@icure/api 8.0.0-RC.1 → 8.0.0-RC.2

package/icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor.js

@@ -40,34 +40,35 @@ class SecureDelegationsSecurityMetadataDecryptor {
     decryptSecretIdsOf(typedEntity, dataOwnersHierarchySubset) {
         return this.decryptSecureDelegations(typedEntity, dataOwnersHierarchySubset, (d) => { var _a; return (_a = d.secretIds) !== null && _a !== void 0 ? _a : []; }, (e, k) => this.secureDelegationsEncryption.decryptSecretId(e, k));
     }
-    getDataOwnersWithAccessTo(typedEntity) {
+    /**
+     * Get information for members of secure delegations in the entity. Also provides information for delegations with anonymous delegate and/or
+     * delegator if one of the delegation members is the current data owner (or a parent) AND has still access to the exchange data used in the .
+     */
+    getDelegationMemberDetails(typedEntity) {
         var _a, _b, _c, _d, _e, _f;
         return __awaiter(this, void 0, void 0, function* () {
-            const accumulatedPermissions = {};
-            let hasUnknownAnonymousDataOwners = false;
-            function addPermission(delegateId, level) {
-                if (accumulatedPermissions[delegateId] !== AccessLevel.WRITE) {
-                    accumulatedPermissions[delegateId] = level;
-                }
-            }
+            const res = {};
             // 1. Add all explicit data owners, keep only delegations with at least an anonymous data owner to check later
             let remainingDelegations = Object.entries((_b = (_a = typedEntity.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {});
             let updatedRemainingDelegations = [];
             for (const delegationEntry of remainingDelegations) {
                 const delegation = delegationEntry[1];
-                if (delegation.delegator) {
-                    addPermission(delegation.delegator, delegation.permissions);
+                if (delegation.delegator && delegation.delegate) {
+                    res[delegationEntry[0]] = {
+                        delegate: delegation.delegate,
+                        delegator: delegation.delegator,
+                        fullyExplicit: true,
+                        accessLevel: delegation.permissions,
+                        accessControlSecret: undefined,
+                    };
                 }
-                if (delegation.delegate) {
-                    addPermission(delegation.delegate, delegation.permissions);
-                }
-                if (!delegation.delegator || !delegation.delegate) {
+                else {
                     updatedRemainingDelegations.push(delegationEntry);
                 }
             }
             remainingDelegations = updatedRemainingDelegations;
             if (!remainingDelegations.length)
-                return { permissionsByDataOwnerId: accumulatedPermissions, hasUnknownAnonymousDataOwners };
+                return res;
             updatedRemainingDelegations = [];
             // 2. Attempt to identify the anonymous data owner of remaining delegations by checking if we have the exchange data cached by hash
             // Note: we can find exchange data by hash only if we could successfully decrypt it
@@ -75,8 +76,13 @@ class SecureDelegationsSecurityMetadataDecryptor {
             for (const delegationEntry of remainingDelegations) {
                 const exchangeDataOfDelegation = cachedExchangeData[delegationEntry[0]];
                 if (exchangeDataOfDelegation) {
-                    addPermission(exchangeDataOfDelegation.exchangeData.delegator, delegationEntry[1].permissions);
-                    addPermission(exchangeDataOfDelegation.exchangeData.delegate, delegationEntry[1].permissions);
+                    res[delegationEntry[0]] = {
+                        delegate: exchangeDataOfDelegation.exchangeData.delegate,
+                        delegator: exchangeDataOfDelegation.exchangeData.delegator,
+                        fullyExplicit: false,
+                        accessLevel: delegationEntry[1].permissions,
+                        accessControlSecret: exchangeDataOfDelegation.accessControlSecret,
+                    };
                 }
                 else {
                     updatedRemainingDelegations.push(delegationEntry);
@@ -84,7 +90,8 @@ class SecureDelegationsSecurityMetadataDecryptor {
             }
             remainingDelegations = updatedRemainingDelegations;
             if (!remainingDelegations.length)
-                return { permissionsByDataOwnerId: accumulatedPermissions, hasUnknownAnonymousDataOwners };
+                return res;
+            updatedRemainingDelegations = [];
             // 3. Attempt to identify the anonymous data owner of remaining delegations between us (or one of our parents) and an anonymous data owner
             const hierarchy = yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds();
             const allHashes = [
@@ -103,21 +110,32 @@ class SecureDelegationsSecurityMetadataDecryptor {
                         ? yield this.exchangeData.getDecryptionDataKeyById(dataId, typedEntity.type, (_f = typedEntity.entity.secretForeignKeys) !== null && _f !== void 0 ? _f : [], true)
                         : undefined;
                     if (exchangeDataInfo) {
-                        addPermission(exchangeDataInfo.exchangeData.delegator, delegation.permissions);
-                        addPermission(exchangeDataInfo.exchangeData.delegate, delegation.permissions);
+                        res[hash] = {
+                            delegator: exchangeDataInfo.exchangeData.delegator,
+                            delegate: exchangeDataInfo.exchangeData.delegate,
+                            fullyExplicit: false,
+                            accessLevel: delegation.permissions,
+                            accessControlSecret: exchangeDataInfo.accessControlSecret,
+                        };
                     }
                     else {
-                        hasUnknownAnonymousDataOwners = true;
+                        updatedRemainingDelegations.push([hash, delegation]);
                     }
                 }
                 else {
-                    hasUnknownAnonymousDataOwners = true;
+                    updatedRemainingDelegations.push([hash, delegation]);
                 }
             }
-            return {
-                permissionsByDataOwnerId: accumulatedPermissions,
-                hasUnknownAnonymousDataOwners,
-            };
+            return Object.assign(Object.assign({}, res), Object.fromEntries(updatedRemainingDelegations.map(([hash, secureDelegation]) => [
+                hash,
+                {
+                    delegator: secureDelegation.delegator,
+                    delegate: secureDelegation.delegate,
+                    fullyExplicit: false,
+                    accessLevel: secureDelegation.permissions,
+                    accessControlSecret: undefined,
+                },
+            ])));
         });
     }
     hasAnyEncryptionKeys(entity) {

