@icure/api 7.1.14 → 8.0.0-RC.1

package/icc-x-api/crypto/AccessControlSecretUtils.js

@@ -0,0 +1,86 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessControlSecretUtils = void 0;
+const utils_1 = require("../utils");
+const ACCESS_CONTROL_KEY_LENGTH_BYTES = 16;
+/**
+ * @internal this class is intended for internal use only and may be changed without notice.
+ */
+class AccessControlSecretUtils {
+    constructor(primitives) {
+        this.primitives = primitives;
+    }
+    /**
+     * Size of the access control keys returned by this class.
+     */
+    get accessControlKeyLengthBytes() {
+        return ACCESS_CONTROL_KEY_LENGTH_BYTES;
+    }
+    /**
+     * Get the access control key to use for entities of the provided type and using the provided secret foreign key. The combination of secret foreign
+     * keys and entity type ensures that unauthorised people will not be able to draw links between entities of different types of data or different
+     * confidentiality levels.
+     * These keys will be sent to the icure server for access control of data owners which require anonymous delegations.
+     * @param accessControlSecret an access control secret
+     * @param entityTypeName an entity type name
+     * @param secretForeignKey optionally a secret foreign key to include in the secret. "" and undefined are equivalent.
+     */
+    accessControlKeyFor(accessControlSecret, entityTypeName, secretForeignKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact
+            // Ignore secret foreign key for now
+            return (yield this.primitives.sha256((0, utils_1.utf8_2ua)(accessControlSecret + entityTypeName /* + (secretForeignKey ?? '')*/))).slice(0, ACCESS_CONTROL_KEY_LENGTH_BYTES);
+        });
+    }
+    /**
+     * Get the access control keys for proving access to an entity of provided type with the provided secret foreign keys.
+     */
+    accessControlKeysFor(accessControlSecret, entityTypeName, secretForeignKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.accessControlKeyFor(a, b, c));
+        });
+    }
+    /**
+     * Get value to use as key in secure delegations for entities of the provided type with the provided secret foreign key. The combination of secret
+     * foreign keys and entity type ensures that unauthorised people will not be able to draw links between entities of different types of data or
+     * different confidentiality levels.
+     * These keys will be used in the secure delegations map of security metadata.
+     * @param accessControlSecret an access control secret
+     * @param entityTypeName an entity type name
+     * @param secretForeignKey optionally a secret foreign key to include in the secret. "" and undefined are equivalent.
+     */
+    secureDelegationKeyFor(accessControlSecret, entityTypeName, secretForeignKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, utils_1.ua2hex)(yield this.primitives.sha256(yield this.accessControlKeyFor(accessControlSecret, entityTypeName, secretForeignKey)));
+        });
+    }
+    /**
+     * Get the secure delegations keys which can be used on an entity of provided type with the provided secret foreign keys.
