@icure/api 8.0.0-RC.3 → 8.0.0-RC.4

package/icc-api/model/internal/RecoveryData.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @internal this entity is meant for internal use only
+ */
+export declare class RecoveryData {
+    constructor(json: JSON | any);
+    id?: string;
+    rev?: string;
+    /**
+     * Id of the data owner that this recovery data is meant for
+     */
+    recipient: string;
+    /**
+     * Encrypted recovery data. The structure of the decrypted data depends on the [type] of the recovery data.
+     */
+    encryptedSelf: string;
+    /**
+     * Type of the recovery data.
+     */
+    type: RecoveryData.Type;
+    /**
+     * Timestamp (unix epoch in ms) at which this recovery data will expire. If null, this recovery data will never
+     * expire. Negative values or zero mean the data is already expired.
+     */
+    expirationInstant?: number;
+    /**
+     * hard delete (unix epoch in ms) timestamp of the object. Filled automatically when the delete method is called.
+     */
+    deletionDate?: number;
+}
+export declare namespace RecoveryData {
+    /**
+     * Represents possible types of recovery data.
+     */
+    enum Type {
+        /**
+         * This recovery data is meant to be used to recover a keypair of the recipient. This could be for making a key
+         * available on another device, or for recovering a keypair that has been fully lost.
+         */
+        KEYPAIR_RECOVERY = "KEYPAIR_RECOVERY",
+        /**
+         * This recovery data is meant to be used to recover an exchange key of the recipient. The main purpose of this
+         * is to allow data owners to share data with other data owners that do not have created a keypair yet, but it
+         * can also be used as part of the give-access-back recovery mechanism.
+         */
+        EXCHANGE_KEY_RECOVERY = "EXCHANGE_KEY_RECOVERY"
+    }
+}

package/icc-api/model/internal/RecoveryData.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecoveryData = void 0;
+/**
+ * @internal this entity is meant for internal use only
+ */
+class RecoveryData {
+    constructor(json) {
+        if (!json.recipient || !json.encryptedSelf || !json.type)
+            throw new Error(`Recovery data json is missing required properties.\n${JSON.stringify(json)}`);
+        Object.assign(this, json);
+    }
+}
+exports.RecoveryData = RecoveryData;
+(function (RecoveryData) {
+    /**
+     * Represents possible types of recovery data.
+     */
+    let Type;
+    (function (Type) {
+        /**
+         * This recovery data is meant to be used to recover a keypair of the recipient. This could be for making a key
+         * available on another device, or for recovering a keypair that has been fully lost.
+         */
+        Type["KEYPAIR_RECOVERY"] = "KEYPAIR_RECOVERY";
+        /**
+         * This recovery data is meant to be used to recover an exchange key of the recipient. The main purpose of this
+         * is to allow data owners to share data with other data owners that do not have created a keypair yet, but it
+         * can also be used as part of the give-access-back recovery mechanism.
+         */
+        Type["EXCHANGE_KEY_RECOVERY"] = "EXCHANGE_KEY_RECOVERY";
+    })(Type = RecoveryData.Type || (RecoveryData.Type = {}));
+})(RecoveryData = exports.RecoveryData || (exports.RecoveryData = {}));
+//# sourceMappingURL=RecoveryData.js.map

package/icc-api/model/internal/RecoveryData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecoveryData.js","sourceRoot":"","sources":["../../../../icc-api/model/internal/RecoveryData.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,MAAa,YAAY;IACvB,YAAY,IAAgB;QAC1B,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI;YACtD,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChG,MAAM,CAAC,MAAM,CAAC,IAAoB,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC;CAyBF;AA9BD,oCA8BC;AACD,WAAiB,YAAY;IAC3B;;OAEG;IACH,IAAY,IAYX;IAZD,WAAY,IAAI;QACd;;;WAGG;QACH,6CAAqC,CAAA;QACrC;;;;WAIG;QACH,uDAA+C,CAAA;IACjD,CAAC,EAZW,IAAI,GAAJ,iBAAI,KAAJ,iBAAI,QAYf;AACH,CAAC,EAjBgB,YAAY,GAAZ,oBAAY,KAAZ,oBAAY,QAiB5B","sourcesContent":["/**\n * @internal this entity is meant for internal use only\n */\nexport class RecoveryData {\n  constructor(json: JSON | any) {\n    if (!json.recipient || !json.encryptedSelf || !json.type)\n      throw new Error(`Recovery data json is missing required properties.\\n${JSON.stringify(json)}`)\n    Object.assign(this as RecoveryData, json)\n  }\n\n  id?: string\n  rev?: string\n  /**\n   * Id of the data owner that this recovery data is meant for\n   */\n  recipient!: string\n  /**\n   * Encrypted recovery data. The structure of the decrypted data depends on the [type] of the recovery data.\n   */\n  encryptedSelf!: string\n  /**\n   * Type of the recovery data.\n   */\n  type!: RecoveryData.Type\n  /**\n   * Timestamp (unix epoch in ms) at which this recovery data will expire. If null, this recovery data will never\n   * expire. Negative values or zero mean the data is already expired.\n   */\n  expirationInstant?: number\n  /**\n   * hard delete (unix epoch in ms) timestamp of the object. Filled automatically when the delete method is called.\n   */\n  deletionDate?: number\n}\nexport namespace RecoveryData {\n  /**\n   * Represents possible types of recovery data.\n   */\n  export enum Type {\n    /**\n     * This recovery data is meant to be used to recover a keypair of the recipient. This could be for making a key\n     * available on another device, or for recovering a keypair that has been fully lost.\n     */\n    KEYPAIR_RECOVERY = 'KEYPAIR_RECOVERY',\n    /**\n     * This recovery data is meant to be used to recover an exchange key of the recipient. The main purpose of this\n     * is to allow data owners to share data with other data owners that do not have created a keypair yet, but it\n     * can also be used as part of the give-access-back recovery mechanism.\n     */\n    EXCHANGE_KEY_RECOVERY = 'EXCHANGE_KEY_RECOVERY',\n  }\n}\n"]}

