@icure/api 7.0.0-beta.3 → 7.0.0

package/icc-x-api/auth/EnsembleAuthService.d.ts

@@ -1,9 +1,10 @@
 import { AuthService } from './AuthService';
 import { XHR } from '../../icc-api/api/XHR';
-import { JwtAuthService } from './JwtAuthService';
+import { JwtBridgedAuthService } from './JwtBridgedAuthService';
 import { NoAuthService } from './NoAuthService';
 import { BasicAuthService } from './BasicAuthService';
 import Header = XHR.Header;
+import { JwtAuthService } from './JwtAuthService';
 export declare class EnsembleAuthService implements AuthService {
     private readonly jwtAuth;
     private readonly sessionAuth;
@@ -11,7 +12,11 @@ export declare class EnsembleAuthService implements AuthService {
     private currentState;
     private error;
     private stateMap;
-    constructor(jwtAuth: JwtAuthService | null, sessionAuth: NoAuthService, basicAuth: BasicAuthService);
+    constructor(jwtAuth: JwtBridgedAuthService | JwtAuthService | null, sessionAuth: NoAuthService, basicAuth: BasicAuthService);
+    getIcureTokens(): Promise<{
+        token: string;
+        refreshToken: string;
+    } | undefined>;
     getAuthHeaders(): Promise<Array<Header>>;
     invalidateHeader(error: Error): void;
 }

package/icc-x-api/auth/EnsembleAuthService.js

@@ -10,6 +10,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EnsembleAuthService = void 0;
+const XHR_1 = require("../../icc-api/api/XHR");
+var XHRError = XHR_1.XHR.XHRError;
 class EnsembleAuthService {
     constructor(jwtAuth, sessionAuth, basicAuth) {
         this.jwtAuth = jwtAuth;
@@ -24,6 +26,10 @@ class EnsembleAuthService {
         };
         this.currentState = 'start';
     }
+    getIcureTokens() {
+        var _a, _b;
+        return (_b = (_a = this.jwtAuth) === null || _a === void 0 ? void 0 : _a.getIcureTokens()) !== null && _b !== void 0 ? _b : Promise.resolve();
+    }
     getAuthHeaders() {
         return __awaiter(this, void 0, void 0, function* () {
             this.currentState = !!this.currentState ? this.stateMap[this.currentState].next : this.currentState;
@@ -32,6 +38,9 @@ class EnsembleAuthService {
                 // And delegate the responsibility of handling the error to the next call
                 return !!this.stateMap[this.currentState].state
                     ? this.stateMap[this.currentState].state.getAuthHeaders().catch((e) => {
+                        if (e instanceof XHRError && e.statusCode === 417) {
+                            throw e;
+                        }
                         // If I get an error, it is also responsibility of the next call, but I give a warning
                         console.warn(e.message);
                         this.error = e;

