@icure/api 7.1.5 → 7.1.6

package/icc-x-api/crypto/TransferKeysManager.ts

@@ -0,0 +1,137 @@
+import { KeyPair } from './RSA'
+import { BaseExchangeKeysManager } from './BaseExchangeKeysManager'
+import { IccDataOwnerXApi } from '../icc-data-owner-x-api'
+import { ua2hex } from '../utils'
+import { KeyManager } from './KeyManager'
+import { reachSetsAcyclic, StronglyConnectedGraph } from '../utils/graph-utils'
+import { fingerprintToPublicKeysMapOf, loadPublicKeys, transferKeysFpGraphOf } from './utils'
+import { CryptoPrimitives } from './CryptoPrimitives'
+import { IcureStorageFacade } from '../storage/IcureStorageFacade'
+import { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'
+
+/**
+ * @internal this class is intended only for internal use and may be changed without notice.
+ * Allows to create new transfer keys.
+ */
+export class TransferKeysManager {
+  private readonly primitives: CryptoPrimitives
+  private readonly baseExchangeKeysManager: BaseExchangeKeysManager
+  private readonly dataOwnerApi: IccDataOwnerXApi
+  private readonly keyManager: KeyManager
+  private readonly icureStorage: IcureStorageFacade
+
+  constructor(
+    primitives: CryptoPrimitives,
+    baseExchangeKeysManager: BaseExchangeKeysManager,
+    dataOwnerApi: IccDataOwnerXApi,
+    keyManager: KeyManager,
+    icureStorage: IcureStorageFacade
+  ) {
+    this.primitives = primitives
+    this.baseExchangeKeysManager = baseExchangeKeysManager
+    this.dataOwnerApi = dataOwnerApi
+    this.keyManager = keyManager
+    this.icureStorage = icureStorage
+  }
+
+  /**
+   * Analyses the transfer keys graph and creates new transfer keys which allow to improve data accessibility from other devices.
+   * For security reasons transfer keys will only be created between keys verified by the user, but this will be done ignoring any existing edges from
+   * unverified keys to verified keys.
+   * @param self the current data owner.
+   * @return the updated data owner.
+   */
+  async updateTransferKeys(self: CryptoActorStubWithType): Promise<void> {
+    const newEdges = await this.getNewVerifiedTransferKeysEdges(self)
+    if (!newEdges) return
+    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()
+    const fpToPublicKey = fingerprintToPublicKeysMapOf(self.stub)
+    const newExchangeKeyPublicKeys = newEdges.sources.map((fp) => fpToPublicKey[fp])
+    const { key: exchangeKey, updatedDelegator: updatedSelf } = await this.baseExchangeKeysManager.createOrUpdateEncryptedExchangeKeyTo(
+      selfId,
+      newEdges.target,
+      await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeys)
+    )
+    // note: createEncryptedExchangeKeyFor may update self
+    const encryptedTransferKey = await this.encryptTransferKey(newEdges.target, exchangeKey)
+    const newTransferKeys = newEdges.sources.reduce(
+      (acc, candidateFp) => {
+        const existingKeys = { ...(acc[candidateFp] ?? {}) }
+        existingKeys[newEdges.targetFp] = encryptedTransferKey
+        acc[candidateFp] = existingKeys
+        return acc
+      },
+      { ...(updatedSelf.stub.transferKeys ?? {}) }
+    )
+    await this.dataOwnerApi.modifyCryptoActorStub({
+      type: updatedSelf.type,
+      stub: {
+        ...updatedSelf.stub,
+        transferKeys: newTransferKeys,
+      },
+    })
+  }
+
+  // encrypts a transfer key in pkcs8 format using an exchange key, returns the hex representation
+  private async encryptTransferKey(transferKey: KeyPair<CryptoKey>, exchangeKey: CryptoKey): Promise<string> {
+    const exportedKey = await this.primitives.RSA.exportKey(transferKey.privateKey, 'pkcs8')
+    return ua2hex(await this.primitives.AES.encrypt(exchangeKey, exportedKey))
+  }
+
+  // all public keys would go to the stored keys -> no need for specifying the key.
