@icure/api 7.1.5 → 7.1.6

package/icc-x-api/auth/AuthenticationProvider.ts

@@ -0,0 +1,200 @@
+import { AuthService } from './AuthService'
+import { IccAuthApi, OAuthThirdParty } from '../../icc-api'
+import { EnsembleAuthService } from './EnsembleAuthService'
+import { JwtBridgedAuthService } from './JwtBridgedAuthService'
+import { NoAuthService } from './NoAuthService'
+import { BasicAuthService } from './BasicAuthService'
+import { JwtAuthService } from './JwtAuthService'
+import { UserGroup } from '../../icc-api/model/UserGroup'
+
+/**
+ * @internal you should not instantiate implementations of this interface directly.
+ */
+export interface AuthenticationProvider {
+  /**
+   * @internal this method is meant for internal use only and may be changed without notice
+   */
+  getAuthService(): AuthService
+
+  /**
+   * @internal this method is meant for internal use only and may be changed without notice
+   * Gives a new authentication provider for the same user and authentication method but for a different iCure group
+   * @param newGroupId id of the new group to switch to
+   * @param matches the list of groups the user is in, containing also the group-specific id of the user. Note that users with same login username but
+   * different password are considered as if they are different users and should not appear in these matches. You can get this list by calling
+   * {@link IccUserApi.getMatchingUsers} authenticated.
+   * @return a new authentication provider
+   */
+  switchGroup(newGroupId: string, matches: Array<UserGroup>): Promise<AuthenticationProvider>
+
+  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined>
+}
+
+export class EnsembleAuthenticationProvider implements AuthenticationProvider {
+  private readonly basicAuth: BasicAuthService
+  private jwtAuth: JwtAuthService | JwtBridgedAuthService
+  private suspensionEnd: Date | undefined
+
+  constructor(
+    private readonly authApi: IccAuthApi,
+    private readonly username: string,
+    private readonly password: string,
+    private readonly jwtTimeout: number = 3600,
+    jwtAuth?: JwtAuthService | JwtBridgedAuthService,
+    basicAuth?: BasicAuthService,
+    thirdPartyTokens: { [thirdParty: string]: string } = {}
+  ) {
+    this.jwtAuth = jwtAuth ?? new JwtBridgedAuthService(this.authApi, this.username, this.password)
+    this.basicAuth = basicAuth ?? new BasicAuthService(this.username, this.password)
+  }
+
+  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {
+    return this.jwtAuth.getIcureTokens()
+  }
+
+  getAuthService(): AuthService {
+    // If the jwtAuth is in an error state, it instantiates a new one,
+    // but it will not use it until the suspension ends
+    if (this.jwtAuth.isInErrorState()) {
+      console.warn('Error state in JWT, I will skip it')
+      this.jwtAuth = new JwtBridgedAuthService(this.authApi, this.username, this.password)
+      this.suspensionEnd = new Date(new Date().getTime() + this.jwtTimeout * 1000)
+    }
+
+    return !!this.suspensionEnd && new Date() <= this.suspensionEnd
+      ? new EnsembleAuthService(null, new NoAuthService(), this.basicAuth)
+      : new EnsembleAuthService(this.jwtAuth, new NoAuthService(), this.basicAuth)
+  }
+
+  async switchGroup(newGroupId: string, matches: Array<UserGroup>): Promise<AuthenticationProvider> {
+    const switchInfo = await switchJwtAuth(this.authApi, this.jwtAuth, this.username, this.password, newGroupId, matches)
+    return new EnsembleAuthenticationProvider(
+      this.authApi,
+      switchInfo.loginForGroup,
+      this.password,
+      this.jwtTimeout,
+      switchInfo.switchedJwtAuth,
+      new BasicAuthService(switchInfo.loginForGroup, this.password)
+    )
+  }
+}
+
+export class JwtAuthenticationProvider implements AuthenticationProvider {
+  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {
+    return this.jwtAuth.getIcureTokens()
+  }
+
+  private readonly jwtAuth: JwtAuthService | JwtBridgedAuthService
