@icure/api 7.1.14 → 8.0.0-RC.1

package/icc-x-api/crypto/ExtendedApisUtilsImpl.js

@@ -0,0 +1,562 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExtendedApisUtilsImpl = void 0;
+const utils_1 = require("../utils");
+const collection_utils_1 = require("../utils/collection-utils");
+const SecurityMetadataDecryptor_1 = require("./SecurityMetadataDecryptor");
+const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
+const EntityShareRequest_1 = require("../../icc-api/model/requests/EntityShareRequest");
+const ShareResult_1 = require("../utils/ShareResult");
+const ShareMetadataBehaviour_1 = require("./ShareMetadataBehaviour");
+var AccessLevel = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
+var RequestedPermissionEnum = EntityShareRequest_1.EntityShareRequest.RequestedPermissionEnum;
+var RequestedPermissionInternal = EntityShareRequest_1.EntityShareRequest.RequestedPermissionInternal;
+var AccessLevelEnum = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
+/**
+ * @internal this class is for internal use only and may be changed without notice.
+ * Methods to support extended apis.
+ */
+class ExtendedApisUtilsImpl {
+    constructor(primitives, dataOwnerApi, legacyDelMetadataDecryptor, secDelMetadataDecryptor, secureDelegationsManager, userApi, useParentKeys) {
+        this.primitives = primitives;
+        this.dataOwnerApi = dataOwnerApi;
+        this.legacyDelMetadataDecryptor = legacyDelMetadataDecryptor;
+        this.secDelMetadataDecryptor = secDelMetadataDecryptor;
+        this.secureDelegationsManager = secureDelegationsManager;
+        this.userApi = userApi;
+        this.useParentKeys = useParentKeys;
+        this.allSecurityMetadataDecryptor = new SecurityMetadataDecryptor_1.SecurityMetadataDecryptorChain([legacyDelMetadataDecryptor, secDelMetadataDecryptor]);
+    }
+    encryptionKeysOf(entity, dataOwnerId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.decryptAndMergeHierarchy(entity, dataOwnerId, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf(entityWithType, hierarchy));
+        });
+    }
+    encryptionKeysForHcpHierarchyOf(entity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.decryptHierarchy(entity, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf(entityWithType, hierarchy));
+        });
+    }
+    secretIdsOf(entity, dataOwnerId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.decryptAndMergeHierarchy(entity, dataOwnerId, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptSecretIdsOf(entityWithType, hierarchy));
+        });
+    }
+    secretIdsForHcpHierarchyOf(entity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.decryptHierarchy(entity, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptSecretIdsOf(entityWithType, hierarchy));
+        });
+    }
+    owningEntityIdsOf(entity, dataOwnerId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.decryptAndMergeHierarchy(entity, dataOwnerId, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptOwningEntityIdsOf(entityWithType, hierarchy));
+        });
+    }
+    owningEntityIdsForHcpHierarchyOf(entity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.decryptHierarchy(entity, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptOwningEntityIdsOf(entityWithType, hierarchy));
+        });
+    }
+    hasWriteAccess(entity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return ((yield this.allSecurityMetadataDecryptor.getEntityAccessLevel(entity, yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())) ===
+                AccessLevel.WRITE);
+        });
+    }
+    entityWithInitialisedEncryptedMetadata(entity, entityType, owningEntity, owningEntitySecretId, initialiseEncryptionKey, initialiseSecretId, autoDelegations) {
+        return __awaiter(this, arguments, void 0, function* () {
+            this.throwDetailedExceptionForInvalidParameter('entity.id', entity.id, 'entityWithInitialisedEncryptedMetadata', arguments);
+            this.checkEmptyEncryptionMetadata(entity);
+            const newRawKey = initialiseEncryptionKey ? yield this.primitives.AES.generateCryptoKey(true) : undefined;
+            const newSecretId = initialiseSecretId ? this.primitives.randomUuid() : undefined;
