@icure/api 8.0.23 → 8.0.24

package/icc-x-api/auth/JwtAuthService.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtAuthService = void 0;
 const XHR_1 = require("../../icc-api/api/XHR");
 const JwtUtils_1 = require("./JwtUtils");
+const JwtError_1 = require("./JwtError");
 /**
  * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens
  */
@@ -33,6 +34,14 @@ class JwtAuthService {
     getAuthHeaders() {
         return __awaiter(this, void 0, void 0, function* () {
             return this._currentPromise
+                .then((x) => ({ authJwt: x === null || x === void 0 ? void 0 : x.authJwt, refreshJwt: x === null || x === void 0 ? void 0 : x.refreshJwt }), (e) => {
+                if (e instanceof JwtError_1.JwtError && !!e.jwt && !!e.refreshJwt) {
+                    return { authJwt: e.jwt, refreshJwt: e.refreshJwt };
+                }
+                else {
+                    throw new Error('There was an error while refreshing the token, please re-instantiate the API.');
+                }
+            })
                 .then((x) => {
                 const authJwt = x === null || x === void 0 ? void 0 : x.authJwt;
                 const refreshJwt = x === null || x === void 0 ? void 0 : x.refreshJwt;
@@ -46,6 +55,8 @@ class JwtAuthService {
                             throw new Error('Your iCure back-end version does not support JWT authentication');
                         }
                         return updatedTokens;
+                    }, (e) => {
+                        throw new JwtError_1.JwtError(authJwt, refreshJwt, 'There was an error while refreshing the token, please re-instantiate the API or try again.', e);
                     });
                 }
                 else if (!!this._error) {

package/icc-x-api/auth/JwtAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAM3C,yCAAkD;AAElD;;GAEG;AACH,MAAa,cAAc;IAIzB,YAA6B,OAAmB,EAAE,UAAoD;QAAzE,YAAO,GAAP,OAAO,CAAY;QAHxC,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAiE,OAAO,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAA;QAGvH,IAAI,CAAC,CAAC,UAAU,EAAE;YAChB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;SACnD;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAiB,CAAC,CAAA;IAC/D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7G,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gBAC1B,MAAM,UAAU,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA;gBAEhC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAA,gCAAqB,EAAC,OAAO,CAAC,CAAC,IAAI,UAAU,EAAE;oBAC9D,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAC,CAAC,CAAC,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAC9H,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAAkB;;YAC9C,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,IAAA,gCAAqB,EAAC,UAAU,CAAC,EAAE;gBACrC,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;aACrE;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAM;oBAC/B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAnED,wCAmEC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi } from '../../icc-api'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\nimport { isJwtInvalidOrExpired } from './JwtUtils'\n\n/**\n * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens\n */\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)\n\n  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {\n    if (!!initialJwt) {\n      this._currentPromise = Promise.resolve(initialJwt)\n    }\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x?.refreshJwt as any)\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then((x) => {\n        const authJwt = x?.authJwt\n        const refreshJwt = x?.refreshJwt\n\n        if ((!authJwt || isJwtInvalidOrExpired(authJwt)) && refreshJwt) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then((x) => {\n        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (isJwtInvalidOrExpired(refreshJwt)) {\n      throw Error('Missing or expired refresh token: please log in again')\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token!,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}
+{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAG3C,yCAAkD;AAClD,yCAAqC;AAErC;;GAEG;AACH,MAAa,cAAc;IAIzB,YAA6B,OAAmB,EAAE,UAAoD;QAAzE,YAAO,GAAP,OAAO,CAAY;QAHxC,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAiE,OAAO,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAA;QAGvH,IAAI,CAAC,CAAC,UAAU,EAAE;YAChB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;SACnD;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAiB,CAAC,CAAA;IAC/D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7G,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CACH,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAE,UAAU,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,EAAE,CAAC,EAC3D,CAAC,CAAQ,EAAE,EAAE;gBACX,IAAI,CAAC,YAAY,mBAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;oBACtD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAA;iBACpD;qBAAM;oBACL,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;iBACjG;YACH,CAAC,CACF;iBACA,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gBAC1B,MAAM,UAAU,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA;gBAEhC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAA,gCAAqB,EAAC,OAAO,CAAC,CAAC,IAAI,UAAU,EAAE;oBAC9D,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAC1D,CAAC,aAAa,EAAE,EAAE;wBAChB,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,EACD,CAAC,CAAQ,EAAE,EAAE;wBACX,MAAM,IAAI,mBAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,4FAA4F,EAAE,CAAC,CAAC,CAAA;oBAC1I,CAAC,CACF,CAAA;iBACF;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAC,CAAC,CAAC,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAC9H,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAAkB;;YAC9C,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,IAAA,gCAAqB,EAAC,UAAU,CAAC,EAAE;gBACrC,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;aACrE;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAM;oBAC/B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAlFD,wCAkFC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi } from '../../icc-api'\nimport Header = XHR.Header\nimport { isJwtInvalidOrExpired } from './JwtUtils'\nimport { JwtError } from './JwtError'\n\n/**\n * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens\n */\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)\n\n  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {\n    if (!!initialJwt) {\n      this._currentPromise = Promise.resolve(initialJwt)\n    }\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x?.refreshJwt as any)\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then(\n        (x) => ({ authJwt: x?.authJwt, refreshJwt: x?.refreshJwt }),\n        (e: Error) => {\n          if (e instanceof JwtError && !!e.jwt && !!e.refreshJwt) {\n            return { authJwt: e.jwt, refreshJwt: e.refreshJwt }\n          } else {\n            throw new Error('There was an error while refreshing the token, please re-instantiate the API.')\n          }\n        }\n      )\n      .then((x) => {\n        const authJwt = x?.authJwt\n        const refreshJwt = x?.refreshJwt\n\n        if ((!authJwt || isJwtInvalidOrExpired(authJwt)) && refreshJwt) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then(\n            (updatedTokens) => {\n              // If here the token is null,\n              // it goes in a suspension status\n              if (!updatedTokens.authJwt) {\n                throw new Error('Your iCure back-end version does not support JWT authentication')\n              }\n\n              return updatedTokens\n            },\n            (e: Error) => {\n              throw new JwtError(authJwt, refreshJwt, 'There was an error while refreshing the token, please re-instantiate the API or try again.', e)\n            }\n          )\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then((x) => {\n        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (isJwtInvalidOrExpired(refreshJwt)) {\n      throw Error('Missing or expired refresh token: please log in again')\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token!,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/icc-x-api/auth/JwtBridgedAuthService.js

@@ -14,6 +14,7 @@ const XHR_1 = require("../../icc-api/api/XHR");
 const LoginCredentials_1 = require("../../icc-api/model/LoginCredentials");
 const utils_1 = require("../utils");
 var XHRError = XHR_1.XHR.XHRError;
+const JwtError_1 = require("./JwtError");
 /**
  * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired
  */
@@ -36,6 +37,20 @@ class JwtBridgedAuthService {
     getJWT() {
         return __awaiter(this, void 0, void 0, function* () {
             return this._currentPromise
+                .then(({ authJwt, refreshJwt }) => ({ authJwt, refreshJwt }), (e) => {
+                if (e instanceof JwtError_1.JwtError) {
+                    const wrappedError = e.reason;
+                    if (!!wrappedError.statusCode && wrappedError.statusCode >= 400 && wrappedError.statusCode < 500) {
+                        return { authJwt: undefined, refreshJwt: undefined };
+                    }
+                    else {
+                        return { authJwt: e.jwt, refreshJwt: e.refreshJwt };
+                    }
+                }
+                else {
+                    return { authJwt: undefined, refreshJwt: undefined };
+                }
+            })
                 .then(({ authJwt, refreshJwt }) => {
                 if (!authJwt || this._isJwtInvalidOrExpired(authJwt)) {
                     // If it does not have the JWT, tries to get it
@@ -47,6 +62,8 @@ class JwtBridgedAuthService {
                             throw new Error('Your iCure back-end version does not support JWT authentication');
                         }
                         return updatedTokens;
+                    }, (e) => {
+                        throw new JwtError_1.JwtError(authJwt, refreshJwt, 'There was an error while refreshing the token, please re-instantiate the API or try again.', e);
                     });
                 }
                 else if (!!this._error) {

