@icure/api 6.4.0 → 7.0.0-beta.0

package/dist/icc-x-api/crypto/EntitiesEncryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntitiesEncryption.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/EntitiesEncryption.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,oCAA8H;AAC9H,4BAA2B;AAE3B,gEAAuD;AACvD,qEAAiE;AAEjE;;;GAGG;AACH,MAAa,kBAAkB;IAK7B,YAAY,UAA4B,EAAE,YAA8B,EAAE,mBAAwC;QAChH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAChD,CAAC;IAED;;;;;;;OAOG;IACG,gBAAgB,CACpB,MAA6C,EAC7C,WAAoB,EACpB,aAAmD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;;;YAE9E,2DAA2D;YAC3D,OAAO,IAAI,CAAC,4CAA4C,CACtD,MAAM,CAAC,IAAI,CAAC,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAe,CAAC,CAAC,CAAC,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,EACvG,WAAW,EACX,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EACpC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAA;;KACF;IAED;;;;;;;;;OASG;IACG,+BAA+B,CACnC,MAA6C,EAC7C,aAAmD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;;;YAE9E,OAAO,IAAI,CAAC,gCAAgC,CAC1C,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,EAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EACpC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAA;;KACF;IAED;;;;;;OAMG;IACG,WAAW,CACf,MAA6C,EAC7C,WAAoB,EACpB,aAAmD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;;;YAE9E,OAAO,IAAI,CAAC,4CAA4C,CACtD,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,EACxB,WAAW,EACX,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAA;;KACF;IAED;;;;;;;;OAQG;IACG,0BAA0B,CAC9B,MAA6C,EAC7C,aAAmD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;;;YAE9E,OAAO,IAAI,CAAC,gCAAgC,CAC1C,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,EACxB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAA;;KACF;IAED;;;;;;;;;;OAUG;IACG,iBAAiB,CACrB,MAA6C,EAC7C,WAAoB,EACpB,aAAmD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;;;YAE9E,OAAO,IAAI,CAAC,4CAA4C,CACtD,MAAA,MAAM,CAAC,kBAAkB,mCAAI,EAAE,EAC/B,WAAW,EACX,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EACrC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAA;;KACF;IAED;;;;;;;;;;;;;OAaG;IACG,gCAAgC,CACpC,MAA6C,EAC7C,aAAmD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;;;YAE9E,OAAO,IAAI,CAAC,gCAAgC,CAC1C,MAAA,MAAM,CAAC,kBAAkB,mCAAI,EAAE,EAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EACrC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAA;;KACF;IAED;;;;;;;;;;;;;;OAcG;IACG,sCAAsC,CAC1C,MAAS,EACT,YAAgC,EAChC,oBAAwC,EACxC,wBAAiC,EACjC,wBAAkC,EAAE,EACpC,OAAiB,EAAE;;YAMnB,IAAI,CAAC,yCAAyC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,wCAAwC,EAAE,SAAS,CAAC,CAAA;YAC3H,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAA;YAC7C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,CAAC,CAAC,IAAA,cAAM,EAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAA;YACtF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAChF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CACvC,CAAO,UAAU,EAAE,UAAU,EAAE,EAAE;gBAC/B,OAAA,MAAM,IAAI,CAAC,+BAA+B,CACxC,MAAM,UAAU,EAChB,UAAU,EACV,EAAE,EACF,EAAE,EACF,EAAE,EACF,CAAC,QAAQ,CAAC,EACV,wBAAwB,CAAC,CAAC,CAAC,CAAC,gBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,EACnD,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,EAClC,IAAI,EACJ,cAAc,CAAC,gBAAgB,CAChC,CAAA;cAAA,EACH,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAC9C,CAAA;YACD,IAAI,oBAAoB,EAAE;gBACxB,aAAa,CAAC,iBAAiB,GAAG,CAAC,oBAAoB,CAAC,CAAA;aACzD;YACD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAA;QACtD,CAAC;KAAA;IAEK,uCAAuC,CAC3C,MAAS,EACT,UAAkB,EAClB,cAAoC,EACpC,mBAAuD,EACvD,oBAAwD;;YAExD,IAAI,cAAc,KAAK,SAAS,EAAE;gBAChC,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBACzD,IAAI,kBAAkB,CAAC,MAAM,EAAE;oBAC7B,cAAc,GAAG,kBAAkB,CAAA;iBACpC;qBAAM;oBACL,cAAc,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;iBAChD;aACF;YACD,IAAI,yBAAyB,GAAa,EAAE,CAAA;YAC5C,IAAI,mBAAmB,KAAK,+CAAsB,CAAC,KAAK,EAAE;gBACxD,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBACnE,IAAI,CAAC,uBAAuB,CAAC,MAAM,IAAI,mBAAmB,KAAK,+CAAsB,CAAC,QAAQ,EAAE;oBAC9F,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,qFAAqF,CAAC,CAAA;iBACvI;gBACD,yBAAyB,GAAG,uBAAuB,CAAA;aACpD;YACD,IAAI,0BAA0B,GAAa,EAAE,CAAA;YAC7C,IAAI,oBAAoB,KAAK,+CAAsB,CAAC,KAAK,EAAE;gBACzD,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;gBACrE,IAAI,CAAC,wBAAwB,CAAC,MAAM,IAAI,oBAAoB,KAAK,+CAAsB,CAAC,QAAQ,EAAE;oBAChG,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAA;iBAC3I;gBACD,0BAA0B,GAAG,wBAAwB,CAAA;aACtD;YACD,OAAO,IAAI,CAAC,mCAAmC,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,CAAA;QAC5I,CAAC;KAAA;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,mCAAmC,CACvC,MAAS,EACT,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,UAAoB,EAAE;;;YAEtB,IAAI,CAAC,yCAAyC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,mCAAmC,EAAE,SAAS,CAAC,CAAA;YACtH,SAAe,gBAAgB,CAAC,KAAe,EAAE,SAAiB,EAAE,QAAmD;;oBACrH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;wBACrB,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;wBAC9B,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,GAAG,CAAC,CAAA;qBAC3H;oBACD,OAAO,KAAK,CAAA;gBACd,CAAC;aAAA;YACD,MAAM,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7G,MAAM,qBAAqB,GAAG,MAAM,gBAAgB,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAA;YACjI,MAAM,sBAAsB,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAA;YACrI,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,8CAA8C,CACxF,UAAU,EACV,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,EACxB,gBAAgB,EAChB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAChC,CAAA;YACD,MAAM,6BAA6B,GAAG,MAAM,IAAI,CAAC,8CAA8C,CAC7F,UAAU,EACV,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,EAC3B,qBAAqB,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACrC,CAAA;YACD,MAAM,8BAA8B,GAAG,MAAM,IAAI,CAAC,8CAA8C,CAC9F,UAAU,EACV,MAAA,MAAM,CAAC,kBAAkB,mCAAI,EAAE,EAC/B,sBAAsB,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CACtC,CAAA;YACD;;;eAGG;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,IAAI,wBAAwB,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE;gBAC7I,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;aAC3E;YACD,IACE,wBAAwB,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;gBACpD,6BAA6B,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;gBACzD,8BAA8B,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;gBAE1D,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC5B,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;YAC3G,OAAO,IAAI,CAAC,+BAA+B,CACzC,aAAa,EACb,UAAU,EACV,wBAAwB,CAAC,uBAAuB,EAChD,6BAA6B,CAAC,uBAAuB,EACrD,8BAA8B,CAAC,uBAAuB,EACtD,wBAAwB,CAAC,cAAc,EACvC,6BAA6B,CAAC,cAAc,EAC5C,8BAA8B,CAAC,cAAc,EAC7C,OAAO,EACP,gBAAgB,CACjB,CAAA;;KACF;IAED;;;;;;;;;;;OAWG;IACG,aAAa,CACjB,MAA6C,EAC7C,OAAiC,EACjC,WAAoB,EACpB,aAAmD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;;YAE9E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;YACrH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,mBACvD,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CACjE,GAAG,CACJ,CAAA;YACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;QAChE,CAAC;KAAA;IAED;;;;;;;;;;;;;;;OAeG;IACG,aAAa,CACjB,MAA6C,EAC7C,OAAiC,EACjC,YAA8D,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EACzF,WAAoB,EACpB,aAAmD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;;YAE9E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;YACzE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE;gBACtB,IAAI;oBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;oBAC3E,IAAI,MAAM,SAAS,CAAC,SAAS,CAAC;wBAAE,OAAO,SAAS,CAAA;iBACjD;gBAAC,OAAO,CAAC,EAAE;oBACV,YAAY;iBACb;aACF;YACD,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,mBAAmB,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC,GAAG,CACtI,CAAA;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,aAAa,CACjB,MAAS,EACT,OAAe,EACf,WAA6B;;YAE7B,IAAI,CAAC,MAAM,CAAC,aAAa;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;YAC7D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;YAClG,IAAI,CAAC,cAAc,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;YAC/D,OAAO;gBACL,MAAM,EAAE,WAAW,CACjB,MAAM,IAAA,eAAO,EAAC,MAAM,EAAE,CAAO,SAAS,EAAE,EAAE;;oBACxC,OAAO,MAAA,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,mCAAI,EAAE,CAAA;gBAC5E,CAAC,CAAA,CAAC,CACH;gBACD,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,cAAc,CAClB,aAAgD,EAChD,SAAqB,EACrB,8BAAuC;;;YAEvC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE;gBAC/B,IAAI;oBACF,MAAM,SAAS,GAAG,MAAA,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,mCAAI,SAAS,CAAA;oBAC/F,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,eAAO,EAAC,8BAA8B,CAAC,CAAC,CAAC,IAAA,6BAAqB,EAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;iBAC1H;gBAAC,OAAO,CAAC,EAAE,GAAE;aACf;YACD,OAAO,SAAS,CAAA;;KACjB;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,MAAS,EACT,WAAmB,EACnB,WAAqB,EACrB,gBAAyB,EACzB,iBAA0B,EAC1B,WAA6B;;YAE7B,MAAM,mCAAmC,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAA;YAC9F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;YACrH,IAAI,CAAC,CAAC,aAAa,EAAE;gBACnB,OAAO,WAAW,CAChB,MAAM,IAAA,aAAK,EACT,mCAAmC,EACnC,CAAC,GAAG,EAAE,EAAE;oBACN,MAAM,IAAI,GAAG,gBAAgB;wBAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;4BAC3B,OAAO,CAAC,YAAY,WAAW,IAAI,CAAC,YAAY,UAAU;gCACxD,CAAC,CAAC,IAAA,WAAG,EAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gCACzE,CAAC,CAAC,CAAC,CAAA;wBACP,CAAC,CAAC;wBACJ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;oBACvB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;gBAC1F,CAAC,EACD,WAAW,CACZ,CACF,CAAA;aACF;iBAAM,IAAI,iBAAiB,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAA;aACnE;iBAAM;gBACL,MAAM,wBAAwB,GAAG,MAAM,IAAA,aAAK,EAC1C,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EACnB,CAAO,GAA8B,EAAE,EAAE,gDAAC,OAAA,OAAO,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA,GAAA,EAC7E,WAAW,CACZ,CAAA;gBACD,IACE,CAAC,CAAC,CAAC,OAAO,CACR,CAAC,CAAC,MAAM,iCAAM,wBAAwB,KAAE,aAAa,EAAE,SAAS,KAAI,CAAC,CAAC,KAAK,CAAC,EAC5E,CAAC,CAAC,MAAM,iCAAM,MAAM,KAAE,aAAa,EAAE,SAAS,KAAI,CAAC,CAAC,KAAK,CAAC,CAC3D,EACD;oBACA,MAAM,IAAI,KAAK,CAAC,qFAAqF,MAAM,EAAE,CAAC,CAAA;iBAC/G;gBACD,OAAO,MAAM,CAAA;aACd;QACH,CAAC;KAAA;IAED;;;;;OAKG;IACG,+BAA+B,CAA4B,MAAS;;;YACxE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAA;YACtE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;gBACf,MAAM,IAAI,KAAK,CACb,uDAAuD;oBACrD,kGAAkG,CACrG,CAAA;aACF;YACD;;;;eAIG;YACH,OAAO,MAAM,IAAI,CAAC,mCAAmC,CACnD,MAAM,EACN,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAC/C,EAAE,EACF,CAAC,IAAA,cAAM,EAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EACzC,EAAE,CACH,CAAA;;KACF;IAED;;;;;;;;;;;;OAYG;IACW,kCAAkC,CAC9C,WAAmB,EACnB,WAAmD,EACnD,sBAA+B,EAC/B,iBAAiE,EACjE,UAAgD;;;YAEhD,MAAM,oBAAoB,GAAG,sBAAsB;gBACjD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,CAChE,WAAW,KAAK,UAAU;oBACxB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC;oBACnD,CAAC,CAAC,IAAI,CAAC,mBAAmB,CACtB,UAAU,EACV,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CACnD,CACN;gBACH,CAAC,CAAC,MAAA,WAAW,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAA;YAClC,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE;gBAC7C,IAAI,MAAM,UAAU,CAAC,MAAA,UAAU,CAAC,IAAI,mCAAI,EAAE,CAAC,EAAE;oBAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;oBAC1F,IAAI,SAAS;wBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;iBACnC;aACF;YACD,OAAO,GAAG,CAAA;;KACX;IAED,mJAAmJ;IAC3I,mBAAmB,CAAC,UAAkB,EAAE,WAAyB;QACvE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAM,CAAC,KAAE,WAAW,EAAE,UAAU,GAAE,CAAC,CAAC,CAAA;IACvG,CAAC;IAEa,gCAAgC,CAC5C,WAAmD,EACnD,iBAAiE,EACjE,UAAgD;;YAEhD,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAO,OAAO,EAAE,EAAE;gBAChF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAChC,MAAM,IAAI,CAAC,kCAAkC,CAC3C,OAAO,EACP,WAAW,EACX,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CACF,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