@icure/api 7.1.14 → 8.0.0-RC.1

package/icc-x-api/icc-contact-x-api.d.ts

@@ -6,32 +6,27 @@ import { PaginatedListContact } from '../icc-api/model/PaginatedListContact';
 import { IccDataOwnerXApi } from './icc-data-owner-x-api';
 import { SubscriptionOptions } from './utils';
 import { AuthenticationProvider } from './auth/AuthenticationProvider';
+import { SecureDelegation } from '../icc-api/model/SecureDelegation';
+import AccessLevelEnum = SecureDelegation.AccessLevelEnum;
 import { ShareMetadataBehaviour } from './crypto/ShareMetadataBehaviour';
+import { ShareResult } from './utils/ShareResult';
+import { EntityShareRequest } from '../icc-api/model/requests/EntityShareRequest';
+import RequestedPermissionEnum = EntityShareRequest.RequestedPermissionEnum;
+import { XHR } from '../icc-api/api/XHR';
+import { IccUserXApi } from './icc-user-x-api';
 import { EncryptedEntityXApi } from './basexapi/EncryptedEntityXApi';
-import { AbstractFilter } from "./filters/filters";
-import { IccUserXApi } from "./icc-user-x-api";
-import { Connection } from "../icc-api/model/Connection";
+import { AbstractFilter } from './filters/filters';
+import { Connection } from '../icc-api/model/Connection';
 export declare class IccContactXApi extends IccContactApi implements EncryptedEntityXApi<models.Contact> {
-    i18n: any;
-    crypto: IccCryptoXApi;
-    dataOwnerApi: IccDataOwnerXApi;
+    private readonly crypto;
+    private readonly dataOwnerApi;
     private readonly userApi;
     private readonly authApi;
+    i18n: any;
     private readonly contactEncryptedFields;
     private readonly serviceEncryptedFieldsNoContent;
     private readonly serviceEncryptedFieldsWithContent;
-    /**
-     *
-     * @param host
-     * @param headers
-     * @param crypto
-     * @param dataOwnerApi
-     * @param authenticationProvider
-     * @param fetchImpl
-     * @param contactEncryptedKeys custom encrypted fields for Contact. Note that to customise the encryption of contained services (`services` field),
-     * you need to use the serviceEncryptedKeys parameter.
-     * @param serviceEncryptedKeys custom encrypted fields for Service. Note that you can't customise encryption of the `content` field
-     */
+    get headers(): Promise<Array<XHR.Header>>;
     constructor(host: string, headers: {
         [key: string]: string;
     }, crypto: IccCryptoXApi, dataOwnerApi: IccDataOwnerXApi, userApi: IccUserXApi, authApi: IccAuthApi, authenticationProvider?: AuthenticationProvider, fetchImpl?: (input: RequestInfo, init?: RequestInit) => Promise<Response>, contactEncryptedKeys?: string[], serviceEncryptedKeys?: string[]);
@@ -44,17 +39,17 @@ export declare class IccContactXApi extends IccContactApi implements EncryptedEn
      * @param options optional parameters:
      * - additionalDelegates: delegates which will have access to the entity in addition to the current data owner and delegates from the
      * auto-delegations. Must be an object which associates each data owner id with the access level to give to that data owner. May overlap with
-     * auto-delegations, in such case the access level specified here will be used. Currently only WRITE access is supported, but in future also read
-     * access will be possible.
-     * - preferredSfk: secret id of the patient to use as the secret foreign key to use for the classification. The default value will be a
-     * secret id of patient known by the topmost parent in the current data owner hierarchy.
+     * auto-delegations, in such case the access level specified here will be used.
+     * - preferredSfk: secret id of the patient to use as the secret foreign key to use for the contact. The default value will be a
+     * secret id of patient known by the topmost parent in the current data owner hierarchy if the confidential is set to false, else a secret id that
+     * the data owner did not share with any of his parents.
      * - confidential: if true, the entity will be created as confidential. Confidential entities are not shared with auto-delegations, and the default
      * foreign key used is any key that is not shared with any of the data owner parents. By default entities are created as non-confidential.