package/icc-x-api/auth/JwtBridgedAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtBridgedAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtBridgedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B;;GAEG;AACH,MAAa,qBAAqB;IAIhC,YACU,OAAmB,EACnB,QAA4B,EAC5B,QAA4B,EAC5B,mBAAqD,EAAE,EAC/D,UAA+D;QAJvD,YAAO,GAAP,OAAO,CAAY;QACnB,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,qBAAgB,GAAhB,gBAAgB,CAAuC;QAPzD,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAS/F,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAiB,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAQ,EAAE,YAAY,EAAE,UAAW,EAAE,CAAC,CAAC,CAAC,CAAA;IACnJ,CAAC;IAEK,MAAM;;YACV,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE;oBACpD,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACpC,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;gBAC1D,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,IAAI,YAAgD,CAAA;YACpD,IAAI,UAAgC,CAAA;YACpC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI;oBACF,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,IAAI,mCAAgB,CAAC;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CACH,CAAA;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,UAAU,GAAG,CAAa,CAAA;iBAC3B;aACF;YACD,IAAI,CAAC,YAAY,EAAE;gBACjB,YAAY,GAAG,MAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAiC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE;oBACpI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAA;oBACtB,OAAO,CACL,IAAI,aAAJ,IAAI,cAAJ,IAAI,GACJ,CAAC,KAAK;wBACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;4BACnE,IAAI,CAAC,UAAU,EAAE;gCACf,UAAU,GAAG,CAAa,CAAA;6BAC3B;4BACD,OAAO,OAAO,CAAC,OAAO,EAAwB,CAAA;wBAChD,CAAC,CAAC;wBACJ,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;gBACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAiD,CAAC,CAAA;aACrE;YAED,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,UAAU;oBAAE,MAAM,UAAU,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;aAC5E;YAED,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAA;QACH,CAAC;KAAA;IAEO,sBAAsB,CAAC,GAAW;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAA;IACpF,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAlID,sDAkIC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\n/**\n * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired\n */\nexport class JwtBridgedAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(\n    private authApi: IccAuthApi,\n    private username: string | undefined,\n    private password: string | undefined,\n    private thirdPartyTokens: { [thirdParty: string]: string } = {},\n    initialJwt: { authJwt: string; refreshJwt: string } | undefined\n  ) {\n    this._currentPromise = Promise.resolve(initialJwt ?? {})\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x.refreshJwt as any)\n  }\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))\n  }\n\n  async getJWT(): Promise<string | undefined> {\n    return this._currentPromise\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtInvalidOrExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then(({ authJwt }) => {\n        return authJwt\n      })\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this.getJWT().then((authJwt) => {\n      return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n    })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtInvalidOrExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    let authResponse: AuthenticationResponse | undefined\n    let firstError: XHRError | undefined\n    if (this.username && this.password) {\n      try {\n        authResponse = await this.authApi.login(\n          new LoginCredentials({\n            username: this.username,\n            password: this.password,\n          })\n        )\n      } catch (e) {\n        firstError = e as XHRError\n      }\n    }\n    if (!authResponse) {\n      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {\n        const prev = await acc\n        return (\n          prev ??\n          (token\n            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {\n                if (!firstError) {\n                  firstError = e as XHRError\n                }\n                return Promise.resolve() as Promise<undefined>\n              })\n            : undefined)\n        )\n      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)\n    }\n\n    if (!authResponse) {\n      if (firstError) throw firstError\n      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())\n    }\n\n    return {\n      authJwt: authResponse.token,\n      refreshJwt: authResponse.refreshToken,\n    }\n  }\n\n  private _isJwtInvalidOrExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return true\n    }\n    const payload = this._base64Decode(parts[1])\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime() - 10000\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}
+{"version":3,"file":"JwtBridgedAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtBridgedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAC9B,yCAAqC;AAErC;;GAEG;AACH,MAAa,qBAAqB;IAIhC,YACU,OAAmB,EACnB,QAA4B,EAC5B,QAA4B,EAC5B,mBAAqD,EAAE,EAC/D,UAA+D;QAJvD,YAAO,GAAP,OAAO,CAAY;QACnB,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,qBAAgB,GAAhB,gBAAgB,CAAuC;QAPzD,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAS/F,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAiB,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAQ,EAAE,YAAY,EAAE,UAAW,EAAE,CAAC,CAAC,CAAC,CAAA;IACnJ,CAAC;IAEK,MAAM;;YACV,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CACH,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EACtD,CAAC,CAAQ,EAAE,EAAE;gBACX,IAAI,CAAC,YAAY,mBAAQ,EAAE;oBACzB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAa,CAAA;oBACpC,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,IAAI,GAAG,IAAI,YAAY,CAAC,UAAU,GAAG,GAAG,EAAE;wBAChG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;qBACrD;yBAAM;wBACL,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAA;qBACpD;iBACF;qBAAM;oBACL,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;iBACrD;YACH,CAAC,CACF;iBACA,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE;oBACpD,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAC1D,CAAC,aAAa,EAAE,EAAE;wBAChB,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,EACD,CAAC,CAAQ,EAAE,EAAE;wBACX,MAAM,IAAI,mBAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,4FAA4F,EAAE,CAAC,CAAC,CAAA;oBAC1I,CAAC,CACF,CAAA;iBACF;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACpC,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;gBAC1D,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,IAAI,YAAgD,CAAA;YACpD,IAAI,UAAgC,CAAA;YACpC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI;oBACF,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,IAAI,mCAAgB,CAAC;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CACH,CAAA;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,UAAU,GAAG,CAAa,CAAA;iBAC3B;aACF;YACD,IAAI,CAAC,YAAY,EAAE;gBACjB,YAAY,GAAG,MAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAiC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE;oBACpI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAA;oBACtB,OAAO,CACL,IAAI,aAAJ,IAAI,cAAJ,IAAI,GACJ,CAAC,KAAK;wBACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;4BACnE,IAAI,CAAC,UAAU,EAAE;gCACf,UAAU,GAAG,CAAa,CAAA;6BAC3B;4BACD,OAAO,OAAO,CAAC,OAAO,EAAwB,CAAA;wBAChD,CAAC,CAAC;wBACJ,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;gBACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAiD,CAAC,CAAA;aACrE;YAED,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,UAAU;oBAAE,MAAM,UAAU,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;aAC5E;YAED,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAA;QACH,CAAC;KAAA;IAEO,sBAAsB,CAAC,GAAW;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAA;IACpF,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAtJD,sDAsJC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\nimport { JwtError } from './JwtError'\n\n/**\n * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired\n */\nexport class JwtBridgedAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(\n    private authApi: IccAuthApi,\n    private username: string | undefined,\n    private password: string | undefined,\n    private thirdPartyTokens: { [thirdParty: string]: string } = {},\n    initialJwt: { authJwt: string; refreshJwt: string } | undefined\n  ) {\n    this._currentPromise = Promise.resolve(initialJwt ?? {})\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x.refreshJwt as any)\n  }\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))\n  }\n\n  async getJWT(): Promise<string | undefined> {\n    return this._currentPromise\n      .then(\n        ({ authJwt, refreshJwt }) => ({ authJwt, refreshJwt }),\n        (e: Error) => {\n          if (e instanceof JwtError) {\n            const wrappedError = e.reason as any\n            if (!!wrappedError.statusCode && wrappedError.statusCode >= 400 && wrappedError.statusCode < 500) {\n              return { authJwt: undefined, refreshJwt: undefined }\n            } else {\n              return { authJwt: e.jwt, refreshJwt: e.refreshJwt }\n            }\n          } else {\n            return { authJwt: undefined, refreshJwt: undefined }\n          }\n        }\n      )\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtInvalidOrExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then(\n            (updatedTokens) => {\n              // If here the token is null,\n              // it goes in a suspension status\n              if (!updatedTokens.authJwt) {\n                throw new Error('Your iCure back-end version does not support JWT authentication')\n              }\n\n              return updatedTokens\n            },\n            (e: Error) => {\n              throw new JwtError(authJwt, refreshJwt, 'There was an error while refreshing the token, please re-instantiate the API or try again.', e)\n            }\n          )\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then(({ authJwt }) => {\n        return authJwt\n      })\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this.getJWT().then((authJwt) => {\n      return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n    })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtInvalidOrExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    let authResponse: AuthenticationResponse | undefined\n    let firstError: XHRError | undefined\n    if (this.username && this.password) {\n      try {\n        authResponse = await this.authApi.login(\n          new LoginCredentials({\n            username: this.username,\n            password: this.password,\n          })\n        )\n      } catch (e) {\n        firstError = e as XHRError\n      }\n    }\n    if (!authResponse) {\n      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {\n        const prev = await acc\n        return (\n          prev ??\n          (token\n            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {\n                if (!firstError) {\n                  firstError = e as XHRError\n                }\n                return Promise.resolve() as Promise<undefined>\n              })\n            : undefined)\n        )\n      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)\n    }\n\n    if (!authResponse) {\n      if (firstError) throw firstError\n      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())\n    }\n\n    return {\n      authJwt: authResponse.token,\n      refreshJwt: authResponse.refreshToken,\n    }\n  }\n\n  private _isJwtInvalidOrExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return true\n    }\n    const payload = this._base64Decode(parts[1])\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime() - 10000\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/icc-x-api/auth/JwtError.d.ts