package/icc-x-api/auth/EnsembleAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"EnsembleAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/EnsembleAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AAOA,MAAa,mBAAmB;IAK9B,YACmB,OAA8B,EAC9B,WAA0B,EAC1B,SAA2B;QAF3B,YAAO,GAAP,OAAO,CAAuB;QAC9B,gBAAW,GAAX,WAAW,CAAe;QAC1B,cAAS,GAAT,SAAS,CAAkB;QANtC,UAAK,GAAiB,IAAI,CAAA;QAQhC,IAAI,CAAC,QAAQ,GAAG;YACd,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YACnC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;SAC7C,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;IAC7B,CAAC;IAEK,cAAc;;YAClB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAA;YAEnG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;gBACvB,2EAA2E;gBAC3E,yEAAyE;gBACzE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK;oBAC7C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAM,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;wBACnE,sFAAsF;wBACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;wBACvB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;wBACd,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC;oBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;aACxB;iBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;gBACvB,oEAAoE;gBACpE,MAAM,IAAI,CAAC,KAAK,CAAA;aACjB;iBAAM;gBACL,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;aACvC;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;YACvB,MAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,0CAAE,gBAAgB,CAAC,KAAK,CAAC,CAAA;SAChE;IACH,CAAC;CACF;AA/CD,kDA+CC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { JwtAuthService } from './JwtAuthService'\nimport { NoAuthService } from './NoAuthService'\nimport { BasicAuthService } from './BasicAuthService'\nimport Header = XHR.Header\n\nexport class EnsembleAuthService implements AuthService {\n  private currentState: string | null\n  private error: Error | null = null\n  private stateMap: { [key: string]: { state: AuthService | null; next: string | null } }\n\n  constructor(\n    private readonly jwtAuth: JwtAuthService | null,\n    private readonly sessionAuth: NoAuthService,\n    private readonly basicAuth: BasicAuthService\n  ) {\n    this.stateMap = {\n      start: { state: null, next: 'jwt' },\n      jwt: { state: this.jwtAuth, next: 'session' },\n      session: { state: this.sessionAuth, next: 'basic' },\n      basic: { state: this.basicAuth, next: null },\n    }\n    this.currentState = 'start'\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    this.currentState = !!this.currentState ? this.stateMap[this.currentState].next : this.currentState\n\n    if (!!this.currentState) {\n      // If I have a state I return the headers, otherwise I return empty headers\n      // And delegate the responsibility of handling the error to the next call\n      return !!this.stateMap[this.currentState].state\n        ? this.stateMap[this.currentState].state!.getAuthHeaders().catch((e) => {\n            // If I get an error, it is also responsibility of the next call, but I give a warning\n            console.warn(e.message)\n            this.error = e\n            return []\n          })\n        : Promise.resolve([])\n    } else if (!!this.error) {\n      // If I have no more states, I throw the last error or a default one\n      throw this.error\n    } else {\n      throw new Error('Cannot authenticate')\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this.error = error\n    if (!!this.currentState) {\n      this.stateMap[this.currentState].state?.invalidateHeader(error)\n    }\n  }\n}\n"]}
+{"version":3,"file":"EnsembleAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/EnsembleAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAK3C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAG9B,MAAa,mBAAmB;IAK9B,YACmB,OAAsD,EACtD,WAA0B,EAC1B,SAA2B;QAF3B,YAAO,GAAP,OAAO,CAA+C;QACtD,gBAAW,GAAX,WAAW,CAAe;QAC1B,cAAS,GAAT,SAAS,CAAkB;QANtC,UAAK,GAAiB,IAAI,CAAA;QAQhC,IAAI,CAAC,QAAQ,GAAG;YACd,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YACnC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;SAC7C,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;IAC7B,CAAC;IAED,cAAc;;QACZ,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,cAAc,EAAE,mCAAK,OAAO,CAAC,OAAO,EAAyB,CAAA;IACpF,CAAC;IAEK,cAAc;;YAClB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAA;YAEnG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;gBACvB,2EAA2E;gBAC3E,yEAAyE;gBACzE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK;oBAC7C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAM,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;wBACnE,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;4BACjD,MAAM,CAAC,CAAA;yBACR;wBACD,sFAAsF;wBACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;wBACvB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;wBAEd,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC;oBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;aACxB;iBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;gBACvB,oEAAoE;gBACpE,MAAM,IAAI,CAAC,KAAK,CAAA;aACjB;iBAAM;gBACL,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;aACvC;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;YACvB,MAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,0CAAE,gBAAgB,CAAC,KAAK,CAAC,CAAA;SAChE;IACH,CAAC;CACF;AAvDD,kDAuDC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { JwtBridgedAuthService } from './JwtBridgedAuthService'\nimport { NoAuthService } from './NoAuthService'\nimport { BasicAuthService } from './BasicAuthService'\nimport Header = XHR.Header\nimport XHRError = XHR.XHRError\nimport { JwtAuthService } from './JwtAuthService'\n\nexport class EnsembleAuthService implements AuthService {\n  private currentState: string | null\n  private error: Error | null = null\n  private stateMap: { [key: string]: { state: AuthService | null; next: string | null } }\n\n  constructor(\n    private readonly jwtAuth: JwtBridgedAuthService | JwtAuthService | null,\n    private readonly sessionAuth: NoAuthService,\n    private readonly basicAuth: BasicAuthService\n  ) {\n    this.stateMap = {\n      start: { state: null, next: 'jwt' },\n      jwt: { state: this.jwtAuth, next: 'session' },\n      session: { state: this.sessionAuth, next: 'basic' },\n      basic: { state: this.basicAuth, next: null },\n    }\n    this.currentState = 'start'\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.jwtAuth?.getIcureTokens() ?? (Promise.resolve() as Promise<undefined>)\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    this.currentState = !!this.currentState ? this.stateMap[this.currentState].next : this.currentState\n\n    if (!!this.currentState) {\n      // If I have a state I return the headers, otherwise I return empty headers\n      // And delegate the responsibility of handling the error to the next call\n      return !!this.stateMap[this.currentState].state\n        ? this.stateMap[this.currentState].state!.getAuthHeaders().catch((e) => {\n            if (e instanceof XHRError && e.statusCode === 417) {\n              throw e\n            }\n            // If I get an error, it is also responsibility of the next call, but I give a warning\n            console.warn(e.message)\n            this.error = e\n\n            return []\n          })\n        : Promise.resolve([])\n    } else if (!!this.error) {\n      // If I have no more states, I throw the last error or a default one\n      throw this.error\n    } else {\n      throw new Error('Cannot authenticate')\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this.error = error\n    if (!!this.currentState) {\n      this.stateMap[this.currentState].state?.invalidateHeader(error)\n    }\n  }\n}\n"]}

