@icure/api 7.0.0-beta.4 → 7.0.0

package/icc-x-api/utils/crypto-utils.d.ts

@@ -42,24 +42,153 @@ export declare function appendBuffer(buffer1: ArrayBuffer, buffer2: ArrayBuffer)
 export declare function after(d1: number | null | undefined, d2: number | null | undefined): boolean;
 export declare function before(d1: number | null | undefined, d2: number | null | undefined): boolean;
 /**
- * Encrypt object graph recursively
+ * Configuration for the encryption of an object.
+ * @param topLevelFields the fields of the object to encrypt. All the fields will be encrypted in a single encryptedSelf field which is added to the
+ * object.
+ * @param nestedObjectsKeys the name of fields which are expected to contain a nested object (or undefined). Allows to specify
+ */
+export type EncryptedFieldsManifest = {
+    topLevelFields: {
+        fieldName: string;
+        fieldPath: string;
+    }[];
+    nestedObjectsKeys: {
+        [objectFieldName: string]: EncryptedFieldsManifest;
+    };
+    mapsValuesKeys: {
+        [mapFieldName: string]: EncryptedFieldsManifest;
+    };
+    arraysValuesKeys: {
+        [arrayFieldName: string]: EncryptedFieldsManifest;
+    };
+};
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ *
+ * Parse the encrypted fields configuration for a specific entity type.
+ *
+ * ## Grammar
+ *
+ * The grammar for each encrypted field is the following:
+ * ```
+ * fieldName :=
+ *   regex([a-zA-Z_][a-zA-Z0-9_]+)
+ * encryptedField :=
+ *   fieldName
+ *   | fieldName + ("." | ".*." | "[].") + encryptedField
+ * ```
+ *
+ * This grammar allows you to specify the fields to encrypt for the object and recursively for nested objects.
+ * - A string containing only a single `fieldName` will encrypt the field with the given name.
+ * - A string starting with `fieldName.` allows to specify the encrypted fields of a nested object. The encrypted values of the
+ *   fields in the nested object will be saved in the nested object.
+ * - A string starting with `fieldName.*.` treats `fieldName` as a map/dictionary data structure and allows to specify the encrypted fields of the
+ *   values of the map. Note that the values of the map must be objects as well. The encrypted content of each map value is stored in that value.
+ * - A string starting with `fieldName[].` treats `fieldName` as an array and allows to specify the encrypted fields of the values of the array.
+ *   Note that the values of the array must be objects as well. The encrypted content of each array element is stored in that element.
  *
+ * ## Example
+ *
+ * Consider the following object and encryption keys:
+ * ```javascript
+ * const obj = {
+ *   a: { x: 0, y: 1 },
+ *   b: "hello",
+ *   c: [ { public: "a", secret: "b" }, { public: "c", secret: "d" } ],
+ *   d: "ok",
+ *   e: {
+ *     info: "something",
+ *     private: "secret",
+ *     dataMap: {
+ *       "en": {
+ *         a: 1,
+ *         b: 2
+ *       },
+ *       "fr": {
+ *         a: 3,
+ *         b: 4
+ *       }
+ *     }
+ *   }
+ * }
+ * const encryptedFields = [
+ *   "a",
+ *   "c[].secret",
+ *   "d",
+ *   "e.private",
+ *   "e.datamap.*.a"
+ * ]
+ * ```
+ * If you use them with the crypt method you will get the following result:
+ * ```json
+ * {
+ *   b: "hello",
+ *   c: [
+ *     { public: "a", encryptedSelf: "...encrypted data of c[0]" },
+ *     { public: "c", encryptedSelf: "...encrypted data of c[1]" }
+ *   ],
+ *   e: {
+ *     info: "something",
+ *     dataMap: {
+ *       "en": { b: 2, encryptedSelf: "...encrypted data of e.dataMap['en']" },
+ *       "fr": { b: 4, encryptedSelf: "...encrypted data of e.dataMap['fr']" }
+ *     },
+ *     encryptedSelf: "...encrypted data of e"
+ *   },
+ *   encryptedSelf: "...encrypted data of obj"
+ * }
+ * ```
+ *
+ * ## Shortened representation
+ *
+ * You can also group encrypted fields having the same prefix by concatenating to the prefix the JSON representation of an array of all the postfixes.
+ * For example the following encrypted fields:
+ * ```javascript
+ * const encryptedFields = ["a.b.c.d.e.f1", "a.b.c.d.e.f2", "a.b.c.d.e.f3", "a.b.c.d.e.f4"]
+ * ```
+ * can be shortened to
+ * ```javascript
+ * const encryptedFields = ['a.b.c.d.e.["f1","f2","f3","f4"]'] // Note the use of single quotes to avoid escaping the double quotes
+ * ```
+ * If you use the shortened representation you may need to escape nested json representations. In that case the use of `JSON.stringify` is
+ * recommended.
+ *
+ * @param encryptedFields
+ * @param path
+ */
+export declare function parseEncryptedFields(encryptedFields: string[], path: string): EncryptedFieldsManifest;
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ * Encrypt the object graph recursively. Generally return an updated SHALLOW copy, although some fields may be deep copied if they also needed to be
+ * recursively encrypted.
  * @param obj the object to encrypt
- * @param cryptor the cryptor function (returns a promise)
- * @param keys the keys to be crypted: ex for a Patient ['note', 'addresses.*.["street", "houseNumber", "telecoms.*.telecomNumber"]']
+ * @param cryptor takes in input an object consisting only of the fields to encrypt of obj, and returns the encrypted object.
+ * @param keys the keys to encrypt for the
+ * @param path path of the current object, used for error messages.
+ * @return a shallow copy of the object with a new encryptedSelfField and without the encrypted fields.
  */
-export declare function crypt(obj: any, cryptor: (obj: {
-    [key: string]: string;
-}) => Promise<ArrayBuffer>, keys: Array<string>): Promise<any>;
+export declare function encryptObject(obj: {
+    [key: string]: any;
+}, cryptor: (obj: {
+    [key: string]: any;
+}) => Promise<ArrayBuffer>, keys: EncryptedFieldsManifest, path?: string): Promise<{
+    [key: string]: any;
+}>;
 /**
- * Decrypt object graph recursively
+ * @internal this function is for internal use only and may be changed without notice
+ * Decrypt object graph recursively.
  *
- * @param obj the object to encrypt
+ * @param obj the object to decrypt
  * @param decryptor the decryptor function (returns a promise)
+ * @return a deep copy of the object with the decrypted fields and removed encryptedSelf field
  */
-export declare function decrypt(obj: any, decryptor: (obj: Uint8Array) => Promise<{
-    [key: string]: string;
-}>): Promise<any>;
+export declare function decryptObject(obj: {
+    [key: string]: any;
+}, decryptor: (obj: Uint8Array) => Promise<{
+    [key: string]: any;
+}>): Promise<{
+    [key: string]: any;
+}>;
 /**
  * Extracts the full jwk key pair from the jwk representation of the private key.
  * @param privateKeyJwk private key in jwk representation

package/icc-x-api/utils/crypto-utils.js

@@ -9,9 +9,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.keyPairFromPrivateKeyJwk = exports.decrypt = exports.crypt = exports.before = exports.after = exports.appendBuffer = exports.truncateTrailingNulls = exports.pkcs8ToJwk = exports.spkiToJwk = exports.jwk2spki = exports.jwk2pkcs8 = exports.notConcurrent = void 0;
+exports.keyPairFromPrivateKeyJwk = exports.decryptObject = exports.encryptObject = exports.parseEncryptedFields = exports.before = exports.after = exports.appendBuffer = exports.truncateTrailingNulls = exports.pkcs8ToJwk = exports.spkiToJwk = exports.jwk2spki = exports.jwk2pkcs8 = exports.notConcurrent = void 0;
 const mm = require("moment");
-const _ = require("lodash");
 const binary_utils_1 = require("../utils/binary-utils");
 const asn1_packer_1 = require("./asn1-packer");
 const asn1_parser_1 = require("./asn1-parser");
@@ -195,56 +194,306 @@ function moment(epochOrLongCalendar) {
     }
 }
 /**
- * Encrypt object graph recursively
+ * @internal this function is for internal use only and may be changed without notice
  *
+ * Parse the encrypted fields configuration for a specific entity type.
+ *
+ * ## Grammar
+ *
+ * The grammar for each encrypted field is the following:
+ * ```
+ * fieldName :=
+ *   regex([a-zA-Z_][a-zA-Z0-9_]+)
+ * encryptedField :=
+ *   fieldName
+ *   | fieldName + ("." | ".*." | "[].") + encryptedField
+ * ```
+ *
+ * This grammar allows you to specify the fields to encrypt for the object and recursively for nested objects.
+ * - A string containing only a single `fieldName` will encrypt the field with the given name.
+ * - A string starting with `fieldName.` allows to specify the encrypted fields of a nested object. The encrypted values of the
+ *   fields in the nested object will be saved in the nested object.
+ * - A string starting with `fieldName.*.` treats `fieldName` as a map/dictionary data structure and allows to specify the encrypted fields of the
+ *   values of the map. Note that the values of the map must be objects as well. The encrypted content of each map value is stored in that value.
+ * - A string starting with `fieldName[].` treats `fieldName` as an array and allows to specify the encrypted fields of the values of the array.
+ *   Note that the values of the array must be objects as well. The encrypted content of each array element is stored in that element.