+            return {
+                updatedEntity: yield this.secureDelegationsManager.entityWithInitialisedEncryptedMetadata(Object.assign(Object.assign({}, entity), { secretForeignKeys: owningEntitySecretId ? [owningEntitySecretId] : [] }), entityType, newSecretId ? [newSecretId] : [], !!owningEntity ? [owningEntity] : [], newRawKey ? [newRawKey] : [], autoDelegations),
+                rawEncryptionKey: newRawKey,
+                secretId: newSecretId,
+            };
+        });
+    }
+    bulkShareOrUpdateEncryptedEntityMetadata(entitiesType, entitiesUpdates, doRequestBulkShareOrUpdate) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const { allRequestsByEntityId, orderedRequestsInfoByEntityId, unmodifiedEntitiesIds } = yield this.prepareBulkShareRequests(entitiesType, entitiesUpdates);
+            const results = yield doRequestBulkShareOrUpdate(allRequestsByEntityId);
+            const updatedEntities = [];
+            const updateErrors = [];
+            for (const result of results) {
+                if (result.updatedEntity) {
+                    updatedEntities.push(result.updatedEntity);
+                }
+                for (const [errorRequestId, error] of Object.entries((_a = result.rejectedRequests) !== null && _a !== void 0 ? _a : {})) {
+                    const requestIndex = Number(errorRequestId);
+                    const { delegateId, request, updatedForMigration } = orderedRequestsInfoByEntityId[result.entityId][requestIndex];
+                    updateErrors.push({
+                        entityId: result.entityId,
+                        delegateId,
+                        request,
+                        updatedForMigration,
+                        code: error.code,
+                        reason: error.reason,
+                    });
+                }
+            }
+            // TODO implement auto-retry for failed requests if the shouldRetry flag is set to true
+            return {
+                updatedEntities,
+                updateErrors,
+                unmodifiedEntitiesIds,
+            };
+        });
+    }
+    bulkShareOrUpdateEncryptedEntityMetadataNoEntities(entitiesType, entitiesUpdates, doRequestBulkShareOrUpdate) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const { allRequestsByEntityId, orderedRequestsInfoByEntityId, unmodifiedEntitiesIds } = yield this.prepareBulkShareRequests(entitiesType, entitiesUpdates);
+            const results = yield doRequestBulkShareOrUpdate(allRequestsByEntityId);
+            const updateErrors = [];
+            for (const result of results) {
+                for (const [errorRequestId, error] of Object.entries((_a = result.rejectedRequests) !== null && _a !== void 0 ? _a : {})) {
+                    const requestIndex = Number(errorRequestId);
+                    const { delegateId, request, updatedForMigration } = orderedRequestsInfoByEntityId[result.entityId][requestIndex];
+                    updateErrors.push({
+                        entityId: result.entityId,
+                        delegateId,
+                        request,
+                        updatedForMigration,
+                        code: error.code,
+                        reason: error.reason,
+                    });
+                }
+            }
+            const successfulRequests = Object.entries(allRequestsByEntityId)
+                .flatMap(([entityId, requests]) => Object.keys(requests).map((delegateId) => ({ entityId, delegateId })))
+                .filter(({ entityId, delegateId }) => !updateErrors.some((error) => error.entityId === entityId && error.delegateId === delegateId));
+            return {
+                successfulUpdates: successfulRequests,
+                updateErrors,
+                unmodifiedEntitiesIds,
+            };
+        });
+    }
+    prepareBulkShareRequests(entitiesType, entitiesUpdates) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (new Set(entitiesUpdates.map((e) => e.entity.id)).size !== entitiesUpdates.length) {
+                throw new Error('Duplicate requests: the same entity id is present more than once in the input');
