@icure/api 7.0.0-beta.0 → 7.0.0-beta.2

package/.secrets.baseline

@@ -1,178 +0,0 @@
-{
-  "version": "1.3.0",
-  "plugins_used": [
-    {
-      "name": "ArtifactoryDetector"
-    },
-    {
-      "name": "AWSKeyDetector"
-    },
-    {
-      "name": "AzureStorageKeyDetector"
-    },
-    {
-      "name": "Base64HighEntropyString",
-      "limit": 4.5
-    },
-    {
-      "name": "BasicAuthDetector"
-    },
-    {
-      "name": "CloudantDetector"
-    },
-    {
-      "name": "EncodedFileDetector",
-      "path": "file://./icure-pre-commit/icure_detect_secrets/plugins/EncodedFileDetector.py"
-    },
-    {
-      "name": "GitHubTokenDetector"
-    },
-    {
-      "name": "HexHighEntropyString",
-      "limit": 3.0
-    },
-    {
-      "name": "IbmCloudIamDetector"
-    },
-    {
-      "name": "IbmCosHmacDetector"
-    },
-    {
-      "name": "JwtTokenDetector"
-    },
-    {
-      "name": "KeyFileDetector",
-      "path": "file://./icure-pre-commit/icure_detect_secrets/plugins/KeyFileDetector.py"
-    },
-    {
-      "name": "KeywordDetector",
-      "keyword_exclude": ""
-    },
-    {
-      "name": "MailchimpDetector"
-    },
-    {
-      "name": "NpmDetector"
-    },
-    {
-      "name": "PrivateKeyDetector"
-    },
-    {
-      "name": "SendGridDetector"
-    },
-    {
-      "name": "SlackDetector"
-    },
-    {
-      "name": "SoftlayerDetector"
-    },
-    {
-      "name": "SquareOAuthDetector"
-    },
-    {
-      "name": "StripeDetector"
-    },
-    {
-      "name": "TwilioKeyDetector"
-    }
-  ],
-  "filters_used": [
-    {
-      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
-    },
-    {
-      "path": "detect_secrets.filters.common.is_baseline_file",
-      "filename": ".secrets.baseline"
-    },
-    {
-      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
-      "min_level": 2
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_lock_file"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_sequential_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_swagger_file"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_templated_secret"
-    },
-    {
-      "path": "detect_secrets.filters.wordlist.should_exclude_secret",
-      "min_length": 3,
-      "file_name": "fake-secrets.txt",
-      "file_hash": "34ddac9f4256e5233e14adc00b7793a4e59e7e4d"
-    },
-    {
-      "path": "file://./icure-pre-commit/icure_detect_secrets/filters/is_icure_safe_data.py::is_icure_safe_data"
-    },
-    {
-      "path": "file://./icure-pre-commit/icure_detect_secrets/filters/is_key_format.py::is_key_format"
-    }
-  ],
-  "results": {
-    "test/icc-x-api/crypto/shamir.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "test/icc-x-api/crypto/shamir.ts",
-        "hashed_secret": "cc48012444588fd02bfaef62e35d869cdffef04f",
-        "is_verified": false,
-        "line_number": 29
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "test/icc-x-api/crypto/shamir.ts",
-        "hashed_secret": "d2db26df62a65e68d0199ab47799638d71e03667",
-        "is_verified": false,
-        "line_number": 31
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "test/icc-x-api/crypto/shamir.ts",
-        "hashed_secret": "27bbc8963103629d307036d2f52e5d0fb3dd54f2",
-        "is_verified": false,
-        "line_number": 32
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "test/icc-x-api/crypto/shamir.ts",
-        "hashed_secret": "54c1677ac787041ddadafa3bb038e18064c880e0",
-        "is_verified": false,
-        "line_number": 33
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "test/icc-x-api/crypto/shamir.ts",
-        "hashed_secret": "4cebcee238dcc431d82d6a5cc0507696c81b8dee",
-        "is_verified": false,
-        "line_number": 34
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "test/icc-x-api/crypto/shamir.ts",
-        "hashed_secret": "38c3d2c84f839dd8a10c3f7888e2622a64594cf9",
-        "is_verified": false,
-        "line_number": 35
-      }
-    ]
-  },
-  "generated_at": "2023-01-11T16:03:46Z"
-}