+ *
+ * ## Example
+ *
+ * Consider the following object and encryption keys:
+ * ```javascript
+ * const obj = {
+ *   a: { x: 0, y: 1 },
+ *   b: "hello",
+ *   c: [ { public: "a", secret: "b" }, { public: "c", secret: "d" } ],
+ *   d: "ok",
+ *   e: {
+ *     info: "something",
+ *     private: "secret",
+ *     dataMap: {
+ *       "en": {
+ *         a: 1,
+ *         b: 2
+ *       },
+ *       "fr": {
+ *         a: 3,
+ *         b: 4
+ *       }
+ *     }
+ *   }
+ * }
+ * const encryptedFields = [
+ *   "a",
+ *   "c[].secret",
+ *   "d",
+ *   "e.private",
+ *   "e.datamap.*.a"
+ * ]
+ * ```
+ * If you use them with the crypt method you will get the following result:
+ * ```json
+ * {
+ *   b: "hello",
+ *   c: [
+ *     { public: "a", encryptedSelf: "...encrypted data of c[0]" },
+ *     { public: "c", encryptedSelf: "...encrypted data of c[1]" }
+ *   ],
+ *   e: {
+ *     info: "something",
+ *     dataMap: {
+ *       "en": { b: 2, encryptedSelf: "...encrypted data of e.dataMap['en']" },
+ *       "fr": { b: 4, encryptedSelf: "...encrypted data of e.dataMap['fr']" }
+ *     },
+ *     encryptedSelf: "...encrypted data of e"
+ *   },
+ *   encryptedSelf: "...encrypted data of obj"
+ * }
+ * ```
+ *
+ * ## Shortened representation
+ *
+ * You can also group encrypted fields having the same prefix by concatenating to the prefix the JSON representation of an array of all the postfixes.
+ * For example the following encrypted fields:
+ * ```javascript
+ * const encryptedFields = ["a.b.c.d.e.f1", "a.b.c.d.e.f2", "a.b.c.d.e.f3", "a.b.c.d.e.f4"]
+ * ```
+ * can be shortened to
+ * ```javascript
+ * const encryptedFields = ['a.b.c.d.e.["f1","f2","f3","f4"]'] // Note the use of single quotes to avoid escaping the double quotes
+ * ```
+ * If you use the shortened representation you may need to escape nested json representations. In that case the use of `JSON.stringify` is
+ * recommended.
+ *
+ * @param encryptedFields
+ * @param path
+ */
+function parseEncryptedFields(encryptedFields, path) {
+    const groupedData = {
+        topLevelFields: new Set(),
+        nestedObjectsKeys: {},
+        mapsValuesKeys: {},
+        arraysValuesKeys: {},
+    };
+    const encryptedFieldRegex = /^([_a-zA-Z][_a-zA-Z0-9]*)(?:(\.\*\.|\[]\.|\.)(?:[_a-zA-Z].*|\[.*]))?$/;
+    const addSubkeyToGroupedData = (currFieldName, currFieldSeparator, currEncryptedField, groupedDataKey) => {
+        var _a;
+        const existingOrNew = (_a = groupedData[groupedDataKey][currFieldName]) !== null && _a !== void 0 ? _a : (groupedData[groupedDataKey][currFieldName] = []);
+        const subKey = currEncryptedField.slice(currFieldName.length + currFieldSeparator.length);
+        if (subKey.startsWith('[')) {
+            let parsedJson;
+            try {
+                parsedJson = JSON.parse(subKey);
+            }
+            catch (_b) {
+                throw new Error(`Invalid encrypted field ${path}${currEncryptedField} (not a valid JSON subkey)`);
+            }
+            if (Array.isArray(parsedJson) && parsedJson.every((x) => typeof x == 'string')) {
+                parsedJson.forEach((x) => existingOrNew.push(x));
+            }
+            else
+                throw new Error(`Invalid encrypted field ${path}${currEncryptedField} (not an array of strings)`);
+        }
+        else {
+            existingOrNew.push(subKey);
+        }
+    };
+    for (const currEncryptedField of encryptedFields) {
+        const currFieldMatch = currEncryptedField.match(encryptedFieldRegex);
+        if (!!currFieldMatch) {
+            const currFieldName = currFieldMatch[1];
+            const currFieldSeparator = currFieldMatch[2];
+            if (!currFieldSeparator) {
+                if (groupedData.topLevelFields.has(currFieldName))
+                    throw new Error(`Duplicate encrypted field ${path}${currFieldName}`);
+                if (!!groupedData.nestedObjectsKeys[currFieldName] ||
+                    !!groupedData.mapsValuesKeys[currFieldName] ||
+                    !!groupedData.arraysValuesKeys[currFieldName])
+                    throw new Error(`Encrypted field appears multiple times as different nested types and or top-level-field: ${path}${currFieldName}`);
+                groupedData.topLevelFields.add(currFieldName);
+            }
+            else if (currFieldSeparator == '.') {
+                if (groupedData.topLevelFields.has(currFieldName) ||
+                    !!groupedData.mapsValuesKeys[currFieldName] ||
+                    !!groupedData.arraysValuesKeys[currFieldName])
+                    throw new Error(`Encrypted field appears multiple times as different nested types and or top-level-field: ${path}${currFieldName}`);
+                addSubkeyToGroupedData(currFieldName, currFieldSeparator, currEncryptedField, 'nestedObjectsKeys');
+            }
+            else if (currFieldSeparator == '.*.') {
+                if (groupedData.topLevelFields.has(currFieldName) ||
+                    !!groupedData.nestedObjectsKeys[currFieldName] ||
+                    !!groupedData.arraysValuesKeys[currFieldName])
+                    throw new Error(`Encrypted field appears multiple times as different nested types and or top-level-field: ${path}${currFieldName}`);
+                addSubkeyToGroupedData(currFieldName, currFieldSeparator, currEncryptedField, 'mapsValuesKeys');
+            }
+            else if (currFieldSeparator == '[].') {
+                if (groupedData.topLevelFields.has(currFieldName) ||
+                    !!groupedData.nestedObjectsKeys[currFieldName] ||
+                    !!groupedData.mapsValuesKeys[currFieldName])
+                    throw new Error(`Encrypted field appears multiple times as different nested types and or top-level-field: ${path}${currFieldName}`);
+                addSubkeyToGroupedData(currFieldName, currFieldSeparator, currEncryptedField, 'arraysValuesKeys');
+            }
+            else
+                throw new Error(`Internal error: unknown separator ${currFieldSeparator} passed regex validation in ${path}${currEncryptedField}`);
+        }
+        else
+            throw new Error(`Invalid encrypted field ${path}${currEncryptedField}`);
+    }
+    return {
+        topLevelFields: Array.from(groupedData.topLevelFields).map((fieldName) => ({ fieldName, fieldPath: path + fieldName })),
+        nestedObjectsKeys: Object.fromEntries(Object.entries(groupedData.nestedObjectsKeys).map(([fieldName, fieldNames]) => [
+            fieldName,
+            parseEncryptedFields(fieldNames, path + fieldName + '.'),
+        ])),
+        mapsValuesKeys: Object.fromEntries(Object.entries(groupedData.mapsValuesKeys).map(([fieldName, fieldNames]) => [
+            fieldName,
+            parseEncryptedFields(fieldNames, path + fieldName + '.*.'),
+        ])),
+        arraysValuesKeys: Object.fromEntries(Object.entries(groupedData.arraysValuesKeys).map(([fieldName, fieldNames]) => [
+            fieldName,
+            parseEncryptedFields(fieldNames, path + fieldName + '[].'),
+        ])),
+    };
+}
+exports.parseEncryptedFields = parseEncryptedFields;
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ * Encrypt the object graph recursively. Generally return an updated SHALLOW copy, although some fields may be deep copied if they also needed to be
+ * recursively encrypted.
  * @param obj the object to encrypt
- * @param cryptor the cryptor function (returns a promise)
- * @param keys the keys to be crypted: ex for a Patient ['note', 'addresses.*.["street", "houseNumber", "telecoms.*.telecomNumber"]']
+ * @param cryptor takes in input an object consisting only of the fields to encrypt of obj, and returns the encrypted object.
+ * @param keys the keys to encrypt for the
+ * @param path path of the current object, used for error messages.
+ * @return a shallow copy of the object with a new encryptedSelfField and without the encrypted fields.