;YAC/B,CAAC,CAAA,CAAC,CACH,CAAA;QACH,CAAC;KAAA;IAED;;OAEG;IACG,4CAA4C,CAChD,WAAmD,EACnD,WAA+B,EAC/B,iBAAiE,EACjE,UAAgD;;YAEhD,MAAM,SAAS,GAAG,WAAW;gBAC3B,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,mCAAmC,CAAC,WAAW,CAAC;gBAC1E,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;YAC7D,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG;YACxC,mIAAmI;YACnI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACvC,IAAI,CAAC,kCAAkC,CACrC,OAAO,EACP,WAAW,EACX,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CACF,CACF,CAAA;YACD,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7D,CAAC;KAAA;IAEa,oBAAoB,CAChC,UAAsB,EACtB,iBAAiE;;YAEjE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,UAAU,CAAC,KAAM,EAAE,UAAU,CAAC,WAAY,CAAC,CAAA;YAC5H,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE;gBAC9B,IAAI;oBACF,uIAAuI;oBACvI,gIAAgI;oBAChI,+HAA+H;oBAC/H,MAAM,SAAS,GAAG,IAAA,iBAAS,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,cAAM,EAAC,UAAU,CAAC,GAAI,CAAC,CAAC,CAAC,CAAA;oBAC5F,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC3C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/B,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;wBACvD,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC;4BAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAA;qBAClG;yBAAM;wBACL,OAAO,CAAC,IAAI,CAAC,qGAAqG,CAAC,CAAA;qBACpH;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,wEAAwE;iBACzE;aACF;QACH,CAAC;KAAA;IAEa,YAAY,CAAC,GAAW;;YACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YACpD,IAAI;gBACF,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;aACjF;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,CAAC,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,EAAE,CAAC,CAAC,CAAA;gBACpE,OAAO,SAAS,CAAA;aACjB;QACH,CAAC;KAAA;IAED;;OAEG;IACG,mBAAmB,CAAC,IAAc,EAAE,QAAgB;;YACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC7D,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,GAAG,CAAC,CAAA;YACjF,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,sBAAsB,CAAC,IAAc,EAAE,QAAgB;;YACnE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE;gBACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;gBAC7C,IAAI,QAAQ;oBAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;aACjD;QACH,CAAC;KAAA;IAED;;OAEG;IACG,kBAAkB,CAAC,IAAc;;YACrC,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE;gBACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;gBAC7C,IAAI,QAAQ;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;aACpD;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,qBAAqB,CAAC,GAAW;;YAC7C,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QACzC,CAAC;KAAA;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,CAAC,CAAC,GAAG,CAAA;IACd,CAAC;IAEO,sBAAsB,CAAC,GAAW;QACxC,OAAO,CAAC,CAAC,GAAG,CAAA;IACd,CAAC;IAEa,6BAA6B,CACzC,QAAgB,EAChB,UAAkB,EAClB,WAAsB,EACtB,aAAqB,EACrB,OAAiB;;YAEjB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAA;YAClH,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QACzF,CAAC;KAAA;IAEa,wBAAwB,CACpC,QAAgB,EAChB,UAAkB,EAClB,WAAsB,EACtB,QAAgB,EAChB,OAAiB;;YAEjB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAA;YACtF,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QACpF,CAAC;KAAA;IAEa,8BAA8B,CAC1C,QAAgB,EAChB,UAAkB,EAClB,WAAsB,EACtB,cAAsB,EACtB,OAAiB;;YAEjB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,cAAc,EAAE,CAAC,CAAA;YACxG,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;QAC1F,CAAC;KAAA;IAEa,gBAAgB,CAC5B,QAAgB,EAChB,UAAkB,EAClB,WAAsB,EACtB,OAAe,EACf,OAAiB;;YAEjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;YACxG,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACxF,OAAO;gBACL,WAAW,EAAE,UAAU;gBACvB,KAAK,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE;gBACtD,GAAG,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAA,iBAAS,EAAC,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;gBAChG,IAAI,EAAE,OAAO;aACd,CAAA;QACH,CAAC;KAAA;IAEa,8BAA8B,CAC1C,MAAS,EACT,SAAmB;;;YAEnB,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CACnE,CAAO,GAAG,EAAE,UAAU,EAAE,EAAE;;gBACxB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAA;gBAC5B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mCAAmC,CAAC,UAAU,CAAC,CAAA;gBACvG,OAAO;oBACL,gBAAgB,EAAE,MAAA,gBAAgB,CAAC,gBAAgB,mCAAI,UAAU,CAAC,gBAAgB;oBAClF,gBAAgB,kCACX,UAAU,CAAC,gBAAgB,KAC9B,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,IAAI,GACpC;iBACF,CAAA;YACH,CAAC,CAAA,EACD,OAAO,CAAC,OAAO,CAAC;gBACd,gBAAgB,EAAE,SAA0C;gBAC5D,gBAAgB,EAAE,EAA2C;aAC9D,CAAC,CACH,CAAA;YACD,MAAM,aAAa,GACjB,MAAM,CAAC,EAAE,MAAK,MAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,SAAS,0CAAE,EAAE,CAAA;gBAC3C,CAAC,iCACM,MAAM,KACT,GAAG,EAAE,gBAAiB,CAAC,SAAS,CAAC,GAAG,EACpC,WAAW,EAAE,gBAAiB,CAAC,SAAS,CAAC,WAAW,EACpD,eAAe,EAAE,gBAAiB,CAAC,SAAS,CAAC,eAAe,IAEhE,CAAC,CAAC,MAAM,CAAA;YACZ,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAA;;KAC3C;IAEa,+BAA+B,CAC3C,MAAS,EACT,UAAkB,EAClB,iBAA+B,EAC/B,sBAAoC,EACpC,uBAAqC,EACrC,YAAsB,EACtB,iBAA2B,EAC3B,kBAA4B,EAC5B,OAAiB,EACjB,gBAAuD;;;YAEvD,MAAM,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACtC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,UAAU,CAAA;YACrH,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YACjD,MAAM,gBAAgB,GAAG;gBACvB,GAAG,iBAAiB;gBACpB,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;aAC9H,CAAA;YACD,MAAM,qBAAqB,GAAG;gBAC5B,GAAG,sBAAsB;gBACzB,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,EAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;aACxI,CAAA;YACD,MAAM,sBAAsB,GAAG;gBAC7B,GAAG,uBAAuB;gBAC1B,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;aAC1I,CAAA;YACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC/B,UAAU,CAAC,WAAW,mCACjB,CAAC,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,KAC7B,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAC/B,CAAA;aACF;YACD,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE;gBACpC,UAAU,CAAC,cAAc,mCACpB,CAAC,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,CAAC,KAChC,CAAC,UAAU,CAAC,EAAE,qBAAqB,GACpC,CAAA;aACF;YACD,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE;gBACrC,UAAU,CAAC,kBAAkB,mCACxB,CAAC,MAAA,MAAM,CAAC,kBAAkB,mCAAI,EAAE,CAAC,KACpC,CAAC,UAAU,CAAC,EAAE,sBAAsB,GACrC,CAAA;aACF;YACD,OAAO,UAAU,CAAA;;KAClB;IAED;;;;;;;;OAQG;IACW,8CAA8C,CAC1D,UAAkB,EAClB,cAAsD,EACtD,eAAyB,EACzB,iBAA4D;;;YAK5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,qBAAqB,GAAG,MAAA,cAAc,CAAC,UAAU,CAAC,mCAAI,EAAE,CAAA;YAC9D,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5C,qBAAqB,CAAC,GAAG,CAAC,CAAO,CAAC,EAAE,EAAE;gBAAC,OAAA,CAAC;oBACtC,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;iBAC1G,CAAC,CAAA;cAAA,CAAC,CACJ,CAAA;YACD,MAAM,uBAAuB,GAAiB,EAAE,CAAA;YAChD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAsB,CAAA;YACzD,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;;gBACvD,IAAI,OAAO,KAAK,SAAS,EAAE;oBACzB,sEAAsE;oBACtE,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;iBACzC;qBAAM;oBACL,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;oBACzD,IAAI,CAAC,gBAAgB,EAAE;wBACrB,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAA,UAAU,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,CAAA;wBACzD,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;qBACzC;yBAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,IAAA,8BAAW,EAAC,CAAC,EAAE,MAAA,UAAU,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA,EAAA,CAAC,EAAE;wBAC/E,gBAAgB,CAAC,IAAI,CAAC,MAAA,UAAU,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA;wBAC5C,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;qBACzC;iBACF;YACH,CAAC,CAAC,CAAA;YACF,MAAM,6BAA6B,GAAG,CAAC,MAAA,cAAc,CAAC,MAAM,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAA;YAC1G,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAC9C,MAAM,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACnI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACpC,CACF,CAAA;YACD,OAAO;gBACL,uBAAuB;gBACvB,cAAc,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;aACpI,CAAA;;KACF;IAEO,WAAW,CAAI,MAAW;QAChC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7B,CAAC;IAEO,yCAAyC,CAAC,OAAe,EAAE,QAAa,EAAE,UAAkB,EAAE,UAAsB;QAC1H,IAAI,QAAQ;YAAE,OAAM;QAEpB,IAAI,OAAO,GAAG,kCAAkC,GAAG,UAAU,GAAG,gBAAgB,CAAA;QAEhF,IAAI,UAAU,EAAE;YACd,IAAI;gBACF,MAAM,SAAS,GAAG,CAAC,GAAG,UAAU,CAAC,CAAA;gBACjC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;aAC5F;YAAC,OAAO,EAAE,EAAE;gBACX,OAAO,IAAI,uDAAuD,GAAG,EAAE,CAAA;aACxE;SACF;QAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,OAAO,GAAG,yBAAyB,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAA;IAC5G,CAAC;IAEO,4BAA4B,CAAC,MAAuB;QAC1D,MAAM,gBAAgB,GAAG,EAAE,CAAA;QAC3B,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM;YAAE,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtG,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM;YAAE,gBAAgB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QAC3H,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM;YAAE,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC/G,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM;YAAE,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC3G,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE;YAC/B,MAAM,IAAI,KAAK,CACb,mHAAmH,gBAAgB,IAAI;gBACrI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CACvC,CAAA;SACF;IACH,CAAC;CACF;AA93BD,gDA83BC","sourcesContent":["import { Delegation, EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { DataOwnerWithType, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { ExchangeKeysManager } from './ExchangeKeysManager'\nimport { b2a, crypt, decrypt, hex2ua, string2ua, truncateTrailingNulls, ua2hex, ua2string, ua2utf8, utf8_2ua } from '../utils'\nimport * as _ from 'lodash'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { arrayEquals } from '../utils/collection-utils'\nimport { ShareMetadataBehaviour } from './ShareMetadataBehaviour'\n\n/**\n * @internal this class is for internal use only and may be changed without notice\n * Give access to functions for retrieving encryption metadata of entities.\n */\nexport class EntitiesEncryption {\n  private readonly primitives: CryptoPrimitives\n  private readonly dataOwnerApi: IccDataOwnerXApi\n  private readonly exchangeKeysManager: ExchangeKeysManager\n\n  constructor(primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, exchangeKeysManager: ExchangeKeysManager) {\n    this.primitives = primitives\n    this.dataOwnerApi = dataOwnerApi\n    this.exchangeKeysManager = exchangeKeysManager\n  }\n\n  /**\n   * Get the encryption keys of an entity that the provided data owner can access, potentially using the keys for his parent.\n   * There should only be one encryption key for each entity, but the method supports more to allow to deal with conflicts and merged duplicate data.\n   * @param entity an encrypted entity.\n   * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.\n   * @param tagsFilter allows to obtain only encryption keys associated to tags which satisfy the provided filter.\n   * @return the encryption keys that the provided data owner can decrypt, deduplicated.\n   */\n  async encryptionKeysOf(\n    entity: EncryptedEntity | EncryptedEntityStub,\n    dataOwnerId?: string,\n    tagsFilter: (tags: string[]) => Promise<boolean> = () => Promise.resolve(true)\n  ): Promise<string[]> {\n    // Legacy entities may have encryption keys in delegations.\n    return this.extractMergedHierarchyFromDelegationAndOwner(\n      Object.keys(entity.encryptionKeys ?? {}).length > 0 ? entity.encryptionKeys! : entity.delegations ?? {},\n      dataOwnerId,\n      (k) => this.validateEncryptionKey(k),\n      (t) => tagsFilter(t)\n    )\n  }\n\n  /**\n   * Get the encryption keys of an entity that the current data owner and his parents can access. The resulting array contains the keys for each data\n   * owner in the hierarchy which can be decrypted using only that data owner keys (excludes keys accessible through the parent keys). The order of\n   * the array is the same as in {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds}.