@icure/api 8.0.8 → 8.0.9

package/icc-x-api/crypto/RSA.js.map

@@ -1 +1 @@
-{"version":3,"file":"RSA.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/RSA.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAA4C;AAS5C,MAAa,QAAQ;IA2BnB,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QA1BvI,iCAAiC;QACjC,qBAAqB;QACrB,sBAAsB;QACtB,cAAS,GAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACrC,mDAAmD;QACnD,oBAAe,GAAQ;YACrB,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACxB,CAAA;QACD,8BAAyB,GAAQ;YAC/B,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,CAAA;QACgB,kCAA6B,GAAG;YAC/C,IAAI,EAAE,SAAS;YACf,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,CAAA;QAKC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,UAAsB;QACpC,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAA;QAE5D,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACG,wBAAwB;;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3G,CAAC;KAAA;IAeD,UAAU,CAAC,OAA2B,EAAE,aAAqB,EAAE,YAAoB;QACjF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACvF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAE1F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAgBD,SAAS,CAAC,SAAoB,EAAE,MAAc;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiD,EAAE,MAAM,EAAE,EAAE;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9E,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAoB,EAAE,SAAqB;QACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,0BAA0B;QACzJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAqB,EAAE,aAAyB;QACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,MAAc,EAAE,OAAiC,EAAE,SAAqB,EAAE,aAAyB;QAC3G,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACtH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,kBAAkB,CAAC,MAAuB,EAAE,OAAiC;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,6BAA6B,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/H,CAAC;IAED,qBAAqB,CAAC,MAAsB,EAAE,OAAiC;QAC7E,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,6BAA6B,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjI,CAAC;IAEO,yBAAyB,CAAC,UAAsB;QACtD,IAAI,UAAU,KAAK,OAAO,EAAE;YAC1B,OAAO,IAAI,CAAC,eAAe,CAAA;SAC5B;aAAM,IAAI,UAAU,KAAK,SAAS,EAAE;YACnC,OAAO,IAAI,CAAC,yBAAyB,CAAA;SACtC;aAAM;YACL,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;SACzD;IACH,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAc,EAAE,OAAiC,EAAE,aAAyB;QAC3F,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CACX,gBAAwB,EACxB,cAAwC,EACxC,eAAuB,EACvB,aAAuC,EACvC,aAAyB;QAEzB,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAuB,EAAE,cAAqB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACrI,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAsB,EAAE,aAAoB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAElI,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACG,oBAAoB,CAAC,OAA2B;;YACpD,IAAI;gBACF,MAAM,IAAI,GAAG,YAAY,CAAA;gBACzB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAA;gBAC3E,MAAM,aAAa,GAAG,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;gBACpG,OAAO,aAAa,KAAK,IAAI,CAAA;aAC9B;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,KAAK,CAAA;aACb;QACH,CAAC;KAAA;IAED;;;;;OAKG;IACG,IAAI,CAAC,UAAqB,EAAE,IAAiB;;YACjD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;KAAA;IAED;;;;;;OAMG;IACG,eAAe,CAAC,SAAoB,EAAE,SAAsB,EAAE,IAAiB;;YACnF,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QACzG,CAAC;KAAA;CACF;AA5OD,4BA4OC;AAEY,QAAA,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA","sourcesContent":["import { ua2utf8, utf8_2ua } from '../utils'\n\n/**\n * Represents an RSA KeyPair in a generic format.\n */\nexport type KeyPair<T> = { publicKey: T; privateKey: T }\n\nexport type ShaVersion = 'sha-1' | 'sha-256'\n\nexport class RSAUtils {\n  /********* RSA Config **********/\n  //TODO bigger modulus\n  //TODO PSS for signing\n  rsaParams: any = { name: 'RSA-OAEP' }\n  // RSA params for 'import' and 'generate' function.\n  rsaHashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'sha-1' },\n  }\n  rsaWithSha256HashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'SHA-256' },\n  }\n  private readonly signatureKeysGenerationParams = {\n    name: 'RSA-PSS',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'SHA-256' },\n  }\n\n  private crypto: Crypto\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this.crypto = crypto\n  }\n\n  /**\n   * Generates a key pair for encryption/decryption of data.\n   * @param shaVersion the version of the SHA algorithm to use.\n   */\n  generateKeyPair(shaVersion: ShaVersion): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n    const rsaParams = this.paramsForCreationOrImport(shaVersion)\n\n    return new Promise<KeyPair<CryptoKey>>((resolve, reject) => {\n      this.crypto.subtle.generateKey(rsaParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   * Generates a key pair for signing data and signature verification.\n   */\n  async generateSignatureKeyPair(): Promise<KeyPair<CryptoKey>> {\n    return await this.crypto.subtle.generateKey(this.signatureKeysGenerationParams, true, ['sign', 'verify'])\n  }\n\n  /**\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param keyPair is {publicKey: CryptoKey, privateKey: CryptoKey}\n   * @param privKeyFormat will be 'pkcs8' or 'jwk'\n   * @param pubKeyFormat will be 'spki' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'jwk', pubKeyFormat: 'jwk'): Promise<KeyPair<JsonWebKey>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'pkcs8', pubKeyFormat: 'spki'): Promise<KeyPair<ArrayBuffer>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: string, pubKeyFormat: string): Promise<KeyPair<JsonWebKey | ArrayBuffer>> {\n    const pubPromise = this.crypto.subtle.exportKey(pubKeyFormat as any, keyPair.publicKey)\n    const privPromise = this.crypto.subtle.exportKey(privKeyFormat as any, keyPair.privateKey)\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   *  Format:\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param cryptoKey public or private\n   * @param format either 'jwk' or 'spki' or 'pkcs8'\n   * @returns {Promise|*} will be RSA key (public or private)\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n  exportKey(cryptoKey: CryptoKey, format: 'spki'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: 'pkcs8'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: string): Promise<JsonWebKey | ArrayBuffer> {\n    return new Promise((resolve: (value: JsonWebKey | ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.exportKey(format as any, cryptoKey).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param publicKey (CryptoKey)\n   * @param plainData (Uint8Array)\n   */\n  encrypt(publicKey: CryptoKey, plainData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.encrypt(this.rsaParams, publicKey, plainData.buffer ? plainData.buffer : plainData).then(resolve, reject) //Node prefers arrayBuffer\n    })\n  }\n\n  /**\n   *\n   * @param privateKey (CryptoKey)\n   * @param encryptedData (Uint8Array)\n   */\n  decrypt(privateKey: CryptoKey, encryptedData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.decrypt(this.rsaParams, privateKey, encryptedData).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk', 'spki', or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param keyUsages Array of usages. For example, ['encrypt'] for public key.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {*}\n   */\n  importKey(format: string, keydata: JsonWebKey | ArrayBuffer, keyUsages: KeyUsage[], hashAlgorithm: ShaVersion): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n      this.crypto.subtle.importKey(format as any, keydata as any, rsaParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  importSignatureKey(format: 'jwk' | 'pkcs8', keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey> {\n    const extractable = true\n    return this.crypto.subtle.importKey(format as any, keydata as any, this.signatureKeysGenerationParams, extractable, ['sign'])\n  }\n\n  importVerificationKey(format: 'jwk' | 'spki', keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey> {\n    const extractable = true\n    return this.crypto.subtle.importKey(format as any, keydata as any, this.signatureKeysGenerationParams, extractable, ['verify'])\n  }\n\n  private paramsForCreationOrImport(shaVersion: ShaVersion) {\n    if (shaVersion === 'sha-1') {\n      return this.rsaHashedParams\n    } else if (shaVersion === 'sha-256') {\n      return this.rsaWithSha256HashedParams\n    } else {\n      throw new Error('Unexpected error, invalid SHA version')\n    }\n  }\n\n  /**\n   *\n   * @param format 'jwk' or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {*}\n   */\n  importPrivateKey(format: string, keydata: JsonWebKey | ArrayBuffer, hashAlgorithm: ShaVersion): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n      this.crypto.subtle.importKey(format as any, keydata as any, rsaParams, extractable, ['decrypt']).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param privateKeyFormat 'jwk' or 'pkcs8'\n   * @param privateKeydata    should be the key data based on the format.\n   * @param publicKeyFormat 'jwk' or 'spki'\n   * @param publicKeyData should be the key data based on the format.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {Promise|*}\n   */\n  importKeyPair(\n    privateKeyFormat: string,\n    privateKeydata: JsonWebKey | ArrayBuffer,\n    publicKeyFormat: string,\n    publicKeyData: JsonWebKey | ArrayBuffer,\n    hashAlgorithm: ShaVersion\n  ): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n    const privPromise = this.crypto.subtle.importKey(privateKeyFormat as any, privateKeydata as any, rsaParams, extractable, ['decrypt'])\n    const pubPromise = this.crypto.subtle.importKey(publicKeyFormat as any, publicKeyData as any, rsaParams, extractable, ['encrypt'])\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   * Tries to encrypt then decrypt data using a keypair. If both operations succeed without throwing an error and the decrypted data matches the\n   * original data returns true, else false.\n   * @param keyPair a key pair.\n   * @return if the key pair could be successfully used to encrypt then decrypt data.\n   */\n  async checkKeyPairValidity(keyPair: KeyPair<CryptoKey>): Promise<boolean> {\n    try {\n      const text = 'shibboleth'\n      const encryptedText = await this.encrypt(keyPair.publicKey, utf8_2ua(text))\n      const decryptedText = ua2utf8(await this.decrypt(keyPair.privateKey, new Uint8Array(encryptedText)))\n      return decryptedText === text\n    } catch (e) {\n      return false\n    }\n  }\n\n  /**\n   * Generates a signature for some data. The signature algorithm used is RSA-PSS with SHA-256.\n   * @param privateKey private key to use for signature\n   * @param data the data to sign\n   * @return the signature.\n   */\n  async sign(privateKey: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer> {\n    return await this.crypto.subtle.sign({ name: 'RSA-PSS', saltLength: 32 }, privateKey, data)\n  }\n\n  /**\n   * Verifies if a signature matches the data. The signature algorithm used is RSA-PSS with sha-256.\n   * @param publicKey public key to use for signature verification.\n   * @param signature the signature to verify\n   * @param data the data that was signed\n   * @return if the signature matches the data and key.\n   */\n  async verifySignature(publicKey: CryptoKey, signature: ArrayBuffer, data: ArrayBuffer): Promise<boolean> {\n    return await this.crypto.subtle.verify({ name: 'RSA-PSS', saltLength: 32 }, publicKey, signature, data)\n  }\n}\n\nexport const RSA = new RSAUtils()\n"]}
+{"version":3,"file":"RSA.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/RSA.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAA4C;AAO5C,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,4BAAc,CAAA;IACd,gCAAkB,CAAA;AACpB,CAAC,EAHW,UAAU,GAAV,kBAAU,KAAV,kBAAU,QAGrB;AAED,MAAa,QAAQ;IA2BnB,YAAY,SAAiB,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAa;QA1BvI,iCAAiC;QACjC,qBAAqB;QACrB,sBAAsB;QACtB,cAAS,GAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QACrC,mDAAmD;QACnD,oBAAe,GAAQ;YACrB,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACxB,CAAA;QACD,8BAAyB,GAAQ;YAC/B,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,CAAA;QACgB,kCAA6B,GAAG;YAC/C,IAAI,EAAE,SAAS;YACf,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,CAAA;QAKC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,UAAsB;QACpC,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAA;QAE5D,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACG,wBAAwB;;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3G,CAAC;KAAA;IAeD,UAAU,CAAC,OAA2B,EAAE,aAAqB,EAAE,YAAoB;QACjF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACvF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAE1F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAgBD,SAAS,CAAC,SAAoB,EAAE,MAAc;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiD,EAAE,MAAM,EAAE,EAAE;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9E,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAoB,EAAE,SAAqB;QACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,0BAA0B;QACzJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAqB,EAAE,aAAyB;QACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAoC,EAAE,MAAM,EAAE,EAAE;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,MAAc,EAAE,OAAiC,EAAE,SAAqB,EAAE,aAAyB;QAC3G,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACtH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,kBAAkB,CAAC,MAAuB,EAAE,OAAiC;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,6BAA6B,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/H,CAAC;IAED,qBAAqB,CAAC,MAAsB,EAAE,OAAiC;QAC7E,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,IAAI,CAAC,6BAA6B,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjI,CAAC;IAEO,yBAAyB,CAAC,UAAsB;QACtD,IAAI,UAAU,KAAK,OAAO,EAAE;YAC1B,OAAO,IAAI,CAAC,eAAe,CAAA;SAC5B;aAAM,IAAI,UAAU,KAAK,SAAS,EAAE;YACnC,OAAO,IAAI,CAAC,yBAAyB,CAAA;SACtC;aAAM;YACL,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;SACzD;IACH,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAc,EAAE,OAAiC,EAAE,aAAyB;QAC3F,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAkC,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAa,EAAE,OAAc,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CACX,gBAAwB,EACxB,cAAwC,EACxC,eAAuB,EACvB,aAAuC,EACvC,aAAyB;QAEzB,MAAM,WAAW,GAAG,IAAI,CAAA;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAuB,EAAE,cAAqB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACrI,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAsB,EAAE,aAAoB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAElI,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,OAAO;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;aACvB,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACG,oBAAoB,CAAC,OAA2B;;YACpD,IAAI;gBACF,MAAM,IAAI,GAAG,YAAY,CAAA;gBACzB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAA;gBAC3E,MAAM,aAAa,GAAG,IAAA,eAAO,EAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;gBACpG,OAAO,aAAa,KAAK,IAAI,CAAA;aAC9B;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,KAAK,CAAA;aACb;QACH,CAAC;KAAA;IAED;;;;;OAKG;IACG,IAAI,CAAC,UAAqB,EAAE,IAAiB;;YACjD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;KAAA;IAED;;;;;;OAMG;IACG,eAAe,CAAC,SAAoB,EAAE,SAAsB,EAAE,IAAiB;;YACnF,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QACzG,CAAC;KAAA;CACF;AA5OD,4BA4OC;AAEY,QAAA,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA","sourcesContent":["import { ua2utf8, utf8_2ua } from '../utils'\n\n/**\n * Represents an RSA KeyPair in a generic format.\n */\nexport type KeyPair<T> = { publicKey: T; privateKey: T }\n\nexport enum ShaVersion {\n  Sha1 = 'sha-1',\n  Sha256 = 'sha-256',\n}\n\nexport class RSAUtils {\n  /********* RSA Config **********/\n  //TODO bigger modulus\n  //TODO PSS for signing\n  rsaParams: any = { name: 'RSA-OAEP' }\n  // RSA params for 'import' and 'generate' function.\n  rsaHashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'sha-1' },\n  }\n  rsaWithSha256HashedParams: any = {\n    name: 'RSA-OAEP',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'SHA-256' },\n  }\n  private readonly signatureKeysGenerationParams = {\n    name: 'RSA-PSS',\n    modulusLength: 2048,\n    publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // Equivalent to 65537 (Fermat F4), read http://en.wikipedia.org/wiki/65537_(number)\n    hash: { name: 'SHA-256' },\n  }\n\n  private crypto: Crypto\n\n  constructor(crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto)) {\n    this.crypto = crypto\n  }\n\n  /**\n   * Generates a key pair for encryption/decryption of data.\n   * @param shaVersion the version of the SHA algorithm to use.\n   */\n  generateKeyPair(shaVersion: ShaVersion): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const keyUsages: KeyUsage[] = ['decrypt', 'encrypt']\n    const rsaParams = this.paramsForCreationOrImport(shaVersion)\n\n    return new Promise<KeyPair<CryptoKey>>((resolve, reject) => {\n      this.crypto.subtle.generateKey(rsaParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  /**\n   * Generates a key pair for signing data and signature verification.\n   */\n  async generateSignatureKeyPair(): Promise<KeyPair<CryptoKey>> {\n    return await this.crypto.subtle.generateKey(this.signatureKeysGenerationParams, true, ['sign', 'verify'])\n  }\n\n  /**\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param keyPair is {publicKey: CryptoKey, privateKey: CryptoKey}\n   * @param privKeyFormat will be 'pkcs8' or 'jwk'\n   * @param pubKeyFormat will be 'spki' or 'jwk'\n   * @returns {Promise} will the AES Key\n   */\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'jwk', pubKeyFormat: 'jwk'): Promise<KeyPair<JsonWebKey>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: 'pkcs8', pubKeyFormat: 'spki'): Promise<KeyPair<ArrayBuffer>>\n  exportKeys(keyPair: KeyPair<CryptoKey>, privKeyFormat: string, pubKeyFormat: string): Promise<KeyPair<JsonWebKey | ArrayBuffer>> {\n    const pubPromise = this.crypto.subtle.exportKey(pubKeyFormat as any, keyPair.publicKey)\n    const privPromise = this.crypto.subtle.exportKey(privKeyFormat as any, keyPair.privateKey)\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   *  Format:\n   *\n   * 'JWK': Json Web key (ref. http://tools.ietf.org/html/draft-ietf-jose-json-web-key-11)\n   * 'spki': for private key\n   * 'pkcs8': for private Key\n   *\n   * @param cryptoKey public or private\n   * @param format either 'jwk' or 'spki' or 'pkcs8'\n   * @returns {Promise|*} will be RSA key (public or private)\n   */\n  exportKey(cryptoKey: CryptoKey, format: 'jwk'): Promise<JsonWebKey>\n  exportKey(cryptoKey: CryptoKey, format: 'spki'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: 'pkcs8'): Promise<ArrayBuffer>\n  exportKey(cryptoKey: CryptoKey, format: string): Promise<JsonWebKey | ArrayBuffer> {\n    return new Promise((resolve: (value: JsonWebKey | ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.exportKey(format as any, cryptoKey).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param publicKey (CryptoKey)\n   * @param plainData (Uint8Array)\n   */\n  encrypt(publicKey: CryptoKey, plainData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.encrypt(this.rsaParams, publicKey, plainData.buffer ? plainData.buffer : plainData).then(resolve, reject) //Node prefers arrayBuffer\n    })\n  }\n\n  /**\n   *\n   * @param privateKey (CryptoKey)\n   * @param encryptedData (Uint8Array)\n   */\n  decrypt(privateKey: CryptoKey, encryptedData: Uint8Array): Promise<ArrayBuffer> {\n    return new Promise((resolve: (value: ArrayBuffer) => any, reject) => {\n      this.crypto.subtle.decrypt(this.rsaParams, privateKey, encryptedData).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param format 'jwk', 'spki', or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param keyUsages Array of usages. For example, ['encrypt'] for public key.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {*}\n   */\n  importKey(format: string, keydata: JsonWebKey | ArrayBuffer, keyUsages: KeyUsage[], hashAlgorithm: ShaVersion): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n      this.crypto.subtle.importKey(format as any, keydata as any, rsaParams, extractable, keyUsages).then(resolve, reject)\n    })\n  }\n\n  importSignatureKey(format: 'jwk' | 'pkcs8', keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey> {\n    const extractable = true\n    return this.crypto.subtle.importKey(format as any, keydata as any, this.signatureKeysGenerationParams, extractable, ['sign'])\n  }\n\n  importVerificationKey(format: 'jwk' | 'spki', keydata: JsonWebKey | ArrayBuffer): Promise<CryptoKey> {\n    const extractable = true\n    return this.crypto.subtle.importKey(format as any, keydata as any, this.signatureKeysGenerationParams, extractable, ['verify'])\n  }\n\n  private paramsForCreationOrImport(shaVersion: ShaVersion) {\n    if (shaVersion === 'sha-1') {\n      return this.rsaHashedParams\n    } else if (shaVersion === 'sha-256') {\n      return this.rsaWithSha256HashedParams\n    } else {\n      throw new Error('Unexpected error, invalid SHA version')\n    }\n  }\n\n  /**\n   *\n   * @param format 'jwk' or 'pkcs8'\n   * @param keydata should be the key data based on the format.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {*}\n   */\n  importPrivateKey(format: string, keydata: JsonWebKey | ArrayBuffer, hashAlgorithm: ShaVersion): Promise<CryptoKey> {\n    const extractable = true\n    return new Promise((resolve: (value: CryptoKey) => any, reject) => {\n      const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n      this.crypto.subtle.importKey(format as any, keydata as any, rsaParams, extractable, ['decrypt']).then(resolve, reject)\n    })\n  }\n\n  /**\n   *\n   * @param privateKeyFormat 'jwk' or 'pkcs8'\n   * @param privateKeydata    should be the key data based on the format.\n   * @param publicKeyFormat 'jwk' or 'spki'\n   * @param publicKeyData should be the key data based on the format.\n   * @param hashAlgorithm 'sha-1' or 'sha-256'\n   * @returns {Promise|*}\n   */\n  importKeyPair(\n    privateKeyFormat: string,\n    privateKeydata: JsonWebKey | ArrayBuffer,\n    publicKeyFormat: string,\n    publicKeyData: JsonWebKey | ArrayBuffer,\n    hashAlgorithm: ShaVersion\n  ): Promise<KeyPair<CryptoKey>> {\n    const extractable = true\n    const rsaParams = this.paramsForCreationOrImport(hashAlgorithm)\n    const privPromise = this.crypto.subtle.importKey(privateKeyFormat as any, privateKeydata as any, rsaParams, extractable, ['decrypt'])\n    const pubPromise = this.crypto.subtle.importKey(publicKeyFormat as any, publicKeyData as any, rsaParams, extractable, ['encrypt'])\n\n    return Promise.all([pubPromise, privPromise]).then(function (results) {\n      return {\n        publicKey: results[0],\n        privateKey: results[1],\n      }\n    })\n  }\n\n  /**\n   * Tries to encrypt then decrypt data using a keypair. If both operations succeed without throwing an error and the decrypted data matches the\n   * original data returns true, else false.\n   * @param keyPair a key pair.\n   * @return if the key pair could be successfully used to encrypt then decrypt data.\n   */\n  async checkKeyPairValidity(keyPair: KeyPair<CryptoKey>): Promise<boolean> {\n    try {\n      const text = 'shibboleth'\n      const encryptedText = await this.encrypt(keyPair.publicKey, utf8_2ua(text))\n      const decryptedText = ua2utf8(await this.decrypt(keyPair.privateKey, new Uint8Array(encryptedText)))\n      return decryptedText === text\n    } catch (e) {\n      return false\n    }\n  }\n\n  /**\n   * Generates a signature for some data. The signature algorithm used is RSA-PSS with SHA-256.\n   * @param privateKey private key to use for signature\n   * @param data the data to sign\n   * @return the signature.\n   */\n  async sign(privateKey: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer> {\n    return await this.crypto.subtle.sign({ name: 'RSA-PSS', saltLength: 32 }, privateKey, data)\n  }\n\n  /**\n   * Verifies if a signature matches the data. The signature algorithm used is RSA-PSS with sha-256.\n   * @param publicKey public key to use for signature verification.\n   * @param signature the signature to verify\n   * @param data the data that was signed\n   * @return if the signature matches the data and key.\n   */\n  async verifySignature(publicKey: CryptoKey, signature: ArrayBuffer, data: ArrayBuffer): Promise<boolean> {\n    return await this.crypto.subtle.verify({ name: 'RSA-PSS', saltLength: 32 }, publicKey, signature, data)\n  }\n}\n\nexport const RSA = new RSAUtils()\n"]}

package/icc-x-api/crypto/SecureDelegationsManager.js

@@ -19,6 +19,7 @@ const EntitySharedMetadataUpdateRequest_1 = require("../../icc-api/model/request
 var EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest_1.EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum;
 var AccessLevelEnum = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
 const SecurityMetadata_1 = require("../../icc-api/model/SecurityMetadata");
+const RSA_1 = require("./RSA");
 class SecureDelegationsManager {
     constructor(exchangeDataManager, exchangeDataMapManager, secureDelegationsEncryption, accessControlSecretUtils, userKeys, primitives, dataOwnerApi, cryptoStrategies, selfNeedsAnonymousDelegations) {
         this.exchangeDataManager = exchangeDataManager;
@@ -198,7 +199,7 @@ class SecureDelegationsManager {
                 const delegateVerifiedKeys = {};
                 for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {
                     const currFp = (0, utils_1.fingerprintV2)(keyHex);
-                    const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? 'sha-1' : 'sha-256';
+                    const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? RSA_1.ShaVersion.Sha1 : RSA_1.ShaVersion.Sha256;
                     if (fingerprintsOfVerifiedExchangeData.has(currFp)) {
                         delegateVerifiedKeys[currFp] = yield this.primitives.RSA.importKey('spki', (0, utils_2.hex2ua)(keyHex), ['encrypt'], shaVersion);
                     }

