@icure/api 7.1.16 → 8.0.0-RC.2

package/icc-x-api/crypto/SecureDelegationsEncryption.js

@@ -0,0 +1,178 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureDelegationsEncryption = void 0;
+const utils_1 = require("../utils");
+const utils_2 = require("./utils");
+/**
+ * @internal this class is for internal use only and may be changed without notice.
+ */
+class SecureDelegationsEncryption {
+    constructor(userKeys, primitives) {
+        this.userKeys = userKeys;
+        this.primitives = primitives;
+        /**
+         * WARNING: this values should be ALWAYS be the string 'Cure' and its utf-8 bytes. If changed, it would not be possible to decrypt old secretIds and owningEntityIds
+         * anymore.
+         * @private
+         */
+        this.decryptionValidatorPrefix = 'Cure';
+        this.decryptionValidatorBytes = (0, utils_1.utf8_2ua)(this.decryptionValidatorPrefix);
+    }
+    /**
+     * Check if a Uint8Array or an Array buffer contains the decryption validator prefix.
+     * @param bytes an ArrayBuffer or Uint8Array to verify.
+     * @return true if the buffer contains the prefix, false otherwise.
+     */
+    prefixVerification(bytes) {
+        const arrayToVerify = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+        if (arrayToVerify.length < this.decryptionValidatorBytes.length)
+            return false;
+        let result = true;
+        for (let i = 0; i < this.decryptionValidatorBytes.length; i++) {
+            result = result && this.decryptionValidatorBytes[i] === arrayToVerify[i];
+        }
+        return result;
+    }
+    /**
+     * If the secure delegation has an encrypted exchange data id attempts to decrypt it with the available keys for the current user.
+     * @param encryptedExchangeIds a map that associates an encrypted exchange data id to the fingerprint of the public key used to encrypt it.
+     * @return the id of the exchange data used for the encryption of the provided secure delegation if it was encrypted and could be decrypted,
+     * undefined otherwise (there was no encrypted id of the exchange data, or it could not be decrypted as no key was available).
+     */
+    decryptExchangeDataId(encryptedExchangeIds) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const decryptionKeys = this.userKeys.getDecryptionKeys();
+            const decryptionKeysV2 = Object.fromEntries(Object.entries(decryptionKeys).map(([fp, keyPair]) => [(0, utils_2.fingerprintIsV1)(fp) ? (0, utils_2.fingerprintV1toV2)(fp) : fp, keyPair]));
+            for (const [fp, encryptedId] of Object.entries(encryptedExchangeIds)) {
+                const key = (_a = decryptionKeys === null || decryptionKeys === void 0 ? void 0 : decryptionKeys[fp]) !== null && _a !== void 0 ? _a : decryptionKeysV2 === null || decryptionKeysV2 === void 0 ? void 0 : decryptionKeysV2[fp];
+                if (key)
+                    return (0, utils_1.ua2utf8)(yield this.primitives.RSA.decrypt(key.privateKey, (0, utils_1.b64_2ua)(encryptedId)));
+            }
+            return undefined;
+        });
+    }
+    /**
+     * Encrypts the exchange data id for a secure delegation. To avoid leaks of sensitive data the provided public keys should be only keys of users
+     * which DO NOT REQUIRE anonymous delegations
+     */
+    encryptExchangeDataId(exchangeDataId, publicKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = {};
+            for (const [fp, key] of Object.entries(publicKeys)) {
+                res[fp] = (0, utils_1.ua2b64)(yield this.primitives.RSA.encrypt(key, (0, utils_1.utf8_2ua)(exchangeDataId)));
+            }
+            return res;
+        });
+    }
+    encryptEncryptionKey(hexKey, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, utils_1.ua2b64)(yield this.primitives.AES.encrypt(key, (0, utils_1.concat_uas)(this.decryptionValidatorBytes, (0, utils_1.hex2ua)(hexKey))));
+        });
+    }
+    encryptEncryptionKeys(hexKeys, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = [];
+            for (const hexKey of hexKeys) {
+                res.push(yield this.encryptEncryptionKey(hexKey, key));
+            }
+            return res;
+        });
+    }
+    decryptEncryptionKey(encrypted, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const probableKey = yield this.primitives.AES.decrypt(key, (0, utils_1.b64_2ua)(encrypted));
+            if (!this.prefixVerification(probableKey)) {
+                throw new Error('Invalid encryption key');
+            }
+            return (0, utils_1.ua2hex)(probableKey.slice(this.decryptionValidatorBytes.length));
+        });
+    }
+    decryptEncryptionKeys(delegation, key) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = [];
+            for (const encrypted of (_a = delegation.encryptionKeys) !== null && _a !== void 0 ? _a : []) {
+                res.push(yield this.decryptEncryptionKey(encrypted, key));
+            }
+            return res;
+        });
+    }
+    encryptSecretId(secretId, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, utils_1.ua2b64)(yield this.primitives.AES.encrypt(key, (0, utils_1.utf8_2ua)(this.decryptionValidatorPrefix + secretId)));
+        });
+    }
+    encryptSecretIds(secretIds, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = [];
+            for (const secretId of secretIds) {
+                res.push(yield this.encryptSecretId(secretId, key));
+            }
+            return res;
+        });
+    }
+    decryptSecretId(encrypted, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const probableSecretId = (0, utils_1.ua2utf8)(yield this.primitives.AES.decrypt(key, (0, utils_1.b64_2ua)(encrypted)));
+            if (probableSecretId.substring(0, this.decryptionValidatorPrefix.length) !== this.decryptionValidatorPrefix) {
+                throw new Error('Invalid secretID');
+            }
+            return probableSecretId.substring(this.decryptionValidatorPrefix.length);
+        });
+    }
+    decryptSecretIds(delegation, key) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = [];
+            for (const encrypted of (_a = delegation.secretIds) !== null && _a !== void 0 ? _a : []) {
+                res.push(yield this.decryptSecretId(encrypted, key));
+            }
+            return res;
+        });
+    }
+    encryptOwningEntityId(owningEntityId, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, utils_1.ua2b64)(yield this.primitives.AES.encrypt(key, (0, utils_1.utf8_2ua)(this.decryptionValidatorPrefix + owningEntityId)));
+        });
+    }
+    encryptOwningEntityIds(owningEntityIds, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = [];
+            for (const owningEntityId of owningEntityIds) {
+                res.push(yield this.encryptOwningEntityId(owningEntityId, key));
+            }
+            return res;
+        });
+    }
+    decryptOwningEntityId(encrypted, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const probableOwningEntityId = (0, utils_1.ua2utf8)(yield this.primitives.AES.decrypt(key, (0, utils_1.b64_2ua)(encrypted)));
+            if (probableOwningEntityId.substring(0, this.decryptionValidatorPrefix.length) !== this.decryptionValidatorPrefix) {
+                throw new Error('Invalid Owning Entity id');
+            }
+            return probableOwningEntityId.substring(this.decryptionValidatorPrefix.length);
+        });
+    }
+    decryptOwningEntityIds(delegation, key) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = [];
+            for (const encrypted of (_a = delegation.owningEntityIds) !== null && _a !== void 0 ? _a : []) {
+                res.push(yield this.decryptOwningEntityId(encrypted, key));
+            }
+            return res;
+        });
+    }
+}
+exports.SecureDelegationsEncryption = SecureDelegationsEncryption;
+//# sourceMappingURL=SecureDelegationsEncryption.js.map