\n   * Note that different data owners may have access to the same keys, but the keys extracted for each data owner are deduplicated.\n   * There should only be one encryption key for each entity, but the method supports more to allow to deal with conflicts and merged duplicate data.\n   * @param entity an encrypted entity.\n   * @param tagsFilter allows to obtain only encryption keys associated to tags which satisfy the provided filter.\n   * @return the encryption keys that each member of the current data owner hierarchy can decrypt using only his keys and not keys of his parents.\n   */\n  async encryptionKeysForHcpHierarchyOf(\n    entity: EncryptedEntity | EncryptedEntityStub,\n    tagsFilter: (tags: string[]) => Promise<boolean> = () => Promise.resolve(true)\n  ): Promise<{ ownerId: string; extracted: string[] }[]> {\n    return this.extractedHierarchyFromDelegation(\n      entity.encryptionKeys ?? {},\n      (k) => this.validateEncryptionKey(k),\n      (t) => tagsFilter(t)\n    )\n  }\n\n  /**\n   * Get the secret ids (SFKs) of an entity that the provided data owner can access, potentially using the keys for his parent.\n   * @param entity an encrypted entity.\n   * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.\n   * @param tagsFilter allows to obtain only secret ids associated to tags which satisfy the provided filter.\n   * @return the secret ids (SFKs) that the provided data owner can decrypt, deduplicated.\n   */\n  async secretIdsOf(\n    entity: EncryptedEntity | EncryptedEntityStub,\n    dataOwnerId?: string,\n    tagsFilter: (tags: string[]) => Promise<boolean> = () => Promise.resolve(true)\n  ): Promise<string[]> {\n    return this.extractMergedHierarchyFromDelegationAndOwner(\n      entity.delegations ?? {},\n      dataOwnerId,\n      (k) => this.validateSecretId(k),\n      (t) => tagsFilter(t)\n    )\n  }\n\n  /**\n   * Get the secret ids (SFKs) of an entity that the current data owner and his parents can access. The resulting array contains the ids for each data\n   * owner in the hierarchy which can be decrypted using only that data owner keys (excludes ids accessible through the parent keys). The order of\n   * the array is the same as in {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds}.\n   * Note that different data owners may have access to the same secret ids, but the secret ids extracted for each data owner are deduplicated.\n   * @param entity an encrypted entity.\n   * @param tagsFilter allows to obtain only secret ids associated to tags which satisfy the provided filter.\n   * @return the secret ids that each member of the current data owner hierarchy can decrypt using only his keys and not keys of his parents.\n   */\n  async secretIdsForHcpHierarchyOf(\n    entity: EncryptedEntity | EncryptedEntityStub,\n    tagsFilter: (tags: string[]) => Promise<boolean> = () => Promise.resolve(true)\n  ): Promise<{ ownerId: string; extracted: string[] }[]> {\n    return this.extractedHierarchyFromDelegation(\n      entity.delegations ?? {},\n      (k) => this.validateSecretId(k),\n      (t) => tagsFilter(t)\n    )\n  }\n\n  /**\n   * Get the decrypted owning entity ids (formerly CFKs) for the provided entity that can be decrypted using the private keys of the current data\n   * owner and his parents. The owning entity id would be, for example, the id of a patient for contact and healthcare elements, or the id of a\n   * message for documents.\n   * There should only be one owning entity id for each entity, but the method supports more to allow to deal with conflicts and merged duplicate\n   * data.\n   * @param entity an encrypted entity.\n   * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.\n   * @param tagsFilter allows to obtain only owning entity ids associated to tags which satisfy the provided filter.\n   * @return the owning entity ids (CFKs) that the provided data owner can decrypt, deduplicated.\n   */\n  async owningEntityIdsOf(\n    entity: EncryptedEntity | EncryptedEntityStub,\n    dataOwnerId?: string,\n    tagsFilter: (tags: string[]) => Promise<boolean> = () => Promise.resolve(true)\n  ): Promise<string[]> {\n    return this.extractMergedHierarchyFromDelegationAndOwner(\n      entity.cryptedForeignKeys ?? {},\n      dataOwnerId,\n      (k) => this.validateOwningEntityId(k),\n      (t) => tagsFilter(t)\n    )\n  }\n\n  /**\n   * Get the decrypted owning entity ids (formerly CFKs) for the provided entity that can be decrypted using the private keys of the current data\n   * owner and his parents. The owning entity id would be, for example, the id of a patient for contact and healthcare elements, or the id of a\n   * message for documents.\n   * The resulting array contains the ids for each data owner in the hierarchy which can be decrypted using only that data owner keys (excludes ids\n   * accessible through the parent keys). The order of the array is the same as in {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds}.\n   * Note that different data owners may have access to the same owning entity ids, but the owning entity ids extracted for each data owner are\n   * deduplicated in case they could be accessed through different delegations.\n   * There should only be one owning entity id for each entity, but the method supports more to allow to deal with conflicts and merged duplicate\n   * data.\n   * @param entity an encrypted entity.\n   * @param tagsFilter allows to obtain only owning entity ids associated to tags which satisfy the provided filter.\n   * @return the owning entity ids that each member of the current data owner hierarchy can decrypt using only his keys and not keys of his parents.\n   */\n  async owningEntityIdsForHcpHierarchyOf(\n    entity: EncryptedEntity | EncryptedEntityStub,\n    tagsFilter: (tags: string[]) => Promise<boolean> = () => Promise.resolve(true)\n  ): Promise<{ ownerId: string; extracted: string[] }[]> {\n    return this.extractedHierarchyFromDelegation(\n      entity.cryptedForeignKeys ?? {},\n      (k) => this.validateOwningEntityId(k),\n      (t) => tagsFilter(t)\n    )\n  }\n\n  /**\n   * @internal this method is intended only for internal use and may be changed without notice.\n   * Initializes encryption metadata for an entity. This includes the encrypted secret id, owning entity id, and encryption key for the entity, and\n   * the clear text secret foreign key of the parent entity.\n   * This method returns a modified copy of the entity.\n   * @param entity entity which requires encryption metadata initialisation.\n   * @param owningEntity id of the owning entity, if any (e.g. patient id for Contact/HealtchareElement, message id for Document, ...).\n   * @param owningEntitySecretId secret id of the parent entity, to use in the secret foreign keys for the provided entity, if any.\n   * @param initialiseEncryptionKeys if false this method will not initialize any encryption keys. Use only for entities which use delegations for\n   * access control but don't actually have any encrypted content.\n   * @param additionalDelegations automatically shares the\n   * @param tags tags to associate with the initial encryption keys and metadata\n   * @throws if the entity already has non-empty values for encryption metadata.\n   * @return an updated copy of the entity.\n   */\n  async entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T,\n    owningEntity: string | undefined,\n    owningEntitySecretId: string | undefined,\n    initialiseEncryptionKeys: boolean,\n    additionalDelegations: string[] = [],\n    tags: string[] = []\n  ): Promise<{\n    updatedEntity: T\n    rawEncryptionKey: string | undefined\n    secretId: string\n  }> {\n    this.throwDetailedExceptionForInvalidParameter('entity.id', entity.id, 'entityWithInitialisedEncryptedMetadata', arguments)\n    this.checkEmptyEncryptionMetadata(entity)\n    const secretId = this.primitives.randomUuid()\n    const rawEncryptionKey = initialiseEncryptionKeys ? ua2hex(this.primitives.randomBytes(16)) : undefined\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const allIds = [selfId, ...new Set(additionalDelegations.filter((x) => x !== selfId))]\n    const loadKeysResult = await this.loadEncryptionKeysForDelegates(entity, allIds)\n    const updatedEntity = await allIds.reduce<Promise<T>>(\n      async (prevUpdate, delegateId) =>\n        await this.createOrUpdateEntityDelegations(\n          await prevUpdate,\n          delegateId,\n          [],\n          [],\n          [],\n          [secretId],\n          initialiseEncryptionKeys ? [rawEncryptionKey!] : [],\n          owningEntity ? [owningEntity] : [],\n          tags,\n          loadKeysResult.keysForDelegates\n        ),\n      Promise.resolve(loadKeysResult.updatedEntity)\n    )\n    if (owningEntitySecretId) {\n      updatedEntity.secretForeignKeys = [owningEntitySecretId]\n    }\n    return { updatedEntity, secretId, rawEncryptionKey }\n  }\n\n  async entityWithAutoExtendedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T,\n    delegateId: string,\n    shareSecretIds: string[] | undefined,\n    shareEncryptionKeys: ShareMetadataBehaviour | undefined,\n    shareOwningEntityIds: ShareMetadataBehaviour | undefined\n  ): Promise<T> {\n    if (shareSecretIds === undefined) {\n      const availableSecretIds = await this.secretIdsOf(entity)\n      if (availableSecretIds.length) {\n        shareSecretIds = availableSecretIds\n      } else {\n        shareSecretIds = [this.primitives.randomUuid()]\n      }\n    }\n    let actualShareEncryptionKeys: string[] = []\n    if (shareEncryptionKeys !== ShareMetadataBehaviour.NEVER) {\n      const availableEncryptionKeys = await this.encryptionKeysOf(entity)\n      if (!availableEncryptionKeys.length && shareEncryptionKeys === ShareMetadataBehaviour.REQUIRED) {\n        throw new Error(`Entity ${JSON.stringify(entity)} has no encryption keys or the current data owner can't access any encryption keys.`)\n      }\n      actualShareEncryptionKeys = availableEncryptionKeys\n    }\n    let actualShareOwningEntityIds: string[] = []\n    if (shareOwningEntityIds !== ShareMetadataBehaviour.NEVER) {\n      const availableOwningEntityIds = await this.owningEntityIdsOf(entity)\n      if (!availableOwningEntityIds.length && shareOwningEntityIds === ShareMetadataBehaviour.REQUIRED) {\n        throw new Error(`Entity ${JSON.stringify(entity)} has no owning entity ids or the current data owner can't access any owning entity ids.`)\n      }\n      actualShareOwningEntityIds = availableOwningEntityIds\n    }\n    return this.entityWithExtendedEncryptedMetadata(entity, delegateId, shareSecretIds, actualShareEncryptionKeys, actualShareOwningEntityIds)\n  }\n\n  /**\n   * Updates encryption metadata for an entity in order to share it with a delegate or in order to add additional encrypted metadata for an existing\n   * delegate.\n   * The first time this method is used for a specific delegate it will give access to all unencrypted content of the entity to the delegate data\n   * owner. Additionally, this method also allows to share new or existing secret ids (shareSecretId), encryption keys (shareEncryptionKeys) and\n   * owning entity ids (shareOwningEntityIds) for the entity.\n   * You can use methods like {@link secretIdsOf}, {@link secretIdsForHcpHierarchyOf}, {@link encryptionKeysOf}, ... to retrieve the data you want to\n   * share. In most cases you may want to share everything related to the entity, but note that if you use confidential delegations for patients you\n   * may want to avoid sharing the confidential secret ids of the current user with other hcps.\n   * This method returns a modified copy of the entity.