@icure/api 7.1.16 → 8.0.0-RC.2

package/icc-x-api/crypto/LegacyDelegationSecurityMetadataDecryptor.js

@@ -0,0 +1,141 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function verb(n) { if (g[n]) i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyDelegationSecurityMetadataDecryptor = void 0;
+const ModelHelper_1 = require("../../icc-api/model/ModelHelper");
+const utils_1 = require("../utils");
+const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
+var AccessLevel = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
+class LegacyDelegationSecurityMetadataDecryptor {
+    constructor(exchangeKeysManager, primitives) {
+        this.exchangeKeysManager = exchangeKeysManager;
+        this.primitives = primitives;
+    }
+    decryptEncryptionKeysOf(typedEntity, dataOwnersHierarchySubset) {
+        function generator(self) {
+            var _a;
+            return __asyncGenerator(this, arguments, function* generator_1() {
+                const decryptedGenerator = self.extractFromDelegations(dataOwnersHierarchySubset, (_a = typedEntity.entity.encryptionKeys) !== null && _a !== void 0 ? _a : {}, (d) => self.validateEncryptionKey(d));
+                let next = yield __await(decryptedGenerator.next());
+                while (!next.done) {
+                    yield yield __await({ decrypted: next.value.decrypted.replace(/-/g, ''), dataOwnersWithAccess: next.value.dataOwnersWithAccess });
+                    next = yield __await(decryptedGenerator.next());
+                }
+            });
+        }
+        return generator(this);
+    }
+    decryptOwningEntityIdsOf(typedEntity, dataOwnersHierarchySubset) {
+        var _a;
+        return this.extractFromDelegations(dataOwnersHierarchySubset, (_a = typedEntity.entity.cryptedForeignKeys) !== null && _a !== void 0 ? _a : {}, (d) => Promise.resolve(this.validateOwningEntityId(d)));
+    }
+    decryptSecretIdsOf(typedEntity, dataOwnersHierarchySubset) {
+        var _a;
+        return this.extractFromDelegations(dataOwnersHierarchySubset, (_a = typedEntity.entity.delegations) !== null && _a !== void 0 ? _a : {}, (d) => Promise.resolve(this.validateSecretId(d)));
+    }
+    getEntityAccessLevel(typedEntity, dataOwnersHierarchySubset) {
+        var _a;
+        const delegatesSet = new Set(Object.keys((_a = typedEntity.entity.delegations) !== null && _a !== void 0 ? _a : {}));
+        return dataOwnersHierarchySubset.some((dataOwner) => delegatesSet.has(dataOwner))
+            ? Promise.resolve(AccessLevel.WRITE)
+            : Promise.resolve(undefined);
+    }
+    hasAnyEncryptionKeys(entity) {
+        var _a;
+        return Object.values((_a = entity.encryptionKeys) !== null && _a !== void 0 ? _a : {}).some((delegations) => delegations.length > 0);
+    }
+    extractFromDelegations(dataOwnersHierarchySubset, delegations, validateDecrypted) {
+        if (!dataOwnersHierarchySubset.length)
+            throw new Error("`dataOwnersHierarchySubset` can't be empty");
+        const delegationsWithOwner = Object.entries(delegations).flatMap(([delegateId, delegations]) => dataOwnersHierarchySubset.some((dataOwnerId) => dataOwnerId === delegateId)
+            ? this.populateDelegatedTo(delegateId, delegations)
+            : this.populateDelegatedTo(delegateId, delegations.filter((d) => dataOwnersHierarchySubset.some((dataOwnerId) => d.owner === dataOwnerId))));
+        const self = this;
+        function generator() {
+            return __asyncGenerator(this, arguments, function* generator_2() {
+                for (const delegation of delegationsWithOwner) {
+                    const decrypted = yield __await(self.tryDecryptDelegation(delegation, (k) => validateDecrypted(k)));
+                    if (decrypted)
+                        yield yield __await({
+                            decrypted,
+                            dataOwnersWithAccess: delegation.owner ? [delegation.owner, delegation.delegatedTo] : [delegation.delegatedTo],
+                        });
+                }
+            });
+        }
+        return generator();
+    }
+    populateDelegatedTo(delegateId, delegations) {
+        return delegations.map((d) => (d.delegatedTo === delegateId ? d : Object.assign(Object.assign({}, d), { delegatedTo: delegateId })));
+    }
+    tryDecryptDelegation(delegation, validateDecrypted) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const exchangeKeys = yield this.exchangeKeysManager.getDecryptionExchangeKeysFor(delegation.owner, delegation.delegatedTo);
+            for (const key of exchangeKeys) {
+                try {
+                    // Format of encrypted key for any delegation should be entityId:key, but with the merging of entities the entityId might not match the
+                    // current id. As a checksum we are only verifying that the decrypted bytes can be represented as a string with exactly one ':'.
+                    // Additionally, we also have a validator that is specific for each type of delegation content (encryption key, secret id, ...)
