@icure/api 6.4.0 → 7.0.0-beta.1

package/icc-x-api/crypto/CryptoPrimitives.d.ts

@@ -0,0 +1,31 @@
+import { RSAUtils } from './RSA';
+import { AESUtils } from './AES';
+import { ShamirClass } from './shamir';
+/**
+ * Gives access to cryptographic primitives.
+ */
+export declare class CryptoPrimitives {
+    private readonly _rsa;
+    private readonly _aes;
+    private readonly _shamir;
+    private readonly _crypto;
+    get crypto(): Crypto;
+    get shamir(): ShamirClass;
+    get RSA(): RSAUtils;
+    get AES(): AESUtils;
+    constructor(crypto?: Crypto);
+    /**
+     * Generates a UUID using a cryptographically secure random number generator.
+     */
+    randomUuid(): string;
+    /**
+     * @param data some data
+     * @return the sha256 hash of {@link data}
+     */
+    sha256(data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>;
+    /**
+     * @param n how many bytes to generate
+     * @return an array with n random bytes
+     */
+    randomBytes(n: number): Uint8Array;
+}

package/icc-x-api/crypto/CryptoPrimitives.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoPrimitives = void 0;
+const RSA_1 = require("./RSA");
+const AES_1 = require("./AES");
+const shamir_1 = require("./shamir");
+/**
+ * Gives access to cryptographic primitives.
+ */
+class CryptoPrimitives {
+    get crypto() {
+        return this._crypto;
+    }
+    get shamir() {
+        return this._shamir;
+    }
+    get RSA() {
+        return this._rsa;
+    }
+    get AES() {
+        return this._aes;
+    }
+    constructor(crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}) {
+        this._crypto = crypto;
+        this._rsa = new RSA_1.RSAUtils(crypto);
+        this._aes = new AES_1.AESUtils(crypto);
+        this._shamir = new shamir_1.ShamirClass(crypto);
+    }
+    /**
+     * Generates a UUID using a cryptographically secure random number generator.
+     */
+    randomUuid() {
+        return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(/[018]/g, 
+        //Keep next inlined or you will lose the random
+        (c) => (Number(c) ^ (this.crypto.getRandomValues(new Uint8Array(1))[0] & (15 >> (Number(c) / 4)))).toString(16));
+    }
+    /**
+     * @param data some data
+     * @return the sha256 hash of {@link data}
+     */
+    sha256(data) {
+        return this.crypto.subtle.digest('SHA-256', data);
+    }
+    /**
+     * @param n how many bytes to generate
+     * @return an array with n random bytes
+     */
+    randomBytes(n) {
+        const res = new Uint8Array(n);
+        this.crypto.getRandomValues(res);
+        return res;
+    }
+}
+exports.CryptoPrimitives = CryptoPrimitives;
+//# sourceMappingURL=CryptoPrimitives.js.map

package/icc-x-api/crypto/CryptoPrimitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoPrimitives.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/CryptoPrimitives.ts"],"names":[],"mappings":";;;AAAA,+BAAgC;AAChC,+BAAgC;AAChC,qCAAsC;AAEtC;;GAEG;AACH,MAAa,gBAAgB;IAM3B,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QACrI,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,cAAQ,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,cAAQ,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,oBAAW,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAC5D,QAAQ;QACR,+CAA+C;QAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CACjI,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,IAA8B;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,CAAS;QACnB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAzDD,4CAyDC","sourcesContent":["import { RSAUtils } from './RSA'\nimport { AESUtils } from './AES'\nimport { ShamirClass } from './shamir'\n\n/**\n * Gives access to cryptographic primitives.\n */\nexport class CryptoPrimitives {\n  private readonly _rsa: RSAUtils\n  private readonly _aes: AESUtils\n  private readonly _shamir: ShamirClass\n  private readonly _crypto: Crypto\n\n  get crypto(): Crypto {\n    return this._crypto\n  }\n\n  get shamir(): ShamirClass {\n    return this._shamir\n  }\n\n  get RSA(): RSAUtils {\n    return this._rsa\n  }\n\n  get AES(): AESUtils {\n    return this._aes\n  }\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this._crypto = crypto\n    this._rsa = new RSAUtils(crypto)\n    this._aes = new AESUtils(crypto)\n    this._shamir = new ShamirClass(crypto)\n  }\n\n  /**\n   * Generates a UUID using a cryptographically secure random number generator.\n   */\n  randomUuid() {\n    return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(\n      /[018]/g,\n      //Keep next inlined or you will lose the random\n      (c) => (Number(c) ^ ((this.crypto.getRandomValues(new Uint8Array(1))! as Uint8Array)[0] & (15 >> (Number(c) / 4)))).toString(16)\n    )\n  }\n\n  /**\n   * @param data some data\n   * @return the sha256 hash of {@link data}\n   */\n  sha256(data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer> {\n    return this.crypto.subtle.digest('SHA-256', data)\n  }\n\n  /**\n   * @param n how many bytes to generate\n   * @return an array with n random bytes\n   */\n  randomBytes(n: number): Uint8Array {\n    const res = new Uint8Array(n)\n    this.crypto.getRandomValues(res)\n    return res\n  }\n}\n"]}

package/icc-x-api/crypto/CryptoStrategies.d.ts

@@ -0,0 +1,82 @@
+import { KeyPair } from './RSA';
+import { DataOwner } from '../icc-data-owner-x-api';
+import { CryptoPrimitives } from './CryptoPrimitives';
+/**
+ * Allows to customise the behaviour of the crypto api to better suit your needs.
+ *
+ * An important task which should be done in these crypto strategies is public key verification: in general there is no guarantee that the public keys
+ * stored in the iCure database are authentic, i.e. created by the data owner they are associated to. This is because the database admins or a
+ * malicious attacker may have added his own public keys to the data owner's public keys.
+ * Sharing any kind of data using unverified public keys could potentially cause a data leak: this is why when creating new exchange keys or when
+ * creating recovery data only verified keys will be considered. For decrypting existing data instead unverified keys will be used without issues.
+ */
+export interface CryptoStrategies {
+    /**
+     * Method called during initialisation of the crypto API to validate keys recovered through iCure's recovery methods and/or to allow recovery of
+     * missing keys using means external to iCure.
+     * On startup the iCure sdk will try to load all keys for the current data owner and its parent hierarchy: if the sdk can't find some of the keys
+     * for any of the data owners (according to the public keys for the data owner in the iCure server) and/or the sdk could recover some private keys
+     * but can't verify the authenticity of the key pairs this method will be called.
+     * The recovered and verified keys will automatically be cached using the current api {@link KeyStorageFacade} and {@link StorageFacade}
+     *
+     * The input is an array containing an object for each data owner part of the current data owner hierarchy. The objects are ordered from the data
+     * for the topmost parent of the current data owner hierarchy (first element) to the data for the current data owner (last element). Each object
+     * contains:
+     * - dataOwner: the data owner entity that this object refers to
+     * - unknownKeys: all public keys (in hex-encoded spki format) of `dataOwner` for which the authenticity status (verified or unverified) is unknown
+     *   (no result was cached from a previous api instantiation and the key was not generated on the current device).
+     * - unavailableKeys: all public keys (in hex-encoded spki format) of `dataOwner` for which the sdk could not recover a private key. May overlap
+     *   (partially or completely) with `unknownKeys`.
+     *
+     * The returned value must be an object associating to each data owner id an object with:
+     * - `recoveredKeys`: all recovered keys (will be automatically considered as verified), by fingerprint.
+     * - `keyAuthenticity`: an object associating to each public key fingerprint its authenticity. Note that if any of the keys from `unknownKeys` is
+     *   completely missing from this object the key will be considered as unverified in this api instance (same as if associated to false), but this
+     *   value won't be cached (will be again part of `unknownKeys` in future instances.
+     * @param keysData all information on unknown and unavailable keys for each data owner part of the current data owner hierarchy.
+     * @param cryptoPrimitives cryptographic primitives you can use to support the process.
+     * @return all recovered keys and key authenticity information, by data owner.
+     */
+    recoverAndVerifySelfHierarchyKeys(keysData: {
+        dataOwner: DataOwner;
+        unknownKeys: string[];
+        unavailableKeys: string[];
+    }[], cryptoPrimitives: CryptoPrimitives): Promise<{
+        [dataOwnerId: string]: {
+            recoveredKeys: {
+                [keyPairFingerprint: string]: KeyPair<CryptoKey>;
+            };
+            keyAuthenticity: {
+                [keyPairFingerprint: string]: boolean;
+            };
+        };
+    }>;
+    /**
+     * The correct initialisation of the crypto API requires that at least 1 verified (or device) key pair is available for each data owner part of the
+     * current data owner hierarchy. If no verified key is available for any of the data owner parents the api initialisation will automatically fail,
+     * however if there is no verified key for the current data owner you can instead create a new crypto key.
+     * @param self the current data owner.
+     * @param cryptoPrimitives cryptographic primitives you can use to support the process.
+     * @return depending on which values you return the api initialisation will proceed differently:
+     * - If this method returns true a new key will be automatically generated by the sdk.
+     * - If this method returns a key pair the crypto api loads the key pair and considers it as a device key.
+     * - If this method returns false the initialisation will fail with a predefined error.
+     * - If this method throws an error the initialisation will propagate the error.
+     */
+    generateNewKeyForDataOwner(self: DataOwner, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean>;
+    /**
+     * Verifies if the public keys of a data owner which will be the delegate of a new exchange key do actually belong to the person the data owner
+     * represents. This method is not called when the delegate would be the current data owner for the api.
+     *
+     * The user will have to obtain the verified public keys of the delegate from outside iCure, for example by email with another hcp, by checking the
+     * personal website of the other user, or by scanning verification qr codes at the doctor office...
+     *
+     * As long as one of the public keys is verified the creation of a new exchange key will succeed. If no public key is verified the operation will
+     * fail.
+     * @param delegate the potential data owner delegate.
+     * @param publicKeys public keys requiring verification, in spki hex-encoded format.
+     * @param cryptoPrimitives cryptographic primitives you can use to support the process.
+     * @return all verified public keys, in spki hex-encoded format.
+     */
+    verifyDelegatePublicKeys(delegate: DataOwner, publicKeys: string[], cryptoPrimitives: CryptoPrimitives): Promise<string[]>;
+}

package/icc-x-api/crypto/CryptoStrategies.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=CryptoStrategies.js.map

package/icc-x-api/crypto/CryptoStrategies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoStrategies.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/CryptoStrategies.ts"],"names":[],"mappings":"","sourcesContent":["import { KeyPair } from './RSA'\nimport { DataOwner } from '../icc-data-owner-x-api'\nimport { CryptoPrimitives } from './CryptoPrimitives'\n\n/**\n * Allows to customise the behaviour of the crypto api to better suit your needs.\n *\n * An important task which should be done in these crypto strategies is public key verification: in general there is no guarantee that the public keys\n * stored in the iCure database are authentic, i.e. created by the data owner they are associated to. This is because the database admins or a\n * malicious attacker may have added his own public keys to the data owner's public keys.\n * Sharing any kind of data using unverified public keys could potentially cause a data leak: this is why when creating new exchange keys or when\n * creating recovery data only verified keys will be considered. For decrypting existing data instead unverified keys will be used without issues.\n */\nexport interface CryptoStrategies {\n  /**\n   * Method called during initialisation of the crypto API to validate keys recovered through iCure's recovery methods and/or to allow recovery of\n   * missing keys using means external to iCure.\n   * On startup the iCure sdk will try to load all keys for the current data owner and its parent hierarchy: if the sdk can't find some of the keys\n   * for any of the data owners (according to the public keys for the data owner in the iCure server) and/or the sdk could recover some private keys\n   * but can't verify the authenticity of the key pairs this method will be called.\n   * The recovered and verified keys will automatically be cached using the current api {@link KeyStorageFacade} and {@link StorageFacade}\n   *\n   * The input is an array containing an object for each data owner part of the current data owner hierarchy. The objects are ordered from the data\n   * for the topmost parent of the current data owner hierarchy (first element) to the data for the current data owner (last element). Each object\n   * contains:\n   * - dataOwner: the data owner entity that this object refers to\n   * - unknownKeys: all public keys (in hex-encoded spki format) of `dataOwner` for which the authenticity status (verified or unverified) is unknown\n   *   (no result was cached from a previous api instantiation and the key was not generated on the current device).\n   * - unavailableKeys: all public keys (in hex-encoded spki format) of `dataOwner` for which the sdk could not recover a private key. May overlap\n   *   (partially or completely) with `unknownKeys`.\n   *\n   * The returned value must be an object associating to each data owner id an object with:\n   * - `recoveredKeys`: all recovered keys (will be automatically considered as verified), by fingerprint.\n   * - `keyAuthenticity`: an object associating to each public key fingerprint its authenticity. Note that if any of the keys from `unknownKeys` is\n   *   completely missing from this object the key will be considered as unverified in this api instance (same as if associated to false), but this\n   *   value won't be cached (will be again part of `unknownKeys` in future instances.\n   * @param keysData all information on unknown and unavailable keys for each data owner part of the current data owner hierarchy.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @return all recovered keys and key authenticity information, by data owner.\n   */\n  recoverAndVerifySelfHierarchyKeys(\n    keysData: {\n      dataOwner: DataOwner\n      unknownKeys: string[]\n      unavailableKeys: string[]\n    }[],\n    cryptoPrimitives: CryptoPrimitives\n  ): Promise<{\n    [dataOwnerId: string]: {\n      recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n      keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n    }\n  }>\n\n  /**\n   * The correct initialisation of the crypto API requires that at least 1 verified (or device) key pair is available for each data owner part of the\n   * current data owner hierarchy. If no verified key is available for any of the data owner parents the api initialisation will automatically fail,\n   * however if there is no verified key for the current data owner you can instead create a new crypto key.\n   * @param self the current data owner.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @return depending on which values you return the api initialisation will proceed differently:\n   * - If this method returns true a new key will be automatically generated by the sdk.\n   * - If this method returns a key pair the crypto api loads the key pair and considers it as a device key.\n   * - If this method returns false the initialisation will fail with a predefined error.\n   * - If this method throws an error the initialisation will propagate the error.\n   */\n  generateNewKeyForDataOwner(self: DataOwner, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean>\n\n  /**\n   * Verifies if the public keys of a data owner which will be the delegate of a new exchange key do actually belong to the person the data owner\n   * represents. This method is not called when the delegate would be the current data owner for the api.\n   *\n   * The user will have to obtain the verified public keys of the delegate from outside iCure, for example by email with another hcp, by checking the\n   * personal website of the other user, or by scanning verification qr codes at the doctor office...\n   *\n   * As long as one of the public keys is verified the creation of a new exchange key will succeed. If no public key is verified the operation will\n   * fail.\n   * @param delegate the potential data owner delegate.\n   * @param publicKeys public keys requiring verification, in spki hex-encoded format.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @return all verified public keys, in spki hex-encoded format.\n   */\n  verifyDelegatePublicKeys(delegate: DataOwner, publicKeys: string[], cryptoPrimitives: CryptoPrimitives): Promise<string[]>\n}\n"]}

package/icc-x-api/crypto/EntitiesEncryption.d.ts

@@ -0,0 +1,254 @@
+import { Delegation, EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models';
+import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { ExchangeKeysManager } from './ExchangeKeysManager';
+import { CryptoPrimitives } from './CryptoPrimitives';
+import { ShareMetadataBehaviour } from './ShareMetadataBehaviour';
+/**
+ * @internal this class is for internal use only and may be changed without notice
+ * Give access to functions for retrieving encryption metadata of entities.
+ */
+export declare class EntitiesEncryption {
+    private readonly primitives;
+    private readonly dataOwnerApi;
+    private readonly exchangeKeysManager;
+    constructor(primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, exchangeKeysManager: ExchangeKeysManager);
+    /**
+     * Get the encryption keys of an entity that the provided data owner can access, potentially using the keys for his parent.
+     * There should only be one encryption key for each entity, but the method supports more to allow to deal with conflicts and merged duplicate data.
+     * @param entity an encrypted entity.
+     * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.
+     * @param tagsFilter allows to obtain only encryption keys associated to tags which satisfy the provided filter.
+     * @return the encryption keys that the provided data owner can decrypt, deduplicated.
+     */
+    encryptionKeysOf(entity: EncryptedEntity | EncryptedEntityStub, dataOwnerId?: string, tagsFilter?: (tags: string[]) => Promise<boolean>): Promise<string[]>;
+    /**
+     * Get the encryption keys of an entity that the current data owner and his parents can access. The resulting array contains the keys for each data
+     * owner in the hierarchy which can be decrypted using only that data owner keys (excludes keys accessible through the parent keys). The order of
+     * the array is the same as in {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds}.
+     * Note that different data owners may have access to the same keys, but the keys extracted for each data owner are deduplicated.
+     * There should only be one encryption key for each entity, but the method supports more to allow to deal with conflicts and merged duplicate data.
+     * @param entity an encrypted entity.
+     * @param tagsFilter allows to obtain only encryption keys associated to tags which satisfy the provided filter.
+     * @return the encryption keys that each member of the current data owner hierarchy can decrypt using only his keys and not keys of his parents.
+     */
+    encryptionKeysForHcpHierarchyOf(entity: EncryptedEntity | EncryptedEntityStub, tagsFilter?: (tags: string[]) => Promise<boolean>): Promise<{
+        ownerId: string;
+        extracted: string[];
+    }[]>;
+    /**
+     * Get the secret ids (SFKs) of an entity that the provided data owner can access, potentially using the keys for his parent.
+     * @param entity an encrypted entity.
+     * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.
+     * @param tagsFilter allows to obtain only secret ids associated to tags which satisfy the provided filter.
+     * @return the secret ids (SFKs) that the provided data owner can decrypt, deduplicated.
+     */
+    secretIdsOf(entity: EncryptedEntity | EncryptedEntityStub, dataOwnerId?: string, tagsFilter?: (tags: string[]) => Promise<boolean>): Promise<string[]>;
+    /**
+     * Get the secret ids (SFKs) of an entity that the current data owner and his parents can access. The resulting array contains the ids for each data
+     * owner in the hierarchy which can be decrypted using only that data owner keys (excludes ids accessible through the parent keys). The order of
+     * the array is the same as in {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds}.
+     * Note that different data owners may have access to the same secret ids, but the secret ids extracted for each data owner are deduplicated.
+     * @param entity an encrypted entity.
+     * @param tagsFilter allows to obtain only secret ids associated to tags which satisfy the provided filter.
+     * @return the secret ids that each member of the current data owner hierarchy can decrypt using only his keys and not keys of his parents.
+     */
+    secretIdsForHcpHierarchyOf(entity: EncryptedEntity | EncryptedEntityStub, tagsFilter?: (tags: string[]) => Promise<boolean>): Promise<{
+        ownerId: string;
+        extracted: string[];
+    }[]>;
+    /**
+     * Get the decrypted owning entity ids (formerly CFKs) for the provided entity that can be decrypted using the private keys of the current data
+     * owner and his parents. The owning entity id would be, for example, the id of a patient for contact and healthcare elements, or the id of a
+     * message for documents.
+     * There should only be one owning entity id for each entity, but the method supports more to allow to deal with conflicts and merged duplicate
+     * data.
+     * @param entity an encrypted entity.
+     * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.
+     * @param tagsFilter allows to obtain only owning entity ids associated to tags which satisfy the provided filter.
+     * @return the owning entity ids (CFKs) that the provided data owner can decrypt, deduplicated.
