@icure/api 7.1.16 → 8.0.0-RC.2

package/icc-x-api/crypto/ExchangeDataMapManager.d.ts

@@ -0,0 +1,32 @@
+import { IccExchangeDataMapApi } from '../../icc-api/api/IccExchangeDataMapApi';
+import { ExchangeDataMap } from '../../icc-api/model/internal/ExchangeDataMap';
+/**
+ * @internal this class is intended for internal use only and may be modified without notice
+ * This class manages the Exchange Data Map entities, caching with an LRU cache on retrieval.
+ */
+export declare class ExchangeDataMapManager {
+    private readonly api;
+    constructor(api: IccExchangeDataMapApi);
+    private exchangeDataMapCache;
+    /**
+     * This function creates a batch of Exchange Data Map, ignoring the one that already exist and are already present in the cache.
+     * The ones that are not are created and their ids are cached.
+     * @param batch a map where each key is the hex-encoded access control key to another map that associates the encoded id of an
+     * Exchange Data entity to the fingerprint of the key used to encrypt it.
+     */
+    createExchangeDataMaps(batch: {
+        [accessControlKey: string]: {
+            [fp: string]: string;
+        };
+    }): Promise<void>;
+    /**
+     * Retrieves an Exchange Data Map.
+     * @param accessControlKeyHash the hex-encoded hash of the Exchange Data Map to retrieve.
+     */
+    getExchangeDataMap(accessControlKeyHash: string): Promise<ExchangeDataMap>;
+    /**
+     * Retrieves a batch of Exchange Data Maps.
+     * @param accessControlKeyHashes the hex-encoded hashes of the Exchange Data Maps to retrieve.
+     */
+    getExchangeDataMapBatch(accessControlKeyHashes: string[]): Promise<ExchangeDataMap[]>;
+}

package/icc-x-api/crypto/ExchangeDataMapManager.js

@@ -0,0 +1,70 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExchangeDataMapManager = void 0;
+const lru_temporised_async_cache_1 = require("../utils/lru-temporised-async-cache");
+const ExchangeDataMapCreationBatch_1 = require("../../icc-api/model/ExchangeDataMapCreationBatch");
+/**
+ * @internal this class is intended for internal use only and may be modified without notice
+ * This class manages the Exchange Data Map entities, caching with an LRU cache on retrieval.
+ */
+class ExchangeDataMapManager {
+    constructor(api) {
+        this.api = api;
+        this.exchangeDataMapCache = new lru_temporised_async_cache_1.LruTemporisedAsyncCache(1000, () => -1);
+    }
+    /**
+     * This function creates a batch of Exchange Data Map, ignoring the one that already exist and are already present in the cache.
+     * The ones that are not are created and their ids are cached.
+     * @param batch a map where each key is the hex-encoded access control key to another map that associates the encoded id of an
+     * Exchange Data entity to the fingerprint of the key used to encrypt it.
+     */
+    createExchangeDataMaps(batch) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const entriesToCreate = {};
+            for (const [k, v] of Object.entries(batch)) {
+                if (!(yield this.exchangeDataMapCache.getIfCachedJob(k))) {
+                    entriesToCreate[k] = v;
+                }
+            }
+            yield this.api.createExchangeDataMapBatch(new ExchangeDataMapCreationBatch_1.ExchangeDataMapCreationBatch({ batch: entriesToCreate }));
+            yield Promise.all(Object.keys(entriesToCreate).map((entry) => __awaiter(this, void 0, void 0, function* () {
+                yield this.exchangeDataMapCache.get(entry, () => Promise.resolve({ item: null }));
+            })));
+        });
+    }
+    /**
+     * Retrieves an Exchange Data Map.
+     * @param accessControlKeyHash the hex-encoded hash of the Exchange Data Map to retrieve.
+     */
+    getExchangeDataMap(accessControlKeyHash) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const exchangeDataMap = yield this.api.getExchangeDataMapById(accessControlKeyHash);
+            yield this.exchangeDataMapCache.get(exchangeDataMap.id, () => Promise.resolve({ item: null }));
+            return exchangeDataMap;
+        });
+    }
+    /**
+     * Retrieves a batch of Exchange Data Maps.
+     * @param accessControlKeyHashes the hex-encoded hashes of the Exchange Data Maps to retrieve.