+                    const decrypted = (0, ModelHelper_1.ua2string)(yield this.primitives.AES.decrypt(key, (0, utils_1.hex2ua)(delegation.key)));
+                    const decryptedSplit = decrypted.split(':');
+                    if (decryptedSplit.length === 2) {
+                        if (yield validateDecrypted(decryptedSplit[1]))
+                            return decryptedSplit[1];
+                    }
+                    else {
+                        console.warn("Error in the decrypted delegation: content should contain exactly 1 ':', the delegation is ignored.");
+                    }
+                }
+                catch (e) {
+                    // Do nothing: the delegation uses another exchange key owner->delegator
+                }
+            }
+        });
+    }
+    validateEncryptionKey(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return !!(yield this.tryImportKey(key));
+        });
+    }
+    validateSecretId(key) {
+        return !!key;
+    }
+    validateOwningEntityId(key) {
+        return !!key;
+    }
+    tryImportKey(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[0-9A-Fa-f\-]+$/g.test(key))
+                return undefined;
+            try {
+                return yield this.primitives.AES.importKey('raw', (0, utils_1.hex2ua)(key.replace(/-/g, '')));
+            }
+            catch (e) {
+                console.warn(`Could not import key ${key} as an encryption key.`, e);
+                return undefined;
+            }
+        });
+    }
+}
+exports.LegacyDelegationSecurityMetadataDecryptor = LegacyDelegationSecurityMetadataDecryptor;
+//# sourceMappingURL=LegacyDelegationSecurityMetadataDecryptor.js.map

package/icc-x-api/crypto/LegacyDelegationSecurityMetadataDecryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LegacyDelegationSecurityMetadataDecryptor.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/LegacyDelegationSecurityMetadataDecryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAGA,iEAA2D;AAC3D,oCAAiC;AAGjC,2EAAuE;AACvE,IAAO,WAAW,GAAG,mCAAgB,CAAC,eAAe,CAAA;AAGrD,MAAa,yCAAyC;IACpD,YAA6B,mBAAwC,EAAmB,UAA4B;QAAvF,wBAAmB,GAAnB,mBAAmB,CAAqB;QAAmB,eAAU,GAAV,UAAU,CAAkB;IAAG,CAAC;IAExH,uBAAuB,CACrB,WAAoC,EACpC,yBAAmC;QAEnC,SAAgB,SAAS,CACvB,IAA+C;;;gBAE/C,MAAM,kBAAkB,GAAG,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,EAAE,MAAA,WAAW,CAAC,MAAM,CAAC,cAAc,mCAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAC/H,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAC9B,CAAA;gBACD,IAAI,IAAI,GAAG,cAAM,kBAAkB,CAAC,IAAI,EAAE,CAAA,CAAA;gBAC1C,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBACjB,oBAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAA,CAAA;oBAClH,IAAI,GAAG,cAAM,kBAAkB,CAAC,IAAI,EAAE,CAAA,CAAA;iBACvC;;SACF;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAED,wBAAwB,CACtB,WAAoC,EACpC,yBAAmC;;QAEnC,OAAO,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,EAAE,MAAA,WAAW,CAAC,MAAM,CAAC,kBAAkB,mCAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAC/G,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAChD,CAAA;IACH,CAAC;IAED,kBAAkB,CAChB,WAAoC,EACpC,yBAAmC;;QAEnC,OAAO,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,EAAE,MAAA,WAAW,CAAC,MAAM,CAAC,WAAW,mCAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CACxG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAA;IACH,CAAC;IAED,oBAAoB,CAAC,WAAoC,EAAE,yBAAmC;;QAC5F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,WAAW,CAAC,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,CAAA;QAC/E,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/E,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChC,CAAC;IAED,oBAAoB,CAAC,MAA6C;;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACjG,CAAC;IAEO,sBAAsB,CAC5B,yBAAmC,EACnC,WAAmD,EACnD,iBAAuD;QAEvD,IAAI,CAAC,yBAAyB,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QACpG,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,CAC7F,yBAAyB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,UAAU,CAAC;YACzE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC;YACnD,CAAC,CAAC,IAAI,CAAC,mBAAmB,CACtB,UAAU,EACV,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CACpG,CACN,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,CAAA;QACjB,SAAgB,SAAS;;gBACvB,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE;oBAC7C,MAAM,SAAS,GAAG,cAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA,CAAA;oBAC1F,IAAI,SAAS;wBACX,oBAAM;4BACJ,SAAS;4BACT,oBAAoB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAY,CAAC;yBACjH,CAAA,CAAA;iBACJ;YACH,CAAC;SAAA;QACD,OAAO,SAAS,EAAE,CAAA;IACpB,CAAC;IAEO,mBAAmB,CAAC,UAAkB,EAAE,WAAyB;QACvE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAM,CAAC,KAAE,WAAW,EAAE,UAAU,GAAE,CAAC,CAAC,CAAA;IACvG,CAAC;IAEa,oBAAoB,CAAC,UAAsB,EAAE,iBAAuD;;YAChH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,UAAU,CAAC,KAAM,EAAE,UAAU,CAAC,WAAY,CAAC,CAAA;YAC5H,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE;gBAC9B,IAAI;oBACF,uIAAuI;oBACvI,gIAAgI;oBAChI,+HAA+H;oBAC/H,MAAM,SAAS,GAAG,IAAA,uBAAS,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,cAAM,EAAC,UAAU,CAAC,GAAI,CAAC,CAAC,CAAC,CAAA;oBAC5F,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC3C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/B,IAAI,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;4BAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAA;qBACzE;yBAAM;wBACL,OAAO,CAAC,IAAI,CAAC,qGAAqG,CAAC,CAAA;qBACpH;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,wEAAwE;iBACzE;aACF;QACH,CAAC;KAAA;IAEa,qBAAqB,CAAC,GAAW;;YAC7C,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QACzC,CAAC;KAAA;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,CAAC,CAAC,GAAG,CAAA;IACd,CAAC;IAEO,sBAAsB,CAAC,GAAW;QACxC,OAAO,CAAC,CAAC,GAAG,CAAA;IACd,CAAC;IAEa,YAAY,CAAC,GAAW;;YACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YACpD,IAAI;gBACF,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;aACjF;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,CAAC,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,EAAE,CAAC,CAAC,CAAA;gBACpE,OAAO,SAAS,CAAA;aACjB;QACH,CAAC;KAAA;CACF;AA5HD,8FA4HC","sourcesContent":["import { SecurityMetadataDecryptor } from './SecurityMetadataDecryptor'\nimport { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName'\nimport { Delegation } from '../../icc-api/model/Delegation'\nimport { ua2string } from '../../icc-api/model/ModelHelper'\nimport { hex2ua } from '../utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { ExchangeKeysManager } from './ExchangeKeysManager'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevel = SecureDelegation.AccessLevelEnum\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\n\nexport