this.getPublicKeys();
+            const newPubKeyCryptoKey = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(ownerNewPublicKey)), ['encrypt']);
+            const dataOwnerToUpdate = yield this.getDataOwner(ownerId);
+            const newAesExchangeKeys = yield (0, utils_1.foldAsync)(Object.entries((_c = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => __awaiter(this, void 0, void 0, function* () {
+                var _e;
+                const existingKeys = (_e = pubAcc[pubKey]) !== null && _e !== void 0 ? _e : {};
+                pubAcc[pubKey] = yield (0, utils_1.foldAsync)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => __awaiter(this, void 0, void 0, function* () {
+                    if (delId == delegateId && pubKey != ownerNewPublicKey) {
+                        // Add the AES Key encrypted with the new public key in the aesExchangeKeys
+                        try {
+                            // First, we decrypt it using the delegate RSA Public Key
+                            const encrAesKeyInfo = yield this.decryptHcPartyKey(delegateId, dataOwnerToUpdate.dataOwner.id, delegateId, pubKey, delKeys, delegatePublicKeys).then((delegatorAndKeys) => __awaiter(this, void 0, void 0, function* () {
+                                // Then, we encrypt it using the owner new RSA Public Key (provided in argument)
+                                return yield this.encryptAesKeyOnlyForProvidedKeys(delegatorAndKeys === null || delegatorAndKeys === void 0 ? void 0 : delegatorAndKeys.rawKey, dataOwnerToUpdate, [newPubKeyCryptoKey])
+                                    .then((encrAes) => Object.values(encrAes)[0])
+                                    .then((encrAesInfo) => {
+                                    return { pubKeyUsedToEncryptAes: Object.keys(encrAesInfo)[0], encryptedAes: Object.values(encrAesInfo)[0] };
+                                });
+                            }));
+                            delKeys[encrAesKeyInfo.pubKeyUsedToEncryptAes] = encrAesKeyInfo.encryptedAes;
+                        }
+                        catch (e) {
+                            console.log(`${delegateId} could not re-encrypt AES Key of ${dataOwnerToUpdate.dataOwner.id}`);
+                        }
+                        finally {
+                            delAcc[delId] = delKeys;
+                        }
+                    }
+                    else {
+                        // Otherwise, we don't transform the aesExchangeKeys for this delegate
+                        delAcc[delId] = delKeys;
+                    }
+                    return delAcc;
+                }));
+                return pubAcc;
+            }));
+            // After adding the potential new aesExchangeKeys, we save the updated data owner
+            return this._saveDataOwner({
+                type: dataOwnerToUpdate.type,
+                dataOwner: Object.assign(Object.assign({}, dataOwnerToUpdate.dataOwner), { aesExchangeKeys: newAesExchangeKeys }),
+            });
+        });
+    }
     addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true) {
         return __awaiter(this, void 0, void 0, function* () {
             return this.addNewKeyPairForOwner(maintenanceTasksApi, user, yield this.getDataOwner(ownerId), generateTransferKey);
@@ -1227,7 +1351,22 @@ class IccCryptoXApi {
             }).then((dataOwnerWithUpdatedAesKeys) => generateTransferKey
                 ? this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: publicKey, privKey: privateKey })
                 : dataOwnerWithUpdatedAesKeys);
-            const modifiedDataOwnerAndType = ownerType === 'hcp'
+            const modifiedDataOwnerAndType = yield this._saveDataOwner({ type: ownerType, dataOwner: ownerToUpdate });
+            const sentMaintenanceTasks = yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, publicKey);
+            return {
+                dataOwner: sentMaintenanceTasks.length
+                    ? yield this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
+                    : modifiedDataOwnerAndType.dataOwner,
+                publicKey: publicKeyHex,
+                privateKey: (0, binary_utils_1.ua2hex)((yield this.RSA.exportKey(privateKey, 'pkcs8'))),
+            };
+        });
+    }
+    _saveDataOwner(dataOwner) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const ownerType = dataOwner.type;
+            const ownerToUpdate = dataOwner.dataOwner;
+            return ownerType === 'hcp'
                 ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.hcpartyBaseApi
                     .modifyHealthcareParty(ownerToUpdate)
                     .then((x) => ({ type: 'hcp', dataOwner: x })))
@@ -1238,14 +1377,6 @@ class IccCryptoXApi {
                     : yield (this.dataOwnerCache[ownerToUpdate.id] = this.deviceBaseApi
                         .updateDevice(ownerToUpdate)
                         .then((x) => ({ type: 'device', dataOwner: x })));
-            const sentMaintenanceTasks = yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, publicKey);
-            return {
-                dataOwner: sentMaintenanceTasks.length
-                    ? yield this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
-                    : modifiedDataOwnerAndType.dataOwner,
-                publicKey: publicKeyHex,
-                privateKey: (0, binary_utils_1.ua2hex)((yield this.RSA.exportKey(privateKey, 'pkcs8'))),
-            };
         });
     }
     createOrUpdateAesExchangeKeysFor(cdo, decryptedAesExchangeKey, keyToEncrypt) {
@@ -1278,11 +1409,16 @@ class IccCryptoXApi {
     encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
         return __awaiter(this, void 0, void 0, function* () {
             const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
-            const encrAes = {};
-            for (const pubKey of dataOwnerAllPubKeys) {
+            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerAllPubKeys);
+        });
+    }
+    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerPubKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const encryptedAesForDataOwner = yield (0, utils_1.foldAsync)(dataOwnerPubKeys, {}, (encrAes, pubKey) => __awaiter(this, void 0, void 0, function* () {
                 encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
-            }
-            return { [dataOwner.id]: encrAes };
+                return encrAes;
+            }));
+            return { [dataOwner.id]: encryptedAesForDataOwner };
         });
     }
     retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {