@icure/api 5.2.35 → 5.3.0

package/icc-x-api/icc-crypto-x-api.d.ts

@@ -407,13 +407,11 @@ export declare class IccCryptoXApi {
      * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
      * AES key using the new user public key.
      *
-     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
-     * @param ownerId Id of the data owner to which we would like to give access back
+     * @param accessGiver User, in charge of giving access back to the person who previously gave him some access (should be the current user)
+     * @param ownerId Id of the data owner to which we would like to get access back
      * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
-     *
-     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
      */
-    giveAccessBackTo(delegateUser: User, ownerId: string, ownerNewPublicKey: string): Promise<CachedDataOwner>;
+    giveAccessBackTo(accessGiver: User, ownerId: string, ownerNewPublicKey: string): Promise<void>;
     addNewKeyPairForOwnerId(maintenanceTasksApi: IccMaintenanceTaskXApi, user: User, ownerId: string, generateTransferKey?: boolean, sendMaintenanceTasks?: boolean): Promise<{
         dataOwner: HealthcareParty | Patient | Device;
         publicKey: string;

package/icc-x-api/icc-crypto-x-api.js

@@ -1287,60 +1287,56 @@ class IccCryptoXApi {
      * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
      * AES key using the new user public key.
      *
-     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
-     * @param ownerId Id of the data owner to which we would like to give access back
+     * @param accessGiver User, in charge of giving access back to the person who previously gave him some access (should be the current user)
+     * @param ownerId Id of the data owner to which we would like to get access back
      * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
-     *
-     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
      */
-    giveAccessBackTo(delegateUser, ownerId, ownerNewPublicKey) {
-        var _a, _b, _c, _d;
+    giveAccessBackTo(accessGiver, ownerId, ownerNewPublicKey) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            const delegateId = (_b = (_a = delegateUser.healthcarePartyId) !== null && _a !== void 0 ? _a : delegateUser.patientId) !== null && _b !== void 0 ? _b : delegateUser.deviceId;
-            if (!delegateId) {
-                throw new Error(`DelegateUser ${delegateUser.id} must be a data Owner`);
+            const newPubKeyCryptoKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(ownerNewPublicKey), ['encrypt']);
+            const giverDoId = (_b = (_a = accessGiver.healthcarePartyId) !== null && _a !== void 0 ? _a : accessGiver.patientId) !== null && _b !== void 0 ? _b : accessGiver.deviceId;
+            if (!giverDoId) {
+                throw new Error(`Access giver ${accessGiver.id} must be a data Owner`);
             }
-            const delegatePublicKeys = yield this.getPublicKeys();
-            const newPubKeyCryptoKey = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(ownerNewPublicKey)), ['encrypt']);
-            const dataOwnerToUpdate = yield this.getDataOwner(ownerId);
-            const newAesExchangeKeys = yield (0, utils_1.foldAsync)(Object.entries((_c = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => __awaiter(this, void 0, void 0, function* () {
-                var _e;
-                const existingKeys = (_e = pubAcc[pubKey]) !== null && _e !== void 0 ? _e : {};
-                pubAcc[pubKey] = yield (0, utils_1.foldAsync)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => __awaiter(this, void 0, void 0, function* () {
-                    if (delId == delegateId && pubKey != ownerNewPublicKey) {
-                        // Add the AES Key encrypted with the new public key in the aesExchangeKeys
-                        try {
-                            // First, we decrypt it using the delegate RSA Public Key
-                            const encrAesKeyInfo = yield this.decryptHcPartyKey(delegateId, dataOwnerToUpdate.dataOwner.id, delegateId, pubKey, delKeys, delegatePublicKeys).then((delegatorAndKeys) => __awaiter(this, void 0, void 0, function* () {
-                                // Then, we encrypt it using the owner new RSA Public Key (provided in argument)
-                                return yield this.encryptAesKeyOnlyForProvidedKeys(delegatorAndKeys === null || delegatorAndKeys === void 0 ? void 0 : delegatorAndKeys.rawKey, dataOwnerToUpdate, [newPubKeyCryptoKey])
-                                    .then((encrAes) => Object.values(encrAes)[0])
-                                    .then((encrAesInfo) => {
-                                    return { pubKeyUsedToEncryptAes: Object.keys(encrAesInfo)[0], encryptedAes: Object.values(encrAesInfo)[0] };
-                                });
-                            }));
-                            delKeys[encrAesKeyInfo.pubKeyUsedToEncryptAes] = encrAesKeyInfo.encryptedAes;
-                        }