+     */
+    getExchangeDataMapBatch(accessControlKeyHashes) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const exchangeDataMaps = yield this.api.getExchangeDataMapByBatch(accessControlKeyHashes);
+            yield Promise.all(exchangeDataMaps.map((entry) => __awaiter(this, void 0, void 0, function* () {
+                yield this.exchangeDataMapCache.get(entry.id, () => Promise.resolve({ item: null }));
+            })));
+            return exchangeDataMaps;
+        });
+    }
+}
+exports.ExchangeDataMapManager = ExchangeDataMapManager;
+//# sourceMappingURL=ExchangeDataMapManager.js.map

package/icc-x-api/crypto/ExchangeDataMapManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExchangeDataMapManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ExchangeDataMapManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oFAA6E;AAE7E,mGAA+F;AAE/F;;;GAGG;AACH,MAAa,sBAAsB;IACjC,YAA6B,GAA0B;QAA1B,QAAG,GAAH,GAAG,CAAuB;QAE/C,yBAAoB,GAA0C,IAAI,oDAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAFvD,CAAC;IAI3D;;;;;OAKG;IACG,sBAAsB,CAAC,KAA+D;;YAC1F,MAAM,eAAe,GAA6D,EAAE,CAAA;YACpF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBAC1C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE;oBACxD,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;iBACvB;aACF;YACD,MAAM,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,2DAA4B,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;YACvG,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAO,KAAK,EAAE,EAAE;gBAC/C,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YACnF,CAAC,CAAA,CAAC,CACH,CAAA;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,kBAAkB,CAAC,oBAA4B;;YACnD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAA;YACnF,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9F,OAAO,eAAe,CAAA;QACxB,CAAC;KAAA;IAED;;;OAGG;IACG,uBAAuB,CAAC,sBAAgC;;YAC5D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAA;YACzF,MAAM,OAAO,CAAC,GAAG,CACf,gBAAgB,CAAC,GAAG,CAAC,CAAO,KAAK,EAAE,EAAE;gBACnC,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YACtF,CAAC,CAAA,CAAC,CACH,CAAA;YACD,OAAO,gBAAgB,CAAA;QACzB,CAAC;KAAA;CACF;AAjDD,wDAiDC","sourcesContent":["import { IccExchangeDataMapApi } from '../../icc-api/api/IccExchangeDataMapApi'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { ExchangeDataMap } from '../../icc-api/model/internal/ExchangeDataMap'\nimport { ExchangeDataMapCreationBatch } from '../../icc-api/model/ExchangeDataMapCreationBatch'\n\n/**\n * @internal this class is intended for internal use only and may be modified without notice\n * This class manages the Exchange Data Map entities, caching with an LRU cache on retrieval.\n */\nexport class ExchangeDataMapManager {\n  constructor(private readonly api: IccExchangeDataMapApi) {}\n\n  private exchangeDataMapCache: LruTemporisedAsyncCache<string, null> = new LruTemporisedAsyncCache(1000, () => -1)\n\n  /**\n   * This function creates a batch of Exchange Data Map, ignoring the one that already exist and are already present in the cache.\n   * The ones that are not are created and their ids are cached.\n   * @param batch a map where each key is the hex-encoded access control key to another map that associates the encoded id of an\n   * Exchange Data entity to the fingerprint of the key used to encrypt it.\n   */\n  async createExchangeDataMaps(batch: { [accessControlKey: string]: { [fp: string]: string } }): Promise<void> {\n    const entriesToCreate: { [accessControlKey: string]: { [fp: string]: string } } = {}\n    for (const [k, v] of Object.entries(batch)) {\n      if (!(await this.exchangeDataMapCache.getIfCachedJob(k))) {\n        entriesToCreate[k] = v\n      }\n    }\n    await this.api.createExchangeDataMapBatch(new ExchangeDataMapCreationBatch({ batch: entriesToCreate }))\n    await Promise.all(\n      Object.keys(entriesToCreate).map(async (entry) => {\n        await this.exchangeDataMapCache.get(entry, () => Promise.resolve({ item: null }))\n      })\n    )\n  }\n\n  /**\n   * Retrieves an Exchange Data Map.\n   * @param accessControlKeyHash the hex-encoded hash of the Exchange Data Map to retrieve.\n   */\n  async getExchangeDataMap(accessControlKeyHash: string): Promise<ExchangeDataMap> {\n    const exchangeDataMap = await this.api.getExchangeDataMapById(accessControlKeyHash)\n    await this.exchangeDataMapCache.get(exchangeDataMap.id, () => Promise.resolve({ item: null }))\n    return exchangeDataMap\n  }\n\n  /**\n   * Retrieves a batch of Exchange Data Maps.\n   * @param accessControlKeyHashes the hex-encoded hashes of the Exchange Data Maps to retrieve.\n   */\n  async getExchangeDataMapBatch(accessControlKeyHashes: string[]): Promise<ExchangeDataMap[]> {\n    const exchangeDataMaps = await this.api.getExchangeDataMapByBatch(accessControlKeyHashes)\n    await Promise.all(\n      exchangeDataMaps.map(async (entry) => {\n        await this.exchangeDataMapCache.get(entry.id, () => Promise.resolve({ item: null }))\n      })\n    )\n    return exchangeDataMaps\n  }\n}\n"]}

package/icc-x-api/crypto/ExchangeKeysManager.d.ts

@@ -1,9 +1,9 @@
-import { KeyManager } from './KeyManager';
+import { UserEncryptionKeysManager } from './UserEncryptionKeysManager';
 import { BaseExchangeKeysManager } from './BaseExchangeKeysManager';
 import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
 import { CryptoPrimitives } from './CryptoPrimitives';
 import { CryptoStrategies } from './CryptoStrategies';
-import { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub';
+import { IcureStorageFacade } from '../storage/IcureStorageFacade';
 /**
  * @internal This class is meant only for internal use and may be changed without notice.
