@icure/api 7.1.13 → 8.0.0-RC.1

package/icc-x-api/crypto/BaseExchangeDataManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseExchangeDataManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/BaseExchangeDataManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,mEAA+D;AAE/D,+CAA2C;AAC3C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B,oCAA6E;AAC7E,4BAA2B;AAC3B,mCAA4D;AAE5D;;;;GAIG;AACH,MAAa,uBAAuB;IAClC,YACW,GAAuB,EACf,YAA8B,EAC9B,UAA4B,EAC5B,gCAAyC;QAHjD,QAAG,GAAH,GAAG,CAAoB;QACf,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,eAAU,GAAV,UAAU,CAAkB;QAC5B,qCAAgC,GAAhC,gCAAgC,CAAS;IACzD,CAAC;IAEJ;;;;;;OAMG;IACG,8CAA8C;;;YAClD,IAAI,CAAC,IAAI,CAAC,gCAAgC;gBAAE,OAAO,SAAS,CAAA;YAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAC5F,MAAM,YAAY,GAAG,MAAA,YAAY,CAAC,IAAI,mCAAI,EAAE,CAAA;YAC5C,OAAO,MAAA,YAAY,CAAC,WAAW,0CAAE,aAAa,EAAE;gBAC9C,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACrH,IAAI,YAAY,CAAC,IAAI;oBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;aAC/D;YACD,OAAO,YAAY,CAAA;;KACpB;IAED;;;;;OAKG;IACG,sCAAsC,CAAC,WAAmB,EAAE,UAAkB;;YAClF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACnF,CAAC;KAAA;IAED;;;;OAIG;IACG,mBAAmB,CAAC,cAAsB;;YAC9C,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpE,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;oBACjD,OAAO,SAAS,CAAA;iBACjB;;oBAAM,MAAM,CAAC,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,0BAA0B,CAC9B,YAA4B,EAC5B,kBAAoF;;YAEpF,MAAM,QAAQ,GAAmB,EAAE,CAAA;YACnC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;gBAC7B,IAAI,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;aACvF;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC;KAAA;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,YAA0B,EAC1B,kBAAoF;;YAEpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,IAAI,YAAY,CAAC,SAAS,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAA;YACxD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE;gBACpE,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC/D,IAAI,eAAe,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,eAAe,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAA;aACpI;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,6BAA6B,CACjC,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACzD,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,sBAAsB,CAC1B,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACjD,CAAA;QACH,CAAC;KAAA;IAEa,sBAAsB,CAClC,YAA4B,EAC5B,cAAsE,EACtE,qBAAuF,EACvF,kBAA0D;;YAK1D,MAAM,qBAAqB,GAAQ,EAAE,CAAA;YACrC,MAAM,iBAAiB,GAAmB,EAAE,CAAA;YAC5C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;gBAC7B,IAAI;oBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAA;oBAClF,IAAI,SAAS,EAAE;wBACb,qBAAqB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAA;qBAChE;yBAAM;wBACL,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;qBAC3B;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;iBAC3B;aACF;YACD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAA;QACrD,CAAC;KAAA;IAEa,UAAU,CACtB,aAAyD,EACzD,cAAwE;;;YAExE,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC7E,uCACK,IAAI,KACP,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,IACvE;YACH,CAAC,EAAE,EAA4D,CAAC,CAAA;YAChE,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;gBAC3D,IAAI;oBACF,MAAM,GAAG,GAAG,MAAA,sBAAsB,CAAC,EAAE,CAAC,0CAAE,UAAU,CAAA;oBAClD,IAAI,GAAG;wBAAE,OAAO,IAAA,cAAM,EAAC,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;iBAC5F;gBAAC,OAAO,CAAC,EAAE;oBACV,uBAAuB;iBACxB;aACF;;KACF;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,UAAkB,EAClB,aAA0D,EAC1D,cAA2D,EAC3D,qBAEI,EAAE;;;YAMN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;gBAC7E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;aAChE;YACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAA;YACpD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAA;YACpE,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjG,MAAM,4BAA4B,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjH,MAAM,gBAAgB,GAAG;gBACvB,EAAE,EAAE,MAAA,kBAAkB,CAAC,EAAE,mCAAI,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;gBACzD,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,oBAAoB;gBACjC,mBAAmB,EAAE,4BAA4B;aAClD,CAAA;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,CAAA;YACtG,MAAM,YAAY,GAAG,IAAI,2BAAY,iCAAM,gBAAgB,KAAE,SAAS,IAAG,CAAA;YACzE,OAAO;gBACL,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,GAAG;gBAC5B,mBAAmB,EAAE,mBAAmB,CAAC,MAAM;aAChD,CAAA;;KACF;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,qBAAqB,CACzB,YAA0B,EAC1B,cAAsE,EACtE,iBAA8D,EAC9D,aAA0D,EAC1D,kBAAoF;;YASpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;YACtF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;YACtG,IAAI,CAAC,cAAc,IAAI,CAAC,sBAAsB;gBAAE,OAAO,SAAS,CAAA;YAChE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;YAChF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAA;YACxG,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;YACjF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAA;YACjF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACxI,IAAI,CAAC,cAAc,CAAC,MAAM;gBAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;YACrF,MAAM,+BAA+B,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;gBACxE,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;gBAC/B,OAAO,GAAG,CAAA;YACZ,CAAC,EAAE,EAAiD,CAAC,CAAA;YACrD,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACzI,MAAM,mBAAmB,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YACrD,mBAAmB,CAAC,WAAW,mCAC1B,YAAY,CAAC,WAAW,GACxB,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC,CACrF,CAAA;YACD,mBAAmB,CAAC,mBAAmB,mCAClC,YAAY,CAAC,mBAAmB,GAChC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,+BAA+B,CAAC,CAAC,CAC7F,CAAA;YACD,IAAI,UAAU,EAAE;gBACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAA;gBACjE,mBAAmB,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;aAC1F;YACD,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,2BAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;QACrI,CAAC;KAAA;IAED,sGAAsG;IACtG,mHAAmH;IACnH,iBAAiB;IACH,WAAW,CAAC,YAKzB;;YACC,SAAS,UAAU,CAAC,GAA4B;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;qBACpB,IAAI,EAAE;qBACN,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;oBACtB,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACrC,CAAC,EAAE,EAAwB,CAAC,CAAA;YAChC,CAAC;YACD,MAAM,UAAU,GAAG;gBACjB,CAAC,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC;gBACrC,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC;gBACnC,CAAC,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBACrD,CAAC,qBAAqB,EAAE,UAAU,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;aACtE,CAAA;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAA,gBAAQ,EAAC,QAAQ,CAAC,CAAC,CAAA;QACnD,CAAC;KAAA;IAED,+BAA+B;IACjB,mBAAmB;;YAI/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACtD,OAAO;gBACL,GAAG,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;gBAC3C,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEa,iBAAiB,CAAC,cAA2B;;YACzD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;QACnE,CAAC;KAAA;IAED,wCAAwC;IAC1B,2BAA2B;;YAIvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACtD,OAAO;gBACL,MAAM,EAAE,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC;gBACtD,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEO,yBAAyB,CAAC,cAA2B;QAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,cAAc,CAAC,CAAC,CAAA;IAChD,CAAC;IAEa,mBAAmB,CAC/B,OAAoB,EACpB,IAAmD;;YAEnD,MAAM,GAAG,GAA+C,EAAE,CAAA;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,gBAAQ,EAAC,IAAA,cAAM,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;aAClI;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,gBAAgB,CAC5B,OAAoB,EACpB,IAAiD;;YAEjD,MAAM,GAAG,GAA6C,EAAE,CAAA;YACxD,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;aAC/E;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;CACF;AArXD,0DAqXC","sourcesContent":["import { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair } from './RSA'\nimport { ExchangeData } from '../../icc-api/model/ExchangeData'\nimport { IccExchangeDataApi } from '../../icc-api/api/IccExchangeDataApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport XHRError = XHR.XHRError\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { b64_2ua, hex2ua, ua2b64, ua2hex, ua2utf8, utf8_2ua } from '../utils'\nimport * as _ from 'lodash'\nimport { fingerprintV1toV2, fingerprintIsV1 } from './utils'\n\n/**\n * @internal this class is intended for internal use only and may be modified without notice\n * Functions to create and get exchange data.\n * The methods of this api require to pass the appropriate keys for encryption/decryption manually.\n */\nexport class BaseExchangeDataManager {\n  constructor(\n    readonly api: IccExchangeDataApi,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly primitives: CryptoPrimitives,\n    private readonly selfRequiresAnonymousDelegations: boolean\n  ) {}\n\n  /**\n   * Get all the exchange data where the current data owner is the delegator or the delegate. However, some data owners, generally HCPs, may have a\n   * prohibitively high amount of exchange data. If the crypto strategies specify that the current data owner requires anonymous delegation this\n   * method returns all the exchange data found for the data owner, else the method returns undefined.\n   * @return all the exchange data for the current data owner or undefined if the crypto strategies don't allow to retrieve all data for the current\n   * data owner.\n   */\n  async getAllExchangeDataForCurrentDataOwnerIfAllowed(): Promise<ExchangeData[] | undefined> {\n    if (!this.selfRequiresAnonymousDelegations) return undefined\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    let latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, undefined, 1000)\n    const allRetrieved = latestResult.rows ?? []\n    while (latestResult.nextKeyPair?.startKeyDocId) {\n      latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, latestResult.nextKeyPair.startKeyDocId, 1000)\n      if (latestResult.rows) allRetrieved.push(...latestResult.rows)\n    }\n    return allRetrieved\n  }\n\n  /**\n   * Get all exchange data for the provided delegator-delegate pair.\n   * @param delegatorId id of a delegator data owner.\n   * @param delegateId id of a delegate data owner.\n   * @return all exchange data for the provided delegator-delegate pair.\n   */\n  async getExchangeDataByDelegatorDelegatePair(delegatorId: string, delegateId: string): Promise<ExchangeData[]> {\n    return await this.api.getExchangeDataByDelegatorDelegate(delegatorId, delegateId)\n  }\n\n  /**\n   * Get the exchange data with the provided id.\n   * @param exchangeDataId id of the exchange data.\n   * @return the exchange data with the provided id or undefined if no exchange data with such id could be found.\n   */\n  async getExchangeDataById(exchangeDataId: string): Promise<ExchangeData | undefined> {\n    return await this.api.getExchangeDataById(exchangeDataId).catch((e) => {\n      if (e instanceof XHRError && e.statusCode === 404) {\n        return undefined\n      } else throw e\n    })\n  }\n\n  /**\n   * Filters exchange data returning only the instances that could be verified using their signature and the provided verification\n   * keys.\n   * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)\n   * will always be unverified.\n   * @param exchangeData the exchange data to verify.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the exchange data which could be verified given his signature and the available verification keys.\n   * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.\n   */\n  async filterVerifiedExchangeData(\n    exchangeData: ExchangeData[],\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<ExchangeData[]> {\n    const verified: ExchangeData[] = []\n    for (const ed of exchangeData) {\n      if (await this.verifyExchangeData(ed, (x) => getVerificationKey(x))) verified.push(ed)\n    }\n    return verified\n  }\n\n  /**\n   * Verifies the authenticity of the exchange data by checking the signature.\n   * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)\n   * will always be unverified.\n   * @param exchangeData the exchange data to verify.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the exchange data which could be verified given his signature and the available verification keys.\n   * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.\n   */\n  async verifyExchangeData(\n    exchangeData: ExchangeData,\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<boolean> {\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    if (exchangeData.delegator !== dataOwnerId) return false\n    const signatureData = await this.bytesToSign(exchangeData)\n    for (const [fp, signature] of Object.entries(exchangeData.signature)) {\n      const verificationKey = await getVerificationKey(fp.slice(-32))\n      if (verificationKey && (await this.primitives.RSA.verifySignature(verificationKey, b64_2ua(signature), signatureData))) return true\n    }\n    return false\n  }\n\n  /**\n   * Extracts and decrypts the access control secret from the provided exchange data.\n   * These need to be hashed together with the entity class and confidentiality level in order to get the actual access control key\n   * which will be sent to the server.\n   * @param exchangeData the exchange data from which to extract access control secrets.\n   * @param decryptionKeys rsa key pairs to use for decryption of the access control secret.\n   * @return an object composed of:\n   * - successfulDecryptions: array of all successfully decrypted access control keys\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptAccessControlSecret(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: string[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.accessControlSecret,\n      (d) => this.importAccessControlSecret(new Uint8Array(d))\n    )\n  }\n\n  /**\n   * Extract and decrypts the exchange keys from the provided exchange data.\n   * @param exchangeData the exchange data from which to extract exchange keys.\n   * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.\n   * @return an object composed of:\n   * - successfulDecryptions: array containing the successfully decrypted exchange keys.