@icure/api 8.0.23 → 8.0.25

package/icc-x-api/auth/JwtAuthService.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtAuthService = void 0;
 const XHR_1 = require("../../icc-api/api/XHR");
 const JwtUtils_1 = require("./JwtUtils");
+const JwtError_1 = require("./JwtError");
 /**
  * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens
  */
@@ -33,6 +34,14 @@ class JwtAuthService {
     getAuthHeaders() {
         return __awaiter(this, void 0, void 0, function* () {
             return this._currentPromise
+                .then((x) => ({ authJwt: x === null || x === void 0 ? void 0 : x.authJwt, refreshJwt: x === null || x === void 0 ? void 0 : x.refreshJwt }), (e) => {
+                if (e instanceof JwtError_1.JwtError && !!e.jwt && !!e.refreshJwt) {
+                    return { authJwt: e.jwt, refreshJwt: e.refreshJwt };
+                }
+                else {
+                    throw new Error('There was an error while refreshing the token, please re-instantiate the API.');
+                }
+            })
                 .then((x) => {
                 const authJwt = x === null || x === void 0 ? void 0 : x.authJwt;
                 const refreshJwt = x === null || x === void 0 ? void 0 : x.refreshJwt;
@@ -46,6 +55,8 @@ class JwtAuthService {
                             throw new Error('Your iCure back-end version does not support JWT authentication');
                         }
                         return updatedTokens;
+                    }, (e) => {
+                        throw new JwtError_1.JwtError(authJwt, refreshJwt, 'There was an error while refreshing the token, please re-instantiate the API or try again.', e);
                     });
                 }
                 else if (!!this._error) {

package/icc-x-api/auth/JwtAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAM3C,yCAAkD;AAElD;;GAEG;AACH,MAAa,cAAc;IAIzB,YAA6B,OAAmB,EAAE,UAAoD;QAAzE,YAAO,GAAP,OAAO,CAAY;QAHxC,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAiE,OAAO,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAA;QAGvH,IAAI,CAAC,CAAC,UAAU,EAAE;YAChB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;SACnD;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAiB,CAAC,CAAA;IAC/D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7G,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gBAC1B,MAAM,UAAU,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA;gBAEhC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAA,gCAAqB,EAAC,OAAO,CAAC,CAAC,IAAI,UAAU,EAAE;oBAC9D,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAC,CAAC,CAAC,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAC9H,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAAkB;;YAC9C,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,IAAA,gCAAqB,EAAC,UAAU,CAAC,EAAE;gBACrC,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;aACrE;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAM;oBAC/B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAnED,wCAmEC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi } from '../../icc-api'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\nimport { isJwtInvalidOrExpired } from './JwtUtils'\n\n/**\n * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens\n */\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)\n\n  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {\n    if (!!initialJwt) {\n      this._currentPromise = Promise.resolve(initialJwt)\n    }\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x?.refreshJwt as any)\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then((x) => {\n        const authJwt = x?.authJwt\n        const refreshJwt = x?.refreshJwt\n\n        if ((!authJwt || isJwtInvalidOrExpired(authJwt)) && refreshJwt) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then((x) => {\n        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (isJwtInvalidOrExpired(refreshJwt)) {\n      throw Error('Missing or expired refresh token: please log in again')\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token!,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}
+{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAG3C,yCAAkD;AAClD,yCAAqC;AAErC;;GAEG;AACH,MAAa,cAAc;IAIzB,YAA6B,OAAmB,EAAE,UAAoD;QAAzE,YAAO,GAAP,OAAO,CAAY;QAHxC,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAiE,OAAO,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAA;QAGvH,IAAI,CAAC,CAAC,UAAU,EAAE;YAChB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;SACnD;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAiB,CAAC,CAAA;IAC/D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7G,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CACH,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAE,UAAU,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,EAAE,CAAC,EAC3D,CAAC,CAAQ,EAAE,EAAE;gBACX,IAAI,CAAC,YAAY,mBAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;oBACtD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAA;iBACpD;qBAAM;oBACL,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;iBACjG;YACH,CAAC,CACF;iBACA,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gBAC1B,MAAM,UAAU,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA;gBAEhC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAA,gCAAqB,EAAC,OAAO,CAAC,CAAC,IAAI,UAAU,EAAE;oBAC9D,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAC1D,CAAC,aAAa,EAAE,EAAE;wBAChB,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,EACD,CAAC,CAAQ,EAAE,EAAE;wBACX,MAAM,IAAI,mBAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,4FAA4F,EAAE,CAAC,CAAC,CAAA;oBAC1I,CAAC,CACF,CAAA;iBACF;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAC,CAAC,CAAC,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAC9H,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAAkB;;YAC9C,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,IAAA,gCAAqB,EAAC,UAAU,CAAC,EAAE;gBACrC,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;aACrE;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAM;oBAC/B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAlFD,wCAkFC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi } from '../../icc-api'\nimport Header = XHR.Header\nimport { isJwtInvalidOrExpired } from './JwtUtils'\nimport { JwtError } from './JwtError'\n\n/**\n * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens\n */\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)\n\n  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {\n    if (!!initialJwt) {\n      this._currentPromise = Promise.resolve(initialJwt)\n    }\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x?.refreshJwt as any)\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then(\n        (x) => ({ authJwt: x?.authJwt, refreshJwt: x?.refreshJwt }),\n        (e: Error) => {\n          if (e instanceof JwtError && !!e.jwt && !!e.refreshJwt) {\n            return { authJwt: e.jwt, refreshJwt: e.refreshJwt }\n          } else {\n            throw new Error('There was an error while refreshing the token, please re-instantiate the API.')\n          }\n        }\n      )\n      .then((x) => {\n        const authJwt = x?.authJwt\n        const refreshJwt = x?.refreshJwt\n\n        if ((!authJwt || isJwtInvalidOrExpired(authJwt)) && refreshJwt) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then(\n            (updatedTokens) => {\n              // If here the token is null,\n              // it goes in a suspension status\n              if (!updatedTokens.authJwt) {\n                throw new Error('Your iCure back-end version does not support JWT authentication')\n              }\n\n              return updatedTokens\n            },\n            (e: Error) => {\n              throw new JwtError(authJwt, refreshJwt, 'There was an error while refreshing the token, please re-instantiate the API or try again.', e)\n            }\n          )\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then((x) => {\n        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (isJwtInvalidOrExpired(refreshJwt)) {\n      throw Error('Missing or expired refresh token: please log in again')\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token!,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/icc-x-api/auth/JwtBridgedAuthService.js

@@ -14,6 +14,7 @@ const XHR_1 = require("../../icc-api/api/XHR");
 const LoginCredentials_1 = require("../../icc-api/model/LoginCredentials");
 const utils_1 = require("../utils");
 var XHRError = XHR_1.XHR.XHRError;
+const JwtError_1 = require("./JwtError");
 /**
  * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired
  */
@@ -36,6 +37,20 @@ class JwtBridgedAuthService {
     getJWT() {
         return __awaiter(this, void 0, void 0, function* () {
             return this._currentPromise
+                .then(({ authJwt, refreshJwt }) => ({ authJwt, refreshJwt }), (e) => {
+                if (e instanceof JwtError_1.JwtError) {
+                    const wrappedError = e.reason;
+                    if (!!wrappedError.statusCode && wrappedError.statusCode >= 400 && wrappedError.statusCode < 500) {
+                        return { authJwt: undefined, refreshJwt: undefined };
+                    }
+                    else {
+                        return { authJwt: e.jwt, refreshJwt: e.refreshJwt };
+                    }
+                }
+                else {
+                    return { authJwt: undefined, refreshJwt: undefined };
+                }
+            })
                 .then(({ authJwt, refreshJwt }) => {
                 if (!authJwt || this._isJwtInvalidOrExpired(authJwt)) {
                     // If it does not have the JWT, tries to get it
@@ -47,6 +62,8 @@ class JwtBridgedAuthService {
                             throw new Error('Your iCure back-end version does not support JWT authentication');
                         }
                         return updatedTokens;
+                    }, (e) => {
+                        throw new JwtError_1.JwtError(authJwt, refreshJwt, 'There was an error while refreshing the token, please re-instantiate the API or try again.', e);
                     });
                 }
                 else if (!!this._error) {

