@icure/api 7.1.14 → 8.0.0-RC.1

package/icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor.d.ts

@@ -0,0 +1,37 @@
+import { SecurityMetadataDecryptor } from './SecurityMetadataDecryptor';
+import { SecureDelegation } from '../../icc-api/model/SecureDelegation';
+import { ExchangeDataManager } from './ExchangeDataManager';
+import { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName';
+import { SecureDelegationsEncryption } from './SecureDelegationsEncryption';
+import AccessLevel = SecureDelegation.AccessLevelEnum;
+import { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models';
+import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { ExchangeDataMapManager } from './ExchangeDataMapManager';
+export declare class SecureDelegationsSecurityMetadataDecryptor implements SecurityMetadataDecryptor {
+    private readonly exchangeData;
+    private readonly exchangeDataMap;
+    private readonly secureDelegationsEncryption;
+    private readonly dataOwnerApi;
+    constructor(exchangeData: ExchangeDataManager, exchangeDataMap: ExchangeDataMapManager, secureDelegationsEncryption: SecureDelegationsEncryption, dataOwnerApi: IccDataOwnerXApi);
+    decryptEncryptionKeysOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    decryptOwningEntityIdsOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    decryptSecretIdsOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{
+        permissionsByDataOwnerId: {
+            [delegateId: string]: SecureDelegation.AccessLevelEnum;
+        };
+        hasUnknownAnonymousDataOwners: boolean;
+    }>;
+    hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean;
+    getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevel | undefined>;
+    private decryptSecureDelegations;
+}

package/icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor.js

@@ -0,0 +1,294 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function verb(n) { if (g[n]) i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureDelegationsSecurityMetadataDecryptor = void 0;
+const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
+var AccessLevel = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
+class SecureDelegationsSecurityMetadataDecryptor {
+    constructor(exchangeData, exchangeDataMap, secureDelegationsEncryption, dataOwnerApi) {
+        this.exchangeData = exchangeData;
+        this.exchangeDataMap = exchangeDataMap;
+        this.secureDelegationsEncryption = secureDelegationsEncryption;
+        this.dataOwnerApi = dataOwnerApi;
+    }
+    decryptEncryptionKeysOf(typedEntity, dataOwnersHierarchySubset) {
+        return this.decryptSecureDelegations(typedEntity, dataOwnersHierarchySubset, (d) => { var _a; return (_a = d.encryptionKeys) !== null && _a !== void 0 ? _a : []; }, (e, k) => this.secureDelegationsEncryption.decryptEncryptionKey(e, k));
+    }
+    decryptOwningEntityIdsOf(typedEntity, dataOwnersHierarchySubset) {
+        return this.decryptSecureDelegations(typedEntity, dataOwnersHierarchySubset, (d) => { var _a; return (_a = d.owningEntityIds) !== null && _a !== void 0 ? _a : []; }, (e, k) => this.secureDelegationsEncryption.decryptOwningEntityId(e, k));
+    }
+    decryptSecretIdsOf(typedEntity, dataOwnersHierarchySubset) {
+        return this.decryptSecureDelegations(typedEntity, dataOwnersHierarchySubset, (d) => { var _a; return (_a = d.secretIds) !== null && _a !== void 0 ? _a : []; }, (e, k) => this.secureDelegationsEncryption.decryptSecretId(e, k));
+    }
+    getDataOwnersWithAccessTo(typedEntity) {
+        var _a, _b, _c, _d, _e, _f;
+        return __awaiter(this, void 0, void 0, function* () {
+            const accumulatedPermissions = {};
+            let hasUnknownAnonymousDataOwners = false;
+            function addPermission(delegateId, level) {
+                if (accumulatedPermissions[delegateId] !== AccessLevel.WRITE) {
+                    accumulatedPermissions[delegateId] = level;
+                }
+            }
+            // 1. Add all explicit data owners, keep only delegations with at least an anonymous data owner to check later
+            let remainingDelegations = Object.entries((_b = (_a = typedEntity.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {});
+            let updatedRemainingDelegations = [];
+            for (const delegationEntry of remainingDelegations) {
+                const delegation = delegationEntry[1];
+                if (delegation.delegator) {
+                    addPermission(delegation.delegator, delegation.permissions);
+                }
+                if (delegation.delegate) {
+                    addPermission(delegation.delegate, delegation.permissions);
+                }
+                if (!delegation.delegator || !delegation.delegate) {
+                    updatedRemainingDelegations.push(delegationEntry);
+                }
+            }
+            remainingDelegations = updatedRemainingDelegations;
+            if (!remainingDelegations.length)
+                return { permissionsByDataOwnerId: accumulatedPermissions, hasUnknownAnonymousDataOwners };
+            updatedRemainingDelegations = [];
+            // 2. Attempt to identify the anonymous data owner of remaining delegations by checking if we have the exchange data cached by hash
+            // Note: we can find exchange data by hash only if we could successfully decrypt it
+            const cachedExchangeData = yield this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(remainingDelegations.map((d) => d[0]), typedEntity.type, (_c = typedEntity.entity.secretForeignKeys) !== null && _c !== void 0 ? _c : []);
+            for (const delegationEntry of remainingDelegations) {
+                const exchangeDataOfDelegation = cachedExchangeData[delegationEntry[0]];
+                if (exchangeDataOfDelegation) {
+                    addPermission(exchangeDataOfDelegation.exchangeData.delegator, delegationEntry[1].permissions);
+                    addPermission(exchangeDataOfDelegation.exchangeData.delegate, delegationEntry[1].permissions);
+                }
+                else {
+                    updatedRemainingDelegations.push(delegationEntry);
+                }
+            }
+            remainingDelegations = updatedRemainingDelegations;
+            if (!remainingDelegations.length)
+                return { permissionsByDataOwnerId: accumulatedPermissions, hasUnknownAnonymousDataOwners };
+            // 3. Attempt to identify the anonymous data owner of remaining delegations between us (or one of our parents) and an anonymous data owner
+            const hierarchy = yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds();
+            const allHashes = [
+                ...remainingDelegations.flatMap(([hash, _]) => hash),
+                ...Object.keys((_e = (_d = typedEntity.entity.securityMetadata) === null || _d === void 0 ? void 0 : _d.keysEquivalences) !== null && _e !== void 0 ? _e : {}),
+            ];
+            const encryptedExchangeDataIds = (yield this.exchangeDataMap.getExchangeDataMapBatch(allHashes)).reduce((maps, current) => {
+                return Object.assign(Object.assign({}, maps), { [current.id]: current });