package/icc-x-api/crypto/SecureDelegationsManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecureDelegationsManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wFAAoF;AAKpF,oFAA6E;AAC7E,mCAA2F;AAK3F,oCAAyC;AAIzC,2EAAuE;AACvE,sHAAkH;AAClH,IAAO,mBAAmB,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;AAClF,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,2EAAuE;AAGvE,MAAa,wBAAwB;IACnC,YACmB,mBAAwC,EACxC,sBAA8C,EAC9C,2BAAwD,EACxD,wBAAkD,EAClD,QAAmC,EACnC,UAA4B,EAC5B,YAA8B,EAC9B,gBAAkC,EAClC,6BAAsC;QARtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,aAAQ,GAAR,QAAQ,CAA2B;QACnC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kCAA6B,GAA7B,6BAA6B,CAAS;QAGxC,uBAAkB,GAO/B,IAAI,oDAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IATvD,CAAC;IAWJ;;;;;;;;;;OAUG;IACG,sCAAsC,CAC1C,MAA2C,EAC3C,UAAwC,EACxC,SAAmB,EACnB,eAAyB,EACzB,cAAwB,EACxB,eAA2E;;YAE3E,MAAM,cAAc,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YAC5E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAC5D,cAAc,EACd,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAC/C,SAAS,EACT,cAAc,EACd,eAAe,EACf,eAAe,CAAC,KAAK,EACrB,SAAS,CACV,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,oBAAoB,GAMpB,EAAE,CAAA;YACR,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBACvE,IAAI,UAAU,KAAK,MAAM,EAAE;oBACzB,oBAAoB,CAAC,IAAI,CACvB,MAAM,IAAI,CAAC,wBAAwB,CACjC,cAAc,EACd,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,CAAC,sBAAsB,CAC1C,CACF,CAAA;iBACF;aACF;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC,CACpI,CAAA;YACD,MAAM,gBAAgB,qBACjB,kBAAkB,CAAC,yBAAyB,CAChD,CAAA;YACD,KAAK,MAAM,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,IAAI,oBAAoB,EAAE;gBACtF,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;aACtD;YACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,oBAAoB;iBACjB,MAAM,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;iBAClE,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,yBAAyB,EAAE,uBAAwB,CAAC,CAAC,CAC1H,CAAA;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAA;YAC7E,uCACK,MAAM,KACT,gBAAgB,EAAE,IAAI,mCAAgB,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,IAChF;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,8BAA8B,CAClC,cAAuC,EACvC,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;;YAExE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC7C,KAAK,CACN,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CAAA;YACD,MAAM,wBAAwB,GAAG,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC5H,IAAI,wBAAwB,EAAE;gBAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACrD,wBAAwB,CAAC,YAAY,EACrC,wBAAwB,CAAC,gBAAgB,EACzC,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;gBACD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;aAC3D;iBAAM;gBACL,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;gBACvB,OAAO;oBACL,KAAK,EAAE,MAAM,IAAI,CAAC,sBAAsB,CACtC,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,CACzB;iBACF,CAAA;aACF;;KACF;IAEa,uBAAuB,CACnC,YAAoB,EACpB,kBAAoC,EACpC,gBAAqG,EACrG,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAE9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC5I,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAC/G,CAAA;YACD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAChH,CAAA;YACD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAChG,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE;gBAChF,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACjI,MAAM,0BAA0B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBAChJ,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAC/F,kBAAkB,EAClB,gBAAgB,CAAC,WAAW,CAC7B,CAAA;gBACD,OAAO,IAAI,qEAAiC,CAAC;oBAC3C,yBAAyB,EAAE,YAAY;oBACvC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClG,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9G,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC/G,CAAC,CAAA;aACH;;gBAAM,OAAO,SAAS,CAAA;QACzB,CAAC;KAAA;IAEa,sBAAsB,CAClC,gBAAqG,EACrG,iBAA2B,EAC3B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;YAExE,OAAO,IAAI,uCAAkB,iCACxB,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,KAC1I,oBAAoB,EAAE,wBAAwB,EAC9C,iBAAiB,IACjB,CAAA;QACJ,CAAC;KAAA;IAEa,wBAAwB,CACpC,MAA+B,EAC/B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,WAA4B,EAC5B,mBAAuC;;;YAQvC,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EACrC,KAAK,CACN,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CAAA;YACD,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;YACvB,MAAM,yBAAyB,GAAG,iBAAiB;iBAChD,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1C,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAE3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpD,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;YACrH,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAC1E,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC;gBACtC,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,iBAAiB;gBACrD,QAAQ,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,gBAAgB;gBACnD,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,SAAS;gBAC7C,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,eAAe,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,eAAe;gBACzD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1E,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAA;YACF,OAAO;gBACL,sBAAsB,EAAE,YAAY;gBACpC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,UAAU;gBACV,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,yBAAyB,EAAE,eAAe;aAC3C,CAAA;;KACF;IAEa,iCAAiC,CAC7C,gBAAqG,EACrG,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAU9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,kBAAkB,GACtB,UAAU,KAAK,MAAM;gBACnB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3E,CAAC,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;YACrG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,cAAc,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAChI,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC/I,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAClJ,uCACK,kBAAkB,KACrB,SAAS,EAAE,kBAAkB,EAC7B,cAAc,EAAE,uBAAuB,EACvC,eAAe,EAAE,wBAAwB,IAC1C;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,MAAc,EACd,UAAkB,EAClB,YAA0B;;YAO1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5D,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACrF,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,gBAAgB,EAAE,UAAU;oBAC5B,cAAc,EAAE,YAAY,CAAC,EAAE;iBAChC,CAAA;aACF;iBAAM,IAAI,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC3F,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CACnF,YAAY,CAAC,EAAG,EAChB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACxH;iBACF,CAAA;aACF;iBAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,IAAI,CAAC,6BAA6B,EAAE;gBAC3F;;mBAEG;gBACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;gBACzF,MAAM,oBAAoB,GAAgC,EAAE,CAAA;gBAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY,CAAC,8BAA8B,EAAE,GAAG,YAAY,CAAC,gCAAgC,CAAC,EAAE;oBACvH,MAAM,MAAM,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAA;oBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;oBACrG,IAAI,kCAAkC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;wBAClD,oBAAoB,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;qBACpH;iBACF;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM;oBAC3C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;gBAC3G,OAAO;oBACL,gBAAgB,EAAE,UAAU;oBAC5B,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAG,EAAE,oBAAoB,CAAC;iBAC9H,CAAA;aACF;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAEO,6BAA6B,CACnC,MAAc,EACd,YAA0B;QAO1B,IAAI,IAAI,CAAC,6BAA6B,EAAE;YACtC,OAAO,EAAE,CAAA;SACV;aAAM;YACL,OAAO;gBACL,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,iBAAiB,EAAE,MAAM;gBACzB,gBAAgB,EAAE,MAAM;aACzB,CAAA;SACF;IACH,CAAC;IAEa,gBAAgB,CAAC,WAAmB;;YAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAS,EAAE;gBACzD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACjF,OAAO;oBACL,IAAI,EAAE;wBACJ,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,iBAAiB,CAAC;wBAC3G,8BAA8B,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,+BAAuB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBAC3F,gCAAgC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,iCAAyB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;qBAChG;iBACF,CAAA;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;IAEO,0CAA0C,CAChD,MAA6C,EAC7C,MAAgB;;QAEhB,MAAM,gBAAgB,GAAG,MAAA,MAAM,CAAC,gBAAgB,mCAAI,EAAE,CAAA;QACtD,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,MAAA,MAAA,gBAAgB,CAAC,gBAAgB,0CAAG,IAAI,CAAC,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAC,CAAC,CAAA;QAC9H,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;;YAC/C,MAAM,iBAAiB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,IAAI,CAAC,CAAA;YACpE,OAAO,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7F,CAAC,CAAC,CAAA;QACF,IACE,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAC3B,uBAAuB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,IAAI,uBAAuB,CAAC,CAAC,CAAC,MAAK,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,CAAC;YAEzI,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;QACrG,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAA;QAC5D,MAAM,yBAAyB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,yBAAyB,CAAC,CAAA;QACjG,OAAO,CACL,MAAA,gBAAgB,CAAC,CAAC,CAAC,mCACnB,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,CAAC,yBAAyB;YACzD,CAAC,CAAC,EAAE,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE;YAC1F,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;IACH,CAAC;CACF;AAjaD,4DAiaC","sourcesContent":["import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { fingerprintV2, hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of } from './utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { hex2ua, ua2hex } from '../utils'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest'\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { EntitySharedMetadataUpdateRequest } from '../../icc-api/model/requests/EntitySharedMetadataUpdateRequest'\nimport EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecurityMetadata } from '../../icc-api/model/SecurityMetadata'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\n\nexport class SecureDelegationsManager {\n  constructor(\n    private readonly exchangeDataManager: ExchangeDataManager,\n    private readonly exchangeDataMapManager: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    private readonly userKeys: UserEncryptionKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly selfNeedsAnonymousDelegations: boolean\n  ) {}\n\n  private readonly dataOwnerInfoCache: LruTemporisedAsyncCache<\n    string,\n    {\n      requiresAnonymousDelegations: boolean\n      availablePublicKeysHexWithSha1: string[]\n      availablePublicKeysHexWithSha256: string[]\n    }\n  > = new LruTemporisedAsyncCache(100, () => 30 * 60 * 1000)\n\n  /**\n   * Note: this method does not save the updated entity.\n   * @param entity an entity, must already have secret foreign keys initialised.\n   * @param entityType the type of the entity\n   * @param secretIds the initial secret ids to include and share with the auto-delegations\n   * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations\n   * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations\n   * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level\n   * they will have on the entity.\n   * @return the entity with the security metadata initialised for the provided parameters.\n   */\n  async entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T & { secretForeignKeys: string[] },\n    entityType: EntityWithDelegationTypeName,\n    secretIds: string[],\n    owningEntityIds: string[],\n    encryptionKeys: string[],\n    autoDelegations: { [delegateId: string]: SecureDelegation.AccessLevelEnum }\n  ): Promise<T> {\n    const entityWithType: EncryptedEntityWithType = { entity, type: entityType }\n    const rootDelegationInfo = await this.makeSecureDelegationInfo(\n      entityWithType,\n      await this.dataOwnerApi.getCurrentDataOwnerId(),\n      secretIds,\n      encryptionKeys,\n      owningEntityIds,\n      AccessLevelEnum.WRITE,\n      undefined\n    )\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const otherDelegationsInfo: {\n      canonicalDelegationKey: string\n      canonicalAccessControlKey: string\n      delegation: SecureDelegation\n      delegationKeyEquivalences: { [p: string]: string }\n      encryptedExchangeDataId: { [fp: string]: string } | undefined\n    }[] = []\n    for (const [delegateId, permissions] of Object.entries(autoDelegations)) {\n      if (delegateId !== selfId) {\n        otherDelegationsInfo.push(\n          await this.makeSecureDelegationInfo(\n            entityWithType,\n            delegateId,\n            secretIds,\n            encryptionKeys,\n            owningEntityIds,\n            permissions,\n            rootDelegationInfo.canonicalDelegationKey\n          )\n        )\n      }\n    }\n    const secureDelegations = Object.fromEntries(\n      [rootDelegationInfo, ...otherDelegationsInfo].map(({ canonicalDelegationKey, delegation }) => [canonicalDelegationKey, delegation])\n    )\n    const keysEquivalences = {\n      ...rootDelegationInfo.delegationKeyEquivalences,\n    }\n    for (const { delegationKeyEquivalences: otherKeyEquivalences } of otherDelegationsInfo) {\n      Object.assign(keysEquivalences, otherKeyEquivalences)\n    }\n    const newExchangeDataMaps = Object.fromEntries(\n      otherDelegationsInfo\n        .filter(({ encryptedExchangeDataId }) => !!encryptedExchangeDataId)\n        .map(({ canonicalAccessControlKey, encryptedExchangeDataId }) => [canonicalAccessControlKey, encryptedExchangeDataId!])\n    )\n    await this.exchangeDataMapManager.createExchangeDataMaps(newExchangeDataMaps)\n    return {\n      ...entity,\n      securityMetadata: new SecurityMetadata({ secureDelegations, keysEquivalences }),\n    }\n  }\n\n  /**\n   * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or\n   * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation\n   * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to\n   * share the provided data.\n   * @param entityWithType an entity with type\n   * @param delegateId the id of the delegate\n   * @param shareSecretIds the secret ids to share\n   * @param shareEncryptionKeys the encryption keys to share\n   * @param shareOwningEntityIds the owning entity ids to share\n   * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an\n   * update request instead of a share request, this parameter is ignored.\n   * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update\n   * the entity to allow the delegate to access the provided data.\n   */\n  async makeShareOrUpdateRequestParams(\n    entityWithType: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareOrMetadataUpdateRequest | undefined> {\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? [],\n      false\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? []\n    )\n    const existingSecureDelegation = this.getExistingCanonicalKeyAndSecureDelegation(entityWithType.entity, accessControlHashes)\n    if (existingSecureDelegation) {\n      const updateParams = await this.makeUpdateRequestParams(\n        existingSecureDelegation.canonicalKey,\n        existingSecureDelegation.secureDelegation,\n        exchangeDataInfo,\n        shareSecretIds,\n        shareEncryptionKeys,\n        shareOwningEntityIds\n      )\n      return updateParams ? { update: updateParams } : undefined\n    } else {\n      const accessControlKeys = (\n        await this.accessControlSecretUtils.accessControlKeysFor(\n          exchangeDataInfo.accessControlSecret,\n          entityWithType.type,\n          entityWithType.entity.secretForeignKeys ?? []\n        )\n      ).map((x) => ua2hex(x))\n      return {\n        share: await this.makeShareRequestParams(\n          exchangeDataInfo,\n          accessControlKeys,\n          delegateId,\n          shareSecretIds,\n          shareEncryptionKeys,\n          shareOwningEntityIds,\n          newDelegationPermissions\n        ),\n      }\n    }\n  }\n\n  private async makeUpdateRequestParams(\n    canonicalKey: string,\n    existingDelegation: SecureDelegation,\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<EntitySharedMetadataUpdateRequest | undefined> {\n    const existingSecretIds = new Set(await this.secureDelegationsEncryption.decryptSecretIds(existingDelegation, exchangeDataInfo.exchangeKey))\n    const existingEncryptionKeys = new Set(\n      await this.secureDelegationsEncryption.decryptEncryptionKeys(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const existingOwningEntityIds = new Set(\n      await this.secureDelegationsEncryption.decryptOwningEntityIds(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const newSecretIds = shareSecretIds.filter((id) => !existingSecretIds.has(id))\n    const newEncryptionKeys = shareEncryptionKeys.filter((key) => !existingEncryptionKeys.has(key))\n    const newOwningEntityIds = shareOwningEntityIds.filter((id) => !existingOwningEntityIds.has(id))\n    if (newSecretIds.length || newEncryptionKeys.length || newOwningEntityIds.length) {\n      const encryptedNewSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(newSecretIds, exchangeDataInfo.exchangeKey)\n      const encryptedNewEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(newEncryptionKeys, exchangeDataInfo.exchangeKey)\n      const encryptedNewOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(\n        newOwningEntityIds,\n        exchangeDataInfo.exchangeKey\n      )\n      return new EntitySharedMetadataUpdateRequest({\n        metadataAccessControlHash: canonicalKey,\n        secretIds: Object.fromEntries(encryptedNewSecretIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n        encryptionKeys: Object.fromEntries(encryptedNewEncryptionKeys.map((key) => [key, EntryUpdateTypeEnum.CREATE])),\n        owningEntityIds: Object.fromEntries(encryptedNewOwningEntityIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n      })\n    } else return undefined\n  }\n\n  private async makeShareRequestParams(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    accessControlKeys: string[],\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareRequest> {\n    return new EntityShareRequest({\n      ...(await this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds)),\n      requestedPermissions: newDelegationPermissions,\n      accessControlKeys,\n    })\n  }\n\n  private async makeSecureDelegationInfo(\n    entity: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    permissions: AccessLevelEnum,\n    parentDelegationKey: string | undefined\n  ): Promise<{\n    canonicalDelegationKey: string\n    canonicalAccessControlKey: string\n    delegation: SecureDelegation\n    encryptedExchangeDataId: { [fp: string]: string } | undefined\n    delegationKeyEquivalences: { [alias: string]: string }\n  }> {\n    // Be wary of explicit delegator and explicit delegate\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entity.type,\n      entity.entity.secretForeignKeys ?? [],\n      false\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entity.type,\n      entity.entity.secretForeignKeys ?? []\n    )\n    const accessControlKeys = (\n      await this.accessControlSecretUtils.accessControlKeysFor(\n        exchangeDataInfo.accessControlSecret,\n        entity.type,\n        entity.entity.secretForeignKeys ?? []\n      )\n    ).map((x) => ua2hex(x))\n    const accessControlKeysToHashes = accessControlKeys\n      .map((key, index) => {\n        return [key, accessControlHashes[index]]\n      })\n      .sort((a, b) => a[1].localeCompare(b[1]))\n\n    const canonicalKey = accessControlKeysToHashes[0][1]\n    const keyEquivalences = Object.fromEntries(accessControlKeysToHashes.slice(1).map((hash) => [hash[1], canonicalKey]))\n    const encryptedDelegationInfo = await this.makeSecureDelegationEncryptedData(\n      exchangeDataInfo,\n      delegateId,\n      shareSecretIds,\n      shareEncryptionKeys,\n      shareOwningEntityIds\n    )\n    const delegation = new SecureDelegation({\n      delegator: encryptedDelegationInfo?.explicitDelegator,\n      delegate: encryptedDelegationInfo?.explicitDelegate,\n      secretIds: encryptedDelegationInfo?.secretIds,\n      encryptionKeys: encryptedDelegationInfo?.encryptionKeys,\n      owningEntityIds: encryptedDelegationInfo?.owningEntityIds,\n      parentDelegations: parentDelegationKey ? [parentDelegationKey] : undefined,\n      exchangeDataId: encryptedDelegationInfo?.exchangeDataId,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      permissions: permissions,\n    })\n    return {\n      canonicalDelegationKey: canonicalKey,\n      canonicalAccessControlKey: accessControlKeysToHashes[0][0],\n      delegation,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      delegationKeyEquivalences: keyEquivalences,\n    }\n  }\n\n  private async makeSecureDelegationEncryptedData(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<{\n    explicitDelegator?: string\n    explicitDelegate?: string\n    secretIds?: string[]\n    encryptionKeys?: string[]\n    owningEntityIds?: string[]\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string } // TODO if secure delegation info, check cache before calculating\n  }> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const exchangeDataIdInfo =\n      delegateId === selfId\n        ? this.makeExchangeDataIdInfoForSelf(selfId, exchangeDataInfo.exchangeData)\n        : await this.makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeDataInfo.exchangeData)\n    const encryptedSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(shareSecretIds, exchangeDataInfo.exchangeKey)\n    const encryptedEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(shareEncryptionKeys, exchangeDataInfo.exchangeKey)\n    const encryptedOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(shareOwningEntityIds, exchangeDataInfo.exchangeKey)\n    return {\n      ...exchangeDataIdInfo,\n      secretIds: encryptedSecretIds,\n      encryptionKeys: encryptedEncryptionKeys,\n      owningEntityIds: encryptedOwningEntityIds,\n    }\n  }\n\n  private async makeExchangeDataIdInfoForDelegate(\n    selfId: string,\n    delegateId: string,\n    exchangeData: ExchangeData\n  ): Promise<{\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  }> {\n    const delegateInfo = await this.getDataOwnerInfo(delegateId)\n    if (!delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        explicitDelegate: delegateId,\n        exchangeDataId: exchangeData.id,\n      }\n    } else if (delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(\n          exchangeData.id!,\n          Object.fromEntries(this.userKeys.getSelfVerifiedKeys().map((keyInfo) => [keyInfo.fingerprint, keyInfo.pair.publicKey]))\n        ),\n      }\n    } else if (!delegateInfo.requiresAnonymousDelegations && this.selfNeedsAnonymousDelegations) {\n      /**\n       * Important: this requires that the exchange data signature also validates the authenticity of the public keys included in there.\n       */\n      const fingerprintsOfVerifiedExchangeData = new Set(Object.keys(exchangeData.exchangeKey))\n      const delegateVerifiedKeys: { [fp: string]: CryptoKey } = {}\n      for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {\n        const currFp = fingerprintV2(keyHex)\n        const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? 'sha-1' : 'sha-256'\n        if (fingerprintsOfVerifiedExchangeData.has(currFp)) {\n          delegateVerifiedKeys[currFp] = await this.primitives.RSA.importKey('spki', hex2ua(keyHex), ['encrypt'], shaVersion)\n        }\n      }\n      if (!Object.keys(delegateVerifiedKeys).length)\n        throw new Error('Illegal state: could not find any verified key for delegate in verified exchange data.')\n      return {\n        explicitDelegate: delegateId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id!, delegateVerifiedKeys),\n      }\n    } else return {}\n  }\n\n  private makeExchangeDataIdInfoForSelf(\n    selfId: string,\n    exchangeData: ExchangeData\n  ): {\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  } {\n    if (this.selfNeedsAnonymousDelegations) {\n      return {}\n    } else {\n      return {\n        exchangeDataId: exchangeData.id,\n        explicitDelegator: selfId,\n        explicitDelegate: selfId,\n      }\n    }\n  }\n\n  private async getDataOwnerInfo(dataOwnerId: string) {\n    return this.dataOwnerInfoCache.get(dataOwnerId, async () => {\n      const dataOwnerWithType = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n      return {\n        item: {\n          requiresAnonymousDelegations: this.cryptoStrategies.dataOwnerRequiresAnonymousDelegation(dataOwnerWithType),\n          availablePublicKeysHexWithSha1: Array.from(hexPublicKeysWithSha1Of(dataOwnerWithType.stub)),\n          availablePublicKeysHexWithSha256: Array.from(hexPublicKeysWithSha256Of(dataOwnerWithType.stub)),\n        },\n      }\n    })\n  }\n\n  private getExistingCanonicalKeyAndSecureDelegation(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    hashes: string[]\n  ): { canonicalKey: string; secureDelegation: SecureDelegation } | undefined {\n    const securityMetadata = entity.securityMetadata ?? {}\n    const canonicalByEquivalences = Array.from(new Set(hashes.flatMap((hash) => securityMetadata.keysEquivalences?.[hash] ?? [])))\n    const directRetrievals = hashes.flatMap((hash) => {\n      const retrievedMetadata = securityMetadata.secureDelegations?.[hash]\n      return retrievedMetadata ? { canonicalKey: hash, secureDelegation: retrievedMetadata } : []\n    })\n    if (\n      directRetrievals.length > 1 ||\n      canonicalByEquivalences.length > 1 ||\n      (!!canonicalByEquivalences[0] && !!directRetrievals[0]?.canonicalKey && canonicalByEquivalences[0] !== directRetrievals[0]?.canonicalKey)\n    )\n      throw new Error('Illegal state: multiple secure delegations matching equivalent hashes of entity.')\n    const canonicalFromEquivalences = canonicalByEquivalences[0]\n    const retrievedFromEquivalences = securityMetadata.secureDelegations?.[canonicalFromEquivalences]\n    return (\n      directRetrievals[0] ??\n      (!!canonicalFromEquivalences && !!retrievedFromEquivalences\n        ? { canonicalKey: canonicalFromEquivalences, secureDelegation: retrievedFromEquivalences }\n        : undefined)\n    )\n  }\n}\n"]}