  */
-function crypt(obj, cryptor, keys) {
+function encryptObject(obj, cryptor, keys, path = 'obj') {
     return __awaiter(this, void 0, void 0, function* () {
-        const subObj = _.pick(obj, keys.filter((k) => !k.includes('*')));
-        obj.encryptedSelf = (0, binary_utils_1.b2a)((0, binary_utils_1.ua2string)(yield cryptor(subObj)));
-        Object.keys(subObj).forEach((k) => delete obj[k]);
-        yield keys
-            .filter((k) => k.includes('*'))
-            .reduce((prev, k) => __awaiter(this, void 0, void 0, function* () {
-            yield prev;
-            const k1 = k.split('.*.')[0];
-            const k2 = k.substr(k1.length + 3);
-            const mapped = yield Promise.all((_.get(obj, k1) || []).map((so) => crypt(so, cryptor, k2.startsWith('[') ? JSON.parse(k2) : [k2])));
-            _.set(obj, k1, mapped);
-        }), Promise.resolve());
-        return obj;
+        const shallowClone = Object.assign({}, obj);
+        const currEncryptedFields = {};
+        for (const { fieldName } of keys.topLevelFields) {
+            const fieldValue = shallowClone[fieldName];
+            if (fieldValue !== undefined) {
+                // we keep null values
+                currEncryptedFields[fieldName] = fieldValue;
+                delete shallowClone[fieldName];
+            }
+        }
+        shallowClone['encryptedSelf'] = (0, binary_utils_1.b2a)((0, binary_utils_1.ua2string)(yield cryptor(currEncryptedFields)));
+        for (const [fieldName, subKeys] of Object.entries(keys.nestedObjectsKeys)) {
+            const fieldValue = shallowClone[fieldName];
+            if (fieldValue !== undefined && fieldValue !== null) {
+                if (!isPojo(fieldValue))
+                    throw new Error(`Expected field ${path}.${fieldName} to be a non-array object`);
+                shallowClone[fieldName] = yield encryptObject(fieldValue, cryptor, subKeys, path + '.' + fieldName);
+            }
+        }
+        for (const [mapFieldName, subKeys] of Object.entries(keys.mapsValuesKeys)) {
+            const fieldValue = shallowClone[mapFieldName];
+            if (fieldValue !== undefined && fieldValue !== null) {
+                if (!isPojo(fieldValue))
+                    throw new Error(`Expected field ${path}.${mapFieldName} to be a non-array object`);
+                const newMap = {};
+                for (const [key, value] of Object.entries(fieldValue)) {
+                    if (value === null || value === undefined) {
+                        newMap[key] = value;
+                    }
+                    else {
+                        if (!isPojo(value))
+                            throw new Error(`Expected field ${path}.${mapFieldName}.${key} to be a non-array object`);
+                        newMap[key] = yield encryptObject(value, cryptor, subKeys, path + '.' + mapFieldName + '.' + key);
+                    }
+                }
+                shallowClone[mapFieldName] = newMap;
+            }
+        }
+        for (const [arrayFieldName, subKeys] of Object.entries(keys.arraysValuesKeys)) {
+            const fieldValue = shallowClone[arrayFieldName];
+            if (fieldValue !== undefined && fieldValue !== null) {
+                if (!Array.isArray(fieldValue))
+                    throw new Error(`Expected field ${path}.${arrayFieldName} to be an array`);
+                const newArray = Array(fieldValue.length);
+                for (let i = 0; i < fieldValue.length; i++) {
+                    const value = fieldValue[i];
+                    if (value === null || value === undefined) {
+                        newArray[i] = value;
+                    }
+                    else {
+                        if (!isPojo(value))
+                            throw new Error(`Expected field ${path}.${arrayFieldName}[${i}] to be a non-array object`);
+                        newArray[i] = yield encryptObject(value, cryptor, subKeys, path + '.' + arrayFieldName + '[' + i + ']');
+                    }
+                }
+                shallowClone[arrayFieldName] = newArray;
+            }
+        }
+        return shallowClone;
     });
 }
-exports.crypt = crypt;
+exports.encryptObject = encryptObject;
+/**
+ * Check if value is a non-null object that is not an array.
+ */
+function isPojo(value) {
+    // This break if for some reason we have object versions of String/Number/Boolean
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
 /**
- * Decrypt object graph recursively
+ * @internal this function is for internal use only and may be changed without notice
+ * Decrypt object graph recursively.
  *
- * @param obj the object to encrypt
+ * @param obj the object to decrypt
  * @param decryptor the decryptor function (returns a promise)
+ * @return a deep copy of the object with the decrypted fields and removed encryptedSelf field
  */
-function decrypt(obj, decryptor) {
+function decryptObject(obj, decryptor) {
     return __awaiter(this, void 0, void 0, function* () {
-        yield Object.keys(obj).reduce((prev, k) => __awaiter(this, void 0, void 0, function* () {
-            yield prev;
-            if (Array.isArray(obj[k])) {
-                yield obj[k]
-                    .filter((o) => typeof o === 'object' && o !== null)
-                    .reduce((prev, so) => __awaiter(this, void 0, void 0, function* () {
-                    yield prev;
-                    yield decrypt(so, decryptor);
-                }), Promise.resolve());
+        const copy = {};
+        for (const [key, value] of Object.entries(obj)) {
+            if (key === 'encryptedSelf') {
+                copy[key] = value;
+            }
+            else if (typeof value === 'object' && value !== null) {
+                if (Array.isArray(value)) {
+                    // Note: nested arrays (and primitives) are returned as is and not they are not recursively decrypted. This is because we currently do not
+                    // support encryption of elements from arrays in arrays (we only support arrays in objects in arrays). In future this may change.
+                    copy[key] = yield Promise.all(value.map((v) => (isPojo(v) ? decryptObject(v, decryptor) : v)));
+                }
+                else {
+                    copy[key] = yield decryptObject(value, decryptor);
+                }
             }
-        }), Promise.resolve());
+            else {
+                copy[key] = value;
+            }
+        }
         if (obj.encryptedSelf) {
-            Object.assign(obj, yield decryptor((0, binary_utils_1.string2ua)((0, binary_utils_1.a2b)(obj.encryptedSelf))));
+            const decrypted = yield decryptor((0, binary_utils_1.string2ua)((0, binary_utils_1.a2b)(obj.encryptedSelf)));
+            return Object.assign(Object.assign({}, copy), decrypted);
         }
-        return obj;
+        else
+            return copy;
     });
 }
-exports.decrypt = decrypt;
+exports.decryptObject = decryptObject;
 /**
  * Extracts the full jwk key pair from the jwk representation of the private key.
  * @param privateKeyJwk private key in jwk representation

package/icc-x-api/utils/crypto-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-utils.js","sourceRoot":"","sources":["../../../icc-x-api/utils/crypto-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6BAA4B;AAE5B,4BAA2B;AAC3B,wDAA4G;AAC5G,+CAAoC;AACpC,+CAAyC;AAGzC,SAAgB,aAAa,CAAI,cAAmD,EAAE,GAAW,EAAE,IAA0B;IAC3H,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,MAAM,GAAG,CAAC,GAAS,EAAE;YACzB,IAAI;gBACF,OAAO,MAAM,IAAI,EAAE,CAAA;aACpB;oBAAS;gBACR,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;aAC3B;QACH,CAAC,CAAA,CAAC,EAAE,CAAA;QACJ,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;QAC5B,OAAO,MAAM,CAAA;KACd;SAAM;QACL,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;KAChF;AACH,CAAC;AAfD,sCAeC;AAED,SAAgB,SAAS,CAAC,GAAQ;IAChC,OAAO,IAAA,kBAAI,EAAC;QACV,IAAI;QACJ;YACE,CAAC,IAAI,EAAE,IAAI,CAAC;YACZ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C;gBACE,IAAI;gBACJ;oBACE;wBACE,IAAI;wBACJ;4BACE,CAAC,IAAI,EAAE,IAAI,CAAC;4BACZ,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;4BACjC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;4BACjC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;yBAClC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AA3BD,8BA2BC;AAED,SAAgB,QAAQ,CAAC,GAAQ;IAC/B,OAAO,IAAA,kBAAI,EAAC;QACV,IAAI;QACJ;YACE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C;gBACE,IAAI;gBACJ;oBACE;wBACE,IAAI;wBACJ;4BACE,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;yBACjC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AAnBD,4BAmBC;AAED,SAAgB,SAAS,CAAC,GAAe;;IACvC,MAAM,IAAI,GAAG,IAAA,uBAAS,EAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAE3C,IAAI,OAAO,GAA2B,SAAS,CAAA;IAC/C,IAAI,QAAQ,GAA2B,SAAS,CAAA;IAChD,IACE,IAAI,CAAC,IAAI,KAAK,IAAI;QAClB,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI;QACjC,CAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI;QAChD,IAAA,qBAAM,EAAC,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,2BAA2B;MAC1H;QACA,OAAO,GAAG,MAAA,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;QACjE,QAAQ,GAAG,MAAA,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