+  // Result only includes the acyclic label, not the full group
+  private transferKeysCandidatesFp(keyToFp: string, graph: StronglyConnectedGraph): string[] {
+    return Object.entries(reachSetsAcyclic(graph.acyclicGraph))
+      .filter(([from, reachable]) => from != keyToFp && !reachable.has(keyToFp))
+      .map((x) => x[0])
+  }
+
+  private async transferTargetVerifiedKey(keyManager: KeyManager): Promise<{ fingerprint: string; pair: KeyPair<CryptoKey> }> {
+    return keyManager.getSelfVerifiedKeys()[0]
+  }
+
+  // Decides the best edges considering the verified public keys.
+  private async getNewVerifiedTransferKeysEdges(self: CryptoActorStubWithType): Promise<
+    | undefined
+    | {
+        sources: string[]
+        target: KeyPair<CryptoKey>
+        targetFp: string
+      }
+  > {
+    const verifiedKeysFpSet = new Set(this.keyManager.getSelfVerifiedKeys().map((x) => x.fingerprint))
+    Object.entries(await this.icureStorage.loadSelfVerifiedKeys(self.stub.id!)).forEach(([key, verified]) => {
+      if (verified) verifiedKeysFpSet.add(key.slice(-32))
+    })
+    if (verifiedKeysFpSet.size == 0) return undefined
+    const graph = transferKeysFpGraphOf(self.stub)
+    // 1. Choose a key available in this device which should be reachable from all other verified keys
+    const { fingerprint: targetKeyFp, pair: targetKey } = await this.transferTargetVerifiedKey(this.keyManager)
+    // 2. Find groups which can't reach the existing target keys
+    const candidatesFp = this.transferKeysCandidatesFp(targetKeyFp, graph)
+    // 3. Keep only groups which contain at least a verified candidate
+    const verifiedGroupCandidates = candidatesFp.filter((candidate) =>
+      graph.acyclicLabelToGroup[candidate].some((candidateGroupMember) => verifiedKeysFpSet.has(candidateGroupMember))
+    )
+    const verifiedCandidatesSet = new Set(verifiedGroupCandidates)
+    if (verifiedCandidatesSet.size == 0) return undefined
+    // 4. Drop all candidates which can already reach another candidate group: it is sufficient to create a transfer key from that group.
+    const reachSets = reachSetsAcyclic(graph.acyclicGraph)
+    const optimizedCandidates = verifiedGroupCandidates.filter((candidate) =>
+      Array.from(reachSets[candidate]).every((reachableNode) => !verifiedCandidatesSet.has(reachableNode))
+    )
+    if (optimizedCandidates.length == 0) throw new Error('Check failed: at least one candidate should survive optimization')
+    // 5. Transfer keys could also be faked: to make sure we are not giving access to unauthorised people we remap the candidates to a verified public
+    // keys
+    const verifiedOptimizedCandidates = optimizedCandidates.map((candidate) => {
+      const res = graph.acyclicLabelToGroup[candidate].find((groupMemberFp) => verifiedKeysFpSet.has(groupMemberFp))
+      if (!res) throw new Error('Check failed: optimized candidates groups should have at least a verified member')
+      return res
+    })
+    return {
+      sources: verifiedOptimizedCandidates,
+      target: targetKey,
+      targetFp: targetKeyFp,
+    }
+  }
+}

package/icc-x-api/crypto/shamir.ts

@@ -0,0 +1,326 @@
+export class ShamirClass {
+  // Protected settings object
+  config = {
+    bits: 8, // default number of bits
+    radix: 16, // work with HEX by default
+    size: Math.pow(2, 8 /* config.bits */),
+    max: Math.pow(2, 8 /* config.bits */) - 1,
+    minBits: 3,
+    maxBits: 16, // this permits 65,535 shares, though going this high is NOT recommended in JS!