package/CHANGELOG.md

@@ -1,112 +0,0 @@
-# icc-api CHANGELOG
-
-## 4.2.29
-
-- [BREAKING] - Make Api() async so that we can call authAPi.login and clear session cookie
-
-## 4.2.20
-
-- [FEATURE] - Add a tag to groups to differentiate root, apps and databases
-
-### Breaking changes for 4.2.20
-
-The createGroup signature has been slightly altered with an extra argument before the databaseSynchronisations argument
-
-## 4.2.19
-
-- Internal release
-
-## 4.2.18
-
-- [FIX] - Do not send BASIC auth if cookies are available
-
-## 4.2.17
-
-- Internal release
-
-## 4.2.16
-
-- [FIX] - Do not send BASIC auth while logging out in order to prevent creation of a new session
-
-## 4.2.15
-
-- [FIX] - Add missing X-Requested-With: XMLHttpRequest header in XHR.ts
-
-## 4.2.13
-
-- [FIX] - Invalidate caches when hcparty keys cannot be found
-
-## 4.2.12
-
-- [FIX] - Fix path in AMP by ATC
-
-## 4.2.11
-
-- [FEATURE] - Added delete group endpoint
-
-## 4.2.10
-
-- [FEATURE] [#90](https://github.com/taktik/icc-api/pull/90) - Adding ServiceByHcPartyAndHealthElementIdsFilter
-
-## 4.2.9
-
-- [FEATURE] [487e0abae86e0d2d978774c8bcc2d108a322bf49](https://github.com/taktik/icc-api/commit/487e0abae86e0d2d978774c8bcc2d108a322bf49) - Add support for devices per group endpoints
-
-## 4.2.8
-
-- [FEATURE] [1309bd53ae06a0c8d2e8ebaa9986669d0e37bb2a](https://github.com/taktik/icc-api/commit/1309bd53ae06a0c8d2e8ebaa9986669d0e37bb2a) - Switched doImport from GET to POST
-
-## 4.2.7
-
-- [FEATURE] [b1de8da2ba3c08e49bf311a9c565aa29061859cb](https://github.com/taktik/icc-api/commit/b1de8da2ba3c08e49bf311a9c565aa29061859cb) - Upgrade UserGroup
-
-## 4.2.6
-
-- [FEATURE] [deb9ea154fbcbeb2f2ba386a13379cced8b88fe3](https://github.com/taktik/icc-api/commit/deb9ea154fbcbeb2f2ba386a13379cced8b88fe3) - Add incapacity api
-
-## 4.2.5
-
-- [FEATURE] [874e1f83e0b2f67e2541653fa086ae4286564a48](https://github.com/taktik/icc-api/commit/874e1f83e0b2f67e2541653fa086ae4286564a48) - Add icapacity dtos + extra token request api
-
-## 4.2.4
-
-- [FEATURE] [b2dfb46089bb95029b32fcef1c7c49029408b1b2](https://github.com/taktik/icc-api/commit/b2dfb46089bb95029b32fcef1c7c49029408b1b2) - Add api to search users in groups
-
-## 4.2.3
-
-- [FEATURE] [6a658d4fddf99b61ee74a892eec8d15701b62daf](https://github.com/taktik/icc-api/commit/6a658d4fddf99b61ee74a892eec8d15701b62daf) - Add PermissionApi in API services
-
-## 4.2.2
-
-- [FIX] [#88](https://github.com/taktik/icc-api/pull/88) - UserByNameEmailPhoneFilter Typo
-
-## 4.2.1
-
-- [FIX] [#87](https://github.com/taktik/icc-api/pull/87) - Add descr property on hcp
-
-## 4.2.0
-
-- [FEATURE] [#86](https://github.com/taktik/icc-api/pull/86) - BREAK Add icc-helement-x-api services managing encryption/decryption
-- [FEATURE] [#86](https://github.com/taktik/icc-api/pull/86) - Every dataOwner is now supported for encryption/decryption services (not only HCP anymore)
