@icure/api 8.0.0-RC.6 → 8.0.0

package/icc-x-api/icc-recovery-x-api.js

@@ -1,2 +1,219 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IccRecoveryXApi = exports.RecoveryDataUseFailureReason = void 0;
+const utils_1 = require("./utils");
+const RecoveryData_1 = require("../icc-api/model/internal/RecoveryData");
+var RecoveryDataEncryption_1 = require("./crypto/RecoveryDataEncryption");
+Object.defineProperty(exports, "RecoveryDataUseFailureReason", { enumerable: true, get: function () { return RecoveryDataEncryption_1.RecoveryDataUseFailureReason; } });
+class IccRecoveryXApi {
+    constructor(baseRecoveryApi, recoveryDataEncryption, keyManager, dataOwnerApi, primitives, exchangeData) {
+        this.baseRecoveryApi = baseRecoveryApi;
+        this.recoveryDataEncryption = recoveryDataEncryption;
+        this.keyManager = keyManager;
+        this.dataOwnerApi = dataOwnerApi;
+        this.primitives = primitives;
+        this.exchangeData = exchangeData;
+    }
+    /**
+     * Create recovery data for the logged user and stores it encrypted on the iCure server. This allows the user that created
+     * it to recover all the currently available keypairs at a later time by just providing the string returned by this method to the
+     * {@link recoverKeyPairs} method.
+     *
+     * You can also provide an expiration time for the recovery data (through `options.lifetimeSeconds`). If you do so, the recovery dat
+     * a will be deleted automatically after that amount seconds has passed. If you don't provide an expiration time, the recovery data
+     * will be available until it is explicitly deleted.
+     *
+     * This could be used to:
+     * - Provide some sort of one-use "recovery codes" to the user, which he can use to recover his keypair if he loses
+     *   his device. In this case you should not put any expiration time on the recovery data.
+     * - Provide a way for the user to easily "copy" the key from one device to another. In this case you should put a
+     *   short expiration time on the recovery data (a few minutes), so that it will automatically be deleted if it is
+     *   not used after all.
+     *
+     * # Important
+     *
+     * A malicious user that can login as the creator of the recovery data or that can access directly the database
+     * containing the recovery data will be able to get the private key of the data owner from the recovery key returned
+     * by this method. Therefore, the resulting recovery key must be kept secret, just like a private key.
+     *
+     * @param options optional parameters:
+     * - `includeParentsKeys` if true, the recovery data will also contain any available keypairs for parents data owners.
+     * - `lifetimeSeconds` the amount of seconds the recovery data will be available. If not provided, the recovery data will be available until it is
+     *   explicitly deleted.
+     * @return an hexadecimal string that is the `recoveryKey` which will allow the user to recover his keypair later or
+     * from another device. This value must be kept secret from other users. You can use this value with {@link recoverKeyPairs}
+     */
+    createRecoveryInfoForAvailableKeyPairs(options = {}) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const selfId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            const allAvailableKeys = yield this.keyManager.getCurrentUserHierarchyAvailableKeypairs();
+            let dataOwnersToInclude;
+            if (options.includeParentsKeys) {
+                dataOwnersToInclude = [allAvailableKeys.self, ...allAvailableKeys.parents];
+            }
+            else {
+                dataOwnersToInclude = [allAvailableKeys.self];
+            }
+            const keyPairsToSave = {};
+            for (const { dataOwnerId, keys } of dataOwnersToInclude) {
+                const dataOwner = yield this.dataOwnerApi.getDataOwner(dataOwnerId);
+                const sha1Keys = new Set(this.dataOwnerApi.getHexPublicKeysWithSha1Of(dataOwner.dataOwner));
+                const sha256Keys = new Set(this.dataOwnerApi.getHexPublicKeysWithSha256Of(dataOwner.dataOwner));
+                const pairs = [];
+                for (const { pair, verified } of keys) {
+                    if (verified) {
+                        const pubKeyHex = (0, utils_1.ua2hex)(yield this.primitives.RSA.exportKey(pair.publicKey, 'spki'));
+                        if (sha256Keys.has(pubKeyHex)) {
+                            pairs.push({ pair, algorithm: 'sha-256' });
+                        }
+                        else if (sha1Keys.has(pubKeyHex)) {
+                            pairs.push({ pair, algorithm: 'sha-1' });
+                        }
+                        else {
+                            console.warn(`Found stored key ${pubKeyHex} for data owner ${dataOwnerId} which is not saved in the data owner. Ignoring.`);
+                        }
+                    }
+                }
+                keyPairsToSave[dataOwnerId] = pairs;
+            }
+            return yield this.recoveryDataEncryption.createAndSaveKeyPairsRecoveryDataFor(selfId, keyPairsToSave, options.lifetimeSeconds);
+        });
+    }
+    /**
+     * Equivalent to {@link KeyPairRecoverer.recoverWithRecoveryKey}
+     */
+    recoverKeyPairs(recoveryKey, autoDelete) {
+        return this.recoveryDataEncryption.getAndDecryptKeyPairsRecoveryData(recoveryKey, autoDelete);
+    }
+    /**
+     * Create recovery data that allows the delegate {@link delegateId} recover the content of exchange data from the
+     * current data owner to the delegate.
+     *
+     * This can be useful in the following situations:
+     * - A user lost access to his old keypair and is asking for access back to his data. This is similar to the
+     *   give-access-back mechanism, except that instead of having to verify the public key of the delegate as in the
+     *   give-access-back, the delegator has to provide the recovery key to the delegate: the delegator has to properly
+     *   identify the delegate instead of validating that the public key belongs to the delegate.
+     * - A patient is not yet registered in the system and therefore has no keypair, but the doctor wants to already share
+     *   some data with them. The doctor can create some placeholder exchange data, encrypted only with his own key
+     *   through the {@link IccPatientXApi.forceInitialiseExchangeDataToNewlyInvitedPatient} method, then create recovery data
+     *   for it and share the recovery key with the patient. The moment the patient logs in and creates his keypair he
+     *   will use the {@link recoverExchangeData} method to "complete" the placeholder exchange data.
+     *
+     * @param delegateId id of the delegate that needs access to his exchange data from the current data owner. This can't
+     * be the id of the current data owner (you should instead recover the keypair).
+     * @param options optional parameters:
+     * - `lifetimeSeconds` the amount of seconds the recovery data will be available. If not provided, the recovery data will be available until it is
+     *   explicitly deleted.
+     * @return an hexadecimal string that is the `recoveryKey` which will allow the delegate to gain access to the exchange data.
+     * This value must be kept secret from users other than the current data owner and the delegate.
+     * You can use this value with {@link recoverExchangeData}
+     */
+    createExchangeDataRecoveryInfo(delegateId, options = {}) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const exchangeDataToDelegate = yield this.exchangeData.base.getExchangeDataByDelegatorDelegatePair(yield this.dataOwnerApi.getCurrentDataOwnerId(), delegateId);
+            const decryptionKeys = this.keyManager.getDecryptionKeys();
+            const decryptedInformation = [];
+            for (const exchangeData of exchangeDataToDelegate) {
+                const decryptedData = yield this.exchangeData.base.tryRawDecryptExchangeData(exchangeData, decryptionKeys);
+                if (decryptedData !== undefined) {
+                    decryptedInformation.push(Object.assign(Object.assign({}, decryptedData), { exchangeDataId: exchangeData.id }));
+                }
+            }
+            return this.recoveryDataEncryption.createAndSaveExchangeDataRecoveryData(delegateId, decryptedInformation, options.lifetimeSeconds);
+        });
+    }
+    /**
+     * Recover the content of exchange data from the delegator that created the recovery data at the provided.
+     * {@link recoveryKey} to the current delegate. This will enable the current user to access the exchange data with
+     * any of his private keys available on the device from which this method was called.
+     * The exchange data will be automatically deleted from the server after the process completes successfully.
+     *
+     * @param recoveryKey the result of a call to {@link createExchangeDataRecoveryInfo} by a delegator.
+     * @return null on success or a failure reason if the recovery data could not be used to perform the operation.
+     * @throws If the recovery data is valid but the process fails for other reasons.
+     */
+    recoverExchangeData(recoveryKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const selfEncryptionKeys = Object.fromEntries(this.keyManager.getSelfVerifiedKeys().map((k) => [k.fingerprint, k.pair.publicKey]));
+            const recoveredExchangeData = yield this.recoveryDataEncryption.getAndDecryptExchangeDataRecoveryData(recoveryKey);
+            if ('failure' in recoveredExchangeData) {
+                return recoveredExchangeData.failure;
+            }
+            for (const exchangeDataInfo of recoveredExchangeData.success) {
+                const retrievedData = yield this.exchangeData.base.getExchangeDataById(exchangeDataInfo.exchangeDataId);
+                if (!retrievedData) {
+                    console.warn(`Could not recover exchange data with id ${exchangeDataInfo.exchangeDataId} as it was not found. Ignoring`);
+                }
+                else {
+                    yield this.exchangeData.base.updateExchangeDataWithRawDecryptedContent(retrievedData, selfEncryptionKeys, exchangeDataInfo.rawExchangeKey, exchangeDataInfo.rawAccessControlSecret, exchangeDataInfo.rawSharedSignatureKey);
+                }
+            }
+            yield this.baseRecoveryApi.deleteRecoveryData(yield this.recoveryDataEncryption.recoveryKeyToId(recoveryKey)).catch((e) => {
+                console.warn(`Could not delete recovery data with id ${recoveryKey} after successful recovery: ${e}. Ignoring.`);
+            });
+            yield this.exchangeData.clearOrRepopulateCache();
+            return null;
+        });
+    }
+    /**
+     * Deletes the recovery information associated to a certain recovery key. You can use this method with the recovery key for any kind of data,
+     * regardless of how you obtained the recovery key (from the {@link createRecoveryInfoForAvailableKeyPairs} or from the
+     * {@link createExchangeDataRecoveryInfo} methods).
+     * If there is no data associated to the provided recovery key, this method will do nothing.
+     * @param recoveryKey the recovery key associated to the recovery information to delete.
+     */
+    deleteRecoveryInfo(recoveryKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.baseRecoveryApi.deleteRecoveryData(yield this.recoveryDataEncryption.recoveryKeyToId(recoveryKey));
+        });
+    }
+    /**
+     * Deletes the recovery information associated to a certain data owner, regardless of type.
+     * @param dataOwnerId the data owner for which to delete the recovery data.
+     * @return the number of deleted recovery information.
+     */
+    deleteAllRecoveryInfoFor(dataOwnerId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.getCountFromDeleteAllRes(yield this.baseRecoveryApi.deleteAllRecoveryDataForRecipient(dataOwnerId));
+        });
+    }
+    /**
+     * Deletes all key pair recovery information for a certain data owner.
+     * @param dataOwnerId the data owner for which to delete the key pair recovery information.
+     * @return the number of deleted key pair recovery information.
+     */
+    deleteAllKeyPairRecoveryInfoFor(dataOwnerId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.getCountFromDeleteAllRes(yield this.baseRecoveryApi.deleteAllRecoveryDataOfTypeForRecipient(RecoveryData_1.RecoveryData.Type.KEYPAIR_RECOVERY, dataOwnerId));
+        });
+    }
+    /**
+     * Deletes all exchange data recovery information for a certain data owner.
+     * @param dataOwnerId the data owner for which to delete the exchange data recovery information.
+     * @return the number of deleted exchange data recovery information.
+     */
+    deleteAllExchangeDataRecoveryInfoFor(dataOwnerId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.getCountFromDeleteAllRes(yield this.baseRecoveryApi.deleteAllRecoveryDataOfTypeForRecipient(RecoveryData_1.RecoveryData.Type.EXCHANGE_KEY_RECOVERY, dataOwnerId));
+        });
+    }
+    getCountFromDeleteAllRes(deleteAllRes) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (deleteAllRes.numberValue !== undefined)
+                return deleteAllRes.numberValue;
+            throw new Error(`Unexpected result from delete method: ${JSON.stringify(deleteAllRes)}`);
+        });
+    }
+}
+exports.IccRecoveryXApi = IccRecoveryXApi;
 //# sourceMappingURL=icc-recovery-x-api.js.map

package/icc-x-api/icc-recovery-x-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"icc-recovery-x-api.js","sourceRoot":"","sources":["../../icc-x-api/icc-recovery-x-api.ts"],"names":[],"mappings":"","sourcesContent":[""]}
+{"version":3,"file":"icc-recovery-x-api.js","sourceRoot":"","sources":["../../icc-x-api/icc-recovery-x-api.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,mCAAgC;AAEhC,yEAAqE;AAGrE,0EAA8E;AAArE,sIAAA,4BAA4B,OAAA;AAErC,MAAa,eAAe;IAC1B,YACmB,eAAmC,EACnC,sBAA8C,EAC9C,UAAqC,EACrC,YAA8B,EAC9B,UAA4B,EAC5B,YAAiC;QALjC,oBAAe,GAAf,eAAe,CAAoB;QACnC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,eAAU,GAAV,UAAU,CAA2B;QACrC,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAqB;IACjD,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,sCAAsC,CAAC,UAAsE,EAAE;;YACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wCAAwC,EAAE,CAAA;YACzF,IAAI,mBAAuG,CAAA;YAC3G,IAAI,OAAO,CAAC,kBAAkB,EAAE;gBAC9B,mBAAmB,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;aAC3E;iBAAM;gBACL,mBAAmB,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAA;aAC9C;YACD,MAAM,cAAc,GAAoF,EAAE,CAAA;YAC1G,KAAK,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,mBAAmB,EAAE;gBACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,CAAC,CAAA;gBACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAA;gBAC3F,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAA;gBAC/F,MAAM,KAAK,GAA0D,EAAE,CAAA;gBACvE,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;oBACrC,IAAI,QAAQ,EAAE;wBACZ,MAAM,SAAS,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;wBACrF,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;4BAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;yBAC3C;6BAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;4BAClC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;yBACzC;6BAAM;4BACL,OAAO,CAAC,IAAI,CAAC,oBAAoB,SAAS,mBAAmB,WAAW,kDAAkD,CAAC,CAAA;yBAC5H;qBACF;iBACF;gBACD,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;aACpC;YACD,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;QAChI,CAAC;KAAA;IAED;;OAEG;IACH,eAAe,CACb,WAAmB,EACnB,UAAmB;QAEnB,OAAO,IAAI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAC/F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,8BAA8B,CAAC,UAAkB,EAAE,UAAwC,EAAE;;YACjG,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,sCAAsC,CAChG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAC/C,UAAU,CACX,CAAA;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAA;YAC1D,MAAM,oBAAoB,GAKpB,EAAE,CAAA;YACR,KAAK,MAAM,YAAY,IAAI,sBAAsB,EAAE;gBACjD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;gBAC1G,IAAI,aAAa,KAAK,SAAS,EAAE;oBAC/B,oBAAoB,CAAC,IAAI,iCAAM,aAAa,KAAE,cAAc,EAAE,YAAY,CAAC,EAAG,IAAG,CAAA;iBAClF;aACF;YACD,OAAO,IAAI,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,UAAU,EAAE,oBAAoB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;QACrI,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,mBAAmB,CAAC,WAAmB;;YAC3C,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YAClI,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,WAAW,CAAC,CAAA;YAClH,IAAI,SAAS,IAAI,qBAAqB,EAAE;gBACtC,OAAO,qBAAqB,CAAC,OAAO,CAAA;aACrC;YACD,KAAK,MAAM,gBAAgB,IAAI,qBAAqB,CAAC,OAAO,EAAE;gBAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAA;gBACvG,IAAI,CAAC,aAAa,EAAE;oBAClB,OAAO,CAAC,IAAI,CAAC,2CAA2C,gBAAgB,CAAC,cAAc,gCAAgC,CAAC,CAAA;iBACzH;qBAAM;oBACL,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,yCAAyC,CACpE,aAAa,EACb,kBAAkB,EAClB,gBAAgB,CAAC,cAAc,EAC/B,gBAAgB,CAAC,sBAAsB,EACvC,gBAAgB,CAAC,qBAAqB,CACvC,CAAA;iBACF;aACF;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxH,OAAO,CAAC,IAAI,CAAC,0CAA0C,WAAW,+BAA+B,CAAC,aAAa,CAAC,CAAA;YAClH,CAAC,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;KAAA;IAED;;;;;;OAMG;IACG,kBAAkB,CAAC,WAAmB;;YAC1C,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;QAC/G,CAAC;KAAA;IAED;;;;OAIG;IACG,wBAAwB,CAAC,WAAmB;;YAChD,OAAO,IAAI,CAAC,wBAAwB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,iCAAiC,CAAC,WAAW,CAAC,CAAC,CAAA;QACjH,CAAC;KAAA;IAED;;;;OAIG;IACG,+BAA+B,CAAC,WAAmB;;YACvD,OAAO,IAAI,CAAC,wBAAwB,CAClC,MAAM,IAAI,CAAC,eAAe,CAAC,uCAAuC,CAAC,2BAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CACpH,CAAA;QACH,CAAC;KAAA;IAED;;;;OAIG;IACG,oCAAoC,CAAC,WAAmB;;YAC5D,OAAO,IAAI,CAAC,wBAAwB,CAClC,MAAM,IAAI,CAAC,eAAe,CAAC,uCAAuC,CAAC,2BAAY,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CACzH,CAAA;QACH,CAAC;KAAA;IAEa,wBAAwB,CAAC,YAAqB;;YAC1D,IAAI,YAAY,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,YAAY,CAAC,WAAW,CAAA;YAC3E,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAC1F,CAAC;KAAA;CACF;AAjND,0CAiNC","sourcesContent":["import { KeyPair, ShaVersion } from './crypto/RSA'\nimport { RecoveryDataEncryption, RecoveryDataUseFailureReason } from './crypto/RecoveryDataEncryption'\nimport { IccRecoveryDataApi } from '../icc-api/api/internal/IccRecoveryDataApi'\nimport { UserEncryptionKeysManager } from './crypto/UserEncryptionKeysManager'\nimport { IccDataOwnerXApi } from './icc-data-owner-x-api'\nimport { CryptoPrimitives } from './crypto/CryptoPrimitives'\nimport { ua2hex } from './utils'\nimport { Content } from '../icc-api/model/Content'\nimport { RecoveryData } from '../icc-api/model/internal/RecoveryData'\nimport { ExchangeDataManager } from './crypto/ExchangeDataManager'\n\nexport { RecoveryDataUseFailureReason } from './crypto/RecoveryDataEncryption'\n\nexport class IccRecoveryXApi {\n  constructor(\n    private readonly baseRecoveryApi: IccRecoveryDataApi,\n    private readonly recoveryDataEncryption: RecoveryDataEncryption,\n    private readonly keyManager: UserEncryptionKeysManager,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly primitives: CryptoPrimitives,\n    private readonly exchangeData: ExchangeDataManager\n  ) {}\n\n  /**\n   * Create recovery data for the logged user and stores it encrypted on the iCure server. This allows the user that created\n   * it to recover all the currently available keypairs at a later time by just providing the string returned by this method to the\n   * {@link recoverKeyPairs} method.\n   *\n   * You can also provide an expiration time for the recovery data (through `options.lifetimeSeconds`). If you do so, the recovery dat\n   * a will be deleted automatically after that amount seconds has passed. If you don't provide an expiration time, the recovery data\n   * will be available until it is explicitly deleted.\n   *\n   * This could be used to:\n   * - Provide some sort of one-use \"recovery codes\" to the user, which he can use to recover his keypair if he loses\n   *   his device. In this case you should not put any expiration time on the recovery data.\n   * - Provide a way for the user to easily \"copy\" the key from one device to another. In this case you should put a\n   *   short expiration time on the recovery data (a few minutes), so that it will automatically be deleted if it is\n   *   not used after all.\n   *\n   * # Important\n   *\n   * A malicious user that can login as the creator of the recovery data or that can access directly the database\n   * containing the recovery data will be able to get the private key of the data owner from the recovery key returned\n   * by this method. Therefore, the resulting recovery key must be kept secret, just like a private key.\n   *\n   * @param options optional parameters:\n   * - `includeParentsKeys` if true, the recovery data will also contain any available keypairs for parents data owners.\n   * - `lifetimeSeconds` the amount of seconds the recovery data will be available. If not provided, the recovery data will be available until it is\n   *   explicitly deleted.\n   * @return an hexadecimal string that is the `recoveryKey` which will allow the user to recover his keypair later or\n   * from another device. This value must be kept secret from other users. You can use this value with {@link recoverKeyPairs}\n   */\n  async createRecoveryInfoForAvailableKeyPairs(options: { includeParentsKeys?: boolean; lifetimeSeconds?: number } = {}): Promise<string> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const allAvailableKeys = await this.keyManager.getCurrentUserHierarchyAvailableKeypairs()\n    let dataOwnersToInclude: { dataOwnerId: string; keys: { pair: KeyPair<CryptoKey>; verified: boolean }[] }[]\n    if (options.includeParentsKeys) {\n      dataOwnersToInclude = [allAvailableKeys.self, ...allAvailableKeys.parents]\n    } else {\n      dataOwnersToInclude = [allAvailableKeys.self]\n    }\n    const keyPairsToSave: { [delegateId: string]: { pair: KeyPair<CryptoKey>; algorithm: ShaVersion }[] } = {}\n    for (const { dataOwnerId, keys } of dataOwnersToInclude) {\n      const dataOwner = await this.dataOwnerApi.getDataOwner(dataOwnerId)\n      const sha1Keys = new Set(this.dataOwnerApi.getHexPublicKeysWithSha1Of(dataOwner.dataOwner))\n      const sha256Keys = new Set(this.dataOwnerApi.getHexPublicKeysWithSha256Of(dataOwner.dataOwner))\n      const pairs: { pair: KeyPair<CryptoKey>; algorithm: ShaVersion }[] = []\n      for (const { pair, verified } of keys) {\n        if (verified) {\n          const pubKeyHex = ua2hex(await this.primitives.RSA.exportKey(pair.publicKey, 'spki'))\n          if (sha256Keys.has(pubKeyHex)) {\n            pairs.push({ pair, algorithm: 'sha-256' })\n          } else if (sha1Keys.has(pubKeyHex)) {\n            pairs.push({ pair, algorithm: 'sha-1' })\n          } else {\n            console.warn(`Found stored key ${pubKeyHex} for data owner ${dataOwnerId} which is not saved in the data owner. Ignoring.`)\n          }\n        }\n      }\n      keyPairsToSave[dataOwnerId] = pairs\n    }\n    return await this.recoveryDataEncryption.createAndSaveKeyPairsRecoveryDataFor(selfId, keyPairsToSave, options.lifetimeSeconds)\n  }\n\n  /**\n   * Equivalent to {@link KeyPairRecoverer.recoverWithRecoveryKey}\n   */\n  recoverKeyPairs(\n    recoveryKey: string,\n    autoDelete: boolean\n  ): Promise<{ success: { [dataOwnerId: string]: { [publicKeySpki: string]: KeyPair<CryptoKey> } } } | { failure: RecoveryDataUseFailureReason }> {\n    return this.recoveryDataEncryption.getAndDecryptKeyPairsRecoveryData(recoveryKey, autoDelete)\n  }\n\n  /**\n   * Create recovery data that allows the delegate {@link delegateId} recover the content of exchange data from the\n   * current data owner to the delegate.\n   *\n   * This can be useful in the following situations:\n   * - A user lost access to his old keypair and is asking for access back to his data. This is similar to the\n   *   give-access-back mechanism, except that instead of having to verify the public key of the delegate as in the\n   *   give-access-back, the delegator has to provide the recovery key to the delegate: the delegator has to properly\n   *   identify the delegate instead of validating that the public key belongs to the delegate.\n   * - A patient is not yet registered in the system and therefore has no keypair, but the doctor wants to already share\n   *   some data with them. The doctor can create some placeholder exchange data, encrypted only with his own key\n   *   through the {@link IccPatientXApi.forceInitialiseExchangeDataToNewlyInvitedPatient} method, then create recovery data\n   *   for it and share the recovery key with the patient. The moment the patient logs in and creates his keypair he\n   *   will use the {@link recoverExchangeData} method to \"complete\" the placeholder exchange data.\n   *\n   * @param delegateId id of the delegate that needs access to his exchange data from the current data owner. This can't\n   * be the id of the current data owner (you should instead recover the keypair).\n   * @param options optional parameters:\n   * - `lifetimeSeconds` the amount of seconds the recovery data will be available. If not provided, the recovery data will be available until it is\n   *   explicitly deleted.\n   * @return an hexadecimal string that is the `recoveryKey` which will allow the delegate to gain access to the exchange data.\n   * This value must be kept secret from users other than the current data owner and the delegate.\n   * You can use this value with {@link recoverExchangeData}\n   */\n  async createExchangeDataRecoveryInfo(delegateId: string, options: { lifetimeSeconds?: number } = {}): Promise<string> {\n    const exchangeDataToDelegate = await this.exchangeData.base.getExchangeDataByDelegatorDelegatePair(\n      await this.dataOwnerApi.getCurrentDataOwnerId(),\n      delegateId\n    )\n    const decryptionKeys = this.keyManager.getDecryptionKeys()\n    const decryptedInformation: {\n      exchangeDataId: string\n      rawExchangeKey: ArrayBuffer\n      rawAccessControlSecret: ArrayBuffer\n      rawSharedSignatureKey: ArrayBuffer\n    }[] = []\n    for (const exchangeData of exchangeDataToDelegate) {\n      const decryptedData = await this.exchangeData.base.tryRawDecryptExchangeData(exchangeData, decryptionKeys)\n      if (decryptedData !== undefined) {\n        decryptedInformation.push({ ...decryptedData, exchangeDataId: exchangeData.id! })\n      }\n    }\n    return this.recoveryDataEncryption.createAndSaveExchangeDataRecoveryData(delegateId, decryptedInformation, options.lifetimeSeconds)\n  }\n\n  /**\n   * Recover the content of exchange data from the delegator that created the recovery data at the provided.\n   * {@link recoveryKey} to the current delegate. This will enable the current user to access the exchange data with\n   * any of his private keys available on the device from which this method was called.\n   * The exchange data will be automatically deleted from the server after the process completes successfully.\n   *\n   * @param recoveryKey the result of a call to {@link createExchangeDataRecoveryInfo} by a delegator.\n   * @return null on success or a failure reason if the recovery data could not be used to perform the operation.\n   * @throws If the recovery data is valid but the process fails for other reasons.\n   */\n  async recoverExchangeData(recoveryKey: string): Promise<RecoveryDataUseFailureReason | null> {\n    const selfEncryptionKeys = Object.fromEntries(this.keyManager.getSelfVerifiedKeys().map((k) => [k.fingerprint, k.pair.publicKey]))\n    const recoveredExchangeData = await this.recoveryDataEncryption.getAndDecryptExchangeDataRecoveryData(recoveryKey)\n    if ('failure' in recoveredExchangeData) {\n      return recoveredExchangeData.failure\n    }\n    for (const exchangeDataInfo of recoveredExchangeData.success) {\n      const retrievedData = await this.exchangeData.base.getExchangeDataById(exchangeDataInfo.exchangeDataId)\n      if (!retrievedData) {\n        console.warn(`Could not recover exchange data with id ${exchangeDataInfo.exchangeDataId} as it was not found. Ignoring`)\n      } else {\n        await this.exchangeData.base.updateExchangeDataWithRawDecryptedContent(\n          retrievedData,\n          selfEncryptionKeys,\n          exchangeDataInfo.rawExchangeKey,\n          exchangeDataInfo.rawAccessControlSecret,\n          exchangeDataInfo.rawSharedSignatureKey\n        )\n      }\n    }\n    await this.baseRecoveryApi.deleteRecoveryData(await this.recoveryDataEncryption.recoveryKeyToId(recoveryKey)).catch((e) => {\n      console.warn(`Could not delete recovery data with id ${recoveryKey} after successful recovery: ${e}. Ignoring.`)\n    })\n    await this.exchangeData.clearOrRepopulateCache()\n    return null\n  }\n\n  /**\n   * Deletes the recovery information associated to a certain recovery key. You can use this method with the recovery key for any kind of data,\n   * regardless of how you obtained the recovery key (from the {@link createRecoveryInfoForAvailableKeyPairs} or from the\n   * {@link createExchangeDataRecoveryInfo} methods).\n   * If there is no data associated to the provided recovery key, this method will do nothing.\n   * @param recoveryKey the recovery key associated to the recovery information to delete.\n   */\n  async deleteRecoveryInfo(recoveryKey: string): Promise<void> {\n    await this.baseRecoveryApi.deleteRecoveryData(await this.recoveryDataEncryption.recoveryKeyToId(recoveryKey))\n  }\n\n  /**\n   * Deletes the recovery information associated to a certain data owner, regardless of type.\n   * @param dataOwnerId the data owner for which to delete the recovery data.\n   * @return the number of deleted recovery information.\n   */\n  async deleteAllRecoveryInfoFor(dataOwnerId: string): Promise<number> {\n    return this.getCountFromDeleteAllRes(await this.baseRecoveryApi.deleteAllRecoveryDataForRecipient(dataOwnerId))\n  }\n\n  /**\n   * Deletes all key pair recovery information for a certain data owner.\n   * @param dataOwnerId the data owner for which to delete the key pair recovery information.\n   * @return the number of deleted key pair recovery information.\n   */\n  async deleteAllKeyPairRecoveryInfoFor(dataOwnerId: string): Promise<number> {\n    return this.getCountFromDeleteAllRes(\n      await this.baseRecoveryApi.deleteAllRecoveryDataOfTypeForRecipient(RecoveryData.Type.KEYPAIR_RECOVERY, dataOwnerId)\n    )\n  }\n\n  /**\n   * Deletes all exchange data recovery information for a certain data owner.\n   * @param dataOwnerId the data owner for which to delete the exchange data recovery information.\n   * @return the number of deleted exchange data recovery information.\n   */\n  async deleteAllExchangeDataRecoveryInfoFor(dataOwnerId: string): Promise<number> {\n    return this.getCountFromDeleteAllRes(\n      await this.baseRecoveryApi.deleteAllRecoveryDataOfTypeForRecipient(RecoveryData.Type.EXCHANGE_KEY_RECOVERY, dataOwnerId)\n    )\n  }\n\n  private async getCountFromDeleteAllRes(deleteAllRes: Content): Promise<number> {\n    if (deleteAllRes.numberValue !== undefined) return deleteAllRes.numberValue\n    throw new Error(`Unexpected result from delete method: ${JSON.stringify(deleteAllRes)}`)\n  }\n}\n"]}

package/icc-x-api/icc-user-x-api.js

@@ -14,6 +14,7 @@ const IccUserApi_1 = require("../icc-api/api/IccUserApi");
 const AuthenticationProvider_1 = require("./auth/AuthenticationProvider");
 const Connection_1 = require("../icc-api/model/Connection");
 const utils_1 = require("./utils");
+const collection_utils_1 = require("./utils/collection-utils");
 class IccUserXApi extends IccUserApi_1.IccUserApi {
     constructor(host, headers, authenticationProvider = new AuthenticationProvider_1.NoAuthenticationProvider(), authApi, fetchImpl = typeof window !== 'undefined'
         ? window.fetch
@@ -33,12 +34,24 @@ class IccUserXApi extends IccUserApi_1.IccUserApi {
     }
     modifyUser(body) {
         const _super = Object.create(null, {
-            modifyUser: { get: () => super.modifyUser }
+            modifyUser: { get: () => super.modifyUser },
+            getCurrentUser: { get: () => super.getCurrentUser }
         });
         return __awaiter(this, void 0, void 0, function* () {
+            //If we do not load the current user, we cannot know if the modification is on the current user
+            yield this.getCurrentUser();
             if (this.cachedCurrentUser && (yield this.cachedCurrentUser).id === (body === null || body === void 0 ? void 0 : body.id)) {
                 try {
-                    const modifiedUser = yield _super.modifyUser.call(this, body);
+                    const modifiedUser = yield _super.modifyUser.call(this, body).catch((e) => __awaiter(this, void 0, void 0, function* () {
+                        //It is
+                        if (e.statusCode === 409) {
+                            let userInDb = yield _super.getCurrentUser.call(this);
+                            if ((0, collection_utils_1.objectEquals)((yield this.cachedCurrentUser), userInDb, ['authenticationTokens', 'rev'])) {
+                                return yield _super.modifyUser.call(this, Object.assign(Object.assign({}, body), { rev: userInDb.rev, authenticationTokens: userInDb.authenticationTokens }));
+                            }
+                        }
+                        throw e;
+                    }));
                     this.cachedCurrentUser = Promise.resolve(modifiedUser);
                     return modifiedUser;
                 }

package/icc-x-api/icc-user-x-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"icc-user-x-api.js","sourceRoot":"","sources":["../../icc-x-api/icc-user-x-api.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0DAAsD;AACtD,0EAAgG;AAGhG,4DAAwE;AACxE,mCAAsE;AAGtE,MAAa,WAAY,SAAQ,uBAAU;IAIzC,YACE,IAAY,EACZ,OAAkC,EAClC,yBAAiD,IAAI,iDAAwB,EAAE,EAC9D,OAAmB,EACpC,YAA2E,OAAO,MAAM,KAAK,WAAW;QACtG,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,KAAK;QAET,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAA;QAPtC,YAAO,GAAP,OAAO,CAAY;QAQpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAED,cAAc,CAAC,cAAuB,KAAK;;QACzC,IAAI,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,CAAA;;YACpE,OAAO,MAAA,IAAI,CAAC,iBAAiB,mCAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,CAAA;IACzF,CAAC;IAEK,UAAU,CAAC,IAAW;;;;;YAC1B,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAK,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE;gBAC5E,IAAI;oBACF,MAAM,YAAY,GAAG,MAAM,OAAM,UAAU,YAAC,IAAI,CAAC,CAAA;oBACjD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;oBACtD,OAAO,YAAY,CAAA;iBACpB;gBAAC,OAAO,CAAC,EAAE;oBACV,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAA;oBAClC,MAAM,CAAC,CAAA;iBACR;aACF;;gBAAM,OAAO,OAAM,UAAU,YAAC,IAAI,EAAC;QACtC,CAAC;KAAA;IAEK,qBAAqB,CACzB,UAA8C,EAC9C,MAAwC,EACxC,UAAyC,EACzC,UAA+B,EAAE;;YAEjC,MAAM,EAAE,GAAG,MAAM,IAAA,+BAAuB,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAClH,OAAO,IAAI,2BAAc,CAAC,EAAE,CAAC,CAAA;QAC/B,CAAC;KAAA;CACF;AA9CD,kCA8CC","sourcesContent":["import { IccUserApi } from '../icc-api/api/IccUserApi'\nimport { AuthenticationProvider, NoAuthenticationProvider } from './auth/AuthenticationProvider'\nimport { AbstractFilter } from './filters/filters'\nimport { User } from '../icc-api/model/User'\nimport { Connection, ConnectionImpl } from '../icc-api/model/Connection'\nimport { subscribeToEntityEvents , SubscriptionOptions} from './utils'\nimport { IccAuthApi } from '../icc-api'\n\nexport class IccUserXApi extends IccUserApi {\n  fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response>\n  private cachedCurrentUser: Promise<User> | undefined\n\n  constructor(\n    host: string,\n    headers: { [key: string]: string },\n    authenticationProvider: AuthenticationProvider = new NoAuthenticationProvider(),\n    private readonly authApi: IccAuthApi,\n    fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response> = typeof window !== 'undefined'\n      ? window.fetch\n      : typeof self !== 'undefined'\n      ? self.fetch\n      : fetch\n  ) {\n    super(host, headers, authenticationProvider, fetchImpl)\n    this.fetchImpl = fetchImpl\n  }\n\n  getCurrentUser(bypassCache: boolean = false): Promise<User> {\n    if (bypassCache) return (this.cachedCurrentUser = super.getCurrentUser())\n    else return this.cachedCurrentUser ?? (this.cachedCurrentUser = super.getCurrentUser())\n  }\n\n  async modifyUser(body?: User): Promise<User> {\n    if (this.cachedCurrentUser && (await this.cachedCurrentUser).id === body?.id) {\n      try {\n        const modifiedUser = await super.modifyUser(body)\n        this.cachedCurrentUser = Promise.resolve(modifiedUser)\n        return modifiedUser\n      } catch (e) {\n        this.cachedCurrentUser = undefined\n        throw e\n      }\n    } else return super.modifyUser(body)\n  }\n\n  async subscribeToUserEvents(\n    eventTypes: ('CREATE' | 'UPDATE' | 'DELETE')[],\n    filter: AbstractFilter<User> | undefined,\n    eventFired: (user: User) => Promise<void>,\n    options: SubscriptionOptions = {}\n  ): Promise<Connection> {\n    const rs = await subscribeToEntityEvents(this.host, this.authApi, 'User', eventTypes, filter, eventFired, options)\n    return new ConnectionImpl(rs)\n  }\n}\n"]}
+{"version":3,"file":"icc-user-x-api.js","sourceRoot":"","sources":["../../icc-x-api/icc-user-x-api.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0DAAsD;AACtD,0EAAgG;AAGhG,4DAAwE;AACxE,mCAAsE;AAEtE,+DAAuD;AAEvD,MAAa,WAAY,SAAQ,uBAAU;IAIzC,YACE,IAAY,EACZ,OAAkC,EAClC,yBAAiD,IAAI,iDAAwB,EAAE,EAC9D,OAAmB,EACpC,YAA2E,OAAO,MAAM,KAAK,WAAW;QACtG,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,KAAK;QAET,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAA;QAPtC,YAAO,GAAP,OAAO,CAAY;QAQpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAED,cAAc,CAAC,cAAuB,KAAK;;QACzC,IAAI,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,CAAA;;YACpE,OAAO,MAAA,IAAI,CAAC,iBAAiB,mCAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,CAAA;IACzF,CAAC;IAEK,UAAU,CAAC,IAAW;;;;;;YAC1B,+FAA+F;YAC/F,MAAM,IAAI,CAAC,cAAc,EAAE,CAAA;YAC3B,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAK,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE;gBAC5E,IAAI;oBACF,MAAM,YAAY,GAAG,MAAM,OAAM,UAAU,YAAC,IAAI,EAAE,KAAK,CAAC,CAAO,CAAC,EAAE,EAAE;wBAClE,OAAO;wBACP,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;4BACxB,IAAI,QAAQ,GAAG,MAAM,OAAM,cAAc,WAAE,CAAA;4BAC3C,IAAI,IAAA,+BAAY,EAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAE,EAAE,QAAQ,EAAE,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,EAAE;gCAC5F,OAAO,MAAM,OAAM,UAAU,4CAAM,IAAI,KAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,IAAG,CAAA;6BACnH;yBACF;wBACD,MAAM,CAAC,CAAA;oBACT,CAAC,CAAA,CAAC,CAAA;oBACF,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;oBACtD,OAAO,YAAY,CAAA;iBACpB;gBAAC,OAAO,CAAC,EAAE;oBACV,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAA;oBAClC,MAAM,CAAC,CAAA;iBACR;aACF;;gBAAM,OAAO,OAAM,UAAU,YAAC,IAAI,EAAC;QACtC,CAAC;KAAA;IAEK,qBAAqB,CACzB,UAA8C,EAC9C,MAAwC,EACxC,UAAyC,EACzC,UAA+B,EAAE;;YAEjC,MAAM,EAAE,GAAG,MAAM,IAAA,+BAAuB,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAClH,OAAO,IAAI,2BAAc,CAAC,EAAE,CAAC,CAAA;QAC/B,CAAC;KAAA;CACF;AAzDD,kCAyDC","sourcesContent":["import { IccUserApi } from '../icc-api/api/IccUserApi'\nimport { AuthenticationProvider, NoAuthenticationProvider } from './auth/AuthenticationProvider'\nimport { AbstractFilter } from './filters/filters'\nimport { User } from '../icc-api/model/User'\nimport { Connection, ConnectionImpl } from '../icc-api/model/Connection'\nimport { subscribeToEntityEvents, SubscriptionOptions } from './utils'\nimport { IccAuthApi } from '../icc-api'\nimport { objectEquals } from './utils/collection-utils'\n\nexport class IccUserXApi extends IccUserApi {\n  fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response>\n  private cachedCurrentUser: Promise<User> | undefined\n\n  constructor(\n    host: string,\n    headers: { [key: string]: string },\n    authenticationProvider: AuthenticationProvider = new NoAuthenticationProvider(),\n    private readonly authApi: IccAuthApi,\n    fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response> = typeof window !== 'undefined'\n      ? window.fetch\n      : typeof self !== 'undefined'\n      ? self.fetch\n      : fetch\n  ) {\n    super(host, headers, authenticationProvider, fetchImpl)\n    this.fetchImpl = fetchImpl\n  }\n\n  getCurrentUser(bypassCache: boolean = false): Promise<User> {\n    if (bypassCache) return (this.cachedCurrentUser = super.getCurrentUser())\n    else return this.cachedCurrentUser ?? (this.cachedCurrentUser = super.getCurrentUser())\n  }\n\n  async modifyUser(body?: User): Promise<User> {\n    //If we do not load the current user, we cannot know if the modification is on the current user\n    await this.getCurrentUser()\n    if (this.cachedCurrentUser && (await this.cachedCurrentUser).id === body?.id) {\n      try {\n        const modifiedUser = await super.modifyUser(body).catch(async (e) => {\n          //It is\n          if (e.statusCode === 409) {\n            let userInDb = await super.getCurrentUser()\n            if (objectEquals((await this.cachedCurrentUser)!, userInDb, ['authenticationTokens', 'rev'])) {\n              return await super.modifyUser({ ...body, rev: userInDb.rev, authenticationTokens: userInDb.authenticationTokens })\n            }\n          }\n          throw e\n        })\n        this.cachedCurrentUser = Promise.resolve(modifiedUser)\n        return modifiedUser\n      } catch (e) {\n        this.cachedCurrentUser = undefined\n        throw e\n      }\n    } else return super.modifyUser(body)\n  }\n\n  async subscribeToUserEvents(\n    eventTypes: ('CREATE' | 'UPDATE' | 'DELETE')[],\n    filter: AbstractFilter<User> | undefined,\n    eventFired: (user: User) => Promise<void>,\n    options: SubscriptionOptions = {}\n  ): Promise<Connection> {\n    const rs = await subscribeToEntityEvents(this.host, this.authApi, 'User', eventTypes, filter, eventFired, options)\n    return new ConnectionImpl(rs)\n  }\n}\n"]}

package/icc-x-api/index.d.ts

@@ -1,4 +1,4 @@
-import { IccAgendaApi, IccAnonymousAccessApi, IccApplicationsettingsApi, IccArticleApi, IccAuthApi, IccBeefactApi, IccBeresultexportApi, IccBeresultimportApi, IccBesamv2Api, IccCalendarItemTypeApi, IccClassificationTemplateApi, IccEntityrefApi, IccEntitytemplateApi, IccFrontendmigrationApi, IccGroupApi, IccIcureApi, IccInsuranceApi, IccKeywordApi, IccMedexApi, IccMedicallocationApi, IccPermissionApi, IccPlaceApi, IccPubsubApi, IccReplicationApi, IccTarificationApi, IccTmpApi } from '../icc-api';
+import { IccAgendaApi, IccAnonymousAccessApi, IccApplicationsettingsApi, IccArticleApi, IccAuthApi, IccBeefactApi, IccBeresultexportApi, IccBeresultimportApi, IccBesamv2Api, IccCalendarItemTypeApi, IccClassificationTemplateApi, IccEntityrefApi, IccEntitytemplateApi, IccFrontendmigrationApi, IccGroupApi, IccIcureApi, IccInsuranceApi, IccKeywordApi, IccMedexApi, IccMedicallocationApi, IccPermissionApi, IccPlaceApi, IccPubsubApi, IccReplicationApi, IccTarificationApi, IccTmpApi, OAuthThirdParty } from '../icc-api';
 import { IccUserXApi } from './icc-user-x-api';
 import { IccCryptoXApi } from './icc-crypto-x-api';
 import { IccContactXApi } from './icc-contact-x-api';
@@ -29,6 +29,8 @@ import { IccDoctemplateXApi } from './icc-doctemplate-x-api';
 import { UserGroup } from '../icc-api/model/UserGroup';
 import { IccTopicXApi } from './icc-topic-x-api';
 import { IccRoleApi } from '../icc-api/api/IccRoleApi';
+import { AuthSecretProvider } from './auth/SmartAuthProvider';
+import { IccRecoveryXApi } from './icc-recovery-x-api';
 export * from './icc-accesslog-x-api';
 export * from './icc-bekmehr-x-api';
 export * from './icc-calendar-item-x-api';
@@ -113,6 +115,7 @@ export interface Apis extends BasicApis {
     readonly tmpApi: IccTmpApi;
     readonly topicApi: IccTopicXApi;
     readonly roleApi: IccRoleApi;
+    readonly recoveryApi: IccRecoveryXApi;
 }
 /**
  * Allows to customise the behaviour of the iCure API by providing various optional parameters.