package/icc-x-api/auth/JwtAuthService.d.ts

@@ -3,15 +3,20 @@ import { XHR } from '../../icc-api/api/XHR';
 import { IccAuthApi } from '../../icc-api';
 import Header = XHR.Header;
 export declare class JwtAuthService implements AuthService {
-    private authApi;
-    private username;
-    private password;
+    private readonly authApi;
     private _error;
     private _currentPromise;
-    constructor(authApi: IccAuthApi, username: string, password: string);
+    constructor(authApi: IccAuthApi, initialJwt?: {
+        authJwt: string;
+        refreshJwt: string;
+    });
+    getIcureTokens(): Promise<{
+        token: string;
+        refreshToken: string;
+    } | undefined>;
+    get refreshToken(): Promise<string | undefined>;
     getAuthHeaders(): Promise<Array<Header>>;
     private _refreshAuthJwt;
-    private _loginAndGetTokens;
     private _isJwtExpired;
     private _base64Decode;
     invalidateHeader(error: Error): void;

package/icc-x-api/auth/JwtAuthService.js

@@ -11,21 +11,30 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtAuthService = void 0;
 const XHR_1 = require("../../icc-api/api/XHR");
-const LoginCredentials_1 = require("../../icc-api/model/LoginCredentials");
 const utils_1 = require("../utils");
 class JwtAuthService {
-    constructor(authApi, username, password) {
+    constructor(authApi, initialJwt) {
         this.authApi = authApi;
-        this.username = username;
-        this.password = password;
         this._error = null;
-        this._currentPromise = Promise.resolve({});
+        this._currentPromise = Promise.resolve(undefined);
+        if (!!initialJwt) {
+            this._currentPromise = Promise.resolve(initialJwt);
+        }
+    }
+    getIcureTokens() {
+        return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined));
+    }
+    get refreshToken() {
+        return this._currentPromise.then((x) => x === null || x === void 0 ? void 0 : x.refreshJwt);
     }
     getAuthHeaders() {
         return __awaiter(this, void 0, void 0, function* () {
             return this._currentPromise
-                .then(({ authJwt, refreshJwt }) => {
-                if (!authJwt || this._isJwtExpired(authJwt)) {
+                .then((x) => {
+                var _a;
+                const authJwt = x === null || x === void 0 ? void 0 : x.authJwt;
+                const refreshJwt = x === null || x === void 0 ? void 0 : x.refreshJwt;
+                if ((!authJwt || this._isJwtExpired(authJwt)) && refreshJwt) {
                     // If it does not have the JWT, tries to get it
                     // If the JWT is expired, tries to refresh it
                     this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {
@@ -37,13 +46,13 @@ class JwtAuthService {
                         return updatedTokens;
                     });
                 }
-                else if (!!this._error) {
-                    throw this._error;
+                else {
+                    throw (_a = this._error) !== null && _a !== void 0 ? _a : 'Expired JWT refresh token in pure JwtAuthService incapable of relogging';
                 }
                 return this._currentPromise;
             })
-                .then(({ authJwt }) => {
-                return [new XHR_1.XHR.Header('Authorization', `Bearer ${authJwt}`)];
+                .then((x) => {
+                return (x === null || x === void 0 ? void 0 : x.authJwt) ? [new XHR_1.XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT');
             });
         });
     }
@@ -51,8 +60,8 @@ class JwtAuthService {
         return __awaiter(this, void 0, void 0, function* () {
             // If I do not have a refresh JWT or the refresh JWT is expired,
             // I have to log in again
-            if (!refreshJwt || this._isJwtExpired(refreshJwt)) {
-                return this._loginAndGetTokens();
+            if (this._isJwtExpired(refreshJwt)) {
+                throw Error('Missing or expired refresh token: please log in again');
             }
             else {
                 return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({
@@ -62,19 +71,6 @@ class JwtAuthService {
             }
         });
     }
-    _loginAndGetTokens() {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.authApi
-                .login(new LoginCredentials_1.LoginCredentials({
-                username: this.username,
-                password: this.password,
-            }))
-                .then((authResponse) => ({
-                authJwt: authResponse.token,
-                refreshJwt: authResponse.refreshToken,
-            }));
-        });
-    }
     _isJwtExpired(jwt) {
         const parts = jwt.split('.');
         if (parts.length !== 3) {