-- [FEATURE] [a3318e7477b929a00bc8227080fa424cd2896d6b](https://github.com/taktik/icc-api/commit/a3318e7477b929a00bc8227080fa424cd2896d6b) - Add getGroupsStorageInfos API in IccGroupApi
-- [FEATURE] [a3318e7477b929a00bc8227080fa424cd2896d6b](https://github.com/taktik/icc-api/commit/a3318e7477b929a00bc8227080fa424cd2896d6b) - Add getUserSyncInfo API in IccIcureApi
-- [FEATURE] [531eaf99c2d1a91cb3e228bda2cfc71c5a99b8f4](https://github.com/taktik/icc-api/commit/531eaf99c2d1a91cb3e228bda2cfc71c5a99b8f4) - Add findGroupsWithContent API in IccGroupApi
-- [FEATURE] [f53614ef84b8cb525820d1e1a3fbed1b98e62c2e](https://github.com/taktik/icc-api/commit/f53614ef84b8cb525820d1e1a3fbed1b98e62c2e) - Add UserByNameEmailPhoneFilter
-
-### Breaking changes for [#86](https://github.com/taktik/icc-api/pull/86)
-
-icc-helement-x-api now includes API services managing encryption/decryption. Just like other APIs, icc-helement-api services not managing encryption
-throw an Error in order to force the usage of the corresponding new APIs.
-
-In the next table, you will find all deleted services and their corresponding substitute
-
-| Previous service                                                                        | New service                                                                                                        |
-| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| `createHealthElement(body?: HealthElement)`                                             | `createHealthElementWithUser(user: User, body?: HealthElement)`                                                    |
-| `createHealthElements(body?: Array<HealthElement>)`                                     | `createHealthElementsWithUser(user: models.User, bodies?: models.HealthElement[])`                                 |
-| `getHealthElement(healthElementId: string)`                                             | `getHealthElementWithUser(user: models.User, healthElementId: string)`                                             |
-| `getHealthElements(body?: models.ListOfIds)`                                            | `getHealthElementsWithUser(user: models.User, body?: models.ListOfIds)`                                            |
-| `newHealthElementDelegations(healthElementId: string, body?: Array<models.Delegation>)` | `newHealthElementDelegationsWithUser(user: models.User, healthElementId: string, body?: Array<models.Delegation>)` |
-| `findHealthElementsByHCPartyPatientForeignKeys(hcPartyId: string, secretFKeys: string)` | `findHealthElementsByHCPartyPatientForeignKeysWithUser(user: models.User, hcPartyId: string, secretFKeys: string)` |
-| `modifyHealthElement(body?: HealthElement)`                                             | `modifyHealthElementWithUser(user: models.User, body?: HealthElement)`                                             |
-| `modifyHealthElements(body?: Array<HealthElement>)`                                     | `modifyHealthElementsWithUser(user: models.User, bodies?: HealthElement[])`                                        |