-                        catch (e) {
-                            console.log(`${delegateId} could not re-encrypt AES Key of ${dataOwnerToUpdate.dataOwner.id}`);
-                        }
-                        finally {
-                            delAcc[delId] = delKeys;
+            const giverDoKeys = yield this.getDataOwner(giverDoId).then((doData) => { var _a; return [doData.dataOwner.publicKey, ...Object.keys((_a = doData.dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})].filter((x) => !!x); });
+            const giveAccessBackToExchangeKey = (exchangeKeys, delegatorId, // Getter for getter exchange keys, giver for giver exchange keys
+            delegateId // Giver for getter exchange keys, getter for giver exchange keys
+            ) => __awaiter(this, void 0, void 0, function* () {
+                const updatedExchangeKeys = _.cloneDeep(exchangeKeys);
+                for (const [publicKey, mapsByDelegate] of Object.entries(updatedExchangeKeys)) {
+                    const mapOfDelegate = mapsByDelegate[delegateId];
+                    if (!!mapOfDelegate && !mapOfDelegate[ownerNewPublicKey.slice(-32)]) {
+                        const decryptedKey = yield this.decryptHcPartyKey(giverDoId, delegatorId, delegateId, publicKey, mapOfDelegate, giverDoKeys)
+                            .then((x) => x === null || x === void 0 ? void 0 : x.rawKey)
+                            .catch(() => undefined);
+                        if (decryptedKey) {
+                            mapOfDelegate[ownerNewPublicKey.slice(-32)] = yield this.encryptAesKeyOnlyForProvidedKeys(decryptedKey, delegateId, [
+                                newPubKeyCryptoKey,
+                            ]).then((encrAes) => Object.values(Object.values(encrAes)[0])[0]);
                         }
                     }
-                    else {
-                        // Otherwise, we don't transform the aesExchangeKeys for this delegate
-                        delAcc[delId] = delKeys;
-                    }
-                    return delAcc;
-                }));
-                return pubAcc;
-            }));
-            // After adding the potential new aesExchangeKeys, we save the updated data owner
-            return this._saveDataOwner({
-                type: dataOwnerToUpdate.type,
-                dataOwner: Object.assign(Object.assign({}, dataOwnerToUpdate.dataOwner), { aesExchangeKeys: newAesExchangeKeys }),
+                }
+                return updatedExchangeKeys;
             });
+            yield (0, utils_1.retry)(() => __awaiter(this, void 0, void 0, function* () {
+                var _c;
+                const getterDo = yield this.getDataOwner(ownerId);
+                const updatedGetterKeys = yield giveAccessBackToExchangeKey((_c = getterDo.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}, ownerId, giverDoId);
+                yield this._saveDataOwner({
+                    type: getterDo.type,
+                    dataOwner: Object.assign(Object.assign({}, getterDo.dataOwner), { aesExchangeKeys: updatedGetterKeys }),
+                });
+            }), 3, 5000, 1);
+            yield (0, utils_1.retry)(() => __awaiter(this, void 0, void 0, function* () {
+                var _d;
+                const giverDo = yield this.getDataOwner(giverDoId);
+                const updatedGiverKeys = yield giveAccessBackToExchangeKey((_d = giverDo.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, giverDoId, ownerId);
+                yield this._saveDataOwner({
+                    type: giverDo.type,
+                    dataOwner: Object.assign(Object.assign({}, giverDo.dataOwner), { aesExchangeKeys: updatedGiverKeys }),
+                });
+            }), 3, 5000, 1);
         });
     }
     addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true, sendMaintenanceTasks = true) {
@@ -1442,16 +1438,16 @@ class IccCryptoXApi {
     encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
         return __awaiter(this, void 0, void 0, function* () {
             const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
-            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerAllPubKeys);
+            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner.id, dataOwnerAllPubKeys);
         });
     }
-    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerPubKeys) {
+    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwnerId, dataOwnerPubKeys) {
         return __awaiter(this, void 0, void 0, function* () {
             const encryptedAesForDataOwner = yield (0, utils_1.foldAsync)(dataOwnerPubKeys, {}, (encrAes, pubKey) => __awaiter(this, void 0, void 0, function* () {
                 encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
                 return encrAes;
             }));
-            return { [dataOwner.id]: encryptedAesForDataOwner };
+            return { [dataOwnerId]: encryptedAesForDataOwner };
         });
     }
     retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {