@icure/api 7.1.4 → 7.1.6

package/README.md

@@ -0,0 +1,75 @@
+# Crypto model in iCure
+
+## Lexic
+
+- `"ABCD"` is a **non** encrypted key (uuid, ...)
+- `{AB}` is the encryption key of the pair `AB`, where hcParty `A` gives delegation to hcParty `B`.
+  The encryption key is stored encrypted in the hcPartyKeys of hcParty `A` document (see below)
+- `<ABCD>_{AB}` is the key `ABCD` encrypted with encryption key `{AB}`
+- `<{AB}>_{A}` is the encryption key `{AB}` encrypted with the public key of hcParty `A`
+
+The encryption keys are stored in the hcParty document that gives delegation to other user, since only the user can modify his hcParty document in CouchDB.
+The hcParty `B` needs to access the hcParty `A` document to decrypt (with his private key) the encryption key `{AB}` stored in the field hcPartyKeys.
+
+```
+## HCP A ##
+hcPartyKeys: {
+   A: [ <{AA}>_{A}, <{AA}>_{A} ]
+   B: [ <{AB}>_{A}, <{AB}>_{B} ]
+}
+```
+
+## Document type relations
+
+```
+## Patient 1234 ##
+ID: "1234"
+Delegations: { A->A: <ABCD>_{AA}, A->B: <ABCD>_{AB} }
+EncryptionKeys: { A->A: <DCBA>_{AA}, A->B: <DCBA>_{AB} }
+```
+
+```
+## Contact 4567 ##
+ID: "4567"
+SecretForeignKeys: [ "ABCD" ]
+CryptedForeignKeys: { A->A: <1234>_{AA}, A->B: <1234>_{AB} }
+EncryptionKeys: { A->A: <EFGH>_{AA}, A->B: <EFGH>_{AB} }
+```
+
+The **delegations** of the **patient** document store the encrypted secretForeignKeys that you find in clear in the **contact** document. And allows, once decrypted, to find the contacts of a patient.
+
+On the other side, the **cryptedForeignKeys** of the **contact** document allows, once decrypted, to find the corresponding **patient** document.
+
+The **encryptionKeys** of a document are used to encrypt the content of the corresponding document. As for the delegations, the document encryption keys are stored encrypted with the encryption keys `{AA}`, `{AB}`, ...
+
+The **healthElement** documents are linked to patient documents in the same way as the contact. This means that the healthElement documents have also **SecretForeignKeys** and **CryptedForeignKeys**, beside the **encryptionKeys**.
+
+## Delegations
+
+- Delegations === encrypted foreign key of all patient icureStoredDocument => it makes the link from a patient to a storedDocument
+- CryptedForeignKeys === encrypted patient.ID => it makes the link from a storedDocument to a patient
+- EncryptionKeys === encrypted encryptionKey (probably symmetric)
+
+## Multi profession
+
+Contacts and delegations need to be segmented.
+=> need to have segmented auto-delegations
+
+# Usage
+
+## Instalation
+
+Install from npm
+
+```
+npm install --save icc-api
+```
+
+## ES6 import
+
+Example
+ES6 include
+
+```javaScript
+import * as IccApi from 'icc-api'
+```

package/apidocs/.swagger-codegen-ignore

@@ -0,0 +1,23 @@
+# Swagger Codegen Ignore
+# Generated by swagger-codegen https://github.com/swagger-api/swagger-codegen
+
+# Use this file to prevent files from being overwritten by the generator.
+# The patterns follow closely to .gitignore or .dockerignore.
+
+# As an example, the C# client generator defines ApiClient.cs.
+# You can make changes and tell Swagger Codgen to ignore just this file by uncommenting the following line:
+#ApiClient.cs
+
+# You can match any string of characters against a directory, file or extension with a single asterisk (*):
+#foo/*/qux
+# The above matches foo/bar/qux and foo/baz/qux, but not foo/bar/baz/qux
+
+# You can recursively match patterns against a directory, file or extension with a double asterisk (**):
+#foo/**/qux
+# This matches foo/bar/qux, foo/baz/qux, and foo/bar/baz/qux
+
+# You can also negate patterns with an exclamation (!).
+# For example, you can ignore all files in a docs folder with the file extension .md:
+#docs/*.md
+# Then explicitly reverse the ignore rule for a single file:
+#!docs/README.md

