@icure/api 5.0.30 → 5.0.32

package/icc-x-api/icc-crypto-x-api.d.ts

@@ -4,6 +4,8 @@ import { RSAUtils } from './crypto/RSA';
 import { ShamirClass } from './crypto/shamir';
 import { Delegation, Device, Document, EncryptedEntity, EncryptedParentEntity, HealthcareParty, Patient, User } from '../icc-api/model/models';
 import { IccMaintenanceTaskXApi } from './icc-maintenance-task-x-api';
+import { StorageFacade } from './storage/StorageFacade';
+import { KeyStorageFacade } from './storage/KeyStorageFacade';
 interface DelegatorAndKeys {
     delegatorId: string;
     key: CryptoKey;
@@ -64,10 +66,12 @@ export declare class IccCryptoXApi {
     private readonly _AES;
     private readonly _RSA;
     private readonly _shamir;
+    private readonly _storage;
+    private readonly _keyStorage;
     constructor(host: string, headers: {
         [key: string]: string;
     }, hcpartyBaseApi: IccHcpartyApi, //Init with a hcparty x api for better performances
-    patientBaseApi: IccPatientApi, deviceBaseApi: IccDeviceApi, crypto?: Crypto);
+    patientBaseApi: IccPatientApi, deviceBaseApi: IccDeviceApi, crypto?: Crypto, storage?: StorageFacade<string>, keyStorage?: KeyStorageFacade);
     loadAllKeysFromLocalStorage(dataOwnerId: string): Promise<void>;
     getCachedRsaKeyPairForFingerprint(dataOwnerId: string, pubKeyOrFingerprint: string): Promise<{
         publicKey: CryptoKey;
@@ -373,18 +377,9 @@ export declare class IccCryptoXApi {
         remote: boolean;
         local: boolean;
     }>;
-    getKeychainInBrowserLocalStorageAsBase64(id: string): string | null;
-    getKeychainValidityDateInBrowserLocalStorage(id: string): string | null;
+    getKeychainInBrowserLocalStorageAsBase64(id: string): string | undefined;
+    getKeychainValidityDateInBrowserLocalStorage(id: string): string | undefined;
     loadKeychainFromBrowserLocalStorage(id: string): Uint8Array[] | null;
-    /**
-     *
-     * @param id
-     * @param keyPair should be JWK
-     */
-    storeKeyPair(id: string, keyPair: {
-        publicKey: any;
-        privateKey: any;
-    }): void;
     /**
      * loads the RSA key pair (hcparty) in JWK from local storage, not imported
      *

package/icc-x-api/icc-crypto-x-api.js

@@ -17,9 +17,11 @@ const _ = require("lodash");
 const models_1 = require("../icc-api/model/models");
 const binary_utils_1 = require("./utils/binary-utils");
 const utils_1 = require("./utils");
+const LocalStorageImpl_1 = require("./storage/LocalStorageImpl");
+const KeyStorageImpl_1 = require("./storage/KeyStorageImpl");
 class IccCryptoXApi {
     constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
-    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}) {
+    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}, storage, keyStorage) {
         this.hcPartyKeysCache = {};
         //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
         //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
@@ -40,6 +42,8 @@ class IccCryptoXApi {
         this._AES = new AES_1.AESUtils(crypto);
         this._RSA = new RSA_1.RSAUtils(crypto);
         this._shamir = new shamir_1.ShamirClass(crypto);
+        this._storage = storage || new LocalStorageImpl_1.LocalStorageImpl();
+        this._keyStorage = keyStorage || new KeyStorageImpl_1.KeyStorageImpl(this._storage);
     }
     get crypto() {
         return this._crypto;
@@ -181,7 +185,7 @@ class IccCryptoXApi {
                 const importedPrivateKey = yield this._RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(decryptedPrivatedKey), ['decrypt']);
                 const importedPublicKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(hcp.publicKey), ['encrypt']);
                 const exportedKeyPair = yield this._RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
-                this.storeKeyPair(hcp.id, exportedKeyPair);
+                this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${hcp.id}`, exportedKeyPair);
             }
             catch (e) {
                 console.log('Cannot decrypt shamir RSA key');
@@ -251,7 +255,7 @@ class IccCryptoXApi {
                     const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId} for pubKey ${fingerprint}: impossible to decrypt`;
                     console.log(reason);
                 }
-            }), Promise.resolve());