\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptExchangeKeys(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.exchangeKey,\n      (d) => this.importExchangeKey(new Uint8Array(d))\n    )\n  }\n\n  private async tryDecryptExchangeData<T>(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    encryptedDataSelector: (data: ExchangeData) => { [keyPairFingerprint: string]: string },\n    unmarshalDecrypted: (decrypted: ArrayBuffer) => Promise<T>\n  ): Promise<{\n    successfulDecryptions: T[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    const successfulDecryptions: T[] = []\n    const failedDecryptions: ExchangeData[] = []\n    for (const ed of exchangeData) {\n      try {\n        const decrypted = await this.tryDecrypt(encryptedDataSelector(ed), decryptionKeys)\n        if (decrypted) {\n          successfulDecryptions.push(await unmarshalDecrypted(decrypted))\n        } else {\n          failedDecryptions.push(ed)\n        }\n      } catch (e) {\n        failedDecryptions.push(ed)\n      }\n    }\n    return { successfulDecryptions, failedDecryptions }\n  }\n\n  private async tryDecrypt(\n    encryptedData: { [keyPairFingerprintV2: string]: string },\n    decryptionKeys: { [publicKeyFingerprintV1: string]: KeyPair<CryptoKey> }\n  ): Promise<ArrayBuffer | undefined> {\n    const decryptionKeysWithV2Fp = Object.keys(decryptionKeys).reduce((prev, fp) => {\n      return {\n        ...prev,\n        [fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp]: decryptionKeys[fp],\n      }\n    }, {} as { [publicKeyFingerprint: string]: KeyPair<CryptoKey> })\n    for (const [fp, encrypted] of Object.entries(encryptedData)) {\n      try {\n        const key = decryptionKeysWithV2Fp[fp]?.privateKey\n        if (key) return hex2ua(ua2utf8(await this.primitives.RSA.decrypt(key, b64_2ua(encrypted))))\n      } catch (e) {\n        // Try with another key\n      }\n    }\n  }\n\n  /**\n   * Creates exchange data from the current data owner to the provided delegate, uploading the newly created exchange data to the cloud.\n   * This assumes that the keys have been verified.\n   * @param delegateId id of the delegate for the new exchange data.\n   * @param signatureKeys private keys to use for signing the created data.\n   * @param encryptionKeys public keys to use for the encryption of the exchange data (from delegator and delegate).\n   * @param optionalAttributes optional precalculated attributes for the creation of data\n   * @return the newly created exchange data, and its decrypted exchange key and access control secret.\n   */\n  async createExchangeData(\n    delegateId: string,\n    signatureKeys: { [keyPairFingerprint: string]: CryptoKey },\n    encryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    optionalAttributes: {\n      id?: string\n    } = {}\n  ): Promise<{\n    exchangeData: ExchangeData\n    exchangeKey: CryptoKey\n    accessControlSecret: string\n  }> {\n    if (!Object.keys(signatureKeys).length || !Object.keys(encryptionKeys).length) {\n      throw new Error('Must specify at least one signature key and ')\n    }\n    const exchangeKey = await this.generateExchangeKey()\n    const accessControlSecret = await this.generateAccessControlSecret()\n    const encryptedExchangeKey = await this.encryptDataWithKeys(exchangeKey.rawBytes, encryptionKeys)\n    const encryptedAccessControlSecret = await this.encryptDataWithKeys(accessControlSecret.rawBytes, encryptionKeys)\n    const baseExchangeData = {\n      id: optionalAttributes.id ?? this.primitives.randomUuid(),\n      delegator: await this.dataOwnerApi.getCurrentDataOwnerId(),\n      delegate: delegateId,\n      exchangeKey: encryptedExchangeKey,\n      accessControlSecret: encryptedAccessControlSecret,\n    }\n    const signature = await this.signDataWithKeys(await this.bytesToSign(baseExchangeData), signatureKeys)\n    const exchangeData = new ExchangeData({ ...baseExchangeData, signature })\n    return {\n      exchangeData: await this.api.createExchangeData(exchangeData),\n      exchangeKey: exchangeKey.key,\n      accessControlSecret: accessControlSecret.secret,\n    }\n  }\n\n  /**\n   * Updates existing exchange data and uploads it to the cloud in order to share it also with additional public keys, useful for example in cases\n   * where one of the data owners involved in the exchange data has lost one of his keys.\n   * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.\n   * This method assumes that the new encryption keys have been verified.\n   * If the current data owner is also the delegator of the provided exchange data and at least one of the verification keys can be used to\n   * validate the current exchange data then the signature will be updated using the signature keys.\n   * Instead, if the current data owner is not the delegator of the provided exchange data, or the exchange data could not be verified using\n   * the provided verification keys then the updated exchange data will become unverified, and won't ever be verifiable again.\n   * @param exchangeData exchange data to update.\n   * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.\n   * @param signatureKeys keys to use for the new signature of the updated exchange data.\n   * @param newEncryptionKeys new keys to add to the exchange data.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not\n   * be decrypted and the exchange data could not be updated.\n   */\n  async tryUpdateExchangeData(\n    exchangeData: ExchangeData,\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    newEncryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    signatureKeys: { [keyPairFingerprint: string]: CryptoKey },\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<\n    | {\n        exchangeData: ExchangeData\n        exchangeKey: CryptoKey\n        accessControlSecret: string\n      }\n    | undefined\n  > {\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const rawExchangeKey = await this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys)\n    const rawAccessControlSecret = await this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys)\n    if (!rawExchangeKey || !rawAccessControlSecret) return undefined\n    const exchangeKey = await this.importExchangeKey(new Uint8Array(rawExchangeKey))\n    const accessControlSecret = await this.importAccessControlSecret(new Uint8Array(rawAccessControlSecret))\n    const existingExchangeKeyEntries = new Set(Object.keys(exchangeData.exchangeKey))\n    const existingAcsEntries = new Set(Object.keys(exchangeData.accessControlSecret))\n    const missingEntries = Object.keys(newEncryptionKeys).filter((fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp))\n    if (!missingEntries.length) return { exchangeData, exchangeKey, accessControlSecret }\n    const encryptionKeysForMissingEntries = missingEntries.reduce((obj, fp) => {\n      obj[fp] = newEncryptionKeys[fp]\n      return obj\n    }, {} as { [keyPairFingerprint: string]: CryptoKey })\n    const isVerified = exchangeData.delegator == dataOwnerId && (await this.verifyExchangeData(exchangeData, (fp) => getVerificationKey(fp)))\n    const updatedExchangeData = _.cloneDeep(exchangeData)\n    updatedExchangeData.exchangeKey = {\n      ...exchangeData.exchangeKey,\n      ...(await this.encryptDataWithKeys(rawExchangeKey, encryptionKeysForMissingEntries)),\n    }\n    updatedExchangeData.accessControlSecret = {\n      ...exchangeData.accessControlSecret,\n      ...(await this.encryptDataWithKeys(rawAccessControlSecret, encryptionKeysForMissingEntries)),\n    }\n    if (isVerified) {\n      const newDataToSign = await this.bytesToSign(updatedExchangeData)\n      updatedExchangeData.signature = await this.signDataWithKeys(newDataToSign, signatureKeys)\n    }\n    return { exchangeData: await this.api.modifyExchangeData(new ExchangeData(updatedExchangeData)), exchangeKey, accessControlSecret }\n  }\n\n  // Gets a byte representation of the parts of exchange data which should be included in the signature.\n  // Equivalent json representations of the exchange data should provide the same bytes (even if the order of entries\n  // is different).\n  private async bytesToSign(exchangeData: {\n    delegate: string\n    delegator: string\n    exchangeKey: { [k: string]: string }\n    accessControlSecret: { [k: string]: string }\n  }): Promise<ArrayBuffer> {\n    function sortObject(obj: { [k: string]: string }): [string, string][] {\n      return Object.keys(obj)\n        .sort()\n        .reduce((sorted, key) => {\n          return [...sorted, [key, obj[key]]]\n        }, [] as [string, string][])\n    }\n    const signObject = [\n      ['delegator', exchangeData.delegator],\n      ['delegate', exchangeData.delegate],\n      ['exchangeKey', sortObject(exchangeData.exchangeKey)],\n      ['accessControlSecret', sortObject(exchangeData.accessControlSecret)],\n    ]\n    const signJson = JSON.stringify(signObject)\n    return this.primitives.sha256(utf8_2ua(signJson))\n  }\n\n  // Generates a new exchange key\n  private async generateExchangeKey(): Promise<{\n    key: CryptoKey // the imported key\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = await this.primitives.randomBytes(32)\n    return {\n      key: await this.importExchangeKey(rawBytes),\n      rawBytes,\n    }\n  }\n\n  private async importExchangeKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey> {\n    return await this.primitives.AES.importKey('raw', decryptedBytes)\n  }\n\n  // Generates a new access control secret\n  private async generateAccessControlSecret(): Promise<{\n    secret: string // the imported secret\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = await this.primitives.randomBytes(16)\n    return {\n      secret: await this.importAccessControlSecret(rawBytes),\n      rawBytes,\n    }\n  }\n\n  private importAccessControlSecret(decryptedBytes: ArrayBuffer): Promise<string> {\n    return Promise.resolve(ua2hex(decryptedBytes))\n  }\n\n  private async encryptDataWithKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprintV1: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprintV2: string]: string }> {\n    const res: { [keyPairFingerprintV2: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp] = ua2b64(await this.primitives.RSA.encrypt(key, utf8_2ua(ua2hex(rawData))))\n    }\n    return res\n  }\n\n  private async signDataWithKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprint: string]: string }> {\n    const res: { [keyPairFingerprint: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fp] = ua2b64(await this.primitives.RSA.sign(key, new Uint8Array(rawData)))\n    }\n    return res\n  }\n}\n"]}

package/icc-x-api/crypto/BaseExchangeKeysManager.d.ts

@@ -2,7 +2,6 @@ import { KeyPair } from './RSA';
 import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
 import { CryptoPrimitives } from './CryptoPrimitives';
 import { IccDeviceApi, IccHcpartyApi, IccPatientApi } from '../../icc-api';
-import { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub';
 import { DataOwnerTypeEnum } from '../../icc-api/model/DataOwnerTypeEnum';
 /**
  * @internal This class is meant only for internal use and may be changed without notice.
@@ -17,21 +16,6 @@ export declare class BaseExchangeKeysManager {
     private readonly patientBaseApi;
     private readonly deviceBaseApi;
     constructor(primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, hcpartyBaseApi: IccHcpartyApi, patientBaseApi: IccPatientApi, deviceBaseApi: IccDeviceApi);
-    /**
-     * Creates a new exchange key from the current data owner to a delegate, or updates an existing one allowing additional public keys to access it.
-     * @param delegateId the delegate data owner id.
-     * @param delegatorMainKeyPair main key pair for the delegator. The private key will be used for the decryption of the existing key in case of
-     * update, and the public key will be used as entry key of the aesExchangeKey map
-     * @param additionalPublicKeys all public keys of key pairs other than {@link delegatorMainKeyPair} that need to have access to the exchange key.
-     * Can be a mix of crypto keys and full hex-encoded spki format (no fingerprints).
-     * @return the exchange key for the delegator-delegate-delegatorKey triple (new or existing) and the updated delegator.
-     */
-    createOrUpdateEncryptedExchangeKeyTo(delegateId: string, delegatorMainKeyPair: KeyPair<CryptoKey>, additionalPublicKeys: {
-        [keyFingerprint: string]: CryptoKey;
-    }): Promise<{
-        updatedDelegator: CryptoActorStubWithType;
-        key: CryptoKey;
-    }>;
     /**
      * Updates the aes exchange keys between the current data owner and another data owner to allow the other data owner to access the exchange key
      * using his new public key. Note that this will make existing exchange keys from the other data owner to the current data owner invalid for
@@ -118,7 +102,5 @@ export declare class BaseExchangeKeysManager {
      */
     private tryDecryptExchangeKeyWith;
     private updateLegacyExchangeKeys;
-    private updateExchangeKeys;
     private combineLegacyHcpKeysWithAesExchangeKeys;
-    private fixAesExchangeKeyEntriesToFingerprints;
 }

package/icc-x-api/crypto/BaseExchangeKeysManager.js

@@ -11,8 +11,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseExchangeKeysManager = void 0;
 const utils_1 = require("../utils");
-const CryptoActorStub_1 = require("../../icc-api/model/CryptoActorStub");
-const DataOwnerTypeEnum_1 = require("../../icc-api/model/DataOwnerTypeEnum");
+const utils_2 = require("./utils");
 /**
  * @internal This class is meant only for internal use and may be changed without notice.
  * Functions to create and get exchange keys.
@@ -27,65 +26,6 @@ class BaseExchangeKeysManager {
         this.patientBaseApi = patientBaseApi;
         this.deviceBaseApi = deviceBaseApi;
     }
-    /**
-     * Creates a new exchange key from the current data owner to a delegate, or updates an existing one allowing additional public keys to access it.
-     * @param delegateId the delegate data owner id.
-     * @param delegatorMainKeyPair main key pair for the delegator. The private key will be used for the decryption of the existing key in case of
-     * update, and the public key will be used as entry key of the aesExchangeKey map
-     * @param additionalPublicKeys all public keys of key pairs other than {@link delegatorMainKeyPair} that need to have access to the exchange key.
-     * Can be a mix of crypto keys and full hex-encoded spki format (no fingerprints).
-     * @return the exchange key for the delegator-delegate-delegatorKey triple (new or existing) and the updated delegator.