+     */
+    secureDelegationKeysFor(accessControlSecret, entityTypeName, secretForeignKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.secureDelegationKeyFor(a, b, c));
+        });
+    }
+    getKeys(accessControlSecret, entityTypeName, secretForeignKeys, getKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact
+            // if (!secretForeignKeys.length) {
+            return [yield getKey(accessControlSecret, entityTypeName, undefined)];
+            // } else {
+            //   return await Promise.all(secretForeignKeys.map((sfk) => getKey(accessControlSecret, entityTypeName, sfk)))
+            // }
+        });
+    }
+}
+exports.AccessControlSecretUtils = AccessControlSecretUtils;
+//# sourceMappingURL=AccessControlSecretUtils.js.map

package/icc-x-api/crypto/AccessControlSecretUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessControlSecretUtils.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/AccessControlSecretUtils.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,oCAA2C;AAE3C,MAAM,+BAA+B,GAAG,EAAE,CAAA;AAE1C;;GAEG;AACH,MAAa,wBAAwB;IACnC,YAA6B,UAA4B;QAA5B,eAAU,GAAV,UAAU,CAAkB;IAAG,CAAC;IAE7D;;OAEG;IACH,IAAI,2BAA2B;QAC7B,OAAO,+BAA+B,CAAA;IACxC,CAAC;IAED;;;;;;;;OAQG;IACG,mBAAmB,CACvB,mBAA2B,EAC3B,cAA4C,EAC5C,gBAAoC;;YAEpC,sIAAsI;YACtI,oCAAoC;YACpC,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAA,gBAAQ,EAAC,mBAAmB,GAAG,cAAc,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,KAAK,CACzH,CAAC,EACD,+BAA+B,CAChC,CAAA;QACH,CAAC;KAAA;IAED;;OAEG;IACG,oBAAoB,CACxB,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B;;YAE3B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACnI,CAAC;KAAA;IAED;;;;;;;;OAQG;IACG,sBAAsB,CAC1B,mBAA2B,EAC3B,cAA4C,EAC5C,gBAAoC;;YAEpC,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACpI,CAAC;KAAA;IAED;;OAEG;IACG,uBAAuB,CAC3B,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B;;YAE3B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACtI,CAAC;KAAA;IAEa,OAAO,CACnB,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B,EAC3B,MAAuI;;YAEvI,sIAAsI;YAEtI,mCAAmC;YACnC,OAAO,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAA;YACrE,WAAW;YACX,+GAA+G;YAC/G,IAAI;QACN,CAAC;KAAA;CACF;AArFD,4DAqFC","sourcesContent":["import { CryptoPrimitives } from './CryptoPrimitives'\nimport { EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { ua2hex, utf8_2ua } from '../utils'\n\nconst ACCESS_CONTROL_KEY_LENGTH_BYTES = 16\n\n/**\n * @internal this class is intended for internal use only and may be changed without notice.\n */\nexport class AccessControlSecretUtils {\n  constructor(private readonly primitives: CryptoPrimitives) {}\n\n  /**\n   * Size of the access control keys returned by this class.\n   */\n  get accessControlKeyLengthBytes(): number {\n    return ACCESS_CONTROL_KEY_LENGTH_BYTES\n  }\n\n  /**\n   * Get the access control key to use for entities of the provided type and using the provided secret foreign key. The combination of secret foreign\n   * keys and entity type ensures that unauthorised people will not be able to draw links between entities of different types of data or different\n   * confidentiality levels.\n   * These keys will be sent to the icure server for access control of data owners which require anonymous delegations.\n   * @param accessControlSecret an access control secret\n   * @param entityTypeName an entity type name\n   * @param secretForeignKey optionally a secret foreign key to include in the secret. \"\" and undefined are equivalent.\n   */\n  async accessControlKeyFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKey: string | undefined\n  ): Promise<ArrayBuffer> {\n    // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n    // Ignore secret foreign key for now\n    return (await this.primitives.sha256(utf8_2ua(accessControlSecret + entityTypeName /* + (secretForeignKey ?? '')*/))).slice(\n      0,\n      ACCESS_CONTROL_KEY_LENGTH_BYTES\n    )\n  }\n\n  /**\n   * Get the access control keys for proving access to an entity of provided type with the provided secret foreign keys.\n   */\n  async accessControlKeysFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[]\n  ): Promise<ArrayBuffer[]> {\n    return await this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.accessControlKeyFor(a, b, c))\n  }\n\n  /**\n   * Get value to use as key in secure delegations for entities of the provided type with the provided secret foreign key. The combination of secret\n   * foreign keys and entity type ensures that unauthorised people will not be able to draw links between entities of different types of data or\n   * different confidentiality levels.\n   * These keys will be used in the secure delegations map of security metadata.\n   * @param accessControlSecret an access control secret\n   * @param entityTypeName an entity type name\n   * @param secretForeignKey optionally a secret foreign key to include in the secret. \"\" and undefined are equivalent.