@icure/api 8.0.0-RC.1 → 8.0.0-RC.2

package/icc-x-api/crypto/DelegationsDeAnonymization.js

@@ -0,0 +1,235 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationsDeAnonymization = void 0;
+const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
+var AccessLevelEnum = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
+const SecureDelegationKeyMap_1 = require("../../icc-api/model/internal/SecureDelegationKeyMap");
+const ShareMetadataBehaviour_1 = require("./ShareMetadataBehaviour");
+const EntityShareRequest_1 = require("../../icc-api/model/requests/EntityShareRequest");
+var RequestedPermissionEnum = EntityShareRequest_1.EntityShareRequest.RequestedPermissionEnum;
+const utils_1 = require("../utils");
+const IccSecureDelegationKeyMapApi_1 = require("../../icc-api/api/IccSecureDelegationKeyMapApi");
+const XHR_1 = require("../../icc-api/api/XHR");
+const AuthenticationProvider_1 = require("../auth/AuthenticationProvider");
+const AccessControlKeysHeadersProvider_1 = require("./AccessControlKeysHeadersProvider");
+// TODO could be optimised using bulk methods
+class DelegationsDeAnonymization {
+    constructor(dataOwnerApi, secureDelegationsMetadataDecryptor, xapis, cryptoPrimitives, accessControlSecretUtils, host, headers, authenticationProvider = new AuthenticationProvider_1.NoAuthenticationProvider(), fetchImpl = typeof window !== 'undefined'
+        ? window.fetch
+        : typeof self !== 'undefined'
+            ? self.fetch
+            : fetch, accessControlKeysHeadersProvider) {
+        this.dataOwnerApi = dataOwnerApi;
+        this.secureDelegationsMetadataDecryptor = secureDelegationsMetadataDecryptor;
+        this.xapis = xapis;
+        this.cryptoPrimitives = cryptoPrimitives;
+        this.accessControlSecretUtils = accessControlSecretUtils;
+        this.accessControlKeysHeadersProvider = accessControlKeysHeadersProvider;
+        this.delegationKeyMapFieldsToEncrypt = (0, utils_1.parseEncryptedFields)(['delegate', 'delegator'], 'SecureDelegationKeyMap');
+        this.delegationKeyMapApi = new IccSecureDelegationKeyMapApi_1.IccSecureDelegationKeyMapApi(host, headers, authenticationProvider, fetchImpl);
+    }
+    /**
+     * Creates / updates information to allow the data owners in {@link shareWithDataOwners} to de-anonymize the delegations contained within
+     * {@link entity}.
+     * Note that the delegation de-anonymization information may be used also with other entities of the same type.
+     */
+    createOrUpdateDeAnonymizationInfo(entityWithType, shareWithDataOwners) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const delegationsDetails = Object.entries(yield this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails(entityWithType)).flatMap(([canonicalKey, delegation]) => {
+                var _a, _b;
+                const aliases = Object.entries((_b = (_a = entityWithType.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.keysEquivalences) !== null && _b !== void 0 ? _b : {}).flatMap(([alias, canon]) => {
+                    if (canon == canonicalKey) {
+                        return [alias];
+                    }
+                    else {
+                        return [];
+                    }
+                });
+                return [[canonicalKey, delegation], ...aliases.map((alias) => [alias, delegation])];
+            });
+            const delegationsForDeanonInfoSharing = delegationsDetails.filter(([_, delegationInfo]) => {
+                // Drop fully explicit ones: they don't need de-anonymization info
+                return !delegationInfo.fullyExplicit;
+            });
+            // A subset of delegations for which deanon info is relevant AND for which we can also create new info instead of sharing only existing one.
+            const delegationsForNewDeanonInfoCreation = delegationsForDeanonInfoSharing.filter(([_, delegationInfo]) => {
+                // Drop those for which we don't have the full information needed for the creation of new data.
+                return !!delegationInfo.delegate && !!delegationInfo.delegator && !!delegationInfo.accessControlSecret;
+            });
+            const existingDelegationsMap = yield this.getDecryptedSecureDelegationKeyMaps(delegationsForDeanonInfoSharing.map((x) => x[0]), entityWithType.type);
+            for (const delMapToShare of existingDelegationsMap) {
+                yield this.ensureDelegationKeyMapSharedWith(entityWithType.type, delMapToShare, shareWithDataOwners);
+            }
+            const existingDelegationsMapKeys = new Set(existingDelegationsMap.map((x) => x.delegationKey));
+            const delegationsToCreate = delegationsForNewDeanonInfoCreation.filter(([k, _]) => !existingDelegationsMapKeys.has(k));
+            for (const [delKey, membersDetails] of delegationsToCreate) {
+                yield this.createSecureDelegationKeyMap(entityWithType.type, delKey, membersDetails, shareWithDataOwners);
+            }
+        });
+    }
+    /**
+     * Get the data owners which can access the entity. See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for more details.
+     * @param entityWithType an entity.