+            }, {});
+            for (const [hash, delegation] of remainingDelegations) {
+                if (hierarchy.some((x) => x === delegation.delegate || x === delegation.delegator)) {
+                    const dataId = !!encryptedExchangeDataIds[hash]
+                        ? yield this.secureDelegationsEncryption.decryptExchangeDataId(encryptedExchangeDataIds[hash].encryptedExchangeDataIds)
+                        : undefined;
+                    const exchangeDataInfo = dataId
+                        ? yield this.exchangeData.getDecryptionDataKeyById(dataId, typedEntity.type, (_f = typedEntity.entity.secretForeignKeys) !== null && _f !== void 0 ? _f : [], true)
+                        : undefined;
+                    if (exchangeDataInfo) {
+                        addPermission(exchangeDataInfo.exchangeData.delegator, delegation.permissions);
+                        addPermission(exchangeDataInfo.exchangeData.delegate, delegation.permissions);
+                    }
+                    else {
+                        hasUnknownAnonymousDataOwners = true;
+                    }
+                }
+                else {
+                    hasUnknownAnonymousDataOwners = true;
+                }
+            }
+            return {
+                permissionsByDataOwnerId: accumulatedPermissions,
+                hasUnknownAnonymousDataOwners,
+            };
+        });
+    }
+    hasAnyEncryptionKeys(entity) {
+        var _a, _b;
+        return Object.values((_b = (_a = entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {}).some((d) => { var _a; return (_a = d.encryptionKeys) === null || _a === void 0 ? void 0 : _a.length; });
+    }
+    getEntityAccessLevel(typedEntity, dataOwnersHierarchySubset) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!dataOwnersHierarchySubset.length)
+                throw new Error("`dataOwnersHierarchySubset` can't be empty");
+            // If the data owner is explicit all delegations he can access has his id. If the delegator is anonymous all delegations he can access are
+            // accessible by hash. No mixed scenario possible.
+            let accessibleDelegations = Object.values((_b = (_a = typedEntity.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {}).filter((secureDelegation) => dataOwnersHierarchySubset.some((dataOwner) => dataOwner === secureDelegation.delegator || dataOwner === secureDelegation.delegate));
+            if (!accessibleDelegations.length) {
+                const equivalences = (_c = typedEntity.entity.securityMetadata) === null || _c === void 0 ? void 0 : _c.keysEquivalences;
+                const availableCanonicalHashes = Array.from(new Set(Object.keys(yield this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash([
+                    ...Object.keys((_e = (_d = typedEntity.entity.securityMetadata) === null || _d === void 0 ? void 0 : _d.secureDelegations) !== null && _e !== void 0 ? _e : {}),
+                    ...Object.keys((_g = (_f = typedEntity.entity.securityMetadata) === null || _f === void 0 ? void 0 : _f.keysEquivalences) !== null && _g !== void 0 ? _g : {}),
+                ], typedEntity.type, (_h = typedEntity.entity.secretForeignKeys) !== null && _h !== void 0 ? _h : [])).map((hash) => {
+                    const canonicalEquivalence = equivalences ? equivalences[hash] : undefined;
+                    return canonicalEquivalence ? canonicalEquivalence : hash;
+                })));
+                accessibleDelegations = availableCanonicalHashes.map((hash) => { var _a, _b; return ((_b = (_a = typedEntity.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {})[hash]; });
+            }
+            const permissions = accessibleDelegations.map((secureDelegation) => secureDelegation.permissions);
+            let maxLevel = undefined;
+            for (const permission of permissions) {
+                if (permission === AccessLevel.WRITE) {
+                    return AccessLevel.WRITE;
+                }
+                if (permission === AccessLevel.READ) {
+                    maxLevel = AccessLevel.READ;
+                }
+            }
+            return maxLevel;
+        });
+    }
+    decryptSecureDelegations(typedEntity, dataOwnersHierarchySubset, getDataToDecrypt, decryptDataWithKey) {
+        if (!dataOwnersHierarchySubset.length)
+            throw new Error("`dataOwnersHierarchySubset` can't be empty");
+        const self = this;
+        function getFirstDecryptedExchangeDataIdForHash(hashes, encryptedExchangeDataIdsByDelegationKey) {
+            var _a;
+            return __awaiter(this, void 0, void 0, function* () {
+                for (const hash of new Set(hashes)) {
+                    const decryptedExchangeDataId = !!encryptedExchangeDataIdsByDelegationKey[hash]
+                        ? yield self.secureDelegationsEncryption.decryptExchangeDataId((_a = encryptedExchangeDataIdsByDelegationKey[hash]) === null || _a === void 0 ? void 0 : _a.encryptedExchangeDataIds)
+                        : undefined;
+                    if (!!decryptedExchangeDataId)
+                        return decryptedExchangeDataId;
+                }
+            });
+        }
+        function decrypt(delegation, exchangeDataDetails) {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (!exchangeDataDetails.exchangeKey)
+                    return [];
+                const dataToDecrypt = getDataToDecrypt(delegation);
+                if (!dataToDecrypt.length)
+                    return [];
+                if (!dataOwnersHierarchySubset.some((x) => x === exchangeDataDetails.exchangeData.delegator || x === exchangeDataDetails.exchangeData.delegate))
+                    return [];
+                const dataOwnersWithAccess = [exchangeDataDetails.exchangeData.delegator, exchangeDataDetails.exchangeData.delegate];
+                const res = [];
+                for (const curr of dataToDecrypt) {
+                    res.push({ decrypted: yield decryptDataWithKey(curr, exchangeDataDetails.exchangeKey), dataOwnersWithAccess });
+                }
+                return res;
+            });
+        }
+        function generator() {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+            return __asyncGenerator(this, arguments, function* generator_1() {
+                let remainingDelegations = Object.entries((_b = (_a = typedEntity.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {}).map(([canonicalHash, delegation]) => {
+                    var _a, _b;
+                    return ({
+                        delegation,
+                        hashes: [
+                            canonicalHash,
+                            ...Object.entries((_b = (_a = typedEntity.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.keysEquivalences) !== null && _b !== void 0 ? _b : {})
+                                .filter((x) => x[1] == canonicalHash)
+                                .map((x) => x[0]),
+                        ],
+                    });
+                });
+                /*
+                 * Generate from least expensive to most (in terms of time to decrypt). 1 and 2a have equivalent costs.