class LegacyDelegationSecurityMetadataDecryptor implements SecurityMetadataDecryptor {\n  constructor(private readonly exchangeKeysManager: ExchangeKeysManager, private readonly primitives: CryptoPrimitives) {}\n\n  decryptEncryptionKeysOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    async function* generator(\n      self: LegacyDelegationSecurityMetadataDecryptor\n    ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n      const decryptedGenerator = self.extractFromDelegations(dataOwnersHierarchySubset, typedEntity.entity.encryptionKeys ?? {}, (d) =>\n        self.validateEncryptionKey(d)\n      )\n      let next = await decryptedGenerator.next()\n      while (!next.done) {\n        yield { decrypted: next.value.decrypted.replace(/-/g, ''), dataOwnersWithAccess: next.value.dataOwnersWithAccess }\n        next = await decryptedGenerator.next()\n      }\n    }\n    return generator(this)\n  }\n\n  decryptOwningEntityIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.extractFromDelegations(dataOwnersHierarchySubset, typedEntity.entity.cryptedForeignKeys ?? {}, (d) =>\n      Promise.resolve(this.validateOwningEntityId(d))\n    )\n  }\n\n  decryptSecretIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.extractFromDelegations(dataOwnersHierarchySubset, typedEntity.entity.delegations ?? {}, (d) =>\n      Promise.resolve(this.validateSecretId(d))\n    )\n  }\n\n  getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevel | undefined> {\n    const delegatesSet = new Set(Object.keys(typedEntity.entity.delegations ?? {}))\n    return dataOwnersHierarchySubset.some((dataOwner) => delegatesSet.has(dataOwner))\n      ? Promise.resolve(AccessLevel.WRITE)\n      : Promise.resolve(undefined)\n  }\n\n  hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean {\n    return Object.values(entity.encryptionKeys ?? {}).some((delegations) => delegations.length > 0)\n  }\n\n  private extractFromDelegations(\n    dataOwnersHierarchySubset: string[],\n    delegations: { [delegateId: string]: Delegation[] },\n    validateDecrypted: (result: string) => Promise<boolean>\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    const delegationsWithOwner = Object.entries(delegations).flatMap(([delegateId, delegations]) =>\n      dataOwnersHierarchySubset.some((dataOwnerId) => dataOwnerId === delegateId)\n        ? this.populateDelegatedTo(delegateId, delegations)\n        : this.populateDelegatedTo(\n            delegateId,\n            delegations.filter((d) => dataOwnersHierarchySubset.some((dataOwnerId) => d.owner === dataOwnerId))\n          )\n    )\n    const self = this\n    async function* generator() {\n      for (const delegation of delegationsWithOwner) {\n        const decrypted = await self.tryDecryptDelegation(delegation, (k) => validateDecrypted(k))\n        if (decrypted)\n          yield {\n            decrypted,\n            dataOwnersWithAccess: delegation.owner ? [delegation.owner, delegation.delegatedTo!] : [delegation.delegatedTo!],\n          }\n      }\n    }\n    return generator()\n  }\n\n  private populateDelegatedTo(delegateId: string, delegations: Delegation[]): Delegation[] {\n    return delegations.map((d) => (d.delegatedTo === delegateId ? d : { ...d, delegatedTo: delegateId }))\n  }\n\n  private async tryDecryptDelegation(delegation: Delegation, validateDecrypted: (result: string) => Promise<boolean>): Promise<string | undefined> {\n    const exchangeKeys = await this.exchangeKeysManager.getDecryptionExchangeKeysFor(delegation.owner!, delegation.delegatedTo!)\n    for (const key of exchangeKeys) {\n      try {\n        // Format of encrypted key for any delegation should be entityId:key, but with the merging of entities the entityId might not match the\n        // current id. As a checksum we are only verifying that the decrypted bytes can be represented as a string with exactly one ':'.\n        // Additionally, we also have a validator that is specific for each type of delegation content (encryption key, secret id, ...)\n        const decrypted = ua2string(await this.primitives.AES.decrypt(key, hex2ua(delegation.key!)))\n        const decryptedSplit = decrypted.split(':')\n        if (decryptedSplit.length === 2) {\n          if (await validateDecrypted(decryptedSplit[1])) return decryptedSplit[1]\n        } else {\n          console.warn(\"Error in the decrypted delegation: content should contain exactly 1 ':', the delegation is ignored.\")\n        }\n      } catch (e) {\n        // Do nothing: the delegation uses another exchange key owner->delegator\n      }\n    }\n  }\n\n  private async validateEncryptionKey(key: string): Promise<boolean> {\n    return !!(await this.tryImportKey(key))\n  }\n\n  private validateSecretId(key: string): boolean {\n    return !!key\n  }\n\n  private validateOwningEntityId(key: string): boolean {\n    return !!key\n  }\n\n  private async tryImportKey(key: string): Promise<CryptoKey | undefined> {\n    if (!/^[0-9A-Fa-f\\-]+$/g.test(key)) return undefined\n    try {\n      return await this.primitives.AES.importKey('raw', hex2ua(key.replace(/-/g, '')))\n    } catch (e) {\n      console.warn(`Could not import key ${key} as an encryption key.`, e)\n      return undefined\n    }\n  }\n}\n"]}

package/icc-x-api/crypto/RSA.d.ts

@@ -5,19 +5,24 @@ export type KeyPair<T> = {
     publicKey: T;
     privateKey: T;
 };
+export type ShaVersion = 'sha-1' | 'sha-256';
 export declare class RSAUtils {
     /********* RSA Config **********/
     rsaParams: any;
     rsaHashedParams: any;
+    rsaWithSha256HashedParams: any;
+    private readonly signatureKeysGenerationParams;
     private crypto;
     constructor(crypto?: Crypto);
     /**
-     * It returns CryptoKey promise, which doesn't hold the bytes of the key.
-     * If bytes are needed, you must export the generated key.
-     *
-     * @returns {Promise} will be {publicKey: CryptoKey, privateKey: CryptoKey}
+     * Generates a key pair for encryption/decryption of data.
+     * @param shaVersion the version of the SHA algorithm to use.
+     */
+    generateKeyPair(shaVersion: ShaVersion): Promise<KeyPair<CryptoKey>>;
+    /**
+     * Generates a key pair for signing data and signature verification.
      */
-    generateKeyPair(): Promise<KeyPair<CryptoKey>>;
+    generateSignatureKeyPair(): Promise<KeyPair<CryptoKey>>;
     /**
      *
      * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)
@@ -62,25 +67,31 @@ export declare class RSAUtils {
      * @param format 'jwk', 'spki', or 'pkcs8'
      * @param keydata should be the key data based on the format.