\n   * @param entity entity which requires encryption metadata initialisation.\n   * @param delegateId id of the delegate to share data with.\n   * @param shareSecretIds secret ids to share.\n   * @param shareEncryptionKeys encryption keys to share.\n   * @param shareOwningEntityIds owning enttiy ids to share.\n   * @param newTags tags to associate with the new encryption keys and metadata. Existing data won't be changed.\n   * @throws if any of the shareX parameters is set to `true` but the corresponding piece of data could not be retrieved.\n   * @return an updated copy of the entity.\n   */\n  async entityWithExtendedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newTags: string[] = []\n  ): Promise<T> {\n    this.throwDetailedExceptionForInvalidParameter('entity.id', entity.id, 'entityWithSharedEncryptedMetadata', arguments)\n    async function checkInputAndGet(input: string[], inputName: string, validate: (x: string) => boolean | Promise<boolean>): Promise<string[]> {\n      for (const x of input) {\n        const validation = validate(x)\n        if (validation !== true && validation !== false && !(await validation)) throw new Error(`Invalid input for ${inputName}.`)\n      }\n      return input\n    }\n    const secretIdsToShare = await checkInputAndGet(shareSecretIds, 'secretIds', (x) => this.validateSecretId(x))\n    const encryptionKeysToShare = await checkInputAndGet(shareEncryptionKeys, 'encryptionKeys', (x) => this.validateEncryptionKey(x))\n    const owningEntityIdsToShare = await checkInputAndGet(shareOwningEntityIds, 'owningEntityIds', (x) => this.validateOwningEntityId(x))\n    const deduplicateInfoSecretIds = await this.deduplicateDelegationsAndFilterRequiredEntries(\n      delegateId,\n      entity.delegations ?? {},\n      secretIdsToShare,\n      (x) => this.validateSecretId(x)\n    )\n    const deduplicateInfoEncryptionKeys = await this.deduplicateDelegationsAndFilterRequiredEntries(\n      delegateId,\n      entity.encryptionKeys ?? {},\n      encryptionKeysToShare,\n      (x) => this.validateEncryptionKey(x)\n    )\n    const deduplicateInfoOwningEntityIds = await this.deduplicateDelegationsAndFilterRequiredEntries(\n      delegateId,\n      entity.cryptedForeignKeys ?? {},\n      owningEntityIdsToShare,\n      (x) => this.validateOwningEntityId(x)\n    )\n    /*TODO\n     * Temporary hack since secret id is necessary to create a delegation for access control: if there is no delegation existing from me to the\n     * delegate and there is no new secret id to be created create a new random id.\n     */\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    if (deduplicateInfoSecretIds.missingEntries.length === 0 && !deduplicateInfoSecretIds.deduplicatedDelegations.some((d) => d.owner === selfId)) {\n      deduplicateInfoSecretIds.missingEntries.push(this.primitives.randomUuid())\n    }\n    if (\n      deduplicateInfoSecretIds.missingEntries.length === 0 &&\n      deduplicateInfoEncryptionKeys.missingEntries.length === 0 &&\n      deduplicateInfoOwningEntityIds.missingEntries.length === 0\n    )\n      return _.cloneDeep(entity)\n    const { updatedEntity, keysForDelegates } = await this.loadEncryptionKeysForDelegates(entity, [delegateId])\n    return this.createOrUpdateEntityDelegations(\n      updatedEntity,\n      delegateId,\n      deduplicateInfoSecretIds.deduplicatedDelegations,\n      deduplicateInfoEncryptionKeys.deduplicatedDelegations,\n      deduplicateInfoOwningEntityIds.deduplicatedDelegations,\n      deduplicateInfoSecretIds.missingEntries,\n      deduplicateInfoEncryptionKeys.missingEntries,\n      deduplicateInfoOwningEntityIds.missingEntries,\n      newTags,\n      keysForDelegates\n    )\n  }\n\n  /**\n   * Encrypts data using a key of the entity that the provided data owner can access (current data owner by default). If the provided data owner can\n   * access multiple encryption keys of the entity there is no guarantee on which key will be used.\n   * Note: you should not use this method to encrypt the `encryptedSelf` of iCure entities, since that will be automatically handled by the extended\n   * apis. You should use this method only to encrypt additional data, such as document attachments.\n   * @param entity an entity.\n   * @param content data of the entity which you want to encrypt.\n   * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.\n   * @param tagsFilter allows to use for encryption only keys associated to tags which pass the filter.\n   * @return the encrypted data.\n   * @throws if the provided data owner can't access any encryption keys for the entity.\n   */\n  async encryptDataOf(\n    entity: EncryptedEntity | EncryptedEntityStub,\n    content: ArrayBuffer | Uint8Array,\n    dataOwnerId?: string,\n    tagsFilter: (tags: string[]) => Promise<boolean> = () => Promise.resolve(true)\n  ): Promise<ArrayBuffer> {\n    const keys = await this.encryptionKeysOf(await this.ensureEncryptionKeysInitialised(entity), dataOwnerId, tagsFilter)\n    if (keys.length === 0)\n      throw new Error(\n        `Could not extract any encryption keys of entity ${entity} for data owner ${\n          dataOwnerId ?? (await this.dataOwnerApi.getCurrentDataOwnerId())\n        }.`\n      )\n    return this.primitives.AES.encryptWithRawKey(keys[0], content)\n  }\n\n  /**\n   * Decrypts data using a key of the entity that the provided data owner can access (current data owner by default). If the provided data owner can\n   * access multiple encryption keys each of them will be tried for decryption until one of them gives a result that is valid according to the\n   * provided validator.\n   * Note: you should not use this method to decrypt the `encryptedSelf` of iCure entities, since that will be automatically handled by the extended\n   * apis. You should use this method only to decrypt additional data, such as document attachments.\n   * @param entity an entity.\n   * @param content data of the entity which you want to decrypt.\n   * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.\n   * @param validator a function which verifies the correctness of decrypted content: helps to identify decryption with the wrong key without relying\n   * solely on padding.\n   * @param tagsFilter allows to use for decryption only keys associated to tags which pass the filter.\n   * @return the decrypted data.\n   * @throws if the provided data owner can't access any encryption keys for the entity, or if no key could be found which provided valid decrypted\n   * content according to the validator.\n   */\n  async decryptDataOf(\n    entity: EncryptedEntity | EncryptedEntityStub,\n    content: ArrayBuffer | Uint8Array,\n    validator: (decryptedData: ArrayBuffer) => Promise<boolean> = () => Promise.resolve(true),\n    dataOwnerId?: string,\n    tagsFilter: (tags: string[]) => Promise<boolean> = () => Promise.resolve(true)\n  ): Promise<ArrayBuffer> {\n    const keys = await this.encryptionKeysOf(entity, dataOwnerId, tagsFilter)\n    for (const key of keys) {\n      try {\n        const decrypted = await this.primitives.AES.decryptWithRawKey(key, content)\n        if (await validator(decrypted)) return decrypted\n      } catch (e) {\n        /* ignore */\n      }\n    }\n    throw new Error(\n      `No valid key found to decrypt data of ${entity} for data owner ${dataOwnerId ?? (await this.dataOwnerApi.getCurrentDataOwnerId())}.`\n    )\n  }\n\n  /**\n   * @internal this method is intended for internal use only and may be changed without notice.\n   * Decrypts the content of an encrypted entity.\n   */\n  async decryptEntity<T extends EncryptedEntity>(\n    entity: T,\n    ownerId: string,\n    constructor: (json: any) => T\n  ): Promise<{ entity: T; decrypted: boolean }> {\n    if (!entity.encryptedSelf) return { entity, decrypted: true }\n    const encryptionKeys = await this.importAllValidKeys(await this.encryptionKeysOf(entity, ownerId))\n    if (!encryptionKeys.length) return { entity, decrypted: false }\n    return {\n      entity: constructor(\n        await decrypt(entity, async (encrypted) => {\n          return (await this.tryDecryptJson(encryptionKeys, encrypted, false)) ?? {}\n        })\n      ),\n      decrypted: true,\n    }\n  }\n\n  /**\n   * @internal this method is intended for internal use only and may be changed without notice.\n   * Tries using the provided keys to decrypt some json.\n   */\n  async tryDecryptJson(\n    potentialKeys: { key: CryptoKey; raw: string }[],\n    encrypted: Uint8Array,\n    truncateTrailingDecryptedNulls: boolean\n  ): Promise<{} | undefined> {\n    for (const key of potentialKeys) {\n      try {\n        const decrypted = (await this.primitives.AES.decrypt(key.key, encrypted, key.raw)) ?? encrypted\n        return JSON.parse(ua2utf8(truncateTrailingDecryptedNulls ? truncateTrailingNulls(new Uint8Array(decrypted)) : decrypted))\n      } catch (e) {}\n    }\n    return undefined\n  }\n\n  /**\n   * @internal this method is intended for internal use only and may be changed without notice.\n   * Tries to encrypt the content of an encrypted entity.\n   * 1. If valid key for encryption is found the method returns the entity with the encrypted fields specified by cryptedKeys\n   * 2. If requireEncryption is true and no key could be found for encryption of the entity the method fails.\n   * 3. If requireEncryption is false and no key could be found for encryption the method will only check that the entity does not specify any value\n   * for fields which should be encrypted according to cryptedKeys (e.g. note in a patient by default). If the entity specifies a value for any field\n   * which should be encrypted the method throws an error, otherwise the method returns the original entity.\n   */\n  async tryEncryptEntity<T extends EncryptedEntity>(\n    entity: T,\n    dataOwnerId: string,\n    cryptedKeys: string[],\n    encodeBinaryData: boolean,\n    requireEncryption: boolean,\n    constructor: (json: any) => T\n  ): Promise<T> {\n    const entityWithInitialisedEncryptionKeys = await this.ensureEncryptionKeysInitialised(entity)\n    const encryptionKey = await this.tryImportFirstValidKey(await this.encryptionKeysOf(entity, dataOwnerId), entity.id!)\n    if (!!encryptionKey) {\n      return constructor(\n        await crypt(\n          entityWithInitialisedEncryptionKeys,\n          (obj) => {\n            const json = encodeBinaryData\n              ? JSON.stringify(obj, (k, v) => {\n                  return v instanceof ArrayBuffer || v instanceof Uint8Array\n                    ? b2a(new Uint8Array(v).reduce((d, b) => d + String.fromCharCode(b), ''))\n                    : v\n                })\n              : JSON.stringify(obj)\n            return this.primitives.AES.encrypt(encryptionKey.key, utf8_2ua(json), encryptionKey.raw)\n          },\n          cryptedKeys\n        )\n      )\n    } else if (requireEncryption) {\n      throw new Error(`No key found for encryption of entity ${entity}`)\n    } else {\n      const cryptedCopyWithRandomKey = await crypt(\n        _.cloneDeep(entity),\n        async (obj: { [key: string]: string }) => Promise.resolve(new ArrayBuffer(1)),\n        cryptedKeys\n      )\n      if (\n        !_.isEqual(\n          _.omitBy({ ...cryptedCopyWithRandomKey, encryptedSelf: undefined }, _.isNil),\n          _.omitBy({ ...entity, encryptedSelf: undefined }, _.isNil)\n        )\n      ) {\n        throw new Error(`Impossible to modify encrypted value of an entity if no encryption key is known.\\n${entity}`)\n      }\n      return entity\n    }\n  }\n\n  /**\n   * @internal This method is for internal use only and may be changed without notice.