+                 * 1) Secure delegations with cached exchange data by hash
+                 * 2) Secure delegations with cached exchange data by id for explicit->explicit delegations where delegator and/or delegate is me or parent
+                 * 3) Non cached secure delegations for explicit->explicit delegations where delegator and/or delegate is me or parent (half of old 3)
+                 * 4) Decrypt secure delegation id for explicit->anonymous or anonymous->explicit where explicit is me or parent (2b and half of old3)
+                 */
+                // Step 1) Secure delegations with cached exchange data by hash
+                if (!remainingDelegations.length)
+                    return yield __await(void 0);
+                const cachedDataByHash = yield __await(self.exchangeData.getCachedDecryptionDataKeyByAccessControlHash([
+                    ...Object.keys((_d = (_c = typedEntity.entity.securityMetadata) === null || _c === void 0 ? void 0 : _c.secureDelegations) !== null && _d !== void 0 ? _d : {}),
+                    ...Object.keys((_f = (_e = typedEntity.entity.securityMetadata) === null || _e === void 0 ? void 0 : _e.keysEquivalences) !== null && _f !== void 0 ? _f : {}),
+                ], typedEntity.type, (_g = typedEntity.entity.secretForeignKeys) !== null && _g !== void 0 ? _g : []));
+                let updatedRemainingDelegations = [];
+                for (const decryptionDetails of remainingDelegations) {
+                    const exchangeDataDetails = decryptionDetails.hashes.map((h) => cachedDataByHash === null || cachedDataByHash === void 0 ? void 0 : cachedDataByHash[h]).find((x) => !!x);
+                    if (exchangeDataDetails) {
+                        for (const decrypted of yield __await(decrypt(decryptionDetails.delegation, exchangeDataDetails)))
+                            yield yield __await(decrypted);
+                    }
+                    else if ((!!decryptionDetails.delegation.delegate || !!decryptionDetails.delegation.delegator) &&
+                        dataOwnersHierarchySubset.some((x) => x === decryptionDetails.delegation.delegate || x === decryptionDetails.delegation.delegator)) {
+                        updatedRemainingDelegations.push(decryptionDetails);
+                    }
+                }
+                remainingDelegations = updatedRemainingDelegations;
+                updatedRemainingDelegations = [];
+                // Step 2) Secure delegations with cached exchange data by id for explicit->explicit delegations where delegator and/or delegate is me or parent
+                if (!remainingDelegations.length)
+                    return yield __await(void 0);
+                for (const decryptionDetails of remainingDelegations) {
+                    const exchangeDataDetails = decryptionDetails.delegation.exchangeDataId
+                        ? yield __await(self.exchangeData.getDecryptionDataKeyById(decryptionDetails.delegation.exchangeDataId, typedEntity.type, (_h = typedEntity.entity.secretForeignKeys) !== null && _h !== void 0 ? _h : [], false))
+                        : undefined;
+                    if (!!exchangeDataDetails) {
+                        for (const decrypted of yield __await(decrypt(decryptionDetails.delegation, exchangeDataDetails)))
+                            yield yield __await(decrypted);
+                    }
+                    else {
+                        updatedRemainingDelegations.push(decryptionDetails);
+                    }
+                }
+                remainingDelegations = updatedRemainingDelegations;
+                updatedRemainingDelegations = [];
+                // Step 3) Non cached secure delegations for explicit->explicit delegations where delegator and/or delegate is me or parent
+                if (!remainingDelegations.length)
+                    return yield __await(void 0);
+                for (const decryptionDetails of remainingDelegations) {
+                    const exchangeDataDetails = decryptionDetails.delegation.exchangeDataId
+                        ? yield __await(self.exchangeData.getDecryptionDataKeyById(decryptionDetails.delegation.exchangeDataId, typedEntity.type, (_j = typedEntity.entity.secretForeignKeys) !== null && _j !== void 0 ? _j : [], true))
+                        : undefined;
+                    if (!!exchangeDataDetails) {
+                        for (const decrypted of yield __await(decrypt(decryptionDetails.delegation, exchangeDataDetails)))
+                            yield yield __await(decrypted);
+                    }
+                    else {
+                        updatedRemainingDelegations.push(decryptionDetails);
+                    }
+                }
+                remainingDelegations = updatedRemainingDelegations;
+                // Step 4) Decrypt secure delegation id for explicit->anonymous or anonymous->explicit where explicit is me or parent
+                if (!remainingDelegations.length)
+                    return yield __await(void 0);
+                const allHashes = [
+                    ...remainingDelegations.flatMap((x) => x.hashes),
+                    ...Object.keys((_l = (_k = typedEntity.entity.securityMetadata) === null || _k === void 0 ? void 0 : _k.keysEquivalences) !== null && _l !== void 0 ? _l : {}),
+                ];
+                const encryptedExchangeDataIdsByDelegationKey = (yield __await(self.exchangeDataMap.getExchangeDataMapBatch(allHashes))).reduce((maps, current) => {
+                    return Object.assign(Object.assign({}, maps), { [current.id]: current });
+                }, {});
+                for (const decryptionDetails of remainingDelegations) {
+                    const decryptedExchangeDataId = yield __await(getFirstDecryptedExchangeDataIdForHash(decryptionDetails.hashes, encryptedExchangeDataIdsByDelegationKey));
+                    if (decryptedExchangeDataId) {
+                        const exchangeDataDetails = yield __await(self.exchangeData.getDecryptionDataKeyById(decryptedExchangeDataId, typedEntity.type, (_m = typedEntity.entity.secretForeignKeys) !== null && _m !== void 0 ? _m : [], true));
+                        if (exchangeDataDetails) {
+                            for (const decrypted of yield __await(decrypt(decryptionDetails.delegation, exchangeDataDetails)))
+                                yield yield __await(decrypted);
+                        }
+                    }
+                }
+            });
+        }
+        return generator();
+    }
+}