package/icc-x-api/crypto/SecureDelegationsEncryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureDelegationsEncryption.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsEncryption.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAyF;AAGzF,mCAA4D;AAE5D;;GAEG;AACH,MAAa,2BAA2B;IACtC,YAA6B,QAAmC,EAAmB,UAA4B;QAAlF,aAAQ,GAAR,QAAQ,CAA2B;QAAmB,eAAU,GAAV,UAAU,CAAkB;QAE/G;;;;WAIG;QACc,8BAAyB,GAAW,MAAM,CAAA;QAC1C,6BAAwB,GAAe,IAAA,gBAAQ,EAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;IARkB,CAAC;IAUnH;;;;OAIG;IACK,kBAAkB,CAAC,KAA+B;QACxD,MAAM,aAAa,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;QACjF,IAAI,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAC7E,IAAI,MAAM,GAAG,IAAI,CAAA;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YAC7D,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAA;SACzE;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACG,qBAAqB,CAAC,oBAA8C;;;YACxE,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAA;YACxD,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACzC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CACnH,CAAA;YACD,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE;gBACpE,MAAM,GAAG,GAAG,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAG,EAAE,CAAC,mCAAI,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAG,EAAE,CAAC,CAAA;gBAC1D,IAAI,GAAG;oBAAE,OAAO,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,eAAO,EAAC,WAAW,CAAC,CAAC,CAAC,CAAA;aACjG;YACD,OAAO,SAAS,CAAA;;KACjB;IAED;;;OAGG;IACG,qBAAqB,CAAC,cAAsB,EAAE,UAAuC;;YACzF,MAAM,GAAG,GAAG,EAA8B,CAAA;YAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;gBAClD,GAAG,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,gBAAQ,EAAC,cAAc,CAAC,CAAC,CAAC,CAAA;aACnF;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEK,oBAAoB,CAAC,MAAc,EAAE,GAAc;;YACvD,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,kBAAU,EAAC,IAAI,CAAC,wBAAwB,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAClH,CAAC;KAAA;IAEK,qBAAqB,CAAC,OAAiB,EAAE,GAAc;;YAC3D,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;gBAC5B,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;aACvD;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEK,oBAAoB,CAAC,SAAiB,EAAE,GAAc;;YAC1D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAA;YAC9E,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE;gBACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;aAC1C;YACD,OAAO,IAAA,cAAM,EAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAA;QACxE,CAAC;KAAA;IAEK,qBAAqB,CAAC,UAA4B,EAAE,GAAc;;;YACtE,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,SAAS,IAAI,MAAA,UAAU,CAAC,cAAc,mCAAI,EAAE,EAAE;gBACvD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;aAC1D;YACD,OAAO,GAAG,CAAA;;KACX;IAEK,eAAe,CAAC,QAAgB,EAAE,GAAc;;YACpD,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,yBAAyB,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QAC5G,CAAC;KAAA;IAEK,gBAAgB,CAAC,SAAmB,EAAE,GAAc;;YACxD,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;gBAChC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;aACpD;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEK,eAAe,CAAC,SAAiB,EAAE,GAAc;;YACrD,MAAM,gBAAgB,GAAG,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YAC5F,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,yBAAyB,EAAE;gBAC3G,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;aACpC;YACD,OAAO,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;QAC1E,CAAC;KAAA;IAEK,gBAAgB,CAAC,UAA4B,EAAE,GAAc;;;YACjE,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,SAAS,IAAI,MAAA,UAAU,CAAC,SAAS,mCAAI,EAAE,EAAE;gBAClD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;aACrD;YACD,OAAO,GAAG,CAAA;;KACX;IAEK,qBAAqB,CAAC,cAAsB,EAAE,GAAc;;YAChE,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,yBAAyB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QAClH,CAAC;KAAA;IAEK,sBAAsB,CAAC,eAAyB,EAAE,GAAc;;YACpE,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;gBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAA;aAChE;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEK,qBAAqB,CAAC,SAAiB,EAAE,GAAc;;YAC3D,MAAM,sBAAsB,GAAG,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YAClG,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,yBAAyB,EAAE;gBACjH,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;aAC5C;YACD,OAAO,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;QAChF,CAAC;KAAA;IAEK,sBAAsB,CAAC,UAA4B,EAAE,GAAc;;;YACvE,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,SAAS,IAAI,MAAA,UAAU,CAAC,eAAe,mCAAI,EAAE,EAAE;gBACxD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;aAC3D;YACD,OAAO,GAAG,CAAA;;KACX;CACF;AA3ID,kEA2IC","sourcesContent":["import { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { b64_2ua, concat_uas, hex2ua, ua2b64, ua2hex, ua2utf8, utf8_2ua } from '../utils'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { fingerprintV1toV2, fingerprintIsV1 } from './utils'\n\n/**\n * @internal this class is for internal use only and may be changed without notice.\n */\nexport class SecureDelegationsEncryption {\n  constructor(private readonly userKeys: UserEncryptionKeysManager, private readonly primitives: CryptoPrimitives) {}\n\n  /**\n   * WARNING: this values should be ALWAYS be the string 'Cure' and its utf-8 bytes. If changed, it would not be possible to decrypt old secretIds and owningEntityIds\n   * anymore.\n   * @private\n   */\n  private readonly decryptionValidatorPrefix: string = 'Cure'\n  private readonly decryptionValidatorBytes: Uint8Array = utf8_2ua(this.decryptionValidatorPrefix)\n\n  /**\n   * Check if a Uint8Array or an Array buffer contains the decryption validator prefix.\n   * @param bytes an ArrayBuffer or Uint8Array to verify.\n   * @return true if the buffer contains the prefix, false otherwise.\n   */\n  private prefixVerification(bytes: ArrayBuffer | Uint8Array): boolean {\n    const arrayToVerify = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)\n    if (arrayToVerify.length < this.decryptionValidatorBytes.length) return false\n    let result = true\n    for (let i = 0; i < this.decryptionValidatorBytes.length; i++) {\n      result = result && this.decryptionValidatorBytes[i] === arrayToVerify[i]\n    }\n    return result\n  }\n\n  /**\n   * If the secure delegation has an encrypted exchange data id attempts to decrypt it with the available keys for the current user.\n   * @param encryptedExchangeIds a map that associates an encrypted exchange data id to the fingerprint of the public key used to encrypt it.\n   * @return the id of the exchange data used for the encryption of the provided secure delegation if it was encrypted and could be decrypted,\n   * undefined otherwise (there was no encrypted id of the exchange data, or it could not be decrypted as no key was available).\n   */\n  async decryptExchangeDataId(encryptedExchangeIds: { [fp: string]: string }): Promise<string | undefined> {\n    const decryptionKeys = this.userKeys.getDecryptionKeys()\n    const decryptionKeysV2 = Object.fromEntries(\n      Object.entries(decryptionKeys).map(([fp, keyPair]) => [fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp, keyPair])\n    )\n    for (const [fp, encryptedId] of Object.entries(encryptedExchangeIds)) {\n      const key = decryptionKeys?.[fp] ?? decryptionKeysV2?.[fp]\n      if (key) return ua2utf8(await this.primitives.RSA.decrypt(key.privateKey, b64_2ua(encryptedId)))\n    }\n    return undefined\n  }\n\n  /**\n   * Encrypts the exchange data id for a secure delegation. To avoid leaks of sensitive data the provided public keys should be only keys of users\n   * which DO NOT REQUIRE anonymous delegations\n   */\n  async encryptExchangeDataId(exchangeDataId: string, publicKeys: { [fp: string]: CryptoKey }): Promise<{ [fp: string]: string }> {\n    const res = {} as { [fp: string]: string }\n    for (const [fp, key] of Object.entries(publicKeys)) {\n      res[fp] = ua2b64(await this.primitives.RSA.encrypt(key, utf8_2ua(exchangeDataId)))\n    }\n    return res\n  }\n\n  async encryptEncryptionKey(hexKey: string, key: CryptoKey): Promise<string> {\n    return ua2b64(await this.primitives.AES.encrypt(key, concat_uas(this.decryptionValidatorBytes, hex2ua(hexKey))))\n  }\n\n  async encryptEncryptionKeys(hexKeys: string[], key: CryptoKey): Promise<string[]> {\n    const res = []\n    for (const hexKey of hexKeys) {\n      res.push(await this.encryptEncryptionKey(hexKey, key))\n    }\n    return res\n  }\n\n  async decryptEncryptionKey(encrypted: string, key: CryptoKey): Promise<string> {\n    const probableKey = await this.primitives.AES.decrypt(key, b64_2ua(encrypted))\n    if (!this.prefixVerification(probableKey)) {\n      throw new Error('Invalid encryption key')\n    }\n    return ua2hex(probableKey.slice(this.decryptionValidatorBytes.length))\n  }\n\n  async decryptEncryptionKeys(delegation: SecureDelegation, key: CryptoKey): Promise<string[]> {\n    const res = []\n    for (const encrypted of delegation.encryptionKeys ?? []) {\n      res.push(await this.decryptEncryptionKey(encrypted, key))\n    }\n    return res\n  }\n\n  async encryptSecretId(secretId: string, key: CryptoKey): Promise<string> {\n    return ua2b64(await this.primitives.AES.encrypt(key, utf8_2ua(this.decryptionValidatorPrefix + secretId)))\n  }\n\n  async encryptSecretIds(secretIds: string[], key: CryptoKey): Promise<string[]> {\n    const res = []\n    for (const secretId of secretIds) {\n      res.push(await this.encryptSecretId(secretId, key))\n    }\n    return res\n  }\n\n  async decryptSecretId(encrypted: string, key: CryptoKey): Promise<string> {\n    const probableSecretId = ua2utf8(await this.primitives.AES.decrypt(key, b64_2ua(encrypted)))\n    if (probableSecretId.substring(0, this.decryptionValidatorPrefix.length) !