@icure/api 8.0.7 → 8.0.9

package/test/icc-x-api/crypto/secure-delegations-manager-test.js

@@ -0,0 +1,266 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const mocha_1 = require("mocha");
+const CryptoPrimitives_1 = require("../../../icc-x-api/crypto/CryptoPrimitives");
+const crypto_1 = require("crypto");
+const FakeEncryptionKeysManager_1 = require("../../utils/FakeEncryptionKeysManager");
+const SecureDelegationsSecurityMetadataDecryptor_1 = require("../../../icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor");
+const SecureDelegationsEncryption_1 = require("../../../icc-x-api/crypto/SecureDelegationsEncryption");
+const icc_x_api_1 = require("../../../icc-x-api");
+const SecureDelegationsManager_1 = require("../../../icc-x-api/crypto/SecureDelegationsManager");
+const AccessControlSecretUtils_1 = require("../../../icc-x-api/crypto/AccessControlSecretUtils");
+const ExchangeDataManager_1 = require("../../../icc-x-api/crypto/ExchangeDataManager");
+const BaseExchangeDataManager_1 = require("../../../icc-x-api/crypto/BaseExchangeDataManager");
+const FakeExchangeDataApi_1 = require("../../utils/FakeExchangeDataApi");
+const FakeDataOwnerApi_1 = require("../../utils/FakeDataOwnerApi");
+const TestCryptoStrategies_1 = require("../../utils/TestCryptoStrategies");
+const FakeSignatureKeysManager_1 = require("../../utils/FakeSignatureKeysManager");
+const EntityShareRequest_1 = require("../../../icc-api/model/requests/EntityShareRequest");
+const chai_1 = require("chai");
+const SecurityMetadata_1 = require("../../../icc-api/model/SecurityMetadata");
+const SecureDelegation_1 = require("../../../icc-api/model/SecureDelegation");
+const collection_utils_1 = require("../../../icc-x-api/utils/collection-utils");
+const EntitySharedMetadataUpdateRequest_1 = require("../../../icc-api/model/requests/EntitySharedMetadataUpdateRequest");
+const utils_1 = require("../../../icc-x-api/crypto/utils");
+const DataOwnerTypeEnum_1 = require("../../../icc-api/model/DataOwnerTypeEnum");
+const FakeExchangeDataMapManager_1 = require("../../utils/FakeExchangeDataMapManager");
+var RequestedPermissionEnum = EntityShareRequest_1.EntityShareRequest.RequestedPermissionInternal;
+var EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest_1.EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum;
+(0, mocha_1.describe)('Secure delegations manager', function () {
+    return __awaiter(this, void 0, void 0, function* () {
+        const primitives = new CryptoPrimitives_1.CryptoPrimitives(crypto_1.webcrypto);
+        let selfId;
+        let selfKeyFp;
+        let selfKeypair;
+        let delegateId;
+        let delegateKeyFp;
+        let delegateKeypair;
+        let dataOwnerApi;
+        let exchangeDataMapManager;
+        let secureDelegationsEncryption;
+        let decryptor;
+        let manager;
+        let exchangeData;
+        let accessControlSecretUtils;
+        function initialiseComponents(explicitSelf, explicitDelegate) {
+            return __awaiter(this, void 0, void 0, function* () {
+                selfId = primitives.randomUuid();
+                selfKeypair = yield primitives.RSA.generateKeyPair(icc_x_api_1.ShaVersion.Sha256);
+                selfKeyFp = (0, icc_x_api_1.ua2hex)(yield primitives.RSA.exportKey(selfKeypair.publicKey, 'spki')).slice(-32);
+                delegateId = primitives.randomUuid();
+                delegateKeypair = yield primitives.RSA.generateKeyPair(icc_x_api_1.ShaVersion.Sha256);
+                delegateKeyFp = (0, utils_1.fingerprintV2)((0, icc_x_api_1.ua2hex)(yield primitives.RSA.exportKey(delegateKeypair.publicKey, 'spki')));
+                dataOwnerApi = new FakeDataOwnerApi_1.FakeDataOwnerApi({
+                    id: selfId,
+                    type: explicitSelf ? DataOwnerTypeEnum_1.DataOwnerTypeEnum.Hcp : DataOwnerTypeEnum_1.DataOwnerTypeEnum.Patient,
+                    publicKey: (0, icc_x_api_1.ua2hex)(yield primitives.RSA.exportKey(selfKeypair.publicKey, 'spki')),
+                }, [
+                    {
+                        id: delegateId,
+                        type: explicitDelegate ? DataOwnerTypeEnum_1.DataOwnerTypeEnum.Hcp : DataOwnerTypeEnum_1.DataOwnerTypeEnum.Patient,
+                        publicKey: (0, icc_x_api_1.ua2hex)(yield primitives.RSA.exportKey(delegateKeypair.publicKey, 'spki')),
+                    },
+                ]);
+                const cryptoStrategies = new TestCryptoStrategies_1.TestCryptoStrategies();
+                const exchangeDataApi = new FakeExchangeDataApi_1.FakeExchangeDataApi();
+                accessControlSecretUtils = new AccessControlSecretUtils_1.AccessControlSecretUtils(primitives);
+                const encryptionKeysManager = yield FakeEncryptionKeysManager_1.FakeEncryptionKeysManager.create(primitives, [selfKeypair]);
+                const signatureKeysManager = new FakeSignatureKeysManager_1.FakeSignatureKeysManager(primitives);
+                const baseExchangeData = new BaseExchangeDataManager_1.BaseExchangeDataManager(exchangeDataApi, dataOwnerApi, primitives, !explicitSelf);
+                exchangeData = yield (0, ExchangeDataManager_1.initialiseExchangeDataManagerForCurrentDataOwner)(baseExchangeData, encryptionKeysManager, signatureKeysManager, accessControlSecretUtils, cryptoStrategies, dataOwnerApi, primitives, true);
+                exchangeDataMapManager = new FakeExchangeDataMapManager_1.FakeExchangeDataMapManager();
+                secureDelegationsEncryption = new SecureDelegationsEncryption_1.SecureDelegationsEncryption(encryptionKeysManager, primitives);
+                decryptor = new SecureDelegationsSecurityMetadataDecryptor_1.SecureDelegationsSecurityMetadataDecryptor(exchangeData, exchangeDataMapManager, secureDelegationsEncryption, dataOwnerApi);
+                manager = new SecureDelegationsManager_1.SecureDelegationsManager(exchangeData, exchangeDataMapManager, secureDelegationsEncryption, accessControlSecretUtils, encryptionKeysManager, primitives, dataOwnerApi, cryptoStrategies, !explicitSelf);
+            });
+        }
+        it('should make a share request which will create a decryptable secure delegation.', function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                function doTest(explicitSelf, explicitDelegate) {