+            }
+            const allRequestsByEntityId = {};
+            const orderedRequestsInfoByEntityId = {};
+            const unmodifiedEntitiesIds = [];
+            for (const { entity, dataForDelegates } of entitiesUpdates) {
+                const entityId = entity.id;
+                if (!entityId)
+                    throw new Error('Share of an entity requires for the entity to already exist and have an id');
+                const entityWithType = { entity, type: entitiesType };
+                const currentRequests = {};
+                const currentOrderedRequests = [];
+                const migrationRequests = yield this.makeMigrationRequestsIfNeeded(entityWithType, dataForDelegates);
+                for (const [delegate, request] of Object.entries(migrationRequests)) {
+                    currentRequests[String(currentOrderedRequests.length)] = request;
+                    currentOrderedRequests.push({
+                        delegateId: delegate,
+                        request: dataForDelegates[delegate],
+                        updatedForMigration: true,
+                    });
+                }
+                for (const [delegate, userRequest] of Object.entries(dataForDelegates)) {
+                    if (!migrationRequests[delegate]) {
+                        const request = yield this.secureDelegationsManager.makeShareOrUpdateRequestParams(entityWithType, delegate, (_a = userRequest.shareSecretIds) !== null && _a !== void 0 ? _a : [], (_b = userRequest.shareEncryptionKeys) !== null && _b !== void 0 ? _b : [], (_c = userRequest.shareOwningEntityIds) !== null && _c !== void 0 ? _c : [], userRequest.requestedPermissions);
+                        if (request) {
+                            currentRequests[String(currentOrderedRequests.length)] = request;
+                            currentOrderedRequests.push({
+                                delegateId: delegate,
+                                request: userRequest,
+                                updatedForMigration: false,
+                            });
+                        }
+                    }
+                }
+                if (Object.keys(currentRequests).length > 0) {
+                    allRequestsByEntityId[entityId] = currentRequests;
+                    orderedRequestsInfoByEntityId[entityId] = currentOrderedRequests;
+                }
+                else {
+                    unmodifiedEntitiesIds.push(entityId);
+                }
+            }
+            return { unmodifiedEntitiesIds, allRequestsByEntityId, orderedRequestsInfoByEntityId };
+        });
+    }
+    simpleShareOrUpdateEncryptedEntityMetadata(entity, unusedSecretIds, delegates, doRequestBulkShareOrUpdate) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const availableEncryptionKeys = yield this.encryptionKeysOf(entity);
+            const availableOwningEntityIds = yield this.owningEntityIdsOf(entity);
+            let availableSecretIds;
+            if (unusedSecretIds) {
+                availableSecretIds = yield this.secretIdsOf(entity);
+            }
+            const dataForDelegates = {};
+            for (const [delegateId, delegateRequests] of Object.entries(delegates)) {
+                if (!availableEncryptionKeys.length && delegateRequests.shareEncryptionKeys === ShareMetadataBehaviour_1.ShareMetadataBehaviour.REQUIRED) {
+                    throw new Error(`Entity ${JSON.stringify(entity)} has no encryption keys or the current data owner can't access any encryption keys.`);
+                }
+                if (!availableOwningEntityIds.length && delegateRequests.shareEncryptionKeys === ShareMetadataBehaviour_1.ShareMetadataBehaviour.REQUIRED) {
+                    throw new Error(`Entity ${JSON.stringify(entity)} has no encryption keys or the current data owner can't access any encryption keys.`);
+                }
+                if (!delegateRequests.shareSecretIds && !unusedSecretIds) {
+                    throw new Error(`Share secret ids parameter is mandatory for entities of type ${entity.type}.`);
+                }