package/Dockerfile

@@ -1,25 +0,0 @@
-# build environment
-FROM node:10.16-alpine as build
-RUN apk add --update \
-    git \
-    python \
-    python-dev \
-    py-pip \
-    build-base \
-  && pip install virtualenv \
-  && rm -rf /var/cache/apk/*
-WORKDIR /app
-ENV PATH /app/node_modules/.bin:$PATH
-COPY package.json /app/package.json
-RUN npm install
-RUN npm install react-scripts@3.0.1 -g --silent
-COPY . /app
-RUN NODE_OPTIONS="--max_old_space_size=4096" npm run build
-
-# production environment
-FROM nginx:1.16.0-alpine
-COPY --from=build /app/build /usr/share/nginx/html
-RUN rm /etc/nginx/conf.d/default.conf
-COPY nginx/nginx.conf /etc/nginx/conf.d
-EXPOSE 80
-CMD ["nginx", "-g", "daemon off;"]

package/InstantiateIccXApiWithAuthProvider.md

@@ -1,72 +0,0 @@
-# Authentication Providers and Authentication Service
-
-## Instantiate an api using an AuthenticationProvider
-
-When you want to instantiate an icc-x-api or an icc-api, you can provide an additional parameter, the `AuthenticationProvider`, to define the authentication method
-to use in the calls.<br>
-The AuthenticationProviders defined in `icc-x-api/auth/AuthenticationProvider` are:
-
-- **NoAuthenticationProvider**: it will pass no authentication headers to the requests. It can be used when passing the SESSION-ID from the Cookies.
-- **BasicAuthenticationProvider**: it will pass to the requests a Basic Authentication header.
-- **JwtAuthenticationProvider**: it will pass to the requests the Bearer Token header. If the user does not have a token, it will automatically fetch one from the Back-end. If the token is expired, it will automatically refresh it.
-- **EnsembleAuthenticationProvider**: it will try to use several authentication methods until it finds one that works. First, it will try with the Jwt Authentication, then with the SESSION-ID (no authentication header), then with the Basic authentication. _Note_: if the JWT Authentication fails, it will not try it again for a period of time which duration can be configured in the parameters (default: 1 hour).
-
-**Note**: to instantiate a `JwtAuthenticationProvider` or a `EnsembleAuthenticationProvider` you need to pass as parameter an instance of `IccAuthApi`.<br>
-**Note**: If not authentication provider is specified, the `NoAuthenticationProvider` is used by default.<br>
-
-### Example
-
-```typescript
-import { IccAuthApi, NoAuthenticationProvider, JwtAuthenticationProvider } from '@icure/api'
-
-const xUserApi = new IccUserXApi(ICURE_URL, HEADERS, new NoAuthenticationProvider()) // Equivalent to const xUserApi = new IccUserXApi(env.iCureUrl, {})
-
-const authApi = new IccAuthApi(ICURE_URL, HEADERS)
-const xHcpApi = new IccHcpartyXApi(ICURE_URL, HEADERS, new JwtAuthenticationProvider(authApi, username, password))
-```
-
-## Send a request using XHR
-
-To specify the authentication method when using the `sendCommand` method, you can specify the authentication method by passing a AuthenticationService.
-There are four implementation of `AuthenticationService` and their working is analogous to their corresponding provider:
-
-- **NoAuthService**
-- **BasicAuthService**
-- **JwtAuthService**
-- **EnsembleAuthService**
-
-**Note**: if no `AuthenticationService` is specified, the `NoAuthService` is used by default.
-
-## How does the JWT authentication works?
-
-The JWT (JSON Web Token) is an authentication method that involves storing the session data on the client side instead of the server side.
-All the session data are stored in the JWT and signed with a secret key when the token is issued, to prevent modifications and malicious accesses.
-Two types of token are issued:
-
-- **Authentication Token**: a short-lived token that is attached to all the requests that require authentication. It lasts 1 hour.
-- **Refresh Token** a long-lived token used to request a new authentication token on its expiration. It lasts 1 day.
-
-One of the biggest disadvantages of the JWT is that, once issued, it is not possible to invalidate a token. This means that if the user's privileges gets updated (e.g. the user loses the admin privileges or gets banned) he can still access the API with the old privileges until the token expires. This is not a big problem for the authentication token, as it is short-lived, but it can be for the long-lived refresh token.
-To avoid malicious accesses to the API with non-updated tokens, each refresh token has a unique ID that is stored in hazelcast inside the application server. Before issuing a new authentication token using the refresh token, the ID of the latter is compared with the one stored in the database and, if they do not match, the operation fails. In this way, it is possible to invalidate old refresh tokens.
-
-Currently, the JWT authentication has been enabled but is it still possible to receive and use the SESSION Cookie.
-If both the authentication JWT and the SESSION Cookie are provided, the JWT has always the priority:
-
-- Trying to access an endpoint with a valid JWT and a non-valid SESSION Cookie will result in a success.
-- Trying to access an endpoint with a non-valid JWT and a valid SESSION Cookie will result in a failure
-
-### Authentication Details
-
-- When the user logs in, in the response payload he will receive an authentication token and a refresh token.
-- To access a protected endpoint, the user should add the `Authorization: Bearer <AUTHENTICATION_TOKEN>` where `<AUTHENTICATION_TOKEN>` is the authentication JWT provided after login.
-- If the token is not valid, missing, or expired, the user will receive a `401_UNAUTHORIZED` response with a clarifying message in the payload.
-- To obtain a new authentication JWT, is it possible to send a POST request to the `/auth/refresh` endpoint, setting the `Refresh-Token` header to the refresh JWT provided after login.
-- If also the refresh JWT expires, the user must perform the login again.
-- When the user asks for a new authentication JWT, the validity of the refresh JWT is checked.
-- A user can invalidate one of his own refresh JWTs by sending a POST request to the `/auth/invalidate` endpoint, setting the `Refresh-Token` header to the refresh JWT provided after login.
-- When the user logs in and receives a new refresh JWT, the previous one stays valid unless explicitly invalidated.
-- The `/auth/logout` endpoint is still available, but will not invalidate the authentication JWT nor the refresh JWT
-- The `/auth/login` method still sets the SESSION Cookie, and it is still possible to use that to access the API.
-- It is still possible to use the Basic authentication method.
-- The `DatabaseUserDetails` class has been removed, as it contained useless data.
-- As for now, the user will receive both the JWT and the SESSIONID Cookie. You can avoid receiving the SESSIONID Cookie by setting the `X-Bypass-Session` header.

