@icure/api 6.4.1 → 6.4.3

package/icc-x-api/icc-crypto-x-api.js

@@ -18,6 +18,31 @@ const models_1 = require("../icc-api/model/models");
 const binary_utils_1 = require("./utils/binary-utils");
 const utils_1 = require("./utils");
 class IccCryptoXApi {
+    constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
+    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}, storage, keyStorage) {
+        this.hcPartyKeysCache = {};
+        //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
+        //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
+        this.hcPartyKeysRequestsCache = {};
+        this.cacheLastDeletionTimestamp = undefined;
+        this.dataOwnerCache = {};
+        this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
+        this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
+        this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
+        this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
+        this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
+        this.rsaKeyPairs = {};
+        this.hcpartyBaseApi = hcpartyBaseApi;
+        this.patientBaseApi = patientBaseApi;
+        this.deviceBaseApi = deviceBaseApi;
+        this._crypto = crypto;
+        this.generateKeyConcurrencyMap = {};
+        this._AES = new AES_1.AESUtils(crypto);
+        this._RSA = new RSA_1.RSAUtils(crypto);
+        this._shamir = new shamir_1.ShamirClass(crypto);
+        this._storage = storage;
+        this._keyStorage = keyStorage;
+    }
     get crypto() {
         return this._crypto;
     }
@@ -58,31 +83,6 @@ class IccCryptoXApi {
             this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
         ]).then(([a, b, c]) => (Object.assign(Object.assign(Object.assign({}, a), b), c)));
     }
-    constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
-    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}, storage, keyStorage) {
-        this.hcPartyKeysCache = {};
-        //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
-        //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
-        this.hcPartyKeysRequestsCache = {};
-        this.cacheLastDeletionTimestamp = undefined;
-        this.dataOwnerCache = {};
-        this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
-        this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
-        this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
-        this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
-        this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
-        this.rsaKeyPairs = {};
-        this.hcpartyBaseApi = hcpartyBaseApi;
-        this.patientBaseApi = patientBaseApi;
-        this.deviceBaseApi = deviceBaseApi;
-        this._crypto = crypto;
-        this.generateKeyConcurrencyMap = {};
-        this._AES = new AES_1.AESUtils(crypto);
-        this._RSA = new RSA_1.RSAUtils(crypto);
-        this._shamir = new shamir_1.ShamirClass(crypto);
-        this._storage = storage;
-        this._keyStorage = keyStorage;
-    }
     loadAllKeysFromLocalStorage(dataOwnerId) {
         return __awaiter(this, void 0, void 0, function* () {
             const pubKeys = yield this.getDataOwnerHexPublicKeys((yield this.getDataOwner(dataOwnerId)).dataOwner);
@@ -1245,91 +1245,91 @@ class IccCryptoXApi {
      * @returns {Promise} -> {CryptoKey} - imported RSA
      */
     loadKeyPairImported(id) {
-        return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
-            try {
-                const jwkKeyPair = yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
-                if (jwkKeyPair !== undefined) {
-                    if (jwkKeyPair.publicKey && jwkKeyPair.privateKey) {
-                        this._RSA.importKeyPair('jwk', jwkKeyPair.privateKey, 'jwk', jwkKeyPair.publicKey).then(resolve, (err) => {
-                            console.error('Error in RSA.importKeyPair: ' + err);
-                            reject(err);
-                        });
-                    }
-                    else {
-                        const message = 'Error in RSA.importKeyPair: Invalid key';
-                        console.error(message);
-                        reject(Error(message));
-                    }
+        return __awaiter(this, void 0, void 0, function* () {
+            let jwkKeyPair = yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
+            if (!jwkKeyPair) {
+                const { dataOwner } = yield this.getDataOwner(id);
+                if (dataOwner.publicKey) {
+                    jwkKeyPair = yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id + '.' + dataOwner.publicKey.slice(-32));
                 }
                 else {
-                    const message = 'Error in RSA.importKeyPair: Missing key';
+                    console.warn('Attempting to load default public key for data owner without default public key');
+                }
+            }
+            if (jwkKeyPair !== undefined) {
+                if (jwkKeyPair.publicKey && jwkKeyPair.privateKey) {
+                    return yield this._RSA.importKeyPair('jwk', jwkKeyPair.privateKey, 'jwk', jwkKeyPair.publicKey).catch((err) => {
+                        console.error('Error in RSA.importKeyPair: ' + err);
+                        throw err;
+                    });
+                }
+                else {
+                    const message = 'Error in RSA.importKeyPair: Invalid key';
                     console.error(message);
-                    reject(Error(message));
+                    throw Error(message);
                 }
             }
-            catch (err) {
-                reject(err);
+            else {
+                const message = 'Error in RSA.importKeyPair: Missing key';
+                console.error(message);
+                throw Error(message);
             }
-        }));
+        });
     }
     /**
      * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
      * AES key using the new user public key.