== this.decryptionValidatorPrefix) {\n      throw new Error('Invalid secretID')\n    }\n    return probableSecretId.substring(this.decryptionValidatorPrefix.length)\n  }\n\n  async decryptSecretIds(delegation: SecureDelegation, key: CryptoKey): Promise<string[]> {\n    const res = []\n    for (const encrypted of delegation.secretIds ?? []) {\n      res.push(await this.decryptSecretId(encrypted, key))\n    }\n    return res\n  }\n\n  async encryptOwningEntityId(owningEntityId: string, key: CryptoKey): Promise<string> {\n    return ua2b64(await this.primitives.AES.encrypt(key, utf8_2ua(this.decryptionValidatorPrefix + owningEntityId)))\n  }\n\n  async encryptOwningEntityIds(owningEntityIds: string[], key: CryptoKey): Promise<string[]> {\n    const res = []\n    for (const owningEntityId of owningEntityIds) {\n      res.push(await this.encryptOwningEntityId(owningEntityId, key))\n    }\n    return res\n  }\n\n  async decryptOwningEntityId(encrypted: string, key: CryptoKey): Promise<string> {\n    const probableOwningEntityId = ua2utf8(await this.primitives.AES.decrypt(key, b64_2ua(encrypted)))\n    if (probableOwningEntityId.substring(0, this.decryptionValidatorPrefix.length) !== this.decryptionValidatorPrefix) {\n      throw new Error('Invalid Owning Entity id')\n    }\n    return probableOwningEntityId.substring(this.decryptionValidatorPrefix.length)\n  }\n\n  async decryptOwningEntityIds(delegation: SecureDelegation, key: CryptoKey): Promise<string[]> {\n    const res = []\n    for (const encrypted of delegation.owningEntityIds ?? []) {\n      res.push(await this.decryptOwningEntityId(encrypted, key))\n    }\n    return res\n  }\n}\n"]}

package/icc-x-api/crypto/SecureDelegationsManager.d.ts

@@ -0,0 +1,66 @@
+import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest';
+import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { UserEncryptionKeysManager } from './UserEncryptionKeysManager';
+import { CryptoStrategies } from './CryptoStrategies';
+import { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName';
+import { ExchangeDataManager } from './ExchangeDataManager';
+import { SecureDelegationsEncryption } from './SecureDelegationsEncryption';
+import { CryptoPrimitives } from './CryptoPrimitives';
+import { AccessControlSecretUtils } from './AccessControlSecretUtils';
+import { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest';
+import { EncryptedEntity } from '../../icc-api/model/models';
+import { SecureDelegation } from '../../icc-api/model/SecureDelegation';
+import { ExchangeDataMapManager } from './ExchangeDataMapManager';
+export declare class SecureDelegationsManager {
+    private readonly exchangeDataManager;
+    private readonly exchangeDataMapManager;
+    private readonly secureDelegationsEncryption;
+    private readonly accessControlSecretUtils;
+    private readonly userKeys;
+    private readonly primitives;
+    private readonly dataOwnerApi;
+    private readonly cryptoStrategies;
+    private readonly selfNeedsAnonymousDelegations;
+    constructor(exchangeDataManager: ExchangeDataManager, exchangeDataMapManager: ExchangeDataMapManager, secureDelegationsEncryption: SecureDelegationsEncryption, accessControlSecretUtils: AccessControlSecretUtils, userKeys: UserEncryptionKeysManager, primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, cryptoStrategies: CryptoStrategies, selfNeedsAnonymousDelegations: boolean);
+    private readonly dataOwnerInfoCache;
+    /**
+     * Note: this method does not save the updated entity.
+     * @param entity an entity, must already have secret foreign keys initialised.
+     * @param entityType the type of the entity
+     * @param secretIds the initial secret ids to include and share with the auto-delegations
+     * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations
+     * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations
+     * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level
+     * they will have on the entity.
+     * @return the entity with the security metadata initialised for the provided parameters.
+     */
+    entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(entity: T & {
+        secretForeignKeys: string[];
+    }, entityType: EntityWithDelegationTypeName, secretIds: string[], owningEntityIds: string[], encryptionKeys: string[], autoDelegations: {
+        [delegateId: string]: SecureDelegation.AccessLevelEnum;
+    }): Promise<T>;
+    /**
+     * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or
+     * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation
+     * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to
+     * share the provided data.
+     * @param entityWithType an entity with type
+     * @param delegateId the id of the delegate
+     * @param shareSecretIds the secret ids to share
+     * @param shareEncryptionKeys the encryption keys to share
+     * @param shareOwningEntityIds the owning entity ids to share
+     * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an
+     * update request instead of a share request, this parameter is ignored.
+     * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update
+     * the entity to allow the delegate to access the provided data.
+     */
+    makeShareOrUpdateRequestParams(entityWithType: EncryptedEntityWithType, delegateId: string, shareSecretIds: string[], shareEncryptionKeys: string[], shareOwningEntityIds: string[], newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal): Promise<EntityShareOrMetadataUpdateRequest | undefined>;
+    private makeUpdateRequestParams;
+    private makeShareRequestParams;
+    private makeSecureDelegationInfo;
+    private makeSecureDelegationEncryptedData;
+    private makeExchangeDataIdInfoForDelegate;
+    private makeExchangeDataIdInfoForSelf;
+    private getDataOwnerInfo;
+    private getExistingCanonicalKeyAndSecureDelegation;
+}

package/icc-x-api/crypto/SecureDelegationsManager.js

@@ -0,0 +1,261 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureDelegationsManager = void 0;
+const EntityShareRequest_1 = require("../../icc-api/model/requests/EntityShareRequest");
+const lru_temporised_async_cache_1 = require("../utils/lru-temporised-async-cache");
+const utils_1 = require("./utils");
+const utils_2 = require("../utils");
+const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
+const EntitySharedMetadataUpdateRequest_1 = require("../../icc-api/model/requests/EntitySharedMetadataUpdateRequest");
+var EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest_1.EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum;
+var AccessLevelEnum = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
+const SecurityMetadata_1 = require("../../icc-api/model/SecurityMetadata");
+class SecureDelegationsManager {
+    constructor(exchangeDataManager, exchangeDataMapManager, secureDelegationsEncryption, accessControlSecretUtils, userKeys, primitives, dataOwnerApi, cryptoStrategies, selfNeedsAnonymousDelegations) {
+        this.exchangeDataManager = exchangeDataManager;
+        this.exchangeDataMapManager = exchangeDataMapManager;
+        this.secureDelegationsEncryption = secureDelegationsEncryption;
+        this.accessControlSecretUtils = accessControlSecretUtils;
+        this.userKeys = userKeys;
+        this.primitives = primitives;
+        this.dataOwnerApi = dataOwnerApi;
+        this.cryptoStrategies = cryptoStrategies;
+        this.selfNeedsAnonymousDelegations = selfNeedsAnonymousDelegations;
+        this.dataOwnerInfoCache = new lru_temporised_async_cache_1.LruTemporisedAsyncCache(100, () => 30 * 60 * 1000);
+    }
+    /**
+     * Note: this method does not save the updated entity.