package/ci/cloudbuild.yaml

@@ -0,0 +1,16 @@
+steps:
+  - name: 'gcr.io/cloud-builders/git'
+    entrypoint: 'bash'
+    args:
+      ['-c', 'git fetch --unshallow --tags && git checkout ${BRANCH_NAME} && git describe --tags --abbrev=10 --dirty --always --long > .gitversion']
+
+  - name: 'gcr.io/cloud-builders/docker'
+    args: ['login', 'docker.taktik.be', '--username', '${_REPO_USERNAME}', '--password', '${_REPO_PASSWORD}']
+
+  - name: 'docker'
+    entrypoint: 'sh'
+    args: ['-c', 'v=$(cat .gitversion) && tag="docker.taktik.be/lutaplanning:$v" && docker build . -t $tag && docker push $tag']
+
+options:
+  machineType: 'N1_HIGHCPU_8'
+timeout: 1800s

package/dist/icc-x-api/auth/JwtAuthService.d.ts

@@ -0,0 +1,27 @@
+import { AuthService } from './AuthService';
+import { XHR } from '../../icc-api/api/XHR';
+import { IccAuthApi } from '../../icc-api';
+import Header = XHR.Header;
+/**
+ * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens
+ */
+export declare class JwtAuthService implements AuthService {
+    private readonly authApi;
+    private _error;
+    private _currentPromise;
+    constructor(authApi: IccAuthApi, initialJwt?: {
+        authJwt: string;
+        refreshJwt: string;
+    });
+    get refreshToken(): Promise<string | undefined>;
+    getIcureTokens(): Promise<{
+        token: string;
+        refreshToken: string;
+    } | undefined>;
+    getAuthHeaders(): Promise<Array<Header>>;
+    private _refreshAuthJwt;
+    private _isJwtExpired;
+    private _base64Decode;
+    invalidateHeader(error: Error): void;
+    isInErrorState(): boolean;
+}

package/dist/icc-x-api/auth/JwtAuthService.js

@@ -0,0 +1,95 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthService = void 0;
+const XHR_1 = require("../../icc-api/api/XHR");
+const utils_1 = require("../utils");
+/**
+ * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens
+ */
+class JwtAuthService {
+    constructor(authApi, initialJwt) {
+        this.authApi = authApi;
+        this._error = null;
+        this._currentPromise = Promise.resolve(undefined);
+        if (!!initialJwt) {
+            this._currentPromise = Promise.resolve(initialJwt);
+        }
+    }
+    get refreshToken() {
+        return this._currentPromise.then((x) => x === null || x === void 0 ? void 0 : x.refreshJwt);
+    }
+    getIcureTokens() {
+        return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined));
+    }
+    getAuthHeaders() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this._currentPromise
+                .then((x) => {
+                const authJwt = x === null || x === void 0 ? void 0 : x.authJwt;
+                const refreshJwt = x === null || x === void 0 ? void 0 : x.refreshJwt;
+                if ((!authJwt || this._isJwtExpired(authJwt)) && refreshJwt) {
+                    // If it does not have the JWT, tries to get it
+                    // If the JWT is expired, tries to refresh it
+                    this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {
+                        // If here the token is null,
+                        // it goes in a suspension status
+                        if (!updatedTokens.authJwt) {
+                            throw new Error('Your iCure back-end version does not support JWT authentication');
+                        }
+                        return updatedTokens;
+                    });
+                }
+                else if (!!this._error) {
+                    throw this._error;
+                }
+                return this._currentPromise;
+            })
+                .then((x) => {
+                return (x === null || x === void 0 ? void 0 : x.authJwt) ? [new XHR_1.XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT');
+            });
+        });
+    }
+    _refreshAuthJwt(refreshJwt) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // If I do not have a refresh JWT or the refresh JWT is expired,
+            // I have to log in again
+            if (this._isJwtExpired(refreshJwt)) {
+                throw Error('Missing or expired refresh token: please log in again');
+            }
+            else {
+                return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({
+                    authJwt: refreshResponse.token,
+                    refreshJwt: refreshJwt,
+                }));
+            }
+        });
+    }
+    _isJwtExpired(jwt) {
+        const parts = jwt.split('.');
+        if (parts.length !== 3) {
+            return false;
+        }
+        const payload = this._base64Decode(parts[1]);
+        return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime();
+    }
+    _base64Decode(encodedString) {
+        return JSON.parse((0, utils_1.a2b)(encodedString));
+    }
+    invalidateHeader(error) {
+        this._error = error;
+    }
+    isInErrorState() {
+        return !!this._error;
+    }
+}
+exports.JwtAuthService = JwtAuthService;
+//# sourceMappingURL=JwtAuthService.js.map

package/dist/icc-x-api/auth/JwtAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAI3C,oCAA8B;AAI9B;;GAEG;AACH,MAAa,cAAc;IAIzB,YAA6B,OAAmB,EAAE,UAAoD;QAAzE,YAAO,GAAP,OAAO,CAAY;QAHxC,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAiE,OAAO,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAA;QAGvH,IAAI,CAAC,CAAC,UAAU,EAAE;YAChB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;SACnD;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAiB,CAAC,CAAA;IAC/D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7G,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gBAC1B,MAAM,UAAU,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA;gBAEhC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,EAAE;oBAC3D,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAC,CAAC,CAAC,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAC9H,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAAkB;;YAC9C,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;gBAClC,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;aACrE;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAM;oBAC/B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,KAAK,CAAA;SACb;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAhFD,wCAgFC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\n/**\n * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens\n */\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)\n\n  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {\n    if (!!initialJwt) {\n      this._currentPromise = Promise.resolve(initialJwt)\n    }\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x?.refreshJwt as any)\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then((x) => {\n        const authJwt = x?.authJwt\n        const refreshJwt = x?.refreshJwt\n\n        if ((!authJwt || this._isJwtExpired(authJwt)) && refreshJwt) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then((x) => {\n        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (this._isJwtExpired(refreshJwt)) {\n      throw Error('Missing or expired refresh token: please log in again')\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token!,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private _isJwtExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return false\n    }\n    const payload = this._base64Decode(parts[1])\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/dist/icc-x-api/auth/JwtBridgedAuthService.d.ts

@@ -0,0 +1,30 @@
+import { AuthService } from './AuthService';
+import { XHR } from '../../icc-api/api/XHR';
+import { IccAuthApi } from '../../icc-api';
+import Header = XHR.Header;
+/**
+ * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired
+ */
+export declare class JwtBridgedAuthService implements AuthService {
+    private authApi;
+    private username;
+    private password;
+    private thirdPartyTokens;
+    private _error;
+    private _currentPromise;
+    constructor(authApi: IccAuthApi, username: string, password: string, thirdPartyTokens?: {
+        [thirdParty: string]: string;
+    });
+    get refreshToken(): Promise<string | undefined>;
+    getIcureTokens(): Promise<{
+        token: string;
+        refreshToken: string;
+    } | undefined>;
+    getAuthHeaders(): Promise<Array<Header>>;
+    private _refreshAuthJwt;
+    private _loginAndGetTokens;
+    private _isJwtExpired;
+    private _base64Decode;
+    invalidateHeader(error: Error): void;
+    isInErrorState(): boolean;
+}

package/dist/icc-x-api/auth/JwtBridgedAuthService.js

@@ -0,0 +1,134 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtBridgedAuthService = void 0;
+const XHR_1 = require("../../icc-api/api/XHR");
+const LoginCredentials_1 = require("../../icc-api/model/LoginCredentials");
+const utils_1 = require("../utils");
+var XHRError = XHR_1.XHR.XHRError;
+/**
+ * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired
+ */
+class JwtBridgedAuthService {
+    constructor(authApi, username, password, thirdPartyTokens = {}) {
+        this.authApi = authApi;
+        this.username = username;
+        this.password = password;
+        this.thirdPartyTokens = thirdPartyTokens;
+        this._error = null;
+        this._currentPromise = Promise.resolve({});
+    }
+    get refreshToken() {
+        return this._currentPromise.then((x) => x.refreshJwt);
+    }
+    getIcureTokens() {
+        return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt, refreshToken: refreshJwt })));
+    }
+    getAuthHeaders() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this._currentPromise
+                .then(({ authJwt, refreshJwt }) => {
+                if (!authJwt || this._isJwtExpired(authJwt)) {
+                    // If it does not have the JWT, tries to get it
+                    // If the JWT is expired, tries to refresh it
+                    this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {
+                        // If here the token is null,
+                        // it goes in a suspension status
+                        if (!updatedTokens.authJwt) {
+                            throw new Error('Your iCure back-end version does not support JWT authentication');
+                        }
+                        return updatedTokens;
+                    });
+                }
+                else if (!!this._error) {
+                    throw this._error;
+                }
+                return this._currentPromise;
+            })
+                .then(({ authJwt }) => {
+                return [new XHR_1.XHR.Header('Authorization', `Bearer ${authJwt}`)];
+            });
+        });
+    }
+    _refreshAuthJwt(refreshJwt) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // If I do not have a refresh JWT or the refresh JWT is expired,
+            // I have to log in again
+            if (!refreshJwt || this._isJwtExpired(refreshJwt)) {
+                return this._loginAndGetTokens();
+            }
+            else {
+                return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({
+                    authJwt: refreshResponse.token,
+                    refreshJwt: refreshJwt,
+                }));
+            }
+        });
+    }
+    _loginAndGetTokens() {
+        return __awaiter(this, void 0, void 0, function* () {
+            let authResponse;
+            let firstError;
+            if (this.username && this.password) {
+                try {
+                    authResponse = yield this.authApi.login(new LoginCredentials_1.LoginCredentials({
+                        username: this.username,
+                        password: this.password,
+                    }));
+                }
+                catch (e) {
+                    firstError = e;
+                }
+            }
+            if (!authResponse) {
+                authResponse = yield Object.entries(this.thirdPartyTokens).reduce((acc, [thirdParty, token]) => __awaiter(this, void 0, void 0, function* () {
+                    const prev = yield acc;
+                    return (prev !== null && prev !== void 0 ? prev : (token
+                        ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {
+                            if (!firstError) {
+                                firstError = e;
+                            }
+                            return Promise.resolve();
+                        })
+                        : undefined));
+                }), Promise.resolve());
+            }
+            if (!authResponse) {
+                if (firstError)
+                    throw firstError;
+                throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers());
+            }
+            return {
+                authJwt: authResponse.token,
+                refreshJwt: authResponse.refreshToken,
+            };
+        });
+    }
+    _isJwtExpired(jwt) {
+        const parts = jwt.split('.');
+        if (parts.length !== 3) {
+            return false;
+        }
+        const payload = this._base64Decode(parts[1]);
+        return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime();
+    }
+    _base64Decode(encodedString) {
+        return JSON.parse((0, utils_1.a2b)(encodedString));
+    }
+    invalidateHeader(error) {
+        this._error = error;
+    }
+    isInErrorState() {
+        return !!this._error;
+    }
+}
+exports.JwtBridgedAuthService = JwtBridgedAuthService;
+//# sourceMappingURL=JwtBridgedAuthService.js.map

package/dist/icc-x-api/auth/JwtBridgedAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtBridgedAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtBridgedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B;;GAEG;AACH,MAAa,qBAAqB;IAIhC,YACU,OAAmB,EACnB,QAAgB,EAChB,QAAgB,EAChB,mBAAqD,EAAE;QAHvD,YAAO,GAAP,OAAO,CAAY;QACnB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,qBAAgB,GAAhB,gBAAgB,CAAuC;QAPzD,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAO9F,CAAC;IAEJ,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAiB,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAQ,EAAE,YAAY,EAAE,UAAW,EAAE,CAAC,CAAC,CAAC,CAAA;IACnJ,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE;oBAC3C,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;gBACjD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,IAAI,YAAgD,CAAA;YACpD,IAAI,UAAgC,CAAA;YACpC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI;oBACF,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,IAAI,mCAAgB,CAAC;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CACH,CAAA;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,UAAU,GAAG,CAAa,CAAA;iBAC3B;aACF;YACD,IAAI,CAAC,YAAY,EAAE;gBACjB,YAAY,GAAG,MAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAiC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE;oBACpI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAA;oBACtB,OAAO,CACL,IAAI,aAAJ,IAAI,cAAJ,IAAI,GACJ,CAAC,KAAK;wBACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;4BACnE,IAAI,CAAC,UAAU,EAAE;gCACf,UAAU,GAAG,CAAa,CAAA;6BAC3B;4BACD,OAAO,OAAO,CAAC,OAAO,EAAwB,CAAA;wBAChD,CAAC,CAAC;wBACJ,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;gBACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAiD,CAAC,CAAA;aACrE;YAED,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,UAAU;oBAAE,MAAM,UAAU,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;aAC5E;YAED,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAA;QACH,CAAC;KAAA;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,KAAK,CAAA;SACb;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAxHD,sDAwHC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\n/**\n * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired\n */\nexport class JwtBridgedAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(\n    private authApi: IccAuthApi,\n    private username: string,\n    private password: string,\n    private thirdPartyTokens: { [thirdParty: string]: string } = {}\n  ) {}\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x.refreshJwt as any)\n  }\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then(({ authJwt }) => {\n        return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    let authResponse: AuthenticationResponse | undefined\n    let firstError: XHRError | undefined\n    if (this.username && this.password) {\n      try {\n        authResponse = await this.authApi.login(\n          new LoginCredentials({\n            username: this.username,\n            password: this.password,\n          })\n        )\n      } catch (e) {\n        firstError = e as XHRError\n      }\n    }\n    if (!authResponse) {\n      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {\n        const prev = await acc\n        return (\n          prev ??\n          (token\n            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {\n                if (!firstError) {\n                  firstError = e as XHRError\n                }\n                return Promise.resolve() as Promise<undefined>\n              })\n            : undefined)\n        )\n      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)\n    }\n\n    if (!authResponse) {\n      if (firstError) throw firstError\n      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())\n    }\n\n    return {\n      authJwt: authResponse.token,\n      refreshJwt: authResponse.refreshToken,\n    }\n  }\n\n  private _isJwtExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return false\n    }\n    const payload = this._base64Decode(parts[1])\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/dist/icc-x-api/crypto/utils.d.ts

@@ -0,0 +1,47 @@
+import { StronglyConnectedGraph } from '../utils/graph-utils';
+import { DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api';
+import { RSAUtils } from './RSA';
+import { EntitiesEncryption } from './EntitiesEncryption';
+import { CryptoPrimitives } from './CryptoPrimitives';
+import { DataOwnerWithType, EncryptedEntityStub } from '../../icc-api/model/models';
+import { IccPatientApi } from '../../icc-api';
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get the public keys of a data owner, same as {@link IccDataOwnerXApi.getHexPublicKeysOf}.
+ * @param dataOwner
+ */
+export declare function hexPublicKeysOf(dataOwner: DataOwnerOrStub): Set<string>;
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get the transfer key graph for a data owner. Node names are the public key fingerprints of the data owner's keys, and an edge represents a key
+ * which can be retrieved from another key using the transfer keys.
+ * @param dataOwner a data owner.
+ * @return a graph representing the possible key recovery paths using transfer keys for hte provided data owner.
+ */
+export declare function transferKeysFpGraphOf(dataOwner: DataOwnerOrStub): StronglyConnectedGraph;
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get a map for converting public keys fingerprint to full public keys for the provided data owner.
+ * @param dataOwner a data owner.
+ * @return a map to convert fingerprints of the data owner into full public keys.
+ */
+export declare function fingerprintToPublicKeysMapOf(dataOwner: DataOwnerOrStub): {
+    [fp: string]: string;
+};
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Load many public keys in spki format.
+ * @param rsa the rsa service
+ * @param publicKeysSpkiHex public keys in spki format, hex encoded.
+ * @return public keys as crypto keys by their fingerprint.
+ */
+export declare function loadPublicKeys(rsa: RSAUtils, publicKeysSpkiHex: string[]): Promise<{
+    [publicKeyFingerprint: string]: CryptoKey;
+}>;
+/**
+ * @internal This method is intended only for internal use and may be changed without notice.
+ * Creates a delegation for the current data owner if the data owner is an encrypted entity and there is no delegation to himself.
+ * @return the updated self.
+ */
+export declare function ensureDelegationForSelf(dataOwnerApi: IccDataOwnerXApi, entitiesEncryption: EntitiesEncryption, cryptoPrimitives: CryptoPrimitives, basePatientApi: IccPatientApi): Promise<DataOwnerWithType>;
+export declare function encryptedStubEquals(a: EncryptedEntityStub, b: EncryptedEntityStub): boolean;

package/dist/icc-x-api/crypto/utils.js

@@ -0,0 +1,127 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptedStubEquals = exports.ensureDelegationForSelf = exports.loadPublicKeys = exports.fingerprintToPublicKeysMapOf = exports.transferKeysFpGraphOf = exports.hexPublicKeysOf = void 0;
+// Uses fp as node names
+const graph_utils_1 = require("../utils/graph-utils");
+const utils_1 = require("../utils");
+const collection_utils_1 = require("../utils/collection-utils");
+const DataOwnerTypeEnum_1 = require("../../icc-api/model/DataOwnerTypeEnum");
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get the public keys of a data owner, same as {@link IccDataOwnerXApi.getHexPublicKeysOf}.
+ * @param dataOwner
+ */
+function hexPublicKeysOf(dataOwner) {
+    var _a;
+    return new Set([dataOwner.publicKey, ...Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})].filter((pubKey) => !!pubKey));
+}
+exports.hexPublicKeysOf = hexPublicKeysOf;
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get the transfer key graph for a data owner. Node names are the public key fingerprints of the data owner's keys, and an edge represents a key
+ * which can be retrieved from another key using the transfer keys.
+ * @param dataOwner a data owner.
+ * @return a graph representing the possible key recovery paths using transfer keys for hte provided data owner.
+ */
+function transferKeysFpGraphOf(dataOwner) {
+    var _a;
+    const publicKeys = Array.from(hexPublicKeysOf(dataOwner));
+    const edges = [];
+    Object.entries((_a = dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {}).forEach(([from, tos]) => {
+        Object.keys(tos).forEach((to) => {
+            edges.push([from.slice(-32), to.slice(-32)]);
+        });
+    });
+    return (0, graph_utils_1.acyclic)((0, graph_utils_1.graphFromEdges)(edges, publicKeys.map((x) => x.slice(-32))));
+}
+exports.transferKeysFpGraphOf = transferKeysFpGraphOf;
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get a map for converting public keys fingerprint to full public keys for the provided data owner.
+ * @param dataOwner a data owner.
+ * @return a map to convert fingerprints of the data owner into full public keys.
+ */
+function fingerprintToPublicKeysMapOf(dataOwner) {
+    const publicKeys = Array.from(hexPublicKeysOf(dataOwner));
+    const res = {};
+    publicKeys.forEach((pk) => {
+        res[pk.slice(-32)] = pk;
+    });
+    return res;
+}
+exports.fingerprintToPublicKeysMapOf = fingerprintToPublicKeysMapOf;
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Load many public keys in spki format.
+ * @param rsa the rsa service
+ * @param publicKeysSpkiHex public keys in spki format, hex encoded.
+ * @return public keys as crypto keys by their fingerprint.
+ */
+function loadPublicKeys(rsa, publicKeysSpkiHex) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return Object.fromEntries(yield Promise.all(publicKeysSpkiHex.map((x) => __awaiter(this, void 0, void 0, function* () { return [x.slice(-32), yield rsa.importKey('spki', (0, utils_1.hex2ua)(x), ['encrypt'])]; }))));
+    });
+}
+exports.loadPublicKeys = loadPublicKeys;
+/**
+ * @internal This method is intended only for internal use and may be changed without notice.
+ * Creates a delegation for the current data owner if the data owner is an encrypted entity and there is no delegation to himself.
+ * @return the updated self.
+ */
+function ensureDelegationForSelf(dataOwnerApi, entitiesEncryption, cryptoPrimitives, basePatientApi) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function* () {
+        const self = yield dataOwnerApi.getCurrentDataOwner();
+        if (self.type === DataOwnerTypeEnum_1.DataOwnerTypeEnum.Patient) {
+            const patient = self.dataOwner;
+            const availableSecretIds = yield entitiesEncryption.secretIdsOf(patient);
+            if (availableSecretIds.length) {
+                return self;
+            }
+            else {
+                const updatedPatient = Object.entries((_a = patient.encryptionKeys) !== null && _a !== void 0 ? _a : {}).length || Object.entries((_b = patient.delegations) !== null && _b !== void 0 ? _b : {}).length
+                    ? yield entitiesEncryption.entityWithExtendedEncryptedMetadata(
+                    // If there is already something initialise only a new delegation to self
+                    patient, patient.id, [cryptoPrimitives.randomUuid()], [], []) // else initialise also encryption keys
+                    : yield entitiesEncryption.entityWithInitialisedEncryptedMetadata(patient, undefined, undefined, true).then((x) => x.updatedEntity);
+                return yield basePatientApi.modifyPatient(updatedPatient).then((x) => ({ dataOwner: x, type: DataOwnerTypeEnum_1.DataOwnerTypeEnum.Patient }));
+            }
+        }
+        else {
+            return self;
+        }
+    });
+}
+exports.ensureDelegationForSelf = ensureDelegationForSelf;
+function encryptedStubEquals(a, b) {
+    if (!delegationLikeEquality(a.delegations, b.delegations))
+        return false;
+    if (!delegationLikeEquality(a.encryptionKeys, b.encryptionKeys))
+        return false;
+    if (!delegationLikeEquality(a.cryptedForeignKeys, b.cryptedForeignKeys))
+        return false;
+    if (!(0, collection_utils_1.setEquals)(new Set(a.secretForeignKeys), new Set(b.secretForeignKeys)))
+        return false;
+    return a.encryptedSelf === b.encryptedSelf;
+}
+exports.encryptedStubEquals = encryptedStubEquals;
+function delegationLikeEquality(a, b) {
+    if (!(0, collection_utils_1.setEquals)(new Set(Object.keys(a !== null && a !== void 0 ? a : {})), new Set(Object.keys(b !== null && b !== void 0 ? b : {}))))
+        return false;
+    for (const [k, aDelegations] of Object.entries(a !== null && a !== void 0 ? a : {})) {
+        const bDelegations = (b !== null && b !== void 0 ? b : {})[k];
+        if (!aDelegations.every((da) => !!bDelegations.find((db) => da.key === db.key && da.delegatedTo === db.delegatedTo && da.owner === db.owner && (0, collection_utils_1.setEquals)(new Set(da.tags), new Set(db.tags)))))
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=utils.js.map

package/dist/icc-x-api/crypto/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/utils.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wBAAwB;AACxB,sDAAsF;AAGtF,oCAAiC;AAOjC,gEAAqD;AACrD,6EAAyE;AAIzE;;;;GAIG;AACH,SAAgB,eAAe,CAAC,SAA0B;;IACxD,OAAO,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,SAAS,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAa,CAAC,CAAA;AACjI,CAAC;AAFD,0CAEC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,SAA0B;;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAA;IACzD,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,MAAM,CAAC,OAAO,CAAC,MAAA,SAAS,CAAC,YAAY,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;QACnE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,IAAA,qBAAO,EACZ,IAAA,4BAAc,EACZ,KAAK,EACL,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CACpC,CACF,CAAA;AACH,CAAC;AAdD,sDAcC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B,CAAC,SAA0B;IACrE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAA;IACzD,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QACxB,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;IACzB,CAAC,CAAC,CAAA;IACF,OAAO,GAAG,CAAA;AACZ,CAAC;AAPD,oEAOC;AAED;;;;;;GAMG;AACH,SAAsB,cAAc,CAAC,GAAa,EAAE,iBAA2B;;QAC7E,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAO,CAAC,EAAE,EAAE,gDAAC,OAAA,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA,GAAA,CAAC,CAAC,CAC3H,CAAA;IACH,CAAC;CAAA;AAJD,wCAIC;AAED;;;;GAIG;AACH,SAAsB,uBAAuB,CAC3C,YAA8B,EAC9B,kBAAsC,EACtC,gBAAkC,EAClC,cAA6B;;;QAE7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,mBAAmB,EAAE,CAAA;QACrD,IAAI,IAAI,CAAC,IAAI,KAAK,qCAAiB,CAAC,OAAO,EAAE;YAC3C,MAAM,OAAO,GAAY,IAAI,CAAC,SAAS,CAAA;YACvC,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YACxE,IAAI,kBAAkB,CAAC,MAAM,EAAE;gBAC7B,OAAO,IAAI,CAAA;aACZ;iBAAM;gBACL,MAAM,cAAc,GAClB,MAAM,CAAC,OAAO,CAAC,MAAA,OAAO,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,MAAM;oBACrG,CAAC,CAAC,MAAM,kBAAkB,CAAC,mCAAmC;oBAC1D,yEAAyE;oBACzE,OAAO,EACP,OAAO,CAAC,EAAG,EACX,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC,EAC/B,EAAE,EACF,EAAE,CACH,CAAC,uCAAuC;oBAC3C,CAAC,CAAC,MAAM,kBAAkB,CAAC,sCAAsC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;gBACvI,OAAO,MAAM,cAAc,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,qCAAiB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;aAC3H;SACF;aAAM;YACL,OAAO,IAAI,CAAA;SACZ;;CACF;AA7BD,0DA6BC;AAED,SAAgB,mBAAmB,CAAC,CAAsB,EAAE,CAAsB;IAChF,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAA;IACvE,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7E,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,IAAI,CAAC,IAAA,4BAAS,EAAC,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACxF,OAAO,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa,CAAA;AAC5C,CAAC;AAND,kDAMC;AAED,SAAS,sBAAsB,CAAC,CAA4C,EAAE,CAA4C;IACxH,IAAI,CAAC,IAAA,4BAAS,EAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1F,KAAK,MAAM,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,EAAE,CAAC,EAAE;QACvD,MAAM,YAAY,GAAG,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACjC,IACE,CAAC,YAAY,CAAC,KAAK,CACjB,CAAC,EAAE,EAAE,EAAE,CACL,CAAC,CAAC,YAAY,CAAC,IAAI,CACjB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,WAAW,KAAK,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,IAAA,4BAAS,EAAC,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CACzI,CACJ;YAED,OAAO,KAAK,CAAA;KACf;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["// Uses fp as node names\nimport { acyclic, graphFromEdges, StronglyConnectedGraph } from '../utils/graph-utils'\nimport { DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { RSAUtils } from './RSA'\nimport { hex2ua } from '../utils'\nimport { HealthcareParty } from '../../icc-api/model/HealthcareParty'\nimport { Patient } from '../../icc-api/model/Patient'\nimport { Device } from '../../icc-api/model/Device'\nimport { EntitiesEncryption } from './EntitiesEncryption'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { DataOwnerWithType, Delegation, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { setEquals } from '../utils/collection-utils'\nimport { DataOwnerTypeEnum } from '../../icc-api/model/DataOwnerTypeEnum'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { IccPatientApi } from '../../icc-api'\n\n/**\n * @internal this function is meant only for internal use and may be changed without notice.\n * Get the public keys of a data owner, same as {@link IccDataOwnerXApi.getHexPublicKeysOf}.\n * @param dataOwner\n */\nexport function hexPublicKeysOf(dataOwner: DataOwnerOrStub) {\n  return new Set([dataOwner.publicKey, ...Object.keys(dataOwner.aesExchangeKeys ?? {})].filter((pubKey) => !!pubKey) as string[])\n}\n\n/**\n * @internal this function is meant only for internal use and may be changed without notice.\n * Get the transfer key graph for a data owner. Node names are the public key fingerprints of the data owner's keys, and an edge represents a key\n * which can be retrieved from another key using the transfer keys.\n * @param dataOwner a data owner.\n * @return a graph representing the possible key recovery paths using transfer keys for hte provided data owner.\n */\nexport function transferKeysFpGraphOf(dataOwner: DataOwnerOrStub): StronglyConnectedGraph {\n  const publicKeys = Array.from(hexPublicKeysOf(dataOwner))\n  const edges: [string, string][] = []\n  Object.entries(dataOwner.transferKeys ?? {}).forEach(([from, tos]) => {\n    Object.keys(tos).forEach((to) => {\n      edges.push([from.slice(-32), to.slice(-32)])\n    })\n  })\n  return acyclic(\n    graphFromEdges(\n      edges,\n      publicKeys.map((x) => x.slice(-32))\n    )\n  )\n}\n\n/**\n * @internal this function is meant only for internal use and may be changed without notice.\n * Get a map for converting public keys fingerprint to full public keys for the provided data owner.\n * @param dataOwner a data owner.\n * @return a map to convert fingerprints of the data owner into full public keys.\n */\nexport function fingerprintToPublicKeysMapOf(dataOwner: DataOwnerOrStub): { [fp: string]: string } {\n  const publicKeys = Array.from(hexPublicKeysOf(dataOwner))\n  const res: { [fp: string]: string } = {}\n  publicKeys.forEach((pk) => {\n    res[pk.slice(-32)] = pk\n  })\n  return res\n}\n\n/**\n * @internal this function is meant only for internal use and may be changed without notice.\n * Load many public keys in spki format.\n * @param rsa the rsa service\n * @param publicKeysSpkiHex public keys in spki format, hex encoded.\n * @return public keys as crypto keys by their fingerprint.\n */\nexport async function loadPublicKeys(rsa: RSAUtils, publicKeysSpkiHex: string[]): Promise<{ [publicKeyFingerprint: string]: CryptoKey }> {\n  return Object.fromEntries(\n    await Promise.all(publicKeysSpkiHex.map(async (x) => [x.slice(-32), await rsa.importKey('spki', hex2ua(x), ['encrypt'])]))\n  )\n}\n\n/**\n * @internal This method is intended only for internal use and may be changed without notice.\n * Creates a delegation for the current data owner if the data owner is an encrypted entity and there is no delegation to himself.\n * @return the updated self.\n */\nexport async function ensureDelegationForSelf(\n  dataOwnerApi: IccDataOwnerXApi,\n  entitiesEncryption: EntitiesEncryption,\n  cryptoPrimitives: CryptoPrimitives,\n  basePatientApi: IccPatientApi\n): Promise<DataOwnerWithType> {\n  const self = await dataOwnerApi.getCurrentDataOwner()\n  if (self.type === DataOwnerTypeEnum.Patient) {\n    const patient: Patient = self.dataOwner\n    const availableSecretIds = await entitiesEncryption.secretIdsOf(patient)\n    if (availableSecretIds.length) {\n      return self\n    } else {\n      const updatedPatient =\n        Object.entries(patient.encryptionKeys ?? {}).length || Object.entries(patient.delegations ?? {}).length\n          ? await entitiesEncryption.entityWithExtendedEncryptedMetadata(\n              // If there is already something initialise only a new delegation to self\n              patient,\n              patient.id!,\n              [cryptoPrimitives.randomUuid()],\n              [],\n              []\n            ) // else initialise also encryption keys\n          : await entitiesEncryption.entityWithInitialisedEncryptedMetadata(patient, undefined, undefined, true).then((x) => x.updatedEntity)\n      return await basePatientApi.modifyPatient(updatedPatient).then((x) => ({ dataOwner: x, type: DataOwnerTypeEnum.Patient }))\n    }\n  } else {\n    return self\n  }\n}\n\nexport function encryptedStubEquals(a: EncryptedEntityStub, b: EncryptedEntityStub): boolean {\n  if (!delegationLikeEquality(a.delegations, b.delegations)) return false\n  if (!delegationLikeEquality(a.encryptionKeys, b.encryptionKeys)) return false\n  if (!delegationLikeEquality(a.cryptedForeignKeys, b.cryptedForeignKeys)) return false\n  if (!setEquals(new Set(a.secretForeignKeys), new Set(b.secretForeignKeys))) return false\n  return a.encryptedSelf === b.encryptedSelf\n}\n\nfunction delegationLikeEquality(a: { [s: string]: Delegation[] } | undefined, b: { [s: string]: Delegation[] } | undefined): boolean {\n  if (!setEquals(new Set(Object.keys(a ?? {})), new Set(Object.keys(b ?? {})))) return false\n  for (const [k, aDelegations] of Object.entries(a ?? {})) {\n    const bDelegations = (b ?? {})[k]\n    if (\n      !aDelegations.every(\n        (da) =>\n          !!bDelegations.find(\n            (db) => da.key === db.key && da.delegatedTo === db.delegatedTo && da.owner === db.owner && setEquals(new Set(da.tags), new Set(db.tags))\n          )\n      )\n    )\n      return false\n  }\n  return true\n}\n"]}