package/icc-x-api/auth/JwtBridgedAuthService.d.ts

@@ -20,6 +20,7 @@ export declare class JwtBridgedAuthService implements AuthService {
         token: string;
         refreshToken: string;
     } | undefined>;
+    getJWT(): Promise<string | undefined>;
     getAuthHeaders(): Promise<Array<Header>>;
     private _refreshAuthJwt;
     private _loginAndGetTokens;

package/icc-x-api/auth/JwtBridgedAuthService.js

@@ -32,7 +32,7 @@ class JwtBridgedAuthService {
     getIcureTokens() {
         return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt, refreshToken: refreshJwt })));
     }
-    getAuthHeaders() {
+    getJWT() {
         return __awaiter(this, void 0, void 0, function* () {
             return this._currentPromise
                 .then(({ authJwt, refreshJwt }) => {
@@ -52,8 +52,15 @@ class JwtBridgedAuthService {
                     throw this._error;
                 }
                 return this._currentPromise;
-            })
-                .then(({ authJwt }) => {
+            }).then(({ authJwt }) => {
+                return authJwt;
+            });
+        });
+    }
+    getAuthHeaders() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.getJWT()
+                .then((authJwt) => {
                 return [new XHR_1.XHR.Header('Authorization', `Bearer ${authJwt}`)];
             });
         });

package/icc-x-api/auth/JwtBridgedAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtBridgedAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtBridgedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B;;GAEG;AACH,MAAa,qBAAqB;IAIhC,YACU,OAAmB,EACnB,QAAgB,EAChB,QAAgB,EAChB,mBAAqD,EAAE;QAHvD,YAAO,GAAP,OAAO,CAAY;QACnB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,qBAAgB,GAAhB,gBAAgB,CAAuC;QAPzD,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAO9F,CAAC;IAEJ,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAiB,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAQ,EAAE,YAAY,EAAE,UAAW,EAAE,CAAC,CAAC,CAAC,CAAA;IACnJ,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE;oBACpD,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;gBAC1D,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,IAAI,YAAgD,CAAA;YACpD,IAAI,UAAgC,CAAA;YACpC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI;oBACF,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,IAAI,mCAAgB,CAAC;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CACH,CAAA;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,UAAU,GAAG,CAAa,CAAA;iBAC3B;aACF;YACD,IAAI,CAAC,YAAY,EAAE;gBACjB,YAAY,GAAG,MAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAiC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE;oBACpI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAA;oBACtB,OAAO,CACL,IAAI,aAAJ,IAAI,cAAJ,IAAI,GACJ,CAAC,KAAK;wBACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;4BACnE,IAAI,CAAC,UAAU,EAAE;gCACf,UAAU,GAAG,CAAa,CAAA;6BAC3B;4BACD,OAAO,OAAO,CAAC,OAAO,EAAwB,CAAA;wBAChD,CAAC,CAAC;wBACJ,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;gBACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAiD,CAAC,CAAA;aACrE;YAED,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,UAAU;oBAAE,MAAM,UAAU,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;aAC5E;YAED,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAA;QACH,CAAC;KAAA;IAEO,sBAAsB,CAAC,GAAW;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAzHD,sDAyHC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\n/**\n * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired\n */\nexport class JwtBridgedAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(\n    private authApi: IccAuthApi,\n    private username: string,\n    private password: string,\n    private thirdPartyTokens: { [thirdParty: string]: string } = {}\n  ) {}\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x.refreshJwt as any)\n  }\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtInvalidOrExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then(({ authJwt }) => {\n        return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtInvalidOrExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    let authResponse: AuthenticationResponse | undefined\n    let firstError: XHRError | undefined\n    if (this.username && this.password) {\n      try {\n        authResponse = await this.authApi.login(\n          new LoginCredentials({\n            username: this.username,\n            password: this.password,\n          })\n        )\n      } catch (e) {\n        firstError = e as XHRError\n      }\n    }\n    if (!authResponse) {\n      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {\n        const prev = await acc\n        return (\n          prev ??\n          (token\n            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {\n                if (!firstError) {\n                  firstError = e as XHRError\n                }\n                return Promise.resolve() as Promise<undefined>\n              })\n            : undefined)\n        )\n      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)\n    }\n\n    if (!authResponse) {\n      if (firstError) throw firstError\n      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())\n    }\n\n    return {\n      authJwt: authResponse.token,\n      refreshJwt: authResponse.refreshToken,\n    }\n  }\n\n  private _isJwtInvalidOrExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return true\n    }\n    const payload = this._base64Decode(parts[1])\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}