      * @return a new instance of contact.
      */
     newInstance(user: models.User, patient: models.Patient, c: any, options?: {
         additionalDelegates?: {
-            [dataOwnerId: string]: 'WRITE';
+            [dataOwnerId: string]: AccessLevelEnum;
         };
         preferredSfk?: string;
         confidential?: boolean;
@@ -98,7 +93,7 @@ export declare class IccContactXApi extends IccContactApi implements EncryptedEn
     getContactWithUser(user: models.User, contactId: string): Promise<models.Contact>;
     getContactsWithUser(user: models.User, body?: models.ListOfIds): Promise<Array<models.Contact> | any>;
     modifyContactWithUser(user: models.User, body?: models.Contact): Promise<models.Contact | any>;
-    private modifyAs;
+    private modifyContactAs;
     modifyContactsWithUser(user: models.User, bodies?: Array<models.Contact>): Promise<models.Contact[] | any>;
     createContactWithUser(user: models.User, body?: models.Contact): Promise<models.Contact | null>;
     createContactsWithUser(user: models.User, bodies?: Array<models.Contact>): Promise<models.Contact[] | null>;
@@ -170,9 +165,13 @@ export declare class IccContactXApi extends IccContactApi implements EncryptedEn
      * in the returned array, but in case of entity merges there could be multiple values.
      */
     decryptPatientIdOf(contact: models.Contact): Promise<string[]>;
+    /**
+     * @return if the logged data owner has write access to the content of the given contact
+     */
+    hasWriteAccess(contact: models.Contact): Promise<boolean>;
     /**
      * Share an existing contact with other data owners, allowing them to access the non-encrypted data of the contact and optionally also
-     * the encrypted content.
+     * the encrypted content, with read-only or read-write permissions.
      * @param delegateId the id of the data owner which will be granted access to the contact.
      * @param contact the contact to share.
      * @param options optional parameters to customize the sharing behaviour:
@@ -181,37 +180,62 @@ export declare class IccContactXApi extends IccContactApi implements EncryptedEn
      * contact does not have encrypted content.
      * - sharePatientId: specifies if the id of the patient that this contact refers to should be shared with the delegate (defaults to
      * {@link ShareMetadataBehaviour.IF_AVAILABLE}).
-     * @return a promise which will contain the updated contact.
+     * - requestedPermissions: the requested permissions for the delegate, defaults to {@link RequestedPermissionEnum.MAX_WRITE}.
+     * @return the updated entity
      */
     shareWith(delegateId: string, contact: models.Contact, options?: {
+        requestedPermissions?: RequestedPermissionEnum;
         shareEncryptionKey?: ShareMetadataBehaviour;
         sharePatientId?: ShareMetadataBehaviour;
     }): Promise<models.Contact>;
     /**
      * Share an existing contact with other data owners, allowing them to access the non-encrypted data of the contact and optionally also
-     * the encrypted content.
+     * the encrypted content, with read-only or read-write permissions.
      * @param contact the contact to share.
-     * @param delegates share options for each delegate.
+     * @param delegates associates the id of data owners which will be granted access to the entity, to the following sharing options:
      * - shareEncryptionKey: specifies if the encryption key of the access log should be shared with the delegate, giving access to all encrypted
      * content of the entity, excluding other encrypted metadata (defaults to {@link ShareMetadataBehaviour.IF_AVAILABLE}). Note that by default a
      * contact does not have encrypted content.
      * - sharePatientId: specifies if the id of the patient that this contact refers to should be shared with the delegate (defaults to
      * {@link ShareMetadataBehaviour.IF_AVAILABLE}).
-     * @return a promise which will contain the updated contact.
+     * - requestedPermissions: the requested permissions for the delegate, defaults to {@link RequestedPermissionEnum.MAX_WRITE}.
+     * @return the updated entity
      */
     shareWithMany(contact: models.Contact, delegates: {
         [delegateId: string]: {
+            requestedPermissions?: RequestedPermissionEnum;
             shareEncryptionKey?: ShareMetadataBehaviour;
             sharePatientId?: ShareMetadataBehaviour;
         };
     }): Promise<models.Contact>;
-    getDataOwnersWithAccessTo(entity: Contact): Promise<{
+    /**
+     * Share an existing contact with other data owners, allowing them to access the non-encrypted data of the contact and optionally also
+     * the encrypted content, with read-only or read-write permissions.