\n   * Ensures that the encryption keys of an entity are initialised. If not will throw an exception or initialise them depending on the content of\n   * the entity. This function supports migration of entities using older encryption schemes (delegation only without encrypted keys) or entities\n   * which were previously not encrypted.\n   */\n  async ensureEncryptionKeysInitialised<T extends EncryptedEntity>(entity: T): Promise<T> {\n    if (Object.keys(entity.encryptionKeys ?? {}).length > 0) return entity\n    if (!entity.rev) {\n      throw new Error(\n        'New encrypted entity is lacking encryption metadata. ' +\n          'Please instantiate new entities using the `newInstance` method from the respective extended api.'\n      )\n    }\n    /*\n     * If entity was using delegations as legacy encryption keys we will essentially revoke the access to the encrypted data for all other data\n     * owners. This however should not be a problem as this form of legacy entities should not exist anymore, and it should be present only in the\n     * databases of hcps without collaborators.\n     */\n    return await this.entityWithExtendedEncryptedMetadata(\n      entity,\n      await this.dataOwnerApi.getCurrentDataOwnerId(),\n      [],\n      [ua2hex(this.primitives.randomBytes(16))],\n      []\n    )\n  }\n\n  /**\n   * Get the decrypted content of a delegation-like object which the provided data owner would be able to access using ONLY HIS EXCHANGE KEYS (does\n   * not consider exchange keys for parents).\n   * Note that the retrieved exchange keys are decrypted using the private keys available on the device, and results may vary from other devices.\n   * @param dataOwnerId id of a data owner, he should be part of the current data owner hierarchy.\n   * @param delegations a delegation-like object containing the encrypted key\n   * @param includeFromDelegations if true also considers delegation from the provided data owner (or parents) to look for values. This allows to\n   * decrypt delegations associated to exchange keys recovered after a giveAccessBack request.\n   * @param validateDecrypted validates the decrypted result, to drop decryption results with wrong key that still gave a valid checksum.\n   * @param tagsFilter allows to obtain only encryption keys associated to tags which satisfy the provided filter.\n   * @return the key which could be decrypted using only keys available on the current device and delegations from/to the provided data owner. May\n   * contain duplicates.\n   */\n  private async extractFromDelegationsForDataOwner(\n    dataOwnerId: string,\n    delegations: { [delegateId: string]: Delegation[] },\n    includeFromDelegations: boolean,\n    validateDecrypted: (result: string) => boolean | Promise<boolean>,\n    tagsFilter: (tags: string[]) => Promise<boolean>\n  ): Promise<string[]> {\n    const delegationsWithOwner = includeFromDelegations\n      ? Object.entries(delegations).flatMap(([delegateId, delegations]) =>\n          dataOwnerId === delegateId\n            ? this.populateDelegatedTo(delegateId, delegations)\n            : this.populateDelegatedTo(\n                delegateId,\n                delegations.filter((d) => d.owner === dataOwnerId)\n              )\n        )\n      : delegations[dataOwnerId] ?? []\n    const res = []\n    for (const delegation of delegationsWithOwner) {\n      if (await tagsFilter(delegation.tags ?? [])) {\n        const decrypted = await this.tryDecryptDelegation(delegation, (k) => validateDecrypted(k))\n        if (decrypted) res.push(decrypted)\n      }\n    }\n    return res\n  }\n\n  // Ensures that the delegatedTo field of delegations has the appropriate values, else returns a copy of the delegations with the appropriate value.\n  private populateDelegatedTo(delegateId: string, delegations: Delegation[]): Delegation[] {\n    return delegations.map((d) => (d.delegatedTo === delegateId ? d : { ...d, delegatedTo: delegateId }))\n  }\n\n  private async extractedHierarchyFromDelegation(\n    delegations: { [delegateId: string]: Delegation[] },\n    validateDecrypted: (result: string) => boolean | Promise<boolean>,\n    tagsFilter: (tags: string[]) => Promise<boolean>\n  ): Promise<{ ownerId: string; extracted: string[] }[]> {\n    return Promise.all(\n      (await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()).map(async (ownerId) => {\n        const extracted = this.deduplicate(\n          await this.extractFromDelegationsForDataOwner(\n            ownerId,\n            delegations,\n            true,\n            (k) => validateDecrypted(k),\n            (t) => tagsFilter(t)\n          )\n        )\n        return { ownerId, extracted }\n      })\n    )\n  }\n\n  /**\n   * @internal This method should be private but is currently public/internal to allow to continue supporting legacy methods\n   */\n  async extractMergedHierarchyFromDelegationAndOwner(\n    delegations: { [delegateId: string]: Delegation[] },\n    dataOwnerId: string | undefined,\n    validateDecrypted: (result: string) => boolean | Promise<boolean>,\n    tagsFilter: (tags: string[]) => Promise<boolean>\n  ): Promise<string[]> {\n    const hierarchy = dataOwnerId\n      ? await this.dataOwnerApi.getCurrentDataOwnerHierarchyIdsFrom(dataOwnerId)\n      : await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n    const extractedByOwner = await Promise.all(\n      // Reverse is just to keep method behaviour as close as possible to the legacy behaviour, in case someone depended on the ordering.\n      [...hierarchy].reverse().map((ownerId) =>\n        this.extractFromDelegationsForDataOwner(\n          ownerId,\n          delegations,\n          true,\n          (k) => validateDecrypted(k),\n          (t) => tagsFilter(t)\n        )\n      )\n    )\n    return this.deduplicate(extractedByOwner.flatMap((x) => x))\n  }\n\n  private async tryDecryptDelegation(\n    delegation: Delegation,\n    validateDecrypted: (result: string) => boolean | Promise<boolean>\n  ): Promise<string | undefined> {\n    const exchangeKeys = await this.exchangeKeysManager.getDecryptionExchangeKeysFor(delegation.owner!, delegation.delegatedTo!)\n    for (const key of exchangeKeys) {\n      try {\n        // Format of encrypted key for any delegation should be entityId:key, but with the merging of entities the entityId might not match the\n        // current id. As a checksum we are only verifying that the decrypted bytes can be represented as a string with exactly one ':'.\n        // Additionally, we also have a validator that is specific for each type of delegation content (encryption key, secret id, ...)\n        const decrypted = ua2string(await this.primitives.AES.decrypt(key, hex2ua(delegation.key!)))\n        const decryptedSplit = decrypted.split(':')\n        if (decryptedSplit.length === 2) {\n          const validation = validateDecrypted(decryptedSplit[1])\n          if (validation === true || (validation !== false && (await validation))) return decryptedSplit[1]\n        } else {\n          console.warn(\"Error in the decrypted delegation: content should contain exactly 1 ':', the delegation is ignored.\")\n        }\n      } catch (e) {\n        // Do nothing: the delegation uses another exchange key owner->delegator\n      }\n    }\n  }\n\n  private async tryImportKey(key: string): Promise<CryptoKey | undefined> {\n    if (!/^[0-9A-Fa-f\\-]+$/g.test(key)) return undefined\n    try {\n      return await this.primitives.AES.importKey('raw', hex2ua(key.replace(/-/g, '')))\n    } catch (e) {\n      console.warn(`Could not import key ${key} as an encryption key.`, e)\n      return undefined\n    }\n  }\n\n  /**\n   * @internal this method is for internal use only and may be changed without notice.\n   */\n  async importFirstValidKey(keys: string[], entityId: string): Promise<{ key: CryptoKey; raw: string }> {\n    const res = await this.tryImportFirstValidKey(keys, entityId)\n    if (!res) throw new Error(`Could not find any valid key for entity ${entityId}.`)\n    return res\n  }\n\n  private async tryImportFirstValidKey(keys: string[], entityId: string): Promise<{ key: CryptoKey; raw: string } | undefined> {\n    for (const key of keys) {\n      const imported = await this.tryImportKey(key)\n      if (imported) return { key: imported, raw: key }\n    }\n  }\n\n  /**\n   * @internal this method is for internal use only and may be changed without notice.\n   */\n  async importAllValidKeys(keys: string[]): Promise<{ key: CryptoKey; raw: string }[]> {\n    const res = []\n    for (const key of keys) {\n      const imported = await this.tryImportKey(key)\n      if (imported) res.push({ key: imported, raw: key })\n    }\n    return res\n  }\n\n  private async validateEncryptionKey(key: string): Promise<boolean> {\n    return !!(await this.tryImportKey(key))\n  }\n\n  private validateSecretId(key: string): boolean {\n    return !!key\n  }\n\n  private validateOwningEntityId(key: string): boolean {\n    return !!key\n  }\n\n  private async createEncryptionKeyDelegation(\n    entityId: string,\n    delegateId: string,\n    exchangeKey: CryptoKey,\n    encryptionKey: string,\n    newTags: string[]\n  ): Promise<Delegation> {\n    if (!(await this.validateEncryptionKey(encryptionKey))) throw new Error(`Invalid encryption key ${encryptionKey}`)\n    return this.createDelegation(entityId, delegateId, exchangeKey, encryptionKey, newTags)\n  }\n\n  private async createSecretIdDelegation(\n    entityId: string,\n    delegateId: string,\n    exchangeKey: CryptoKey,\n    secretId: string,\n    newTags: string[]\n  ): Promise<Delegation> {\n    if (!this.validateSecretId(secretId)) throw new Error(`Invalid secret id ${secretId}`)\n    return this.createDelegation(entityId, delegateId, exchangeKey, secretId, newTags)\n  }\n\n  private async createOwningEntityIdDelegation(\n    entityId: string,\n    delegateId: string,\n    exchangeKey: CryptoKey,\n    owningEntityId: string,\n    newTags: string[]\n  ): Promise<Delegation> {\n    if (!this.validateOwningEntityId(owningEntityId)) throw new Error(`Invalid owning id ${owningEntityId}`)\n    return this.createDelegation(entityId, delegateId, exchangeKey, owningEntityId, newTags)\n  }\n\n  private async createDelegation(\n    entityId: string,\n    delegateId: string,\n    exchangeKey: CryptoKey,\n    content: string,\n    newTags: string[]\n  ): Promise<Delegation> {\n    if (entityId.includes(':')) throw new Error(\"Ids for encrypted entities are not allowed to contain ':'\")\n    if (content.includes(':')) throw new Error(\"Content of delegations can not contain ':'\")\n    return {\n      delegatedTo: delegateId,\n      owner: await this.dataOwnerApi.getCurrentDataOwnerId(),\n      key: ua2hex(await this.primitives.AES.encrypt(exchangeKey, string2ua(entityId + ':' + content))),\n      tags: newTags,\n    }\n  }\n\n  private async loadEncryptionKeysForDelegates<T extends EncryptedEntity>(\n    entity: T,\n    delegates: string[]\n  ): Promise<{ updatedEntity: T; keysForDelegates: { [delegateId: string]: CryptoKey[] } }> {\n    const { updatedDelegator, keysForDelegates } = await delegates.reduce(\n      async (acc, delegateId) => {\n        const awaitedAcc = await acc\n        const currUpdateResult = await this.exchangeKeysManager.getOrCreateEncryptionExchangeKeysTo(delegateId)\n        return {\n          updatedDelegator: currUpdateResult.updatedDelegator ?? awaitedAcc.updatedDelegator,\n          keysForDelegates: {\n            ...awaitedAcc.keysForDelegates,\n            [delegateId]: currUpdateResult.keys,\n          },\n        }\n      },\n      Promise.resolve({\n        updatedDelegator: undefined as DataOwnerWithType | undefined,\n        keysForDelegates: {} as { [delegateId: string]: CryptoKey[] },\n      })\n    )\n    const updatedEntity =\n      entity.id === updatedDelegator?.dataOwner?.id\n        ? {\n            ...entity,\n            rev: updatedDelegator!.dataOwner.rev,\n            hcPartyKeys: updatedDelegator!.dataOwner.hcPartyKeys,\n            aesExchangeKeys: updatedDelegator!.dataOwner.aesExchangeKeys,\n          }\n        : entity\n    return { updatedEntity, keysForDelegates }\n  }\n\n  private async createOrUpdateEntityDelegations<T extends EncryptedEntity>(\n    entity: T,\n    delegateId: string,\n    existingSecretIds: Delegation[],\n    existingEncryptionKeys: Delegation[],\n    existingOwningEntityIds: Delegation[],\n    newSecretIds: string[],\n    newEncryptionKeys: string[],\n    newOwningEntityIds: string[],\n    newTags: string[],\n    keysForDelegates: { [delegateId: string]: CryptoKey[] }\n  ): Promise<T> {\n    const entityCopy = _.cloneDeep(entity)\n    if (newSecretIds.length === 0 && newEncryptionKeys.length === 0 && newOwningEntityIds.length === 0) return entityCopy\n    const chosenKey = keysForDelegates[delegateId][0]\n    const updatedSecretIds = [\n      ...existingSecretIds,\n      ...