  * More powerful version of {@link BaseExchangeKeysManager} with a simplified interface. Has the following functionalities:
@@ -19,22 +19,11 @@ export declare class ExchangeKeysManager {
     private readonly baseExchangeKeysManager;
     private readonly dataOwnerApi;
     private readonly useParentKeys;
+    private readonly icureStorage;
     private delegatorExchangeKeysCache;
     private delegatedExchangeKeysCache;
     get base(): BaseExchangeKeysManager;
-    constructor(delegatorKeysCacheSize: number, delegatedKeysCacheSize: number, delegatedKeysCacheLifetimeMsBase: number, delegatedKeysCacheLifetimeMsNoKeys: number, cryptoStrategies: CryptoStrategies, primitives: CryptoPrimitives, keyManager: KeyManager, baseExchangeKeysManager: BaseExchangeKeysManager, dataOwnerApi: IccDataOwnerXApi, useParentKeys: boolean);
-    /**
-     * Get exchange keys from the current data owner to the provided delegate which are safe for encryption according to the locally verified keys.
-     * If currently there is no exchange key towards the provided delegate which is safe for encryption a new one will be automatically created.
-     * @param delegateId a delegate
-     * @return an object with the following fields:
-     *  - keys: all available exchange keys which are safe for encryption.
-     *  - updatedDelegator (optional): if a new key creation job was started when the function was invoked the updated delegator, else undefined.
-     */
-    getOrCreateEncryptionExchangeKeysTo(delegateId: string): Promise<{
-        updatedDelegator?: CryptoActorStubWithType;
-        keys: CryptoKey[];
-    }>;
+    constructor(delegatorKeysCacheSize: number, delegatedKeysCacheSize: number, delegatedKeysCacheLifetimeMsBase: number, delegatedKeysCacheLifetimeMsNoKeys: number, cryptoStrategies: CryptoStrategies, primitives: CryptoPrimitives, keyManager: UserEncryptionKeysManager, baseExchangeKeysManager: BaseExchangeKeysManager, dataOwnerApi: IccDataOwnerXApi, useParentKeys: boolean, icureStorage: IcureStorageFacade);
     /**
      * Get all keys currently available for a delegator-delegate pair. At least one of the two data owners must be part of the hierarchy for the current
      * data owner.
@@ -52,5 +41,4 @@ export declare class ExchangeKeysManager {
     private forceGetExchangeKeysFor;
     private getSelfExchangeKeysTo;
     private forceGetSelfExchangeKeysTo;
-    private forceCreateVerifiedExchangeKeyTo;
 }

package/icc-x-api/crypto/ExchangeKeysManager.js

@@ -11,7 +11,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExchangeKeysManager = void 0;
 const lru_temporised_async_cache_1 = require("../utils/lru-temporised-async-cache");
-const utils_1 = require("./utils");
 /**
  * @internal This class is meant only for internal use and may be changed without notice.
  * More powerful version of {@link BaseExchangeKeysManager} with a simplified interface. Has the following functionalities:
@@ -24,53 +23,17 @@ class ExchangeKeysManager {
     get base() {
         return this.baseExchangeKeysManager;
     }
-    constructor(delegatorKeysCacheSize, delegatedKeysCacheSize, delegatedKeysCacheLifetimeMsBase, delegatedKeysCacheLifetimeMsNoKeys, cryptoStrategies, primitives, keyManager, baseExchangeKeysManager, dataOwnerApi, useParentKeys) {
+    constructor(delegatorKeysCacheSize, delegatedKeysCacheSize, delegatedKeysCacheLifetimeMsBase, delegatedKeysCacheLifetimeMsNoKeys, cryptoStrategies, primitives, keyManager, baseExchangeKeysManager, dataOwnerApi, useParentKeys, icureStorage) {
         this.cryptoStrategies = cryptoStrategies;
         this.primitives = primitives;
         this.keyManager = keyManager;
         this.baseExchangeKeysManager = baseExchangeKeysManager;
         this.dataOwnerApi = dataOwnerApi;
         this.useParentKeys = useParentKeys;
+        this.icureStorage = icureStorage;
         this.delegatedExchangeKeysCache = new lru_temporised_async_cache_1.LruTemporisedAsyncCache(delegatedKeysCacheSize, (keys) => keys.length > 0 ? delegatedKeysCacheLifetimeMsBase : delegatedKeysCacheLifetimeMsNoKeys);
         this.delegatorExchangeKeysCache = new lru_temporised_async_cache_1.LruTemporisedAsyncCache(delegatorKeysCacheSize, () => -1);
     }
-    /**
-     * Get exchange keys from the current data owner to the provided delegate which are safe for encryption according to the locally verified keys.
-     * If currently there is no exchange key towards the provided delegate which is safe for encryption a new one will be automatically created.
-     * @param delegateId a delegate
-     * @return an object with the following fields:
-     *  - keys: all available exchange keys which are safe for encryption.
-     *  - updatedDelegator (optional): if a new key creation job was started when the function was invoked the updated delegator, else undefined.