package/icc-x-api/auth/JwtBridgedAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtBridgedAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtBridgedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B;;GAEG;AACH,MAAa,qBAAqB;IAIhC,YACU,OAAmB,EACnB,QAA4B,EAC5B,QAA4B,EAC5B,mBAAqD,EAAE,EAC/D,UAA+D;QAJvD,YAAO,GAAP,OAAO,CAAY;QACnB,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,qBAAgB,GAAhB,gBAAgB,CAAuC;QAPzD,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAS/F,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAiB,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAQ,EAAE,YAAY,EAAE,UAAW,EAAE,CAAC,CAAC,CAAC,CAAA;IACnJ,CAAC;IAEK,MAAM;;YACV,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE;oBACpD,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACpC,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;gBAC1D,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,IAAI,YAAgD,CAAA;YACpD,IAAI,UAAgC,CAAA;YACpC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI;oBACF,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,IAAI,mCAAgB,CAAC;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CACH,CAAA;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,UAAU,GAAG,CAAa,CAAA;iBAC3B;aACF;YACD,IAAI,CAAC,YAAY,EAAE;gBACjB,YAAY,GAAG,MAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAiC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE;oBACpI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAA;oBACtB,OAAO,CACL,IAAI,aAAJ,IAAI,cAAJ,IAAI,GACJ,CAAC,KAAK;wBACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;4BACnE,IAAI,CAAC,UAAU,EAAE;gCACf,UAAU,GAAG,CAAa,CAAA;6BAC3B;4BACD,OAAO,OAAO,CAAC,OAAO,EAAwB,CAAA;wBAChD,CAAC,CAAC;wBACJ,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;gBACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAiD,CAAC,CAAA;aACrE;YAED,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,UAAU;oBAAE,MAAM,UAAU,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;aAC5E;YAED,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAA;QACH,CAAC;KAAA;IAEO,sBAAsB,CAAC,GAAW;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAA;IACpF,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAlID,sDAkIC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\n/**\n * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired\n */\nexport class JwtBridgedAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(\n    private authApi: IccAuthApi,\n    private username: string | undefined,\n    private password: string | undefined,\n    private thirdPartyTokens: { [thirdParty: string]: string } = {},\n    initialJwt: { authJwt: string; refreshJwt: string } | undefined\n  ) {\n    this._currentPromise = Promise.resolve(initialJwt ?? {})\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x.refreshJwt as any)\n  }\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))\n  }\n\n  async getJWT(): Promise<string | undefined> {\n    return this._currentPromise\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtInvalidOrExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then(({ authJwt }) => {\n        return authJwt\n      })\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this.getJWT().then((authJwt) => {\n      return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n    })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtInvalidOrExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    let authResponse: AuthenticationResponse | undefined\n    let firstError: XHRError | undefined\n    if (this.username && this.password) {\n      try {\n        authResponse = await this.authApi.login(\n          new LoginCredentials({\n            username: this.username,\n            password: this.password,\n          })\n        )\n      } catch (e) {\n        firstError = e as XHRError\n      }\n    }\n    if (!authResponse) {\n      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {\n        const prev = await acc\n        return (\n          prev ??\n          (token\n            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {\n                if (!firstError) {\n                  firstError = e as XHRError\n                }\n                return Promise.resolve() as Promise<undefined>\n              })\n            : undefined)\n        )\n      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)\n    }\n\n    if (!authResponse) {\n      if (firstError) throw firstError\n      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())\n    }\n\n    return {\n      authJwt: authResponse.token,\n      refreshJwt: authResponse.refreshToken,\n    }\n  }\n\n  private _isJwtInvalidOrExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return true\n    }\n    const payload = this._base64Decode(parts[1])\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime() - 10000\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}
+{"version":3,"file":"JwtBridgedAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtBridgedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAE3C,2EAAuE;AAEvE,oCAA8B;AAE9B,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAC9B,yCAAqC;AAErC;;GAEG;AACH,MAAa,qBAAqB;IAIhC,YACU,OAAmB,EACnB,QAA4B,EAC5B,QAA4B,EAC5B,mBAAqD,EAAE,EAC/D,UAA+D;QAJvD,YAAO,GAAP,OAAO,CAAY;QACnB,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,qBAAgB,GAAhB,gBAAgB,CAAuC;QAPzD,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAuD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAS/F,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAiB,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAQ,EAAE,YAAY,EAAE,UAAW,EAAE,CAAC,CAAC,CAAC,CAAA;IACnJ,CAAC;IAEK,MAAM;;YACV,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CACH,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EACtD,CAAC,CAAQ,EAAE,EAAE;gBACX,IAAI,CAAC,YAAY,mBAAQ,EAAE;oBACzB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAa,CAAA;oBACpC,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,IAAI,GAAG,IAAI,YAAY,CAAC,UAAU,GAAG,GAAG,EAAE;wBAChG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;qBACrD;yBAAM;wBACL,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAA;qBACpD;iBACF;qBAAM;oBACL,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;iBACrD;YACH,CAAC,CACF;iBACA,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE;oBACpD,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAC1D,CAAC,aAAa,EAAE,EAAE;wBAChB,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,EACD,CAAC,CAAQ,EAAE,EAAE;wBACX,MAAM,IAAI,mBAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,4FAA4F,EAAE,CAAC,CAAC,CAAA;oBAC1I,CAAC,CACF,CAAA;iBACF;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACpC,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAEa,eAAe,CAAC,UAA8B;;YAC1D,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;gBAC1D,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;aACjC;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAK;oBAC9B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEa,kBAAkB;;YAC9B,IAAI,YAAgD,CAAA;YACpD,IAAI,UAAgC,CAAA;YACpC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI;oBACF,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,IAAI,mCAAgB,CAAC;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CACH,CAAA;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,UAAU,GAAG,CAAa,CAAA;iBAC3B;aACF;YACD,IAAI,CAAC,YAAY,EAAE;gBACjB,YAAY,GAAG,MAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAiC,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE;oBACpI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAA;oBACtB,OAAO,CACL,IAAI,aAAJ,IAAI,cAAJ,IAAI,GACJ,CAAC,KAAK;wBACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;4BACnE,IAAI,CAAC,UAAU,EAAE;gCACf,UAAU,GAAG,CAAa,CAAA;6BAC3B;4BACD,OAAO,OAAO,CAAC,OAAO,EAAwB,CAAA;wBAChD,CAAC,CAAC;wBACJ,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;gBACH,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAiD,CAAC,CAAA;aACrE;YAED,IAAI,CAAC,YAAY,EAAE;gBACjB,IAAI,UAAU;oBAAE,MAAM,UAAU,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;aAC5E;YAED,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,KAAK;gBAC3B,UAAU,EAAE,YAAY,CAAC,YAAY;aACtC,CAAA;QACH,CAAC;KAAA;IAEO,sBAAsB,CAAC,GAAW;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAA;IACpF,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAtJD,sDAsJC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\nimport { JwtError } from './JwtError'\n\n/**\n * Differs from JwtAuthService in that it can create new refresh tokens if the old one is expired\n */\nexport class JwtBridgedAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt?: string; refreshJwt?: string }> = Promise.resolve({})\n\n  constructor(\n    private authApi: IccAuthApi,\n    private username: string | undefined,\n    private password: string | undefined,\n    private thirdPartyTokens: { [thirdParty: string]: string } = {},\n    initialJwt: { authJwt: string; refreshJwt: string } | undefined\n  ) {\n    this._currentPromise = Promise.resolve(initialJwt ?? {})\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x.refreshJwt as any)\n  }\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.getAuthHeaders().then(() => this._currentPromise.then(({ authJwt, refreshJwt }) => ({ token: authJwt!, refreshToken: refreshJwt! })))\n  }\n\n  async getJWT(): Promise<string | undefined> {\n    return this._currentPromise\n      .then(\n        ({ authJwt, refreshJwt }) => ({ authJwt, refreshJwt }),\n        (e: Error) => {\n          if (e instanceof JwtError) {\n            const wrappedError = e.reason as any\n            if (!!wrappedError.statusCode && wrappedError.statusCode >= 400 && wrappedError.statusCode < 500) {\n              return { authJwt: undefined, refreshJwt: undefined }\n            } else {\n              return { authJwt: e.jwt, refreshJwt: e.refreshJwt }\n            }\n          } else {\n            return { authJwt: undefined, refreshJwt: undefined }\n          }\n        }\n      )\n      .then(({ authJwt, refreshJwt }) => {\n        if (!authJwt || this._isJwtInvalidOrExpired(authJwt)) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then(\n            (updatedTokens) => {\n              // If here the token is null,\n              // it goes in a suspension status\n              if (!updatedTokens.authJwt) {\n                throw new Error('Your iCure back-end version does not support JWT authentication')\n              }\n\n              return updatedTokens\n            },\n            (e: Error) => {\n              throw new JwtError(authJwt, refreshJwt, 'There was an error while refreshing the token, please re-instantiate the API or try again.', e)\n            }\n          )\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then(({ authJwt }) => {\n        return authJwt\n      })\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this.getJWT().then((authJwt) => {\n      return [new XHR.Header('Authorization', `Bearer ${authJwt}`)]\n    })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string | undefined): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (!refreshJwt || this._isJwtInvalidOrExpired(refreshJwt)) {\n      return this._loginAndGetTokens()\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private async _loginAndGetTokens(): Promise<{ authJwt?: string; refreshJwt?: string }> {\n    let authResponse: AuthenticationResponse | undefined\n    let firstError: XHRError | undefined\n    if (this.username && this.password) {\n      try {\n        authResponse = await this.authApi.login(\n          new LoginCredentials({\n            username: this.username,\n            password: this.password,\n          })\n        )\n      } catch (e) {\n        firstError = e as XHRError\n      }\n    }\n    if (!authResponse) {\n      authResponse = await (Object.entries(this.thirdPartyTokens) as [OAuthThirdParty, string][]).reduce(async (acc, [thirdParty, token]) => {\n        const prev = await acc\n        return (\n          prev ??\n          (token\n            ? this.authApi.loginWithThirdPartyToken(thirdParty, token).catch((e) => {\n                if (!firstError) {\n                  firstError = e as XHRError\n                }\n                return Promise.resolve() as Promise<undefined>\n              })\n            : undefined)\n        )\n      }, Promise.resolve() as Promise<AuthenticationResponse | undefined>)\n    }\n\n    if (!authResponse) {\n      if (firstError) throw firstError\n      throw new XHRError('', 'Unknown error', 401, 'Unauthorized', new Headers())\n    }\n\n    return {\n      authJwt: authResponse.token,\n      refreshJwt: authResponse.refreshToken,\n    }\n  }\n\n  private _isJwtInvalidOrExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return true\n    }\n    const payload = this._base64Decode(parts[1])\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime() - 10000\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/icc-x-api/auth/JwtError.d.ts

@@ -0,0 +1,7 @@
+export declare class JwtError extends Error {
+    readonly jwt: string | undefined;
+    readonly refreshJwt: string | undefined;
+    readonly message: string;
+    readonly reason: Error;
+    constructor(jwt: string | undefined, refreshJwt: string | undefined, message: string, reason: Error);
+}

package/icc-x-api/auth/JwtError.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtError = void 0;
+class JwtError extends Error {
+    constructor(jwt, refreshJwt, message, reason) {
+        super(message);
+        this.jwt = jwt;
+        this.refreshJwt = refreshJwt;
+        this.message = message;
+        this.reason = reason;
+    }
+}
+exports.JwtError = JwtError;
+//# sourceMappingURL=JwtError.js.map

package/icc-x-api/auth/JwtError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtError.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtError.ts"],"names":[],"mappings":";;;AAAA,MAAa,QAAS,SAAQ,KAAK;IACjC,YAAqB,GAAuB,EAAW,UAA8B,EAAW,OAAe,EAAW,MAAa;QACrI,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,QAAG,GAAH,GAAG,CAAoB;QAAW,eAAU,GAAV,UAAU,CAAoB;QAAW,YAAO,GAAP,OAAO,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAO;IAEvI,CAAC;CACF;AAJD,4BAIC","sourcesContent":["export class JwtError extends Error {\n  constructor(readonly jwt: string | undefined, readonly refreshJwt: string | undefined, readonly message: string, readonly reason: Error) {\n    super(message)\n  }\n}\n"]}

package/icc-x-api/crypto/AES.d.ts

@@ -1,4 +1,56 @@
-export declare class AESUtils {
+export interface AESUtils {
+    encryptWithRawKey(rawKey: string, plainData: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>;
+    encrypt(cryptoKey: CryptoKey, plainData: ArrayBuffer | Uint8Array, rawKey?: string): Promise<ArrayBuffer>;
+    decryptWithRawKey(rawKey: string, plainData: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>;
+    /**
+     *
+     * @param cryptoKey (CryptoKey)
+     * @param encryptedData (ArrayBuffer)
+     * @param rawKey
+     * @returns {Promise} will be ArrayBuffer
+     */
+    decrypt(cryptoKey: CryptoKey, encryptedData: ArrayBuffer | Uint8Array, rawKey?: string): Promise<ArrayBuffer>;
+    /**
+     * @deprecated this method is not correct: in some cases decryption may not fail even if the wrong key is used: if the
+     * first provided keys are wrong and the last one is correct the decryption will succeed for sure, but there is a small
+     * chance that you will get garbage
+     */
+    decryptSome(cryptoKeys: CryptoKey[], uint8Array: Uint8Array): Promise<ArrayBuffer>;
+    /**
+     *
+     * @param toHex boolean, if true, it returns hex String
+     * @returns {Promise} either Hex string or CryptoKey
+     */
+    generateCryptoKey(toHex: false): Promise<CryptoKey>;
+    generateCryptoKey(toHex: true): Promise<string>;
+    generateCryptoKey(toHex: boolean): Promise<string | CryptoKey>;
+    generateIV(ivByteLength: number): Uint8Array;
+    /**
+     * This function return a promise which will be the key Format will be either 'raw' or 'jwk'.
+     * JWK: Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)
+     *
+     * @param cryptoKey CryptoKey
+     * @param format will be 'raw' or 'jwk'
+     * @returns {Promise} will the AES Key
+     */
+    exportKey(cryptoKey: CryptoKey, format: 'raw'): Promise<ArrayBuffer>;
+    exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>;
+    exportKey(cryptoKey: CryptoKey, format: 'jwk' | 'raw'): Promise<ArrayBuffer | JsonWebKey>;
+    /**
+     * the ability to import a key that have already been created elsewhere, for use within the web
+     * application that is invoking the import function, for use within the importing web application's
+     * origin. This necessiates an interoperable key format, such as JSON Web Key [JWK] which may be
+     * represented as octets.
+     *
+     * https://chromium.googlesource.com/chromium/blink.git/+/6b902997e3ca0384c8fa6fe56f79ecd7589d3ca6/LayoutTests/crypto/resources/common.js
+     *
+     * @param format 'raw' or 'jwk'
+     * @param aesKey
+     * @returns {*}
+     */
+    importKey(format: 'jwk' | 'raw', aesKey: JsonWebKey | ArrayBuffer | Uint8Array): Promise<CryptoKey>;
+}
+export declare class AESUtilsImpl implements AESUtils {
     /********* AES Config **********/
     ivLength: number;
     aesAlgorithmEncryptName: string;
@@ -51,4 +103,4 @@ export declare class AESUtils {
      */
     importKey(format: 'jwk' | 'raw', aesKey: JsonWebKey | ArrayBuffer | Uint8Array): Promise<CryptoKey>;
 }
-export declare const AES: AESUtils;
+export declare const AES: AESUtilsImpl;

package/icc-x-api/crypto/AES.js

@@ -9,9 +9,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AES = exports.AESUtils = void 0;
+exports.AES = exports.AESUtilsImpl = void 0;
 const utils_1 = require("../utils");
-class AESUtils {
+class AESUtilsImpl {
     set debug(value) {
         this._debug = value;
     }
@@ -64,7 +64,7 @@ class AESUtils {
      * @param rawKey
      * @returns {Promise} will be ArrayBuffer
      */
-    decrypt(cryptoKey, encryptedData, rawKey = '<NA>') {
+    decrypt(cryptoKey, encryptedData, rawKey) {
         return new Promise((resolve, reject) => {
             if (!cryptoKey) {
                 return reject('No crypto key provided for decryption');
@@ -161,6 +161,6 @@ class AESUtils {
         });
     }
 }
-exports.AESUtils = AESUtils;
-exports.AES = new AESUtils();
+exports.AESUtilsImpl = AESUtilsImpl;
+exports.AES = new AESUtilsImpl();
 //# sourceMappingURL=AES.js.map

