@icure/api 8.0.0-RC.5 → 8.0.0

package/icc-x-api/crypto/RecoveryDataEncryption.js

@@ -0,0 +1,171 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecoveryDataEncryption = exports.RecoveryDataUseFailureReason = void 0;
+const RecoveryData_1 = require("../../icc-api/model/internal/RecoveryData");
+const utils_1 = require("../utils");
+const XHR_1 = require("../../icc-api/api/XHR");
+var XHRError = XHR_1.XHR.XHRError;
+var RecoveryDataUseFailureReason;
+(function (RecoveryDataUseFailureReason) {
+    /**
+     * The recovery data matching the provided recovery key does not exist. It could have been deleted, or it could have been expired.
+     */
+    RecoveryDataUseFailureReason["Missing"] = "MISSING";
+    /**
+     * The recovery data exists but it is not available to the current user. The user may have used a recovery key that he created while logged in as
+     * a different user.
+     */
+    RecoveryDataUseFailureReason["Unauthorized"] = "UNAUTHORIZED";
+    /**
+     * The recovery data exists and is available to the current user, but it is not of the expected type.
+     */
+    RecoveryDataUseFailureReason["InvalidType"] = "INVALID_TYPE";
+    /**
+     * The recovery data exists and is available to the current user, but its content could not be interpreted. The data may have been created
+     * with an unsupported SDK version.
+     */
+    RecoveryDataUseFailureReason["InvalidContent"] = "INVALID_CONTENT";
+})(RecoveryDataUseFailureReason = exports.RecoveryDataUseFailureReason || (exports.RecoveryDataUseFailureReason = {}));
+/**
+ * @internal this class is for internal use only and may change without notice.
+ */
+class RecoveryDataEncryption {
+    constructor(primitives, baseRecoveryApi) {
+        this.primitives = primitives;
+        this.baseRecoveryApi = baseRecoveryApi;
+    }
+    recoveryKeyToId(recoveryKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, utils_1.ua2hex)(yield this.primitives.sha256((0, utils_1.hex2ua)(recoveryKey)));
+        });
+    }
+    createAndSaveKeyPairsRecoveryDataFor(recipient, keyPairs, lifetimeSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const content = {};
+            for (const [delegateId, pairs] of Object.entries(keyPairs)) {
+                const entries = [];
+                for (const { pair, algorithm } of pairs) {
+                    entries.push({
+                        pair: {
+                            privateKey: (0, utils_1.ua2b64)(yield this.primitives.RSA.exportKey(pair.privateKey, 'pkcs8')),
+                            publicKey: (0, utils_1.ua2b64)(yield this.primitives.RSA.exportKey(pair.publicKey, 'spki')),
+                        },
+                        algorithm,
+                    });
+                }
+                content[delegateId] = entries;
+            }
+            return yield this.createRecoveryData(recipient, RecoveryData_1.RecoveryData.Type.KEYPAIR_RECOVERY, lifetimeSeconds, content);
+        });
+    }
+    getAndDecryptKeyPairsRecoveryData(recoveryKey, autoDeleteOnSuccess) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const getRecoveryDataResult = yield this.getRecoveryDataAndDecrypt(recoveryKey, RecoveryData_1.RecoveryData.Type.KEYPAIR_RECOVERY);
+            if ('failure' in getRecoveryDataResult) {
+                return getRecoveryDataResult;
+            }
+            else {
+                const recoveredKeysData = getRecoveryDataResult.decryptedJson;
+                const recoveredKeys = {};
+                for (const [delegateId, pairs] of Object.entries(recoveredKeysData)) {
+                    const delegateKeys = {};
+                    for (const { pair, algorithm } of pairs) {
+                        delegateKeys[(0, utils_1.ua2hex)((0, utils_1.b64_2ua)(pair.publicKey))] = {
+                            privateKey: yield this.primitives.RSA.importKey('pkcs8', (0, utils_1.b64_2ua)(pair.privateKey), ['decrypt'], algorithm),
+                            publicKey: yield this.primitives.RSA.importKey('spki', (0, utils_1.b64_2ua)(pair.publicKey), ['encrypt'], algorithm),
+                        };
+                    }
+                    recoveredKeys[delegateId] = delegateKeys;
+                }
+                if (autoDeleteOnSuccess) {
+                    yield this.baseRecoveryApi.deleteRecoveryData(yield this.recoveryKeyToId(recoveryKey)).catch((e) => {
+                        console.warn(`Failed to auto-delete recovery data, ignoring. ${e}`);
+                    });
+                }
+                return { success: recoveredKeys };
+            }
+        });
+    }
+    createAndSaveExchangeDataRecoveryData(recipient, exchangeDataInfo, lifetimeSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.createRecoveryData(recipient, RecoveryData_1.RecoveryData.Type.EXCHANGE_KEY_RECOVERY, lifetimeSeconds, exchangeDataInfo.map((x) => ({
+                exchangeDataId: x.exchangeDataId,
+                rawAccessControlSecret: (0, utils_1.ua2b64)(x.rawAccessControlSecret),
+                rawSharedSignatureKey: (0, utils_1.ua2b64)(x.rawSharedSignatureKey),
+                rawExchangeKey: (0, utils_1.ua2b64)(x.rawExchangeKey),
+            })));
+        });
+    }
+    getAndDecryptExchangeDataRecoveryData(recoveryKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const getRecoveryDataResult = yield this.getRecoveryDataAndDecrypt(recoveryKey, RecoveryData_1.RecoveryData.Type.EXCHANGE_KEY_RECOVERY);
+            if ('failure' in getRecoveryDataResult)
+                return getRecoveryDataResult;
+            return {
+                success: getRecoveryDataResult.decryptedJson.map((x) => ({
+                    exchangeDataId: x.exchangeDataId,
+                    rawAccessControlSecret: (0, utils_1.b64_2ua)(x.rawAccessControlSecret),
+                    rawSharedSignatureKey: (0, utils_1.b64_2ua)(x.rawSharedSignatureKey),
+                    rawExchangeKey: (0, utils_1.b64_2ua)(x.rawExchangeKey),
+                })),
+            };
+        });
+    }
+    getRecoveryDataAndDecrypt(recoveryKey, expectedType) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const id = yield this.recoveryKeyToId(recoveryKey);
+            const getResult = yield this.baseRecoveryApi.getRecoveryData(id).then((r) => ({ recoveryData: r }), (e) => {
+                if (e instanceof XHRError) {
+                    if (e.statusCode === 404) {
+                        return { failure: RecoveryDataUseFailureReason.Missing };
+                    }
+                    else if (e.statusCode === 403) {
+                        return { failure: RecoveryDataUseFailureReason.Unauthorized };
+                    }
+                }
+                throw e;
+            });
+            if ('failure' in getResult)
+                return getResult;
+            const { recoveryData } = getResult;
+            if (recoveryData.type !== expectedType)
+                return { failure: RecoveryDataUseFailureReason.InvalidType };
+            const decryptionKey = yield this.primitives.AES.importKey('raw', (0, utils_1.hex2ua)(recoveryKey));
+            const decryptionResult = yield this.primitives.AES.decrypt(decryptionKey, (0, utils_1.string2ua)((0, utils_1.a2b)(recoveryData.encryptedSelf)))
+                .then((d) => JSON.parse((0, utils_1.ua2utf8)(d)))
+                .then((r) => ({ success: r }), () => ({ failure: RecoveryDataUseFailureReason.InvalidContent }));
+            if ('failure' in decryptionResult)
+                return decryptionResult;
+            return { recoveryData, decryptedJson: decryptionResult.success };
+        });
+    }
+    createRecoveryData(recipient, type, lifetimeSeconds, content) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const recoveryKey = yield this.primitives.AES.generateCryptoKey(false);
+            const recoveryKeyHex = (0, utils_1.ua2hex)(yield this.primitives.AES.exportKey(recoveryKey, 'raw'));
+            const id = yield this.recoveryKeyToId(recoveryKeyHex);
+            const encryptedSelf = (0, utils_1.b2a)((0, utils_1.ua2string)(yield this.primitives.AES.encrypt(recoveryKey, (0, utils_1.utf8_2ua)(JSON.stringify(content)))));
+            const expirationInstant = lifetimeSeconds ? Date.now() + lifetimeSeconds * 1000 : undefined;
+            const data = new RecoveryData_1.RecoveryData({
+                id,
+                encryptedSelf,
+                expirationInstant,
+                recipient,
+                type,
+            });
+            yield this.baseRecoveryApi.createRecoveryData(data);
+            return recoveryKeyHex;
+        });
+    }
+}
+exports.RecoveryDataEncryption = RecoveryDataEncryption;
+//# sourceMappingURL=RecoveryDataEncryption.js.map

package/icc-x-api/crypto/RecoveryDataEncryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecoveryDataEncryption.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/RecoveryDataEncryption.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,4EAAwE;AACxE,oCAA6G;AAC7G,+CAA2C;AAC3C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAK9B,IAAY,4BAmBX;AAnBD,WAAY,4BAA4B;IACtC;;OAEG;IACH,mDAAmB,CAAA;IACnB;;;OAGG;IACH,6DAA6B,CAAA;IAC7B;;OAEG;IACH,4DAA4B,CAAA;IAC5B;;;OAGG;IACH,kEAAkC,CAAA;AACpC,CAAC,EAnBW,4BAA4B,GAA5B,oCAA4B,KAA5B,oCAA4B,QAmBvC;AAaD;;GAEG;AACH,MAAa,sBAAsB;IACjC,YAA6B,UAA4B,EAAmB,eAAmC;QAAlF,eAAU,GAAV,UAAU,CAAkB;QAAmB,oBAAe,GAAf,eAAe,CAAoB;IAAG,CAAC;IAE7G,eAAe,CAAC,WAAmB;;YACvC,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAA,cAAM,EAAC,WAAW,CAAC,CAAC,CAAC,CAAA;QAClE,CAAC;KAAA;IAEK,oCAAoC,CACxC,SAAiB,EACjB,QAAyF,EACzF,eAAmC;;YAEnC,MAAM,OAAO,GAA+B,EAAE,CAAA;YAC9C,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAC1D,MAAM,OAAO,GAAuD,EAAE,CAAA;gBACtE,KAAK,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE;oBACvC,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE;4BACJ,UAAU,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;4BACjF,SAAS,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;yBAC/E;wBACD,SAAS;qBACV,CAAC,CAAA;iBACH;gBACD,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAA;aAC9B;YACD,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,2BAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;QAC/G,CAAC;KAAA;IAEK,iCAAiC,CACrC,WAAmB,EACnB,mBAA4B;;YAE5B,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,2BAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YACnH,IAAI,SAAS,IAAI,qBAAqB,EAAE;gBACtC,OAAO,qBAAqB,CAAA;aAC7B;iBAAM;gBACL,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,aAA2C,CAAA;gBAC3F,MAAM,aAAa,GAA8E,EAAE,CAAA;gBACnG,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE;oBACnE,MAAM,YAAY,GAAoD,EAAE,CAAA;oBACxE,KAAK,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE;wBACvC,YAAY,CAAC,IAAA,cAAM,EAAC,IAAA,eAAO,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;4BAC9C,UAAU,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAA,eAAO,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;4BAC1G,SAAS,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,eAAO,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;yBACxG,CAAA;qBACF;oBACD,aAAa,CAAC,UAAU,CAAC,GAAG,YAAY,CAAA;iBACzC;gBACD,IAAI,mBAAmB,EAAE;oBACvB,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;wBACjG,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAA;oBACrE,CAAC,CAAC,CAAA;iBACH;gBACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;aAClC;QACH,CAAC;KAAA;IAEK,qCAAqC,CACzC,SAAiB,EACjB,gBAKG,EACH,eAAmC;;YAEnC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAClC,SAAS,EACT,2BAAY,CAAC,IAAI,CAAC,qBAAqB,EACvC,eAAe,EACf,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,sBAAsB,EAAE,IAAA,cAAM,EAAC,CAAC,CAAC,sBAAsB,CAAC;gBACxD,qBAAqB,EAAE,IAAA,cAAM,EAAC,CAAC,CAAC,qBAAqB,CAAC;gBACtD,cAAc,EAAE,IAAA,cAAM,EAAC,CAAC,CAAC,cAAc,CAAC;aACzC,CAAC,CAAC,CACJ,CAAA;QACH,CAAC;KAAA;IAEK,qCAAqC,CACzC,WAAmB;;YAKnB,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,2BAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;YACxH,IAAI,SAAS,IAAI,qBAAqB;gBAAE,OAAO,qBAAqB,CAAA;YACpE,OAAO;gBACL,OAAO,EAAG,qBAAqB,CAAC,aAAiD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC5F,cAAc,EAAE,CAAC,CAAC,cAAc;oBAChC,sBAAsB,EAAE,IAAA,eAAO,EAAC,CAAC,CAAC,sBAAsB,CAAC;oBACzD,qBAAqB,EAAE,IAAA,eAAO,EAAC,CAAC,CAAC,qBAAqB,CAAC;oBACvD,cAAc,EAAE,IAAA,eAAO,EAAC,CAAC,CAAC,cAAc,CAAC;iBAC1C,CAAC,CAAC;aACJ,CAAA;QACH,CAAC;KAAA;IAEK,yBAAyB,CAC7B,WAAmB,EACnB,YAA+B;;YAE/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;YAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,IAAI,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,EAC5B,CAAC,CAAC,EAAE,EAAE;gBACJ,IAAI,CAAC,YAAY,QAAQ,EAAE;oBACzB,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;wBACxB,OAAO,EAAE,OAAO,EAAE,4BAA4B,CAAC,OAAO,EAAE,CAAA;qBACzD;yBAAM,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;wBAC/B,OAAO,EAAE,OAAO,EAAE,4BAA4B,CAAC,YAAY,EAAE,CAAA;qBAC9D;iBACF;gBACD,MAAM,CAAC,CAAA;YACT,CAAC,CACF,CAAA;YACD,IAAI,SAAS,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAA;YAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAAA;YAClC,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,CAAC,WAAW,EAAE,CAAA;YACpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,WAAW,CAAC,CAAC,CAAA;YACrF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAA,iBAAS,EAAC,IAAA,WAAG,EAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC;iBAClH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,eAAO,EAAC,CAAC,CAAC,CAAC,CAAC;iBACnC,IAAI,CACH,CAAC,CAAC,EAAoC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EACzD,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,4BAA4B,CAAC,cAAc,EAAE,CAAC,CACjE,CAAA;YACH,IAAI,SAAS,IAAI,gBAAgB;gBAAE,OAAO,gBAAgB,CAAA;YAC1D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,OAAO,EAAE,CAAA;QAClE,CAAC;KAAA;IACK,kBAAkB,CACtB,SAAiB,EACjB,IAAuB,EACvB,eAAmC,EACnC,OAA4B;;YAE5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;YACtE,MAAM,cAAc,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;YACtF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAA;YACrD,MAAM,aAAa,GAAG,IAAA,WAAG,EAAC,IAAA,iBAAS,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACvH,MAAM,iBAAiB,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3F,MAAM,IAAI,GAAiB,IAAI,2BAAY,CAAC;gBAC1C,EAAE;gBACF,aAAa;gBACb,iBAAiB;gBACjB,SAAS;gBACT,IAAI;aACL,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA;YACnD,OAAO,cAAc,CAAA;QACvB,CAAC;KAAA;CACF;AAvJD,wDAuJC","sourcesContent":["import { KeyPair, ShaVersion } from './RSA'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { IccRecoveryDataApi } from '../../icc-api/api/internal/IccRecoveryDataApi'\nimport { IccExchangeDataApi } from '../../icc-api/api/internal/IccExchangeDataApi'\nimport { RecoveryData } from '../../icc-api/model/internal/RecoveryData'\nimport { a2b, b2a, b64_2ua, hex2ua, string2ua, ua2b64, ua2hex, ua2string, ua2utf8, utf8_2ua } from '../utils'\nimport { XHR } from '../../icc-api/api/XHR'\nimport XHRError = XHR.XHRError\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { KeyPairUpdateRequest } from '../maintenance/KeyPairUpdateRequest'\nimport { get } from 'lodash'\n\nexport enum RecoveryDataUseFailureReason {\n  /**\n   * The recovery data matching the provided recovery key does not exist. It could have been deleted, or it could have been expired.\n   */\n  Missing = 'MISSING',\n  /**\n   * The recovery data exists but it is not available to the current user. The user may have used a recovery key that he created while logged in as\n   * a different user.\n   */\n  Unauthorized = 'UNAUTHORIZED',\n  /**\n   * The recovery data exists and is available to the current user, but it is not of the expected type.\n   */\n  InvalidType = 'INVALID_TYPE',\n  /**\n   * The recovery data exists and is available to the current user, but its content could not be interpreted. The data may have been created\n   * with an unsupported SDK version.\n   */\n  InvalidContent = 'INVALID_CONTENT',\n}\n\n// accessControlSecret, sharedSignatureKey, and exchangeKey all raw bytes b64 encoded\ntype ExchangeDataRecoveryDataContent = {\n  exchangeDataId: string\n  rawAccessControlSecret: string\n  rawSharedSignatureKey: string\n  rawExchangeKey: string\n}[]\n// delegateId -> { pair: { privateKey: base64pkcs8, publicKey: base64spki }, algorithm: ShaVersion }[]\ntype KeyPairRecoveryDataContent = { [delegateId: string]: { pair: KeyPair<string>; algorithm: ShaVersion }[] }\ntype RecoveryDataContent = KeyPairRecoveryDataContent | ExchangeDataRecoveryDataContent\n\n/**\n * @internal this class is for internal use only and may change without notice.\n */\nexport class RecoveryDataEncryption {\n  constructor(private readonly primitives: CryptoPrimitives, private readonly baseRecoveryApi: IccRecoveryDataApi) {}\n\n  async recoveryKeyToId(recoveryKey: string): Promise<string> {\n    return ua2hex(await this.primitives.sha256(hex2ua(recoveryKey)))\n  }\n\n  async createAndSaveKeyPairsRecoveryDataFor(\n    recipient: string,\n    keyPairs: { [delegateId: string]: { pair: KeyPair<CryptoKey>; algorithm: ShaVersion }[] },\n    lifetimeSeconds: number | undefined\n  ): Promise<string> {\n    const content: KeyPairRecoveryDataContent = {}\n    for (const [delegateId, pairs] of Object.entries(keyPairs)) {\n      const entries: { pair: KeyPair<string>; algorithm: ShaVersion }[] = []\n      for (const { pair, algorithm } of pairs) {\n        entries.push({\n          pair: {\n            privateKey: ua2b64(await this.primitives.RSA.exportKey(pair.privateKey, 'pkcs8')),\n            publicKey: ua2b64(await this.primitives.RSA.exportKey(pair.publicKey, 'spki')),\n          },\n          algorithm,\n        })\n      }\n      content[delegateId] = entries\n    }\n    return await this.createRecoveryData(recipient, RecoveryData.Type.KEYPAIR_RECOVERY, lifetimeSeconds, content)\n  }\n\n  async getAndDecryptKeyPairsRecoveryData(\n    recoveryKey: string,\n    autoDeleteOnSuccess: boolean\n  ): Promise<{ success: { [dataOwnerId: string]: { [publicKeySpki: string]: KeyPair<CryptoKey> } } } | { failure: RecoveryDataUseFailureReason }> {\n    const getRecoveryDataResult = await this.getRecoveryDataAndDecrypt(recoveryKey, RecoveryData.Type.KEYPAIR_RECOVERY)\n    if ('failure' in getRecoveryDataResult) {\n      return getRecoveryDataResult\n    } else {\n      const recoveredKeysData = getRecoveryDataResult.decryptedJson as KeyPairRecoveryDataContent\n      const recoveredKeys: { [delegateId: string]: { [publicKeySpki: string]: KeyPair<CryptoKey> } } = {}\n      for (const [delegateId, pairs] of Object.entries(recoveredKeysData)) {\n        const delegateKeys: { [publicKeySpki: string]: KeyPair<CryptoKey> } = {}\n        for (const { pair, algorithm } of pairs) {\n          delegateKeys[ua2hex(b64_2ua(pair.publicKey))] = {\n            privateKey: await this.primitives.RSA.importKey('pkcs8', b64_2ua(pair.privateKey), ['decrypt'], algorithm),\n            publicKey: await this.primitives.RSA.importKey('spki', b64_2ua(pair.publicKey), ['encrypt'], algorithm),\n          }\n        }\n        recoveredKeys[delegateId] = delegateKeys\n      }\n      if (autoDeleteOnSuccess) {\n        await this.baseRecoveryApi.deleteRecoveryData(await this.recoveryKeyToId(recoveryKey)).catch((e) => {\n          console.warn(`Failed to auto-delete recovery data, ignoring. ${e}`)\n        })\n      }\n      return { success: recoveredKeys }\n    }\n  }\n\n  async createAndSaveExchangeDataRecoveryData(\n    recipient: string,\n    exchangeDataInfo: {\n      exchangeDataId: string\n      rawAccessControlSecret: ArrayBuffer\n      rawSharedSignatureKey: ArrayBuffer\n      rawExchangeKey: ArrayBuffer\n    }[],\n    lifetimeSeconds: number | undefined\n  ): Promise<string> {\n    return await this.createRecoveryData(\n      recipient,\n      RecoveryData.Type.EXCHANGE_KEY_RECOVERY,\n      lifetimeSeconds,\n      exchangeDataInfo.map((x) => ({\n        exchangeDataId: x.exchangeDataId,\n        rawAccessControlSecret: ua2b64(x.rawAccessControlSecret),\n        rawSharedSignatureKey: ua2b64(x.rawSharedSignatureKey),\n        rawExchangeKey: ua2b64(x.rawExchangeKey),\n      }))\n    )\n  }\n\n  async getAndDecryptExchangeDataRecoveryData(\n    recoveryKey: string\n  ): Promise<\n    | { success: { exchangeDataId: string; rawAccessControlSecret: ArrayBuffer; rawSharedSignatureKey: ArrayBuffer; rawExchangeKey: ArrayBuffer }[] }\n    | { failure: RecoveryDataUseFailureReason }\n  > {\n    const getRecoveryDataResult = await this.getRecoveryDataAndDecrypt(recoveryKey, RecoveryData.Type.EXCHANGE_KEY_RECOVERY)\n    if ('failure' in getRecoveryDataResult) return getRecoveryDataResult\n    return {\n      success: (getRecoveryDataResult.decryptedJson as ExchangeDataRecoveryDataContent).map((x) => ({\n        exchangeDataId: x.exchangeDataId,\n        rawAccessControlSecret: b64_2ua(x.rawAccessControlSecret),\n        rawSharedSignatureKey: b64_2ua(x.rawSharedSignatureKey),\n        rawExchangeKey: b64_2ua(x.rawExchangeKey),\n      })),\n    }\n  }\n\n  async getRecoveryDataAndDecrypt(\n    recoveryKey: string,\n    expectedType: RecoveryData.Type\n  ): Promise<{ recoveryData: RecoveryData; decryptedJson: any } | { failure: RecoveryDataUseFailureReason }> {\n    const id = await this.recoveryKeyToId(recoveryKey)\n    const getResult = await this.baseRecoveryApi.getRecoveryData(id).then(\n      (r) => ({ recoveryData: r }),\n      (e) => {\n        if (e instanceof XHRError) {\n          if (e.statusCode === 404) {\n            return { failure: RecoveryDataUseFailureReason.Missing }\n          } else if (e.statusCode === 403) {\n            return { failure: RecoveryDataUseFailureReason.Unauthorized }\n          }\n        }\n        throw e\n      }\n    )\n    if ('failure' in getResult) return getResult\n    const { recoveryData } = getResult\n    if (recoveryData.type !== expectedType) return { failure: RecoveryDataUseFailureReason.InvalidType }\n    const decryptionKey = await this.primitives.AES.importKey('raw', hex2ua(recoveryKey))\n    const decryptionResult = await this.primitives.AES.decrypt(decryptionKey, string2ua(a2b(recoveryData.encryptedSelf)))\n      .then((d) => JSON.parse(ua2utf8(d)))\n      .then(\n        (r): { success: RecoveryDataContent } => ({ success: r }),\n        () => ({ failure: RecoveryDataUseFailureReason.InvalidContent })\n      )\n    if ('failure' in decryptionResult) return decryptionResult\n    return { recoveryData, decryptedJson: decryptionResult.success }\n  }\n  async createRecoveryData(\n    recipient: string,\n    type: RecoveryData.Type,\n    lifetimeSeconds: number | undefined,\n    content: RecoveryDataContent\n  ): Promise<string> {\n    const recoveryKey = await this.primitives.AES.generateCryptoKey(false)\n    const recoveryKeyHex = ua2hex(await this.primitives.AES.exportKey(recoveryKey, 'raw'))\n    const id = await this.recoveryKeyToId(recoveryKeyHex)\n    const encryptedSelf = b2a(ua2string(await this.primitives.AES.encrypt(recoveryKey, utf8_2ua(JSON.stringify(content)))))\n    const expirationInstant = lifetimeSeconds ? Date.now() + lifetimeSeconds * 1000 : undefined\n    const data: RecoveryData = new RecoveryData({\n      id,\n      encryptedSelf,\n      expirationInstant,\n      recipient,\n      type,\n    })\n    await this.baseRecoveryApi.createRecoveryData(data)\n    return recoveryKeyHex\n  }\n}\n"]}

package/icc-x-api/crypto/SecureDelegationsManager.js

@@ -84,7 +84,7 @@ class SecureDelegationsManager {
     makeShareOrUpdateRequestParams(entityWithType, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds, newDelegationPermissions) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function* () {
-            const exchangeDataInfo = yield this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, entityWithType.type, (_a = entityWithType.entity.secretForeignKeys) !== null && _a !== void 0 ? _a : []);
+            const exchangeDataInfo = yield this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, entityWithType.type, (_a = entityWithType.entity.secretForeignKeys) !== null && _a !== void 0 ? _a : [], false);
             const accessControlHashes = yield this.accessControlSecretUtils.secureDelegationKeysFor(exchangeDataInfo.accessControlSecret, entityWithType.type, (_b = entityWithType.entity.secretForeignKeys) !== null && _b !== void 0 ? _b : []);
             const existingSecureDelegation = this.getExistingCanonicalKeyAndSecureDelegation(entityWithType.entity, accessControlHashes);
             if (existingSecureDelegation) {
@@ -131,7 +131,7 @@ class SecureDelegationsManager {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function* () {
             // Be wary of explicit delegator and explicit delegate
-            const exchangeDataInfo = yield this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, entity.type, (_a = entity.entity.secretForeignKeys) !== null && _a !== void 0 ? _a : []);
+            const exchangeDataInfo = yield this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, entity.type, (_a = entity.entity.secretForeignKeys) !== null && _a !== void 0 ? _a : [], false);
             const accessControlHashes = yield this.accessControlSecretUtils.secureDelegationKeysFor(exchangeDataInfo.accessControlSecret, entity.type, (_b = entity.entity.secretForeignKeys) !== null && _b !== void 0 ? _b : []);
             const accessControlKeys = (yield this.accessControlSecretUtils.accessControlKeysFor(exchangeDataInfo.accessControlSecret, entity.type, (_c = entity.entity.secretForeignKeys) !== null && _c !== void 0 ? _c : [])).map((x) => (0, utils_2.ua2hex)(x));
             const accessControlKeysToHashes = accessControlKeys

package/icc-x-api/crypto/SecureDelegationsManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecureDelegationsManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wFAAoF;AAKpF,oFAA6E;AAC7E,mCAA2F;AAK3F,oCAAyC;AAIzC,2EAAuE;AACvE,sHAAkH;AAClH,IAAO,mBAAmB,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;AAClF,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,2EAAuE;AAGvE,MAAa,wBAAwB;IACnC,YACmB,mBAAwC,EACxC,sBAA8C,EAC9C,2BAAwD,EACxD,wBAAkD,EAClD,QAAmC,EACnC,UAA4B,EAC5B,YAA8B,EAC9B,gBAAkC,EAClC,6BAAsC;QARtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,aAAQ,GAAR,QAAQ,CAA2B;QACnC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kCAA6B,GAA7B,6BAA6B,CAAS;QAGxC,uBAAkB,GAO/B,IAAI,oDAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IATvD,CAAC;IAWJ;;;;;;;;;;OAUG;IACG,sCAAsC,CAC1C,MAA2C,EAC3C,UAAwC,EACxC,SAAmB,EACnB,eAAyB,EACzB,cAAwB,EACxB,eAA2E;;YAE3E,MAAM,cAAc,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YAC5E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAC5D,cAAc,EACd,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAC/C,SAAS,EACT,cAAc,EACd,eAAe,EACf,eAAe,CAAC,KAAK,EACrB,SAAS,CACV,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,oBAAoB,GAMpB,EAAE,CAAA;YACR,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBACvE,IAAI,UAAU,KAAK,MAAM,EAAE;oBACzB,oBAAoB,CAAC,IAAI,CACvB,MAAM,IAAI,CAAC,wBAAwB,CACjC,cAAc,EACd,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,CAAC,sBAAsB,CAC1C,CACF,CAAA;iBACF;aACF;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC,CACpI,CAAA;YACD,MAAM,gBAAgB,qBACjB,kBAAkB,CAAC,yBAAyB,CAChD,CAAA;YACD,KAAK,MAAM,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,IAAI,oBAAoB,EAAE;gBACtF,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;aACtD;YACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,oBAAoB;iBACjB,MAAM,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;iBAClE,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,yBAAyB,EAAE,uBAAwB,CAAC,CAAC,CAC1H,CAAA;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAA;YAC7E,uCACK,MAAM,KACT,gBAAgB,EAAE,IAAI,mCAAgB,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,IAChF;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,8BAA8B,CAClC,cAAuC,EACvC,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;;YAExE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CAAA;YACD,MAAM,wBAAwB,GAAG,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC5H,IAAI,wBAAwB,EAAE;gBAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACrD,wBAAwB,CAAC,YAAY,EACrC,wBAAwB,CAAC,gBAAgB,EACzC,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;gBACD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;aAC3D;iBAAM;gBACL,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;gBACvB,OAAO;oBACL,KAAK,EAAE,MAAM,IAAI,CAAC,sBAAsB,CACtC,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,CACzB;iBACF,CAAA;aACF;;KACF;IAEa,uBAAuB,CACnC,YAAoB,EACpB,kBAAoC,EACpC,gBAAqG,EACrG,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAE9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC5I,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAC/G,CAAA;YACD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAChH,CAAA;YACD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAChG,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE;gBAChF,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACjI,MAAM,0BAA0B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBAChJ,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAC/F,kBAAkB,EAClB,gBAAgB,CAAC,WAAW,CAC7B,CAAA;gBACD,OAAO,IAAI,qEAAiC,CAAC;oBAC3C,yBAAyB,EAAE,YAAY;oBACvC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClG,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9G,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC/G,CAAC,CAAA;aACH;;gBAAM,OAAO,SAAS,CAAA;QACzB,CAAC;KAAA;IAEa,sBAAsB,CAClC,gBAAqG,EACrG,iBAA2B,EAC3B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;YAExE,OAAO,IAAI,uCAAkB,iCACxB,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,KAC1I,oBAAoB,EAAE,wBAAwB,EAC9C,iBAAiB,IACjB,CAAA;QACJ,CAAC;KAAA;IAEa,wBAAwB,CACpC,MAA+B,EAC/B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,WAA4B,EAC5B,mBAAuC;;;YAQvC,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CAAA;YACD,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;YACvB,MAAM,yBAAyB,GAAG,iBAAiB;iBAChD,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1C,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAE3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpD,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;YACrH,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAC1E,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC;gBACtC,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,iBAAiB;gBACrD,QAAQ,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,gBAAgB;gBACnD,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,SAAS;gBAC7C,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,eAAe,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,eAAe;gBACzD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1E,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAA;YACF,OAAO;gBACL,sBAAsB,EAAE,YAAY;gBACpC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,UAAU;gBACV,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,yBAAyB,EAAE,eAAe;aAC3C,CAAA;;KACF;IAEa,iCAAiC,CAC7C,gBAAqG,EACrG,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAU9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,kBAAkB,GACtB,UAAU,KAAK,MAAM;gBACnB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3E,CAAC,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;YACrG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,cAAc,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAChI,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC/I,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAClJ,uCACK,kBAAkB,KACrB,SAAS,EAAE,kBAAkB,EAC7B,cAAc,EAAE,uBAAuB,EACvC,eAAe,EAAE,wBAAwB,IAC1C;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,MAAc,EACd,UAAkB,EAClB,YAA0B;;YAO1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5D,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACrF,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,gBAAgB,EAAE,UAAU;oBAC5B,cAAc,EAAE,YAAY,CAAC,EAAE;iBAChC,CAAA;aACF;iBAAM,IAAI,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC3F,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CACnF,YAAY,CAAC,EAAG,EAChB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACxH;iBACF,CAAA;aACF;iBAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,IAAI,CAAC,6BAA6B,EAAE;gBAC3F;;mBAEG;gBACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;gBACzF,MAAM,oBAAoB,GAAgC,EAAE,CAAA;gBAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY,CAAC,8BAA8B,EAAE,GAAG,YAAY,CAAC,gCAAgC,CAAC,EAAE;oBACvH,MAAM,MAAM,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAA;oBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;oBACrG,IAAI,kCAAkC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;wBAClD,oBAAoB,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;qBACpH;iBACF;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM;oBAC3C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;gBAC3G,OAAO;oBACL,gBAAgB,EAAE,UAAU;oBAC5B,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAG,EAAE,oBAAoB,CAAC;iBAC9H,CAAA;aACF;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAEO,6BAA6B,CACnC,MAAc,EACd,YAA0B;QAO1B,IAAI,IAAI,CAAC,6BAA6B,EAAE;YACtC,OAAO,EAAE,CAAA;SACV;aAAM;YACL,OAAO;gBACL,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,iBAAiB,EAAE,MAAM;gBACzB,gBAAgB,EAAE,MAAM;aACzB,CAAA;SACF;IACH,CAAC;IAEa,gBAAgB,CAAC,WAAmB;;YAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAS,EAAE;gBACzD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACjF,OAAO;oBACL,IAAI,EAAE;wBACJ,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,iBAAiB,CAAC;wBAC3G,8BAA8B,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,+BAAuB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBAC3F,gCAAgC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,iCAAyB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;qBAChG;iBACF,CAAA;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;IAEO,0CAA0C,CAChD,MAA6C,EAC7C,MAAgB;;QAEhB,MAAM,gBAAgB,GAAG,MAAA,MAAM,CAAC,gBAAgB,mCAAI,EAAE,CAAA;QACtD,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,MAAA,MAAA,gBAAgB,CAAC,gBAAgB,0CAAG,IAAI,CAAC,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAC,CAAC,CAAA;QAC9H,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;;YAC/C,MAAM,iBAAiB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,IAAI,CAAC,CAAA;YACpE,OAAO,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7F,CAAC,CAAC,CAAA;QACF,IACE,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAC3B,uBAAuB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,IAAI,uBAAuB,CAAC,CAAC,CAAC,MAAK,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,CAAC;YAEzI,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;QACrG,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAA;QAC5D,MAAM,yBAAyB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,yBAAyB,CAAC,CAAA;QACjG,OAAO,CACL,MAAA,gBAAgB,CAAC,CAAC,CAAC,mCACnB,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,CAAC,yBAAyB;YACzD,CAAC,CAAC,EAAE,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE;YAC1F,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;IACH,CAAC;CACF;AA/ZD,4DA+ZC","sourcesContent":["import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { fingerprintV2, hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of } from './utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { hex2ua, ua2hex } from '../utils'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest'\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { EntitySharedMetadataUpdateRequest } from '../../icc-api/model/requests/EntitySharedMetadataUpdateRequest'\nimport EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecurityMetadata } from '../../icc-api/model/SecurityMetadata'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\n\nexport class SecureDelegationsManager {\n  constructor(\n    private readonly exchangeDataManager: ExchangeDataManager,\n    private readonly exchangeDataMapManager: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    private readonly userKeys: UserEncryptionKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly selfNeedsAnonymousDelegations: boolean\n  ) {}\n\n  private readonly dataOwnerInfoCache: LruTemporisedAsyncCache<\n    string,\n    {\n      requiresAnonymousDelegations: boolean\n      availablePublicKeysHexWithSha1: string[]\n      availablePublicKeysHexWithSha256: string[]\n    }\n  > = new LruTemporisedAsyncCache(100, () => 30 * 60 * 1000)\n\n  /**\n   * Note: this method does not save the updated entity.\n   * @param entity an entity, must already have secret foreign keys initialised.\n   * @param entityType the type of the entity\n   * @param secretIds the initial secret ids to include and share with the auto-delegations\n   * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations\n   * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations\n   * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level\n   * they will have on the entity.\n   * @return the entity with the security metadata initialised for the provided parameters.\n   */\n  async entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T & { secretForeignKeys: string[] },\n    entityType: EntityWithDelegationTypeName,\n    secretIds: string[],\n    owningEntityIds: string[],\n    encryptionKeys: string[],\n    autoDelegations: { [delegateId: string]: SecureDelegation.AccessLevelEnum }\n  ): Promise<T> {\n    const entityWithType: EncryptedEntityWithType = { entity, type: entityType }\n    const rootDelegationInfo = await this.makeSecureDelegationInfo(\n      entityWithType,\n      await this.dataOwnerApi.getCurrentDataOwnerId(),\n      secretIds,\n      encryptionKeys,\n      owningEntityIds,\n      AccessLevelEnum.WRITE,\n      undefined\n    )\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const otherDelegationsInfo: {\n      canonicalDelegationKey: string\n      canonicalAccessControlKey: string\n      delegation: SecureDelegation\n      delegationKeyEquivalences: { [p: string]: string }\n      encryptedExchangeDataId: { [fp: string]: string } | undefined\n    }[] = []\n    for (const [delegateId, permissions] of Object.entries(autoDelegations)) {\n      if (delegateId !== selfId) {\n        otherDelegationsInfo.push(\n          await this.makeSecureDelegationInfo(\n            entityWithType,\n            delegateId,\n            secretIds,\n            encryptionKeys,\n            owningEntityIds,\n            permissions,\n            rootDelegationInfo.canonicalDelegationKey\n          )\n        )\n      }\n    }\n    const secureDelegations = Object.fromEntries(\n      [rootDelegationInfo, ...otherDelegationsInfo].map(({ canonicalDelegationKey, delegation }) => [canonicalDelegationKey, delegation])\n    )\n    const keysEquivalences = {\n      ...rootDelegationInfo.delegationKeyEquivalences,\n    }\n    for (const { delegationKeyEquivalences: otherKeyEquivalences } of otherDelegationsInfo) {\n      Object.assign(keysEquivalences, otherKeyEquivalences)\n    }\n    const newExchangeDataMaps = Object.fromEntries(\n      otherDelegationsInfo\n        .filter(({ encryptedExchangeDataId }) => !!encryptedExchangeDataId)\n        .map(({ canonicalAccessControlKey, encryptedExchangeDataId }) => [canonicalAccessControlKey, encryptedExchangeDataId!])\n    )\n    await this.exchangeDataMapManager.createExchangeDataMaps(newExchangeDataMaps)\n    return {\n      ...entity,\n      securityMetadata: new SecurityMetadata({ secureDelegations, keysEquivalences }),\n    }\n  }\n\n  /**\n   * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or\n   * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation\n   * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to\n   * share the provided data.\n   * @param entityWithType an entity with type\n   * @param delegateId the id of the delegate\n   * @param shareSecretIds the secret ids to share\n   * @param shareEncryptionKeys the encryption keys to share\n   * @param shareOwningEntityIds the owning entity ids to share\n   * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an\n   * update request instead of a share request, this parameter is ignored.\n   * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update\n   * the entity to allow the delegate to access the provided data.\n   */\n  async makeShareOrUpdateRequestParams(\n    entityWithType: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareOrMetadataUpdateRequest | undefined> {\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? []\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? []\n    )\n    const existingSecureDelegation = this.getExistingCanonicalKeyAndSecureDelegation(entityWithType.entity, accessControlHashes)\n    if (existingSecureDelegation) {\n      const updateParams = await this.makeUpdateRequestParams(\n        existingSecureDelegation.canonicalKey,\n        existingSecureDelegation.secureDelegation,\n        exchangeDataInfo,\n        shareSecretIds,\n        shareEncryptionKeys,\n        shareOwningEntityIds\n      )\n      return updateParams ? { update: updateParams } : undefined\n    } else {\n      const accessControlKeys = (\n        await this.accessControlSecretUtils.accessControlKeysFor(\n          exchangeDataInfo.accessControlSecret,\n          entityWithType.type,\n          entityWithType.entity.secretForeignKeys ?? []\n        )\n      ).map((x) => ua2hex(x))\n      return {\n        share: await this.makeShareRequestParams(\n          exchangeDataInfo,\n          accessControlKeys,\n          delegateId,\n          shareSecretIds,\n          shareEncryptionKeys,\n          shareOwningEntityIds,\n          newDelegationPermissions\n        ),\n      }\n    }\n  }\n\n  private async makeUpdateRequestParams(\n    canonicalKey: string,\n    existingDelegation: SecureDelegation,\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<EntitySharedMetadataUpdateRequest | undefined> {\n    const existingSecretIds = new Set(await this.secureDelegationsEncryption.decryptSecretIds(existingDelegation, exchangeDataInfo.exchangeKey))\n    const existingEncryptionKeys = new Set(\n      await this.secureDelegationsEncryption.decryptEncryptionKeys(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const existingOwningEntityIds = new Set(\n      await this.secureDelegationsEncryption.decryptOwningEntityIds(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const newSecretIds = shareSecretIds.filter((id) => !existingSecretIds.has(id))\n    const newEncryptionKeys = shareEncryptionKeys.filter((key) => !existingEncryptionKeys.has(key))\n    const newOwningEntityIds = shareOwningEntityIds.filter((id) => !existingOwningEntityIds.has(id))\n    if (newSecretIds.length || newEncryptionKeys.length || newOwningEntityIds.length) {\n      const encryptedNewSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(newSecretIds, exchangeDataInfo.exchangeKey)\n      const encryptedNewEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(newEncryptionKeys, exchangeDataInfo.exchangeKey)\n      const encryptedNewOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(\n        newOwningEntityIds,\n        exchangeDataInfo.exchangeKey\n      )\n      return new EntitySharedMetadataUpdateRequest({\n        metadataAccessControlHash: canonicalKey,\n        secretIds: Object.fromEntries(encryptedNewSecretIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n        encryptionKeys: Object.fromEntries(encryptedNewEncryptionKeys.map((key) => [key, EntryUpdateTypeEnum.CREATE])),\n        owningEntityIds: Object.fromEntries(encryptedNewOwningEntityIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n      })\n    } else return undefined\n  }\n\n  private async makeShareRequestParams(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    accessControlKeys: string[],\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareRequest> {\n    return new EntityShareRequest({\n      ...(await this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds)),\n      requestedPermissions: newDelegationPermissions,\n      accessControlKeys,\n    })\n  }\n\n  private async makeSecureDelegationInfo(\n    entity: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    permissions: AccessLevelEnum,\n    parentDelegationKey: string | undefined\n  ): Promise<{\n    canonicalDelegationKey: string\n    canonicalAccessControlKey: string\n    delegation: SecureDelegation\n    encryptedExchangeDataId: { [fp: string]: string } | undefined\n    delegationKeyEquivalences: { [alias: string]: string }\n  }> {\n    // Be wary of explicit delegator and explicit delegate\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entity.type,\n      entity.entity.secretForeignKeys ?? []\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entity.type,\n      entity.entity.secretForeignKeys ?? []\n    )\n    const accessControlKeys = (\n      await this.accessControlSecretUtils.accessControlKeysFor(\n        exchangeDataInfo.accessControlSecret,\n        entity.type,\n        entity.entity.secretForeignKeys ?? []\n      )\n    ).map((x) => ua2hex(x))\n    const accessControlKeysToHashes = accessControlKeys\n      .map((key, index) => {\n        return [key, accessControlHashes[index]]\n      })\n      .sort((a, b) => a[1].localeCompare(b[1]))\n\n    const canonicalKey = accessControlKeysToHashes[0][1]\n    const keyEquivalences = Object.fromEntries(accessControlKeysToHashes.slice(1).map((hash) => [hash[1], canonicalKey]))\n    const encryptedDelegationInfo = await this.makeSecureDelegationEncryptedData(\n      exchangeDataInfo,\n      delegateId,\n      shareSecretIds,\n      shareEncryptionKeys,\n      shareOwningEntityIds\n    )\n    const delegation = new SecureDelegation({\n      delegator: encryptedDelegationInfo?.explicitDelegator,\n      delegate: encryptedDelegationInfo?.explicitDelegate,\n      secretIds: encryptedDelegationInfo?.secretIds,\n      encryptionKeys: encryptedDelegationInfo?.encryptionKeys,\n      owningEntityIds: encryptedDelegationInfo?.owningEntityIds,\n      parentDelegations: parentDelegationKey ? [parentDelegationKey] : undefined,\n      exchangeDataId: encryptedDelegationInfo?.exchangeDataId,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      permissions: permissions,\n    })\n    return {\n      canonicalDelegationKey: canonicalKey,\n      canonicalAccessControlKey: accessControlKeysToHashes[0][0],\n      delegation,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      delegationKeyEquivalences: keyEquivalences,\n    }\n  }\n\n  private async makeSecureDelegationEncryptedData(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<{\n    explicitDelegator?: string\n    explicitDelegate?: string\n    secretIds?: string[]\n    encryptionKeys?: string[]\n    owningEntityIds?: string[]\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string } // TODO if secure delegation info, check cache before calculating\n  }> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const exchangeDataIdInfo =\n      delegateId === selfId\n        ? this.makeExchangeDataIdInfoForSelf(selfId, exchangeDataInfo.exchangeData)\n        : await this.makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeDataInfo.exchangeData)\n    const encryptedSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(shareSecretIds, exchangeDataInfo.exchangeKey)\n    const encryptedEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(shareEncryptionKeys, exchangeDataInfo.exchangeKey)\n    const encryptedOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(shareOwningEntityIds, exchangeDataInfo.exchangeKey)\n    return {\n      ...exchangeDataIdInfo,\n      secretIds: encryptedSecretIds,\n      encryptionKeys: encryptedEncryptionKeys,\n      owningEntityIds: encryptedOwningEntityIds,\n    }\n  }\n\n  private async makeExchangeDataIdInfoForDelegate(\n    selfId: string,\n    delegateId: string,\n    exchangeData: ExchangeData\n  ): Promise<{\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  }> {\n    const delegateInfo = await this.getDataOwnerInfo(delegateId)\n    if (!delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        explicitDelegate: delegateId,\n        exchangeDataId: exchangeData.id,\n      }\n    } else if (delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(\n          exchangeData.id!,\n          Object.fromEntries(this.userKeys.getSelfVerifiedKeys().map((keyInfo) => [keyInfo.fingerprint, keyInfo.pair.publicKey]))\n        ),\n      }\n    } else if (!delegateInfo.requiresAnonymousDelegations && this.selfNeedsAnonymousDelegations) {\n      /**\n       * Important: this requires that the exchange data signature also validates the authenticity of the public keys included in there.\n       */\n      const fingerprintsOfVerifiedExchangeData = new Set(Object.keys(exchangeData.exchangeKey))\n      const delegateVerifiedKeys: { [fp: string]: CryptoKey } = {}\n      for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {\n        const currFp = fingerprintV2(keyHex)\n        const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? 'sha-1' : 'sha-256'\n        if (fingerprintsOfVerifiedExchangeData.has(currFp)) {\n          delegateVerifiedKeys[currFp] = await this.primitives.RSA.importKey('spki', hex2ua(keyHex), ['encrypt'], shaVersion)\n        }\n      }\n      if (!Object.keys(delegateVerifiedKeys).length)\n        throw new Error('Illegal state: could not find any verified key for delegate in verified exchange data.')\n      return {\n        explicitDelegate: delegateId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id!, delegateVerifiedKeys),\n      }\n    } else return {}\n  }\n\n  private makeExchangeDataIdInfoForSelf(\n    selfId: string,\n    exchangeData: ExchangeData\n  ): {\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  } {\n    if (this.selfNeedsAnonymousDelegations) {\n      return {}\n    } else {\n      return {\n        exchangeDataId: exchangeData.id,\n        explicitDelegator: selfId,\n        explicitDelegate: selfId,\n      }\n    }\n  }\n\n  private async getDataOwnerInfo(dataOwnerId: string) {\n    return this.dataOwnerInfoCache.get(dataOwnerId, async () => {\n      const dataOwnerWithType = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n      return {\n        item: {\n          requiresAnonymousDelegations: this.cryptoStrategies.dataOwnerRequiresAnonymousDelegation(dataOwnerWithType),\n          availablePublicKeysHexWithSha1: Array.from(hexPublicKeysWithSha1Of(dataOwnerWithType.stub)),\n          availablePublicKeysHexWithSha256: Array.from(hexPublicKeysWithSha256Of(dataOwnerWithType.stub)),\n        },\n      }\n    })\n  }\n\n  private getExistingCanonicalKeyAndSecureDelegation(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    hashes: string[]\n  ): { canonicalKey: string; secureDelegation: SecureDelegation } | undefined {\n    const securityMetadata = entity.securityMetadata ?? {}\n    const canonicalByEquivalences = Array.from(new Set(hashes.flatMap((hash) => securityMetadata.keysEquivalences?.[hash] ?? [])))\n    const directRetrievals = hashes.flatMap((hash) => {\n      const retrievedMetadata = securityMetadata.secureDelegations?.[hash]\n      return retrievedMetadata ? { canonicalKey: hash, secureDelegation: retrievedMetadata } : []\n    })\n    if (\n      directRetrievals.length > 1 ||\n      canonicalByEquivalences.length > 1 ||\n      (!!canonicalByEquivalences[0] && !!directRetrievals[0]?.canonicalKey && canonicalByEquivalences[0] !== directRetrievals[0]?.canonicalKey)\n    )\n      throw new Error('Illegal state: multiple secure delegations matching equivalent hashes of entity.')\n    const canonicalFromEquivalences = canonicalByEquivalences[0]\n    const retrievedFromEquivalences = securityMetadata.secureDelegations?.[canonicalFromEquivalences]\n    return (\n      directRetrievals[0] ??\n      (!!canonicalFromEquivalences && !!retrievedFromEquivalences\n        ? { canonicalKey: canonicalFromEquivalences, secureDelegation: retrievedFromEquivalences }\n        : undefined)\n    )\n  }\n}\n"]}