+exports.SecureDelegationsSecurityMetadataDecryptor = SecureDelegationsSecurityMetadataDecryptor;
+//# sourceMappingURL=SecureDelegationsSecurityMetadataDecryptor.js.map

package/icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureDelegationsSecurityMetadataDecryptor.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AACA,2EAAuE;AAKvE,IAAO,WAAW,GAAG,mCAAgB,CAAC,eAAe,CAAA;AAWrD,MAAa,0CAA0C;IACrD,YACmB,YAAiC,EACjC,eAAuC,EACvC,2BAAwD,EACxD,YAA8B;QAH9B,iBAAY,GAAZ,YAAY,CAAqB;QACjC,oBAAe,GAAf,eAAe,CAAwB;QACvC,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,iBAAY,GAAZ,YAAY,CAAkB;IAC9C,CAAC;IAEJ,uBAAuB,CACrB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,cAAc,mCAAI,EAAE,CAAA,EAAA,EAC7B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CACtE,CAAA;IACH,CAAC;IAED,wBAAwB,CACtB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,eAAe,mCAAI,EAAE,CAAA,EAAA,EAC9B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CACvE,CAAA;IACH,CAAC;IAED,kBAAkB,CAChB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,SAAS,mCAAI,EAAE,CAAA,EAAA,EACxB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CACjE,CAAA;IACH,CAAC;IAEK,yBAAyB,CAAC,WAAoC;;;YAIlE,MAAM,sBAAsB,GAA+D,EAAE,CAAA;YAC7F,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,SAAS,aAAa,CAAC,UAAkB,EAAE,KAAuC;gBAChF,IAAI,sBAAsB,CAAC,UAAU,CAAC,KAAK,WAAW,CAAC,KAAK,EAAE;oBAC5D,sBAAsB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAA;iBAC3C;YACH,CAAC;YACD,8GAA8G;YAC9G,IAAI,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAA;YACvG,IAAI,2BAA2B,GAAiC,EAAE,CAAA;YAClE,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE;gBAClD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;gBACrC,IAAI,UAAU,CAAC,SAAS,EAAE;oBACxB,aAAa,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBAC5D;gBACD,IAAI,UAAU,CAAC,QAAQ,EAAE;oBACvB,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBAC3D;gBACD,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE;oBACjD,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;iBAClD;aACF;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,CAAA;YAC5H,2BAA2B,GAAG,EAAE,CAAA;YAChC,mIAAmI;YACnI,mFAAmF;YACnF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAC9F,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACrC,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CAAA;YACD,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE;gBAClD,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;gBACvE,IAAI,wBAAwB,EAAE;oBAC5B,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;oBAC9F,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;iBAC9F;qBAAM;oBACL,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;iBAClD;aACF;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,CAAA;YAC5H,0IAA0I;YAC1I,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;YAC3E,MAAM,SAAS,GAAG;gBAChB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;gBACpD,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;aAC5E,CAAA;YACD,MAAM,wBAAwB,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;gBACxH,uCACK,IAAI,KACP,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,IACtB;YACH,CAAC,EAAE,EAAyC,CAAC,CAAA;YAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,oBAAoB,EAAE;gBACrD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,EAAE;oBAClF,MAAM,MAAM,GAAG,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC;wBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC;wBACvH,CAAC,CAAC,SAAS,CAAA;oBACb,MAAM,gBAAgB,GAAG,MAAM;wBAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAAE,IAAI,CAAC;wBAC9H,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,gBAAgB,EAAE;wBACpB,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;wBAC9E,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;qBAC9E;yBAAM;wBACL,6BAA6B,GAAG,IAAI,CAAA;qBACrC;iBACF;qBAAM;oBACL,6BAA6B,GAAG,IAAI,CAAA;iBACrC;aACF;YACD,OAAO;gBACL,wBAAwB,EAAE,sBAAsB;gBAChD,6BAA6B;aAC9B,CAAA;;KACF;IAED,oBAAoB,CAAC,MAA6C;;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,cAAc,0CAAE,MAAM,CAAA,EAAA,CAAC,CAAA;IAC9G,CAAC;IAEK,oBAAoB,CAAC,WAAoC,EAAE,yBAAmC;;;YAClG,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,0IAA0I;YAC1I,kDAAkD;YAClD,IAAI,qBAAqB,GAAuB,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,MAAM,CAChI,CAAC,gBAAgB,EAAE,EAAE,CACnB,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,SAAS,IAAI,SAAS,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CACrI,CAAA;YACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBACjC,MAAM,YAAY,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,CAAA;gBAC1E,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CACzC,IAAI,GAAG,CACL,MAAM,CAAC,IAAI,CACT,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CACnE;oBACE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC;oBAC5E,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,EACD,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CACF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACb,MAAM,oBAAoB,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC1E,OAAO,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC3D,CAAC,CAAC,CACH,CACF,CAAA;gBACD,qBAAqB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA,EAAA,CAAC,CAAA;aACrI;YAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YACjG,IAAI,QAAQ,GAA4B,SAAS,CAAA;YACjD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE;gBACpC,IAAI,UAAU,KAAK,WAAW,CAAC,KAAK,EAAE;oBACpC,OAAO,WAAW,CAAC,KAAK,CAAA;iBACzB;gBACD,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,EAAE;oBACnC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAA;iBAC5B;aACF;YACD,OAAO,QAAQ,CAAA;;KAChB;IAEO,wBAAwB,CAC9B,WAAoC,EACpC,yBAAmC,EACnC,gBAA4D,EAC5D,kBAA8E;QAE9E,IAAI,CAAC,yBAAyB,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QACpG,MAAM,IAAI,GAAG,IAAI,CAAA;QAEjB,SAAe,sCAAsC,CACnD,MAAgB,EAChB,uCAA4E;;;gBAE5E,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE;oBAClC,MAAM,uBAAuB,GAAG,CAAC,CAAC,uCAAuC,CAAC,IAAI,CAAC;wBAC7E,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,MAAA,uCAAuC,CAAC,IAAI,CAAC,0CAAE,wBAAwB,CAAC;wBACvI,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,uBAAuB;wBAAE,OAAO,uBAAuB,CAAA;iBAC9D;;SACF;QAED,SAAe,OAAO,CACpB,UAA4B,EAC5B,mBAAuF;;gBAEvF,IAAI,CAAC,mBAAmB,CAAC,WAAW;oBAAE,OAAO,EAAE,CAAA;gBAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;gBAClD,IAAI,CAAC,aAAa,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAA;gBACpC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,mBAAmB,CAAC,YAAY,CAAC,SAAS,IAAI,CAAC,KAAK,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC;oBAC7I,OAAO,EAAE,CAAA;gBACX,MAAM,oBAAoB,GAAG,CAAC,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;gBACpH,MAAM,GAAG,GAAG,EAAE,CAAA;gBACd,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE;oBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,CAAC,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAA;iBAC/G;gBACD,OAAO,GAAG,CAAA;YACZ,CAAC;SAAA;QAED,SAAgB,SAAS;;;gBACvB,IAAI,oBAAoB,GAAkC,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE;;oBAAC,OAAA,CAAC;wBAChC,UAAU;wBACV,MAAM,EAAE;4BACN,aAAa;4BACb,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iCAC3E,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;iCACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;yBACpB;qBACF,CAAC,CAAA;iBAAA,CACH,CAAA;gBAED;;;;;;mBAMG;gBAEH,+DAA+D;gBAC/D,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,MAAM,gBAAgB,GAAG,cAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAC5F;oBACE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC;oBAC5E,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,EACD,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CAAA,CAAA;gBACD,IAAI,2BAA2B,GAAkC,EAAE,CAAA;gBACnE,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBACvG,IAAI,mBAAmB,EAAE;wBACvB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM,IACL,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC;wBACrF,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,iBAAiB,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,KAAK,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EAClI;wBACA,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAClD,2BAA2B,GAAG,EAAE,CAAA;gBAEhC,gJAAgJ;gBAChJ,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,cAAc;wBACrE,CAAC,CAAC,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC9C,iBAAiB,CAAC,UAAU,CAAC,cAAc,EAC3C,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,KAAK,CACN,CAAA;wBACH,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,mBAAmB,EAAE;wBACzB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM;wBACL,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAClD,2BAA2B,GAAG,EAAE,CAAA;gBAEhC,2HAA2H;gBAC3H,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,cAAc;wBACrE,CAAC,CAAC,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC9C,iBAAiB,CAAC,UAAU,CAAC,cAAc,EAC3C,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,IAAI,CACL,CAAA;wBACH,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,mBAAmB,EAAE;wBACzB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM;wBACL,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAElD,qHAAqH;gBACrH,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,MAAM,SAAS,GAAG;oBAChB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;oBAChD,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,CAAA;gBACD,MAAM,uCAAuC,GAAG,CAAC,cAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;oBACvI,uCACK,IAAI,KACP,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,IACtB;gBACH,CAAC,EAAE,EAAyC,CAAC,CAAA;gBAC7C,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,uBAAuB,GAAG,cAAM,sCAAsC,CAC1E,iBAAiB,CAAC,MAAM,EACxB,uCAAuC,CACxC,CAAA,CAAA;oBACD,IAAI,uBAAuB,EAAE;wBAC3B,MAAM,mBAAmB,GAAG,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC1E,uBAAuB,EACvB,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,IAAI,CACL,CAAA,CAAA;wBACD,IAAI,mBAAmB,EAAE;4BACvB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;gCAAE,oBAAM,SAAS,CAAA,CAAA;yBAC1G;qBACF;iBACF;;SACF;QAED,OAAO,SAAS,EAAE,CAAA;IACpB,CAAC;CACF;AA1UD,gGA0UC","sourcesContent":["import { SecurityMetadataDecryptor } from './SecurityMetadataDecryptor'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName'\nimport { ExchangeData } from '../../icc-api/model/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport AccessLevel = SecureDelegation.AccessLevelEnum\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\nimport { ExchangeDataMap } from '../../icc-api/model/ExchangeDataMap'\n\ntype DelegationDecryptionDetails = {\n  delegation: SecureDelegation\n  hashes: string[]\n}\n\nexport class SecureDelegationsSecurityMetadataDecryptor implements SecurityMetadataDecryptor {\n  constructor(\n    private readonly exchangeData: ExchangeDataManager,\n    private readonly exchangeDataMap: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly dataOwnerApi: IccDataOwnerXApi\n  ) {}\n\n  decryptEncryptionKeysOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.encryptionKeys ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptEncryptionKey(e, k)\n    )\n  }\n\n  decryptOwningEntityIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.owningEntityIds ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptOwningEntityId(e, k)\n    )\n  }\n\n  decryptSecretIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.secretIds ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptSecretId(e, k)\n    )\n  }\n\n  async getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [delegateId: string]: SecureDelegation.AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const accumulatedPermissions: { [delegateId: string]: SecureDelegation.AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    function addPermission(delegateId: string, level: SecureDelegation.AccessLevelEnum): void {\n      if (accumulatedPermissions[delegateId] !== AccessLevel.WRITE) {\n        accumulatedPermissions[delegateId] = level\n      }\n    }\n    // 1. Add all explicit data owners, keep only delegations with at least an anonymous data owner to check later\n    let remainingDelegations = Object.entries(typedEntity.entity.securityMetadata?.secureDelegations ?? {})\n    let updatedRemainingDelegations: [string, SecureDelegation][] = []\n    for (const delegationEntry of remainingDelegations) {\n      const delegation = delegationEntry[1]\n      if (delegation.delegator) {\n        addPermission(delegation.delegator, delegation.permissions)\n      }\n      if (delegation.delegate) {\n        addPermission(delegation.delegate, delegation.permissions)\n      }\n      if (!delegation.delegator || !delegation.delegate) {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return { permissionsByDataOwnerId: accumulatedPermissions, hasUnknownAnonymousDataOwners }\n    updatedRemainingDelegations = []\n    // 2. Attempt to identify the anonymous data owner of remaining delegations by checking if we have the exchange data cached by hash\n    // Note: we can find exchange data by hash only if we could successfully decrypt it\n    const cachedExchangeData = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n      remainingDelegations.map((d) => d[0]),\n      typedEntity.type,\n      typedEntity.entity.secretForeignKeys ?? []\n    )\n    for (const delegationEntry of remainingDelegations) {\n      const exchangeDataOfDelegation = cachedExchangeData[delegationEntry[0]]\n      if (exchangeDataOfDelegation) {\n        