+     * @param contact the contact to share.
+     * @param delegates associates the id of data owners which will be granted access to the entity, to the following sharing options:
+     * - shareEncryptionKey: specifies if the encryption key of the access log should be shared with the delegate, giving access to all encrypted
+     * content of the entity, excluding other encrypted metadata (defaults to {@link ShareMetadataBehaviour.IF_AVAILABLE}). Note that by default a
+     * contact does not have encrypted content.
+     * - sharePatientId: specifies if the id of the patient that this contact refers to should be shared with the delegate (defaults to
+     * {@link ShareMetadataBehaviour.IF_AVAILABLE}).
+     * - requestedPermissions: the requested permissions for the delegate, defaults to {@link RequestedPermissionEnum.MAX_WRITE}.
+     * @return a promise which will contain the result of the operation: the updated entity if the operation was successful or details of the error if
+     * the operation failed.
+     */
+    tryShareWithMany(contact: models.Contact, delegates: {
+        [delegateId: string]: {
+            requestedPermissions?: RequestedPermissionEnum;
+            shareEncryptionKey?: ShareMetadataBehaviour;
+            sharePatientId?: ShareMetadataBehaviour;
+        };
+    }): Promise<ShareResult<models.Contact>>;
+    getDataOwnersWithAccessTo(entity: models.Contact): Promise<{
         permissionsByDataOwnerId: {
-            [p: string]: 'WRITE';
+            [p: string]: AccessLevelEnum;
         };
         hasUnknownAnonymousDataOwners: boolean;
     }>;
-    getEncryptionKeysOf(entity: Contact): Promise<string[]>;
+    getEncryptionKeysOf(entity: models.Contact): Promise<string[]>;
     subscribeToServiceEvents(eventTypes: ('CREATE' | 'UPDATE' | 'DELETE')[], filter: AbstractFilter<Service> | undefined, eventFired: (dataSample: Service) => Promise<void>, options?: SubscriptionOptions): Promise<Connection>;
     subscribeToContactEvents(eventTypes: ('CREATE' | 'UPDATE' | 'DELETE')[], filter: AbstractFilter<Contact> | undefined, eventFired: (dataSample: Contact) => Promise<void>, options?: SubscriptionOptions): Promise<Connection>;
 }

package/icc-x-api/icc-contact-x-api.js

@@ -20,27 +20,23 @@ const binary_utils_1 = require("./utils/binary-utils");
 const ServiceByIdsFilter_1 = require("./filters/ServiceByIdsFilter");
 const utils_1 = require("./utils");
 const AuthenticationProvider_1 = require("./auth/AuthenticationProvider");
-const websocket_1 = require("./utils/websocket");
+const SecureDelegation_1 = require("../icc-api/model/SecureDelegation");
+var AccessLevelEnum = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
 const Connection_1 = require("../icc-api/model/Connection");
 class IccContactXApi extends icc_api_1.IccContactApi {
-    /**
-     *
-     * @param host
-     * @param headers
-     * @param crypto
-     * @param dataOwnerApi
-     * @param authenticationProvider
-     * @param fetchImpl
-     * @param contactEncryptedKeys custom encrypted fields for Contact. Note that to customise the encryption of contained services (`services` field),
-     * you need to use the serviceEncryptedKeys parameter.