+{"version":3,"file":"SecureDelegationsManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wFAAoF;AAKpF,oFAA6E;AAC7E,mCAA2F;AAK3F,oCAAyC;AAIzC,2EAAuE;AACvE,sHAAkH;AAClH,IAAO,mBAAmB,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;AAClF,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,2EAAuE;AAGvE,MAAa,wBAAwB;IACnC,YACmB,mBAAwC,EACxC,sBAA8C,EAC9C,2BAAwD,EACxD,wBAAkD,EAClD,QAAmC,EACnC,UAA4B,EAC5B,YAA8B,EAC9B,gBAAkC,EAClC,6BAAsC;QARtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,aAAQ,GAAR,QAAQ,CAA2B;QACnC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kCAA6B,GAA7B,6BAA6B,CAAS;QAGxC,uBAAkB,GAO/B,IAAI,oDAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IATvD,CAAC;IAWJ;;;;;;;;;;OAUG;IACG,sCAAsC,CAC1C,MAA2C,EAC3C,UAAwC,EACxC,SAAmB,EACnB,eAAyB,EACzB,cAAwB,EACxB,eAA2E;;YAE3E,MAAM,cAAc,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YAC5E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAC5D,cAAc,EACd,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAC/C,SAAS,EACT,cAAc,EACd,eAAe,EACf,eAAe,CAAC,KAAK,EACrB,SAAS,CACV,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,oBAAoB,GAMpB,EAAE,CAAA;YACR,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBACvE,IAAI,UAAU,KAAK,MAAM,EAAE;oBACzB,oBAAoB,CAAC,IAAI,CACvB,MAAM,IAAI,CAAC,wBAAwB,CACjC,cAAc,EACd,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,CAAC,sBAAsB,CAC1C,CACF,CAAA;iBACF;aACF;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC,CACpI,CAAA;YACD,MAAM,gBAAgB,qBACjB,kBAAkB,CAAC,yBAAyB,CAChD,CAAA;YACD,KAAK,MAAM,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,IAAI,oBAAoB,EAAE;gBACtF,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;aACtD;YACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,oBAAoB;iBACjB,MAAM,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;iBAClE,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,yBAAyB,EAAE,uBAAwB,CAAC,CAAC,CAC1H,CAAA;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAA;YAC7E,uCACK,MAAM,KACT,gBAAgB,EAAE,IAAI,mCAAgB,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,IAChF;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,8BAA8B,CAClC,cAAuC,EACvC,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;;YAExE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC7C,KAAK,CACN,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CAAA;YACD,MAAM,wBAAwB,GAAG,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC5H,IAAI,wBAAwB,EAAE;gBAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACrD,wBAAwB,CAAC,YAAY,EACrC,wBAAwB,CAAC,gBAAgB,EACzC,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;gBACD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;aAC3D;iBAAM;gBACL,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;gBACvB,OAAO;oBACL,KAAK,EAAE,MAAM,IAAI,CAAC,sBAAsB,CACtC,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,CACzB;iBACF,CAAA;aACF;;KACF;IAEa,uBAAuB,CACnC,YAAoB,EACpB,kBAAoC,EACpC,gBAAqG,EACrG,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAE9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC5I,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAC/G,CAAA;YACD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAChH,CAAA;YACD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAChG,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE;gBAChF,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACjI,MAAM,0BAA0B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBAChJ,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAC/F,kBAAkB,EAClB,gBAAgB,CAAC,WAAW,CAC7B,CAAA;gBACD,OAAO,IAAI,qEAAiC,CAAC;oBAC3C,yBAAyB,EAAE,YAAY;oBACvC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClG,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9G,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC/G,CAAC,CAAA;aACH;;gBAAM,OAAO,SAAS,CAAA;QACzB,CAAC;KAAA;IAEa,sBAAsB,CAClC,gBAAqG,EACrG,iBAA2B,EAC3B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;YAExE,OAAO,IAAI,uCAAkB,iCACxB,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,KAC1I,oBAAoB,EAAE,wBAAwB,EAC9C,iBAAiB,IACjB,CAAA;QACJ,CAAC;KAAA;IAEa,wBAAwB,CACpC,MAA+B,EAC/B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,WAA4B,EAC5B,mBAAuC;;;YAQvC,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EACrC,KAAK,CACN,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CAAA;YACD,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;YACvB,MAAM,yBAAyB,GAAG,iBAAiB;iBAChD,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1C,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAE3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpD,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;YACrH,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAC1E,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC;gBACtC,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,iBAAiB;gBACrD,QAAQ,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,gBAAgB;gBACnD,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,SAAS;gBAC7C,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,eAAe,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,eAAe;gBACzD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1E,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAA;YACF,OAAO;gBACL,sBAAsB,EAAE,YAAY;gBACpC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,UAAU;gBACV,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,yBAAyB,EAAE,eAAe;aAC3C,CAAA;;KACF;IAEa,iCAAiC,CAC7C,gBAAqG,EACrG,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAU9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,kBAAkB,GACtB,UAAU,KAAK,MAAM;gBACnB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3E,CAAC,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;YACrG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,cAAc,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAChI,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC/I,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAClJ,uCACK,kBAAkB,KACrB,SAAS,EAAE,kBAAkB,EAC7B,cAAc,EAAE,uBAAuB,EACvC,eAAe,EAAE,wBAAwB,IAC1C;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,MAAc,EACd,UAAkB,EAClB,YAA0B;;YAO1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5D,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACrF,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,gBAAgB,EAAE,UAAU;oBAC5B,cAAc,EAAE,YAAY,CAAC,EAAE;iBAChC,CAAA;aACF;iBAAM,IAAI,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC3F,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CACnF,YAAY,CAAC,EAAG,EAChB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACxH;iBACF,CAAA;aACF;iBAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,IAAI,CAAC,6BAA6B,EAAE;gBAC3F;;mBAEG;gBACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;gBACzF,MAAM,oBAAoB,GAAgC,EAAE,CAAA;gBAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY,CAAC,8BAA8B,EAAE,GAAG,YAAY,CAAC,gCAAgC,CAAC,EAAE;oBACvH,MAAM,MAAM,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAA;oBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;oBACrG,IAAI,kCAAkC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;wBAClD,oBAAoB,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;qBACpH;iBACF;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM;oBAC3C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;gBAC3G,OAAO;oBACL,gBAAgB,EAAE,UAAU;oBAC5B,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAG,EAAE,oBAAoB,CAAC;iBAC9H,CAAA;aACF;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAEO,6BAA6B,CACnC,MAAc,EACd,YAA0B;QAO1B,IAAI,IAAI,CAAC,6BAA6B,EAAE;YACtC,OAAO,EAAE,CAAA;SACV;aAAM;YACL,OAAO;gBACL,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,iBAAiB,EAAE,MAAM;gBACzB,gBAAgB,EAAE,MAAM;aACzB,CAAA;SACF;IACH,CAAC;IAEa,gBAAgB,CAAC,WAAmB;;YAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAS,EAAE;gBACzD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACjF,OAAO;oBACL,IAAI,EAAE;wBACJ,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,iBAAiB,CAAC;wBAC3G,8BAA8B,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,+BAAuB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBAC3F,gCAAgC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,iCAAyB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;qBAChG;iBACF,CAAA;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;IAEO,0CAA0C,CAChD,MAA6C,EAC7C,MAAgB;;QAEhB,MAAM,gBAAgB,GAAG,MAAA,MAAM,CAAC,gBAAgB,mCAAI,EAAE,CAAA;QACtD,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,MAAA,MAAA,gBAAgB,CAAC,gBAAgB,0CAAG,IAAI,CAAC,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAC,CAAC,CAAA;QAC9H,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;;YAC/C,MAAM,iBAAiB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,IAAI,CAAC,CAAA;YACpE,OAAO,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7F,CAAC,CAAC,CAAA;QACF,IACE,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAC3B,uBAAuB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,IAAI,uBAAuB,CAAC,CAAC,CAAC,MAAK,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,CAAC;YAEzI,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;QACrG,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAA;QAC5D,MAAM,yBAAyB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,yBAAyB,CAAC,CAAA;QACjG,OAAO,CACL,MAAA,gBAAgB,CAAC,CAAC,CAAC,mCACnB,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,CAAC,yBAAyB;YACzD,CAAC,CAAC,EAAE,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE;YAC1F,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;IACH,CAAC;CACF;AAjaD,4DAiaC","sourcesContent":["import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { fingerprintV2, hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of } from './utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { hex2ua, ua2hex } from '../utils'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest'\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { EntitySharedMetadataUpdateRequest } from '../../icc-api/model/requests/EntitySharedMetadataUpdateRequest'\nimport EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecurityMetadata } from '../../icc-api/model/SecurityMetadata'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\n\nexport class SecureDelegationsManager {\n  constructor(\n    private readonly exchangeDataManager: ExchangeDataManager,\n    private readonly exchangeDataMapManager: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    private readonly userKeys: UserEncryptionKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly selfNeedsAnonymousDelegations: boolean\n  ) {}\n\n  private readonly dataOwnerInfoCache: LruTemporisedAsyncCache<\n    string,\n    {\n      requiresAnonymousDelegations: boolean\n      availablePublicKeysHexWithSha1: string[]\n      availablePublicKeysHexWithSha256: string[]\n    }\n  > = new LruTemporisedAsyncCache(100, () => 30 * 60 * 1000)\n\n  /**\n   * Note: this method does not save the updated entity.\n   * @param entity an entity, must already have secret foreign keys initialised.\n   * @param entityType the type of the entity\n   * @param secretIds the initial secret ids to include and share with the auto-delegations\n   * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations\n   * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations\n   * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level\n   * they will have on the entity.\n   * @return the entity with the security metadata initialised for the provided parameters.\n   */\n  async entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T & { secretForeignKeys: string[] },\n    entityType: EntityWithDelegationTypeName,\n    secretIds: string[],\n    owningEntityIds: string[],\n    encryptionKeys: string[],\n    autoDelegations: { [delegateId: string]: SecureDelegation.AccessLevelEnum }\n  ): Promise<T> {\n    const entityWithType: EncryptedEntityWithType = { entity, type: entityType }\n    const rootDelegationInfo = await this.makeSecureDelegationInfo(\n      entityWithType,\n      await this.dataOwnerApi.getCurrentDataOwnerId(),\n      secretIds,\n      encryptionKeys,\n      owningEntityIds,\n      AccessLevelEnum.WRITE,\n      undefined\n    )\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const otherDelegationsInfo: {\n      canonicalDelegationKey: string\n      canonicalAccessControlKey: string\n      delegation: SecureDelegation\n      delegationKeyEquivalences: { [p: string]: string }\n      encryptedExchangeDataId: { [fp: string]: string } | undefined\n    }[] = []\n    for (const [delegateId, permissions] of Object.entries(autoDelegations)) {\n      if (delegateId !== selfId) {\n        otherDelegationsInfo.push(\n          await this.makeSecureDelegationInfo(\n            entityWithType,\n            delegateId,\n            secretIds,\n            encryptionKeys,\n            owningEntityIds,\n            permissions,\n            rootDelegationInfo.canonicalDelegationKey\n          )\n        )\n      }\n    }\n    const secureDelegations = Object.fromEntries(\n      [rootDelegationInfo, ...otherDelegationsInfo].map(({ canonicalDelegationKey, delegation }) => [canonicalDelegationKey, delegation])\n    )\n    const keysEquivalences = {\n      ...rootDelegationInfo.delegationKeyEquivalences,\n    }\n    for (const { delegationKeyEquivalences: otherKeyEquivalences } of otherDelegationsInfo) {\n      Object.assign(keysEquivalences, otherKeyEquivalences)\n    }\n    const newExchangeDataMaps = Object.fromEntries(\n      otherDelegationsInfo\n        .filter(({ encryptedExchangeDataId }) => !!encryptedExchangeDataId)\n        .map(({ canonicalAccessControlKey, encryptedExchangeDataId }) => [canonicalAccessControlKey, encryptedExchangeDataId!])\n    )\n    await this.exchangeDataMapManager.createExchangeDataMaps(newExchangeDataMaps)\n    return {\n      ...entity,\n      securityMetadata: new SecurityMetadata({ secureDelegations, keysEquivalences }),\n    }\n  }\n\n  /**\n   * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or\n   * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation\n   * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to\n   * share the provided data.\n   * @param entityWithType an entity with type\n   * @param delegateId the id of the delegate\n   * @param shareSecretIds the secret ids to share\n   * @param shareEncryptionKeys the encryption keys to share\n   * @param shareOwningEntityIds the owning entity ids to share\n   * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an\n   * update request instead of a share request, this parameter is ignored.\n   * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update\n   * the entity to allow the delegate to access the provided data.\n   */\n  async makeShareOrUpdateRequestParams(\n    entityWithType: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareOrMetadataUpdateRequest | undefined> {\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? [],\n      false\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? []\n    )\n    const existingSecureDelegation = this.getExistingCanonicalKeyAndSecureDelegation(entityWithType.entity, accessControlHashes)\n    if (existingSecureDelegation) {\n      const updateParams = await this.makeUpdateRequestParams(\n        existingSecureDelegation.canonicalKey,\n        existingSecureDelegation.secureDelegation,\n        exchangeDataInfo,\n        shareSecretIds,\n        shareEncryptionKeys,\n        shareOwningEntityIds\n      )\n      return updateParams ? { update: updateParams } : undefined\n    } else {\n      const accessControlKeys = (\n        await this.accessControlSecretUtils.accessControlKeysFor(\n          exchangeDataInfo.accessControlSecret,\n          entityWithType.type,\n          entityWithType.entity.secretForeignKeys ?? []\n        )\n      ).map((x) => ua2hex(x))\n      return {\n        share: await this.makeShareRequestParams(\n          exchangeDataInfo,\n          accessControlKeys,\n          delegateId,\n          shareSecretIds,\n          shareEncryptionKeys,\n          shareOwningEntityIds,\n          newDelegationPermissions\n        ),\n      }\n    }\n  }\n\n  private async makeUpdateRequestParams(\n    canonicalKey: string,\n    existingDelegation: SecureDelegation,\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<EntitySharedMetadataUpdateRequest | undefined> {\n    const existingSecretIds = new Set(await this.secureDelegationsEncryption.decryptSecretIds(existingDelegation, exchangeDataInfo.exchangeKey))\n    const existingEncryptionKeys = new Set(\n      await this.secureDelegationsEncryption.decryptEncryptionKeys(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const existingOwningEntityIds = new Set(\n      await this.secureDelegationsEncryption.decryptOwningEntityIds(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const newSecretIds = shareSecretIds.filter((id) => !existingSecretIds.has(id))\n    const newEncryptionKeys = shareEncryptionKeys.filter((key) => !existingEncryptionKeys.has(key))\n    const newOwningEntityIds = shareOwningEntityIds.filter((id) => !existingOwningEntityIds.has(id))\n    if (newSecretIds.length || newEncryptionKeys.length || newOwningEntityIds.length) {\n      const encryptedNewSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(newSecretIds, exchangeDataInfo.exchangeKey)\n      const encryptedNewEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(newEncryptionKeys, exchangeDataInfo.exchangeKey)\n      const encryptedNewOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(\n        newOwningEntityIds,\n        exchangeDataInfo.exchangeKey\n      )\n      return new EntitySharedMetadataUpdateRequest({\n        metadataAccessControlHash: canonicalKey,\n        secretIds: Object.fromEntries(encryptedNewSecretIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n        encryptionKeys: Object.fromEntries(encryptedNewEncryptionKeys.map((key) => [key, EntryUpdateTypeEnum.CREATE])),\n        owningEntityIds: Object.fromEntries(encryptedNewOwningEntityIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n      })\n    } else return undefined\n  }\n\n  private async makeShareRequestParams(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    accessControlKeys: string[],\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareRequest> {\n    return new EntityShareRequest({\n      ...(await this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds)),\n      requestedPermissions: newDelegationPermissions,\n      accessControlKeys,\n    })\n  }\n\n  private async makeSecureDelegationInfo(\n    entity: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    permissions: AccessLevelEnum,\n    parentDelegationKey: string | undefined\n  ): Promise<{\n    canonicalDelegationKey: string\n    canonicalAccessControlKey: string\n    delegation: SecureDelegation\n    encryptedExchangeDataId: { [fp: string]: string } | undefined\n    delegationKeyEquivalences: { [alias: string]: string }\n  }> {\n    // Be wary of explicit delegator and explicit delegate\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entity.type,\n      entity.entity.secretForeignKeys ?? [],\n      false\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entity.type,\n      entity.entity.secretForeignKeys ?? []\n    )\n    const accessControlKeys = (\n      await this.accessControlSecretUtils.accessControlKeysFor(\n        exchangeDataInfo.accessControlSecret,\n        entity.type,\n        entity.entity.secretForeignKeys ?? []\n      )\n    ).map((x) => ua2hex(x))\n    const accessControlKeysToHashes = accessControlKeys\n      .map((key, index) => {\n        return [key, accessControlHashes[index]]\n      })\n      .sort((a, b) => a[1].localeCompare(b[1]))\n\n    const canonicalKey = accessControlKeysToHashes[0][1]\n    const keyEquivalences = Object.fromEntries(accessControlKeysToHashes.slice(1).map((hash) => [hash[1], canonicalKey]))\n    const encryptedDelegationInfo = await this.makeSecureDelegationEncryptedData(\n      exchangeDataInfo,\n      delegateId,\n      shareSecretIds,\n      shareEncryptionKeys,\n      shareOwningEntityIds\n    )\n    const delegation = new SecureDelegation({\n      delegator: encryptedDelegationInfo?.explicitDelegator,\n      delegate: encryptedDelegationInfo?.explicitDelegate,\n      secretIds: encryptedDelegationInfo?.secretIds,\n      encryptionKeys: encryptedDelegationInfo?.encryptionKeys,\n      owningEntityIds: encryptedDelegationInfo?.owningEntityIds,\n      parentDelegations: parentDelegationKey ? [parentDelegationKey] : undefined,\n      exchangeDataId: encryptedDelegationInfo?.exchangeDataId,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      permissions: permissions,\n    })\n    return {\n      canonicalDelegationKey: canonicalKey,\n      canonicalAccessControlKey: accessControlKeysToHashes[0][0],\n      delegation,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      delegationKeyEquivalences: keyEquivalences,\n    }\n  }\n\n  private async makeSecureDelegationEncryptedData(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<{\n    explicitDelegator?: string\n    explicitDelegate?: string\n    secretIds?: string[]\n    encryptionKeys?: string[]\n    owningEntityIds?: string[]\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string } // TODO if secure delegation info, check cache before calculating\n  }> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const exchangeDataIdInfo =\n      delegateId === selfId\n        ? this.makeExchangeDataIdInfoForSelf(selfId, exchangeDataInfo.exchangeData)\n        : await this.makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeDataInfo.exchangeData)\n    const encryptedSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(shareSecretIds, exchangeDataInfo.exchangeKey)\n    const encryptedEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(shareEncryptionKeys, exchangeDataInfo.exchangeKey)\n    const encryptedOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(shareOwningEntityIds, exchangeDataInfo.exchangeKey)\n    return {\n      ...exchangeDataIdInfo,\n      secretIds: encryptedSecretIds,\n      encryptionKeys: encryptedEncryptionKeys,\n      owningEntityIds: encryptedOwningEntityIds,\n    }\n  }\n\n  private async makeExchangeDataIdInfoForDelegate(\n    selfId: string,\n    delegateId: string,\n    exchangeData: ExchangeData\n  ): Promise<{\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  }> {\n    const delegateInfo = await this.getDataOwnerInfo(delegateId)\n    if (!delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        explicitDelegate: delegateId,\n        exchangeDataId: exchangeData.id,\n      }\n    } else if (delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(\n          exchangeData.id!,\n          Object.fromEntries(this.userKeys.getSelfVerifiedKeys().map((keyInfo) => [keyInfo.fingerprint, keyInfo.pair.publicKey]))\n        ),\n      }\n    } else if (!delegateInfo.requiresAnonymousDelegations && this.selfNeedsAnonymousDelegations) {\n      /**\n       * Important: this requires that the exchange data signature also validates the authenticity of the public keys included in there.\n       */\n      const fingerprintsOfVerifiedExchangeData = new Set(Object.keys(exchangeData.exchangeKey))\n      const delegateVerifiedKeys: { [fp: string]: CryptoKey } = {}\n      for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {\n        const currFp = fingerprintV2(keyHex)\n        const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? 'sha-1' : 'sha-256'\n        if (fingerprintsOfVerifiedExchangeData.has(currFp)) {\n          delegateVerifiedKeys[currFp] = await this.primitives.RSA.importKey('spki', hex2ua(keyHex), ['encrypt'], shaVersion)\n        }\n      }\n      if (!Object.keys(delegateVerifiedKeys).length)\n        throw new Error('Illegal state: could not find any verified key for delegate in verified exchange data.')\n      return {\n        explicitDelegate: delegateId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id!, delegateVerifiedKeys),\n      }\n    } else return {}\n  }\n\n  private makeExchangeDataIdInfoForSelf(\n    selfId: string,\n    exchangeData: ExchangeData\n  ): {\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  } {\n    if (this.selfNeedsAnonymousDelegations) {\n      return {}\n    } else {\n      return {\n        exchangeDataId: exchangeData.id,\n        explicitDelegator: selfId,\n        explicitDelegate: selfId,\n      }\n    }\n  }\n\n  private async getDataOwnerInfo(dataOwnerId: string) {\n    return this.dataOwnerInfoCache.get(dataOwnerId, async () => {\n      const dataOwnerWithType = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n      return {\n        item: {\n          requiresAnonymousDelegations: this.cryptoStrategies.dataOwnerRequiresAnonymousDelegation(dataOwnerWithType),\n          availablePublicKeysHexWithSha1: Array.from(hexPublicKeysWithSha1Of(dataOwnerWithType.stub)),\n          availablePublicKeysHexWithSha256: Array.from(hexPublicKeysWithSha256Of(dataOwnerWithType.stub)),\n        },\n      }\n    })\n  }\n\n  private getExistingCanonicalKeyAndSecureDelegation(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    hashes: string[]\n  ): { canonicalKey: string; secureDelegation: SecureDelegation } | undefined {\n    const securityMetadata = entity.securityMetadata ?? {}\n    const canonicalByEquivalences = Array.from(new Set(hashes.flatMap((hash) => securityMetadata.keysEquivalences?.[hash] ?? [])))\n    const directRetrievals = hashes.flatMap((hash) => {\n      const retrievedMetadata = securityMetadata.secureDelegations?.[hash]\n      return retrievedMetadata ? { canonicalKey: hash, secureDelegation: retrievedMetadata } : []\n    })\n    if (\n      directRetrievals.length > 1 ||\n      canonicalByEquivalences.length > 1 ||\n      (!!canonicalByEquivalences[0] && !!directRetrievals[0]?.canonicalKey && canonicalByEquivalences[0] !== directRetrievals[0]?.canonicalKey)\n    )\n      throw new Error('Illegal state: multiple secure delegations matching equivalent hashes of entity.')\n    const canonicalFromEquivalences = canonicalByEquivalences[0]\n    const retrievedFromEquivalences = securityMetadata.secureDelegations?.[canonicalFromEquivalences]\n    return (\n      directRetrievals[0] ??\n      (!!canonicalFromEquivalences && !!retrievedFromEquivalences\n        ? { canonicalKey: canonicalFromEquivalences, secureDelegation: retrievedFromEquivalences }\n        : undefined)\n    )\n  }\n}\n"]}

package/icc-x-api/crypto/ShamirKeysManager.js

@@ -70,7 +70,7 @@ class ShamirKeysManager {
             const delegatesKeys = {};
             let updatedSelf = self;
             for (const delegateId of new Set(Object.values(keySplitsToUpdate).flatMap((x) => x.notariesIds))) {
-                const res = yield this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, undefined, undefined);
+                const res = yield this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, undefined, undefined, false);
                 delegatesKeys[delegateId] = res.exchangeKey;
             }
             for (const [key, params] of Object.entries(keySplitsToUpdate)) {