package/icc-x-api/crypto/AES.js.map

@@ -1 +1 @@
-{"version":3,"file":"AES.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/AES.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAuD;AAEvD,MAAa,QAAQ;IAYnB,IAAI,KAAK,CAAC,KAAc;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QAfvI,iCAAiC;QACjC,aAAQ,GAAG,EAAE,CAAA;QACb,4BAAuB,GAAG,SAAS,CAAA;QAEnC,oBAAe,GAAoB;YACjC,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG;SACZ,CAAA;QAEO,WAAM,GAAY,KAAK,CAAA;QAO7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEK,iBAAiB,CAAC,MAAc,EAAE,SAAmC;;YACzE,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAC7D,SAAS,EACT,MAAM,CAAC,+DAA+D;aACvE,CAAA;QACH,CAAC;KAAA;IAED,OAAO,CAAC,SAAoB,EAAE,SAAmC,EAAE,MAAM,GAAG,MAAM;QAChF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAA4B,EAAE,EAAE;YACxF,IAAI,SAAS,YAAY,UAAU,EAAE;gBACnC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAA;gBAC/B,SAAS,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAgB,CAAA;aACvH;YACD,MAAM,mBAAmB,GAAG;gBAC1B,IAAI,EAAE,IAAI,CAAC,uBAAuB;gBAClC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;aACnC,CAAA;YACD,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAA,cAAM,EAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;YACzE,IAAI,CAAC,MAAM,CAAC,MAAM;iBACf,OAAO,mBAED,mBAAmB,GAExB,SAAS,EACT,SAAS,CACV;iBACA,IAAI,CACH,CAAC,UAAU,EAAE,EAAE;gBACb,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAA,cAAM,EAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBAC/D,OAAO,OAAO,CAAC,IAAA,oBAAY,EAAC,mBAAmB,CAAC,EAAE,CAAC,MAAqB,EAAE,UAAU,CAAC,CAAC,CAAA;YACxF,CAAC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,yBAAyB,GAAG,GAAG,CAAC,CACjD,CAAA;QACL,CAAC,CAAC,CAAA;IACJ,CAAC;IAEK,iBAAiB,CAAC,MAAc,EAAE,SAAmC;;YACzE,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAC7D,SAAS,EACT,MAAM,CAAC,+DAA+D;aACvE,CAAA;QACH,CAAC;KAAA;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAoB,EAAE,aAAuC,EAAE,MAAM,GAAG,MAAM;QACpF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAA4B,EAAE,EAAE;YACxF,IAAI,CAAC,SAAS,EAAE;gBACd,OAAO,MAAM,CAAC,uCAAuC,CAAC,CAAA;aACvD;YACD,MAAM,kBAAkB,GAAG,aAAa,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;YAC/G,MAAM,mBAAmB,GAAG;gBAC1B,IAAI,EAAE,IAAI,CAAC,uBAAuB;gBAClC,EAAE,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC;gBAEjD;;;;;;;;;;;;;;;mBAeG;aACJ,CAAA;YACD,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAA,cAAM,EAAC,aAAa,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACpI,CAAC,cAAc,EAAE,EAAE;gBACjB,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAA,cAAM,EAAC,cAAc,CAAC,EAAE,CAAC,CAAA;gBACvE,OAAO,CAAC,cAAc,CAAC,CAAA;YACzB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC,CAAA;YACpD,CAAC,CACF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAEK,WAAW,CAAC,UAAuB,EAAE,UAAsB;;YAC/D,IAAI;gBACF,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;aAC/C;YAAC,OAAO,CAAC,EAAE;gBACV,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;oBACzB,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;iBACzD;qBAAM;oBACL,MAAM,CAAC,CAAA;iBACR;aACF;QACH,CAAC;KAAA;IAWD,iBAAiB,CAAC,KAAc;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAA2C,EAAE,MAA4B,EAAE,EAAE;YAC/F,MAAM,WAAW,GAAG,IAAI,CAAA;YACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YACpD,MAAM,gBAAgB,GAAuB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAuB,CAAA;YAC/I,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK;gBAClC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;gBACxC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAChH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,mCAAmC;IACnC,UAAU,CAAC,YAAoB;QAC7B,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAClF,CAAC;IAYD,SAAS,CAAC,SAAoB,EAAE,MAAqB;QACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiD,EAAE,MAA4B,EAAE,EAAE;YACrG,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACrF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,MAAqB,EAAE,MAA6C;QAC5E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAA4B,EAAE,EAAE;YACtF,MAAM,WAAW,GAAG,IAAI,CAAA;YACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YACpD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM;iBACtB,SAAS,CAAC,MAAa,EAAE,MAAa,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC;iBACrF,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,MAAM,YAAY,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE;oBACpF,OAAO,CAAC,IAAI,CAAC,iBAAiB,IAAA,cAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAA;iBACvD;gBACD,MAAM,GAAG,CAAA;YACX,CAAC,CAAC;iBACD,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAhMD,4BAgMC;AAEY,QAAA,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA","sourcesContent":["import { appendBuffer, hex2ua, ua2hex } from '../utils'\n\nexport class AESUtils {\n  /********* AES Config **********/\n  ivLength = 16\n  aesAlgorithmEncryptName = 'AES-CBC'\n\n  aesKeyGenParams: AesKeyGenParams = {\n    name: 'AES-CBC',\n    length: 256,\n  }\n  private crypto: Crypto\n  private _debug: boolean = false\n\n  set debug(value: boolean) {\n    this._debug = value\n  }\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this.crypto = crypto\n  }\n\n  async encryptWithRawKey(rawKey: string, plainData: ArrayBuffer | Uint8Array): Promise<ArrayBuffer> {\n    return this.encrypt(\n      await this.importKey('raw', hex2ua(rawKey.replace(/-/g, ''))),\n      plainData,\n      rawKey // Used for logging only if debug is enabled, ok to always pass\n    )\n  }\n\n  encrypt(cryptoKey: CryptoKey, plainData: ArrayBuffer | Uint8Array, rawKey = '<NA>'): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject: (reason: any) => any) => {\n      if (plainData instanceof Uint8Array) {\n        const buffer = plainData.buffer\n        plainData = (buffer.byteLength > plainData.byteLength ? buffer.slice(0, plainData.byteLength) : buffer) as ArrayBuffer\n      }\n      const aesAlgorithmEncrypt = {\n        name: this.aesAlgorithmEncryptName,\n        iv: this.generateIV(this.ivLength),\n      }\n      this._debug && console.log(`encrypt ${ua2hex(plainData)} with ${rawKey}`)\n      this.crypto.subtle\n        .encrypt(\n          {\n            ...aesAlgorithmEncrypt,\n          } /* some ill behaved implementations change the values in place */,\n          cryptoKey,\n          plainData\n        )\n        .then(\n          (cipherData) => {\n            this._debug && console.log(`cipherData: ${ua2hex(cipherData)}`)\n            return resolve(appendBuffer(aesAlgorithmEncrypt.iv.buffer as ArrayBuffer, cipherData))\n          },\n          (err) => reject('AES encryption failed: ' + err)\n        )\n    })\n  }\n\n  async decryptWithRawKey(rawKey: string, plainData: ArrayBuffer | Uint8Array): Promise<ArrayBuffer> {\n    return this.decrypt(\n      await this.importKey('raw', hex2ua(rawKey.replace(/-/g, ''))),\n      plainData,\n      rawKey // Used for logging only if debug is enabled, ok to always pass\n    )\n  }\n\n  /**\n   *\n   * @param cryptoKey (CryptoKey)\n   * @param encryptedData (ArrayBuffer)\n   * @param rawKey\n   * @returns {Promise} will be ArrayBuffer\n   */\n  decrypt(cryptoKey: CryptoKey, encryptedData: ArrayBuffer | Uint8Array, rawKey = '<NA>'): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject: (reason: any) => any) => {\n      if (!cryptoKey) {\n        return reject('No crypto key provided for decryption')\n      }\n      const encryptedDataUint8 = encryptedData instanceof ArrayBuffer ? new Uint8Array(encryptedData) : encryptedData\n      const aesAlgorithmEncrypt = {\n        name: this.aesAlgorithmEncryptName,\n        iv: encryptedDataUint8.subarray(0, this.ivLength),\n\n        /*\n         * IF THIS BIT OF CODE PRODUCES A DOMEXCEPTION CODE 0 ERROR, IT MIGHT BE RELATED TO THIS:\n         *\n         * NOTOK:\n         * if (!hcparty.hcPartyKeys && !hcparty.hcPartyKeys[hcpartyId] && hcparty.hcPartyKeys[hcpartyId].length !== 2) {\n         *   throw 'No hcPartyKey for this Healthcare party(' + hcpartyId + ').';\n         * }\n         * var delegateHcPartyKey = hcparty.hcPartyKeys[hcpartyId][1];\n         *\n         * SHOULD BE:\n         * var delegatorId = patient.delegations[hcpartyId][0].owner;\n         * if (!hcparty.hcPartyKeys && !hcparty.hcPartyKeys[delegatorId] && hcparty.hcPartyKeys[delegatorId].length !== 2) {\n         *   throw 'No hcPartyKey for this Healthcare party(' + delegatorId + ').';\n         * }\n         * var delegateHcPartyKey = hcparty.hcPartyKeys[delegatorId][1];\n         */\n      }\n      this._debug && console.log(`decrypt ${ua2hex(encryptedData)} with ${rawKey}`)\n      this.crypto.subtle.decrypt(aesAlgorithmEncrypt, cryptoKey, encryptedDataUint8.subarray(this.ivLength, encryptedDataUint8.length)).then(\n        (decipheredData) => {\n          this._debug && console.log(`decipheredData: ${ua2hex(decipheredData)}`)\n          resolve(decipheredData)\n        },\n        (err) => {\n          reject(new Error('AES decryption failed: ' + err))\n        }\n      )\n    })\n  }\n\n  async decryptSome(cryptoKeys: CryptoKey[], uint8Array: Uint8Array): Promise<ArrayBuffer> {\n    try {\n      return this.decrypt(cryptoKeys[0], uint8Array)\n    } catch (e) {\n      if (cryptoKeys.length > 1) {\n        return this.decryptSome(cryptoKeys.slice(1), uint8Array)\n      } else {\n        throw e\n      }\n    }\n  }\n\n  // generate an AES key\n  // noinspection JSUnusedGlobalSymbols\n  /**\n   *\n   * @param toHex boolean, if true, it returns hex String\n   * @returns {Promise} either Hex string or CryptoKey\n   */\n  generateCryptoKey(toHex: false): Promise<CryptoKey>\n  generateCryptoKey(toHex: true): Promise<string>\n  generateCryptoKey(toHex: boolean): Promise<string | CryptoKey> {\n    return new Promise((resolve: (value: CryptoKey | string) => any, reject: (reason: any) => any) => {\n      const extractable = true\n      const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n      const cryptoKeyPromise: Promise<CryptoKey> = this.crypto.subtle.generateKey(this.aesKeyGenParams, extractable, keyUsages) as Promise<CryptoKey>\n      return toHex === undefined || !toHex\n        ? cryptoKeyPromise.then(resolve, reject)\n        : cryptoKeyPromise.then((k) => this.exportKey(k, 'raw'), reject).then((raw) => resolve(ua2hex(raw)), reject)\n    })\n  }\n\n  // noinspection JSMethodCanBeStatic\n  generateIV(ivByteLength: number): Uint8Array {\n    return new Uint8Array(this.crypto.getRandomValues(new Uint8Array(ivByteLength)))\n  }\n\n  /**\n   * This function return a promise which will be the key Format will be either 'raw' or 'jwk'.\n   * JWK: Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   *\n   * @param cryptoKey CryptoKey\n   * @param format will be 'raw' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'raw'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n  exportKey(cryptoKey: CryptoKey, format: 'jwk' | 'raw'): Promise<ArrayBuffer | JsonWebKey> {\n    return new Promise((resolve: (value: ArrayBuffer | JsonWebKey) => any, reject: (reason: any) => any) => {\n      return this.crypto.subtle.exportKey(format as any, cryptoKey).then(resolve, reject)\n    })\n  }\n\n  /**\n   * the ability to import a key that have already been created elsewhere, for use within the web\n   * application that is invoking the import function, for use within the importing web application's\n   * origin. This necessiates an interoperable key format, such as JSON Web Key [JWK] which may be\n   * represented as octets.\n   *\n   * https://chromium.googlesource.com/chromium/blink.git/+/6b902997e3ca0384c8fa6fe56f79ecd7589d3ca6/LayoutTests/crypto/resources/common.js\n   *\n   * @param format 'raw' or 'jwk'\n   * @param aesKey\n   * @returns {*}\n   */\n  importKey(format: 'jwk' | 'raw', aesKey: JsonWebKey | ArrayBuffer | Uint8Array): Promise<CryptoKey> {\n    return new Promise((resolve: (value: CryptoKey) => any, reject: (reason: any) => any) => {\n      const extractable = true\n      const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n      return this.crypto.subtle\n        .importKey(format as any, aesKey as any, this.aesKeyGenParams, extractable, keyUsages)\n        .catch((err) => {\n          if (format == 'raw' && (aesKey instanceof ArrayBuffer || ArrayBuffer.isView(aesKey))) {\n            console.warn(`Import of key ${ua2hex(aesKey)} failed`)\n          }\n          throw err\n        })\n        .then(resolve, reject)\n    })\n  }\n}\n\nexport const AES = new AESUtils()\n"]}
+{"version":3,"file":"AES.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/AES.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAuD;AAmEvD,MAAa,YAAY;IAYvB,IAAI,KAAK,CAAC,KAAc;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QAfvI,iCAAiC;QACjC,aAAQ,GAAG,EAAE,CAAA;QACb,4BAAuB,GAAG,SAAS,CAAA;QAEnC,oBAAe,GAAoB;YACjC,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG;SACZ,CAAA;QAEO,WAAM,GAAY,KAAK,CAAA;QAO7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEK,iBAAiB,CAAC,MAAc,EAAE,SAAmC;;YACzE,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAC7D,SAAS,EACT,MAAM,CAAC,+DAA+D;aACvE,CAAA;QACH,CAAC;KAAA;IAED,OAAO,CAAC,SAAoB,EAAE,SAAmC,EAAE,MAAM,GAAG,MAAM;QAChF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAA4B,EAAE,EAAE;YACxF,IAAI,SAAS,YAAY,UAAU,EAAE;gBACnC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAA;gBAC/B,SAAS,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAgB,CAAA;aACvH;YACD,MAAM,mBAAmB,GAAG;gBAC1B,IAAI,EAAE,IAAI,CAAC,uBAAuB;gBAClC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;aACnC,CAAA;YACD,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAA,cAAM,EAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;YACzE,IAAI,CAAC,MAAM,CAAC,MAAM;iBACf,OAAO,mBAED,mBAAmB,GAExB,SAAS,EACT,SAAS,CACV;iBACA,IAAI,CACH,CAAC,UAAU,EAAE,EAAE;gBACb,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAA,cAAM,EAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBAC/D,OAAO,OAAO,CAAC,IAAA,oBAAY,EAAC,mBAAmB,CAAC,EAAE,CAAC,MAAqB,EAAE,UAAU,CAAC,CAAC,CAAA;YACxF,CAAC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,yBAAyB,GAAG,GAAG,CAAC,CACjD,CAAA;QACL,CAAC,CAAC,CAAA;IACJ,CAAC;IAEK,iBAAiB,CAAC,MAAc,EAAE,SAAmC;;YACzE,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAC7D,SAAS,EACT,MAAM,CAAC,+DAA+D;aACvE,CAAA;QACH,CAAC;KAAA;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAoB,EAAE,aAAuC,EAAE,MAAe;QACpF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAA4B,EAAE,EAAE;YACxF,IAAI,CAAC,SAAS,EAAE;gBACd,OAAO,MAAM,CAAC,uCAAuC,CAAC,CAAA;aACvD;YACD,MAAM,kBAAkB,GAAG,aAAa,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;YAC/G,MAAM,mBAAmB,GAAG;gBAC1B,IAAI,EAAE,IAAI,CAAC,uBAAuB;gBAClC,EAAE,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC;gBAEjD;;;;;;;;;;;;;;;mBAeG;aACJ,CAAA;YACD,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAA,cAAM,EAAC,aAAa,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACpI,CAAC,cAAc,EAAE,EAAE;gBACjB,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAA,cAAM,EAAC,cAAc,CAAC,EAAE,CAAC,CAAA;gBACvE,OAAO,CAAC,cAAc,CAAC,CAAA;YACzB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC,CAAA;YACpD,CAAC,CACF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAEK,WAAW,CAAC,UAAuB,EAAE,UAAsB;;YAC/D,IAAI;gBACF,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;aAC/C;YAAC,OAAO,CAAC,EAAE;gBACV,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;oBACzB,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;iBACzD;qBAAM;oBACL,MAAM,CAAC,CAAA;iBACR;aACF;QACH,CAAC;KAAA;IAWD,iBAAiB,CAAC,KAAc;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAA2C,EAAE,MAA4B,EAAE,EAAE;YAC/F,MAAM,WAAW,GAAG,IAAI,CAAA;YACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YACpD,MAAM,gBAAgB,GAAuB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAuB,CAAA;YAC/I,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK;gBAClC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;gBACxC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAChH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,mCAAmC;IACnC,UAAU,CAAC,YAAoB;QAC7B,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAClF,CAAC;IAYD,SAAS,CAAC,SAAoB,EAAE,MAAqB;QACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiD,EAAE,MAA4B,EAAE,EAAE;YACrG,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACrF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,MAAqB,EAAE,MAA6C;QAC5E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAA4B,EAAE,EAAE;YACtF,MAAM,WAAW,GAAG,IAAI,CAAA;YACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YACpD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM;iBACtB,SAAS,CAAC,MAAa,EAAE,MAAa,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC;iBACrF,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,MAAM,YAAY,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE;oBACpF,OAAO,CAAC,IAAI,CAAC,iBAAiB,IAAA,cAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAA;iBACvD;gBACD,MAAM,GAAG,CAAA;YACX,CAAC,CAAC;iBACD,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAhMD,oCAgMC;AAEY,QAAA,GAAG,GAAG,IAAI,YAAY,EAAE,CAAA","sourcesContent":["import { appendBuffer, hex2ua, ua2hex } from '../utils'\n\nexport interface AESUtils {\n  encryptWithRawKey(rawKey: string, plainData: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>\n\n  encrypt(cryptoKey: CryptoKey, plainData: ArrayBuffer | Uint8Array, rawKey?: string): Promise<ArrayBuffer>\n\n  decryptWithRawKey(rawKey: string, plainData: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>\n\n  /**\n   *\n   * @param cryptoKey (CryptoKey)\n   * @param encryptedData (ArrayBuffer)\n   * @param rawKey\n   * @returns {Promise} will be ArrayBuffer\n   */\n  decrypt(cryptoKey: CryptoKey, encryptedData: ArrayBuffer | Uint8Array, rawKey?: string): Promise<ArrayBuffer>\n\n  /**\n   * @deprecated this method is not correct: in some cases decryption may not fail even if the wrong key is used: if the\n   * first provided keys are wrong and the last one is correct the decryption will succeed for sure, but there is a small\n   * chance that you will get garbage\n   */\n  decryptSome(cryptoKeys: CryptoKey[], uint8Array: Uint8Array): Promise<ArrayBuffer>\n\n  /**\n   *\n   * @param toHex boolean, if true, it returns hex String\n   * @returns {Promise} either Hex string or CryptoKey\n   */\n  generateCryptoKey(toHex: false): Promise<CryptoKey>\n\n  generateCryptoKey(toHex: true): Promise<string>\n\n  generateCryptoKey(toHex: boolean): Promise<string | CryptoKey>\n\n  generateIV(ivByteLength: number): Uint8Array\n\n  /**\n   * This function return a promise which will be the key Format will be either 'raw' or 'jwk'.\n   * JWK: Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   *\n   * @param cryptoKey CryptoKey\n   * @param format will be 'raw' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'raw'): Promise<ArrayBuffer>\n\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n\n  exportKey(cryptoKey: CryptoKey, format: 'jwk' | 'raw'): Promise<ArrayBuffer | JsonWebKey>\n\n  /**\n   * the ability to import a key that have already been created elsewhere, for use within the web\n   * application that is invoking the import function, for use within the importing web application's\n   * origin. This necessiates an interoperable key format, such as JSON Web Key [JWK] which may be\n   * represented as octets.\n   *\n   * https://chromium.googlesource.com/chromium/blink.git/+/6b902997e3ca0384c8fa6fe56f79ecd7589d3ca6/LayoutTests/crypto/resources/common.js\n   *\n   * @param format 'raw' or 'jwk'\n   * @param aesKey\n   * @returns {*}\n   */\n  importKey(format: 'jwk' | 'raw', aesKey: JsonWebKey | ArrayBuffer | Uint8Array): Promise<CryptoKey>\n}\n\nexport class AESUtilsImpl implements AESUtils {\n  /********* AES Config **********/\n  ivLength = 16\n  aesAlgorithmEncryptName = 'AES-CBC'\n\n  aesKeyGenParams: AesKeyGenParams = {\n    name: 'AES-CBC',\n    length: 256,\n  }\n  private crypto: Crypto\n  private _debug: boolean = false\n\n  set debug(value: boolean) {\n    this._debug = value\n  }\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this.crypto = crypto\n  }\n\n  async encryptWithRawKey(rawKey: string, plainData: ArrayBuffer | Uint8Array): Promise<ArrayBuffer> {\n    return this.encrypt(\n      await this.importKey('raw', hex2ua(rawKey.replace(/-/g, ''))),\n      plainData,\n      rawKey // Used for logging only if debug is enabled, ok to always pass\n    )\n  }\n\n  encrypt(cryptoKey: CryptoKey, plainData: ArrayBuffer | Uint8Array, rawKey = '<NA>'): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject: (reason: any) => any) => {\n      if (plainData instanceof Uint8Array) {\n        const buffer = plainData.buffer\n        plainData = (buffer.byteLength > plainData.byteLength ? buffer.slice(0, plainData.byteLength) : buffer) as ArrayBuffer\n      }\n      const aesAlgorithmEncrypt = {\n        name: this.aesAlgorithmEncryptName,\n        iv: this.generateIV(this.ivLength),\n      }\n      this._debug && console.log(`encrypt ${ua2hex(plainData)} with ${rawKey}`)\n      this.crypto.subtle\n        .encrypt(\n          {\n            ...aesAlgorithmEncrypt,\n          } /* some ill behaved implementations change the values in place */,\n          cryptoKey,\n          plainData\n        )\n        .then(\n          (cipherData) => {\n            this._debug && console.log(`cipherData: ${ua2hex(cipherData)}`)\n            return resolve(appendBuffer(aesAlgorithmEncrypt.iv.buffer as ArrayBuffer, cipherData))\n          },\n          (err) => reject('AES encryption failed: ' + err)\n        )\n    })\n  }\n\n  async decryptWithRawKey(rawKey: string, plainData: ArrayBuffer | Uint8Array): Promise<ArrayBuffer> {\n    return this.decrypt(\n      await this.importKey('raw', hex2ua(rawKey.replace(/-/g, ''))),\n      plainData,\n      rawKey // Used for logging only if debug is enabled, ok to always pass\n    )\n  }\n\n  /**\n   *\n   * @param cryptoKey (CryptoKey)\n   * @param encryptedData (ArrayBuffer)\n   * @param rawKey\n   * @returns {Promise} will be ArrayBuffer\n   */\n  decrypt(cryptoKey: CryptoKey, encryptedData: ArrayBuffer | Uint8Array, rawKey?: string): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject: (reason: any) => any) => {\n      if (!cryptoKey) {\n        return reject('No crypto key provided for decryption')\n      }\n      const encryptedDataUint8 = encryptedData instanceof ArrayBuffer ? new Uint8Array(encryptedData) : encryptedData\n      const aesAlgorithmEncrypt = {\n        name: this.aesAlgorithmEncryptName,\n        iv: encryptedDataUint8.subarray(0, this.ivLength),\n\n        /*\n         * IF THIS BIT OF CODE PRODUCES A DOMEXCEPTION CODE 0 ERROR, IT MIGHT BE RELATED TO THIS:\n         *\n         * NOTOK:\n         * if (!hcparty.hcPartyKeys && !hcparty.hcPartyKeys[hcpartyId] && hcparty.hcPartyKeys[hcpartyId].length !== 2) {\n         *   throw 'No hcPartyKey for this Healthcare party(' + hcpartyId + ').';\n         * }\n         * var delegateHcPartyKey = hcparty.hcPartyKeys[hcpartyId][1];\n         *\n         * SHOULD BE:\n         * var delegatorId = patient.delegations[hcpartyId][0].owner;\n         * if (!hcparty.hcPartyKeys && !hcparty.hcPartyKeys[delegatorId] && hcparty.hcPartyKeys[delegatorId].length !== 2) {\n         *   throw 'No hcPartyKey for this Healthcare party(' + delegatorId + ').';\n         * }\n         * var delegateHcPartyKey = hcparty.hcPartyKeys[delegatorId][1];\n         */\n      }\n      this._debug && console.log(`decrypt ${ua2hex(encryptedData)} with ${rawKey}`)\n      this.crypto.subtle.decrypt(aesAlgorithmEncrypt, cryptoKey, encryptedDataUint8.subarray(this.ivLength, encryptedDataUint8.length)).then(\n        (decipheredData) => {\n          this._debug && console.log(`decipheredData: ${ua2hex(decipheredData)}`)\n          resolve(decipheredData)\n        },\n        (err) => {\n          reject(new Error('AES decryption failed: ' + err))\n        }\n      )\n    })\n  }\n\n  async decryptSome(cryptoKeys: CryptoKey[], uint8Array: Uint8Array): Promise<ArrayBuffer> {\n    try {\n      return this.decrypt(cryptoKeys[0], uint8Array)\n    } catch (e) {\n      if (cryptoKeys.length > 1) {\n        return this.decryptSome(cryptoKeys.slice(1), uint8Array)\n      } else {\n        throw e\n      }\n    }\n  }\n\n  // generate an AES key\n  // noinspection JSUnusedGlobalSymbols\n  /**\n   *\n   * @param toHex boolean, if true, it returns hex String\n   * @returns {Promise} either Hex string or CryptoKey\n   */\n  generateCryptoKey(toHex: false): Promise<CryptoKey>\n  generateCryptoKey(toHex: true): Promise<string>\n  generateCryptoKey(toHex: boolean): Promise<string | CryptoKey> {\n    return new Promise((resolve: (value: CryptoKey | string) => any, reject: (reason: any) => any) => {\n      const extractable = true\n      const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n      const cryptoKeyPromise: Promise<CryptoKey> = this.crypto.subtle.generateKey(this.aesKeyGenParams, extractable, keyUsages) as Promise<CryptoKey>\n      return toHex === undefined || !toHex\n        ? cryptoKeyPromise.then(resolve, reject)\n        : cryptoKeyPromise.then((k) => this.exportKey(k, 'raw'), reject).then((raw) => resolve(ua2hex(raw)), reject)\n    })\n  }\n\n  // noinspection JSMethodCanBeStatic\n  generateIV(ivByteLength: number): Uint8Array {\n    return new Uint8Array(this.crypto.getRandomValues(new Uint8Array(ivByteLength)))\n  }\n\n  /**\n   * This function return a promise which will be the key Format will be either 'raw' or 'jwk'.\n   * JWK: Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   *\n   * @param cryptoKey CryptoKey\n   * @param format will be 'raw' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'raw'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n  exportKey(cryptoKey: CryptoKey, format: 'jwk' | 'raw'): Promise<ArrayBuffer | JsonWebKey> {\n    return new Promise((resolve: (value: ArrayBuffer | JsonWebKey) => any, reject: (reason: any) => any) => {\n      return this.crypto.subtle.exportKey(format as any, cryptoKey).then(resolve, reject)\n    })\n  }\n\n  /**\n   * the ability to import a key that have already been created elsewhere, for use within the web\n   * application that is invoking the import function, for use within the importing web application's\n   * origin. This necessiates an interoperable key format, such as JSON Web Key [JWK] which may be\n   * represented as octets.\n   *\n   * https://chromium.googlesource.com/chromium/blink.git/+/6b902997e3ca0384c8fa6fe56f79ecd7589d3ca6/LayoutTests/crypto/resources/common.js\n   *\n   * @param format 'raw' or 'jwk'\n   * @param aesKey\n   * @returns {*}\n   */\n  importKey(format: 'jwk' | 'raw', aesKey: JsonWebKey | ArrayBuffer | Uint8Array): Promise<CryptoKey> {\n    return new Promise((resolve: (value: CryptoKey) => any, reject: (reason: any) => any) => {\n      const extractable = true\n      const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n      return this.crypto.subtle\n        .importKey(format as any, aesKey as any, this.aesKeyGenParams, extractable, keyUsages)\n        .catch((err) => {\n          if (format == 'raw' && (aesKey instanceof ArrayBuffer || ArrayBuffer.isView(aesKey))) {\n            console.warn(`Import of key ${ua2hex(aesKey)} failed`)\n          }\n          throw err\n        })\n        .then(resolve, reject)\n    })\n  }\n}\n\nexport const AES = new AESUtilsImpl()\n"]}