+     */
+    owningEntityIdsOf(entity: EncryptedEntity | EncryptedEntityStub, dataOwnerId?: string, tagsFilter?: (tags: string[]) => Promise<boolean>): Promise<string[]>;
+    /**
+     * Get the decrypted owning entity ids (formerly CFKs) for the provided entity that can be decrypted using the private keys of the current data
+     * owner and his parents. The owning entity id would be, for example, the id of a patient for contact and healthcare elements, or the id of a
+     * message for documents.
+     * The resulting array contains the ids for each data owner in the hierarchy which can be decrypted using only that data owner keys (excludes ids
+     * accessible through the parent keys). The order of the array is the same as in {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds}.
+     * Note that different data owners may have access to the same owning entity ids, but the owning entity ids extracted for each data owner are
+     * deduplicated in case they could be accessed through different delegations.
+     * There should only be one owning entity id for each entity, but the method supports more to allow to deal with conflicts and merged duplicate
+     * data.
+     * @param entity an encrypted entity.
+     * @param tagsFilter allows to obtain only owning entity ids associated to tags which satisfy the provided filter.
+     * @return the owning entity ids that each member of the current data owner hierarchy can decrypt using only his keys and not keys of his parents.
+     */
+    owningEntityIdsForHcpHierarchyOf(entity: EncryptedEntity | EncryptedEntityStub, tagsFilter?: (tags: string[]) => Promise<boolean>): Promise<{
+        ownerId: string;
+        extracted: string[];
+    }[]>;
+    /**
+     * @internal this method is intended only for internal use and may be changed without notice.
+     * Initializes encryption metadata for an entity. This includes the encrypted secret id, owning entity id, and encryption key for the entity, and
+     * the clear text secret foreign key of the parent entity.
+     * This method returns a modified copy of the entity.
+     * @param entity entity which requires encryption metadata initialisation.
+     * @param owningEntity id of the owning entity, if any (e.g. patient id for Contact/HealtchareElement, message id for Document, ...).
+     * @param owningEntitySecretId secret id of the parent entity, to use in the secret foreign keys for the provided entity, if any.
+     * @param initialiseEncryptionKeys if false this method will not initialize any encryption keys. Use only for entities which use delegations for
+     * access control but don't actually have any encrypted content.
+     * @param additionalDelegations automatically shares the
+     * @param tags tags to associate with the initial encryption keys and metadata
+     * @throws if the entity already has non-empty values for encryption metadata.
+     * @return an updated copy of the entity.
+     */
+    entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(entity: T, owningEntity: string | undefined, owningEntitySecretId: string | undefined, initialiseEncryptionKeys: boolean, additionalDelegations?: string[], tags?: string[]): Promise<{
+        updatedEntity: T;
+        rawEncryptionKey: string | undefined;
+        secretId: string;
+    }>;
+    entityWithAutoExtendedEncryptedMetadata<T extends EncryptedEntity>(entity: T, delegateId: string, shareSecretIds: string[] | undefined, shareEncryptionKeys: ShareMetadataBehaviour | undefined, shareOwningEntityIds: ShareMetadataBehaviour | undefined): Promise<T>;
+    /**
+     * Updates encryption metadata for an entity in order to share it with a delegate or in order to add additional encrypted metadata for an existing
+     * delegate.
+     * The first time this method is used for a specific delegate it will give access to all unencrypted content of the entity to the delegate data
+     * owner. Additionally, this method also allows to share new or existing secret ids (shareSecretId), encryption keys (shareEncryptionKeys) and
+     * owning entity ids (shareOwningEntityIds) for the entity.
+     * You can use methods like {@link secretIdsOf}, {@link secretIdsForHcpHierarchyOf}, {@link encryptionKeysOf}, ... to retrieve the data you want to
+     * share. In most cases you may want to share everything related to the entity, but note that if you use confidential delegations for patients you
+     * may want to avoid sharing the confidential secret ids of the current user with other hcps.
+     * This method returns a modified copy of the entity.
+     * @param entity entity which requires encryption metadata initialisation.
+     * @param delegateId id of the delegate to share data with.
+     * @param shareSecretIds secret ids to share.
