@icure/api 8.0.0-RC.1 → 8.0.0-RC.2

package/icc-x-api/basexapi/EncryptedEntityXApi.d.ts

@@ -6,10 +6,15 @@ import AccessLevelEnum = SecureDelegation.AccessLevelEnum;
 export interface EncryptedEntityXApi<T extends EncryptedEntity> {
     /**
      * Get the ids of all data owners with access to the provided entity, including their permissions on the entity. This method also uses the
-     * information available to the current user to attempt to identify the anonymous data owners with access to this entity. Note however that
-     * the user may not be capable of identifying all anonymous data owners with access to the entity. In cases where there is at least an anonymous
-     * data owner with access to the entity the value of `hasUnknownAnonymousDataOwners` in the returned object will be `true` (`false` otherwise).
-     * Note that users are only capable of identifying anonymous data owners in delegations where the user itself is involved, meaning that if a
+     * information available to the current user to attempt to identify the anonymous data owners with access to this entity.
+     *
+     * Note however that the user may not be capable of identifying all anonymous data owners with access to the entity. In cases where there is at least
+     * an anonymous data owner with access to the entity that the current data owner can't identify the value of `hasUnknownAnonymousDataOwners` in the
+     * returned object will be `true` (`false` otherwise).
+     *
+     * ## Basic anonymous data owners identification
+     *
+     * Initially users are only capable of identifying anonymous data owners in delegations where the user itself is involved, meaning that if a
      * specific anonymous data owners has access to an entity through two delegations, one accessible to the current user and one not, the anonymous
      * data owner will appear in the `permissionsByDataOwnerId`, but the `hasUnknownAnonymousDataOwners` will also be `true`, since the user can't know
      * if the other delegation refers to the same anonymous data owner or not.
@@ -28,6 +33,31 @@ export interface EncryptedEntityXApi<T extends EncryptedEntity> {
      * - `P` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'WRITE' }, hasUnknownAnonymousDataOwners: false }` (`P` knows the
      *    delegations that he is part of)
      *
+     * ## Anonymous data owner identification through de-anonymization metadata
+     *
+     * You also have the possibility of identifying anonymous data owners through the de-anonymization metadata. This metadata is created on request
+     * by data owners that have access to the delegation anonymous data owners involved in the delegations, but can later be shared also by other
+     * data owners.
+     *
+     * For example consider an entity with the following delegations, where `A`, `B` and `C` are unrelated explicit data owners, and `P` is an
+     * anonymous data owner:
+     * - A -> A
+     * - A -> B
+     * - A -> P
+     *
+     * As we know initially B will not be able to identify P (B only knows that [A,B] have access to the entity), but if A creates the
+     * de-anonymization metadata for the delegation A->P, then B will be to do so.
+     *
+     * If later B shares the entity with C, resulting in the following delegations:
+     * - A -> A
+     * - A -> B
+     * - A -> P
+     * - B -> C
+     *
+     * C will initially be only aware of [A, B, C] having access to the entity, but now B can share with C the information that P has also
+     * access to the entity through the delegation A->P. Note that if A had not created the de-anonymization metadata for the delegation A->P,
+     * then B would not be able to share this information with C.
+     *
      * @param entity an entity.
      * @return an object containing:
      * - `permissionsByDataOwnerId`: a map associating each data owner id with the access level to the entity. Currently only WRITE access is supported.
@@ -40,6 +70,24 @@ export interface EncryptedEntityXApi<T extends EncryptedEntity> {
         };
         hasUnknownAnonymousDataOwners: boolean;
     }>;
+    /**
+     * Creates the metadata to support {@link delegates} in the de-anonymization of the delegations in the provided entity.
+     *
+     * Refer to {@link getDataOwnersWithAccessTo} for more information on how this metadata is used.
+     *
+     * # Important information
+     *
+     * while the metadata is created based on the delegations of the provided entity, the metadata may be used to de-anonymize
+     * equivalent delegations in other entities of the same type.
+     *
+     * For example if A creates an entity of type T, shares it with B and P, and then creates the de-anonymization metadata
+     * to allow B to de-anonymize the delegation A->P, then B will be able to de-anonymize any delegation A->P in any other
+     * entity of type T that B can access (through the iCure cloud or directly through database replicas).
+     *
+     * @param entity an entity.
+     * @param delegates users
+     */
+    createDelegationDeAnonymizationMetadata(entity: T, delegates: string[]): Promise<void>;
     /**
      * @param entity an entity.
      * @return the available encryption keys for the entity, which could be decrypted by the current data owner. Normally this array should contain at

package/icc-x-api/basexapi/EncryptedEntityXApi.js.map

@@ -1 +1 @@
-{"version":3,"file":"EncryptedEntityXApi.js","sourceRoot":"","sources":["../../../icc-x-api/basexapi/EncryptedEntityXApi.ts"],"names":[],"mappings":"","sourcesContent":["import { EncryptedEntity, SecureDelegation } from '../../icc-api/model/models'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\n\n/**\n * Interface of common methods for XApis of any encryptable entities.\n */\nexport interface EncryptedEntityXApi<T extends EncryptedEntity> {\n  /**\n   * Get the ids of all data owners with access to the provided entity, including their permissions on the entity. This method also uses the\n   * information available to the current user to attempt to identify the anonymous data owners with access to this entity. Note however that\n   * the user may not be capable of identifying all anonymous data owners with access to the entity. In cases where there is at least an anonymous\n   * data owner with access to the entity the value of `hasUnknownAnonymousDataOwners` in the returned object will be `true` (`false` otherwise).\n   * Note that users are only capable of identifying anonymous data owners in delegations where the user itself is involved, meaning that if a\n   * specific anonymous data owners has access to an entity through two delegations, one accessible to the current user and one not, the anonymous\n   * data owner will appear in the `permissionsByDataOwnerId`, but the `hasUnknownAnonymousDataOwners` will also be `true`, since the user can't know\n   * if the other delegation refers to the same anonymous data owner or not.\n   *\n   * For example consider an entity with the following delegations, where `A` and `B` are unrelated explicit data owners, and `P` is an anonymous\n   * data owner:\n   * - A -> A - r/w\n   * - A -> B - r/w\n   * - A -> P - r\n   * - B -> P - r/w\n   * In this case we can get the following results, depending on whether the current user is `A`, `B` or `P`:\n   * - `A` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'READ' }, hasUnknownAnonymousDataOwners: true }` (`A` does not know that\n   *   `B->P` actually refers to `P`, but only that it was created by `B`)\n   * - `B` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'WRITE' }, hasUnknownAnonymousDataOwners: true }` (`B` does not know that\n   *   `A->P` actually refers to `P`, but only that it was created by `A`)\n   * - `P` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'WRITE' }, hasUnknownAnonymousDataOwners: false }` (`P` knows the\n   *    delegations that he is part of)\n   *\n   * @param entity an entity.\n   * @return an object containing:\n   * - `permissionsByDataOwnerId`: a map associating each data owner id with the access level to the entity. Currently only WRITE access is supported.\n   * - `hasUnknownAnonymousDataOwners`: a boolean indicating if there are anonymous data owners with access to the entity that the current user can\n   *   not identify.\n   */\n  getDataOwnersWithAccessTo(entity: T): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }>\n\n  /**\n   * @param entity an entity.\n   * @return the available encryption keys for the entity, which could be decrypted by the current data owner. Normally this array should contain at\n   * most one element but this method in case of entity merges there could be multiple values.\n   */\n  getEncryptionKeysOf(entity: T): Promise<string[]>\n}\n"]}
+{"version":3,"file":"EncryptedEntityXApi.js","sourceRoot":"","sources":["../../../icc-x-api/basexapi/EncryptedEntityXApi.ts"],"names":[],"mappings":"","sourcesContent":["import { EncryptedEntity, SecureDelegation } from '../../icc-api/model/models'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\n\n/**\n * Interface of common methods for XApis of any encryptable entities.\n */\nexport interface EncryptedEntityXApi<T extends EncryptedEntity> {\n  /**\n   * Get the ids of all data owners with access to the provided entity, including their permissions on the entity. This method also uses the\n   * information available to the current user to attempt to identify the anonymous data owners with access to this entity.\n   *\n   * Note however that the user may not be capable of identifying all anonymous data owners with access to the entity. In cases where there is at least\n   * an anonymous data owner with access to the entity that the current data owner can't identify the value of `hasUnknownAnonymousDataOwners` in the\n   * returned object will be `true` (`false` otherwise).\n   *\n   * ## Basic anonymous data owners identification\n   *\n   * Initially users are only capable of identifying anonymous data owners in delegations where the user itself is involved, meaning that if a\n   * specific anonymous data owners has access to an entity through two delegations, one accessible to the current user and one not, the anonymous\n   * data owner will appear in the `permissionsByDataOwnerId`, but the `hasUnknownAnonymousDataOwners` will also be `true`, since the user can't know\n   * if the other delegation refers to the same anonymous data owner or not.\n   *\n   * For example consider an entity with the following delegations, where `A` and `B` are unrelated explicit data owners, and `P` is an anonymous\n   * data owner:\n   * - A -> A - r/w\n   * - A -> B - r/w\n   * - A -> P - r\n   * - B -> P - r/w\n   * In this case we can get the following results, depending on whether the current user is `A`, `B` or `P`:\n   * - `A` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'READ' }, hasUnknownAnonymousDataOwners: true }` (`A` does not know that\n   *   `B->P` actually refers to `P`, but only that it was created by `B`)\n   * - `B` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'WRITE' }, hasUnknownAnonymousDataOwners: true }` (`B` does not know that\n   *   `A->P` actually refers to `P`, but only that it was created by `A`)\n   * - `P` gets `{ permissionsByDataOwnerId: { A: 'WRITE', B: 'WRITE', P: 'WRITE' }, hasUnknownAnonymousDataOwners: false }` (`P` knows the\n   *    delegations that he is part of)\n   *\n   * ## Anonymous data owner identification through de-anonymization metadata\n   *\n   * You also have the possibility of identifying anonymous data owners through the de-anonymization metadata. This metadata is created on request\n   * by data owners that have access to the delegation anonymous data owners involved in the delegations, but can later be shared also by other\n   * data owners.\n   *\n   * For example consider an entity with the following delegations, where `A`, `B` and `C` are unrelated explicit data owners, and `P` is an\n   * anonymous data owner:\n   * - A -> A\n   * - A -> B\n   * - A -> P\n   *\n   * As we know initially B will not be able to identify P (B only knows that [A,B] have access to the entity), but if A creates the\n   * de-anonymization metadata for the delegation A->P, then B will be to do so.\n   *\n   * If later B shares the entity with C, resulting in the following delegations:\n   * - A -> A\n   * - A -> B\n   * - A -> P\n   * - B -> C\n   *\n   * C will initially be only aware of [A, B, C] having access to the entity, but now B can share with C the information that P has also\n   * access to the entity through the delegation A->P. Note that if A had not created the de-anonymization metadata for the delegation A->P,\n   * then B would not be able to share this information with C.\n   *\n   * @param entity an entity.\n   * @return an object containing:\n   * - `permissionsByDataOwnerId`: a map associating each data owner id with the access level to the entity. Currently only WRITE access is supported.\n   * - `hasUnknownAnonymousDataOwners`: a boolean indicating if there are anonymous data owners with access to the entity that the current user can\n   *   not identify.\n   */\n  getDataOwnersWithAccessTo(entity: T): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }>\n\n  /**\n   * Creates the metadata to support {@link delegates} in the de-anonymization of the delegations in the provided entity.\n   *\n   * Refer to {@link getDataOwnersWithAccessTo} for more information on how this metadata is used.\n   *\n   * # Important information\n   *\n   * while the metadata is created based on the delegations of the provided entity, the metadata may be used to de-anonymize\n   * equivalent delegations in other entities of the same type.\n   *\n   * For example if A creates an entity of type T, shares it with B and P, and then creates the de-anonymization metadata\n   * to allow B to de-anonymize the delegation A->P, then B will be able to de-anonymize any delegation A->P in any other\n   * entity of type T that B can access (through the iCure cloud or directly through database replicas).\n   *\n   * @param entity an entity.\n   * @param delegates users\n   */\n  createDelegationDeAnonymizationMetadata(entity: T, delegates: string[]): Promise<void>\n\n  /**\n   * @param entity an entity.\n   * @return the available encryption keys for the entity, which could be decrypted by the current data owner. Normally this array should contain at\n   * most one element but this method in case of entity merges there could be multiple values.\n   */\n  getEncryptionKeysOf(entity: T): Promise<string[]>\n}\n"]}