package/icc-x-api/auth/JwtAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,MAAa,cAAc;IAIzB,YAAoB,OAAmB,EAAU,QAAgB,EAAU,QAAgB;QAAvE,YAAO,GAAP,OAAO,CAAY;QAAU,aAAQ,GAAR,QAAQ,CAAQ;QAAU,aAAQ,GAAR,QAAQ,CAAQ;QAHnF,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAEH,CAAC;IAEzF,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE;oBAC3C,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;gBACjD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,OAAO,IAAI,CAAC,OAAO;iBAChB,KAAK,CACJ,IAAI,mCAAgB,CAAC;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CACH;iBACA,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;gBACvB,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAC,CAAC,CAAA;QACP,CAAC;KAAA;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,KAAK,CAAA;SACb;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AA/ED,wCA+EC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\n\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(private authApi: IccAuthApi, private username: string, private password: string) {}\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then(({ authJwt }) => {\n        return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    return this.authApi\n      .login(\n        new LoginCredentials({\n          username: this.username,\n          password: this.password,\n        })\n      )\n      .then((authResponse) => ({\n        authJwt: authResponse.token,\n        refreshJwt: authResponse.refreshToken,\n      }))\n  }\n\n  private _isJwtExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return false\n    }\n    const payload = this._base64Decode(parts[1])\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}
+{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAI3C,oCAA8B;AAI9B,MAAa,cAAc;IAIzB,YAA6B,OAAmB,EAAE,UAAoD;QAAzE,YAAO,GAAP,OAAO,CAAY;QAHxC,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAiE,OAAO,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAA;QAGvH,IAAI,CAAC,CAAC,UAAU,EAAE;YAChB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;SACnD;IACH,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAQ,CAAC,CAAA;IACpH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAiB,CAAC,CAAA;IAC/D,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;;gBACV,MAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gBAC1B,MAAM,UAAU,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA;gBAEhC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,EAAE;oBAC3D,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM;oBACL,MAAM,MAAA,IAAI,CAAC,MAAM,mCAAI,yEAAyE,CAAA;iBAC/F;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAC,CAAC,CAAC,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAC9H,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAAkB;;YAC9C,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;gBAClC,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;aACrE;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAM;oBAC/B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,KAAK,CAAA;SACb;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAhFD,wCAgFC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)\n\n  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {\n    if (!!initialJwt) {\n      this._currentPromise = Promise.resolve(initialJwt)\n    }\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined) as any)\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x?.refreshJwt as any)\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then((x) => {\n        const authJwt = x?.authJwt\n        const refreshJwt = x?.refreshJwt\n\n        if ((!authJwt || this._isJwtExpired(authJwt)) && refreshJwt) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else {\n          throw this._error ?? 'Expired JWT refresh token in pure JwtAuthService incapable of relogging'\n        }\n        return this._currentPromise\n      })\n      .then((x) => {\n        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (this._isJwtExpired(refreshJwt)) {\n      throw Error('Missing or expired refresh token: please log in again')\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token!,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private _isJwtExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return false\n    }\n    const payload = this._base64Decode(parts[1])\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/icc-x-api/auth/JwtBridgedAuthService.d.ts

@@ -0,0 +1,27 @@
+import { AuthService } from './AuthService';
+import { XHR } from '../../icc-api/api/XHR';
+import { IccAuthApi } from '../../icc-api';
+import Header = XHR.Header;
+export declare class JwtBridgedAuthService implements AuthService {
+    private authApi;
+    private username;
+    private password;
+    private thirdPartyTokens;
+    private _error;
+    private _currentPromise;
+    constructor(authApi: IccAuthApi, username: string, password: string, thirdPartyTokens?: {
+        [thirdParty: string]: string;
+    });
+    get refreshToken(): Promise<string | undefined>;
+    getIcureTokens(): Promise<{
+        token: string;
+        refreshToken: string;
+    } | undefined>;
+    getAuthHeaders(): Promise<Array<Header>>;
+    private _refreshAuthJwt;
+    private _loginAndGetTokens;
+    private _isJwtExpired;
+    private _base64Decode;
+    invalidateHeader(error: Error): void;
+    isInErrorState(): boolean;
+}