-     * @param serviceEncryptedKeys custom encrypted fields for Service. Note that you can't customise encryption of the `content` field
-     */
+    get headers() {
+        return super.headers.then((h) => this.crypto.accessControlKeysHeaders.addAccessControlKeysHeaders(h, 'Contact'));
+    }
     constructor(host, headers, crypto, dataOwnerApi, userApi, authApi, authenticationProvider = new AuthenticationProvider_1.NoAuthenticationProvider(), fetchImpl = typeof window !== 'undefined'
         ? window.fetch
         : typeof self !== 'undefined'
             ? self.fetch
             : fetch, contactEncryptedKeys = ['descr'], serviceEncryptedKeys = []) {
         super(host, headers, authenticationProvider, fetchImpl);
+        this.crypto = crypto;
+        this.dataOwnerApi = dataOwnerApi;
+        this.userApi = userApi;
+        this.authApi = authApi;
         this.i18n = contact_i18n_1.default;
         if (contactEncryptedKeys.some((key) => key.startsWith('services'))) {
             throw new Error("You can't customise encryption of the `services` field of Contact. Use the serviceEncryptedKeys parameter instead.");
@@ -68,31 +64,30 @@ class IccContactXApi extends icc_api_1.IccContactApi {
      * @param options optional parameters:
      * - additionalDelegates: delegates which will have access to the entity in addition to the current data owner and delegates from the
      * auto-delegations. Must be an object which associates each data owner id with the access level to give to that data owner. May overlap with
-     * auto-delegations, in such case the access level specified here will be used. Currently only WRITE access is supported, but in future also read
-     * access will be possible.
-     * - preferredSfk: secret id of the patient to use as the secret foreign key to use for the classification. The default value will be a
-     * secret id of patient known by the topmost parent in the current data owner hierarchy.
+     * auto-delegations, in such case the access level specified here will be used.
+     * - preferredSfk: secret id of the patient to use as the secret foreign key to use for the contact. The default value will be a
+     * secret id of patient known by the topmost parent in the current data owner hierarchy if the confidential is set to false, else a secret id that
+     * the data owner did not share with any of his parents.
      * - confidential: if true, the entity will be created as confidential. Confidential entities are not shared with auto-delegations, and the default
      * foreign key used is any key that is not shared with any of the data owner parents. By default entities are created as non-confidential.
      * @return a new instance of contact.
      */
     newInstance(user, patient, c, options = {}) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t;
         return __awaiter(this, void 0, void 0, function* () {
             const contact = new models.Contact(Object.assign(Object.assign({}, (c !== null && c !== void 0 ? c : {})), { _type: 'org.taktik.icure.entities.Contact', id: (_a = c === null || c === void 0 ? void 0 : c.id) !== null && _a !== void 0 ? _a : this.crypto.primitives.randomUuid(), created: (_b = c === null || c === void 0 ? void 0 : c.created) !== null && _b !== void 0 ? _b : new Date().getTime(), modified: (_c = c === null || c === void 0 ? void 0 : c.modified) !== null && _c !== void 0 ? _c : new Date().getTime(), responsible: (_d = c === null || c === void 0 ? void 0 : c.responsible) !== null && _d !== void 0 ? _d : this.dataOwnerApi.getDataOwnerIdOf(user), author: (_e = c === null || c === void 0 ? void 0 : c.author) !== null && _e !== void 0 ? _e : user.id, codes: (_f = c === null || c === void 0 ? void 0 : c.codes) !== null && _f !== void 0 ? _f : [], tags: (_g = c === null || c === void 0 ? void 0 : c.tags) !== null && _g !== void 0 ? _g : [], groupId: (_h = c === null || c === void 0 ? void 0 : c.groupId) !== null && _h !== void 0 ? _h : this.crypto.primitives.randomUuid(), subContacts: (_j = c === null || c === void 0 ? void 0 : c.subContacts) !== null && _j !== void 0 ? _j : [], services: (_k = c === null || c === void 0 ? void 0 : c.services) !== null && _k !== void 0 ? _k : [], openingDate: (_l = c === null || c === void 0 ? void 0 : c.openingDate) !== null && _l !== void 0 ? _l : parseInt(moment().format('YYYYMMDDHHmmss')) }));
             const ownerId = this.dataOwnerApi.getDataOwnerIdOf(user);
             if (ownerId !== (yield this.dataOwnerApi.getCurrentDataOwnerId()))
                 throw new Error('Can only initialise entities as current data owner.');