@@ -0,0 +1,7 @@
+export declare class JwtError extends Error {
+    readonly jwt: string | undefined;
+    readonly refreshJwt: string | undefined;
+    readonly message: string;
+    readonly reason: Error;
+    constructor(jwt: string | undefined, refreshJwt: string | undefined, message: string, reason: Error);
+}

package/icc-x-api/auth/JwtError.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtError = void 0;
+class JwtError extends Error {
+    constructor(jwt, refreshJwt, message, reason) {
+        super(message);
+        this.jwt = jwt;
+        this.refreshJwt = refreshJwt;
+        this.message = message;
+        this.reason = reason;
+    }
+}
+exports.JwtError = JwtError;
+//# sourceMappingURL=JwtError.js.map

package/icc-x-api/auth/JwtError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtError.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtError.ts"],"names":[],"mappings":";;;AAAA,MAAa,QAAS,SAAQ,KAAK;IACjC,YAAqB,GAAuB,EAAW,UAA8B,EAAW,OAAe,EAAW,MAAa;QACrI,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,QAAG,GAAH,GAAG,CAAoB;QAAW,eAAU,GAAV,UAAU,CAAoB;QAAW,YAAO,GAAP,OAAO,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAO;IAEvI,CAAC;CACF;AAJD,4BAIC","sourcesContent":["export class JwtError extends Error {\n  constructor(readonly jwt: string | undefined, readonly refreshJwt: string | undefined, readonly message: string, readonly reason: Error) {\n    super(message)\n  }\n}\n"]}

package/icc-x-api/crypto/TransferKeysManager.js

@@ -79,7 +79,12 @@ class TransferKeysManager {
     // Result only includes the acyclic label, not the full group
     transferKeysCandidatesFp(keyToFp, graph) {
         return Object.entries((0, graph_utils_1.reachSetsAcyclic)(graph.acyclicGraph))
-            .filter(([from, reachable]) => from != keyToFp && !reachable.has(keyToFp))
+            .filter(([from, reachable]) => {
+            var _a;
+            const currGroup = (_a = graph.acyclicLabelToGroup[from]) !== null && _a !== void 0 ? _a : [from];
+            const reachableOriginal = new Set(Array.from(reachable).flatMap((x) => { var _a; return (_a = graph.acyclicLabelToGroup[x]) !== null && _a !== void 0 ? _a : [x]; }));
+            return !currGroup.includes(keyToFp) && !reachableOriginal.has(keyToFp);
+        })
             .map((x) => x[0]);
     }
     transferTargetKeys(keyManager, graph) {