@@ -352,6 +355,44 @@ export type AuthenticationDetails = {
     thirdPartyTokens: {
         [thirdParty: string]: string;
     };
+} | SmartAuthenticationDetails;
+/**
+ * Allows to perform authentication through an {@link AuthSecretProvider}.
+ *
+ * The iCure SDK can authenticate to the backend using different kinds of secrets, such as passwords, long-lived authentication tokens, and
+ * short-lived authentication tokens generated through the message gateway. iCure associates to each kind of secret a certain security level, and for
+ * some sensitive operations, depending on the configurations of the user and his group, some operations may require a secret of a certain security
+ * level. For example, with the default configurations, in order to change his own email the user can't have logged in with a long-lived token, but he
+ * needs to provide his current password or a short-lived token.
+ *
+ * By using this authentication option, the iCure SDK will automatically request and cache the secret from the {@link AuthSecretProvider} only when
+ * needed, which should help to minimise the interaction with the user.
+ *
+ * Another advantage of using this authentication option over others is that in case all the cached tokens and secrets were to expire while performing
+ * a request, instead of having the request fail the SDK will ask for a new secret from the {@link SmartAuthProvider} and the request will
+ * automatically be retried with the new secret.
+ *
+ * You must provide the following information:
+ * - username: any kind of value that can identify the user (userId, groupId/userId, username, email, ...). More generic identifiers, valid
+ *   on multiple groups, allow for simpler group switching by using {@link IcureApi.switchGroup}.
+ * - secretProvider: the secret provider to use for authentication. Will handle interaction with the gui.
+ *
+ * You can also provide the following optional information, which may allow to reduce the requests for secrets initially:
+ * - initialSecret: an initial secret (password, token, ...) that will be used to get new authentication tokens as needed. If it is expired it will be ignored.
+ * - initialAuthToken: an initial authentication token used on each request. If it is expired it will be ignored.
+ * - initialRefreshToken: an initial refresh token used to get new authentication tokens as needed. If it is expired it will be ignored.
+ */
+export type SmartAuthenticationDetails = {
+    username: string;
+    secretProvider: AuthSecretProvider;
+    initialSecret?: {
+        plainSecret: string;
+    } | {
+        oauthToken: string;
+        oauthType: OAuthThirdParty;
+    };
+    initialAuthToken?: string;
+    initialRefreshToken?: string;
 };
 /**
  * Main entry point for the iCure API. Provides entity-specific sub-apis and some general methods which are not related to a specific entity.
@@ -361,9 +402,12 @@ export interface IcureApi extends Apis {
      * Get the information on groups that the current user can access and the current group that this api instance is working on.
      * Note that the values you will get for `availableGroups` may differ from the values you would get if you call {@link IccUserApi.getMatchingUsers}
      * on {@link Apis.userApi}, since the latter is specialised on the specific instance of the user in `currentGroup`.
+     * - `currentGroup`: the group that this api instance is working on, or undefined if the backend environment is not multi-group.
+     * - `availableGroups`: the list of groups that the current user can access with the provided secret. Empty if the backend environment is not
+     * multi-group.
      */
     getGroupsInfo(): Promise<{
-        currentGroup: UserGroup;
+        currentGroup: UserGroup | undefined;
         availableGroups: UserGroup[];
     }>;
     /**

package/icc-x-api/index.js

@@ -79,6 +79,11 @@ const IccRoleApi_1 = require("../icc-api/api/IccRoleApi");
 const DataOwnerTypeEnum_1 = require("../icc-api/model/DataOwnerTypeEnum");
 const DelegationsDeAnonymization_1 = require("./crypto/DelegationsDeAnonymization");
 const JwtBridgedAuthService_1 = require("./auth/JwtBridgedAuthService");
+const SmartAuthProvider_1 = require("./auth/SmartAuthProvider");
+const KeyPairRecoverer_1 = require("./crypto/KeyPairRecoverer");
+const IccRecoveryDataApi_1 = require("../icc-api/api/internal/IccRecoveryDataApi");
+const RecoveryDataEncryption_1 = require("./crypto/RecoveryDataEncryption");
+const icc_recovery_x_api_1 = require("./icc-recovery-x-api");
 __exportStar(require("./icc-accesslog-x-api"), exports);
 __exportStar(require("./icc-bekmehr-x-api"), exports);
 __exportStar(require("./icc-calendar-item-x-api"), exports);
@@ -156,17 +161,24 @@ var IcureApi;
         : typeof self !== 'undefined'
             ? self.fetch
             : fetch, options = {}) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             const params = new IcureApiOptions.WithDefaults(options);
             let grouplessAuthenticationProvider = yield getAuthenticationProvider(host, authenticationOptions, params.headers, fetchImpl);
+            // TODO if this uses a smart auth provider the groupless auth provider does not share the secret cache with the group specific one.
             const grouplessUserApi = new icc_api_1.IccUserApi(host, params.headers, grouplessAuthenticationProvider, fetchImpl);
-            const matches = yield grouplessUserApi.getMatchingUsers();
-            const chosenGroupId = matches.length > 1 ? yield params.groupSelector(matches) : matches[0].groupId;
+            const matches = yield getMatchesOrEmpty(grouplessUserApi);
+            const chosenGroupId = matches.length > 1 && !!options.groupSelector ? yield options.groupSelector(matches) : (_a = matches[0]) === null || _a === void 0 ? void 0 : _a.groupId;
+            const groupSpecificAuthenticationProviderInfo = matches.length > 1 && chosenGroupId
+                ? yield grouplessAuthenticationProvider.switchGroup(chosenGroupId, matches)
+                : { switchedProvider: grouplessAuthenticationProvider, isGroupLocked: false };
             /*TODO
              * On new very new users switching the authentication provider to a specific group may fail and block the user for too many requests. This is
              * probably linked to replication of the user in the fallback database.