+    bytesPerChar: 2,
+    maxBytesPerChar: 6, // Math.pow(256,7) > Math.pow(2,53)
+    // Primitive polynomials (in decimal form) for Galois Fields GF(2^n), for 2 <= n <= 30
+    // The index of each term in the array corresponds to the n for that polynomial
+    // i.e. to get the polynomial for n=16, use primitivePolynomials[16]
+    primitivePolynomials: [null, null, 1, 3, 3, 5, 3, 3, 29, 17, 9, 5, 83, 27, 43, 3, 45, 9, 39, 39, 9, 5, 3, 33, 27, 9, 71, 39, 9, 5, 83],
+    // warning for insecure PRNG
+    warning: 'WARNING:\nA secure random number generator was not found.\nUsing Math.random(), which is NOT cryptographically strong!',
+    logs: [] as Array<number>,
+    exps: [] as Array<number>,
+  }
+  private crypto: Crypto
+
+  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {
+    this.crypto = crypto
+  }
+
+  init() {
+    const primitive = this.config.primitivePolynomials[this.config.bits]!
+    let x = 1
+
+    for (let i = 0; i < this.config.size; i++) {
+      this.config.exps[i] = x
+      this.config.logs[x] = i
+      x <<= 1
+      if (x >= this.config.size) {
+        x ^= primitive
+        x &= this.config.max
+      }
+    }
+  }
+
+  // Splits a number string `bits`-length segments, after first
+  // optionally zero-padding it to a length that is a multiple of `padLength.
+  // Returns array of integers (each less than 2^bits-1), with each element
+  // representing a `bits`-length segment of the input string from right to left,
+  // i.e. parts[0] represents the right-most `bits`-length segment of the input string.
+  split(str: string, padLength = 0) {
+    if (padLength) {
+      str = this.padLeft(str, padLength)
+    }
+    const parts = []
+    for (var i = str.length; i > this.config.bits; i -= this.config.bits) {
+      parts.push(parseInt(str.slice(i - this.config.bits, i), 2))
+    }
+    parts.push(parseInt(str.slice(0, i), 2))
+    return parts
+  }
+
+  bin2hex(str: string) {
+    let hex = '',
+      num
+    str = this.padLeft(str, 4)
+    for (let i = str.length; i >= 4; i -= 4) {
+      num = parseInt(str.slice(i - 4, i), 2)
+      if (isNaN(num)) {
+        throw new Error('Invalid binary character.')
+      }
+      hex = num.toString(16) + hex
+    }
+    return hex
+  }
+
+  hex2bin(str: string) {
+    let bin = '',
+      num
+    for (let i = str.length - 1; i >= 0; i--) {
+      num = parseInt(str[i], 16)
+      if (isNaN(num)) {
+        throw new Error('Invalid hex character.')
+      }
+      bin = this.padLeft(num.toString(2), 4) + bin
+    }
+
+    return bin
+  }
+
+  padLeft(str: string, bits: number = this.config.bits) {
+    const missing = str.length % bits
+    return (missing ? new Array(bits - missing + 1).join('0') : '') + str
+  }
+
+  random(bits: number) {
+    const construct = (bits: number, arr: Uint32Array, size: number) => {
+      let str = '',
+        i = 0
+      const len = arr.length - 1
+      while (i < len || str.length < bits) {
+        str += this.padLeft(arr[i].toString(16), size)
+        i++
+      }
+      str = str.substr(-bits / 4)
+      return (str.match(/0/g) || []).length === str.length ? null : str
+    }
+
+    let elems = Math.ceil(bits / 32),
+      str = null,
+      arr = new Uint32Array(elems)
+
+    while (str === null) {
+      this.crypto.getRandomValues(arr)
+      str = construct(bits, arr, 8)
+    }
+
+    return str
+  }
+
+  share(secretString: string, numShares: number, threshold: number) {
+    if (!this.config.logs.length) {
+      this.init()
+    }
+
+    if (numShares % 1 !== 0 || numShares < 2) {
+      throw new Error('Number of shares must be an integer between 2 and 2^bits-1 (' + this.config.max + '), inclusive.')
+    }
+    if (numShares > this.config.max) {
+      var neededBits = Math.ceil(Math.log(numShares + 1) / Math.LN2)
+      throw new Error(
+        'Number of shares must be an integer between 2 and 2^bits-1 (' +
+          this.config.max +
+          '), inclusive. To create ' +
+          numShares +
+          ' shares, use at least ' +
+          neededBits +
+          ' bits.'