+
+  /**
+   * @internal
+   * @param authApi
+   * @param username
+   * @param password
+   * @param jwtAuth
+   * @param icureToken
+   */
+  constructor(
+    private readonly authApi: IccAuthApi,
+    private readonly username?: string,
+    private readonly password?: string,
+    jwtAuth?: JwtAuthService | JwtBridgedAuthService,
+    private readonly icureToken?: { token: string; refreshToken: string }
+  ) {
+    const composedAuth =
+      jwtAuth ??
+      (icureToken
+        ? new JwtAuthService(authApi, { authJwt: icureToken.token, refreshJwt: icureToken.refreshToken })
+        : !!username && !!password
+        ? new JwtBridgedAuthService(authApi, username!, password!)
+        : undefined)
+    if (!composedAuth) {
+      throw new Error('No authentication method provided')
+    }
+    this.jwtAuth = composedAuth
+  }
+
+  getAuthService(): AuthService {
+    return this.jwtAuth
+  }
+
+  async switchGroup(newGroupId: string, matches: Array<UserGroup>): Promise<AuthenticationProvider> {
+    const switchInfo = await switchJwtAuth(this.authApi, this.jwtAuth, this.username, this.password, newGroupId, matches)
+    return new JwtAuthenticationProvider(this.authApi, switchInfo.loginForGroup, this.password, switchInfo.switchedJwtAuth)
+  }
+}
+
+export class BasicAuthenticationProvider implements AuthenticationProvider {
+  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {
+    return Promise.resolve() as Promise<undefined>
+  }
+
+  constructor(private username: string, private password: string) {}
+
+  getAuthService(): AuthService {
+    return new BasicAuthService(this.username, this.password)
+  }
+
+  async switchGroup(newGroupId: string, matches: Array<UserGroup>): Promise<AuthenticationProvider> {
+    return Promise.resolve(new BasicAuthenticationProvider(loginForGroup(newGroupId, matches), this.password))
+  }
+}
+
+export class NoAuthenticationProvider implements AuthenticationProvider {
+  getAuthService(): AuthService {
+    return new NoAuthService()
+  }
+
+  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {
+    return Promise.resolve() as Promise<undefined>
+  }
+
+  async switchGroup(newGroupId: string, matches: Array<UserGroup>): Promise<AuthenticationProvider> {
+    return this
+  }
+}
+
+/**
+ * @internal
+ */
+function loginForGroup(groupId: string, matches: Array<UserGroup>): string {
+  const matchForGroup = matches.find((x) => x.groupId === groupId)
+  if (!matchForGroup?.userId) {
+    throw new Error(`Can't switch to group ${groupId} for the current user.`)
+  }
+  return `${groupId}/${matchForGroup.userId}`
+}
+
+/**
+ * @internal
+ * Creates a jwtAuth from an existing one in order to switch group
+ */
+async function switchJwtAuth(
+  authApi: IccAuthApi,
+  jwtAuth: JwtAuthService | JwtBridgedAuthService,
+  username: string | undefined,
+  password: string | undefined,
+  newGroupId: string,
+  matches: Array<UserGroup>
+): Promise<{ loginForGroup: string; switchedJwtAuth: JwtAuthService | JwtBridgedAuthService }> {
+  const refreshToken = jwtAuth.isInErrorState() ? undefined : await jwtAuth.refreshToken
+  const switchedJwtInfo = refreshToken ? await authApi.switchGroup(refreshToken, newGroupId).catch(() => undefined as any) : undefined
+  const updatedLogin = loginForGroup(newGroupId, matches)
+  const switchedJwtAuth =
+    !!username && !!password
+      ? new JwtBridgedAuthService(
+          authApi,
+          updatedLogin,
+          password,
+          switchedJwtInfo?.token && switchedJwtInfo?.refreshToken
+            ? { authJwt: switchedJwtInfo.token, refreshJwt: switchedJwtInfo.refreshToken }
+            : undefined
+        )
+      : new JwtAuthService(
+          authApi,
+          switchedJwtInfo?.token && switchedJwtInfo?.refreshToken
+            ? { authJwt: switchedJwtInfo.token, refreshJwt: switchedJwtInfo.refreshToken }
+            : undefined
+        )
+  return { loginForGroup: updatedLogin, switchedJwtAuth }
+}

package/icc-x-api/auth/BasicAuthService.ts

@@ -0,0 +1,25 @@
+import { AuthService } from './AuthService'
+import { XHR } from '../../icc-api/api/XHR'
+import Header = XHR.Header
+import { b2a } from '../utils'
+
+export class BasicAuthService implements AuthService {
+  private error: Error | null = null
+
+  constructor(private username: string, private password: string) {}
+
+  getAuthHeaders(): Promise<Array<Header>> {
+    if (!!this.error) {
+      throw this.error
+    }
+    return Promise.resolve([new Header('Authorization', `Basic ${this._base64Encode(`${this.username}:${this.password}`)}`)])
+  }
+
+  private _base64Encode(decodedString: string): string {
+    return b2a(decodedString)
+  }
+
+  invalidateHeader(error: Error): void {
+    this.error = error
+  }
+}

package/icc-x-api/auth/EnsembleAuthService.ts

@@ -0,0 +1,65 @@
+import { AuthService } from './AuthService'
+import { XHR } from '../../icc-api/api/XHR'
+import { JwtBridgedAuthService } from './JwtBridgedAuthService'
+import { NoAuthService } from './NoAuthService'
+import { BasicAuthService } from './BasicAuthService'
+import Header = XHR.Header
+import XHRError = XHR.XHRError
+import { JwtAuthService } from './JwtAuthService'
+
+export class EnsembleAuthService implements AuthService {
+  private currentState: string | null
+  private error: Error | null = null
+  private stateMap: { [key: string]: { state: AuthService | null; next: string | null } }
+
+  constructor(
+    private readonly jwtAuth: JwtBridgedAuthService | JwtAuthService | null,
+    private readonly sessionAuth: NoAuthService,
+    private readonly basicAuth: BasicAuthService
+  ) {
+    this.stateMap = {
+      start: { state: null, next: 'jwt' },
+      jwt: { state: this.jwtAuth, next: 'session' },
+      session: { state: this.sessionAuth, next: 'basic' },
+      basic: { state: this.basicAuth, next: null },
+    }
+    this.currentState = 'start'
+  }
+
+  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {
+    return this.jwtAuth?.getIcureTokens() ?? (Promise.resolve() as Promise<undefined>)
+  }
+
+  async getAuthHeaders(): Promise<Array<Header>> {
+    this.currentState = !!this.currentState ? this.stateMap[this.currentState].next : this.currentState
+
+    if (!!this.currentState) {
+      // If I have a state I return the headers, otherwise I return empty headers
+      // And delegate the responsibility of handling the error to the next call
+      return !!this.stateMap[this.currentState].state
+        ? this.stateMap[this.currentState].state!.getAuthHeaders().catch((e) => {
+            if (e instanceof XHRError && e.statusCode === 417) {
+              throw e
+            }
+            // If I get an error, it is also responsibility of the next call, but I give a warning
+            console.warn(e.message)
+            this.error = e
+
+            return []
+          })
+        : Promise.resolve([])
+    } else if (!!this.error) {
+      // If I have no more states, I throw the last error or a default one
+      throw this.error
+    } else {
+      throw new Error('Cannot authenticate')
+    }
+  }
+
+  invalidateHeader(error: Error): void {
+    this.error = error
+    if (!!this.currentState) {
+      this.stateMap[this.currentState].state?.invalidateHeader(error)
+    }
+  }
+}