+                    var _a, _b, _c, _d;
+                    return __awaiter(this, void 0, void 0, function* () {
+                        yield initialiseComponents(explicitSelf, explicitDelegate);
+                        const secretIds = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16)), (0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                        const encryptionKeys = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                        const owningEntityIds = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16)), (0, icc_x_api_1.ua2hex)(primitives.randomBytes(16)), (0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                        const entityType = icc_x_api_1.EntityWithDelegationTypeName.Patient;
+                        const shareOrUpdateParams = yield manager.makeShareOrUpdateRequestParams({ entity: { secretForeignKeys: [] }, type: entityType }, delegateId, secretIds, encryptionKeys, owningEntityIds, EntityShareRequest_1.EntityShareRequest.RequestedPermissionEnum.MAX_WRITE);
+                        (0, chai_1.expect)(shareOrUpdateParams).to.not.be.undefined;
+                        (0, chai_1.expect)(shareOrUpdateParams.update).to.be.undefined;
+                        (0, chai_1.expect)(shareOrUpdateParams.share).to.not.be.undefined;
+                        const shareParams = shareOrUpdateParams.share;
+                        (0, chai_1.expect)(shareParams.accessControlKeys).to.have.length(1);
+                        if (explicitSelf && explicitDelegate) {
+                            (0, chai_1.expect)(shareParams.exchangeDataId).to.not.be.undefined;
+                            (0, chai_1.expect)(Object.entries((_a = shareParams.encryptedExchangeDataId) !== null && _a !== void 0 ? _a : {})).to.have.length(0);
+                        }
+                        else if (explicitSelf && !explicitDelegate) {
+                            (0, chai_1.expect)(shareParams.exchangeDataId).to.be.undefined;
+                            (0, chai_1.expect)(Object.entries((_b = shareParams.encryptedExchangeDataId) !== null && _b !== void 0 ? _b : {})).to.have.length(1);
+                            (0, chai_1.expect)(shareParams.encryptedExchangeDataId[selfKeyFp]).to.not.be.undefined;
+                        }
+                        else if (!explicitSelf && explicitDelegate) {
+                            (0, chai_1.expect)(shareParams.exchangeDataId).to.be.undefined;
+                            (0, chai_1.expect)(Object.entries((_c = shareParams.encryptedExchangeDataId) !== null && _c !== void 0 ? _c : {})).to.have.length(1);
+                            (0, chai_1.expect)(shareParams.encryptedExchangeDataId[delegateKeyFp]).to.not.be.undefined;
+                        }
+                        else {
+                            (0, chai_1.expect)(shareParams.exchangeDataId).to.be.undefined;
+                            (0, chai_1.expect)(Object.entries((_d = shareParams.encryptedExchangeDataId) !== null && _d !== void 0 ? _d : {})).to.have.length(0);
+                        }
+                        const secDelKey = (0, icc_x_api_1.ua2hex)(yield primitives.sha256((0, icc_x_api_1.hex2ua)(shareParams.accessControlKeys[0])));
+                        const fakeEntity = {
+                            entity: {
+                                secretForeignKeys: [],
+                                securityMetadata: new SecurityMetadata_1.SecurityMetadata({
+                                    secureDelegations: {
+                                        [secDelKey]: new SecureDelegation_1.SecureDelegation({
+                                            delegator: shareParams.explicitDelegator,
+                                            delegate: shareParams.explicitDelegate,
+                                            secretIds: shareParams.secretIds,
+                                            encryptionKeys: shareParams.encryptionKeys,
+                                            owningEntityIds: shareParams.owningEntityIds,
+                                            exchangeDataId: shareParams.exchangeDataId,
+                                            encryptedExchangeDataId: shareParams.encryptedExchangeDataId,
+                                            permissions: SecureDelegation_1.SecureDelegation.AccessLevelEnum.WRITE,
+                                        }),
+                                    },
+                                }),
+                            },
+                            type: icc_x_api_1.EntityWithDelegationTypeName.Patient,
+                        };
+                        yield exchangeDataMapManager.createExchangeDataMaps({ [secDelKey]: shareParams.encryptedExchangeDataId });
+                        yield exchangeData.clearOrRepopulateCache();
+                        const decryptedSecretIds = (yield (0, collection_utils_1.asyncGeneratorToArray)(decryptor.decryptSecretIdsOf(fakeEntity, [selfId]))).map((x) => x.decrypted);
+                        const decryptedEncryptionKeys = (yield (0, collection_utils_1.asyncGeneratorToArray)(decryptor.decryptEncryptionKeysOf(fakeEntity, [selfId]))).map((x) => x.decrypted);
+                        const decryptedOwningEntityIds = (yield (0, collection_utils_1.asyncGeneratorToArray)(decryptor.decryptOwningEntityIdsOf(fakeEntity, [selfId]))).map((x) => x.decrypted);
+                        (0, chai_1.expect)(decryptedSecretIds).to.have.length(secretIds.length);
+                        for (const secretId of secretIds) {
+                            (0, chai_1.expect)(decryptedSecretIds).to.include(secretId);
+                        }
+                        (0, chai_1.expect)(decryptedEncryptionKeys).to.have.length(encryptionKeys.length);
+                        for (const encryptionKey of encryptionKeys) {
+                            (0, chai_1.expect)(decryptedEncryptionKeys).to.include(encryptionKey);
+                        }
+                        (0, chai_1.expect)(decryptedOwningEntityIds).to.have.length(owningEntityIds.length);
+                        for (const owningEntityId of owningEntityIds) {
+                            (0, chai_1.expect)(decryptedOwningEntityIds).to.include(owningEntityId);
+                        }
+                    });