+                else if (delegateRequests.shareSecretIds && unusedSecretIds) {
+                    throw new Error(`Share secret ids parameter must not be unused with entities of type ${entity.type}.`);
+                }
+                dataForDelegates[delegateId] = {
+                    shareSecretIds: (_a = delegateRequests.shareSecretIds) !== null && _a !== void 0 ? _a : availableSecretIds,
+                    shareEncryptionKeys: delegateRequests.shareEncryptionKeys === ShareMetadataBehaviour_1.ShareMetadataBehaviour.NEVER ? [] : availableEncryptionKeys,
+                    shareOwningEntityIds: delegateRequests.shareOwningEntityIds === ShareMetadataBehaviour_1.ShareMetadataBehaviour.NEVER ? [] : availableOwningEntityIds,
+                    requestedPermissions: (_b = delegateRequests.requestedPermissions) !== null && _b !== void 0 ? _b : RequestedPermissionEnum.MAX_WRITE,
+                };
+            }
+            const shareResult = yield this.bulkShareOrUpdateEncryptedEntityMetadata(entity.type, [
+                {
+                    entity: entity.entity,
+                    dataForDelegates,
+                },
+            ], (x) => doRequestBulkShareOrUpdate(x));
+            if (shareResult.unmodifiedEntitiesIds.includes(entity.entity.id)) {
+                return new ShareResult_1.ShareResultSuccess(entity.entity);
+            }
+            if (!shareResult.updateErrors.length && shareResult.updatedEntities.length === 1) {
+                return new ShareResult_1.ShareResultSuccess(shareResult.updatedEntities[0]);
+            }
+            const requestedDelegates = new Set(Object.keys(delegates));
+            const errorsOfRequestedDelegates = shareResult.updateErrors.filter((x) => requestedDelegates.has(x.delegateId));
+            if (errorsOfRequestedDelegates.length === 0 && shareResult.updatedEntities.length === 1) {
+                console.warn(`Errors with migration of encrypted metadata ${JSON.stringify(shareResult.updateErrors)}.`);
+                return new ShareResult_1.ShareResultSuccess(shareResult.updatedEntities[0]);
+            }
+            return new ShareResult_1.ShareResultFailure(shareResult.updateErrors, `There was an error sharing entity with id ${entity.entity.id}. Check the logs for more details.`);
+        });
+    }
+    makeMigrationRequestsIfNeeded(entity, userRequestsForEntity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const hierarchy = yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds();
+            const legacySecretIds = yield (0, collection_utils_1.asyncGeneratorToArray)(this.legacyDelMetadataDecryptor.decryptSecretIdsOf(entity, hierarchy));
+            const legacyEncryptionKeys = yield (0, collection_utils_1.asyncGeneratorToArray)(this.legacyDelMetadataDecryptor.decryptEncryptionKeysOf(entity, hierarchy));
+            const legacyOwningEntityIds = yield (0, collection_utils_1.asyncGeneratorToArray)(this.legacyDelMetadataDecryptor.decryptOwningEntityIdsOf(entity, hierarchy));
+            const res = {};
+            for (const hierarchyMember of hierarchy) {
+                const hierarchyMemberMigration = yield this.makeMigrationRequestForMemberOfHierarchy(entity, hierarchyMember, userRequestsForEntity[hierarchyMember], legacySecretIds, legacyEncryptionKeys, legacyOwningEntityIds);
+                if (hierarchyMemberMigration) {
+                    res[hierarchyMember] = hierarchyMemberMigration;
+                }
+            }
+            return res;
+        });
+    }
+    makeMigrationRequestForMemberOfHierarchy(entity, dataOwnerId, userRequestForDelegate, legacySecretIds, legacyEncryptionKeys, legacyOwningEntityIds) {
+        var _a, _b, _c, _d;
+        return __awaiter(this, void 0, void 0, function* () {
+            const selfId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            const legacyAccess = selfId === entity.entity.id && dataOwnerId === selfId
+                ? AccessLevel.WRITE
+                : yield this.legacyDelMetadataDecryptor.getEntityAccessLevel(entity, [dataOwnerId]);
+            if (!legacyAccess)
+                return undefined;