+     * @param entity an entity, must already have secret foreign keys initialised.
+     * @param entityType the type of the entity
+     * @param secretIds the initial secret ids to include and share with the auto-delegations
+     * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations
+     * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations
+     * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level
+     * they will have on the entity.
+     * @return the entity with the security metadata initialised for the provided parameters.
+     */
+    entityWithInitialisedEncryptedMetadata(entity, entityType, secretIds, owningEntityIds, encryptionKeys, autoDelegations) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const entityWithType = { entity, type: entityType };
+            const rootDelegationInfo = yield this.makeSecureDelegationInfo(entityWithType, yield this.dataOwnerApi.getCurrentDataOwnerId(), secretIds, encryptionKeys, owningEntityIds, AccessLevelEnum.WRITE, undefined);
+            const selfId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            const otherDelegationsInfo = [];
+            for (const [delegateId, permissions] of Object.entries(autoDelegations)) {
+                if (delegateId !== selfId) {
+                    otherDelegationsInfo.push(yield this.makeSecureDelegationInfo(entityWithType, delegateId, secretIds, encryptionKeys, owningEntityIds, permissions, rootDelegationInfo.canonicalDelegationKey));
+                }
+            }
+            const secureDelegations = Object.fromEntries([rootDelegationInfo, ...otherDelegationsInfo].map(({ canonicalDelegationKey, delegation }) => [canonicalDelegationKey, delegation]));
+            const keysEquivalences = Object.assign({}, rootDelegationInfo.delegationKeyEquivalences);
+            for (const { delegationKeyEquivalences: otherKeyEquivalences } of otherDelegationsInfo) {
+                Object.assign(keysEquivalences, otherKeyEquivalences);
+            }
+            const newExchangeDataMaps = Object.fromEntries(otherDelegationsInfo
+                .filter(({ encryptedExchangeDataId }) => !!encryptedExchangeDataId)
+                .map(({ canonicalAccessControlKey, encryptedExchangeDataId }) => [canonicalAccessControlKey, encryptedExchangeDataId]));
+            yield this.exchangeDataMapManager.createExchangeDataMaps(newExchangeDataMaps);
+            return Object.assign(Object.assign({}, entity), { securityMetadata: new SecurityMetadata_1.SecurityMetadata({ secureDelegations, keysEquivalences }) });
+        });
+    }
+    /**
+     * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or
+     * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation
+     * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to
+     * share the provided data.
+     * @param entityWithType an entity with type
+     * @param delegateId the id of the delegate
+     * @param shareSecretIds the secret ids to share
+     * @param shareEncryptionKeys the encryption keys to share
+     * @param shareOwningEntityIds the owning entity ids to share
+     * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an
+     * update request instead of a share request, this parameter is ignored.
+     * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update
+     * the entity to allow the delegate to access the provided data.
+     */
+    makeShareOrUpdateRequestParams(entityWithType, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds, newDelegationPermissions) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            const exchangeDataInfo = yield this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, entityWithType.type, (_a = entityWithType.entity.secretForeignKeys) !== null && _a !== void 0 ? _a : []);
+            const accessControlHashes = yield this.accessControlSecretUtils.secureDelegationKeysFor(exchangeDataInfo.accessControlSecret, entityWithType.type, (_b = entityWithType.entity.secretForeignKeys) !== null && _b !== void 0 ? _b : []);
+            const existingSecureDelegation = this.getExistingCanonicalKeyAndSecureDelegation(entityWithType.entity, accessControlHashes);
+            if (existingSecureDelegation) {
+                const updateParams = yield this.makeUpdateRequestParams(existingSecureDelegation.canonicalKey, existingSecureDelegation.secureDelegation, exchangeDataInfo, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds);
+                return updateParams ? { update: updateParams } : undefined;
+            }
+            else {
+                const accessControlKeys = (yield this.accessControlSecretUtils.accessControlKeysFor(exchangeDataInfo.accessControlSecret, entityWithType.type, (_c = entityWithType.entity.secretForeignKeys) !== null && _c !== void 0 ? _c : [])).map((x) => (0, utils_2.ua2hex)(x));
+                return {
+                    share: yield this.makeShareRequestParams(exchangeDataInfo, accessControlKeys, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds, newDelegationPermissions),
+                };
+            }
+        });
+    }
+    makeUpdateRequestParams(canonicalKey, existingDelegation, exchangeDataInfo, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const existingSecretIds = new Set(yield this.secureDelegationsEncryption.decryptSecretIds(existingDelegation, exchangeDataInfo.exchangeKey));
+            const existingEncryptionKeys = new Set(yield this.secureDelegationsEncryption.decryptEncryptionKeys(existingDelegation, exchangeDataInfo.exchangeKey));
+            const existingOwningEntityIds = new Set(yield this.secureDelegationsEncryption.decryptOwningEntityIds(existingDelegation, exchangeDataInfo.exchangeKey));
+            const newSecretIds = shareSecretIds.filter((id) => !existingSecretIds.has(id));
+            const newEncryptionKeys = shareEncryptionKeys.filter((key) => !existingEncryptionKeys.has(key));
+            const newOwningEntityIds = shareOwningEntityIds.filter((id) => !existingOwningEntityIds.has(id));
+            if (newSecretIds.length || newEncryptionKeys.length || newOwningEntityIds.length) {
+                const encryptedNewSecretIds = yield this.secureDelegationsEncryption.encryptSecretIds(newSecretIds, exchangeDataInfo.exchangeKey);
+                const encryptedNewEncryptionKeys = yield this.secureDelegationsEncryption.encryptEncryptionKeys(newEncryptionKeys, exchangeDataInfo.exchangeKey);
+                const encryptedNewOwningEntityIds = yield this.secureDelegationsEncryption.encryptOwningEntityIds(newOwningEntityIds, exchangeDataInfo.exchangeKey);
+                return new EntitySharedMetadataUpdateRequest_1.EntitySharedMetadataUpdateRequest({
+                    metadataAccessControlHash: canonicalKey,
+                    secretIds: Object.fromEntries(encryptedNewSecretIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),
+                    encryptionKeys: Object.fromEntries(encryptedNewEncryptionKeys.map((key) => [key, EntryUpdateTypeEnum.CREATE])),
+                    owningEntityIds: Object.fromEntries(encryptedNewOwningEntityIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),
+                });
+            }
+            else
+                return undefined;
+        });
+    }
+    makeShareRequestParams(exchangeDataInfo, accessControlKeys, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds, newDelegationPermissions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return new EntityShareRequest_1.EntityShareRequest(Object.assign(Object.assign({}, (yield this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds))), { requestedPermissions: newDelegationPermissions, accessControlKeys }));
+        });
+    }
+    makeSecureDelegationInfo(entity, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds, permissions, parentDelegationKey) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            // Be wary of explicit delegator and explicit delegate
+            const exchangeDataInfo = yield this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, entity.type, (_a = entity.entity.secretForeignKeys) !== null && _a !== void 0 ? _a : []);
+            const accessControlHashes = yield this.accessControlSecretUtils.secureDelegationKeysFor(exchangeDataInfo.accessControlSecret, entity.type, (_b = entity.entity.secretForeignKeys) !== null && _b !== void 0 ? _b : []);
+            const accessControlKeys = (yield this.accessControlSecretUtils.accessControlKeysFor(exchangeDataInfo.accessControlSecret, entity.type, (_c = entity.entity.secretForeignKeys) !== null && _c !== void 0 ? _c : [])).map((x) => (0, utils_2.ua2hex)(x));