package/icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecureDelegationsSecurityMetadataDecryptor.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AACA,2EAAuE;AAKvE,IAAO,WAAW,GAAG,mCAAgB,CAAC,eAAe,CAAA;AAWrD,MAAa,0CAA0C;IACrD,YACmB,YAAiC,EACjC,eAAuC,EACvC,2BAAwD,EACxD,YAA8B;QAH9B,iBAAY,GAAZ,YAAY,CAAqB;QACjC,oBAAe,GAAf,eAAe,CAAwB;QACvC,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,iBAAY,GAAZ,YAAY,CAAkB;IAC9C,CAAC;IAEJ,uBAAuB,CACrB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,cAAc,mCAAI,EAAE,CAAA,EAAA,EAC7B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CACtE,CAAA;IACH,CAAC;IAED,wBAAwB,CACtB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,eAAe,mCAAI,EAAE,CAAA,EAAA,EAC9B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CACvE,CAAA;IACH,CAAC;IAED,kBAAkB,CAChB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,SAAS,mCAAI,EAAE,CAAA,EAAA,EACxB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CACjE,CAAA;IACH,CAAC;IAEK,yBAAyB,CAAC,WAAoC;;;YAIlE,MAAM,sBAAsB,GAA+D,EAAE,CAAA;YAC7F,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,SAAS,aAAa,CAAC,UAAkB,EAAE,KAAuC;gBAChF,IAAI,sBAAsB,CAAC,UAAU,CAAC,KAAK,WAAW,CAAC,KAAK,EAAE;oBAC5D,sBAAsB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAA;iBAC3C;YACH,CAAC;YACD,8GAA8G;YAC9G,IAAI,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAA;YACvG,IAAI,2BAA2B,GAAiC,EAAE,CAAA;YAClE,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE;gBAClD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;gBACrC,IAAI,UAAU,CAAC,SAAS,EAAE;oBACxB,aAAa,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBAC5D;gBACD,IAAI,UAAU,CAAC,QAAQ,EAAE;oBACvB,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBAC3D;gBACD,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE;oBACjD,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;iBAClD;aACF;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,CAAA;YAC5H,2BAA2B,GAAG,EAAE,CAAA;YAChC,mIAAmI;YACnI,mFAAmF;YACnF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAC9F,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACrC,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CAAA;YACD,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE;gBAClD,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;gBACvE,IAAI,wBAAwB,EAAE;oBAC5B,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;oBAC9F,aAAa,CAAC,wBAAwB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;iBAC9F;qBAAM;oBACL,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;iBAClD;aACF;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,CAAA;YAC5H,0IAA0I;YAC1I,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;YAC3E,MAAM,SAAS,GAAG;gBAChB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;gBACpD,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;aAC5E,CAAA;YACD,MAAM,wBAAwB,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;gBACxH,uCACK,IAAI,KACP,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,IACtB;YACH,CAAC,EAAE,EAAyC,CAAC,CAAA;YAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,oBAAoB,EAAE;gBACrD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,EAAE;oBAClF,MAAM,MAAM,GAAG,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC;wBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC;wBACvH,CAAC,CAAC,SAAS,CAAA;oBACb,MAAM,gBAAgB,GAAG,MAAM;wBAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAAE,IAAI,CAAC;wBAC9H,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,gBAAgB,EAAE;wBACpB,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;wBAC9E,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;qBAC9E;yBAAM;wBACL,6BAA6B,GAAG,IAAI,CAAA;qBACrC;iBACF;qBAAM;oBACL,6BAA6B,GAAG,IAAI,CAAA;iBACrC;aACF;YACD,OAAO;gBACL,wBAAwB,EAAE,sBAAsB;gBAChD,6BAA6B;aAC9B,CAAA;;KACF;IAED,oBAAoB,CAAC,MAA6C;;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,cAAc,0CAAE,MAAM,CAAA,EAAA,CAAC,CAAA;IAC9G,CAAC;IAEK,oBAAoB,CAAC,WAAoC,EAAE,yBAAmC;;;YAClG,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,0IAA0I;YAC1I,kDAAkD;YAClD,IAAI,qBAAqB,GAAuB,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,MAAM,CAChI,CAAC,gBAAgB,EAAE,EAAE,CACnB,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,SAAS,IAAI,SAAS,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CACrI,CAAA;YACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBACjC,MAAM,YAAY,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,CAAA;gBAC1E,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CACzC,IAAI,GAAG,CACL,MAAM,CAAC,IAAI,CACT,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CACnE;oBACE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC;oBAC5E,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,EACD,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CACF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACb,MAAM,oBAAoB,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC1E,OAAO,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC3D,CAAC,CAAC,CACH,CACF,CAAA;gBACD,qBAAqB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA,EAAA,CAAC,CAAA;aACrI;YAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YACjG,IAAI,QAAQ,GAA4B,SAAS,CAAA;YACjD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE;gBACpC,IAAI,UAAU,KAAK,WAAW,CAAC,KAAK,EAAE;oBACpC,OAAO,WAAW,CAAC,KAAK,CAAA;iBACzB;gBACD,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,EAAE;oBACnC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAA;iBAC5B;aACF;YACD,OAAO,QAAQ,CAAA;;KAChB;IAEO,wBAAwB,CAC9B,WAAoC,EACpC,yBAAmC,EACnC,gBAA4D,EAC5D,kBAA8E;QAE9E,IAAI,CAAC,yBAAyB,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QACpG,MAAM,IAAI,GAAG,IAAI,CAAA;QAEjB,SAAe,sCAAsC,CACnD,MAAgB,EAChB,uCAA4E;;;gBAE5E,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE;oBAClC,MAAM,uBAAuB,GAAG,CAAC,CAAC,uCAAuC,CAAC,IAAI,CAAC;wBAC7E,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,MAAA,uCAAuC,CAAC,IAAI,CAAC,0CAAE,wBAAwB,CAAC;wBACvI,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,uBAAuB;wBAAE,OAAO,uBAAuB,CAAA;iBAC9D;;SACF;QAED,SAAe,OAAO,CACpB,UAA4B,EAC5B,mBAAuF;;gBAEvF,IAAI,CAAC,mBAAmB,CAAC,WAAW;oBAAE,OAAO,EAAE,CAAA;gBAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;gBAClD,IAAI,CAAC,aAAa,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAA;gBACpC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,mBAAmB,CAAC,YAAY,CAAC,SAAS,IAAI,CAAC,KAAK,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC;oBAC7I,OAAO,EAAE,CAAA;gBACX,MAAM,oBAAoB,GAAG,CAAC,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;gBACpH,MAAM,GAAG,GAAG,EAAE,CAAA;gBACd,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE;oBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,CAAC,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAA;iBAC/G;gBACD,OAAO,GAAG,CAAA;YACZ,CAAC;SAAA;QAED,SAAgB,SAAS;;;gBACvB,IAAI,oBAAoB,GAAkC,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE;;oBAAC,OAAA,CAAC;wBAChC,UAAU;wBACV,MAAM,EAAE;4BACN,aAAa;4BACb,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iCAC3E,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;iCACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;yBACpB;qBACF,CAAC,CAAA;iBAAA,CACH,CAAA;gBAED;;;;;;mBAMG;gBAEH,+DAA+D;gBAC/D,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,MAAM,gBAAgB,GAAG,cAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAC5F;oBACE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC;oBAC5E,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,EACD,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CAAA,CAAA;gBACD,IAAI,2BAA2B,GAAkC,EAAE,CAAA;gBACnE,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBACvG,IAAI,mBAAmB,EAAE;wBACvB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM,IACL,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC;wBACrF,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,iBAAiB,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,KAAK,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EAClI;wBACA,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAClD,2BAA2B,GAAG,EAAE,CAAA;gBAEhC,gJAAgJ;gBAChJ,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,cAAc;wBACrE,CAAC,CAAC,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC9C,iBAAiB,CAAC,UAAU,CAAC,cAAc,EAC3C,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,KAAK,CACN,CAAA;wBACH,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,mBAAmB,EAAE;wBACzB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM;wBACL,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAClD,2BAA2B,GAAG,EAAE,CAAA;gBAEhC,2HAA2H;gBAC3H,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,cAAc;wBACrE,CAAC,CAAC,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC9C,iBAAiB,CAAC,UAAU,CAAC,cAAc,EAC3C,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,IAAI,CACL,CAAA;wBACH,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,mBAAmB,EAAE;wBACzB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM;wBACL,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAElD,qHAAqH;gBACrH,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,MAAM,SAAS,GAAG;oBAChB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;oBAChD,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,CAAA;gBACD,MAAM,uCAAuC,GAAG,CAAC,cAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;oBACvI,uCACK,IAAI,KACP,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,IACtB;gBACH,CAAC,EAAE,EAAyC,CAAC,CAAA;gBAC7C,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,uBAAuB,GAAG,cAAM,sCAAsC,CAC1E,iBAAiB,CAAC,MAAM,EACxB,uCAAuC,CACxC,CAAA,CAAA;oBACD,IAAI,uBAAuB,EAAE;wBAC3B,MAAM,mBAAmB,GAAG,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC1E,uBAAuB,EACvB,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,IAAI,CACL,CAAA,CAAA;wBACD,IAAI,mBAAmB,EAAE;4BACvB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;gCAAE,oBAAM,SAAS,CAAA,CAAA;yBAC1G;qBACF;iBACF;;SACF;QAED,OAAO,SAAS,EAAE,CAAA;IACpB,CAAC;CACF;AA1UD,gGA0UC","sourcesContent":["import { SecurityMetadataDecryptor } from './SecurityMetadataDecryptor'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName'\nimport { ExchangeData } from '../../icc-api/model/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport AccessLevel = SecureDelegation.AccessLevelEnum\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\nimport { ExchangeDataMap } from '../../icc-api/model/ExchangeDataMap'\n\ntype DelegationDecryptionDetails = {\n  delegation: SecureDelegation\n  hashes: string[]\n}\n\nexport class SecureDelegationsSecurityMetadataDecryptor implements SecurityMetadataDecryptor {\n  constructor(\n    private readonly exchangeData: ExchangeDataManager,\n    private readonly exchangeDataMap: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly dataOwnerApi: IccDataOwnerXApi\n  ) {}\n\n  decryptEncryptionKeysOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.encryptionKeys ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptEncryptionKey(e, k)\n    )\n  }\n\n  decryptOwningEntityIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.owningEntityIds ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptOwningEntityId(e, k)\n    )\n  }\n\n  decryptSecretIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.secretIds ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptSecretId(e, k)\n    )\n  }\n\n  async getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [delegateId: string]: SecureDelegation.AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const accumulatedPermissions: { [delegateId: string]: SecureDelegation.AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    function addPermission(delegateId: string, level: SecureDelegation.AccessLevelEnum): void {\n      if (accumulatedPermissions[delegateId] !== AccessLevel.WRITE) {\n        accumulatedPermissions[delegateId] = level\n      }\n    }\n    // 1. Add all explicit data owners, keep only delegations with at least an anonymous data owner to check later\n    let remainingDelegations = Object.entries(typedEntity.entity.securityMetadata?.secureDelegations ?? {})\n    let updatedRemainingDelegations: [string, SecureDelegation][] = []\n    for (const delegationEntry of remainingDelegations) {\n      const delegation = delegationEntry[1]\n      if (delegation.delegator) {\n        addPermission(delegation.delegator, delegation.permissions)\n      }\n      if (delegation.delegate) {\n        addPermission(delegation.delegate, delegation.permissions)\n      }\n      if (!delegation.delegator || !delegation.delegate) {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return { permissionsByDataOwnerId: accumulatedPermissions, hasUnknownAnonymousDataOwners }\n    updatedRemainingDelegations = []\n    // 2. Attempt to identify the anonymous data owner of remaining delegations by checking if we have the exchange data cached by hash\n    // Note: we can find exchange data by hash only if we could successfully decrypt it\n    const cachedExchangeData = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n      remainingDelegations.map((d) => d[0]),\n      typedEntity.type,\n      typedEntity.entity.secretForeignKeys ?? []\n    )\n    for (const delegationEntry of remainingDelegations) {\n      const exchangeDataOfDelegation = cachedExchangeData[delegationEntry[0]]\n      if (exchangeDataOfDelegation) {\n        addPermission(exchangeDataOfDelegation.exchangeData.delegator, delegationEntry[1].permissions)\n        addPermission(exchangeDataOfDelegation.exchangeData.delegate, delegationEntry[1].permissions)\n      } else {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return { permissionsByDataOwnerId: accumulatedPermissions, hasUnknownAnonymousDataOwners }\n    // 3. Attempt to identify the anonymous data owner of remaining delegations between us (or one of our parents) and an anonymous data owner\n    const hierarchy = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n    const allHashes = [\n      ...remainingDelegations.flatMap(([hash, _]) => hash),\n      ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n    ]\n    const encryptedExchangeDataIds = (await this.exchangeDataMap.getExchangeDataMapBatch(allHashes)).reduce((maps, current) => {\n      return {\n        ...maps,\n        [current.id]: current,\n      }\n    }, {} as { [hash: string]: ExchangeDataMap })\n    for (const [hash, delegation] of remainingDelegations) {\n      if (hierarchy.some((x) => x === delegation.delegate || x === delegation.delegator)) {\n        const dataId = !!encryptedExchangeDataIds[hash]\n          ? await this.secureDelegationsEncryption.decryptExchangeDataId(encryptedExchangeDataIds[hash].encryptedExchangeDataIds)\n          : undefined\n        const exchangeDataInfo = dataId\n          ? await this.exchangeData.getDecryptionDataKeyById(dataId, typedEntity.type, typedEntity.entity.secretForeignKeys ?? [], true)\n          : undefined\n        if (exchangeDataInfo) {\n          addPermission(exchangeDataInfo.exchangeData.delegator, delegation.permissions)\n          addPermission(exchangeDataInfo.exchangeData.delegate, delegation.permissions)\n        } else {\n          hasUnknownAnonymousDataOwners = true\n        }\n      } else {\n        hasUnknownAnonymousDataOwners = true\n      }\n    }\n    return {\n      permissionsByDataOwnerId: accumulatedPermissions,\n      hasUnknownAnonymousDataOwners,\n    }\n  }\n\n  hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean {\n    return Object.values(entity.securityMetadata?.secureDelegations ?? {}).some((d) => d.encryptionKeys?.length)\n  }\n\n  async getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevel | undefined> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    // If the data owner is explicit all delegations he can access has his id. If the delegator is anonymous all delegations he can access are\n    // accessible by hash. No mixed scenario possible.