-     */
-    getOrCreateEncryptionExchangeKeysTo(delegateId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const currentKeys = yield this.getSelfExchangeKeysTo(delegateId);
-            if (currentKeys.length > 0) {
-                return { keys: currentKeys };
-            }
-            else {
-                while (true) {
-                    let updatedDelegatorJob = undefined;
-                    const keysWithNew = yield this.delegatorExchangeKeysCache.get(delegateId, (previous) => __awaiter(this, void 0, void 0, function* () {
-                        const fullJob = this.forceCreateVerifiedExchangeKeyTo(delegateId);
-                        updatedDelegatorJob = fullJob.then(({ updatedDelegator }) => updatedDelegator);
-                        let existingKeys = previous ? previous : yield this.forceGetSelfExchangeKeysTo(delegateId);
-                        return fullJob.then(({ key }) => [...existingKeys, key]);
-                    }), (v) => !v.length);
-                    if (keysWithNew.length > 0) {
-                        const updatedDelegator = updatedDelegatorJob ? yield updatedDelegatorJob : undefined;
-                        return updatedDelegator ? { keys: keysWithNew, updatedDelegator } : { keys: keysWithNew };
-                    }
-                }
-                /*NOTE:
-                 * in case of two concurrent calls to `getOrCreateEncryptionExchangeKeysTo` only one of the calls will receive the updated delegator. This could
-                 * be a problem if one of the callers would want to update the delegator for other reasons as well, as the request would result in a database
-                 * conflict. This situation however should be very rare and will be fully resolved in the near future when delegations will be moved out of the
-                 * data owner objects and into a specific database.
-                 */
-            }
-        });
-    }
     /**
      * Get all keys currently available for a delegator-delegate pair. At least one of the two data owners must be part of the hierarchy for the current
      * data owner.
@@ -89,7 +52,7 @@ class ExchangeKeysManager {
                 const hierarchyIds = yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds();
                 if (!hierarchyIds.some((x) => x === delegateId || x === delegatorId))
                     throw new Error(`Trying to retrieve exchange key ${key} but current data owner hierarchy is ${hierarchyIds}`);
-                return yield this.delegatedExchangeKeysCache.get(key, () => this.forceGetExchangeKeysFor(delegatorId, delegateId));
+                return yield this.delegatedExchangeKeysCache.get(key, () => this.forceGetExchangeKeysFor(delegatorId, delegateId).then((x) => ({ item: x })));
             }
         });
     }
@@ -110,7 +73,7 @@ class ExchangeKeysManager {
     }
     getSelfExchangeKeysTo(delegateId) {
         return __awaiter(this, void 0, void 0, function* () {
-            return yield this.delegatorExchangeKeysCache.get(delegateId, () => this.forceGetSelfExchangeKeysTo(delegateId));
+            return yield this.delegatorExchangeKeysCache.get(delegateId, () => this.forceGetSelfExchangeKeysTo(delegateId).then((x) => ({ item: x })));
         });
     }
     forceGetSelfExchangeKeysTo(delegateId) {
@@ -121,27 +84,6 @@ class ExchangeKeysManager {
             return successfulDecryptions;
         });
     }
-    forceCreateVerifiedExchangeKeyTo(delegateId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const [mainKey, ...otherSelfKeys] = this.keyManager.getSelfVerifiedKeys();
-            let otherPublicKeys = Object.fromEntries(otherSelfKeys.map((x) => [x.fingerprint, x.pair.publicKey]));
-            if (delegateId !== (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
-                const delegate = yield this.dataOwnerApi.getCryptoActorStub(delegateId);
-                const delegatePublicKeys = Array.from(this.dataOwnerApi.getHexPublicKeysOf(delegate.stub));
-                let verifiedDelegatePublicKeys;
-                if (this.useParentKeys && (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()).includes(delegateId)) {
-                    verifiedDelegatePublicKeys = yield this.keyManager.getVerifiedPublicKeysFor(delegate.stub);
-                }
-                else {
-                    verifiedDelegatePublicKeys = yield this.cryptoStrategies.verifyDelegatePublicKeys(delegate, delegatePublicKeys, this.primitives);
-                }
-                if (!verifiedDelegatePublicKeys || verifiedDelegatePublicKeys.length == 0)
-                    throw new Error(`No verified public keys for delegate ${delegateId}: impossible to create new exchange key.`);
-                otherPublicKeys = Object.assign(Object.assign({}, otherPublicKeys), (yield (0, utils_1.loadPublicKeys)(this.primitives.RSA, verifiedDelegatePublicKeys)));
-            }
-            return yield this.baseExchangeKeysManager.createOrUpdateEncryptedExchangeKeyTo(delegateId, mainKey.pair, otherPublicKeys);
-        });
-    }
 }
 exports.ExchangeKeysManager = ExchangeKeysManager;
 //# sourceMappingURL=ExchangeKeysManager.js.map