-     */
-    createOrUpdateEncryptedExchangeKeyTo(delegateId, delegatorMainKeyPair, additionalPublicKeys) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const delegatorId = yield this.dataOwnerApi.getCurrentDataOwnerId();
-            return yield (0, utils_1.notConcurrent)(this.generateKeyConcurrencyMap, delegatorId, () => __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
-                const delegator = CryptoActorStub_1.CryptoActorStubWithType.fromDataOwner(yield this.dataOwnerApi.getCurrentDataOwner());
-                const delegate = delegatorId === delegateId ? delegator : yield this.dataOwnerApi.getCryptoActorStub(delegateId);
-                const mainDelegatorKeyPairPubHex = (0, utils_1.ua2hex)(yield this.primitives.RSA.exportKey(delegatorMainKeyPair.publicKey, 'spki'));
-                let exchangeKey = undefined;
-                const existingExchangeKey = (_d = (_c = (_b = (_a = delegator.stub.aesExchangeKeys) === null || _a === void 0 ? void 0 : _a[mainDelegatorKeyPairPubHex]) === null || _b === void 0 ? void 0 : _b[delegateId]) === null || _c === void 0 ? void 0 : _c[mainDelegatorKeyPairPubHex.slice(-32)]) !== null && _d !== void 0 ? _d : (mainDelegatorKeyPairPubHex === delegator.stub.publicKey ? (_f = (_e = delegator.stub.hcPartyKeys) === null || _e === void 0 ? void 0 : _e[delegateId]) === null || _f === void 0 ? void 0 : _f[0] : undefined);
-                if (existingExchangeKey) {
-                    exchangeKey = yield this.tryDecryptExchangeKeyWith(existingExchangeKey, delegatorMainKeyPair, undefined);
-                    if (!exchangeKey)
-                        throw new Error(`Failed to decrypt existing exchange key for update of ${mainDelegatorKeyPairPubHex.slice(-32)}@${delegatorId}->${delegateId}`);
-                    const existingAesExchangeKey = (_h = (_g = delegator.stub.aesExchangeKeys) === null || _g === void 0 ? void 0 : _g[mainDelegatorKeyPairPubHex]) === null || _h === void 0 ? void 0 : _h[delegateId];
-                    if (existingAesExchangeKey) {
-                        const existingPublicKeysSet = new Set(existingExchangeKey);
-                        if (Object.keys(additionalPublicKeys).every((fp) => existingPublicKeysSet.has(fp)))
-                            return {
-                                updatedDelegator: delegator,
-                                key: exchangeKey.key,
-                            };
-                    }
-                }
-                const allPublicKeys = Object.assign(Object.assign({}, additionalPublicKeys), { [mainDelegatorKeyPairPubHex.slice(-32)]: delegatorMainKeyPair.publicKey });
-                const encryptedKeyInfo = yield this.encryptExchangeKey(exchangeKey, allPublicKeys);
-                let updatedDelegatorPublicKey;
-                if (delegator.stub.publicKey == '') {
-                    if (Object.entries((_j = delegator.stub.hcPartyKeys) !== null && _j !== void 0 ? _j : {}).length > 0)
-                        throw new Error(`Data owner ${delegator.stub.id} has "" as public key but has non-empty hcPartyKeys`);
-                    updatedDelegatorPublicKey = mainDelegatorKeyPairPubHex;
-                }
-                else {
-                    updatedDelegatorPublicKey = (_k = delegator.stub.publicKey) !== null && _k !== void 0 ? _k : mainDelegatorKeyPairPubHex;
-                }
-                const updatedStub = Object.assign(Object.assign({}, delegator.stub), { aesExchangeKeys: yield this.updateExchangeKeys(delegator, delegate, mainDelegatorKeyPairPubHex, encryptedKeyInfo.encryptedExchangeKey), publicKey: updatedDelegatorPublicKey });
-                if (delegator.stub.publicKey === mainDelegatorKeyPairPubHex) {
-                    updatedStub.hcPartyKeys = this.updateLegacyExchangeKeys(delegator, delegate, encryptedKeyInfo.encryptedExchangeKey);
-                }
-                const updatedDelegator = yield this.dataOwnerApi.modifyCryptoActorStub({
-                    type: delegator.type,
-                    stub: updatedStub,
-                });
-                return {
-                    key: encryptedKeyInfo.exchangeKey,
-                    updatedDelegator,
-                };
-            }));
-        });
-    }
     /**
      * Updates the aes exchange keys between the current data owner and another data owner to allow the other data owner to access the exchange key
      * using his new public key. Note that this will make existing exchange keys from the other data owner to the current data owner invalid for
@@ -97,9 +37,13 @@ class BaseExchangeKeysManager {
     giveAccessBackTo(otherDataOwner, newDataOwnerPublicKey, keyPairsByFingerprint) {
         return __awaiter(this, void 0, void 0, function* () {
             const selfId = yield this.dataOwnerApi.getCurrentDataOwnerId();
-            const newPublicKey = yield this.primitives.RSA.importKey('spki', (0, utils_1.hex2ua)(newDataOwnerPublicKey), ['encrypt']);
-            yield this.extendForGiveAccessBackTo(selfId, otherDataOwner, newDataOwnerPublicKey.slice(-32), newPublicKey, keyPairsByFingerprint);
-            yield this.extendForGiveAccessBackTo(otherDataOwner, selfId, newDataOwnerPublicKey.slice(-32), newPublicKey, keyPairsByFingerprint);
+            const other = yield this.dataOwnerApi.getCryptoActorStub(otherDataOwner);
+            const newKeyHashVersion = (0, utils_2.getShaVersionForKey)(other.stub, newDataOwnerPublicKey);
+            if (!newKeyHashVersion)
+                throw new Error(`Public key not found for data owner ${otherDataOwner}`);
+            const newPublicKey = yield this.primitives.RSA.importKey('spki', (0, utils_1.hex2ua)(newDataOwnerPublicKey), ['encrypt'], newKeyHashVersion);
+            yield this.extendForGiveAccessBackTo(selfId, otherDataOwner, (0, utils_2.fingerprintV1)(newDataOwnerPublicKey), newPublicKey, keyPairsByFingerprint);
+            yield this.extendForGiveAccessBackTo(otherDataOwner, selfId, (0, utils_2.fingerprintV1)(newDataOwnerPublicKey), newPublicKey, keyPairsByFingerprint);
         });
     }
     /**
@@ -138,13 +82,11 @@ class BaseExchangeKeysManager {
             if (otherOwnerTypes.length === 0)
                 throw new Error('otherOwnerTypes must not be empty!');
             const keysToOwner = yield Promise.all([
-                otherOwnerTypes.find((x) => x === DataOwnerTypeEnum_1.DataOwnerTypeEnum.Hcp)
-                    ? this.hcpartyBaseApi.getAesExchangeKeysForDelegate(dataOwnerId).catch(() => { })
-                    : Promise.resolve({}),
-                otherOwnerTypes.find((x) => x === DataOwnerTypeEnum_1.DataOwnerTypeEnum.Patient)
+                otherOwnerTypes.find((x) => x === 'hcp') ? this.hcpartyBaseApi.getAesExchangeKeysForDelegate(dataOwnerId).catch(() => { }) : Promise.resolve({}),
+                otherOwnerTypes.find((x) => x === 'patient')
                     ? this.patientBaseApi.getPatientAesExchangeKeysForDelegate(dataOwnerId).catch(() => { })
                     : Promise.resolve({}),
-                otherOwnerTypes.find((x) => x === DataOwnerTypeEnum_1.DataOwnerTypeEnum.Device)
+                otherOwnerTypes.find((x) => x === 'device')
                     ? this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(dataOwnerId).catch(() => { })
                     : Promise.resolve({}),
             ]).then(([a, b, c]) => (Object.assign(Object.assign(Object.assign({}, a), b), c)));
@@ -315,13 +257,6 @@ class BaseExchangeKeysManager {
         else
             return delegator.stub.hcPartyKeys;
     }
-    updateExchangeKeys(delegator, delegate, mainDelegatorKeyPairPubHex, encryptedKeyMap) {
-        var _a, _b, _c;
-        return __awaiter(this, void 0, void 0, function* () {
-            const combinedAesExchangeKeys = yield this.combineLegacyHcpKeysWithAesExchangeKeys(delegator.stub, delegate.stub);
-            return this.fixAesExchangeKeyEntriesToFingerprints(Object.assign(Object.assign({}, combinedAesExchangeKeys), { [mainDelegatorKeyPairPubHex]: Object.assign(Object.assign({}, ((_a = combinedAesExchangeKeys[mainDelegatorKeyPairPubHex]) !== null && _a !== void 0 ? _a : {})), { [delegate.stub.id]: Object.assign(Object.assign({}, ((_c = (_b = combinedAesExchangeKeys[mainDelegatorKeyPairPubHex]) === null || _b === void 0 ? void 0 : _b[delegate.stub.id]) !== null && _c !== void 0 ? _c : {})), encryptedKeyMap) }) }));
-        });
-    }
     // Copy all legacy hcp exchange keys into the new aes exchange keys
     combineLegacyHcpKeysWithAesExchangeKeys(owner, delegate) {
         var _a, _b, _c, _d, _e;
@@ -352,15 +287,6 @@ class BaseExchangeKeysManager {
                 return (_e = owner.aesExchangeKeys) !== null && _e !== void 0 ? _e : {};
         });
     }
-    fixAesExchangeKeyEntriesToFingerprints(aesExchangeKeys) {
-        return Object.fromEntries(Object.entries(aesExchangeKeys).map(([delegatorPubKey, allDelegates]) => [
-            delegatorPubKey,
-            Object.fromEntries(Object.entries(allDelegates).map(([delegateId, keyEntries]) => [
-                delegateId,
-                Object.fromEntries(Object.entries(keyEntries).map(([publicKey, encryptedValue]) => [publicKey.slice(-32), encryptedValue])),
-            ])),
-        ]));
-    }
 }
 exports.BaseExchangeKeysManager = BaseExchangeKeysManager;
 //# sourceMappingURL=BaseExchangeKeysManager.js.map

package/icc-x-api/crypto/BaseExchangeKeysManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"BaseExchangeKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/BaseExchangeKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAwD;AAIxD,yEAA8F;AAC9F,6EAAyE;AAEzE;;;;GAIG;AACH,MAAa,uBAAuB;IAQlC,YACE,UAA4B,EAC5B,YAA8B,EAC9B,cAA6B,EAC7B,cAA6B,EAC7B,aAA2B;QAZZ,8BAAyB,GAAwC,EAAE,CAAA;QAclF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAA;QACpC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAA;QACpC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;IAED;;;;;;;;OAQG;IACG,oCAAoC,CACxC,UAAkB,EAClB,oBAAwC,EACxC,oBAA6D;;YAK7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,OAAO,MAAM,IAAA,qBAAa,EAAC,IAAI,CAAC,yBAAyB,EAAE,WAAW,EAAE,GAAS,EAAE;;gBACjF,MAAM,SAAS,GAAG,yCAAuB,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAA;gBACtG,MAAM,QAAQ,GAAG,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;gBAChH,MAAM,0BAA0B,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;gBACtH,IAAI,WAAW,GAAgD,SAAS,CAAA;gBACxE,MAAM,mBAAmB,GACvB,MAAA,MAAA,MAAA,MAAA,SAAS,CAAC,IAAI,CAAC,eAAe,0CAAG,0BAA0B,CAAC,0CAAG,UAAU,CAAC,0CAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mCACnH,CAAC,0BAA0B,KAAK,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAA,MAAA,SAAS,CAAC,IAAI,CAAC,WAAW,0CAAG,UAAU,CAAC,0CAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBACvH,IAAI,mBAAmB,EAAE;oBACvB,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAA;oBACxG,IAAI,CAAC,WAAW;wBACd,MAAM,IAAI,KAAK,CACb,yDAAyD,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,WAAW,KAAK,UAAU,EAAE,CAC/H,CAAA;oBACH,MAAM,sBAAsB,GAAG,MAAA,MAAA,SAAS,CAAC,IAAI,CAAC,eAAe,0CAAG,0BAA0B,CAAC,0CAAG,UAAU,CAAC,CAAA;oBACzG,IAAI,sBAAsB,EAAE;wBAC1B,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAA;wBAC1D,IAAI,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;4BAChF,OAAO;gCACL,gBAAgB,EAAE,SAAS;gCAC3B,GAAG,EAAE,WAAW,CAAC,GAAG;6BACrB,CAAA;qBACJ;iBACF;gBACD,MAAM,aAAa,mCACd,oBAAoB,KACvB,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,oBAAoB,CAAC,SAAS,GACxE,CAAA;gBACD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;gBAClF,IAAI,yBAAiC,CAAA;gBACrC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE;oBAClC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,SAAS,CAAC,IAAI,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;wBAC7D,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,CAAC,IAAI,CAAC,EAAE,qDAAqD,CAAC,CAAA;oBACvG,yBAAyB,GAAG,0BAA0B,CAAA;iBACvD;qBAAM;oBACL,yBAAyB,GAAG,MAAA,SAAS,CAAC,IAAI,CAAC,SAAS,mCAAI,0BAA0B,CAAA;iBACnF;gBACD,MAAM,WAAW,mCACZ,SAAS,CAAC,IAAI,KACjB,eAAe,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,QAAQ,EAAE,0BAA0B,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,EACtI,SAAS,EAAE,yBAAyB,GACrC,CAAA;gBACD,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,KAAK,0BAA0B,EAAE;oBAC3D,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;iBACpH;gBACD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;oBACrE,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,IAAI,EAAE,WAAW;iBAClB,CAAC,CAAA;gBACF,OAAO;oBACL,GAAG,EAAE,gBAAgB,CAAC,WAAW;oBACjC,gBAAgB;iBACjB,CAAA;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,gBAAgB,CACpB,cAAsB,EACtB,qBAA6B,EAC7B,qBAA6E;;YAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;YAC5G,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,cAAc,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAA;YACnI,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAA;QACrI,CAAC;KAAA;IAED;;;;;OAKG;IACG,2BAA2B,CAAC,WAAmB,EAAE,UAAkB;;;YACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;YACzE,MAAM,GAAG,GAAiD,MAAM,CAAC,MAAM,CAAC,MAAA,SAAS,CAAC,IAAI,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;gBACtI,MAAM,uBAAuB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;gBACzD,IAAI,uBAAuB,EAAE;oBAC3B,OAAO,CAAC,uBAAuB,CAAC,CAAA;iBACjC;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,gBAAgB,GAAG,MAAA,MAAA,SAAS,CAAC,IAAI,CAAC,WAAW,0CAAG,UAAU,CAAC,0CAAG,CAAC,CAAC,CAAA;YACtE,IAAI,gBAAgB;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAA;YACxD,OAAO,GAAG,CAAA;;KACX;IAED;;;;;OAKG;IACG,sBAAsB,CAC1B,WAAmB,EACnB,eAAoC;;YAKpC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACvF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,qCAAiB,CAAC,GAAG,CAAC;oBACtD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;oBAChF,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,qCAAiB,CAAC,OAAO,CAAC;oBAC1D,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