package/icc-x-api/crypto/AccessControlKeysHeadersProvider.d.ts

@@ -1,6 +1,7 @@
 import { ExchangeDataManager } from './ExchangeDataManager';
 import { XHR } from '../../icc-api/api/XHR';
 import { EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName';
+export declare const ACCESS_CONTROL_KEYS_HEADER = "Icure-Access-Control-Keys";
 /**
  * @internal this class is intended for internal use only and may be changed without notice.
  */
@@ -13,4 +14,5 @@ export declare class AccessControlKeysHeadersProvider {
      * @param entityType the type of entity which the user is attempting to retrieve.
      */
     addAccessControlKeysHeaders(initialHeaders: XHR.Header[], entityType: EntityWithDelegationTypeName): Promise<XHR.Header[]>;
+    getAccessControlKeysHeaders(entityType: EntityWithDelegationTypeName): Promise<XHR.Header[]>;
 }

package/icc-x-api/crypto/AccessControlKeysHeadersProvider.js

@@ -9,9 +9,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccessControlKeysHeadersProvider = void 0;
+exports.AccessControlKeysHeadersProvider = exports.ACCESS_CONTROL_KEYS_HEADER = void 0;
 const XHR_1 = require("../../icc-api/api/XHR");
-const ACCESS_CONTROL_KEYS_HEADER = 'Icure-Access-Control-Keys';
+exports.ACCESS_CONTROL_KEYS_HEADER = 'Icure-Access-Control-Keys';
 /**
  * @internal this class is intended for internal use only and may be changed without notice.
  */
@@ -26,13 +26,22 @@ class AccessControlKeysHeadersProvider {
      * @param entityType the type of entity which the user is attempting to retrieve.
      */
     addAccessControlKeysHeaders(initialHeaders, entityType) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const newHeaders = yield this.getAccessControlKeysHeaders(entityType);
+            if (newHeaders.length > 0)
+                return [...initialHeaders, ...newHeaders];
+            else
+                return initialHeaders;
+        });
+    }
+    getAccessControlKeysHeaders(entityType) {
         return __awaiter(this, void 0, void 0, function* () {
             const accessControlKeysValue = yield this.exchangeDataManager.getAccessControlKeysValue(entityType);
             if (accessControlKeysValue) {
-                return [...initialHeaders, new XHR_1.XHR.Header(ACCESS_CONTROL_KEYS_HEADER, accessControlKeysValue)];
+                return [new XHR_1.XHR.Header(exports.ACCESS_CONTROL_KEYS_HEADER, accessControlKeysValue)];
             }
             else {
-                return initialHeaders;
+                return [];
             }
         });
     }

package/icc-x-api/crypto/AccessControlKeysHeadersProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessControlKeysHeadersProvider.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/AccessControlKeysHeadersProvider.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAG3C,MAAM,0BAA0B,GAAG,2BAA2B,CAAA;AAE9D;;GAEG;AACH,MAAa,gCAAgC;IAC3C,YAA6B,mBAAwC;QAAxC,wBAAmB,GAAnB,mBAAmB,CAAqB;IAAG,CAAC;IAEzE,iGAAiG;IACjG;;;;OAIG;IACG,2BAA2B,CAAC,cAA4B,EAAE,UAAwC;;YACtG,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAA;YACnG,IAAI,sBAAsB,EAAE;gBAC1B,OAAO,CAAC,GAAG,cAAc,EAAE,IAAI,SAAG,CAAC,MAAM,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC,CAAA;aAC/F;iBAAM;gBACL,OAAO,cAAc,CAAA;aACtB;QACH,CAAC;KAAA;CACF;AAjBD,4EAiBC","sourcesContent":["import { ExchangeDataManager } from './ExchangeDataManager'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\n\nconst ACCESS_CONTROL_KEYS_HEADER = 'Icure-Access-Control-Keys'\n\n/**\n * @internal this class is intended for internal use only and may be changed without notice.\n */\nexport class AccessControlKeysHeadersProvider {\n  constructor(private readonly exchangeDataManager: ExchangeDataManager) {}\n\n  // This will be enough only as long as we don't use the entities sfks in the access control keys.\n  /**\n   * Add the access control keys headers to the provided initial headers, allowing access control on users with anonymous delegations.\n   * @param initialHeaders the initial headers\n   * @param entityType the type of entity which the user is attempting to retrieve.\n   */\n  async addAccessControlKeysHeaders(initialHeaders: XHR.Header[], entityType: EntityWithDelegationTypeName): Promise<XHR.Header[]> {\n    const accessControlKeysValue = await this.exchangeDataManager.getAccessControlKeysValue(entityType)\n    if (accessControlKeysValue) {\n      return [...initialHeaders, new XHR.Header(ACCESS_CONTROL_KEYS_HEADER, accessControlKeysValue)]\n    } else {\n      return initialHeaders\n    }\n  }\n}\n"]}
+{"version":3,"file":"AccessControlKeysHeadersProvider.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/AccessControlKeysHeadersProvider.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAG9B,QAAA,0BAA0B,GAAG,2BAA2B,CAAA;AAErE;;GAEG;AACH,MAAa,gCAAgC;IAC3C,YAA6B,mBAAwC;QAAxC,wBAAmB,GAAnB,mBAAmB,CAAqB;IAAG,CAAC;IAEzE,iGAAiG;IACjG;;;;OAIG;IACG,2BAA2B,CAAC,cAA4B,EAAE,UAAwC;;YACtG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAA;YACrE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,CAAA;;gBAC/D,OAAO,cAAc,CAAA;QAC5B,CAAC;KAAA;IAEK,2BAA2B,CAAC,UAAwC;;YACxE,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAA;YACnG,IAAI,sBAAsB,EAAE;gBAC1B,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,kCAA0B,EAAE,sBAAsB,CAAC,CAAC,CAAA;aAC5E;iBAAM;gBACL,OAAO,EAAE,CAAA;aACV;QACH,CAAC;KAAA;CACF;AAvBD,4EAuBC","sourcesContent":["import { ExchangeDataManager } from './ExchangeDataManager'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\n\nexport const ACCESS_CONTROL_KEYS_HEADER = 'Icure-Access-Control-Keys'\n\n/**\n * @internal this class is intended for internal use only and may be changed without notice.\n */\nexport class AccessControlKeysHeadersProvider {\n  constructor(private readonly exchangeDataManager: ExchangeDataManager) {}\n\n  // This will be enough only as long as we don't use the entities sfks in the access control keys.\n  /**\n   * Add the access control keys headers to the provided initial headers, allowing access control on users with anonymous delegations.\n   * @param initialHeaders the initial headers\n   * @param entityType the type of entity which the user is attempting to retrieve.\n   */\n  async addAccessControlKeysHeaders(initialHeaders: XHR.Header[], entityType: EntityWithDelegationTypeName): Promise<XHR.Header[]> {\n    const newHeaders = await this.getAccessControlKeysHeaders(entityType)\n    if (newHeaders.length > 0) return [...initialHeaders, ...newHeaders]\n    else return initialHeaders\n  }\n\n  async getAccessControlKeysHeaders(entityType: EntityWithDelegationTypeName): Promise<XHR.Header[]> {\n    const accessControlKeysValue = await this.exchangeDataManager.getAccessControlKeysValue(entityType)\n    if (accessControlKeysValue) {\n      return [new XHR.Header(ACCESS_CONTROL_KEYS_HEADER, accessControlKeysValue)]\n    } else {\n      return []\n    }\n  }\n}\n"]}

package/icc-x-api/crypto/AccessControlSecretUtils.d.ts

@@ -38,5 +38,6 @@ export declare class AccessControlSecretUtils {
      * Get the secure delegations keys which can be used on an entity of provided type with the provided secret foreign keys.
      */
     secureDelegationKeysFor(accessControlSecret: string, entityTypeName: EntityWithDelegationTypeName, secretForeignKeys: string[]): Promise<string[]>;
+    getEncodedAccessControlKeys(accessControlSecrets: string[], entityTypeName: EntityWithDelegationTypeName): Promise<string>;
     private getKeys;
 }