+                }
+                console.log('Patient->Patient');
+                yield doTest(false, false);
+                console.log('Hcp->Patient');
+                yield doTest(true, false);
+                console.log('Patient->Hcp');
+                yield doTest(false, true);
+                console.log('Hcp->Hcp');
+                yield doTest(true, true);
+            });
+        });
+        it('should make an update request which the missing entries for existing secure delegations.', function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                function doTest(makeAccessibleFromAlias) {
+                    var _a, _b, _c, _d, _e, _f;
+                    return __awaiter(this, void 0, void 0, function* () {
+                        yield initialiseComponents(false, false);
+                        const canonicalSfk = primitives.randomUuid();
+                        const aliasSfk = primitives.randomUuid();
+                        const exchangeDataInfo = yield exchangeData.getOrCreateEncryptionDataTo(delegateId, icc_x_api_1.EntityWithDelegationTypeName.Patient, [], false);
+                        const canonicalKey = yield accessControlSecretUtils.secureDelegationKeyFor(exchangeDataInfo.accessControlSecret, icc_x_api_1.EntityWithDelegationTypeName.Patient, canonicalSfk);
+                        const aliasKey = yield accessControlSecretUtils.secureDelegationKeyFor(exchangeDataInfo.accessControlSecret, icc_x_api_1.EntityWithDelegationTypeName.Patient, aliasSfk);
+                        const existingSecretIds = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                        const newSecretIds = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                        const existingEncryptionKeys = [];
+                        const newEncryptionKeys = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                        const existingOwningEntityIds = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                        const newOwningEntityIds = [];
+                        const fakeEntity = {
+                            entity: {
+                                secretForeignKeys: makeAccessibleFromAlias ? [aliasSfk] : [canonicalSfk],
+                                securityMetadata: new SecurityMetadata_1.SecurityMetadata({
+                                    secureDelegations: {
+                                        [canonicalKey]: new SecureDelegation_1.SecureDelegation({
+                                            delegator: selfId,
+                                            delegate: selfId,
+                                            secretIds: yield secureDelegationsEncryption.encryptSecretIds(existingSecretIds, exchangeDataInfo.exchangeKey),
+                                            encryptionKeys: yield secureDelegationsEncryption.encryptEncryptionKeys(existingEncryptionKeys, exchangeDataInfo.exchangeKey),
+                                            owningEntityIds: yield secureDelegationsEncryption.encryptOwningEntityIds(existingOwningEntityIds, exchangeDataInfo.exchangeKey),
+                                            permissions: SecureDelegation_1.SecureDelegation.AccessLevelEnum.WRITE,
+                                        }),
+                                    },
+                                    keysEquivalences: { [aliasKey]: canonicalKey },
+                                }),
+                            },
+                            type: icc_x_api_1.EntityWithDelegationTypeName.Patient,
+                        };
+                        const shareOrUpdateParams = yield manager.makeShareOrUpdateRequestParams(fakeEntity, delegateId, [...existingSecretIds, ...newSecretIds], [...existingEncryptionKeys, ...newEncryptionKeys], [...existingOwningEntityIds, ...newOwningEntityIds], RequestedPermissionEnum.MAX_WRITE);
+                        (0, chai_1.expect)(shareOrUpdateParams).to.not.be.undefined;
+                        (0, chai_1.expect)(shareOrUpdateParams.share).to.be.undefined;
+                        (0, chai_1.expect)(shareOrUpdateParams.update).to.not.be.undefined;
+                        const updateParams = shareOrUpdateParams.update;
+                        (0, chai_1.expect)(updateParams.metadataAccessControlHash).to.equal(canonicalKey);
+                        (0, chai_1.expect)(Object.keys((_a = updateParams.secretIds) !== null && _a !== void 0 ? _a : {})).to.have.length(newSecretIds.length);
+                        for (const [secretId, updateType] of Object.entries((_b = updateParams.secretIds) !== null && _b !== void 0 ? _b : {})) {
+                            (0, chai_1.expect)(updateType).to.equal(EntryUpdateTypeEnum.CREATE);
+                            (0, chai_1.expect)(newSecretIds).to.contain(yield secureDelegationsEncryption.decryptSecretId(secretId, exchangeDataInfo.exchangeKey));
+                        }
+                        (0, chai_1.expect)(Object.keys((_c = updateParams.encryptionKeys) !== null && _c !== void 0 ? _c : {})).to.have.length(newEncryptionKeys.length);
+                        for (const [encryptionKey, updateType] of Object.entries((_d = updateParams.encryptionKeys) !== null && _d !== void 0 ? _d : {})) {
+                            (0, chai_1.expect)(updateType).to.equal(EntryUpdateTypeEnum.CREATE);
+                            (0, chai_1.expect)(newEncryptionKeys).to.contain(yield secureDelegationsEncryption.decryptEncryptionKey(encryptionKey, exchangeDataInfo.exchangeKey));
+                        }
+                        (0, chai_1.expect)(Object.keys((_e = updateParams.owningEntityIds) !== null && _e !== void 0 ? _e : {})).to.have.length(newOwningEntityIds.length);
+                        for (const [owningEntityId, updateType] of Object.entries((_f = updateParams.owningEntityIds) !== null && _f !== void 0 ? _f : {})) {
+                            (0, chai_1.expect)(updateType).to.equal(EntryUpdateTypeEnum.CREATE);
+                            (0, chai_1.expect)(newOwningEntityIds).to.contain(yield secureDelegationsEncryption.decryptOwningEntityId(owningEntityId, exchangeDataInfo.exchangeKey));
+                        }
+                    });
+                }
+                yield doTest(true);
+                yield doTest(false);