-            const sfk = (_m = options.preferredSfk) !== null && _m !== void 0 ? _m : (!!options.confidential
-                ? yield this.crypto.confidential.getConfidentialSecretId(patient)
-                : yield this.crypto.confidential.getAnySecretIdSharedWithParents(patient));
+            const sfk = (_m = options.preferredSfk) !== null && _m !== void 0 ? _m : ((options === null || options === void 0 ? void 0 : options.confidential)
+                ? yield this.crypto.confidential.getConfidentialSecretId({ entity: patient, type: 'Patient' })
+                : yield this.crypto.confidential.getAnySecretIdSharedWithParents({ entity: patient, type: 'Patient' }));
             if (!sfk)
-                throw new Error(`Couldn't find any sfk of parent patient ${patient.id} for confidential=${!!options.confidential}`);
-            const extraDelegations = [
-                ...Object.keys((_o = options.additionalDelegates) !== null && _o !== void 0 ? _o : {}),
-                ...(options.confidential ? [] : [...((_q = (_p = user.autoDelegations) === null || _p === void 0 ? void 0 : _p.all) !== null && _q !== void 0 ? _q : []), ...((_s = (_r = user.autoDelegations) === null || _r === void 0 ? void 0 : _r.medicalInformation) !== null && _s !== void 0 ? _s : [])]),
-            ];
-            const initialisationInfo = yield this.crypto.entities.entityWithInitialisedEncryptedMetadata(contact, patient.id, sfk, true, extraDelegations);
+                throw new Error(`Couldn't find any sfk of parent patient ${patient.id} for confidential=${(_o = options.confidential) !== null && _o !== void 0 ? _o : false}`);
+            const extraDelegations = Object.assign(Object.assign({}, (options.confidential
+                ? {}
+                : Object.fromEntries([...((_q = (_p = user.autoDelegations) === null || _p === void 0 ? void 0 : _p.all) !== null && _q !== void 0 ? _q : []), ...((_s = (_r = user.autoDelegations) === null || _r === void 0 ? void 0 : _r.medicalInformation) !== null && _s !== void 0 ? _s : [])].map((d) => [d, AccessLevelEnum.WRITE])))), ((_t = options === null || options === void 0 ? void 0 : options.additionalDelegates) !== null && _t !== void 0 ? _t : {}));
+            const initialisationInfo = yield this.crypto.xapi.entityWithInitialisedEncryptedMetadata(contact, 'Contact', patient.id, sfk, true, false, extraDelegations);
             return new models.Contact(initialisationInfo.updatedEntity);
         });
     }
@@ -114,7 +109,7 @@ class IccContactXApi extends icc_api_1.IccContactApi {
      */
     findBy(hcpartyId, patient, usingPost = false) {
         return __awaiter(this, void 0, void 0, function* () {
-            return yield this.crypto.entities.secretIdsForHcpHierarchyOf(patient).then((keysHierarchy) => keysHierarchy && keysHierarchy.length > 0
+            return yield this.crypto.xapi.secretIdsForHcpHierarchyOf({ entity: patient, type: 'Patient' }).then((keysHierarchy) => keysHierarchy && keysHierarchy.length > 0
                 ? Promise.all(keysHierarchy
                     .reduce((acc, level) => {
                     return acc.concat([
@@ -136,7 +131,7 @@ class IccContactXApi extends icc_api_1.IccContactApi {
             const perHcpId = {};
             for (const patient of patients) {
                 ;
-                (yield this.crypto.entities.secretIdsForHcpHierarchyOf(patient))
+                (yield this.crypto.xapi.secretIdsForHcpHierarchyOf({ entity: patient, type: 'Patient' }))
                     .reduce((acc, level) => {
                     return acc.concat([
                         {
@@ -235,11 +230,11 @@ class IccContactXApi extends icc_api_1.IccContactApi {
     }
     modifyContactWithUser(user, body) {
         return __awaiter(this, void 0, void 0, function* () {
-            return body ? this.modifyAs(this.dataOwnerApi.getDataOwnerIdOf(user), body) : null;
+            return body ? this.modifyContactAs(this.dataOwnerApi.getDataOwnerIdOf(user), body) : null;
         });
     }
-    modifyAs(dataOwner, contact) {
-        return this.encryptAs(dataOwner, [_.cloneDeep(contact)])
+    modifyContactAs(dataOwner, body) {
+        return this.encryptAs(dataOwner, [_.cloneDeep(body)])
             .then((ctcs) => super.modifyContact(ctcs[0]))
             .then((ctc) => this.decrypt(dataOwner, [ctc]))
             .then((ctcs) => ctcs[0]);
@@ -322,11 +317,14 @@ class IccContactXApi extends icc_api_1.IccContactApi {
     encryptAs(hcpartyId, ctcs) {
         const bypassEncryption = false; //Used for debug