package/icc-x-api/crypto/AccessControlSecretUtils.js

@@ -71,6 +71,17 @@ class AccessControlSecretUtils {
             return yield this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.secureDelegationKeyFor(a, b, c));
         });
     }
+    getEncodedAccessControlKeys(accessControlSecrets, entityTypeName) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const fullBuffer = new Uint8Array(accessControlSecrets.length * this.accessControlKeyLengthBytes);
+            for (let i = 0; i < accessControlSecrets.length; i++) {
+                const accessControlSecret = accessControlSecrets[i];
+                const key = yield this.accessControlKeyFor(accessControlSecret, entityTypeName, undefined);
+                fullBuffer.set(new Uint8Array(key), i * this.accessControlKeyLengthBytes);
+            }
+            return (0, utils_1.ua2b64)(fullBuffer);
+        });
+    }
     getKeys(accessControlSecret, entityTypeName, secretForeignKeys, getKey) {
         return __awaiter(this, void 0, void 0, function* () {
             // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact

package/icc-x-api/crypto/AccessControlSecretUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessControlSecretUtils.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/AccessControlSecretUtils.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,oCAA2C;AAE3C,MAAM,+BAA+B,GAAG,EAAE,CAAA;AAE1C;;GAEG;AACH,MAAa,wBAAwB;IACnC,YAA6B,UAA4B;QAA5B,eAAU,GAAV,UAAU,CAAkB;IAAG,CAAC;IAE7D;;OAEG;IACH,IAAI,2BAA2B;QAC7B,OAAO,+BAA+B,CAAA;IACxC,CAAC;IAED;;;;;;;;OAQG;IACG,mBAAmB,CACvB,mBAA2B,EAC3B,cAA4C,EAC5C,gBAAoC;;YAEpC,sIAAsI;YACtI,oCAAoC;YACpC,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAA,gBAAQ,EAAC,mBAAmB,GAAG,cAAc,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,KAAK,CACzH,CAAC,EACD,+BAA+B,CAChC,CAAA;QACH,CAAC;KAAA;IAED;;OAEG;IACG,oBAAoB,CACxB,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B;;YAE3B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACnI,CAAC;KAAA;IAED;;;;;;;;OAQG;IACG,sBAAsB,CAC1B,mBAA2B,EAC3B,cAA4C,EAC5C,gBAAoC;;YAEpC,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACpI,CAAC;KAAA;IAED;;OAEG;IACG,uBAAuB,CAC3B,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B;;YAE3B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACtI,CAAC;KAAA;IAEa,OAAO,CACnB,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B,EAC3B,MAAuI;;YAEvI,sIAAsI;YAEtI,mCAAmC;YACnC,OAAO,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAA;YACrE,WAAW;YACX,+GAA+G;YAC/G,IAAI;QACN,CAAC;KAAA;CACF;AArFD,4DAqFC","sourcesContent":["import { CryptoPrimitives } from './CryptoPrimitives'\nimport { EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { ua2hex, utf8_2ua } from '../utils'\n\nconst ACCESS_CONTROL_KEY_LENGTH_BYTES = 16\n\n/**\n * @internal this class is intended for internal use only and may be changed without notice.\n */\nexport class AccessControlSecretUtils {\n  constructor(private readonly primitives: CryptoPrimitives) {}\n\n  /**\n   * Size of the access control keys returned by this class.\n   */\n  get accessControlKeyLengthBytes(): number {\n    return ACCESS_CONTROL_KEY_LENGTH_BYTES\n  }\n\n  /**\n   * Get the access control key to use for entities of the provided type and using the provided secret foreign key. The combination of secret foreign\n   * keys and entity type ensures that unauthorised people will not be able to draw links between entities of different types of data or different\n   * confidentiality levels.\n   * These keys will be sent to the icure server for access control of data owners which require anonymous delegations.\n   * @param accessControlSecret an access control secret\n   * @param entityTypeName an entity type name\n   * @param secretForeignKey optionally a secret foreign key to include in the secret. \"\" and undefined are equivalent.\n   */\n  async accessControlKeyFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKey: string | undefined\n  ): Promise<ArrayBuffer> {\n    // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n    // Ignore secret foreign key for now\n    return (await this.primitives.sha256(utf8_2ua(accessControlSecret + entityTypeName /* + (secretForeignKey ?? '')*/))).slice(\n      0,\n      ACCESS_CONTROL_KEY_LENGTH_BYTES\n    )\n  }\n\n  /**\n   * Get the access control keys for proving access to an entity of provided type with the provided secret foreign keys.\n   */\n  async accessControlKeysFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[]\n  ): Promise<ArrayBuffer[]> {\n    return await this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.accessControlKeyFor(a, b, c))\n  }\n\n  /**\n   * Get value to use as key in secure delegations for entities of the provided type with the provided secret foreign key. The combination of secret\n   * foreign keys and entity type ensures that unauthorised people will not be able to draw links between entities of different types of data or\n   * different confidentiality levels.\n   * These keys will be used in the secure delegations map of security metadata.\n   * @param accessControlSecret an access control secret\n   * @param entityTypeName an entity type name\n   * @param secretForeignKey optionally a secret foreign key to include in the secret. \"\" and undefined are equivalent.\n   */\n  async secureDelegationKeyFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKey: string | undefined\n  ): Promise<string> {\n    return ua2hex(await this.primitives.sha256(await this.accessControlKeyFor(accessControlSecret, entityTypeName, secretForeignKey)))\n  }\n\n  /**\n   * Get the secure delegations keys which can be used on an entity of provided type with the provided secret foreign keys.\n   */\n  async secureDelegationKeysFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[]\n  ): Promise<string[]> {\n    return await this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.secureDelegationKeyFor(a, b, c))\n  }\n\n  private async getKeys<T>(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[],\n    getKey: (accessControlSecret: string, entityTypeName: EntityWithDelegationTypeName, secretForeignKey: string | undefined) => Promise<T>\n  ): Promise<T[]> {\n    // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n\n    // if (!secretForeignKeys.length) {\n    return [await getKey(accessControlSecret, entityTypeName, undefined)]\n    // } else {\n    //   return await Promise.all(secretForeignKeys.map((sfk) => getKey(accessControlSecret, entityTypeName, sfk)))\n    // }\n  }\n}\n"]}
+{"version":3,"file":"AccessControlSecretUtils.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/AccessControlSecretUtils.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,oCAAmD;AAEnD,MAAM,+BAA+B,GAAG,EAAE,CAAA;AAE1C;;GAEG;AACH,MAAa,wBAAwB;IACnC,YAA6B,UAA4B;QAA5B,eAAU,GAAV,UAAU,CAAkB;IAAG,CAAC;IAE7D;;OAEG;IACH,IAAI,2BAA2B;QAC7B,OAAO,+BAA+B,CAAA;IACxC,CAAC;IAED;;;;;;;;OAQG;IACG,mBAAmB,CACvB,mBAA2B,EAC3B,cAA4C,EAC5C,gBAAoC;;YAEpC,sIAAsI;YACtI,oCAAoC;YACpC,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAA,gBAAQ,EAAC,mBAAmB,GAAG,cAAc,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,KAAK,CACzH,CAAC,EACD,+BAA+B,CAChC,CAAA;QACH,CAAC;KAAA;IAED;;OAEG;IACG,oBAAoB,CACxB,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B;;YAE3B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACnI,CAAC;KAAA;IAED;;;;;;;;OAQG;IACG,sBAAsB,CAC1B,mBAA2B,EAC3B,cAA4C,EAC5C,gBAAoC;;YAEpC,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACpI,CAAC;KAAA;IAED;;OAEG;IACG,uBAAuB,CAC3B,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B;;YAE3B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACtI,CAAC;KAAA;IAEK,2BAA2B,CAAC,oBAA8B,EAAE,cAA4C;;YAC5G,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,2BAA2B,CAAC,CAAA;YACjG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;gBACpD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;gBACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAA;gBAC1F,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,CAAA;aAC1E;YACD,OAAO,IAAA,cAAM,EAAC,UAAU,CAAC,CAAA;QAC3B,CAAC;KAAA;IAEa,OAAO,CACnB,mBAA2B,EAC3B,cAA4C,EAC5C,iBAA2B,EAC3B,MAAuI;;YAEvI,sIAAsI;YAEtI,mCAAmC;YACnC,OAAO,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAA;YACrE,WAAW;YACX,+GAA+G;YAC/G,IAAI;QACN,CAAC;KAAA;CACF;AA/FD,4DA+FC","sourcesContent":["import { CryptoPrimitives } from './CryptoPrimitives'\nimport { EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { ua2b64, ua2hex, utf8_2ua } from '../utils'\n\nconst ACCESS_CONTROL_KEY_LENGTH_BYTES = 16\n\n/**\n * @internal this class is intended for internal use only and may be changed without notice.\n */\nexport class AccessControlSecretUtils {\n  constructor(private readonly primitives: CryptoPrimitives) {}\n\n  /**\n   * Size of the access control keys returned by this class.\n   */\n  get accessControlKeyLengthBytes(): number {\n    return ACCESS_CONTROL_KEY_LENGTH_BYTES\n  }\n\n  /**\n   * Get the access control key to use for entities of the provided type and using the provided secret foreign key. The combination of secret foreign\n   * keys and entity type ensures that unauthorised people will not be able to draw links between entities of different types of data or different\n   * confidentiality levels.\n   * These keys will be sent to the icure server for access control of data owners which require anonymous delegations.\n   * @param accessControlSecret an access control secret\n   * @param entityTypeName an entity type name\n   * @param secretForeignKey optionally a secret foreign key to include in the secret. \"\" and undefined are equivalent.\n   */\n  async accessControlKeyFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKey: string | undefined\n  ): Promise<ArrayBuffer> {\n    // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n    // Ignore secret foreign key for now\n    return (await this.primitives.sha256(utf8_2ua(accessControlSecret + entityTypeName /* + (secretForeignKey ?? '')*/))).slice(\n      0,\n      ACCESS_CONTROL_KEY_LENGTH_BYTES\n    )\n  }\n\n  /**\n   * Get the access control keys for proving access to an entity of provided type with the provided secret foreign keys.\n   */\n  async accessControlKeysFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[]\n  ): Promise<ArrayBuffer[]> {\n    return await this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.accessControlKeyFor(a, b, c))\n  }\n\n  /**\n   * Get value to use as key in secure delegations for entities of the provided type with the provided secret foreign key. The combination of secret\n   * foreign keys and entity type ensures that unauthorised people will not be able to draw links between entities of different types of data or\n   * different confidentiality levels.\n   * These keys will be used in the secure delegations map of security metadata.\n   * @param accessControlSecret an access control secret\n   * @param entityTypeName an entity type name\n   * @param secretForeignKey optionally a secret foreign key to include in the secret. \"\" and undefined are equivalent.\n   */\n  async secureDelegationKeyFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKey: string | undefined\n  ): Promise<string> {\n    return ua2hex(await this.primitives.sha256(await this.accessControlKeyFor(accessControlSecret, entityTypeName, secretForeignKey)))\n  }\n\n  /**\n   * Get the secure delegations keys which can be used on an entity of provided type with the provided secret foreign keys.\n   */\n  async secureDelegationKeysFor(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[]\n  ): Promise<string[]> {\n    return await this.getKeys(accessControlSecret, entityTypeName, secretForeignKeys, (a, b, c) => this.secureDelegationKeyFor(a, b, c))\n  }\n\n  async getEncodedAccessControlKeys(accessControlSecrets: string[], entityTypeName: EntityWithDelegationTypeName): Promise<string> {\n    const fullBuffer = new Uint8Array(accessControlSecrets.length * this.accessControlKeyLengthBytes)\n    for (let i = 0; i < accessControlSecrets.length; i++) {\n      const accessControlSecret = accessControlSecrets[i]\n      const key = await this.accessControlKeyFor(accessControlSecret, entityTypeName, undefined)\n      fullBuffer.set(new Uint8Array(key), i * this.accessControlKeyLengthBytes)\n    }\n    return ua2b64(fullBuffer)\n  }\n\n  private async getKeys<T>(\n    accessControlSecret: string,\n    entityTypeName: EntityWithDelegationTypeName,\n    secretForeignKeys: string[],\n    getKey: (accessControlSecret: string, entityTypeName: EntityWithDelegationTypeName, secretForeignKey: string | undefined) => Promise<T>\n  ): Promise<T[]> {\n    // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n\n    // if (!secretForeignKeys.length) {\n    return [await getKey(accessControlSecret, entityTypeName, undefined)]\n    // } else {\n    //   return await Promise.all(secretForeignKeys.map((sfk) => getKey(accessControlSecret, entityTypeName, sfk)))\n    // }\n  }\n}\n"]}