      *
-     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
-     * @param ownerId Id of the data owner to which we would like to give access back
+     * @param accessGiver User, in charge of giving access back to the person who previously gave him some access (should be the current user)
+     * @param ownerId Id of the data owner to which we would like to get access back
      * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
-     *
-     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
      */
-    giveAccessBackTo(delegateUser, ownerId, ownerNewPublicKey) {
-        var _a, _b, _c, _d;
+    giveAccessBackTo(accessGiver, ownerId, ownerNewPublicKey) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            const delegateId = (_b = (_a = delegateUser.healthcarePartyId) !== null && _a !== void 0 ? _a : delegateUser.patientId) !== null && _b !== void 0 ? _b : delegateUser.deviceId;
-            if (!delegateId) {
-                throw new Error(`DelegateUser ${delegateUser.id} must be a data Owner`);
+            const newPubKeyCryptoKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(ownerNewPublicKey), ['encrypt']);
+            const giverDoId = (_b = (_a = accessGiver.healthcarePartyId) !== null && _a !== void 0 ? _a : accessGiver.patientId) !== null && _b !== void 0 ? _b : accessGiver.deviceId;
+            if (!giverDoId) {
+                throw new Error(`Access giver ${accessGiver.id} must be a data Owner`);
             }
-            const delegatePublicKeys = yield this.getPublicKeys();
-            const newPubKeyCryptoKey = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(ownerNewPublicKey)), ['encrypt']);
-            const dataOwnerToUpdate = yield this.getDataOwner(ownerId);
-            const newAesExchangeKeys = yield (0, utils_1.foldAsync)(Object.entries((_c = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => __awaiter(this, void 0, void 0, function* () {
-                var _e;
-                const existingKeys = (_e = pubAcc[pubKey]) !== null && _e !== void 0 ? _e : {};
-                pubAcc[pubKey] = yield (0, utils_1.foldAsync)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => __awaiter(this, void 0, void 0, function* () {
-                    if (delId == delegateId && pubKey != ownerNewPublicKey) {
-                        // Add the AES Key encrypted with the new public key in the aesExchangeKeys
-                        try {
-                            // First, we decrypt it using the delegate RSA Public Key
-                            const encrAesKeyInfo = yield this.decryptHcPartyKey(delegateId, dataOwnerToUpdate.dataOwner.id, delegateId, pubKey, delKeys, delegatePublicKeys).then((delegatorAndKeys) => __awaiter(this, void 0, void 0, function* () {
-                                // Then, we encrypt it using the owner new RSA Public Key (provided in argument)
-                                return yield this.encryptAesKeyOnlyForProvidedKeys(delegatorAndKeys === null || delegatorAndKeys === void 0 ? void 0 : delegatorAndKeys.rawKey, dataOwnerToUpdate, [newPubKeyCryptoKey])
-                                    .then((encrAes) => Object.values(encrAes)[0])
-                                    .then((encrAesInfo) => {
-                                    return { pubKeyUsedToEncryptAes: Object.keys(encrAesInfo)[0], encryptedAes: Object.values(encrAesInfo)[0] };
-                                });
-                            }));
-                            delKeys[encrAesKeyInfo.pubKeyUsedToEncryptAes] = encrAesKeyInfo.encryptedAes;
+            const giverDoKeys = yield this.getDataOwner(giverDoId).then((doData) => { var _a; return [doData.dataOwner.publicKey, ...Object.keys((_a = doData.dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})].filter((x) => !!x); });
+            const giveAccessBackToExchangeKey = (exchangeKeys, delegatorId, // Getter for getter exchange keys, giver for giver exchange keys
+            delegateId // Giver for getter exchange keys, getter for giver exchange keys