+            }), Promise.resolve(undefined));
             const availablePublicKeys = publicKeys.filter((pk) => this.rsaKeyPairs[pk.slice(-32)]);
             if (!result) {
                 //Try to find another key from the transfer keys
@@ -341,8 +345,7 @@ class IccCryptoXApi {
      */
     decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
         return __awaiter(this, void 0, void 0, function* () {
-            const aesExchangeKeys = yield (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
-                (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId))).then((delegatorIdsWithDelegateEncryptedHcPartyKeys) => __awaiter(this, void 0, void 0, function* () {
+            const aesExchangeKeys = yield this.getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId).then((delegatorIdsWithDelegateEncryptedHcPartyKeys) => __awaiter(this, void 0, void 0, function* () {
                 // [key: delegatorId] = delegateEncryptedHcPartyKey
                 // For each delegatorId, obtain the AES key (decrypted HcParty Key) shared with the delegate, decrypted by the delegate
                 return (yield Promise.all(delegatorsHcPartyIdsSet.map((delegatorId) => __awaiter(this, void 0, void 0, function* () {
@@ -472,7 +475,7 @@ class IccCryptoXApi {
                 catch (e) {
                     return undefined;
                 }
-            }), Promise.resolve());
+            }), Promise.resolve(undefined));
             if (!importedAESHcPartyKey) {
                 throw new Error(`No hcParty key can be decrypted from ${delegatorId} to ${delegateHcPartyId} using currently available private keys`);
             }
@@ -827,7 +830,6 @@ class IccCryptoXApi {
         }
         const eckeysForAllDelegates = document.encryptionKeys;
         if (!eckeysForAllDelegates || !Object.keys(eckeysForAllDelegates).length) {
-            //console.log(`There is no encryption key in document (${document.id})`)
             return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
         }
         return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, eckeysForAllDelegates);
@@ -912,7 +914,7 @@ class IccCryptoXApi {
             return { extractedKeys: extractedKeys.concat(parentExtractedKeys.extractedKeys), hcpartyId: (_a = parentExtractedKeys.hcpartyId) !== null && _a !== void 0 ? _a : dataOwnerId };
         })))
             .catch((e) => {
-            console.error(`Dataowner with id ${dataOwnerId} cannot be resolved`);
+            console.error(`DataOwner with id ${dataOwnerId} cannot be resolved`);
             throw e;
         });
     }
@@ -930,20 +932,24 @@ class IccCryptoXApi {
             // Find other keys through aesExchangeKeys
             const dataOwnerPubKeys = yield this.getPublicKeys();
             const keysToDecrypt = (0, utils_1.fold)(Object.entries(dataOwner.aesExchangeKeys), {}, (acc, [pub, aesForPub]) => {
-                Object.entries(aesForPub).forEach(([delegateId, aesKeys]) => {
-                    if (delegateId != dataOwner.id) {
-                        const aesAcc = {};
-                        Object.entries(aesKeys)
-                            .filter(([encrPubKey]) => dataOwnerPubKeys.some((pubKey) => pubKey.slice(-32) == encrPubKey))
-                            .forEach(([pubKeyFingerprint, aesEncr]) => {
-                            aesAcc[pubKeyFingerprint] = aesEncr;
-                        });
-                        if (acc[delegateId] == undefined) {
-                            acc[delegateId] = {};
+                if (dataOwnerPubKeys.find((pubKey) => pubKey.slice(-32) == pub.slice(-32)) == undefined) {
+                    // We get AES Keys only from delegates of keys we don't currently have
+                    // Otherwise, decrypted AES Keys would have previously worked
+                    Object.entries(aesForPub).forEach(([delegateId, aesKeys]) => {
+                        if (delegateId != dataOwner.id) {
+                            const aesAcc = {};
+                            Object.entries(aesKeys)
+                                .filter(([encrPubKey]) => dataOwnerPubKeys.some((pubKey) => pubKey.slice(-32) == encrPubKey))
+                                .forEach(([pubKeyFingerprint, aesEncr]) => {
+                                aesAcc[pubKeyFingerprint] = aesEncr;