package/icc-x-api/crypto/CryptoPrimitives.d.ts

@@ -2,10 +2,30 @@ import { RSAUtils } from './RSA';
 import { AESUtils } from './AES';
 import { ShamirClass } from './shamir';
 import { HMACUtils } from './HMACUtils';
+export interface CryptoPrimitives {
+    readonly shamir: ShamirClass;
+    readonly RSA: RSAUtils;
+    readonly AES: AESUtils;
+    readonly HMAC: HMACUtils;
+    /**
+     * Generates a UUID using a cryptographically secure random number generator.
+     */
+    randomUuid(): string;
+    /**
+     * @param data some data
+     * @return the sha256 hash of {@link data}
+     */
+    sha256(data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>;
+    /**
+     * @param n how many bytes to generate
+     * @return an array with n random bytes
+     */
+    randomBytes(n: number): Uint8Array;
+}
 /**
  * Gives access to cryptographic primitives.
  */
-export declare class CryptoPrimitives {
+export declare class CryptoPrimitivesImpl implements CryptoPrimitives {
     private readonly _rsa;
     private readonly _aes;
     private readonly _shamir;
@@ -17,18 +37,7 @@ export declare class CryptoPrimitives {
     get AES(): AESUtils;
     get HMAC(): HMACUtils;
     constructor(crypto?: Crypto);
-    /**
-     * Generates a UUID using a cryptographically secure random number generator.
-     */
     randomUuid(): string;
-    /**
-     * @param data some data
-     * @return the sha256 hash of {@link data}
-     */
     sha256(data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>;
-    /**
-     * @param n how many bytes to generate
-     * @return an array with n random bytes
-     */
     randomBytes(n: number): Uint8Array;
 }