      * @param keyUsages Array of usages. For example, ['encrypt'] for public key.
+     * @param hashAlgorithm 'sha-1' or 'sha-256'
      * @returns {*}
      */
-    importKey(format: string, keydata: JsonWebKey | ArrayBuffer, keyUsages: KeyUsage[]): Promise<CryptoKey>;
+    importKey(format: string, keydata: JsonWebKey | ArrayBuffer, keyUsages: KeyUsage[], hashAlgorithm: ShaVersion): Promise<CryptoKey>;
+    importSignatureKey(format: 'jwk' | 'pkcs8', keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey>;
+    importVerificationKey(format: 'jwk' | 'spki', keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey>;
+    private paramsForCreationOrImport;
     /**
      *
      * @param format 'jwk' or 'pkcs8'
      * @param keydata should be the key data based on the format.
+     * @param hashAlgorithm 'sha-1' or 'sha-256'
      * @returns {*}
      */
-    importPrivateKey(format: string, keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey>;
+    importPrivateKey(format: string, keydata: JsonWebKey | ArrayBuffer, hashAlgorithm: ShaVersion): Promise<CryptoKey>;
     /**
      *
      * @param privateKeyFormat 'jwk' or 'pkcs8'
      * @param privateKeydata    should be the key data based on the format.
      * @param publicKeyFormat 'jwk' or 'spki'
      * @param publicKeyData should be the key data based on the format.
+     * @param hashAlgorithm 'sha-1' or 'sha-256'
      * @returns {Promise|*}
      */
-    importKeyPair(privateKeyFormat: string, privateKeydata: JsonWebKey | ArrayBuffer, publicKeyFormat: string, publicKeyData: JsonWebKey | ArrayBuffer): Promise<KeyPair<CryptoKey>>;
+    importKeyPair(privateKeyFormat: string, privateKeydata: JsonWebKey | ArrayBuffer, publicKeyFormat: string, publicKeyData: JsonWebKey | ArrayBuffer, hashAlgorithm: ShaVersion): Promise<KeyPair<CryptoKey>>;
     /**
      * Tries to encrypt then decrypt data using a keypair. If both operations succeed without throwing an error and the decrypted data matches the
      * original data returns true, else false.
@@ -88,5 +99,20 @@ export declare class RSAUtils {
      * @return if the key pair could be successfully used to encrypt then decrypt data.
      */
     checkKeyPairValidity(keyPair: KeyPair<CryptoKey>): Promise<boolean>;
+    /**
+     * Generates a signature for some data. The signature algorithm used is RSA-PSS with SHA-256.
+     * @param privateKey private key to use for signature
+     * @param data the data to sign
+     * @return the signature.
+     */
+    sign(privateKey: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer>;
+    /**
+     * Verifies if a signature matches the data. The signature algorithm used is RSA-PSS with sha-256.
+     * @param publicKey public key to use for signature verification.
+     * @param signature the signature to verify
+     * @param data the data that was signed
+     * @return if the signature matches the data and key.
+     */
+    verifySignature(publicKey: CryptoKey, signature: ArrayBuffer, data: ArrayBuffer): Promise<boolean>;
 }
 export declare const RSA: RSAUtils;

package/icc-x-api/crypto/RSA.js

@@ -24,19 +24,38 @@ class RSAUtils {
             publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
             hash: { name: 'sha-1' },
         };
+        this.rsaWithSha256HashedParams = {
+            name: 'RSA-OAEP',
+            modulusLength: 2048,
+            publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+            hash: { name: 'SHA-256' },
+        };
+        this.signatureKeysGenerationParams = {
+            name: 'RSA-PSS',
+            modulusLength: 2048,
+            publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+            hash: { name: 'SHA-256' },
+        };
         this.crypto = crypto;
     }
     /**
-     * It returns CryptoKey promise, which doesn't hold the bytes of the key.
-     * If bytes are needed, you must export the generated key.
-     *
-     * @returns {Promise} will be {publicKey: CryptoKey, privateKey: CryptoKey}
+     * Generates a key pair for encryption/decryption of data.
+     * @param shaVersion the version of the SHA algorithm to use.
      */
-    generateKeyPair() {
+    generateKeyPair(shaVersion) {
         const extractable = true;
         const keyUsages = ['decrypt', 'encrypt'];
+        const rsaParams = this.paramsForCreationOrImport(shaVersion);
         return new Promise((resolve, reject) => {
-            this.crypto.subtle.generateKey(this.rsaHashedParams, extractable, keyUsages).then(resolve, reject);
+            this.crypto.subtle.generateKey(rsaParams, extractable, keyUsages).then(resolve, reject);
+        });
+    }
+    /**
+     * Generates a key pair for signing data and signature verification.
+     */
+    generateSignatureKeyPair() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.crypto.subtle.generateKey(this.signatureKeysGenerationParams, true, ['sign', 'verify']);
         });
     }
     exportKeys(keyPair, privKeyFormat, pubKeyFormat) {
@@ -79,24 +98,47 @@ class RSAUtils {
      * @param format 'jwk', 'spki', or 'pkcs8'
      * @param keydata should be the key data based on the format.
      * @param keyUsages Array of usages. For example, ['encrypt'] for public key.
+     * @param hashAlgorithm 'sha-1' or 'sha-256'
      * @returns {*}
      */
-    importKey(format, keydata, keyUsages) {
+    importKey(format, keydata, keyUsages, hashAlgorithm) {
         const extractable = true;
         return new Promise((resolve, reject) => {
-            this.crypto.subtle.importKey(format, keydata, this.rsaHashedParams, extractable, keyUsages).then(resolve, reject);
+            const rsaParams = this.paramsForCreationOrImport(hashAlgorithm);
+            this.crypto.subtle.importKey(format, keydata, rsaParams, extractable, keyUsages).then(resolve, reject);
         });
     }
+    importSignatureKey(format, keydata) {
+        const extractable = true;
+        return this.crypto.subtle.importKey(format, keydata, this.signatureKeysGenerationParams, extractable, ['sign']);
+    }
+    importVerificationKey(format, keydata) {
+        const extractable = true;
+        return this.crypto.subtle.importKey(format, keydata, this.signatureKeysGenerationParams, extractable, ['verify']);
+    }
+    paramsForCreationOrImport(shaVersion) {
+        if (shaVersion === 'sha-1') {
+            return this.rsaHashedParams;
+        }
+        else if (shaVersion === 'sha-256') {
+            return this.rsaWithSha256HashedParams;
+        }
+        else {
+            throw new Error('Unexpected error, invalid SHA version');
+        }
+    }
     /**
      *
      * @param format 'jwk' or 'pkcs8'
      * @param keydata should be the key data based on the format.
