@icure/api 6.4.0 → 7.0.0-beta.0

package/dist/icc-x-api/storage/IcureStorageFacade.js

@@ -0,0 +1,95 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IcureStorageFacade = void 0;
+/**
+ * @internal This class is meant for internal use only and may be changed without notice.
+ * Simplifies access to the storage facades for iCure-specific data storage.
+ */
+class IcureStorageFacade {
+    constructor(keyStorage, storage, entryKeysFactory) {
+        this.keys = keyStorage;
+        this.data = storage;
+        this.entryFor = entryKeysFactory;
+    }
+    /**
+     * Saves a key pair for the data owner.
+     * @param dataOwnerId id of the data owner with the key.
+     * @param publicKeyFingerprint fingerprint of the public key of the pair.
+     * @param keyPair a key pair of the data owner.
+     * @param isDevice true if the key was generated on this device.
+     */
+    saveKey(dataOwnerId, publicKeyFingerprint, keyPair, isDevice) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const key = isDevice
+                ? this.entryFor.deviceKeypairOfDataOwner(dataOwnerId, publicKeyFingerprint)
+                : this.entryFor.cachedRecoveredKeypairOfDataOwner(dataOwnerId, publicKeyFingerprint);
+            yield this.keys.storeKeyPair(key, keyPair);
+        });
+    }
+    /**
+     * Get an existing key pair for the data owner.
+     * @param dataOwnerId id of the data owner with the key.
+     * @param publicKeyFingerprint fingerprint of a public key of the data owner.
+     * @param legacyPublicKey the legacy public key of the data owner, if present
+     * @return the keypair and if the key was generated on this device or undefined if the key pair could not be found.
+     */
+    loadKey(dataOwnerId, publicKeyFingerprint, legacyPublicKey) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const deviceKey = (_b = (_a = (yield this.keys.getKeypair(this.entryFor.deviceKeypairOfDataOwner(dataOwnerId, publicKeyFingerprint)))) !== null && _a !== void 0 ? _a : (yield this.keys.getKeypair(`org.taktik.icure.rsa.${dataOwnerId}.${publicKeyFingerprint}`))) !== null && _b !== void 0 ? _b : ((legacyPublicKey === null || legacyPublicKey === void 0 ? void 0 : legacyPublicKey.slice(-32)) === publicKeyFingerprint ? yield this.keys.getKeypair(`org.taktik.icure.rsa.${dataOwnerId}`) : undefined);
+            if (deviceKey)
+                return { pair: deviceKey, isDevice: true };
+            const cachedKey = yield this.keys.getKeypair(this.entryFor.cachedRecoveredKeypairOfDataOwner(dataOwnerId, publicKeyFingerprint));
+            if (cachedKey)
+                return { pair: cachedKey, isDevice: false };
+            return undefined;
+        });
+    }
+    /**
+     * Save the results of public key verification. If there were already results stored the entries will be merged. In case of conflicts the new
+     * {@link verificationDetails} take priority over the stored data.
+     * @param dataOwnerId id of a data owner.
+     * @param verificationDetails results of verification, associates key fingerprints to true if they were verified by the user or false otherwise.
+     * @return the udpated keys
+     */
+    saveSelfVerifiedKeys(dataOwnerId, verificationDetails) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const updated = Object.assign(Object.assign({}, (yield this.loadSelfVerifiedKeys(dataOwnerId))), verificationDetails);
+            yield this.data.setItem(this.entryFor.selfPublicKeysVerificationCacheForDataOwner(dataOwnerId), JSON.stringify(updated));
+            return updated;
+        });
+    }
+    /**
+     * Get the last saved results of public key verification.
+     * @param dataOwnerId id of a data owner.
+     * @return saved results of verification, associates key fingerprints to true if they were verified by the user or false otherwise. If no results
+     * were saved returns an empty object instead.
+     * @throws if the stored results are not in a valid format.
+     */
+    loadSelfVerifiedKeys(dataOwnerId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataString = yield this.data.getItem(this.entryFor.selfPublicKeysVerificationCacheForDataOwner(dataOwnerId));
+            if (dataString) {
+                const parsed = JSON.parse(dataString);
+                Object.entries(parsed).forEach(([k, v]) => {
+                    if (v !== true && v !== false)
+                        throw new Error(`Unexpected entry ${k}:${v}`);
+                });
+                return parsed;
+            }
+            else
+                return {};
+        });
+    }
+}
+exports.IcureStorageFacade = IcureStorageFacade;
+//# sourceMappingURL=IcureStorageFacade.js.map

package/dist/icc-x-api/storage/IcureStorageFacade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IcureStorageFacade.js","sourceRoot":"","sources":["../../../icc-x-api/storage/IcureStorageFacade.ts"],"names":[],"mappings":";;;;;;;;;;;;AAKA;;;GAGG;AACH,MAAa,kBAAkB;IAK7B,YAAY,UAA4B,EAAE,OAA8B,EAAE,gBAAyC;QACjH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;QACnB,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAA;IAClC,CAAC;IAED;;;;;;OAMG;IACG,OAAO,CAAC,WAAmB,EAAE,oBAA4B,EAAE,OAA4B,EAAE,QAAiB;;YAC9G,MAAM,GAAG,GAAG,QAAQ;gBAClB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,WAAW,EAAE,oBAAoB,CAAC;gBAC3E,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAA;YACtF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;KAAA;IAED;;;;;;OAMG;IACG,OAAO,CACX,WAAmB,EACnB,oBAA4B,EAC5B,eAAmC;;;YAEnC,MAAM,SAAS,GACb,MAAA,MAAA,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAC,mCACvG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,WAAW,IAAI,oBAAoB,EAAE,CAAC,CAAC,mCAC3F,CAAC,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,MAAK,oBAAoB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YACxI,IAAI,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;YACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAA;YAChI,IAAI,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;YAC1D,OAAO,SAAS,CAAA;;KACjB;IAED;;;;;;OAMG;IACG,oBAAoB,CACxB,WAAmB,EACnB,mBAA0D;;YAE1D,MAAM,OAAO,mCACR,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,GAC9C,mBAAmB,CACvB,CAAA;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;YACxH,OAAO,OAAO,CAAA;QAChB,CAAC;KAAA;IAED;;;;;;OAMG;IACG,oBAAoB,CAAC,WAAmB;;YAC5C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,WAAW,CAAC,CAAC,CAAA;YAClH,IAAI,UAAU,EAAE;gBACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBACrC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;oBACxC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC9E,CAAC,CAAC,CAAA;gBACF,OAAO,MAAM,CAAA;aACd;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;CACF;AAnFD,gDAmFC","sourcesContent":["import { KeyStorageFacade } from './KeyStorageFacade'\nimport { StorageFacade } from './StorageFacade'\nimport { StorageEntryKeysFactory } from './StorageEntryKeysFactory'\nimport { KeyPair } from '../crypto/RSA'\n\n/**\n * @internal This class is meant for internal use only and may be changed without notice.\n * Simplifies access to the storage facades for iCure-specific data storage.\n */\nexport class IcureStorageFacade {\n  private readonly keys: KeyStorageFacade\n  private readonly data: StorageFacade<string>\n  private readonly entryFor: StorageEntryKeysFactory\n\n  constructor(keyStorage: KeyStorageFacade, storage: StorageFacade<string>, entryKeysFactory: StorageEntryKeysFactory) {\n    this.keys = keyStorage\n    this.data = storage\n    this.entryFor = entryKeysFactory\n  }\n\n  /**\n   * Saves a key pair for the data owner.\n   * @param dataOwnerId id of the data owner with the key.\n   * @param publicKeyFingerprint fingerprint of the public key of the pair.\n   * @param keyPair a key pair of the data owner.\n   * @param isDevice true if the key was generated on this device.\n   */\n  async saveKey(dataOwnerId: string, publicKeyFingerprint: string, keyPair: KeyPair<JsonWebKey>, isDevice: boolean): Promise<void> {\n    const key = isDevice\n      ? this.entryFor.deviceKeypairOfDataOwner(dataOwnerId, publicKeyFingerprint)\n      : this.entryFor.cachedRecoveredKeypairOfDataOwner(dataOwnerId, publicKeyFingerprint)\n    await this.keys.storeKeyPair(key, keyPair)\n  }\n\n  /**\n   * Get an existing key pair for the data owner.\n   * @param dataOwnerId id of the data owner with the key.\n   * @param publicKeyFingerprint fingerprint of a public key of the data owner.\n   * @param legacyPublicKey the legacy public key of the data owner, if present\n   * @return the keypair and if the key was generated on this device or undefined if the key pair could not be found.\n   */\n  async loadKey(\n    dataOwnerId: string,\n    publicKeyFingerprint: string,\n    legacyPublicKey: string | undefined\n  ): Promise<{ pair: KeyPair<JsonWebKey>; isDevice: boolean } | undefined> {\n    const deviceKey =\n      (await this.keys.getKeypair(this.entryFor.deviceKeypairOfDataOwner(dataOwnerId, publicKeyFingerprint))) ??\n      (await this.keys.getKeypair(`org.taktik.icure.rsa.${dataOwnerId}.${publicKeyFingerprint}`)) ??\n      (legacyPublicKey?.slice(-32) === publicKeyFingerprint ? await this.keys.getKeypair(`org.taktik.icure.rsa.${dataOwnerId}`) : undefined)\n    if (deviceKey) return { pair: deviceKey, isDevice: true }\n    const cachedKey = await this.keys.getKeypair(this.entryFor.cachedRecoveredKeypairOfDataOwner(dataOwnerId, publicKeyFingerprint))\n    if (cachedKey) return { pair: cachedKey, isDevice: false }\n    return undefined\n  }\n\n  /**\n   * Save the results of public key verification. If there were already results stored the entries will be merged. In case of conflicts the new\n   * {@link verificationDetails} take priority over the stored data.\n   * @param dataOwnerId id of a data owner.\n   * @param verificationDetails results of verification, associates key fingerprints to true if they were verified by the user or false otherwise.\n   * @return the udpated keys\n   */\n  async saveSelfVerifiedKeys(\n    dataOwnerId: string,\n    verificationDetails: { [keyFingerprint: string]: boolean }\n  ): Promise<{ [keyFingerprint: string]: boolean }> {\n    const updated = {\n      ...(await this.loadSelfVerifiedKeys(dataOwnerId)),\n      ...verificationDetails,\n    }\n    await this.data.setItem(this.entryFor.selfPublicKeysVerificationCacheForDataOwner(dataOwnerId), JSON.stringify(updated))\n    return updated\n  }\n\n  /**\n   * Get the last saved results of public key verification.\n   * @param dataOwnerId id of a data owner.\n   * @return saved results of verification, associates key fingerprints to true if they were verified by the user or false otherwise. If no results\n   * were saved returns an empty object instead.\n   * @throws if the stored results are not in a valid format.\n   */\n  async loadSelfVerifiedKeys(dataOwnerId: string): Promise<{ [keyFingerprint: string]: boolean }> {\n    const dataString = await this.data.getItem(this.entryFor.selfPublicKeysVerificationCacheForDataOwner(dataOwnerId))\n    if (dataString) {\n      const parsed = JSON.parse(dataString)\n      Object.entries(parsed).forEach(([k, v]) => {\n        if (v !== true && v !== false) throw new Error(`Unexpected entry ${k}:${v}`)\n      })\n      return parsed\n    } else return {}\n  }\n}\n"]}

package/dist/icc-x-api/storage/StorageEntryKeysFactory.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Specifies the entry keys to use for storage of data needed by iCure.
+ */
+export interface StorageEntryKeysFactory {
+    /**
+     * Get the entry key for the storage of a key pair of a data owner which was created on this device. All keys created on this device will be
+     * considered as verified and safe.
+     * This entry key will be used in a {@link KeyStorageFacade}.
+     * @param dataOwnerId Id of a data owner.
+     * @param publicKeyFingerprint Fingerprint of the public key in a keypair of the data owner.
+     * @return entry key for the keypair.
+     */
+    deviceKeypairOfDataOwner(dataOwnerId: string, publicKeyFingerprint: string): string;
+    /**
+     * Get the entry key for the storage of a key pair of a data owner which was recovered from transfer keys or shamir.
+     * These keys are going to be considered as UNSAFE for encryption unless their public key has been verified by the human user and has been stored in
+     * {@link selfPublicKeysVerificationCacheForDataOwner}.
+     * This entry key will be used in a {@link KeyStorageFacade}.
+     * @param dataOwnerId Id of a data owner.
+     * @param publicKeyFingerprint Fingerprint of the public key in a keypair of the data owner.
+     * @return entry key for the keypair.
+     */
+    cachedRecoveredKeypairOfDataOwner(dataOwnerId: string, publicKeyFingerprint: string): string;
+    /**
+     * Get the entry key for the storage of answers to own public key verification (from {@link CryptoStrategies.verifyOwnPublicKeys}).
+     * This entry key will be used in a {@link StorageFacade}.
+     * @param dataOwnerId Id of a data owner.
+     * @return entry key for verified public keys of the data owner.
+     */
+    selfPublicKeysVerificationCacheForDataOwner(dataOwnerId: string): string;
+}

package/dist/icc-x-api/storage/StorageEntryKeysFactory.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=StorageEntryKeysFactory.js.map

package/dist/icc-x-api/storage/StorageEntryKeysFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageEntryKeysFactory.js","sourceRoot":"","sources":["../../../icc-x-api/storage/StorageEntryKeysFactory.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Specifies the entry keys to use for storage of data needed by iCure.\n */\nexport interface StorageEntryKeysFactory {\n  /**\n   * Get the entry key for the storage of a key pair of a data owner which was created on this device. All keys created on this device will be\n   * considered as verified and safe.\n   * This entry key will be used in a {@link KeyStorageFacade}.\n   * @param dataOwnerId Id of a data owner.\n   * @param publicKeyFingerprint Fingerprint of the public key in a keypair of the data owner.\n   * @return entry key for the keypair.\n   */\n  deviceKeypairOfDataOwner(dataOwnerId: string, publicKeyFingerprint: string): string\n\n  /**\n   * Get the entry key for the storage of a key pair of a data owner which was recovered from transfer keys or shamir.\n   * These keys are going to be considered as UNSAFE for encryption unless their public key has been verified by the human user and has been stored in\n   * {@link selfPublicKeysVerificationCacheForDataOwner}.\n   * This entry key will be used in a {@link KeyStorageFacade}.\n   * @param dataOwnerId Id of a data owner.\n   * @param publicKeyFingerprint Fingerprint of the public key in a keypair of the data owner.\n   * @return entry key for the keypair.\n   */\n  cachedRecoveredKeypairOfDataOwner(dataOwnerId: string, publicKeyFingerprint: string): string\n\n  /**\n   * Get the entry key for the storage of answers to own public key verification (from {@link CryptoStrategies.verifyOwnPublicKeys}).\n   * This entry key will be used in a {@link StorageFacade}.\n   * @param dataOwnerId Id of a data owner.\n   * @return entry key for verified public keys of the data owner.\n   */\n  selfPublicKeysVerificationCacheForDataOwner(dataOwnerId: string): string\n\n  /*\n   * There is no need to store verified public keys for other data owners: we verify only when we want to create a new exchange key, and we need to\n   * create an exchange key to each user only once unless we lose our key. But we can lose our key only if we delete our data, which means we would\n   * also used the verified keys for other data owners...\n   */\n}\n"]}

package/dist/icc-x-api/utils/collection-utils.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Check if two sets are equals (they contain the same elements). Will not work if the content can't be compared by `==`.
+ */
+export declare function setEquals<T>(setA: Set<T>, setB: Set<T>): boolean;
+/**
+ * Check if two arrays are equals (they contain the same elements). Will not work if the content can't be compared by `==`.
+ */
+export declare function arrayEquals<T>(arrayA: T[], arrayB: T[]): boolean;

package/dist/icc-x-api/utils/collection-utils.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.arrayEquals = exports.setEquals = void 0;
+/**
+ * Check if two sets are equals (they contain the same elements). Will not work if the content can't be compared by `==`.
+ */
+function setEquals(setA, setB) {
+    if (setA.size != setB.size)
+        return false;
+    return Array.from(setA).every((x) => setB.has(x));
+}
+exports.setEquals = setEquals;
+/**
+ * Check if two arrays are equals (they contain the same elements). Will not work if the content can't be compared by `==`.
+ */
+function arrayEquals(arrayA, arrayB) {
+    if (arrayA.length != arrayB.length)
+        return false;
+    for (let i = 0; i < arrayA.length; ++i) {
+        if (arrayA[i] !== arrayB[i])
+            return false;
+    }
+    return true;
+}
+exports.arrayEquals = arrayEquals;
+//# sourceMappingURL=collection-utils.js.map

package/dist/icc-x-api/utils/collection-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection-utils.js","sourceRoot":"","sources":["../../../icc-x-api/utils/collection-utils.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,SAAgB,SAAS,CAAI,IAAY,EAAE,IAAY;IACrD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAHD,8BAGC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAI,MAAW,EAAE,MAAW;IACrD,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;QACtC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;KAC1C;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAND,kCAMC","sourcesContent":["/**\n * Check if two sets are equals (they contain the same elements). Will not work if the content can't be compared by `==`.\n */\nexport function setEquals<T>(setA: Set<T>, setB: Set<T>): boolean {\n  if (setA.size != setB.size) return false\n  return Array.from(setA).every((x) => setB.has(x))\n}\n\n/**\n * Check if two arrays are equals (they contain the same elements). Will not work if the content can't be compared by `==`.\n */\nexport function arrayEquals<T>(arrayA: T[], arrayB: T[]): boolean {\n  if (arrayA.length != arrayB.length) return false\n  for (let i = 0; i < arrayA.length; ++i) {\n    if (arrayA[i] !== arrayB[i]) return false\n  }\n  return true\n}\n"]}