package/icc-x-api/auth/JwtBridgedAuthService.js

@@ -0,0 +1,131 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtBridgedAuthService = void 0;
+const XHR_1 = require("../../icc-api/api/XHR");
+const LoginCredentials_1 = require("../../icc-api/model/LoginCredentials");
+const utils_1 = require("../utils");
+var XHRError = XHR_1.XHR.XHRError;
+class JwtBridgedAuthService {
+    constructor(authApi, username, password, thirdPartyTokens = {}) {
+        this.authApi = authApi;
+        this.username = username;
+        this.password = password;
+        this.thirdPartyTokens = thirdPartyTokens;
+        this._error = null;
+        this._currentPromise = Promise.resolve({});
+    }
+    get refreshToken() {
+        return this._currentPromise.then((x) => x.refreshJwt);
+    }
+    getIcureTokens() {
+        return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt, refreshToken: refreshJwt })));
+    }
+    getAuthHeaders() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this._currentPromise
+                .then(({ authJwt, refreshJwt }) => {
+                if (!authJwt || this._isJwtExpired(authJwt)) {
+                    // If it does not have the JWT, tries to get it
+                    // If the JWT is expired, tries to refresh it
+                    this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {
+                        // If here the token is null,
+                        // it goes in a suspension status
+                        if (!updatedTokens.authJwt) {
+                            throw new Error('Your iCure back-end version does not support JWT authentication');
+                        }
+                        return updatedTokens;
+                    });
+                }
+                else if (!!this._error) {
+                    throw this._error;
+                }
+                return this._currentPromise;
+            })
+                .then(({ authJwt }) => {
+                return [new XHR_1.XHR.Header('Authorization', `Bearer ${authJwt}`)];
+            });
+        });
+    }
+    _refreshAuthJwt(refreshJwt) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // If I do not have a refresh JWT or the refresh JWT is expired,
+            // I have to log in again
+            if (!refreshJwt || this._isJwtExpired(refreshJwt)) {
+                return this._loginAndGetTokens();
+            }
+            else {
+                return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({
+                    authJwt: refreshResponse.token,
+                    refreshJwt: refreshJwt,
+                }));
+            }
+        });
+    }
+    _loginAndGetTokens() {
+        return __awaiter(this, void 0, void 0, function* () {
+            let authResponse;
+            let firstError;
+            if (this.username && this.password) {
+                try {
+                    authResponse = yield this.authApi.login(new LoginCredentials_1.LoginCredentials({
+                        username: this.username,
+                        password: this.password,
+                    }));
+                }
+                catch (e) {
+                    firstError = e;
+                }
+            }
+            if (!authResponse) {
+                authResponse = yield Object.entries(this.thirdPartyTokens).reduce((acc, [thirdParty, token]) => __awaiter(this, void 0, void 0, function* () {
+                    const prev = yield acc;
+                    return (prev !== null && prev !== void 0 ? prev : (token
+                        ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {
+                            if (!firstError) {
+                                firstError = e;
+                            }
+                            return Promise.resolve();
+                        })
+                        : undefined));
+                }), Promise.resolve());
+            }
+            if (!authResponse) {
+                if (firstError)
+                    throw firstError;
+                throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers());
+            }
+            return {
+                authJwt: authResponse.token,
+                refreshJwt: authResponse.refreshToken,
+            };
+        });
+    }
+    _isJwtExpired(jwt) {
+        const parts = jwt.split('.');
+        if (parts.length !== 3) {
+            return false;
+        }
+        const payload = this._base64Decode(parts[1]);
+        return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime();
+    }
+    _base64Decode(encodedString) {
+        return JSON.parse((0, utils_1.a2b)(encodedString));
+    }
+    invalidateHeader(error) {
+        this._error = error;
+    }
+    isInErrorState() {
+        return !!this._error;
+    }
+}
+exports.JwtBridgedAuthService = JwtBridgedAuthService;
+//# sourceMappingURL=JwtBridgedAuthService.js.map