package/LICENSE

@@ -1,7 +0,0 @@
-Copyright 2018 Taktik sa
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,75 +0,0 @@
-# Crypto model in iCure
-
-## Lexic
-
-- `"ABCD"` is a **non** encrypted key (uuid, ...)
-- `{AB}` is the encryption key of the pair `AB`, where hcParty `A` gives delegation to hcParty `B`.
-  The encryption key is stored encrypted in the hcPartyKeys of hcParty `A` document (see below)
-- `<ABCD>_{AB}` is the key `ABCD` encrypted with encryption key `{AB}`
-- `<{AB}>_{A}` is the encryption key `{AB}` encrypted with the public key of hcParty `A`
-
-The encryption keys are stored in the hcParty document that gives delegation to other user, since only the user can modify his hcParty document in CouchDB.
-The hcParty `B` needs to access the hcParty `A` document to decrypt (with his private key) the encryption key `{AB}` stored in the field hcPartyKeys.
-
-```
-## HCP A ##
-hcPartyKeys: {
-   A: [ <{AA}>_{A}, <{AA}>_{A} ]
-   B: [ <{AB}>_{A}, <{AB}>_{B} ]
-}
-```
-
-## Document type relations
-
-```
-## Patient 1234 ##
-ID: "1234"
-Delegations: { A->A: <ABCD>_{AA}, A->B: <ABCD>_{AB} }
-EncryptionKeys: { A->A: <DCBA>_{AA}, A->B: <DCBA>_{AB} }
-```
-
-```
-## Contact 4567 ##
-ID: "4567"
-SecretForeignKeys: [ "ABCD" ]
-CryptedForeignKeys: { A->A: <1234>_{AA}, A->B: <1234>_{AB} }
-EncryptionKeys: { A->A: <EFGH>_{AA}, A->B: <EFGH>_{AB} }
-```
-
-The **delegations** of the **patient** document store the encrypted secretForeignKeys that you find in clear in the **contact** document. And allows, once decrypted, to find the contacts of a patient.
-
-On the other side, the **cryptedForeignKeys** of the **contact** document allows, once decrypted, to find the corresponding **patient** document.
-
-The **encryptionKeys** of a document are used to encrypt the content of the corresponding document. As for the delegations, the document encryption keys are stored encrypted with the encryption keys `{AA}`, `{AB}`, ...
-
-The **healthElement** documents are linked to patient documents in the same way as the contact. This means that the healthElement documents have also **SecretForeignKeys** and **CryptedForeignKeys**, beside the **encryptionKeys**.
-
-## Delegations
-
-- Delegations === encrypted foreign key of all patient icureStoredDocument => it makes the link from a patient to a storedDocument
-- CryptedForeignKeys === encrypted patient.ID => it makes the link from a storedDocument to a patient
-- EncryptionKeys === encrypted encryptionKey (probably symmetric)
-
-## Multi profession
-
-Contacts and delegations need to be segmented.
-=> need to have segmented auto-delegations
-
-# Usage
-
-## Instalation
-
-Install from npm
-
-```
-npm install --save icc-api
-```
-
-## ES6 import
-
-Example
-ES6 include
-
-```javaScript
-import * as IccApi from 'icc-api'
-```

package/apidocs/.swagger-codegen-ignore

@@ -1,23 +0,0 @@
-# Swagger Codegen Ignore
-# Generated by swagger-codegen https://github.com/swagger-api/swagger-codegen
-
-# Use this file to prevent files from being overwritten by the generator.
-# The patterns follow closely to .gitignore or .dockerignore.
-
-# As an example, the C# client generator defines ApiClient.cs.
-# You can make changes and tell Swagger Codgen to ignore just this file by uncommenting the following line:
-#ApiClient.cs
-
-# You can match any string of characters against a directory, file or extension with a single asterisk (*):
-#foo/*/qux
-# The above matches foo/bar/qux and foo/baz/qux, but not foo/bar/baz/qux
-
-# You can recursively match patterns against a directory, file or extension with a double asterisk (**):
-#foo/**/qux
-# This matches foo/bar/qux, foo/baz/qux, and foo/bar/baz/qux
-
-# You can also negate patterns with an exclamation (!).
-# For example, you can ignore all files in a docs folder with the file extension .md:
-#docs/*.md
-# Then explicitly reverse the ignore rule for a single file:
-#!docs/README.md

package/ci/cloudbuild.yaml

@@ -1,16 +0,0 @@
-steps:
-  - name: 'gcr.io/cloud-builders/git'
-    entrypoint: 'bash'
-    args:
-      ['-c', 'git fetch --unshallow --tags && git checkout ${BRANCH_NAME} && git describe --tags --abbrev=10 --dirty --always --long > .gitversion']
-
-  - name: 'gcr.io/cloud-builders/docker'
-    args: ['login', 'docker.taktik.be', '--username', '${_REPO_USERNAME}', '--password', '${_REPO_PASSWORD}']
-
-  - name: 'docker'
-    entrypoint: 'sh'
-    args: ['-c', 'v=$(cat .gitversion) && tag="docker.taktik.be/lutaplanning:$v" && docker build . -t $tag && docker push $tag']
-
-options:
-  machineType: 'N1_HIGHCPU_8'
-timeout: 1800s