+{"version":3,"file":"JwtBridgedAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtBridgedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B;;GAEG;AACH,MAAa,qBAAqB;IAIhC,YACU,OAAmB,EACnB,QAAgB,EAChB,QAAgB,EAChB,mBAAqD,EAAE;QAHvD,YAAO,GAAP,OAAO,CAAY;QACnB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,qBAAgB,GAAhB,gBAAgB,CAAuC;QAPzD,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAO9F,CAAC;IAEJ,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAiB,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAQ,EAAE,YAAY,EAAE,UAAW,EAAE,CAAC,CAAC,CAAC,CAAA;IACnJ,CAAC;IAEK,MAAM;;YACV,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE;oBACpD,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAC,OAAO,EAAC,EAAE,EAAE;gBACpB,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE;iBACjB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;gBAC1D,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,IAAI,YAAgD,CAAA;YACpD,IAAI,UAAgC,CAAA;YACpC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI;oBACF,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,IAAI,mCAAgB,CAAC;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CACH,CAAA;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,UAAU,GAAG,CAAa,CAAA;iBAC3B;aACF;YACD,IAAI,CAAC,YAAY,EAAE;gBACjB,YAAY,GAAG,MAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAiC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE;oBACpI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAA;oBACtB,OAAO,CACL,IAAI,aAAJ,IAAI,cAAJ,IAAI,GACJ,CAAC,KAAK;wBACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;4BACnE,IAAI,CAAC,UAAU,EAAE;gCACf,UAAU,GAAG,CAAa,CAAA;6BAC3B;4BACD,OAAO,OAAO,CAAC,OAAO,EAAwB,CAAA;wBAChD,CAAC,CAAC;wBACJ,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;gBACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAiD,CAAC,CAAA;aACrE;YAED,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,UAAU;oBAAE,MAAM,UAAU,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;aAC5E;YAED,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAA;QACH,CAAC;KAAA;IAEO,sBAAsB,CAAC,GAAW;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AA/HD,sDA+HC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\n/**\n * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired\n */\nexport class JwtBridgedAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(\n    private authApi: IccAuthApi,\n    private username: string,\n    private password: string,\n    private thirdPartyTokens: { [thirdParty: string]: string } = {}\n  ) {}\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x.refreshJwt as any)\n  }\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))\n  }\n\n  async getJWT(): Promise<string | undefined> {\n    return this._currentPromise\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtInvalidOrExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      }).then(({authJwt}) => {\n        return authJwt\n      })\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this.getJWT()\n      .then((authJwt) => {\n        return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtInvalidOrExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    let authResponse: AuthenticationResponse | undefined\n    let firstError: XHRError | undefined\n    if (this.username && this.password) {\n      try {\n        authResponse = await this.authApi.login(\n          new LoginCredentials({\n            username: this.username,\n            password: this.password,\n          })\n        )\n      } catch (e) {\n        firstError = e as XHRError\n      }\n    }\n    if (!authResponse) {\n      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {\n        const prev = await acc\n        return (\n          prev ??\n          (token\n            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {\n                if (!firstError) {\n                  firstError = e as XHRError\n                }\n                return Promise.resolve() as Promise<undefined>\n              })\n            : undefined)\n        )\n      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)\n    }\n\n    if (!authResponse) {\n      if (firstError) throw firstError\n      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())\n    }\n\n    return {\n      authJwt: authResponse.token,\n      refreshJwt: authResponse.refreshToken,\n    }\n  }\n\n  private _isJwtInvalidOrExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return true\n    }\n    const payload = this._base64Decode(parts[1])\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/icc-x-api/crypto/BaseExchangeDataManager.d.ts

@@ -1,7 +1,7 @@
 import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
 import { KeyPair } from './RSA';
 import { ExchangeData } from '../../icc-api/model/internal/ExchangeData';
-import { IccExchangeDataApi } from '../../icc-api/api/IccExchangeDataApi';
+import { IccExchangeDataApi } from '../../icc-api/api/internal/IccExchangeDataApi';
 import { CryptoPrimitives } from './CryptoPrimitives';
 /**
  * @internal this class is intended for internal use only and may be modified without notice
@@ -35,27 +35,27 @@ export declare class BaseExchangeDataManager {
      * @return the exchange data with the provided id or undefined if no exchange data with such id could be found.