package/icc-x-api/crypto/ExchangeKeysManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ExchangeKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ExchangeKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,oFAA6E;AAC7E,mCAAwC;AAKxC;;;;;;;GAOG;AACH,MAAa,mBAAmB;IAc9B,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,uBAAuB,CAAA;IACrC,CAAC;IAED,YACE,sBAA8B,EAC9B,sBAA8B,EAC9B,gCAAwC,EACxC,kCAA0C,EACzB,gBAAkC,EAClC,UAA4B,EAC5B,UAAsB,EACtB,uBAAgD,EAChD,YAA8B,EAC9B,aAAsB;QALtB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,eAAU,GAAV,UAAU,CAAkB;QAC5B,eAAU,GAAV,UAAU,CAAY;QACtB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,kBAAa,GAAb,aAAa,CAAS;QAEvC,IAAI,CAAC,0BAA0B,GAAG,IAAI,oDAAuB,CAAC,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC7F,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,kCAAkC,CACxF,CAAA;QACD,IAAI,CAAC,0BAA0B,GAAG,IAAI,oDAAuB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjG,CAAC;IAED;;;;;;;OAOG;IACG,mCAAmC,CAAC,UAAkB;;YAC1D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;YAChE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC1B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;aAC7B;iBAAM;gBACL,OAAO,IAAI,EAAE;oBACX,IAAI,mBAAmB,GAAiD,SAAS,CAAA;oBACjF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAC3D,UAAU,EACV,CAAO,QAAQ,EAAE,EAAE;wBACjB,MAAM,OAAO,GAAG,IAAI,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAA;wBACjE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAA;wBAC9E,IAAI,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAA;wBAC1F,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,CAAA;oBAC1D,CAAC,CAAA,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CACjB,CAAA;oBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC1B,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAA;wBACpF,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;qBAC1F;iBACF;gBACD;;;;;mBAKG;aACJ;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,4BAA4B,CAAC,WAAmB,EAAE,UAAkB;;YACxE,IAAI,WAAW,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC,EAAE;gBACrE,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;aACpD;iBAAM;gBACL,MAAM,GAAG,GAAG,GAAG,WAAW,KAAK,UAAU,EAAE,CAAA;gBAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;gBAC9E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,CAAC;oBAClE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,wCAAwC,YAAY,EAAE,CAAC,CAAA;gBAC/G,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAA;aACnH;QACH,CAAC;KAAA;IAED;;;OAGG;IACH,UAAU,CAAC,+BAAwC;QACjD,IAAI,+BAA+B;YAAE,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAA;QAC5E,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAA;IACzC,CAAC;IAEa,uBAAuB,CAAC,WAAmB,EAAE,UAAkB;;YAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;YACvG,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAA;QACxI,CAAC;KAAA;IAEa,qBAAqB,CAAC,UAAkB;;YACpD,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAA;QACjH,CAAC;KAAA;IAEa,0BAA0B,CAAC,UAAkB;;YACzD,6DAA6D;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,CAAC,CAAA;YAC3I,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAA;YACzI,OAAO,qBAAqB,CAAA;QAC9B,CAAC;KAAA;IAEa,gCAAgC,CAAC,UAAkB;;YAC/D,MAAM,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAA;YACzE,IAAI,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACrG,IAAI,UAAU,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC,EAAE;gBACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;gBACvE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;gBAC1F,IAAI,0BAAoC,CAAA;gBACxC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;oBAC1G,0BAA0B,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;iBAC3F;qBAAM;oBACL,0BAA0B,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;iBACjI;gBACD,IAAI,CAAC,0BAA0B,IAAI,0BAA0B,CAAC,MAAM,IAAI,CAAC;oBACvE,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,0CAA0C,CAAC,CAAA;gBAC/G,eAAe,mCACV,eAAe,GACf,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,CAC3E,CAAA;aACF;YACD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,oCAAoC,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;QAC3H,CAAC;KAAA;CACF;AA7ID,kDA6IC","sourcesContent":["import { KeyManager } from './KeyManager'\nimport { BaseExchangeKeysManager } from './BaseExchangeKeysManager'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { loadPublicKeys } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\n/**\n * @internal This class is meant only for internal use and may be changed without notice.\n * More powerful version of {@link BaseExchangeKeysManager} with a simplified interface. Has the following functionalities:\n * - Caches results\n * - Automatically creates new exchange keys if none is available\n * - Automatically choose the public keys to use during the creation of new exchange keys\n * - Automatically retrieves the private keys to use during decryption.\n */\nexport class ExchangeKeysManager {\n  /*\n   * Exchange keys cache where the current user is the delegator. The keys where the delegator is the current user should never change without\n   * an action from the delegator (unless he does this action from another device), so it should be safe to store them without expiration. However,\n   * the delegator may still have a lot of exchange keys (e.g. doctor -> all patients), so it is not safe to have a cache with unlimited size.