package/icc-x-api/auth/JwtAuthService.ts

@@ -0,0 +1,93 @@
+import { AuthService } from './AuthService'
+import { XHR } from '../../icc-api/api/XHR'
+import { IccAuthApi, OAuthThirdParty } from '../../icc-api'
+import { LoginCredentials } from '../../icc-api/model/LoginCredentials'
+import Header = XHR.Header
+import { a2b } from '../utils'
+import { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'
+import XHRError = XHR.XHRError
+
+/**
+ * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens
+ */
+export class JwtAuthService implements AuthService {
+  private _error: Error | null = null
+  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)
+
+  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {
+    if (!!initialJwt) {
+      this._currentPromise = Promise.resolve(initialJwt)
+    }
+  }
+
+  get refreshToken(): Promise<string | undefined> {
+    return this._currentPromise.then((x) => x?.refreshJwt as any)
+  }
+
+  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {
+    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined))
+  }
+
+  async getAuthHeaders(): Promise<Array<Header>> {
+    return this._currentPromise
+      .then((x) => {
+        const authJwt = x?.authJwt
+        const refreshJwt = x?.refreshJwt
+
+        if ((!authJwt || this._isJwtExpired(authJwt)) && refreshJwt) {
+          // If it does not have the JWT, tries to get it
+          // If the JWT is expired, tries to refresh it
+
+          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {
+            // If here the token is null,
+            // it goes in a suspension status
+            if (!updatedTokens.authJwt) {
+              throw new Error('Your iCure back-end version does not support JWT authentication')
+            }
+
+            return updatedTokens
+          })
+        } else if (!!this._error) {
+          throw this._error
+        }
+        return this._currentPromise
+      })
+      .then((x) => {
+        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')
+      })
+  }
+
+  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {
+    // If I do not have a refresh JWT or the refresh JWT is expired,
+    // I have to log in again
+    if (this._isJwtExpired(refreshJwt)) {
+      throw Error('Missing or expired refresh token: please log in again')
+    } else {
+      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({
+        authJwt: refreshResponse.token!,
+        refreshJwt: refreshJwt,
+      }))
+    }
+  }
+
+  private _isJwtExpired(jwt: string): boolean {
+    const parts = jwt.split('.')
+    if (parts.length !== 3) {
+      return false
+    }
+    const payload = this._base64Decode(parts[1])
+    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()
+  }
+
+  private _base64Decode(encodedString: string): any {
+    return JSON.parse(a2b(encodedString))
+  }
+
+  invalidateHeader(error: Error): void {
+    this._error = error
+  }
+
+  isInErrorState(): boolean {
+    return !!this._error
+  }
+}

package/icc-x-api/auth/JwtBridgedAuthService.ts

@@ -0,0 +1,133 @@
+import { AuthService } from './AuthService'
+import { XHR } from '../../icc-api/api/XHR'
+import { IccAuthApi, OAuthThirdParty } from '../../icc-api'
+import { LoginCredentials } from '../../icc-api/model/LoginCredentials'
+import Header = XHR.Header
+import { a2b } from '../utils'
+import { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'
+import XHRError = XHR.XHRError
+
+/**
+ * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired
+ */
+export class JwtBridgedAuthService implements AuthService {
+  private _error: Error | null = null
+  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})
+
+  constructor(
+    private authApi: IccAuthApi,
+    private username: string,
+    private password: string,
+    private thirdPartyTokens: { [thirdParty: string]: string } = {}
+  ) {}
+
+  get refreshToken(): Promise<string | undefined> {
+    return this._currentPromise.then((x) => x.refreshJwt as any)
+  }
+  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {
+    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))
+  }
+
+  async getAuthHeaders(): Promise<Array<Header>> {
+    return this._currentPromise
+      .then(({ authJwt, refreshJwt }) => {
+        if (!authJwt || this._isJwtExpired(authJwt)) {
+          // If it does not have the JWT, tries to get it
+          // If the JWT is expired, tries to refresh it
+
+          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {
+            // If here the token is null,
+            // it goes in a suspension status
+            if (!updatedTokens.authJwt) {
+              throw new Error('Your iCure back-end version does not support JWT authentication')
+            }
+
+            return updatedTokens
+          })
+        } else if (!!this._error) {
+          throw this._error
+        }
+        return this._currentPromise
+      })
+      .then(({ authJwt }) => {
+        return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]
+      })
+  }
+
+  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {
+    // If I do not have a refresh JWT or the refresh JWT is expired,
+    // I have to log in again
+    if (!refreshJwt || this._isJwtExpired(refreshJwt)) {
+      return this._loginAndGetTokens()
+    } else {
+      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({
+        authJwt: refreshResponse.token,
+        refreshJwt: refreshJwt,
+      }))
+    }
+  }
+
+  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {
+    let authResponse: AuthenticationResponse | undefined
+    let firstError: XHRError | undefined
+    if (this.username && this.password) {
+      try {
+        authResponse = await this.authApi.login(
+          new LoginCredentials({
+            username: this.username,
+            password: this.password,
+          })
+        )
+      } catch (e) {
+        firstError = e as XHRError
+      }
+    }
+    if (!authResponse) {
+      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {
+        const prev = await acc
+        return (
+          prev ??
+          (token
+            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {
+                if (!firstError) {
+                  firstError = e as XHRError
+                }
+                return Promise.resolve() as Promise<undefined>
+              })
+            : undefined)
+        )
+      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)
+    }
+
+    if (!authResponse) {
+      if (firstError) throw firstError
+      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())
+    }
+
+    return {
+      authJwt: authResponse.token,
+      refreshJwt: authResponse.refreshToken,
+    }
+  }
+
+  private _isJwtExpired(jwt: string): boolean {
+    const parts = jwt.split('.')
+    if (parts.length !== 3) {
+      return false
+    }
+    const payload = this._base64Decode(parts[1])
+    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()
+  }
+
+  private _base64Decode(encodedString: string): any {
+    return JSON.parse(a2b(encodedString))
+  }
+
+  invalidateHeader(error: Error): void {
+    this._error = error
+  }
+
+  isInErrorState(): boolean {
+    return !!this._error
+  }
+}