+     * @param hashAlgorithm 'sha-1' or 'sha-256'
      * @returns {*}
      */
-    importPrivateKey(format, keydata) {
+    importPrivateKey(format, keydata, hashAlgorithm) {
         const extractable = true;
         return new Promise((resolve, reject) => {
-            this.crypto.subtle.importKey(format, keydata, this.rsaHashedParams, extractable, ['decrypt']).then(resolve, reject);
+            const rsaParams = this.paramsForCreationOrImport(hashAlgorithm);
+            this.crypto.subtle.importKey(format, keydata, rsaParams, extractable, ['decrypt']).then(resolve, reject);
         });
     }
     /**
@@ -105,12 +147,14 @@ class RSAUtils {
      * @param privateKeydata    should be the key data based on the format.
      * @param publicKeyFormat 'jwk' or 'spki'
      * @param publicKeyData should be the key data based on the format.
+     * @param hashAlgorithm 'sha-1' or 'sha-256'
      * @returns {Promise|*}
      */
-    importKeyPair(privateKeyFormat, privateKeydata, publicKeyFormat, publicKeyData) {
+    importKeyPair(privateKeyFormat, privateKeydata, publicKeyFormat, publicKeyData, hashAlgorithm) {
         const extractable = true;
-        const privPromise = this.crypto.subtle.importKey(privateKeyFormat, privateKeydata, this.rsaHashedParams, extractable, ['decrypt']);
-        const pubPromise = this.crypto.subtle.importKey(publicKeyFormat, publicKeyData, this.rsaHashedParams, extractable, ['encrypt']);
+        const rsaParams = this.paramsForCreationOrImport(hashAlgorithm);
+        const privPromise = this.crypto.subtle.importKey(privateKeyFormat, privateKeydata, rsaParams, extractable, ['decrypt']);
+        const pubPromise = this.crypto.subtle.importKey(publicKeyFormat, publicKeyData, rsaParams, extractable, ['encrypt']);
         return Promise.all([pubPromise, privPromise]).then(function (results) {
             return {
                 publicKey: results[0],
@@ -137,6 +181,29 @@ class RSAUtils {
             }
         });
     }
+    /**
+     * Generates a signature for some data. The signature algorithm used is RSA-PSS with SHA-256.
+     * @param privateKey private key to use for signature
+     * @param data the data to sign
+     * @return the signature.
+     */
+    sign(privateKey, data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.crypto.subtle.sign({ name: 'RSA-PSS', saltLength: 32 }, privateKey, data);
+        });
+    }
+    /**
+     * Verifies if a signature matches the data. The signature algorithm used is RSA-PSS with sha-256.
+     * @param publicKey public key to use for signature verification.
+     * @param signature the signature to verify
+     * @param data the data that was signed
+     * @return if the signature matches the data and key.
+     */
+    verifySignature(publicKey, signature, data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.crypto.subtle.verify({ name: 'RSA-PSS', saltLength: 32 }, publicKey, signature, data);
+        });
+    }
 }
 exports.RSAUtils = RSAUtils;
 exports.RSA = new RSAUtils();

package/icc-x-api/crypto/RSA.js.map

@@ -1 +1 @@
-{"version":3,"file":"RSA.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/RSA.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAA4C;AAO5C,MAAa,QAAQ;IAenB,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QAdvI,iCAAiC;QACjC,qBAAqB;QACrB,sBAAsB;QACtB,cAAS,GAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACrC,mDAAmD;QACnD,oBAAe,GAAQ;YACrB,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACxB,CAAA;QAKC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAEpD,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACpG,CAAC,CAAC,CAAA;IACJ,CAAC;IAeD,UAAU,CAAC,OAA2B,EAAE,aAAqB,EAAE,YAAoB;QACjF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACvF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAE1F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAgBD,SAAS,CAAC,SAAoB,EAAE,MAAc;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiD,EAAE,MAAM,EAAE,EAAE;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9E,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAoB,EAAE,SAAqB;QACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,0BAA0B;QACzJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAqB,EAAE,aAAyB;QACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAc,EAAE,OAAiC,EAAE,SAAqB;QAChF,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACjI,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,MAAc,EAAE,OAAiC;QAChE,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACnI,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CACX,gBAAwB,EACxB,cAAwC,EACxC,eAAuB,EACvB,aAAuC;QAEvC,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAuB,EAAE,cAAqB,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAChJ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAsB,EAAE,aAAoB,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAE7I,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACG,oBAAoB,CAAC,OAA2B;;YACpD,IAAI;gBACF,MAAM,IAAI,GAAG,YAAY,CAAA;gBACzB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAA;gBAC3E,MAAM,aAAa,GAAG,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;gBACpG,OAAO,aAAa,KAAK,IAAI,CAAA;aAC9B;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,KAAK,CAAA;aACb;QACH,CAAC;KAAA;CACF;AA1KD,4BA0KC;AAEY,QAAA,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA","sourcesContent":["import { ua2utf8, utf8_2ua } from '../utils'\n\n/**\n * Represents an RSA KeyPair in a generic format.\n */\nexport type KeyPair<T> = { publicKey: T; privateKey: T }\n\nexport class RSAUtils {\n  /********* RSA Config **********/\n  //TODO bigger modulus\n  //TODO PSS for signing\n  rsaParams: any = { name: 'RSA-OAEP' }\n  // RSA params for 'import' and 'generate' function.\n  rsaHashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'sha-1' },\n  }\n\n  private crypto: Crypto\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this.crypto = crypto\n  }\n\n  /**\n   * It returns CryptoKey promise, which doesn't hold the bytes of the key.\n   * If bytes are needed, you must export the generated key.