+            });
+        });
+        it('should return undefined for existing secure delegations if it contains all entries.', function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield initialiseComponents(false, false);
+                const canonicalSfk = primitives.randomUuid();
+                const exchangeDataInfo = yield exchangeData.getOrCreateEncryptionDataTo(delegateId, icc_x_api_1.EntityWithDelegationTypeName.Patient, [], false);
+                const canonicalKey = yield accessControlSecretUtils.secureDelegationKeyFor(exchangeDataInfo.accessControlSecret, icc_x_api_1.EntityWithDelegationTypeName.Patient, canonicalSfk);
+                const existingSecretIds = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                const existingEncryptionKeys = [];
+                const existingOwningEntityIds = [(0, icc_x_api_1.ua2hex)(primitives.randomBytes(16))];
+                const fakeEntity = {
+                    entity: {
+                        secretForeignKeys: [canonicalSfk],
+                        securityMetadata: new SecurityMetadata_1.SecurityMetadata({
+                            secureDelegations: {
+                                [canonicalKey]: new SecureDelegation_1.SecureDelegation({
+                                    delegator: selfId,
+                                    delegate: selfId,
+                                    secretIds: yield secureDelegationsEncryption.encryptSecretIds(existingSecretIds, exchangeDataInfo.exchangeKey),
+                                    encryptionKeys: yield secureDelegationsEncryption.encryptEncryptionKeys(existingEncryptionKeys, exchangeDataInfo.exchangeKey),
+                                    owningEntityIds: yield secureDelegationsEncryption.encryptOwningEntityIds(existingOwningEntityIds, exchangeDataInfo.exchangeKey),
+                                    permissions: SecureDelegation_1.SecureDelegation.AccessLevelEnum.WRITE,
+                                }),
+                            },
+                        }),
+                    },
+                    type: icc_x_api_1.EntityWithDelegationTypeName.Patient,
+                };
+                const shareOrUpdateParams = yield manager.makeShareOrUpdateRequestParams(fakeEntity, delegateId, [...existingSecretIds], [...existingEncryptionKeys], [...existingOwningEntityIds], RequestedPermissionEnum.MAX_WRITE);
+                (0, chai_1.expect)(shareOrUpdateParams).to.be.undefined;
+            });
+        });
+    });
+});
+//# sourceMappingURL=secure-delegations-manager-test.js.map

package/test/icc-x-api/crypto/secure-delegations-manager-test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-delegations-manager-test.js","sourceRoot":"","sources":["../../../../test/icc-x-api/crypto/secure-delegations-manager-test.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,iCAAgC;AAChC,iFAA6E;AAC7E,mCAAkC;AAClC,qFAAiF;AACjF,qIAAiI;AACjI,uGAAmG;AACnG,kDAA6F;AAC7F,iGAA6F;AAC7F,iGAA6F;AAC7F,uFAAqI;AACrI,+FAA2F;AAC3F,yEAAqE;AACrE,mEAA+D;AAC/D,2EAAuE;AACvE,mFAA+E;AAE/E,2FAAuF;AACvF,+BAA6B;AAE7B,8EAA0E;AAC1E,8EAA0E;AAC1E,gFAAiF;AACjF,yHAAqH;AACrH,2DAA+D;AAC/D,gFAA4E;AAC5E,uFAAmF;AACnF,IAAO,uBAAuB,GAAG,uCAAkB,CAAC,2BAA2B,CAAA;AAC/E,IAAO,mBAAmB,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;AAElF,IAAA,gBAAQ,EAAC,4BAA4B,EAAE;;QACrC,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC,kBAAgB,CAAC,CAAA;QACzD,IAAI,MAAc,CAAA;QAClB,IAAI,SAAiB,CAAA;QACrB,IAAI,WAA+B,CAAA;QACnC,IAAI,UAAkB,CAAA;QACtB,IAAI,aAAqB,CAAA;QACzB,IAAI,eAAmC,CAAA;QACvC,IAAI,YAA8B,CAAA;QAClC,IAAI,sBAAkD,CAAA;QACtD,IAAI,2BAAwD,CAAA;QAC5D,IAAI,SAAqD,CAAA;QACzD,IAAI,OAAiC,CAAA;QACrC,IAAI,YAAiC,CAAA;QACrC,IAAI,wBAAkD,CAAA;QAEtD,SAAe,oBAAoB,CAAC,YAAqB,EAAE,gBAAyB;;gBAClF,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,CAAA;gBAChC,WAAW,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAU,CAAC,MAAM,CAAC,CAAA;gBACrE,SAAS,GAAG,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;gBAC5F,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,CAAA;gBACpC,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAU,CAAC,MAAM,CAAC,CAAA;gBACzE,aAAa,GAAG,IAAA,qBAAa,EAAC,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;gBACxG,YAAY,GAAG,IAAI,mCAAgB,CACjC;oBACE,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,qCAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,qCAAiB,CAAC,OAAO;oBACtE,SAAS,EAAE,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;iBACjF,EACD;oBACE;wBACE,EAAE,EAAE,UAAU;wBACd,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,qCAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,qCAAiB,CAAC,OAAO;wBAC1E,SAAS,EAAE,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;qBACrF;iBACF,CACF,CAAA;gBACD,MAAM,gBAAgB,GAAG,IAAI,2CAAoB,EAAE,CAAA;gBACnD,MAAM,eAAe,GAAG,IAAI,yCAAmB,EAAE,CAAA;gBACjD,wBAAwB,GAAG,IAAI,mDAAwB,CAAC,UAAU,CAAC,CAAA;gBACnE,MAAM,qBAAqB,GAAG,MAAM,qDAAyB,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;gBAC/F,MAAM,oBAAoB,GAAG,IAAI,mDAAwB,CAAC,UAAU,CAAC,CAAA;gBACrE,MAAM,gBAAgB,GAAG,IAAI,iDAAuB,CAAC,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,CAAA;gBAC9G,YAAY,GAAG,MAAM,IAAA,sEAAgD,EACnE,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,IAAI,CACL,CAAA;gBACD,sBAAsB,GAAG,IAAI,uDAA0B,EAAE,CAAA;gBACzD,2BAA2B,GAAG,IAAI,yDAA2B,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAA;gBAChG,SAAS,GAAG,IAAI,uFAA0C,CAAC,YAAY,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,YAAY,CAAC,CAAA;gBAC3I,OAAO,GAAG,IAAI,mDAAwB,CACpC,YAAY,EACZ,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EACrB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,CAAC,YAAY,CACd,CAAA;YACH,CAAC;SAAA;QAED,EAAE,CAAC,gFAAgF,EAAE;;gBACnF,SAAe,MAAM,CAAC,YAAqB,EAAE,gBAAyB;;;wBACpE,MAAM,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;wBAC1D,MAAM,SAAS,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;wBAC1F,MAAM,cAAc,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;wBAC3D,MAAM,eAAe,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;wBACpI,MAAM,UAAU,GAAG,wCAA4B,CAAC,OAAO,CAAA;wBACvD,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,8BAA8B,CACtE,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EACvD,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,uCAAkB,CAAC,uBAAuB,CAAC,SAAS,CACrD,CAAA;wBACD,IAAA,aAAM,EAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