;KACnE;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI,IAAI,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI,EAAE;QACvG,OAAO,GAAG,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;QACnC,QAAQ,GAAG,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;KACrC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE;QACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;KACvC;IACD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,IAAI;QACT,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;KACnC,CAAA;AACH,CAAC;AA5BD,8BA4BC;AAED,SAAgB,UAAU,CAAC,GAA6B;;IACtD,MAAM,MAAM,GAAG,IAAA,uBAAS,EAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GACP,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,MAAM,MAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,0CAAE,MAAM,MAAK,CAAC;QAC5G,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,MAAM,CAAA;IACZ,OAAO;QACL,GAAG,EAAE,KAAK;QACV,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC/D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC/D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;KAChE,CAAA;AACH,CAAC;AAjBD,gCAiBC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;QACjB,CAAC,EAAE,CAAA;KACJ;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,CAAa;IACjD,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAA;IAC1B,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE;QAC/B,GAAG,EAAE,CAAA;KACN;IACD,yEAAyE;IACzE,8CAA8C;IAC9C,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;AAC/B,CAAC;AARD,sDAQC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,OAAoB,EAAE,OAAoB;IACrE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACnE,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IACnC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACpD,OAAO,GAAG,CAAC,MAAqB,CAAA;AAClC,CAAC;AALD,oCAKC;AAED,0CAA0C;AAC1C,SAAgB,KAAK,CAAC,EAA6B,EAAE,EAA6B;IAChF,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,CAAA;AAC/G,CAAC;AAFD,sBAEC;AAED,SAAgB,MAAM,CAAC,EAA6B,EAAE,EAA6B;IACjF,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,CAAA;AAChH,CAAC;AAFD,wBAEC;AAED,SAAS,MAAM,CAAC,mBAA2B;IACzC,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,KAAK,CAAC,EAAE;QACrD,OAAO,IAAI,CAAA;KACZ;IACD,IAAI,mBAAmB,IAAI,QAAQ,IAAI,mBAAmB,GAAG,QAAQ,EAAE;QACrE,OAAO,EAAE,CAAC,EAAE,GAAG,mBAAmB,EAAE,UAAU,CAAC,CAAA;KAChD;SAAM,IAAI,mBAAmB,IAAI,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,EAAE,GAAG,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;KACtD;SAAM;QACL,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAA;KAC/B;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAsB,KAAK,CAAC,GAAQ,EAAE,OAAiE,EAAE,IAAmB;;QAC1H,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CACnB,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CACrC,CAAA;QACD,GAAG,CAAC,aAAa,GAAG,IAAA,kBAAG,EAAC,IAAA,wBAAS,EAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAEjD,MAAM,IAAI;aACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;aAC9B,MAAM,CAAC,CAAO,IAAmB,EAAE,CAAM,EAAE,EAAE;YAC5C,MAAM,IAAI,CAAA;YACV,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAElC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;YACzI,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;QACxB,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAEvB,OAAO,GAAG,CAAA;IACZ,CAAC;CAAA;AApBD,sBAoBC;AAED;;;;;GAKG;AACH,SAAsB,OAAO,CAAC,GAAQ,EAAE,SAAkE;;QACxG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAO,IAAmB,EAAE,CAAM,EAAE,EAAE;YAClE,MAAM,IAAI,CAAA;YACV,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACzB,MAAO,GAAG,CAAC,CAAC,CAAgB;qBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;qBAClD,MAAM,CAAC,CAAO,IAAmB,EAAE,EAAO,EAAE,EAAE;oBAC7C,MAAM,IAAI,CAAA;oBACV,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;gBAC9B,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;aACxB;QACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QACrB,IAAI,GAAG,CAAC,aAAa,EAAE;YACrB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,IAAA,wBAAS,EAAC,IAAA,kBAAG,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;SACvE;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CAAA;AAhBD,0BAgBC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,aAAyB;IAChE,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAClI,OAAO;QACL,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,SAAS,CAAC,IAAA,qBAAM,EAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;KACtD,CAAA;AACH,CAAC;AAND,4DAMC","sourcesContent":["import * as mm from 'moment'\nimport { Moment } from 'moment'\nimport * as _ from 'lodash'\nimport { a2b, b2a, b64Url2ua, hex2ua, string2ua, ua2b64Url, ua2hex, ua2string } from '../utils/binary-utils'\nimport { pack } from './asn1-packer'\nimport { parseAsn1 } from './asn1-parser'\nimport { KeyPair } from '../crypto/RSA'\n\nexport function notConcurrent<T>(concurrencyMap: { [key: string]: PromiseLike<any> }, key: string, proc: () => PromiseLike<T>): PromiseLike<T> {\n  const inFlight = concurrencyMap[key]\n  if (!inFlight) {\n    const newJob = (async () => {\n      try {\n        return await proc()\n      } finally {\n        delete concurrencyMap[key]\n      }\n    })()\n    concurrencyMap[key] = newJob\n    return newJob\n  } else {\n    return concurrencyMap[key].then(() => notConcurrent(concurrencyMap, key, proc))\n  }\n}\n\nexport function jwk2pkcs8(jwk: any): string {\n  return pack([\n    0x30,\n    [\n      [0x02, '00'],\n      [0x30, [[0x06, '2a864886f70d010101'], [0x05]]], // pragma: allowlist secret\n      [\n        0x04,\n        [\n          [\n            0x30,\n            [\n              [0x02, '00'],\n              [0x02, ua2hex(b64Url2ua(jwk.n))],\n              [0x02, ua2hex(b64Url2ua(jwk.e))],\n              [0x02, ua2hex(b64Url2ua(jwk.d))],\n              [0x02, ua2hex(b64Url2ua(jwk.p))],\n              [0x02, ua2hex(b64Url2ua(jwk.q))],\n              [0x02, ua2hex(b64Url2ua(jwk.dp))],\n              [0x02, ua2hex(b64Url2ua(jwk.dq))],\n              [0x02, ua2hex(b64Url2ua(jwk.qi))],\n            ],\n          ],\n        ],\n      ],\n    ],\n  ])\n}\n\nexport function jwk2spki(jwk: any): string {\n  return pack([\n    0x30,\n    [\n      [0x30, [[0x06, '2a864886f70d010101'], [0x05]]], // pragma: allowlist secret\n      [\n        0x03,\n        [\n          [\n            0x30,\n            [\n              [0x02, ua2hex(b64Url2ua(jwk.n))],\n              [0x02, ua2hex(b64Url2ua(jwk.e))],\n            ],\n          ],\n        ],\n      ],\n    ],\n  ])\n}\n\nexport function spkiToJwk(buf: Uint8Array): { kty: string; alg: string; n: string; e: string; ext: boolean } {\n  const asn1 = parseAsn1(new Uint8Array(buf))\n\n  var modulus: Uint8Array | undefined = undefined\n  var exponent: Uint8Array | undefined = undefined\n  if (\n    asn1.type === 0x30 &&\n    asn1.children?.[0]?.type === 0x30 &&\n    asn1.children?.[0]?.children?.[0]?.type === 0x06 &&\n    ua2hex(asn1.children?.[0]?.children?.[0]?.value ?? new Uint8Array(0)) === '2a864886f70d010101' // pragma: allowlist secret\n  ) {\n    modulus = asn1.children?.[1]?.children?.[0]?.children?.[0]?.value\n    exponent = asn1.children?.[1]?.children?.[0]?.children?.[1]?.value\n  } else if (asn1.type === 0x30 && asn1.children?.[0]?.type === 0x02 && asn1.children?.[1]?.type === 0x02) {\n    modulus = asn1.children?.[0]?.value\n    exponent = asn1.children?.[1]?.value\n  }\n\n  if (!modulus || !exponent) {\n    throw new Error('Invalid spki format')\n  }\n  return {\n    kty: 'RSA',\n    alg: 'RSA-OAEP',\n    ext: true,\n    n: ua2b64Url(minimalRep(modulus)),\n    e: ua2b64Url(minimalRep(exponent)),\n  }\n}\n\nexport function pkcs8ToJwk(buf: Uint8Array | ArrayBuffer) {\n  const parsed = parseAsn1(new Uint8Array(buf))\n  const seq =\n    parsed.children?.length === 3 && parsed.children[2].type === 0x04 && parsed.children[2].children?.length === 1\n      ? parsed.children[2].children[0]\n      : parsed\n  return {\n    kty: 'RSA',\n    n: ua2b64Url(minimalRep(seq.children![1].value as Uint8Array)),\n    e: ua2b64Url(minimalRep(seq.children![2].value as Uint8Array)),\n    d: ua2b64Url(minimalRep(seq.children![3].value as Uint8Array)),\n    p: ua2b64Url(minimalRep(seq.children![4].value as Uint8Array)),\n    q: ua2b64Url(minimalRep(seq.children![5].value as Uint8Array)),\n    dp: ua2b64Url(minimalRep(seq.children![6].value as Uint8Array)),\n    dq: ua2b64Url(minimalRep(seq.children![7].value as Uint8Array)),\n    qi: ua2b64Url(minimalRep(seq.children![8].value as Uint8Array)),\n  }\n}\n\nfunction minimalRep(b: Uint8Array) {\n  let i = 0\n  while (b[i] === 0) {\n    i++\n  }\n  return b.slice(i)\n}\n\n/**\n * Provide a view over the given Uint8Array where any trailing null bytes at\n * the end are truncated.\n *\n * This can be used to ignore null bytes at the end of a padded UTF-8 string\n * without needing to copy that string, assuming code point U+0000 is encoded\n * in one null byte according to standards rather than in a multi-byte\n * overlong form.\n */\nexport function truncateTrailingNulls(a: Uint8Array) {\n  let end = a.byteLength - 1\n  while (a[end] === 0 && end >= 0) {\n    end--\n  }\n  // end is now either the last non-null position in a or -1; in the latter\n  // case the returned array will have length 0.