package/icc-x-api/crypto/ShamirKeysManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ShamirKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ShamirKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,oCAAyC;AAEzC,yEAA6E;AAE7E;;GAEG;AACH,MAAa,iBAAiB;IAC5B,YACmB,UAA4B,EAC5B,YAA8B,EAC9B,qBAAgD,EAChD,mBAAwC;QAHxC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,0BAAqB,GAArB,qBAAqB,CAA2B;QAChD,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEJ;;;;;OAKG;IACH,qBAAqB,CAAC,SAA0B;;QAC9C,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,SAAS,CAAC,0BAA0B,mCAAI,EAAE,CAAC,CAAA;QACxF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE;YACvC,MAAM,EAAE,GAAG,MAAA,SAAS,CAAC,SAAS,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;YAC1C,IAAI,CAAC,EAAE,EAAE;gBACP,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAA;aAC5F;;gBAAM,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,wBAAwB,EAAE,CAAA;SACjD;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,iBAA+F,EAC/F,iBAA2B;;YAE3B,MAAM,IAAI,GAAG,yCAAuB,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAA;YACjG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACpF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACzD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAClF,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAA;YAC9D,IAAI,WAAW,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBACxI,MAAM,IAAI,KAAK,CAAC,gDAAgD,iBAAiB,wBAAwB,iBAAiB,EAAE,CAAC,CAAA;YAC/H,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;YACpG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnE,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;aAC/I;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACpD,MAAM,IAAI,KAAK,CAAC,6EAA6E,iBAAiB,EAAE,CAAC,CAAA;aAClH;YACD,MAAM,aAAa,GAAwC,EAAE,CAAA;YAC7D,IAAI,WAAW,GAAG,IAAI,CAAA;YACtB,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;gBAChG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;gBACxG,aAAa,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,WAAW,CAAA;aAC5C;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE;gBAC7D,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;aACnI;YACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE;gBAC/B,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;aACtD;YACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAA;QACnE,CAAC;KAAA;IAED;;OAEG;IAEK,oBAAoB,CAAC,GAAW,EAAE,MAAoD;QAC5F,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE;YACjC,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE;gBAChD,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,+DAA+D,MAAM,EAAE,CAAC,CAAA;aAC1H;SACF;;YAAM,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sCAAsC,MAAM,EAAE,CAAC,CAAA;IACzG,CAAC;IAEO,cAAc,CAAC,SAAkC,EAAE,KAAa;;QACtE,IAAI,KAAK,MAAK,MAAA,SAAS,CAAC,IAAI,CAAC,SAAS,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA,EAAE;YAClD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;SAChG;QACD,OAAO;YACL,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,0BAA0B,EAAE,EAAE,GAC/B;SACF,CAAA;IACH,CAAC;IAEa,cAAc,CAC1B,SAAkC,EAClC,KAAa,EACb,WAAqB,EACrB,SAAiB,EACjB,aAAyC,EACzC,OAA4C;;;YAE5C,IAAI,KAAK,MAAK,MAAA,SAAS,CAAC,IAAI,CAAC,SAAS,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA,EAAE;gBAClD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;aAChG;YACD,OAAO;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,0BAA0B,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,GAClH;aACF,CAAA;;KACF;IAEa,mBAAmB,CAC/B,OAA2B,EAC3B,WAAqB,EACrB,SAAiB,EACjB,aAAyC;;YAEzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACpF,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE;gBAC3B,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;aAC3E;iBAAM;gBACL,MAAM,eAAe,GAAG,IAAA,cAAM,EAAC,WAAW,CAAC,CAAA;gBAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBACjG,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,mEAAmE;gBAC/H,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE;oBACtC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;oBAC5I,IAAI,KAAK,KAAK,IAAA,cAAM,EAAC,IAAA,cAAM,EAAC,KAAK,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;iBACvG;gBACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAC7B,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,EACxC,WAAW,EACX,aAAa,CACd,CAAA;aACF;QACH,CAAC;KAAA;IAEa,aAAa,CACzB,MAAqB,EACrB,WAAqB,EACrB,aAAyC;;YAEzC,OAAO,WAAW,CAAC,MAAM,CACvB,CAAO,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;gBAAC,OAAA,iCAC7B,CAAC,MAAM,GAAG,CAAC,KACd,CAAC,UAAU,CAAC,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IACjG,CAAA;cAAA,EACF,OAAO,CAAC,OAAO,CAAC,EAAsC,CAAC,CACxD,CAAA;QACH,CAAC;KAAA;CACF;AAvJD,8CAuJC","sourcesContent":["import { DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { KeyPair } from './RSA'\nimport { hex2ua, ua2hex } from '../utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\n/**\n * Allows to create or update shamir split keys.\n */\nexport class ShamirKeysManager {\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly encryptionKeysManager: UserEncryptionKeysManager,\n    private readonly exchangeDataManager: ExchangeDataManager\n  ) {}\n\n  /**\n   * Get information on existing private keys splits for the provided data owner. For each private key of the provided data owner which has been\n   * split using the Shamir sharing algorithm gives the list of the notaries (other data owners) which hold a copy of the key part.\n   * @param dataOwner a data owner\n   * @return the existing splits for the current data owner as a publicKeyFingerprint -> notariesIds object\n   */\n  getExistingSplitsInfo(dataOwner: DataOwnerOrStub): { [keyPairFingerprint: string]: string[] } {\n    const legacyPartitionDelegates = Object.keys(dataOwner.privateKeyShamirPartitions ?? {})\n    if (legacyPartitionDelegates.length > 0) {\n      const fp = dataOwner.publicKey?.slice(-32)\n      if (!fp) {\n        console.error('Invalid data owner: the owner has legacy key partitions but no legacy key.')\n      } else return { [fp]: legacyPartitionDelegates }\n    }\n    return {}\n  }\n\n  /**\n   * Creates, updates or deletes shamir splits for keys of the current data owner. Any request to update the splits for a specific key will completely\n   * replace any existing data on that split (all previous notaries will be ignored).\n   * Note: currently you can only split the legacy key pair.\n   * @param keySplitsToUpdate the fingerprints of key pairs which will have updated/new splits and the details on how to create the updated splits.\n   * @param keySplitsToDelete the fingerprints or hex-encoded spki public keys which will not be shared anymore.\n   * @throws if the parameters refer to non-existing or unavailable keys, have split creation details, or if they request to delete a non-existing\n   * split.\n   */\n  async updateSelfSplits(\n    keySplitsToUpdate: { [publicKeyHexOrFp: string]: { notariesIds: string[]; minShares: number } },\n    keySplitsToDelete: string[]\n  ): Promise<CryptoActorStubWithType> {\n    const self = CryptoActorStubWithType.fromDataOwner(await this.dataOwnerApi.getCurrentDataOwner())\n    const toUpdateSet = new Set(Object.keys(keySplitsToUpdate).map((x) => x.slice(-32)))\n    const toDeleteSet = new Set(keySplitsToDelete.slice(-32))\n    const intersection = Array.from(toDeleteSet).filter((x) => toUpdateSet.has(x))\n    const existingSplits = new Set(Object.keys(this.getExistingSplitsInfo(self.stub)))\n    const allKeys = this.encryptionKeysManager.getDecryptionKeys()\n    if (toDeleteSet.size !== keySplitsToDelete.length || toUpdateSet.size !== Object.keys(keySplitsToUpdate).length || intersection.length > 0)\n      throw new Error(`Duplicate keys in input:\\nkeySplitsToUpdate: ${keySplitsToUpdate}\\nkeySplitsToDelete: ${keySplitsToDelete}`)\n    Object.entries(keySplitsToUpdate).forEach(([key, params]) => this.validateShamirParams(key, params))\n    if (!Array.from(existingSplits).every((x) => existingSplits.has(x))) {\n      throw new Error(`Requested to delete non-existing split.\\nexistingSplits: ${Array.from(existingSplits)}\\ntoDelete:${Array.from(toDeleteSet)}`)\n    }\n    if (Array.from(toUpdateSet).some((x) => !allKeys[x])) {\n      throw new Error(`Private key is not available for some of the requested key split updates. ${keySplitsToUpdate}`)\n    }\n    const delegatesKeys: { [delegateId: string]: CryptoKey } = {}\n    let updatedSelf = self\n    for (const delegateId of new Set(Object.values(keySplitsToUpdate).flatMap((x) => x.notariesIds))) {\n      const res = await this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, undefined, undefined)\n      delegatesKeys[delegateId] = res.exchangeKey\n    }\n    for (const [key, params] of Object.entries(keySplitsToUpdate)) {\n      updatedSelf = await this.updateKeySplit(updatedSelf, key.slice(-32), params.notariesIds, params.minShares, delegatesKeys, allKeys)\n    }\n    for (const keyFp of toDeleteSet) {\n      updatedSelf = this.deleteKeySplit(updatedSelf, keyFp)\n    }\n    return await this.dataOwnerApi.modifyCryptoActorStub(updatedSelf)\n  }\n\n  /*TODO\n   * Get suggested recovery keys: analyse transfer keys and shamir to get keys which should be shared with shamir for optimal recovery.\n   */\n\n  private validateShamirParams(key: string, params: { notariesIds: string[]; minShares: number }) {\n    if (params.notariesIds.length > 0) {\n      if (params.minShares > params.notariesIds.length) {\n        throw new Error(`Invalid parameters for key ${key}: min shares can't be greater than the number of delegates. ${params}`)\n      }\n    } else throw new Error(`Invalid parameters for key ${key}: must have at least one delegate. ${params}`)\n  }\n\n  private deleteKeySplit(dataOwner: CryptoActorStubWithType, keyFp: string): CryptoActorStubWithType {\n    if (keyFp !== dataOwner.stub.publicKey?.slice(-32)) {\n      throw new Error('Currently it is possible to use shamir splits only for the legacy public key')\n    }\n    return {\n      type: dataOwner.type,\n      stub: {\n        ...dataOwner.stub,\n        privateKeyShamirPartitions: {},\n      },\n    }\n  }\n\n  private async updateKeySplit(\n    dataOwner: CryptoActorStubWithType,\n    keyFp: string,\n    delegateIds: string[],\n    minShares: number,\n    delegatesKeys: { [p: string]: CryptoKey },\n    allKeys: { [p: string]: KeyPair<CryptoKey> }\n  ): Promise<CryptoActorStubWithType> {\n    if (keyFp !== dataOwner.stub.publicKey?.slice(-32)) {\n      throw new Error('Currently it is possible to use shamir splits only for the legacy public key')\n    }\n    return {\n      type: dataOwner.type,\n      stub: {\n        ...dataOwner.stub,\n        privateKeyShamirPartitions: await this.createPartitionsFor(allKeys[keyFp], delegateIds, minShares, delegatesKeys),\n      },\n    }\n  }\n\n  private async createPartitionsFor(\n    keyPair: KeyPair<CryptoKey>,\n    delegateIds: string[],\n    minShares: number,\n    delegatesKeys: { [p: string]: CryptoKey }\n  ): Promise<{ [delegateId: string]: string }> {\n    const exportedKey = await this.primitives.RSA.exportKey(keyPair.privateKey, 'pkcs8')\n    if (delegateIds.length == 1) {\n      return await this.encryptShares([exportedKey], delegateIds, delegatesKeys)\n    } else {\n      const exportedKeysHex = ua2hex(exportedKey)\n      const stringShares = this.primitives.shamir.share(exportedKeysHex, delegateIds.length, minShares)\n      const paddedStringShares = stringShares.map((x) => `f${x}`) // Shares are uneven length, apart from that they are perfect hexes\n      for (const share of paddedStringShares) {\n        if (!/^(?:[0-9a-f][0-9a-f])+$/g.test(share)) throw new Error('Unexpected result of shamir split: padded shares should be a valid hex value')\n        if (share !== ua2hex(hex2ua(share))) throw new Error('Unexpected result with encoding-decoding share')\n      }\n      return await this.encryptShares(\n        paddedStringShares.map((x) => hex2ua(x)),\n        delegateIds,\n        delegatesKeys\n      )\n    }\n  }\n\n  private async encryptShares(\n    shares: ArrayBuffer[],\n    delegateIds: string[],\n    delegatesKeys: { [p: string]: CryptoKey }\n  ): Promise<{ [delegateId: string]: string }> {\n    return delegateIds.reduce(\n      async (acc, delegateId, index) => ({\n        ...(await acc),\n        [delegateId]: ua2hex(await this.primitives.AES.encrypt(delegatesKeys[delegateId], shares[index])),\n      }),\n      Promise.resolve({} as { [delegateId: string]: string })\n    )\n  }\n}\n"]}
+{"version":3,"file":"ShamirKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ShamirKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,oCAAyC;AAEzC,yEAA6E;AAE7E;;GAEG;AACH,MAAa,iBAAiB;IAC5B,YACmB,UAA4B,EAC5B,YAA8B,EAC9B,qBAAgD,EAChD,mBAAwC;QAHxC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,0BAAqB,GAArB,qBAAqB,CAA2B;QAChD,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEJ;;;;;OAKG;IACH,qBAAqB,CAAC,SAA0B;;QAC9C,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,SAAS,CAAC,0BAA0B,mCAAI,EAAE,CAAC,CAAA;QACxF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE;YACvC,MAAM,EAAE,GAAG,MAAA,SAAS,CAAC,SAAS,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;YAC1C,IAAI,CAAC,EAAE,EAAE;gBACP,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAA;aAC5F;;gBAAM,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,wBAAwB,EAAE,CAAA;SACjD;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,iBAA+F,EAC/F,iBAA2B;;YAE3B,MAAM,IAAI,GAAG,yCAAuB,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAA;YACjG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACpF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACzD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAClF,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAA;YAC9D,IAAI,WAAW,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBACxI,MAAM,IAAI,KAAK,CAAC,gDAAgD,iBAAiB,wBAAwB,iBAAiB,EAAE,CAAC,CAAA;YAC/H,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;YACpG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnE,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;aAC/I;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACpD,MAAM,IAAI,KAAK,CAAC,6EAA6E,iBAAiB,EAAE,CAAC,CAAA;aAClH;YACD,MAAM,aAAa,GAAwC,EAAE,CAAA;YAC7D,IAAI,WAAW,GAAG,IAAI,CAAA;YACtB,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;gBAChG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;gBAC/G,aAAa,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,WAAW,CAAA;aAC5C;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE;gBAC7D,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;aACnI;YACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE;gBAC/B,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;aACtD;YACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAA;QACnE,CAAC;KAAA;IAED;;OAEG;IAEK,oBAAoB,CAAC,GAAW,EAAE,MAAoD;QAC5F,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE;YACjC,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE;gBAChD,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,+DAA+D,MAAM,EAAE,CAAC,CAAA;aAC1H;SACF;;YAAM,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sCAAsC,MAAM,EAAE,CAAC,CAAA;IACzG,CAAC;IAEO,cAAc,CAAC,SAAkC,EAAE,KAAa;;QACtE,IAAI,KAAK,MAAK,MAAA,SAAS,CAAC,IAAI,CAAC,SAAS,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA,EAAE;YAClD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;SAChG;QACD,OAAO;YACL,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,0BAA0B,EAAE,EAAE,GAC/B;SACF,CAAA;IACH,CAAC;IAEa,cAAc,CAC1B,SAAkC,EAClC,KAAa,EACb,WAAqB,EACrB,SAAiB,EACjB,aAAyC,EACzC,OAA4C;;;YAE5C,IAAI,KAAK,MAAK,MAAA,SAAS,CAAC,IAAI,CAAC,SAAS,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA,EAAE;gBAClD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;aAChG;YACD,OAAO;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,0BAA0B,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,GAClH;aACF,CAAA;;KACF;IAEa,mBAAmB,CAC/B,OAA2B,EAC3B,WAAqB,EACrB,SAAiB,EACjB,aAAyC;;YAEzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACpF,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE;gBAC3B,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;aAC3E;iBAAM;gBACL,MAAM,eAAe,GAAG,IAAA,cAAM,EAAC,WAAW,CAAC,CAAA;gBAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBACjG,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,mEAAmE;gBAC/H,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE;oBACtC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;oBAC5I,IAAI,KAAK,KAAK,IAAA,cAAM,EAAC,IAAA,cAAM,EAAC,KAAK,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;iBACvG;gBACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAC7B,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,EACxC,WAAW,EACX,aAAa,CACd,CAAA;aACF;QACH,CAAC;KAAA;IAEa,aAAa,CACzB,MAAqB,EACrB,WAAqB,EACrB,aAAyC;;YAEzC,OAAO,WAAW,CAAC,MAAM,CACvB,CAAO,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;gBAAC,OAAA,iCAC7B,CAAC,MAAM,GAAG,CAAC,KACd,CAAC,UAAU,CAAC,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IACjG,CAAA;cAAA,EACF,OAAO,CAAC,OAAO,CAAC,EAAsC,CAAC,CACxD,CAAA;QACH,CAAC;KAAA;CACF;AAvJD,8CAuJC","sourcesContent":["import { DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { KeyPair } from './RSA'\nimport { hex2ua, ua2hex } from '../utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\n/**\n * Allows to create or update shamir split keys.\n */\nexport class ShamirKeysManager {\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly encryptionKeysManager: UserEncryptionKeysManager,\n    private readonly exchangeDataManager: ExchangeDataManager\n  ) {}\n\n  /**\n   * Get information on existing private keys splits for the provided data owner. For each private key of the provided data owner which has been\n   * split using the Shamir sharing algorithm gives the list of the notaries (other data owners) which hold a copy of the key part.\n   * @param dataOwner a data owner\n   * @return the existing splits for the current data owner as a publicKeyFingerprint -> notariesIds object\n   */\n  getExistingSplitsInfo(dataOwner: DataOwnerOrStub): { [keyPairFingerprint: string]: string[] } {\n    const legacyPartitionDelegates = Object.keys(dataOwner.privateKeyShamirPartitions ?? {})\n    if (legacyPartitionDelegates.length > 0) {\n      const fp = dataOwner.publicKey?.slice(-32)\n      if (!fp) {\n        console.error('Invalid data owner: the owner has legacy key partitions but no legacy key.')\n      } else return { [fp]: legacyPartitionDelegates }\n    }\n    return {}\n  }\n\n  /**\n   * Creates, updates or deletes shamir splits for keys of the current data owner. Any request to update the splits for a specific key will completely\n   * replace any existing data on that split (all previous notaries will be ignored).\n   * Note: currently you can only split the legacy key pair.\n   * @param keySplitsToUpdate the fingerprints of key pairs which will have updated/new splits and the details on how to create the updated splits.\n   * @param keySplitsToDelete the fingerprints or hex-encoded spki public keys which will not be shared anymore.\n   * @throws if the parameters refer to non-existing or unavailable keys, have split creation details, or if they request to delete a non-existing\n   * split.\n   */\n  async updateSelfSplits(\n    keySplitsToUpdate: { [publicKeyHexOrFp: string]: { notariesIds: string[]; minShares: number } },\n    keySplitsToDelete: string[]\n  ): Promise<CryptoActorStubWithType> {\n    const self = CryptoActorStubWithType.fromDataOwner(await this.dataOwnerApi.getCurrentDataOwner())\n    const toUpdateSet = new Set(Object.keys(keySplitsToUpdate).map((x) => x.slice(-32)))\n    const toDeleteSet = new Set(keySplitsToDelete.slice(-32))\n    const intersection = Array.from(toDeleteSet).filter((x) => toUpdateSet.has(x))\n    const existingSplits = new Set(Object.keys(this.getExistingSplitsInfo(self.stub)))\n    const allKeys = this.encryptionKeysManager.getDecryptionKeys()\n    if (toDeleteSet.size !== keySplitsToDelete.length || toUpdateSet.size !== Object.keys(keySplitsToUpdate).length || intersection.length > 0)\n      throw new Error(`Duplicate keys in input:\\nkeySplitsToUpdate: ${keySplitsToUpdate}\\nkeySplitsToDelete: ${keySplitsToDelete}`)\n    Object.entries(keySplitsToUpdate).forEach(([key, params]) => this.validateShamirParams(key, params))\n    if (!Array.from(existingSplits).every((x) => existingSplits.has(x))) {\n      throw new Error(`Requested to delete non-existing split.\\nexistingSplits: ${Array.from(existingSplits)}\\ntoDelete:${Array.from(toDeleteSet)}`)\n    }\n    if (Array.from(toUpdateSet).some((x) => !allKeys[x])) {\n      throw new Error(`Private key is not available for some of the requested key split updates. ${keySplitsToUpdate}`)\n    }\n    const delegatesKeys: { [delegateId: string]: CryptoKey } = {}\n    let updatedSelf = self\n    for (const delegateId of new Set(Object.values(keySplitsToUpdate).flatMap((x) => x.notariesIds))) {\n      const res = await this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId, undefined, undefined, false)\n      delegatesKeys[delegateId] = res.exchangeKey\n    }\n    for (const [key, params] of Object.entries(keySplitsToUpdate)) {\n      updatedSelf = await this.updateKeySplit(updatedSelf, key.slice(-32), params.notariesIds, params.minShares, delegatesKeys, allKeys)\n    }\n    for (const keyFp of toDeleteSet) {\n      updatedSelf = this.deleteKeySplit(updatedSelf, keyFp)\n    }\n    return await this.dataOwnerApi.modifyCryptoActorStub(updatedSelf)\n  }\n\n  /*TODO\n   * Get suggested recovery keys: analyse transfer keys and shamir to get keys which should be shared with shamir for optimal recovery.\n   */\n\n  private validateShamirParams(key: string, params: { notariesIds: string[]; minShares: number }) {\n    if (params.notariesIds.length > 0) {\n      if (params.minShares > params.notariesIds.length) {\n        throw new Error(`Invalid parameters for key ${key}: min shares can't be greater than the number of delegates. ${params}`)\n      }\n    } else throw new Error(`Invalid parameters for key ${key}: must have at least one delegate. ${params}`)\n  }\n\n  private deleteKeySplit(dataOwner: CryptoActorStubWithType, keyFp: string): CryptoActorStubWithType {\n    if (keyFp !== dataOwner.stub.publicKey?.slice(-32)) {\n      throw new Error('Currently it is possible to use shamir splits only for the legacy public key')\n    }\n    return {\n      type: dataOwner.type,\n      stub: {\n        ...dataOwner.stub,\n        privateKeyShamirPartitions: {},\n      },\n    }\n  }\n\n  private async updateKeySplit(\n    dataOwner: CryptoActorStubWithType,\n    keyFp: string,\n    delegateIds: string[],\n    minShares: number,\n    delegatesKeys: { [p: string]: CryptoKey },\n    allKeys: { [p: string]: KeyPair<CryptoKey> }\n  ): Promise<CryptoActorStubWithType> {\n    if (keyFp !== dataOwner.stub.publicKey?.slice(-32)) {\n      throw new Error('Currently it is possible to use shamir splits only for the legacy public key')\n    }\n    return {\n      type: dataOwner.type,\n      stub: {\n        ...dataOwner.stub,\n        privateKeyShamirPartitions: await this.createPartitionsFor(allKeys[keyFp], delegateIds, minShares, delegatesKeys),\n      },\n    }\n  }\n\n  private async createPartitionsFor(\n    keyPair: KeyPair<CryptoKey>,\n    delegateIds: string[],\n    minShares: number,\n    delegatesKeys: { [p: string]: CryptoKey }\n  ): Promise<{ [delegateId: string]: string }> {\n    const exportedKey = await this.primitives.RSA.exportKey(keyPair.privateKey, 'pkcs8')\n    if (delegateIds.length == 1) {\n      return await this.encryptShares([exportedKey], delegateIds, delegatesKeys)\n    } else {\n      const exportedKeysHex = ua2hex(exportedKey)\n      const stringShares = this.primitives.shamir.share(exportedKeysHex, delegateIds.length, minShares)\n      const paddedStringShares = stringShares.map((x) => `f${x}`) // Shares are uneven length, apart from that they are perfect hexes\n      for (const share of paddedStringShares) {\n        if (!/^(?:[0-9a-f][0-9a-f])+$/g.test(share)) throw new Error('Unexpected result of shamir split: padded shares should be a valid hex value')\n        if (share !== ua2hex(hex2ua(share))) throw new Error('Unexpected result with encoding-decoding share')\n      }\n      return await this.encryptShares(\n        paddedStringShares.map((x) => hex2ua(x)),\n        delegateIds,\n        delegatesKeys\n      )\n    }\n  }\n\n  private async encryptShares(\n    shares: ArrayBuffer[],\n    delegateIds: string[],\n    delegatesKeys: { [p: string]: CryptoKey }\n  ): Promise<{ [delegateId: string]: string }> {\n    return delegateIds.reduce(\n      async (acc, delegateId, index) => ({\n        ...(await acc),\n        [delegateId]: ua2hex(await this.primitives.AES.encrypt(delegatesKeys[delegateId], shares[index])),\n      }),\n      Promise.resolve({} as { [delegateId: string]: string })\n    )\n  }\n}\n"]}

package/icc-x-api/crypto/UserEncryptionKeysManager.d.ts

@@ -4,6 +4,7 @@ import { IcureStorageFacade } from '../storage/IcureStorageFacade';
 import { CryptoPrimitives } from './CryptoPrimitives';
 import { KeyRecovery } from './KeyRecovery';
 import { CryptoStrategies } from './CryptoStrategies';
+import { KeyPairRecoverer } from './KeyPairRecoverer';
 /**
  * Allows to manage public and private keys for the current user and his parent hierarchy.
  */
@@ -14,10 +15,11 @@ export declare class UserEncryptionKeysManager {
     private readonly keyRecovery;
     private readonly strategies;
     private readonly initialiseParentKeys;
+    private readonly keypairRecoverer;
     private selfId;
     private selfLegacyPublicKey;
     private keysCache;
-    constructor(primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, icureStorage: IcureStorageFacade, keyRecovery: KeyRecovery, strategies: CryptoStrategies, initialiseParentKeys: boolean);
+    constructor(primitives: CryptoPrimitives, dataOwnerApi: IccDataOwnerXApi, icureStorage: IcureStorageFacade, keyRecovery: KeyRecovery, strategies: CryptoStrategies, initialiseParentKeys: boolean, keypairRecoverer: KeyPairRecoverer);
     /**
      * @internal
      * Get all key pairs available for the current data owner and his parents.
@@ -38,6 +40,7 @@ export declare class UserEncryptionKeysManager {
             dataOwnerId: string;
             keys: {
                 pair: KeyPair<CryptoKey>;
+                verified: boolean;
             }[];
         }[];
     }>;

package/icc-x-api/crypto/UserEncryptionKeysManager.js

@@ -18,13 +18,14 @@ const nothingKeyRecovererAndVerifier = (x) => Promise.resolve(x.reduce((acc, { d
  * Allows to manage public and private keys for the current user and his parent hierarchy.
  */
 class UserEncryptionKeysManager {
-    constructor(primitives, dataOwnerApi, icureStorage, keyRecovery, strategies, initialiseParentKeys) {
+    constructor(primitives, dataOwnerApi, icureStorage, keyRecovery, strategies, initialiseParentKeys, keypairRecoverer) {
         this.primitives = primitives;
         this.dataOwnerApi = dataOwnerApi;
         this.icureStorage = icureStorage;
         this.keyRecovery = keyRecovery;
         this.strategies = strategies;
         this.initialiseParentKeys = initialiseParentKeys;
+        this.keypairRecoverer = keypairRecoverer;
         this.keysCache = undefined;
     }
     /**
@@ -49,7 +50,7 @@ class UserEncryptionKeysManager {
                 },
                 parents: remainingHierarchy.map((x) => ({
                     dataOwnerId: x,
-                    keys: Object.values(this.keysCache[x]).map(({ pair }) => ({ pair })),
+                    keys: Object.values(this.keysCache[x]).map(({ pair, isVerified, isDevice }) => ({ pair, verified: isVerified || isDevice })),
                 })),
             };
         });
@@ -108,7 +109,7 @@ class UserEncryptionKeysManager {
      */
     initialiseKeys() {
         return __awaiter(this, void 0, void 0, function* () {
-            const newKey = yield this.doLoadKeys((x) => this.strategies.recoverAndVerifySelfHierarchyKeys(x, this.primitives), (x) => this.strategies.generateNewKeyForDataOwner(x, this.primitives));
+            const newKey = yield this.doLoadKeys((x) => this.strategies.recoverAndVerifySelfHierarchyKeys(x, this.primitives, this.keypairRecoverer), (x) => this.strategies.generateNewKeyForDataOwner(x, this.primitives));
             return newKey ? { newKeyPair: newKey.pair, newKeyFingerprint: newKey.fingerprint } : undefined;
         });
     }