         return Promise.all(ctcs.map((ctc) => __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const initialisedCtc = bypassEncryption //Prevent encryption for test ctc
-                ? ctc
-                : (_a = (yield this.crypto.entities.ensureEncryptionKeysInitialised(ctc))) !== null && _a !== void 0 ? _a : ctc;
-            const encryptionKey = yield this.crypto.entities.importFirstValidKey(yield this.crypto.entities.encryptionKeysOf(ctc, hcpartyId), ctc.id);
+            let initialisedCtc = ctc;
+            if (!bypassEncryption) {
+                const contactWithKeys = yield this.crypto.xapi.ensureEncryptionKeysInitialised(ctc, 'Contact');
+                if (contactWithKeys) {
+                    initialisedCtc = contactWithKeys;
+                }
+            }
+            const encryptionKey = yield this.crypto.xapi.decryptAndImportAnyEncryptionKey({ entity: initialisedCtc, type: 'Contact' });
             return new models_1.Contact(yield (0, utils_1.encryptObject)(Object.assign(Object.assign({}, initialisedCtc), { services: initialisedCtc.services ? yield this.encryptServices(encryptionKey.key, encryptionKey.raw, initialisedCtc.services) : [] }), (obj) => {
                 return this.crypto.primitives.AES.encrypt(encryptionKey.key, (0, binary_utils_1.utf8_2ua)(JSON.stringify(obj)), encryptionKey.raw);
             }, this.contactEncryptedFields, 'contact'));
@@ -334,25 +332,31 @@ class IccContactXApi extends icc_api_1.IccContactApi {
     }
     decrypt(hcpartyId, ctcs) {
         return Promise.all(ctcs.map((ctc) => __awaiter(this, void 0, void 0, function* () {
-            const keys = yield this.crypto.entities.importAllValidKeys(yield this.crypto.entities.encryptionKeysOf(ctc, hcpartyId));
+            const keys = yield this.crypto.xapi.decryptAndImportAllDecryptionKeys({ entity: ctc, type: 'Contact' });
             if (!keys || !keys.length) {
                 console.log('Cannot decrypt contact', ctc.id);
                 return ctc;
             }
             return new models_1.Contact(yield (0, utils_1.decryptObject)(ctc, (encrypted) => __awaiter(this, void 0, void 0, function* () {
                 var _a;
-                return (_a = (yield this.crypto.entities.tryDecryptJson(keys, encrypted, false))) !== null && _a !== void 0 ? _a : {};
+                return (_a = (yield this.crypto.xapi.tryDecryptJson(keys, encrypted, false))) !== null && _a !== void 0 ? _a : {};
             })));
         })));
     }
     decryptServices(hcpartyId, svcs, keys) {
+        const contactKeysCache = {};
         return Promise.all(svcs.map((svc) => __awaiter(this, void 0, void 0, function* () {
-            if (!keys) {
-                keys = yield this.crypto.entities.importAllValidKeys(yield this.crypto.entities.encryptionKeysOf(svc, hcpartyId));
+            let currentKeys = keys !== null && keys !== void 0 ? keys : (svc.contactId ? contactKeysCache[svc.contactId] : undefined);
+            if (!currentKeys) {
+                const decryptedKeys = yield this.crypto.xapi.decryptAndImportAllDecryptionKeys({ entity: svc, type: 'Contact' });
+                if (svc.contactId) {
+                    contactKeysCache[svc.contactId] = decryptedKeys;
+                }
+                currentKeys = decryptedKeys;
             }
             return new models_1.Service(yield (0, utils_1.decryptObject)(svc, (encrypted) => __awaiter(this, void 0, void 0, function* () {
                 var _a;
-                return (_a = (yield this.crypto.entities.tryDecryptJson(keys, encrypted, false))) !== null && _a !== void 0 ? _a : {};
+                return (_a = (yield this.crypto.xapi.tryDecryptJson(keys, encrypted, false))) !== null && _a !== void 0 ? _a : {};
             })));
         })));
     }
@@ -718,12 +722,20 @@ class IccContactXApi extends icc_api_1.IccContactApi {
      */
     decryptPatientIdOf(contact) {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.crypto.entities.owningEntityIdsOf(contact, undefined);
+            return this.crypto.xapi.owningEntityIdsOf({ entity: contact, type: 'Contact' }, undefined);
+        });
+    }
+    /**
+     * @return if the logged data owner has write access to the content of the given contact
+     */
+    hasWriteAccess(contact) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.crypto.xapi.hasWriteAccess({ entity: contact, type: 'Contact' });
         });
     }
     /**
      * Share an existing contact with other data owners, allowing them to access the non-encrypted data of the contact and optionally also
-     * the encrypted content.