package/icc-x-api/crypto/BaseExchangeDataManager.d.ts

@@ -1,6 +1,6 @@
 import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
 import { KeyPair } from './RSA';
-import { ExchangeData } from '../../icc-api/model/ExchangeData';
+import { ExchangeData } from '../../icc-api/model/internal/ExchangeData';
 import { IccExchangeDataApi } from '../../icc-api/api/IccExchangeDataApi';
 import { CryptoPrimitives } from './CryptoPrimitives';
 /**

package/icc-x-api/crypto/BaseExchangeDataManager.js

@@ -10,7 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseExchangeDataManager = void 0;
-const ExchangeData_1 = require("../../icc-api/model/ExchangeData");
+const ExchangeData_1 = require("../../icc-api/model/internal/ExchangeData");
 const XHR_1 = require("../../icc-api/api/XHR");
 var XHRError = XHR_1.XHR.XHRError;
 const utils_1 = require("../utils");

package/icc-x-api/crypto/BaseExchangeDataManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"BaseExchangeDataManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/BaseExchangeDataManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,mEAA+D;AAE/D,+CAA2C;AAC3C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B,oCAA6E;AAC7E,4BAA2B;AAC3B,mCAA4D;AAE5D;;;;GAIG;AACH,MAAa,uBAAuB;IAClC,YACW,GAAuB,EACf,YAA8B,EAC9B,UAA4B,EAC5B,gCAAyC;QAHjD,QAAG,GAAH,GAAG,CAAoB;QACf,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,eAAU,GAAV,UAAU,CAAkB;QAC5B,qCAAgC,GAAhC,gCAAgC,CAAS;IACzD,CAAC;IAEJ;;;;;;OAMG;IACG,8CAA8C;;;YAClD,IAAI,CAAC,IAAI,CAAC,gCAAgC;gBAAE,OAAO,SAAS,CAAA;YAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAC5F,MAAM,YAAY,GAAG,MAAA,YAAY,CAAC,IAAI,mCAAI,EAAE,CAAA;YAC5C,OAAO,MAAA,YAAY,CAAC,WAAW,0CAAE,aAAa,EAAE;gBAC9C,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACrH,IAAI,YAAY,CAAC,IAAI;oBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;aAC/D;YACD,OAAO,YAAY,CAAA;;KACpB;IAED;;;;;OAKG;IACG,sCAAsC,CAAC,WAAmB,EAAE,UAAkB;;YAClF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACnF,CAAC;KAAA;IAED;;;;OAIG;IACG,mBAAmB,CAAC,cAAsB;;YAC9C,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpE,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;oBACjD,OAAO,SAAS,CAAA;iBACjB;;oBAAM,MAAM,CAAC,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,0BAA0B,CAC9B,YAA4B,EAC5B,kBAAoF;;YAEpF,MAAM,QAAQ,GAAmB,EAAE,CAAA;YACnC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;gBAC7B,IAAI,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;aACvF;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC;KAAA;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,YAA0B,EAC1B,kBAAoF;;YAEpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,IAAI,YAAY,CAAC,SAAS,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAA;YACxD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE;gBACpE,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC/D,IAAI,eAAe,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,eAAe,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAA;aACpI;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,6BAA6B,CACjC,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACzD,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,sBAAsB,CAC1B,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACjD,CAAA;QACH,CAAC;KAAA;IAEa,sBAAsB,CAClC,YAA4B,EAC5B,cAAsE,EACtE,qBAAuF,EACvF,kBAA0D;;YAK1D,MAAM,qBAAqB,GAAQ,EAAE,CAAA;YACrC,MAAM,iBAAiB,GAAmB,EAAE,CAAA;YAC5C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;gBAC7B,IAAI;oBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAA;oBAClF,IAAI,SAAS,EAAE;wBACb,qBAAqB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAA;qBAChE;yBAAM;wBACL,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;qBAC3B;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;iBAC3B;aACF;YACD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAA;QACrD,CAAC;KAAA;IAEa,UAAU,CACtB,aAAyD,EACzD,cAAwE;;;YAExE,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC7E,uCACK,IAAI,KACP,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,IACvE;YACH,CAAC,EAAE,EAA4D,CAAC,CAAA;YAChE,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;gBAC3D,IAAI;oBACF,MAAM,GAAG,GAAG,MAAA,sBAAsB,CAAC,EAAE,CAAC,0CAAE,UAAU,CAAA;oBAClD,IAAI,GAAG;wBAAE,OAAO,IAAA,cAAM,EAAC,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;iBAC5F;gBAAC,OAAO,CAAC,EAAE;oBACV,uBAAuB;iBACxB;aACF;;KACF;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,UAAkB,EAClB,aAA0D,EAC1D,cAA2D,EAC3D,qBAEI,EAAE;;;YAMN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;gBAC7E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;aAChE;YACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAA;YACpD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAA;YACpE,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjG,MAAM,4BAA4B,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjH,MAAM,gBAAgB,GAAG;gBACvB,EAAE,EAAE,MAAA,kBAAkB,CAAC,EAAE,mCAAI,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;gBACzD,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,oBAAoB;gBACjC,mBAAmB,EAAE,4BAA4B;aAClD,CAAA;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,CAAA;YACtG,MAAM,YAAY,GAAG,IAAI,2BAAY,iCAAM,gBAAgB,KAAE,SAAS,IAAG,CAAA;YACzE,OAAO;gBACL,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,GAAG;gBAC5B,mBAAmB,EAAE,mBAAmB,CAAC,MAAM;aAChD,CAAA;;KACF;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,qBAAqB,CACzB,YAA0B,EAC1B,cAAsE,EACtE,iBAA8D,EAC9D,aAA0D,EAC1D,kBAAoF;;YASpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;YACtF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;YACtG,IAAI,CAAC,cAAc,IAAI,CAAC,sBAAsB;gBAAE,OAAO,SAAS,CAAA;YAChE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;YAChF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAA;YACxG,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;YACjF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAA;YACjF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACxI,IAAI,CAAC,cAAc,CAAC,MAAM;gBAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;YACrF,MAAM,+BAA+B,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;gBACxE,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;gBAC/B,OAAO,GAAG,CAAA;YACZ,CAAC,EAAE,EAAiD,CAAC,CAAA;YACrD,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACzI,MAAM,mBAAmB,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YACrD,mBAAmB,CAAC,WAAW,mCAC1B,YAAY,CAAC,WAAW,GACxB,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC,CACrF,CAAA;YACD,mBAAmB,CAAC,mBAAmB,mCAClC,YAAY,CAAC,mBAAmB,GAChC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,+BAA+B,CAAC,CAAC,CAC7F,CAAA;YACD,IAAI,UAAU,EAAE;gBACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAA;gBACjE,mBAAmB,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;aAC1F;YACD,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,2BAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;QACrI,CAAC;KAAA;IAED,sGAAsG;IACtG,mHAAmH;IACnH,iBAAiB;IACH,WAAW,CAAC,YAKzB;;YACC,SAAS,UAAU,CAAC,GAA4B;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;qBACpB,IAAI,EAAE;qBACN,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;oBACtB,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACrC,CAAC,EAAE,EAAwB,CAAC,CAAA;YAChC,CAAC;YACD,MAAM,UAAU,GAAG;gBACjB,CAAC,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC;gBACrC,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC;gBACnC,CAAC,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBACrD,CAAC,qBAAqB,EAAE,UAAU,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;aACtE,CAAA;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAA,gBAAQ,EAAC,QAAQ,CAAC,CAAC,CAAA;QACnD,CAAC;KAAA;IAED,+BAA+B;IACjB,mBAAmB;;YAI/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACtD,OAAO;gBACL,GAAG,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;gBAC3C,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEa,iBAAiB,CAAC,cAA2B;;YACzD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;QACnE,CAAC;KAAA;IAED,wCAAwC;IAC1B,2BAA2B;;YAIvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACtD,OAAO;gBACL,MAAM,EAAE,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC;gBACtD,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEO,yBAAyB,CAAC,cAA2B;QAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,cAAc,CAAC,CAAC,CAAA;IAChD,CAAC;IAEa,mBAAmB,CAC/B,OAAoB,EACpB,IAAmD;;YAEnD,MAAM,GAAG,GAA+C,EAAE,CAAA;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,gBAAQ,EAAC,IAAA,cAAM,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;aAClI;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,gBAAgB,CAC5B,OAAoB,EACpB,IAAiD;;YAEjD,MAAM,GAAG,GAA6C,EAAE,CAAA;YACxD,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;aAC/E;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;CACF;AArXD,0DAqXC","sourcesContent":["import { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair } from './RSA'\nimport { ExchangeData } from '../../icc-api/model/ExchangeData'\nimport { IccExchangeDataApi } from '../../icc-api/api/IccExchangeDataApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport XHRError = XHR.XHRError\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { b64_2ua, hex2ua, ua2b64, ua2hex, ua2utf8, utf8_2ua } from '../utils'\nimport * as _ from 'lodash'\nimport { fingerprintV1toV2, fingerprintIsV1 } from './utils'\n\n/**\n * @internal this class is intended for internal use only and may be modified without notice\n * Functions to create and get exchange data.\n * The methods of this api require to pass the appropriate keys for encryption/decryption manually.\n */\nexport class BaseExchangeDataManager {\n  constructor(\n    readonly api: IccExchangeDataApi,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly primitives: CryptoPrimitives,\n    private readonly selfRequiresAnonymousDelegations: boolean\n  ) {}\n\n  /**\n   * Get all the exchange data where the current data owner is the delegator or the delegate. However, some data owners, generally HCPs, may have a\n   * prohibitively high amount of exchange data. If the crypto strategies specify that the current data owner requires anonymous delegation this\n   * method returns all the exchange data found for the data owner, else the method returns undefined.\n   * @return all the exchange data for the current data owner or undefined if the crypto strategies don't allow to retrieve all data for the current\n   * data owner.\n   */\n  async getAllExchangeDataForCurrentDataOwnerIfAllowed(): Promise<ExchangeData[] | undefined> {\n    if (!this.selfRequiresAnonymousDelegations) return undefined\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    let latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, undefined, 1000)\n    const allRetrieved = latestResult.rows ?? []\n    while (latestResult.nextKeyPair?.startKeyDocId) {\n      latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, latestResult.nextKeyPair.startKeyDocId, 1000)\n      if (latestResult.rows) allRetrieved.push(...latestResult.rows)\n    }\n    return allRetrieved\n  }\n\n  /**\n   * Get all exchange data for the provided delegator-delegate pair.\n   * @param delegatorId id of a delegator data owner.\n   * @param delegateId id of a delegate data owner.\n   * @return all exchange data for the provided delegator-delegate pair.\n   */\n  async getExchangeDataByDelegatorDelegatePair(delegatorId: string, delegateId: string): Promise<ExchangeData[]> {\n    return await this.api.getExchangeDataByDelegatorDelegate(delegatorId, delegateId)\n  }\n\n  /**\n   * Get the exchange data with the provided id.\n   * @param exchangeDataId id of the exchange data.\n   * @return the exchange data with the provided id or undefined if no exchange data with such id could be found.\n   */\n  async getExchangeDataById(exchangeDataId: string): Promise<ExchangeData | undefined> {\n    return await this.api.getExchangeDataById(exchangeDataId).catch((e) => {\n      if (e instanceof XHRError && e.statusCode === 404) {\n        return undefined\n      } else throw e\n    })\n  }\n\n  /**\n   * Filters exchange data returning only the instances that could be verified using their signature and the provided verification\n   * keys.\n   * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)\n   * will always be unverified.\n   * @param exchangeData the exchange data to verify.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the exchange data which could be verified given his signature and the available verification keys.\n   * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.\n   */\n  async filterVerifiedExchangeData(\n    exchangeData: ExchangeData[],\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<ExchangeData[]> {\n    const verified: ExchangeData[] = []\n    for (const ed of exchangeData) {\n      if (await this.verifyExchangeData(ed, (x) => getVerificationKey(x))) verified.push(ed)\n    }\n    return verified\n  }\n\n  /**\n   * Verifies the authenticity of the exchange data by checking the signature.\n   * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)\n   * will always be unverified.\n   * @param exchangeData the exchange data to verify.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the exchange data which could be verified given his signature and the available verification keys.\n   * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.\n   */\n  async verifyExchangeData(\n    exchangeData: ExchangeData,\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<boolean> {\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    if (exchangeData.delegator !== dataOwnerId) return false\n    const signatureData = await this.bytesToSign(exchangeData)\n    for (const [fp, signature] of Object.entries(exchangeData.signature)) {\n      const verificationKey = await getVerificationKey(fp.slice(-32))\n      if (verificationKey && (await this.primitives.RSA.verifySignature(verificationKey, b64_2ua(signature), signatureData))) return true\n    }\n    return false\n  }\n\n  /**\n   * Extracts and decrypts the access control secret from the provided exchange data.\n   * These need to be hashed together with the entity class and confidentiality level in order to get the actual access control key\n   * which will be sent to the server.\n   * @param exchangeData the exchange data from which to extract access control secrets.\n   * @param decryptionKeys rsa key pairs to use for decryption of the access control secret.\n   * @return an object composed of:\n   * - successfulDecryptions: array of all successfully decrypted access control keys\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptAccessControlSecret(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: string[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.accessControlSecret,\n      (d) => this.importAccessControlSecret(new Uint8Array(d))\n    )\n  }\n\n  /**\n   * Extract and decrypts the exchange keys from the provided exchange data.\n   * @param exchangeData the exchange data from which to extract exchange keys.\n   * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.\n   * @return an object composed of:\n   * - successfulDecryptions: array containing the successfully decrypted exchange keys.\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptExchangeKeys(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.exchangeKey,\n      (d) => this.importExchangeKey(new Uint8Array(d))\n    )\n  }\n\n  private async tryDecryptExchangeData<T>(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    encryptedDataSelector: (data: ExchangeData) => { [keyPairFingerprint: string]: string },\n    unmarshalDecrypted: (decrypted: ArrayBuffer) => Promise<T>\n  ): Promise<{\n    successfulDecryptions: T[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    const successfulDecryptions: T[] = []\n    const failedDecryptions: ExchangeData[] = []\n    for (const ed of exchangeData) {\n      try {\n        const decrypted = await this.tryDecrypt(encryptedDataSelector(ed), decryptionKeys)\n        if (decrypted) {\n          successfulDecryptions.push(await unmarshalDecrypted(decrypted))\n        } else {\n          failedDecryptions.push(ed)\n        }\n      } catch (e) {\n        failedDecryptions.push(ed)\n      }\n    }\n    return { successfulDecryptions, failedDecryptions }\n  }\n\n  private async tryDecrypt(\n    encryptedData: { [keyPairFingerprintV2: string]: string },\n    decryptionKeys: { [publicKeyFingerprintV1: string]: KeyPair<CryptoKey> }\n  ): Promise<ArrayBuffer | undefined> {\n    const decryptionKeysWithV2Fp = Object.keys(decryptionKeys).reduce((prev, fp) => {\n      return {\n        ...prev,\n        [fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp]: decryptionKeys[fp],\n      }\n    }, {} as { [publicKeyFingerprint: string]: KeyPair<CryptoKey> })\n    for (const [fp, encrypted] of Object.entries(encryptedData)) {\n      try {\n        const key = decryptionKeysWithV2Fp[fp]?.privateKey\n        if (key) return hex2ua(ua2utf8(await this.primitives.RSA.decrypt(key, b64_2ua(encrypted))))\n      } catch (e) {\n        // Try with another key\n      }\n    }\n  }\n\n  /**\n   * Creates exchange data from the current data owner to the provided delegate, uploading the newly created exchange data to the cloud.\n   * This assumes that the keys have been verified.\n   * @param delegateId id of the delegate for the new exchange data.\n   * @param signatureKeys private keys to use for signing the created data.\n   * @param encryptionKeys public keys to use for the encryption of the exchange data (from delegator and delegate).\n   * @param optionalAttributes optional precalculated attributes for the creation of data\n   * @return the newly created exchange data, and its decrypted exchange key and access control secret.\n   */\n  async createExchangeData(\n    delegateId: string,\n    signatureKeys: { [keyPairFingerprint: string]: CryptoKey },\n    encryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    optionalAttributes: {\n      id?: string\n    } = {}\n  ): Promise<{\n    exchangeData: ExchangeData\n    exchangeKey: CryptoKey\n    accessControlSecret: string\n  }> {\n    if (!Object.keys(signatureKeys).length || !Object.keys(encryptionKeys).length) {\n      throw new Error('Must specify at least one signature key and ')\n    }\n    const exchangeKey = await this.generateExchangeKey()\n    const accessControlSecret = await this.generateAccessControlSecret()\n    const encryptedExchangeKey = await this.encryptDataWithKeys(exchangeKey.rawBytes, encryptionKeys)\n    const encryptedAccessControlSecret = await this.encryptDataWithKeys(accessControlSecret.rawBytes, encryptionKeys)\n    const baseExchangeData = {\n      id: optionalAttributes.id ?? this.primitives.randomUuid(),\n      delegator: await this.dataOwnerApi.getCurrentDataOwnerId(),\n      delegate: delegateId,\n      exchangeKey: encryptedExchangeKey,\n      accessControlSecret: encryptedAccessControlSecret,\n    }\n    const signature = await this.signDataWithKeys(await this.bytesToSign(baseExchangeData), signatureKeys)\n    const exchangeData = new ExchangeData({ ...baseExchangeData, signature })\n    return {\n      exchangeData: await this.api.createExchangeData(exchangeData),\n      exchangeKey: exchangeKey.key,\n      accessControlSecret: accessControlSecret.secret,\n    }\n  }\n\n  /**\n   * Updates existing exchange data and uploads it to the cloud in order to share it also with additional public keys, useful for example in cases\n   * where one of the data owners involved in the exchange data has lost one of his keys.\n   * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.\n   * This method assumes that the new encryption keys have been verified.\n   * If the current data owner is also the delegator of the provided exchange data and at least one of the verification keys can be used to\n   * validate the current exchange data then the signature will be updated using the signature keys.\n   * Instead, if the current data owner is not the delegator of the provided exchange data, or the exchange data could not be verified using\n   * the provided verification keys then the updated exchange data will become unverified, and won't ever be verifiable again.\n   * @param exchangeData exchange data to update.\n   * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.\n   * @param signatureKeys keys to use for the new signature of the updated exchange data.\n   * @param newEncryptionKeys new keys to add to the exchange data.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not\n   * be decrypted and the exchange data could not be updated.\n   */\n  async tryUpdateExchangeData(\n    exchangeData: ExchangeData,\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    newEncryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    signatureKeys: { [keyPairFingerprint: string]: CryptoKey },\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<\n    | {\n        exchangeData: ExchangeData\n        exchangeKey: CryptoKey\n        accessControlSecret: string\n      }\n    | undefined\n  > {\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const rawExchangeKey = await this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys)\n    const rawAccessControlSecret = await this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys)\n    if (!rawExchangeKey || !rawAccessControlSecret) return undefined\n    const exchangeKey = await this.importExchangeKey(new Uint8Array(rawExchangeKey))\n    const accessControlSecret = await this.importAccessControlSecret(new Uint8Array(rawAccessControlSecret))\n    const existingExchangeKeyEntries = new Set(Object.keys(exchangeData.exchangeKey))\n    const existingAcsEntries = new Set(Object.keys(exchangeData.accessControlSecret))\n    const missingEntries = Object.keys(newEncryptionKeys).filter((fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp))\n    if (!missingEntries.length) return { exchangeData, exchangeKey, accessControlSecret }\n    const encryptionKeysForMissingEntries = missingEntries.reduce((obj, fp) => {\n      obj[fp] = newEncryptionKeys[fp]\n      return obj\n    }, {} as { [keyPairFingerprint: string]: CryptoKey })\n    const isVerified = exchangeData.delegator == dataOwnerId && (await this.verifyExchangeData(exchangeData, (fp) => getVerificationKey(fp)))\n    const updatedExchangeData = _.cloneDeep(exchangeData)\n    updatedExchangeData.exchangeKey = {\n      ...exchangeData.exchangeKey,\n      ...(await this.encryptDataWithKeys(rawExchangeKey, encryptionKeysForMissingEntries)),\n    }\n    updatedExchangeData.accessControlSecret = {\n      ...exchangeData.accessControlSecret,\n      ...(await this.encryptDataWithKeys(rawAccessControlSecret, encryptionKeysForMissingEntries)),\n    }\n    if (isVerified) {\n      const newDataToSign = await this.bytesToSign(updatedExchangeData)\n      updatedExchangeData.signature = await this.signDataWithKeys(newDataToSign, signatureKeys)\n    }\n    return { exchangeData: await this.api.modifyExchangeData(new ExchangeData(updatedExchangeData)), exchangeKey, accessControlSecret }\n  }\n\n  // Gets a byte representation of the parts of exchange data which should be included in the signature.\n  // Equivalent json representations of the exchange data should provide the same bytes (even if the order of entries\n  // is different).\n  private async bytesToSign(exchangeData: {\n    delegate: string\n    delegator: string\n    exchangeKey: { [k: string]: string }\n    accessControlSecret: { [k: string]: string }\n  }): Promise<ArrayBuffer> {\n    function sortObject(obj: { [k: string]: string }): [string, string][] {\n      return Object.keys(obj)\n        .sort()\n        .reduce((sorted, key) => {\n          return [...sorted, [key, obj[key]]]\n        }, [] as [string, string][])\n    }\n    const signObject = [\n      ['delegator', exchangeData.delegator],\n      ['delegate', exchangeData.delegate],\n      ['exchangeKey', sortObject(exchangeData.exchangeKey)],\n      ['accessControlSecret', sortObject(exchangeData.accessControlSecret)],\n    ]\n    const signJson = JSON.stringify(signObject)\n    return this.primitives.sha256(utf8_2ua(signJson))\n  }\n\n  // Generates a new exchange key\n  private async generateExchangeKey(): Promise<{\n    key: CryptoKey // the imported key\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = await this.primitives.randomBytes(32)\n    return {\n      key: await this.importExchangeKey(rawBytes),\n      rawBytes,\n    }\n  }\n\n  private async importExchangeKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey> {\n    return await this.primitives.AES.importKey('raw', decryptedBytes)\n  }\n\n  // Generates a new access control secret\n  private async generateAccessControlSecret(): Promise<{\n    secret: string // the imported secret\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = await this.primitives.randomBytes(16)\n    return {\n      secret: await this.importAccessControlSecret(rawBytes),\n      rawBytes,\n    }\n  }\n\n  private importAccessControlSecret(decryptedBytes: ArrayBuffer): Promise<string> {\n    return Promise.resolve(ua2hex(decryptedBytes))\n  }\n\n  private async encryptDataWithKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprintV1: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprintV2: string]: string }> {\n    const res: { [keyPairFingerprintV2: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp] = ua2b64(await this.primitives.RSA.encrypt(key, utf8_2ua(ua2hex(rawData))))\n    }\n    return res\n  }\n\n  private async signDataWithKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprint: string]: string }> {\n    const res: { [keyPairFingerprint: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fp] = ua2b64(await this.primitives.RSA.sign(key, new Uint8Array(rawData)))\n    }\n    return res\n  }\n}\n"]}
+{"version":3,"file":"BaseExchangeDataManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/BaseExchangeDataManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,4EAAwE;AAExE,+CAA2C;AAC3C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B,oCAA6E;AAC7E,4BAA2B;AAC3B,mCAA4D;AAE5D;;;;GAIG;AACH,MAAa,uBAAuB;IAClC,YACW,GAAuB,EACf,YAA8B,EAC9B,UAA4B,EAC5B,gCAAyC;QAHjD,QAAG,GAAH,GAAG,CAAoB;QACf,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,eAAU,GAAV,UAAU,CAAkB;QAC5B,qCAAgC,GAAhC,gCAAgC,CAAS;IACzD,CAAC;IAEJ;;;;;;OAMG;IACG,8CAA8C;;;YAClD,IAAI,CAAC,IAAI,CAAC,gCAAgC;gBAAE,OAAO,SAAS,CAAA;YAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAC5F,MAAM,YAAY,GAAG,MAAA,YAAY,CAAC,IAAI,mCAAI,EAAE,CAAA;YAC5C,OAAO,MAAA,YAAY,CAAC,WAAW,0CAAE,aAAa,EAAE;gBAC9C,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACrH,IAAI,YAAY,CAAC,IAAI;oBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;aAC/D;YACD,OAAO,YAAY,CAAA;;KACpB;IAED;;;;;OAKG;IACG,sCAAsC,CAAC,WAAmB,EAAE,UAAkB;;YAClF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACnF,CAAC;KAAA;IAED;;;;OAIG;IACG,mBAAmB,CAAC,cAAsB;;YAC9C,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpE,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;oBACjD,OAAO,SAAS,CAAA;iBACjB;;oBAAM,MAAM,CAAC,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,0BAA0B,CAC9B,YAA4B,EAC5B,kBAAoF;;YAEpF,MAAM,QAAQ,GAAmB,EAAE,CAAA;YACnC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;gBAC7B,IAAI,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;aACvF;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC;KAAA;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,YAA0B,EAC1B,kBAAoF;;YAEpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,IAAI,YAAY,CAAC,SAAS,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAA;YACxD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE;gBACpE,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC/D,IAAI,eAAe,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,eAAe,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAA;aACpI;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,6BAA6B,CACjC,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACzD,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,sBAAsB,CAC1B,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACjD,CAAA;QACH,CAAC;KAAA;IAEa,sBAAsB,CAClC,YAA4B,EAC5B,cAAsE,EACtE,qBAAuF,EACvF,kBAA0D;;YAK1D,MAAM,qBAAqB,GAAQ,EAAE,CAAA;YACrC,MAAM,iBAAiB,GAAmB,EAAE,CAAA;YAC5C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;gBAC7B,IAAI;oBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAA;oBAClF,IAAI,SAAS,EAAE;wBACb,qBAAqB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAA;qBAChE;yBAAM;wBACL,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;qBAC3B;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;iBAC3B;aACF;YACD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAA;QACrD,CAAC;KAAA;IAEa,UAAU,CACtB,aAAyD,EACzD,cAAwE;;;YAExE,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC7E,uCACK,IAAI,KACP,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,IACvE;YACH,CAAC,EAAE,EAA4D,CAAC,CAAA;YAChE,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;gBAC3D,IAAI;oBACF,MAAM,GAAG,GAAG,MAAA,sBAAsB,CAAC,EAAE,CAAC,0CAAE,UAAU,CAAA;oBAClD,IAAI,GAAG;wBAAE,OAAO,IAAA,cAAM,EAAC,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;iBAC5F;gBAAC,OAAO,CAAC,EAAE;oBACV,uBAAuB;iBACxB;aACF;;KACF;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,UAAkB,EAClB,aAA0D,EAC1D,cAA2D,EAC3D,qBAEI,EAAE;;;YAMN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;gBAC7E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;aAChE;YACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAA;YACpD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAA;YACpE,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjG,MAAM,4BAA4B,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjH,MAAM,gBAAgB,GAAG;gBACvB,EAAE,EAAE,MAAA,kBAAkB,CAAC,EAAE,mCAAI,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;gBACzD,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,oBAAoB;gBACjC,mBAAmB,EAAE,4BAA4B;aAClD,CAAA;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,CAAA;YACtG,MAAM,YAAY,GAAG,IAAI,2BAAY,iCAAM,gBAAgB,KAAE,SAAS,IAAG,CAAA;YACzE,OAAO;gBACL,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,GAAG;gBAC5B,mBAAmB,EAAE,mBAAmB,CAAC,MAAM;aAChD,CAAA;;KACF;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,qBAAqB,CACzB,YAA0B,EAC1B,cAAsE,EACtE,iBAA8D,EAC9D,aAA0D,EAC1D,kBAAoF;;YASpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;YACtF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;YACtG,IAAI,CAAC,cAAc,IAAI,CAAC,sBAAsB;gBAAE,OAAO,SAAS,CAAA;YAChE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;YAChF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAA;YACxG,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;YACjF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAA;YACjF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACxI,IAAI,CAAC,cAAc,CAAC,MAAM;gBAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;YACrF,MAAM,+BAA+B,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;gBACxE,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;gBAC/B,OAAO,GAAG,CAAA;YACZ,CAAC,EAAE,EAAiD,CAAC,CAAA;YACrD,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACzI,MAAM,mBAAmB,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YACrD,mBAAmB,CAAC,WAAW,mCAC1B,YAAY,CAAC,WAAW,GACxB,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC,CACrF,CAAA;YACD,mBAAmB,CAAC,mBAAmB,mCAClC,YAAY,CAAC,mBAAmB,GAChC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,+BAA+B,CAAC,CAAC,CAC7F,CAAA;YACD,IAAI,UAAU,EAAE;gBACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAA;gBACjE,mBAAmB,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;aAC1F;YACD,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,2BAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;QACrI,CAAC;KAAA;IAED,sGAAsG;IACtG,mHAAmH;IACnH,iBAAiB;IACH,WAAW,CAAC,YAKzB;;YACC,SAAS,UAAU,CAAC,GAA4B;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;qBACpB,IAAI,EAAE;qBACN,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;oBACtB,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACrC,CAAC,EAAE,EAAwB,CAAC,CAAA;YAChC,CAAC;YACD,MAAM,UAAU,GAAG;gBACjB,CAAC,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC;gBACrC,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC;gBACnC,CAAC,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBACrD,CAAC,qBAAqB,EAAE,UAAU,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;aACtE,CAAA;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAA,gBAAQ,EAAC,QAAQ,CAAC,CAAC,CAAA;QACnD,CAAC;KAAA;IAED,+BAA+B;IACjB,mBAAmB;;YAI/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACtD,OAAO;gBACL,GAAG,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;gBAC3C,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEa,iBAAiB,CAAC,cAA2B;;YACzD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;QACnE,CAAC;KAAA;IAED,wCAAwC;IAC1B,2BAA2B;;YAIvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACtD,OAAO;gBACL,MAAM,EAAE,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC;gBACtD,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEO,yBAAyB,CAAC,cAA2B;QAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,cAAc,CAAC,CAAC,CAAA;IAChD,CAAC;IAEa,mBAAmB,CAC/B,OAAoB,EACpB,IAAmD;;YAEnD,MAAM,GAAG,GAA+C,EAAE,CAAA;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,gBAAQ,EAAC,IAAA,cAAM,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;aAClI;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,gBAAgB,CAC5B,OAAoB,EACpB,IAAiD;;YAEjD,MAAM,GAAG,GAA6C,EAAE,CAAA;YACxD,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;aAC/E;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;CACF;AArXD,0DAqXC","sourcesContent":["import { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair } from './RSA'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { IccExchangeDataApi } from '../../icc-api/api/IccExchangeDataApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport XHRError = XHR.XHRError\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { b64_2ua, hex2ua, ua2b64, ua2hex, ua2utf8, utf8_2ua } from '../utils'\nimport * as _ from 'lodash'\nimport { fingerprintV1toV2, fingerprintIsV1 } from './utils'\n\n/**\n * @internal this class is intended for internal use only and may be modified without notice\n * Functions to create and get exchange data.\n * The methods of this api require to pass the appropriate keys for encryption/decryption manually.\n */\nexport class BaseExchangeDataManager {\n  constructor(\n    readonly api: IccExchangeDataApi,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly primitives: CryptoPrimitives,\n    private readonly selfRequiresAnonymousDelegations: boolean\n  ) {}\n\n  /**\n   * Get all the exchange data where the current data owner is the delegator or the delegate. However, some data owners, generally HCPs, may have a\n   * prohibitively high amount of exchange data. If the crypto strategies specify that the current data owner requires anonymous delegation this\n   * method returns all the exchange data found for the data owner, else the method returns undefined.\n   * @return all the exchange data for the current data owner or undefined if the crypto strategies don't allow to retrieve all data for the current\n   * data owner.\n   */\n  async getAllExchangeDataForCurrentDataOwnerIfAllowed(): Promise<ExchangeData[] | undefined> {\n    if (!this.selfRequiresAnonymousDelegations) return undefined\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    let latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, undefined, 1000)\n    const allRetrieved = latestResult.rows ?? []\n    while (latestResult.nextKeyPair?.startKeyDocId) {\n      latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, latestResult.nextKeyPair.startKeyDocId, 1000)\n      if (latestResult.rows) allRetrieved.push(...latestResult.rows)\n    }\n    return allRetrieved\n  }\n\n  /**\n   * Get all exchange data for the provided delegator-delegate pair.\n   * @param delegatorId id of a delegator data owner.\n   * @param delegateId id of a delegate data owner.\n   * @return all exchange data for the provided delegator-delegate pair.\n   */\n  async getExchangeDataByDelegatorDelegatePair(delegatorId: string, delegateId: string): Promise<ExchangeData[]> {\n    return await this.api.getExchangeDataByDelegatorDelegate(delegatorId, delegateId)\n  }\n\n  /**\n   * Get the exchange data with the provided id.\n   * @param exchangeDataId id of the exchange data.\n   * @return the exchange data with the provided id or undefined if no exchange data with such id could be found.\n   */\n  async getExchangeDataById(exchangeDataId: string): Promise<ExchangeData | undefined> {\n    return await this.api.getExchangeDataById(exchangeDataId).catch((e) => {\n      if (e instanceof XHRError && e.statusCode === 404) {\n        return undefined\n      } else throw e\n    })\n  }\n\n  /**\n   * Filters exchange data returning only the instances that could be verified using their signature and the provided verification\n   * keys.\n   * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)\n   * will always be unverified.\n   * @param exchangeData the exchange data to verify.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the exchange data which could be verified given his signature and the available verification keys.\n   * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.\n   */\n  async filterVerifiedExchangeData(\n    exchangeData: ExchangeData[],\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<ExchangeData[]> {\n    const verified: ExchangeData[] = []\n    for (const ed of exchangeData) {\n      if (await this.verifyExchangeData(ed, (x) => getVerificationKey(x))) verified.push(ed)\n    }\n    return verified\n  }\n\n  /**\n   * Verifies the authenticity of the exchange data by checking the signature.\n   * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)\n   * will always be unverified.\n   * @param exchangeData the exchange data to verify.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the exchange data which could be verified given his signature and the available verification keys.