\n   *\n   * @returns {Promise} will be {publicKey: CryptoKey, privateKey: CryptoKey}\n   */\n  generateKeyPair(): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n\n    return new Promise<KeyPair<CryptoKey>>((resolve, reject) => {\n      this.crypto.subtle.generateKey(this.rsaHashedParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param keyPair is {publicKey: CryptoKey, privateKey: CryptoKey}\n   * @param privKeyFormat will be 'pkcs8' or 'jwk'\n   * @param pubKeyFormat will be 'spki' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'jwk', pubKeyFormat: 'jwk'): Promise<KeyPair<JsonWebKey>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'pkcs8', pubKeyFormat: 'spki'): Promise<KeyPair<ArrayBuffer>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: string, pubKeyFormat: string): Promise<KeyPair<JsonWebKey | ArrayBuffer>> {\n    const pubPromise = this.crypto.subtle.exportKey(pubKeyFormat as any, keyPair.publicKey)\n    const privPromise = this.crypto.subtle.exportKey(privKeyFormat as any, keyPair.privateKey)\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   *  Format:\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param cryptoKey public or private\n   * @param format either 'jwk' or 'spki' or 'pkcs8'\n   * @returns {Promise|*} will be RSA key (public or private)\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n  exportKey(cryptoKey: CryptoKey, format: 'spki'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: 'pkcs8'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: string): Promise<JsonWebKey | ArrayBuffer> {\n    return new Promise((resolve: (value: JsonWebKey | ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.exportKey(format as any, cryptoKey).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param publicKey (CryptoKey)\n   * @param plainData (Uint8Array)\n   */\n  encrypt(publicKey: CryptoKey, plainData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.encrypt(this.rsaParams, publicKey, plainData.buffer ? plainData.buffer : plainData).then(resolve, reject) //Node prefers arrayBuffer\n    })\n  }\n\n  /**\n   *\n   * @param privateKey (CryptoKey)\n   * @param encryptedData (Uint8Array)\n   */\n  decrypt(privateKey: CryptoKey, encryptedData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.decrypt(this.rsaParams, privateKey, encryptedData).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk', 'spki', or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param keyUsages Array of usages. For example, ['encrypt'] for public key.\n   * @returns {*}\n   */\n  importKey(format: string, keydata: JsonWebKey | ArrayBuffer, keyUsages: KeyUsage[]): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      this.crypto.subtle.importKey(format as any, keydata as any, this.rsaHashedParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk' or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @returns {*}\n   */\n  importPrivateKey(format: string, keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      this.crypto.subtle.importKey(format as any, keydata as any, this.rsaHashedParams, extractable, ['decrypt']).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param privateKeyFormat 'jwk' or 'pkcs8'\n   * @param privateKeydata    should be the key data based on the format.\n   * @param publicKeyFormat 'jwk' or 'spki'\n   * @param publicKeyData should be the key data based on the format.\n   * @returns {Promise|*}\n   */\n  importKeyPair(\n    privateKeyFormat: string,\n    privateKeydata: JsonWebKey | ArrayBuffer,\n    publicKeyFormat: string,\n    publicKeyData: JsonWebKey | ArrayBuffer\n  ): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const privPromise = this.crypto.subtle.importKey(privateKeyFormat as any, privateKeydata as any, this.rsaHashedParams, extractable, ['decrypt'])\n    const pubPromise = this.crypto.subtle.importKey(publicKeyFormat as any, publicKeyData as any, this.rsaHashedParams, extractable, ['encrypt'])\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   * Tries to encrypt then decrypt data using a keypair. If both operations succeed without throwing an error and the decrypted data matches the\n   * original data returns true, else false.\n   * @param keyPair a key pair.\n   * @return if the key pair could be successfully used to encrypt then decrypt data.\n   */\n  async checkKeyPairValidity(keyPair: KeyPair<CryptoKey>): Promise<boolean> {\n    try {\n      const text = 'shibboleth'\n      const encryptedText = await this.encrypt(keyPair.publicKey, utf8_2ua(text))\n      const decryptedText = ua2utf8(await this.decrypt(keyPair.privateKey, new Uint8Array(encryptedText)))\n      return decryptedText === text\n    } catch (e) {\n      return false\n    }\n  }\n}\n\nexport const RSA = new RSAUtils()\n"]}
+{"version":3,"file":"RSA.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/RSA.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAA4C;AAS5C,MAAa,QAAQ;IA2BnB,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QA1BvI,iCAAiC;QACjC,qBAAqB;QACrB,sBAAsB;QACtB,cAAS,GAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACrC,mDAAmD;QACnD,oBAAe,GAAQ;YACrB,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACxB,CAAA;QACD,8BAAyB,GAAQ;YAC/B,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,CAAA;QACgB,kCAA6B,GAAG;YAC/C,IAAI,EAAE,SAAS;YACf,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,CAAA;QAKC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,UAAsB;QACpC,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAA;QAE5D,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACG,wBAAwB;;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3G,CAAC;KAAA;IAeD,UAAU,CAAC,OAA2B,EAAE,aAAqB,EAAE,YAAoB;QACjF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACvF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAE1F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAgBD,SAAS,CAAC,SAAoB,EAAE,MAAc;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiD,EAAE,MAAM,EAAE,EAAE;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9E,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAoB,EAAE,SAAqB;QACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,0BAA0B;QACzJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAqB,EAAE,aAAyB;QACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,MAAc,EAAE,OAAiC,EAAE,SAAqB,EAAE,aAAyB;QAC3G,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACtH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,kBAAkB,CAAC,MAAuB,EAAE,OAAiC;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,6BAA6B,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/H,CAAC;IAED,qBAAqB,CAAC,MAAsB,EAAE,OAAiC;QAC7E,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,6BAA6B,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjI,CAAC;IAEO,yBAAyB,CAAC,UAAsB;QACtD,IAAI,UAAU,KAAK,OAAO,EAAE;YAC1B,OAAO,IAAI,CAAC,eAAe,CAAA;SAC5B;aAAM,IAAI,UAAU,KAAK,SAAS,EAAE;YACnC,OAAO,IAAI,CAAC,yBAAyB,CAAA;SACtC;aAAM;YACL,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;SACzD;IACH,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAc,EAAE,OAAiC,EAAE,aAAyB;QAC3F,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CACX,gBAAwB,EACxB,cAAwC,EACxC,eAAuB,EACvB,aAAuC,EACvC,aAAyB;QAEzB,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAuB,EAAE,cAAqB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACrI,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAsB,EAAE,aAAoB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAElI,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACG,oBAAoB,CAAC,OAA2B;;YACpD,IAAI;gBACF,MAAM,IAAI,GAAG,YAAY,CAAA;gBACzB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAA;gBAC3E,MAAM,aAAa,GAAG,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;gBACpG,OAAO,aAAa,KAAK,IAAI,CAAA;aAC9B;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,KAAK,CAAA;aACb;QACH,CAAC;KAAA;IAED;;;;;OAKG;IACG,IAAI,CAAC,UAAqB,EAAE,IAAiB;;YACjD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;KAAA;IAED;;;;;;OAMG;IACG,eAAe,CAAC,SAAoB,EAAE,SAAsB,EAAE,IAAiB;;YACnF,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QACzG,CAAC;KAAA;CACF;AA5OD,4BA4OC;AAEY,QAAA,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA","sourcesContent":["import { ua2utf8, utf8_2ua } from '../utils'\n\n/**\n * Represents an RSA KeyPair in a generic format.\n */\nexport type KeyPair<T> = { publicKey: T; privateKey: T }\n\nexport type ShaVersion = 'sha-1' | 'sha-256'\n\nexport class RSAUtils {\n  /********* RSA Config **********/\n  //TODO bigger modulus\n  //TODO PSS for signing\n  rsaParams: any = { name: 'RSA-OAEP' }\n  // RSA params for 'import' and 'generate' function.\n  rsaHashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'sha-1' },\n  }\n  rsaWithSha256HashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'SHA-256' },\n  }\n  private readonly signatureKeysGenerationParams = {\n    name: 'RSA-PSS',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'SHA-256' },\n  }\n\n  private crypto: Crypto\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this.crypto = crypto\n  }\n\n  /**\n   * Generates a key pair for encryption/decryption of data.\n   * @param shaVersion the version of the SHA algorithm to use.\n   */\n  generateKeyPair(shaVersion: ShaVersion): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n    const rsaParams = this.paramsForCreationOrImport(shaVersion)\n\n    return new Promise<KeyPair<CryptoKey>>((resolve, reject) => {\n      this.crypto.subtle.generateKey(rsaParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   * Generates a key pair for signing data and signature verification.\n   */\n  async generateSignatureKeyPair(): Promise<KeyPair<CryptoKey>> {\n    return await this.crypto.subtle.generateKey(this.signatureKeysGenerationParams, true, ['sign', 'verify'])\n  }\n\n  /**\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param keyPair is {publicKey: CryptoKey, privateKey: CryptoKey}\n   * @param privKeyFormat will be 'pkcs8' or 'jwk'\n   * @param pubKeyFormat will be 'spki' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'jwk', pubKeyFormat: 'jwk'): Promise<KeyPair<JsonWebKey>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'pkcs8', pubKeyFormat: 'spki'): Promise<KeyPair<ArrayBuffer>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: string, pubKeyFormat: string): Promise<KeyPair<JsonWebKey | ArrayBuffer>> {\n    const pubPromise = this.crypto.subtle.exportKey(pubKeyFormat as any, keyPair.publicKey)\n    const privPromise = this.crypto.subtle.exportKey(privKeyFormat as any, keyPair.privateKey)\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   *  Format:\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param cryptoKey public or private\n   * @param format either 'jwk' or 'spki' or 'pkcs8'\n   * @returns {Promise|*} will be RSA key (public or private)\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n  exportKey(cryptoKey: CryptoKey, format: 'spki'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: 'pkcs8'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: string): Promise<JsonWebKey | ArrayBuffer> {\n    return new Promise((resolve: (value: JsonWebKey | ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.exportKey(format as any, cryptoKey).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param publicKey (CryptoKey)\n   * @param plainData (Uint8Array)\n   */\n  encrypt(publicKey: CryptoKey, plainData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.encrypt(this.rsaParams, publicKey, plainData.buffer ? plainData.buffer : plainData).then(resolve, reject) //Node prefers arrayBuffer\n    })\n  }\n\n  /**\n   *\n   * @param privateKey (CryptoKey)\n   * @param encryptedData (Uint8Array)\n   */\n  decrypt(privateKey: CryptoKey, encryptedData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.decrypt(this.rsaParams, privateKey, encryptedData).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk', 'spki', or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param keyUsages Array of usages. For example, ['encrypt'] for public key.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {*}\n   */\n  importKey(format: string, keydata: JsonWebKey | ArrayBuffer, keyUsages: KeyUsage[], hashAlgorithm: ShaVersion): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n      this.crypto.subtle.importKey(format as any, keydata as any, rsaParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  importSignatureKey(format: 'jwk' | 'pkcs8', keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey> {\n    const extractable = true\n    return this.crypto.subtle.importKey(format as any, keydata as any, this.signatureKeysGenerationParams, extractable, ['sign'])\n  }\n\n  importVerificationKey(format: 'jwk' | 'spki', keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey> {\n    const extractable = true\n    return this.crypto.subtle.importKey(format as any, keydata as any, this.signatureKeysGenerationParams, extractable, ['verify'])\n  }\n\n  private paramsForCreationOrImport(shaVersion: ShaVersion) {\n    if (shaVersion === 'sha-1') {\n      return this.rsaHashedParams\n    } else if (shaVersion === 'sha-256') {\n      return this.rsaWithSha256HashedParams\n    } else {\n      throw new Error('Unexpected error, invalid SHA version')\n    }\n  }\n\n  /**\n   *\n   * @param format 'jwk' or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {*}\n   */\n  importPrivateKey(format: string, keydata: JsonWebKey | ArrayBuffer, hashAlgorithm: ShaVersion): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n      this.crypto.subtle.importKey(format as any, keydata as any, rsaParams, extractable, ['decrypt']).