package/dist/icc-x-api/utils/crypto-utils.d.ts

@@ -0,0 +1,68 @@
+import { KeyPair } from '../crypto/RSA';
+export declare function notConcurrent<T>(concurrencyMap: {
+    [key: string]: PromiseLike<any>;
+}, key: string, proc: () => PromiseLike<T>): PromiseLike<T>;
+export declare function jwk2pkcs8(jwk: any): string;
+export declare function jwk2spki(jwk: any): string;
+export declare function spkiToJwk(buf: Uint8Array): {
+    kty: string;
+    alg: string;
+    n: string;
+    e: string;
+    ext: boolean;
+};
+export declare function pkcs8ToJwk(buf: Uint8Array | ArrayBuffer): {
+    kty: string;
+    n: string;
+    e: string;
+    d: string;
+    p: string;
+    q: string;
+    dp: string;
+    dq: string;
+    qi: string;
+};
+/**
+ * Provide a view over the given Uint8Array where any trailing null bytes at
+ * the end are truncated.
+ *
+ * This can be used to ignore null bytes at the end of a padded UTF-8 string
+ * without needing to copy that string, assuming code point U+0000 is encoded
+ * in one null byte according to standards rather than in a multi-byte
+ * overlong form.
+ */
+export declare function truncateTrailingNulls(a: Uint8Array): Uint8Array;
+/**
+ *
+ * @param buffer1 {Uint8Array}
+ * @param buffer2{ Uint8Array}
+ * @returns {ArrayBuffer}
+ */
+export declare function appendBuffer(buffer1: ArrayBuffer, buffer2: ArrayBuffer): ArrayBuffer;
+export declare function after(d1: number | null | undefined, d2: number | null | undefined): boolean;
+export declare function before(d1: number | null | undefined, d2: number | null | undefined): boolean;
+/**
+ * Encrypt object graph recursively
+ *
+ * @param obj the object to encrypt
+ * @param cryptor the cryptor function (returns a promise)
+ * @param keys the keys to be crypted: ex for a Patient ['note', 'addresses.*.["street", "houseNumber", "telecoms.*.telecomNumber"]']
+ */
+export declare function crypt(obj: any, cryptor: (obj: {
+    [key: string]: string;
+}) => Promise<ArrayBuffer>, keys: Array<string>): Promise<any>;
+/**
+ * Decrypt object graph recursively
+ *
+ * @param obj the object to encrypt
+ * @param decryptor the decryptor function (returns a promise)
+ */
+export declare function decrypt(obj: any, decryptor: (obj: Uint8Array) => Promise<{
+    [key: string]: string;
+}>): Promise<any>;
+/**
+ * Extracts the full jwk key pair from the jwk representation of the private key.
+ * @param privateKeyJwk private key in jwk representation
+ * @throws if the key is missing the public modulus or public exponent.
+ */
+export declare function keyPairFromPrivateKeyJwk(privateKeyJwk: JsonWebKey): KeyPair<JsonWebKey>;