;oBACvF,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,qCAAiB,CAAC,MAAM,CAAC;oBACzD,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;oBACrF,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;aACxB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,8CAAK,CAAC,GAAK,CAAC,GAAK,CAAC,CAA0F,CAAA,CAAC,CAAA;YACrI,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;YACzE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uCAAuC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAClG,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,OAAO,EAAE,EAAE;gBAClH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAA;gBAC5B,IAAI,OAAO,KAAK,WAAW,EAAE;oBAC3B,OAAO,CAAC,GAAG,UAAU,EAAE,OAAO,CAAC,CAAA;iBAChC;qBAAM;oBACL,MAAM,aAAa,GAAsB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;oBACnG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,EAAE;wBACpD,OAAO,CAAC,GAAG,UAAU,EAAE,OAAO,CAAC,CAAA;qBAChC;;wBAAM,OAAO,UAAU,CAAA;iBACzB;YACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,CAAC,EAAc,CAAC,CAAC,CACpC,CAAA;YACD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CACtC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;iBACzB,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;gBAC1C,eAAe;gBACf,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAwC,CAClI;aACF,CAAC;iBACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAyD,CACxG,CAAA;YACD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA;QACvC,CAAC;KAAA;IAED;;;;;OAKG;IACG,sBAAsB,CAC1B,qBAAmE,EACnE,qBAA6E;;YAK7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,MAAM,GAAG,GAGL,EAAE,qBAAqB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAA;YACxD,KAAK,MAAM,oBAAoB,IAAI,qBAAqB,EAAE;gBACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAA;gBAC/F,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;oBACvD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;oBACvB,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;iBAC9C;qBAAM;oBACL,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;iBACjD;aACF;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,yBAAyB,CACrC,WAAmB,EACnB,UAAkB,EAClB,cAAsB,EACtB,YAAuB,EACvB,+BAAuF;;YAEvF,MAAM,IAAA,qBAAa,EAAC,IAAI,CAAC,yBAAyB,EAAE,WAAW,EAAE,GAAS,EAAE;gBAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;gBACvE,IAAI,gBAAgB,GAAG,KAAK,CAAA;gBAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uCAAuC,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACtG,MAAM,mBAAmB,GAAsF,EAAE,CAAA;gBACjH,MAAM,iBAAiB,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAA;gBAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;oBAClF,MAAM,sBAAsB,GAA0D,EAAE,CAAA;oBACxF,KAAK,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE;wBACpF,IAAI,UAAU,KAAK,cAAc,IAAI,cAAc,IAAI,gBAAgB,EAAE;4BACvE,sBAAsB,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAA;yBAC1D;6BAAM;4BACL,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAA;4BACrG,IAAI,SAAS,EAAE;gCACb,gBAAgB,GAAG,IAAI,CAAA;gCACvB,sBAAsB,CAAC,cAAc,CAAC,mCACjC,gBAAgB,GAChB,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CACtF,CAAA;6BACF;iCAAM;gCACL,sBAAsB,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAA;6BAC1D;yBACF;qBACF;oBACD,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,sBAAsB,CAAA;iBAC/D;gBACD,IAAI,gBAAgB,EAAE;oBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;wBAC5C,IAAI,EAAE,SAAS,CAAC,IAAI;wBACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,eAAe,EAAE,mBAAmB,GACrC;qBACF,CAAC,CAAA;iBACH;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;;;OAMG;IACW,qBAAqB,CACjC,oBAAgE,EAChE,qBAA6E;;YAE7E,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE;gBACxE,kHAAkH;gBAClH,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;gBAC9B,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAA;gBACzC,IAAI,OAAO,KAAK,SAAS,EAAE;oBACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;oBACxE,IAAI,GAAG,KAAK,SAAS;wBAAE,OAAO,GAAG,CAAA;iBAClC;aACF;YACD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;YACpD,IAAI,mBAAmB,KAAK,SAAS,EAAE;gBACrC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE;oBAC1D,oEAAoE;oBACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;oBACzF,IAAI,GAAG,KAAK,SAAS;wBAAE,OAAO,GAAG,CAAA;iBAClC;aACF;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;KAAA;IAED;;;;;OAKG;IACW,kBAAkB,CAC9B,WAAwD,EACxD,UAAmD;;;YAKnD,MAAM,iBAAiB,GAAG,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,GAAG,mCAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;YAClG,MAAM,gBAAgB,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,cAAM,EAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;YAC5I,MAAM,oBAAoB,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAClE,CAAO,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE;gBAAC,OAAA,iCAChC,CAAC,MAAM,GAAG,CAAC,KACd,CAAC,SAAS,CAAC,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,IACjG,CAAA;cAAA,EACF,OAAO,CAAC,OAAO,CAAC,EAAoC,CAAC,CACtD,CAAA;YACD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAA;;KAChE;IAED;;;;;;;;;OASG;IACW,yBAAyB,CACrC,iBAAyB,EACzB,OAA2B,EAC3B,SAA6B,CAAC,iGAAiG;;;YAE/H,IAAI;gBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAA,cAAM,EAAC,iBAAiB,CAAC,CAAC,CAAA;gBAClG,OAAO,EAAE,GAAG,EAAE,IAAA,cAAM,EAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAA;aAC9F;YAAC,OAAO,CAAC,EAAE;gBACV,IAAI,SAAS,EAAE;oBACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,iBAAiB,+BAA+B,SAAS,GAAG,EAAE,CAAC,CAAC,CAAA;iBAC3H;aACF;QACH,CAAC;KAAA;IAEO,wBAAwB,CAC9B,SAAkC,EAClC,QAAiC,EACjC,eAAyC;;QAEzC,MAAM,2BAA2B,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACpH,MAAM,0BAA0B,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACjH,IAAI,2BAA2B,IAAI,0BAA0B,EAAE;YAC7D,uCACK,CAAC,MAAA,SAAS,CAAC,IAAI,CAAC,WAAW,mCAAI,EAAE,CAAC,KACrC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAG,CAAC,EAAE,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,IAC/E;SACF;;YAAM,OAAO,SAAS,CAAC,IAAI,CAAC,WAAW,CAAA;IAC1C,CAAC;IAEa,kBAAkB,CAC9B,SAAkC,EAClC,QAAiC,EACjC,0BAAkC,EAClC,eAAyC;;;YAEzC,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,uCAAuC,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;YACjH,OAAO,IAAI,CAAC,sCAAsC,iCAC7C,uBAAuB,KAC1B,CAAC,0BAA0B,CAAC,kCACvB,CAAC,MAAA,uBAAuB,CAAC,0BAA0B,CAAC,mCAAI,EAAE,CAAC,KAC9D,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAG,CAAC,kCACd,CAAC,MAAA,MAAA,uBAAuB,CAAC,0BAA0B,CAAC,0CAAG,QAAQ,CAAC,IAAI,CAAC,EAAG,CAAC,mCAAI,EAAE,CAAC,GAChF,eAAe,QAGtB,CAAA;;KACH;IAED,mEAAmE;IACrD,uCAAuC,CACnD,KAAsB,EACtB,QAAqC;;;YAErC,MAAM,oBAAoB,GAAG,KAAK,CAAC,SAAS,CAAA;YAC5C,IAAI,oBAAoB,IAAI,CAAC,CAAC,MAAA,KAAK,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,oBAAoB,CAAC,EAAE;gBAChF;;;;mBAIG;gBACH,MAAM,8BAA8B,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC,MAAK,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,EAAE,CAAA,CAAC,CAAA;gBAC/H,MAAM,gBAAgB,GAAG;oBACvB,KAAK;oBACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAO,IAAI,EAAE,EAAE,gDAAC,OAAA,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA,GAAA,CAAC,CAAC,CAAC;iBACpI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;oBAC1B,GAAG,CAAC,SAAS,CAAC,EAAG,CAAC,GAAG,SAAS,CAAA;oBAC9B,OAAO,GAAG,CAAA;gBACZ,CAAC,EAAE,EAAuC,CAAC,CAAA;gBAC3C,uBACE,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE;;wBAC5F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAA,MAAA,MAAA,gBAAgB,CAAC,KAAK,CAAC,0CAAE,SAAS,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;wBAC5H,OAAO,GAAG,CAAA;oBACZ,CAAC,EAAE,EAAiE,CAAC,IAClE,CAAC,MAAA,KAAK,CAAC,eAAe,mCAAI,EAAE,CAAC,EACjC;aACF;;gBAAM,OAAO,MAAA,KAAK,CAAC,eAAe,mCAAI,EAAE,CAAA;;KAC1C;IAEO,sCAAsC,CAAC,eAE9C;QACC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;YACvE,eAAe;YACf,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;gBAC7D,UAAU;gBACV,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;aAC5H,CAAC,CACH;SACF,CAAC,CACH,CAAA;IACH,CAAC;CACF;AA1aD,0DA0aC","sourcesContent":["import { KeyPair } from './RSA'\nimport { hex2ua, notConcurrent, ua2hex } from '../utils'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { IccDeviceApi, IccHcpartyApi, IccPatientApi } from '../../icc-api'\nimport { CryptoActorStub, CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { DataOwnerTypeEnum } from '../../icc-api/model/DataOwnerTypeEnum'\n\n/**\n * @internal This class is meant only for internal use and may be changed without notice.\n * Functions to create and get exchange keys.\n * The methods of this api require to pass the appropriate keys for encryption/decryption manually.\n */\nexport class BaseExchangeKeysManager {\n  private readonly generateKeyConcurrencyMap: { [key: string]: PromiseLike<any> } = {}\n  private readonly primitives: CryptoPrimitives\n  private readonly dataOwnerApi: IccDataOwnerXApi\n  private readonly hcpartyBaseApi: IccHcpartyApi\n  private readonly patientBaseApi: IccPatientApi\n  private readonly deviceBaseApi: IccDeviceApi\n\n  constructor(\n    primitives: CryptoPrimitives,\n    dataOwnerApi: IccDataOwnerXApi,\n    hcpartyBaseApi: IccHcpartyApi,\n    patientBaseApi: IccPatientApi,\n    deviceBaseApi: IccDeviceApi\n  ) {\n    this.primitives = primitives\n    this.dataOwnerApi = dataOwnerApi\n    this.hcpartyBaseApi = hcpartyBaseApi\n    this.patientBaseApi = patientBaseApi\n    this.deviceBaseApi = deviceBaseApi\n  }\n\n  /**\n   * Creates a new exchange key from the current data owner to a delegate, or updates an existing one allowing additional public keys to access it.\n   * @param delegateId the delegate data owner id.\n   * @param delegatorMainKeyPair main key pair for the delegator. The private key will be used for the decryption of the existing key in case of\n   * update, and the public key will be used as entry key of the aesExchangeKey map\n   * @param additionalPublicKeys all public keys of key pairs other than {@link delegatorMainKeyPair} that need to have access to the exchange key.\n   * Can be a mix of crypto keys and full hex-encoded spki format (no fingerprints).\n   * @return the exchange key for the delegator-delegate-delegatorKey triple (new or existing) and the updated delegator.\n   */\n  async createOrUpdateEncryptedExchangeKeyTo(\n    delegateId: string,\n    delegatorMainKeyPair: KeyPair<CryptoKey>,\n    additionalPublicKeys: { [keyFingerprint: string]: CryptoKey }\n  ): Promise<{\n    updatedDelegator: CryptoActorStubWithType\n    key: CryptoKey\n  }> {\n    const delegatorId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    return await notConcurrent(this.generateKeyConcurrencyMap, delegatorId, async () => {\n      const delegator = CryptoActorStubWithType.fromDataOwner(await this.dataOwnerApi.getCurrentDataOwner())\n      const delegate = delegatorId === delegateId ? delegator : await this.dataOwnerApi.getCryptoActorStub(delegateId)\n      const mainDelegatorKeyPairPubHex = ua2hex(await this.primitives.RSA.exportKey(delegatorMainKeyPair.publicKey, 'spki'))\n      let exchangeKey: { raw: string; key: CryptoKey } | undefined = undefined\n      const existingExchangeKey =\n        delegator.stub.aesExchangeKeys?.[mainDelegatorKeyPairPubHex]?.[delegateId]?.[mainDelegatorKeyPairPubHex.slice(-32)] ??\n        (mainDelegatorKeyPairPubHex === delegator.stub.publicKey ? delegator.stub.hcPartyKeys?.[delegateId]?.[0] : undefined)\n      if (existingExchangeKey) {\n        exchangeKey = await this.tryDecryptExchangeKeyWith(existingExchangeKey, delegatorMainKeyPair, undefined)\n        if (!exchangeKey)\n          throw new Error(\n            `Failed to decrypt existing exchange key for update of ${mainDelegatorKeyPairPubHex.slice(-32)}@${delegatorId}->${delegateId}`\n          )\n        const existingAesExchangeKey = delegator.stub.aesExchangeKeys?.[mainDelegatorKeyPairPubHex]?.[delegateId]\n        if (existingAesExchangeKey) {\n          const existingPublicKeysSet = new Set(existingExchangeKey)\n          if (Object.keys(additionalPublicKeys).every((fp) => existingPublicKeysSet.has(fp)))\n            return {\n              updatedDelegator: delegator,\n              key: exchangeKey.key,\n            }\n        }\n      }\n      const allPublicKeys = {\n        ...additionalPublicKeys,\n        [mainDelegatorKeyPairPubHex.slice(-32)]: delegatorMainKeyPair.publicKey,\n      }\n      const encryptedKeyInfo = await this.encryptExchangeKey(exchangeKey, allPublicKeys)\n      let updatedDelegatorPublicKey: string\n      if (delegator.stub.publicKey == '') {\n        if (Object.entries(delegator.stub.hcPartyKeys ?? {}).length > 0)\n          throw new Error(`Data owner ${delegator.stub.id} has \"\" as public key but has non-empty hcPartyKeys`)\n        updatedDelegatorPublicKey = mainDelegatorKeyPairPubHex\n      } else {\n        updatedDelegatorPublicKey = delegator.stub.publicKey ?? mainDelegatorKeyPairPubHex\n      }\n      const updatedStub: CryptoActorStub = {\n        ...delegator.stub,\n        aesExchangeKeys: await this.updateExchangeKeys(delegator, delegate, mainDelegatorKeyPairPubHex, encryptedKeyInfo.encryptedExchangeKey),\n        publicKey: updatedDelegatorPublicKey,\n      }\n      if (delegator.stub.publicKey === mainDelegatorKeyPairPubHex) {\n        updatedStub.hcPartyKeys = this.updateLegacyExchangeKeys(delegator, delegate, encryptedKeyInfo.encryptedExchangeKey)\n      }\n      const updatedDelegator = await this.dataOwnerApi.modifyCryptoActorStub({\n        type: delegator.type,\n        stub: updatedStub,\n      })\n      return {\n        key: encryptedKeyInfo.exchangeKey,\n        updatedDelegator,\n      }\n    })\n  }\n\n  /**\n   * Updates the aes exchange keys between the current data owner and another data owner to allow the other data owner to access the exchange key\n   * using his new public key. Note that this will make existing exchange keys from the other data owner to the current data owner invalid for\n   * encryption.\n   * @param otherDataOwner the other data owner.\n   * @param newDataOwnerPublicKey a new public key of the other data owner.\n   * @param keyPairsByFingerprint all available key pairs to use for the decryption of existing aes exchange keys.\n   */\n  async giveAccessBackTo(\n    otherDataOwner: string,\n    newDataOwnerPublicKey: string,\n    keyPairsByFingerprint: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ) {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const newPublicKey = await this.primitives.RSA.importKey('spki', hex2ua(newDataOwnerPublicKey), ['encrypt'])\n    await this.extendForGiveAccessBackTo(selfId, otherDataOwner, newDataOwnerPublicKey.slice(-32), newPublicKey, keyPairsByFingerprint)\n    await this.extendForGiveAccessBackTo(otherDataOwner, selfId, newDataOwnerPublicKey.slice(-32), newPublicKey, keyPairsByFingerprint)\n  }\n\n  /**\n   * Get the encrypted exchange keys for a delegator-delegate pair.\n   * @param delegatorId id of the delegator data owner.\n   * @param delegateId id of the delegate data owner.\n   * @return an array of exchange keys from the delegator to delegate where each key is encrypted with one or more public keys.\n   */\n  async getEncryptedExchangeKeysFor(delegatorId: string, delegateId: string): Promise<{ [publicKeyFingerprint: string]: string }[]> {\n    const delegator = await this.dataOwnerApi.getCryptoActorStub(delegatorId)\n    const res: { [publicKeyFingerprint: string]: string }[] = Object.values(delegator.stub.aesExchangeKeys ?? {}).flatMap((delegateToKey) => {\n      const encryptedKeyForDelegate = delegateToKey[delegateId]\n      if (encryptedKeyForDelegate) {\n        return [encryptedKeyForDelegate]\n      } else {\n        return []\n      }\n    })\n    const legacyDelegation = delegator.stub.hcPartyKeys?.[delegateId]?.[1]\n    if (legacyDelegation) res.push({ '': legacyDelegation })\n    return res\n  }\n\n  /**\n   * Get all exchange keys where the provided data owner is involved either as the delegator or as the delegate.\n   * @param dataOwnerId id of a data owner.\n   * @param otherOwnerTypes only exchange keys between the current data owner and data owners of this type will be included in the result.\n   * @return all exchange keys involving the provided data owner. Note that there may be an overlap between some keys to and from the data owner.\n   */\n  async getAllExchangeKeysWith(\n    dataOwnerId: string,\n    otherOwnerTypes: DataOwnerTypeEnum[]\n  ): Promise<{\n    keysToOwner: { [delegatorId: string]: { [delegatorFp: string]: { [entryFp: string]: string } } }\n    keysFromOwner: { [delegatorFp: string]: { [delegateId: string]: { [entryFp: string]: string } } }\n  }> {\n    if (otherOwnerTypes.length === 0) throw new Error('otherOwnerTypes must not be empty!')\n    const keysToOwner = await Promise.all([\n      otherOwnerTypes.find((x) => x === DataOwnerTypeEnum.Hcp)\n        ? this.hcpartyBaseApi.getAesExchangeKeysForDelegate(dataOwnerId).catch(() => {})\n        : Promise.resolve({}),\n      otherOwnerTypes.find((x) => x === DataOwnerTypeEnum.Patient)\n        ? this.patientBaseApi.getPatientAesExchangeKeysForDelegate(dataOwnerId).catch(() => {})\n        : Promise.resolve({}),\n      otherOwnerTypes.find((x) => x === DataOwnerTypeEnum.Device)\n        ? this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(dataOwnerId).catch(() => {})\n        : Promise.resolve({}),\n    ]).then(([a, b, c]) => ({ ...a, ...b, ...c } as { [delegatorId: string]: { [delegatorFp: string]: { [entryFp: string]: string } } }))\n    const dataOwner = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n    const allOwnerKeys = await this.combineLegacyHcpKeysWithAesExchangeKeys(dataOwner.stub, undefined)\n    const filteredDelegates = new Set(\n      await Array.from(new Set(Object.values(allOwnerKeys).flatMap((x) => Object.keys(x)))).reduce(async (acc, ownerId) => {\n        const awaitedAcc = await acc\n        if (ownerId === dataOwnerId) {\n          return [...awaitedAcc, ownerId]\n        } else {\n          const dataOwnerType: DataOwnerTypeEnum = (await this.dataOwnerApi.getCryptoActorStub(ownerId)).type\n          if (otherOwnerTypes.some((x) => x === dataOwnerType)) {\n            return [...awaitedAcc, ownerId]\n          } else return awaitedAcc\n        }\n      }, Promise.resolve([] as string[]))\n    )\n    const keysFromOwner = Object.fromEntries(\n      Object.entries(allOwnerKeys)\n        .map(([delegatorPubKey, delegateToKeys]) => [\n          delegatorPubKey,\n          Object.fromEntries(\n            Object.entries(delegateToKeys).filter(([delegateId]) => filteredDelegates.has(delegateId)) as [string, { [k: string]: string }][]\n          ),\n        ])\n        .filter(([, x]) => Object.keys(x).length > 0) as [string, { [k: string]: { [k: string]: string } }][]\n    )\n    return { keysToOwner, keysFromOwner }\n  }\n\n  /**\n   * Attempts to decrypt many exchange keys using any of the provided key pairs.\n   * @param encryptedExchangeKeys an array of exchange keys where each key is encrypted with one or more public keys.\n   * @param keyPairsByFingerprint rsa key pairs to use for decryption.\n   * @return an array all successfully decrypted exchange keys and an array containing all exchange keys which could not be decrypted.\n   */\n  async tryDecryptExchangeKeys(\n    encryptedExchangeKeys: { [publicKeyFingerprint: string]: string }[],\n    keyPairsByFingerprint: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: { [publicKeyFingerprint: string]: string }[]\n  }> {\n    const raws = new Set<string>()\n    const res: {\n      successfulDecryptions: CryptoKey[]\n      failedDecryptions: { [publicKeyFingerprint: string]: string }[]\n    } = { successfulDecryptions: [], failedDecryptions: [] }\n    for (const encryptedExchangeKey of encryptedExchangeKeys) {\n      const decrypted = await this.tryDecryptExchangeKey(encryptedExchangeKey, keyPairsByFingerprint)\n      if (decrypted !== undefined && !raws.has(decrypted.raw)) {\n        raws.add(decrypted.raw)\n        res.successfulDecryptions.push(decrypted.key)\n      } else {\n        res.failedDecryptions.push(encryptedExchangeKey)\n      }\n    }\n    return res\n  }\n\n  private async extendForGiveAccessBackTo(\n    delegatorId: string,\n    delegateId: string,\n    newPublicKeyFp: string,\n    newPublicKey: CryptoKey,\n    decryptionKeyPairsByFingerprint: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ) {\n    await notConcurrent(this.generateKeyConcurrencyMap, delegatorId, async () => {\n      const delegator = await this.dataOwnerApi.getCryptoActorStub(delegatorId)\n      const delegate = await this.dataOwnerApi.getCryptoActorStub(delegateId)\n      let didUpdateSomeKey = false\n      const combinedKeys = await this.combineLegacyHcpKeysWithAesExchangeKeys(delegator.stub, delegate.stub)\n      const updatedExchangeKeys: { [delegatorKey: string]: { [delegateId: string]: { [keyFp: string]: string } } } = {}\n      const newEncryptionKeys = { [newPublicKeyFp]: newPublicKey }\n      for (const [currDelegatorKey, currDelegatesToKeys] of Object.entries(combinedKeys)) {\n        const updatedDelegatesToKeys: { [delegateId: string]: { [keyFp: string]: string } } = {}\n        for (const [currDelegateId, currEncryptedKey] of Object.entries(currDelegatesToKeys)) {\n          if (delegateId !== currDelegateId || newPublicKeyFp in currEncryptedKey) {\n            updatedDelegatesToKeys[currDelegateId] = currEncryptedKey\n          } else {\n            const decrypted = await this.tryDecryptExchangeKey(currEncryptedKey, decryptionKeyPairsByFingerprint)\n            if (decrypted) {\n              didUpdateSomeKey = true\n              updatedDelegatesToKeys[currDelegateId] = {\n                ...currEncryptedKey,\n                ...(await this.encryptExchangeKey(decrypted, newEncryptionKeys)).encryptedExchangeKey,\n              }\n            } else {\n              updatedDelegatesToKeys[currDelegateId] = currEncryptedKey\n            }\n          }\n        }\n        updatedExchangeKeys[currDelegatorKey] = updatedDelegatesToKeys\n      }\n      if (didUpdateSomeKey) {\n        await this.dataOwnerApi.modifyCryptoActorStub({\n          type: delegator.type,\n          stub: {\n            ...delegator.stub,\n            aesExchangeKeys: updatedExchangeKeys,\n          },\n        })\n      }\n    })\n  }\n\n  /**\n   * Attempts to decrypt an exchange key using any of the provided key pairs.\n   * @param encryptedExchangeKey an encrypted exchange key, in the form publicKeyXyzFingerprint -> hex(exchangeKeyEncryptedByPrivateKeyXyz).\n   * @param keyPairsByFingerprint rsa key pairs to use for decryption.\n   * @return the decrypted exchange key, in raw and key format (to allow deduplication), or undefined if the key could not be decrypted using the\n   * provided keys.\n   */\n  private async tryDecryptExchangeKey(\n    encryptedExchangeKey: { [publicKeyFingerprint: string]: string },\n    keyPairsByFingerprint: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{ raw: string; key: CryptoKey } | undefined> {\n    for (const [entryKey, encrypted] of Object.entries(encryptedExchangeKey)) {\n      // Due to bugs in past version the entry may actually contain the full public key instead of just the fingerprint.\n      const fp = entryKey.slice(-32)\n      const keyPair = keyPairsByFingerprint[fp]\n      if (keyPair !== undefined) {\n        const res = await this.tryDecryptExchangeKeyWith(encrypted, keyPair, fp)\n        if (res !== undefined) return res\n      }\n    }\n    const defaultEncryptedKey = encryptedExchangeKey['']\n    if (defaultEncryptedKey !== undefined) {\n      for (const keyPair of Object.values(keyPairsByFingerprint)) {\n        // disable error logging, we are not sure keyPair is the correct key\n        const res = await this.tryDecryptExchangeKeyWith(defaultEncryptedKey, keyPair, undefined)\n        if (res !== undefined) return res\n      }\n    }\n    return undefined\n  }\n\n  /**\n   * Creates an encrypted exchange key for the provided public keys.\n   * @param exchangeKey the exchange key in raw and imported format. If undefined a new key will be automatically created.\n   * @param publicKeys additional public keys that will have access to the exchange key in spki format, hex-encoded.\n   * @return the exchangeKey and an object with the exchange key encrypted with each of the provided public keys, hex-encoded, by fingerprint.\n   */\n  private async encryptExchangeKey(\n    exchangeKey: { raw: string; key: CryptoKey } | undefined,\n    publicKeys: { [keyFingerprint: string]: CryptoKey }\n  ): Promise<{\n    exchangeKey: CryptoKey\n    encryptedExchangeKey: { [pubKeyFp: string]: string }\n  }> {\n    const exchangeKeyCrypto = exchangeKey?.key ?? (await this.primitives.AES.generateCryptoKey(false))\n    const exchangeKeyBytes = exchangeKey !== undefined ? hex2ua(exchangeKey.raw) : await this.primitives.AES.exportKey(exchangeKeyCrypto, 'raw')\n    const encryptedExchangeKey = await Object.entries(publicKeys).reduce(\n      async (acc, [currKeyFp, currKey]) => ({\n        ...(await acc),\n        [currKeyFp]: ua2hex(await this.primitives.RSA.encrypt(currKey, new Uint8Array(exchangeKeyBytes))),\n      }),\n      Promise.resolve({} as { [pubKeyFp: string]: string })\n    )\n    return { exchangeKey: exchangeKeyCrypto, encryptedExchangeKey }\n  }\n\n  /**\n   * Attempts to decrypt an exchange key using the provided key pairs.\n   * If you are confident that the provided {@link keyPair} was used to encrypt {@link encryptedByOneKey} you should also provide {@link keyPairFp},\n   * so that if the decryption fail an error will be logged to console before returning undefined.\n   * @param encryptedByOneKey an exchange key which may be encrypted with {@link keyPair}.\n   * @param keyPair an rsa key pair.\n   * @param keyPairFp the fingerprint of the provided key pair or undefined to disable logging of error if the decryption failed.\n   * @return the decrypted exchange key, in raw and key format (to allow deduplication), or undefined if the key could not be decrypted using the\n   * provided key.\n   */\n  private async tryDecryptExchangeKeyWith(\n    encryptedByOneKey: string,\n    keyPair: KeyPair<CryptoKey>,\n    keyPairFp: string | undefined // if undefined will not log errors, when we are not sure the key to be used is the provided key.\n  ): Promise<{ raw: string; key: CryptoKey } | undefined> {\n    try {\n      const decrypted = await this.primitives.RSA.decrypt(keyPair.privateKey, hex2ua(encryptedByOneKey))\n      return { raw: ua2hex(decrypted), key: await this.primitives.AES.importKey('raw', decrypted) }\n    } catch (e) {\n      if (keyPairFp) {\n        console.error(`Failed to decrypt or import exchange key ${encryptedByOneKey} using key with fingerprint ${keyPairFp}.`, e)\n      }\n    }\n  }\n\n  private updateLegacyExchangeKeys(\n    delegator: CryptoActorStubWithType,\n    delegate: CryptoActorStubWithType,\n    encryptedKeyMap: { [fp: string]: string }\n  ): { [delegateId: string]: string[] } | undefined {\n    const legacyEncryptedKeyDelegator = delegator.stub.publicKey ? encryptedKeyMap[delegator.stub.publicKey] : undefined\n    const legacyEncryptedKeyDelegate = delegate.stub.publicKey ? encryptedKeyMap[delegate.stub.publicKey] : undefined\n    if (legacyEncryptedKeyDelegator && legacyEncryptedKeyDelegate) {\n      return {\n        ...(delegator.stub.hcPartyKeys ?? {}),\n        [delegate.stub.id!]: [legacyEncryptedKeyDelegator, legacyEncryptedKeyDelegate],\n      }\n    } else return delegator.stub.hcPartyKeys\n  }\n\n  private async updateExchangeKeys(\n    delegator: CryptoActorStubWithType,\n    delegate: CryptoActorStubWithType,\n    mainDelegatorKeyPairPubHex: string,\n    encryptedKeyMap: { [fp: string]: string }\n  ): Promise<{ [ownerPublicKey: string]: { [delegateId: string]: { [fingerprint: string]: string } } }> {\n    const combinedAesExchangeKeys = await this.combineLegacyHcpKeysWithAesExchangeKeys(delegator.stub, delegate.stub)\n    return this.fixAesExchangeKeyEntriesToFingerprints({\n      ...combinedAesExchangeKeys,\n      [mainDelegatorKeyPairPubHex]: {\n        ...(combinedAesExchangeKeys[mainDelegatorKeyPairPubHex] ?? {}),\n        [delegate.stub.id!]: {\n          ...(combinedAesExchangeKeys[mainDelegatorKeyPairPubHex]?.[delegate.stub.id!] ?? {}),\n          ...encryptedKeyMap,\n        },\n      },\n    })\n  }\n\n  // Copy all legacy hcp exchange keys into the new aes exchange keys\n  private async combineLegacyHcpKeysWithAesExchangeKeys(\n    owner: CryptoActorStub,\n    delegate: CryptoActorStub | undefined\n  ): Promise<{ [ownerPublicKey: string]: { [delegateId: string]: { [fingerprint: string]: string } } }> {\n    const ownerLegacyPublicKey = owner.publicKey\n    if (ownerLegacyPublicKey && !(owner.aesExchangeKeys ?? {})[ownerLegacyPublicKey]) {\n      /*\n       * This condition would technically prevent new updates to the hcPartyKeys to be migrated to the aes exchange keys, but since I can only update\n       * data for self data owner and parent entities this is not an issue, because I will always be using the new api from now on and I won't have\n       * a situation where the legacy keys are updated but the aes exchange keys are not.\n       */\n      const unknownDataOwnerCounterPartIds = Object.keys(owner.hcPartyKeys ?? {}).filter((x) => x !== owner.id && x !== delegate?.id)\n      const counterPartsById = [\n        owner,\n        ...(delegate ? [delegate] : []),\n        ...(await Promise.all(unknownDataOwnerCounterPartIds.map(async (cpid) => (await this.dataOwnerApi.getCryptoActorStub(cpid)).stub))),\n      ].reduce((acc, dataOwner) => {\n        acc[dataOwner.id!] = dataOwner\n        return acc\n      }, {} as { [id: string]: CryptoActorStub })\n      return {\n        [ownerLegacyPublicKey]: Object.entries(owner.hcPartyKeys ?? {}).reduce((acc, [hcpId, keys]) => {\n          acc[hcpId] = { [ownerLegacyPublicKey.slice(-32)]: keys[0], [counterPartsById[hcpId]?.publicKey?.slice(-32) ?? '']: keys[1] }\n          return acc\n        }, {} as { [delegateId: string]: { [fingerprint: string]: string } }),\n        ...(owner.aesExchangeKeys ?? {}),\n      }\n    } else return owner.aesExchangeKeys ?? {}\n  }\n\n  private fixAesExchangeKeyEntriesToFingerprints(aesExchangeKeys: {\n    [delegatorPubKey: string]: { [delegateId: string]: { [pubKeyFp: string]: string } }\n  }): { [delegatorPubKey: string]: { [delegateId: string]: { [pubKeyFp: string]: string } } } {\n    return Object.fromEntries(\n      Object.entries(aesExchangeKeys).map(([delegatorPubKey, allDelegates]) => [\n        delegatorPubKey,\n        Object.fromEntries(\n          Object.entries(allDelegates).map(([delegateId, keyEntries]) => [\n            delegateId,\n            Object.fromEntries(Object.entries(keyEntries).map(([publicKey, encryptedValue]) => [publicKey.slice(-32), encryptedValue])),\n          ])\n        ),\n      ])\n    )\n  }\n}\n"]}
+{"version":3,"file":"BaseExchangeKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/BaseExchangeKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAwD;AAIxD,mCAA4D;AAI5D;;;;GAIG;AACH,MAAa,uBAAuB;IAQlC,YACE,UAA4B,EAC5B,YAA8B,EAC9B,cAA6B,EAC7B,cAA6B,EAC7B,aAA2B;QAZZ,8BAAyB,GAAwC,EAAE,CAAA;QAclF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAA;QACpC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAA;QACpC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;IAED;;;;;;;OAOG;IACG,gBAAgB,CACpB,cAAsB,EACtB,qBAA6B,EAC7B,qBAA6E;;YAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;YACxE,MAAM,iBAAiB,GAAG,IAAA,2BAAmB,EAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;YAChF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,cAAc,EAAE,CAAC,CAAA;YAChG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAA;YAC/H,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAA,qBAAa,EAAC,qBAAqB,CAAC,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAA;YACvI,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,EAAE,MAAM,EAAE,IAAA,qBAAa,EAAC,qBAAqB,CAAC,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAA;QACzI,CAAC;KAAA;IAED;;;;;OAKG;IACG,2BAA2B,CAAC,WAAmB,EAAE,UAAkB;;;YACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;YACzE,MAAM,GAAG,GAAiD,MAAM,CAAC,MAAM,CAAC,MAAA,SAAS,CAAC,IAAI,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;gBACtI,MAAM,uBAAuB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;gBACzD,IAAI,uBAAuB,EAAE;oBAC3B,OAAO,CAAC,uBAAuB,CAAC,CAAA;iBACjC;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,gBAAgB,GAAG,MAAA,MAAA,SAAS,CAAC,IAAI,CAAC,WAAW,0CAAG,UAAU,CAAC,0CAAG,CAAC,CAAC,CAAA;YACtE,IAAI,gBAAgB;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAA;YACxD,OAAO,GAAG,CAAA;;KACX;IAED;;;;;OAKG;IACG,sBAAsB,CAC1B,WAAmB,EACnB,eAAoC;;YAKpC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACvF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/I,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;oBAC1C,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;oBACvF,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC;oBACzC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;oBACrF,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;aACxB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,8CAAK,CAAC,GAAK,CAAC,GAAK,CAAC,CAA0F,CAAA,CAAC,CAAA;YACrI,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;YACzE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uCAAuC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAClG,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,OAAO,EAAE,EAAE;gBAClH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAA;gBAC5B,IAAI,OAAO,KAAK,WAAW,EAAE;oBAC3B,OAAO,CAAC,GAAG,UAAU,EAAE,OAAO,CAAC,CAAA;iBAChC;qBAAM;oBACL,MAAM,aAAa,GAAsB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;oBACnG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,EAAE;wBACpD,OAAO,CAAC,GAAG,UAAU,EAAE,OAAO,CAAC,CAAA;qBAChC;;wBAAM,OAAO,UAAU,CAAA;iBACzB;YACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,CAAC,EAAc,CAAC,CAAC,CACpC,CAAA;YACD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CACtC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;iBACzB,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;gBAC1C,eAAe;gBACf,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAwC,CAClI;aACF,CAAC;iBACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAyD,CACxG,CAAA;YACD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA;QACvC,CAAC;KAAA;IAED;;;;;OAKG;IACG,sBAAsB,CAC1B,qBAAmE,EACnE,qBAA6E;;YAK7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,MAAM,GAAG,GAGL,EAAE,qBAAqB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAA;YACxD,KAAK,MAAM,oBAAoB,IAAI,qBAAqB,EAAE;gBACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAA;gBAC/F,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;oBACvD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;oBACvB,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;iBAC9C;qBAAM;oBACL,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;iBACjD;aACF;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,yBAAyB,CACrC,WAAmB,EACnB,UAAkB,EAClB,cAAsB,EACtB,YAAuB,EACvB,+BAAuF;;YAEvF,MAAM,IAAA,qBAAa,EAAC,IAAI,CAAC,yBAAyB,EAAE,WAAW,EAAE,GAAS,EAAE;gBAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;gBACvE,IAAI,gBAAgB,GAAG,KAAK,CAAA;gBAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uCAAuC,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACtG,MAAM,mBAAmB,GAAsF,EAAE,CAAA;gBACjH,MAAM,iBAAiB,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAA;gBAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;oBAClF,MAAM,sBAAsB,GAA0D,EAAE,CAAA;oBACxF,KAAK,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE;wBACpF,IAAI,UAAU,KAAK,cAAc,IAAI,cAAc,IAAI,gBAAgB,EAAE;4BACvE,sBAAsB,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAA;yBAC1D;6BAAM;4BACL,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAA;4BACrG,IAAI,SAAS,EAAE;gCACb,gBAAgB,GAAG,IAAI,CAAA;gCACvB,sBAAsB,CAAC,cAAc,CAAC,mCACjC,gBAAgB,GAChB,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CACtF,CAAA;6BACF;iCAAM;gCACL,sBAAsB,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAA;6BAC1D;yBACF;qBACF;oBACD,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,sBAAsB,CAAA;iBAC/D;gBACD,IAAI,gBAAgB,EAAE;oBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;wBAC5C,IAAI,EAAE,SAAS,CAAC,IAAI;wBACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,eAAe,EAAE,mBAAmB,GACrC;qBACF,CAAC,CAAA;iBACH;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;;;OAMG;IACW,qBAAqB,CACjC,oBAAgE,EAChE,qBAA6E;;YAE7E,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE;gBACxE,kHAAkH;gBAClH,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;gBAC9B,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAA;gBACzC,IAAI,OAAO,KAAK,SAAS,EAAE;oBACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;oBACxE,IAAI,GAAG,KAAK,SAAS;wBAAE,OAAO,GAAG,CAAA;iBAClC;aACF;YACD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;YACpD,IAAI,mBAAmB,KAAK,SAAS,EAAE;gBACrC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE;oBAC1D,oEAAoE;oBACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;oBACzF,IAAI,GAAG,KAAK,SAAS;wBAAE,OAAO,GAAG,CAAA;iBAClC;aACF;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;KAAA;IAED;;;;;OAKG;IACW,kBAAkB,CAC9B,WAAwD,EACxD,UAAmD;;;YAKnD,MAAM,iBAAiB,GAAG,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,GAAG,mCAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;YAClG,MAAM,gBAAgB,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,cAAM,EAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;YAC5I,MAAM,oBAAoB,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAClE,CAAO,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE;gBAAC,OAAA,iCAChC,CAAC,MAAM,GAAG,CAAC,KACd,CAAC,SAAS,CAAC,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,IACjG,CAAA;cAAA,EACF,OAAO,CAAC,OAAO,CAAC,EAAoC,CAAC,CACtD,CAAA;YACD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAA;;KAChE;IAED;;;;;;;;;OASG;IACW,yBAAyB,CACrC,iBAAyB,EACzB,OAA2B,EAC3B,SAA6B,CAAC,iGAAiG;;;YAE/H,IAAI;gBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAA,cAAM,EAAC,iBAAiB,CAAC,CAAC,CAAA;gBAClG,OAAO,EAAE,GAAG,EAAE,IAAA,cAAM,EAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAA;aAC9F;YAAC,OAAO,CAAC,EAAE;gBACV,IAAI,SAAS,EAAE;oBACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,iBAAiB,+BAA+B,SAAS,GAAG,EAAE,CAAC,CAAC,CAAA;iBAC3H;aACF;QACH,CAAC;KAAA;IAEO,wBAAwB,CAC9B,SAAkC,EAClC,QAAiC,EACjC,eAAyC;;QAEzC,MAAM,2BAA2B,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACpH,MAAM,0BAA0B,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACjH,IAAI,2BAA2B,IAAI,0BAA0B,EAAE;YAC7D,uCACK,CAAC,MAAA,SAAS,CAAC,IAAI,CAAC,WAAW,mCAAI,EAAE,CAAC,KACrC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAG,CAAC,EAAE,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,IAC/E;SACF;;YAAM,OAAO,SAAS,CAAC,IAAI,CAAC,WAAW,CAAA;IAC1C,CAAC;IAED,mEAAmE;IACrD,uCAAuC,CACnD,KAAsB,EACtB,QAAqC;;;YAErC,MAAM,oBAAoB,GAAG,KAAK,CAAC,SAAS,CAAA;YAC5C,IAAI,oBAAoB,IAAI,CAAC,CAAC,MAAA,KAAK,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,oBAAoB,CAAC,EAAE;gBAChF;;;;mBAIG;gBACH,MAAM,8BAA8B,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC,MAAK,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,EAAE,CAAA,CAAC,CAAA;gBAC/H,MAAM,gBAAgB,GAAG;oBACvB,KAAK;oBACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAO,IAAI,EAAE,EAAE,gDAAC,OAAA,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA,GAAA,CAAC,CAAC,CAAC;iBACpI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;oBAC1B,GAAG,CAAC,SAAS,CAAC,EAAG,CAAC,GAAG,SAAS,CAAA;oBAC9B,OAAO,GAAG,CAAA;gBACZ,CAAC,EAAE,EAAuC,CAAC,CAAA;gBAC3C,uBACE,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE;;wBAC5F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAA,MAAA,MAAA,gBAAgB,CAAC,KAAK,CAAC,0CAAE,SAAS,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;wBAC5H,OAAO,GAAG,CAAA;oBACZ,CAAC,EAAE,EAAiE,CAAC,IAClE,CAAC,MAAA,KAAK,CAAC,eAAe,mCAAI,EAAE,CAAC,EACjC;aACF;;gBAAM,OAAO,MAAA,KAAK,CAAC,eAAe,mCAAI,EAAE,CAAA;;KAC1C;CACF;AA9TD,0DA8TC","sourcesContent":["import { KeyPair } from './RSA'\nimport { hex2ua, notConcurrent, ua2hex } from '../utils'\nimport { DataOwner, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { IccDeviceApi, IccHcpartyApi, IccPatientApi } from '../../icc-api'\nimport { fingerprintV1, getShaVersionForKey } from './utils'\nimport { CryptoActorStub, CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { DataOwnerTypeEnum } from '../../icc-api/model/DataOwnerTypeEnum'\n\n/**\n * @internal This class is meant only for internal use and may be changed without notice.\n * Functions to create and get exchange keys.\n * The methods of this api require to pass the appropriate keys for encryption/decryption manually.\n */\nexport class BaseExchangeKeysManager {\n  private readonly generateKeyConcurrencyMap: { [key: string]: PromiseLike<any> } = {}\n  private readonly primitives: CryptoPrimitives\n  private readonly dataOwnerApi: IccDataOwnerXApi\n  private readonly hcpartyBaseApi: IccHcpartyApi\n  private readonly patientBaseApi: IccPatientApi\n  private readonly deviceBaseApi: IccDeviceApi\n\n  constructor(\n    primitives: CryptoPrimitives,\n    dataOwnerApi: IccDataOwnerXApi,\n    hcpartyBaseApi: IccHcpartyApi,\n    patientBaseApi: IccPatientApi,\n    deviceBaseApi: IccDeviceApi\n  ) {\n    this.primitives = primitives\n    this.dataOwnerApi = dataOwnerApi\n    this.hcpartyBaseApi = hcpartyBaseApi\n    this.patientBaseApi = patientBaseApi\n    this.deviceBaseApi = deviceBaseApi\n  }\n\n  /**\n   * Updates the aes exchange keys between the current data owner and another data owner to allow the other data owner to access the exchange key\n   * using his new public key. Note that this will make existing exchange keys from the other data owner to the current data owner invalid for\n   * encryption.