addPermission(exchangeDataOfDelegation.exchangeData.delegator, delegationEntry[1].permissions)\n        addPermission(exchangeDataOfDelegation.exchangeData.delegate, delegationEntry[1].permissions)\n      } else {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return { permissionsByDataOwnerId: accumulatedPermissions, hasUnknownAnonymousDataOwners }\n    // 3. Attempt to identify the anonymous data owner of remaining delegations between us (or one of our parents) and an anonymous data owner\n    const hierarchy = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n    const allHashes = [\n      ...remainingDelegations.flatMap(([hash, _]) => hash),\n      ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n    ]\n    const encryptedExchangeDataIds = (await this.exchangeDataMap.getExchangeDataMapBatch(allHashes)).reduce((maps, current) => {\n      return {\n        ...maps,\n        [current.id]: current,\n      }\n    }, {} as { [hash: string]: ExchangeDataMap })\n    for (const [hash, delegation] of remainingDelegations) {\n      if (hierarchy.some((x) => x === delegation.delegate || x === delegation.delegator)) {\n        const dataId = !!encryptedExchangeDataIds[hash]\n          ? await this.secureDelegationsEncryption.decryptExchangeDataId(encryptedExchangeDataIds[hash].encryptedExchangeDataIds)\n          : undefined\n        const exchangeDataInfo = dataId\n          ? await this.exchangeData.getDecryptionDataKeyById(dataId, typedEntity.type, typedEntity.entity.secretForeignKeys ?? [], true)\n          : undefined\n        if (exchangeDataInfo) {\n          addPermission(exchangeDataInfo.exchangeData.delegator, delegation.permissions)\n          addPermission(exchangeDataInfo.exchangeData.delegate, delegation.permissions)\n        } else {\n          hasUnknownAnonymousDataOwners = true\n        }\n      } else {\n        hasUnknownAnonymousDataOwners = true\n      }\n    }\n    return {\n      permissionsByDataOwnerId: accumulatedPermissions,\n      hasUnknownAnonymousDataOwners,\n    }\n  }\n\n  hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean {\n    return Object.values(entity.securityMetadata?.secureDelegations ?? {}).some((d) => d.encryptionKeys?.length)\n  }\n\n  async getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevel | undefined> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    // If the data owner is explicit all delegations he can access has his id. If the delegator is anonymous all delegations he can access are\n    // accessible by hash. No mixed scenario possible.\n    let accessibleDelegations: SecureDelegation[] = Object.values(typedEntity.entity.securityMetadata?.secureDelegations ?? {}).filter(\n      (secureDelegation) =>\n        dataOwnersHierarchySubset.some((dataOwner) => dataOwner === secureDelegation.delegator || dataOwner === secureDelegation.delegate)\n    )\n    if (!accessibleDelegations.length) {\n      const equivalences = typedEntity.entity.securityMetadata?.keysEquivalences\n      const availableCanonicalHashes = Array.from(\n        new Set(\n          Object.keys(\n            await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n              [\n                ...Object.keys(typedEntity.entity.securityMetadata?.secureDelegations ?? {}),\n                ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n              ],\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? []\n            )\n          ).map((hash) => {\n            const canonicalEquivalence = equivalences ? equivalences[hash] : undefined\n            return canonicalEquivalence ? canonicalEquivalence : hash\n          })\n        )\n      )\n      accessibleDelegations = availableCanonicalHashes.map((hash) => (typedEntity.entity.securityMetadata?.secureDelegations ?? {})[hash])\n    }\n\n    const permissions = accessibleDelegations.map((secureDelegation) => secureDelegation.permissions)\n    let maxLevel: AccessLevel | undefined = undefined\n    for (const permission of permissions) {\n      if (permission === AccessLevel.WRITE) {\n        return AccessLevel.WRITE\n      }\n      if (permission === AccessLevel.READ) {\n        maxLevel = AccessLevel.READ\n      }\n    }\n    return maxLevel\n  }\n\n  private decryptSecureDelegations(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[],\n    getDataToDecrypt: (delegation: SecureDelegation) => string[],\n    decryptDataWithKey: (encryptedData: string, key: CryptoKey) => Promise<string>\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    const self = this\n\n    async function getFirstDecryptedExchangeDataIdForHash(\n      hashes: string[],\n      encryptedExchangeDataIdsByDelegationKey: { [hash: string]: ExchangeDataMap }\n    ): Promise<string | undefined> {\n      for (const hash of new Set(hashes)) {\n        const decryptedExchangeDataId = !!encryptedExchangeDataIdsByDelegationKey[hash]\n          ? await self.secureDelegationsEncryption.decryptExchangeDataId(encryptedExchangeDataIdsByDelegationKey[hash]?.encryptedExchangeDataIds)\n          : undefined\n        if (!!decryptedExchangeDataId) return decryptedExchangeDataId\n      }\n    }\n\n    async function decrypt(\n      delegation: SecureDelegation,\n      exchangeDataDetails: { exchangeData: ExchangeData; exchangeKey: CryptoKey | undefined }\n    ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n      if (!exchangeDataDetails.exchangeKey) return []\n      const dataToDecrypt = getDataToDecrypt(delegation)\n      if (!dataToDecrypt.length) return []\n      if (!dataOwnersHierarchySubset.some((x) => x === exchangeDataDetails.exchangeData.delegator || x === exchangeDataDetails.exchangeData.delegate))\n        return []\n      const dataOwnersWithAccess = [exchangeDataDetails.exchangeData.delegator, exchangeDataDetails.exchangeData.delegate]\n      const res = []\n      for (const curr of dataToDecrypt) {\n        res.push({ decrypted: await decryptDataWithKey(curr, exchangeDataDetails.exchangeKey), dataOwnersWithAccess })\n      }\n      return res\n    }\n\n    async function* generator(): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n      let remainingDelegations: DelegationDecryptionDetails[] = Object.entries(typedEntity.entity.securityMetadata?.secureDelegations ?? {}).map(\n        ([canonicalHash, delegation]) => ({\n          delegation,\n          hashes: [\n            canonicalHash,\n            ...Object.entries(typedEntity.entity.securityMetadata?.keysEquivalences ?? {})\n              .filter((x) => x[1] == canonicalHash)\n              .map((x) => x[0]),\n          ],\n        })\n      )\n\n      /*\n       * Generate from least expensive to most (in terms of time to decrypt). 