+            const accessControlKeysToHashes = accessControlKeys
+                .map((key, index) => {
+                return [key, accessControlHashes[index]];
+            })
+                .sort((a, b) => a[1].localeCompare(b[1]));
+            const canonicalKey = accessControlKeysToHashes[0][1];
+            const keyEquivalences = Object.fromEntries(accessControlKeysToHashes.slice(1).map((hash) => [hash[1], canonicalKey]));
+            const encryptedDelegationInfo = yield this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds);
+            const delegation = new SecureDelegation_1.SecureDelegation({
+                delegator: encryptedDelegationInfo === null || encryptedDelegationInfo === void 0 ? void 0 : encryptedDelegationInfo.explicitDelegator,
+                delegate: encryptedDelegationInfo === null || encryptedDelegationInfo === void 0 ? void 0 : encryptedDelegationInfo.explicitDelegate,
+                secretIds: encryptedDelegationInfo === null || encryptedDelegationInfo === void 0 ? void 0 : encryptedDelegationInfo.secretIds,
+                encryptionKeys: encryptedDelegationInfo === null || encryptedDelegationInfo === void 0 ? void 0 : encryptedDelegationInfo.encryptionKeys,
+                owningEntityIds: encryptedDelegationInfo === null || encryptedDelegationInfo === void 0 ? void 0 : encryptedDelegationInfo.owningEntityIds,
+                parentDelegations: parentDelegationKey ? [parentDelegationKey] : undefined,
+                exchangeDataId: encryptedDelegationInfo === null || encryptedDelegationInfo === void 0 ? void 0 : encryptedDelegationInfo.exchangeDataId,
+                encryptedExchangeDataId: encryptedDelegationInfo === null || encryptedDelegationInfo === void 0 ? void 0 : encryptedDelegationInfo.encryptedExchangeDataId,
+                permissions: permissions,
+            });
+            return {
+                canonicalDelegationKey: canonicalKey,
+                canonicalAccessControlKey: accessControlKeysToHashes[0][0],
+                delegation,
+                encryptedExchangeDataId: encryptedDelegationInfo === null || encryptedDelegationInfo === void 0 ? void 0 : encryptedDelegationInfo.encryptedExchangeDataId,
+                delegationKeyEquivalences: keyEquivalences,
+            };
+        });
+    }
+    makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const selfId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            const exchangeDataIdInfo = delegateId === selfId
+                ? this.makeExchangeDataIdInfoForSelf(selfId, exchangeDataInfo.exchangeData)
+                : yield this.makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeDataInfo.exchangeData);
+            const encryptedSecretIds = yield this.secureDelegationsEncryption.encryptSecretIds(shareSecretIds, exchangeDataInfo.exchangeKey);
+            const encryptedEncryptionKeys = yield this.secureDelegationsEncryption.encryptEncryptionKeys(shareEncryptionKeys, exchangeDataInfo.exchangeKey);
+            const encryptedOwningEntityIds = yield this.secureDelegationsEncryption.encryptOwningEntityIds(shareOwningEntityIds, exchangeDataInfo.exchangeKey);
+            return Object.assign(Object.assign({}, exchangeDataIdInfo), { secretIds: encryptedSecretIds, encryptionKeys: encryptedEncryptionKeys, owningEntityIds: encryptedOwningEntityIds });
+        });
+    }
+    makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeData) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const delegateInfo = yield this.getDataOwnerInfo(delegateId);
+            if (!delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {
+                return {
+                    explicitDelegator: selfId,
+                    explicitDelegate: delegateId,
+                    exchangeDataId: exchangeData.id,
+                };
+            }
+            else if (delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {
+                return {
+                    explicitDelegator: selfId,
+                    encryptedExchangeDataId: yield this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id, Object.fromEntries(this.userKeys.getSelfVerifiedKeys().map((keyInfo) => [keyInfo.fingerprint, keyInfo.pair.publicKey]))),
+                };
+            }
+            else if (!delegateInfo.requiresAnonymousDelegations && this.selfNeedsAnonymousDelegations) {
+                const fingerprintsOfVerifiedExchangeData = new Set(Object.keys(exchangeData.exchangeKey));
+                const delegateVerifiedKeys = {};
+                for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {
+                    const currFp = (0, utils_1.fingerprintV2)(keyHex);
+                    const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? 'sha-1' : 'sha-256';
+                    if (fingerprintsOfVerifiedExchangeData.has(currFp)) {
+                        delegateVerifiedKeys[currFp] = yield this.primitives.RSA.importKey('spki', (0, utils_2.hex2ua)(keyHex), ['encrypt'], shaVersion);
+                    }
+                }
+                if (!Object.keys(delegateVerifiedKeys).length)
+                    throw new Error('Illegal state: could not find any verified key for delegate in verified exchange data.');
+                return {
+                    explicitDelegate: delegateId,
+                    encryptedExchangeDataId: yield this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id, delegateVerifiedKeys),
+                };
+            }
+            else
+                return {};
+        });
+    }
+    makeExchangeDataIdInfoForSelf(selfId, exchangeData) {
+        if (this.selfNeedsAnonymousDelegations) {
+            return {};
+        }
+        else {
+            return {
+                exchangeDataId: exchangeData.id,
+                explicitDelegator: selfId,
+                explicitDelegate: selfId,
+            };
+        }
+    }
+    getDataOwnerInfo(dataOwnerId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.dataOwnerInfoCache.get(dataOwnerId, () => __awaiter(this, void 0, void 0, function* () {
+                const dataOwnerWithType = yield this.dataOwnerApi.getCryptoActorStub(dataOwnerId);
+                return {
+                    item: {
+                        requiresAnonymousDelegations: this.cryptoStrategies.dataOwnerRequiresAnonymousDelegation(dataOwnerWithType),
+                        availablePublicKeysHexWithSha1: Array.from((0, utils_1.hexPublicKeysWithSha1Of)(dataOwnerWithType.stub)),
+                        availablePublicKeysHexWithSha256: Array.from((0, utils_1.hexPublicKeysWithSha256Of)(dataOwnerWithType.stub)),
+                    },
+                };
+            }));
+        });
+    }
+    getExistingCanonicalKeyAndSecureDelegation(entity, hashes) {
+        var _a, _b, _c, _d, _e;
+        const securityMetadata = (_a = entity.securityMetadata) !== null && _a !== void 0 ? _a : {};
+        const canonicalByEquivalences = Array.from(new Set(hashes.flatMap((hash) => { var _a, _b; return (_b = (_a = securityMetadata.keysEquivalences) === null || _a === void 0 ? void 0 : _a[hash]) !== null && _b !== void 0 ? _b : []; })));
+        const directRetrievals = hashes.flatMap((hash) => {
+            var _a;
+            const retrievedMetadata = (_a = securityMetadata.secureDelegations) === null || _a === void 0 ? void 0 : _a[hash];
+            return retrievedMetadata ? { canonicalKey: hash, secureDelegation: retrievedMetadata } : [];
+        });
+        if (directRetrievals.length > 1 ||
+            canonicalByEquivalences.length > 1 ||
+            (!!canonicalByEquivalences[0] && !!((_b = directRetrievals[0]) === null || _b === void 0 ? void 0 : _b.canonicalKey) && canonicalByEquivalences[0] !== ((_c = directRetrievals[0]) === null || _c === void 0 ? void 0 : _c.canonicalKey)))
+            throw new Error('Illegal state: multiple secure delegations matching equivalent hashes of entity.');
+        const canonicalFromEquivalences = canonicalByEquivalences[0];
+        const retrievedFromEquivalences = (_d = securityMetadata.secureDelegations) === null || _d === void 0 ? void 0 : _d[canonicalFromEquivalences];
+        return ((_e = directRetrievals[0]) !== null && _e !== void 0 ? _e : (!!canonicalFromEquivalences && !!retrievedFromEquivalences
+            ? { canonicalKey: canonicalFromEquivalences, secureDelegation: retrievedFromEquivalences }
+            : undefined));
+    }
+}
+exports.SecureDelegationsManager = SecureDelegationsManager;
+//# sourceMappingURL=SecureDelegationsManager.js.map