\n   */\n  private delegatorExchangeKeysCache: LruTemporisedAsyncCache<string, CryptoKey[]>\n  /*\n   * Exchange keys cache where the current user is not the delegator. There may be many keys where the current user is the delegate,\n   * and they may change over time without any action from the current data owner, since the delegator is someone else. For this reason the cache must\n   * be limited in size and it should not use data that is too old, as it may be outdated.\n   */\n  private delegatedExchangeKeysCache: LruTemporisedAsyncCache<string, CryptoKey[]>\n\n  get base(): BaseExchangeKeysManager {\n    return this.baseExchangeKeysManager\n  }\n\n  constructor(\n    delegatorKeysCacheSize: number,\n    delegatedKeysCacheSize: number,\n    delegatedKeysCacheLifetimeMsBase: number,\n    delegatedKeysCacheLifetimeMsNoKeys: number,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly primitives: CryptoPrimitives,\n    private readonly keyManager: KeyManager,\n    private readonly baseExchangeKeysManager: BaseExchangeKeysManager,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly useParentKeys: boolean\n  ) {\n    this.delegatedExchangeKeysCache = new LruTemporisedAsyncCache(delegatedKeysCacheSize, (keys) =>\n      keys.length > 0 ? delegatedKeysCacheLifetimeMsBase : delegatedKeysCacheLifetimeMsNoKeys\n    )\n    this.delegatorExchangeKeysCache = new LruTemporisedAsyncCache(delegatorKeysCacheSize, () => -1)\n  }\n\n  /**\n   * Get exchange keys from the current data owner to the provided delegate which are safe for encryption according to the locally verified keys.\n   * If currently there is no exchange key towards the provided delegate which is safe for encryption a new one will be automatically created.\n   * @param delegateId a delegate\n   * @return an object with the following fields:\n   *  - keys: all available exchange keys which are safe for encryption.\n   *  - updatedDelegator (optional): if a new key creation job was started when the function was invoked the updated delegator, else undefined.\n   */\n  async getOrCreateEncryptionExchangeKeysTo(delegateId: string): Promise<{ updatedDelegator?: CryptoActorStubWithType; keys: CryptoKey[] }> {\n    const currentKeys = await this.getSelfExchangeKeysTo(delegateId)\n    if (currentKeys.length > 0) {\n      return { keys: currentKeys }\n    } else {\n      while (true) {\n        let updatedDelegatorJob: Promise<CryptoActorStubWithType> | undefined = undefined\n        const keysWithNew = await this.delegatorExchangeKeysCache.get(\n          delegateId,\n          async (previous) => {\n            const fullJob = this.forceCreateVerifiedExchangeKeyTo(delegateId)\n            updatedDelegatorJob = fullJob.then(({ updatedDelegator }) => updatedDelegator)\n            let existingKeys = previous ? previous : await this.forceGetSelfExchangeKeysTo(delegateId)\n            return fullJob.then(({ key }) => [...existingKeys, key])\n          },\n          (v) => !v.length\n        )\n        if (keysWithNew.length > 0) {\n          const updatedDelegator = updatedDelegatorJob ? await updatedDelegatorJob : undefined\n          return updatedDelegator ? { keys: keysWithNew, updatedDelegator } : { keys: keysWithNew }\n        }\n      }\n      /*NOTE:\n       * in case of two concurrent calls to `getOrCreateEncryptionExchangeKeysTo` only one of the calls will receive the updated delegator. This could\n       * be a problem if one of the callers would want to update the delegator for other reasons as well, as the request would result in a database\n       * conflict. This situation however should be very rare and will be fully resolved in the near future when delegations will be moved out of the\n       * data owner objects and into a specific database.\n       */\n    }\n  }\n\n  /**\n   * Get all keys currently available for a delegator-delegate pair. At least one of the two data owners must be part of the hierarchy for the current\n   * data owner.\n   * @param delegatorId id of a delegator\n   * @param delegateId id of a delegate\n   * @throws if neither the delegator nor the delegate is part of the hierarchy of the current data owner.\n   * @return all available exchange keys from the delegator-delegate pair.\n   */\n  async getDecryptionExchangeKeysFor(delegatorId: string, delegateId: string): Promise<CryptoKey[]> {\n    if (delegatorId === (await this.dataOwnerApi.getCurrentDataOwnerId())) {\n      return await this.getSelfExchangeKeysTo(delegateId)\n    } else {\n      const key = `${delegatorId}->${delegateId}`\n      const hierarchyIds = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n      if (!hierarchyIds.some((x) => x === delegateId || x === delegatorId))\n        throw new Error(`Trying to retrieve exchange key ${key} but current data owner hierarchy is ${hierarchyIds}`)\n      return await this.delegatedExchangeKeysCache.get(key, () => this.forceGetExchangeKeysFor(delegatorId, delegateId))\n    }\n  }\n\n  /**\n   * Empties the exchange keys cache.