@icure/api 6.4.2 → 6.4.4

package/icc-x-api/icc-crypto-x-api.js

@@ -18,31 +18,6 @@ const models_1 = require("../icc-api/model/models");
 const binary_utils_1 = require("./utils/binary-utils");
 const utils_1 = require("./utils");
 class IccCryptoXApi {
-    constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
-    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}, storage, keyStorage) {
-        this.hcPartyKeysCache = {};
-        //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
-        //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
-        this.hcPartyKeysRequestsCache = {};
-        this.cacheLastDeletionTimestamp = undefined;
-        this.dataOwnerCache = {};
-        this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
-        this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
-        this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
-        this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
-        this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
-        this.rsaKeyPairs = {};
-        this.hcpartyBaseApi = hcpartyBaseApi;
-        this.patientBaseApi = patientBaseApi;
-        this.deviceBaseApi = deviceBaseApi;
-        this._crypto = crypto;
-        this.generateKeyConcurrencyMap = {};
-        this._AES = new AES_1.AESUtils(crypto);
-        this._RSA = new RSA_1.RSAUtils(crypto);
-        this._shamir = new shamir_1.ShamirClass(crypto);
-        this._storage = storage;
-        this._keyStorage = keyStorage;
-    }
     get crypto() {
         return this._crypto;
     }
@@ -83,6 +58,31 @@ class IccCryptoXApi {
             this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
         ]).then(([a, b, c]) => (Object.assign(Object.assign(Object.assign({}, a), b), c)));
     }
+    constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
+    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}, storage, keyStorage) {
+        this.hcPartyKeysCache = {};
+        //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
+        //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
+        this.hcPartyKeysRequestsCache = {};
+        this.cacheLastDeletionTimestamp = undefined;
+        this.dataOwnerCache = {};
+        this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
+        this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
+        this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
+        this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
+        this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
+        this.rsaKeyPairs = {};
+        this.hcpartyBaseApi = hcpartyBaseApi;
+        this.patientBaseApi = patientBaseApi;
+        this.deviceBaseApi = deviceBaseApi;
+        this._crypto = crypto;
+        this.generateKeyConcurrencyMap = {};
+        this._AES = new AES_1.AESUtils(crypto);
+        this._RSA = new RSA_1.RSAUtils(crypto);
+        this._shamir = new shamir_1.ShamirClass(crypto);
+        this._storage = storage;
+        this._keyStorage = keyStorage;
+    }
     loadAllKeysFromLocalStorage(dataOwnerId) {
         return __awaiter(this, void 0, void 0, function* () {
             const pubKeys = yield this.getDataOwnerHexPublicKeys((yield this.getDataOwner(dataOwnerId)).dataOwner);
@@ -1280,60 +1280,56 @@ class IccCryptoXApi {
      * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
      * AES key using the new user public key.
      *
-     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
-     * @param ownerId Id of the data owner to which we would like to give access back
+     * @param accessGiver User, in charge of giving access back to the person who previously gave him some access (should be the current user)
+     * @param ownerId Id of the data owner to which we would like to get access back
      * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
-     *
-     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
      */
-    giveAccessBackTo(delegateUser, ownerId, ownerNewPublicKey) {
-        var _a, _b, _c, _d;
+    giveAccessBackTo(accessGiver, ownerId, ownerNewPublicKey) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            const delegateId = (_b = (_a = delegateUser.healthcarePartyId) !== null && _a !== void 0 ? _a : delegateUser.patientId) !== null && _b !== void 0 ? _b : delegateUser.deviceId;
-            if (!delegateId) {
-                throw new Error(`DelegateUser ${delegateUser.id} must be a data Owner`);
+            const newPubKeyCryptoKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(ownerNewPublicKey), ['encrypt']);
+            const giverDoId = (_b = (_a = accessGiver.healthcarePartyId) !== null && _a !== void 0 ? _a : accessGiver.patientId) !== null && _b !== void 0 ? _b : accessGiver.deviceId;
+            if (!giverDoId) {
+                throw new Error(`Access giver ${accessGiver.id} must be a data Owner`);
             }
-            const delegatePublicKeys = yield this.getPublicKeys();
-            const newPubKeyCryptoKey = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(ownerNewPublicKey)), ['encrypt']);
-            const dataOwnerToUpdate = yield this.getDataOwner(ownerId);
-            const newAesExchangeKeys = yield (0, utils_1.foldAsync)(Object.entries((_c = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => __awaiter(this, void 0, void 0, function* () {
-                var _e;
-                const existingKeys = (_e = pubAcc[pubKey]) !== null && _e !== void 0 ? _e : {};
-                pubAcc[pubKey] = yield (0, utils_1.foldAsync)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => __awaiter(this, void 0, void 0, function* () {
-                    if (delId == delegateId && pubKey != ownerNewPublicKey) {
-                        // Add the AES Key encrypted with the new public key in the aesExchangeKeys
-                        try {
-                            // First, we decrypt it using the delegate RSA Public Key
-                            const encrAesKeyInfo = yield this.decryptHcPartyKey(delegateId, dataOwnerToUpdate.dataOwner.id, delegateId, pubKey, delKeys, delegatePublicKeys).then((delegatorAndKeys) => __awaiter(this, void 0, void 0, function* () {
-                                // Then, we encrypt it using the owner new RSA Public Key (provided in argument)