+            const selfLegacySecretIds = legacySecretIds.filter((x) => x.dataOwnersWithAccess.includes(dataOwnerId)).map((x) => x.decrypted);
+            const selfLegacyEncryptionKeys = legacyEncryptionKeys.filter((x) => x.dataOwnersWithAccess.includes(dataOwnerId)).map((x) => x.decrypted);
+            const selfLegacyOwningEntityIds = legacyOwningEntityIds.filter((x) => x.dataOwnersWithAccess.includes(dataOwnerId)).map((x) => x.decrypted);
+            const currentAccess = yield this.secDelMetadataDecryptor.getEntityAccessLevel(entity, [dataOwnerId]);
+            const needsImprovedAccess = legacyAccess === AccessLevel.WRITE && currentAccess !== AccessLevel.WRITE; // Only applies to legacy delegations to secure delegations migration: may change if in future we need to migrate from legacy delegations to secure delegations
+            let missingSecretIds = [];
+            let missingEncryptionKeys = [];
+            let missingOwningEntityIds = [];
+            if (selfLegacySecretIds.length > 0) {
+                const currentSecretIds = new Set((yield (0, collection_utils_1.asyncGeneratorToArray)(this.secDelMetadataDecryptor.decryptSecretIdsOf(entity, [dataOwnerId]))).map((x) => x.decrypted));
+                missingSecretIds = selfLegacySecretIds.filter((x) => !currentSecretIds.has(x));
+            }
+            if (selfLegacyEncryptionKeys.length > 0) {
+                const currentEncryptionKeys = new Set((yield (0, collection_utils_1.asyncGeneratorToArray)(this.secDelMetadataDecryptor.decryptEncryptionKeysOf(entity, [dataOwnerId]))).map((x) => x.decrypted));
+                missingEncryptionKeys = selfLegacyEncryptionKeys.filter((x) => !currentEncryptionKeys.has(x));
+            }
+            if (selfLegacyOwningEntityIds.length > 0) {
+                const currentOwningEntityIds = new Set((yield (0, collection_utils_1.asyncGeneratorToArray)(this.secDelMetadataDecryptor.decryptOwningEntityIdsOf(entity, [dataOwnerId]))).map((x) => x.decrypted));
+                missingOwningEntityIds = selfLegacyOwningEntityIds.filter((x) => !currentOwningEntityIds.has(x));
+            }
+            if (needsImprovedAccess || missingSecretIds.length > 0 || missingEncryptionKeys.length > 0 || missingOwningEntityIds.length > 0) {
+                let requestedPermissions;
+                if (dataOwnerId === selfId && needsImprovedAccess) {
+                    requestedPermissions = RequestedPermissionInternal.ROOT;
+                }
+                else if (legacyAccess === AccessLevel.WRITE) {
+                    requestedPermissions = RequestedPermissionInternal.FULL_WRITE;
+                }
+                else {
+                    requestedPermissions = (_a = userRequestForDelegate === null || userRequestForDelegate === void 0 ? void 0 : userRequestForDelegate.requestedPermissions) !== null && _a !== void 0 ? _a : RequestedPermissionInternal.FULL_READ;
+                }
+                return yield this.secureDelegationsManager.makeShareOrUpdateRequestParams(entity, dataOwnerId, Array.from(new Set([...missingSecretIds, ...((_b = userRequestForDelegate === null || userRequestForDelegate === void 0 ? void 0 : userRequestForDelegate.shareSecretIds) !== null && _b !== void 0 ? _b : [])])), Array.from(new Set([...missingEncryptionKeys, ...((_c = userRequestForDelegate === null || userRequestForDelegate === void 0 ? void 0 : userRequestForDelegate.shareEncryptionKeys) !== null && _c !== void 0 ? _c : [])])), Array.from(new Set([...missingOwningEntityIds, ...((_d = userRequestForDelegate === null || userRequestForDelegate === void 0 ? void 0 : userRequestForDelegate.shareOwningEntityIds) !== null && _d !== void 0 ? _d : [])])), requestedPermissions);
+            }
+            else
+                return undefined;
+        });
+    }
+    tryDecryptDataOf(entity, content, validator) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const decryptedKeys = this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf(entity, [yield this.dataOwnerApi.getCurrentDataOwnerId()]);
+            const triedKeys = new Set();
+            let latest = yield decryptedKeys.next();
+            while (!latest.done) {