(await Promise.all(newSecretIds.map((x) => this.createSecretIdDelegation(entity.id!, delegateId, chosenKey, x, newTags)))),\n    ]\n    const updatedEncryptionKeys = [\n      ...existingEncryptionKeys,\n      ...(await Promise.all(newEncryptionKeys.map((x) => this.createEncryptionKeyDelegation(entity.id!, delegateId, chosenKey, x, newTags)))),\n    ]\n    const updatedOwningEntityIds = [\n      ...existingOwningEntityIds,\n      ...(await Promise.all(newOwningEntityIds.map((x) => this.createOwningEntityIdDelegation(entity.id!, delegateId, chosenKey, x, newTags)))),\n    ]\n    if (updatedSecretIds.length > 0) {\n      entityCopy.delegations = {\n        ...(entity.delegations ?? {}),\n        [delegateId]: updatedSecretIds,\n      }\n    }\n    if (updatedEncryptionKeys.length > 0) {\n      entityCopy.encryptionKeys = {\n        ...(entity.encryptionKeys ?? {}),\n        [delegateId]: updatedEncryptionKeys,\n      }\n    }\n    if (updatedOwningEntityIds.length > 0) {\n      entityCopy.cryptedForeignKeys = {\n        ...(entity.cryptedForeignKeys ?? {}),\n        [delegateId]: updatedOwningEntityIds,\n      }\n    }\n    return entityCopy\n  }\n\n  /**\n   * De-duplicates all currently accessible delegations, by removing any delegations created by the current data owner which have duplicated content,\n   * and checks if any of the required entries are currently available to the delegate through the existing delegations.\n   * @param delegateId id of the delegate.\n   * @param allDelegations delegations of the entity.\n   * @param requiredEntries potentially new entries that the delegate needs to be able to access from the delegations.\n   * @param validateDecrypted validator for decrypted delegation content\n   * @return the deduplicated delegations\n   */\n  private async deduplicateDelegationsAndFilterRequiredEntries(\n    delegateId: string,\n    allDelegations: { [delegateId: string]: Delegation[] },\n    requiredEntries: string[],\n    validateDecrypted: (x: string) => boolean | Promise<boolean>\n  ): Promise<{\n    deduplicatedDelegations: Delegation[]\n    missingEntries: string[]\n  }> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const delegationsToDelegate = allDelegations[delegateId] ?? []\n    const decryptedDelegations = await Promise.all(\n      delegationsToDelegate.map(async (d) => ({\n        delegation: d,\n        content: d.owner === selfId ? await this.tryDecryptDelegation(d, (x) => validateDecrypted(x)) : undefined,\n      }))\n    )\n    const deduplicatedDelegations: Delegation[] = []\n    const deduplicatedContent = new Map<string, string[][]>()\n    decryptedDelegations.forEach(({ delegation, content }) => {\n      if (content === undefined) {\n        // Keep all delegations we could not decrypt or from other data owners\n        deduplicatedDelegations.push(delegation)\n      } else {\n        const deduplicatedTags = deduplicatedContent.get(content)\n        if (!deduplicatedTags) {\n          deduplicatedContent.set(content, [delegation.tags ?? []])\n          deduplicatedDelegations.push(delegation)\n        } else if (!deduplicatedTags.some((t) => arrayEquals(t, delegation.tags ?? []))) {\n          deduplicatedTags.push(delegation.tags ?? [])\n          deduplicatedDelegations.push(delegation)\n        }\n      }\n    })\n    const delegationsFromDelegateToSelf = (allDelegations[selfId] ?? []).filter((d) => d.owner === delegateId)\n    const decryptedDelegationsFromDelegate = new Set(\n      await Promise.all(delegationsFromDelegateToSelf.map((d) => this.tryDecryptDelegation(d, (x) => validateDecrypted(x)))).then((dels) =>\n        dels.flatMap((x) => (x ? [x] : []))\n      )\n    )\n    return {\n      deduplicatedDelegations,\n      missingEntries: requiredEntries.filter((entry) => !(deduplicatedContent.has(entry) || decryptedDelegationsFromDelegate.has(entry))),\n    }\n  }\n\n  private deduplicate<T>(values: T[]): T[] {\n    return [...new Set(values)]\n  }\n\n  private throwDetailedExceptionForInvalidParameter(argName: string, argValue: any, methodName: string, methodArgs: IArguments) {\n    if (argValue) return\n\n    let details = '\\nMethod name: icc-crypto-x-api.' + methodName + '()\\nArguments:'\n\n    if (methodArgs) {\n      try {\n        const argsArray = [...methodArgs]\n        _.each(argsArray, (arg, index) => (details += '\\n[' + index + ']: ' + JSON.stringify(arg)))\n      } catch (ex) {\n        details += '; a problem occured while logging arguments details: ' + ex\n      }\n    }\n\n    throw new Error('### THIS SHOULD NOT HAPPEN: ' + argName + ' has an invalid value: ' + argValue + details)\n  }\n\n  private checkEmptyEncryptionMetadata(entity: EncryptedEntity) {\n    const existingMetadata = []\n    if (entity.delegations && Object.keys(entity.delegations).length) existingMetadata.push('delegations')\n    if (entity.cryptedForeignKeys && Object.keys(entity.cryptedForeignKeys).length) existingMetadata.push('cryptedForeignKeys')\n    if (entity.encryptionKeys && Object.keys(entity.encryptionKeys).length) existingMetadata.push('encryptionKeys')\n    if (entity.secretForeignKeys && entity.secretForeignKeys.length) existingMetadata.push('secretForeignKeys')\n    if (existingMetadata.length > 0) {\n      throw new Error(\n        `Entity should have no encryption metadata on initialisation, but the following fields already have some values: ${existingMetadata}\\n` +\n          JSON.stringify(entity, undefined, 2)\n      )\n    }\n  }\n}\n"]}

package/dist/icc-x-api/crypto/ExchangeKeysManager.d.ts

@@ -0,0 +1,56 @@
+import { KeyManager } from './KeyManager';
+import { BaseExchangeKeysManager } from './BaseExchangeKeysManager';
+import { DataOwnerWithType, IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { CryptoPrimitives } from './CryptoPrimitives';
+import { CryptoStrategies } from './CryptoStrategies';
+import { IcureStorageFacade } from '../storage/IcureStorageFacade';
+/**
+ * @internal This class is meant only for internal use and may be changed without notice.
+ * More powerful version of {@link BaseExchangeKeysManager} with a simplified interface. Has the following functionalities:
+ * - Caches results
+ * - Automatically creates new exchange keys if none is available
+ * - Automatically choose the public keys to use during the creation of new exchange keys
+ * - Automatically retrieves the private keys to use during decryption.
+ */
+export declare class ExchangeKeysManager {
+    private readonly keyManager;
+    private readonly baseExchangeKeysManager;
+    private readonly dataOwnerApi;
+    private readonly cryptoStrategies;
+    private readonly primitives;
+    private readonly icureStorage;
+    private delegatorExchangeKeysCache;
+    private delegatedExchangeKeysCache;
+    get base(): BaseExchangeKeysManager;
+    constructor(delegatorKeysCacheSize: number, delegatedKeysCacheSize: number, delegatedKeysCacheLifetimeMsBase: number, delegatedKeysCacheLifetimeMsNoKeys: number, cryptoStrategies: CryptoStrategies, primitives: CryptoPrimitives, keyManager: KeyManager, baseExchangeKeysManager: BaseExchangeKeysManager, dataOwnerApi: IccDataOwnerXApi, icureStorage: IcureStorageFacade);
+    /**
+     * Get exchange keys from the current data owner to the provided delegate which are safe for encryption according to the locally verified keys.
+     * If currently there is no exchange key towards the provided delegate which is safe for encryption a new one will be automatically created.
+     * @param delegateId a delegate
+     * @return an object with the following fields:
+     *  - keys: all available exchange keys which are safe for encryption.
+     *  - updatedDelegator (optional): if a new key creation job was started when the function was invoked the updated delegator, else undefined.
+     */
+    getOrCreateEncryptionExchangeKeysTo(delegateId: string): Promise<{
+        updatedDelegator?: DataOwnerWithType;
+        keys: CryptoKey[];
+    }>;
+    /**
+     * Get all keys currently available for a delegator-delegate pair. At least one of the two data owners must be part of the hierarchy for the current
+     * data owner.
+     * @param delegatorId id of a delegator
+     * @param delegateId id of a delegate
+     * @throws if neither the delegator nor the delegate is part of the hierarchy of the current data owner.
+     * @return all available exchange keys from the delegator-delegate pair.
+     */
+    getDecryptionExchangeKeysFor(delegatorId: string, delegateId: string): Promise<CryptoKey[]>;
+    /**
+     * Empties the exchange keys cache.
+     * @param includeKeysFromCurrentDataOwner if true also clears the
+     */
+    clearCache(includeKeysFromCurrentDataOwner: boolean): void;
+    private forceGetExchangeKeysFor;
+    private getSelfExchangeKeysTo;
+    private forceGetSelfExchangeKeysTo;
+    private forceCreateVerifiedExchangeKeyTo;
+}

package/dist/icc-x-api/crypto/ExchangeKeysManager.js

@@ -0,0 +1,147 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExchangeKeysManager = void 0;
+const lru_temporised_async_cache_1 = require("../utils/lru-temporised-async-cache");
+const utils_1 = require("./utils");
+/**
+ * @internal This class is meant only for internal use and may be changed without notice.
+ * More powerful version of {@link BaseExchangeKeysManager} with a simplified interface. Has the following functionalities:
+ * - Caches results
+ * - Automatically creates new exchange keys if none is available
+ * - Automatically choose the public keys to use during the creation of new exchange keys
+ * - Automatically retrieves the private keys to use during decryption.
+ */
+class ExchangeKeysManager {
+    get base() {
+        return this.baseExchangeKeysManager;
+    }
+    constructor(delegatorKeysCacheSize, delegatedKeysCacheSize, delegatedKeysCacheLifetimeMsBase, delegatedKeysCacheLifetimeMsNoKeys, cryptoStrategies, primitives, keyManager, baseExchangeKeysManager, dataOwnerApi, icureStorage) {
+        this.primitives = primitives;
+        this.cryptoStrategies = cryptoStrategies;
+        this.keyManager = keyManager;
+        this.baseExchangeKeysManager = baseExchangeKeysManager;
+        this.dataOwnerApi = dataOwnerApi;
+        this.delegatedExchangeKeysCache = new lru_temporised_async_cache_1.LruTemporisedAsyncCache(delegatedKeysCacheSize, (keys) => keys.length > 0 ? delegatedKeysCacheLifetimeMsBase : delegatedKeysCacheLifetimeMsNoKeys);
+        this.delegatorExchangeKeysCache = new lru_temporised_async_cache_1.LruTemporisedAsyncCache(delegatorKeysCacheSize, () => -1);
+        this.icureStorage = icureStorage;
+    }
+    /**
+     * Get exchange keys from the current data owner to the provided delegate which are safe for encryption according to the locally verified keys.