+                            });
+                            if (acc[delegateId] == undefined) {
+                                acc[delegateId] = {};
+                            }
+                            acc[delegateId][pub] = aesAcc;
                         }
-                        acc[delegateId][pub] = aesAcc;
-                    }
-                });
+                    });
+                }
                 return acc;
             });
             const decryptedAndImportedAesHcPartyKeys = yield (0, utils_1.foldAsync)(Object.entries(keysToDecrypt), [], (delKeysAcc, [delegateId, keysForDelegate]) => __awaiter(this, void 0, void 0, function* () {
@@ -1010,10 +1016,9 @@ class IccCryptoXApi {
                         }
                         catch (err) {
                             console.log(`Could not decrypt generic delegation in object with ID: ${masterId} from ${genericDelegationItem.owner} to ${genericDelegationItem.delegatedTo}: ${err}`);
-                            console.log(`AES key is: ${aesKey.rawKey}. Encrypted data is ${genericDelegationItem.key}.`);
                             return undefined;
                         }
-                    }), Promise.resolve());
+                    }), Promise.resolve(undefined));
                 }
                 else {
                     console.log(`Could not find aes key for object with ID: ${masterId}`);
@@ -1046,7 +1051,7 @@ class IccCryptoXApi {
             const keyPair = yield this._RSA.importKeyPair('jwk', privateKeyInJwk, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
             this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
             const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-            return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
+            return this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
         });
     }
     loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privateKey) {
@@ -1063,7 +1068,7 @@ class IccCryptoXApi {
             const keyPair = yield this._RSA.importKeyPair('jwk', privateKey, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
             this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
             const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-            return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
+            return this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
         });
     }
     // noinspection JSUnusedGlobalSymbols
@@ -1084,20 +1089,20 @@ class IccCryptoXApi {
     }
     // noinspection JSUnusedGlobalSymbols
     saveKeychainInBrowserLocalStorage(id, keychain) {
-        localStorage.setItem(this.keychainLocalStoreIdPrefix + id, (0, binary_utils_1.b2a)(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
+        this._storage.setItem(this.keychainLocalStoreIdPrefix + id, (0, binary_utils_1.b2a)(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
     }
     saveKeychainInBrowserLocalStorageAsBase64(id, keyChainB64) {
-        localStorage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64);
+        this._storage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64);
     }
     // noinspection JSUnusedGlobalSymbols
     saveKeychainValidityDateInBrowserLocalStorage(id, date) {
         if (!id)
             return;
         if (!date) {
-            localStorage.removeItem(this.keychainValidityDateLocalStoreIdPrefix + id);
+            this._storage.deleteItem(this.keychainValidityDateLocalStoreIdPrefix + id);
         }
         else {
-            localStorage.setItem(this.keychainValidityDateLocalStoreIdPrefix + id, date);
+            this._storage.setItem(this.keychainValidityDateLocalStoreIdPrefix + id, date);
         }
     }
     /**
@@ -1203,28 +1208,15 @@ class IccCryptoXApi {
         });
     }
     getKeychainInBrowserLocalStorageAsBase64(id) {
-        return localStorage.getItem(this.keychainLocalStoreIdPrefix + id);
+        return this._storage.getItem(this.keychainLocalStoreIdPrefix + id);
     }
     getKeychainValidityDateInBrowserLocalStorage(id) {
-        return localStorage.getItem(this.keychainValidityDateLocalStoreIdPrefix + id);
+        return this._storage.getItem(this.keychainValidityDateLocalStoreIdPrefix + id);
     }
     // noinspection JSUnusedGlobalSymbols
     loadKeychainFromBrowserLocalStorage(id) {
-        const lsItem = localStorage.getItem('org.taktik.icure.ehealth.keychain.' + id);
-        return lsItem !== null ? (0, binary_utils_1.b64_2uas)(lsItem) : null;
-    }
-    /**
-     *
-     * @param id
-     * @param keyPair should be JWK
-     */
-    storeKeyPair(id, keyPair) {
-        if (typeof Storage === 'undefined') {
-            console.log('Your browser does not support HTML5 Browser Local Storage !');
-            throw 'Your browser does not support HTML5 Browser Local Storage !';
-        }
-        //TODO encryption
-        localStorage.setItem(this.rsaLocalStoreIdPrefix + id, JSON.stringify(keyPair));
+        const lsItem = this._storage.getItem(this.keychainLocalStoreIdPrefix + id);
+        return lsItem !== undefined ? (0, binary_utils_1.b64_2uas)(lsItem) : null;
     }
     /**
      * loads the RSA key pair (hcparty) in JWK from local storage, not imported
@@ -1240,11 +1232,13 @@ class IccCryptoXApi {
             throw 'Your browser does not support HTML5 Browser Local Storage !';
         }
         //TODO decryption
-        const item = (_a = (publicKeyFingerPrint && localStorage.getItem(this.rsaLocalStoreIdPrefix + id + '.' + publicKeyFingerPrint.slice(-32)))) !== null && _a !== void 0 ? _a : localStorage.getItem(this.rsaLocalStoreIdPrefix + id);
+        const item = publicKeyFingerPrint
+            ? (_a = this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id + '.' + publicKeyFingerPrint.slice(-32))) !== null && _a !== void 0 ? _a : this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id)
+            : this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
         if (!item) {
             console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`);
         }
-        return JSON.parse(item);
+        return item;
     }
     /**
      * Loads and imports the RSA key pair (hcparty) from local storage
@@ -1255,24 +1249,23 @@ class IccCryptoXApi {
     loadKeyPairImported(id) {
         return new Promise((resolve, reject) => {
             try {
-                const jwkKey = localStorage.getItem(this.rsaLocalStoreIdPrefix + id);
-                if (jwkKey) {
-                    const jwkKeyPair = JSON.parse(jwkKey);
+                const jwkKeyPair = this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
+                if (jwkKeyPair !== undefined) {
                     if (jwkKeyPair.publicKey && jwkKeyPair.privateKey) {
                         this._RSA.importKeyPair('jwk', jwkKeyPair.privateKey, 'jwk', jwkKeyPair.publicKey).then(resolve, (err) => {
-                            console.log('Error in RSA.importKeyPair: ' + err);
+                            console.error('Error in RSA.importKeyPair: ' + err);
                             reject(err);
                         });
                     }
                     else {
                         const message = 'Error in RSA.importKeyPair: Invalid key';
-                        console.log(message);
+                        console.error(message);
                         reject(Error(message));
                     }
                 }
                 else {
                     const message = 'Error in RSA.importKeyPair: Missing key';
-                    console.log(message);
+                    console.error(message);
                     reject(Error(message));
                 }
             }
@@ -1375,9 +1368,11 @@ class IccCryptoXApi {
             const { type: ownerType, dataOwner: ownerToUpdate } = yield this.createOrUpdateAesExchangeKeysFor(cdo, gen, {
                 pubKey: keypair.publicKey,
                 privKey: keypair.privateKey,
-            }).then((dataOwnerWithUpdatedAesKeys) => generateTransferKey
-                ? this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: keypair.publicKey, privKey: keypair.privateKey })
-                : dataOwnerWithUpdatedAesKeys);
+            }).then((dataOwnerWithUpdatedAesKeys) => __awaiter(this, void 0, void 0, function* () {
+                return generateTransferKey
+                    ? yield this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: keypair.publicKey, privKey: keypair.privateKey })
+                    : dataOwnerWithUpdatedAesKeys;
+            }));
             const modifiedDataOwnerAndType = yield this._saveDataOwner({ type: ownerType, dataOwner: ownerToUpdate });