1 and 2a have equivalent costs.\n       * 1) Secure delegations with cached exchange data by hash\n       * 2) Secure delegations with cached exchange data by id for explicit->explicit delegations where delegator and/or delegate is me or parent\n       * 3) Non cached secure delegations for explicit->explicit delegations where delegator and/or delegate is me or parent (half of old 3)\n       * 4) Decrypt secure delegation id for explicit->anonymous or anonymous->explicit where explicit is me or parent (2b and half of old3)\n       */\n\n      // Step 1) Secure delegations with cached exchange data by hash\n      if (!remainingDelegations.length) return\n      const cachedDataByHash = await self.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n        [\n          ...Object.keys(typedEntity.entity.securityMetadata?.secureDelegations ?? {}),\n          ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n        ],\n        typedEntity.type,\n        typedEntity.entity.secretForeignKeys ?? []\n      )\n      let updatedRemainingDelegations: DelegationDecryptionDetails[] = []\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.hashes.map((h) => cachedDataByHash?.[h]).find((x) => !!x)\n        if (exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else if (\n          (!!decryptionDetails.delegation.delegate || !!decryptionDetails.delegation.delegator) &&\n          dataOwnersHierarchySubset.some((x) => x === decryptionDetails.delegation.delegate || x === decryptionDetails.delegation.delegator)\n        ) {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n      updatedRemainingDelegations = []\n\n      // Step 2) Secure delegations with cached exchange data by id for explicit->explicit delegations where delegator and/or delegate is me or parent\n      if (!remainingDelegations.length) return\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.delegation.exchangeDataId\n          ? await self.exchangeData.getDecryptionDataKeyById(\n              decryptionDetails.delegation.exchangeDataId,\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? [],\n              false\n            )\n          : undefined\n        if (!!exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n      updatedRemainingDelegations = []\n\n      // Step 3) Non cached secure delegations for explicit->explicit delegations where delegator and/or delegate is me or parent\n      if (!remainingDelegations.length) return\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.delegation.exchangeDataId\n          ? await self.exchangeData.getDecryptionDataKeyById(\n              decryptionDetails.delegation.exchangeDataId,\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? [],\n              true\n            )\n          : undefined\n        if (!!exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n\n      // Step 4) Decrypt secure delegation id for explicit->anonymous or anonymous->explicit where explicit is me or parent\n      if (!remainingDelegations.length) return\n      const allHashes = [\n        ...remainingDelegations.flatMap((x) => x.hashes),\n        ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n      ]\n      const encryptedExchangeDataIdsByDelegationKey = (await self.exchangeDataMap.getExchangeDataMapBatch(allHashes)).reduce((maps, current) => {\n        return {\n          ...maps,\n          [current.id]: current,\n        }\n      }, {} as { [hash: string]: ExchangeDataMap })\n      for (const decryptionDetails of remainingDelegations) {\n        const decryptedExchangeDataId = await getFirstDecryptedExchangeDataIdForHash(\n          decryptionDetails.hashes,\n          encryptedExchangeDataIdsByDelegationKey\n        )\n        if (decryptedExchangeDataId) {\n          const exchangeDataDetails = await self.exchangeData.getDecryptionDataKeyById(\n            decryptedExchangeDataId,\n            typedEntity.type,\n            typedEntity.entity.secretForeignKeys ?? [],\n            true\n          )\n          if (exchangeDataDetails) {\n            for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n          }\n        }\n      }\n    }\n\n    return generator()\n  }\n}\n"]}

package/icc-x-api/crypto/SecurityMetadataDecryptor.d.ts

@@ -0,0 +1,114 @@
+import { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models';
+import { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName';
+import { SecureDelegation } from '../../icc-api/model/SecureDelegation';
+import AccessLevel = SecureDelegation.AccessLevelEnum;
+import AccessLevelEnum = SecureDelegation.AccessLevelEnum;
+/**
+ * @internal this class is for internal use only and may be changed without notice.
+ * Logic for the decryption of the metadata used for access control, encryption, and other security features in an entity.
+ */
+export interface SecurityMetadataDecryptor {
+    /**
+     * Decrypt the encryption keys for an entity. Keys must be returned in raw hex format, removing dashes if they were generated from a UUID.
+     * @param typedEntity an encrypted entity or its stub.
+     * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should
+     * contain only data owners from the current data owner hierarchy.
+     * @throws if dataOwnersHierarchySubset is empty
+     * @return a generator for the decrypted exchange key which yields objects containing:
+     * - `decrypted`: a decrypted encryption key for {@link typedEntity}. Note that the same key may be yielded multiple times by the generator.
+     * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this
+     *   key was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`
+     */
+    decryptEncryptionKeysOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    /**
+     * Decrypt the secret ids for an entity.
+     * @param typedEntity an encrypted entity or its stub.
+     * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should
+     * contain only data owners from the current data owner hierarchy.
+     * @throws if dataOwnersHierarchySubset is empty
+     * @return a generator for the decrypted secret ids which yields objects containing:
+     * - `decrypted`: a decrypted secret id of {@link entity}. Note that the same id may be yielded multiple times by the generator.
+     * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this
+     *   id was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`
+     */
+    decryptSecretIdsOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    /**
+     * Decrypt the owning entity ids of an entity.