-                                return yield this.encryptAesKeyOnlyForProvidedKeys(delegatorAndKeys === null || delegatorAndKeys === void 0 ? void 0 : delegatorAndKeys.rawKey, dataOwnerToUpdate, [newPubKeyCryptoKey])
-                                    .then((encrAes) => Object.values(encrAes)[0])
-                                    .then((encrAesInfo) => {
-                                    return { pubKeyUsedToEncryptAes: Object.keys(encrAesInfo)[0], encryptedAes: Object.values(encrAesInfo)[0] };
-                                });
-                            }));
-                            delKeys[encrAesKeyInfo.pubKeyUsedToEncryptAes] = encrAesKeyInfo.encryptedAes;
-                        }
-                        catch (e) {
-                            console.log(`${delegateId} could not re-encrypt AES Key of ${dataOwnerToUpdate.dataOwner.id}`);
-                        }
-                        finally {
-                            delAcc[delId] = delKeys;
+            const giverDoKeys = yield this.getDataOwner(giverDoId).then((doData) => { var _a; return [doData.dataOwner.publicKey, ...Object.keys((_a = doData.dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})].filter((x) => !!x); });
+            const giveAccessBackToExchangeKey = (exchangeKeys, delegatorId, // Getter for getter exchange keys, giver for giver exchange keys
+            delegateId // Giver for getter exchange keys, getter for giver exchange keys
+            ) => __awaiter(this, void 0, void 0, function* () {
+                const updatedExchangeKeys = _.cloneDeep(exchangeKeys);
+                for (const [publicKey, mapsByDelegate] of Object.entries(updatedExchangeKeys)) {
+                    const mapOfDelegate = mapsByDelegate[delegateId];
+                    if (!!mapOfDelegate && !mapOfDelegate[ownerNewPublicKey.slice(-32)]) {
+                        const decryptedKey = yield this.decryptHcPartyKey(giverDoId, delegatorId, delegateId, publicKey, mapOfDelegate, giverDoKeys)
+                            .then((x) => x === null || x === void 0 ? void 0 : x.rawKey)
+                            .catch(() => undefined);
+                        if (decryptedKey) {
+                            mapOfDelegate[ownerNewPublicKey.slice(-32)] = yield this.encryptAesKeyOnlyForProvidedKeys(decryptedKey, delegateId, [
+                                newPubKeyCryptoKey,
+                            ]).then((encrAes) => Object.values(Object.values(encrAes)[0])[0]);
                         }
                     }
-                    else {
-                        // Otherwise, we don't transform the aesExchangeKeys for this delegate
-                        delAcc[delId] = delKeys;
-                    }
-                    return delAcc;
-                }));
-                return pubAcc;
-            }));
-            // After adding the potential new aesExchangeKeys, we save the updated data owner
-            return this._saveDataOwner({
-                type: dataOwnerToUpdate.type,
-                dataOwner: Object.assign(Object.assign({}, dataOwnerToUpdate.dataOwner), { aesExchangeKeys: newAesExchangeKeys }),
+                }
+                return updatedExchangeKeys;
             });
+            yield (0, utils_1.retry)(() => __awaiter(this, void 0, void 0, function* () {
+                var _c;
+                const getterDo = yield this.getDataOwner(ownerId);
+                const updatedGetterKeys = yield giveAccessBackToExchangeKey((_c = getterDo.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}, ownerId, giverDoId);
+                yield this._saveDataOwner({
+                    type: getterDo.type,
+                    dataOwner: Object.assign(Object.assign({}, getterDo.dataOwner), { aesExchangeKeys: updatedGetterKeys }),
+                });
+            }), 3, 5000, 1);
+            yield (0, utils_1.retry)(() => __awaiter(this, void 0, void 0, function* () {
+                var _d;
+                const giverDo = yield this.getDataOwner(giverDoId);
+                const updatedGiverKeys = yield giveAccessBackToExchangeKey((_d = giverDo.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, giverDoId, ownerId);
+                yield this._saveDataOwner({
+                    type: giverDo.type,
+                    dataOwner: Object.assign(Object.assign({}, giverDo.dataOwner), { aesExchangeKeys: updatedGiverKeys }),
+                });
+            }), 3, 5000, 1);
         });
     }
     addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true, sendMaintenanceTasks = true) {
@@ -1435,16 +1431,16 @@ class IccCryptoXApi {
     encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
         return __awaiter(this, void 0, void 0, function* () {
             const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
-            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerAllPubKeys);
+            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner.id, dataOwnerAllPubKeys);
         });
     }
-    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerPubKeys) {
+    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwnerId, dataOwnerPubKeys) {
         return __awaiter(this, void 0, void 0, function* () {
             const encryptedAesForDataOwner = yield (0, utils_1.foldAsync)(dataOwnerPubKeys, {}, (encrAes, pubKey) => __awaiter(this, void 0, void 0, function* () {
                 encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
                 return encrAes;
             }));
-            return { [dataOwner.id]: encryptedAesForDataOwner };
+            return { [dataOwnerId]: encryptedAesForDataOwner };
         });
     }
     retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {
@@ -1483,6 +1479,9 @@ class IccCryptoXApi {
                     .map((delegateId) => {
                     return { delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, hexNewPubKey) };
                 });
+                if (tasks.length > 0) {
+                    this.emptyHcpCache(dataOwner.id);
+                }
                 const res = [];
                 for (const task of tasks) {
                     const taskToCreate = yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.newInstance(user, task.maintenanceTask, [task.delegateId]));