package/icc-x-api/auth/JwtBridgedAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtBridgedAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtBridgedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B,MAAa,qBAAqB;IAIhC,YACU,OAAmB,EACnB,QAAgB,EAChB,QAAgB,EAChB,mBAAqD,EAAE;QAHvD,YAAO,GAAP,OAAO,CAAY;QACnB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,qBAAgB,GAAhB,gBAAgB,CAAuC;QAPzD,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAO9F,CAAC;IAEJ,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAiB,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAQ,EAAE,YAAY,EAAE,UAAW,EAAE,CAAC,CAAC,CAAC,CAAA;IACnJ,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE;oBAC3C,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;gBACjD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,IAAI,YAAgD,CAAA;YACpD,IAAI,UAAgC,CAAA;YACpC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI;oBACF,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,IAAI,mCAAgB,CAAC;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CACH,CAAA;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,UAAU,GAAG,CAAa,CAAA;iBAC3B;aACF;YACD,IAAI,CAAC,YAAY,EAAE;gBACjB,YAAY,GAAG,MAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAiC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE;oBACpI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAA;oBACtB,OAAO,CACL,IAAI,aAAJ,IAAI,cAAJ,IAAI,GACJ,CAAC,KAAK;wBACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;4BACnE,IAAI,CAAC,UAAU,EAAE;gCACf,UAAU,GAAG,CAAa,CAAA;6BAC3B;4BACD,OAAO,OAAO,CAAC,OAAO,EAAwB,CAAA;wBAChD,CAAC,CAAC;wBACJ,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;gBACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAiD,CAAC,CAAA;aACrE;YAED,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,UAAU;oBAAE,MAAM,UAAU,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;aAC5E;YAED,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAA;QACH,CAAC;KAAA;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,KAAK,CAAA;SACb;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAxHD,sDAwHC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\nexport class JwtBridgedAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(\n    private authApi: IccAuthApi,\n    private username: string,\n    private password: string,\n    private thirdPartyTokens: { [thirdParty: string]: string } = {}\n  ) {}\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x.refreshJwt as any)\n  }\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then(({ authJwt }) => {\n        return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    let authResponse: AuthenticationResponse | undefined\n    let firstError: XHRError | undefined\n    if (this.username && this.password) {\n      try {\n        authResponse = await this.authApi.login(\n          new LoginCredentials({\n            username: this.username,\n            password: this.password,\n          })\n        )\n      } catch (e) {\n        firstError = e as XHRError\n      }\n    }\n    if (!authResponse) {\n      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {\n        const prev = await acc\n        return (\n          prev ??\n          (token\n            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {\n                if (!firstError) {\n                  firstError = e as XHRError\n                }\n                return Promise.resolve() as Promise<undefined>\n              })\n            : undefined)\n        )\n      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)\n    }\n\n    if (!authResponse) {\n      if (firstError) throw firstError\n      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())\n    }\n\n    return {\n      authJwt: authResponse.token,\n      refreshJwt: authResponse.refreshToken,\n    }\n  }\n\n  private _isJwtExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return false\n    }\n    const payload = this._base64Decode(parts[1])\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/icc-x-api/crypto/EntitiesEncryption.d.ts

@@ -1,6 +1,7 @@
 import { Delegation, EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models';
 import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
 import { ExchangeKeysManager } from './ExchangeKeysManager';
+import { EncryptedFieldsManifest } from '../utils';
 import { CryptoPrimitives } from './CryptoPrimitives';
 import { ShareMetadataBehaviour } from './ShareMetadataBehaviour';
 /**
@@ -122,7 +123,7 @@ export declare class EntitiesEncryption {
             shareEncryptionKey?: ShareMetadataBehaviour;
             shareOwningEntityIds?: ShareMetadataBehaviour;
         };
-    }): Promise<T>;
+    }): Promise<T | undefined>;
     /**
      * Updates encryption metadata for an entity in order to share it with a delegate or in order to add additional encrypted metadata for an existing
      * delegate.
@@ -142,7 +143,7 @@ export declare class EntitiesEncryption {
      * @throws if any of the shareX parameters is set to `true` but the corresponding piece of data could not be retrieved.
      * @return an updated copy of the entity.
      */
-    entityWithExtendedEncryptedMetadata<T extends EncryptedEntity>(entity: T, delegateId: string, shareSecretIds: string[], shareEncryptionKeys: string[], shareOwningEntityIds: string[], newTags?: string[]): Promise<T>;
+    entityWithExtendedEncryptedMetadata<T extends EncryptedEntity>(entity: T, delegateId: string, shareSecretIds: string[], shareEncryptionKeys: string[], shareOwningEntityIds: string[], newTags?: string[]): Promise<T | undefined>;
     /**
      * Encrypts data using a key of the entity that the provided data owner can access (current data owner by default). If the provided data owner can
      * access multiple encryption keys of the entity there is no guarantee on which key will be used.
@@ -201,14 +202,14 @@ export declare class EntitiesEncryption {
      * for fields which should be encrypted according to cryptedKeys (e.g. note in a patient by default). If the entity specifies a value for any field
      * which should be encrypted the method throws an error, otherwise the method returns the original entity.
      */
-    tryEncryptEntity<T extends EncryptedEntity>(entity: T, dataOwnerId: string | undefined, cryptedKeys: string[], encodeBinaryData: boolean, requireEncryption: boolean, constructor: (json: any) => T): Promise<T>;
+    tryEncryptEntity<T extends EncryptedEntity>(entity: T, dataOwnerId: string | undefined, fieldsToEncrypt: EncryptedFieldsManifest, encodeBinaryData: boolean, requireEncryption: boolean, constructor: (json: any) => T): Promise<T>;
     /**
      * @internal This method is for internal use only and may be changed without notice.
      * Ensures that the encryption keys of an entity are initialised. If not will throw an exception or initialise them depending on the content of
      * the entity. This function supports migration of entities using older encryption schemes (delegation only without encrypted keys) or entities
      * which were previously not encrypted.
      */
-    ensureEncryptionKeysInitialised<T extends EncryptedEntity>(entity: T): Promise<T>;
+    ensureEncryptionKeysInitialised<T extends EncryptedEntity>(entity: T): Promise<T | undefined>;
     /**
      * Get the decrypted content of a delegation-like object which the provided data owner would be able to access using ONLY HIS EXCHANGE KEYS (does
      * not consider exchange keys for parents).