package/icc-x-api/crypto/CryptoPrimitives.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CryptoPrimitives = void 0;
+exports.CryptoPrimitivesImpl = void 0;
 const RSA_1 = require("./RSA");
 const AES_1 = require("./AES");
 const shamir_1 = require("./shamir");
@@ -8,7 +8,7 @@ const HMACUtils_1 = require("./HMACUtils");
 /**
  * Gives access to cryptographic primitives.
  */
-class CryptoPrimitives {
+class CryptoPrimitivesImpl {
     get crypto() {
         return this._crypto;
     }
@@ -26,35 +26,24 @@ class CryptoPrimitives {
     }
     constructor(crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}) {
         this._crypto = crypto;
-        this._rsa = new RSA_1.RSAUtils(crypto);
-        this._aes = new AES_1.AESUtils(crypto);
-        this._shamir = new shamir_1.ShamirClass(crypto);
-        this._hmac = new HMACUtils_1.HMACUtils(crypto);
-    }
-    /**
-     * Generates a UUID using a cryptographically secure random number generator.
-     */
+        this._rsa = new RSA_1.RSAUtilsImpl(crypto);
+        this._aes = new AES_1.AESUtilsImpl(crypto);
+        this._shamir = new shamir_1.WebcryptoShamir(crypto);
+        this._hmac = new HMACUtils_1.HMACUtilsImpl(crypto);
+    }
     randomUuid() {
         return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(/[018]/g, 
         //Keep next inlined or you will lose the random
         (c) => (Number(c) ^ (this.crypto.getRandomValues(new Uint8Array(1))[0] & (15 >> (Number(c) / 4)))).toString(16));
     }
-    /**
-     * @param data some data
-     * @return the sha256 hash of {@link data}
-     */
     sha256(data) {
         return this.crypto.subtle.digest('SHA-256', data);
     }
-    /**
-     * @param n how many bytes to generate
-     * @return an array with n random bytes
-     */
     randomBytes(n) {
         const res = new Uint8Array(n);
         this.crypto.getRandomValues(res);
         return res;
     }
 }
-exports.CryptoPrimitives = CryptoPrimitives;
+exports.CryptoPrimitivesImpl = CryptoPrimitivesImpl;
 //# sourceMappingURL=CryptoPrimitives.js.map

package/icc-x-api/crypto/CryptoPrimitives.js.map

@@ -1 +1 @@
-{"version":3,"file":"CryptoPrimitives.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/CryptoPrimitives.ts"],"names":[],"mappings":";;;AAAA,+BAAgC;AAChC,+BAAgC;AAChC,qCAAsC;AACtC,2CAAuC;AAEvC;;GAEG;AACH,MAAa,gBAAgB;IAO3B,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QACrI,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,cAAQ,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,cAAQ,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,oBAAW,CAAC,MAAM,CAAC,CAAA;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAS,CAAC,MAAM,CAAC,CAAA;IACpC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAC5D,QAAQ;QACR,+CAA+C;QAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CACjI,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,IAA8B;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,CAAS;QACnB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AA/DD,4CA+DC","sourcesContent":["import { RSAUtils } from './RSA'\nimport { AESUtils } from './AES'\nimport { ShamirClass } from './shamir'\nimport { HMACUtils } from './HMACUtils'\n\n/**\n * Gives access to cryptographic primitives.\n */\nexport class CryptoPrimitives {\n  private readonly _rsa: RSAUtils\n  private readonly _aes: AESUtils\n  private readonly _shamir: ShamirClass\n  private readonly _crypto: Crypto\n  private readonly _hmac: HMACUtils\n\n  get crypto(): Crypto {\n    return this._crypto\n  }\n\n  get shamir(): ShamirClass {\n    return this._shamir\n  }\n\n  get RSA(): RSAUtils {\n    return this._rsa\n  }\n\n  get AES(): AESUtils {\n    return this._aes\n  }\n\n  get HMAC(): HMACUtils {\n    return this._hmac\n  }\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this._crypto = crypto\n    this._rsa = new RSAUtils(crypto)\n    this._aes = new AESUtils(crypto)\n    this._shamir = new ShamirClass(crypto)\n    this._hmac = new HMACUtils(crypto)\n  }\n\n  /**\n   * Generates a UUID using a cryptographically secure random number generator.\n   */\n  randomUuid() {\n    return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(\n      /[018]/g,\n      //Keep next inlined or you will lose the random\n      (c) => (Number(c) ^ ((this.crypto.getRandomValues(new Uint8Array(1))! as Uint8Array)[0] & (15 >> (Number(c) / 4)))).toString(16)\n    )\n  }\n\n  /**\n   * @param data some data\n   * @return the sha256 hash of {@link data}\n   */\n  sha256(data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer> {\n    return this.crypto.subtle.digest('SHA-256', data)\n  }\n\n  /**\n   * @param n how many bytes to generate\n   * @return an array with n random bytes\n   */\n  randomBytes(n: number): Uint8Array {\n    const res = new Uint8Array(n)\n    this.crypto.getRandomValues(res)\n    return res\n  }\n}\n"]}
+{"version":3,"file":"CryptoPrimitives.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/CryptoPrimitives.ts"],"names":[],"mappings":";;;AAAA,+BAA8C;AAC9C,+BAA8C;AAC9C,qCAAuD;AACvD,2CAAsD;AAuBtD;;GAEG;AACH,MAAa,oBAAoB;IAO/B,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QACrI,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,kBAAY,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,kBAAY,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAe,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,yBAAa,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,UAAU;QACR,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAC5D,QAAQ;QACR,+CAA+C;QAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CACjI,CAAA;IACH,CAAC;IAED,MAAM,CAAC,IAA8B;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;IAED,WAAW,CAAC,CAAS;QACnB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AApDD,oDAoDC","sourcesContent":["import { RSAUtils, RSAUtilsImpl } from './RSA'\nimport { AESUtils, AESUtilsImpl } from './AES'\nimport { ShamirClass, WebcryptoShamir } from './shamir'\nimport { HMACUtils, HMACUtilsImpl } from './HMACUtils'\n\nexport interface CryptoPrimitives {\n  readonly shamir: ShamirClass\n  readonly RSA: RSAUtils\n  readonly AES: AESUtils\n  readonly HMAC: HMACUtils\n  /**\n   * Generates a UUID using a cryptographically secure random number generator.\n   */\n  randomUuid(): string\n  /**\n   * @param data some data\n   * @return the sha256 hash of {@link data}\n   */\n  sha256(data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>\n  /**\n   * @param n how many bytes to generate\n   * @return an array with n random bytes\n   */\n  randomBytes(n: number): Uint8Array\n}\n\n/**\n * Gives access to cryptographic primitives.\n */\nexport class CryptoPrimitivesImpl implements CryptoPrimitives {\n  private readonly _rsa: RSAUtils\n  private readonly _aes: AESUtils\n  private readonly _shamir: ShamirClass\n  private readonly _crypto: Crypto\n  private readonly _hmac: HMACUtils\n\n  get crypto(): Crypto {\n    return this._crypto\n  }\n\n  get shamir(): ShamirClass {\n    return this._shamir\n  }\n\n  get RSA(): RSAUtils {\n    return this._rsa\n  }\n\n  get AES(): AESUtils {\n    return this._aes\n  }\n\n  get HMAC(): HMACUtils {\n    return this._hmac\n  }\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this._crypto = crypto\n    this._rsa = new RSAUtilsImpl(crypto)\n    this._aes = new AESUtilsImpl(crypto)\n    this._shamir = new WebcryptoShamir(crypto)\n    this._hmac = new HMACUtilsImpl(crypto)\n  }\n\n  randomUuid() {\n    return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(\n      /[018]/g,\n      //Keep next inlined or you will lose the random\n      (c) => (Number(c) ^ ((this.crypto.getRandomValues(new Uint8Array(1))! as Uint8Array)[0] & (15 >> (Number(c) / 4)))).toString(16)\n    )\n  }\n\n  sha256(data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer> {\n    return this.crypto.subtle.digest('SHA-256', data)\n  }\n\n  randomBytes(n: number): Uint8Array {\n    const res = new Uint8Array(n)\n    this.crypto.getRandomValues(res)\n    return res\n  }\n}\n"]}

package/icc-x-api/crypto/DelegationsDeAnonymization.js

@@ -221,7 +221,7 @@ class DelegationsDeAnonymization {
             // Usually either the delegator or delegate are the current data owner, but sometimes also the child of the delegator or delegate can do it.
             const initialDelegates = [delegationMembersDetails.delegate, delegationMembersDetails.delegator, ...delegates].filter((x) => x != selfDoId);
             const initalisedMapInfo = yield this.xapis.entityWithInitialisedEncryptedMetadata({
-                id: this.cryptoPrimitives.crypto.randomUUID(),
+                id: this.cryptoPrimitives.randomUuid(),
                 delegate: delegationMembersDetails.delegate,
                 delegator: delegationMembersDetails.delegator,
                 delegationKey: delegationKey,