             const sentMaintenanceTasks = sendMaintenanceTasks
                 ? yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, keypair.publicKey)
@@ -1451,6 +1446,7 @@ class IccCryptoXApi {
         });
     }
     retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {
+        this.emptyHcpCache(dataOwnerToUpdate.id);
         return this.getDataOwner(dataOwnerToUpdate.id).then(({ type, dataOwner }) => {
             var _a, _b, _c, _d;
             return {
@@ -1486,16 +1482,16 @@ class IccCryptoXApi {
                         });
                     });
                 });
-                const tasksForDelegator = (yield this._getDelegateIdsOf(dataOwner)).map((delegateId) => {
+                const tasksForDelegator = (yield this._getDelegateIdsOf(dataOwner))
+                    .filter((delegateId) => delegateId != dataOwner.id)
+                    .map((delegateId) => {
                     return { delegateId: delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, hexNewPubKey) };
                 });
-                return Promise.all(tasksForDelegates
-                    .concat(tasksForDelegator)
-                    .map(({ delegateId, maintenanceTask }) => __awaiter(this, void 0, void 0, function* () {
-                    const taskToCreate = yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.newInstance(user, maintenanceTask, [delegateId]));
-                    return taskToCreate ? maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.createMaintenanceTaskWithUser(user, taskToCreate) : undefined;
-                }))
-                    .filter((createdTask) => createdTask != undefined));
+                return yield tasksForDelegates.concat(tasksForDelegator).reduce((existingTasks, task) => __awaiter(this, void 0, void 0, function* () {
+                    const taskToCreate = yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.newInstance(user, task.maintenanceTask, [task.delegateId]));
+                    const createdTask = taskToCreate ? yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.createMaintenanceTaskWithUser(user, taskToCreate)) : undefined;
+                    return createdTask ? (yield existingTasks).concat(createdTask) : yield existingTasks;
+                }), Promise.resolve([]));
             }
             else {
                 return [];
@@ -1545,8 +1541,11 @@ class IccCryptoXApi {
                 this.getDataOwner(ownerId),
                 this.getDataOwner(delegateId),
             ]);
-            const ownerLegacyPublicKey = owner.publicKey;
             const availablePublicKeysFingerprints = Object.keys(this.rsaKeyPairs);
+            const ownerLegacyPublicKey = owner.publicKey;
+            const isOwnerLegacyPublicKeyAvailable = ownerLegacyPublicKey
+                ? availablePublicKeysFingerprints.some((fp) => ownerLegacyPublicKey.endsWith(fp))
+                : false;
             const availableOwnerPublicKeys = [
                 ownerLegacyPublicKey,
                 ...Object.keys(owner.aesExchangeKeys || {}).filter((x) => x !== ownerLegacyPublicKey),
@@ -1583,7 +1582,7 @@ class IccCryptoXApi {
                 const encryptedAesKeys = yield allPubKeys.reduce((map, pubK) => __awaiter(this, void 0, void 0, function* () {
                     return (Object.assign(Object.assign({}, (yield map)), { [pubK.slice(-32)]: (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubK)), ['encrypt']), (0, binary_utils_1.hex2ua)(AESKey))) }));
                 }), Promise.resolve({}));
-                if (delegate.publicKey && ownerLegacyPublicKey) {
+                if (delegate.publicKey && ownerLegacyPublicKey && isOwnerLegacyPublicKeyAvailable) {
                     owner.hcPartyKeys[delegateId] = [encryptedAesKeys[ownerLegacyPublicKey.slice(-32)], encryptedAesKeys[delegate.publicKey.slice(-32)]];
                 }
                 owner.aesExchangeKeys = Object.assign(Object.assign({}, (ownerCombinedAesExchangeKeys !== null && ownerCombinedAesExchangeKeys !== void 0 ? ownerCombinedAesExchangeKeys : {})), { [selectedPublicKey]: Object.assign(Object.assign({}, ((_g = (_f = owner.aesExchangeKeys) === null || _f === void 0 ? void 0 : _f[selectedPublicKey]) !== null && _g !== void 0 ? _g : {})), { [delegateId]: encryptedAesKeys }) });