\n   * @param otherDataOwner the other data owner.\n   * @param newDataOwnerPublicKey a new public key of the other data owner.\n   * @param keyPairsByFingerprint all available key pairs to use for the decryption of existing aes exchange keys.\n   */\n  async giveAccessBackTo(\n    otherDataOwner: string,\n    newDataOwnerPublicKey: string,\n    keyPairsByFingerprint: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ) {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const other = await this.dataOwnerApi.getCryptoActorStub(otherDataOwner)\n    const newKeyHashVersion = getShaVersionForKey(other.stub, newDataOwnerPublicKey)\n    if (!newKeyHashVersion) throw new Error(`Public key not found for data owner ${otherDataOwner}`)\n    const newPublicKey = await this.primitives.RSA.importKey('spki', hex2ua(newDataOwnerPublicKey), ['encrypt'], newKeyHashVersion)\n    await this.extendForGiveAccessBackTo(selfId, otherDataOwner, fingerprintV1(newDataOwnerPublicKey), newPublicKey, keyPairsByFingerprint)\n    await this.extendForGiveAccessBackTo(otherDataOwner, selfId, fingerprintV1(newDataOwnerPublicKey), newPublicKey, keyPairsByFingerprint)\n  }\n\n  /**\n   * Get the encrypted exchange keys for a delegator-delegate pair.\n   * @param delegatorId id of the delegator data owner.\n   * @param delegateId id of the delegate data owner.\n   * @return an array of exchange keys from the delegator to delegate where each key is encrypted with one or more public keys.\n   */\n  async getEncryptedExchangeKeysFor(delegatorId: string, delegateId: string): Promise<{ [publicKeyFingerprint: string]: string }[]> {\n    const delegator = await this.dataOwnerApi.getCryptoActorStub(delegatorId)\n    const res: { [publicKeyFingerprint: string]: string }[] = Object.values(delegator.stub.aesExchangeKeys ?? {}).flatMap((delegateToKey) => {\n      const encryptedKeyForDelegate = delegateToKey[delegateId]\n      if (encryptedKeyForDelegate) {\n        return [encryptedKeyForDelegate]\n      } else {\n        return []\n      }\n    })\n    const legacyDelegation = delegator.stub.hcPartyKeys?.[delegateId]?.[1]\n    if (legacyDelegation) res.push({ '': legacyDelegation })\n    return res\n  }\n\n  /**\n   * Get all exchange keys where the provided data owner is involved either as the delegator or as the delegate.\n   * @param dataOwnerId id of a data owner.\n   * @param otherOwnerTypes only exchange keys between the current data owner and data owners of this type will be included in the result.\n   * @return all exchange keys involving the provided data owner. Note that there may be an overlap between some keys to and from the data owner.\n   */\n  async getAllExchangeKeysWith(\n    dataOwnerId: string,\n    otherOwnerTypes: DataOwnerTypeEnum[]\n  ): Promise<{\n    keysToOwner: { [delegatorId: string]: { [delegatorFp: string]: { [entryFp: string]: string } } }\n    keysFromOwner: { [delegatorFp: string]: { [delegateId: string]: { [entryFp: string]: string } } }\n  }> {\n    if (otherOwnerTypes.length === 0) throw new Error('otherOwnerTypes must not be empty!')\n    const keysToOwner = await Promise.all([\n      otherOwnerTypes.find((x) => x === 'hcp') ? this.hcpartyBaseApi.getAesExchangeKeysForDelegate(dataOwnerId).catch(() => {}) : Promise.resolve({}),\n      otherOwnerTypes.find((x) => x === 'patient')\n        ? this.patientBaseApi.getPatientAesExchangeKeysForDelegate(dataOwnerId).catch(() => {})\n        : Promise.resolve({}),\n      otherOwnerTypes.find((x) => x === 'device')\n        ? this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(dataOwnerId).catch(() => {})\n        : Promise.resolve({}),\n    ]).then(([a, b, c]) => ({ ...a, ...b, ...c } as { [delegatorId: string]: { [delegatorFp: string]: { [entryFp: string]: string } } }))\n    const dataOwner = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n    const allOwnerKeys = await this.combineLegacyHcpKeysWithAesExchangeKeys(dataOwner.stub, undefined)\n    const filteredDelegates = new Set(\n      await Array.from(new Set(Object.values(allOwnerKeys).flatMap((x) => Object.keys(x)))).reduce(async (acc, ownerId) => {\n        const awaitedAcc = await acc\n        if (ownerId === dataOwnerId) {\n          return [...awaitedAcc, ownerId]\n        } else {\n          const dataOwnerType: DataOwnerTypeEnum = (await this.dataOwnerApi.getCryptoActorStub(ownerId)).type\n          if (otherOwnerTypes.some((x) => x === dataOwnerType)) {\n            return [...awaitedAcc, ownerId]\n          } else return awaitedAcc\n        }\n      }, Promise.resolve([] as string[]))\n    )\n    const keysFromOwner = Object.fromEntries(\n      Object.entries(allOwnerKeys)\n        .map(([delegatorPubKey, delegateToKeys]) => [\n          delegatorPubKey,\n          Object.fromEntries(\n            Object.entries(delegateToKeys).filter(([delegateId]) => filteredDelegates.has(delegateId)) as [string, { [k: string]: string }][]\n          ),\n        ])\n        .filter(([, x]) => Object.keys(x).length > 0) as [string, { [k: string]: { [k: string]: string } }][]\n    )\n    return { keysToOwner, keysFromOwner }\n  }\n\n  /**\n   * Attempts to decrypt many exchange keys using any of the provided key pairs.\n   * @param encryptedExchangeKeys an array of exchange keys where each key is encrypted with one or more public keys.\n   * @param keyPairsByFingerprint rsa key pairs to use for decryption.\n   * @return an array all successfully decrypted exchange keys and an array containing all exchange keys which could not be decrypted.\n   */\n  async tryDecryptExchangeKeys(\n    encryptedExchangeKeys: { [publicKeyFingerprint: string]: string }[],\n    keyPairsByFingerprint: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: { [publicKeyFingerprint: string]: string }[]\n  }> {\n    const raws = new Set<string>()\n    const res: {\n      successfulDecryptions: CryptoKey[]\n      failedDecryptions: { [publicKeyFingerprint: string]: string }[]\n    } = { successfulDecryptions: [], failedDecryptions: [] }\n    for (const encryptedExchangeKey of encryptedExchangeKeys) {\n      const decrypted = await this.tryDecryptExchangeKey(encryptedExchangeKey, keyPairsByFingerprint)\n      if (decrypted !== undefined && !raws.has(decrypted.raw)) {\n        raws.add(decrypted.raw)\n        res.successfulDecryptions.push(decrypted.key)\n      } else {\n        res.failedDecryptions.push(encryptedExchangeKey)\n      }\n    }\n    return res\n  }\n\n  private async extendForGiveAccessBackTo(\n    delegatorId: string,\n    delegateId: string,\n    newPublicKeyFp: string,\n    newPublicKey: CryptoKey,\n    decryptionKeyPairsByFingerprint: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ) {\n    await notConcurrent(this.generateKeyConcurrencyMap, delegatorId, async () => {\n      const delegator = await this.dataOwnerApi.getCryptoActorStub(delegatorId)\n      const delegate = await this.dataOwnerApi.getCryptoActorStub(delegateId)\n      let didUpdateSomeKey = false\n      const combinedKeys = await this.combineLegacyHcpKeysWithAesExchangeKeys(delegator.stub, delegate.stub)\n      const updatedExchangeKeys: { [delegatorKey: string]: { [delegateId: string]: { [keyFp: string]: string } } } = {}\n      const newEncryptionKeys = { [newPublicKeyFp]: newPublicKey }\n      for (const [currDelegatorKey, currDelegatesToKeys] of Object.entries(combinedKeys)) {\n        const updatedDelegatesToKeys: { [delegateId: string]: { [keyFp: string]: string } } = {}\n        for (const [currDelegateId, currEncryptedKey] of Object.entries(currDelegatesToKeys)) {\n          if (delegateId !== currDelegateId || newPublicKeyFp in currEncryptedKey) {\n            updatedDelegatesToKeys[currDelegateId] = currEncryptedKey\n          } else {\n            const decrypted = await this.tryDecryptExchangeKey(currEncryptedKey, decryptionKeyPairsByFingerprint)\n            if (decrypted) {\n              didUpdateSomeKey = true\n              updatedDelegatesToKeys[currDelegateId] = {\n                ...currEncryptedKey,\n                ...(await this.encryptExchangeKey(decrypted, newEncryptionKeys)).encryptedExchangeKey,\n              }\n            } else {\n              updatedDelegatesToKeys[currDelegateId] = currEncryptedKey\n            }\n          }\n        }\n        updatedExchangeKeys[currDelegatorKey] = updatedDelegatesToKeys\n      }\n      if (didUpdateSomeKey) {\n        await this.dataOwnerApi.modifyCryptoActorStub({\n          type: delegator.type,\n          stub: {\n            ...delegator.stub,\n            aesExchangeKeys: updatedExchangeKeys,\n          },\n        })\n      }\n    })\n  }\n\n  /**\n   * Attempts to decrypt an exchange key using any of the provided key pairs.\n   * @param encryptedExchangeKey an encrypted exchange key, in the form publicKeyXyzFingerprint -> hex(exchangeKeyEncryptedByPrivateKeyXyz).\n   * @param keyPairsByFingerprint rsa key pairs to use for decryption.\n   * @return the decrypted exchange key, in raw and key format (to allow deduplication), or undefined if the key could not be decrypted using the\n   * provided keys.\n   */\n  private async tryDecryptExchangeKey(\n    encryptedExchangeKey: { [publicKeyFingerprint: string]: string },\n    keyPairsByFingerprint: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{ raw: string; key: CryptoKey } | undefined> {\n    for (const [entryKey, encrypted] of Object.entries(encryptedExchangeKey)) {\n      // Due to bugs in past version the entry may actually contain the full public key instead of just the fingerprint.\n      const fp = entryKey.slice(-32)\n      const keyPair = keyPairsByFingerprint[fp]\n      if (keyPair !== undefined) {\n        const res = await this.tryDecryptExchangeKeyWith(encrypted, keyPair, fp)\n        if (res !== undefined) return res\n      }\n    }\n    const defaultEncryptedKey = encryptedExchangeKey['']\n    if (defaultEncryptedKey !== undefined) {\n      for (const keyPair of Object.values(keyPairsByFingerprint)) {\n        // disable error logging, we are not sure keyPair is the correct key\n        const res = await this.tryDecryptExchangeKeyWith(defaultEncryptedKey, keyPair, undefined)\n        if (res !== undefined) return res\n      }\n    }\n    return undefined\n  }\n\n  /**\n   * Creates an encrypted exchange key for the provided public keys.\n   * @param exchangeKey the exchange key in raw and imported format. If undefined a new key will be automatically created.\n   * @param publicKeys additional public keys that will have access to the exchange key in spki format, hex-encoded.\n   * @return the exchangeKey and an object with the exchange key encrypted with each of the provided public keys, hex-encoded, by fingerprint.\n   */\n  private async encryptExchangeKey(\n    exchangeKey: { raw: string; key: CryptoKey } | undefined,\n    publicKeys: { [keyFingerprint: string]: CryptoKey }\n  ): Promise<{\n    exchangeKey: CryptoKey\n    encryptedExchangeKey: { [pubKeyFp: string]: string }\n  }> {\n    const exchangeKeyCrypto = exchangeKey?.key ?? (await this.primitives.AES.generateCryptoKey(false))\n    const exchangeKeyBytes = exchangeKey !== undefined ? hex2ua(exchangeKey.raw) : await this.primitives.AES.exportKey(exchangeKeyCrypto, 'raw')\n    const encryptedExchangeKey = await Object.entries(publicKeys).reduce(\n      async (acc, [currKeyFp, currKey]) => ({\n        ...(await acc),\n        [currKeyFp]: ua2hex(await this.primitives.RSA.encrypt(currKey, new Uint8Array(exchangeKeyBytes))),\n      }),\n      Promise.resolve({} as { [pubKeyFp: string]: string })\n    )\n    return { exchangeKey: exchangeKeyCrypto, encryptedExchangeKey }\n  }\n\n  /**\n   * Attempts to decrypt an exchange key using the provided key pairs.\n   * If you are confident that the provided {@link keyPair} was used to encrypt {@link encryptedByOneKey} you should also provide {@link keyPairFp},\n   * so that if the decryption fail an error will be logged to console before returning undefined.\n   * @param encryptedByOneKey an exchange key which may be encrypted with {@link keyPair}.\n   * @param keyPair an rsa key pair.\n   * @param keyPairFp the fingerprint of the provided key pair or undefined to disable logging of error if the decryption failed.\n   * @return the decrypted exchange key, in raw and key format (to allow deduplication), or undefined if the key could not be decrypted using the\n   * provided key.\n   */\n  private async tryDecryptExchangeKeyWith(\n    encryptedByOneKey: string,\n    keyPair: KeyPair<CryptoKey>,\n    keyPairFp: string | undefined // if undefined will not log errors, when we are not sure the key to be used is the provided key.\n  ): Promise<{ raw: string; key: CryptoKey } | undefined> {\n    try {\n      const decrypted = await this.primitives.RSA.decrypt(keyPair.privateKey, hex2ua(encryptedByOneKey))\n      return { raw: ua2hex(decrypted), key: await this.primitives.AES.importKey('raw', decrypted) }\n    } catch (e) {\n      if (keyPairFp) {\n        console.error(`Failed to decrypt or import exchange key ${encryptedByOneKey} using key with fingerprint ${keyPairFp}.`, e)\n      }\n    }\n  }\n\n  private updateLegacyExchangeKeys(\n    delegator: CryptoActorStubWithType,\n    delegate: CryptoActorStubWithType,\n    encryptedKeyMap: { [fp: string]: string }\n  ): { [delegateId: string]: string[] } | undefined {\n    const legacyEncryptedKeyDelegator = delegator.stub.publicKey ? encryptedKeyMap[delegator.stub.publicKey] : undefined\n    const legacyEncryptedKeyDelegate = delegate.stub.publicKey ? encryptedKeyMap[delegate.stub.publicKey] : undefined\n    if (legacyEncryptedKeyDelegator && legacyEncryptedKeyDelegate) {\n      return {\n        ...(delegator.stub.hcPartyKeys ?? {}),\n        [delegate.stub.id!]: [legacyEncryptedKeyDelegator, legacyEncryptedKeyDelegate],\n      }\n    } else return delegator.stub.hcPartyKeys\n  }\n\n  // Copy all legacy hcp exchange keys into the new aes exchange keys\n  private async combineLegacyHcpKeysWithAesExchangeKeys(\n    owner: CryptoActorStub,\n    delegate: CryptoActorStub | undefined\n  ): Promise<{ [ownerPublicKey: string]: { [delegateId: string]: { [fingerprint: string]: string } } }> {\n    const ownerLegacyPublicKey = owner.publicKey\n    if (ownerLegacyPublicKey && !(owner.aesExchangeKeys ?? {})[ownerLegacyPublicKey]) {\n      /*\n       * This condition would technically prevent new updates to the hcPartyKeys to be migrated to the aes exchange keys, but since I can only update\n       * data for self data owner and parent entities this is not an issue, because I will always be using the new api from now on and I won't have\n       * a situation where the legacy keys are updated but the aes exchange keys are not.\n       */\n      const unknownDataOwnerCounterPartIds = Object.keys(owner.hcPartyKeys ?? {}).filter((x) => x !== owner.id && x !== delegate?.id)\n      const counterPartsById = [\n        owner,\n        ...(delegate ? [delegate] : []),\n        ...(await Promise.all(unknownDataOwnerCounterPartIds.map(async (cpid) => (await this.dataOwnerApi.getCryptoActorStub(cpid)).stub))),\n      ].reduce((acc, dataOwner) => {\n        acc[dataOwner.id!] = dataOwner\n        return acc\n      }, {} as { [id: string]: CryptoActorStub })\n      return {\n        [ownerLegacyPublicKey]: Object.entries(owner.hcPartyKeys ?? {}).reduce((acc, [hcpId, keys]) => {\n          acc[hcpId] = { [ownerLegacyPublicKey.slice(-32)]: keys[0], [counterPartsById[hcpId]?.publicKey?.slice(-32) ?? '']: keys[1] }\n          return acc\n        }, {} as { [delegateId: string]: { [fingerprint: string]: string } }),\n        ...(owner.aesExchangeKeys ?? {}),\n      }\n    } else return owner.aesExchangeKeys ?? {}\n  }\n}\n"]}