;wBAC/C,IAAA,aAAM,EAAC,mBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAA;wBACnD,IAAA,aAAM,EAAC,mBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;wBACtD,MAAM,WAAW,GAAG,mBAAoB,CAAC,KAAM,CAAA;wBAC/C,IAAA,aAAM,EAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;wBACvD,IAAI,YAAY,IAAI,gBAAgB,EAAE;4BACpC,IAAA,aAAM,EAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;4BACtD,IAAA,aAAM,EAAC,MAAM,CAAC,OAAO,CAAC,MAAA,WAAW,CAAC,uBAAuB,mCAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;yBACpF;6BAAM,IAAI,YAAY,IAAI,CAAC,gBAAgB,EAAE;4BAC5C,IAAA,aAAM,EAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAA;4BAClD,IAAA,aAAM,EAAC,MAAM,CAAC,OAAO,CAAC,MAAA,WAAW,CAAC,uBAAuB,mCAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;4BACnF,IAAA,aAAM,EAAC,WAAW,CAAC,uBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;yBAC5E;6BAAM,IAAI,CAAC,YAAY,IAAI,gBAAgB,EAAE;4BAC5C,IAAA,aAAM,EAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAA;4BAClD,IAAA,aAAM,EAAC,MAAM,CAAC,OAAO,CAAC,MAAA,WAAW,CAAC,uBAAuB,mCAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;4BACnF,IAAA,aAAM,EAAC,WAAW,CAAC,uBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;yBAChF;6BAAM;4BACL,IAAA,aAAM,EAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAA;4BAClD,IAAA,aAAM,EAAC,MAAM,CAAC,OAAO,CAAC,MAAA,WAAW,CAAC,uBAAuB,mCAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;yBACpF;wBACD,MAAM,SAAS,GAAG,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,MAAM,CAAC,IAAA,kBAAM,EAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;wBAC3F,MAAM,UAAU,GAAwE;4BACtF,MAAM,EAAE;gCACN,iBAAiB,EAAE,EAAE;gCACrB,gBAAgB,EAAE,IAAI,mCAAgB,CAAC;oCACrC,iBAAiB,EAAE;wCACjB,CAAC,SAAS,CAAC,EAAE,IAAI,mCAAgB,CAAC;4CAChC,SAAS,EAAE,WAAW,CAAC,iBAAiB;4CACxC,QAAQ,EAAE,WAAW,CAAC,gBAAgB;4CACtC,SAAS,EAAE,WAAW,CAAC,SAAS;4CAChC,cAAc,EAAE,WAAW,CAAC,cAAc;4CAC1C,eAAe,EAAE,WAAW,CAAC,eAAe;4CAC5C,cAAc,EAAE,WAAW,CAAC,cAAc;4CAC1C,uBAAuB,EAAE,WAAW,CAAC,uBAAuB;4CAC5D,WAAW,EAAE,mCAAgB,CAAC,eAAe,CAAC,KAAK;yCACpD,CAAC;qCACH;iCACF,CAAC;6BACH;4BACD,IAAI,EAAE,wCAA4B,CAAC,OAAO;yBAC3C,CAAA;wBACD,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,uBAAwB,EAAE,CAAC,CAAA;wBAC1G,MAAM,YAAY,CAAC,sBAAsB,EAAE,CAAA;wBAC3C,MAAM,kBAAkB,GAAG,CAAC,MAAM,IAAA,wCAAqB,EAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;wBACpI,MAAM,uBAAuB,GAAG,CAAC,MAAM,IAAA,wCAAqB,EAAC,SAAS,CAAC,uBAAuB,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;wBAC9I,MAAM,wBAAwB,GAAG,CAAC,MAAM,IAAA,wCAAqB,EAAC,SAAS,CAAC,wBAAwB,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;wBAChJ,IAAA,aAAM,EAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;wBAC3D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;4BAChC,IAAA,aAAM,EAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;yBAChD;wBACD,IAAA,aAAM,EAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;wBACrE,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE;4BAC1C,IAAA,aAAM,EAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;yBAC1D;wBACD,IAAA,aAAM,EAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;wBACvE,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;4BAC5C,IAAA,aAAM,EAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;yBAC5D;;iBACF;gBACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;gBAC/B,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBAC3B,MAAM,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACzB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBAC3B,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;gBACzB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACvB,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC1B,CAAC;SAAA,CAAC,CAAA;QAEF,EAAE,CAAC,0FAA0F,EAAE;;gBAC7F,SAAe,MAAM,CAAC,uBAAgC;;;wBACpD,MAAM,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;wBACxC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,EAAE,CAAA;wBAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,EAAE,CAAA;wBACxC,MAAM,gBAAgB,GAAG,MAAM,YAAY,CAAC,2BAA2B,CAAC,UAAU,EAAE,wCAA4B,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;wBACpI,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,sBAAsB,CACxE,gBAAgB,CAAC,mBAAmB,EACpC,wCAA4B,CAAC,OAAO,EACpC,YAAY,CACb,CAAA;wBACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,sBAAsB,CACpE,gBAAgB,CAAC,mBAAmB,EACpC,wCAA4B,CAAC,OAAO,EACpC,QAAQ,CACT,CAAA;wBACD,MAAM,iBAAiB,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;wBAC9D,MAAM,YAAY,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;wBACzD,MAAM,sBAAsB,GAAa,EAAE,CAAA;wBAC3C,MAAM,iBAAiB,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;wBAC9D,MAAM,uBAAuB,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;wBACpE,MAAM,kBAAkB,GAAa,EAAE,CAAA;wBACvC,MAAM,UAAU,GAAwE;4BACtF,MAAM,EAAE;gCACN,iBAAiB,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;gCACxE,gBAAgB,EAAE,IAAI,mCAAgB,CAAC;oCACrC,iBAAiB,EAAE;wCACjB,CAAC,YAAY,CAAC,EAAE,IAAI,mCAAgB,CAAC;4CACnC,SAAS,EAAE,MAAM;4CACjB,QAAQ,EAAE,MAAM;4CAChB,SAAS,EAAE,MAAM,2BAA2B,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC;4CAC9G,cAAc,EAAE,MAAM,2BAA2B,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,WAAW,CAAC;4CAC7H,eAAe,EAAE,MAAM,2BAA2B,CAAC,sBAAsB,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,WAAW,CAAC;4CAChI,WAAW,EAAE,mCAAgB,CAAC,eAAe,CAAC,KAAK;yCACpD,CAAC;qCACH;oCACD,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE;iCAC/C,CAAC;6BACH;4BACD,IAAI,EAAE,wCAA4B,CAAC,OAAO;yBAC3C,CAAA;wBACD,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,8BAA8B,CACtE,UAAU,EACV,UAAU,EACV,CAAC,GAAG,iBAAiB,EAAE,GAAG,YAAY,CAAC,EACvC,CAAC,GAAG,sBAAsB,EAAE,GAAG,iBAAiB,CAAC,EACjD,CAAC,GAAG,uBAAuB,EAAE,GAAG,kBAAkB,CAAC,EACnD,uBAAuB,CAAC,SAAS,CAClC,CAAA;wBACD,IAAA,aAAM,EAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;wBAC/C,IAAA,aAAM,EAAC,mBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAA;wBAClD,IAAA,aAAM,EAAC,mBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;wBACvD,MAAM,YAAY,GAAG,mBAAoB,CAAC,MAAO,CAAA;wBACjD,IAAA,aAAM,EAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;wBACrE,IAAA,aAAM,EAAC,MAAM,CAAC,IAAI,CAAC,MAAA,YAAY,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;wBACrF,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,SAAS,mCAAI,EAAE,CAAC,EAAE;4BACjF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;4BACvD,IAAA,aAAM,EAAC,YAAY,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,2BAA2B,CAAC,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;