      */
     getExchangeDataById(exchangeDataId: string): Promise<ExchangeData | undefined>;
-    /**
-     * Filters exchange data returning only the instances that could be verified using their signature and the provided verification
-     * keys.
-     * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)
-     * will always be unverified.
-     * @param exchangeData the exchange data to verify.
-     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
-     * @return the exchange data which could be verified given his signature and the available verification keys.
-     * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.
-     */
-    filterVerifiedExchangeData(exchangeData: ExchangeData[], getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>): Promise<ExchangeData[]>;
     /**
      * Verifies the authenticity of the exchange data by checking the signature.
      * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)
      * will always be unverified.
-     * @param exchangeData the exchange data to verify.
+     * @param data collects the following information about the exchange data being verified:
+     * - exchangeData the exchange data to verify.
+     * - decryptedAccessControlSecret the access control secret decrypted from the exchange data.
+     * - decryptedExchangeKey the exchange key decrypted from the exchange data.
+     * - decryptedSharedSignatureKey the shared signature key decrypted from the exchange data.
      * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
+     * @param verifyAsDelegator if true the method will also verify that the hmac key used for the signature was created by the delegator of the
+     * exchange data. If true and the data was not created by the current data owner this method will return false.
      * @return the exchange data which could be verified given his signature and the available verification keys.
      * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.
      */
-    verifyExchangeData(exchangeData: ExchangeData, getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>): Promise<boolean>;
+    verifyExchangeData(data: {
+        exchangeData: ExchangeData;
+        decryptedAccessControlSecret: string;
+        decryptedExchangeKey: CryptoKey;
+        decryptedSharedSignatureKey: CryptoKey;
+    }, getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>, verifyAsDelegator: boolean): Promise<boolean>;
     /**
      * Extracts and decrypts the access control secret from the provided exchange data.
      * These need to be hashed together with the entity class and confidentiality level in order to get the actual access control key
@@ -86,6 +86,20 @@ export declare class BaseExchangeDataManager {
         successfulDecryptions: CryptoKey[];
         failedDecryptions: ExchangeData[];
     }>;
+    /**
+     * Extract and decrypts the shared signature key from the provided exchange data.
+     * @param exchangeData the exchange data from which to extract exchange keys.
+     * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.
+     * @return an object composed of:
+     * - successfulDecryptions: array containing the successfully decrypted exchange keys.
+     * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).
+     */
+    tryDecryptSharedSignatureKeys(exchangeData: ExchangeData[], decryptionKeys: {
+        [publicKeyFingerprint: string]: KeyPair<CryptoKey>;
+    }): Promise<{
+        successfulDecryptions: CryptoKey[];
+        failedDecryptions: ExchangeData[];
+    }>;
     private tryDecryptExchangeData;
     private tryDecrypt;
     /**
@@ -113,15 +127,9 @@ export declare class BaseExchangeDataManager {
      * where one of the data owners involved in the exchange data has lost one of his keys.
      * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.
      * This method assumes that the new encryption keys have been verified.
-     * If the current data owner is also the delegator of the provided exchange data and at least one of the verification keys can be used to
-     * validate the current exchange data then the signature will be updated using the signature keys.
-     * Instead, if the current data owner is not the delegator of the provided exchange data, or the exchange data could not be verified using
-     * the provided verification keys then the updated exchange data will become unverified, and won't ever be verifiable again.
      * @param exchangeData exchange data to update.
      * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.
-     * @param signatureKeys keys to use for the new signature of the updated exchange data.
      * @param newEncryptionKeys new keys to add to the exchange data.