\n   * @param includeKeysFromCurrentDataOwner if true also clears the\n   */\n  clearCache(includeKeysFromCurrentDataOwner: boolean) {\n    if (includeKeysFromCurrentDataOwner) this.delegatorExchangeKeysCache.clear()\n    this.delegatedExchangeKeysCache.clear()\n  }\n\n  private async forceGetExchangeKeysFor(delegatorId: string, delegateId: string): Promise<CryptoKey[]> {\n    const encKeys = await this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(delegatorId, delegateId)\n    return (await this.baseExchangeKeysManager.tryDecryptExchangeKeys(encKeys, this.keyManager.getDecryptionKeys())).successfulDecryptions\n  }\n\n  private async getSelfExchangeKeysTo(delegateId: string): Promise<CryptoKey[]> {\n    return await this.delegatorExchangeKeysCache.get(delegateId, () => this.forceGetSelfExchangeKeysTo(delegateId))\n  }\n\n  private async forceGetSelfExchangeKeysTo(delegateId: string): Promise<CryptoKey[]> {\n    // Retrieve then try to decrypt with own and parent key pairs\n    const encKeys = await this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(await this.dataOwnerApi.getCurrentDataOwnerId(), delegateId)\n    const { successfulDecryptions } = await this.baseExchangeKeysManager.tryDecryptExchangeKeys(encKeys, this.keyManager.getDecryptionKeys())\n    return successfulDecryptions\n  }\n\n  private async forceCreateVerifiedExchangeKeyTo(delegateId: string): Promise<{ updatedDelegator: CryptoActorStubWithType; key: CryptoKey }> {\n    const [mainKey, ...otherSelfKeys] = this.keyManager.getSelfVerifiedKeys()\n    let otherPublicKeys = Object.fromEntries(otherSelfKeys.map((x) => [x.fingerprint, x.pair.publicKey]))\n    if (delegateId !== (await this.dataOwnerApi.getCurrentDataOwnerId())) {\n      const delegate = await this.dataOwnerApi.getCryptoActorStub(delegateId)\n      const delegatePublicKeys = Array.from(this.dataOwnerApi.getHexPublicKeysOf(delegate.stub))\n      let verifiedDelegatePublicKeys: string[]\n      if (this.useParentKeys && (await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()).includes(delegateId)) {\n        verifiedDelegatePublicKeys = await this.keyManager.getVerifiedPublicKeysFor(delegate.stub)\n      } else {\n        verifiedDelegatePublicKeys = await this.cryptoStrategies.verifyDelegatePublicKeys(delegate, delegatePublicKeys, this.primitives)\n      }\n      if (!verifiedDelegatePublicKeys || verifiedDelegatePublicKeys.length == 0)\n        throw new Error(`No verified public keys for delegate ${delegateId}: impossible to create new exchange key.`)\n      otherPublicKeys = {\n        ...otherPublicKeys,\n        ...(await loadPublicKeys(this.primitives.RSA, verifiedDelegatePublicKeys)),\n      }\n    }\n    return await this.baseExchangeKeysManager.createOrUpdateEncryptedExchangeKeyTo(delegateId, mainKey.pair, otherPublicKeys)\n  }\n}\n"]}
+{"version":3,"file":"ExchangeKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ExchangeKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,oFAA6E;AAQ7E;;;;;;;GAOG;AACH,MAAa,mBAAmB;IAc9B,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,uBAAuB,CAAA;IACrC,CAAC;IAED,YACE,sBAA8B,EAC9B,sBAA8B,EAC9B,gCAAwC,EACxC,kCAA0C,EACzB,gBAAkC,EAClC,UAA4B,EAC5B,UAAqC,EACrC,uBAAgD,EAChD,YAA8B,EAC9B,aAAsB,EACtB,YAAgC;QANhC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,eAAU,GAAV,UAAU,CAAkB;QAC5B,eAAU,GAAV,UAAU,CAA2B;QACrC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,kBAAa,GAAb,aAAa,CAAS;QACtB,iBAAY,GAAZ,YAAY,CAAoB;QAEjD,IAAI,CAAC,0BAA0B,GAAG,IAAI,oDAAuB,CAAC,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC7F,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,kCAAkC,CACxF,CAAA;QACD,IAAI,CAAC,0BAA0B,GAAG,IAAI,oDAAuB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjG,CAAC;IAED;;;;;;;OAOG;IACG,4BAA4B,CAAC,WAAmB,EAAE,UAAkB;;YACxE,IAAI,WAAW,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC,EAAE;gBACrE,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;aACpD;iBAAM;gBACL,MAAM,GAAG,GAAG,GAAG,WAAW,KAAK,UAAU,EAAE,CAAA;gBAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;gBAC9E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,CAAC;oBAClE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,wCAAwC,YAAY,EAAE,CAAC,CAAA;gBAC/G,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;aAC9I;QACH,CAAC;KAAA;IAED;;;OAGG;IACH,UAAU,CAAC,+BAAwC;QACjD,IAAI,+BAA+B;YAAE,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAA;QAC5E,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAA;IACzC,CAAC;IAEa,uBAAuB,CAAC,WAAmB,EAAE,UAAkB;;YAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;YACvG,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAA;QACxI,CAAC;KAAA;IAEa,qBAAqB,CAAC,UAAkB;;YACpD,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5I,CAAC;KAAA;IAEa,0BAA0B,CAAC,UAAkB;;YACzD,6DAA6D;YAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,CAAC,CAAA;YAC3I,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAA;YACzI,OAAO,qBAAqB,CAAA;QAC9B,CAAC;KAAA;CACF;AAjFD,kDAiFC","sourcesContent":["import { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { BaseExchangeKeysManager } from './BaseExchangeKeysManager'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { getShaVersionForKey, loadPublicKeys } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\nimport { DataOwnerWithType } from '../../icc-api/model/DataOwnerWithType'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\n/**\n * @internal This class is meant only for internal use and may be changed without notice.