\n   * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.\n   */\n  async verifyExchangeData(\n    exchangeData: ExchangeData,\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<boolean> {\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    if (exchangeData.delegator !== dataOwnerId) return false\n    const signatureData = await this.bytesToSign(exchangeData)\n    for (const [fp, signature] of Object.entries(exchangeData.signature)) {\n      const verificationKey = await getVerificationKey(fp.slice(-32))\n      if (verificationKey && (await this.primitives.RSA.verifySignature(verificationKey, b64_2ua(signature), signatureData))) return true\n    }\n    return false\n  }\n\n  /**\n   * Extracts and decrypts the access control secret from the provided exchange data.\n   * These need to be hashed together with the entity class and confidentiality level in order to get the actual access control key\n   * which will be sent to the server.\n   * @param exchangeData the exchange data from which to extract access control secrets.\n   * @param decryptionKeys rsa key pairs to use for decryption of the access control secret.\n   * @return an object composed of:\n   * - successfulDecryptions: array of all successfully decrypted access control keys\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptAccessControlSecret(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: string[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.accessControlSecret,\n      (d) => this.importAccessControlSecret(new Uint8Array(d))\n    )\n  }\n\n  /**\n   * Extract and decrypts the exchange keys from the provided exchange data.\n   * @param exchangeData the exchange data from which to extract exchange keys.\n   * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.\n   * @return an object composed of:\n   * - successfulDecryptions: array containing the successfully decrypted exchange keys.\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptExchangeKeys(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.exchangeKey,\n      (d) => this.importExchangeKey(new Uint8Array(d))\n    )\n  }\n\n  private async tryDecryptExchangeData<T>(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    encryptedDataSelector: (data: ExchangeData) => { [keyPairFingerprint: string]: string },\n    unmarshalDecrypted: (decrypted: ArrayBuffer) => Promise<T>\n  ): Promise<{\n    successfulDecryptions: T[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    const successfulDecryptions: T[] = []\n    const failedDecryptions: ExchangeData[] = []\n    for (const ed of exchangeData) {\n      try {\n        const decrypted = await this.tryDecrypt(encryptedDataSelector(ed), decryptionKeys)\n        if (decrypted) {\n          successfulDecryptions.push(await unmarshalDecrypted(decrypted))\n        } else {\n          failedDecryptions.push(ed)\n        }\n      } catch (e) {\n        failedDecryptions.push(ed)\n      }\n    }\n    return { successfulDecryptions, failedDecryptions }\n  }\n\n  private async tryDecrypt(\n    encryptedData: { [keyPairFingerprintV2: string]: string },\n    decryptionKeys: { [publicKeyFingerprintV1: string]: KeyPair<CryptoKey> }\n  ): Promise<ArrayBuffer | undefined> {\n    const decryptionKeysWithV2Fp = Object.keys(decryptionKeys).reduce((prev, fp) => {\n      return {\n        ...prev,\n        [fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp]: decryptionKeys[fp],\n      }\n    }, {} as { [publicKeyFingerprint: string]: KeyPair<CryptoKey> })\n    for (const [fp, encrypted] of Object.entries(encryptedData)) {\n      try {\n        const key = decryptionKeysWithV2Fp[fp]?.privateKey\n        if (key) return hex2ua(ua2utf8(await this.primitives.RSA.decrypt(key, b64_2ua(encrypted))))\n      } catch (e) {\n        // Try with another key\n      }\n    }\n  }\n\n  /**\n   * Creates exchange data from the current data owner to the provided delegate, uploading the newly created exchange data to the cloud.\n   * This assumes that the keys have been verified.\n   * @param delegateId id of the delegate for the new exchange data.\n   * @param signatureKeys private keys to use for signing the created data.\n   * @param encryptionKeys public keys to use for the encryption of the exchange data (from delegator and delegate).\n   * @param optionalAttributes optional precalculated attributes for the creation of data\n   * @return the newly created exchange data, and its decrypted exchange key and access control secret.\n   */\n  async createExchangeData(\n    delegateId: string,\n    signatureKeys: { [keyPairFingerprint: string]: CryptoKey },\n    encryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    optionalAttributes: {\n      id?: string\n    } = {}\n  ): Promise<{\n    exchangeData: ExchangeData\n    exchangeKey: CryptoKey\n    accessControlSecret: string\n  }> {\n    if (!Object.keys(signatureKeys).length || !Object.keys(encryptionKeys).length) {\n      throw new Error('Must specify at least one signature key and ')\n    }\n    const exchangeKey = await this.generateExchangeKey()\n    const accessControlSecret = await this.generateAccessControlSecret()\n    const encryptedExchangeKey = await this.encryptDataWithKeys(exchangeKey.rawBytes, encryptionKeys)\n    const encryptedAccessControlSecret = await this.encryptDataWithKeys(accessControlSecret.rawBytes, encryptionKeys)\n    const baseExchangeData = {\n      id: optionalAttributes.id ?? this.primitives.randomUuid(),\n      delegator: await this.dataOwnerApi.getCurrentDataOwnerId(),\n      delegate: delegateId,\n      exchangeKey: encryptedExchangeKey,\n      accessControlSecret: encryptedAccessControlSecret,\n    }\n    const signature = await this.signDataWithKeys(await this.bytesToSign(baseExchangeData), signatureKeys)\n    const exchangeData = new ExchangeData({ ...baseExchangeData, signature })\n    return {\n      exchangeData: await this.api.createExchangeData(exchangeData),\n      exchangeKey: exchangeKey.key,\n      accessControlSecret: accessControlSecret.secret,\n    }\n  }\n\n  /**\n   * Updates existing exchange data and uploads it to the cloud in order to share it also with additional public keys, useful for example in cases\n   * where one of the data owners involved in the exchange data has lost one of his keys.\n   * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.\n   * This method assumes that the new encryption keys have been verified.\n   * If the current data owner is also the delegator of the provided exchange data and at least one of the verification keys can be used to\n   * validate the current exchange data then the signature will be updated using the signature keys.\n   * Instead, if the current data owner is not the delegator of the provided exchange data, or the exchange data could not be verified using\n   * the provided verification keys then the updated exchange data will become unverified, and won't ever be verifiable again.\n   * @param exchangeData exchange data to update.\n   * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.\n   * @param signatureKeys keys to use for the new signature of the updated exchange data.\n   * @param newEncryptionKeys new keys to add to the exchange data.\n   * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.\n   * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not\n   * be decrypted and the exchange data could not be updated.\n   */\n  async tryUpdateExchangeData(\n    exchangeData: ExchangeData,\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    newEncryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    signatureKeys: { [keyPairFingerprint: string]: CryptoKey },\n    getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>\n  ): Promise<\n    | {\n        exchangeData: ExchangeData\n        exchangeKey: CryptoKey\n        accessControlSecret: string\n      }\n    | undefined\n  > {\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const rawExchangeKey = await this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys)\n    const rawAccessControlSecret = await this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys)\n    if (!rawExchangeKey || !rawAccessControlSecret) return undefined\n    const exchangeKey = await this.importExchangeKey(new Uint8Array(rawExchangeKey))\n    const accessControlSecret = await this.importAccessControlSecret(new Uint8Array(rawAccessControlSecret))\n    const existingExchangeKeyEntries = new Set(Object.keys(exchangeData.exchangeKey))\n    const existingAcsEntries = new Set(Object.keys(exchangeData.accessControlSecret))\n    const missingEntries = Object.keys(newEncryptionKeys).filter((fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp))\n    if (!missingEntries.length) return { exchangeData, exchangeKey, accessControlSecret }\n    const encryptionKeysForMissingEntries = missingEntries.reduce((obj, fp) => {\n      obj[fp] = newEncryptionKeys[fp]\n      return obj\n    }, {} as { [keyPairFingerprint: string]: CryptoKey })\n    const isVerified = exchangeData.delegator == dataOwnerId && (await this.verifyExchangeData(exchangeData, (fp) => getVerificationKey(fp)))\n    const updatedExchangeData = _.cloneDeep(exchangeData)\n    updatedExchangeData.exchangeKey = {\n      ...exchangeData.exchangeKey,\n      ...(await this.encryptDataWithKeys(rawExchangeKey, encryptionKeysForMissingEntries)),\n    }\n    updatedExchangeData.accessControlSecret = {\n      ...exchangeData.accessControlSecret,\n      ...(await this.encryptDataWithKeys(rawAccessControlSecret, encryptionKeysForMissingEntries)),\n    }\n    if (isVerified) {\n      const newDataToSign = await this.bytesToSign(updatedExchangeData)\n      updatedExchangeData.signature = await this.signDataWithKeys(newDataToSign, signatureKeys)\n    }\n    return { exchangeData: await this.api.modifyExchangeData(new ExchangeData(updatedExchangeData)), exchangeKey, accessControlSecret }\n  }\n\n  // Gets a byte representation of the parts of exchange data which should be included in the signature.\n  // Equivalent json representations of the exchange data should provide the same bytes (even if the order of entries\n  // is different).\n  private async bytesToSign(exchangeData: {\n    delegate: string\n    delegator: string\n    exchangeKey: { [k: string]: string }\n    accessControlSecret: { [k: string]: string }\n  }): Promise<ArrayBuffer> {\n    function sortObject(obj: { [k: string]: string }): [string, string][] {\n      return Object.keys(obj)\n        .sort()\n        .reduce((sorted, key) => {\n          return [...sorted, [key, obj[key]]]\n        }, [] as [string, string][])\n    }\n    const signObject = [\n      ['delegator', exchangeData.delegator],\n      ['delegate', exchangeData.delegate],\n      ['exchangeKey', sortObject(exchangeData.exchangeKey)],\n      ['accessControlSecret', sortObject(exchangeData.accessControlSecret)],\n    ]\n    const signJson = JSON.stringify(signObject)\n    return this.primitives.sha256(utf8_2ua(signJson))\n  }\n\n  // Generates a new exchange key\n  private async generateExchangeKey(): Promise<{\n    key: CryptoKey // the imported key\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = await this.primitives.randomBytes(32)\n    return {\n      key: await this.importExchangeKey(rawBytes),\n      rawBytes,\n    }\n  }\n\n  private async importExchangeKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey> {\n    return await this.primitives.AES.importKey('raw', decryptedBytes)\n  }\n\n  // Generates a new access control secret\n  private async generateAccessControlSecret(): Promise<{\n    secret: string // the imported secret\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = await this.primitives.randomBytes(16)\n    return {\n      secret: await this.importAccessControlSecret(rawBytes),\n      rawBytes,\n    }\n  }\n\n  private importAccessControlSecret(decryptedBytes: ArrayBuffer): Promise<string> {\n    return Promise.resolve(ua2hex(decryptedBytes))\n  }\n\n  private async encryptDataWithKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprintV1: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprintV2: string]: string }> {\n    const res: { [keyPairFingerprintV2: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp] = ua2b64(await this.primitives.RSA.encrypt(key, utf8_2ua(ua2hex(rawData))))\n    }\n    return res\n  }\n\n  private async signDataWithKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprint: string]: string }> {\n    const res: { [keyPairFingerprint: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fp] = ua2b64(await this.primitives.RSA.sign(key, new Uint8Array(rawData)))\n    }\n    return res\n  }\n}\n"]}