+{"version":3,"file":"SecureDelegationsManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wFAAoF;AAKpF,oFAA6E;AAC7E,mCAA2F;AAK3F,oCAAyC;AAIzC,2EAAuE;AACvE,sHAAkH;AAClH,IAAO,mBAAmB,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;AAClF,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,2EAAuE;AAEvE,+BAAkC;AAElC,MAAa,wBAAwB;IACnC,YACmB,mBAAwC,EACxC,sBAA8C,EAC9C,2BAAwD,EACxD,wBAAkD,EAClD,QAAmC,EACnC,UAA4B,EAC5B,YAA8B,EAC9B,gBAAkC,EAClC,6BAAsC;QARtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,aAAQ,GAAR,QAAQ,CAA2B;QACnC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kCAA6B,GAA7B,6BAA6B,CAAS;QAGxC,uBAAkB,GAO/B,IAAI,oDAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IATvD,CAAC;IAWJ;;;;;;;;;;OAUG;IACG,sCAAsC,CAC1C,MAA2C,EAC3C,UAAwC,EACxC,SAAmB,EACnB,eAAyB,EACzB,cAAwB,EACxB,eAA2E;;YAE3E,MAAM,cAAc,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YAC5E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAC5D,cAAc,EACd,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAC/C,SAAS,EACT,cAAc,EACd,eAAe,EACf,eAAe,CAAC,KAAK,EACrB,SAAS,CACV,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,oBAAoB,GAMpB,EAAE,CAAA;YACR,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBACvE,IAAI,UAAU,KAAK,MAAM,EAAE;oBACzB,oBAAoB,CAAC,IAAI,CACvB,MAAM,IAAI,CAAC,wBAAwB,CACjC,cAAc,EACd,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,CAAC,sBAAsB,CAC1C,CACF,CAAA;iBACF;aACF;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC,CACpI,CAAA;YACD,MAAM,gBAAgB,qBACjB,kBAAkB,CAAC,yBAAyB,CAChD,CAAA;YACD,KAAK,MAAM,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,IAAI,oBAAoB,EAAE;gBACtF,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;aACtD;YACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,oBAAoB;iBACjB,MAAM,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;iBAClE,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,yBAAyB,EAAE,uBAAwB,CAAC,CAAC,CAC1H,CAAA;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAA;YAC7E,uCACK,MAAM,KACT,gBAAgB,EAAE,IAAI,mCAAgB,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,IAChF;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,8BAA8B,CAClC,cAAuC,EACvC,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;;YAExE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EAC7C,KAAK,CACN,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CAAA;YACD,MAAM,wBAAwB,GAAG,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC5H,IAAI,wBAAwB,EAAE;gBAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACrD,wBAAwB,CAAC,YAAY,EACrC,wBAAwB,CAAC,gBAAgB,EACzC,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;gBACD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;aAC3D;iBAAM;gBACL,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,cAAc,CAAC,IAAI,EACnB,MAAA,cAAc,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAC9C,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;gBACvB,OAAO;oBACL,KAAK,EAAE,MAAM,IAAI,CAAC,sBAAsB,CACtC,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,CACzB;iBACF,CAAA;aACF;;KACF;IAEa,uBAAuB,CACnC,YAAoB,EACpB,kBAAoC,EACpC,gBAAqG,EACrG,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAE9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC5I,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAC/G,CAAA;YACD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAChH,CAAA;YACD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAChG,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE;gBAChF,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACjI,MAAM,0BAA0B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBAChJ,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAC/F,kBAAkB,EAClB,gBAAgB,CAAC,WAAW,CAC7B,CAAA;gBACD,OAAO,IAAI,qEAAiC,CAAC;oBAC3C,yBAAyB,EAAE,YAAY;oBACvC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClG,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9G,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC/G,CAAC,CAAA;aACH;;gBAAM,OAAO,SAAS,CAAA;QACzB,CAAC;KAAA;IAEa,sBAAsB,CAClC,gBAAqG,EACrG,iBAA2B,EAC3B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;YAExE,OAAO,IAAI,uCAAkB,iCACxB,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,KAC1I,oBAAoB,EAAE,wBAAwB,EAC9C,iBAAiB,IACjB,CAAA;QACJ,CAAC;KAAA;IAEa,wBAAwB,CACpC,MAA+B,EAC/B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,WAA4B,EAC5B,mBAAuC;;;YAQvC,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CACjF,UAAU,EACV,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,EACrC,KAAK,CACN,CAAA;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACrF,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CAAA;YACD,MAAM,iBAAiB,GAAG,CACxB,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,MAAM,CAAC,IAAI,EACX,MAAA,MAAM,CAAC,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CACtC,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,CAAA;YACvB,MAAM,yBAAyB,GAAG,iBAAiB;iBAChD,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1C,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAE3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpD,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;YACrH,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAC1E,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC;gBACtC,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,iBAAiB;gBACrD,QAAQ,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,gBAAgB;gBACnD,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,SAAS;gBAC7C,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,eAAe,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,eAAe;gBACzD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1E,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAA;YACF,OAAO;gBACL,sBAAsB,EAAE,YAAY;gBACpC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,UAAU;gBACV,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,yBAAyB,EAAE,eAAe;aAC3C,CAAA;;KACF;IAEa,iCAAiC,CAC7C,gBAAqG,EACrG,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAU9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,kBAAkB,GACtB,UAAU,KAAK,MAAM;gBACnB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3E,CAAC,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;YACrG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,cAAc,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAChI,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC/I,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAClJ,uCACK,kBAAkB,KACrB,SAAS,EAAE,kBAAkB,EAC7B,cAAc,EAAE,uBAAuB,EACvC,eAAe,EAAE,wBAAwB,IAC1C;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,MAAc,EACd,UAAkB,EAClB,YAA0B;;YAO1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5D,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACrF,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,gBAAgB,EAAE,UAAU;oBAC5B,cAAc,EAAE,YAAY,CAAC,EAAE;iBAChC,CAAA;aACF;iBAAM,IAAI,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC3F,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CACnF,YAAY,CAAC,EAAG,EAChB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACxH;iBACF,CAAA;aACF;iBAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,IAAI,CAAC,6BAA6B,EAAE;gBAC3F;;mBAEG;gBACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;gBACzF,MAAM,oBAAoB,GAAgC,EAAE,CAAA;gBAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY,CAAC,8BAA8B,EAAE,GAAG,YAAY,CAAC,gCAAgC,CAAC,EAAE;oBACvH,MAAM,MAAM,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAA;oBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAU,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAU,CAAC,MAAM,CAAA;oBACrH,IAAI,kCAAkC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;wBAClD,oBAAoB,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;qBACpH;iBACF;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM;oBAC3C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;gBAC3G,OAAO;oBACL,gBAAgB,EAAE,UAAU;oBAC5B,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAG,EAAE,oBAAoB,CAAC;iBAC9H,CAAA;aACF;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAEO,6BAA6B,CACnC,MAAc,EACd,YAA0B;QAO1B,IAAI,IAAI,CAAC,6BAA6B,EAAE;YACtC,OAAO,EAAE,CAAA;SACV;aAAM;YACL,OAAO;gBACL,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,iBAAiB,EAAE,MAAM;gBACzB,gBAAgB,EAAE,MAAM;aACzB,CAAA;SACF;IACH,CAAC;IAEa,gBAAgB,CAAC,WAAmB;;YAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAS,EAAE;gBACzD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACjF,OAAO;oBACL,IAAI,EAAE;wBACJ,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,iBAAiB,CAAC;wBAC3G,8BAA8B,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,+BAAuB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBAC3F,gCAAgC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,iCAAyB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;qBAChG;iBACF,CAAA;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;IAEO,0CAA0C,CAChD,MAA6C,EAC7C,MAAgB;;QAEhB,MAAM,gBAAgB,GAAG,MAAA,MAAM,CAAC,gBAAgB,mCAAI,EAAE,CAAA;QACtD,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,MAAA,MAAA,gBAAgB,CAAC,gBAAgB,0CAAG,IAAI,CAAC,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAC,CAAC,CAAA;QAC9H,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;;YAC/C,MAAM,iBAAiB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,IAAI,CAAC,CAAA;YACpE,OAAO,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7F,CAAC,CAAC,CAAA;QACF,IACE,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAC3B,uBAAuB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,IAAI,uBAAuB,CAAC,CAAC,CAAC,MAAK,MAAA,gBAAgB,CAAC,CAAC,CAAC,0CAAE,YAAY,CAAA,CAAC;YAEzI,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;QACrG,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAA;QAC5D,MAAM,yBAAyB,GAAG,MAAA,gBAAgB,CAAC,iBAAiB,0CAAG,yBAAyB,CAAC,CAAA;QACjG,OAAO,CACL,MAAA,gBAAgB,CAAC,CAAC,CAAC,mCACnB,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,CAAC,yBAAyB;YACzD,CAAC,CAAC,EAAE,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE;YAC1F,CAAC,CAAC,SAAS,CAAC,CACf,CAAA;IACH,CAAC;CACF;AAjaD,4DAiaC","sourcesContent":["import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { fingerprintV2, hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of } from './utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { hex2ua, ua2hex } from '../utils'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest'\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { EntitySharedMetadataUpdateRequest } from '../../icc-api/model/requests/EntitySharedMetadataUpdateRequest'\nimport EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecurityMetadata } from '../../icc-api/model/SecurityMetadata'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\nimport { ShaVersion } from './RSA'\n\nexport class SecureDelegationsManager {\n  constructor(\n    private readonly exchangeDataManager: ExchangeDataManager,\n    private readonly exchangeDataMapManager: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    private readonly userKeys: UserEncryptionKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly selfNeedsAnonymousDelegations: boolean\n  ) {}\n\n  private readonly dataOwnerInfoCache: LruTemporisedAsyncCache<\n    string,\n    {\n      requiresAnonymousDelegations: boolean\n      availablePublicKeysHexWithSha1: string[]\n      availablePublicKeysHexWithSha256: string[]\n    }\n  > = new LruTemporisedAsyncCache(100, () => 30 * 60 * 1000)\n\n  /**\n   * Note: this method does not save the updated entity.\n   * @param entity an entity, must already have secret foreign keys initialised.\n   * @param entityType the type of the entity\n   * @param secretIds the initial secret ids to include and share with the auto-delegations\n   * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations\n   * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations\n   * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level\n   * they will have on the entity.\n   * @return the entity with the security metadata initialised for the provided parameters.\n   */\n  async entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T & { secretForeignKeys: string[] },\n    entityType: EntityWithDelegationTypeName,\n    secretIds: string[],\n    owningEntityIds: string[],\n    encryptionKeys: string[],\n    autoDelegations: { [delegateId: string]: SecureDelegation.AccessLevelEnum }\n  ): Promise<T> {\n    const entityWithType: EncryptedEntityWithType = { entity, type: entityType }\n    const rootDelegationInfo = await this.makeSecureDelegationInfo(\n      entityWithType,\n      await this.dataOwnerApi.getCurrentDataOwnerId(),\n      secretIds,\n      encryptionKeys,\n      owningEntityIds,\n      AccessLevelEnum.WRITE,\n      undefined\n    )\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const otherDelegationsInfo: {\n      canonicalDelegationKey: string\n      canonicalAccessControlKey: string\n      delegation: SecureDelegation\n      delegationKeyEquivalences: { [p: string]: string }\n      encryptedExchangeDataId: { [fp: string]: string } | undefined\n    }[] = []\n    for (const [delegateId, permissions] of Object.entries(autoDelegations)) {\n      if (delegateId !== selfId) {\n        otherDelegationsInfo.push(\n          await this.makeSecureDelegationInfo(\n            entityWithType,\n            delegateId,\n            secretIds,\n            encryptionKeys,\n            owningEntityIds,\n            permissions,\n            rootDelegationInfo.canonicalDelegationKey\n          )\n        )\n      }\n    }\n    const secureDelegations = Object.fromEntries(\n      [rootDelegationInfo, ...otherDelegationsInfo].map(({ canonicalDelegationKey, delegation }) => [canonicalDelegationKey, delegation])\n    )\n    const keysEquivalences = {\n      ...rootDelegationInfo.delegationKeyEquivalences,\n    }\n    for (const { delegationKeyEquivalences: otherKeyEquivalences } of otherDelegationsInfo) {\n      Object.assign(keysEquivalences, otherKeyEquivalences)\n    }\n    const newExchangeDataMaps = Object.fromEntries(\n      otherDelegationsInfo\n        .filter(({ encryptedExchangeDataId }) => !!encryptedExchangeDataId)\n        .map(({ canonicalAccessControlKey, encryptedExchangeDataId }) => [canonicalAccessControlKey, encryptedExchangeDataId!])\n    )\n    await this.exchangeDataMapManager.createExchangeDataMaps(newExchangeDataMaps)\n    return {\n      ...entity,\n      securityMetadata: new SecurityMetadata({ secureDelegations, keysEquivalences }),\n    }\n  }\n\n  /**\n   * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or\n   * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation\n   * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to\n   * share the provided data.\n   * @param entityWithType an entity with type\n   * @param delegateId the id of the delegate\n   * @param shareSecretIds the secret ids to share\n   * @param shareEncryptionKeys the encryption keys to share\n   * @param shareOwningEntityIds the owning entity ids to share\n   * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an\n   * update request instead of a share request, this parameter is ignored.