package/icc-x-api/crypto/SecureDelegationsManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureDelegationsManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wFAAoF;AAKpF,oFAA6E;AAC7E,mCAA2F;AAK3F,oCAAyC;AAIzC,2EAAuE;AACvE,sHAAkH;AAClH,IAAO,mBAAmB,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;AAClF,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,2EAAuE;AAGvE,MAAa,wBAAwB;IACnC,YACmB,mBAAwC,EACxC,sBAA8C,EAC9C,2BAAwD,EACxD,wBAAkD,EAClD,QAAmC,EACnC,UAA4B,EAC5B,YAA8B,EAC9B,gBAAkC,EAClC,6BAAsC;QARtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,aAAQ,GAAR,QAAQ,CAA2B;QACnC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kCAA6B,GAA7B,6BAA6B,CAAS;QAGxC,uBAAkB,GAO/B,IAAI,oDAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IATvD,CAAC;IAWJ;;;;;;;;;;OAUG;IACG,sCAAsC,CAC1C,MAA2C,EAC3C,UAAwC,EACxC,SAAmB,EACnB,eAAyB,EACzB,cAAwB,EACxB,eAA2E;;YAE3E,MAAM,cAAc,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YAC5E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAC5D,cAAc,EACd,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAC/C,SAAS,EACT,cAAc,EACd,eAAe,EACf,eAAe,CAAC,KAAK,EACrB,SAAS,CACV,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,oBAAoB,GAMpB,EAAE,CAAA;YACR,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBACvE,IAAI,UAAU,KAAK,MAAM,EAAE;oBACzB,oBAAoB,CAAC,IAAI,CACvB,MAAM,IAAI,CAAC,wBAAwB,CACjC,cAAc,EACd,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,CAAC,sBAAsB,CAC1C,CACF,CAAA;iBACF;aACF;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC,CACpI,CAAA;YACD,MAAM,gBAAgB,qBACjB,kBAAkB,CAAC,yBAAyB,CAChD,CAAA;YACD,KAAK,MAAM,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,IAAI,oBAAoB,EAAE;gBACtF,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;aACtD;YACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,oBAAoB;iBACjB,MAAM,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;iBAClE,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,yBAAyB,EAAE,uBAAwB,CAAC,CAAC,CAC1H,CAAA;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAA;YAC7E,uCACK,MAAM,KACT,gBAAgB,EAAE,IAAI,mCAAgB,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,IAChF;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,8BAA8B,CAClC,cAAuC,EACvC,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;;YAExE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CAAA;YACD,MAAM,wBAAwB,GAAG,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC5H,IAAI,wBAAwB,EAAE;gBAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACrD,wBAAwB,CAAC,YAAY,EACrC,wBAAwB,CAAC,gBAAgB,EACzC,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;gBACD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;aAC3D;iBAAM;gBACL,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;gBACvB,OAAO;oBACL,KAAK,EAAE,MAAM,IAAI,CAAC,sBAAsB,CACtC,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,CACzB;iBACF,CAAA;aACF;;KACF;IAEa,uBAAuB,CACnC,YAAoB,EACpB,kBAAoC,EACpC,gBAAqG,EACrG,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAE9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC5I,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAC/G,CAAA;YACD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAChH,CAAA;YACD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAChG,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE;gBAChF,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACjI,MAAM,0BAA0B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBAChJ,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAC/F,kBAAkB,EAClB,gBAAgB,CAAC,WAAW,CAC7B,CAAA;gBACD,OAAO,IAAI,qEAAiC,CAAC;oBAC3C,yBAAyB,EAAE,YAAY;oBACvC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClG,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9G,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC/G,CAAC,CAAA;aACH;;gBAAM,OAAO,SAAS,CAAA;QACzB,CAAC;KAAA;IAEa,sBAAsB,CAClC,gBAAqG,EACrG,iBAA2B,EAC3B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;YAExE,OAAO,IAAI,uCAAkB,iCACxB,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,KAC1I,oBAAoB,EAAE,wBAAwB,EAC9C,iBAAiB,IACjB,CAAA;QACJ,CAAC;KAAA;IAEa,wBAAwB,CACpC,MAA+B,EAC/B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,WAA4B,EAC5B,mBAAuC;;;YAQvC,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CAAA;YACD,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;YACvB,MAAM,yBAAyB,GAAG,iBAAiB;iBAChD,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1C,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAE3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpD,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;YACrH,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAC1E,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC;gBACtC,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,iBAAiB;gBACrD,QAAQ,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,gBAAgB;gBACnD,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,SAAS;gBAC7C,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,eAAe,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,eAAe;gBACzD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1E,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAA;YACF,OAAO;gBACL,sBAAsB,EAAE,YAAY;gBACpC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,UAAU;gBACV,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,yBAAyB,EAAE,eAAe;aAC3C,CAAA;;KACF;IAEa,iCAAiC,CAC7C,gBAAqG,EACrG,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAU9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,kBAAkB,GACtB,UAAU,KAAK,MAAM;gBACnB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3E,CAAC,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;YACrG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,cAAc,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAChI,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC/I,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAClJ,uCACK,kBAAkB,KACrB,SAAS,EAAE,kBAAkB,EAC7B,cAAc,EAAE,uBAAuB,EACvC,eAAe,EAAE,wBAAwB,IAC1C;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,MAAc,EACd,UAAkB,EAClB,YAA0B;;YAO1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5D,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACrF,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,gBAAgB,EAAE,UAAU;oBAC5B,cAAc,EAAE,YAAY,CAAC,EAAE;iBAChC,CAAA;aACF;iBAAM,IAAI,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC3F,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CACnF,YAAY,CAAC,EAAG,EAChB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACxH;iBACF,CAAA;aACF;iBAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,IAAI,CAAC,6BAA6B,EAAE;gBAC3F,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;gBACzF,MAAM,oBAAoB,GAAgC,EAAE,CAAA;gBAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY,CAAC,8BAA8B,EAAE,GAAG,YAAY,CAAC,gCAAgC,CAAC,EAAE;oBACvH,MAAM,MAAM,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAA;oBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;oBACrG,IAAI,kCAAkC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;wBAClD,oBAAoB,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;qBACpH;iBACF;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM;oBAC3C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;gBAC3G,OAAO;oBACL,gBAAgB,EAAE,UAAU;oBAC5B,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAG,EAAE,oBAAoB,CAAC;iBAC9H,CAAA;aACF;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAEO,6BAA6B,CACnC,MAAc,EACd,YAA0B;QAO1B,IAAI,IAAI,CAAC,6BAA6B,EAAE;YACtC,OAAO,EAAE,CAAA;SACV;aAAM;YACL,OAAO;gBACL,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,iBAAiB,EAAE,MAAM;gBACzB,gBAAgB,EAAE,MAAM;aACzB,CAAA;SACF;IACH,CAAC;IAEa,gBAAgB,CAAC,WAAmB;;YAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAS,EAAE;gBACzD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACjF,OAAO;oBACL,IAAI,EAAE;wBACJ,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,iBAAiB,CAAC;wBAC3G,8BAA8B,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,+BAAuB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBAC3F,gCAAgC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,iCAAyB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;qBAChG;iBACF,CAAA;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;IAEO,0CAA0C,CAChD,MAA6C,EAC7C,MAAgB;;QAEhB,MAAM,gBAAgB,GAAG,MAAA,MAAM,CAAC,gBAAgB,mCAAI,EAAE,CAAA;QACtD,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,MAAA,MAAA,gBAAgB,CAAC,gBAAgB,0CAAG,IAAI,CAAC,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAC,CAAC,CAAA;QAC9H,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;;YAC/C,MAAM,iBAAiB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,IAAI,CAAC,CAAA;YACpE,OAAO,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7F,CAAC,CAAC,CAAA;QACF,IACE,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAC3B,uBAAuB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,IAAI,uBAAuB,CAAC,CAAC,CAAC,MAAK,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,CAAC;YAEzI,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;QACrG,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAA;QAC5D,MAAM,yBAAyB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,yBAAyB,CAAC,CAAA;QACjG,OAAO,CACL,MAAA,gBAAgB,CAAC,CAAC,CAAC,mCACnB,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,CAAC,yBAAyB;YACzD,CAAC,CAAC,EAAE,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE;YAC1F,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;IACH,CAAC;CACF;AA5ZD,4DA4ZC","sourcesContent":["import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { fingerprintV2, hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of } from './utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { hex2ua, ua2hex } from '../utils'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest'\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { EntitySharedMetadataUpdateRequest } from '../../icc-api/model/requests/EntitySharedMetadataUpdateRequest'\nimport EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecurityMetadata } from '../../icc-api/model/SecurityMetadata'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\n\nexport class SecureDelegationsManager {\n  constructor(\n    private readonly exchangeDataManager: ExchangeDataManager,\n    private readonly exchangeDataMapManager: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    private readonly userKeys: UserEncryptionKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly selfNeedsAnonymousDelegations: boolean\n  ) {}\n\n  private readonly dataOwnerInfoCache: LruTemporisedAsyncCache<\n    string,\n    {\n      requiresAnonymousDelegations: boolean\n      availablePublicKeysHexWithSha1: string[]\n      availablePublicKeysHexWithSha256: string[]\n    }\n  > = new LruTemporisedAsyncCache(100, () => 30 * 60 * 1000)\n\n  /**\n   * Note: this method does not save the updated entity.\n   * @param entity an entity, must already have secret foreign keys initialised.\n   * @param entityType the type of the entity\n   * @param secretIds the initial secret ids to include and share with the auto-delegations\n   * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations\n   * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations\n   * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level\n   * they will have on the entity.\n   * @return the entity with the security metadata initialised for the provided parameters.\n   */\n  async entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T & { secretForeignKeys: string[] },\n    entityType: EntityWithDelegationTypeName,\n    secretIds: string[],\n    owningEntityIds: string[],\n    encryptionKeys: string[],\n    autoDelegations: { [delegateId: string]: SecureDelegation.AccessLevelEnum }\n  ): Promise<T> {\n    const entityWithType: EncryptedEntityWithType = { entity, type: entityType }\n    const rootDelegationInfo = await this.makeSecureDelegationInfo(\n      entityWithType,\n      await this.dataOwnerApi.getCurrentDataOwnerId(),\n      secretIds,\n      encryptionKeys,\n      owningEntityIds,\n      AccessLevelEnum.WRITE,\n      undefined\n    )\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const otherDelegationsInfo: {\n      canonicalDelegationKey: string\n      canonicalAccessControlKey: string\n      delegation: SecureDelegation\n      delegationKeyEquivalences: { [p: string]: string }\n      encryptedExchangeDataId: { [fp: string]: string } | undefined\n    }[] = []\n    for (const [delegateId, permissions] of Object.entries(autoDelegations)) {\n      if (delegateId !== selfId) {\n        otherDelegationsInfo.push(\n          await this.makeSecureDelegationInfo(\n            entityWithType,\n            delegateId,\n            secretIds,\n            encryptionKeys,\n            owningEntityIds,\n            permissions,\n            rootDelegationInfo.canonicalDelegationKey\n          )\n        )\n      }\n    }\n    const secureDelegations = Object.fromEntries(\n      [rootDelegationInfo, ...otherDelegationsInfo].map(({ canonicalDelegationKey, delegation }) => [canonicalDelegationKey, delegation])\n    )\n    const keysEquivalences = {\n      ...rootDelegationInfo.delegationKeyEquivalences,\n    }\n    for (const { delegationKeyEquivalences: otherKeyEquivalences } of otherDelegationsInfo) {\n      Object.assign(keysEquivalences, otherKeyEquivalences)\n    }\n    const newExchangeDataMaps = Object.fromEntries(\n      otherDelegationsInfo\n        .filter(({ encryptedExchangeDataId }) => !!encryptedExchangeDataId)\n        .map(({ canonicalAccessControlKey, encryptedExchangeDataId }) => [canonicalAccessControlKey, encryptedExchangeDataId!])\n    )\n    await this.exchangeDataMapManager.createExchangeDataMaps(newExchangeDataMaps)\n    return {\n      ...entity,\n      securityMetadata: new SecurityMetadata({ secureDelegations, keysEquivalences }),\n    }\n  }\n\n  /**\n   * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or\n   * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation\n   * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to\n   * share the provided data.\n   * @param entityWithType an entity with type\n   * @param delegateId the id of the delegate\n   * @param shareSecretIds the secret ids to share\n   * @param shareEncryptionKeys the encryption keys to share\n   * @param shareOwningEntityIds the owning entity ids to share\n   * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an\n   * update request instead of a share request, this parameter is ignored.\n   * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update\n   * the entity to allow the delegate to access the provided data.\n   */\n  async makeShareOrUpdateRequestParams(\n    entityWithType: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareOrMetadataUpdateRequest | undefined> {\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? []\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? []\n    )\n    const existingSecureDelegation = this.getExistingCanonicalKeyAndSecureDelegation(entityWithType.entity, accessControlHashes)\n    if (existingSecureDelegation) {\n      const updateParams = await this.makeUpdateRequestParams(\n        existingSecureDelegation.canonicalKey,\n        existingSecureDelegation.secureDelegation,\n        exchangeDataInfo,\n        shareSecretIds,\n        shareEncryptionKeys,\n        shareOwningEntityIds\n      )\n      return updateParams ? { update: updateParams } : undefined\n    } else {\n      const accessControlKeys = (\n        await this.accessControlSecretUtils.accessControlKeysFor(\n          exchangeDataInfo.accessControlSecret,\n          entityWithType.type,\n          entityWithType.entity.secretForeignKeys ?? []\n        )\n      ).map((x) => ua2hex(x))\n      return {\n        share: await this.makeShareRequestParams(\n          exchangeDataInfo,\n          accessControlKeys,\n          delegateId,\n          shareSecretIds,\n          shareEncryptionKeys,\n          shareOwningEntityIds,\n          newDelegationPermissions\n        ),\n      }\n    }\n  }\n\n  private async makeUpdateRequestParams(\n    canonicalKey: string,\n    existingDelegation: SecureDelegation,\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<EntitySharedMetadataUpdateRequest | undefined> {\n    const existingSecretIds = new Set(await this.secureDelegationsEncryption.decryptSecretIds(existingDelegation, exchangeDataInfo.exchangeKey))\n    const existingEncryptionKeys = new Set(\n      await this.secureDelegationsEncryption.decryptEncryptionKeys(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const existingOwningEntityIds = new Set(\n      await this.secureDelegationsEncryption.decryptOwningEntityIds(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const newSecretIds = shareSecretIds.filter((id) => !existingSecretIds.has(id))\n    const newEncryptionKeys = shareEncryptionKeys.filter((key) => !existingEncryptionKeys.has(key))\n    const newOwningEntityIds = shareOwningEntityIds.filter((id) => !existingOwningEntityIds.has(id))\n    if (newSecretIds.length || newEncryptionKeys.length || newOwningEntityIds.length) {\n      const encryptedNewSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(newSecretIds, exchangeDataInfo.exchangeKey)\n      const encryptedNewEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(newEncryptionKeys, exchangeDataInfo.exchangeKey)\n      const encryptedNewOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(\n        newOwningEntityIds,\n        exchangeDataInfo.exchangeKey\n      )\n      return new EntitySharedMetadataUpdateRequest({\n        metadataAccessControlHash: canonicalKey,\n        secretIds: Object.fromEntries(encryptedNewSecretIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n        encryptionKeys: Object.fromEntries(encryptedNewEncryptionKeys.map((key) => [key, EntryUpdateTypeEnum.CREATE])),\n        owningEntityIds: Object.fromEntries(encryptedNewOwningEntityIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n      })\n    } else return undefined\n  }\n\n  private async makeShareRequestParams(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    accessControlKeys: string[],\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareRequest> {\n    return new EntityShareRequest({\n      ...