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param privateKeyFormat 'jwk' or 'pkcs8'\n   * @param privateKeydata    should be the key data based on the format.\n   * @param publicKeyFormat 'jwk' or 'spki'\n   * @param publicKeyData should be the key data based on the format.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {Promise|*}\n   */\n  importKeyPair(\n    privateKeyFormat: string,\n    privateKeydata: JsonWebKey | ArrayBuffer,\n    publicKeyFormat: string,\n    publicKeyData: JsonWebKey | ArrayBuffer,\n    hashAlgorithm: ShaVersion\n  ): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n    const privPromise = this.crypto.subtle.importKey(privateKeyFormat as any, privateKeydata as any, rsaParams, extractable, ['decrypt'])\n    const pubPromise = this.crypto.subtle.importKey(publicKeyFormat as any, publicKeyData as any, rsaParams, extractable, ['encrypt'])\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   * Tries to encrypt then decrypt data using a keypair. If both operations succeed without throwing an error and the decrypted data matches the\n   * original data returns true, else false.\n   * @param keyPair a key pair.\n   * @return if the key pair could be successfully used to encrypt then decrypt data.\n   */\n  async checkKeyPairValidity(keyPair: KeyPair<CryptoKey>): Promise<boolean> {\n    try {\n      const text = 'shibboleth'\n      const encryptedText = await this.encrypt(keyPair.publicKey, utf8_2ua(text))\n      const decryptedText = ua2utf8(await this.decrypt(keyPair.privateKey, new Uint8Array(encryptedText)))\n      return decryptedText === text\n    } catch (e) {\n      return false\n    }\n  }\n\n  /**\n   * Generates a signature for some data. The signature algorithm used is RSA-PSS with SHA-256.\n   * @param privateKey private key to use for signature\n   * @param data the data to sign\n   * @return the signature.\n   */\n  async sign(privateKey: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer> {\n    return await this.crypto.subtle.sign({ name: 'RSA-PSS', saltLength: 32 }, privateKey, data)\n  }\n\n  /**\n   * Verifies if a signature matches the data. The signature algorithm used is RSA-PSS with sha-256.\n   * @param publicKey public key to use for signature verification.\n   * @param signature the signature to verify\n   * @param data the data that was signed\n   * @return if the signature matches the data and key.\n   */\n  async verifySignature(publicKey: CryptoKey, signature: ArrayBuffer, data: ArrayBuffer): Promise<boolean> {\n    return await this.crypto.subtle.verify({ name: 'RSA-PSS', saltLength: 32 }, publicKey, signature, data)\n  }\n}\n\nexport const RSA = new RSAUtils()\n"]}

package/icc-x-api/crypto/SecureDelegationsEncryption.d.ts

@@ -0,0 +1,54 @@
+import { SecureDelegation } from '../../icc-api/model/SecureDelegation';
+import { UserEncryptionKeysManager } from './UserEncryptionKeysManager';
+import { CryptoPrimitives } from './CryptoPrimitives';
+/**
+ * @internal this class is for internal use only and may be changed without notice.
+ */
+export declare class SecureDelegationsEncryption {
+    private readonly userKeys;
+    private readonly primitives;
+    constructor(userKeys: UserEncryptionKeysManager, primitives: CryptoPrimitives);
+    /**
+     * WARNING: this values should be ALWAYS be the string 'Cure' and its utf-8 bytes. If changed, it would not be possible to decrypt old secretIds and owningEntityIds
+     * anymore.
+     * @private
+     */
+    private readonly decryptionValidatorPrefix;
+    private readonly decryptionValidatorBytes;
+    /**
+     * Check if a Uint8Array or an Array buffer contains the decryption validator prefix.
+     * @param bytes an ArrayBuffer or Uint8Array to verify.
+     * @return true if the buffer contains the prefix, false otherwise.
+     */
+    private prefixVerification;
+    /**
+     * If the secure delegation has an encrypted exchange data id attempts to decrypt it with the available keys for the current user.
+     * @param encryptedExchangeIds a map that associates an encrypted exchange data id to the fingerprint of the public key used to encrypt it.
+     * @return the id of the exchange data used for the encryption of the provided secure delegation if it was encrypted and could be decrypted,
+     * undefined otherwise (there was no encrypted id of the exchange data, or it could not be decrypted as no key was available).
+     */
+    decryptExchangeDataId(encryptedExchangeIds: {
+        [fp: string]: string;
+    }): Promise<string | undefined>;
+    /**
+     * Encrypts the exchange data id for a secure delegation. To avoid leaks of sensitive data the provided public keys should be only keys of users
+     * which DO NOT REQUIRE anonymous delegations
+     */
+    encryptExchangeDataId(exchangeDataId: string, publicKeys: {
+        [fp: string]: CryptoKey;
+    }): Promise<{
+        [fp: string]: string;
+    }>;
+    encryptEncryptionKey(hexKey: string, key: CryptoKey): Promise<string>;
+    encryptEncryptionKeys(hexKeys: string[], key: CryptoKey): Promise<string[]>;
+    decryptEncryptionKey(encrypted: string, key: CryptoKey): Promise<string>;
+    decryptEncryptionKeys(delegation: SecureDelegation, key: CryptoKey): Promise<string[]>;
+    encryptSecretId(secretId: string, key: CryptoKey): Promise<string>;
+    encryptSecretIds(secretIds: string[], key: CryptoKey): Promise<string[]>;
+    decryptSecretId(encrypted: string, key: CryptoKey): Promise<string>;
+    decryptSecretIds(delegation: SecureDelegation, key: CryptoKey): Promise<string[]>;
+    encryptOwningEntityId(owningEntityId: string, key: CryptoKey): Promise<string>;
+    encryptOwningEntityIds(owningEntityIds: string[], key: CryptoKey): Promise<string[]>;
+    decryptOwningEntityId(encrypted: string, key: CryptoKey): Promise<string>;
+    decryptOwningEntityIds(delegation: SecureDelegation, key: CryptoKey): Promise<string[]>;
+}