\n   * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update\n   * the entity to allow the delegate to access the provided data.\n   */\n  async makeShareOrUpdateRequestParams(\n    entityWithType: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareOrMetadataUpdateRequest | undefined> {\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? [],\n      false\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entityWithType.type,\n      entityWithType.entity.secretForeignKeys ?? []\n    )\n    const existingSecureDelegation = this.getExistingCanonicalKeyAndSecureDelegation(entityWithType.entity, accessControlHashes)\n    if (existingSecureDelegation) {\n      const updateParams = await this.makeUpdateRequestParams(\n        existingSecureDelegation.canonicalKey,\n        existingSecureDelegation.secureDelegation,\n        exchangeDataInfo,\n        shareSecretIds,\n        shareEncryptionKeys,\n        shareOwningEntityIds\n      )\n      return updateParams ? { update: updateParams } : undefined\n    } else {\n      const accessControlKeys = (\n        await this.accessControlSecretUtils.accessControlKeysFor(\n          exchangeDataInfo.accessControlSecret,\n          entityWithType.type,\n          entityWithType.entity.secretForeignKeys ?? []\n        )\n      ).map((x) => ua2hex(x))\n      return {\n        share: await this.makeShareRequestParams(\n          exchangeDataInfo,\n          accessControlKeys,\n          delegateId,\n          shareSecretIds,\n          shareEncryptionKeys,\n          shareOwningEntityIds,\n          newDelegationPermissions\n        ),\n      }\n    }\n  }\n\n  private async makeUpdateRequestParams(\n    canonicalKey: string,\n    existingDelegation: SecureDelegation,\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<EntitySharedMetadataUpdateRequest | undefined> {\n    const existingSecretIds = new Set(await this.secureDelegationsEncryption.decryptSecretIds(existingDelegation, exchangeDataInfo.exchangeKey))\n    const existingEncryptionKeys = new Set(\n      await this.secureDelegationsEncryption.decryptEncryptionKeys(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const existingOwningEntityIds = new Set(\n      await this.secureDelegationsEncryption.decryptOwningEntityIds(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const newSecretIds = shareSecretIds.filter((id) => !existingSecretIds.has(id))\n    const newEncryptionKeys = shareEncryptionKeys.filter((key) => !existingEncryptionKeys.has(key))\n    const newOwningEntityIds = shareOwningEntityIds.filter((id) => !existingOwningEntityIds.has(id))\n    if (newSecretIds.length || newEncryptionKeys.length || newOwningEntityIds.length) {\n      const encryptedNewSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(newSecretIds, exchangeDataInfo.exchangeKey)\n      const encryptedNewEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(newEncryptionKeys, exchangeDataInfo.exchangeKey)\n      const encryptedNewOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(\n        newOwningEntityIds,\n        exchangeDataInfo.exchangeKey\n      )\n      return new EntitySharedMetadataUpdateRequest({\n        metadataAccessControlHash: canonicalKey,\n        secretIds: Object.fromEntries(encryptedNewSecretIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n        encryptionKeys: Object.fromEntries(encryptedNewEncryptionKeys.map((key) => [key, EntryUpdateTypeEnum.CREATE])),\n        owningEntityIds: Object.fromEntries(encryptedNewOwningEntityIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n      })\n    } else return undefined\n  }\n\n  private async makeShareRequestParams(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    accessControlKeys: string[],\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareRequest> {\n    return new EntityShareRequest({\n      ...(await this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds)),\n      requestedPermissions: newDelegationPermissions,\n      accessControlKeys,\n    })\n  }\n\n  private async makeSecureDelegationInfo(\n    entity: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    permissions: AccessLevelEnum,\n    parentDelegationKey: string | undefined\n  ): Promise<{\n    canonicalDelegationKey: string\n    canonicalAccessControlKey: string\n    delegation: SecureDelegation\n    encryptedExchangeDataId: { [fp: string]: string } | undefined\n    delegationKeyEquivalences: { [alias: string]: string }\n  }> {\n    // Be wary of explicit delegator and explicit delegate\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(\n      delegateId,\n      entity.type,\n      entity.entity.secretForeignKeys ?? [],\n      false\n    )\n    const accessControlHashes = await this.accessControlSecretUtils.secureDelegationKeysFor(\n      exchangeDataInfo.accessControlSecret,\n      entity.type,\n      entity.entity.secretForeignKeys ?? []\n    )\n    const accessControlKeys = (\n      await this.accessControlSecretUtils.accessControlKeysFor(\n        exchangeDataInfo.accessControlSecret,\n        entity.type,\n        entity.entity.secretForeignKeys ?? []\n      )\n    ).map((x) => ua2hex(x))\n    const accessControlKeysToHashes = accessControlKeys\n      .map((key, index) => {\n        return [key, accessControlHashes[index]]\n      })\n      .sort((a, b) => a[1].localeCompare(b[1]))\n\n    const canonicalKey = accessControlKeysToHashes[0][1]\n    const keyEquivalences = Object.fromEntries(accessControlKeysToHashes.slice(1).map((hash) => [hash[1], canonicalKey]))\n    const encryptedDelegationInfo = await this.makeSecureDelegationEncryptedData(\n      exchangeDataInfo,\n      delegateId,\n      shareSecretIds,\n      shareEncryptionKeys,\n      shareOwningEntityIds\n    )\n    const delegation = new SecureDelegation({\n      delegator: encryptedDelegationInfo?.explicitDelegator,\n      delegate: encryptedDelegationInfo?.explicitDelegate,\n      secretIds: encryptedDelegationInfo?.secretIds,\n      encryptionKeys: encryptedDelegationInfo?.encryptionKeys,\n      owningEntityIds: encryptedDelegationInfo?.owningEntityIds,\n      parentDelegations: parentDelegationKey ? [parentDelegationKey] : undefined,\n      exchangeDataId: encryptedDelegationInfo?.exchangeDataId,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      permissions: permissions,\n    })\n    return {\n      canonicalDelegationKey: canonicalKey,\n      canonicalAccessControlKey: accessControlKeysToHashes[0][0],\n      delegation,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      delegationKeyEquivalences: keyEquivalences,\n    }\n  }\n\n  private async makeSecureDelegationEncryptedData(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<{\n    explicitDelegator?: string\n    explicitDelegate?: string\n    secretIds?: string[]\n    encryptionKeys?: string[]\n    owningEntityIds?: string[]\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string } // TODO if secure delegation info, check cache before calculating\n  }> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const exchangeDataIdInfo =\n      delegateId === selfId\n        ? this.makeExchangeDataIdInfoForSelf(selfId, exchangeDataInfo.exchangeData)\n        : await this.makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeDataInfo.exchangeData)\n    const encryptedSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(shareSecretIds, exchangeDataInfo.exchangeKey)\n    const encryptedEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(shareEncryptionKeys, exchangeDataInfo.exchangeKey)\n    const encryptedOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(shareOwningEntityIds, exchangeDataInfo.exchangeKey)\n    return {\n      ...exchangeDataIdInfo,\n      secretIds: encryptedSecretIds,\n      encryptionKeys: encryptedEncryptionKeys,\n      owningEntityIds: encryptedOwningEntityIds,\n    }\n  }\n\n  private async makeExchangeDataIdInfoForDelegate(\n    selfId: string,\n    delegateId: string,\n    exchangeData: ExchangeData\n  ): Promise<{\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  }> {\n    const delegateInfo = await this.getDataOwnerInfo(delegateId)\n    if (!delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        explicitDelegate: delegateId,\n        exchangeDataId: exchangeData.id,\n      }\n    } else if (delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(\n          exchangeData.id!,\n          Object.fromEntries(this.userKeys.getSelfVerifiedKeys().map((keyInfo) => [keyInfo.fingerprint, keyInfo.pair.publicKey]))\n        ),\n      }\n    } else if (!delegateInfo.requiresAnonymousDelegations && this.selfNeedsAnonymousDelegations) {\n      /**\n       * Important: this requires that the exchange data signature also validates the authenticity of the public keys included in there.\n       */\n      const fingerprintsOfVerifiedExchangeData = new Set(Object.keys(exchangeData.exchangeKey))\n      const delegateVerifiedKeys: { [fp: string]: CryptoKey } = {}\n      for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {\n        const currFp = fingerprintV2(keyHex)\n        const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? ShaVersion.Sha1 : ShaVersion.Sha256\n        if (fingerprintsOfVerifiedExchangeData.has(currFp)) {\n          delegateVerifiedKeys[currFp] = await this.primitives.RSA.importKey('spki', hex2ua(keyHex), ['encrypt'], shaVersion)\n        }\n      }\n      if (!Object.keys(delegateVerifiedKeys).length)\n        throw new Error('Illegal state: could not find any verified key for delegate in verified exchange data.')\n      return {\n        explicitDelegate: delegateId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id!, delegateVerifiedKeys),\n      }\n    } else return {}\n  }\n\n  private makeExchangeDataIdInfoForSelf(\n    selfId: string,\n    exchangeData: ExchangeData\n  ): {\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  } {\n    if (this.selfNeedsAnonymousDelegations) {\n      return {}\n    } else {\n      return {\n        exchangeDataId: exchangeData.id,\n        explicitDelegator: selfId,\n        explicitDelegate: selfId,\n      }\n    }\n  }\n\n  private async getDataOwnerInfo(dataOwnerId: string) {\n    return this.dataOwnerInfoCache.get(dataOwnerId, async () => {\n      const dataOwnerWithType = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n      return {\n        item: {\n          requiresAnonymousDelegations: this.cryptoStrategies.dataOwnerRequiresAnonymousDelegation(dataOwnerWithType),\n          availablePublicKeysHexWithSha1: Array.from(hexPublicKeysWithSha1Of(dataOwnerWithType.stub)),\n          availablePublicKeysHexWithSha256: Array.from(hexPublicKeysWithSha256Of(dataOwnerWithType.stub)),\n        },\n      }\n    })\n  }\n\n  private getExistingCanonicalKeyAndSecureDelegation(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    hashes: string[]\n  ): { canonicalKey: string; secureDelegation: SecureDelegation } | undefined {\n    const securityMetadata = entity.securityMetadata ?? {}\n    const canonicalByEquivalences = Array.from(new Set(hashes.flatMap((hash) => securityMetadata.keysEquivalences?.[hash] ?? [])))\n    const directRetrievals = hashes.flatMap((hash) => {\n      const retrievedMetadata = securityMetadata.secureDelegations?.[hash]\n      return retrievedMetadata ? { canonicalKey: hash, secureDelegation: retrievedMetadata } : []\n    })\n    if (\n      directRetrievals.length > 1 ||\n      canonicalByEquivalences.length > 1 ||\n      (!!canonicalByEquivalences[0] && !!directRetrievals[0]?.canonicalKey && canonicalByEquivalences[0] !== directRetrievals[0]?.canonicalKey)\n    )\n      throw new Error('Illegal state: multiple secure delegations matching equivalent hashes of entity.')\n    const canonicalFromEquivalences = canonicalByEquivalences[0]\n    const retrievedFromEquivalences = securityMetadata.secureDelegations?.[canonicalFromEquivalences]\n    return (\n      directRetrievals[0] ??\n      (!!canonicalFromEquivalences && !!retrievedFromEquivalences\n        ? { canonicalKey: canonicalFromEquivalences, secureDelegation: retrievedFromEquivalences }\n        : undefined)\n    )\n  }\n}\n"]}

package/icc-x-api/crypto/TransferKeysManager.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TransferKeysManager = void 0;
+const RSA_1 = require("./RSA");
 const utils_1 = require("../utils");
 const graph_utils_1 = require("../utils/graph-utils");
 const utils_2 = require("./utils");
@@ -40,8 +41,8 @@ class TransferKeysManager {
             if (!newEdgesByTarget.length)
                 return;
             const selfId = self.stub.id;
-            const fpToPublicKey = (0, utils_2.fingerprintToPublicKeysMapOf)(self.stub, 'sha-1');
-            const fpToPublicKeyWithSha256 = (0, utils_2.fingerprintToPublicKeysMapOf)(self.stub, 'sha-256');
+            const fpToPublicKey = (0, utils_2.fingerprintToPublicKeysMapOf)(self.stub, RSA_1.ShaVersion.Sha1);
+            const fpToPublicKeyWithSha256 = (0, utils_2.fingerprintToPublicKeysMapOf)(self.stub, RSA_1.ShaVersion.Sha256);
             const signatureKeyPair = yield this.userSignatureKeysManager.getOrCreateSignatureKeyPair();
             const verifiedFps = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint));
             const allVerifiedSourcesAndTarget = Array.from(new Set(newEdgesByTarget.flatMap((x) => 