+     * @param typedEntity an encrypted entity or its stub.
+     * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should
+     * contain only data owners from the current data owner hierarchy.
+     * @throws if dataOwnersHierarchySubset is empty
+     * @return a generator for the decrypted owning entity ids which yields objects containing:
+     * - `decrypted`: a decrypted owning entity id of {@link entity}. Note that the same id may be yielded multiple times by the generator.
+     * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this
+     *   id was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`
+     */
+    decryptOwningEntityIdsOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    /**
+     * Get the maximum access level that any data owner in {@link dataOwnersHierarchySubset} has to {@link typedEntity}, according to the metadata
+     * supported by this decryptor.
+     * - If at least a data owner in {@link dataOwnersHierarchySubset} has write access the method returns {@link AccessLevel.WRITE}.
+     * - If at least a data owner in {@link dataOwnersHierarchySubset} has read access and no data owner has write access the method returns
+     * {@link AccessLevel.READ}.
+     * - If a data owner has no access to the entity the method returns undefined (this can happen if the data owner has access to an entity through
+     * some metadata which is not supported by this decryptor).
+     * @param typedEntity an entity
+     * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when calculating the
+     * access level. This array should contain only data owners from the current data owner hierarchy.
+     * @return the access level to the entity or undefined if none of the data owners has full access to the entity.
+     */
+    getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevel | undefined>;
+    /**
+     * Get the access level of each data owner with access to the entity according to the metadata supported by this decryptor.
+     * See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for details on the expected behaviour.
+     */
+    getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{
+        permissionsByDataOwnerId: {
+            [dataOwnerId: string]: AccessLevelEnum;
+        };
+        hasUnknownAnonymousDataOwners: boolean;
+    }>;
+    /**
+     * Verifies if there is at least one (encrypted) encryption key in the metadata supported by this decryptor, even if it can't be decrypted by the
+     * current data owner.
+     */
+    hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean;
+}
+/**
+ * @internal this class is meant for internal use only and may be changed without notice.
+ * Security metadata decryptor which combines other existing decryptors.
+ */
+export declare class SecurityMetadataDecryptorChain implements SecurityMetadataDecryptor {
+    private readonly decryptors;
+    constructor(decryptors: SecurityMetadataDecryptor[]);
+    decryptEncryptionKeysOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    decryptOwningEntityIdsOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    decryptSecretIdsOf(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): AsyncGenerator<{
+        decrypted: string;
+        dataOwnersWithAccess: string[];
+    }, void, never>;
+    getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<SecureDelegation.AccessLevelEnum | undefined>;
+    hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean;
+    getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{
+        permissionsByDataOwnerId: {
+            [dataOwnerId: string]: AccessLevelEnum;
+        };
+        hasUnknownAnonymousDataOwners: boolean;
+    }>;
+    private concatenate;
+}

package/icc-x-api/crypto/SecurityMetadataDecryptor.js

@@ -0,0 +1,98 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function verb(n) { if (g[n]) i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityMetadataDecryptorChain = void 0;
+const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
+var AccessLevel = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
+/**
+ * @internal this class is meant for internal use only and may be changed without notice.
+ * Security metadata decryptor which combines other existing decryptors.
+ */
+class SecurityMetadataDecryptorChain {
+    constructor(decryptors) {
+        this.decryptors = decryptors;
+    }
+    decryptEncryptionKeysOf(typedEntity, dataOwnersHierarchySubset) {
+        return this.concatenate((d) => d.decryptEncryptionKeysOf(typedEntity, dataOwnersHierarchySubset));
+    }
+    decryptOwningEntityIdsOf(typedEntity, dataOwnersHierarchySubset) {
+        return this.concatenate((d) => d.decryptOwningEntityIdsOf(typedEntity, dataOwnersHierarchySubset));
+    }
+    decryptSecretIdsOf(typedEntity, dataOwnersHierarchySubset) {
+        return this.concatenate((d) => d.decryptSecretIdsOf(typedEntity, dataOwnersHierarchySubset));
+    }
+    getEntityAccessLevel(typedEntity, dataOwnersHierarchySubset) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let currMaxLevel = undefined;
+            for (const d of this.decryptors) {
+                const currLevel = yield d.getEntityAccessLevel(typedEntity, dataOwnersHierarchySubset);
+                if (currLevel === AccessLevel.WRITE) {
+                    return currLevel;
+                }
+                if (currLevel === AccessLevel.READ) {
+                    currMaxLevel = AccessLevel.READ;
+                }
+            }
+            return currMaxLevel;
+        });
+    }
+    hasAnyEncryptionKeys(entity) {
+        return this.decryptors.some((d) => d.hasAnyEncryptionKeys(entity));
+    }
+    getDataOwnersWithAccessTo(typedEntity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const accumulatedPermissions = {};
+            let hasUnknownAnonymousDataOwners = false;
+            for (const d of this.decryptors) {
+                const currAccess = yield d.getDataOwnersWithAccessTo(typedEntity);
+                hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || currAccess.hasUnknownAnonymousDataOwners;
+                for (const [dataOwnerId, level] of Object.entries(currAccess.permissionsByDataOwnerId)) {
+                    if (accumulatedPermissions[dataOwnerId] !== AccessLevel.WRITE) {
+                        accumulatedPermissions[dataOwnerId] = level;
+                    }
+                }
+            }
+            return {
+                permissionsByDataOwnerId: accumulatedPermissions,
+                hasUnknownAnonymousDataOwners,
+            };
+        });
+    }
+    concatenate(getGenerator) {
+        function generator(decryptors) {
+            return __asyncGenerator(this, arguments, function* generator_1() {
+                for (const d of decryptors) {
+                    const currGenerator = getGenerator(d);
+                    let next = yield __await(currGenerator.next());
+                    while (!next.done) {
+                        yield yield __await(next.value);
+                        next = yield __await(currGenerator.next());
+                    }
+                }
+            });
+        }
+        return generator(this.decryptors);
+    }
+}
+exports.SecurityMetadataDecryptorChain = SecurityMetadataDecryptorChain;
+//# sourceMappingURL=SecurityMetadataDecryptor.js.map