\n    let accessibleDelegations: SecureDelegation[] = Object.values(typedEntity.entity.securityMetadata?.secureDelegations ?? {}).filter(\n      (secureDelegation) =>\n        dataOwnersHierarchySubset.some((dataOwner) => dataOwner === secureDelegation.delegator || dataOwner === secureDelegation.delegate)\n    )\n    if (!accessibleDelegations.length) {\n      const equivalences = typedEntity.entity.securityMetadata?.keysEquivalences\n      const availableCanonicalHashes = Array.from(\n        new Set(\n          Object.keys(\n            await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n              [\n                ...Object.keys(typedEntity.entity.securityMetadata?.secureDelegations ?? {}),\n                ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n              ],\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? []\n            )\n          ).map((hash) => {\n            const canonicalEquivalence = equivalences ? equivalences[hash] : undefined\n            return canonicalEquivalence ? canonicalEquivalence : hash\n          })\n        )\n      )\n      accessibleDelegations = availableCanonicalHashes.map((hash) => (typedEntity.entity.securityMetadata?.secureDelegations ?? {})[hash])\n    }\n\n    const permissions = accessibleDelegations.map((secureDelegation) => secureDelegation.permissions)\n    let maxLevel: AccessLevel | undefined = undefined\n    for (const permission of permissions) {\n      if (permission === AccessLevel.WRITE) {\n        return AccessLevel.WRITE\n      }\n      if (permission === AccessLevel.READ) {\n        maxLevel = AccessLevel.READ\n      }\n    }\n    return maxLevel\n  }\n\n  private decryptSecureDelegations(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[],\n    getDataToDecrypt: (delegation: SecureDelegation) => string[],\n    decryptDataWithKey: (encryptedData: string, key: CryptoKey) => Promise<string>\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    const self = this\n\n    async function getFirstDecryptedExchangeDataIdForHash(\n      hashes: string[],\n      encryptedExchangeDataIdsByDelegationKey: { [hash: string]: ExchangeDataMap }\n    ): Promise<string | undefined> {\n      for (const hash of new Set(hashes)) {\n        const decryptedExchangeDataId = !!encryptedExchangeDataIdsByDelegationKey[hash]\n          ? await self.secureDelegationsEncryption.decryptExchangeDataId(encryptedExchangeDataIdsByDelegationKey[hash]?.encryptedExchangeDataIds)\n          : undefined\n        if (!!decryptedExchangeDataId) return decryptedExchangeDataId\n      }\n    }\n\n    async function decrypt(\n      delegation: SecureDelegation,\n      exchangeDataDetails: { exchangeData: ExchangeData; exchangeKey: CryptoKey | undefined }\n    ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n      if (!exchangeDataDetails.exchangeKey) return []\n      const dataToDecrypt = getDataToDecrypt(delegation)\n      if (!dataToDecrypt.length) return []\n      if (!dataOwnersHierarchySubset.some((x) => x === exchangeDataDetails.exchangeData.delegator || x === exchangeDataDetails.exchangeData.delegate))\n        return []\n      const dataOwnersWithAccess = [exchangeDataDetails.exchangeData.delegator, exchangeDataDetails.exchangeData.delegate]\n      const res = []\n      for (const curr of dataToDecrypt) {\n        res.push({ decrypted: await decryptDataWithKey(curr, exchangeDataDetails.exchangeKey), dataOwnersWithAccess })\n      }\n      return res\n    }\n\n    async function* generator(): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n      let remainingDelegations: DelegationDecryptionDetails[] = Object.entries(typedEntity.entity.securityMetadata?.secureDelegations ?? {}).map(\n        ([canonicalHash, delegation]) => ({\n          delegation,\n          hashes: [\n            canonicalHash,\n            ...Object.entries(typedEntity.entity.securityMetadata?.keysEquivalences ?? {})\n              .filter((x) => x[1] == canonicalHash)\n              .map((x) => x[0]),\n          ],\n        })\n      )\n\n      /*\n       * Generate from least expensive to most (in terms of time to decrypt). 1 and 2a have equivalent costs.\n       * 1) Secure delegations with cached exchange data by hash\n       * 2) Secure delegations with cached exchange data by id for explicit->explicit delegations where delegator and/or delegate is me or parent\n       * 3) Non cached secure delegations for explicit->explicit delegations where delegator and/or delegate is me or parent (half of old 3)\n       * 4) Decrypt secure delegation id for explicit->anonymous or anonymous->explicit where explicit is me or parent (2b and half of old3)\n       */\n\n      // Step 1) Secure delegations with cached exchange data by hash\n      if (!remainingDelegations.length) return\n      const cachedDataByHash = await self.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n        [\n          ...Object.keys(typedEntity.entity.securityMetadata?.secureDelegations ?? {}),\n          ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n        ],\n        typedEntity.type,\n        typedEntity.entity.secretForeignKeys ?? []\n      )\n      let updatedRemainingDelegations: DelegationDecryptionDetails[] = []\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.hashes.map((h) => cachedDataByHash?.[h]).find((x) => !!x)\n        if (exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else if (\n          (!!decryptionDetails.delegation.delegate || !!decryptionDetails.delegation.delegator) &&\n          dataOwnersHierarchySubset.some((x) => x === decryptionDetails.delegation.delegate || x === decryptionDetails.delegation.delegator)\n        ) {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n      updatedRemainingDelegations = []\n\n      // Step 2) Secure delegations with cached exchange data by id for explicit->explicit delegations where delegator and/or delegate is me or parent\n      if (!remainingDelegations.length) return\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.delegation.exchangeDataId\n          ? await self.exchangeData.getDecryptionDataKeyById(\n              decryptionDetails.delegation.exchangeDataId,\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? [],\n              false\n            )\n          : undefined\n        if (!!exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n      updatedRemainingDelegations = []\n\n      // Step 3) Non cached secure delegations for explicit->explicit delegations where delegator and/or delegate is me or parent\n      if (!remainingDelegations.length) return\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.delegation.exchangeDataId\n          ? await self.exchangeData.getDecryptionDataKeyById(\n              decryptionDetails.delegation.exchangeDataId,\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? [],\n              true\n            )\n          : undefined\n        if (!!exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n\n      // Step 4) Decrypt secure delegation id for explicit->anonymous or anonymous->explicit where explicit is me or parent\n      if (!remainingDelegations.length) return\n      const allHashes = [\n        ...remainingDelegations.flatMap((x) => x.hashes),\n        ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n      ]\n      const encryptedExchangeDataIdsByDelegationKey = (await self.exchangeDataMap.getExchangeDataMapBatch(allHashes)).reduce((maps, current) => {\n        return {\n          ...maps,\n          [current.id]: current,\n        }\n      }, {} as { [hash: string]: ExchangeDataMap })\n      for (const decryptionDetails of remainingDelegations) {\n        const decryptedExchangeDataId = await getFirstDecryptedExchangeDataIdForHash(\n          decryptionDetails.hashes,\n          encryptedExchangeDataIdsByDelegationKey\n        )\n        if (decryptedExchangeDataId) {\n          const exchangeDataDetails = await self.exchangeData.getDecryptionDataKeyById(\n            decryptedExchangeDataId,\n            typedEntity.type,\n            typedEntity.entity.secretForeignKeys ?? [],\n            true\n          )\n          if (exchangeDataDetails) {\n            for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n          }\n        }\n      }\n    }\n\n    return generator()\n  }\n}\n"]}
+{"version":3,"file":"SecureDelegationsSecurityMetadataDecryptor.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AACA,2EAAuE;AAKvE,IAAO,WAAW,GAAG,mCAAgB,CAAC,eAAe,CAAA;AAoBrD,MAAa,0CAA0C;IACrD,YACmB,YAAiC,EACjC,eAAuC,EACvC,2BAAwD,EACxD,YAA8B;QAH9B,iBAAY,GAAZ,YAAY,CAAqB;QACjC,oBAAe,GAAf,eAAe,CAAwB;QACvC,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,iBAAY,GAAZ,YAAY,CAAkB;IAC9C,CAAC;IAEJ,uBAAuB,CACrB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,cAAc,mCAAI,EAAE,CAAA,EAAA,EAC7B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CACtE,CAAA;IACH,CAAC;IAED,wBAAwB,CACtB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,eAAe,mCAAI,EAAE,CAAA,EAAA,EAC9B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CACvE,CAAA;IACH,CAAC;IAED,kBAAkB,CAChB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,wBAAwB,CAClC,WAAW,EACX,yBAAyB,EACzB,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,SAAS,mCAAI,EAAE,CAAA,EAAA,EACxB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CACjE,CAAA;IACH,CAAC;IAED;;;OAGG;IACG,0BAA0B,CAAC,WAAoC;;;YAGnE,MAAM,GAAG,GAA0D,EAAE,CAAA;YACrE,8GAA8G;YAC9G,IAAI,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAA;YACvG,IAAI,2BAA2B,GAAiC,EAAE,CAAA;YAClE,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE;gBAClD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;gBACrC,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,EAAE;oBAC/C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG;wBACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC/B,aAAa,EAAE,IAAI;wBACnB,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,mBAAmB,EAAE,SAAS;qBAC/B,CAAA;iBACF;qBAAM;oBACL,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;iBAClD;aACF;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAA;YAC5C,2BAA2B,GAAG,EAAE,CAAA;YAChC,mIAAmI;YACnI,mFAAmF;YACnF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAC9F,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACrC,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CAAA;YACD,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE;gBAClD,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;gBACvE,IAAI,wBAAwB,EAAE;oBAC5B,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG;wBACxB,QAAQ,EAAE,wBAAwB,CAAC,YAAY,CAAC,QAAQ;wBACxD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS;wBAC1D,aAAa,EAAE,KAAK;wBACpB,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW;wBAC3C,mBAAmB,EAAE,wBAAwB,CAAC,mBAAmB;qBAClE,CAAA;iBACF;qBAAM;oBACL,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;iBAClD;aACF;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAA;YAC5C,2BAA2B,GAAG,EAAE,CAAA;YAChC,0IAA0I;YAC1I,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;YAC3E,MAAM,SAAS,GAAG;gBAChB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;gBACpD,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;aAC5E,CAAA;YACD,MAAM,wBAAwB,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;gBACxH,uCACK,IAAI,KACP,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,IACtB;YACH,CAAC,EAAE,EAAyC,CAAC,CAAA;YAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,oBAAoB,EAAE;gBACrD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,EAAE;oBAClF,MAAM,MAAM,GAAG,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC;wBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC;wBACvH,CAAC,CAAC,SAAS,CAAA;oBACb,MAAM,gBAAgB,GAAG,MAAM;wBAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAAE,IAAI,CAAC;wBAC9H,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,gBAAgB,EAAE;wBACpB,GAAG,CAAC,IAAI,CAAC,GAAG;4BACV,SAAS,EAAE,gBAAgB,CAAC,YAAY,CAAC,SAAS;4BAClD,QAAQ,EAAE,gBAAgB,CAAC,YAAY,CAAC,QAAQ;4BAChD,aAAa,EAAE,KAAK;4BACpB,WAAW,EAAE,UAAU,CAAC,WAAW;4BACnC,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB;yBAC1D,CAAA;qBACF;yBAAM;wBACL,2BAA2B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;qBACrD;iBACF;qBAAM;oBACL,2BAA2B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;iBACrD;aACF;YACD,uCACK,GAAG,GACH,MAAM,CAAC,WAAW,CACnB,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBAC5D,IAAI;gBACJ;oBACE,SAAS,EAAE,gBAAgB,CAAC,SAAS;oBACrC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,mBAAmB,EAAE,SAAS;iBAC/B;aACF,CAAC,CACH,EACF;;KACF;IAED,oBAAoB,CAAC,MAA6C;;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,CAAC,cAAc,0CAAE,MAAM,CAAA,EAAA,CAAC,CAAA;IAC9G,CAAC;IAEK,oBAAoB,CAAC,WAAoC,EAAE,yBAAmC;;;YAClG,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,0IAA0I;YAC1I,kDAAkD;YAClD,IAAI,qBAAqB,GAAuB,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,MAAM,CAChI,CAAC,gBAAgB,EAAE,EAAE,CACnB,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,SAAS,IAAI,SAAS,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CACrI,CAAA;YACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBACjC,MAAM,YAAY,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,CAAA;gBAC1E,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CACzC,IAAI,GAAG,CACL,MAAM,CAAC,IAAI,CACT,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CACnE;oBACE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC;oBAC5E,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,EACD,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CACF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACb,MAAM,oBAAoB,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC1E,OAAO,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC3D,CAAC,CAAC,CACH,CACF,CAAA;gBACD,qBAAqB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA,EAAA,CAAC,CAAA;aACrI;YAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YACjG,IAAI,QAAQ,GAA4B,SAAS,CAAA;YACjD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE;gBACpC,IAAI,UAAU,KAAK,WAAW,CAAC,KAAK,EAAE;oBACpC,OAAO,WAAW,CAAC,KAAK,CAAA;iBACzB;gBACD,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,EAAE;oBACnC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAA;iBAC5B;aACF;YACD,OAAO,QAAQ,CAAA;;KAChB;IAEO,wBAAwB,CAC9B,WAAoC,EACpC,yBAAmC,EACnC,gBAA4D,EAC5D,kBAA8E;QAE9E,IAAI,CAAC,yBAAyB,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QACpG,MAAM,IAAI,GAAG,IAAI,CAAA;QAEjB,SAAe,sCAAsC,CACnD,MAAgB,EAChB,uCAA4E;;;gBAE5E,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE;oBAClC,MAAM,uBAAuB,GAAG,CAAC,CAAC,uCAAuC,CAAC,IAAI,CAAC;wBAC7E,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,MAAA,uCAAuC,CAAC,IAAI,CAAC,0CAAE,wBAAwB,CAAC;wBACvI,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,uBAAuB;wBAAE,OAAO,uBAAuB,CAAA;iBAC9D;;SACF;QAED,SAAe,OAAO,CACpB,UAA4B,EAC5B,mBAAuF;;gBAEvF,IAAI,CAAC,mBAAmB,CAAC,WAAW;oBAAE,OAAO,EAAE,CAAA;gBAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;gBAClD,IAAI,CAAC,aAAa,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAA;gBACpC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,mBAAmB,CAAC,YAAY,CAAC,SAAS,IAAI,CAAC,KAAK,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC;oBAC7I,OAAO,EAAE,CAAA;gBACX,MAAM,oBAAoB,GAAG,CAAC,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;gBACpH,MAAM,GAAG,GAAG,EAAE,CAAA;gBACd,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE;oBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,CAAC,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAA;iBAC/G;gBACD,OAAO,GAAG,CAAA;YACZ,CAAC;SAAA;QAED,SAAgB,SAAS;;;gBACvB,IAAI,oBAAoB,GAAkC,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE;;oBAAC,OAAA,CAAC;wBAChC,UAAU;wBACV,MAAM,EAAE;4BACN,aAAa;4BACb,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iCAC3E,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;iCACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;yBACpB;qBACF,CAAC,CAAA;iBAAA,CACH,CAAA;gBAED;;;;;;mBAMG;gBAEH,+DAA+D;gBAC/D,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,MAAM,gBAAgB,GAAG,cAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAC5F;oBACE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC;oBAC5E,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,EACD,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC3C,CAAA,CAAA;gBACD,IAAI,2BAA2B,GAAkC,EAAE,CAAA;gBACnE,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBACvG,IAAI,mBAAmB,EAAE;wBACvB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM,IACL,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC;wBACrF,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,iBAAiB,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,KAAK,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EAClI;wBACA,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAClD,2BAA2B,GAAG,EAAE,CAAA;gBAEhC,gJAAgJ;gBAChJ,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,cAAc;wBACrE,CAAC,CAAC,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC9C,iBAAiB,CAAC,UAAU,CAAC,cAAc,EAC3C,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,KAAK,CACN,CAAA;wBACH,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,mBAAmB,EAAE;wBACzB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM;wBACL,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAClD,2BAA2B,GAAG,EAAE,CAAA;gBAEhC,2HAA2H;gBAC3H,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,cAAc;wBACrE,CAAC,CAAC,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC9C,iBAAiB,CAAC,UAAU,CAAC,cAAc,EAC3C,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,IAAI,CACL,CAAA;wBACH,CAAC,CAAC,SAAS,CAAA;oBACb,IAAI,CAAC,CAAC,mBAAmB,EAAE;wBACzB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;4BAAE,oBAAM,SAAS,CAAA,CAAA;qBAC1G;yBAAM;wBACL,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;qBACpD;iBACF;gBACD,oBAAoB,GAAG,2BAA2B,CAAA;gBAElD,qHAAqH;gBACrH,IAAI,CAAC,oBAAoB,CAAC,MAAM;oBAAE,6BAAM;gBACxC,MAAM,SAAS,GAAG;oBAChB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;oBAChD,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC;iBAC5E,CAAA;gBACD,MAAM,uCAAuC,GAAG,CAAC,cAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;oBACvI,uCACK,IAAI,KACP,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,IACtB;gBACH,CAAC,EAAE,EAAyC,CAAC,CAAA;gBAC7C,KAAK,MAAM,iBAAiB,IAAI,oBAAoB,EAAE;oBACpD,MAAM,uBAAuB,GAAG,cAAM,sCAAsC,CAC1E,iBAAiB,CAAC,MAAM,EACxB,uCAAuC,CACxC,CAAA,CAAA;oBACD,IAAI,uBAAuB,EAAE;wBAC3B,MAAM,mBAAmB,GAAG,cAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC1E,uBAAuB,EACvB,WAAW,CAAC,IAAI,EAChB,MAAA,WAAW,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC1C,IAAI,CACL,CAAA,CAAA;wBACD,IAAI,mBAAmB,EAAE;4BACvB,KAAK,MAAM,SAAS,IAAI,cAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;gCAAE,oBAAM,SAAS,CAAA,CAAA;yBAC1G;qBACF;iBACF;;SACF;QAED,OAAO,SAAS,EAAE,CAAA;IACpB,CAAC;CACF;AA/VD,gGA+VC","sourcesContent":["import { SecurityMetadataDecryptor } from './SecurityMetadataDecryptor'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport AccessLevel = SecureDelegation.AccessLevelEnum\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\nimport { ExchangeDataMap } from '../../icc-api/model/internal/ExchangeDataMap'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\n\ntype DelegationDecryptionDetails = {\n  delegation: SecureDelegation\n  hashes: string[]\n}\n\nexport type DelegationMembersDetails = {\n  delegator: string | undefined\n  delegate: string | undefined\n  fullyExplicit: boolean\n  accessControlSecret: string | undefined\n  accessLevel: AccessLevelEnum\n}\n\nexport class SecureDelegationsSecurityMetadataDecryptor implements SecurityMetadataDecryptor {\n  constructor(\n    private readonly exchangeData: ExchangeDataManager,\n    private readonly exchangeDataMap: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly dataOwnerApi: IccDataOwnerXApi\n  ) {}\n\n  decryptEncryptionKeysOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.encryptionKeys ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptEncryptionKey(e, k)\n    )\n  }\n\n  decryptOwningEntityIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.owningEntityIds ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptOwningEntityId(e, k)\n    )\n  }\n\n  decryptSecretIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.decryptSecureDelegations(\n      typedEntity,\n      dataOwnersHierarchySubset,\n      (d) => d.secretIds ?? [],\n      (e, k) => this.secureDelegationsEncryption.decryptSecretId(e, k)\n    )\n  }\n\n  /**\n   * Get information for members of secure delegations in the entity. Also provides information for delegations with anonymous delegate and/or\n   * delegator if one of the delegation members is the current data owner (or a parent) AND has still access to the exchange data used in the .\n   */\n  async getDelegationMemberDetails(typedEntity: EncryptedEntityWithType): Promise<{\n    [delegationKey: string]: DelegationMembersDetails\n  }> {\n    const res: { [delegationKey: string]: DelegationMembersDetails } = {}\n    // 1. Add all explicit data owners, keep only delegations with at least an anonymous data owner to check later\n    let remainingDelegations = Object.entries(typedEntity.entity.securityMetadata?.secureDelegations ?? {})\n    let updatedRemainingDelegations: [string, SecureDelegation][] = []\n    for (const delegationEntry of remainingDelegations) {\n      const delegation = delegationEntry[1]\n      if (delegation.delegator && delegation.delegate) {\n        res[delegationEntry[0]] = {\n          delegate: delegation.delegate,\n          delegator: delegation.delegator,\n          fullyExplicit: true,\n          accessLevel: delegation.permissions,\n          accessControlSecret: undefined,\n        }\n      } else {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return res\n    updatedRemainingDelegations = []\n    // 2. Attempt to identify the anonymous data owner of remaining delegations by checking if we have the exchange data cached by hash\n    // Note: we can find exchange data by hash only if we could successfully decrypt it\n    const cachedExchangeData = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n      remainingDelegations.map((d) => d[0]),\n      typedEntity.type,\n      typedEntity.entity.secretForeignKeys ?? []\n    )\n    for (const delegationEntry of remainingDelegations) {\n      const exchangeDataOfDelegation = cachedExchangeData[delegationEntry[0]]\n      if (exchangeDataOfDelegation) {\n        res[delegationEntry[0]] = {\n          delegate: exchangeDataOfDelegation.exchangeData.delegate,\n          delegator: exchangeDataOfDelegation.exchangeData.delegator,\n          fullyExplicit: false,\n          accessLevel: delegationEntry[1].permissions,\n          accessControlSecret: exchangeDataOfDelegation.accessControlSecret,\n        }\n      } else {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return res\n    updatedRemainingDelegations = []\n    // 3. Attempt to identify the anonymous data owner of remaining delegations between us (or one of our parents) and an anonymous data owner\n    const hierarchy = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n    const allHashes = [\n      ...remainingDelegations.flatMap(([hash, _]) => hash),\n      ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n    ]\n    const encryptedExchangeDataIds = (await this.exchangeDataMap.getExchangeDataMapBatch(allHashes)).reduce((maps, current) => {\n      return {\n        ...maps,\n        [current.id]: current,\n      }\n    }, {} as { [hash: string]: ExchangeDataMap })\n    for (const [hash, delegation] of remainingDelegations) {\n      if (hierarchy.some((x) => x === delegation.delegate || x === delegation.delegator)) {\n        const dataId = !!encryptedExchangeDataIds[hash]\n          ? await this.secureDelegationsEncryption.decryptExchangeDataId(encryptedExchangeDataIds[hash].encryptedExchangeDataIds)\n          : undefined\n        const exchangeDataInfo = dataId\n          ? await this.exchangeData.getDecryptionDataKeyById(dataId, typedEntity.type, typedEntity.entity.secretForeignKeys ?? [], true)\n          : undefined\n        if (exchangeDataInfo) {\n          res[hash] = {\n            delegator: exchangeDataInfo.exchangeData.delegator,\n            delegate: exchangeDataInfo.exchangeData.delegate,\n            fullyExplicit: false,\n            accessLevel: delegation.permissions,\n            accessControlSecret: exchangeDataInfo.accessControlSecret,\n          }\n        } else {\n          updatedRemainingDelegations.push([hash, delegation])\n        }\n      } else {\n        updatedRemainingDelegations.push([hash, delegation])\n      }\n    }\n    return {\n      ...res,\n      ...Object.fromEntries(\n        updatedRemainingDelegations.map(([hash, secureDelegation]) => [\n          hash,\n          {\n            delegator: secureDelegation.delegator,\n            delegate: secureDelegation.delegate,\n            fullyExplicit: false,\n            accessLevel: secureDelegation.permissions,\n            accessControlSecret: undefined,\n          },\n        ])\n      ),\n    }\n  }\n\n  hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean {\n    return Object.values(entity.securityMetadata?.secureDelegations ?? {}).some((d) => d.encryptionKeys?.length)\n  }\n\n  async getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevel | undefined> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    // If the data owner is explicit all delegations he can access has his id. If the delegator is anonymous all delegations he can access are\n    // accessible by hash. No mixed scenario possible.\n    let accessibleDelegations: SecureDelegation[] = Object.values(typedEntity.entity.securityMetadata?.secureDelegations ?? {}).filter(\n      (secureDelegation) =>\n        dataOwnersHierarchySubset.some((dataOwner) => dataOwner === secureDelegation.delegator || dataOwner === secureDelegation.delegate)\n    )\n    if (!accessibleDelegations.length) {\n      const equivalences = typedEntity.entity.securityMetadata?.keysEquivalences\n      const availableCanonicalHashes = Array.from(\n        new Set(\n          Object.keys(\n            await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n              [\n                ...Object.keys(typedEntity.entity.securityMetadata?.secureDelegations ?? {}),\n                ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n              ],\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? []\n            )\n          ).map((hash) => {\n            const canonicalEquivalence = equivalences ? equivalences[hash] : undefined\n            return canonicalEquivalence ? canonicalEquivalence : hash\n          })\n        )\n      )\n      accessibleDelegations = availableCanonicalHashes.map((hash) => (typedEntity.entity.securityMetadata?.secureDelegations ?? {})[hash])\n    }\n\n    const permissions = accessibleDelegations.map((secureDelegation) => secureDelegation.permissions)\n    let maxLevel: AccessLevel | undefined = undefined\n    for (const permission of permissions) {\n      if (permission === AccessLevel.WRITE) {\n        return AccessLevel.WRITE\n      }\n      if (permission === AccessLevel.READ) {\n        maxLevel = AccessLevel.READ\n      }\n    }\n    return maxLevel\n  }\n\n  private decryptSecureDelegations(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[],\n    getDataToDecrypt: (delegation: SecureDelegation) => string[],\n    decryptDataWithKey: (encryptedData: string, key: CryptoKey) => Promise<string>\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    const self = this\n\n    async function getFirstDecryptedExchangeDataIdForHash(\n      hashes: string[],\n      encryptedExchangeDataIdsByDelegationKey: { [hash: string]: ExchangeDataMap }\n    ): Promise<string | undefined> {\n      for (const hash of new Set(hashes)) {\n        const decryptedExchangeDataId = !!encryptedExchangeDataIdsByDelegationKey[hash]\n          ? await self.secureDelegationsEncryption.decryptExchangeDataId(encryptedExchangeDataIdsByDelegationKey[hash]?.encryptedExchangeDataIds)\n          : undefined\n        if (!!decryptedExchangeDataId) return decryptedExchangeDataId\n      }\n    }\n\n    async function decrypt(\n      delegation: SecureDelegation,\n      exchangeDataDetails: { exchangeData: ExchangeData; exchangeKey: CryptoKey | undefined }\n    ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n      if (!exchangeDataDetails.exchangeKey) return []\n      const dataToDecrypt = getDataToDecrypt(delegation)\n      if (!dataToDecrypt.length) return []\n      if (!dataOwnersHierarchySubset.some((x) => x === exchangeDataDetails.exchangeData.delegator || x === exchangeDataDetails.exchangeData.delegate))\n        return []\n      const dataOwnersWithAccess = [exchangeDataDetails.exchangeData.delegator, exchangeDataDetails.exchangeData.delegate]\n      const res = []\n      for (const curr of dataToDecrypt) {\n        res.push({ decrypted: await decryptDataWithKey(curr, exchangeDataDetails.exchangeKey), dataOwnersWithAccess })\n      }\n      return res\n    }\n\n    async function* generator(): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n      let remainingDelegations: DelegationDecryptionDetails[] = Object.entries(typedEntity.entity.securityMetadata?.secureDelegations ?? {}).map(\n        ([canonicalHash, delegation]) => ({\n          delegation,\n          hashes: [\n            canonicalHash,\n            ...Object.entries(typedEntity.entity.securityMetadata?.keysEquivalences ?? {})\n              .filter((x) => x[1] == canonicalHash)\n              .map((x) => x[0]),\n          ],\n        })\n      )\n\n      /*\n       * Generate from least expensive to most (in terms of time to decrypt). 1 and 2a have equivalent costs.\n       * 1) Secure delegations with cached exchange data by hash\n       * 2) Secure delegations with cached exchange data by id for explicit->explicit delegations where delegator and/or delegate is me or parent\n       * 3) Non cached secure delegations for explicit->explicit delegations where delegator and/or delegate is me or parent (half of old 3)\n       * 4) Decrypt secure delegation id for explicit->anonymous or anonymous->explicit where explicit is me or parent (2b and half of old3)\n       */\n\n      // Step 1) Secure delegations with cached exchange data by hash\n      if (!remainingDelegations.length) return\n      const cachedDataByHash = await self.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(\n        [\n          ...Object.keys(typedEntity.entity.securityMetadata?.secureDelegations ?? {}),\n          ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n        ],\n        typedEntity.type,\n        typedEntity.entity.secretForeignKeys ?? []\n      )\n      let updatedRemainingDelegations: DelegationDecryptionDetails[] = []\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.hashes.map((h) => cachedDataByHash?.[h]).find((x) => !!x)\n        if (exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else if (\n          (!!decryptionDetails.delegation.delegate || !!decryptionDetails.delegation.delegator) &&\n          dataOwnersHierarchySubset.some((x) => x === decryptionDetails.delegation.delegate || x === decryptionDetails.delegation.delegator)\n        ) {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n      updatedRemainingDelegations = []\n\n      // Step 2) Secure delegations with cached exchange data by id for explicit->explicit delegations where delegator and/or delegate is me or parent\n      if (!remainingDelegations.length) return\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.delegation.exchangeDataId\n          ? await self.exchangeData.getDecryptionDataKeyById(\n              decryptionDetails.delegation.exchangeDataId,\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? [],\n              false\n            )\n          : undefined\n        if (!!exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n      updatedRemainingDelegations = []\n\n      // Step 3) Non cached secure delegations for explicit->explicit delegations where delegator and/or delegate is me or parent\n      if (!remainingDelegations.length) return\n      for (const decryptionDetails of remainingDelegations) {\n        const exchangeDataDetails = decryptionDetails.delegation.exchangeDataId\n          ? await self.exchangeData.getDecryptionDataKeyById(\n              decryptionDetails.delegation.exchangeDataId,\n              typedEntity.type,\n              typedEntity.entity.secretForeignKeys ?? [],\n              true\n            )\n          : undefined\n        if (!!exchangeDataDetails) {\n          for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n        } else {\n          updatedRemainingDelegations.push(decryptionDetails)\n        }\n      }\n      remainingDelegations = updatedRemainingDelegations\n\n      // Step 4) Decrypt secure delegation id for explicit->anonymous or anonymous->explicit where explicit is me or parent\n      if (!remainingDelegations.length) return\n      const allHashes = [\n        ...remainingDelegations.flatMap((x) => x.hashes),\n        ...Object.keys(typedEntity.entity.securityMetadata?.keysEquivalences ?? {}),\n      ]\n      const encryptedExchangeDataIdsByDelegationKey = (await self.exchangeDataMap.getExchangeDataMapBatch(allHashes)).reduce((maps, current) => {\n        return {\n          ...maps,\n          [current.id]: current,\n        }\n      }, {} as { [hash: string]: ExchangeDataMap })\n      for (const decryptionDetails of remainingDelegations) {\n        const decryptedExchangeDataId = await getFirstDecryptedExchangeDataIdForHash(\n          decryptionDetails.hashes,\n          encryptedExchangeDataIdsByDelegationKey\n        )\n        if (decryptedExchangeDataId) {\n          const exchangeDataDetails = await self.exchangeData.getDecryptionDataKeyById(\n            decryptedExchangeDataId,\n            typedEntity.type,\n            typedEntity.entity.secretForeignKeys ?? [],\n            true\n          )\n          if (exchangeDataDetails) {\n            for (const decrypted of await decrypt(decryptionDetails.delegation, exchangeDataDetails)) yield decrypted\n          }\n        }\n      }\n    }\n\n    return generator()\n  }\n}\n"]}

package/icc-x-api/crypto/SecurityMetadataDecryptor.d.ts

@@ -1,7 +1,6 @@
 import { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models';
 import { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName';
 import { SecureDelegation } from '../../icc-api/model/SecureDelegation';
-import AccessLevel = SecureDelegation.AccessLevelEnum;
 import AccessLevelEnum = SecureDelegation.AccessLevelEnum;
 /**
  * @internal this class is for internal use only and may be changed without notice.
@@ -66,17 +65,7 @@ export interface SecurityMetadataDecryptor {
      * access level. This array should contain only data owners from the current data owner hierarchy.
      * @return the access level to the entity or undefined if none of the data owners has full access to the entity.
      */
-    getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevel | undefined>;
-    /**
-     * Get the access level of each data owner with access to the entity according to the metadata supported by this decryptor.
-     * See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for details on the expected behaviour.
-     */
-    getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{
-        permissionsByDataOwnerId: {
-            [dataOwnerId: string]: AccessLevelEnum;
-        };
-        hasUnknownAnonymousDataOwners: boolean;
-    }>;
+    getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevelEnum | undefined>;
     /**
      * Verifies if there is at least one (encrypted) encryption key in the metadata supported by this decryptor, even if it can't be decrypted by the
      * current data owner.
@@ -104,11 +93,5 @@ export declare class SecurityMetadataDecryptorChain implements SecurityMetadataD
     }, void, never>;
     getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<SecureDelegation.AccessLevelEnum | undefined>;
     hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean;
-    getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{
-        permissionsByDataOwnerId: {
-            [dataOwnerId: string]: AccessLevelEnum;
-        };
-        hasUnknownAnonymousDataOwners: boolean;
-    }>;
     private concatenate;
 }

package/icc-x-api/crypto/SecurityMetadataDecryptor.js

@@ -23,7 +23,7 @@ var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _ar
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityMetadataDecryptorChain = void 0;
 const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
-var AccessLevel = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
+var AccessLevelEnum = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
 /**
  * @internal this class is meant for internal use only and may be changed without notice.
  * Security metadata decryptor which combines other existing decryptors.
@@ -46,11 +46,11 @@ class SecurityMetadataDecryptorChain {
             let currMaxLevel = undefined;
             for (const d of this.decryptors) {
                 const currLevel = yield d.getEntityAccessLevel(typedEntity, dataOwnersHierarchySubset);
-                if (currLevel === AccessLevel.WRITE) {
+                if (currLevel === AccessLevelEnum.WRITE) {
                     return currLevel;
                 }
-                if (currLevel === AccessLevel.READ) {
-                    currMaxLevel = AccessLevel.READ;
+                if (currLevel === AccessLevelEnum.READ) {
+                    currMaxLevel = AccessLevelEnum.READ;
                 }
             }
             return currMaxLevel;
@@ -59,25 +59,6 @@ class SecurityMetadataDecryptorChain {
     hasAnyEncryptionKeys(entity) {
         return this.decryptors.some((d) => d.hasAnyEncryptionKeys(entity));
     }
-    getDataOwnersWithAccessTo(typedEntity) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const accumulatedPermissions = {};
-            let hasUnknownAnonymousDataOwners = false;
-            for (const d of this.decryptors) {
-                const currAccess = yield d.getDataOwnersWithAccessTo(typedEntity);
-                hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || currAccess.hasUnknownAnonymousDataOwners;
-                for (const [dataOwnerId, level] of Object.entries(currAccess.permissionsByDataOwnerId)) {
-                    if (accumulatedPermissions[dataOwnerId] !== AccessLevel.WRITE) {
-                        accumulatedPermissions[dataOwnerId] = level;
-                    }
-                }
-            }
-            return {
-                permissionsByDataOwnerId: accumulatedPermissions,
-                hasUnknownAnonymousDataOwners,
-            };
-        });
-    }
     concatenate(getGenerator) {
         function generator(decryptors) {
             return __asyncGenerator(this, arguments, function* generator_1() {