+     * @param shareEncryptionKeys encryption keys to share.
+     * @param shareOwningEntityIds owning enttiy ids to share.
+     * @param newTags tags to associate with the new encryption keys and metadata. Existing data won't be changed.
+     * @throws if any of the shareX parameters is set to `true` but the corresponding piece of data could not be retrieved.
+     * @return an updated copy of the entity.
+     */
+    entityWithExtendedEncryptedMetadata<T extends EncryptedEntity>(entity: T, delegateId: string, shareSecretIds: string[], shareEncryptionKeys: string[], shareOwningEntityIds: string[], newTags?: string[]): Promise<T>;
+    /**
+     * Encrypts data using a key of the entity that the provided data owner can access (current data owner by default). If the provided data owner can
+     * access multiple encryption keys of the entity there is no guarantee on which key will be used.
+     * Note: you should not use this method to encrypt the `encryptedSelf` of iCure entities, since that will be automatically handled by the extended
+     * apis. You should use this method only to encrypt additional data, such as document attachments.
+     * @param entity an entity.
+     * @param content data of the entity which you want to encrypt.
+     * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.
+     * @param tagsFilter allows to use for encryption only keys associated to tags which pass the filter.
+     * @return the encrypted data.
+     * @throws if the provided data owner can't access any encryption keys for the entity.
+     */
+    encryptDataOf(entity: EncryptedEntity | EncryptedEntityStub, content: ArrayBuffer | Uint8Array, dataOwnerId?: string, tagsFilter?: (tags: string[]) => Promise<boolean>): Promise<ArrayBuffer>;
+    /**
+     * Decrypts data using a key of the entity that the provided data owner can access (current data owner by default). If the provided data owner can
+     * access multiple encryption keys each of them will be tried for decryption until one of them gives a result that is valid according to the
+     * provided validator.
+     * Note: you should not use this method to decrypt the `encryptedSelf` of iCure entities, since that will be automatically handled by the extended
+     * apis. You should use this method only to decrypt additional data, such as document attachments.
+     * @param entity an entity.
+     * @param content data of the entity which you want to decrypt.
+     * @param dataOwnerId optionally a data owner part of the hierarchy for the current data owner, defaults to the current data owner.
+     * @param validator a function which verifies the correctness of decrypted content: helps to identify decryption with the wrong key without relying
+     * solely on padding.
+     * @param tagsFilter allows to use for decryption only keys associated to tags which pass the filter.
+     * @return the decrypted data.
+     * @throws if the provided data owner can't access any encryption keys for the entity, or if no key could be found which provided valid decrypted
+     * content according to the validator.
+     */
+    decryptDataOf(entity: EncryptedEntity | EncryptedEntityStub, content: ArrayBuffer | Uint8Array, validator?: (decryptedData: ArrayBuffer) => Promise<boolean>, dataOwnerId?: string, tagsFilter?: (tags: string[]) => Promise<boolean>): Promise<ArrayBuffer>;
+    /**
+     * @internal this method is intended for internal use only and may be changed without notice.
+     * Decrypts the content of an encrypted entity.
+     */
+    decryptEntity<T extends EncryptedEntity>(entity: T, ownerId: string, constructor: (json: any) => T): Promise<{
+        entity: T;
+        decrypted: boolean;
+    }>;
+    /**
+     * @internal this method is intended for internal use only and may be changed without notice.
+     * Tries using the provided keys to decrypt some json.
+     */
+    tryDecryptJson(potentialKeys: {
+        key: CryptoKey;
+        raw: string;
+    }[], encrypted: Uint8Array, truncateTrailingDecryptedNulls: boolean): Promise<{} | undefined>;
+    /**
+     * @internal this method is intended for internal use only and may be changed without notice.
+     * Tries to encrypt the content of an encrypted entity.
+     * 1. If valid key for encryption is found the method returns the entity with the encrypted fields specified by cryptedKeys
+     * 2. If requireEncryption is true and no key could be found for encryption of the entity the method fails.