+     */
+    getDataOwnersWithAccessTo(entityWithType) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.mergePermissions([
+                yield this.getDataOwnersWithAccessToSecureDelegations(entityWithType),
+                {
+                    permissionsByDataOwnerId: Object.fromEntries(Object.keys((_a = entityWithType.entity.delegations) !== null && _a !== void 0 ? _a : {}).map((k) => [k, AccessLevelEnum.WRITE])),
+                    hasUnknownAnonymousDataOwners: false,
+                },
+            ]);
+        });
+    }
+    getDataOwnersWithAccessToSecureDelegations(entityWithType) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const secureDelegationDetails = yield this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails(entityWithType);
+            const secureDelegationWithUnknownMembers = Object.entries(secureDelegationDetails).flatMap(([canonicalKey, delegation]) => {
+                var _a, _b;
+                if (!delegation.delegate || !delegation.delegator) {
+                    const aliases = Object.entries((_b = (_a = entityWithType.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.keysEquivalences) !== null && _b !== void 0 ? _b : {}).flatMap(([alias, canon]) => {
+                        if (canon == canonicalKey) {
+                            return [alias];
+                        }
+                        else {
+                            return [];
+                        }
+                    });
+                    return [{ keys: [canonicalKey, ...aliases], delegation }];
+                }
+                else {
+                    return [];
+                }
+            });
+            const secureDelegationKeyMapsByDelegationKey = Object.fromEntries((yield this.getDecryptedSecureDelegationKeyMaps(secureDelegationWithUnknownMembers.flatMap(({ keys }) => keys), entityWithType.type)).map((x) => [x.delegationKey, x]));
+            const permissionsByDataOwnerId = {};
+            let hasUnknownAnonymousDataOwners = false;
+            function addAccess(dataOwnerId, level) {
+                if (permissionsByDataOwnerId[dataOwnerId] !== AccessLevelEnum.WRITE) {
+                    permissionsByDataOwnerId[dataOwnerId] = level;
+                }
+            }
+            for (const delegation of Object.values(secureDelegationDetails)) {
+                if (delegation.delegate)
+                    addAccess(delegation.delegate, delegation.accessLevel);
+                if (delegation.delegator)
+                    addAccess(delegation.delegator, delegation.accessLevel);
+            }
+            for (const { keys, delegation } of secureDelegationWithUnknownMembers) {
+                const bestKey = keys.find((k) => {
+                    const currMap = secureDelegationKeyMapsByDelegationKey[k];
+                    return currMap && !!currMap.delegator && !!currMap.delegate;
+                });
+                if (bestKey) {
+                    const keyMap = secureDelegationKeyMapsByDelegationKey[bestKey];
+                    addAccess(keyMap.delegate, delegation.accessLevel);
+                    addAccess(keyMap.delegator, delegation.accessLevel);
+                }
+                else {
+                    hasUnknownAnonymousDataOwners = true;
+                }
+            }
+            return { permissionsByDataOwnerId, hasUnknownAnonymousDataOwners };
+        });
+    }
+    mergePermissions(values) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const accumulatedPermissions = {};
+            let hasUnknownAnonymousDataOwners = false;
+            for (const v of values) {
+                hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || v.hasUnknownAnonymousDataOwners;
+                for (const [dataOwnerId, level] of Object.entries(v.permissionsByDataOwnerId)) {
+                    if (accumulatedPermissions[dataOwnerId] !== AccessLevelEnum.WRITE) {
+                        accumulatedPermissions[dataOwnerId] = level;
+                    }
+                }
+            }
+            return {
+                permissionsByDataOwnerId: accumulatedPermissions,
+                hasUnknownAnonymousDataOwners,
+            };
+        });
+    }
+    getDecryptedSecureDelegationKeyMaps(delegationIds, entityType) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (delegationIds.length) {
+                const encryptedMaps = yield this.delegationKeyMapApi.getByDelegationKeys({ ids: delegationIds }, yield this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType));
+                const res = [];
+                for (const encryptedMap of encryptedMaps) {
+                    // Use the original entity type
+                    const decryptionResult = yield this.xapis.decryptEntity(encryptedMap, entityType, (x) => new SecureDelegationKeyMap_1.SecureDelegationKeyMap(x));
+                    if (decryptionResult.decrypted) {
+                        res.push(decryptionResult.entity);
+                    }
+                }
+                return res;
+            }
+            else
+                return [];
+        });
+    }
+    // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the
+    // same entity type as the delegation key for which they are mapping information.
+    ensureDelegationKeyMapSharedWith(entityType, keyMap, delegates) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!keyMap.delegator || !keyMap.delegate)
+                throw new Error('Illegal state: key map is missing delegator or delegate info.');
+            const dataOwnersWithAccessToMapThroughDelegation = Object.values(yield this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails({
+                type: entityType,
+                entity: keyMap,
+            }))
+                .flatMap((x) => [x.delegate, x.delegator])
+                .filter((x) => !!x);
+            // Delegator and delegate got access to the entity when it was first created: no need to share with them ever.