package/icc-x-api/crypto/TransferKeysManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"TransferKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/TransferKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+BAA2C;AAE3C,oCAAiC;AAEjC,sDAA+E;AAC/E,mCAAgJ;AAOhJ;;;GAGG;AACH,MAAa,mBAAmB;IAC9B,YACmB,UAA4B,EAC5B,uBAAgD,EAChD,YAA8B,EAC9B,qBAAgD,EAChD,wBAAkD,EAClD,YAAgC;QALhC,eAAU,GAAV,UAAU,CAAkB;QAC5B,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,0BAAqB,GAArB,qBAAqB,CAA2B;QAChD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,iBAAY,GAAZ,YAAY,CAAoB;IAChD,CAAC;IAEJ;;;;;;OAMG;IACG,kBAAkB,CAAC,IAA6B;;;YACpD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAA;YACzE,IAAI,CAAC,gBAAgB,CAAC,MAAM;gBAAE,OAAM;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAG,CAAA;YAC5B,MAAM,aAAa,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,IAAI,EAAE,gBAAU,CAAC,IAAI,CAAC,CAAA;YAC9E,MAAM,uBAAuB,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,IAAI,EAAE,gBAAU,CAAC,MAAM,CAAC,CAAA;YAC1F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,EAAE,CAAA;YAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YACvG,MAAM,2BAA2B,GAAG,KAAK,CAAC,IAAI,CAC5C,IAAI,GAAG,CACL,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,+DAA+D;YAC/D,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CACrE,CACF,CACF,CAAA;YACD,MAAM,wBAAwB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YAClH,MAAM,kCAAkC,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACtI,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAC/E,MAAM,EACN,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,kCAElE,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,wBAAwB,EAAE,gBAAU,CAAC,IAAI,CAAC,CAAC,GACtF,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,gBAAU,CAAC,MAAM,CAAC,CAAC,EAExG,CAAA;YACD,IAAI,mBAAmB,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,YAAY,mCAAI,EAAE,CAAA;YACtD,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE;gBACvC,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAA;gBAC5G,mBAAmB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE;;oBACjE,MAAM,YAAY,qBAAQ,CAAC,MAAA,GAAG,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAC,CAAE,CAAA;oBACpD,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAA;oBACtD,GAAG,CAAC,WAAW,CAAC,GAAG,YAAY,CAAA;oBAC/B,OAAO,GAAG,CAAA;gBACZ,CAAC,EAAE,mBAAmB,CAAC,CAAA;aACxB;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBAC5C,IAAI,kCACC,IAAI,CAAC,IAAI,KACZ,YAAY,EAAE,mBAAmB,GAClC;gBACD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAA;;KACH;IAED,gGAAgG;IAClF,kBAAkB,CAAC,WAA+B,EAAE,WAAsB;;YACtF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACxF,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;QAC5E,CAAC;KAAA;IAED,iFAAiF;IACjF,6DAA6D;IACrD,wBAAwB,CAAC,OAAe,EAAE,KAA6B;QAC7E,OAAO,MAAM,CAAC,OAAO,CAAC,IAAA,8BAAgB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IAEa,kBAAkB,CAC9B,UAAqC,EACrC,KAA6B;;YAE7B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAA,EAAA,CAAC,CAAC,CAAA;YAClI,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAC1C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAClI,CAAA;YACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACxG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YACvF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;;gBAC1C,MAAM,cAAc,GAAG,MAAA,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,mCAAI,CAAC,WAAW,CAAC,CAAA,CAAC,6CAA6C;gBAC5H,MAAM,oBAAoB,GAAG,MAAA,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAI,WAAW,CAAA;gBAC1F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,CAAC,wBAAwB,CAAC,oBAAoB,CAAE,CAAC,IAAI,EAAE,CAAA;YACrH,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED,+DAA+D;IACjD,+BAA+B,CAAC,IAA6B;;YAOzE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YAC7G,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE;gBACtG,IAAI,QAAQ;oBAAE,iBAAiB,CAAC,GAAG,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC,CAAA;YACzD,CAAC,CAAC,CAAA;YACF,IAAI,iBAAiB,CAAC,IAAI,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAA;YAC1C,MAAM,KAAK,GAAG,IAAA,6BAAqB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9C,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;YACnF,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE;gBACtE,4DAA4D;gBAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBACtE,kEAAkE;gBAClE,MAAM,uBAAuB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CACjH,CAAA;gBACD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAA;gBAC9D,IAAI,qBAAqB,CAAC,IAAI,IAAI,CAAC;oBAAE,SAAQ;gBAC7C,qIAAqI;gBACrI,MAAM,SAAS,GAAG,IAAA,8BAAgB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAA;gBACtD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACvE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CACrG,CAAA;gBACD,IAAI,mBAAmB,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;gBACxH,kJAAkJ;gBAClJ,OAAO;gBACP,MAAM,2BAA2B,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;oBACxE,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;oBAC9G,IAAI,CAAC,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;oBAC7G,OAAO,GAAG,CAAA;gBACZ,CAAC,CAAC,CAAA;gBACF,GAAG,CAAC,IAAI,CAAC;oBACP,OAAO,EAAE,2BAA2B;oBACpC,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,WAAW;iBACtB,CAAC,CAAA;aACH;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;CACF;AA5ID,kDA4IC","sourcesContent":["import { KeyPair, ShaVersion } from './RSA'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { ua2hex } from '../utils'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { reachSetsAcyclic, StronglyConnectedGraph } from '../utils/graph-utils'\nimport { fingerprintToPublicKeysMapOf, fingerprintV1, loadPublicKeys, transferKeysFpGraphOf, fingerprintIsV1, fingerprintV1toV2 } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\nimport { BaseExchangeDataManager } from './BaseExchangeDataManager'\nimport { UserSignatureKeysManager } from './UserSignatureKeysManager'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\n/**\n * @internal this class is intended only for internal use and may be changed without notice.\n * Allows to create new transfer keys.\n */\nexport class TransferKeysManager {\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly baseExchangeDataManager: BaseExchangeDataManager,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly encryptionKeysManager: UserEncryptionKeysManager,\n    private readonly userSignatureKeysManager: UserSignatureKeysManager,\n    private readonly icureStorage: IcureStorageFacade\n  ) {}\n\n  /**\n   * Analyses the transfer keys graph and creates new transfer keys which allow to improve data accessibility from other devices.\n   * For security reasons transfer keys will only be created between keys verified by the user, but this will be done ignoring any existing edges from\n   * unverified keys to verified keys.\n   * @param self the current data owner.\n   * @return the updated data owner.\n   */\n  async updateTransferKeys(self: CryptoActorStubWithType): Promise<void> {\n    const newEdgesByTarget = await this.getNewVerifiedTransferKeysEdges(self)\n    if (!newEdgesByTarget.length) return\n    const selfId = self.stub.id!\n    const fpToPublicKey = fingerprintToPublicKeysMapOf(self.stub, ShaVersion.Sha1)\n    const fpToPublicKeyWithSha256 = fingerprintToPublicKeysMapOf(self.stub, ShaVersion.Sha256)\n    const signatureKeyPair = await this.userSignatureKeysManager.getOrCreateSignatureKeyPair()\n    const verifiedFps = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    const allVerifiedSourcesAndTarget = Array.from(\n      new Set(\n        newEdgesByTarget.flatMap((x) =>\n          // Sources are guaranteed to be verified, but target may not be\n          verifiedFps.has(x.targetFp) ? [x.targetFp, ...x.sources] : x.sources\n        )\n      )\n    )\n    const newExchangeKeyPublicKeys = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKey[fp]).filter((key) => !!key)\n    const newExchangeKeyPublicKeysWithSha256 = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKeyWithSha256[fp]).filter((key) => !!key)\n    const createdExchangeData = await this.baseExchangeDataManager.createExchangeData(\n      selfId,\n      { [signatureKeyPair.fingerprint]: signatureKeyPair.keyPair.privateKey },\n      {\n        ...(await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeys, ShaVersion.Sha1)),\n        ...(await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeysWithSha256, ShaVersion.Sha256)),\n      }\n    )\n    let updatedTransferKeys = self.stub.transferKeys ?? {}\n    for (const newEdges of newEdgesByTarget) {\n      const encryptedTransferKey = await this.encryptTransferKey(newEdges.target, createdExchangeData.exchangeKey)\n      updatedTransferKeys = newEdges.sources.reduce((acc, candidateFp) => {\n        const existingKeys = { ...(acc[candidateFp] ?? {}) }\n        existingKeys[newEdges.targetFp] = encryptedTransferKey\n        acc[candidateFp] = existingKeys\n        return acc\n      }, updatedTransferKeys)\n    }\n    await this.dataOwnerApi.modifyCryptoActorStub({\n      stub: {\n        ...self.stub,\n        transferKeys: updatedTransferKeys,\n      },\n      type: self.type,\n    })\n  }\n\n  // encrypts a transfer key in pkcs8 format using an exchange key, returns the hex representation\n  private async encryptTransferKey(transferKey: KeyPair<CryptoKey>, exchangeKey: CryptoKey): Promise<string> {\n    const exportedKey = await this.primitives.RSA.exportKey(transferKey.privateKey, 'pkcs8')\n    return ua2hex(await this.primitives.AES.encrypt(exchangeKey, exportedKey))\n  }\n\n  // all public keys would go to the stored keys -> no need for specifying the key.