-     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
      * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not
      * be decrypted and the exchange data could not be updated.
      */
@@ -129,18 +137,22 @@ export declare class BaseExchangeDataManager {
         [publicKeyFingerprint: string]: KeyPair<CryptoKey>;
     }, newEncryptionKeys: {
         [keyPairFingerprint: string]: CryptoKey;
-    }, signatureKeys: {
-        [keyPairFingerprint: string]: CryptoKey;
-    }, getVerificationKey: (publicKeyFingerprint: string) => Promise<CryptoKey | undefined>): Promise<{
+    }): Promise<{
         exchangeData: ExchangeData;
         exchangeKey: CryptoKey;
         accessControlSecret: string;
     } | undefined>;
-    private bytesToSign;
+    private bytesToSignForSharedSignature;
+    private bytesToSignForDelegatorSignature;
     private generateExchangeKey;
     private importExchangeKey;
+    private generateSharedSignatureKey;
+    private importSharedSignatureKey;
     private generateAccessControlSecret;
     private importAccessControlSecret;
     private encryptDataWithKeys;
-    private signDataWithKeys;
+    private signDataWithDelegatorKeys;
+    private verifyDelegatorSignature;
+    private signDataWithSharedKey;
+    private verifyDataWithSharedKey;
 }

package/icc-x-api/crypto/BaseExchangeDataManager.js

@@ -78,47 +78,41 @@ class BaseExchangeDataManager {
             });
         });
     }
-    /**
-     * Filters exchange data returning only the instances that could be verified using their signature and the provided verification
-     * keys.
-     * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)
-     * will always be unverified.
-     * @param exchangeData the exchange data to verify.
-     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
-     * @return the exchange data which could be verified given his signature and the available verification keys.
-     * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.
-     */
-    filterVerifiedExchangeData(exchangeData, getVerificationKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const verified = [];
-            for (const ed of exchangeData) {
-                if (yield this.verifyExchangeData(ed, (x) => getVerificationKey(x)))
-                    verified.push(ed);
-            }
-            return verified;
-        });
-    }
     /**
      * Verifies the authenticity of the exchange data by checking the signature.
      * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)
      * will always be unverified.
-     * @param exchangeData the exchange data to verify.
+     * @param data collects the following information about the exchange data being verified:
+     * - exchangeData the exchange data to verify.
+     * - decryptedAccessControlSecret the access control secret decrypted from the exchange data.
+     * - decryptedExchangeKey the exchange key decrypted from the exchange data.
+     * - decryptedSharedSignatureKey the shared signature key decrypted from the exchange data.
      * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
+     * @param verifyAsDelegator if true the method will also verify that the hmac key used for the signature was created by the delegator of the
+     * exchange data. If true and the data was not created by the current data owner this method will return false.
      * @return the exchange data which could be verified given his signature and the available verification keys.
      * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.
      */
-    verifyExchangeData(exchangeData, getVerificationKey) {
+    verifyExchangeData(data, getVerificationKey, verifyAsDelegator) {
         return __awaiter(this, void 0, void 0, function* () {
-            const dataOwnerId = yield this.dataOwnerApi.getCurrentDataOwnerId();
-            if (exchangeData.delegator !== dataOwnerId)
+            if (verifyAsDelegator && data.exchangeData.delegator !== (yield this.dataOwnerApi.getCurrentDataOwnerId()))
                 return false;
-            const signatureData = yield this.bytesToSign(exchangeData);
-            for (const [fp, signature] of Object.entries(exchangeData.signature)) {
-                const verificationKey = yield getVerificationKey(fp.slice(-32));
-                if (verificationKey && (yield this.primitives.RSA.verifySignature(verificationKey, (0, utils_1.b64_2ua)(signature), signatureData)))
-                    return true;
-            }
-            return false;
+            if (verifyAsDelegator && !(yield this.verifyDelegatorSignature(data.exchangeData, data.decryptedSharedSignatureKey, getVerificationKey)))
+                return false;
+            const sharedSignatureData = yield this.bytesToSignForSharedSignature({
+                decryptedAccessControlSecret: data.decryptedAccessControlSecret,
+                decryptedExchangeKey: data.decryptedExchangeKey,
+                delegator: data.exchangeData.delegator,
+                delegate: data.exchangeData.delegate,
+                publicKeysFingerprintsV2: [
+                    ...new Set([
+                        ...Object.keys(data.exchangeData.exchangeKey),
+                        ...Object.keys(data.exchangeData.accessControlSecret),
+                        ...Object.keys(data.exchangeData.sharedSignatureKey),
+                    ]),
+                ],
+            });
+            return yield this.verifyDataWithSharedKey(sharedSignatureData, data.decryptedSharedSignatureKey, data.exchangeData.sharedSignature);
         });
     }
     /**
@@ -149,6 +143,19 @@ class BaseExchangeDataManager {
             return yield this.tryDecryptExchangeData(exchangeData, decryptionKeys, (ed) => ed.exchangeKey, (d) => this.importExchangeKey(new Uint8Array(d)));
         });
     }
+    /**
+     * Extract and decrypts the shared signature key from the provided exchange data.