@@ -49,7 +50,7 @@ class TransferKeysManager {
             verifiedFps.has(x.targetFp) ? [x.targetFp, ...x.sources] : x.sources)));
             const newExchangeKeyPublicKeys = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKey[fp]).filter((key) => !!key);
             const newExchangeKeyPublicKeysWithSha256 = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKeyWithSha256[fp]).filter((key) => !!key);
-            const createdExchangeData = yield this.baseExchangeDataManager.createExchangeData(selfId, { [signatureKeyPair.fingerprint]: signatureKeyPair.keyPair.privateKey }, Object.assign(Object.assign({}, (yield (0, utils_2.loadPublicKeys)(this.primitives.RSA, newExchangeKeyPublicKeys, 'sha-1'))), (yield (0, utils_2.loadPublicKeys)(this.primitives.RSA, newExchangeKeyPublicKeysWithSha256, 'sha-256'))));
+            const createdExchangeData = yield this.baseExchangeDataManager.createExchangeData(selfId, { [signatureKeyPair.fingerprint]: signatureKeyPair.keyPair.privateKey }, Object.assign(Object.assign({}, (yield (0, utils_2.loadPublicKeys)(this.primitives.RSA, newExchangeKeyPublicKeys, RSA_1.ShaVersion.Sha1))), (yield (0, utils_2.loadPublicKeys)(this.primitives.RSA, newExchangeKeyPublicKeysWithSha256, RSA_1.ShaVersion.Sha256))));
             let updatedTransferKeys = (_a = self.stub.transferKeys) !== null && _a !== void 0 ? _a : {};
             for (const newEdges of newEdgesByTarget) {
                 const encryptedTransferKey = yield this.encryptTransferKey(newEdges.target, createdExchangeData.exchangeKey);

package/icc-x-api/crypto/TransferKeysManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"TransferKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/TransferKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,oCAAiC;AAEjC,sDAA+E;AAC/E,mCAAgJ;AAOhJ;;;GAGG;AACH,MAAa,mBAAmB;IAC9B,YACmB,UAA4B,EAC5B,uBAAgD,EAChD,YAA8B,EAC9B,qBAAgD,EAChD,wBAAkD,EAClD,YAAgC;QALhC,eAAU,GAAV,UAAU,CAAkB;QAC5B,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,0BAAqB,GAArB,qBAAqB,CAA2B;QAChD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,iBAAY,GAAZ,YAAY,CAAoB;IAChD,CAAC;IAEJ;;;;;;OAMG;IACG,kBAAkB,CAAC,IAA6B;;;YACpD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAA;YACzE,IAAI,CAAC,gBAAgB,CAAC,MAAM;gBAAE,OAAM;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAG,CAAA;YAC5B,MAAM,aAAa,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACtE,MAAM,uBAAuB,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAClF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,EAAE,CAAA;YAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YACvG,MAAM,2BAA2B,GAAG,KAAK,CAAC,IAAI,CAC5C,IAAI,GAAG,CACL,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,+DAA+D;YAC/D,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CACrE,CACF,CACF,CAAA;YACD,MAAM,wBAAwB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YAClH,MAAM,kCAAkC,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACtI,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAC/E,MAAM,EACN,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,kCAElE,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC,GAC9E,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,SAAS,CAAC,CAAC,EAEhG,CAAA;YACD,IAAI,mBAAmB,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,YAAY,mCAAI,EAAE,CAAA;YACtD,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE;gBACvC,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAA;gBAC5G,mBAAmB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE;;oBACjE,MAAM,YAAY,qBAAQ,CAAC,MAAA,GAAG,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAC,CAAE,CAAA;oBACpD,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAA;oBACtD,GAAG,CAAC,WAAW,CAAC,GAAG,YAAY,CAAA;oBAC/B,OAAO,GAAG,CAAA;gBACZ,CAAC,EAAE,mBAAmB,CAAC,CAAA;aACxB;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBAC5C,IAAI,kCACC,IAAI,CAAC,IAAI,KACZ,YAAY,EAAE,mBAAmB,GAClC;gBACD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAA;;KACH;IAED,gGAAgG;IAClF,kBAAkB,CAAC,WAA+B,EAAE,WAAsB;;YACtF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACxF,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;QAC5E,CAAC;KAAA;IAED,iFAAiF;IACjF,6DAA6D;IACrD,wBAAwB,CAAC,OAAe,EAAE,KAA6B;QAC7E,OAAO,MAAM,CAAC,OAAO,CAAC,IAAA,8BAAgB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IAEa,kBAAkB,CAC9B,UAAqC,EACrC,KAA6B;;YAE7B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAA,EAAA,CAAC,CAAC,CAAA;YAClI,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAC1C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAClI,CAAA;YACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACxG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YACvF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;;gBAC1C,MAAM,cAAc,GAAG,MAAA,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,mCAAI,CAAC,WAAW,CAAC,CAAA,CAAC,6CAA6C;gBAC5H,MAAM,oBAAoB,GAAG,MAAA,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAI,WAAW,CAAA;gBAC1F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,CAAC,wBAAwB,CAAC,oBAAoB,CAAE,CAAC,IAAI,EAAE,CAAA;YACrH,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED,+DAA+D;IACjD,+BAA+B,CAAC,IAA6B;;YAOzE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YAC7G,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE;gBACtG,IAAI,QAAQ;oBAAE,iBAAiB,CAAC,GAAG,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC,CAAA;YACzD,CAAC,CAAC,CAAA;YACF,IAAI,iBAAiB,CAAC,IAAI,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAA;YAC1C,MAAM,KAAK,GAAG,IAAA,6BAAqB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9C,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;YACnF,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE;gBACtE,4DAA4D;gBAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBACtE,kEAAkE;gBAClE,MAAM,uBAAuB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CACjH,CAAA;gBACD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAA;gBAC9D,IAAI,qBAAqB,CAAC,IAAI,IAAI,CAAC;oBAAE,SAAQ;gBAC7C,qIAAqI;gBACrI,MAAM,SAAS,GAAG,IAAA,8BAAgB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAA;gBACtD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACvE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CACrG,CAAA;gBACD,IAAI,mBAAmB,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;gBACxH,kJAAkJ;gBAClJ,OAAO;gBACP,MAAM,2BAA2B,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;oBACxE,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;oBAC9G,IAAI,CAAC,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;oBAC7G,OAAO,GAAG,CAAA;gBACZ,CAAC,CAAC,CAAA;gBACF,GAAG,CAAC,IAAI,CAAC;oBACP,OAAO,EAAE,2BAA2B;oBACpC,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,WAAW;iBACtB,CAAC,CAAA;aACH;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;CACF;AA5ID,kDA4IC","sourcesContent":["import { KeyPair } from './RSA'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { ua2hex } from '../utils'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { reachSetsAcyclic, StronglyConnectedGraph } from '../utils/graph-utils'\nimport { fingerprintToPublicKeysMapOf, fingerprintV1, loadPublicKeys, transferKeysFpGraphOf, fingerprintIsV1, fingerprintV1toV2 } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\nimport { BaseExchangeDataManager } from './BaseExchangeDataManager'\nimport { UserSignatureKeysManager } from './UserSignatureKeysManager'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\n/**\n * @internal this class is intended only for internal use and may be changed without notice.\n * Allows to create new transfer keys.\n */\nexport class TransferKeysManager {\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly baseExchangeDataManager: BaseExchangeDataManager,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly encryptionKeysManager: UserEncryptionKeysManager,\n    private readonly userSignatureKeysManager: UserSignatureKeysManager,\n    private readonly icureStorage: IcureStorageFacade\n  ) {}\n\n  /**\n   * Analyses the transfer keys graph and creates new transfer keys which allow to improve data accessibility from other devices.\n   * For security reasons transfer keys will only be created between keys verified by the user, but this will be done ignoring any existing edges from\n   * unverified keys to verified keys.\n   * @param self the current data owner.\n   * @return the updated data owner.\n   */\n  async updateTransferKeys(self: CryptoActorStubWithType): Promise<void> {\n    const newEdgesByTarget = await this.getNewVerifiedTransferKeysEdges(self)\n    if (!newEdgesByTarget.length) return\n    const selfId = self.stub.id!\n    const fpToPublicKey = fingerprintToPublicKeysMapOf(self.stub, 'sha-1')\n    const fpToPublicKeyWithSha256 = fingerprintToPublicKeysMapOf(self.stub, 'sha-256')\n    const signatureKeyPair = await this.userSignatureKeysManager.getOrCreateSignatureKeyPair()\n    const verifiedFps = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    const allVerifiedSourcesAndTarget = Array.from(\n      new Set(\n        newEdgesByTarget.flatMap((x) =>\n          // Sources are guaranteed to be verified, but target may not be\n          verifiedFps.has(x.targetFp) ? [x.targetFp, ...x.sources] : x.sources\n        )\n      )\n    )\n    const newExchangeKeyPublicKeys = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKey[fp]).filter((key) => !!key)\n    const newExchangeKeyPublicKeysWithSha256 = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKeyWithSha256[fp]).filter((key) => !!key)\n    const createdExchangeData = await this.baseExchangeDataManager.createExchangeData(\n      selfId,\n      { [signatureKeyPair.fingerprint]: signatureKeyPair.keyPair.privateKey },\n      {\n        ...(await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeys, 'sha-1')),\n        ...(await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeysWithSha256, 'sha-256')),\n      }\n    )\n    let updatedTransferKeys = self.stub.transferKeys ?? {}\n    for (const newEdges of newEdgesByTarget) {\n      const encryptedTransferKey = await this.encryptTransferKey(newEdges.target, createdExchangeData.exchangeKey)\n      updatedTransferKeys = newEdges.sources.reduce((acc, candidateFp) => {\n        const existingKeys = { ...(acc[candidateFp] ?? {}) }\n        existingKeys[newEdges.targetFp] = encryptedTransferKey\n        acc[candidateFp] = existingKeys\n        return acc\n      }, updatedTransferKeys)\n    }\n    await this.dataOwnerApi.modifyCryptoActorStub({\n      stub: {\n        ...self.stub,\n        transferKeys: updatedTransferKeys,\n      },\n      type: self.type,\n    })\n  }\n\n  // encrypts a transfer key in pkcs8 format using an exchange key, returns the hex representation\n  private async encryptTransferKey(transferKey: KeyPair<CryptoKey>, exchangeKey: CryptoKey): Promise<string> {\n    const exportedKey = await this.primitives.RSA.exportKey(transferKey.privateKey, 'pkcs8')\n    return ua2hex(await this.primitives.AES.encrypt(exchangeKey, exportedKey))\n  }\n\n  // all public keys would go to the stored keys -> no need for specifying the key.\n  // Result only includes the acyclic label, not the full group\n  private transferKeysCandidatesFp(keyToFp: string, graph: StronglyConnectedGraph): string[] {\n    return Object.entries(reachSetsAcyclic(graph.acyclicGraph))\n      .filter(([from, reachable]) => from != keyToFp && !reachable.has(keyToFp))\n      .map((x) => x[0])\n  }\n\n  private async transferTargetKeys(\n    keyManager: UserEncryptionKeysManager,\n    graph: StronglyConnectedGraph\n  ): Promise<{ fingerprint: string; pair: KeyPair<CryptoKey> }[]> {\n    const availableGroups = new Set(Object.keys(keyManager.getDecryptionKeys()).map((x) => graph.originalLabelToAcyclicLabel[x] ?? x))\n    const groupsReachableFromAvailable = new Set(\n      Object.entries(graph.acyclicGraph).flatMap(([source, reachables]) => (availableGroups.has(source) ? Array.from(reachables) : []))\n    )\n    const targetCandidates = Array.from(availableGroups).filter((x) => !groupsReachableFromAvailable.has(x))\n    const verifiedFps = new Set(keyManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    return targetCandidates.map((candidateFp) => {\n      const candidateGroup = graph.acyclicLabelToGroup[candidateFp] ?? [candidateFp] // May not be part of transfer keys graph yet\n      const bestCandidateOfGroup = candidateGroup.find((x) => verifiedFps.has(x)) ?? candidateFp\n      return { fingerprint: bestCandidateOfGroup, pair: keyManager.getKeyPairForFingerprint(bestCandidateOfGroup)!.pair }\n    })\n  }\n\n  // Decides the best edges considering the verified public keys.\n  private async getNewVerifiedTransferKeysEdges(self: CryptoActorStubWithType): Promise<\n    {\n      sources: string[]\n      target: KeyPair<CryptoKey>\n      targetFp: string\n    }[]\n  > {\n    const verifiedKeysFpSet = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    Object.entries(await this.icureStorage.loadSelfVerifiedKeys(self.stub.id!)).forEach(([key, verified]) => {\n      if (verified) verifiedKeysFpSet.add(fingerprintV1(key))\n    })\n    if (verifiedKeysFpSet.size == 0) return []\n    const graph = transferKeysFpGraphOf(self.stub)\n    // 1. Choose keys available in this device which should be reachable from all other verified keys\n    const targetKeys = await this.transferTargetKeys(this.encryptionKeysManager, graph)\n    const res = []\n    for (const { fingerprint: targetKeyFp, pair: targetKey } of targetKeys) {\n      // 2. Find groups which can't reach the existing target keys\n      const candidatesFp = this.transferKeysCandidatesFp(targetKeyFp, graph)\n      // 3. Keep only groups which contain at least a verified candidate\n      const verifiedGroupCandidates = candidatesFp.filter((candidate) =>\n        graph.acyclicLabelToGroup[candidate].some((candidateGroupMember) => verifiedKeysFpSet.has(candidateGroupMember))\n      )\n      const verifiedCandidatesSet = new Set(verifiedGroupCandidates)\n      if (verifiedCandidatesSet.size == 0) continue\n      // 4. Drop all candidates which can already reach another candidate group: it is sufficient to create a transfer key from that group.\n      const reachSets = reachSetsAcyclic(graph.acyclicGraph)\n      const optimizedCandidates = verifiedGroupCandidates.filter((candidate) =>\n        Array.from(reachSets[candidate]).every((reachableNode) => !verifiedCandidatesSet.has(reachableNode))\n      )\n      if (optimizedCandidates.length == 0) throw new Error('Check failed: at least one candidate should survive optimization')\n      // 5. Transfer keys could also be faked: to make sure we are not giving access to unauthorised people we remap the candidates to a verified public\n      // keys\n      const verifiedOptimizedCandidates = optimizedCandidates.map((candidate) => {\n        const res = graph.acyclicLabelToGroup[candidate].find((groupMemberFp) => verifiedKeysFpSet.has(groupMemberFp))\n        if (!res) throw new Error('Check failed: optimized candidates groups should have at least a verified member')\n        return res\n      })\n      res.push({\n        sources: verifiedOptimizedCandidates,\n        target: targetKey,\n        targetFp: targetKeyFp,\n      })\n    }\n    return res\n  }\n}\n"]}