+     * the encrypted content, with read-only or read-write permissions.
      * @param delegateId the id of the data owner which will be granted access to the contact.
      * @param contact the contact to share.
      * @param options optional parameters to customize the sharing behaviour:
@@ -732,7 +744,8 @@ class IccContactXApi extends icc_api_1.IccContactApi {
      * contact does not have encrypted content.
      * - sharePatientId: specifies if the id of the patient that this contact refers to should be shared with the delegate (defaults to
      * {@link ShareMetadataBehaviour.IF_AVAILABLE}).
-     * @return a promise which will contain the updated contact.
+     * - requestedPermissions: the requested permissions for the delegate, defaults to {@link RequestedPermissionEnum.MAX_WRITE}.
+     * @return the updated entity
      */
     shareWith(delegateId, contact, options = {}) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -741,53 +754,71 @@ class IccContactXApi extends icc_api_1.IccContactApi {
     }
     /**
      * Share an existing contact with other data owners, allowing them to access the non-encrypted data of the contact and optionally also
-     * the encrypted content.
+     * the encrypted content, with read-only or read-write permissions.
      * @param contact the contact to share.
-     * @param delegates share options for each delegate.
+     * @param delegates associates the id of data owners which will be granted access to the entity, to the following sharing options:
      * - shareEncryptionKey: specifies if the encryption key of the access log should be shared with the delegate, giving access to all encrypted
      * content of the entity, excluding other encrypted metadata (defaults to {@link ShareMetadataBehaviour.IF_AVAILABLE}). Note that by default a
      * contact does not have encrypted content.
      * - sharePatientId: specifies if the id of the patient that this contact refers to should be shared with the delegate (defaults to
      * {@link ShareMetadataBehaviour.IF_AVAILABLE}).
-     * @return a promise which will contain the updated contact.
+     * - requestedPermissions: the requested permissions for the delegate, defaults to {@link RequestedPermissionEnum.MAX_WRITE}.
+     * @return the updated entity
      */
     shareWithMany(contact, delegates) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (yield this.tryShareWithMany(contact, delegates)).updatedEntityOrThrow;
+        });
+    }
+    /**
+     * Share an existing contact with other data owners, allowing them to access the non-encrypted data of the contact and optionally also
+     * the encrypted content, with read-only or read-write permissions.
+     * @param contact the contact to share.
+     * @param delegates associates the id of data owners which will be granted access to the entity, to the following sharing options:
+     * - shareEncryptionKey: specifies if the encryption key of the access log should be shared with the delegate, giving access to all encrypted
+     * content of the entity, excluding other encrypted metadata (defaults to {@link ShareMetadataBehaviour.IF_AVAILABLE}). Note that by default a
+     * contact does not have encrypted content.
+     * - sharePatientId: specifies if the id of the patient that this contact refers to should be shared with the delegate (defaults to
+     * {@link ShareMetadataBehaviour.IF_AVAILABLE}).
+     * - requestedPermissions: the requested permissions for the delegate, defaults to {@link RequestedPermissionEnum.MAX_WRITE}.