package/icc-x-api/crypto/DelegationsDeAnonymization.js.map

@@ -1 +1 @@
-{"version":3,"file":"DelegationsDeAnonymization.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/DelegationsDeAnonymization.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2EAAuE;AACvE,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AAEzD,gGAA4F;AAE5F,qEAAiE;AACjE,wFAAoF;AACpF,IAAO,uBAAuB,GAAG,uCAAkB,CAAC,uBAAuB,CAAA;AAE3E,oCAAwE;AACxE,0GAAsG;AACtG,+CAA2C;AAC3C,2EAAiG;AACjG,yFAAiH;AAIjH,6CAA6C;AAC7C,MAAa,0BAA0B;IAIrC,YACmB,YAA8B,EAC9B,kCAA8E,EAC9E,KAAwB,EACxB,gBAAkC,EAClC,wBAAkD,EACnE,IAAY,EACZ,OAAkC,EAClC,yBAAiD,IAAI,iDAAwB,EAAE,EAC/E,YAA2E,OAAO,MAAM,KAAK,WAAW;QACtG,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,KAAK,EACQ,gCAAkE;QAblE,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,uCAAkC,GAAlC,kCAAkC,CAA4C;QAC9E,UAAK,GAAL,KAAK,CAAmB;QACxB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,6BAAwB,GAAxB,wBAAwB,CAA0B;QASlD,qCAAgC,GAAhC,gCAAgC,CAAkC;QAEnF,IAAI,CAAC,+BAA+B,GAAG,IAAA,4BAAoB,EAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,wBAAwB,CAAC,CAAA;QAChH,IAAI,CAAC,mBAAmB,GAAG,IAAI,2DAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAA;IAC/G,CAAC;IAED;;;;OAIG;IACG,iCAAiC,CAAC,cAAuC,EAAE,mBAA6B;;YAC5G,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CACzI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;oBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;wBACzB,OAAO,CAAC,KAAK,CAAC,CAAA;qBACf;yBAAM;wBACL,OAAO,EAAE,CAAA;qBACV;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAyC,CAAA;YAC7H,CAAC,CACF,CAAA;YACD,MAAM,+BAA+B,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACxF,kEAAkE;gBAClE,OAAO,CAAC,cAAc,CAAC,aAAa,CAAA;YACtC,CAAC,CAAC,CAAA;YACF,4IAA4I;YAC5I,MAAM,mCAAmC,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACzG,+FAA+F;gBAC/F,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAA;YACxG,CAAC,CAAC,CAAA;YACF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAC3E,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChD,cAAc,CAAC,IAAI,CACpB,CAAA;YACD,KAAK,MAAM,aAAa,IAAI,sBAAsB,EAAE;gBAClD,MAAM,IAAI,CAAC,gCAAgC,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAA;aACrG;YACD,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;YAC9F,MAAM,mBAAmB,GAAG,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACtH,KAAK,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,mBAAmB,EAAE;gBAC1D,MAAM,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAA;aAC1G;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,yBAAyB,CAAC,cAAuC;;;YAIrE,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC3B,MAAM,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC;gBACrE;oBACE,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,CAAC,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzI,6BAA6B,EAAE,KAAK;iBACrC;aACF,CAAC,CAAA;;KACH;IAEa,0CAA0C,CAAC,cAAuC;;YAI9F,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAA;YACxH,MAAM,kCAAkC,GAAG,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBACxH,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;oBACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;wBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;4BACzB,OAAO,CAAC,KAAK,CAAC,CAAA;yBACf;6BAAM;4BACL,OAAO,EAAE,CAAA;yBACV;oBACH,CAAC,CAAC,CAAA;oBACF,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;iBAC1D;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,sCAAsC,GAAG,MAAM,CAAC,WAAW,CAC/D,CACE,MAAM,IAAI,CAAC,mCAAmC,CAC5C,kCAAkC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAC9D,cAAc,CAAC,IAAI,CACpB,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CACnC,CAAA;YACD,MAAM,wBAAwB,GAA+C,EAAE,CAAA;YAC/E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,SAAS,SAAS,CAAC,WAAmB,EAAE,KAAsB;gBAC5D,IAAI,wBAAwB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;oBACnE,wBAAwB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;iBAC9C;YACH,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE;gBAC/D,IAAI,UAAU,CAAC,QAAQ;oBAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;gBAC/E,IAAI,UAAU,CAAC,SAAS;oBAAE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;aAClF;YACD,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,kCAAkC,EAAE;gBACrE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9B,MAAM,OAAO,GAAG,sCAAsC,CAAC,CAAC,CAAC,CAAA;oBACzD,OAAO,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;gBAC7D,CAAC,CAAC,CAAA;gBACF,IAAI,OAAO,EAAE;oBACX,MAAM,MAAM,GAAG,sCAAsC,CAAC,OAAO,CAAC,CAAA;oBAC9D,SAAS,CAAC,MAAM,CAAC,QAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;oBACnD,SAAS,CAAC,MAAM,CAAC,SAAU,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBACrD;qBAAM;oBACL,6BAA6B,GAAG,IAAI,CAAA;iBACrC;aACF;YACD,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,CAAA;QACpE,CAAC;KAAA;IAEa,gBAAgB,CAC5B,MAGG;;YAKH,MAAM,sBAAsB,GAA+C,EAAE,CAAA;YAC7E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;gBACtB,6BAA6B,GAAG,6BAA6B,IAAI,CAAC,CAAC,6BAA6B,CAAA;gBAChG,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE;oBAC7E,IAAI,sBAAsB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;wBACjE,sBAAsB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;qBAC5C;iBACF;aACF;YACD,OAAO;gBACL,wBAAwB,EAAE,sBAAsB;gBAChD,6BAA6B;aAC9B,CAAA;QACH,CAAC;KAAA;IAEa,mCAAmC,CAC/C,aAAuB,EACvB,UAAwC;;YAExC,IAAI,aAAa,CAAC,MAAM,EAAE;gBACxB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CACtE,EAAE,GAAG,EAAE,aAAa,EAAE,EACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;gBACD,MAAM,GAAG,GAA6B,EAAE,CAAA;gBACxC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;oBACxC,+BAA+B;oBAC/B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CAAC,CAAA;oBACvH,IAAI,gBAAgB,CAAC,SAAS,EAAE;wBAC9B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;qBAClC;iBACF;gBACD,OAAO,GAAG,CAAA;aACX;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,gCAAgC,CAAC,UAAwC,EAAE,MAA8B,EAAE,SAAmB;;YAC1I,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;YAC3H,MAAM,0CAA0C,GAAG,MAAM,CAAC,MAAM,CAC9D,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC;gBACvE,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;aACf,CAAC,CACH;iBACE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;iBACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAa,CAAA;YACjC,8GAA8G;YAC9G,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,0CAA0C,CAAC,CAAC,CAAA;YAC7H,MAAM,sBAAsB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACzF,IAAI,sBAAsB,CAAC,MAAM,EAAE;gBACjC,CAAC;gBAAA,CACC,MAAM,IAAI,CAAC,KAAK,CAAC,0CAA0C,CACzD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EACpC,KAAK,EACL,MAAM,CAAC,WAAW,CAChB,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAChC,CAAC;oBACD;wBACE,cAAc,EAAE,EAAE;wBAClB,mBAAmB,EAAE,+CAAsB,CAAC,QAAQ;wBACpD,oBAAoB,EAAE,+CAAsB,CAAC,KAAK;wBAClD,oBAAoB,EAAE,uBAAuB,CAAC,SAAS;qBACxD;iBACF,CAAC,CACH,EACD,CAAO,OAAO,EAAE,EAAE;oBAChB,OAAA,IAAI,CAAC,mBAAmB,CAAC,+BAA+B,CACtD,OAAO,EACP,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;kBAAA,CACJ,CACF,CAAC,oBAAoB,CAAA;aACvB;QACH,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,4BAA4B,CACxC,UAAwC,EACxC,aAAqB,EACrB,wBAAkD,EAClD,SAAmB;;YAEnB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,IAAI,CAAC,wBAAwB,CAAC,SAAS,IAAI,CAAC,wBAAwB,CAAC,mBAAmB;gBAC5H,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAA;YAC7H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAChE,2IAA2I;YAC3I,4IAA4I;YAC5I,MAAM,gBAAgB,GAAG,CAAC,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAA;YAC3I,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAC/E;gBACE,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE;gBAC7C,QAAQ,EAAE,wBAAwB,CAAC,QAAQ;gBAC3C,SAAS,EAAE,wBAAwB,CAAC,SAAS;gBAC7C,aAAa,EAAE,aAAa;aAC7B,EACD,UAAU,EACV,SAAS,EACT,SAAS,EACT,IAAI,EACJ,KAAK,EACL,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAC3E,CAAA;YACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CACvD,iBAAiB,CAAC,aAAa,EAC/B,UAAU,EACV,IAAI,CAAC,+BAA+B,EACpC,KAAK,EACL,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CACrC,CAAA;YACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CACnC,eAAe,EACf,IAAI,SAAG,CAAC,MAAM,CACZ,6DAA0B,EAC1B,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,UAAU,CAAC,CAC5H,CACF,CAAA;QACH,CAAC;KAAA;CACF;AA3QD,gEA2QC","sourcesContent":["import { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { DelegationMembersDetails, SecureDelegationsSecurityMetadataDecryptor } from './SecureDelegationsSecurityMetadataDecryptor'\nimport { SecureDelegationKeyMap } from '../../icc-api/model/internal/SecureDelegationKeyMap'\nimport { ExtendedApisUtils } from './ExtendedApisUtils'\nimport { ShareMetadataBehaviour } from './ShareMetadataBehaviour'\nimport { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport RequestedPermissionEnum = EntityShareRequest.RequestedPermissionEnum\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { EncryptedFieldsManifest, parseEncryptedFields } from '../utils'\nimport { IccSecureDelegationKeyMapApi } from '../../icc-api/api/internal/IccSecureDelegationKeyMapApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { AuthenticationProvider, NoAuthenticationProvider } from '../auth/AuthenticationProvider'\nimport { ACCESS_CONTROL_KEYS_HEADER, AccessControlKeysHeadersProvider } from './AccessControlKeysHeadersProvider'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\n\n// TODO could be optimised using bulk methods\nexport class DelegationsDeAnonymization {\n  private readonly delegationKeyMapFieldsToEncrypt: EncryptedFieldsManifest\n  private readonly delegationKeyMapApi: IccSecureDelegationKeyMapApi\n\n  constructor(\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly secureDelegationsMetadataDecryptor: SecureDelegationsSecurityMetadataDecryptor,\n    private readonly xapis: ExtendedApisUtils,\n    private readonly cryptoPrimitives: CryptoPrimitives,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    host: string,\n    headers: { [key: string]: string },\n    authenticationProvider: AuthenticationProvider = new NoAuthenticationProvider(),\n    fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response> = typeof window !== 'undefined'\n      ? window.fetch\n      : typeof self !== 'undefined'\n      ? self.fetch\n      : fetch,\n    private readonly accessControlKeysHeadersProvider: AccessControlKeysHeadersProvider\n  ) {\n    this.delegationKeyMapFieldsToEncrypt = parseEncryptedFields(['delegate', 'delegator'], 'SecureDelegationKeyMap')\n    this.delegationKeyMapApi = new IccSecureDelegationKeyMapApi(host, headers, authenticationProvider, fetchImpl)\n  }\n\n  /**\n   * Creates / updates information to allow the data owners in {@link shareWithDataOwners} to de-anonymize the delegations contained within\n   * {@link entity}.\n   * Note that the delegation de-anonymization information may be used also with other entities of the same type.\n   */\n  async createOrUpdateDeAnonymizationInfo(entityWithType: EncryptedEntityWithType, shareWithDataOwners: string[]) {\n    const delegationsDetails = Object.entries(await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails(entityWithType)).flatMap(\n      ([canonicalKey, delegation]) => {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [[canonicalKey, delegation], ...aliases.map((alias) => [alias, delegation])] as [string, DelegationMembersDetails][]\n      }\n    )\n    const delegationsForDeanonInfoSharing = delegationsDetails.filter(([_, delegationInfo]) => {\n      // Drop fully explicit ones: they don't need de-anonymization info\n      return !delegationInfo.fullyExplicit\n    })\n    // A subset of delegations for which deanon info is relevant AND for which we can also create new info instead of sharing only existing one.\n    const delegationsForNewDeanonInfoCreation = delegationsForDeanonInfoSharing.filter(([_, delegationInfo]) => {\n      // Drop those for which we don't have the full information needed for the creation of new data.\n      return !!delegationInfo.delegate && !!delegationInfo.delegator && !!delegationInfo.accessControlSecret\n    })\n    const existingDelegationsMap = await this.getDecryptedSecureDelegationKeyMaps(\n      delegationsForDeanonInfoSharing.map((x) => x[0]),\n      entityWithType.type\n    )\n    for (const delMapToShare of existingDelegationsMap) {\n      await this.ensureDelegationKeyMapSharedWith(entityWithType.type, delMapToShare, shareWithDataOwners)\n    }\n    const existingDelegationsMapKeys = new Set(existingDelegationsMap.map((x) => x.delegationKey))\n    const delegationsToCreate = delegationsForNewDeanonInfoCreation.filter(([k, _]) => !existingDelegationsMapKeys.has(k))\n    for (const [delKey, membersDetails] of delegationsToCreate) {\n      await this.createSecureDelegationKeyMap(entityWithType.type, delKey, membersDetails, shareWithDataOwners)\n    }\n  }\n\n  /**\n   * Get the data owners which can access the entity. See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for more details.\n   * @param entityWithType an entity.\n   */\n  async getDataOwnersWithAccessTo(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    return this.mergePermissions([\n      await this.getDataOwnersWithAccessToSecureDelegations(entityWithType),\n      {\n        permissionsByDataOwnerId: Object.fromEntries(Object.keys(entityWithType.entity.delegations ?? {}).map((k) => [k, AccessLevelEnum.WRITE])),\n        hasUnknownAnonymousDataOwners: false,\n      },\n    ])\n  }\n\n  private async getDataOwnersWithAccessToSecureDelegations(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const secureDelegationDetails = await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails(entityWithType)\n    const secureDelegationWithUnknownMembers = Object.entries(secureDelegationDetails).flatMap(([canonicalKey, delegation]) => {\n      if (!delegation.delegate || !delegation.delegator) {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [{ keys: [canonicalKey, ...aliases], delegation }]\n      } else {\n        return []\n      }\n    })\n    const secureDelegationKeyMapsByDelegationKey = Object.fromEntries(\n      (\n        await this.getDecryptedSecureDelegationKeyMaps(\n          secureDelegationWithUnknownMembers.flatMap(({ keys }) => keys),\n          entityWithType.type\n        )\n      ).map((x) => [x.delegationKey, x])\n    )\n    const permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    function addAccess(dataOwnerId: string, level: AccessLevelEnum) {\n      if (permissionsByDataOwnerId[dataOwnerId] !