yBAC3H;wBACD,IAAA,aAAM,EAAC,MAAM,CAAC,IAAI,CAAC,MAAA,YAAY,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;wBAC/F,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,cAAc,mCAAI,EAAE,CAAC,EAAE;4BAC3F,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;4BACvD,IAAA,aAAM,EAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,2BAA2B,CAAC,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;yBAC1I;wBACD,IAAA,aAAM,EAAC,MAAM,CAAC,IAAI,CAAC,MAAA,YAAY,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;wBACjG,KAAK,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,eAAe,mCAAI,EAAE,CAAC,EAAE;4BAC7F,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;4BACvD,IAAA,aAAM,EAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,2BAA2B,CAAC,qBAAqB,CAAC,cAAc,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;yBAC7I;;iBACF;gBACD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;gBAClB,MAAM,MAAM,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;SAAA,CAAC,CAAA;QAEF,EAAE,CAAC,qFAAqF,EAAE;;gBACxF,MAAM,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBACxC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,EAAE,CAAA;gBAC5C,MAAM,gBAAgB,GAAG,MAAM,YAAY,CAAC,2BAA2B,CAAC,UAAU,EAAE,wCAA4B,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;gBACpI,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,sBAAsB,CACxE,gBAAgB,CAAC,mBAAmB,EACpC,wCAA4B,CAAC,OAAO,EACpC,YAAY,CACb,CAAA;gBACD,MAAM,iBAAiB,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC9D,MAAM,sBAAsB,GAAa,EAAE,CAAA;gBAC3C,MAAM,uBAAuB,GAAG,CAAC,IAAA,kBAAM,EAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACpE,MAAM,UAAU,GAAwE;oBACtF,MAAM,EAAE;wBACN,iBAAiB,EAAE,CAAC,YAAY,CAAC;wBACjC,gBAAgB,EAAE,IAAI,mCAAgB,CAAC;4BACrC,iBAAiB,EAAE;gCACjB,CAAC,YAAY,CAAC,EAAE,IAAI,mCAAgB,CAAC;oCACnC,SAAS,EAAE,MAAM;oCACjB,QAAQ,EAAE,MAAM;oCAChB,SAAS,EAAE,MAAM,2BAA2B,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC;oCAC9G,cAAc,EAAE,MAAM,2BAA2B,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,WAAW,CAAC;oCAC7H,eAAe,EAAE,MAAM,2BAA2B,CAAC,sBAAsB,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,WAAW,CAAC;oCAChI,WAAW,EAAE,mCAAgB,CAAC,eAAe,CAAC,KAAK;iCACpD,CAAC;6BACH;yBACF,CAAC;qBACH;oBACD,IAAI,EAAE,wCAA4B,CAAC,OAAO;iBAC3C,CAAA;gBACD,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,8BAA8B,CACtE,UAAU,EACV,UAAU,EACV,CAAC,GAAG,iBAAiB,CAAC,EACtB,CAAC,GAAG,sBAAsB,CAAC,EAC3B,CAAC,GAAG,uBAAuB,CAAC,EAC5B,uBAAuB,CAAC,SAAS,CAClC,CAAA;gBACD,IAAA,aAAM,EAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAA;YAC7C,CAAC;SAAA,CAAC,CAAA;IACJ,CAAC;CAAA,CAAC,CAAA","sourcesContent":["import { describe } from 'mocha'\nimport { CryptoPrimitives } from '../../../icc-x-api/crypto/CryptoPrimitives'\nimport { webcrypto } from 'crypto'\nimport { FakeEncryptionKeysManager } from '../../utils/FakeEncryptionKeysManager'\nimport { SecureDelegationsSecurityMetadataDecryptor } from '../../../icc-x-api/crypto/SecureDelegationsSecurityMetadataDecryptor'\nimport { SecureDelegationsEncryption } from '../../../icc-x-api/crypto/SecureDelegationsEncryption'\nimport { EntityWithDelegationTypeName, hex2ua, ShaVersion, ua2hex } from '../../../icc-x-api'\nimport { SecureDelegationsManager } from '../../../icc-x-api/crypto/SecureDelegationsManager'\nimport { AccessControlSecretUtils } from '../../../icc-x-api/crypto/AccessControlSecretUtils'\nimport { ExchangeDataManager, initialiseExchangeDataManagerForCurrentDataOwner } from '../../../icc-x-api/crypto/ExchangeDataManager'\nimport { BaseExchangeDataManager } from '../../../icc-x-api/crypto/BaseExchangeDataManager'\nimport { FakeExchangeDataApi } from '../../utils/FakeExchangeDataApi'\nimport { FakeDataOwnerApi } from '../../utils/FakeDataOwnerApi'\nimport { TestCryptoStrategies } from '../../utils/TestCryptoStrategies'\nimport { FakeSignatureKeysManager } from '../../utils/FakeSignatureKeysManager'\nimport { KeyPair } from '../../../icc-x-api/crypto/RSA'\nimport { EntityShareRequest } from '../../../icc-api/model/requests/EntityShareRequest'\nimport { expect } from 'chai'\nimport { EncryptedEntityStub } from '../../../icc-api/model/models'\nimport { SecurityMetadata } from '../../../icc-api/model/SecurityMetadata'\nimport { SecureDelegation } from '../../../icc-api/model/SecureDelegation'\nimport { asyncGeneratorToArray } from '../../../icc-x-api/utils/collection-utils'\nimport { EntitySharedMetadataUpdateRequest } from '../../../icc-api/model/requests/EntitySharedMetadataUpdateRequest'\nimport { fingerprintV2 } from '../../../icc-x-api/crypto/utils'\nimport { DataOwnerTypeEnum } from '../../../icc-api/model/DataOwnerTypeEnum'\nimport { FakeExchangeDataMapManager } from '../../utils/FakeExchangeDataMapManager'\nimport RequestedPermissionEnum = EntityShareRequest.RequestedPermissionInternal\nimport EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum\n\ndescribe('Secure delegations manager', async function () {\n  const primitives = new CryptoPrimitives(webcrypto as any)\n  let selfId: string\n  let selfKeyFp: string\n  let selfKeypair: KeyPair<CryptoKey>\n  let delegateId: string\n  let delegateKeyFp: string\n  let delegateKeypair: KeyPair<CryptoKey>\n  let dataOwnerApi: FakeDataOwnerApi\n  let exchangeDataMapManager: FakeExchangeDataMapManager\n  let secureDelegationsEncryption: SecureDelegationsEncryption\n  let decryptor: SecureDelegationsSecurityMetadataDecryptor\n  let manager: SecureDelegationsManager\n  let exchangeData: ExchangeDataManager\n  let accessControlSecretUtils: AccessControlSecretUtils\n\n  async function initialiseComponents(explicitSelf: boolean, explicitDelegate: boolean) {\n    selfId = primitives.randomUuid()\n    selfKeypair = await primitives.RSA.generateKeyPair(ShaVersion.Sha256)\n    selfKeyFp = ua2hex(await primitives.RSA.exportKey(selfKeypair.publicKey, 'spki')).slice(-32)\n    delegateId = primitives.randomUuid()\n    delegateKeypair = await primitives.RSA.generateKeyPair(ShaVersion.Sha256)\n    delegateKeyFp = fingerprintV2(ua2hex(await primitives.RSA.exportKey(delegateKeypair.publicKey, 'spki')))\n    dataOwnerApi = new FakeDataOwnerApi(\n      {\n        id: selfId,\n        type: explicitSelf ? DataOwnerTypeEnum.Hcp : DataOwnerTypeEnum.Patient,\n        publicKey: ua2hex(await primitives.RSA.exportKey(selfKeypair.publicKey, 'spki')),\n      },\n      [\n        {\n          id: delegateId,\n          type: explicitDelegate ? DataOwnerTypeEnum.Hcp : DataOwnerTypeEnum.Patient,\n          publicKey: ua2hex(await primitives.RSA.exportKey(delegateKeypair.publicKey, 'spki')),\n        },\n      ]\n    )\n    const cryptoStrategies = new TestCryptoStrategies()\n    const exchangeDataApi = new FakeExchangeDataApi()\n    accessControlSecretUtils = new AccessControlSecretUtils(primitives)\n    const encryptionKeysManager = await FakeEncryptionKeysManager.create(primitives, [selfKeypair])\n    const signatureKeysManager = new FakeSignatureKeysManager(primitives)\n    const baseExchangeData = new BaseExchangeDataManager(exchangeDataApi, dataOwnerApi, primitives, !explicitSelf)\n    exchangeData = await initialiseExchangeDataManagerForCurrentDataOwner(\n      baseExchangeData,\n      encryptionKeysManager,\n      signatureKeysManager,\n      accessControlSecretUtils,\n      cryptoStrategies,\n      dataOwnerApi,\n      primitives,\n      true\n    )\n    exchangeDataMapManager = new FakeExchangeDataMapManager()\n    secureDelegationsEncryption = new SecureDelegationsEncryption(encryptionKeysManager, primitives)\n    decryptor = new SecureDelegationsSecurityMetadataDecryptor(exchangeData, exchangeDataMapManager, secureDelegationsEncryption, dataOwnerApi)\n    manager = new SecureDelegationsManager(\n      exchangeData,\n      exchangeDataMapManager,\n      secureDelegationsEncryption,\n      accessControlSecretUtils,\n      encryptionKeysManager,\n      primitives,\n      dataOwnerApi,\n      cryptoStrategies,\n      !explicitSelf\n    )\n  }\n\n  it('should make a share request which will create a decryptable secure delegation.', async function () {\n    async function doTest(explicitSelf: boolean, explicitDelegate: boolean) {\n      await initialiseComponents(explicitSelf, explicitDelegate)\n      const secretIds = [ua2hex(primitives.randomBytes(16)), ua2hex(primitives.randomBytes(16))]\n      const encryptionKeys = [ua2hex(primitives.randomBytes(16))]\n      const owningEntityIds = [ua2hex(primitives.randomBytes(16)), ua2hex(primitives.randomBytes(16)), ua2hex(primitives.randomBytes(16))]\n      const entityType = EntityWithDelegationTypeName.Patient\n      const shareOrUpdateParams = await manager.makeShareOrUpdateRequestParams(\n        { entity: { secretForeignKeys: [] }, type: entityType },\n        delegateId,\n        secretIds,\n        encryptionKeys,\n        owningEntityIds,\n        EntityShareRequest.RequestedPermissionEnum.MAX_WRITE\n      )\n      expect(shareOrUpdateParams).to.not.be.undefined\n      expect(shareOrUpdateParams!.update).to.be.undefined\n      expect(shareOrUpdateParams!.share).to.not.be.undefined\n      const shareParams = shareOrUpdateParams!.share!\n      expect(shareParams.accessControlKeys).to.have.length(1)\n      if (explicitSelf && explicitDelegate) {\n        expect(shareParams.exchangeDataId).to.not.be.undefined\n        expect(Object.entries(shareParams.encryptedExchangeDataId ?? {})).to.have.length(0)\n      } else if (explicitSelf && !explicitDelegate) {\n        expect(shareParams.exchangeDataId).to.be.undefined\n        expect(Object.entries(shareParams.encryptedExchangeDataId ?? {})).to.have.length(1)\n        expect(shareParams.encryptedExchangeDataId![selfKeyFp]).to.not.be.undefined\n      } else if (!explicitSelf && explicitDelegate) {\n        expect(shareParams.exchangeDataId).to.be.undefined\n        expect(Object.entries(shareParams.encryptedExchangeDataId ?? {})).to.have.length(1)\n        expect(shareParams.encryptedExchangeDataId![delegateKeyFp]).to.not.be.undefined\n      } else {\n        expect(shareParams.exchangeDataId).to.be.undefined\n        expect(Object.entries(shareParams.encryptedExchangeDataId ?? {})).to.have.length(0)\n      }\n      const secDelKey = ua2hex(await primitives.sha256(hex2ua(shareParams.accessControlKeys[0])))\n      const fakeEntity: { entity: EncryptedEntityStub; type: EntityWithDelegationTypeName } = {\n        entity: {\n          secretForeignKeys: [],\n          securityMetadata: new SecurityMetadata({\n            secureDelegations: {\n              [secDelKey]: new SecureDelegation({\n                delegator: shareParams.explicitDelegator,\n                delegate: shareParams.explicitDelegate,\n                secretIds: shareParams.secretIds,\n                encryptionKeys: shareParams.encryptionKeys,\n                owningEntityIds: shareParams.owningEntityIds,\n                exchangeDataId: shareParams.exchangeDataId,\n                encryptedExchangeDataId: shareParams.encryptedExchangeDataId,\n                permissions: SecureDelegation.AccessLevelEnum.WRITE,\n              }),\n            },\n          }),\n        },\n        type: EntityWithDelegationTypeName.Patient,\n      }\n      await exchangeDataMapManager.createExchangeDataMaps({ [secDelKey]: shareParams.encryptedExchangeDataId! })\n      await exchangeData.clearOrRepopulateCache()\n      const decryptedSecretIds = (await asyncGeneratorToArray(decryptor.decryptSecretIdsOf(fakeEntity, [selfId]))).map((x) => x.decrypted)\n      const decryptedEncryptionKeys = (await asyncGeneratorToArray(decryptor.decryptEncryptionKeysOf(fakeEntity, [selfId]))).map((x) => x.decrypted)\n      const decryptedOwningEntityIds = (await asyncGeneratorToArray(decryptor.decryptOwningEntityIdsOf(fakeEntity, [selfId]))).map((x) => x.decrypted)\n      expect(decryptedSecretIds).to.have.length(secretIds.length)\n      for (const secretId of secretIds) {\n        expect(decryptedSecretIds).to.include(secretId)\n      }\n      expect(decryptedEncryptionKeys).to.have.length(encryptionKeys.length)\n      for (const encryptionKey of encryptionKeys) {\n        expect(decryptedEncryptionKeys).to.include(encryptionKey)\n      }\n      expect(decryptedOwningEntityIds).to.have.length(owningEntityIds.length)\n      for (const owningEntityId of owningEntityIds) {\n        expect(decryptedOwningEntityIds).to.include(owningEntityId)\n      }\n    }\n    console.log('Patient->Patient')\n    await doTest(false, false)\n    console.log('Hcp->Patient')\n    await doTest(true, false)\n    console.log('Patient->Hcp')\n    await doTest(false, true)\n    console.log('Hcp->Hcp')\n    await doTest(true, true)\n  })\n\n  it('should make an update request which the missing entries for existing secure delegations.', async