package/icc-x-api/crypto/ConfidentialEntities.d.ts

@@ -1,8 +1,12 @@
 import { EncryptedEntity } from '../../icc-api/model/models';
-import { EntitiesEncryption } from './EntitiesEncryption';
+import { ExtendedApisUtils } from './ExtendedApisUtils';
 import { CryptoPrimitives } from './CryptoPrimitives';
 import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName';
+import { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest';
+import { EntityBulkShareResult } from '../../icc-api/model/requests/EntityBulkShareResult';
 /**
+ * @internal this class is intended for internal use only and may be changed without notice.
  * This class helps to create confidential medical data in systems where multiple hcps share data with each other using parent hcps: while normally
  * the hcps would share all data with other hcps part of the same "family" (e.g. an hospital) there are situations where the medical data is
  * confidential and should only be known by the doctor which created the data. In these situations it is also important that the secret foreign key
@@ -13,17 +17,23 @@ export declare class ConfidentialEntities {
     private readonly entitiesEncryption;
     private readonly primitives;
     private readonly dataOwnerApi;
-    constructor(entitiesEncryption: EntitiesEncryption, primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi);
+    constructor(entitiesEncryption: ExtendedApisUtils, primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi);
     /**
      * Ensures that the current data owner has access to a confidential secret id for the provided entity: this is an id that is known to the data owner
      * but is not known by any of his parents. If there is currently no confidential secret id for this entity the method returns a copy of the entity
      * with a new confidential secret id for the current data owner (the entity in the database won't be updated), else this method returns undefined.
      * New confidential secret ids will have an appropriate tag, but existing confidential secret ids may not necessarily have it.
      * @param entity an entity which needs to have a confidential secret id for the current data owner
-     * @return undefined if the entity already had a confidential secret id for the current user, or the updated entity with the new confidential secret
-     * id.
+     * @param entityType the type of the entity
+     * @param doRequestBulkShareOrUpdate perform the request to share or update an entity encrypted metadata on the cloud API (and save to DB).
+     * @return undefined if the entity already had a confidential secret id for the current user, or the updated AND SAVED entity with the new
+     * confidential secret id.
      */
-    entityWithInitialisedConfidentialSecretId<T extends EncryptedEntity>(entity: T): Promise<T | undefined>;
+    initialiseConfidentialSecretId<T extends EncryptedEntity>(entity: T, entityType: EntityWithDelegationTypeName, doRequestBulkShareOrUpdate: (request: {
+        [entityId: string]: {
+            [requestId: string]: EntityShareOrMetadataUpdateRequest;
+        };
+    }) => Promise<EntityBulkShareResult<T>[]>): Promise<T | undefined>;
     /**
      * Get an existing confidential secret id of the provided entity for the provided data owner (current data owner by default). A confidential secret
      * id is a secret id known by the data owner but not known by any of his parents: note however that children will know confidential secret ids.
@@ -31,15 +41,7 @@ export declare class ConfidentialEntities {
      * @param dataOwnerId (current data owner by default) a data owner for which you want to get a confidential secret id.
      * @return the confidential secret id or undefined if there is no confidential secret id for the provided data owner.
      */
-    getConfidentialSecretId(entity: EncryptedEntity, dataOwnerId?: string): Promise<string | undefined>;
-    /**
-     * Gets a secret id known by the topmost parent of the current data owner hierarchy. If there is multiple secret ids shared with the topmost parent
-     * there is no guarantee on which one will be chosen.
-     * @param entity an entity.
-     * @return a secret id known by the topmost parent of the current data owner hierarchy, or undefined if there is no secret id currently available
-     * for the topmost parent.
-     */
-    getAnySecretIdSharedWithParents(entity: EncryptedEntity): Promise<string | undefined>;
+    getConfidentialSecretId(entity: EncryptedEntityWithType, dataOwnerId?: string): Promise<string | undefined>;
     /**
      * Get all existing confidential secret ids of the provided entity for the provided data owner (current data owner by default). A confidential secret
      * id is a secret id known by the data owner but not known by any of his parents: note however that children will know confidential secret ids.
@@ -47,12 +49,20 @@ export declare class ConfidentialEntities {
      * @param dataOwnerId (current data owner by default) a data owner for which you want to get a confidential secret id.
      * @return the confidential secret ids for the data owner (may be empty).
      */
-    getConfidentialSecretIds(entity: EncryptedEntity, dataOwnerId?: string): Promise<string[]>;
+    getConfidentialSecretIds(entity: EncryptedEntityWithType, dataOwnerId?: string): Promise<string[]>;
+    /**
+     * Gets a secret id known by the topmost parent of the current data owner hierarchy. If there is multiple secret ids shared with the topmost parent
+     * there is no guarantee on which one will be chosen.
+     * @param entity an entity.
+     * @return a secret id known by the topmost parent of the current data owner hierarchy, or undefined if there is no secret id currently available
+     * for the topmost parent.
+     */
+    getAnySecretIdSharedWithParents(entity: EncryptedEntityWithType): Promise<string | undefined>;
     /**
      * Gets all secret ids known by the topmost parent of the current data owner hierarchy (or all secret ids known by the current data owner if he is
      * not part of any data owner hierarchy).
      * @param entity an entity.
      * @return all secret ids known by the topmost parent of the current data owner hierarchy, may be empty.
      */
-    getSecretIdsSharedWithParents(entity: EncryptedEntity): Promise<string[]>;
+    getSecretIdsSharedWithParents(entity: EncryptedEntityWithType): Promise<string[]>;
 }

package/icc-x-api/crypto/ConfidentialEntities.js

@@ -10,7 +10,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConfidentialEntities = void 0;
+const ShareMetadataBehaviour_1 = require("./ShareMetadataBehaviour");
+const EntityShareRequest_1 = require("../../icc-api/model/requests/EntityShareRequest");
+var RequestedPermissionEnum = EntityShareRequest_1.EntityShareRequest.RequestedPermissionEnum;
 /**
+ * @internal this class is intended for internal use only and may be changed without notice.
  * This class helps to create confidential medical data in systems where multiple hcps share data with each other using parent hcps: while normally
  * the hcps would share all data with other hcps part of the same "family" (e.g. an hospital) there are situations where the medical data is
  * confidential and should only be known by the doctor which created the data. In these situations it is also important that the secret foreign key
@@ -29,15 +33,24 @@ class ConfidentialEntities {
      * with a new confidential secret id for the current data owner (the entity in the database won't be updated), else this method returns undefined.
      * New confidential secret ids will have an appropriate tag, but existing confidential secret ids may not necessarily have it.
      * @param entity an entity which needs to have a confidential secret id for the current data owner
-     * @return undefined if the entity already had a confidential secret id for the current user, or the updated entity with the new confidential secret
-     * id.
+     * @param entityType the type of the entity
+     * @param doRequestBulkShareOrUpdate perform the request to share or update an entity encrypted metadata on the cloud API (and save to DB).
+     * @return undefined if the entity already had a confidential secret id for the current user, or the updated AND SAVED entity with the new
+     * confidential secret id.
      */
-    entityWithInitialisedConfidentialSecretId(entity) {
+    initialiseConfidentialSecretId(entity, entityType, doRequestBulkShareOrUpdate) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (yield this.getConfidentialSecretId(entity))
+            if (yield this.getConfidentialSecretId({ entity, type: entityType }))
                 return undefined;
             const confidentialSecretId = this.primitives.randomUuid();
-            return yield this.entitiesEncryption.entityWithExtendedEncryptedMetadata(entity, yield this.dataOwnerApi.getCurrentDataOwnerId(), [confidentialSecretId], [], [], ['confidential']);
+            return (yield this.entitiesEncryption.simpleShareOrUpdateEncryptedEntityMetadata({ entity, type: entityType }, false, {
+                [yield this.dataOwnerApi.getCurrentDataOwnerId()]: {
+                    shareEncryptionKeys: ShareMetadataBehaviour_1.ShareMetadataBehaviour.NEVER,
+                    shareOwningEntityIds: ShareMetadataBehaviour_1.ShareMetadataBehaviour.NEVER,
+                    shareSecretIds: [confidentialSecretId],
+                    requestedPermissions: RequestedPermissionEnum.MAX_WRITE,
+                },
+            }, (request) => doRequestBulkShareOrUpdate(request))).updatedEntityOrThrow;
         });
     }
     /**
@@ -52,18 +65,6 @@ class ConfidentialEntities {
             return this.getConfidentialSecretIds(entity, dataOwnerId).then((x) => x[0]);
         });
     }
-    /**
-     * Gets a secret id known by the topmost parent of the current data owner hierarchy. If there is multiple secret ids shared with the topmost parent
-     * there is no guarantee on which one will be chosen.
-     * @param entity an entity.
-     * @return a secret id known by the topmost parent of the current data owner hierarchy, or undefined if there is no secret id currently available
-     * for the topmost parent.
-     */
-    getAnySecretIdSharedWithParents(entity) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return (yield this.getSecretIdsSharedWithParents(entity))[0];
-        });
-    }
     /**
      * Get all existing confidential secret ids of the provided entity for the provided data owner (current data owner by default). A confidential secret
      * id is a secret id known by the data owner but not known by any of his parents: note however that children will know confidential secret ids.
@@ -83,6 +84,18 @@ class ConfidentialEntities {
             return keysForDataOwner.extracted.filter((k) => !hierarchySecretIds.some((x) => x.ownerId !== chosenDataOwnerId && x.extracted.includes(k)));
         });
     }
+    /**
+     * Gets a secret id known by the topmost parent of the current data owner hierarchy. If there is multiple secret ids shared with the topmost parent
+     * there is no guarantee on which one will be chosen.
+     * @param entity an entity.
+     * @return a secret id known by the topmost parent of the current data owner hierarchy, or undefined if there is no secret id currently available
+     * for the topmost parent.
+     */
+    getAnySecretIdSharedWithParents(entity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (yield this.getSecretIdsSharedWithParents(entity))[0];
+        });
+    }
     /**
      * Gets all secret ids known by the topmost parent of the current data owner hierarchy (or all secret ids known by the current data owner if he is
      * not part of any data owner hierarchy).