package/dist/icc-x-api/utils/crypto-utils.js

@@ -0,0 +1,262 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keyPairFromPrivateKeyJwk = exports.decrypt = exports.crypt = exports.before = exports.after = exports.appendBuffer = exports.truncateTrailingNulls = exports.pkcs8ToJwk = exports.spkiToJwk = exports.jwk2spki = exports.jwk2pkcs8 = exports.notConcurrent = void 0;
+const mm = require("moment");
+const _ = require("lodash");
+const binary_utils_1 = require("../utils/binary-utils");
+const asn1_packer_1 = require("./asn1-packer");
+const asn1_parser_1 = require("./asn1-parser");
+function notConcurrent(concurrencyMap, key, proc) {
+    const inFlight = concurrencyMap[key];
+    if (!inFlight) {
+        const newJob = (() => __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield proc();
+            }
+            finally {
+                delete concurrencyMap[key];
+            }
+        }))();
+        concurrencyMap[key] = newJob;
+        return newJob;
+    }
+    else {
+        return concurrencyMap[key].then(() => notConcurrent(concurrencyMap, key, proc));
+    }
+}
+exports.notConcurrent = notConcurrent;
+function jwk2pkcs8(jwk) {
+    return (0, asn1_packer_1.pack)([
+        0x30,
+        [
+            [0x02, '00'],
+            [0x30, [[0x06, '2a864886f70d010101'], [0x05]]],
+            [
+                0x04,
+                [
+                    [
+                        0x30,
+                        [
+                            [0x02, '00'],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.n))],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.e))],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.d))],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.p))],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.q))],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.dp))],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.dq))],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.qi))],
+                        ],
+                    ],
+                ],
+            ],
+        ],
+    ]);
+}
+exports.jwk2pkcs8 = jwk2pkcs8;
+function jwk2spki(jwk) {
+    return (0, asn1_packer_1.pack)([
+        0x30,
+        [
+            [0x30, [[0x06, '2a864886f70d010101'], [0x05]]],
+            [
+                0x03,
+                [
+                    [
+                        0x30,
+                        [
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.n))],
+                            [0x02, (0, binary_utils_1.ua2hex)((0, binary_utils_1.b64Url2ua)(jwk.e))],
+                        ],
+                    ],
+                ],
+            ],
+        ],
+    ]);
+}
+exports.jwk2spki = jwk2spki;
+function spkiToJwk(buf) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6;
+    const asn1 = (0, asn1_parser_1.parseAsn1)(new Uint8Array(buf));
+    var modulus = undefined;
+    var exponent = undefined;
+    if (asn1.type === 0x30 &&
+        ((_b = (_a = asn1.children) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.type) === 0x30 &&
+        ((_f = (_e = (_d = (_c = asn1.children) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.children) === null || _e === void 0 ? void 0 : _e[0]) === null || _f === void 0 ? void 0 : _f.type) === 0x06 &&
+        (0, binary_utils_1.ua2hex)((_l = (_k = (_j = (_h = (_g = asn1.children) === null || _g === void 0 ? void 0 : _g[0]) === null || _h === void 0 ? void 0 : _h.children) === null || _j === void 0 ? void 0 : _j[0]) === null || _k === void 0 ? void 0 : _k.value) !== null && _l !== void 0 ? _l : new Uint8Array(0)) === '2a864886f70d010101' // pragma: allowlist secret
+    ) {
+        modulus = (_s = (_r = (_q = (_p = (_o = (_m = asn1.children) === null || _m === void 0 ? void 0 : _m[1]) === null || _o === void 0 ? void 0 : _o.children) === null || _p === void 0 ? void 0 : _p[0]) === null || _q === void 0 ? void 0 : _q.children) === null || _r === void 0 ? void 0 : _r[0]) === null || _s === void 0 ? void 0 : _s.value;
+        exponent = (_y = (_x = (_w = (_v = (_u = (_t = asn1.children) === null || _t === void 0 ? void 0 : _t[1]) === null || _u === void 0 ? void 0 : _u.children) === null || _v === void 0 ? void 0 : _v[0]) === null || _w === void 0 ? void 0 : _w.children) === null || _x === void 0 ? void 0 : _x[1]) === null || _y === void 0 ? void 0 : _y.value;
+    }
+    else if (asn1.type === 0x30 && ((_0 = (_z = asn1.children) === null || _z === void 0 ? void 0 : _z[0]) === null || _0 === void 0 ? void 0 : _0.type) === 0x02 && ((_2 = (_1 = asn1.children) === null || _1 === void 0 ? void 0 : _1[1]) === null || _2 === void 0 ? void 0 : _2.type) === 0x02) {
+        modulus = (_4 = (_3 = asn1.children) === null || _3 === void 0 ? void 0 : _3[0]) === null || _4 === void 0 ? void 0 : _4.value;
+        exponent = (_6 = (_5 = asn1.children) === null || _5 === void 0 ? void 0 : _5[1]) === null || _6 === void 0 ? void 0 : _6.value;
+    }
+    if (!modulus || !exponent) {
+        throw new Error('Invalid spki format');
+    }
+    return {
+        kty: 'RSA',
+        alg: 'RSA-OAEP',
+        ext: true,
+        n: (0, binary_utils_1.ua2b64Url)(minimalRep(modulus)),
+        e: (0, binary_utils_1.ua2b64Url)(minimalRep(exponent)),
+    };
+}
+exports.spkiToJwk = spkiToJwk;
+function pkcs8ToJwk(buf) {
+    var _a, _b;
+    const parsed = (0, asn1_parser_1.parseAsn1)(new Uint8Array(buf));
+    const seq = ((_a = parsed.children) === null || _a === void 0 ? void 0 : _a.length) === 3 && parsed.children[2].type === 0x04 && ((_b = parsed.children[2].children) === null || _b === void 0 ? void 0 : _b.length) === 1
+        ? parsed.children[2].children[0]
+        : parsed;
+    return {
+        kty: 'RSA',
+        n: (0, binary_utils_1.ua2b64Url)(minimalRep(seq.children[1].value)),
+        e: (0, binary_utils_1.ua2b64Url)(minimalRep(seq.children[2].value)),
+        d: (0, binary_utils_1.ua2b64Url)(minimalRep(seq.children[3].value)),
+        p: (0, binary_utils_1.ua2b64Url)(minimalRep(seq.children[4].value)),
+        q: (0, binary_utils_1.ua2b64Url)(minimalRep(seq.children[5].value)),
+        dp: (0, binary_utils_1.ua2b64Url)(minimalRep(seq.children[6].value)),
+        dq: (0, binary_utils_1.ua2b64Url)(minimalRep(seq.children[7].value)),
+        qi: (0, binary_utils_1.ua2b64Url)(minimalRep(seq.children[8].value)),
+    };
+}
+exports.pkcs8ToJwk = pkcs8ToJwk;
+function minimalRep(b) {
+    let i = 0;
+    while (b[i] === 0) {
+        i++;
+    }
+    return b.slice(i);
+}
+/**
+ * Provide a view over the given Uint8Array where any trailing null bytes at
+ * the end are truncated.
+ *
+ * This can be used to ignore null bytes at the end of a padded UTF-8 string
+ * without needing to copy that string, assuming code point U+0000 is encoded
+ * in one null byte according to standards rather than in a multi-byte
+ * overlong form.
+ */
+function truncateTrailingNulls(a) {
+    let end = a.byteLength - 1;
+    while (a[end] === 0 && end >= 0) {
+        end--;
+    }
+    // end is now either the last non-null position in a or -1; in the latter
+    // case the returned array will have length 0.
+    return a.subarray(0, end + 1);
+}
+exports.truncateTrailingNulls = truncateTrailingNulls;
+/**
+ *
+ * @param buffer1 {Uint8Array}
+ * @param buffer2{ Uint8Array}
+ * @returns {ArrayBuffer}
+ */
+function appendBuffer(buffer1, buffer2) {
+    const tmp = new Uint8Array(buffer1.byteLength + buffer2.byteLength);
+    tmp.set(new Uint8Array(buffer1), 0);
+    tmp.set(new Uint8Array(buffer2), buffer1.byteLength);
+    return tmp.buffer;
+}
+exports.appendBuffer = appendBuffer;
+//Convenience methods for dates management
+function after(d1, d2) {
+    return d1 === null || d2 === null || d1 === undefined || d2 === undefined || moment(d1).isAfter(moment(d2));
+}
+exports.after = after;
+function before(d1, d2) {
+    return d1 === null || d2 === null || d1 === undefined || d2 === undefined || moment(d1).isBefore(moment(d2));
+}
+exports.before = before;
+function moment(epochOrLongCalendar) {
+    if (!epochOrLongCalendar && epochOrLongCalendar !== 0) {
+        return null;
+    }
+    if (epochOrLongCalendar >= 18000101 && epochOrLongCalendar < 25400000) {
+        return mm('' + epochOrLongCalendar, 'YYYYMMDD');
+    }
+    else if (epochOrLongCalendar >= 18000101000000) {
+        return mm('' + epochOrLongCalendar, 'YYYYMMDDHHmmss');
+    }
+    else {
+        return mm(epochOrLongCalendar);
+    }
+}
+/**
+ * Encrypt object graph recursively
+ *
+ * @param obj the object to encrypt
+ * @param cryptor the cryptor function (returns a promise)
+ * @param keys the keys to be crypted: ex for a Patient ['note', 'addresses.*.["street", "houseNumber", "telecoms.*.telecomNumber"]']
+ */
+function crypt(obj, cryptor, keys) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const subObj = _.pick(obj, keys.filter((k) => !k.includes('*')));
+        obj.encryptedSelf = (0, binary_utils_1.b2a)((0, binary_utils_1.ua2string)(yield cryptor(subObj)));
+        Object.keys(subObj).forEach((k) => delete obj[k]);
+        yield keys
+            .filter((k) => k.includes('*'))
+            .reduce((prev, k) => __awaiter(this, void 0, void 0, function* () {
+            yield prev;
+            const k1 = k.split('.*.')[0];
+            const k2 = k.substr(k1.length + 3);
+            const mapped = yield Promise.all((_.get(obj, k1) || []).map((so) => crypt(so, cryptor, k2.startsWith('[') ? JSON.parse(k2) : [k2])));
+            _.set(obj, k1, mapped);
+        }), Promise.resolve());
+        return obj;
+    });
+}
+exports.crypt = crypt;
+/**
+ * Decrypt object graph recursively
+ *
+ * @param obj the object to encrypt
+ * @param decryptor the decryptor function (returns a promise)
+ */
+function decrypt(obj, decryptor) {
+    return __awaiter(this, void 0, void 0, function* () {
+        yield Object.keys(obj).reduce((prev, k) => __awaiter(this, void 0, void 0, function* () {
+            yield prev;
+            if (Array.isArray(obj[k])) {
+                yield obj[k]
+                    .filter((o) => typeof o === 'object' && o !== null)
+                    .reduce((prev, so) => __awaiter(this, void 0, void 0, function* () {
+                    yield prev;
+                    yield decrypt(so, decryptor);
+                }), Promise.resolve());
+            }
+        }), Promise.resolve());
+        if (obj.encryptedSelf) {
+            Object.assign(obj, yield decryptor((0, binary_utils_1.string2ua)((0, binary_utils_1.a2b)(obj.encryptedSelf))));
+        }
+        return obj;
+    });
+}
+exports.decrypt = decrypt;
+/**
+ * Extracts the full jwk key pair from the jwk representation of the private key.
+ * @param privateKeyJwk private key in jwk representation
+ * @throws if the key is missing the public modulus or public exponent.
+ */
+function keyPairFromPrivateKeyJwk(privateKeyJwk) {
+    if (!privateKeyJwk.n || !privateKeyJwk.e)
+        throw new Error('Incomplete private JsonWebKey: missing public modulus and/or exponent');
+    return {
+        privateKey: privateKeyJwk,
+        publicKey: spkiToJwk((0, binary_utils_1.hex2ua)(jwk2spki(privateKeyJwk))),
+    };
+}
+exports.keyPairFromPrivateKeyJwk = keyPairFromPrivateKeyJwk;
+//# sourceMappingURL=crypto-utils.js.map