\n  // Result only includes the acyclic label, not the full group\n  private transferKeysCandidatesFp(keyToFp: string, graph: StronglyConnectedGraph): string[] {\n    return Object.entries(reachSetsAcyclic(graph.acyclicGraph))\n      .filter(([from, reachable]) => from != keyToFp && !reachable.has(keyToFp))\n      .map((x) => x[0])\n  }\n\n  private async transferTargetKeys(\n    keyManager: UserEncryptionKeysManager,\n    graph: StronglyConnectedGraph\n  ): Promise<{ fingerprint: string; pair: KeyPair<CryptoKey> }[]> {\n    const availableGroups = new Set(Object.keys(keyManager.getDecryptionKeys()).map((x) => graph.originalLabelToAcyclicLabel[x] ?? x))\n    const groupsReachableFromAvailable = new Set(\n      Object.entries(graph.acyclicGraph).flatMap(([source, reachables]) => (availableGroups.has(source) ? Array.from(reachables) : []))\n    )\n    const targetCandidates = Array.from(availableGroups).filter((x) => !groupsReachableFromAvailable.has(x))\n    const verifiedFps = new Set(keyManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    return targetCandidates.map((candidateFp) => {\n      const candidateGroup = graph.acyclicLabelToGroup[candidateFp] ?? [candidateFp] // May not be part of transfer keys graph yet\n      const bestCandidateOfGroup = candidateGroup.find((x) => verifiedFps.has(x)) ?? candidateFp\n      return { fingerprint: bestCandidateOfGroup, pair: keyManager.getKeyPairForFingerprint(bestCandidateOfGroup)!.pair }\n    })\n  }\n\n  // Decides the best edges considering the verified public keys.\n  private async getNewVerifiedTransferKeysEdges(self: CryptoActorStubWithType): Promise<\n    {\n      sources: string[]\n      target: KeyPair<CryptoKey>\n      targetFp: string\n    }[]\n  > {\n    const verifiedKeysFpSet = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    Object.entries(await this.icureStorage.loadSelfVerifiedKeys(self.stub.id!)).forEach(([key, verified]) => {\n      if (verified) verifiedKeysFpSet.add(fingerprintV1(key))\n    })\n    if (verifiedKeysFpSet.size == 0) return []\n    const graph = transferKeysFpGraphOf(self.stub)\n    // 1. Choose keys available in this device which should be reachable from all other verified keys\n    const targetKeys = await this.transferTargetKeys(this.encryptionKeysManager, graph)\n    const res = []\n    for (const { fingerprint: targetKeyFp, pair: targetKey } of targetKeys) {\n      // 2. Find groups which can't reach the existing target keys\n      const candidatesFp = this.transferKeysCandidatesFp(targetKeyFp, graph)\n      // 3. Keep only groups which contain at least a verified candidate\n      const verifiedGroupCandidates = candidatesFp.filter((candidate) =>\n        graph.acyclicLabelToGroup[candidate].some((candidateGroupMember) => verifiedKeysFpSet.has(candidateGroupMember))\n      )\n      const verifiedCandidatesSet = new Set(verifiedGroupCandidates)\n      if (verifiedCandidatesSet.size == 0) continue\n      // 4. Drop all candidates which can already reach another candidate group: it is sufficient to create a transfer key from that group.\n      const reachSets = reachSetsAcyclic(graph.acyclicGraph)\n      const optimizedCandidates = verifiedGroupCandidates.filter((candidate) =>\n        Array.from(reachSets[candidate]).every((reachableNode) => !verifiedCandidatesSet.has(reachableNode))\n      )\n      if (optimizedCandidates.length == 0) throw new Error('Check failed: at least one candidate should survive optimization')\n      // 5. Transfer keys could also be faked: to make sure we are not giving access to unauthorised people we remap the candidates to a verified public\n      // keys\n      const verifiedOptimizedCandidates = optimizedCandidates.map((candidate) => {\n        const res = graph.acyclicLabelToGroup[candidate].find((groupMemberFp) => verifiedKeysFpSet.has(groupMemberFp))\n        if (!res) throw new Error('Check failed: optimized candidates groups should have at least a verified member')\n        return res\n      })\n      res.push({\n        sources: verifiedOptimizedCandidates,\n        target: targetKey,\n        targetFp: targetKeyFp,\n      })\n    }\n    return res\n  }\n}\n"]}
+{"version":3,"file":"TransferKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/TransferKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+BAA2C;AAE3C,oCAAiC;AAEjC,sDAA+E;AAC/E,mCAAgJ;AAOhJ;;;GAGG;AACH,MAAa,mBAAmB;IAC9B,YACmB,UAA4B,EAC5B,uBAAgD,EAChD,YAA8B,EAC9B,qBAAgD,EAChD,wBAAkD,EAClD,YAAgC;QALhC,eAAU,GAAV,UAAU,CAAkB;QAC5B,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,0BAAqB,GAArB,qBAAqB,CAA2B;QAChD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,iBAAY,GAAZ,YAAY,CAAoB;IAChD,CAAC;IAEJ;;;;;;OAMG;IACG,kBAAkB,CAAC,IAA6B;;;YACpD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAA;YACzE,IAAI,CAAC,gBAAgB,CAAC,MAAM;gBAAE,OAAM;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAG,CAAA;YAC5B,MAAM,aAAa,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,IAAI,EAAE,gBAAU,CAAC,IAAI,CAAC,CAAA;YAC9E,MAAM,uBAAuB,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,IAAI,EAAE,gBAAU,CAAC,MAAM,CAAC,CAAA;YAC1F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,EAAE,CAAA;YAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YACvG,MAAM,2BAA2B,GAAG,KAAK,CAAC,IAAI,CAC5C,IAAI,GAAG,CACL,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,+DAA+D;YAC/D,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CACrE,CACF,CACF,CAAA;YACD,MAAM,wBAAwB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YAClH,MAAM,kCAAkC,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACtI,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAC/E,MAAM,EACN,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,kCAElE,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,wBAAwB,EAAE,gBAAU,CAAC,IAAI,CAAC,CAAC,GACtF,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,gBAAU,CAAC,MAAM,CAAC,CAAC,EAExG,CAAA;YACD,IAAI,mBAAmB,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,YAAY,mCAAI,EAAE,CAAA;YACtD,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE;gBACvC,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAA;gBAC5G,mBAAmB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE;;oBACjE,MAAM,YAAY,qBAAQ,CAAC,MAAA,GAAG,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAC,CAAE,CAAA;oBACpD,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAA;oBACtD,GAAG,CAAC,WAAW,CAAC,GAAG,YAAY,CAAA;oBAC/B,OAAO,GAAG,CAAA;gBACZ,CAAC,EAAE,mBAAmB,CAAC,CAAA;aACxB;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBAC5C,IAAI,kCACC,IAAI,CAAC,IAAI,KACZ,YAAY,EAAE,mBAAmB,GAClC;gBACD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAA;;KACH;IAED,gGAAgG;IAClF,kBAAkB,CAAC,WAA+B,EAAE,WAAsB;;YACtF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACxF,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;QAC5E,CAAC;KAAA;IAED,iFAAiF;IACjF,6DAA6D;IACrD,wBAAwB,CAAC,OAAe,EAAE,KAA6B;QAC7E,OAAO,MAAM,CAAC,OAAO,CAAC,IAAA,8BAAgB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE;;YAC5B,MAAM,SAAS,GAAG,MAAA,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,mCAAI,CAAC,IAAI,CAAC,CAAA;YAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAC,CAAC,CAAA,EAAA,CAAC,CAAC,CAAA;YAC5G,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxE,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IAEa,kBAAkB,CAC9B,UAAqC,EACrC,KAA6B;;YAE7B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAA,EAAA,CAAC,CAAC,CAAA;YAClI,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAC1C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAClI,CAAA;YACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACxG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YACvF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;;gBAC1C,MAAM,cAAc,GAAG,MAAA,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,mCAAI,CAAC,WAAW,CAAC,CAAA,CAAC,6CAA6C;gBAC5H,MAAM,oBAAoB,GAAG,MAAA,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAI,WAAW,CAAA;gBAC1F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,CAAC,wBAAwB,CAAC,oBAAoB,CAAE,CAAC,IAAI,EAAE,CAAA;YACrH,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED,+DAA+D;IACjD,+BAA+B,CAAC,IAA6B;;YAOzE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YAC7G,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE;gBACtG,IAAI,QAAQ;oBAAE,iBAAiB,CAAC,GAAG,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC,CAAA;YACzD,CAAC,CAAC,CAAA;YACF,IAAI,iBAAiB,CAAC,IAAI,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAA;YAC1C,MAAM,KAAK,GAAG,IAAA,6BAAqB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9C,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;YACnF,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE;gBACtE,4DAA4D;gBAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBACtE,kEAAkE;gBAClE,MAAM,uBAAuB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CACjH,CAAA;gBACD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAA;gBAC9D,IAAI,qBAAqB,CAAC,IAAI,IAAI,CAAC;oBAAE,SAAQ;gBAC7C,qIAAqI;gBACrI,MAAM,SAAS,GAAG,IAAA,8BAAgB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAA;gBACtD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACvE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CACrG,CAAA;gBACD,IAAI,mBAAmB,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;gBACxH,kJAAkJ;gBAClJ,OAAO;gBACP,MAAM,2BAA2B,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;oBACxE,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;oBAC9G,IAAI,CAAC,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;oBAC7G,OAAO,GAAG,CAAA;gBACZ,CAAC,CAAC,CAAA;gBACF,GAAG,CAAC,IAAI,CAAC;oBACP,OAAO,EAAE,2BAA2B;oBACpC,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,WAAW;iBACtB,CAAC,CAAA;aACH;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;CACF;AAhJD,kDAgJC","sourcesContent":["import { KeyPair, ShaVersion } from './RSA'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { ua2hex } from '../utils'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { reachSetsAcyclic, StronglyConnectedGraph } from '../utils/graph-utils'\nimport { fingerprintToPublicKeysMapOf, fingerprintV1, loadPublicKeys, transferKeysFpGraphOf, fingerprintIsV1, fingerprintV1toV2 } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\nimport { BaseExchangeDataManager } from './BaseExchangeDataManager'\nimport { UserSignatureKeysManager } from './UserSignatureKeysManager'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\n/**\n * @internal this class is intended only for internal use and may be changed without notice.