+     * @param exchangeData the exchange data from which to extract exchange keys.
+     * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.
+     * @return an object composed of:
+     * - successfulDecryptions: array containing the successfully decrypted exchange keys.
+     * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).
+     */
+    tryDecryptSharedSignatureKeys(exchangeData, decryptionKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.tryDecryptExchangeData(exchangeData, decryptionKeys, (ed) => ed.sharedSignatureKey, (d) => this.importSharedSignatureKey(new Uint8Array(d)));
+        });
+    }
     tryDecryptExchangeData(exchangeData, decryptionKeys, encryptedDataSelector, unmarshalDecrypted) {
         return __awaiter(this, void 0, void 0, function* () {
             const successfulDecryptions = [];
@@ -180,7 +187,7 @@ class BaseExchangeDataManager {
                 try {
                     const key = (_a = decryptionKeysWithV2Fp[fp]) === null || _a === void 0 ? void 0 : _a.privateKey;
                     if (key)
-                        return (0, utils_1.hex2ua)((0, utils_1.ua2utf8)(yield this.primitives.RSA.decrypt(key, (0, utils_1.b64_2ua)(encrypted))));
+                        return yield this.primitives.RSA.decrypt(key, (0, utils_1.b64_2ua)(encrypted));
                 }
                 catch (e) {
                     // Try with another key
@@ -205,17 +212,29 @@ class BaseExchangeDataManager {
             }
             const exchangeKey = yield this.generateExchangeKey();
             const accessControlSecret = yield this.generateAccessControlSecret();
+            const sharedSignatureKey = yield this.generateSharedSignatureKey();
             const encryptedExchangeKey = yield this.encryptDataWithKeys(exchangeKey.rawBytes, encryptionKeys);
             const encryptedAccessControlSecret = yield this.encryptDataWithKeys(accessControlSecret.rawBytes, encryptionKeys);
+            const encryptedSharedSignatureKey = yield this.encryptDataWithKeys(sharedSignatureKey.rawBytes, encryptionKeys);
             const baseExchangeData = {
                 id: (_a = optionalAttributes.id) !== null && _a !== void 0 ? _a : this.primitives.randomUuid(),
                 delegator: yield this.dataOwnerApi.getCurrentDataOwnerId(),
                 delegate: delegateId,
                 exchangeKey: encryptedExchangeKey,
                 accessControlSecret: encryptedAccessControlSecret,
+                sharedSignatureKey: encryptedSharedSignatureKey,
             };
-            const signature = yield this.signDataWithKeys(yield this.bytesToSign(baseExchangeData), signatureKeys);
-            const exchangeData = new ExchangeData_1.ExchangeData(Object.assign(Object.assign({}, baseExchangeData), { signature }));
+            const sharedSignature = yield this.signDataWithSharedKey(yield this.bytesToSignForSharedSignature({
+                delegate: baseExchangeData.delegate,
+                delegator: baseExchangeData.delegator,
+                decryptedAccessControlSecret: accessControlSecret.secret,
+                decryptedExchangeKey: exchangeKey.key,
+                publicKeysFingerprintsV2: Object.keys(encryptionKeys).map(utils_2.fingerprintV1toV2),
+            }), sharedSignatureKey.key);
+            const delegatorSignature = yield this.signDataWithDelegatorKeys(yield this.bytesToSignForDelegatorSignature({
+                sharedSignatureKey: sharedSignatureKey.key,
+            }), signatureKeys);
+            const exchangeData = new ExchangeData_1.ExchangeData(Object.assign(Object.assign({}, baseExchangeData), { delegatorSignature, sharedSignature }));
             return {
                 exchangeData: yield this.api.createExchangeData(exchangeData),
                 exchangeKey: exchangeKey.key,
@@ -228,67 +247,73 @@ class BaseExchangeDataManager {
      * where one of the data owners involved in the exchange data has lost one of his keys.
      * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.
      * This method assumes that the new encryption keys have been verified.
-     * If the current data owner is also the delegator of the provided exchange data and at least one of the verification keys can be used to
-     * validate the current exchange data then the signature will be updated using the signature keys.