+            ) => __awaiter(this, void 0, void 0, function* () {
+                const updatedExchangeKeys = _.cloneDeep(exchangeKeys);
+                for (const [publicKey, mapsByDelegate] of Object.entries(updatedExchangeKeys)) {
+                    const mapOfDelegate = mapsByDelegate[delegateId];
+                    if (!!mapOfDelegate && !mapOfDelegate[ownerNewPublicKey.slice(-32)]) {
+                        const decryptedKey = yield this.decryptHcPartyKey(giverDoId, delegatorId, delegateId, publicKey, mapOfDelegate, giverDoKeys)
+                            .then((x) => x === null || x === void 0 ? void 0 : x.rawKey)
+                            .catch(() => undefined);
+                        if (decryptedKey) {
+                            mapOfDelegate[ownerNewPublicKey.slice(-32)] = yield this.encryptAesKeyOnlyForProvidedKeys(decryptedKey, delegateId, [
+                                newPubKeyCryptoKey,
+                            ]).then((encrAes) => Object.values(Object.values(encrAes)[0])[0]);
                         }
-                        catch (e) {
-                            console.log(`${delegateId} could not re-encrypt AES Key of ${dataOwnerToUpdate.dataOwner.id}`);
-                        }
-                        finally {
-                            delAcc[delId] = delKeys;
-                        }
-                    }
-                    else {
-                        // Otherwise, we don't transform the aesExchangeKeys for this delegate
-                        delAcc[delId] = delKeys;
                     }
-                    return delAcc;
-                }));
-                return pubAcc;
-            }));
-            // After adding the potential new aesExchangeKeys, we save the updated data owner
-            return this._saveDataOwner({
-                type: dataOwnerToUpdate.type,
-                dataOwner: Object.assign(Object.assign({}, dataOwnerToUpdate.dataOwner), { aesExchangeKeys: newAesExchangeKeys }),
+                }
+                return updatedExchangeKeys;
             });
+            yield (0, utils_1.retry)(() => __awaiter(this, void 0, void 0, function* () {
+                var _c;
+                const getterDo = yield this.getDataOwner(ownerId);
+                const updatedGetterKeys = yield giveAccessBackToExchangeKey((_c = getterDo.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}, ownerId, giverDoId);
+                yield this._saveDataOwner({
+                    type: getterDo.type,
+                    dataOwner: Object.assign(Object.assign({}, getterDo.dataOwner), { aesExchangeKeys: updatedGetterKeys }),
+                });
+            }), 3, 5000, 1);
+            yield (0, utils_1.retry)(() => __awaiter(this, void 0, void 0, function* () {
+                var _d;
+                const giverDo = yield this.getDataOwner(giverDoId);
+                const updatedGiverKeys = yield giveAccessBackToExchangeKey((_d = giverDo.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, giverDoId, ownerId);
+                yield this._saveDataOwner({
+                    type: giverDo.type,
+                    dataOwner: Object.assign(Object.assign({}, giverDo.dataOwner), { aesExchangeKeys: updatedGiverKeys }),
+                });
+            }), 3, 5000, 1);
         });
     }
     addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true, sendMaintenanceTasks = true) {
@@ -1431,16 +1431,16 @@ class IccCryptoXApi {
     encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
         return __awaiter(this, void 0, void 0, function* () {
             const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
-            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerAllPubKeys);
+            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner.id, dataOwnerAllPubKeys);
         });
     }
-    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerPubKeys) {