+                if (!triedKeys.has(latest.value.decrypted)) {
+                    triedKeys.add(latest.value.decrypted);
+                    try {
+                        const decrypted = yield this.primitives.AES.decryptWithRawKey(latest.value.decrypted, content);
+                        if (!validator || (yield validator(decrypted)))
+                            return { data: decrypted, wasDecrypted: true };
+                    }
+                    catch (e) {
+                        console.warn(`Error while decrypting with raw key ${latest.value}: ${e}`);
+                    }
+                }
+                latest = yield decryptedKeys.next();
+            }
+            return { data: content, wasDecrypted: false };
+        });
+    }
+    encryptDataOf(entity, type, content, saveEntity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const ensureInitialisedKeysResult = yield this.ensureEncryptionKeysInitialised(entity, type);
+            let updatedEntity;
+            if (!!ensureInitialisedKeysResult) {
+                updatedEntity = yield saveEntity(ensureInitialisedKeysResult);
+            }
+            const decryptedKeys = this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf({ entity: updatedEntity !== null && updatedEntity !== void 0 ? updatedEntity : entity, type }, [
+                yield this.dataOwnerApi.getCurrentDataOwnerId(),
+            ]);
+            let latest = yield decryptedKeys.next();
+            while (!latest.done) {
+                try {
+                    return { encryptedData: yield this.primitives.AES.encryptWithRawKey(latest.value.decrypted, content), updatedEntity: updatedEntity };
+                }
+                catch (e) {
+                    console.warn(`Error while encrypting with raw key ${latest.value}: ${e}`);
+                }
+                latest = yield decryptedKeys.next();
+            }
+            throw new Error(`Could not extract any valid encryption keys for entity ${JSON.stringify(entity)}.`);
+        });
+    }
+    decryptEntity(entity, entityType, constructor) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!entity.encryptedSelf)
+                return { entity, decrypted: true };
+            const encryptionKeys = yield this.decryptAndImportAllDecryptionKeys({ entity: entity, type: entityType });
+            if (!encryptionKeys.length)
+                return { entity, decrypted: false };
+            return {
+                entity: constructor(yield (0, utils_1.decryptObject)(entity, (encrypted) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    return (_a = (yield this.tryDecryptJson(encryptionKeys, encrypted, false))) !== null && _a !== void 0 ? _a : {};
+                }))),
+                decrypted: true,
+            };
+        });
+    }
+    tryDecryptJson(potentialKeys, encrypted, truncateTrailingDecryptedNulls) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            for (const key of potentialKeys) {
+                try {
+                    const decrypted = (_a = (yield this.primitives.AES.decrypt(key.key, encrypted, key.raw))) !== null && _a !== void 0 ? _a : encrypted;
+                    return JSON.parse((0, utils_1.ua2utf8)(truncateTrailingDecryptedNulls ? (0, utils_1.truncateTrailingNulls)(new Uint8Array(decrypted)) : decrypted));
+                }
+                catch (e) { }
+            }
+            return undefined;
+        });
+    }
+    tryEncryptEntity(entity, entityType, fieldsToEncrypt, encodeBinaryData, requireEncryption, constructor) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const entityWithInitialisedEncryptionKeys = yield this.ensureEncryptionKeysInitialised(entity, entityType);
+            const updatedEntity = entityWithInitialisedEncryptionKeys ? entityWithInitialisedEncryptionKeys : entity;
+            const encryptionKey = yield this.tryImportFirstValidKey({ entity, type: entityType });
+            if (!!encryptionKey) {
+                return constructor(yield (0, utils_1.encryptObject)(updatedEntity, (obj) => {
+                    // TODO should encoding of binary data should probably be applied to everything?