package/dist/icc-x-api/utils/crypto-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.js","sourceRoot":"","sources":["../../../icc-x-api/utils/crypto-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6BAA4B;AAE5B,4BAA2B;AAC3B,wDAA4G;AAC5G,+CAAoC;AACpC,+CAAyC;AAGzC,SAAgB,aAAa,CAAI,cAAmD,EAAE,GAAW,EAAE,IAA0B;IAC3H,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,MAAM,GAAG,CAAC,GAAS,EAAE;YACzB,IAAI;gBACF,OAAO,MAAM,IAAI,EAAE,CAAA;aACpB;oBAAS;gBACR,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;aAC3B;QACH,CAAC,CAAA,CAAC,EAAE,CAAA;QACJ,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;QAC5B,OAAO,MAAM,CAAA;KACd;SAAM;QACL,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;KAChF;AACH,CAAC;AAfD,sCAeC;AAED,SAAgB,SAAS,CAAC,GAAQ;IAChC,OAAO,IAAA,kBAAI,EAAC;QACV,IAAI;QACJ;YACE,CAAC,IAAI,EAAE,IAAI,CAAC;YACZ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C;gBACE,IAAI;gBACJ;oBACE;wBACE,IAAI;wBACJ;4BACE,CAAC,IAAI,EAAE,IAAI,CAAC;4BACZ,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;4BACjC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;4BACjC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;yBAClC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AA3BD,8BA2BC;AAED,SAAgB,QAAQ,CAAC,GAAQ;IAC/B,OAAO,IAAA,kBAAI,EAAC;QACV,IAAI;QACJ;YACE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C;gBACE,IAAI;gBACJ;oBACE;wBACE,IAAI;wBACJ;4BACE,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;yBACjC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AAnBD,4BAmBC;AAED,SAAgB,SAAS,CAAC,GAAe;;IACvC,MAAM,IAAI,GAAG,IAAA,uBAAS,EAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAE3C,IAAI,OAAO,GAA2B,SAAS,CAAA;IAC/C,IAAI,QAAQ,GAA2B,SAAS,CAAA;IAChD,IACE,IAAI,CAAC,IAAI,KAAK,IAAI;QAClB,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI;QACjC,CAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI;QAChD,IAAA,qBAAM,EAAC,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,2BAA2B;MAC1H;QACA,OAAO,GAAG,MAAA,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;QACjE,QAAQ,GAAG,MAAA,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;KACnE;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI,IAAI,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI,EAAE;QACvG,OAAO,GAAG,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;QACnC,QAAQ,GAAG,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;KACrC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE;QACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;KACvC;IACD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,IAAI;QACT,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;KACnC,CAAA;AACH,CAAC;AA5BD,8BA4BC;AAED,SAAgB,UAAU,CAAC,GAA6B;;IACtD,MAAM,MAAM,GAAG,IAAA,uBAAS,EAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GACP,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,MAAM,MAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,0CAAE,MAAM,MAAK,CAAC;QAC5G,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,MAAM,CAAA;IACZ,OAAO;QACL,GAAG,EAAE,KAAK;QACV,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC/D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC/D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;KAChE,CAAA;AACH,CAAC;AAjBD,gCAiBC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;QACjB,CAAC,EAAE,CAAA;KACJ;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,CAAa;IACjD,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAA;IAC1B,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE;QAC/B,GAAG,EAAE,CAAA;KACN;IACD,yEAAyE;IACzE,8CAA8C;IAC9C,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;AAC/B,CAAC;AARD,sDAQC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,OAAoB,EAAE,OAAoB;IACrE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACnE,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IACnC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACpD,OAAO,GAAG,CAAC,MAAqB,CAAA;AAClC,CAAC;AALD,oCAKC;AAED,0CAA0C;AAC1C,SAAgB,KAAK,CAAC,EAA6B,EAAE,EAA6B;IAChF,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,CAAA;AAC/G,CAAC;AAFD,sBAEC;AAED,SAAgB,MAAM,CAAC,EAA6B,EAAE,EAA6B;IACjF,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,CAAA;AAChH,CAAC;AAFD,wBAEC;AAED,SAAS,MAAM,CAAC,mBAA2B;IACzC,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,KAAK,CAAC,EAAE;QACrD,OAAO,IAAI,CAAA;KACZ;IACD,IAAI,mBAAmB,IAAI,QAAQ,IAAI,mBAAmB,GAAG,QAAQ,EAAE;QACrE,OAAO,EAAE,CAAC,EAAE,GAAG,mBAAmB,EAAE,UAAU,CAAC,CAAA;KAChD;SAAM,IAAI,mBAAmB,IAAI,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,EAAE,GAAG,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;KACtD;SAAM;QACL,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAA;KAC/B;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAsB,KAAK,CAAC,GAAQ,EAAE,OAAiE,EAAE,IAAmB;;QAC1H,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CACnB,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CACrC,CAAA;QACD,GAAG,CAAC,aAAa,GAAG,IAAA,kBAAG,EAAC,IAAA,wBAAS,EAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAEjD,MAAM,IAAI;aACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;aAC9B,MAAM,CAAC,CAAO,IAAmB,EAAE,CAAM,EAAE,EAAE;YAC5C,MAAM,IAAI,CAAA;YACV,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAElC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;YACzI,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;QACxB,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAEvB,OAAO,GAAG,CAAA;IACZ,CAAC;CAAA;AApBD,sBAoBC;AAED;;;;;GAKG;AACH,SAAsB,OAAO,CAAC,GAAQ,EAAE,SAAkE;;QACxG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAO,IAAmB,EAAE,CAAM,EAAE,EAAE;YAClE,MAAM,IAAI,CAAA;YACV,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACzB,MAAO,GAAG,CAAC,CAAC,CAAgB;qBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;qBAClD,MAAM,CAAC,CAAO,IAAmB,EAAE,EAAO,EAAE,EAAE;oBAC7C,MAAM,IAAI,CAAA;oBACV,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;gBAC9B,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;aACxB;QACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QACrB,IAAI,GAAG,CAAC,aAAa,EAAE;YACrB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,IAAA,wBAAS,EAAC,IAAA,kBAAG,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;SACvE;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CAAA;AAhBD,0BAgBC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,aAAyB;IAChE,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAClI,OAAO;QACL,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,SAAS,CAAC,IAAA,qBAAM,EAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;KACtD,CAAA;AACH,CAAC;AAND,4DAMC","sourcesContent":["import * as mm from 'moment'\nimport { Moment } from 'moment'\nimport * as _ from 'lodash'\nimport { a2b, b2a, b64Url2ua, hex2ua, string2ua, ua2b64Url, ua2hex, ua2string } from '../utils/binary-utils'\nimport { pack } from './asn1-packer'\nimport { parseAsn1 } from './asn1-parser'\nimport { KeyPair } from '../crypto/RSA'\n\nexport function notConcurrent<T>(concurrencyMap: { [key: string]: PromiseLike<any> }, key: string, proc: () => PromiseLike<T>): PromiseLike<T> {\n  const inFlight = concurrencyMap[key]\n  if (!inFlight) {\n    const newJob = (async () => {\n      try {\n        return await proc()\n      } finally {\n        delete concurrencyMap[key]\n      }\n    })()\n    concurrencyMap[key] = newJob\n    return newJob\n  } else {\n    return concurrencyMap[key].then(() => notConcurrent(concurrencyMap, key, proc))\n  }\n}\n\nexport function jwk2pkcs8(jwk: any): string {\n  return pack([\n    0x30,\n    [\n      [0x02, '00'],\n      [0x30, [[0x06, '2a864886f70d010101'], [0x05]]], // pragma: allowlist secret\n      [\n        0x04,\n        [\n          [\n            0x30,\n            [\n              [0x02, '00'],\n              [0x02, ua2hex(b64Url2ua(jwk.n))],\n              [0x02, ua2hex(b64Url2ua(jwk.e))],\n              [0x02, ua2hex(b64Url2ua(jwk.d))],\n              [0x02, ua2hex(b64Url2ua(jwk.p))],\n              [0x02, ua2hex(b64Url2ua(jwk.q))],\n              [0x02, ua2hex(b64Url2ua(jwk.dp))],\n              [0x02, ua2hex(b64Url2ua(jwk.dq))],\n              [0x02, ua2hex(b64Url2ua(jwk.qi))],\n            ],\n          ],\n        ],\n      ],\n    ],\n  ])\n}\n\nexport function jwk2spki(jwk: any): string {\n  return pack([\n    0x30,\n    [\n      [0x30, [[0x06, '2a864886f70d010101'], [0x05]]], // pragma: allowlist secret\n      [\n        0x03,\n        [\n          [\n            0x30,\n            [\n              [0x02, ua2hex(b64Url2ua(jwk.n))],\n              [0x02, ua2hex(b64Url2ua(jwk.e))],\n            ],\n          ],\n        ],\n      ],\n    ],\n  ])\n}\n\nexport function spkiToJwk(buf: Uint8Array): { kty: string; alg: string; n: string; e: string; ext: boolean } {\n  const asn1 = parseAsn1(new Uint8Array(buf))\n\n  var modulus: Uint8Array | undefined = undefined\n  var exponent: Uint8Array | undefined = undefined\n  if (\n    asn1.type === 0x30 &&\n    asn1.children?.[0]?.type === 0x30 &&\n    asn1.children?.[0]?.children?.[0]?.type === 0x06 &&\n    ua2hex(asn1.children?.[0]?.children?.[0]?.value ?? new Uint8Array(0)) === '2a864886f70d010101' // pragma: allowlist secret\n  ) {\n    modulus = asn1.children?.[1]?.children?.[0]?.children?.[0]?.value\n    exponent = asn1.children?.[1]?.children?.[0]?.children?.[1]?.value\n  } else if (asn1.type === 0x30 && asn1.children?.[0]?.type === 0x02 && asn1.children?.[1]?.type === 0x02) {\n    modulus = asn1.children?.[0]?.value\n    exponent = asn1.children?.[1]?.value\n  }\n\n  if (!modulus || !exponent) {\n    throw new Error('Invalid spki format')\n  }\n  return {\n    kty: 'RSA',\n    alg: 'RSA-OAEP',\n    ext: true,\n    n: ua2b64Url(minimalRep(modulus)),\n    e: ua2b64Url(minimalRep(exponent)),\n  }\n}\n\nexport function pkcs8ToJwk(buf: Uint8Array | ArrayBuffer) {\n  const parsed = parseAsn1(new Uint8Array(buf))\n  const seq =\n    parsed.children?.length === 3 && parsed.children[2].type === 0x04 && parsed.children[2].children?.length === 1\n      ? parsed.children[2].children[0]\n      : parsed\n  return {\n    kty: 'RSA',\n    n: ua2b64Url(minimalRep(seq.children![1].value as Uint8Array)),\n    e: ua2b64Url(minimalRep(seq.children![2].value as Uint8Array)),\n    d: ua2b64Url(minimalRep(seq.children![3].value as Uint8Array)),\n    p: ua2b64Url(minimalRep(seq.children![4].value as Uint8Array)),\n    q: ua2b64Url(minimalRep(seq.children![5].value as Uint8Array)),\n    dp: ua2b64Url(minimalRep(seq.children![6].value as Uint8Array)),\n    dq: ua2b64Url(minimalRep(seq.children![7].value as Uint8Array)),\n    qi: ua2b64Url(minimalRep(seq.children![8].value as Uint8Array)),\n  }\n}\n\nfunction minimalRep(b: Uint8Array) {\n  let i = 0\n  while (b[i] === 0) {\n    i++\n  }\n  return b.slice(i)\n}\n\n/**\n * Provide a view over the given Uint8Array where any trailing null bytes at\n * the end are truncated.\n *\n * This can be used to ignore null bytes at the end of a padded UTF-8 string\n * without needing to copy that string, assuming code point U+0000 is encoded\n * in one null byte according to standards rather than in a multi-byte\n * overlong form.\n */\nexport function truncateTrailingNulls(a: Uint8Array) {\n  let end = a.byteLength - 1\n  while (a[end] === 0 && end >= 0) {\n    end--\n  }\n  // end is now either the last non-null position in a or -1; in the latter\n  // case the returned array will have length 0.\n  return a.subarray(0, end + 1)\n}\n\n/**\n *\n * @param buffer1 {Uint8Array}\n * @param buffer2{ Uint8Array}\n * @returns {ArrayBuffer}\n */\nexport function appendBuffer(buffer1: ArrayBuffer, buffer2: ArrayBuffer): ArrayBuffer {\n  const tmp = new Uint8Array(buffer1.byteLength + buffer2.byteLength)\n  tmp.set(new Uint8Array(buffer1), 0)\n  tmp.set(new Uint8Array(buffer2), buffer1.byteLength)\n  return tmp.buffer as ArrayBuffer\n}\n\n//Convenience methods for dates management\nexport function after(d1: number | null | undefined, d2: number | null | undefined): boolean {\n  return d1 === null || d2 === null || d1 === undefined || d2 === undefined || moment(d1)!.isAfter(moment(d2)!)\n}\n\nexport function before(d1: number | null | undefined, d2: number | null | undefined): boolean {\n  return d1 === null || d2 === null || d1 === undefined || d2 === undefined || moment(d1)!.isBefore(moment(d2)!)\n}\n\nfunction moment(epochOrLongCalendar: number): Moment | null {\n  if (!epochOrLongCalendar && epochOrLongCalendar !== 0) {\n    return null\n  }\n  if (epochOrLongCalendar >= 18000101 && epochOrLongCalendar < 25400000) {\n    return mm('' + epochOrLongCalendar, 'YYYYMMDD')\n  } else if (epochOrLongCalendar >= 18000101000000) {\n    return mm('' + epochOrLongCalendar, 'YYYYMMDDHHmmss')\n  } else {\n    return mm(epochOrLongCalendar)\n  }\n}\n\n/**\n * Encrypt object graph recursively\n *\n * @param obj the object to encrypt\n * @param cryptor the cryptor function (returns a promise)\n * @param keys the keys to be crypted: ex for a Patient ['note', 'addresses.*.[\"street\", \"houseNumber\", \"telecoms.*.telecomNumber\"]']\n */\nexport async function crypt(obj: any, cryptor: (obj: { [key: string]: string }) => Promise<ArrayBuffer>, keys: Array<string>) {\n  const subObj = _.pick(\n    obj,\n    keys.filter((k) => !k.includes('*'))\n  )\n  obj.encryptedSelf = b2a(ua2string(await cryptor(subObj)))\n  Object.keys(subObj).forEach((k) => delete obj[k])\n\n  await keys\n    .filter((k) => k.includes('*'))\n    .reduce(async (prev: Promise<void>, k: any) => {\n      await prev\n      const k1 = k.split('.*.')[0]\n      const k2 = k.substr(k1.length + 3)\n\n      const mapped = await Promise.all((_.get(obj, k1) || []).map((so: any) => crypt(so, cryptor, k2.startsWith('[') ? JSON.parse(k2) : [k2])))\n      _.set(obj, k1, mapped)\n    }, Promise.resolve())\n\n  return obj\n}\n\n/**\n * Decrypt object graph recursively\n *\n * @param obj the object to encrypt\n * @param decryptor the decryptor function (returns a promise)\n */\nexport async function decrypt(obj: any, decryptor: (obj: Uint8Array) => Promise<{ [key: string]: string }>) {\n  await Object.keys(obj).reduce(async (prev: Promise<void>, k: any) => {\n    await prev\n    if (Array.isArray(obj[k])) {\n      await (obj[k] as Array<any>)\n        .filter((o) => typeof o === 'object' && o !== null)\n        .reduce(async (prev: Promise<void>, so: any) => {\n          await prev\n          await decrypt(so, decryptor)\n        }, Promise.resolve())\n    }\n  }, Promise.resolve())\n  if (obj.encryptedSelf) {\n    Object.assign(obj, await decryptor(string2ua(a2b(obj.encryptedSelf))))\n  }\n  return obj\n}\n\n/**\n * Extracts the full jwk key pair from the jwk representation of the private key.\n * @param privateKeyJwk private key in jwk representation\n * @throws if the key is missing the public modulus or public exponent.\n */\nexport function keyPairFromPrivateKeyJwk(privateKeyJwk: JsonWebKey): KeyPair<JsonWebKey> {\n  if (!privateKeyJwk.n || !privateKeyJwk.e) throw new Error('Incomplete private JsonWebKey: missing public modulus and/or exponent')\n  return {\n    privateKey: privateKeyJwk,\n    publicKey: spkiToJwk(hex2ua(jwk2spki(privateKeyJwk))),\n  }\n}\n"]}