+      )
+    }
+    if (threshold % 1 !== 0 || threshold < 2) {
+      throw new Error('Threshold number of shares must be an integer between 2 and 2^bits-1 (' + this.config.max + '), inclusive.')
+    }
+    if (threshold > this.config.max) {
+      var neededBits = Math.ceil(Math.log(threshold + 1) / Math.LN2)
+      throw new Error(
+        'Threshold number of shares must be an integer between 2 and 2^bits-1 (' +
+          this.config.max +
+          '), inclusive.  To use a threshold of ' +
+          threshold +
+          ', use at least ' +
+          neededBits +
+          ' bits.'
+      )
+    }
+
+    // append a 1 so that we can preserve the correct number of leading zeros in our secret
+    const secret = this.split('1' + this.hex2bin(secretString), 0)
+    const x = new Array(numShares),
+      y = new Array(numShares)
+    for (let i = 0, len = secret.length; i < len; i++) {
+      const subShares = this._getShares(secret[i], numShares, threshold)
+      for (let j = 0; j < numShares; j++) {
+        x[j] = x[j] || subShares[j].x.toString(this.config.radix)
+        y[j] = this.padLeft(subShares[j].y.toString(2)) + (y[j] ? y[j] : '')
+      }
+    }
+    const padding = this.config.max.toString(this.config.radix).length
+    return y.map((b, idx) => this.config.bits.toString(16).toUpperCase() + this.padLeft(x[idx], padding) + this.bin2hex(b))
+  }
+
+  // This is the basic polynomial generation and evaluation function
+  // for a `config.bits`-length secret (NOT an arbitrary length)
+  // Note: no error-checking at this stage! If `secrets` is NOT
+  // a NUMBER less than 2^bits-1, the output will be incorrect!
+  _getShares(secret: number, numShares: number, threshold: number) {
+    const shares = []
+    const coeffs = [secret]
+
+    for (var i = 1; i < threshold; i++) {
+      coeffs[i] = parseInt(this.random(this.config.bits), 16)
+    }
+    for (var i = 1, len = numShares + 1; i < len; i++) {
+      shares[i - 1] = {
+        x: i,
+        y: this.horner(i, coeffs),
+      }
+    }
+    return shares
+  }
+
+  // Polynomial evaluation at `x` using Horner's Method
+  // TODO: this can possibly be sped up using other methods
+  // NOTE: fx=fx * x + coeff[i] ->  exp(log(fx) + log(x)) + coeff[i],
+  //       so if fx===0, just set fx to coeff[i] because
+  //       using the exp/log form will result in incorrect value
+  horner(x: number, coeffs: Array<number>) {
+    const logx = this.config.logs[x]
+    let fx = 0
+    for (let i = coeffs.length - 1; i >= 0; i--) {
+      if (fx === 0) {
+        fx = coeffs[i]
+        continue
+      }
+      fx = this.config.exps[(logx + this.config.logs[fx]) % this.config.max] ^ coeffs[i]
+    }
+    return fx
+  }
+
+  processShare(share: string) {
+    const bits = parseInt(share[0], 16)
+    if (bits && (bits % 1 !== 0 || bits < this.config.minBits || bits > this.config.maxBits)) {
+      throw new Error('Number of bits must be an integer between ' + this.config.minBits + ' and ' + this.config.maxBits + ', inclusive.')
+    }
+
+    const max = Math.pow(2, bits) - 1
+    const idLength = max.toString(this.config.radix).length
+
+    const id = parseInt(share.substr(1, idLength), this.config.radix)
+    if (id % 1 !== 0 || id < 1 || id > max) {
+      throw new Error('Share id must be an integer between 1 and ' + this.config.max + ', inclusive.')
+    }
+    share = share.substr(idLength + 1)
+    if (!share.length) {
+      throw new Error('Invalid share: zero-length share.')
+    }
+    return {
+      bits: bits,
+      id: id,
+      value: share,
+    }
+  }
+
+  _combine(at: number, shares: Array<string>) {
+    if (!this.config.logs.length) {
+      this.init()
+    }
+
+    const x: Array<number> = []
+    const y: Array<Array<number>> = []
+    let result = ''
+    let idx: number
+
+    for (var i = 0, len = shares.length; i < len; i++) {
+      const share = this.processShare(shares[i])
+
+      if (x.includes(share['id'])) {
+        // repeated x value?
+        continue
+      }
+
+      idx = x.push(share['id']) - 1
+      const shareValues = this.split(this.hex2bin(share['value']))
+      for (let j = 0, len2 = shareValues.length; j < len2; j++) {
+        y[j] = y[j] || []
+        y[j][idx] = shareValues[j]
+      }
+    }
+
+    for (var i = 0, len = y.length; i < len; i++) {
+      result = this.padLeft(this.lagrange(at, x, y[i]).toString(2)) + result
+    }
+
+    if (at === 0) {
+      // reconstructing the secret
+      return this.bin2hex(result.slice(result.indexOf('1') + 1))
+    } else {
+      // generating a new share
+      return this.bin2hex(result)
+    }
+  }
+
+  combine(shares: Array<string>) {
+    return this._combine(0, shares)
+  }
+
+  // Generate a new share with id `id` (a number between 1 and 2^bits-1)
+  // `id` can be a Number or a String in the default radix (16)
+  newShare(id: number | string, shares: Array<string>) {
+    if (typeof id === 'string') {
+      id = parseInt(id, this.config.radix)
+    }
+
+    const share = this.processShare(shares[0])
+    const max = Math.pow(2, share['bits']) - 1
+
+    if (id % 1 !== 0 || id < 1 || id > max) {
+      throw new Error('Share id must be an integer between 1 and ' + this.config.max + ', inclusive.')
+    }
+
+    const padding = max.toString(this.config.radix).length
+    return this.config.bits.toString(16).toUpperCase() + this.padLeft(id.toString(this.config.radix), padding) + this._combine(id, shares)
+  }
+
+  // Evaluate the Lagrange interpolation polynomial at x = `at`
+  // using x and y Arrays that are of the same length, with
+  // corresponding elements constituting points on the polynomial.
+  lagrange(at: number, x: Array<number>, y: Array<number>) {
+    let sum = 0,
+      product,
+      i,
+      j,
+      len
+    for (i = 0, len = x.length; i < len; i++) {
+      if (!y[i]) {
+        continue
+      }
+
+      product = this.config.logs[y[i]]
+      for (j = 0; j < len; j++) {
+        if (i === j) {
+          continue
+        }
+        if (at === x[j]) {
+          // happens when computing a share that is in the list of shares used to compute it
+          product = -1 // fix for a zero product term, after which the sum should be sum^0 = sum, not sum^1
+          break
+        }
+        product =
+          (product + this.config.logs[at ^ x[j]] - this.config.logs[x[i] ^ x[j]] + this.config.max) /* to make sure it's not negative */ %
+          this.config.max
+      }
+
+      sum = product === -1 ? sum : sum ^ this.config.exps[product] // though exps[-1]= undefined and undefined ^ anything = anything in chrome, this behavior may not hold everywhere, so do the check
+    }
+    return sum
+  }
+}
+
+export const shamir = new ShamirClass()

package/icc-x-api/crypto/utils.ts

@@ -0,0 +1,136 @@
+// Uses fp as node names
+import { acyclic, graphFromEdges, StronglyConnectedGraph } from '../utils/graph-utils'
+import { DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api'
+import { RSAUtils } from './RSA'
+import { hex2ua } from '../utils'
+import { HealthcareParty } from '../../icc-api/model/HealthcareParty'
+import { Patient } from '../../icc-api/model/Patient'
+import { Device } from '../../icc-api/model/Device'
+import { EntitiesEncryption } from './EntitiesEncryption'
+import { CryptoPrimitives } from './CryptoPrimitives'
+import { DataOwnerWithType, Delegation, EncryptedEntityStub } from '../../icc-api/model/models'
+import { setEquals } from '../utils/collection-utils'
+import { DataOwnerTypeEnum } from '../../icc-api/model/DataOwnerTypeEnum'
+import { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'
+import { IccPatientApi } from '../../icc-api'
+
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get the public keys of a data owner, same as {@link IccDataOwnerXApi.getHexPublicKeysOf}.