+            const dataOwnersWithAccessToMap = new Set([keyMap.delegate, keyMap.delegator, ...dataOwnersWithAccessToMapThroughDelegation]);
+            const dataOwnersNeedingShare = delegates.filter((x) => !dataOwnersWithAccessToMap.has(x));
+            if (dataOwnersNeedingShare.length) {
+                ;
+                (yield this.xapis.simpleShareOrUpdateEncryptedEntityMetadata({ entity: keyMap, type: entityType }, false, Object.fromEntries(dataOwnersNeedingShare.map((x) => [
+                    x,
+                    {
+                        shareSecretIds: [],
+                        shareEncryptionKeys: ShareMetadataBehaviour_1.ShareMetadataBehaviour.REQUIRED,
+                        shareOwningEntityIds: ShareMetadataBehaviour_1.ShareMetadataBehaviour.NEVER,
+                        requestedPermissions: RequestedPermissionEnum.FULL_READ,
+                    },
+                ])), (request) => __awaiter(this, void 0, void 0, function* () {
+                    return this.delegationKeyMapApi.bulkShareSecureDelegationKeyMap(request, yield this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType));
+                }))).updatedEntityOrThrow;
+            }
+        });
+    }
+    // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the
+    // same entity type as the delegation key for which they are mapping information.
+    createSecureDelegationKeyMap(entityType, delegationKey, delegationMembersDetails, delegates) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!delegationMembersDetails.delegate || !delegationMembersDetails.delegator || !delegationMembersDetails.accessControlSecret)
+                throw new Error('Illegal state: delegation members details are missing delegate, delegator or access control secret info.');
+            const selfDoId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            // Ensure that both the delegator and delegate of the delegation this map refers tho can share it later on, even if they did not create it.
+            // Usually either the delegator or delegate are the current data owner, but sometimes also the child of the delegator or delegate can do it.
+            const initialDelegates = [delegationMembersDetails.delegate, delegationMembersDetails.delegator, ...delegates].filter((x) => x != selfDoId);
+            const initalisedMapInfo = yield this.xapis.entityWithInitialisedEncryptedMetadata({
+                id: this.cryptoPrimitives.crypto.randomUUID(),
+                delegate: delegationMembersDetails.delegate,
+                delegator: delegationMembersDetails.delegator,
+                delegationKey: delegationKey,
+            }, entityType, undefined, undefined, true, false, Object.fromEntries(initialDelegates.map((x) => [x, AccessLevelEnum.READ])));
+            const encryptedKeyMap = yield this.xapis.tryEncryptEntity(initalisedMapInfo.updatedEntity, entityType, this.delegationKeyMapFieldsToEncrypt, false, true, (x) => new SecureDelegationKeyMap_1.SecureDelegationKeyMap(x));
+            yield this.delegationKeyMapApi.create(encryptedKeyMap, new XHR_1.XHR.Header(AccessControlKeysHeadersProvider_1.ACCESS_CONTROL_KEYS_HEADER, yield this.accessControlSecretUtils.getEncodedAccessControlKeys([delegationMembersDetails.accessControlSecret], entityType)));
+        });
+    }
+}
+exports.DelegationsDeAnonymization = DelegationsDeAnonymization;
+//# sourceMappingURL=DelegationsDeAnonymization.js.map

package/icc-x-api/crypto/DelegationsDeAnonymization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DelegationsDeAnonymization.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/DelegationsDeAnonymization.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2EAAuE;AACvE,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AAEzD,gGAA4F;AAE5F,qEAAiE;AACjE,wFAAoF;AACpF,IAAO,uBAAuB,GAAG,uCAAkB,CAAC,uBAAuB,CAAA;AAE3E,oCAAwE;AACxE,iGAA6F;AAC7F,+CAA2C;AAC3C,2EAAiG;AACjG,yFAAiH;AAIjH,6CAA6C;AAC7C,MAAa,0BAA0B;IAIrC,YACmB,YAA8B,EAC9B,kCAA8E,EAC9E,KAAwB,EACxB,gBAAkC,EAClC,wBAAkD,EACnE,IAAY,EACZ,OAAkC,EAClC,yBAAiD,IAAI,iDAAwB,EAAE,EAC/E,YAA2E,OAAO,MAAM,KAAK,WAAW;QACtG,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,KAAK,EACQ,gCAAkE;QAblE,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,uCAAkC,GAAlC,kCAAkC,CAA4C;QAC9E,UAAK,GAAL,KAAK,CAAmB;QACxB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,6BAAwB,GAAxB,wBAAwB,CAA0B;QASlD,qCAAgC,GAAhC,gCAAgC,CAAkC;QAEnF,IAAI,CAAC,+BAA+B,GAAG,IAAA,4BAAoB,EAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,wBAAwB,CAAC,CAAA;QAChH,IAAI,CAAC,mBAAmB,GAAG,IAAI,2DAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAA;IAC/G,CAAC;IAED;;;;OAIG;IACG,iCAAiC,CAAC,cAAuC,EAAE,mBAA6B;;YAC5G,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CACzI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;oBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;wBACzB,OAAO,CAAC,KAAK,CAAC,CAAA;qBACf;yBAAM;wBACL,OAAO,EAAE,CAAA;qBACV;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAyC,CAAA;YAC7H,CAAC,CACF,CAAA;YACD,MAAM,+BAA+B,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACxF,kEAAkE;gBAClE,OAAO,CAAC,cAAc,CAAC,aAAa,CAAA;YACtC,CAAC,CAAC,CAAA;YACF,4IAA4I;YAC5I,MAAM,mCAAmC,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACzG,+FAA+F;gBAC/F,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAA;YACxG,CAAC,CAAC,CAAA;YACF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAC3E,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChD,cAAc,CAAC,IAAI,CACpB,CAAA;YACD,KAAK,MAAM,aAAa,IAAI,sBAAsB,EAAE;gBAClD,MAAM,IAAI,CAAC,gCAAgC,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAA;aACrG;YACD,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;YAC9F,MAAM,mBAAmB,GAAG,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACtH,KAAK,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,mBAAmB,EAAE;gBAC1D,MAAM,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAA;aAC1G;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,yBAAyB,CAAC,cAAuC;;;YAIrE,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC3B,MAAM,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC;gBACrE;oBACE,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,CAAC,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzI,6BAA6B,EAAE,KAAK;iBACrC;aACF,CAAC,CAAA;;KACH;IAEa,0CAA0C,CAAC,cAAuC;;YAI9F,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAA;YACxH,MAAM,kCAAkC,GAAG,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBACxH,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;oBACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;wBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;4BACzB,OAAO,CAAC,KAAK,CAAC,CAAA;yBACf;6BAAM;4BACL,OAAO,EAAE,CAAA;yBACV;oBACH,CAAC,CAAC,CAAA;oBACF,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;iBAC1D;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,sCAAsC,GAAG,MAAM,CAAC,WAAW,CAC/D,CACE,MAAM,IAAI,CAAC,mCAAmC,CAC5C,kCAAkC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAC9D,cAAc,CAAC,IAAI,CACpB,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CACnC,CAAA;YACD,MAAM,wBAAwB,GAA+C,EAAE,CAAA;YAC/E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,SAAS,SAAS,CAAC,WAAmB,EAAE,KAAsB;gBAC5D,IAAI,wBAAwB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;oBACnE,wBAAwB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;iBAC9C;YACH,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE;gBAC/D,IAAI,UAAU,CAAC,QAAQ;oBAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;gBAC/E,IAAI,UAAU,CAAC,SAAS;oBAAE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;aAClF;YACD,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,kCAAkC,EAAE;gBACrE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9B,MAAM,OAAO,GAAG,sCAAsC,CAAC,CAAC,CAAC,CAAA;oBACzD,OAAO,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;gBAC7D,CAAC,CAAC,CAAA;gBACF,IAAI,OAAO,EAAE;oBACX,MAAM,MAAM,GAAG,sCAAsC,CAAC,OAAO,CAAC,CAAA;oBAC9D,SAAS,CAAC,MAAM,CAAC,QAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;oBACnD,SAAS,CAAC,MAAM,CAAC,SAAU,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBACrD;qBAAM;oBACL,6BAA6B,GAAG,IAAI,CAAA;iBACrC;aACF;YACD,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,CAAA;QACpE,CAAC;KAAA;IAEa,gBAAgB,CAC5B,MAGG;;YAKH,MAAM,sBAAsB,GAA+C,EAAE,CAAA;YAC7E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;gBACtB,6BAA6B,GAAG,6BAA6B,IAAI,CAAC,CAAC,6BAA6B,CAAA;gBAChG,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE;oBAC7E,IAAI,sBAAsB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;wBACjE,sBAAsB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;qBAC5C;iBACF;aACF;YACD,OAAO;gBACL,wBAAwB,EAAE,sBAAsB;gBAChD,6BAA6B;aAC9B,CAAA;QACH,CAAC;KAAA;IAEa,mCAAmC,CAC/C,aAAuB,EACvB,UAAwC;;YAExC,IAAI,aAAa,CAAC,MAAM,EAAE;gBACxB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CACtE,EAAE,GAAG,EAAE,aAAa,EAAE,EACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;gBACD,MAAM,GAAG,GAA6B,EAAE,CAAA;gBACxC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;oBACxC,+BAA+B;oBAC/B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CAAC,CAAA;oBACvH,IAAI,gBAAgB,CAAC,SAAS,EAAE;wBAC9B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;qBAClC;iBACF;gBACD,OAAO,GAAG,CAAA;aACX;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,gCAAgC,CAAC,UAAwC,EAAE,MAA8B,EAAE,SAAmB;;YAC1I,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;YAC3H,MAAM,0CAA0C,GAAG,MAAM,CAAC,MAAM,CAC9D,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC;gBACvE,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;aACf,CAAC,CACH;iBACE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;iBACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAa,CAAA;YACjC,8GAA8G;YAC9G,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,0CAA0C,CAAC,CAAC,CAAA;YAC7H,MAAM,sBAAsB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACzF,IAAI,sBAAsB,CAAC,MAAM,EAAE;gBACjC,CAAC;gBAAA,CACC,MAAM,IAAI,CAAC,KAAK,CAAC,0CAA0C,CACzD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EACpC,KAAK,EACL,MAAM,CAAC,WAAW,CAChB,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAChC,CAAC;oBACD;wBACE,cAAc,EAAE,EAAE;wBAClB,mBAAmB,EAAE,+CAAsB,CAAC,QAAQ;wBACpD,oBAAoB,EAAE,+CAAsB,CAAC,KAAK;wBAClD,oBAAoB,EAAE,uBAAuB,CAAC,SAAS;qBACxD;iBACF,CAAC,CACH,EACD,CAAO,OAAO,EAAE,EAAE;oBAChB,OAAA,IAAI,CAAC,mBAAmB,CAAC,+BAA+B,CACtD,OAAO,EACP,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;kBAAA,CACJ,CACF,CAAC,oBAAoB,CAAA;aACvB;QACH,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,4BAA4B,CACxC,UAAwC,EACxC,aAAqB,EACrB,wBAAkD,EAClD,SAAmB;;YAEnB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,IAAI,CAAC,wBAAwB,CAAC,SAAS,IAAI,CAAC,wBAAwB,CAAC,mBAAmB;gBAC5H,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAA;YAC7H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAChE,2IAA2I;YAC3I,4IAA4I;YAC5I,MAAM,gBAAgB,GAAG,CAAC,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAA;YAC3I,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAC/E;gBACE,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE;gBAC7C,QAAQ,EAAE,wBAAwB,CAAC,QAAQ;gBAC3C,SAAS,EAAE,wBAAwB,CAAC,SAAS;gBAC7C,aAAa,EAAE,aAAa;aAC7B,EACD,UAAU,EACV,SAAS,EACT,SAAS,EACT,IAAI,EACJ,KAAK,EACL,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAC3E,CAAA;YACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CACvD,iBAAiB,CAAC,aAAa,EAC/B,UAAU,EACV,IAAI,CAAC,+BAA+B,EACpC,KAAK,EACL,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CACrC,CAAA;YACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CACnC,eAAe,EACf,IAAI,SAAG,CAAC,MAAM,CACZ,6DAA0B,EAC1B,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,UAAU,CAAC,CAC5H,CACF,CAAA;QACH,CAAC;KAAA;CACF;AA3QD,gEA2QC","sourcesContent":["import { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { DelegationMembersDetails, SecureDelegationsSecurityMetadataDecryptor } from './SecureDelegationsSecurityMetadataDecryptor'\nimport { SecureDelegationKeyMap } from '../../icc-api/model/internal/SecureDelegationKeyMap'\nimport { ExtendedApisUtils } from './ExtendedApisUtils'\nimport { ShareMetadataBehaviour } from './ShareMetadataBehaviour'\nimport { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport RequestedPermissionEnum = EntityShareRequest.RequestedPermissionEnum\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { EncryptedFieldsManifest, parseEncryptedFields } from '../utils'\nimport { IccSecureDelegationKeyMapApi } from '../../icc-api/api/IccSecureDelegationKeyMapApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { AuthenticationProvider, NoAuthenticationProvider } from '../auth/AuthenticationProvider'\nimport { ACCESS_CONTROL_KEYS_HEADER, AccessControlKeysHeadersProvider } from './AccessControlKeysHeadersProvider'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\n\n// TODO could be optimised using bulk methods\nexport class DelegationsDeAnonymization {\n  private readonly delegationKeyMapFieldsToEncrypt: EncryptedFieldsManifest\n  private readonly delegationKeyMapApi: IccSecureDelegationKeyMapApi\n\n  constructor(\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly secureDelegationsMetadataDecryptor: SecureDelegationsSecurityMetadataDecryptor,\n    private readonly xapis: ExtendedApisUtils,\n    private readonly cryptoPrimitives: CryptoPrimitives,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    host: string,\n    headers: { [key: string]: string },\n    authenticationProvider: AuthenticationProvider = new NoAuthenticationProvider(),\n    fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response> = typeof window !== 'undefined'\n      ? window.fetch\n      : typeof self !== 'undefined'\n      ? self.fetch\n      : fetch,\n    private readonly accessControlKeysHeadersProvider: AccessControlKeysHeadersProvider\n  ) {\n    this.delegationKeyMapFieldsToEncrypt = parseEncryptedFields(['delegate', 'delegator'], 'SecureDelegationKeyMap')\n    this.delegationKeyMapApi = new IccSecureDelegationKeyMapApi(host, headers, authenticationProvider, fetchImpl)\n  }\n\n  /**\n   * Creates / updates information to allow the data owners in {@link shareWithDataOwners} to de-anonymize the delegations contained within\n   * {@link entity}.\n   * Note that the delegation de-anonymization information may be used also with other entities of the same type.\n   */\n  async createOrUpdateDeAnonymizationInfo(entityWithType: EncryptedEntityWithType, shareWithDataOwners: string[]) {\n    const delegationsDetails = Object.entries(await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails(entityWithType)).flatMap(\n      ([canonicalKey, delegation]) => {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [[canonicalKey, delegation], ...aliases.map((alias) => [alias, delegation])] as [string, DelegationMembersDetails][]\n      }\n    )\n    const delegationsForDeanonInfoSharing = delegationsDetails.filter(([_, delegationInfo]) => {\n      // Drop fully explicit ones: they don't need de-anonymization info\n      return !delegationInfo.fullyExplicit\n    })\n    // A subset of delegations for which deanon info is relevant AND for which we can also create new info instead of sharing only existing one.\n    const delegationsForNewDeanonInfoCreation = delegationsForDeanonInfoSharing.filter(([_, delegationInfo]) => {\n      // Drop those for which we don't have the full information needed for the creation of new data.\n      return !!delegationInfo.delegate && !!delegationInfo.delegator && !!delegationInfo.accessControlSecret\n    })\n    const existingDelegationsMap = await this.getDecryptedSecureDelegationKeyMaps(\n      delegationsForDeanonInfoSharing.map((x) => x[0]),\n      entityWithType.type\n    )\n    for (const delMapToShare of existingDelegationsMap) {\n      await this.ensureDelegationKeyMapSharedWith(entityWithType.type, delMapToShare, shareWithDataOwners)\n    }\n    const existingDelegationsMapKeys = new Set(existingDelegationsMap.map((x) => x.delegationKey))\n    const delegationsToCreate = delegationsForNewDeanonInfoCreation.filter(([k, _]) => !existingDelegationsMapKeys.has(k))\n    for (const [delKey, membersDetails] of delegationsToCreate) {\n      await this.createSecureDelegationKeyMap(entityWithType.type, delKey, membersDetails, shareWithDataOwners)\n    }\n  }\n\n  /**\n   * Get the data owners which can access the entity. See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for more details.\n   * @param entityWithType an entity.