-     * Instead, if the current data owner is not the delegator of the provided exchange data, or the exchange data could not be verified using
-     * the provided verification keys then the updated exchange data will become unverified, and won't ever be verifiable again.
      * @param exchangeData exchange data to update.
      * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.
-     * @param signatureKeys keys to use for the new signature of the updated exchange data.
      * @param newEncryptionKeys new keys to add to the exchange data.
-     * @param getVerificationKey function to retrieve keys to use for verification by fingerprint.
      * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not
      * be decrypted and the exchange data could not be updated.
      */
-    tryUpdateExchangeData(exchangeData, decryptionKeys, newEncryptionKeys, signatureKeys, getVerificationKey) {
+    tryUpdateExchangeData(exchangeData, decryptionKeys, newEncryptionKeys) {
         return __awaiter(this, void 0, void 0, function* () {
             const dataOwnerId = yield this.dataOwnerApi.getCurrentDataOwnerId();
             const rawExchangeKey = yield this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys);
             const rawAccessControlSecret = yield this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys);
-            if (!rawExchangeKey || !rawAccessControlSecret)
+            const rawSharedSignatureKey = yield this.tryDecrypt(exchangeData.sharedSignatureKey, decryptionKeys);
+            if (!rawExchangeKey || !rawAccessControlSecret || !rawSharedSignatureKey)
                 return undefined;
             const exchangeKey = yield this.importExchangeKey(new Uint8Array(rawExchangeKey));
             const accessControlSecret = yield this.importAccessControlSecret(new Uint8Array(rawAccessControlSecret));
+            const sharedSignatureKey = yield this.importSharedSignatureKey(new Uint8Array(rawSharedSignatureKey));
             const existingExchangeKeyEntries = new Set(Object.keys(exchangeData.exchangeKey));
             const existingAcsEntries = new Set(Object.keys(exchangeData.accessControlSecret));
-            const missingEntries = Object.keys(newEncryptionKeys).filter((fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp));
+            const existingSharedSignatureKeyEntries = new Set(Object.keys(exchangeData.sharedSignatureKey));
+            const missingEntries = Object.keys(newEncryptionKeys).filter((fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp) || !existingSharedSignatureKeyEntries.has(fp));
             if (!missingEntries.length)
                 return { exchangeData, exchangeKey, accessControlSecret };
             const encryptionKeysForMissingEntries = missingEntries.reduce((obj, fp) => {
                 obj[fp] = newEncryptionKeys[fp];
                 return obj;
             }, {});
-            const isVerified = exchangeData.delegator == dataOwnerId && (yield this.verifyExchangeData(exchangeData, (fp) => getVerificationKey(fp)));
             const updatedExchangeData = _.cloneDeep(exchangeData);
             updatedExchangeData.exchangeKey = Object.assign(Object.assign({}, exchangeData.exchangeKey), (yield this.encryptDataWithKeys(rawExchangeKey, encryptionKeysForMissingEntries)));
             updatedExchangeData.accessControlSecret = Object.assign(Object.assign({}, exchangeData.accessControlSecret), (yield this.encryptDataWithKeys(rawAccessControlSecret, encryptionKeysForMissingEntries)));
+            updatedExchangeData.sharedSignatureKey = Object.assign(Object.assign({}, exchangeData.sharedSignatureKey), (yield this.encryptDataWithKeys(rawSharedSignatureKey, encryptionKeysForMissingEntries)));
+            const isVerified = yield this.verifyExchangeData({
+                exchangeData,
+                decryptedAccessControlSecret: accessControlSecret,
+                decryptedExchangeKey: exchangeKey,
+                decryptedSharedSignatureKey: sharedSignatureKey,
+            }, () => Promise.resolve(undefined), false);
             if (isVerified) {
-                const newDataToSign = yield this.bytesToSign(updatedExchangeData);
-                updatedExchangeData.signature = yield this.signDataWithKeys(newDataToSign, signatureKeys);
+                updatedExchangeData.sharedSignature = yield this.signDataWithSharedKey(yield this.bytesToSignForSharedSignature({
+                    delegate: updatedExchangeData.delegate,
+                    delegator: updatedExchangeData.delegator,
+                    decryptedAccessControlSecret: accessControlSecret,
+                    decryptedExchangeKey: exchangeKey,
+                    publicKeysFingerprintsV2: Object.keys(updatedExchangeData.exchangeKey),
+                }), sharedSignatureKey);
             }
             return { exchangeData: yield this.api.modifyExchangeData(new ExchangeData_1.ExchangeData(updatedExchangeData)), exchangeKey, accessControlSecret };
         });
     }
-    // Gets a byte representation of the parts of exchange data which should be included in the signature.