== AccessLevelEnum.WRITE) {\n        permissionsByDataOwnerId[dataOwnerId] = level\n      }\n    }\n    for (const delegation of Object.values(secureDelegationDetails)) {\n      if (delegation.delegate) addAccess(delegation.delegate, delegation.accessLevel)\n      if (delegation.delegator) addAccess(delegation.delegator, delegation.accessLevel)\n    }\n    for (const { keys, delegation } of secureDelegationWithUnknownMembers) {\n      const bestKey = keys.find((k) => {\n        const currMap = secureDelegationKeyMapsByDelegationKey[k]\n        return currMap && !!currMap.delegator && !!currMap.delegate\n      })\n      if (bestKey) {\n        const keyMap = secureDelegationKeyMapsByDelegationKey[bestKey]\n        addAccess(keyMap.delegate!, delegation.accessLevel)\n        addAccess(keyMap.delegator!, delegation.accessLevel)\n      } else {\n        hasUnknownAnonymousDataOwners = true\n      }\n    }\n    return { permissionsByDataOwnerId, hasUnknownAnonymousDataOwners }\n  }\n\n  private async mergePermissions(\n    values: {\n      permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n      hasUnknownAnonymousDataOwners: boolean\n    }[]\n  ): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const accumulatedPermissions: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    for (const v of values) {\n      hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || v.hasUnknownAnonymousDataOwners\n      for (const [dataOwnerId, level] of Object.entries(v.permissionsByDataOwnerId)) {\n        if (accumulatedPermissions[dataOwnerId] !== AccessLevelEnum.WRITE) {\n          accumulatedPermissions[dataOwnerId] = level\n        }\n      }\n    }\n    return {\n      permissionsByDataOwnerId: accumulatedPermissions,\n      hasUnknownAnonymousDataOwners,\n    }\n  }\n\n  private async getDecryptedSecureDelegationKeyMaps(\n    delegationIds: string[],\n    entityType: EntityWithDelegationTypeName\n  ): Promise<SecureDelegationKeyMap[]> {\n    if (delegationIds.length) {\n      const encryptedMaps = await this.delegationKeyMapApi.getByDelegationKeys(\n        { ids: delegationIds },\n        await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n      )\n      const res: SecureDelegationKeyMap[] = []\n      for (const encryptedMap of encryptedMaps) {\n        // Use the original entity type\n        const decryptionResult = await this.xapis.decryptEntity(encryptedMap, entityType, (x) => new SecureDelegationKeyMap(x))\n        if (decryptionResult.decrypted) {\n          res.push(decryptionResult.entity)\n        }\n      }\n      return res\n    } else return []\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async ensureDelegationKeyMapSharedWith(entityType: EntityWithDelegationTypeName, keyMap: SecureDelegationKeyMap, delegates: string[]) {\n    if (!keyMap.delegator || !keyMap.delegate) throw new Error('Illegal state: key map is missing delegator or delegate info.')\n    const dataOwnersWithAccessToMapThroughDelegation = Object.values(\n      await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails({\n        type: entityType,\n        entity: keyMap,\n      })\n    )\n      .flatMap((x) => [x.delegate, x.delegator])\n      .filter((x) => !!x) as string[]\n    // Delegator and delegate got access to the entity when it was first created: no need to share with them ever.\n    const dataOwnersWithAccessToMap = new Set([keyMap.delegate, keyMap.delegator, ...dataOwnersWithAccessToMapThroughDelegation])\n    const dataOwnersNeedingShare = delegates.filter((x) => !dataOwnersWithAccessToMap.has(x))\n    if (dataOwnersNeedingShare.length) {\n      ;(\n        await this.xapis.simpleShareOrUpdateEncryptedEntityMetadata(\n          { entity: keyMap, type: entityType },\n          false,\n          Object.fromEntries(\n            dataOwnersNeedingShare.map((x) => [\n              x,\n              {\n                shareSecretIds: [],\n                shareEncryptionKeys: ShareMetadataBehaviour.REQUIRED,\n                shareOwningEntityIds: ShareMetadataBehaviour.NEVER,\n                requestedPermissions: RequestedPermissionEnum.FULL_READ,\n              },\n            ])\n          ),\n          async (request) =>\n            this.delegationKeyMapApi.bulkShareSecureDelegationKeyMap(\n              request,\n              await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n            )\n        )\n      ).updatedEntityOrThrow\n    }\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async createSecureDelegationKeyMap(\n    entityType: EntityWithDelegationTypeName,\n    delegationKey: string,\n    delegationMembersDetails: DelegationMembersDetails,\n    delegates: string[]\n  ) {\n    if (!delegationMembersDetails.delegate || !delegationMembersDetails.delegator || !delegationMembersDetails.accessControlSecret)\n      throw new Error('Illegal state: delegation members details are missing delegate, delegator or access control secret info.')\n    const selfDoId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    // Ensure that both the delegator and delegate of the delegation this map refers tho can share it later on, even if they did not create it.\n    // Usually either the delegator or delegate are the current data owner, but sometimes also the child of the delegator or delegate can do it.\n    const initialDelegates = [delegationMembersDetails.delegate, delegationMembersDetails.delegator, ...delegates].filter((x) => x != selfDoId)\n    const initalisedMapInfo = await this.xapis.entityWithInitialisedEncryptedMetadata<SecureDelegationKeyMap>(\n      {\n        id: this.cryptoPrimitives.crypto.randomUUID(),\n        delegate: delegationMembersDetails.delegate,\n        delegator: delegationMembersDetails.delegator,\n        delegationKey: delegationKey,\n      },\n      entityType,\n      undefined,\n      undefined,\n      true,\n      false,\n      Object.fromEntries(initialDelegates.map((x) => [x, AccessLevelEnum.READ]))\n    )\n    const encryptedKeyMap = await this.xapis.tryEncryptEntity(\n      initalisedMapInfo.updatedEntity,\n      entityType,\n      this.delegationKeyMapFieldsToEncrypt,\n      false,\n      true,\n      (x) => new SecureDelegationKeyMap(x)\n    )\n    await this.delegationKeyMapApi.create(\n      encryptedKeyMap,\n      new XHR.Header(\n        ACCESS_CONTROL_KEYS_HEADER,\n        await this.accessControlSecretUtils.getEncodedAccessControlKeys([delegationMembersDetails.accessControlSecret], entityType)\n      )\n    )\n  }\n}\n"]}
+{"version":3,"file":"DelegationsDeAnonymization.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/DelegationsDeAnonymization.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2EAAuE;AACvE,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AAEzD,gGAA4F;AAE5F,qEAAiE;AACjE,wFAAoF;AACpF,IAAO,uBAAuB,GAAG,uCAAkB,CAAC,uBAAuB,CAAA;AAE3E,oCAAwE;AACxE,0GAAsG;AACtG,+CAA2C;AAC3C,2EAAiG;AACjG,yFAAiH;AAIjH,6CAA6C;AAC7C,MAAa,0BAA0B;IAIrC,YACmB,YAA8B,EAC9B,kCAA8E,EAC9E,KAAwB,EACxB,gBAAkC,EAClC,wBAAkD,EACnE,IAAY,EACZ,OAAkC,EAClC,yBAAiD,IAAI,iDAAwB,EAAE,EAC/E,YAA2E,OAAO,MAAM,KAAK,WAAW;QACtG,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,KAAK,EACQ,gCAAkE;QAblE,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,uCAAkC,GAAlC,kCAAkC,CAA4C;QAC9E,UAAK,GAAL,KAAK,CAAmB;QACxB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,6BAAwB,GAAxB,wBAAwB,CAA0B;QASlD,qCAAgC,GAAhC,gCAAgC,CAAkC;QAEnF,IAAI,CAAC,+BAA+B,GAAG,IAAA,4BAAoB,EAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,wBAAwB,CAAC,CAAA;QAChH,IAAI,CAAC,mBAAmB,GAAG,IAAI,2DAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAA;IAC/G,CAAC;IAED;;;;OAIG;IACG,iCAAiC,CAAC,cAAuC,EAAE,mBAA6B;;YAC5G,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CACzI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;oBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;wBACzB,OAAO,CAAC,KAAK,CAAC,CAAA;qBACf;yBAAM;wBACL,OAAO,EAAE,CAAA;qBACV;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAyC,CAAA;YAC7H,CAAC,CACF,CAAA;YACD,MAAM,+BAA+B,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACxF,kEAAkE;gBAClE,OAAO,CAAC,cAAc,CAAC,aAAa,CAAA;YACtC,CAAC,CAAC,CAAA;YACF,4IAA4I;YAC5I,MAAM,mCAAmC,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACzG,+FAA+F;gBAC/F,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAA;YACxG,CAAC,CAAC,CAAA;YACF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAC3E,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChD,cAAc,CAAC,IAAI,CACpB,CAAA;YACD,KAAK,MAAM,aAAa,IAAI,sBAAsB,EAAE;gBAClD,MAAM,IAAI,CAAC,gCAAgC,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAA;aACrG;YACD,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;YAC9F,MAAM,mBAAmB,GAAG,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACtH,KAAK,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,mBAAmB,EAAE;gBAC1D,MAAM,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAA;aAC1G;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,yBAAyB,CAAC,cAAuC;;;YAIrE,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC3B,MAAM,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC;gBACrE;oBACE,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,CAAC,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzI,6BAA6B,EAAE,KAAK;iBACrC;aACF,CAAC,CAAA;;KACH;IAEa,0CAA0C,CAAC,cAAuC;;YAI9F,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAA;YACxH,MAAM,kCAAkC,GAAG,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBACxH,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;oBACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;wBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;4BACzB,OAAO,CAAC,KAAK,CAAC,CAAA;yBACf;6BAAM;4BACL,OAAO,EAAE,CAAA;yBACV;oBACH,CAAC,CAAC,CAAA;oBACF,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;iBAC1D;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,sCAAsC,GAAG,MAAM,CAAC,WAAW,CAC/D,CACE,MAAM,IAAI,CAAC,mCAAmC,CAC5C,kCAAkC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAC9D,cAAc,CAAC,IAAI,CACpB,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CACnC,CAAA;YACD,MAAM,wBAAwB,GAA+C,EAAE,CAAA;YAC/E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,SAAS,SAAS,CAAC,WAAmB,EAAE,KAAsB;gBAC5D,IAAI,wBAAwB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;oBACnE,wBAAwB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;iBAC9C;YACH,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE;gBAC/D,IAAI,UAAU,CAAC,QAAQ;oBAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;gBAC/E,IAAI,UAAU,CAAC,SAAS;oBAAE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;aAClF;YACD,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,kCAAkC,EAAE;gBACrE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9B,MAAM,OAAO,GAAG,sCAAsC,CAAC,CAAC,CAAC,CAAA;oBACzD,OAAO,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;gBAC7D,CAAC,CAAC,CAAA;gBACF,IAAI,OAAO,EAAE;oBACX,MAAM,MAAM,GAAG,sCAAsC,CAAC,OAAO,CAAC,CAAA;oBAC9D,SAAS,CAAC,MAAM,CAAC,QAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;oBACnD,SAAS,CAAC,MAAM,CAAC,SAAU,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBACrD;qBAAM;oBACL,6BAA6B,GAAG,IAAI,CAAA;iBACrC;aACF;YACD,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,CAAA;QACpE,CAAC;KAAA;IAEa,gBAAgB,CAC5B,MAGG;;YAKH,MAAM,sBAAsB,GAA+C,EAAE,CAAA;YAC7E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;gBACtB,6BAA6B,GAAG,6BAA6B,IAAI,CAAC,CAAC,6BAA6B,CAAA;gBAChG,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE;oBAC7E,IAAI,sBAAsB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;wBACjE,sBAAsB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;qBAC5C;iBACF;aACF;YACD,OAAO;gBACL,wBAAwB,EAAE,sBAAsB;gBAChD,6BAA6B;aAC9B,CAAA;QACH,CAAC;KAAA;IAEa,mCAAmC,CAC/C,aAAuB,EACvB,UAAwC;;YAExC,IAAI,aAAa,CAAC,MAAM,EAAE;gBACxB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CACtE,EAAE,GAAG,EAAE,aAAa,EAAE,EACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;gBACD,MAAM,GAAG,GAA6B,EAAE,CAAA;gBACxC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;oBACxC,+BAA+B;oBAC/B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CAAC,CAAA;oBACvH,IAAI,gBAAgB,CAAC,SAAS,EAAE;wBAC9B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;qBAClC;iBACF;gBACD,OAAO,GAAG,CAAA;aACX;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,gCAAgC,CAAC,UAAwC,EAAE,MAA8B,EAAE,SAAmB;;YAC1I,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;YAC3H,MAAM,0CAA0C,GAAG,MAAM,CAAC,MAAM,CAC9D,MAAM,IAAI,CAAC,kCAAkC,CAAC,0BAA0B,CAAC;gBACvE,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;aACf,CAAC,CACH;iBACE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;iBACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAa,CAAA;YACjC,8GAA8G;YAC9G,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,0CAA0C,CAAC,CAAC,CAAA;YAC7H,MAAM,sBAAsB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACzF,IAAI,sBAAsB,CAAC,MAAM,EAAE;gBACjC,CAAC;gBAAA,CACC,MAAM,IAAI,CAAC,KAAK,CAAC,0CAA0C,CACzD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EACpC,KAAK,EACL,MAAM,CAAC,WAAW,CAChB,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAChC,CAAC;oBACD;wBACE,cAAc,EAAE,EAAE;wBAClB,mBAAmB,EAAE,+CAAsB,CAAC,QAAQ;wBACpD,oBAAoB,EAAE,+CAAsB,CAAC,KAAK;wBAClD,oBAAoB,EAAE,uBAAuB,CAAC,SAAS;qBACxD;iBACF,CAAC,CACH,EACD,CAAO,OAAO,EAAE,EAAE;oBAChB,OAAA,IAAI,CAAC,mBAAmB,CAAC,+BAA+B,CACtD,OAAO,EACP,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;kBAAA,CACJ,CACF,CAAC,oBAAoB,CAAA;aACvB;QACH,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,4BAA4B,CACxC,UAAwC,EACxC,aAAqB,EACrB,wBAAkD,EAClD,SAAmB;;YAEnB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,IAAI,CAAC,wBAAwB,CAAC,SAAS,IAAI,CAAC,wBAAwB,CAAC,mBAAmB;gBAC5H,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAA;YAC7H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAChE,2IAA2I;YAC3I,4IAA4I;YAC5I,MAAM,gBAAgB,GAAG,CAAC,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAA;YAC3I,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAC/E;gBACE,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE;gBACtC,QAAQ,EAAE,wBAAwB,CAAC,QAAQ;gBAC3C,SAAS,EAAE,wBAAwB,CAAC,SAAS;gBAC7C,aAAa,EAAE,aAAa;aAC7B,EACD,UAAU,EACV,SAAS,EACT,SAAS,EACT,IAAI,EACJ,KAAK,EACL,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAC3E,CAAA;YACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CACvD,iBAAiB,CAAC,aAAa,EAC/B,UAAU,EACV,IAAI,CAAC,+BAA+B,EACpC,KAAK,EACL,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CACrC,CAAA;YACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CACnC,eAAe,EACf,IAAI,SAAG,CAAC,MAAM,CACZ,6DAA0B,EAC1B,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,UAAU,CAAC,CAC5H,CACF,CAAA;QACH,CAAC;KAAA;CACF;AA3QD,gEA2QC","sourcesContent":["import { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { DelegationMembersDetails, SecureDelegationsSecurityMetadataDecryptor } from './SecureDelegationsSecurityMetadataDecryptor'\nimport { SecureDelegationKeyMap } from '../../icc-api/model/internal/SecureDelegationKeyMap'\nimport { ExtendedApisUtils } from './ExtendedApisUtils'\nimport { ShareMetadataBehaviour } from './ShareMetadataBehaviour'\nimport { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport RequestedPermissionEnum = EntityShareRequest.RequestedPermissionEnum\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { EncryptedFieldsManifest, parseEncryptedFields } from '../utils'\nimport { IccSecureDelegationKeyMapApi } from '../../icc-api/api/internal/IccSecureDelegationKeyMapApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { AuthenticationProvider, NoAuthenticationProvider } from '../auth/AuthenticationProvider'\nimport { ACCESS_CONTROL_KEYS_HEADER, AccessControlKeysHeadersProvider } from './AccessControlKeysHeadersProvider'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\n\n// TODO could be optimised using bulk methods\nexport class DelegationsDeAnonymization {\n  private readonly delegationKeyMapFieldsToEncrypt: EncryptedFieldsManifest\n  private readonly delegationKeyMapApi: IccSecureDelegationKeyMapApi\n\n  constructor(\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly secureDelegationsMetadataDecryptor: SecureDelegationsSecurityMetadataDecryptor,\n    private readonly xapis: ExtendedApisUtils,\n    private readonly cryptoPrimitives: CryptoPrimitives,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    host: string,\n    headers: { [key: string]: string },\n    authenticationProvider: AuthenticationProvider = new NoAuthenticationProvider(),\n    fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response> = typeof window !== 'undefined'\n      ? window.fetch\n      : typeof self !== 'undefined'\n      ? self.fetch\n      : fetch,\n    private readonly accessControlKeysHeadersProvider: AccessControlKeysHeadersProvider\n  ) {\n    this.delegationKeyMapFieldsToEncrypt = parseEncryptedFields(['delegate', 'delegator'], 'SecureDelegationKeyMap')\n    this.delegationKeyMapApi = new IccSecureDelegationKeyMapApi(host, headers, authenticationProvider, fetchImpl)\n  }\n\n  /**\n   * Creates / updates information to allow the data owners in {@link shareWithDataOwners} to de-anonymize the delegations contained within\n   * {@link entity}.\n   * Note that the delegation de-anonymization information may be used also with other entities of the same type.\n   */\n  async createOrUpdateDeAnonymizationInfo(entityWithType: EncryptedEntityWithType, shareWithDataOwners: string[]) {\n    const delegationsDetails = Object.entries(await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails(entityWithType)).flatMap(\n      ([canonicalKey, delegation]) => {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [[canonicalKey, delegation], ...aliases.map((alias) => [alias, delegation])] as [string, DelegationMembersDetails][]\n      }\n    )\n    const delegationsForDeanonInfoSharing = delegationsDetails.filter(([_, delegationInfo]) => {\n      // Drop fully explicit ones: they don't need de-anonymization info\n      return !delegationInfo.fullyExplicit\n    })\n    // A subset of delegations for which deanon info is relevant AND for which we can also create new info instead of sharing only existing one.\n    const delegationsForNewDeanonInfoCreation = delegationsForDeanonInfoSharing.filter(([_, delegationInfo]) => {\n      // Drop those for which we don't have the full information needed for the creation of new data.\n      return !!delegationInfo.delegate && !!delegationInfo.delegator && !!delegationInfo.accessControlSecret\n    })\n    const existingDelegationsMap = await this.getDecryptedSecureDelegationKeyMaps(\n      delegationsForDeanonInfoSharing.map((x) => x[0]),\n      entityWithType.type\n    )\n    for (const delMapToShare of existingDelegationsMap) {\n      await this.ensureDelegationKeyMapSharedWith(entityWithType.type, delMapToShare, shareWithDataOwners)\n    }\n    const existingDelegationsMapKeys = new Set(existingDelegationsMap.map((x) => x.delegationKey))\n    const delegationsToCreate = delegationsForNewDeanonInfoCreation.filter(([k, _]) => !existingDelegationsMapKeys.has(k))\n    for (const [delKey, membersDetails] of delegationsToCreate) {\n      await this.createSecureDelegationKeyMap(entityWithType.type, delKey, membersDetails, shareWithDataOwners)\n    }\n  }\n\n  /**\n   * Get the data owners which can access the entity. See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for more details.\n   * @param entityWithType an entity.\n   */\n  async getDataOwnersWithAccessTo(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    return this.mergePermissions([\n      await this.getDataOwnersWithAccessToSecureDelegations(entityWithType),\n      {\n        permissionsByDataOwnerId: Object.fromEntries(Object.keys(entityWithType.entity.delegations ?? {}).map((k) => [k, AccessLevelEnum.WRITE])),\n        hasUnknownAnonymousDataOwners: false,\n      },\n    ])\n  }\n\n  private async getDataOwnersWithAccessToSecureDelegations(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const secureDelegationDetails = await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails(entityWithType)\n    const secureDelegationWithUnknownMembers = Object.entries(secureDelegationDetails).flatMap(([canonicalKey, delegation]) => {\n      if (!delegation.delegate || !delegation.delegator) {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [{ keys: [canonicalKey, ...aliases], delegation }]\n      } else {\n        return []\n      }\n    })\n    const secureDelegationKeyMapsByDelegationKey = Object.fromEntries(\n      (\n        await this.getDecryptedSecureDelegationKeyMaps(\n          secureDelegationWithUnknownMembers.flatMap(({ keys }) => keys),\n          entityWithType.type\n        )\n      ).map((x) => [x.delegationKey, x])\n    )\n    const permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    function addAccess(dataOwnerId: string, level: AccessLevelEnum) {\n      if (permissionsByDataOwnerId[dataOwnerId] !== AccessLevelEnum.WRITE) {\n        permissionsByDataOwnerId[dataOwnerId] = level\n      }\n    }\n    for (const delegation of Object.values(secureDelegationDetails)) {\n      if (delegation.delegate) addAccess(delegation.delegate, delegation.accessLevel)\n      if (delegation.delegator) addAccess(delegation.delegator, delegation.accessLevel)\n    }\n    for (const { keys, delegation } of secureDelegationWithUnknownMembers) {\n      const bestKey = keys.find((k) => {\n        const currMap = secureDelegationKeyMapsByDelegationKey[k]\n        return currMap && !!currMap.delegator && !!currMap.delegate\n      })\n      if (bestKey) {\n        const keyMap = secureDelegationKeyMapsByDelegationKey[bestKey]\n        addAccess(keyMap.delegate!, delegation.accessLevel)\n        addAccess(keyMap.delegator!, delegation.accessLevel)\n      } else {\n        hasUnknownAnonymousDataOwners = true\n      }\n    }\n    return { permissionsByDataOwnerId, hasUnknownAnonymousDataOwners }\n  }\n\n  private async mergePermissions(\n    values: {\n      permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n      hasUnknownAnonymousDataOwners: boolean\n    }[]\n  ): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const accumulatedPermissions: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    for (const v of values) {\n      hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || v.hasUnknownAnonymousDataOwners\n      for (const [dataOwnerId, level] of Object.entries(v.permissionsByDataOwnerId)) {\n        if (accumulatedPermissions[dataOwnerId] !== AccessLevelEnum.WRITE) {\n          accumulatedPermissions[dataOwnerId] = level\n        }\n      }\n    }\n    return {\n      permissionsByDataOwnerId: accumulatedPermissions,\n      hasUnknownAnonymousDataOwners,\n    }\n  }\n\n  private async getDecryptedSecureDelegationKeyMaps(\n    delegationIds: string[],\n    entityType: EntityWithDelegationTypeName\n  ): Promise<SecureDelegationKeyMap[]> {\n    if (delegationIds.length) {\n      const encryptedMaps = await this.delegationKeyMapApi.getByDelegationKeys(\n        { ids: delegationIds },\n        await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n      )\n      const res: SecureDelegationKeyMap[] = []\n      for (const encryptedMap of encryptedMaps) {\n        // Use the original entity type\n        const decryptionResult = await this.xapis.decryptEntity(encryptedMap, entityType, (x) => new SecureDelegationKeyMap(x))\n        if (decryptionResult.decrypted) {\n          res.push(decryptionResult.entity)\n        }\n      }\n      return res\n    } else return []\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async ensureDelegationKeyMapSharedWith(entityType: EntityWithDelegationTypeName, keyMap: SecureDelegationKeyMap, delegates: string[]) {\n    if (!keyMap.delegator || !keyMap.delegate) throw new Error('Illegal state: key map is missing delegator or delegate info.')\n    const dataOwnersWithAccessToMapThroughDelegation = Object.values(\n      await this.secureDelegationsMetadataDecryptor.getDelegationMemberDetails({\n        type: entityType,\n        entity: keyMap,\n      })\n    )\n      .flatMap((x) => [x.delegate, x.delegator])\n      .filter((x) => !!x) as string[]\n    // Delegator and delegate got access to the entity when it was first created: no need to share with them ever.\n    const dataOwnersWithAccessToMap = new Set([keyMap.delegate, keyMap.delegator, ...dataOwnersWithAccessToMapThroughDelegation])\n    const dataOwnersNeedingShare = delegates.filter((x) => !dataOwnersWithAccessToMap.has(x))\n    if (dataOwnersNeedingShare.length) {\n      ;(\n        await this.xapis.simpleShareOrUpdateEncryptedEntityMetadata(\n          { entity: keyMap, type: entityType },\n          false,\n          Object.fromEntries(\n            dataOwnersNeedingShare.map((x) => [\n              x,\n              {\n                shareSecretIds: [],\n                shareEncryptionKeys: ShareMetadataBehaviour.REQUIRED,\n                shareOwningEntityIds: ShareMetadataBehaviour.NEVER,\n                requestedPermissions: RequestedPermissionEnum.FULL_READ,\n              },\n            ])\n          ),\n          async (request) =>\n            this.delegationKeyMapApi.bulkShareSecureDelegationKeyMap(\n              request,\n              await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n            )\n        )\n      ).updatedEntityOrThrow\n    }\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async createSecureDelegationKeyMap(\n    entityType: EntityWithDelegationTypeName,\n    delegationKey: string,\n    delegationMembersDetails: DelegationMembersDetails,\n    delegates: string[]\n  ) {\n    if (!delegationMembersDetails.delegate || !delegationMembersDetails.delegator || !delegationMembersDetails.accessControlSecret)\n      throw new Error('Illegal state: delegation members details are missing delegate, delegator or access control secret info.')\n    const selfDoId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    // Ensure that both the delegator and delegate of the delegation this map refers tho can share it later on, even if they did not create it.\n    // Usually either the delegator or delegate are the current data owner, but sometimes also the child of the delegator or delegate can do it.\n    const initialDelegates = [delegationMembersDetails.delegate, delegationMembersDetails.delegator, ...delegates].filter((x) => x != selfDoId)\n    const initalisedMapInfo = await this.xapis.entityWithInitialisedEncryptedMetadata<SecureDelegationKeyMap>(\n      {\n        id: this.cryptoPrimitives.randomUuid(),\n        delegate: delegationMembersDetails.delegate,\n        delegator: delegationMembersDetails.delegator,\n        delegationKey: delegationKey,\n      },\n      entityType,\n      undefined,\n      undefined,\n      true,\n      false,\n      Object.fromEntries(initialDelegates.map((x) => [x, AccessLevelEnum.READ]))\n    )\n    const encryptedKeyMap = await this.xapis.tryEncryptEntity(\n      initalisedMapInfo.updatedEntity,\n      entityType,\n      this.delegationKeyMapFieldsToEncrypt,\n      false,\n      true,\n      (x) => new SecureDelegationKeyMap(x)\n    )\n    await this.delegationKeyMapApi.create(\n      encryptedKeyMap,\n      new XHR.Header(\n        ACCESS_CONTROL_KEYS_HEADER,\n        await this.accessControlSecretUtils.getEncodedAccessControlKeys([delegationMembersDetails.accessControlSecret], entityType)\n      )\n    )\n  }\n}\n"]}

package/icc-x-api/crypto/HMACUtils.d.ts

@@ -1,4 +1,11 @@
-export declare class HMACUtils {
+export interface HMACUtils {
+    generateKey(): Promise<CryptoKey>;
+    exportKey(key: CryptoKey): Promise<ArrayBuffer>;
+    importKey(key: ArrayBuffer): Promise<CryptoKey>;
+    sign(key: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer>;
+    verify(key: CryptoKey, data: ArrayBuffer, signature: ArrayBuffer): Promise<boolean>;
+}
+export declare class HMACUtilsImpl implements HMACUtils {
     private readonly _crypto;
     private readonly recommendedKeyLengthBytes;
     private readonly params;