+                    const json = encodeBinaryData
+                        ? JSON.stringify(obj, (k, v) => {
+                            return v instanceof ArrayBuffer || ArrayBuffer.isView(v)
+                                ? (0, utils_1.b2a)(new Uint8Array(v).reduce((d, b) => d + String.fromCharCode(b), ''))
+                                : v;
+                        })
+                        : JSON.stringify(obj);
+                    return this.primitives.AES.encrypt(encryptionKey.key, (0, utils_1.utf8_2ua)(json), encryptionKey.raw);
+                }, fieldsToEncrypt, entityType));
+            }
+            else if (requireEncryption) {
+                throw new Error(`No key found for encryption of entity ${entity}`);
+            }
+            else {
+                yield (0, utils_1.encryptObject)(entity, (obj) => __awaiter(this, void 0, void 0, function* () {
+                    const hasNonEmptyValues = Object.values(obj).some((v) => v !== undefined && (typeof v !== 'object' || (Array.isArray(v) && v.length > 0) || Object.keys(v).length > 0));
+                    if (hasNonEmptyValues) {
+                        throw new Error(`Impossible to modify encrypted content of an entity if no encryption key is known.\nEntity: ${JSON.stringify(entity)}\nTo encrypt: ${JSON.stringify(obj)}`);
+                    }
+                    return Promise.resolve(new ArrayBuffer(1));
+                }), fieldsToEncrypt, 'entity');
+                return entity;
+            }
+        });
+    }
+    ensureEncryptionKeysInitialised(entity, entityType) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.allSecurityMetadataDecryptor.hasAnyEncryptionKeys(entity))
+                return undefined;
+            if (!entity.rev) {
+                throw new Error('New encrypted entity is lacking encryption metadata. ' +
+                    'Please instantiate new entities using the `newInstance` method from the respective extended api.');
+            }
+            /*
+             * Add encryption key and share with all auto-delegates already in legacy delegations.
+             * TODO disable this logic and simply throw error for post-2018 customers.
+             */
+            const existingDelegations = new Set(Object.keys((_a = entity.delegations) !== null && _a !== void 0 ? _a : {}));
+            const usersWithAccessToNewKey = Object.fromEntries(Object.values((_b = (yield this.userApi.getCurrentUser()).autoDelegations) !== null && _b !== void 0 ? _b : {})
+                .flatMap((x) => x)
+                .filter((x) => existingDelegations.has(x))
+                .map((x) => [x, AccessLevelEnum.WRITE]));
+            return yield this.secureDelegationsManager.entityWithInitialisedEncryptedMetadata(Object.assign(Object.assign({}, entity), { secretForeignKeys: (_c = entity.secretForeignKeys) !== null && _c !== void 0 ? _c : [] }), entityType, [], [], [yield this.primitives.AES.generateCryptoKey(true)], usersWithAccessToNewKey);
+        });
+    }
+    decryptHierarchy(entity, decryptedDataGeneratorProvider) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const canDecryptOwnerIds = this.useParentKeys
+                ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()
+                : [yield this.dataOwnerApi.getCurrentDataOwnerId()];
+            const decryptedData = yield (0, collection_utils_1.asyncGeneratorToArray)(decryptedDataGeneratorProvider(entity, canDecryptOwnerIds));
+            return canDecryptOwnerIds.map((ownerId) => {
+                const extracted = this.deduplicate(decryptedData.filter((x) => x.dataOwnersWithAccess.some((o) => o === ownerId)).map((x) => x.decrypted));
+                return { ownerId, extracted };
+            });
+        });
+    }
+    decryptAndMergeHierarchy(entity, dataOwnerId, decryptedDataGeneratorProvider) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const hierarchy = this.useParentKeys
+                ? dataOwnerId
+                    ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIdsFrom(dataOwnerId)
+                    : yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()
+                : [dataOwnerId !== null && dataOwnerId !== void 0 ? dataOwnerId : (yield this.dataOwnerApi.getCurrentDataOwnerId())];
+            const decryptedData = yield (0, collection_utils_1.asyncGeneratorToArray)(decryptedDataGeneratorProvider(entity, hierarchy));
+            return this.deduplicate(decryptedData.map((x) => x.decrypted));
+        });
+    }
+    tryImportKey(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[0-9A-Fa-f\-]+$/g.test(key))