\n  return a.subarray(0, end + 1)\n}\n\n/**\n *\n * @param buffer1 {Uint8Array}\n * @param buffer2{ Uint8Array}\n * @returns {ArrayBuffer}\n */\nexport function appendBuffer(buffer1: ArrayBuffer, buffer2: ArrayBuffer): ArrayBuffer {\n  const tmp = new Uint8Array(buffer1.byteLength + buffer2.byteLength)\n  tmp.set(new Uint8Array(buffer1), 0)\n  tmp.set(new Uint8Array(buffer2), buffer1.byteLength)\n  return tmp.buffer as ArrayBuffer\n}\n\n//Convenience methods for dates management\nexport function after(d1: number | null | undefined, d2: number | null | undefined): boolean {\n  return d1 === null || d2 === null || d1 === undefined || d2 === undefined || moment(d1)!.isAfter(moment(d2)!)\n}\n\nexport function before(d1: number | null | undefined, d2: number | null | undefined): boolean {\n  return d1 === null || d2 === null || d1 === undefined || d2 === undefined || moment(d1)!.isBefore(moment(d2)!)\n}\n\nfunction moment(epochOrLongCalendar: number): Moment | null {\n  if (!epochOrLongCalendar && epochOrLongCalendar !== 0) {\n    return null\n  }\n  if (epochOrLongCalendar >= 18000101 && epochOrLongCalendar < 25400000) {\n    return mm('' + epochOrLongCalendar, 'YYYYMMDD')\n  } else if (epochOrLongCalendar >= 18000101000000) {\n    return mm('' + epochOrLongCalendar, 'YYYYMMDDHHmmss')\n  } else {\n    return mm(epochOrLongCalendar)\n  }\n}\n\n/**\n * Encrypt object graph recursively\n *\n * @param obj the object to encrypt\n * @param cryptor the cryptor function (returns a promise)\n * @param keys the keys to be crypted: ex for a Patient ['note', 'addresses.*.[\"street\", \"houseNumber\", \"telecoms.*.telecomNumber\"]']\n */\nexport async function crypt(obj: any, cryptor: (obj: { [key: string]: string }) => Promise<ArrayBuffer>, keys: Array<string>) {\n  const subObj = _.pick(\n    obj,\n    keys.filter((k) => !k.includes('*'))\n  )\n  obj.encryptedSelf = b2a(ua2string(await cryptor(subObj)))\n  Object.keys(subObj).forEach((k) => delete obj[k])\n\n  await keys\n    .filter((k) => k.includes('*'))\n    .reduce(async (prev: Promise<void>, k: any) => {\n      await prev\n      const k1 = k.split('.*.')[0]\n      const k2 = k.substr(k1.length + 3)\n\n      const mapped = await Promise.all((_.get(obj, k1) || []).map((so: any) => crypt(so, cryptor, k2.startsWith('[') ? JSON.parse(k2) : [k2])))\n      _.set(obj, k1, mapped)\n    }, Promise.resolve())\n\n  return obj\n}\n\n/**\n * Decrypt object graph recursively\n *\n * @param obj the object to encrypt\n * @param decryptor the decryptor function (returns a promise)\n */\nexport async function decrypt(obj: any, decryptor: (obj: Uint8Array) => Promise<{ [key: string]: string }>) {\n  await Object.keys(obj).reduce(async (prev: Promise<void>, k: any) => {\n    await prev\n    if (Array.isArray(obj[k])) {\n      await (obj[k] as Array<any>)\n        .filter((o) => typeof o === 'object' && o !== null)\n        .reduce(async (prev: Promise<void>, so: any) => {\n          await prev\n          await decrypt(so, decryptor)\n        }, Promise.resolve())\n    }\n  }, Promise.resolve())\n  if (obj.encryptedSelf) {\n    Object.assign(obj, await decryptor(string2ua(a2b(obj.encryptedSelf))))\n  }\n  return obj\n}\n\n/**\n * Extracts the full jwk key pair from the jwk representation of the private key.\n * @param privateKeyJwk private key in jwk representation\n * @throws if the key is missing the public modulus or public exponent.\n */\nexport function keyPairFromPrivateKeyJwk(privateKeyJwk: JsonWebKey): KeyPair<JsonWebKey> {\n  if (!privateKeyJwk.n || !privateKeyJwk.e) throw new Error('Incomplete private JsonWebKey: missing public modulus and/or exponent')\n  return {\n    privateKey: privateKeyJwk,\n    publicKey: spkiToJwk(hex2ua(jwk2spki(privateKeyJwk))),\n  }\n}\n"]}
+{"version":3,"file":"crypto-utils.js","sourceRoot":"","sources":["../../../icc-x-api/utils/crypto-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6BAA4B;AAG5B,wDAA4G;AAC5G,+CAAoC;AACpC,+CAAyC;AAGzC,SAAgB,aAAa,CAAI,cAAmD,EAAE,GAAW,EAAE,IAA0B;IAC3H,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,MAAM,GAAG,CAAC,GAAS,EAAE;YACzB,IAAI;gBACF,OAAO,MAAM,IAAI,EAAE,CAAA;aACpB;oBAAS;gBACR,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;aAC3B;QACH,CAAC,CAAA,CAAC,EAAE,CAAA;QACJ,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;QAC5B,OAAO,MAAM,CAAA;KACd;SAAM;QACL,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;KAChF;AACH,CAAC;AAfD,sCAeC;AAED,SAAgB,SAAS,CAAC,GAAQ;IAChC,OAAO,IAAA,kBAAI,EAAC;QACV,IAAI;QACJ;YACE,CAAC,IAAI,EAAE,IAAI,CAAC;YACZ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C;gBACE,IAAI;gBACJ;oBACE;wBACE,IAAI;wBACJ;4BACE,CAAC,IAAI,EAAE,IAAI,CAAC;4BACZ,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;4BACjC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;4BACjC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;yBAClC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AA3BD,8BA2BC;AAED,SAAgB,QAAQ,CAAC,GAAQ;IAC/B,OAAO,IAAA,kBAAI,EAAC;QACV,IAAI;QACJ;YACE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C;gBACE,IAAI;gBACJ;oBACE;wBACE,IAAI;wBACJ;4BACE,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChC,CAAC,IAAI,EAAE,IAAA,qBAAM,EAAC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;yBACjC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AAnBD,4BAmBC;AAED,SAAgB,SAAS,CAAC,GAAe;;IACvC,MAAM,IAAI,GAAG,IAAA,uBAAS,EAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAE3C,IAAI,OAAO,GAA2B,SAAS,CAAA;IAC/C,IAAI,QAAQ,GAA2B,SAAS,CAAA;IAChD,IACE,IAAI,CAAC,IAAI,KAAK,IAAI;QAClB,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI;QACjC,CAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI;QAChD,IAAA,qBAAM,EAAC,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,2BAA2B;MAC1H;QACA,OAAO,GAAG,MAAA,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;QACjE,QAAQ,GAAG,MAAA,MAAA,MAAA,MAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;KACnE;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI,IAAI,CAAA,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,IAAI,EAAE;QACvG,OAAO,GAAG,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;QACnC,QAAQ,GAAG,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAG,CAAC,CAAC,0CAAE,KAAK,CAAA;KACrC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE;QACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;KACvC;IACD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,IAAI;QACT,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;KACnC,CAAA;AACH,CAAC;AA5BD,8BA4BC;AAED,SAAgB,UAAU,CAAC,GAA6B;;IACtD,MAAM,MAAM,GAAG,IAAA,uBAAS,EAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GACP,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,MAAM,MAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,0CAAE,MAAM,MAAK,CAAC;QAC5G,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,MAAM,CAAA;IACZ,OAAO;QACL,GAAG,EAAE,KAAK;QACV,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,CAAC,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC9D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC/D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;QAC/D,EAAE,EAAE,IAAA,wBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;KAChE,CAAA;AACH,CAAC;AAjBD,gCAiBC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;QACjB,CAAC,EAAE,CAAA;KACJ;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,CAAa;IACjD,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAA;IAC1B,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE;QAC/B,GAAG,EAAE,CAAA;KACN;IACD,yEAAyE;IACzE,8CAA8C;IAC9C,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;AAC/B,CAAC;AARD,sDAQC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,OAAoB,EAAE,OAAoB;IACrE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACnE,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IACnC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACpD,OAAO,GAAG,CAAC,MAAqB,CAAA;AAClC,CAAC;AALD,oCAKC;AAED,0CAA0C;AAC1C,SAAgB,KAAK,CAAC,EAA6B,EAAE,EAA6B;IAChF,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,CAAA;AAC/G,CAAC;AAFD,sBAEC;AAED,SAAgB,MAAM,CAAC,EAA6B,EAAE,EAA6B;IACjF,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,CAAA;AAChH,CAAC;AAFD,wBAEC;AAED,SAAS,MAAM,CAAC,mBAA2B;IACzC,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,KAAK,CAAC,EAAE;QACrD,OAAO,IAAI,CAAA;KACZ;IACD,IAAI,mBAAmB,IAAI,QAAQ,IAAI,mBAAmB,GAAG,QAAQ,EAAE;QACrE,OAAO,EAAE,CAAC,EAAE,GAAG,mBAAmB,EAAE,UAAU,CAAC,CAAA;KAChD;SAAM,IAAI,mBAAmB,IAAI,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,EAAE,GAAG,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;KACtD;SAAM;QACL,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAA;KAC/B;AACH,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,SAAgB,oBAAoB,CAAC,eAAyB,EAAE,IAAY;IAC1E,MAAM,WAAW,GAAG;QAClB,cAAc,EAAE,IAAI,GAAG,EAAU;QACjC,iBAAiB,EAAE,EAA6C;QAChE,cAAc,EAAE,EAA0C;QAC1D,gBAAgB,EAAE,EAA4C;KAC/D,CAAA;IACD,MAAM,mBAAmB,GAAG,uEAAuE,CAAA;IACnG,MAAM,sBAAsB,GAAG,CAC7B,aAAqB,EACrB,kBAA0B,EAC1B,kBAA0B,EAC1B,cAA2E,EAC3E,EAAE;;QACF,MAAM,aAAa,GAAG,MAAA,WAAW,CAAC,cAAc,CAAC,CAAC,aAAa,CAAC,mCAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAA;QACrH,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACzF,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;YAC1B,IAAI,UAAiB,CAAA;YACrB,IAAI;gBACF,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;aAChC;YAAC,WAAM;gBACN,