+     * If currently there is no exchange key towards the provided delegate which is safe for encryption a new one will be automatically created.
+     * @param delegateId a delegate
+     * @return an object with the following fields:
+     *  - keys: all available exchange keys which are safe for encryption.
+     *  - updatedDelegator (optional): if a new key creation job was started when the function was invoked the updated delegator, else undefined.
+     */
+    getOrCreateEncryptionExchangeKeysTo(delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const currentKeys = yield this.getSelfExchangeKeysTo(delegateId);
+            if (currentKeys.length > 0) {
+                return { keys: currentKeys };
+            }
+            else {
+                while (true) {
+                    let updatedDelegatorJob = undefined;
+                    const keysWithNew = yield this.delegatorExchangeKeysCache.get(delegateId, (previous) => __awaiter(this, void 0, void 0, function* () {
+                        const fullJob = this.forceCreateVerifiedExchangeKeyTo(delegateId);
+                        updatedDelegatorJob = fullJob.then(({ updatedDelegator }) => updatedDelegator);
+                        let existingKeys = previous ? previous : yield this.forceGetSelfExchangeKeysTo(delegateId);
+                        return fullJob.then(({ key }) => [...existingKeys, key]);
+                    }), (v) => !v.length);
+                    if (keysWithNew.length > 0) {
+                        const updatedDelegator = updatedDelegatorJob ? yield updatedDelegatorJob : undefined;
+                        return updatedDelegator ? { keys: keysWithNew, updatedDelegator } : { keys: keysWithNew };
+                    }
+                }
+                /*NOTE:
+                 * in case of two concurrent calls to `getOrCreateEncryptionExchangeKeysTo` only one of the calls will receive the updated delegator. This could
+                 * be a problem if one of the callers would want to update the delegator for other reasons as well, as the request would result in a database
+                 * conflict. This situation however should be very rare and will be fully resolved in the near future when delegations will be moved out of the
+                 * data owner objects and into a specific database.
+                 */
+            }
+        });
+    }
+    /**
+     * Get all keys currently available for a delegator-delegate pair. At least one of the two data owners must be part of the hierarchy for the current
+     * data owner.
+     * @param delegatorId id of a delegator
+     * @param delegateId id of a delegate
+     * @throws if neither the delegator nor the delegate is part of the hierarchy of the current data owner.
+     * @return all available exchange keys from the delegator-delegate pair.
+     */
+    getDecryptionExchangeKeysFor(delegatorId, delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (delegatorId === (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
+                return yield this.getSelfExchangeKeysTo(delegateId);
+            }
+            else {
+                const key = `${delegatorId}->${delegateId}`;
+                const hierarchyIds = yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds();
+                if (!hierarchyIds.some((x) => x === delegateId || x === delegatorId))
+                    throw new Error(`Trying to retrieve exchange key ${key} but current data owner hierarchy is ${hierarchyIds}`);
+                return yield this.delegatedExchangeKeysCache.get(key, () => this.forceGetExchangeKeysFor(delegatorId, delegateId));
+            }
+        });
+    }
+    /**
+     * Empties the exchange keys cache.
+     * @param includeKeysFromCurrentDataOwner if true also clears the
+     */
+    clearCache(includeKeysFromCurrentDataOwner) {
+        if (includeKeysFromCurrentDataOwner)
+            this.delegatorExchangeKeysCache.clear();
+        this.delegatedExchangeKeysCache.clear();
+    }
+    forceGetExchangeKeysFor(delegatorId, delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const encKeys = yield this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(delegatorId, delegateId);
+            return (yield this.baseExchangeKeysManager.tryDecryptExchangeKeys(encKeys, this.keyManager.getDecryptionKeys())).successfulDecryptions;
+        });
+    }
+    getSelfExchangeKeysTo(delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.delegatorExchangeKeysCache.get(delegateId, () => this.forceGetSelfExchangeKeysTo(delegateId));
+        });
+    }
+    forceGetSelfExchangeKeysTo(delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Retrieve then try to decrypt with own and parent key pairs
+            const encKeys = yield this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(yield this.dataOwnerApi.getCurrentDataOwnerId(), delegateId);
+            const { successfulDecryptions } = yield this.baseExchangeKeysManager.tryDecryptExchangeKeys(encKeys, this.keyManager.getDecryptionKeys());
+            return successfulDecryptions;
+        });
+    }
+    forceCreateVerifiedExchangeKeyTo(delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const [mainKey, ...otherSelfKeys] = this.keyManager.getSelfVerifiedKeys();
+            let otherPublicKeys = Object.fromEntries(otherSelfKeys.map((x) => [x.fingerprint, x.pair.publicKey]));
+            if (delegateId !== (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
+                const delegate = (yield this.dataOwnerApi.getDataOwner(delegateId)).dataOwner;
+                const delegatePublicKeys = Array.from(this.dataOwnerApi.getHexPublicKeysOf(delegate));
+                let verifiedDelegatePublicKeys;
+                if ((yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()).includes(delegateId)) {
+                    verifiedDelegatePublicKeys = yield this.keyManager.getVerifiedPublicKeysFor(delegate);
+                }
+                else {
+                    verifiedDelegatePublicKeys = yield this.cryptoStrategies.verifyDelegatePublicKeys(delegate, delegatePublicKeys, this.primitives);
+                }
+                if (!verifiedDelegatePublicKeys || verifiedDelegatePublicKeys.length == 0)
+                    throw new Error(`No verified public keys for delegate ${delegateId}: impossible to create new exchange key.`);
+                otherPublicKeys = Object.assign(Object.assign({}, otherPublicKeys), (yield (0, utils_1.loadPublicKeys)(this.primitives.RSA, verifiedDelegatePublicKeys)));
+            }
+            return yield this.baseExchangeKeysManager.createOrUpdateEncryptedExchangeKeyTo(delegateId, mainKey.pair, otherPublicKeys);
+        });
+    }
+}
+exports.ExchangeKeysManager = ExchangeKeysManager;
+//# sourceMappingURL=ExchangeKeysManager.js.map

package/dist/icc-x-api/crypto/ExchangeKeysManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExchangeKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ExchangeKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,oFAA6E;AAC7E,mCAAwC;AAKxC;;;;;;;GAOG;AACH,MAAa,mBAAmB;IAoB9B,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,uBAAuB,CAAA;IACrC,CAAC;IAED,YACE,sBAA8B,EAC9B,sBAA8B,EAC9B,gCAAwC,EACxC,kCAA0C,EAC1C,gBAAkC,EAClC,UAA4B,EAC5B,UAAsB,EACtB,uBAAgD,EAChD,YAA8B,EAC9B,YAAgC;QAEhC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAA;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAA;QACtD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,0BAA0B,GAAG,IAAI,oDAAuB,CAAC,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC7F,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,kCAAkC,CACxF,CAAA;QACD,IAAI,CAAC,0BAA0B,GAAG,IAAI,oDAAuB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/F,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;IAClC,CAAC;IAED;;;;;;;OAOG;IACG,mCAAmC,CAAC,UAAkB;;YAC1D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;YAChE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC1B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;aAC7B;iBAAM;gBACL,OAAO,IAAI,EAAE;oBACX,IAAI,mBAAmB,GAA2C,SAAS,CAAA;oBAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAC3D,UAAU,EACV,CAAO,QAAQ,EAAE,EAAE;wBACjB,MAAM,OAAO,GAAG,IAAI,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAA;wBACjE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAA;wBAC9E,IAAI,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAA;wBAC1F,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,CAAA;oBAC1D,CAAC,CAAA,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CACjB,CAAA;oBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC1B,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAA;wBACpF,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;qBAC1F;iBACF;gBACD;;;;;mBAKG;aACJ;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,4BAA4B,CAAC,WAAmB,EAAE,UAAkB;;YACxE,IAAI,WAAW,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC,EAAE;gBACrE,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;aACpD;iBAAM;gBACL,MAAM,GAAG,GAAG,GAAG,WAAW,KAAK,UAAU,EAAE,CAAA;gBAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;gBAC9E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,CAAC;oBAClE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,wCAAwC,YAAY,EAAE,CAAC,CAAA;gBAC/G,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAA;aACnH;QACH,CAAC;KAAA;IAED;;;OAGG;IACH,UAAU,CAAC,+BAAwC;QACjD,IAAI,+BAA+B;YAAE,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAA;QAC5E,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAA;IACzC,CAAC;IAEa,uBAAuB,CAAC,WAAmB,EAAE,UAAkB;;YAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;YACvG,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAA;QACxI,CAAC;KAAA;IAEa,qBAAqB,CAAC,UAAkB;;YACpD,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAA;QACjH,CAAC;KAAA;IAEa,0BAA0B,CAAC,UAAkB;;YACzD,6DAA6D;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,CAAC,CAAA;YAC3I,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAA;YACzI,OAAO,qBAAqB,CAAA;QAC9B,CAAC;KAAA;IAEa,gCAAgC,CAAC,UAAkB;;YAC/D,MAAM,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAA;YACzE,IAAI,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACrG,IAAI,UAAU,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC,EAAE;gBACpE,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC7E,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAA;gBACrF,IAAI,0BAAoC,CAAA;gBACxC,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;oBACpF,0BAA0B,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAA;iBACtF;qBAAM;oBACL,0BAA0B,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;iBACjI;gBACD,IAAI,CAAC,0BAA0B,IAAI,0BAA0B,CAAC,MAAM,IAAI,CAAC;oBACvE,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,0CAA0C,CAAC,CAAA;gBAC/G,eAAe,mCACV,eAAe,GACf,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,CAC3E,CAAA;aACF;YACD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;QAC3H,CAAC;KAAA;CACF;AAzJD,kDAyJC","sourcesContent":["import { KeyManager } from './KeyManager'\nimport { BaseExchangeKeysManager } from './BaseExchangeKeysManager'\nimport { DataOwnerWithType, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { loadPublicKeys } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\n\n/**\n * @internal This class is meant only for internal use and may be changed without notice.\n * More powerful version of {@link BaseExchangeKeysManager} with a simplified interface. Has the following functionalities:\n * - Caches results\n * - Automatically creates new exchange keys if none is available\n * - Automatically choose the public keys to use during the creation of new exchange keys\n * - Automatically retrieves the private keys to use during decryption.\n */\nexport class ExchangeKeysManager {\n  private readonly keyManager: KeyManager\n  private readonly baseExchangeKeysManager: BaseExchangeKeysManager\n  private readonly dataOwnerApi: IccDataOwnerXApi\n  private readonly cryptoStrategies: CryptoStrategies\n  private readonly primitives: CryptoPrimitives\n  private readonly icureStorage: IcureStorageFacade\n  /*\n   * Exchange keys cache where the current user is the delegator. The keys where the delegator is the current user should never change without\n   * an action from the delegator (unless he does this action from another device), so it should be safe to store them without expiration. However,\n   * the delegator may still have a lot of exchange keys (e.g. doctor -> all patients), so it is not safe to have a cache with unlimited size.\n   */\n  private delegatorExchangeKeysCache: LruTemporisedAsyncCache<string, CryptoKey[]>\n  /*\n   * Exchange keys cache where the current user is not the delegator. There may be many keys where the current user is the delegate,\n   * and they may change over time without any action from the current data owner, since the delegator is someone else. For this reason the cache must\n   * be limited in size and it should not use data that is too old, as it may be outdated.