\n * Allows to create new transfer keys.\n */\nexport class TransferKeysManager {\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly baseExchangeDataManager: BaseExchangeDataManager,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly encryptionKeysManager: UserEncryptionKeysManager,\n    private readonly userSignatureKeysManager: UserSignatureKeysManager,\n    private readonly icureStorage: IcureStorageFacade\n  ) {}\n\n  /**\n   * Analyses the transfer keys graph and creates new transfer keys which allow to improve data accessibility from other devices.\n   * For security reasons transfer keys will only be created between keys verified by the user, but this will be done ignoring any existing edges from\n   * unverified keys to verified keys.\n   * @param self the current data owner.\n   * @return the updated data owner.\n   */\n  async updateTransferKeys(self: CryptoActorStubWithType): Promise<void> {\n    const newEdgesByTarget = await this.getNewVerifiedTransferKeysEdges(self)\n    if (!newEdgesByTarget.length) return\n    const selfId = self.stub.id!\n    const fpToPublicKey = fingerprintToPublicKeysMapOf(self.stub, ShaVersion.Sha1)\n    const fpToPublicKeyWithSha256 = fingerprintToPublicKeysMapOf(self.stub, ShaVersion.Sha256)\n    const signatureKeyPair = await this.userSignatureKeysManager.getOrCreateSignatureKeyPair()\n    const verifiedFps = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    const allVerifiedSourcesAndTarget = Array.from(\n      new Set(\n        newEdgesByTarget.flatMap((x) =>\n          // Sources are guaranteed to be verified, but target may not be\n          verifiedFps.has(x.targetFp) ? [x.targetFp, ...x.sources] : x.sources\n        )\n      )\n    )\n    const newExchangeKeyPublicKeys = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKey[fp]).filter((key) => !!key)\n    const newExchangeKeyPublicKeysWithSha256 = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKeyWithSha256[fp]).filter((key) => !!key)\n    const createdExchangeData = await this.baseExchangeDataManager.createExchangeData(\n      selfId,\n      { [signatureKeyPair.fingerprint]: signatureKeyPair.keyPair.privateKey },\n      {\n        ...(await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeys, ShaVersion.Sha1)),\n        ...(await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeysWithSha256, ShaVersion.Sha256)),\n      }\n    )\n    let updatedTransferKeys = self.stub.transferKeys ?? {}\n    for (const newEdges of newEdgesByTarget) {\n      const encryptedTransferKey = await this.encryptTransferKey(newEdges.target, createdExchangeData.exchangeKey)\n      updatedTransferKeys = newEdges.sources.reduce((acc, candidateFp) => {\n        const existingKeys = { ...(acc[candidateFp] ?? {}) }\n        existingKeys[newEdges.targetFp] = encryptedTransferKey\n        acc[candidateFp] = existingKeys\n        return acc\n      }, updatedTransferKeys)\n    }\n    await this.dataOwnerApi.modifyCryptoActorStub({\n      stub: {\n        ...self.stub,\n        transferKeys: updatedTransferKeys,\n      },\n      type: self.type,\n    })\n  }\n\n  // encrypts a transfer key in pkcs8 format using an exchange key, returns the hex representation\n  private async encryptTransferKey(transferKey: KeyPair<CryptoKey>, exchangeKey: CryptoKey): Promise<string> {\n    const exportedKey = await this.primitives.RSA.exportKey(transferKey.privateKey, 'pkcs8')\n    return ua2hex(await this.primitives.AES.encrypt(exchangeKey, exportedKey))\n  }\n\n  // all public keys would go to the stored keys -> no need for specifying the key.\n  // Result only includes the acyclic label, not the full group\n  private transferKeysCandidatesFp(keyToFp: string, graph: StronglyConnectedGraph): string[] {\n    return Object.entries(reachSetsAcyclic(graph.acyclicGraph))\n      .filter(([from, reachable]) => {\n        const currGroup = graph.acyclicLabelToGroup[from] ?? [from]\n        const reachableOriginal = new Set(Array.from(reachable).flatMap((x) => graph.acyclicLabelToGroup[x] ?? [x]))\n        return !currGroup.includes(keyToFp) && !reachableOriginal.has(keyToFp)\n      })\n      .map((x) => x[0])\n  }\n\n  private async transferTargetKeys(\n    keyManager: UserEncryptionKeysManager,\n    graph: StronglyConnectedGraph\n  ): Promise<{ fingerprint: string; pair: KeyPair<CryptoKey> }[]> {\n    const availableGroups = new Set(Object.keys(keyManager.getDecryptionKeys()).map((x) => graph.originalLabelToAcyclicLabel[x] ?? x))\n    const groupsReachableFromAvailable = new Set(\n      Object.entries(graph.acyclicGraph).flatMap(([source, reachables]) => (availableGroups.has(source) ? Array.from(reachables) : []))\n    )\n    const targetCandidates = Array.from(availableGroups).filter((x) => !groupsReachableFromAvailable.has(x))\n    const verifiedFps = new Set(keyManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    return targetCandidates.map((candidateFp) => {\n      const candidateGroup = graph.acyclicLabelToGroup[candidateFp] ?? [candidateFp] // May not be part of transfer keys graph yet\n      const bestCandidateOfGroup = candidateGroup.find((x) => verifiedFps.has(x)) ?? candidateFp\n      return { fingerprint: bestCandidateOfGroup, pair: keyManager.getKeyPairForFingerprint(bestCandidateOfGroup)!.pair }\n    })\n  }\n\n  // Decides the best edges considering the verified public keys.\n  private async getNewVerifiedTransferKeysEdges(self: CryptoActorStubWithType): Promise<\n    {\n      sources: string[]\n      target: KeyPair<CryptoKey>\n      targetFp: string\n    }[]\n  > {\n    const verifiedKeysFpSet = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    Object.entries(await this.icureStorage.loadSelfVerifiedKeys(self.stub.id!)).forEach(([key, verified]) => {\n      if (verified) verifiedKeysFpSet.add(fingerprintV1(key))\n    })\n    if (verifiedKeysFpSet.size == 0) return []\n    const graph = transferKeysFpGraphOf(self.stub)\n    // 1. Choose keys available in this device which should be reachable from all other verified keys\n    const targetKeys = await this.transferTargetKeys(this.encryptionKeysManager, graph)\n    const res = []\n    for (const { fingerprint: targetKeyFp, pair: targetKey } of targetKeys) {\n      // 2. Find groups which can't reach the existing target keys\n      const candidatesFp = this.transferKeysCandidatesFp(targetKeyFp, graph)\n      // 3. Keep only groups which contain at least a verified candidate\n      const verifiedGroupCandidates = candidatesFp.filter((candidate) =>\n        graph.acyclicLabelToGroup[candidate].some((candidateGroupMember) => verifiedKeysFpSet.has(candidateGroupMember))\n      )\n      const verifiedCandidatesSet = new Set(verifiedGroupCandidates)\n      if (verifiedCandidatesSet.size == 0) continue\n      // 4. Drop all candidates which can already reach another candidate group: it is sufficient to create a transfer key from that group.\n      const reachSets = reachSetsAcyclic(graph.acyclicGraph)\n      const optimizedCandidates = verifiedGroupCandidates.filter((candidate) =>\n        Array.from(reachSets[candidate]).every((reachableNode) => !verifiedCandidatesSet.has(reachableNode))\n      )\n      if (optimizedCandidates.length == 0) throw new Error('Check failed: at least one candidate should survive optimization')\n      // 5. Transfer keys could also be faked: to make sure we are not giving access to unauthorised people we remap the candidates to a verified public\n      // keys\n      const verifiedOptimizedCandidates = optimizedCandidates.map((candidate) => {\n        const res = graph.acyclicLabelToGroup[candidate].find((groupMemberFp) => verifiedKeysFpSet.has(groupMemberFp))\n        if (!res) throw new Error('Check failed: optimized candidates groups should have at least a verified member')\n        return res\n      })\n      res.push({\n        sources: verifiedOptimizedCandidates,\n        target: targetKey,\n        targetFp: targetKeyFp,\n      })\n    }\n    return res\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@icure/api",
-  "version": "8.0.23",
+  "version": "8.0.24",
   "description": "Typescript version of iCure standalone API client",
   "main": "index.js",
   "types": "index.d.ts",