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,GAAG,kBAAkB,4BAA4B,CAAC,CAAA;aAClG;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,EAAE;gBAC9E,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;aACjD;;gBAAM,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,GAAG,kBAAkB,4BAA4B,CAAC,CAAA;SACzG;aAAM;YACL,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;SAC3B;IACH,CAAC,CAAA;IACD,KAAK,MAAM,kBAAkB,IAAI,eAAe,EAAE;QAChD,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACpE,IAAI,CAAC,CAAC,cAAc,EAAE;YACpB,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;YACvC,MAAM,kBAAkB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;YAC5C,IAAI,CAAC,kBAAkB,EAAE;gBACvB,IAAI,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,GAAG,aAAa,EAAE,CAAC,CAAA;gBACvH,IACE,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;oBAC9C,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC;oBAC3C,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC;oBAE7C,MAAM,IAAI,KAAK,CAAC,4FAA4F,IAAI,GAAG,aAAa,EAAE,CAAC,CAAA;gBACrI,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;aAC9C;iBAAM,IAAI,kBAAkB,IAAI,GAAG,EAAE;gBACpC,IACE,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;oBAC7C,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC;oBAC3C,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC;oBAE7C,MAAM,IAAI,KAAK,CAAC,4FAA4F,IAAI,GAAG,aAAa,EAAE,CAAC,CAAA;gBACrI,sBAAsB,CAAC,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAA;aACnG;iBAAM,IAAI,kBAAkB,IAAI,KAAK,EAAE;gBACtC,IACE,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;oBAC7C,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;oBAC9C,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC;oBAE7C,MAAM,IAAI,KAAK,CAAC,4FAA4F,IAAI,GAAG,aAAa,EAAE,CAAC,CAAA;gBACrI,sBAAsB,CAAC,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAA;aAChG;iBAAM,IAAI,kBAAkB,IAAI,KAAK,EAAE;gBACtC,IACE,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC;oBAC7C,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;oBAC9C,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC;oBAE3C,MAAM,IAAI,KAAK,CAAC,4FAA4F,IAAI,GAAG,aAAa,EAAE,CAAC,CAAA;gBACrI,sBAAsB,CAAC,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAA;aAClG;;gBAAM,MAAM,IAAI,KAAK,CAAC,qCAAqC,kBAAkB,+BAA+B,IAAI,GAAG,kBAAkB,EAAE,CAAC,CAAA;SAC1I;;YAAM,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,GAAG,kBAAkB,EAAE,CAAC,CAAA;KAC/E;IACD,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC;QACvH,iBAAiB,EAAE,MAAM,CAAC,WAAW,CACnC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YAC7E,SAAS;YACT,oBAAoB,CAAC,UAAU,EAAE,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC;SACzD,CAAC,CACH;QACD,cAAc,EAAE,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YAC1E,SAAS;YACT,oBAAoB,CAAC,UAAU,EAAE,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;SAC3D,CAAC,CACH;QACD,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAClC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YAC5E,SAAS;YACT,oBAAoB,CAAC,UAAU,EAAE,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;SAC3D,CAAC,CACH;KACF,CAAA;AACH,CAAC;AA5FD,oDA4FC;AAED;;;;;;;;;GASG;AACH,SAAsB,aAAa,CACjC,GAA2B,EAC3B,OAA8D,EAC9D,IAA6B,EAC7B,OAAe,KAAK;;QAEpB,MAAM,YAAY,qBAAQ,GAAG,CAAE,CAAA;QAC/B,MAAM,mBAAmB,GAA2B,EAAE,CAAA;QACtD,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,UAAU,KAAK,SAAS,EAAE;gBAC5B,sBAAsB;gBACtB,mBAAmB,CAAC,SAAS,CAAC,GAAG,UAAU,CAAA;gBAC3C,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;aAC/B;SACF;QACD,YAAY,CAAC,eAAe,CAAC,GAAG,IAAA,kBAAG,EAAC,IAAA,wBAAS,EAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAA;QAClF,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE;YACzE,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE;gBACnD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,IAAI,SAAS,2BAA2B,CAAC,CAAA;gBACxG,YAAY,CAAC,SAAS,CAAC,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,GAAG,SAAS,CAAC,CAAA;aACpG;SACF;QACD,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;YACzE,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;YAC7C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE;gBACnD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,IAAI,YAAY,2BAA2B,CAAC,CAAA;gBAC3G,MAAM,MAAM,GAA2B,EAAE,CAAA;gBACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAoB,CAAC,EAAE;oBAC/D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE;wBACzC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;qBACpB;yBAAM;wBACL,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,IAAI,YAAY,IAAI,GAAG,2BAA2B,CAAC,CAAA;wBAC7G,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,GAAG,YAAY,GAAG,GAAG,GAAG,GAAG,CAAC,CAAA;qBAClG;iBACF;gBACD,YAAY,CAAC,YAAY,CAAC,GAAG,MAAM,CAAA;aACpC;SACF;QACD,KAAK,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE;YAC7E,MAAM,UAAU,GAAG,YAAY,CAAC,cAAc,CAAC,CAAA;YAC/C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE;gBACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,IAAI,cAAc,iBAAiB,CAAC,CAAA;gBAC1G,MAAM,QAAQ,GAAU,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;oBAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;oBAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE;wBACzC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;qBACpB;yBAAM;wBACL,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,IAAI,cAAc,IAAI,CAAC,4BAA4B,CAAC,CAAA;wBAC9G,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAA;qBACxG;iBACF;gBACD,YAAY,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAA;aACxC;SACF;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;CAAA;AA1DD,sCA0DC;AAED;;GAEG;AACH,SAAS,MAAM,CAAC,KAAU;IACxB,iFAAiF;IACjF,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,SAAsB,aAAa,CACjC,GAA2B,EAC3B,SAA+D;;QAE/D,MAAM,IAAI,GAA2B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YAC9C,IAAI,GAAG,KAAK,eAAe,EAAE;gBAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;aAClB;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE;gBACtD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;oBACxB,0IAA0I;oBAC1I,iIAAiI;oBACjI,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;iBAC/F;qBAAM;oBACL,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;iBAClD;aACF;iBAAM;gBACL,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;aAClB;SACF;QACD,IAAI,GAAG,CAAC,aAAa,EAAE;YACrB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAA,wBAAS,EAAC,IAAA,kBAAG,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;YACpE,uCAAY,IAAI,GAAK,SAAS,EAAE;SACjC;;YAAM,OAAO,IAAI,CAAA;IACpB,CAAC;CAAA;AAxBD,sCAwBC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,aAAyB;IAChE,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAClI,OAAO;QACL,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,SAAS,CAAC,IAAA,qBAAM,EAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;KACtD,CAAA;AACH,CAAC;AAND,4DAMC","sourcesContent":["import * as mm from 'moment'\nimport { Moment } from 'moment'\nimport * as _ from 'lodash'\nimport { a2b, b2a, b64Url2ua, hex2ua, string2ua, ua2b64Url, ua2hex, ua2string } from '../utils/binary-utils'\nimport { pack } from './asn1-packer'\nimport { parseAsn1 } from './asn1-parser'\nimport { KeyPair } from '../crypto/RSA'\n\nexport function notConcurrent<T>(concurrencyMap: { [key: string]: PromiseLike<any> }, key: string, proc: () => PromiseLike<T>): PromiseLike<T> {\n  const inFlight = concurrencyMap[key]\n  if (!inFlight) {\n    const newJob = (async () => {\n      try {\n        return await proc()\n      } finally {\n        delete concurrencyMap[key]\n      }\n    })()\n    concurrencyMap[key] = newJob\n    return newJob\n  } else {\n    return concurrencyMap[key].then(() => notConcurrent(concurrencyMap, key, proc))\n  }\n}\n\nexport function jwk2pkcs8(jwk: any): string {\n  return pack([\n    0x30,\n    [\n      [0x02, '00'],\n      [0x30, [[0x06, '2a864886f70d010101'], [0x05]]], // pragma: allowlist secret\n      [\n        0x04,\n        [\n          [\n            0x30,\n            [\n              [0x02, '00'],\n              [0x02, ua2hex(b64Url2ua(jwk.n))],\n              [0x02, ua2hex(b64Url2ua(jwk.e))],\n              [0x02, ua2hex(b64Url2ua(jwk.d))],\n              [0x02, ua2hex(b64Url2ua(jwk.p))],\n              [0x02, ua2hex(b64Url2ua(jwk.q))],\n              [0x02, ua2hex(b64Url2ua(jwk.dp))],\n              [0x02, ua2hex(b64Url2ua(jwk.dq))],\n              [0x02, ua2hex(b64Url2ua(jwk.qi))],\n            ],\n          ],\n        ],\n      ],\n    ],\n  ])\n}\n\nexport function jwk2spki(jwk: any): string {\n  return pack([\n    0x30,\n    [\n      [0x30, [[0x06, '2a864886f70d010101'], [0x05]]], // pragma: allowlist secret\n      [\n        0x03,\n        [\n          [\n            0x30,\n            [\n              [0x02, ua2hex(b64Url2ua(jwk.n))],\n              [0x02, ua2hex(b64Url2ua(jwk.e))],\n            ],\n          ],\n        ],\n      ],\n    ],\n  ])\n}\n\nexport function spkiToJwk(buf: Uint8Array): { kty: string; alg: string; n: string; e: string; ext: boolean } {\n  const asn1 = parseAsn1(new Uint8Array(buf))\n\n  var modulus: Uint8Array | undefined = undefined\n  var exponent: Uint8Array | undefined = undefined\n  if (\n    asn1.type === 0x30 &&\n    asn1.children?.[0]?.type === 0x30 &&\n    asn1.children?.[0]?.children?.[0]?.type === 0x06 &&\n    ua2hex(asn1.children?.[0]?.children?.