package/icc-x-api/crypto/EntitiesEncryption.js

@@ -167,7 +167,7 @@ class EntitiesEncryption {
         });
     }
     entityWithAutoExtendedEncryptedMetadata(entity, autoShareSecretIds, delegatesShareInfo) {
-        var _a;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             if (!Object.keys(delegatesShareInfo).length) {
                 throw new Error('Must specify at least a delegate');
@@ -184,7 +184,7 @@ class EntitiesEncryption {
             }
             const availableEncryptionKeys = yield this.encryptionKeysOf(entity);
             const availableOwningEntityIds = yield this.owningEntityIdsOf(entity);
-            let updatedEntity = entity;
+            let updatedEntity = undefined;
             for (const [delegateId, requests] of Object.entries(delegatesShareInfo)) {
                 let shareSecretIds = autoShareSecretIds ? defaultSecretIds : (_a = requests.shareSecretIds) !== null && _a !== void 0 ? _a : [];
                 let actualShareEncryptionKeys = [];
@@ -201,7 +201,8 @@ class EntitiesEncryption {
                     }
                     actualShareOwningEntityIds = availableOwningEntityIds;
                 }
-                updatedEntity = yield this.entityWithExtendedEncryptedMetadata(updatedEntity, delegateId, shareSecretIds, actualShareEncryptionKeys, actualShareOwningEntityIds);
+                updatedEntity =
+                    (_b = (yield this.entityWithExtendedEncryptedMetadata(updatedEntity !== null && updatedEntity !== void 0 ? updatedEntity : entity, delegateId, shareSecretIds, actualShareEncryptionKeys, actualShareOwningEntityIds))) !== null && _b !== void 0 ? _b : updatedEntity;
             }
             return updatedEntity;
         });
@@ -256,7 +257,7 @@ class EntitiesEncryption {
             if (deduplicateInfoSecretIds.missingEntries.length === 0 &&
                 deduplicateInfoEncryptionKeys.missingEntries.length === 0 &&
                 deduplicateInfoOwningEntityIds.missingEntries.length === 0)
-                return _.cloneDeep(entity);
+                return undefined;
             const { updatedEntity, keysForDelegates } = yield this.loadEncryptionKeysForDelegates(entity, [delegateId]);
             return this.createOrUpdateEntityDelegations(updatedEntity, delegateId, deduplicateInfoSecretIds.deduplicatedDelegations, deduplicateInfoEncryptionKeys.deduplicatedDelegations, deduplicateInfoOwningEntityIds.deduplicatedDelegations, deduplicateInfoSecretIds.missingEntries, deduplicateInfoEncryptionKeys.missingEntries, deduplicateInfoOwningEntityIds.missingEntries, newTags, keysForDelegates);
         });
@@ -274,8 +275,9 @@ class EntitiesEncryption {
      * @throws if the provided data owner can't access any encryption keys for the entity.
      */
     encryptDataOf(entity, content, dataOwnerId, tagsFilter = () => Promise.resolve(true)) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const keys = yield this.encryptionKeysOf(yield this.ensureEncryptionKeysInitialised(entity), dataOwnerId, tagsFilter);
+            const keys = yield this.encryptionKeysOf((_a = (yield this.ensureEncryptionKeysInitialised(entity))) !== null && _a !== void 0 ? _a : entity, dataOwnerId, tagsFilter);
             if (keys.length === 0)
                 throw new Error(`Could not extract any encryption keys of entity ${entity} for data owner ${dataOwnerId !== null && dataOwnerId !== void 0 ? dataOwnerId : (yield this.dataOwnerApi.getCurrentDataOwnerId())}.`);
             return this.primitives.AES.encryptWithRawKey(keys[0], content);
@@ -319,13 +321,11 @@ class EntitiesEncryption {
      */
     decryptEntity(entity, ownerId, constructor) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (!entity.encryptedSelf)
-                return { entity, decrypted: true };
             const encryptionKeys = yield this.importAllValidKeys(yield this.encryptionKeysOf(entity, ownerId));
             if (!encryptionKeys.length)
                 return { entity, decrypted: false };
             return {
-                entity: constructor(yield (0, utils_1.decrypt)(entity, (encrypted) => __awaiter(this, void 0, void 0, function* () {