+     * 3. If requireEncryption is false and no key could be found for encryption the method will only check that the entity does not specify any value
+     * for fields which should be encrypted according to cryptedKeys (e.g. note in a patient by default). If the entity specifies a value for any field
+     * which should be encrypted the method throws an error, otherwise the method returns the original entity.
+     */
+    tryEncryptEntity<T extends EncryptedEntity>(entity: T, dataOwnerId: string, cryptedKeys: string[], encodeBinaryData: boolean, requireEncryption: boolean, constructor: (json: any) => T): Promise<T>;
+    /**
+     * @internal This method is for internal use only and may be changed without notice.
+     * Ensures that the encryption keys of an entity are initialised. If not will throw an exception or initialise them depending on the content of
+     * the entity. This function supports migration of entities using older encryption schemes (delegation only without encrypted keys) or entities
+     * which were previously not encrypted.
+     */
+    ensureEncryptionKeysInitialised<T extends EncryptedEntity>(entity: T): Promise<T>;
+    /**
+     * Get the decrypted content of a delegation-like object which the provided data owner would be able to access using ONLY HIS EXCHANGE KEYS (does
+     * not consider exchange keys for parents).
+     * Note that the retrieved exchange keys are decrypted using the private keys available on the device, and results may vary from other devices.
+     * @param dataOwnerId id of a data owner, he should be part of the current data owner hierarchy.
+     * @param delegations a delegation-like object containing the encrypted key
+     * @param includeFromDelegations if true also considers delegation from the provided data owner (or parents) to look for values. This allows to
+     * decrypt delegations associated to exchange keys recovered after a giveAccessBack request.
+     * @param validateDecrypted validates the decrypted result, to drop decryption results with wrong key that still gave a valid checksum.
+     * @param tagsFilter allows to obtain only encryption keys associated to tags which satisfy the provided filter.
+     * @return the key which could be decrypted using only keys available on the current device and delegations from/to the provided data owner. May
+     * contain duplicates.
+     */
+    private extractFromDelegationsForDataOwner;
+    private populateDelegatedTo;
+    private extractedHierarchyFromDelegation;
+    /**
+     * @internal This method should be private but is currently public/internal to allow to continue supporting legacy methods
+     */
+    extractMergedHierarchyFromDelegationAndOwner(delegations: {
+        [delegateId: string]: Delegation[];
+    }, dataOwnerId: string | undefined, validateDecrypted: (result: string) => boolean | Promise<boolean>, tagsFilter: (tags: string[]) => Promise<boolean>): Promise<string[]>;
+    private tryDecryptDelegation;
+    private tryImportKey;
+    /**
+     * @internal this method is for internal use only and may be changed without notice.
+     */
+    importFirstValidKey(keys: string[], entityId: string): Promise<{
+        key: CryptoKey;
+        raw: string;
+    }>;
+    private tryImportFirstValidKey;
+    /**
+     * @internal this method is for internal use only and may be changed without notice.
+     */
+    importAllValidKeys(keys: string[]): Promise<{
+        key: CryptoKey;
+        raw: string;
+    }[]>;
+    private validateEncryptionKey;
+    private validateSecretId;
+    private validateOwningEntityId;
+    private createEncryptionKeyDelegation;
+    private createSecretIdDelegation;
+    private createOwningEntityIdDelegation;
+    private createDelegation;
+    private loadEncryptionKeysForDelegates;
+    private createOrUpdateEntityDelegations;
+    /**
+     * De-duplicates all currently accessible delegations, by removing any delegations created by the current data owner which have duplicated content,
+     * and checks if any of the required entries are currently available to the delegate through the existing delegations.
+     * @param delegateId id of the delegate.
+     * @param allDelegations delegations of the entity.
+     * @param requiredEntries potentially new entries that the delegate needs to be able to access from the delegations.
+     * @param validateDecrypted validator for decrypted delegation content
+     * @return the deduplicated delegations
+     */
+    private deduplicateDelegationsAndFilterRequiredEntries;
+    private deduplicate;
+    private throwDetailedExceptionForInvalidParameter;
+    private checkEmptyEncryptionMetadata;
+}