[0]?.value ?? new Uint8Array(0)) === '2a864886f70d010101' // pragma: allowlist secret\n  ) {\n    modulus = asn1.children?.[1]?.children?.[0]?.children?.[0]?.value\n    exponent = asn1.children?.[1]?.children?.[0]?.children?.[1]?.value\n  } else if (asn1.type === 0x30 && asn1.children?.[0]?.type === 0x02 && asn1.children?.[1]?.type === 0x02) {\n    modulus = asn1.children?.[0]?.value\n    exponent = asn1.children?.[1]?.value\n  }\n\n  if (!modulus || !exponent) {\n    throw new Error('Invalid spki format')\n  }\n  return {\n    kty: 'RSA',\n    alg: 'RSA-OAEP',\n    ext: true,\n    n: ua2b64Url(minimalRep(modulus)),\n    e: ua2b64Url(minimalRep(exponent)),\n  }\n}\n\nexport function pkcs8ToJwk(buf: Uint8Array | ArrayBuffer) {\n  const parsed = parseAsn1(new Uint8Array(buf))\n  const seq =\n    parsed.children?.length === 3 && parsed.children[2].type === 0x04 && parsed.children[2].children?.length === 1\n      ? parsed.children[2].children[0]\n      : parsed\n  return {\n    kty: 'RSA',\n    n: ua2b64Url(minimalRep(seq.children![1].value as Uint8Array)),\n    e: ua2b64Url(minimalRep(seq.children![2].value as Uint8Array)),\n    d: ua2b64Url(minimalRep(seq.children![3].value as Uint8Array)),\n    p: ua2b64Url(minimalRep(seq.children![4].value as Uint8Array)),\n    q: ua2b64Url(minimalRep(seq.children![5].value as Uint8Array)),\n    dp: ua2b64Url(minimalRep(seq.children![6].value as Uint8Array)),\n    dq: ua2b64Url(minimalRep(seq.children![7].value as Uint8Array)),\n    qi: ua2b64Url(minimalRep(seq.children![8].value as Uint8Array)),\n  }\n}\n\nfunction minimalRep(b: Uint8Array) {\n  let i = 0\n  while (b[i] === 0) {\n    i++\n  }\n  return b.slice(i)\n}\n\n/**\n * Provide a view over the given Uint8Array where any trailing null bytes at\n * the end are truncated.\n *\n * This can be used to ignore null bytes at the end of a padded UTF-8 string\n * without needing to copy that string, assuming code point U+0000 is encoded\n * in one null byte according to standards rather than in a multi-byte\n * overlong form.\n */\nexport function truncateTrailingNulls(a: Uint8Array) {\n  let end = a.byteLength - 1\n  while (a[end] === 0 && end >= 0) {\n    end--\n  }\n  // end is now either the last non-null position in a or -1; in the latter\n  // case the returned array will have length 0.\n  return a.subarray(0, end + 1)\n}\n\n/**\n *\n * @param buffer1 {Uint8Array}\n * @param buffer2{ Uint8Array}\n * @returns {ArrayBuffer}\n */\nexport function appendBuffer(buffer1: ArrayBuffer, buffer2: ArrayBuffer): ArrayBuffer {\n  const tmp = new Uint8Array(buffer1.byteLength + buffer2.byteLength)\n  tmp.set(new Uint8Array(buffer1), 0)\n  tmp.set(new Uint8Array(buffer2), buffer1.byteLength)\n  return tmp.buffer as ArrayBuffer\n}\n\n//Convenience methods for dates management\nexport function after(d1: number | null | undefined, d2: number | null | undefined): boolean {\n  return d1 === null || d2 === null || d1 === undefined || d2 === undefined || moment(d1)!.isAfter(moment(d2)!)\n}\n\nexport function before(d1: number | null | undefined, d2: number | null | undefined): boolean {\n  return d1 === null || d2 === null || d1 === undefined || d2 === undefined || moment(d1)!.isBefore(moment(d2)!)\n}\n\nfunction moment(epochOrLongCalendar: number): Moment | null {\n  if (!epochOrLongCalendar && epochOrLongCalendar !== 0) {\n    return null\n  }\n  if (epochOrLongCalendar >= 18000101 && epochOrLongCalendar < 25400000) {\n    return mm('' + epochOrLongCalendar, 'YYYYMMDD')\n  } else if (epochOrLongCalendar >= 18000101000000) {\n    return mm('' + epochOrLongCalendar, 'YYYYMMDDHHmmss')\n  } else {\n    return mm(epochOrLongCalendar)\n  }\n}\n\n/**\n * Configuration for the encryption of an object.\n * @param topLevelFields the fields of the object to encrypt. All the fields will be encrypted in a single encryptedSelf field which is added to the\n * object.\n * @param nestedObjectsKeys the name of fields which are expected to contain a nested object (or undefined). Allows to specify\n */\nexport type EncryptedFieldsManifest = {\n  topLevelFields: { fieldName: string; fieldPath: string }[]\n  nestedObjectsKeys: {\n    [objectFieldName: string]: EncryptedFieldsManifest\n  }\n  mapsValuesKeys: {\n    [mapFieldName: string]: EncryptedFieldsManifest\n  }\n  arraysValuesKeys: {\n    [arrayFieldName: string]: EncryptedFieldsManifest\n  }\n}\n\n/**\n * @internal this function is for internal use only and may be changed without notice\n *\n * Parse the encrypted fields configuration for a specific entity type.\n *\n * ## Grammar\n *\n * The grammar for each encrypted field is the following:\n * ```\n * fieldName :=\n *   regex([a-zA-Z_][a-zA-Z0-9_]+)\n * encryptedField :=\n *   fieldName\n *   | fieldName + (\".\" | \".*.\" | \"[].\") + encryptedField\n * ```\n *\n * This grammar allows you to specify the fields to encrypt for the object and recursively for nested objects.\n * - A string containing only a single `fieldName` will encrypt the field with the given name.\n * - A string starting with `fieldName.` allows to specify the encrypted fields of a nested object. The encrypted values of the\n *   fields in the nested object will be saved in the nested object.\n * - A string starting with `fieldName.*.` treats `fieldName` as a map/dictionary data structure and allows to specify the encrypted fields of the\n *   values of the map. Note that the values of the map must be objects as well. The encrypted content of each map value is stored in that value.\n * - A string starting with `fieldName[].` treats `fieldName` as an array and allows to specify the encrypted fields of the values of the array.\n *   Note that the values of the array must be objects as well. The encrypted content of each array element is stored in that element.\n *\n * ## Example\n *\n * Consider the following object and encryption keys:\n * ```javascript\n * const obj = {\n *   a: { x: 0, y: 1 },\n *   b: \"hello\",\n *   c: [ { public: \"a\", secret: \"b\" }, { public: \"c\", secret: \"d\" } ],\n *   d: \"ok\",\n *   e: {\n *     info: \"something\",\n *     private: \"secret\",\n *     dataMap: {\n *       \"en\": {\n *         a: 1,\n *         b: 2\n *       },\n *       \"fr\": {\n *         a: 3,\n *         b: 4\n *       }\n *     }\n *   }\n * }\n * const encryptedFields = [\n *   \"a\",\n *   \"c[].secret\",\n *   \"d\",\n *   \"e.private\",\n *   \"e.datamap.*.a\"\n * ]\n * ```\n * If you use them with the crypt method you will get the following result:\n * ```json\n * {\n *   b: \"hello\",\n *   c: [\n *     { public: \"a\", encryptedSelf: \"...encrypted data of c[0]\" },\n *     { public: \"c\", encryptedSelf: \"...encrypted data of c[1]\" }\n *   ],\n *   e: {\n *     info: \"something\",\n *     dataMap: {\n *       \"en\": { b: 2, encryptedSelf: \"...encrypted data of e.dataMap['en']\" },\n *       \"fr\": { b: 4, encryptedSelf: \"...encrypted data of e.dataMap['fr']\" }\n *     },\n *     encryptedSelf: \"...encrypted data of e\"\n *   },\n *   encryptedSelf: \"...encrypted data of obj\"\n * }\n * ```\n *\n * ## Shortened representation\n *\n * You can also group encrypted fields having the same prefix by concatenating to the prefix the JSON representation of an array of all the postfixes.\n * For example the following encrypted fields:\n * ```javascript\n * const encryptedFields = [\"a.b.c.d.e.f1\", \"a.b.c.d.e.f2\", \"a.b.c.d.e.f3\", \"a.b.c.d.e.f4\"]\n * ```\n * can be shortened to\n * ```javascript\n * const encryptedFields = ['a.b.c.d.e.[\"f1\",\"f2\",\"f3\",\"f4\"]'] // Note the use of single quotes to avoid escaping the double quotes\n * ```\n * If you use the shortened representation you may need to escape nested json representations. In that case the use of `JSON.stringify` is\n * recommended.\n *\n * @param encryptedFields\n * @param path\n */\nexport function parseEncryptedFields(encryptedFields: string[], path: string): EncryptedFieldsManifest {\n  const groupedData = {\n    topLevelFields: new Set<string>(),\n    nestedObjectsKeys: {} as { [objectFieldName: string]: string[] },\n    mapsValuesKeys: {} as { [mapFieldName: string]: string[] },\n    arraysValuesKeys: {} as { [arrayFieldName: string]: string[] },\n  }\n  const encryptedFieldRegex = /^([_a-zA-Z][_a-zA-Z0-9]*)(?:(\\.\\*\\.|\\[]\\.|\\.)(?:[_a-zA-Z].*|\\[.*]))?