package/icc-x-api/crypto/DelegationsDeAnonymization.d.ts

@@ -0,0 +1,44 @@
+import { EncryptedEntityWithType } from '../utils/EntityWithDelegationTypeName';
+import { SecureDelegation } from '../../icc-api/model/SecureDelegation';
+import AccessLevelEnum = SecureDelegation.AccessLevelEnum;
+import { SecureDelegationsSecurityMetadataDecryptor } from './SecureDelegationsSecurityMetadataDecryptor';
+import { ExtendedApisUtils } from './ExtendedApisUtils';
+import { CryptoPrimitives } from './CryptoPrimitives';
+import { AuthenticationProvider } from '../auth/AuthenticationProvider';
+import { AccessControlKeysHeadersProvider } from './AccessControlKeysHeadersProvider';
+import { AccessControlSecretUtils } from './AccessControlSecretUtils';
+import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
+export declare class DelegationsDeAnonymization {
+    private readonly dataOwnerApi;
+    private readonly secureDelegationsMetadataDecryptor;
+    private readonly xapis;
+    private readonly cryptoPrimitives;
+    private readonly accessControlSecretUtils;
+    private readonly accessControlKeysHeadersProvider;
+    private readonly delegationKeyMapFieldsToEncrypt;
+    private readonly delegationKeyMapApi;
+    constructor(dataOwnerApi: IccDataOwnerXApi, secureDelegationsMetadataDecryptor: SecureDelegationsSecurityMetadataDecryptor, xapis: ExtendedApisUtils, cryptoPrimitives: CryptoPrimitives, accessControlSecretUtils: AccessControlSecretUtils, host: string, headers: {
+        [key: string]: string;
+    }, authenticationProvider: AuthenticationProvider | undefined, fetchImpl: ((input: RequestInfo, init?: RequestInit) => Promise<Response>) | undefined, accessControlKeysHeadersProvider: AccessControlKeysHeadersProvider);
+    /**
+     * Creates / updates information to allow the data owners in {@link shareWithDataOwners} to de-anonymize the delegations contained within
+     * {@link entity}.
+     * Note that the delegation de-anonymization information may be used also with other entities of the same type.
+     */
+    createOrUpdateDeAnonymizationInfo(entityWithType: EncryptedEntityWithType, shareWithDataOwners: string[]): Promise<void>;
+    /**
+     * Get the data owners which can access the entity. See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for more details.
+     * @param entityWithType an entity.
+     */
+    getDataOwnersWithAccessTo(entityWithType: EncryptedEntityWithType): Promise<{
+        permissionsByDataOwnerId: {
+            [dataOwnerId: string]: AccessLevelEnum;
+        };
+        hasUnknownAnonymousDataOwners: boolean;
+    }>;
+    private getDataOwnersWithAccessToSecureDelegations;
+    private mergePermissions;
+    private getDecryptedSecureDelegationKeyMaps;
+    private ensureDelegationKeyMapSharedWith;
+    private createSecureDelegationKeyMap;
+}