\n   */\n  async getDataOwnersWithAccessTo(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    return this.mergePermissions([\n      await this.getDataOwnersWithAccessToSecureDelegations(entityWithType),\n      {\n        permissionsByDataOwnerId: Object.fromEntries(Object.keys(entityWithType.entity.delegations ?? {}).map((k) => [k, AccessLevelEnum.WRITE])),\n        hasUnknownAnonymousDataOwners: false,\n      },\n    ])\n  }\n\n  private async getDataOwnersWithAccessToSecureDelegations(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const secureDelegationDetails = await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails(entityWithType)\n    const secureDelegationWithUnknownMembers = Object.entries(secureDelegationDetails).flatMap(([canonicalKey, delegation]) => {\n      if (!delegation.delegate || !delegation.delegator) {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [{ keys: [canonicalKey, ...aliases], delegation }]\n      } else {\n        return []\n      }\n    })\n    const secureDelegationKeyMapsByDelegationKey = Object.fromEntries(\n      (\n        await this.getDecryptedSecureDelegationKeyMaps(\n          secureDelegationWithUnknownMembers.flatMap(({ keys }) => keys),\n          entityWithType.type\n        )\n      ).map((x) => [x.delegationKey, x])\n    )\n    const permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    function addAccess(dataOwnerId: string, level: AccessLevelEnum) {\n      if (permissionsByDataOwnerId[dataOwnerId] !== AccessLevelEnum.WRITE) {\n        permissionsByDataOwnerId[dataOwnerId] = level\n      }\n    }\n    for (const delegation of Object.values(secureDelegationDetails)) {\n      if (delegation.delegate) addAccess(delegation.delegate, delegation.accessLevel)\n      if (delegation.delegator) addAccess(delegation.delegator, delegation.accessLevel)\n    }\n    for (const { keys, delegation } of secureDelegationWithUnknownMembers) {\n      const bestKey = keys.find((k) => {\n        const currMap = secureDelegationKeyMapsByDelegationKey[k]\n        return currMap && !!currMap.delegator && !!currMap.delegate\n      })\n      if (bestKey) {\n        const keyMap = secureDelegationKeyMapsByDelegationKey[bestKey]\n        addAccess(keyMap.delegate!, delegation.accessLevel)\n        addAccess(keyMap.delegator!, delegation.accessLevel)\n      } else {\n        hasUnknownAnonymousDataOwners = true\n      }\n    }\n    return { permissionsByDataOwnerId, hasUnknownAnonymousDataOwners }\n  }\n\n  private async mergePermissions(\n    values: {\n      permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n      hasUnknownAnonymousDataOwners: boolean\n    }[]\n  ): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const accumulatedPermissions: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    for (const v of values) {\n      hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || v.hasUnknownAnonymousDataOwners\n      for (const [dataOwnerId, level] of Object.entries(v.permissionsByDataOwnerId)) {\n        if (accumulatedPermissions[dataOwnerId] !== AccessLevelEnum.WRITE) {\n          accumulatedPermissions[dataOwnerId] = level\n        }\n      }\n    }\n    return {\n      permissionsByDataOwnerId: accumulatedPermissions,\n      hasUnknownAnonymousDataOwners,\n    }\n  }\n\n  private async getDecryptedSecureDelegationKeyMaps(\n    delegationIds: string[],\n    entityType: EntityWithDelegationTypeName\n  ): Promise<SecureDelegationKeyMap[]> {\n    if (delegationIds.length) {\n      const encryptedMaps = await this.delegationKeyMapApi.getByDelegationKeys(\n        { ids: delegationIds },\n        await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n      )\n      const res: SecureDelegationKeyMap[] = []\n      for (const encryptedMap of encryptedMaps) {\n        // Use the original entity type\n        const decryptionResult = await this.xapis.decryptEntity(encryptedMap, entityType, (x) => new SecureDelegationKeyMap(x))\n        if (decryptionResult.decrypted) {\n          res.push(decryptionResult.entity)\n        }\n      }\n      return res\n    } else return []\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async ensureDelegationKeyMapSharedWith(entityType: EntityWithDelegationTypeName, keyMap: SecureDelegationKeyMap, delegates: string[]) {\n    if (!keyMap.delegator || !keyMap.delegate) throw new Error('Illegal state: key map is missing delegator or delegate info.')\n    const dataOwnersWithAccessToMapThroughDelegation = Object.values(\n      await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails({\n        type: entityType,\n        entity: keyMap,\n      })\n    )\n      .flatMap((x) => [x.delegate, x.delegator])\n      .filter((x) => !!x) as string[]\n    // Delegator and delegate got access to the entity when it was first created: no need to share with them ever.