package/icc-x-api/auth/NoAuthService.ts

@@ -0,0 +1,18 @@
+import { AuthService } from './AuthService'
+import { XHR } from '../../icc-api/api/XHR'
+import Header = XHR.Header
+
+export class NoAuthService implements AuthService {
+  private error: Error | null = null
+
+  async getAuthHeaders(): Promise<Array<Header>> {
+    if (!!this.error) {
+      throw this.error
+    }
+    return Promise.resolve([])
+  }
+
+  invalidateHeader(error: Error): void {
+    this.error = error
+  }
+}

package/icc-x-api/basexapi/EncryptedEntityXApi.ts

@@ -0,0 +1,48 @@
+import { EncryptedEntity } from '../../icc-api/model/models'
+
+/**
+ * Interface of common methods for XApis of any encryptable entities.
+ */
+export interface EncryptedEntityXApi<T extends EncryptedEntity> {
+  /**
+   * Get the ids of all data owners with access to the provided entity, including their permissions on the entity. This method also uses the
+   * information available to the current user to attempt to identify the anonymous data owners with access to this entity. Note however that
+   * the user may not be capable of identifying all anonymous data owners with access to the entity. In cases where there is at least an anonymous
+   * data owner with access to the entity the value of `hasUnknownAnonymousDataOwners` in the returned object will be `true` (`false` otherwise).
+   * Note that users are only capable of identifying anonymous data owners in delegations where the user itself is involved, meaning that if a
+   * specific anonymous data owners has access to an entity through two delegations, one accessible to the current user and one not, the anonymous
+   * data owner will appear in the `permissionsByDataOwnerId`, but the `hasUnknownAnonymousDataOwners` will also be `true`, since the user can't know
+   * if the other delegation refers to the same anonymous data owner or not.
+   *
+   * For example consider an entity with the following delegations, where `A` and `B` are unrelated explicit data owners, and `P` is an anonymous
+   * data owner:
+   * - A -> A - r/w
+   * - A -> B - r/w
+   * - A -> P - r
+   * - B -> P - r/w
+   * In this case we can get the following results, depending on whether the current user is `A`, `B` or `P`:
+   * - `A` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'READ' }, hasUnknownAnonymousDataOwners: true }` (`A` does not know that
+   *   `B->P` actually refers to `P`, but only that it was created by `B`)
+   * - `B` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'WRITE' }, hasUnknownAnonymousDataOwners: true }` (`B` does not know that
+   *   `A->P` actually refers to `P`, but only that it was created by `A`)
+   * - `P` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'WRITE' }, hasUnknownAnonymousDataOwners: false }` (`P` knows the
+   *    delegations that he is part of)
+   *
+   * @param entity an entity.
+   * @return an object containing:
+   * - `permissionsByDataOwnerId`: a map associating each data owner id with the access level to the entity. Currently only WRITE access is supported.
+   * - `hasUnknownAnonymousDataOwners`: a boolean indicating if there are anonymous data owners with access to the entity that the current user can
+   *   not identify.
+   */
+  getDataOwnersWithAccessTo(entity: T): Promise<{
+    permissionsByDataOwnerId: { [dataOwnerId: string]: 'WRITE' }
+    hasUnknownAnonymousDataOwners: boolean
+  }>
+
+  /**
+   * @param entity an entity.
+   * @return the available encryption keys for the entity, which could be decrypted by the current data owner. Normally this array should contain at
+   * most one element but this method in case of entity merges there could be multiple values.
+   */
+  getEncryptionKeysOf(entity: T): Promise<string[]>
+}