+                entity: constructor(yield (0, utils_1.decryptObject)(entity, (encrypted) => __awaiter(this, void 0, void 0, function* () {
                     var _a;
                     return (_a = (yield this.tryDecryptJson(encryptionKeys, encrypted, false))) !== null && _a !== void 0 ? _a : {};
                 }))),
@@ -360,12 +360,13 @@ class EntitiesEncryption {
      * for fields which should be encrypted according to cryptedKeys (e.g. note in a patient by default). If the entity specifies a value for any field
      * which should be encrypted the method throws an error, otherwise the method returns the original entity.
      */
-    tryEncryptEntity(entity, dataOwnerId, cryptedKeys, encodeBinaryData, requireEncryption, constructor) {
+    tryEncryptEntity(entity, dataOwnerId, fieldsToEncrypt, encodeBinaryData, requireEncryption, constructor) {
         return __awaiter(this, void 0, void 0, function* () {
             const entityWithInitialisedEncryptionKeys = yield this.ensureEncryptionKeysInitialised(entity);
             const encryptionKey = yield this.tryImportFirstValidKey(yield this.encryptionKeysOf(entity, dataOwnerId), entity.id);
             if (!!encryptionKey) {
-                return constructor(yield (0, utils_1.crypt)(entityWithInitialisedEncryptionKeys, (obj) => {
+                return constructor(yield (0, utils_1.encryptObject)(entityWithInitialisedEncryptionKeys !== null && entityWithInitialisedEncryptionKeys !== void 0 ? entityWithInitialisedEncryptionKeys : entity, (obj) => {
+                    // TODO should encoding of binary data should probably be applied to everything?
                     const json = encodeBinaryData
                         ? JSON.stringify(obj, (k, v) => {
                             return v instanceof ArrayBuffer || v instanceof Uint8Array
@@ -374,16 +375,19 @@ class EntitiesEncryption {
                         })
                         : JSON.stringify(obj);
                     return this.primitives.AES.encrypt(encryptionKey.key, (0, utils_1.utf8_2ua)(json), encryptionKey.raw);
-                }, cryptedKeys));
+                }, fieldsToEncrypt, 'entity'));
             }
             else if (requireEncryption) {
                 throw new Error(`No key found for encryption of entity ${entity}`);
             }
             else {
-                const cryptedCopyWithRandomKey = yield (0, utils_1.crypt)(_.cloneDeep(entity), (obj) => __awaiter(this, void 0, void 0, function* () { return Promise.resolve(new ArrayBuffer(1)); }), cryptedKeys);
-                if (!_.isEqual(_.omitBy(Object.assign(Object.assign({}, cryptedCopyWithRandomKey), { encryptedSelf: undefined }), _.isNil), _.omitBy(Object.assign(Object.assign({}, entity), { encryptedSelf: undefined }), _.isNil))) {
-                    throw new Error(`Impossible to modify encrypted value of an entity if no encryption key is known.\n${entity}`);
-                }
+                yield (0, utils_1.encryptObject)(entity, (obj) => __awaiter(this, void 0, void 0, function* () {
+                    const hasNonEmptyValues = Object.values(obj).some((v) => v !== undefined && (typeof v !== 'object' || (Array.isArray(v) && v.length > 0) || Object.keys(v).length > 0));
+                    if (hasNonEmptyValues) {
+                        throw new Error(`Impossible to modify encrypted content of an entity if no encryption key is known.\nEntity: ${JSON.stringify(entity)}\nTo encrypt: ${JSON.stringify(obj)}`);
+                    }
+                    return Promise.resolve(new ArrayBuffer(1));
+                }), fieldsToEncrypt, 'entity');
                 return entity;
             }
         });
@@ -398,7 +402,7 @@ class EntitiesEncryption {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
             if (Object.keys((_a = entity.encryptionKeys) !== null && _a !== void 0 ? _a : {}).length > 0)
-                return entity;
+                return undefined;
             if (!entity.rev) {
                 throw new Error('New encrypted entity is lacking encryption metadata. ' +
                     'Please instantiate new entities using the `newInstance` method from the respective extended api.');