\n   */\n  private delegatedExchangeKeysCache: LruTemporisedAsyncCache<string, CryptoKey[]>\n\n  get base(): BaseExchangeKeysManager {\n    return this.baseExchangeKeysManager\n  }\n\n  constructor(\n    delegatorKeysCacheSize: number,\n    delegatedKeysCacheSize: number,\n    delegatedKeysCacheLifetimeMsBase: number,\n    delegatedKeysCacheLifetimeMsNoKeys: number,\n    cryptoStrategies: CryptoStrategies,\n    primitives: CryptoPrimitives,\n    keyManager: KeyManager,\n    baseExchangeKeysManager: BaseExchangeKeysManager,\n    dataOwnerApi: IccDataOwnerXApi,\n    icureStorage: IcureStorageFacade\n  ) {\n    this.primitives = primitives\n    this.cryptoStrategies = cryptoStrategies\n    this.keyManager = keyManager\n    this.baseExchangeKeysManager = baseExchangeKeysManager\n    this.dataOwnerApi = dataOwnerApi\n    this.delegatedExchangeKeysCache = new LruTemporisedAsyncCache(delegatedKeysCacheSize, (keys) =>\n      keys.length > 0 ? delegatedKeysCacheLifetimeMsBase : delegatedKeysCacheLifetimeMsNoKeys\n    )\n    this.delegatorExchangeKeysCache = new LruTemporisedAsyncCache(delegatorKeysCacheSize, () => -1)\n    this.icureStorage = icureStorage\n  }\n\n  /**\n   * Get exchange keys from the current data owner to the provided delegate which are safe for encryption according to the locally verified keys.\n   * If currently there is no exchange key towards the provided delegate which is safe for encryption a new one will be automatically created.\n   * @param delegateId a delegate\n   * @return an object with the following fields:\n   *  - keys: all available exchange keys which are safe for encryption.\n   *  - updatedDelegator (optional): if a new key creation job was started when the function was invoked the updated delegator, else undefined.\n   */\n  async getOrCreateEncryptionExchangeKeysTo(delegateId: string): Promise<{ updatedDelegator?: DataOwnerWithType; keys: CryptoKey[] }> {\n    const currentKeys = await this.getSelfExchangeKeysTo(delegateId)\n    if (currentKeys.length > 0) {\n      return { keys: currentKeys }\n    } else {\n      while (true) {\n        let updatedDelegatorJob: Promise<DataOwnerWithType> | undefined = undefined\n        const keysWithNew = await this.delegatorExchangeKeysCache.get(\n          delegateId,\n          async (previous) => {\n            const fullJob = this.forceCreateVerifiedExchangeKeyTo(delegateId)\n            updatedDelegatorJob = fullJob.then(({ updatedDelegator }) => updatedDelegator)\n            let existingKeys = previous ? previous : await this.forceGetSelfExchangeKeysTo(delegateId)\n            return fullJob.then(({ key }) => [...existingKeys, key])\n          },\n          (v) => !v.length\n        )\n        if (keysWithNew.length > 0) {\n          const updatedDelegator = updatedDelegatorJob ? await updatedDelegatorJob : undefined\n          return updatedDelegator ? { keys: keysWithNew, updatedDelegator } : { keys: keysWithNew }\n        }\n      }\n      /*NOTE:\n       * in case of two concurrent calls to `getOrCreateEncryptionExchangeKeysTo` only one of the calls will receive the updated delegator. This could\n       * be a problem if one of the callers would want to update the delegator for other reasons as well, as the request would result in a database\n       * conflict. This situation however should be very rare and will be fully resolved in the near future when delegations will be moved out of the\n       * data owner objects and into a specific database.\n       */\n    }\n  }\n\n  /**\n   * Get all keys currently available for a delegator-delegate pair. At least one of the two data owners must be part of the hierarchy for the current\n   * data owner.\n   * @param delegatorId id of a delegator\n   * @param delegateId id of a delegate\n   * @throws if neither the delegator nor the delegate is part of the hierarchy of the current data owner.\n   * @return all available exchange keys from the delegator-delegate pair.\n   */\n  async getDecryptionExchangeKeysFor(delegatorId: string, delegateId: string): Promise<CryptoKey[]> {\n    if (delegatorId === (await this.dataOwnerApi.getCurrentDataOwnerId())) {\n      return await this.getSelfExchangeKeysTo(delegateId)\n    } else {\n      const key = `${delegatorId}->${delegateId}`\n      const hierarchyIds = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n      if (!hierarchyIds.some((x) => x === delegateId || x === delegatorId))\n        throw new Error(`Trying to retrieve exchange key ${key} but current data owner hierarchy is ${hierarchyIds}`)\n      return await this.delegatedExchangeKeysCache.get(key, () => this.forceGetExchangeKeysFor(delegatorId, delegateId))\n    }\n  }\n\n  /**\n   * Empties the exchange keys cache.\n   * @param includeKeysFromCurrentDataOwner if true also clears the\n   */\n  clearCache(includeKeysFromCurrentDataOwner: boolean) {\n    if (includeKeysFromCurrentDataOwner) this.delegatorExchangeKeysCache.clear()\n    this.delegatedExchangeKeysCache.clear()\n  }\n\n  private async forceGetExchangeKeysFor(delegatorId: string, delegateId: string): Promise<CryptoKey[]> {\n    const encKeys = await this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(delegatorId, delegateId)\n    return (await this.baseExchangeKeysManager.tryDecryptExchangeKeys(encKeys, this.keyManager.getDecryptionKeys())).successfulDecryptions\n  }\n\n  private async getSelfExchangeKeysTo(delegateId: string): Promise<CryptoKey[]> {\n    return await this.delegatorExchangeKeysCache.get(delegateId, () => this.forceGetSelfExchangeKeysTo(delegateId))\n  }\n\n  private async forceGetSelfExchangeKeysTo(delegateId: string): Promise<CryptoKey[]> {\n    // Retrieve then try to decrypt with own and parent key pairs\n    const encKeys = await this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(await this.dataOwnerApi.getCurrentDataOwnerId(), delegateId)\n    const { successfulDecryptions } = await this.baseExchangeKeysManager.tryDecryptExchangeKeys(encKeys, this.keyManager.getDecryptionKeys())\n    return successfulDecryptions\n  }\n\n  private async forceCreateVerifiedExchangeKeyTo(delegateId: string): Promise<{ updatedDelegator: DataOwnerWithType; key: CryptoKey }> {\n    const [mainKey, ...otherSelfKeys] = this.keyManager.getSelfVerifiedKeys()\n    let otherPublicKeys = Object.fromEntries(otherSelfKeys.map((x) => [x.fingerprint, x.pair.publicKey]))\n    if (delegateId !== (await this.dataOwnerApi.getCurrentDataOwnerId())) {\n      const delegate = (await this.dataOwnerApi.getDataOwner(delegateId)).dataOwner\n      const delegatePublicKeys = Array.from(this.dataOwnerApi.getHexPublicKeysOf(delegate))\n      let verifiedDelegatePublicKeys: string[]\n      if ((await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()).includes(delegateId)) {\n        verifiedDelegatePublicKeys = await this.keyManager.getVerifiedPublicKeysFor(delegate)\n      } else {\n        verifiedDelegatePublicKeys = await this.cryptoStrategies.verifyDelegatePublicKeys(delegate, delegatePublicKeys, this.primitives)\n      }\n      if (!verifiedDelegatePublicKeys || verifiedDelegatePublicKeys.length == 0)\n        throw new Error(`No verified public keys for delegate ${delegateId}: impossible to create new exchange key.`)\n      otherPublicKeys = {\n        ...otherPublicKeys,\n        ...(await loadPublicKeys(this.primitives.RSA, verifiedDelegatePublicKeys)),\n      }\n    }\n    return await this.baseExchangeKeysManager.createOrUpdateEncryptedExchangeKeyTo(delegateId, mainKey.pair, otherPublicKeys)\n  }\n}\n"]}

package/dist/icc-x-api/crypto/KeyManager.d.ts

@@ -0,0 +1,103 @@
+import { DataOwner, IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { KeyPair } from './RSA';
+import { IcureStorageFacade } from '../storage/IcureStorageFacade';
+import { BaseExchangeKeysManager } from './BaseExchangeKeysManager';
+import { CryptoPrimitives } from './CryptoPrimitives';
+import { KeyRecovery } from './KeyRecovery';
+import { CryptoStrategies } from './CryptoStrategies';
+/**
+ * Allows to manage public and private keys for the current user and his parent hierarchy.
+ */
+export declare class KeyManager {
+    private readonly primitives;
+    private readonly dataOwnerApi;
+    private readonly keyRecovery;
+    private readonly icureStorage;
+    private readonly baseExchangeKeyManager;
+    private readonly strategies;
+    private selfId;
+    private selfLegacyPublicKey;
+    private keysCache;
+    constructor(primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, icureStorage: IcureStorageFacade, keyRecovery: KeyRecovery, baseExchangeKeyManager: BaseExchangeKeysManager, strategies: CryptoStrategies);
+    /**
+     * Get the public keys of available key pairs for the current user in hex-encoded spki representation (uses cached keys: no request is done to the
+     * server).
+     * By setting {@link verifiedOnly} to true only the public keys for verified key pairs will be returned: these will include only key pairs created
+     * on this device or which have been verified using {@link CryptoStrategies} on this device.
+     * @param verifiedOnly if true only the verified public keys will be returned.
+     * @return the spki representation of public keys of available keypairs for the current user.
+     */
+    getCurrentUserAvailablePublicKeysHex(verifiedOnly: boolean): Promise<string[]>;
+    /**
+     * Get the public keys of available key pairs for the current user and his parents in hex-encoded spki representation (uses cached keys: no request
+     * is done to the server).
+     * Note that this will also include unverified keys.
+     * @return the spki representation of public keys of available keypairs for the current user.
+     */
+    getCurrentUserHierarchyAvailablePublicKeysHex(): Promise<string[]>;
+    /**
+     * Get a key pair with the provided fingerprint if present.
+     * @param fingerprint a key-pair/public-key fingerprint
+     * @return the pair associated to the fingerprint and a boolean indicating if the pair is verified, if present, else undefined
+     */
+    getKeyPairForFingerprint(fingerprint: string): {
+        pair: KeyPair<CryptoKey>;
+        verified: boolean;
+    } | undefined;
+    /**
+     * @internal This method is intended for internal use only and may be changed without notice.
+     * Initializes all keys for the current data owner. This method needs to be called before any other method of this class can be used.
+     * @throws if the current user is not a data owner, or if there is no key and no new key could be created according to this manager crypt
+     * strategies.
+     * @return if a new key was created during initialisation the newly created key, else undefined.
+     */
+    initialiseKeys(): Promise<{
+        newKeyPair: KeyPair<CryptoKey>;
+        newKeyFingerprint: string;
+    } | undefined>;
+    /**
+     * @internal This method is intended for internal use only and may be changed without notice.
+     * Forces to reload keys for the current data owner. This could be useful if the data owner has logged in from another device in order to update the
+     * transfer keys.
+     * This method will complete only after keys have been reloaded successfully.
+     */
+    reloadKeys(): Promise<void>;
+    /**
+     * @internal This method is intended for internal use only and may be changed without notice.
+     * Get all verified key pairs for the current data owner which can safely be used for encryption. This includes all key pairs created on the current
+     * device and all recovered key pairs which have been verified.
+     * The keys returned by this method will be in the following order:
+     * 1. Legacy key pair if it is verified
+     * 2. All device key pais, in alphabetical order according to the fingerprint
+     * 3. Other verified key pairs, in alphabetical order according to the fingerprint
+     * @return all verified keys, in order.
+     */
+    getSelfVerifiedKeys(): {
+        fingerprint: string;
+        pair: KeyPair<CryptoKey>;
+    }[];
+    /**
+     * Get all verified keys for a member of the current data owner hierarchy in no particular order.
+     * @param dataOwner the current data owner or a member of his hierarchy.
+     * @throws if the provided data owner is not part of the current data owner hierarchy
+     */
+    getVerifiedPublicKeysFor(dataOwner: DataOwner): Promise<string[]>;
+    /**
+     * @internal This method is intended for internal use only and may be changed without notice.
+     * Get all key pairs for the current data owner and his parents. These keys should be used only for decryption as they may have not been verified.
+     * @return all key pairs available for decryption.
+     */
+    getDecryptionKeys(): {
+        [fingerprint: string]: KeyPair<CryptoKey>;
+    };
+    private doLoadKeys;
+    private createAndSaveNewKeyPair;
+    private loadStoredKeys;
+    private verifyKeys;
+    private plainKeysByFingerprint;
+    private ensureInitialised;
+    private recoverAndCacheKeys;
+    private loadAndRecoverKeysFor;
+    private ensureFingerprintKeys;
+    private hasVerifiedKey;
+}