package/dist/icc-x-api/utils/graph-utils.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @internal
+ * Represents a graph. Each node is associated to a set of nodes that can be directly reached from it in a single step.
+ */
+export type Graph = {
+    [node: string]: Set<string>;
+};
+/**
+ * @internal
+ * Represents from which all cycles have been removed using strongly connected components. Also holds information on all groups.
+ */
+export type StronglyConnectedGraph = {
+    acyclicGraph: Graph;
+    originalLabelToAcyclicLabel: {
+        [originalLabel: string]: string;
+    };
+    acyclicLabelToGroup: {
+        [newLabel: string]: string[];
+    };
+};
+/**
+ * @internal
+ * Creates a graph from a series of edges and optionally additional nodes.
+ * @param edges edges between nodes, [from, to].
+ * @param additionalNodes nodes which do not appear in any edge.
+ * @return a graph built using the provided parameters.
+ */
+export declare function graphFromEdges(edges: [string, string][], additionalNodes?: string[]): Graph;
+/**
+ * @internal
+ * Get the nodes reachable from each node in an acyclic graph. Exclude the node itself.
+ * @param graph an acyclic graph.
+ * @return all nodes reachable from each node in the graph with 1 or more steps.
+ */
+export declare function reachSetsAcyclic(graph: Graph): {
+    [node: string]: Set<string>;
+};
+/**
+ * @internal
+ * Get a new graph where each cycle has been replaced by a single node, with label chosen from the labels of nodes in the cycle (the specific way
+ * the label is chosen is implementation-dependant).
+ * @param graph a graph.
+ * @return the new graph and dictionaries to allow mapping between original labels and labels in the new graph
+ */
+export declare function acyclic(graph: Graph): StronglyConnectedGraph;