-    // Equivalent json representations of the exchange data should provide the same bytes (even if the order of entries
-    // is different).
-    bytesToSign(exchangeData) {
+    bytesToSignForSharedSignature(data) {
         return __awaiter(this, void 0, void 0, function* () {
-            function sortObject(obj) {
-                return Object.keys(obj)
-                    .sort()
-                    .reduce((sorted, key) => {
-                    return [...sorted, [key, obj[key]]];
-                }, []);
-            }
+            // Use array of array to ensure that order is preserved regardless of how the specific js implementation orders
+            // the keys of an object
             const signObject = [
-                ['delegator', exchangeData.delegator],
-                ['delegate', exchangeData.delegate],
-                ['exchangeKey', sortObject(exchangeData.exchangeKey)],
-                ['accessControlSecret', sortObject(exchangeData.accessControlSecret)],
+                ['delegator', data.delegator],
+                ['delegate', data.delegate],
+                ['exchangeKey', (0, utils_1.ua2hex)(yield this.primitives.AES.exportKey(data.decryptedExchangeKey, 'raw'))],
+                ['accessControlSecret', data.decryptedAccessControlSecret],
+                ['publicKeysFingerprints', data.publicKeysFingerprintsV2.sort()],
             ];
             const signJson = JSON.stringify(signObject);
-            return this.primitives.sha256((0, utils_1.utf8_2ua)(signJson));
+            return (0, utils_1.utf8_2ua)(signJson);
+        });
+    }
+    bytesToSignForDelegatorSignature(data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.primitives.sha256(yield this.primitives.HMAC.exportKey(data.sharedSignatureKey));
         });
     }
     // Generates a new exchange key
@@ -306,6 +331,17 @@ class BaseExchangeDataManager {
             return yield this.primitives.AES.importKey('raw', decryptedBytes);
         });
     }
+    generateSharedSignatureKey() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const key = yield this.primitives.HMAC.generateKey();
+            return { key, rawBytes: yield this.primitives.HMAC.exportKey(key) };
+        });
+    }
+    importSharedSignatureKey(decryptedBytes) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.primitives.HMAC.importKey(decryptedBytes);
+        });
+    }
     // Generates a new access control secret
     generateAccessControlSecret() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -323,12 +359,12 @@ class BaseExchangeDataManager {
         return __awaiter(this, void 0, void 0, function* () {
             const res = {};
             for (const [fp, key] of Object.entries(keys)) {
-                res[(0, utils_2.fingerprintIsV1)(fp) ? (0, utils_2.fingerprintV1toV2)(fp) : fp] = (0, utils_1.ua2b64)(yield this.primitives.RSA.encrypt(key, (0, utils_1.utf8_2ua)((0, utils_1.ua2hex)(rawData))));
+                res[(0, utils_2.fingerprintIsV1)(fp) ? (0, utils_2.fingerprintV1toV2)(fp) : fp] = (0, utils_1.ua2b64)(yield this.primitives.RSA.encrypt(key, new Uint8Array(rawData)));
             }
             return res;
         });
     }
-    signDataWithKeys(rawData, keys) {
+    signDataWithDelegatorKeys(rawData, keys) {
         return __awaiter(this, void 0, void 0, function* () {
             const res = {};
             for (const [fp, key] of Object.entries(keys)) {
@@ -337,6 +373,29 @@ class BaseExchangeDataManager {
             return res;
         });
     }
+    verifyDelegatorSignature(exchangeData, decryptedSharedSignatureKey, getVerificationKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const delegatorSignatureData = yield this.bytesToSignForDelegatorSignature({
+                sharedSignatureKey: decryptedSharedSignatureKey,
+            });
+            for (const [fp, signature] of Object.entries(exchangeData.delegatorSignature)) {
+                const verificationKey = yield getVerificationKey(fp.slice(-32));
+                if (verificationKey && (yield this.primitives.RSA.verifySignature(verificationKey, (0, utils_1.b64_2ua)(signature), delegatorSignatureData)))
+                    return true;
+            }
+            return false;
+        });
+    }
+    signDataWithSharedKey(rawData, key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, utils_1.ua2b64)(yield this.primitives.HMAC.sign(key, new Uint8Array(rawData)));
+        });
+    }
+    verifyDataWithSharedKey(rawData, key, signature) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.primitives.HMAC.verify(key, new Uint8Array(rawData), (0, utils_1.b64_2ua)(signature));
+        });
+    }
 }
 exports.BaseExchangeDataManager = BaseExchangeDataManager;
 //# sourceMappingURL=BaseExchangeDataManager.js.map