+    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwnerId, dataOwnerPubKeys) {
         return __awaiter(this, void 0, void 0, function* () {
             const encryptedAesForDataOwner = yield (0, utils_1.foldAsync)(dataOwnerPubKeys, {}, (encrAes, pubKey) => __awaiter(this, void 0, void 0, function* () {
                 encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
                 return encrAes;
             }));
-            return { [dataOwner.id]: encryptedAesForDataOwner };
+            return { [dataOwnerId]: encryptedAesForDataOwner };
         });
     }
     retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {
@@ -1467,29 +1467,27 @@ class IccCryptoXApi {
     sendMaintenanceTasks(maintenanceTaskApi, user, dataOwner, newPublicKey) {
         return __awaiter(this, void 0, void 0, function* () {
             const hexNewPubKey = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(newPublicKey, 'spki'));
-            const nonAccessiblePubKeys = Array.from(this.getDataOwnerHexPublicKeys(dataOwner).values())
-                .filter((existingPubKey) => existingPubKey != hexNewPubKey)
-                .filter((existingPubKey) => __awaiter(this, void 0, void 0, function* () { return (yield this.getPublicKeysAsSpki()).find((pubKey) => pubKey == existingPubKey) == undefined; }));
-            if (nonAccessiblePubKeys.length) {
-                const tasksForDelegates = Object.entries(yield this.getEncryptedAesExchangeKeysForDelegate(dataOwner.id))
-                    .filter(([delegatorId]) => delegatorId != dataOwner.id)
-                    .flatMap(([delegatorId, delegatorKeys]) => {
-                    return Object.entries(delegatorKeys).flatMap(([, aesExchangeKeys]) => {
-                        return Object.keys(aesExchangeKeys).map((delegatePubKey) => {
-                            return { delegateId: delegatorId, maintenanceTask: this.createMaintenanceTask(dataOwner, delegatePubKey) };
-                        });
-                    });
-                });
-                const tasksForDelegator = (yield this._getDelegateIdsOf(dataOwner))
+            const availablePubKeysSet = new Set(yield this.getPublicKeysAsSpki());
+            const hasNonAccessiblePubKeys = Array.from(this.getDataOwnerHexPublicKeys(dataOwner).values()).some((existingPubKey) => existingPubKey != hexNewPubKey && !availablePubKeysSet.has(existingPubKey));
+            if (hasNonAccessiblePubKeys) {
+                const allDelegatesAndDelegator = new Set([
+                    ...Object.keys(yield this.getEncryptedAesExchangeKeysForDelegate(dataOwner.id)),
+                    ...(yield this._getDelegateIdsOf(dataOwner)),
+                ]);
+                const tasks = [...allDelegatesAndDelegator]
                     .filter((delegateId) => delegateId != dataOwner.id)
                     .map((delegateId) => {
-                    return { delegateId: delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, hexNewPubKey) };
+                    return { delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, hexNewPubKey) };
                 });
-                return yield tasksForDelegates.concat(tasksForDelegator).reduce((existingTasks, task) => __awaiter(this, void 0, void 0, function* () {
+                const res = [];
+                for (const task of tasks) {
                     const taskToCreate = yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.newInstance(user, task.maintenanceTask, [task.delegateId]));
                     const createdTask = taskToCreate ? yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.createMaintenanceTaskWithUser(user, taskToCreate)) : undefined;
-                    return createdTask ? (yield existingTasks).concat(createdTask) : yield existingTasks;
-                }), Promise.resolve([]));
+                    if (createdTask) {
+                        res.push(createdTask);
+                    }
+                }
+                return res;
             }
             else {
                 return [];