\n   */\n  async secureDelegationKeyFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKey: string | undefined\n  ): Promise<string> {\n    return ua2hex(await this.primitives.sha256(await this.accessControlKeyFor(accessControlSecret, entityTypeName, secretForeignKey)))\n  }\n\n  /**\n   * Get the secure delegations keys which can be used on an entity of provided type with the provided secret foreign keys.\n   */\n  async secureDelegationKeysFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[]\n  ): Promise<string[]> {\n    return await this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.secureDelegationKeyFor(a, b, c))\n  }\n\n  private async getKeys<T>(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[],\n    getKey: (accessControlSecret: string, entityTypeName: EntityWithDelegationTypeName, secretForeignKey: string | undefined) => Promise<T>\n  ): Promise<T[]> {\n    // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n\n    // if (!secretForeignKeys.length) {\n    return [await getKey(accessControlSecret, entityTypeName, undefined)]\n    // } else {\n    //   return await Promise.all(secretForeignKeys.map((sfk) => getKey(accessControlSecret, entityTypeName, sfk)))\n    // }\n  }\n}\n"]}

package/icc-x-api/crypto/BaseExchangeDataManager.d.ts

@@ -0,0 +1,146 @@
+import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { KeyPair } from './RSA';
+import { ExchangeData } from '../../icc-api/model/ExchangeData';
+import { IccExchangeDataApi } from '../../icc-api/api/IccExchangeDataApi';
+import { CryptoPrimitives } from './CryptoPrimitives';
+/**
+ * @internal this class is intended for internal use only and may be modified without notice
+ * Functions to create and get exchange data.
+ * The methods of this api require to pass the appropriate keys for encryption/decryption manually.
+ */
+export declare class BaseExchangeDataManager {
+    readonly api: IccExchangeDataApi;
+    private readonly dataOwnerApi;
+    private readonly primitives;
+    private readonly selfRequiresAnonymousDelegations;
+    constructor(api: IccExchangeDataApi, dataOwnerApi: IccDataOwnerXApi, primitives: CryptoPrimitives, selfRequiresAnonymousDelegations: boolean);
+    /**
+     * Get all the exchange data where the current data owner is the delegator or the delegate. However, some data owners, generally HCPs, may have a
+     * prohibitively high amount of exchange data. If the crypto strategies specify that the current data owner requires anonymous delegation this
+     * method returns all the exchange data found for the data owner, else the method returns undefined.
+     * @return all the exchange data for the current data owner or undefined if the crypto strategies don't allow to retrieve all data for the current
+     * data owner.
+     */
+    getAllExchangeDataForCurrentDataOwnerIfAllowed(): Promise<ExchangeData[] | undefined>;
+    /**
+     * Get all exchange data for the provided delegator-delegate pair.
+     * @param delegatorId id of a delegator data owner.
+     * @param delegateId id of a delegate data owner.
+     * @return all exchange data for the provided delegator-delegate pair.
+     */
+    getExchangeDataByDelegatorDelegatePair(delegatorId: string, delegateId: string): Promise<ExchangeData[]>;
+    /**
+     * Get the exchange data with the provided id.
+     * @param exchangeDataId id of the exchange data.
+     * @return the exchange data with the provided id or undefined if no exchange data with such id could be found.
+     */
+    getExchangeDataById(exchangeDataId: string): Promise<ExchangeData | undefined>;
+    /**
+     * Filters exchange data returning only the instances that could be verified using their signature and the provided verification
+     * keys.
+     * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)
+     * will always be unverified.
+     * @param exchangeData the exchange data to verify.
+     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
+     * @return the exchange data which could be verified given his signature and the available verification keys.
+     * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.
+     */
+    filterVerifiedExchangeData(exchangeData: ExchangeData[], getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>): Promise<ExchangeData[]>;
+    /**
+     * Verifies the authenticity of the exchange data by checking the signature.
+     * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)
+     * will always be unverified.
+     * @param exchangeData the exchange data to verify.
+     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
+     * @return the exchange data which could be verified given his signature and the available verification keys.
+     * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.
+     */
+    verifyExchangeData(exchangeData: ExchangeData, getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>): Promise<boolean>;
+    /**
+     * Extracts and decrypts the access control secret from the provided exchange data.
+     * These need to be hashed together with the entity class and confidentiality level in order to get the actual access control key
+     * which will be sent to the server.
+     * @param exchangeData the exchange data from which to extract access control secrets.
+     * @param decryptionKeys rsa key pairs to use for decryption of the access control secret.
+     * @return an object composed of:
+     * - successfulDecryptions: array of all successfully decrypted access control keys
+     * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).
+     */
+    tryDecryptAccessControlSecret(exchangeData: ExchangeData[], decryptionKeys: {
+        [publicKeyFingerprint: string]: KeyPair<CryptoKey>;
+    }): Promise<{
+        successfulDecryptions: string[];
+        failedDecryptions: ExchangeData[];
+    }>;
+    /**
+     * Extract and decrypts the exchange keys from the provided exchange data.
+     * @param exchangeData the exchange data from which to extract exchange keys.
+     * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.
+     * @return an object composed of:
+     * - successfulDecryptions: array containing the successfully decrypted exchange keys.
+     * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).
+     */
+    tryDecryptExchangeKeys(exchangeData: ExchangeData[], decryptionKeys: {
+        [publicKeyFingerprint: string]: KeyPair<CryptoKey>;
+    }): Promise<{
+        successfulDecryptions: CryptoKey[];
+        failedDecryptions: ExchangeData[];
+    }>;
+    private tryDecryptExchangeData;
+    private tryDecrypt;
+    /**
+     * Creates exchange data from the current data owner to the provided delegate, uploading the newly created exchange data to the cloud.
+     * This assumes that the keys have been verified.
+     * @param delegateId id of the delegate for the new exchange data.
+     * @param signatureKeys private keys to use for signing the created data.
+     * @param encryptionKeys public keys to use for the encryption of the exchange data (from delegator and delegate).
+     * @param optionalAttributes optional precalculated attributes for the creation of data
+     * @return the newly created exchange data, and its decrypted exchange key and access control secret.
+     */
+    createExchangeData(delegateId: string, signatureKeys: {
+        [keyPairFingerprint: string]: CryptoKey;
+    }, encryptionKeys: {
+        [keyPairFingerprint: string]: CryptoKey;
+    }, optionalAttributes?: {
+        id?: string;
+    }): Promise<{
+        exchangeData: ExchangeData;
+        exchangeKey: CryptoKey;
+        accessControlSecret: string;
+    }>;
+    /**
+     * Updates existing exchange data and uploads it to the cloud in order to share it also with additional public keys, useful for example in cases
+     * where one of the data owners involved in the exchange data has lost one of his keys.
+     * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.
+     * This method assumes that the new encryption keys have been verified.
+     * If the current data owner is also the delegator of the provided exchange data and at least one of the verification keys can be used to
+     * validate the current exchange data then the signature will be updated using the signature keys.
+     * Instead, if the current data owner is not the delegator of the provided exchange data, or the exchange data could not be verified using
+     * the provided verification keys then the updated exchange data will become unverified, and won't ever be verifiable again.
+     * @param exchangeData exchange data to update.
+     * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.
+     * @param signatureKeys keys to use for the new signature of the updated exchange data.
+     * @param newEncryptionKeys new keys to add to the exchange data.
+     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
+     * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not
+     * be decrypted and the exchange data could not be updated.
+     */
+    tryUpdateExchangeData(exchangeData: ExchangeData, decryptionKeys: {
+        [publicKeyFingerprint: string]: KeyPair<CryptoKey>;
+    }, newEncryptionKeys: {
+        [keyPairFingerprint: string]: CryptoKey;
+    }, signatureKeys: {
+        [keyPairFingerprint: string]: CryptoKey;
+    }, getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>): Promise<{
+        exchangeData: ExchangeData;
+        exchangeKey: CryptoKey;
+        accessControlSecret: string;
+    } | undefined>;
+    private bytesToSign;
+    private generateExchangeKey;
+    private importExchangeKey;
+    private generateAccessControlSecret;
+    private importAccessControlSecret;
+    private encryptDataWithKeys;
+    private signDataWithKeys;
+}

package/icc-x-api/crypto/BaseExchangeDataManager.js

@@ -0,0 +1,342 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseExchangeDataManager = void 0;
+const ExchangeData_1 = require("../../icc-api/model/ExchangeData");
+const XHR_1 = require("../../icc-api/api/XHR");
+var XHRError = XHR_1.XHR.XHRError;
+const utils_1 = require("../utils");
+const _ = require("lodash");
+const utils_2 = require("./utils");
+/**
+ * @internal this class is intended for internal use only and may be modified without notice
+ * Functions to create and get exchange data.
+ * The methods of this api require to pass the appropriate keys for encryption/decryption manually.
+ */
+class BaseExchangeDataManager {
+    constructor(api, dataOwnerApi, primitives, selfRequiresAnonymousDelegations) {
+        this.api = api;
+        this.dataOwnerApi = dataOwnerApi;
+        this.primitives = primitives;
+        this.selfRequiresAnonymousDelegations = selfRequiresAnonymousDelegations;
+    }
+    /**
+     * Get all the exchange data where the current data owner is the delegator or the delegate. However, some data owners, generally HCPs, may have a
+     * prohibitively high amount of exchange data. If the crypto strategies specify that the current data owner requires anonymous delegation this
+     * method returns all the exchange data found for the data owner, else the method returns undefined.
+     * @return all the exchange data for the current data owner or undefined if the crypto strategies don't allow to retrieve all data for the current
+     * data owner.
+     */
+    getAllExchangeDataForCurrentDataOwnerIfAllowed() {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.selfRequiresAnonymousDelegations)
+                return undefined;
+            const dataOwnerId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            let latestResult = yield this.api.getExchangeDataByParticipant(dataOwnerId, undefined, 1000);
+            const allRetrieved = (_a = latestResult.rows) !== null && _a !== void 0 ? _a : [];
+            while ((_b = latestResult.nextKeyPair) === null || _b === void 0 ? void 0 : _b.startKeyDocId) {
+                latestResult = yield this.api.getExchangeDataByParticipant(dataOwnerId, latestResult.nextKeyPair.startKeyDocId, 1000);
+                if (latestResult.rows)
+                    allRetrieved.push(...latestResult.rows);
+            }
+            return allRetrieved;
+        });
+    }
+    /**
+     * Get all exchange data for the provided delegator-delegate pair.
+     * @param delegatorId id of a delegator data owner.
+     * @param delegateId id of a delegate data owner.
+     * @return all exchange data for the provided delegator-delegate pair.
+     */
+    getExchangeDataByDelegatorDelegatePair(delegatorId, delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.api.getExchangeDataByDelegatorDelegate(delegatorId, delegateId);
+        });
+    }
+    /**
+     * Get the exchange data with the provided id.
+     * @param exchangeDataId id of the exchange data.
+     * @return the exchange data with the provided id or undefined if no exchange data with such id could be found.
+     */
+    getExchangeDataById(exchangeDataId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.api.getExchangeDataById(exchangeDataId).catch((e) => {
+                if (e instanceof XHRError && e.statusCode === 404) {
+                    return undefined;
+                }
+                else
+                    throw e;
+            });
+        });
+    }
+    /**
+     * Filters exchange data returning only the instances that could be verified using their signature and the provided verification
+     * keys.
+     * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)
+     * will always be unverified.
+     * @param exchangeData the exchange data to verify.
+     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
+     * @return the exchange data which could be verified given his signature and the available verification keys.
+     * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.
+     */
+    filterVerifiedExchangeData(exchangeData, getVerificationKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const verified = [];
+            for (const ed of exchangeData) {
+                if (yield this.verifyExchangeData(ed, (x) => getVerificationKey(x)))
+                    verified.push(ed);
+            }
+            return verified;
+        });
+    }
+    /**
+     * Verifies the authenticity of the exchange data by checking the signature.
+     * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)
+     * will always be unverified.
+     * @param exchangeData the exchange data to verify.
+     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
+     * @return the exchange data which could be verified given his signature and the available verification keys.
+     * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.
+     */
+    verifyExchangeData(exchangeData, getVerificationKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataOwnerId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            if (exchangeData.delegator !== dataOwnerId)
+                return false;
+            const signatureData = yield this.bytesToSign(exchangeData);
+            for (const [fp, signature] of Object.entries(exchangeData.signature)) {
+                const verificationKey = yield getVerificationKey(fp.slice(-32));
+                if (verificationKey && (yield this.primitives.RSA.verifySignature(verificationKey, (0, utils_1.b64_2ua)(signature), signatureData)))
+                    return true;
+            }
+            return false;
+        });
+    }
+    /**
+     * Extracts and decrypts the access control secret from the provided exchange data.
+     * These need to be hashed together with the entity class and confidentiality level in order to get the actual access control key
+     * which will be sent to the server.
+     * @param exchangeData the exchange data from which to extract access control secrets.
+     * @param decryptionKeys rsa key pairs to use for decryption of the access control secret.
+     * @return an object composed of:
+     * - successfulDecryptions: array of all successfully decrypted access control keys
+     * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).
+     */
+    tryDecryptAccessControlSecret(exchangeData, decryptionKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.tryDecryptExchangeData(exchangeData, decryptionKeys, (ed) => ed.accessControlSecret, (d) => this.importAccessControlSecret(new Uint8Array(d)));
+        });
+    }
+    /**
+     * Extract and decrypts the exchange keys from the provided exchange data.
+     * @param exchangeData the exchange data from which to extract exchange keys.
+     * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.
+     * @return an object composed of:
+     * - successfulDecryptions: array containing the successfully decrypted exchange keys.
+     * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).
+     */
+    tryDecryptExchangeKeys(exchangeData, decryptionKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.tryDecryptExchangeData(exchangeData, decryptionKeys, (ed) => ed.exchangeKey, (d) => this.importExchangeKey(new Uint8Array(d)));
+        });
+    }
+    tryDecryptExchangeData(exchangeData, decryptionKeys, encryptedDataSelector, unmarshalDecrypted) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const successfulDecryptions = [];
+            const failedDecryptions = [];
+            for (const ed of exchangeData) {
+                try {
+                    const decrypted = yield this.tryDecrypt(encryptedDataSelector(ed), decryptionKeys);
+                    if (decrypted) {
+                        successfulDecryptions.push(yield unmarshalDecrypted(decrypted));
+                    }
+                    else {
+                        failedDecryptions.push(ed);
+                    }
+                }
+                catch (e) {
+                    failedDecryptions.push(ed);
+                }
+            }
+            return { successfulDecryptions, failedDecryptions };
+        });
+    }
+    tryDecrypt(encryptedData, decryptionKeys) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const decryptionKeysWithV2Fp = Object.keys(decryptionKeys).reduce((prev, fp) => {
+                return Object.assign(Object.assign({}, prev), { [(0, utils_2.fingerprintIsV1)(fp) ? (0, utils_2.fingerprintV1toV2)(fp) : fp]: decryptionKeys[fp] });
+            }, {});
+            for (const [fp, encrypted] of Object.entries(encryptedData)) {
+                try {
+                    const key = (_a = decryptionKeysWithV2Fp[fp]) === null || _a === void 0 ? void 0 : _a.privateKey;
+                    if (key)
+                        return (0, utils_1.hex2ua)((0, utils_1.ua2utf8)(yield this.primitives.RSA.decrypt(key, (0, utils_1.b64_2ua)(encrypted))));
+                }
+                catch (e) {
+                    // Try with another key
+                }
+            }
+        });
+    }
+    /**
+     * Creates exchange data from the current data owner to the provided delegate, uploading the newly created exchange data to the cloud.
+     * This assumes that the keys have been verified.
+     * @param delegateId id of the delegate for the new exchange data.
+     * @param signatureKeys private keys to use for signing the created data.
+     * @param encryptionKeys public keys to use for the encryption of the exchange data (from delegator and delegate).
+     * @param optionalAttributes optional precalculated attributes for the creation of data
+     * @return the newly created exchange data, and its decrypted exchange key and access control secret.
+     */
+    createExchangeData(delegateId, signatureKeys, encryptionKeys, optionalAttributes = {}) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!Object.keys(signatureKeys).length || !Object.keys(encryptionKeys).length) {
+                throw new Error('Must specify at least one signature key and ');
+            }
+            const exchangeKey = yield this.generateExchangeKey();
+            const accessControlSecret = yield this.generateAccessControlSecret();
+            const encryptedExchangeKey = yield this.encryptDataWithKeys(exchangeKey.rawBytes, encryptionKeys);
+            const encryptedAccessControlSecret = yield this.encryptDataWithKeys(accessControlSecret.rawBytes, encryptionKeys);
+            const baseExchangeData = {
+                id: (_a = optionalAttributes.id) !== null && _a !== void 0 ? _a : this.primitives.randomUuid(),
+                delegator: yield this.dataOwnerApi.getCurrentDataOwnerId(),
+                delegate: delegateId,
+                exchangeKey: encryptedExchangeKey,
+                accessControlSecret: encryptedAccessControlSecret,
+            };
+            const signature = yield this.signDataWithKeys(yield this.bytesToSign(baseExchangeData), signatureKeys);
+            const exchangeData = new ExchangeData_1.ExchangeData(Object.assign(Object.assign({}, baseExchangeData), { signature }));
+            return {
+                exchangeData: yield this.api.createExchangeData(exchangeData),
+                exchangeKey: exchangeKey.key,
+                accessControlSecret: accessControlSecret.secret,
+            };
+        });
+    }
+    /**
+     * Updates existing exchange data and uploads it to the cloud in order to share it also with additional public keys, useful for example in cases
+     * where one of the data owners involved in the exchange data has lost one of his keys.
+     * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.
+     * This method assumes that the new encryption keys have been verified.
+     * If the current data owner is also the delegator of the provided exchange data and at least one of the verification keys can be used to
+     * validate the current exchange data then the signature will be updated using the signature keys.
+     * Instead, if the current data owner is not the delegator of the provided exchange data, or the exchange data could not be verified using
+     * the provided verification keys then the updated exchange data will become unverified, and won't ever be verifiable again.
+     * @param exchangeData exchange data to update.
+     * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.
+     * @param signatureKeys keys to use for the new signature of the updated exchange data.
+     * @param newEncryptionKeys new keys to add to the exchange data.
+     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
+     * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not
+     * be decrypted and the exchange data could not be updated.
+     */
+    tryUpdateExchangeData(exchangeData, decryptionKeys, newEncryptionKeys, signatureKeys, getVerificationKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataOwnerId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            const rawExchangeKey = yield this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys);
+            const rawAccessControlSecret = yield this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys);
+            if (!rawExchangeKey || !rawAccessControlSecret)
+                return undefined;
+            const exchangeKey = yield this.importExchangeKey(new Uint8Array(rawExchangeKey));
+            const accessControlSecret = yield this.importAccessControlSecret(new Uint8Array(rawAccessControlSecret));
+            const existingExchangeKeyEntries = new Set(Object.keys(exchangeData.exchangeKey));
+            const existingAcsEntries = new Set(Object.keys(exchangeData.accessControlSecret));
+            const missingEntries = Object.keys(newEncryptionKeys).filter((fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp));
+            if (!missingEntries.length)
+                return { exchangeData, exchangeKey, accessControlSecret };
+            const encryptionKeysForMissingEntries = missingEntries.reduce((obj, fp) => {
+                obj[fp] = newEncryptionKeys[fp];
+                return obj;
+            }, {});
+            const isVerified = exchangeData.delegator == dataOwnerId && (yield this.verifyExchangeData(exchangeData, (fp) => getVerificationKey(fp)));
+            const updatedExchangeData = _.cloneDeep(exchangeData);
+            updatedExchangeData.exchangeKey = Object.assign(Object.assign({}, exchangeData.exchangeKey), (yield this.encryptDataWithKeys(rawExchangeKey, encryptionKeysForMissingEntries)));
+            updatedExchangeData.accessControlSecret = Object.assign(Object.assign({}, exchangeData.accessControlSecret), (yield this.encryptDataWithKeys(rawAccessControlSecret, encryptionKeysForMissingEntries)));
+            if (isVerified) {
+                const newDataToSign = yield this.bytesToSign(updatedExchangeData);
+                updatedExchangeData.signature = yield this.signDataWithKeys(newDataToSign, signatureKeys);
+            }
+            return { exchangeData: yield this.api.modifyExchangeData(new ExchangeData_1.ExchangeData(updatedExchangeData)), exchangeKey, accessControlSecret };
+        });
+    }
+    // Gets a byte representation of the parts of exchange data which should be included in the signature.
+    // Equivalent json representations of the exchange data should provide the same bytes (even if the order of entries
+    // is different).
+    bytesToSign(exchangeData) {
+        return __awaiter(this, void 0, void 0, function* () {
+            function sortObject(obj) {
+                return Object.keys(obj)
+                    .sort()
+                    .reduce((sorted, key) => {
+                    return [...sorted, [key, obj[key]]];
+                }, []);
+            }
+            const signObject = [
+                ['delegator', exchangeData.delegator],
+                ['delegate', exchangeData.delegate],
+                ['exchangeKey', sortObject(exchangeData.exchangeKey)],
+                ['accessControlSecret', sortObject(exchangeData.accessControlSecret)],
+            ];
+            const signJson = JSON.stringify(signObject);
+            return this.primitives.sha256((0, utils_1.utf8_2ua)(signJson));
+        });
+    }
+    // Generates a new exchange key
+    generateExchangeKey() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const rawBytes = yield this.primitives.randomBytes(32);
+            return {
+                key: yield this.importExchangeKey(rawBytes),
+                rawBytes,
+            };
+        });
+    }
+    importExchangeKey(decryptedBytes) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.primitives.AES.importKey('raw', decryptedBytes);
+        });
+    }
+    // Generates a new access control secret
+    generateAccessControlSecret() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const rawBytes = yield this.primitives.randomBytes(16);
+            return {
+                secret: yield this.importAccessControlSecret(rawBytes),
+                rawBytes,
+            };
+        });
+    }
+    importAccessControlSecret(decryptedBytes) {
+        return Promise.resolve((0, utils_1.ua2hex)(decryptedBytes));
+    }
+    encryptDataWithKeys(rawData, keys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = {};
+            for (const [fp, key] of Object.entries(keys)) {
+                res[(0, utils_2.fingerprintIsV1)(fp) ? (0, utils_2.fingerprintV1toV2)(fp) : fp] = (0, utils_1.ua2b64)(yield this.primitives.RSA.encrypt(key, (0, utils_1.utf8_2ua)((0, utils_1.ua2hex)(rawData))));
+            }
+            return res;
+        });
+    }
+    signDataWithKeys(rawData, keys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = {};
+            for (const [fp, key] of Object.entries(keys)) {
+                res[fp] = (0, utils_1.ua2b64)(yield this.primitives.RSA.sign(key, new Uint8Array(rawData)));
+            }
+            return res;
+        });
+    }
+}
+exports.BaseExchangeDataManager = BaseExchangeDataManager;
+//# sourceMappingURL=BaseExchangeDataManager.js.map