function () {\n    async function doTest(makeAccessibleFromAlias: boolean) {\n      await initialiseComponents(false, false)\n      const canonicalSfk = primitives.randomUuid()\n      const aliasSfk = primitives.randomUuid()\n      const exchangeDataInfo = await exchangeData.getOrCreateEncryptionDataTo(delegateId, EntityWithDelegationTypeName.Patient, [], false)\n      const canonicalKey = await accessControlSecretUtils.secureDelegationKeyFor(\n        exchangeDataInfo.accessControlSecret,\n        EntityWithDelegationTypeName.Patient,\n        canonicalSfk\n      )\n      const aliasKey = await accessControlSecretUtils.secureDelegationKeyFor(\n        exchangeDataInfo.accessControlSecret,\n        EntityWithDelegationTypeName.Patient,\n        aliasSfk\n      )\n      const existingSecretIds = [ua2hex(primitives.randomBytes(16))]\n      const newSecretIds = [ua2hex(primitives.randomBytes(16))]\n      const existingEncryptionKeys: string[] = []\n      const newEncryptionKeys = [ua2hex(primitives.randomBytes(16))]\n      const existingOwningEntityIds = [ua2hex(primitives.randomBytes(16))]\n      const newOwningEntityIds: string[] = []\n      const fakeEntity: { entity: EncryptedEntityStub; type: EntityWithDelegationTypeName } = {\n        entity: {\n          secretForeignKeys: makeAccessibleFromAlias ? [aliasSfk] : [canonicalSfk],\n          securityMetadata: new SecurityMetadata({\n            secureDelegations: {\n              [canonicalKey]: new SecureDelegation({\n                delegator: selfId,\n                delegate: selfId,\n                secretIds: await secureDelegationsEncryption.encryptSecretIds(existingSecretIds, exchangeDataInfo.exchangeKey),\n                encryptionKeys: await secureDelegationsEncryption.encryptEncryptionKeys(existingEncryptionKeys, exchangeDataInfo.exchangeKey),\n                owningEntityIds: await secureDelegationsEncryption.encryptOwningEntityIds(existingOwningEntityIds, exchangeDataInfo.exchangeKey),\n                permissions: SecureDelegation.AccessLevelEnum.WRITE,\n              }),\n            },\n            keysEquivalences: { [aliasKey]: canonicalKey },\n          }),\n        },\n        type: EntityWithDelegationTypeName.Patient,\n      }\n      const shareOrUpdateParams = await manager.makeShareOrUpdateRequestParams(\n        fakeEntity,\n        delegateId,\n        [...existingSecretIds, ...newSecretIds],\n        [...existingEncryptionKeys, ...newEncryptionKeys],\n        [...existingOwningEntityIds, ...newOwningEntityIds],\n        RequestedPermissionEnum.MAX_WRITE\n      )\n      expect(shareOrUpdateParams).to.not.be.undefined\n      expect(shareOrUpdateParams!.share).to.be.undefined\n      expect(shareOrUpdateParams!.update).to.not.be.undefined\n      const updateParams = shareOrUpdateParams!.update!\n      expect(updateParams.metadataAccessControlHash).to.equal(canonicalKey)\n      expect(Object.keys(updateParams.secretIds ?? {})).to.have.length(newSecretIds.length)\n      for (const [secretId, updateType] of Object.entries(updateParams.secretIds ?? {})) {\n        expect(updateType).to.equal(EntryUpdateTypeEnum.CREATE)\n        expect(newSecretIds).to.contain(await secureDelegationsEncryption.decryptSecretId(secretId, exchangeDataInfo.exchangeKey))\n      }\n      expect(Object.keys(updateParams.encryptionKeys ?? {})).to.have.length(newEncryptionKeys.length)\n      for (const [encryptionKey, updateType] of Object.entries(updateParams.encryptionKeys ?? {})) {\n        expect(updateType).to.equal(EntryUpdateTypeEnum.CREATE)\n        expect(newEncryptionKeys).to.contain(await secureDelegationsEncryption.decryptEncryptionKey(encryptionKey, exchangeDataInfo.exchangeKey))\n      }\n      expect(Object.keys(updateParams.owningEntityIds ?? {})).to.have.length(newOwningEntityIds.length)\n      for (const [owningEntityId, updateType] of Object.entries(updateParams.owningEntityIds ?? {})) {\n        expect(updateType).to.equal(EntryUpdateTypeEnum.CREATE)\n        expect(newOwningEntityIds).to.contain(await secureDelegationsEncryption.decryptOwningEntityId(owningEntityId, exchangeDataInfo.exchangeKey))\n      }\n    }\n    await doTest(true)\n    await doTest(false)\n  })\n\n  it('should return undefined for existing secure delegations if it contains all entries.', async function () {\n    await initialiseComponents(false, false)\n    const canonicalSfk = primitives.randomUuid()\n    const exchangeDataInfo = await exchangeData.getOrCreateEncryptionDataTo(delegateId, EntityWithDelegationTypeName.Patient, [], false)\n    const canonicalKey = await accessControlSecretUtils.secureDelegationKeyFor(\n      exchangeDataInfo.accessControlSecret,\n      EntityWithDelegationTypeName.Patient,\n      canonicalSfk\n    )\n    const existingSecretIds = [ua2hex(primitives.randomBytes(16))]\n    const existingEncryptionKeys: string[] = []\n    const existingOwningEntityIds = [ua2hex(primitives.randomBytes(16))]\n    const fakeEntity: { entity: EncryptedEntityStub; type: EntityWithDelegationTypeName } = {\n      entity: {\n        secretForeignKeys: [canonicalSfk],\n        securityMetadata: new SecurityMetadata({\n          secureDelegations: {\n            [canonicalKey]: new SecureDelegation({\n              delegator: selfId,\n              delegate: selfId,\n              secretIds: await secureDelegationsEncryption.encryptSecretIds(existingSecretIds, exchangeDataInfo.exchangeKey),\n              encryptionKeys: await secureDelegationsEncryption.encryptEncryptionKeys(existingEncryptionKeys, exchangeDataInfo.exchangeKey),\n              owningEntityIds: await secureDelegationsEncryption.encryptOwningEntityIds(existingOwningEntityIds, exchangeDataInfo.exchangeKey),\n              permissions: SecureDelegation.AccessLevelEnum.WRITE,\n            }),\n          },\n        }),\n      },\n      type: EntityWithDelegationTypeName.Patient,\n    }\n    const shareOrUpdateParams = await manager.makeShareOrUpdateRequestParams(\n      fakeEntity,\n      delegateId,\n      [...existingSecretIds],\n      [...existingEncryptionKeys],\n      [...existingOwningEntityIds],\n      RequestedPermissionEnum.MAX_WRITE\n    )\n    expect(shareOrUpdateParams).to.be.undefined\n  })\n})\n"]}

package/test/icc-x-api/crypto/secure-delegations-metadata-decryptor-test.d.ts

@@ -0,0 +1 @@
+export {};