              */
-            const groupSpecificAuthenticationProvider = matches.length > 1 ? yield grouplessAuthenticationProvider.switchGroup(chosenGroupId, matches) : grouplessAuthenticationProvider;
+            const groupSpecificAuthenticationProvider = matches.length > 1 && chosenGroupId
+                ? yield grouplessAuthenticationProvider.switchGroup(chosenGroupId, matches)
+                : grouplessAuthenticationProvider;
             const cryptoInitInfo = yield initialiseCryptoWithProvider(host, fetchImpl, groupSpecificAuthenticationProvider, params, cryptoStrategies, crypto);
             return new IcureApiImpl(cryptoInitInfo, host, groupSpecificAuthenticationProvider, fetch, grouplessUserApi, matches, matches.find((match) => match.groupId === chosenGroupId), params, cryptoStrategies);
         });
@@ -177,13 +189,7 @@ function getAuthenticationProvider(host, authenticationOptions, headers, fetchIm
     return __awaiter(this, void 0, void 0, function* () {
         let authenticationProvider;
         if ('getIcureTokens' in authenticationOptions && 'switchGroup' in authenticationOptions && 'getAuthService' in authenticationOptions) {
-            const tokens = yield authenticationOptions.getIcureTokens();
-            if (!!tokens && !!tokens.token && !!tokens.refreshToken) {
-                authenticationProvider = new AuthenticationProvider_1.JwtAuthenticationProvider(new icc_api_1.IccAuthApi(host, headers, new AuthenticationProvider_1.NoAuthenticationProvider(), fetchImpl), undefined, undefined, undefined, tokens);
-            }
-            else {
-                authenticationProvider = authenticationOptions;
-            }
+            authenticationProvider = authenticationOptions;
         }
         else if ('icureTokens' in authenticationOptions && !!authenticationOptions.icureTokens) {
             authenticationProvider = new AuthenticationProvider_1.JwtAuthenticationProvider(new icc_api_1.IccAuthApi(host, headers, new AuthenticationProvider_1.NoAuthenticationProvider(), fetchImpl), undefined, undefined, undefined, authenticationOptions.icureTokens);
@@ -197,6 +203,13 @@ function getAuthenticationProvider(host, authenticationOptions, headers, fetchIm
         else if ('thirdPartyTokens' in authenticationOptions && !!authenticationOptions.thirdPartyTokens) {
             authenticationProvider = new AuthenticationProvider_1.JwtAuthenticationProvider(new icc_api_1.IccAuthApi(host, headers, new AuthenticationProvider_1.NoAuthenticationProvider(), fetchImpl), undefined, undefined, new JwtBridgedAuthService_1.JwtBridgedAuthService(new icc_api_1.IccAuthApi(host, headers, new AuthenticationProvider_1.NoAuthenticationProvider(), fetchImpl), undefined, undefined, authenticationOptions.thirdPartyTokens));
         }
+        else if ('username' in authenticationOptions && 'secretProvider' in authenticationOptions) {
+            authenticationProvider = SmartAuthProvider_1.SmartAuthProvider.initialise(new icc_api_1.IccAuthApi(host, headers, new AuthenticationProvider_1.NoAuthenticationProvider(), fetchImpl), authenticationOptions.username, authenticationOptions.secretProvider, {
+                initialSecret: authenticationOptions.initialSecret,
+                initialAuthToken: authenticationOptions.initialAuthToken,
+                initialRefreshToken: authenticationOptions.initialRefreshToken,
+            });
+        }
         else {
             throw new Error('Invalid authentication options provided');
         }
@@ -229,13 +242,16 @@ function initialiseCryptoWithProvider(host, fetchImpl, groupSpecificAuthenticati
         const basePatientApi = new icc_api_1.IccPatientApi(host, updatedHeaders, groupSpecificAuthenticationProvider, fetchImpl);
         const dataOwnerApi = new icc_data_owner_x_api_1.IccDataOwnerXApi(host, updatedHeaders, groupSpecificAuthenticationProvider, fetchImpl);
         const exchangeDataApi = new IccExchangeDataApi_1.IccExchangeDataApi(host, updatedHeaders, groupSpecificAuthenticationProvider, fetchImpl);
+        const baseRecoveryDataApi = new IccRecoveryDataApi_1.IccRecoveryDataApi(host, updatedHeaders, groupSpecificAuthenticationProvider, fetchImpl);
         // Crypto initialisation
         const icureStorage = new IcureStorageFacade_1.IcureStorageFacade(params.keyStorage, params.storage, params.entryKeysFactory);
         const cryptoPrimitives = new CryptoPrimitives_1.CryptoPrimitives(crypto);
         const baseExchangeKeysManager = new BaseExchangeKeysManager_1.BaseExchangeKeysManager(cryptoPrimitives, dataOwnerApi, healthcarePartyApi, basePatientApi, deviceApi);
         const baseExchangeDataManager = new BaseExchangeDataManager_1.BaseExchangeDataManager(exchangeDataApi, dataOwnerApi, cryptoPrimitives, dataOwnerRequiresAnonymousDelegation);
         const keyRecovery = new KeyRecovery_1.KeyRecovery(cryptoPrimitives, dataOwnerApi, baseExchangeKeysManager, baseExchangeDataManager);
-        const userEncryptionKeysManager = new UserEncryptionKeysManager_1.UserEncryptionKeysManager(cryptoPrimitives, dataOwnerApi, icureStorage, keyRecovery, cryptoStrategies, !params.disableParentKeysInitialisation);
+        const recoveryDataEncryption = new RecoveryDataEncryption_1.RecoveryDataEncryption(cryptoPrimitives, baseRecoveryDataApi);
+        const keyPairRecoverer = new KeyPairRecoverer_1.KeyPairRecoverer(recoveryDataEncryption);
+        const userEncryptionKeysManager = new UserEncryptionKeysManager_1.UserEncryptionKeysManager(cryptoPrimitives, dataOwnerApi, icureStorage, keyRecovery, cryptoStrategies, !params.disableParentKeysInitialisation, keyPairRecoverer);
         const userSignatureKeysManager = new UserSignatureKeysManager_1.UserSignatureKeysManager(icureStorage, dataOwnerApi, cryptoPrimitives);
         const newKey = yield userEncryptionKeysManager.initialiseKeys();
         yield new TransferKeysManager_1.TransferKeysManager(cryptoPrimitives, baseExchangeDataManager, dataOwnerApi, userEncryptionKeysManager, userSignatureKeysManager, icureStorage).updateTransferKeys(yield dataOwnerApi.getCurrentDataOwnerStub());
@@ -268,6 +284,7 @@ function initialiseCryptoWithProvider(host, fetchImpl, groupSpecificAuthenticati
             icureMaintenanceTaskApi,
             headers: updatedHeaders,
             dataOwnerRequiresAnonymousDelegation,
+            recoveryApi: new icc_recovery_x_api_1.IccRecoveryXApi(baseRecoveryDataApi, recoveryDataEncryption, userEncryptionKeysManager, dataOwnerApi, cryptoPrimitives, exchangeDataManager),
         };
     });
 }
@@ -283,6 +300,9 @@ class IcureApiImpl {
         this.cryptoStrategies = cryptoStrategies;
         this.latestGroupsRequest = Promise.resolve(latestMatches);
     }
+    get recoveryApi() {
+        return this.cryptoInitInfos.recoveryApi;
+    }
     get authApi() {
         var _a;
         return ((_a = this._authApi) !== null && _a !== void 0 ? _a : (this._authApi = new icc_api_1.IccAuthApi(this.host, this.cryptoInitInfos.headers, this.groupSpecificAuthenticationProvider, this.fetch)));
@@ -529,4 +549,17 @@ const BasicApis = function (host, authenticationOptions, crypto = typeof window
     });
 };
 exports.BasicApis = BasicApis;
+function getMatchesOrEmpty(userApi) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            return yield userApi.getMatchingUsers();
+        }
+        catch (err) {
+            if (err instanceof Error && 'statusCode' in err && err.statusCode === 404)
+                return Promise.resolve([]);
+            else
+                return Promise.reject(err);
+        }
+    });
+}
 //# sourceMappingURL=index.js.map