package/icc-x-api/crypto/SecurityMetadataDecryptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityMetadataDecryptor.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecurityMetadataDecryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAEA,2EAAuE;AACvE,IAAO,WAAW,GAAG,mCAAgB,CAAC,eAAe,CAAA;AAuFrD;;;GAGG;AACH,MAAa,8BAA8B;IACzC,YAA6B,UAAuC;QAAvC,eAAU,GAAV,UAAU,CAA6B;IAAG,CAAC;IAExE,uBAAuB,CACrB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACnG,CAAC;IAED,wBAAwB,CACtB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACpG,CAAC;IAED,kBAAkB,CAChB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAA;IAC9F,CAAC;IAEK,oBAAoB,CACxB,WAAoC,EACpC,yBAAmC;;YAEnC,IAAI,YAAY,GAAiD,SAAS,CAAA;YAC1E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE;gBAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAA;gBACtF,IAAI,SAAS,KAAK,WAAW,CAAC,KAAK,EAAE;oBACnC,OAAO,SAAS,CAAA;iBACjB;gBACD,IAAI,SAAS,KAAK,WAAW,CAAC,IAAI,EAAE;oBAClC,YAAY,GAAG,WAAW,CAAC,IAAI,CAAA;iBAChC;aACF;YACD,OAAO,YAAY,CAAA;QACrB,CAAC;KAAA;IAED,oBAAoB,CAAC,MAA6C;QAChE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;IACpE,CAAC;IAEK,yBAAyB,CAAC,WAAoC;;YAIlE,MAAM,sBAAsB,GAA+C,EAAE,CAAA;YAC7E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE;gBAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAA;gBACjE,6BAA6B,GAAG,6BAA6B,IAAI,UAAU,CAAC,6BAA6B,CAAA;gBACzG,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE;oBACtF,IAAI,sBAAsB,CAAC,WAAW,CAAC,KAAK,WAAW,CAAC,KAAK,EAAE;wBAC7D,sBAAsB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;qBAC5C;iBACF;aACF;YACD,OAAO;gBACL,wBAAwB,EAAE,sBAAsB;gBAChD,6BAA6B;aAC9B,CAAA;QACH,CAAC;KAAA;IAEO,WAAW,CAAI,YAA8E;QACnG,SAAgB,SAAS,CAAC,UAAuC;;gBAC/D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE;oBAC1B,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;oBACrC,IAAI,IAAI,GAAG,cAAM,aAAa,CAAC,IAAI,EAAE,CAAA,CAAA;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;wBACjB,oBAAM,IAAI,CAAC,KAAK,CAAA,CAAA;wBAChB,IAAI,GAAG,cAAM,aAAa,CAAC,IAAI,EAAE,CAAA,CAAA;qBAClC;iBACF;YACH,CAAC;SAAA;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;CACF;AA/ED,wEA+EC","sourcesContent":["import { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevel = SecureDelegation.AccessLevelEnum\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\n\n/**\n * @internal this class is for internal use only and may be changed without notice.\n * Logic for the decryption of the metadata used for access control, encryption, and other security features in an entity.\n */\nexport interface SecurityMetadataDecryptor {\n  /**\n   * Decrypt the encryption keys for an entity. Keys must be returned in raw hex format, removing dashes if they were generated from a UUID.\n   * @param typedEntity an encrypted entity or its stub.\n   * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should\n   * contain only data owners from the current data owner hierarchy.\n   * @throws if dataOwnersHierarchySubset is empty\n   * @return a generator for the decrypted exchange key which yields objects containing:\n   * - `decrypted`: a decrypted encryption key for {@link typedEntity}. Note that the same key may be yielded multiple times by the generator.\n   * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this\n   *   key was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`\n   */\n  decryptEncryptionKeysOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never>\n\n  /**\n   * Decrypt the secret ids for an entity.\n   * @param typedEntity an encrypted entity or its stub.\n   * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should\n   * contain only data owners from the current data owner hierarchy.\n   * @throws if dataOwnersHierarchySubset is empty\n   * @return a generator for the decrypted secret ids which yields objects containing:\n   * - `decrypted`: a decrypted secret id of {@link entity}. Note that the same id may be yielded multiple times by the generator.\n   * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this\n   *   id was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`\n   */\n  decryptSecretIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never>\n\n  /**\n   * Decrypt the owning entity ids of an entity.\n   * @param typedEntity an encrypted entity or its stub.\n   * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should\n   * contain only data owners from the current data owner hierarchy.\n   * @throws if dataOwnersHierarchySubset is empty\n   * @return a generator for the decrypted owning entity ids which yields objects containing:\n   * - `decrypted`: a decrypted owning entity id of {@link entity}. Note that the same id may be yielded multiple times by the generator.\n   * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this\n   *   id was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`\n   */\n  decryptOwningEntityIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never>\n\n  /**\n   * Get the maximum access level that any data owner in {@link dataOwnersHierarchySubset} has to {@link typedEntity}, according to the metadata\n   * supported by this decryptor.\n   * - If at least a data owner in {@link dataOwnersHierarchySubset} has write access the method returns {@link AccessLevel.WRITE}.\n   * - If at least a data owner in {@link dataOwnersHierarchySubset} has read access and no data owner has write access the method returns\n   * {@link AccessLevel.READ}.\n   * - If a data owner has no access to the entity the method returns undefined (this can happen if the data owner has access to an entity through\n   * some metadata which is not supported by this decryptor).\n   * @param typedEntity an entity\n   * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when calculating the\n   * access level. This array should contain only data owners from the current data owner hierarchy.\n   * @return the access level to the entity or undefined if none of the data owners has full access to the entity.\n   */\n  getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevel | undefined>\n\n  /**\n   * Get the access level of each data owner with access to the entity according to the metadata supported by this decryptor.\n   * See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for details on the expected behaviour.\n   */\n  getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }>\n\n  /**\n   * Verifies if there is at least one (encrypted) encryption key in the metadata supported by this decryptor, even if it can't be decrypted by the\n   * current data owner.\n   */\n  hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean\n}\n\n/**\n * @internal this class is meant for internal use only and may be changed without notice.\n * Security metadata decryptor which combines other existing decryptors.\n */\nexport class SecurityMetadataDecryptorChain implements SecurityMetadataDecryptor {\n  constructor(private readonly decryptors: SecurityMetadataDecryptor[]) {}\n\n  decryptEncryptionKeysOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.concatenate((d) => d.decryptEncryptionKeysOf(typedEntity, dataOwnersHierarchySubset))\n  }\n\n  decryptOwningEntityIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.concatenate((d) => d.decryptOwningEntityIdsOf(typedEntity, dataOwnersHierarchySubset))\n  }\n\n  decryptSecretIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.concatenate((d) => d.decryptSecretIdsOf(typedEntity, dataOwnersHierarchySubset))\n  }\n\n  async getEntityAccessLevel(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): Promise<SecureDelegation.AccessLevelEnum | undefined> {\n    let currMaxLevel: SecureDelegation.AccessLevelEnum | undefined = undefined\n    for (const d of this.decryptors) {\n      const currLevel = await d.getEntityAccessLevel(typedEntity, dataOwnersHierarchySubset)\n      if (currLevel === AccessLevel.WRITE) {\n        return currLevel\n      }\n      if (currLevel === AccessLevel.READ) {\n        currMaxLevel = AccessLevel.READ\n      }\n    }\n    return currMaxLevel\n  }\n\n  hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean {\n    return this.decryptors.some((d) => d.hasAnyEncryptionKeys(entity))\n  }\n\n  async getDataOwnersWithAccessTo(typedEntity: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const accumulatedPermissions: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    for (const d of this.decryptors) {\n      const currAccess = await d.getDataOwnersWithAccessTo(typedEntity)\n      hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || currAccess.hasUnknownAnonymousDataOwners\n      for (const [dataOwnerId, level] of Object.entries(currAccess.permissionsByDataOwnerId)) {\n        if (accumulatedPermissions[dataOwnerId] !== AccessLevel.WRITE) {\n          accumulatedPermissions[dataOwnerId] = level\n        }\n      }\n    }\n    return {\n      permissionsByDataOwnerId: accumulatedPermissions,\n      hasUnknownAnonymousDataOwners,\n    }\n  }\n\n  private concatenate<T>(getGenerator: (d: SecurityMetadataDecryptor) => AsyncGenerator<T, void, never>): AsyncGenerator<T, void, never> {\n    async function* generator(decryptors: SecurityMetadataDecryptor[]): AsyncGenerator<T, void, never> {\n      for (const d of decryptors) {\n        const currGenerator = getGenerator(d)\n        let next = await currGenerator.next()\n        while (!next.done) {\n          yield next.value\n          next = await currGenerator.next()\n        }\n      }\n    }\n    return generator(this.decryptors)\n  }\n}\n"]}
+{"version":3,"file":"SecurityMetadataDecryptor.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecurityMetadataDecryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAEA,2EAAuE;AACvE,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AA6EzD;;;GAGG;AACH,MAAa,8BAA8B;IACzC,YAA6B,UAAuC;QAAvC,eAAU,GAAV,UAAU,CAA6B;IAAG,CAAC;IAExE,uBAAuB,CACrB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACnG,CAAC;IAED,wBAAwB,CACtB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACpG,CAAC;IAED,kBAAkB,CAChB,WAAoC,EACpC,yBAAmC;QAEnC,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAA;IAC9F,CAAC;IAEK,oBAAoB,CACxB,WAAoC,EACpC,yBAAmC;;YAEnC,IAAI,YAAY,GAAiD,SAAS,CAAA;YAC1E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE;gBAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAA;gBACtF,IAAI,SAAS,KAAK,eAAe,CAAC,KAAK,EAAE;oBACvC,OAAO,SAAS,CAAA;iBACjB;gBACD,IAAI,SAAS,KAAK,eAAe,CAAC,IAAI,EAAE;oBACtC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAA;iBACpC;aACF;YACD,OAAO,YAAY,CAAA;QACrB,CAAC;KAAA;IAED,oBAAoB,CAAC,MAA6C;QAChE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;IACpE,CAAC;IAEO,WAAW,CAAI,YAA8E;QACnG,SAAgB,SAAS,CAAC,UAAuC;;gBAC/D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE;oBAC1B,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;oBACrC,IAAI,IAAI,GAAG,cAAM,aAAa,CAAC,IAAI,EAAE,CAAA,CAAA;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;wBACjB,oBAAM,IAAI,CAAC,KAAK,CAAA,CAAA;wBAChB,IAAI,GAAG,cAAM,aAAa,CAAC,IAAI,EAAE,CAAA,CAAA;qBAClC;iBACF;YACH,CAAC;SAAA;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;CACF;AA1DD,wEA0DC","sourcesContent":["import { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\n\n/**\n * @internal this class is for internal use only and may be changed without notice.\n * Logic for the decryption of the metadata used for access control, encryption, and other security features in an entity.\n */\nexport interface SecurityMetadataDecryptor {\n  /**\n   * Decrypt the encryption keys for an entity. Keys must be returned in raw hex format, removing dashes if they were generated from a UUID.\n   * @param typedEntity an encrypted entity or its stub.\n   * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should\n   * contain only data owners from the current data owner hierarchy.\n   * @throws if dataOwnersHierarchySubset is empty\n   * @return a generator for the decrypted exchange key which yields objects containing:\n   * - `decrypted`: a decrypted encryption key for {@link typedEntity}. Note that the same key may be yielded multiple times by the generator.\n   * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this\n   *   key was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`\n   */\n  decryptEncryptionKeysOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never>\n\n  /**\n   * Decrypt the secret ids for an entity.\n   * @param typedEntity an encrypted entity or its stub.\n   * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should\n   * contain only data owners from the current data owner hierarchy.\n   * @throws if dataOwnersHierarchySubset is empty\n   * @return a generator for the decrypted secret ids which yields objects containing:\n   * - `decrypted`: a decrypted secret id of {@link entity}. Note that the same id may be yielded multiple times by the generator.\n   * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this\n   *   id was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`\n   */\n  decryptSecretIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never>\n\n  /**\n   * Decrypt the owning entity ids of an entity.\n   * @param typedEntity an encrypted entity or its stub.\n   * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when decrypting. It should\n   * contain only data owners from the current data owner hierarchy.\n   * @throws if dataOwnersHierarchySubset is empty\n   * @return a generator for the decrypted owning entity ids which yields objects containing:\n   * - `decrypted`: a decrypted owning entity id of {@link entity}. Note that the same id may be yielded multiple times by the generator.\n   * - `dataOwnersWithAccess`: data owners which have access to the exchange data necessary for the decryption of the encrypted data from which this\n   *   id was extracted. The generator may yield more elements with the same `decrypted` but different `dataOwnersWithAccess`\n   */\n  decryptOwningEntityIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never>\n\n  /**\n   * Get the maximum access level that any data owner in {@link dataOwnersHierarchySubset} has to {@link typedEntity}, according to the metadata\n   * supported by this decryptor.\n   * - If at least a data owner in {@link dataOwnersHierarchySubset} has write access the method returns {@link AccessLevel.WRITE}.\n   * - If at least a data owner in {@link dataOwnersHierarchySubset} has read access and no data owner has write access the method returns\n   * {@link AccessLevel.READ}.\n   * - If a data owner has no access to the entity the method returns undefined (this can happen if the data owner has access to an entity through\n   * some metadata which is not supported by this decryptor).\n   * @param typedEntity an entity\n   * @param dataOwnersHierarchySubset only exchange data that is accessible to data owners in this array will be considered when calculating the\n   * access level. This array should contain only data owners from the current data owner hierarchy.\n   * @return the access level to the entity or undefined if none of the data owners has full access to the entity.\n   */\n  getEntityAccessLevel(typedEntity: EncryptedEntityWithType, dataOwnersHierarchySubset: string[]): Promise<AccessLevelEnum | undefined>\n\n  /**\n   * Verifies if there is at least one (encrypted) encryption key in the metadata supported by this decryptor, even if it can't be decrypted by the\n   * current data owner.\n   */\n  hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean\n}\n\n/**\n * @internal this class is meant for internal use only and may be changed without notice.\n * Security metadata decryptor which combines other existing decryptors.\n */\nexport class SecurityMetadataDecryptorChain implements SecurityMetadataDecryptor {\n  constructor(private readonly decryptors: SecurityMetadataDecryptor[]) {}\n\n  decryptEncryptionKeysOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.concatenate((d) => d.decryptEncryptionKeysOf(typedEntity, dataOwnersHierarchySubset))\n  }\n\n  decryptOwningEntityIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.concatenate((d) => d.decryptOwningEntityIdsOf(typedEntity, dataOwnersHierarchySubset))\n  }\n\n  decryptSecretIdsOf(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): AsyncGenerator<{ decrypted: string; dataOwnersWithAccess: string[] }, void, never> {\n    return this.concatenate((d) => d.decryptSecretIdsOf(typedEntity, dataOwnersHierarchySubset))\n  }\n\n  async getEntityAccessLevel(\n    typedEntity: EncryptedEntityWithType,\n    dataOwnersHierarchySubset: string[]\n  ): Promise<SecureDelegation.AccessLevelEnum | undefined> {\n    let currMaxLevel: SecureDelegation.AccessLevelEnum | undefined = undefined\n    for (const d of this.decryptors) {\n      const currLevel = await d.getEntityAccessLevel(typedEntity, dataOwnersHierarchySubset)\n      if (currLevel === AccessLevelEnum.WRITE) {\n        return currLevel\n      }\n      if (currLevel === AccessLevelEnum.READ) {\n        currMaxLevel = AccessLevelEnum.READ\n      }\n    }\n    return currMaxLevel\n  }\n\n  hasAnyEncryptionKeys(entity: EncryptedEntity | EncryptedEntityStub): boolean {\n    return this.decryptors.some((d) => d.hasAnyEncryptionKeys(entity))\n  }\n\n  private concatenate<T>(getGenerator: (d: SecurityMetadataDecryptor) => AsyncGenerator<T, void, never>): AsyncGenerator<T, void, never> {\n    async function* generator(decryptors: SecurityMetadataDecryptor[]): AsyncGenerator<T, void, never> {\n      for (const d of decryptors) {\n        const currGenerator = getGenerator(d)\n        let next = await currGenerator.next()\n        while (!next.done) {\n          yield next.value\n          next = await currGenerator.next()\n        }\n      }\n    }\n    return generator(this.decryptors)\n  }\n}\n"]}

package/icc-x-api/filters/LatestMessageByHcPartyTransportGuidFilter.d.ts

@@ -0,0 +1,8 @@
+import { AbstractFilterMessage } from "../../icc-api/model/AbstractFilterMessage";
+export declare class LatestMessageByHcPartyTransportGuidFilter extends AbstractFilterMessage {
+    $type: string;
+    constructor(json: JSON | any);
+    healthcarePartyId?: string;
+    transportGuid?: string;
+    desc?: string;
+}

package/icc-x-api/filters/LatestMessageByHcPartyTransportGuidFilter.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LatestMessageByHcPartyTransportGuidFilter = void 0;
+const AbstractFilterMessage_1 = require("../../icc-api/model/AbstractFilterMessage");
+class LatestMessageByHcPartyTransportGuidFilter extends AbstractFilterMessage_1.AbstractFilterMessage {
+    constructor(json) {
+        super(json);
+        this.$type = 'LatestMessageByHcPartyTransportGuidFilter';
+        Object.assign(this, json);
+    }
+}
+exports.LatestMessageByHcPartyTransportGuidFilter = LatestMessageByHcPartyTransportGuidFilter;
+//# sourceMappingURL=LatestMessageByHcPartyTransportGuidFilter.js.map

package/icc-x-api/filters/LatestMessageByHcPartyTransportGuidFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LatestMessageByHcPartyTransportGuidFilter.js","sourceRoot":"","sources":["../../../icc-x-api/filters/LatestMessageByHcPartyTransportGuidFilter.ts"],"names":[],"mappings":";;;AAAA,qFAAgF;AAEhF,MAAa,yCAA0C,SAAQ,6CAAqB;IAEhF,YAAY,IAAgB;QACxB,KAAK,CAAC,IAAI,CAAC,CAAA;QAFf,UAAK,GAAW,2CAA2C,CAAA;QAIvD,MAAM,CAAC,MAAM,CAAC,IAAiD,EAAE,IAAI,CAAC,CAAA;IAC1E,CAAC;CAKJ;AAXD,8FAWC","sourcesContent":["import {AbstractFilterMessage} from \"../../icc-api/model/AbstractFilterMessage\";\n\nexport class LatestMessageByHcPartyTransportGuidFilter extends AbstractFilterMessage {\n    $type: string = 'LatestMessageByHcPartyTransportGuidFilter'\n    constructor(json: JSON | any) {\n        super(json)\n\n        Object.assign(this as LatestMessageByHcPartyTransportGuidFilter, json)\n    }\n\n    healthcarePartyId?: string\n    transportGuid?: string\n    desc?: string\n}\n"]}