\n    const dataOwnersWithAccessToMap = new Set([keyMap.delegate, keyMap.delegator, ...dataOwnersWithAccessToMapThroughDelegation])\n    const dataOwnersNeedingShare = delegates.filter((x) => !dataOwnersWithAccessToMap.has(x))\n    if (dataOwnersNeedingShare.length) {\n      ;(\n        await this.xapis.simpleShareOrUpdateEncryptedEntityMetadata(\n          { entity: keyMap, type: entityType },\n          false,\n          Object.fromEntries(\n            dataOwnersNeedingShare.map((x) => [\n              x,\n              {\n                shareSecretIds: [],\n                shareEncryptionKeys: ShareMetadataBehaviour.REQUIRED,\n                shareOwningEntityIds: ShareMetadataBehaviour.NEVER,\n                requestedPermissions: RequestedPermissionEnum.FULL_READ,\n              },\n            ])\n          ),\n          async (request) =>\n            this.delegationKeyMapApi.bulkShareSecureDelegationKeyMap(\n              request,\n              await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n            )\n        )\n      ).updatedEntityOrThrow\n    }\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async createSecureDelegationKeyMap(\n    entityType: EntityWithDelegationTypeName,\n    delegationKey: string,\n    delegationMembersDetails: DelegationMembersDetails,\n    delegates: string[]\n  ) {\n    if (!delegationMembersDetails.delegate || !delegationMembersDetails.delegator || !delegationMembersDetails.accessControlSecret)\n      throw new Error('Illegal state: delegation members details are missing delegate, delegator or access control secret info.')\n    const selfDoId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    // Ensure that both the delegator and delegate of the delegation this map refers tho can share it later on, even if they did not create it.\n    // Usually either the delegator or delegate are the current data owner, but sometimes also the child of the delegator or delegate can do it.\n    const initialDelegates = [delegationMembersDetails.delegate, delegationMembersDetails.delegator, ...delegates].filter((x) => x != selfDoId)\n    const initalisedMapInfo = await this.xapis.entityWithInitialisedEncryptedMetadata<SecureDelegationKeyMap>(\n      {\n        id: this.cryptoPrimitives.crypto.randomUUID(),\n        delegate: delegationMembersDetails.delegate,\n        delegator: delegationMembersDetails.delegator,\n        delegationKey: delegationKey,\n      },\n      entityType,\n      undefined,\n      undefined,\n      true,\n      false,\n      Object.fromEntries(initialDelegates.map((x) => [x, AccessLevelEnum.READ]))\n    )\n    const encryptedKeyMap = await this.xapis.tryEncryptEntity(\n      initalisedMapInfo.updatedEntity,\n      entityType,\n      this.delegationKeyMapFieldsToEncrypt,\n      false,\n      true,\n      (x) => new SecureDelegationKeyMap(x)\n    )\n    await this.delegationKeyMapApi.create(\n      encryptedKeyMap,\n      new XHR.Header(\n        ACCESS_CONTROL_KEYS_HEADER,\n        await this.accessControlSecretUtils.getEncodedAccessControlKeys([delegationMembersDetails.accessControlSecret], entityType)\n      )\n    )\n  }\n}\n"]}

package/icc-x-api/crypto/ExchangeDataManager.d.ts

@@ -1,4 +1,4 @@
-import { ExchangeData } from '../../icc-api/model/ExchangeData';
+import { ExchangeData } from '../../icc-api/model/internal/ExchangeData';
 import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
 import { BaseExchangeDataManager } from './BaseExchangeDataManager';
 import { UserEncryptionKeysManager } from './UserEncryptionKeysManager';
@@ -55,6 +55,7 @@ export interface ExchangeDataManager {
     getCachedDecryptionDataKeyByAccessControlHash(hashes: string[], entityType: EntityWithDelegationTypeName, entitySecretForeignKeys: string[]): Promise<{
         [hash: string]: {
             exchangeData: ExchangeData;
+            accessControlSecret: string;
             exchangeKey: CryptoKey;
         };
     }>;
@@ -75,6 +76,7 @@ export interface ExchangeDataManager {
      */
     getDecryptionDataKeyById(id: string, entityType: EntityWithDelegationTypeName | undefined, entitySecretForeignKeys: string[] | undefined, retrieveIfNotCached: boolean): Promise<{
         exchangeKey: CryptoKey | undefined;
+        accessControlSecret: string | undefined;
         exchangeData: ExchangeData;
     } | undefined>;
     /**

package/icc-x-api/crypto/ExchangeDataManager.js

@@ -160,12 +160,15 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
         return __awaiter(this, void 0, void 0, function* () {
             function retrieveByHashesFromCaches(caches) {
                 return hashes.reduce((res, hash) => {
-                    var _a;
                     const id = caches.hashToId.get(hash);
                     if (id) {
                         const cached = caches.dataById[id];
-                        if ((_a = cached === null || cached === void 0 ? void 0 : cached.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey) {
-                            res[hash] = { exchangeData: cached.exchangeData, exchangeKey: cached.decrypted.exchangeKey };
+                        if (cached === null || cached === void 0 ? void 0 : cached.decrypted) {
+                            res[hash] = {
+                                exchangeData: cached.exchangeData,
+                                exchangeKey: cached.decrypted.exchangeKey,
+                                accessControlSecret: cached.decrypted.accessControlSecret,
+                            };
                         }
                     }
                     return res;
@@ -207,12 +210,16 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
         });
     }
     getDecryptionDataKeyById(id, entityType, entitySecretForeignKeys, retrieveIfNotCached) {
-        var _a;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             const caches = yield this.caches;
             const cachedData = caches.dataById[id];
             if (cachedData) {
-                return { exchangeData: cachedData.exchangeData, exchangeKey: (_a = cachedData.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey };
+                return {
+                    exchangeData: cachedData.exchangeData,