package/test/icc-x-api/auth/jwt-provider-test.d.ts

@@ -0,0 +1 @@
+export {};

package/test/icc-x-api/auth/jwt-provider-test.js

@@ -0,0 +1,138 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const icc_api_1 = require("../../../icc-api");
+const AuthenticationResponse_1 = require("../../../icc-api/model/AuthenticationResponse");
+const ModelHelper_1 = require("../../../icc-api/model/ModelHelper");
+const chai_1 = require("chai");
+const JwtBridgedAuthService_1 = require("../../../icc-x-api/auth/JwtBridgedAuthService");
+const JwtAuthService_1 = require("../../../icc-x-api/auth/JwtAuthService");
+const XHR_1 = require("../../../icc-api/api/XHR");
+var XHRError = XHR_1.XHR.XHRError;
+const JwtError_1 = require("../../../icc-x-api/auth/JwtError");
+describe('JWT provider resiliency test', () => {
+    function generateJwt() {
+        return `jwt.${(0, ModelHelper_1.b2a)(JSON.stringify({ exp: 1000 }))}.${Math.floor(100000 + Math.random() * 900000)}`;
+    }
+    function generateRefreshJwt() {
+        return `refreshJwt.${(0, ModelHelper_1.b2a)(JSON.stringify({ exp: new Date().getTime() * 10 }))}.${Math.floor(100000 + Math.random() * 900000)}`;
+    }
+    class FakeAuthApi extends icc_api_1.IccAuthApi {
+        constructor() {
+            super('', {});
+            this.jwt = `jwt.${(0, ModelHelper_1.b2a)(JSON.stringify({ exp: 1000 }))}.signature`;
+            this.refreshJwt = `refreshJwt.${(0, ModelHelper_1.b2a)(JSON.stringify({ exp: new Date().getTime() * 10 }))}.signature`;
+        }
+        login(body) {
+            if (!!this.loginException) {
+                throw this.loginException;
+            }
+            this.jwt = generateJwt();
+            this.refreshJwt = generateRefreshJwt();
+            return Promise.resolve(new AuthenticationResponse_1.AuthenticationResponse({
+                token: this.jwt,
+                refreshToken: this.refreshJwt,
+            }));
+        }
+        refreshAuthenticationJWT(refreshJWT) {
+            var _a;
+            if (!!this.refreshException) {
+                throw this.refreshException;
+            }
+            this.jwt = generateJwt();
+            return Promise.resolve(new AuthenticationResponse_1.AuthenticationResponse({
+                token: this.jwt,
+                refreshToken: (_a = this.refreshJwt) !== null && _a !== void 0 ? _a : generateRefreshJwt(),
+            }));
+        }
+    }
+    function expectThrowOnGetHeaders(service) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let caught = null;
+            try {
+                yield service.getAuthHeaders();
+            }
+            catch (e) {
+                caught = e;
+            }
+            (0, chai_1.expect)(caught).not.to.be.null;
+            (0, chai_1.expect)(caught).to.be.instanceof(JwtError_1.JwtError);
+        });
+    }
+    it('JwtBridgedAuthService - If the login fails for any type of error it is possible to retry', () => __awaiter(void 0, void 0, void 0, function* () {
+        const errors = [
+            new Error('A generic error'),
+            new XHRError('', '', 403, 'FORBIDDEN', new Headers()),
+            new XHRError('', '', 503, 'TIMEOUT', new Headers()),
+        ];
+        for (const e of errors) {
+            const fakeAuthApi = new FakeAuthApi();
+            const authService = new JwtBridgedAuthService_1.JwtBridgedAuthService(fakeAuthApi, 'username', 'password', {}, undefined);
+            fakeAuthApi.loginException = e;
+            yield expectThrowOnGetHeaders(authService);
+            fakeAuthApi.loginException = null;
+            const firstHeader = yield authService.getAuthHeaders();
+            (0, chai_1.expect)(firstHeader[0].data).to.be.equal(`Bearer ${fakeAuthApi.jwt}`);
+        }
+    }));
+    function jwtBridgedTest(error, loginAfterError) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const fakeAuthApi = new FakeAuthApi();
+            const authService = new JwtBridgedAuthService_1.JwtBridgedAuthService(fakeAuthApi, 'username', 'password', {}, undefined);
+            fakeAuthApi.refreshException = null;
+            const firstHeader = yield authService.getAuthHeaders();
+            const initialJwt = fakeAuthApi.jwt;
+            const initialRefresh = fakeAuthApi.refreshJwt;
+            (0, chai_1.expect)(firstHeader[0].data).to.be.equal(`Bearer ${initialJwt}`);
+            fakeAuthApi.refreshException = error;
+            yield expectThrowOnGetHeaders(authService);
+            fakeAuthApi.refreshException = null;
+            const secondHeader = yield authService.getAuthHeaders();
+            const secondJwt = fakeAuthApi.jwt;
+            const secondRefresh = fakeAuthApi.refreshJwt;
+            (0, chai_1.expect)(secondHeader[0].data).to.be.equal(`Bearer ${secondJwt}`);
+            (0, chai_1.expect)(secondJwt).not.to.be.equal(initialJwt);
+            if (loginAfterError) {
+                (0, chai_1.expect)(secondRefresh).not.to.be.equal(initialRefresh);
+            }
+            else {
+                (0, chai_1.expect)(secondRefresh).to.be.equal(initialRefresh);
+            }
+        });
+    }
+    it('JwtBridgedAuthService - If the refresh fails for a generic error, it is possible to retry', () => __awaiter(void 0, void 0, void 0, function* () {
+        const error = new Error('A generic error');
+        yield jwtBridgedTest(error, false);
+    }));
+    it('JwtBridgedAuthService - If the refresh fails for a 500 error, the login is performed again', () => __awaiter(void 0, void 0, void 0, function* () {
+        const error = new XHRError('', '', 500, 'INTERNAL SERVER ERROR', new Headers());
+        yield jwtBridgedTest(error, false);
+    }));
+    it('JwtBridgedAuthService - If the refresh fails for a 400 error, the login is performed again', () => __awaiter(void 0, void 0, void 0, function* () {
+        const error = new XHRError('', '', 403, 'FORBIDDEN', new Headers());
+        yield jwtBridgedTest(error, true);
+    }));
+    it('JwtAuthService - If the refresh fails for an error, it is possible to retry', () => __awaiter(void 0, void 0, void 0, function* () {
+        const fakeAuthApi = new FakeAuthApi();
+        const error = new Error('A generic error');
+        const initialJwt = generateJwt();
+        const initialRefresh = generateRefreshJwt();
+        const authService = new JwtAuthService_1.JwtAuthService(fakeAuthApi, { authJwt: initialJwt, refreshJwt: initialRefresh });
+        fakeAuthApi.refreshException = error;
+        yield expectThrowOnGetHeaders(authService);
+        fakeAuthApi.refreshException = null;
+        const secondHeader = yield authService.getAuthHeaders();
+        const secondJwt = fakeAuthApi.jwt;
+        (0, chai_1.expect)(secondHeader[0].data).to.be.equal(`Bearer ${secondJwt}`);
+        (0, chai_1.expect)(secondJwt).not.to.be.equal(initialJwt);
+    }));
+});
+//# sourceMappingURL=jwt-provider-test.js.map