(await this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds)),\n      requestedPermissions: newDelegationPermissions,\n      accessControlKeys,\n    })\n  }\n\n  private async makeSecureDelegationInfo(\n    entity: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    permissions: AccessLevelEnum,\n    parentDelegationKey: string | undefined\n  ): Promise<{\n    canonicalDelegationKey: string\n    canonicalAccessControlKey: string\n    delegation: SecureDelegation\n    encryptedExchangeDataId: { [fp: string]: string } | undefined\n    delegationKeyEquivalences: { [alias: string]: string }\n  }> {\n    // Be wary of explicit delegator and explicit delegate\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entity.type,\n      entity.entity.secretForeignKeys ?? []\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entity.type,\n      entity.entity.secretForeignKeys ?? []\n    )\n    const accessControlKeys = (\n      await this.accessControlSecretUtils.accessControlKeysFor(\n        exchangeDataInfo.accessControlSecret,\n        entity.type,\n        entity.entity.secretForeignKeys ?? []\n      )\n    ).map((x) => ua2hex(x))\n    const accessControlKeysToHashes = accessControlKeys\n      .map((key, index) => {\n        return [key, accessControlHashes[index]]\n      })\n      .sort((a, b) => a[1].localeCompare(b[1]))\n\n    const canonicalKey = accessControlKeysToHashes[0][1]\n    const keyEquivalences = Object.fromEntries(accessControlKeysToHashes.slice(1).map((hash) => [hash[1], canonicalKey]))\n    const encryptedDelegationInfo = await this.makeSecureDelegationEncryptedData(\n      exchangeDataInfo,\n      delegateId,\n      shareSecretIds,\n      shareEncryptionKeys,\n      shareOwningEntityIds\n    )\n    const delegation = new SecureDelegation({\n      delegator: encryptedDelegationInfo?.explicitDelegator,\n      delegate: encryptedDelegationInfo?.explicitDelegate,\n      secretIds: encryptedDelegationInfo?.secretIds,\n      encryptionKeys: encryptedDelegationInfo?.encryptionKeys,\n      owningEntityIds: encryptedDelegationInfo?.owningEntityIds,\n      parentDelegations: parentDelegationKey ? [parentDelegationKey] : undefined,\n      exchangeDataId: encryptedDelegationInfo?.exchangeDataId,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      permissions: permissions,\n    })\n    return {\n      canonicalDelegationKey: canonicalKey,\n      canonicalAccessControlKey: accessControlKeysToHashes[0][0],\n      delegation,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      delegationKeyEquivalences: keyEquivalences,\n    }\n  }\n\n  private async makeSecureDelegationEncryptedData(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<{\n    explicitDelegator?: string\n    explicitDelegate?: string\n    secretIds?: string[]\n    encryptionKeys?: string[]\n    owningEntityIds?: string[]\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string } // TODO if secure delegation info, check cache before calculating\n  }> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const exchangeDataIdInfo =\n      delegateId === selfId\n        ? this.makeExchangeDataIdInfoForSelf(selfId, exchangeDataInfo.exchangeData)\n        : await this.makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeDataInfo.exchangeData)\n    const encryptedSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(shareSecretIds, exchangeDataInfo.exchangeKey)\n    const encryptedEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(shareEncryptionKeys, exchangeDataInfo.exchangeKey)\n    const encryptedOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(shareOwningEntityIds, exchangeDataInfo.exchangeKey)\n    return {\n      ...exchangeDataIdInfo,\n      secretIds: encryptedSecretIds,\n      encryptionKeys: encryptedEncryptionKeys,\n      owningEntityIds: encryptedOwningEntityIds,\n    }\n  }\n\n  private async makeExchangeDataIdInfoForDelegate(\n    selfId: string,\n    delegateId: string,\n    exchangeData: ExchangeData\n  ): Promise<{\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  }> {\n    const delegateInfo = await this.getDataOwnerInfo(delegateId)\n    if (!delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        explicitDelegate: delegateId,\n        exchangeDataId: exchangeData.id,\n      }\n    } else if (delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(\n          exchangeData.id!,\n          Object.fromEntries(this.userKeys.getSelfVerifiedKeys().map((keyInfo) => [keyInfo.fingerprint, keyInfo.pair.publicKey]))\n        ),\n      }\n    } else if (!delegateInfo.requiresAnonymousDelegations && this.selfNeedsAnonymousDelegations) {\n      const fingerprintsOfVerifiedExchangeData = new Set(Object.keys(exchangeData.exchangeKey))\n      const delegateVerifiedKeys: { [fp: string]: CryptoKey } = {}\n      for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {\n        const currFp = fingerprintV2(keyHex)\n        const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? 'sha-1' : 'sha-256'\n        if (fingerprintsOfVerifiedExchangeData.has(currFp)) {\n          delegateVerifiedKeys[currFp] = await this.primitives.RSA.importKey('spki', hex2ua(keyHex), ['encrypt'], shaVersion)\n        }\n      }\n      if (!Object.keys(delegateVerifiedKeys).length)\n        throw new Error('Illegal state: could not find any verified key for delegate in verified exchange data.')\n      return {\n        explicitDelegate: delegateId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id!, delegateVerifiedKeys),\n      }\n    } else return {}\n  }\n\n  private makeExchangeDataIdInfoForSelf(\n    selfId: string,\n    exchangeData: ExchangeData\n  ): {\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  } {\n    if (this.selfNeedsAnonymousDelegations) {\n      return {}\n    } else {\n      return {\n        exchangeDataId: exchangeData.id,\n        explicitDelegator: selfId,\n        explicitDelegate: selfId,\n      }\n    }\n  }\n\n  private async getDataOwnerInfo(dataOwnerId: string) {\n    return this.dataOwnerInfoCache.get(dataOwnerId, async () => {\n      const dataOwnerWithType = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n      return {\n        item: {\n          requiresAnonymousDelegations: this.cryptoStrategies.dataOwnerRequiresAnonymousDelegation(dataOwnerWithType),\n          availablePublicKeysHexWithSha1: Array.from(hexPublicKeysWithSha1Of(dataOwnerWithType.stub)),\n          availablePublicKeysHexWithSha256: Array.from(hexPublicKeysWithSha256Of(dataOwnerWithType.stub)),\n        },\n      }\n    })\n  }\n\n  private getExistingCanonicalKeyAndSecureDelegation(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    hashes: string[]\n  ): { canonicalKey: string; secureDelegation: SecureDelegation } | undefined {\n    const securityMetadata = entity.securityMetadata ?? {}\n    const canonicalByEquivalences = Array.from(new Set(hashes.flatMap((hash) => securityMetadata.keysEquivalences?.[hash] ?? [])))\n    const directRetrievals = hashes.flatMap((hash) => {\n      const retrievedMetadata = securityMetadata.secureDelegations?.[hash]\n      return retrievedMetadata ? { canonicalKey: hash, secureDelegation: retrievedMetadata } : []\n    })\n    if (\n      directRetrievals.length > 1 ||\n      canonicalByEquivalences.length > 1 ||\n      (!!canonicalByEquivalences[0] && !!directRetrievals[0]?.canonicalKey && canonicalByEquivalences[0] !== directRetrievals[0]?.canonicalKey)\n    )\n      throw new Error('Illegal state: multiple secure delegations matching equivalent hashes of entity.')\n    const canonicalFromEquivalences = canonicalByEquivalences[0]\n    const retrievedFromEquivalences = securityMetadata.secureDelegations?.[canonicalFromEquivalences]\n    return (\n      directRetrievals[0] ??\n      (!!canonicalFromEquivalences && !!retrievedFromEquivalences\n        ? { canonicalKey: canonicalFromEquivalences, secureDelegation: retrievedFromEquivalences }\n        : undefined)\n    )\n  }\n}\n"]}