+ * @param dataOwner
+ */
+export function hexPublicKeysOf(dataOwner: DataOwnerOrStub) {
+  return new Set([dataOwner.publicKey, ...Object.keys(dataOwner.aesExchangeKeys ?? {})].filter((pubKey) => !!pubKey) as string[])
+}
+
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get the transfer key graph for a data owner. Node names are the public key fingerprints of the data owner's keys, and an edge represents a key
+ * which can be retrieved from another key using the transfer keys.
+ * @param dataOwner a data owner.
+ * @return a graph representing the possible key recovery paths using transfer keys for hte provided data owner.
+ */
+export function transferKeysFpGraphOf(dataOwner: DataOwnerOrStub): StronglyConnectedGraph {
+  const publicKeys = Array.from(hexPublicKeysOf(dataOwner))
+  const edges: [string, string][] = []
+  Object.entries(dataOwner.transferKeys ?? {}).forEach(([from, tos]) => {
+    Object.keys(tos).forEach((to) => {
+      edges.push([from.slice(-32), to.slice(-32)])
+    })
+  })
+  return acyclic(
+    graphFromEdges(
+      edges,
+      publicKeys.map((x) => x.slice(-32))
+    )
+  )
+}
+
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Get a map for converting public keys fingerprint to full public keys for the provided data owner.
+ * @param dataOwner a data owner.
+ * @return a map to convert fingerprints of the data owner into full public keys.
+ */
+export function fingerprintToPublicKeysMapOf(dataOwner: DataOwnerOrStub): { [fp: string]: string } {
+  const publicKeys = Array.from(hexPublicKeysOf(dataOwner))
+  const res: { [fp: string]: string } = {}
+  publicKeys.forEach((pk) => {
+    res[pk.slice(-32)] = pk
+  })
+  return res
+}
+
+/**
+ * @internal this function is meant only for internal use and may be changed without notice.
+ * Load many public keys in spki format.
+ * @param rsa the rsa service
+ * @param publicKeysSpkiHex public keys in spki format, hex encoded.
+ * @return public keys as crypto keys by their fingerprint.
+ */
+export async function loadPublicKeys(rsa: RSAUtils, publicKeysSpkiHex: string[]): Promise<{ [publicKeyFingerprint: string]: CryptoKey }> {
+  return Object.fromEntries(
+    await Promise.all(publicKeysSpkiHex.map(async (x) => [x.slice(-32), await rsa.importKey('spki', hex2ua(x), ['encrypt'])]))
+  )
+}
+
+/**
+ * @internal This method is intended only for internal use and may be changed without notice.
+ * Creates a delegation for the current data owner if the data owner is an encrypted entity and there is no delegation to himself.
+ * @return the updated self.
+ */
+export async function ensureDelegationForSelf(
+  dataOwnerApi: IccDataOwnerXApi,
+  entitiesEncryption: EntitiesEncryption,
+  cryptoPrimitives: CryptoPrimitives,
+  basePatientApi: IccPatientApi
+): Promise<DataOwnerWithType> {
+  const self = await dataOwnerApi.getCurrentDataOwner()
+  if (self.type === DataOwnerTypeEnum.Patient) {
+    const patient: Patient = self.dataOwner
+    const availableSecretIds = await entitiesEncryption.secretIdsOf(patient)
+    if (availableSecretIds.length) {
+      return self
+    } else {
+      const updatedPatient =
+        Object.entries(patient.encryptionKeys ?? {}).length || Object.entries(patient.delegations ?? {}).length
+          ? await entitiesEncryption.entityWithExtendedEncryptedMetadata(
+              // If there is already something initialise only a new delegation to self
+              patient,
+              patient.id!,
+              [cryptoPrimitives.randomUuid()],
+              [],
+              []
+            ) // else initialise also encryption keys
+          : await entitiesEncryption.entityWithInitialisedEncryptedMetadata(patient, undefined, undefined, true).then((x) => x.updatedEntity)