+                    exchangeKey: (_a = cachedData.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey,
+                    accessControlSecret: (_b = cachedData.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret,
+                };
             }
             else if (retrieveIfNotCached) {
                 const data = yield this.base.getExchangeDataById(id);
@@ -220,7 +227,7 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
                     throw new Error(`Could not find exchange data with id ${id}`);
                 const decrypted = yield this.decryptData(data);
                 this.cacheData(data, decrypted, entityType, entitySecretForeignKeys);
-                return { exchangeData: data, exchangeKey: decrypted === null || decrypted === void 0 ? void 0 : decrypted.exchangeKey };
+                return { exchangeData: data, exchangeKey: decrypted === null || decrypted === void 0 ? void 0 : decrypted.exchangeKey, accessControlSecret: decrypted === null || decrypted === void 0 ? void 0 : decrypted.accessControlSecret };
             }
             else
                 return undefined;
@@ -271,13 +278,7 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
             if (cached)
                 return cached;
             const accessControlSecrets = Object.values(caches.dataById).flatMap((x) => (x.decrypted ? [x.decrypted.accessControlSecret] : []));
-            const fullBuffer = new Uint8Array(accessControlSecrets.length * this.accessControlSecret.accessControlKeyLengthBytes);
-            for (let i = 0; i < accessControlSecrets.length; i++) {
-                const accessControlSecret = accessControlSecrets[i];
-                const key = yield this.accessControlSecret.accessControlKeyFor(accessControlSecret, entityType, undefined);
-                fullBuffer.set(new Uint8Array(key), i * this.accessControlSecret.accessControlKeyLengthBytes);
-            }
-            const fullData = (0, utils_2.ua2b64)(fullBuffer);
+            const fullData = yield this.accessControlSecret.getEncodedAccessControlKeys(accessControlSecrets, entityType);
             caches.entityTypeToAccessControlKeysValue[entityType] = fullData;
             return fullData;
         });
@@ -311,7 +312,6 @@ class LimitedLruCacheExchangeDataManager extends AbstractExchangeDataManager {
         });
     }
     getCachedDecryptionDataKeyByAccessControlHash(hashes, entityType, entitySecretForeignKeys) {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             const res = {};
             for (const hash of hashes) {
@@ -320,8 +320,12 @@ class LimitedLruCacheExchangeDataManager extends AbstractExchangeDataManager {
                     const retrieved = yield this.idToDataCache.get(dataId, () => {
                         throw new Error(`Data with id ${dataId} should have been already cached.`);
                     });
-                    if ((_a = retrieved === null || retrieved === void 0 ? void 0 : retrieved.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey) {
-                        res[hash] = { exchangeData: retrieved.exchangeData, exchangeKey: retrieved.decrypted.exchangeKey };
+                    if (retrieved.decrypted) {
+                        res[hash] = {
+                            exchangeData: retrieved.exchangeData,
+                            exchangeKey: retrieved.decrypted.exchangeKey,
+                            accessControlSecret: retrieved.decrypted.accessControlSecret,
+                        };
                     }
                 }
             }
@@ -345,7 +349,7 @@ class LimitedLruCacheExchangeDataManager extends AbstractExchangeDataManager {
         });
     }
     getDecryptionDataKeyById(id, entityType, entitySecretForeignKeys, retrieveIfNotCached) {
-        var _a;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             const cached = yield this.idToDataCache.getIfCachedJob(id);
             if (cached) {
@@ -364,7 +368,11 @@ class LimitedLruCacheExchangeDataManager extends AbstractExchangeDataManager {
                     }
                     return { item: toUpdate, onEviction: (b) => this.doOnEvictionJob(b, toUpdate) };
                 }), () => true);
-                return { exchangeData: updated.exchangeData, exchangeKey: (_a = updated.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey };
+                return {
+                    exchangeData: updated.exchangeData,
+                    exchangeKey: (_a = updated.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey,
+                    accessControlSecret: (_b = updated.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret,
+                };
             }
             else if (retrieveIfNotCached) {
                 return yield this.idToDataCache
@@ -383,7 +391,7 @@ class LimitedLruCacheExchangeDataManager extends AbstractExchangeDataManager {
                         }
                     }));
                 }))
-                    .then((x) => { var _a; return ({ exchangeData: x.exchangeData, exchangeKey: (_a = x.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey }); });
+                    .then((x) => { var _a, _b; return ({ exchangeData: x.exchangeData, exchangeKey: (_a = x.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey, accessControlSecret: (_b = x.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret }); });
             }
             else
                 return undefined;