package/icc-x-api/filters/MessageByHcPartyFilter.d.ts

@@ -0,0 +1,7 @@
+import { AbstractFilterMessage } from "../../icc-api/model/AbstractFilterMessage";
+export declare class MessageByHcPartyFilter extends AbstractFilterMessage {
+    $type: string;
+    constructor(json: JSON | any);
+    hcpId?: string;
+    desc?: string;
+}

package/icc-x-api/filters/MessageByHcPartyFilter.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageByHcPartyFilter = void 0;
+const AbstractFilterMessage_1 = require("../../icc-api/model/AbstractFilterMessage");
+class MessageByHcPartyFilter extends AbstractFilterMessage_1.AbstractFilterMessage {
+    constructor(json) {
+        super(json);
+        this.$type = 'MessageByHcPartyFilter';
+        Object.assign(this, json);
+    }
+}
+exports.MessageByHcPartyFilter = MessageByHcPartyFilter;
+//# sourceMappingURL=MessageByHcPartyFilter.js.map

package/icc-x-api/filters/MessageByHcPartyFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageByHcPartyFilter.js","sourceRoot":"","sources":["../../../icc-x-api/filters/MessageByHcPartyFilter.ts"],"names":[],"mappings":";;;AAAA,qFAAgF;AAEhF,MAAa,sBAAuB,SAAQ,6CAAqB;IAE7D,YAAY,IAAgB;QACxB,KAAK,CAAC,IAAI,CAAC,CAAA;QAFf,UAAK,GAAW,wBAAwB,CAAA;QAIpC,MAAM,CAAC,MAAM,CAAC,IAA8B,EAAE,IAAI,CAAC,CAAA;IACvD,CAAC;CAIJ;AAVD,wDAUC","sourcesContent":["import {AbstractFilterMessage} from \"../../icc-api/model/AbstractFilterMessage\";\n\nexport class MessageByHcPartyFilter extends AbstractFilterMessage {\n    $type: string = 'MessageByHcPartyFilter'\n    constructor(json: JSON | any) {\n        super(json)\n\n        Object.assign(this as MessageByHcPartyFilter, json)\n    }\n\n    hcpId?: string\n    desc?: string\n}\n"]}

package/icc-x-api/filters/MessageByHcPartyTransportGuidFilter.d.ts

@@ -0,0 +1,8 @@
+import { AbstractFilterMessage } from "../../icc-api/model/AbstractFilterMessage";
+export declare class MessageByHcPartyTransportGuidFilter extends AbstractFilterMessage {
+    $type: string;
+    constructor(json: JSON | any);
+    healthcarePartyId?: string;
+    transportGuid?: string;
+    desc?: string;
+}

package/icc-x-api/filters/MessageByHcPartyTransportGuidFilter.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageByHcPartyTransportGuidFilter = void 0;
+const AbstractFilterMessage_1 = require("../../icc-api/model/AbstractFilterMessage");
+class MessageByHcPartyTransportGuidFilter extends AbstractFilterMessage_1.AbstractFilterMessage {
+    constructor(json) {
+        super(json);
+        this.$type = 'MessageByHcPartyTransportGuidFilter';
+        Object.assign(this, json);
+    }
+}
+exports.MessageByHcPartyTransportGuidFilter = MessageByHcPartyTransportGuidFilter;
+//# sourceMappingURL=MessageByHcPartyTransportGuidFilter.js.map

package/icc-x-api/filters/MessageByHcPartyTransportGuidFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageByHcPartyTransportGuidFilter.js","sourceRoot":"","sources":["../../../icc-x-api/filters/MessageByHcPartyTransportGuidFilter.ts"],"names":[],"mappings":";;;AAAA,qFAAgF;AAEhF,MAAa,mCAAoC,SAAQ,6CAAqB;IAE1E,YAAY,IAAgB;QACxB,KAAK,CAAC,IAAI,CAAC,CAAA;QAFf,UAAK,GAAW,qCAAqC,CAAA;QAIjD,MAAM,CAAC,MAAM,CAAC,IAA2C,EAAE,IAAI,CAAC,CAAA;IACpE,CAAC;CAKJ;AAXD,kFAWC","sourcesContent":["import {AbstractFilterMessage} from \"../../icc-api/model/AbstractFilterMessage\";\n\nexport class MessageByHcPartyTransportGuidFilter extends AbstractFilterMessage {\n    $type: string = 'MessageByHcPartyTransportGuidFilter'\n    constructor(json: JSON | any) {\n        super(json)\n\n        Object.assign(this as MessageByHcPartyTransportGuidFilter, json)\n    }\n\n    healthcarePartyId?: string\n    transportGuid?: string\n    desc?: string\n}\n"]}

package/icc-x-api/filters/TopicByHcPartyFilter.d.ts

@@ -0,0 +1,7 @@
+import { AbstractFilterTopic } from "../../icc-api/model/AbstractFilterTopic";
+export declare class TopicByHcPartyFilter extends AbstractFilterTopic {
+    $type: string;
+    constructor(json: JSON | any);
+    hcpId?: string;
+    desc?: string;
+}

package/icc-x-api/filters/TopicByHcPartyFilter.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TopicByHcPartyFilter = void 0;
+const AbstractFilterTopic_1 = require("../../icc-api/model/AbstractFilterTopic");
+class TopicByHcPartyFilter extends AbstractFilterTopic_1.AbstractFilterTopic {
+    constructor(json) {
+        super(json);
+        this.$type = 'TopicByHcPartyFilter';
+        Object.assign(this, json);
+    }
+}
+exports.TopicByHcPartyFilter = TopicByHcPartyFilter;
+//# sourceMappingURL=TopicByHcPartyFilter.js.map

package/icc-x-api/filters/TopicByHcPartyFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TopicByHcPartyFilter.js","sourceRoot":"","sources":["../../../icc-x-api/filters/TopicByHcPartyFilter.ts"],"names":[],"mappings":";;;AAAA,iFAA4E;AAE5E,MAAa,oBAAqB,SAAQ,yCAAmB;IAEzD,YAAY,IAAgB;QACxB,KAAK,CAAC,IAAI,CAAC,CAAA;QAFf,UAAK,GAAW,sBAAsB,CAAA;QAIlC,MAAM,CAAC,MAAM,CAAC,IAA4B,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;CAIJ;AAVD,oDAUC","sourcesContent":["import {AbstractFilterTopic} from \"../../icc-api/model/AbstractFilterTopic\";\n\nexport class TopicByHcPartyFilter extends AbstractFilterTopic {\n    $type: string = 'TopicByHcPartyFilter'\n    constructor(json: JSON | any) {\n        super(json)\n\n        Object.assign(this as TopicByHcPartyFilter, json)\n    }\n\n    hcpId?: string\n    desc?: string\n}\n"]}

package/icc-x-api/filters/TopicByParticipantFilter.d.ts

@@ -0,0 +1,7 @@
+import { AbstractFilterTopic } from "../../icc-api/model/AbstractFilterTopic";
+export declare class TopicByParticipantFilter extends AbstractFilterTopic {
+    $type: string;
+    constructor(json: JSON | any);
+    participantId?: string;
+    desc?: string;
+}

package/icc-x-api/filters/TopicByParticipantFilter.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TopicByParticipantFilter = void 0;
+const AbstractFilterTopic_1 = require("../../icc-api/model/AbstractFilterTopic");
+class TopicByParticipantFilter extends AbstractFilterTopic_1.AbstractFilterTopic {
+    constructor(json) {
+        super(json);
+        this.$type = 'TopicByParticipantFilter';
+        Object.assign(this, json);
+    }
+}
+exports.TopicByParticipantFilter = TopicByParticipantFilter;
+//# sourceMappingURL=TopicByParticipantFilter.js.map

package/icc-x-api/filters/TopicByParticipantFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TopicByParticipantFilter.js","sourceRoot":"","sources":["../../../icc-x-api/filters/TopicByParticipantFilter.ts"],"names":[],"mappings":";;;AAAA,iFAA4E;AAE5E,MAAa,wBAAyB,SAAQ,yCAAmB;IAE7D,YAAY,IAAgB;QACxB,KAAK,CAAC,IAAI,CAAC,CAAA;QAFf,UAAK,GAAW,0BAA0B,CAAA;QAItC,MAAM,CAAC,MAAM,CAAC,IAAgC,EAAE,IAAI,CAAC,CAAA;IACzD,CAAC;CAIJ;AAVD,4DAUC","sourcesContent":["import {AbstractFilterTopic} from \"../../icc-api/model/AbstractFilterTopic\";\n\nexport class TopicByParticipantFilter extends AbstractFilterTopic {\n    $type: string = 'TopicByParticipantFilter'\n    constructor(json: JSON | any) {\n        super(json)\n\n        Object.assign(this as TopicByParticipantFilter, json)\n    }\n\n    participantId?: string\n    desc?: string\n}\n"]}

package/icc-x-api/filters/filters.d.ts

@@ -73,6 +73,11 @@ export * from './MaintenanceTaskByHcPartyAndIdentifiersFilter';
 export * from './MaintenanceTaskByHcPartyAndTypeFilter';
 export * from './MaintenanceTaskByIdsFilter';
 export * from './MaintenanceTaskAfterDateFilter';
+export * from './TopicByHcPartyFilter';
+export * from './TopicByParticipantFilter';
+export * from './MessageByHcPartyFilter';
+export * from './MessageByHcPartyTransportGuidFilter';
+export * from './LatestMessageByHcPartyTransportGuidFilter';
 export declare class Filter {
     static patient(): PatientFilterBuilder;
 }

package/icc-x-api/filters/filters.js

@@ -81,6 +81,11 @@ __exportStar(require("./MaintenanceTaskByHcPartyAndIdentifiersFilter"), exports)
 __exportStar(require("./MaintenanceTaskByHcPartyAndTypeFilter"), exports);
 __exportStar(require("./MaintenanceTaskByIdsFilter"), exports);
 __exportStar(require("./MaintenanceTaskAfterDateFilter"), exports);
+__exportStar(require("./TopicByHcPartyFilter"), exports);
+__exportStar(require("./TopicByParticipantFilter"), exports);
+__exportStar(require("./MessageByHcPartyFilter"), exports);
+__exportStar(require("./MessageByHcPartyTransportGuidFilter"), exports);
+__exportStar(require("./LatestMessageByHcPartyTransportGuidFilter"), exports);
 class Filter {
     static patient() {
         return new PatientFilterBuilder();