+     * @return a promise which will contain the result of the operation: the updated entity if the operation was successful or details of the error if
+     * the operation failed.
+     */
+    tryShareWithMany(contact, delegates) {
         return __awaiter(this, void 0, void 0, function* () {
             const self = yield this.dataOwnerApi.getCurrentDataOwnerId();
-            const extended = yield this.crypto.entities.entityWithAutoExtendedEncryptedMetadata(contact, true, Object.fromEntries(Object.entries(delegates).map(([delegateId, options]) => [
+            // All entities should have an encryption key.
+            const entityWithEncryptionKey = yield this.crypto.xapi.ensureEncryptionKeysInitialised(contact, 'Contact');
+            const updatedEntity = entityWithEncryptionKey ? yield this.modifyContactAs(self, entityWithEncryptionKey) : contact;
+            return this.crypto.xapi
+                .simpleShareOrUpdateEncryptedEntityMetadata({ entity: updatedEntity, type: 'Contact' }, true, Object.fromEntries(Object.entries(delegates).map(([delegateId, options]) => [
                 delegateId,
                 {
-                    shareEncryptionKey: options.shareEncryptionKey,
+                    requestedPermissions: options.requestedPermissions,
+                    shareEncryptionKeys: options.shareEncryptionKey,
                     shareOwningEntityIds: options.sharePatientId,
+                    shareSecretIds: undefined,
                 },
-            ])));
-            if (!!extended) {
-                return yield this.modifyAs(self, extended);
-            }
-            else
-                return contact;
+            ])), (x) => this.bulkShareContacts(x))
+                .then((r) => r.mapSuccessAsync((e) => this.decrypt(self, [e]).then((es) => es[0])));
         });
     }
     getDataOwnersWithAccessTo(entity) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this.crypto.entities.getDataOwnersWithAccessTo(entity);
-        });
+        return this.crypto.xapi.getDataOwnersWithAccessTo({ entity, type: 'Contact' });
     }
     getEncryptionKeysOf(entity) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this.crypto.entities.encryptionKeysOf(entity);
-        });
+        return this.crypto.xapi.encryptionKeysOf({ entity, type: 'Contact' }, undefined);
     }
     subscribeToServiceEvents(eventTypes, filter, eventFired, options = {}) {
         return __awaiter(this, void 0, void 0, function* () {
             const currentUser = yield this.userApi.getCurrentUser();
-            return (0, websocket_1.subscribeToEntityEvents)(this.host, this.authApi, 'Service', eventTypes, filter, eventFired, options, (encrypted) => __awaiter(this, void 0, void 0, function* () { return (yield this.decryptServices(currentUser.healthcarePartyId, [encrypted]))[0]; })).then((ws) => new Connection_1.ConnectionImpl(ws));
+            return (0, utils_1.subscribeToEntityEvents)(this.host, this.authApi, 'Service', eventTypes, filter, eventFired, options, (encrypted) => __awaiter(this, void 0, void 0, function* () { return (yield this.decryptServices(currentUser.healthcarePartyId, [encrypted]))[0]; })).then((ws) => new Connection_1.ConnectionImpl(ws));
         });
     }
     subscribeToContactEvents(eventTypes, filter, eventFired, options = {}) {
         return __awaiter(this, void 0, void 0, function* () {
             const currentUser = yield this.userApi.getCurrentUser();
-            return (0, websocket_1.subscribeToEntityEvents)(this.host, this.authApi, 'Contact', eventTypes, filter, eventFired, options, (encrypted) => __awaiter(this, void 0, void 0, function* () { return (yield this.decrypt(currentUser.healthcarePartyId, [encrypted]))[0]; })).then((ws) => new Connection_1.ConnectionImpl(ws));
+            return (0, utils_1.subscribeToEntityEvents)(this.host, this.authApi, 'Contact', eventTypes, filter, eventFired, options, (encrypted) => __awaiter(this, void 0, void 0, function* () { return (yield this.decrypt(currentUser.healthcarePartyId, [encrypted]))[0]; })).then((ws) => new Connection_1.ConnectionImpl(ws));
         });
     }
 }