+                return undefined;
+            try {
+                return yield this.primitives.AES.importKey('raw', (0, utils_1.hex2ua)(key.replace(/-/g, '')));
+            }
+            catch (e) {
+                console.warn(`Could not import key ${key} as an encryption key.`, e);
+                return undefined;
+            }
+        });
+    }
+    decryptAndImportAllDecryptionKeys(entity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const keys = this.allSecurityMetadataDecryptor.hasAnyEncryptionKeys(entity.entity)
+                ? yield this.encryptionKeysOf(entity)
+                : this.deduplicate(yield (0, collection_utils_1.asyncGeneratorToArray)(this.legacyDelMetadataDecryptor.decryptSecretIdsOf(entity, yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())).then((secretIdsInfo) => secretIdsInfo.map(({ decrypted }) => decrypted)));
+            const res = [];
+            for (const key of keys) {
+                const imported = yield this.tryImportKey(key);
+                if (imported)
+                    res.push({ key: imported, raw: key });
+            }
+            return res;
+        });
+    }
+    decryptAndImportAnyEncryptionKey(entity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = yield this.tryImportFirstValidKey(entity);
+            if (!res)
+                throw new Error(`Could not find any valid key for entity ${entity.entity.id} (${entity.type}).`);
+            return res;
+        });
+    }
+    tryImportFirstValidKey(entity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const generator = this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf(entity, yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds());
+            let latest = yield generator.next();
+            while (!latest.done) {
+                const imported = yield this.tryImportKey(latest.value.decrypted);
+                if (imported)
+                    return { key: imported, raw: latest.value.decrypted };
+                latest = yield generator.next();
+            }
+            return undefined;
+        });
+    }
+    deduplicate(values) {
+        return [...new Set(values)];
+    }
+    throwDetailedExceptionForInvalidParameter(argName, argValue, methodName, methodArgs) {
+        if (argValue)
+            return;
+        let details = '\nMethod name: icc-crypto-x-api.' + methodName + '()\nArguments:';
+        if (methodArgs) {
+            try {
+                const argsArray = [...methodArgs];
+                argsArray.forEach((arg, index) => (details += '\n[' + index + ']: ' + JSON.stringify(arg)));
+            }
+            catch (ex) {
+                details += '; a problem occured while logging arguments details: ' + ex;
+            }
+        }
+        throw new Error('### THIS SHOULD NOT HAPPEN: ' + argName + ' has an invalid value: ' + argValue + details);
+    }
+    checkEmptyEncryptionMetadata(entity) {
+        this.doCheckEmptyEncryptionMetadata(entity, true);
+    }
+    hasEmptyEncryptionMetadata(entity) {
+        return this.doCheckEmptyEncryptionMetadata(entity, false);
+    }
+    doCheckEmptyEncryptionMetadata(entity, throwErrorIfNonEmpty) {
+        const existingMetadata = [];
+        if (entity.delegations && Object.keys(entity.delegations).length)
+            existingMetadata.push('delegations');
+        if (entity.cryptedForeignKeys && Object.keys(entity.cryptedForeignKeys).length)
+            existingMetadata.push('cryptedForeignKeys');
+        if (entity.encryptionKeys && Object.keys(entity.encryptionKeys).length)
+            existingMetadata.push('encryptionKeys');
+        if (entity.secretForeignKeys && entity.secretForeignKeys.length)
+            existingMetadata.push('secretForeignKeys');
+        if (entity.securityMetadata && Object.keys(entity.securityMetadata).length)
+            existingMetadata.push('securityMetadata');
+        if (existingMetadata.length > 0) {
+            if (throwErrorIfNonEmpty) {
+                throw new Error(`Entity should have no encryption metadata on initialisation, but the following fields already have some values: ${existingMetadata}\n` +
+                    JSON.stringify(entity, undefined, 2));
+            }
+            else
+                return false;
+        }
+        return true;
+    }
+    getDataOwnersWithAccessTo(entity) {
+        return this.allSecurityMetadataDecryptor.getDataOwnersWithAccessTo(entity);
+    }
+}
+exports.ExtendedApisUtilsImpl = ExtendedApisUtilsImpl;
+//# sourceMappingURL=ExtendedApisUtilsImpl.js.map