$/\n  const addSubkeyToGroupedData = (\n    currFieldName: string,\n    currFieldSeparator: string,\n    currEncryptedField: string,\n    groupedDataKey: 'nestedObjectsKeys' | 'mapsValuesKeys' | 'arraysValuesKeys'\n  ) => {\n    const existingOrNew = groupedData[groupedDataKey][currFieldName] ?? (groupedData[groupedDataKey][currFieldName] = [])\n    const subKey = currEncryptedField.slice(currFieldName.length + currFieldSeparator.length)\n    if (subKey.startsWith('[')) {\n      let parsedJson: any[]\n      try {\n        parsedJson = JSON.parse(subKey)\n      } catch {\n        throw new Error(`Invalid encrypted field ${path}${currEncryptedField} (not a valid JSON subkey)`)\n      }\n      if (Array.isArray(parsedJson) && parsedJson.every((x) => typeof x == 'string')) {\n        parsedJson.forEach((x) => existingOrNew.push(x))\n      } else throw new Error(`Invalid encrypted field ${path}${currEncryptedField} (not an array of strings)`)\n    } else {\n      existingOrNew.push(subKey)\n    }\n  }\n  for (const currEncryptedField of encryptedFields) {\n    const currFieldMatch = currEncryptedField.match(encryptedFieldRegex)\n    if (!!currFieldMatch) {\n      const currFieldName = currFieldMatch[1]\n      const currFieldSeparator = currFieldMatch[2]\n      if (!currFieldSeparator) {\n        if (groupedData.topLevelFields.has(currFieldName)) throw new Error(`Duplicate encrypted field ${path}${currFieldName}`)\n        if (\n          !!groupedData.nestedObjectsKeys[currFieldName] ||\n          !!groupedData.mapsValuesKeys[currFieldName] ||\n          !!groupedData.arraysValuesKeys[currFieldName]\n        )\n          throw new Error(`Encrypted field appears multiple times as different nested types and or top-level-field: ${path}${currFieldName}`)\n        groupedData.topLevelFields.add(currFieldName)\n      } else if (currFieldSeparator == '.') {\n        if (\n          groupedData.topLevelFields.has(currFieldName) ||\n          !!groupedData.mapsValuesKeys[currFieldName] ||\n          !!groupedData.arraysValuesKeys[currFieldName]\n        )\n          throw new Error(`Encrypted field appears multiple times as different nested types and or top-level-field: ${path}${currFieldName}`)\n        addSubkeyToGroupedData(currFieldName, currFieldSeparator, currEncryptedField, 'nestedObjectsKeys')\n      } else if (currFieldSeparator == '.*.') {\n        if (\n          groupedData.topLevelFields.has(currFieldName) ||\n          !!groupedData.nestedObjectsKeys[currFieldName] ||\n          !!groupedData.arraysValuesKeys[currFieldName]\n        )\n          throw new Error(`Encrypted field appears multiple times as different nested types and or top-level-field: ${path}${currFieldName}`)\n        addSubkeyToGroupedData(currFieldName, currFieldSeparator, currEncryptedField, 'mapsValuesKeys')\n      } else if (currFieldSeparator == '[].') {\n        if (\n          groupedData.topLevelFields.has(currFieldName) ||\n          !!groupedData.nestedObjectsKeys[currFieldName] ||\n          !!groupedData.mapsValuesKeys[currFieldName]\n        )\n          throw new Error(`Encrypted field appears multiple times as different nested types and or top-level-field: ${path}${currFieldName}`)\n        addSubkeyToGroupedData(currFieldName, currFieldSeparator, currEncryptedField, 'arraysValuesKeys')\n      } else throw new Error(`Internal error: unknown separator ${currFieldSeparator} passed regex validation in ${path}${currEncryptedField}`)\n    } else throw new Error(`Invalid encrypted field ${path}${currEncryptedField}`)\n  }\n  return {\n    topLevelFields: Array.from(groupedData.topLevelFields).map((fieldName) => ({ fieldName, fieldPath: path + fieldName })),\n    nestedObjectsKeys: Object.fromEntries(\n      Object.entries(groupedData.nestedObjectsKeys).map(([fieldName, fieldNames]) => [\n        fieldName,\n        parseEncryptedFields(fieldNames, path + fieldName + '.'),\n      ])\n    ),\n    mapsValuesKeys: Object.fromEntries(\n      Object.entries(groupedData.mapsValuesKeys).map(([fieldName, fieldNames]) => [\n        fieldName,\n        parseEncryptedFields(fieldNames, path + fieldName + '.*.'),\n      ])\n    ),\n    arraysValuesKeys: Object.fromEntries(\n      Object.entries(groupedData.arraysValuesKeys).map(([fieldName, fieldNames]) => [\n        fieldName,\n        parseEncryptedFields(fieldNames, path + fieldName + '[].'),\n      ])\n    ),\n  }\n}\n\n/**\n * @internal this function is for internal use only and may be changed without notice\n * Encrypt the object graph recursively. Generally return an updated SHALLOW copy, although some fields may be deep copied if they also needed to be\n * recursively encrypted.\n * @param obj the object to encrypt\n * @param cryptor takes in input an object consisting only of the fields to encrypt of obj, and returns the encrypted object.\n * @param keys the keys to encrypt for the\n * @param path path of the current object, used for error messages.\n * @return a shallow copy of the object with a new encryptedSelfField and without the encrypted fields.\n */\nexport async function encryptObject(\n  obj: { [key: string]: any },\n  cryptor: (obj: { [key: string]: any }) => Promise<ArrayBuffer>,\n  keys: EncryptedFieldsManifest,\n  path: string = 'obj'\n): Promise<{ [key: string]: any }> {\n  const shallowClone = { ...obj }\n  const currEncryptedFields: { [key: string]: any } = {}\n  for (const { fieldName } of keys.topLevelFields) {\n    const fieldValue = shallowClone[fieldName]\n    if (fieldValue !== undefined) {\n      // we keep null values\n      currEncryptedFields[fieldName] = fieldValue\n      delete shallowClone[fieldName]\n    }\n  }\n  shallowClone['encryptedSelf'] = b2a(ua2string(await cryptor(currEncryptedFields)))\n  for (const [fieldName, subKeys] of Object.entries(keys.nestedObjectsKeys)) {\n    const fieldValue = shallowClone[fieldName]\n    if (fieldValue !== undefined && fieldValue !== null) {\n      if (!isPojo(fieldValue)) throw new Error(`Expected field ${path}.${fieldName} to be a non-array object`)\n      shallowClone[fieldName] = await encryptObject(fieldValue, cryptor, subKeys, path + '.' + fieldName)\n    }\n  }\n  for (const [mapFieldName, subKeys] of Object.entries(keys.mapsValuesKeys)) {\n    const fieldValue = shallowClone[mapFieldName]\n    if (fieldValue !== undefined && fieldValue !== null) {\n      if (!isPojo(fieldValue)) throw new Error(`Expected field ${path}.${mapFieldName} to be a non-array object`)\n      const newMap: { [key: string]: any } = {}\n      for (const [key, value] of Object.entries(fieldValue as object)) {\n        if (value === null || value === undefined) {\n          newMap[key] = value\n        } else {\n          if (!isPojo(value)) throw new Error(`Expected field ${path}.${mapFieldName}.${key} to be a non-array object`)\n          newMap[key] = await encryptObject(value, cryptor, subKeys, path + '.' + mapFieldName + '.' + key)\n        }\n      }\n      shallowClone[mapFieldName] = newMap\n    }\n  }\n  for (const [arrayFieldName, subKeys] of Object.entries(keys.arraysValuesKeys)) {\n    const fieldValue = shallowClone[arrayFieldName]\n    if (fieldValue !== undefined && fieldValue !== null) {\n      if (!Array.isArray(fieldValue)) throw new Error(`Expected field ${path}.${arrayFieldName} to be an array`)\n      const newArray: any[] = Array(fieldValue.length)\n      for (let i = 0; i < fieldValue.length; i++) {\n        const value = fieldValue[i]\n        if (value === null || value === undefined) {\n          newArray[i] = value\n        } else {\n          if (!isPojo(value)) throw new Error(`Expected field ${path}.${arrayFieldName}[${i}] to be a non-array object`)\n          newArray[i] = await encryptObject(value, cryptor, subKeys, path + '.' + arrayFieldName + '[' + i + ']')\n        }\n      }\n      shallowClone[arrayFieldName] = newArray\n    }\n  }\n  return shallowClone\n}\n\n/**\n * Check if value is a non-null object that is not an array.\n */\nfunction isPojo(value: any): boolean {\n  // This break if for some reason we have object versions of String/Number/Boolean\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\n/**\n * @internal this function is for internal use only and may be changed without notice\n * Decrypt object graph recursively.\n *\n * @param obj the object to decrypt\n * @param decryptor the decryptor function (returns a promise)\n * @return a deep copy of the object with the decrypted fields and removed encryptedSelf field\n */\nexport async function decryptObject(\n  obj: { [key: string]: any },\n  decryptor: (obj: Uint8Array) => Promise<{ [key: string]: any }>\n): Promise<{ [key: string]: any }> {\n  const copy: { [key: string]: any } = {}\n  for (const [key, value] of Object.entries(obj)) {\n    if (key === 'encryptedSelf') {\n      copy[key] = value\n    } else if (typeof value === 'object' && value !== null) {\n      if (Array.isArray(value)) {\n        // Note: nested arrays (and primitives) are returned as is and not they are not recursively decrypted. This is because we currently do not\n        // support encryption of elements from arrays in arrays (we only support arrays in objects in arrays). In future this may change.\n        copy[key] = await Promise.all(value.map((v) => (isPojo(v) ? decryptObject(v, decryptor) : v)))\n      } else {\n        copy[key] = await decryptObject(value, decryptor)\n      }\n    } else {\n      copy[key] = value\n    }\n  }\n  if (obj.encryptedSelf) {\n    const decrypted = await decryptor(string2ua(a2b(obj.encryptedSelf)))\n    return { ...copy, ...decrypted }\n  } else return copy\n}\n\n/**\n * Extracts the full jwk key pair from the jwk representation of the private key.\n * @param privateKeyJwk private key in jwk representation\n * @throws if the key is missing the public modulus or public exponent.\n */\nexport function keyPairFromPrivateKeyJwk(privateKeyJwk: JsonWebKey): KeyPair<JsonWebKey> {\n  if (!privateKeyJwk.n || !privateKeyJwk.e) throw new Error('Incomplete private JsonWebKey: missing public modulus and/or exponent')\n  return {\n    privateKey: privateKeyJwk,\n    publicKey: spkiToJwk(hex2ua(jwk2spki(privateKeyJwk))),\n  }\n}\n"]}