+      return await basePatientApi.modifyPatient(updatedPatient).then((x) => ({ dataOwner: x, type: DataOwnerTypeEnum.Patient }))
+    }
+  } else {
+    return self
+  }
+}
+
+export function encryptedStubEquals(a: EncryptedEntityStub, b: EncryptedEntityStub): boolean {
+  if (!delegationLikeEquality(a.delegations, b.delegations)) return false
+  if (!delegationLikeEquality(a.encryptionKeys, b.encryptionKeys)) return false
+  if (!delegationLikeEquality(a.cryptedForeignKeys, b.cryptedForeignKeys)) return false
+  if (!setEquals(new Set(a.secretForeignKeys), new Set(b.secretForeignKeys))) return false
+  return a.encryptedSelf === b.encryptedSelf
+}
+
+function delegationLikeEquality(a: { [s: string]: Delegation[] } | undefined, b: { [s: string]: Delegation[] } | undefined): boolean {
+  if (!setEquals(new Set(Object.keys(a ?? {})), new Set(Object.keys(b ?? {})))) return false
+  for (const [k, aDelegations] of Object.entries(a ?? {})) {
+    const bDelegations = (b ?? {})[k]
+    if (
+      !aDelegations.every(
+        (da) =>
+          !!bDelegations.find(
+            (db) => da.key === db.key && da.delegatedTo === db.delegatedTo && da.owner === db.owner && setEquals(new Set(da.tags), new Set(db.tags))
+          )
+      )
+    )
+      return false
+  }
+  return true
+}

package/icc-x-api/filters/AllCodesFilter.ts

@@ -0,0 +1,22 @@
+/**
+ * iCure Data Stack API Documentation
+ * The iCure Data Stack Application API is the native interface to iCure. This version is obsolete, please use v2.
+ *
+ * OpenAPI spec version: v1
+ *
+ *
+ * NOTE: This class is auto generated by the swagger code generator program.
+ * https://github.com/swagger-api/swagger-codegen.git
+ * Do not edit the class manually.
+ */
+import { AbstractFilterCode } from '../../icc-api/model/AbstractFilterCode'
+
+export class AllCodesFilter extends AbstractFilterCode {
+  $type: string = 'AllCodesFilter'
+  constructor(json: JSON | any) {
+    super(json)
+    Object.assign(this as AllCodesFilter, json)
+  }
+
+  desc?: string
+}

package/icc-x-api/filters/AllDevicesFilter.ts

@@ -0,0 +1,23 @@
+/**
+ * iCure Data Stack API Documentation
+ * The iCure Data Stack Application API is the native interface to iCure. This version is obsolete, please use v2.
+ *
+ * OpenAPI spec version: v1
+ *
+ *
+ * NOTE: This class is auto generated by the swagger code generator program.
+ * https://github.com/swagger-api/swagger-codegen.git
+ * Do not edit the class manually.
+ */
+import { AbstractFilterDevice } from '../../icc-api/model/AbstractFilterDevice'
+
+export class AllDevicesFilter extends AbstractFilterDevice {
+  $type: string = 'AllDevicesFilter'
+  constructor(json: JSON | any) {
+    super(json)
+
+    Object.assign(this as AllDevicesFilter, json)
+  }
+
+  desc?: string
+}

package/icc-x-api/filters/AllHealthcarePartiesFilter.ts

@@ -0,0 +1,23 @@
+/**
+ * iCure Data Stack API Documentation
+ * The iCure Data Stack Application API is the native interface to iCure. This version is obsolete, please use v2.
+ *
+ * OpenAPI spec version: v1
+ *
+ *
+ * NOTE: This class is auto generated by the swagger code generator program.
+ * https://github.com/swagger-api/swagger-codegen.git
+ * Do not edit the class manually.
+ */
+import { AbstractFilterHealthcareParty } from '../../icc-api/model/AbstractFilterHealthcareParty'
+
+export class AllHealthcarePartiesFilter extends AbstractFilterHealthcareParty {
+  $type: string = 'AllHealthcarePartiesFilter'
+  constructor(json: JSON | any) {
+    super(json)
+
+    Object.assign(this as AllHealthcarePartiesFilter, json)
+  }
+
+  desc?: string
+}