package/test/icc-x-api/auth/jwt-provider-test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-provider-test.js","sourceRoot":"","sources":["../../../../test/icc-x-api/auth/jwt-provider-test.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,8CAA6C;AAE7C,0FAAsF;AACtF,oEAAwD;AACxD,+BAA6B;AAC7B,yFAAqF;AAErF,2EAAuE;AACvE,kDAA8C;AAC9C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAC9B,+DAA2D;AAE3D,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,SAAS,WAAW;QAClB,OAAO,OAAO,IAAA,iBAAG,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAA;IACnG,CAAC;IAED,SAAS,kBAAkB;QACzB,OAAO,cAAc,IAAA,iBAAG,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAA;IAC/H,CAAC;IAED,MAAM,WAAY,SAAQ,oBAAU;QAMlC;YACE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YAJf,QAAG,GAAG,OAAO,IAAA,iBAAG,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAA;YAC3D,eAAU,GAAG,cAAc,IAAA,iBAAG,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAA;QAI9F,CAAC;QAED,KAAK,CAAC,IAAuB;YAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;gBACzB,MAAM,IAAI,CAAC,cAAc,CAAA;aAC1B;YAED,IAAI,CAAC,GAAG,GAAG,WAAW,EAAE,CAAA;YACxB,IAAI,CAAC,UAAU,GAAG,kBAAkB,EAAE,CAAA;YACtC,OAAO,OAAO,CAAC,OAAO,CACpB,IAAI,+CAAsB,CAAC;gBACzB,KAAK,EAAE,IAAI,CAAC,GAAG;gBACf,YAAY,EAAE,IAAI,CAAC,UAAU;aAC9B,CAAC,CACH,CAAA;QACH,CAAC;QAED,wBAAwB,CAAC,UAAkB;;YACzC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAC3B,MAAM,IAAI,CAAC,gBAAgB,CAAA;aAC5B;YAED,IAAI,CAAC,GAAG,GAAG,WAAW,EAAE,CAAA;YACxB,OAAO,OAAO,CAAC,OAAO,CACpB,IAAI,+CAAsB,CAAC;gBACzB,KAAK,EAAE,IAAI,CAAC,GAAG;gBACf,YAAY,EAAE,MAAA,IAAI,CAAC,UAAU,mCAAI,kBAAkB,EAAE;aACtD,CAAC,CACH,CAAA;QACH,CAAC;KACF;IAED,SAAe,uBAAuB,CAAC,OAAoB;;YACzD,IAAI,MAAM,GAAiB,IAAI,CAAA;YAC/B,IAAI;gBACF,MAAM,OAAO,CAAC,cAAc,EAAE,CAAA;aAC/B;YAAC,OAAO,CAAC,EAAE;gBACV,MAAM,GAAG,CAAU,CAAA;aACpB;YACD,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAA;YAC7B,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAQ,CAAC,CAAA;QAC3C,CAAC;KAAA;IAED,EAAE,CAAC,0FAA0F,EAAE,GAAS,EAAE;QACxG,MAAM,MAAM,GAAY;YACtB,IAAI,KAAK,CAAC,iBAAiB,CAAC;YAC5B,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;YACrD,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,OAAO,EAAE,CAAC;SACpD,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;YACtB,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;YACrC,MAAM,WAAW,GAAG,IAAI,6CAAqB,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;YAEjG,WAAW,CAAC,cAAc,GAAG,CAAC,CAAA;YAC9B,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE1C,WAAW,CAAC,cAAc,GAAG,IAAI,CAAA;YACjC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAA;YACtD,IAAA,aAAM,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,WAAW,CAAC,GAAG,EAAE,CAAC,CAAA;SACrE;IACH,CAAC,CAAA,CAAC,CAAA;IAEF,SAAe,cAAc,CAAC,KAAY,EAAE,eAAwB;;YAClE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;YACrC,MAAM,WAAW,GAAG,IAAI,6CAAqB,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;YAEjG,WAAW,CAAC,gBAAgB,GAAG,IAAI,CAAA;YACnC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAA;YACtD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAA;YAClC,MAAM,cAAc,GAAG,WAAW,CAAC,UAAU,CAAA;YAC7C,IAAA,aAAM,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,UAAU,EAAE,CAAC,CAAA;YAE/D,WAAW,CAAC,gBAAgB,GAAG,KAAK,CAAA;YACpC,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE1C,WAAW,CAAC,gBAAgB,GAAG,IAAI,CAAA;YACnC,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAA;YACvD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAA;YACjC,MAAM,aAAa,GAAG,WAAW,CAAC,UAAU,CAAA;YAC5C,IAAA,aAAM,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,SAAS,EAAE,CAAC,CAAA;YAC/D,IAAA,aAAM,EAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,eAAe,EAAE;gBACnB,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;aACtD;iBAAM;gBACL,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;aAClD;QACH,CAAC;KAAA;IAED,EAAE,CAAC,2FAA2F,EAAE,GAAS,EAAE;QACzG,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC1C,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACpC,CAAC,CAAA,CAAC,CAAA;IAEF,EAAE,CAAC,4FAA4F,EAAE,GAAS,EAAE;QAC1G,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;QAC/E,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACpC,CAAC,CAAA,CAAC,CAAA;IAEF,EAAE,CAAC,4FAA4F,EAAE,GAAS,EAAE;QAC1G,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC,CAAA,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,GAAS,EAAE;QAC3F,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;QACrC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC1C,MAAM,UAAU,GAAG,WAAW,EAAE,CAAA;QAChC,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAA;QAC3C,MAAM,WAAW,GAAG,IAAI,+BAAc,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAA;QAExG,WAAW,CAAC,gBAAgB,GAAG,KAAK,CAAA;QACpC,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAA;QAE1C,WAAW,CAAC,gBAAgB,GAAG,IAAI,CAAA;QACnC,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAA;QACvD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAA;QACjC,IAAA,aAAM,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,SAAS,EAAE,CAAC,CAAA;QAC/D,IAAA,aAAM,EAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC/C,CAAC,CAAA,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { IccAuthApi } from '../../../icc-api'\nimport { LoginCredentials } from '../../../icc-api/model/LoginCredentials'\nimport { AuthenticationResponse } from '../../../icc-api/model/AuthenticationResponse'\nimport { b2a } from '../../../icc-api/model/ModelHelper'\nimport { expect } from 'chai'\nimport { JwtBridgedAuthService } from '../../../icc-x-api/auth/JwtBridgedAuthService'\nimport { AuthService } from '../../../icc-x-api/auth/AuthService'\nimport { JwtAuthService } from '../../../icc-x-api/auth/JwtAuthService'\nimport { XHR } from '../../../icc-api/api/XHR'\nimport XHRError = XHR.XHRError\nimport { JwtError } from '../../../icc-x-api/auth/JwtError'\n\ndescribe('JWT provider resiliency test', () => {\n  function generateJwt() {\n    return `jwt.${b2a(JSON.stringify({ exp: 1000 }))}.${Math.floor(100000 + Math.random() * 900000)}`\n  }\n\n  function generateRefreshJwt() {\n    return `refreshJwt.${b2a(JSON.stringify({ exp: new Date().getTime() * 10 }))}.${Math.floor(100000 + Math.random() * 900000)}`\n  }\n\n  class FakeAuthApi extends IccAuthApi {\n    refreshException: Error | undefined | null\n    loginException: Error | undefined | null\n    jwt = `jwt.${b2a(JSON.stringify({ exp: 1000 }))}.signature`\n    refreshJwt = `refreshJwt.${b2a(JSON.stringify({ exp: new Date().getTime() * 10 }))}.signature`\n\n    constructor() {\n      super('', {})\n    }\n\n    login(body?: LoginCredentials): Promise<AuthenticationResponse> {\n      if (!!this.loginException) {\n        throw this.loginException\n      }\n\n      this.jwt = generateJwt()\n      this.refreshJwt = generateRefreshJwt()\n      return Promise.resolve(\n        new AuthenticationResponse({\n          token: this.jwt,\n          refreshToken: this.refreshJwt,\n        })\n      )\n    }\n\n    refreshAuthenticationJWT(refreshJWT: string): Promise<AuthenticationResponse> {\n      if (!!this.refreshException) {\n        throw this.refreshException\n      }\n\n      this.jwt = generateJwt()\n      return Promise.resolve(\n        new AuthenticationResponse({\n          token: this.jwt,\n          refreshToken: this.refreshJwt ?? generateRefreshJwt(),\n        })\n      )\n    }\n  }\n\n  async function expectThrowOnGetHeaders(service: AuthService): Promise<void> {\n    let caught: Error | null = null\n    try {\n      await service.getAuthHeaders()\n    } catch (e) {\n      caught = e as Error\n    }\n    expect(caught).not.to.be.null\n    expect(caught).to.be.instanceof(JwtError)\n  }\n\n  it('JwtBridgedAuthService - If the login fails for any type of error it is possible to retry', async () => {\n    const errors: Error[] = [\n      new Error('A generic error'),\n      new XHRError('', '', 403, 'FORBIDDEN', new Headers()),\n      new XHRError('', '', 503, 'TIMEOUT', new Headers()),\n    ]\n    for (const e of errors) {\n      const fakeAuthApi = new FakeAuthApi()\n      const authService = new JwtBridgedAuthService(fakeAuthApi, 'username', 'password', {}, undefined)\n\n      fakeAuthApi.loginException = e\n      await expectThrowOnGetHeaders(authService)\n\n      fakeAuthApi.loginException = null\n      const firstHeader = await authService.getAuthHeaders()\n      expect(firstHeader[0].data).to.be.equal(`Bearer ${fakeAuthApi.jwt}`)\n    }\n  })\n\n  async function jwtBridgedTest(error: Error, loginAfterError: boolean) {\n    const fakeAuthApi = new FakeAuthApi()\n    const authService = new JwtBridgedAuthService(fakeAuthApi, 'username', 'password', {}, undefined)\n\n    fakeAuthApi.refreshException = null\n    const firstHeader = await authService.getAuthHeaders()\n    const initialJwt = fakeAuthApi.jwt\n    const initialRefresh = fakeAuthApi.refreshJwt\n    expect(firstHeader[0].data).to.be.equal(`Bearer ${initialJwt}`)\n\n    fakeAuthApi.refreshException = error\n    await expectThrowOnGetHeaders(authService)\n\n    fakeAuthApi.refreshException = null\n    const secondHeader = await authService.getAuthHeaders()\n    const secondJwt = fakeAuthApi.jwt\n    const secondRefresh = fakeAuthApi.refreshJwt\n    expect(secondHeader[0].data).to.be.equal(`Bearer ${secondJwt}`)\n    expect(secondJwt).not.to.be.equal(initialJwt)\n    if (loginAfterError) {\n      expect(secondRefresh).not.to.be.equal(initialRefresh)\n    } else {\n      expect(secondRefresh).to.be.equal(initialRefresh)\n    }\n  }\n\n  it('JwtBridgedAuthService - If the refresh fails for a generic error, it is possible to retry', async () => {\n    const error = new Error('A generic error')\n    await jwtBridgedTest(error, false)\n  })\n\n  it('JwtBridgedAuthService - If the refresh fails for a 500 error, the login is performed again', async () => {\n    const error = new XHRError('', '', 500, 'INTERNAL SERVER ERROR', new Headers())\n    await jwtBridgedTest(error, false)\n  })\n\n  it('JwtBridgedAuthService - If the refresh fails for a 400 error, the login is performed again', async () => {\n    const error = new XHRError('', '', 403, 'FORBIDDEN', new Headers())\n    await jwtBridgedTest(error, true)\n  })\n\n  it('JwtAuthService - If the refresh fails for an error, it is possible to retry', async () => {\n    const fakeAuthApi = new FakeAuthApi()\n    const error = new Error('A generic error')\n    const initialJwt = generateJwt()\n    const initialRefresh = generateRefreshJwt()\n    const authService = new JwtAuthService(fakeAuthApi, { authJwt: initialJwt, refreshJwt: initialRefresh })\n\n    fakeAuthApi.refreshException = error\n    await expectThrowOnGetHeaders(authService)\n\n    fakeAuthApi.refreshException = null\n    const secondHeader = await authService.getAuthHeaders()\n    const secondJwt = fakeAuthApi.jwt\n    expect(secondHeader[0].data).to.be.equal(`Bearer ${secondJwt}`)\n    expect(secondJwt).not.to.be.equal(initialJwt)\n  })\n})\n"]}