\n * More powerful version of {@link BaseExchangeKeysManager} with a simplified interface. Has the following functionalities:\n * - Caches results\n * - Automatically creates new exchange keys if none is available\n * - Automatically choose the public keys to use during the creation of new exchange keys\n * - Automatically retrieves the private keys to use during decryption.\n */\nexport class ExchangeKeysManager {\n  /*\n   * Exchange keys cache where the current user is the delegator. The keys where the delegator is the current user should never change without\n   * an action from the delegator (unless he does this action from another device), so it should be safe to store them without expiration. However,\n   * the delegator may still have a lot of exchange keys (e.g. doctor -> all patients), so it is not safe to have a cache with unlimited size.\n   */\n  private delegatorExchangeKeysCache: LruTemporisedAsyncCache<string, CryptoKey[]>\n  /*\n   * Exchange keys cache where the current user is not the delegator. There may be many keys where the current user is the delegate,\n   * and they may change over time without any action from the current data owner, since the delegator is someone else. For this reason the cache must\n   * be limited in size and it should not use data that is too old, as it may be outdated.\n   */\n  private delegatedExchangeKeysCache: LruTemporisedAsyncCache<string, CryptoKey[]>\n\n  get base(): BaseExchangeKeysManager {\n    return this.baseExchangeKeysManager\n  }\n\n  constructor(\n    delegatorKeysCacheSize: number,\n    delegatedKeysCacheSize: number,\n    delegatedKeysCacheLifetimeMsBase: number,\n    delegatedKeysCacheLifetimeMsNoKeys: number,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly primitives: CryptoPrimitives,\n    private readonly keyManager: UserEncryptionKeysManager,\n    private readonly baseExchangeKeysManager: BaseExchangeKeysManager,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly useParentKeys: boolean,\n    private readonly icureStorage: IcureStorageFacade\n  ) {\n    this.delegatedExchangeKeysCache = new LruTemporisedAsyncCache(delegatedKeysCacheSize, (keys) =>\n      keys.length > 0 ? delegatedKeysCacheLifetimeMsBase : delegatedKeysCacheLifetimeMsNoKeys\n    )\n    this.delegatorExchangeKeysCache = new LruTemporisedAsyncCache(delegatorKeysCacheSize, () => -1)\n  }\n\n  /**\n   * Get all keys currently available for a delegator-delegate pair. At least one of the two data owners must be part of the hierarchy for the current\n   * data owner.\n   * @param delegatorId id of a delegator\n   * @param delegateId id of a delegate\n   * @throws if neither the delegator nor the delegate is part of the hierarchy of the current data owner.\n   * @return all available exchange keys from the delegator-delegate pair.\n   */\n  async getDecryptionExchangeKeysFor(delegatorId: string, delegateId: string): Promise<CryptoKey[]> {\n    if (delegatorId === (await this.dataOwnerApi.getCurrentDataOwnerId())) {\n      return await this.getSelfExchangeKeysTo(delegateId)\n    } else {\n      const key = `${delegatorId}->${delegateId}`\n      const hierarchyIds = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n      if (!hierarchyIds.some((x) => x === delegateId || x === delegatorId))\n        throw new Error(`Trying to retrieve exchange key ${key} but current data owner hierarchy is ${hierarchyIds}`)\n      return await this.delegatedExchangeKeysCache.get(key, () => this.forceGetExchangeKeysFor(delegatorId, delegateId).then((x) => ({ item: x })))\n    }\n  }\n\n  /**\n   * Empties the exchange keys cache.\n   * @param includeKeysFromCurrentDataOwner if true also clears the\n   */\n  clearCache(includeKeysFromCurrentDataOwner: boolean) {\n    if (includeKeysFromCurrentDataOwner) this.delegatorExchangeKeysCache.clear()\n    this.delegatedExchangeKeysCache.clear()\n  }\n\n  private async forceGetExchangeKeysFor(delegatorId: string, delegateId: string): Promise<CryptoKey[]> {\n    const encKeys = await this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(delegatorId, delegateId)\n    return (await this.baseExchangeKeysManager.tryDecryptExchangeKeys(encKeys, this.keyManager.getDecryptionKeys())).successfulDecryptions\n  }\n\n  private async getSelfExchangeKeysTo(delegateId: string): Promise<CryptoKey[]> {\n    return await this.delegatorExchangeKeysCache.get(delegateId, () => this.forceGetSelfExchangeKeysTo(delegateId).then((x) => ({ item: x })))\n  }\n\n  private async forceGetSelfExchangeKeysTo(delegateId: string): Promise<CryptoKey[]> {\n    // Retrieve then try to decrypt with own and parent key pairs\n    const encKeys = await this.baseExchangeKeysManager.getEncryptedExchangeKeysFor(await this.dataOwnerApi.getCurrentDataOwnerId(), delegateId)\n    const { successfulDecryptions } = await this.baseExchangeKeysManager.tryDecryptExchangeKeys(encKeys, this.keyManager.getDecryptionKeys())\n    return successfulDecryptions\n  }\n}\n"]}