+{"version":3,"file":"TransferKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/TransferKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+BAA2C;AAE3C,oCAAiC;AAEjC,sDAA+E;AAC/E,mCAAgJ;AAOhJ;;;GAGG;AACH,MAAa,mBAAmB;IAC9B,YACmB,UAA4B,EAC5B,uBAAgD,EAChD,YAA8B,EAC9B,qBAAgD,EAChD,wBAAkD,EAClD,YAAgC;QALhC,eAAU,GAAV,UAAU,CAAkB;QAC5B,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,0BAAqB,GAArB,qBAAqB,CAA2B;QAChD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,iBAAY,GAAZ,YAAY,CAAoB;IAChD,CAAC;IAEJ;;;;;;OAMG;IACG,kBAAkB,CAAC,IAA6B;;;YACpD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAA;YACzE,IAAI,CAAC,gBAAgB,CAAC,MAAM;gBAAE,OAAM;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAG,CAAA;YAC5B,MAAM,aAAa,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,IAAI,EAAE,gBAAU,CAAC,IAAI,CAAC,CAAA;YAC9E,MAAM,uBAAuB,GAAG,IAAA,oCAA4B,EAAC,IAAI,CAAC,IAAI,EAAE,gBAAU,CAAC,MAAM,CAAC,CAAA;YAC1F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,EAAE,CAAA;YAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YACvG,MAAM,2BAA2B,GAAG,KAAK,CAAC,IAAI,CAC5C,IAAI,GAAG,CACL,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,+DAA+D;YAC/D,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CACrE,CACF,CACF,CAAA;YACD,MAAM,wBAAwB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YAClH,MAAM,kCAAkC,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACtI,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAC/E,MAAM,EACN,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,kCAElE,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,wBAAwB,EAAE,gBAAU,CAAC,IAAI,CAAC,CAAC,GACtF,CAAC,MAAM,IAAA,sBAAc,EAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,gBAAU,CAAC,MAAM,CAAC,CAAC,EAExG,CAAA;YACD,IAAI,mBAAmB,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,YAAY,mCAAI,EAAE,CAAA;YACtD,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE;gBACvC,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAA;gBAC5G,mBAAmB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE;;oBACjE,MAAM,YAAY,qBAAQ,CAAC,MAAA,GAAG,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAC,CAAE,CAAA;oBACpD,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAA;oBACtD,GAAG,CAAC,WAAW,CAAC,GAAG,YAAY,CAAA;oBAC/B,OAAO,GAAG,CAAA;gBACZ,CAAC,EAAE,mBAAmB,CAAC,CAAA;aACxB;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBAC5C,IAAI,kCACC,IAAI,CAAC,IAAI,KACZ,YAAY,EAAE,mBAAmB,GAClC;gBACD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAA;;KACH;IAED,gGAAgG;IAClF,kBAAkB,CAAC,WAA+B,EAAE,WAAsB;;YACtF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACxF,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;QAC5E,CAAC;KAAA;IAED,iFAAiF;IACjF,6DAA6D;IACrD,wBAAwB,CAAC,OAAe,EAAE,KAA6B;QAC7E,OAAO,MAAM,CAAC,OAAO,CAAC,IAAA,8BAAgB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IAEa,kBAAkB,CAC9B,UAAqC,EACrC,KAA6B;;YAE7B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,MAAA,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAA,EAAA,CAAC,CAAC,CAAA;YAClI,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAC1C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAClI,CAAA;YACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACxG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YACvF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;;gBAC1C,MAAM,cAAc,GAAG,MAAA,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,mCAAI,CAAC,WAAW,CAAC,CAAA,CAAC,6CAA6C;gBAC5H,MAAM,oBAAoB,GAAG,MAAA,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAI,WAAW,CAAA;gBAC1F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,CAAC,wBAAwB,CAAC,oBAAoB,CAAE,CAAC,IAAI,EAAE,CAAA;YACrH,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED,+DAA+D;IACjD,+BAA+B,CAAC,IAA6B;;YAOzE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;YAC7G,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE;gBACtG,IAAI,QAAQ;oBAAE,iBAAiB,CAAC,GAAG,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC,CAAA;YACzD,CAAC,CAAC,CAAA;YACF,IAAI,iBAAiB,CAAC,IAAI,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAA;YAC1C,MAAM,KAAK,GAAG,IAAA,6BAAqB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9C,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;YACnF,MAAM,GAAG,GAAG,EAAE,CAAA;YACd,KAAK,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE;gBACtE,4DAA4D;gBAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBACtE,kEAAkE;gBAClE,MAAM,uBAAuB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CACjH,CAAA;gBACD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAA;gBAC9D,IAAI,qBAAqB,CAAC,IAAI,IAAI,CAAC;oBAAE,SAAQ;gBAC7C,qIAAqI;gBACrI,MAAM,SAAS,GAAG,IAAA,8BAAgB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAA;gBACtD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACvE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CACrG,CAAA;gBACD,IAAI,mBAAmB,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;gBACxH,kJAAkJ;gBAClJ,OAAO;gBACP,MAAM,2BAA2B,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;oBACxE,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;oBAC9G,IAAI,CAAC,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;oBAC7G,OAAO,GAAG,CAAA;gBACZ,CAAC,CAAC,CAAA;gBACF,GAAG,CAAC,IAAI,CAAC;oBACP,OAAO,EAAE,2BAA2B;oBACpC,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,WAAW;iBACtB,CAAC,CAAA;aACH;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;CACF;AA5ID,kDA4IC","sourcesContent":["import { KeyPair, ShaVersion } from './RSA'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { ua2hex } from '../utils'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { reachSetsAcyclic, StronglyConnectedGraph } from '../utils/graph-utils'\nimport { fingerprintToPublicKeysMapOf, fingerprintV1, loadPublicKeys, transferKeysFpGraphOf, fingerprintIsV1, fingerprintV1toV2 } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\nimport { BaseExchangeDataManager } from './BaseExchangeDataManager'\nimport { UserSignatureKeysManager } from './UserSignatureKeysManager'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\n/**\n * @internal this class is intended only for internal use and may be changed without notice.\n * Allows to create new transfer keys.\n */\nexport class TransferKeysManager {\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly baseExchangeDataManager: BaseExchangeDataManager,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly encryptionKeysManager: UserEncryptionKeysManager,\n    private readonly userSignatureKeysManager: UserSignatureKeysManager,\n    private readonly icureStorage: IcureStorageFacade\n  ) {}\n\n  /**\n   * Analyses the transfer keys graph and creates new transfer keys which allow to improve data accessibility from other devices.\n   * For security reasons transfer keys will only be created between keys verified by the user, but this will be done ignoring any existing edges from\n   * unverified keys to verified keys.\n   * @param self the current data owner.\n   * @return the updated data owner.\n   */\n  async updateTransferKeys(self: CryptoActorStubWithType): Promise<void> {\n    const newEdgesByTarget = await this.getNewVerifiedTransferKeysEdges(self)\n    if (!newEdgesByTarget.length) return\n    const selfId = self.stub.id!\n    const fpToPublicKey = fingerprintToPublicKeysMapOf(self.stub, ShaVersion.Sha1)\n    const fpToPublicKeyWithSha256 = fingerprintToPublicKeysMapOf(self.stub, ShaVersion.Sha256)\n    const signatureKeyPair = await this.userSignatureKeysManager.getOrCreateSignatureKeyPair()\n    const verifiedFps = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    const allVerifiedSourcesAndTarget = Array.from(\n      new Set(\n        newEdgesByTarget.flatMap((x) =>\n          // Sources are guaranteed to be verified, but target may not be\n          verifiedFps.has(x.targetFp) ? [x.targetFp, ...x.sources] : x.sources\n        )\n      )\n    )\n    const newExchangeKeyPublicKeys = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKey[fp]).filter((key) => !!key)\n    const newExchangeKeyPublicKeysWithSha256 = allVerifiedSourcesAndTarget.map((fp) => fpToPublicKeyWithSha256[fp]).filter((key) => !!key)\n    const createdExchangeData = await this.baseExchangeDataManager.createExchangeData(\n      selfId,\n      { [signatureKeyPair.fingerprint]: signatureKeyPair.keyPair.privateKey },\n      {\n        ...(await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeys, ShaVersion.Sha1)),\n        ...(await loadPublicKeys(this.primitives.RSA, newExchangeKeyPublicKeysWithSha256, ShaVersion.Sha256)),\n      }\n    )\n    let updatedTransferKeys = self.stub.transferKeys ?? {}\n    for (const newEdges of newEdgesByTarget) {\n      const encryptedTransferKey = await this.encryptTransferKey(newEdges.target, createdExchangeData.exchangeKey)\n      updatedTransferKeys = newEdges.sources.reduce((acc, candidateFp) => {\n        const existingKeys = { ...(acc[candidateFp] ?? {}) }\n        existingKeys[newEdges.targetFp] = encryptedTransferKey\n        acc[candidateFp] = existingKeys\n        return acc\n      }, updatedTransferKeys)\n    }\n    await this.dataOwnerApi.modifyCryptoActorStub({\n      stub: {\n        ...self.stub,\n        transferKeys: updatedTransferKeys,\n      },\n      type: self.type,\n    })\n  }\n\n  // encrypts a transfer key in pkcs8 format using an exchange key, returns the hex representation\n  private async encryptTransferKey(transferKey: KeyPair<CryptoKey>, exchangeKey: CryptoKey): Promise<string> {\n    const exportedKey = await this.primitives.RSA.exportKey(transferKey.privateKey, 'pkcs8')\n    return ua2hex(await this.primitives.AES.encrypt(exchangeKey, exportedKey))\n  }\n\n  // all public keys would go to the stored keys -> no need for specifying the key.\n  // Result only includes the acyclic label, not the full group\n  private transferKeysCandidatesFp(keyToFp: string, graph: StronglyConnectedGraph): string[] {\n    return Object.entries(reachSetsAcyclic(graph.acyclicGraph))\n      .filter(([from, reachable]) => from != keyToFp && !reachable.has(keyToFp))\n      .map((x) => x[0])\n  }\n\n  private async transferTargetKeys(\n    keyManager: UserEncryptionKeysManager,\n    graph: StronglyConnectedGraph\n  ): Promise<{ fingerprint: string; pair: KeyPair<CryptoKey> }[]> {\n    const availableGroups = new Set(Object.keys(keyManager.getDecryptionKeys()).map((x) => graph.originalLabelToAcyclicLabel[x] ?? x))\n    const groupsReachableFromAvailable = new Set(\n      Object.entries(graph.acyclicGraph).flatMap(([source, reachables]) => (availableGroups.has(source) ? Array.from(reachables) : []))\n    )\n    const targetCandidates = Array.from(availableGroups).filter((x) => !groupsReachableFromAvailable.has(x))\n    const verifiedFps = new Set(keyManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    return targetCandidates.map((candidateFp) => {\n      const candidateGroup = graph.acyclicLabelToGroup[candidateFp] ?? [candidateFp] // May not be part of transfer keys graph yet\n      const bestCandidateOfGroup = candidateGroup.find((x) => verifiedFps.has(x)) ?? candidateFp\n      return { fingerprint: bestCandidateOfGroup, pair: keyManager.getKeyPairForFingerprint(bestCandidateOfGroup)!.pair }\n    })\n  }\n\n  // Decides the best edges considering the verified public keys.\n  private async getNewVerifiedTransferKeysEdges(self: CryptoActorStubWithType): Promise<\n    {\n      sources: string[]\n      target: KeyPair<CryptoKey>\n      targetFp: string\n    }[]\n  > {\n    const verifiedKeysFpSet = new Set(this.encryptionKeysManager.getSelfVerifiedKeys().map((x) => x.fingerprint))\n    Object.entries(await this.icureStorage.loadSelfVerifiedKeys(self.stub.id!)).forEach(([key, verified]) => {\n      if (verified) verifiedKeysFpSet.add(fingerprintV1(key))\n    })\n    if (verifiedKeysFpSet.size == 0) return []\n    const graph = transferKeysFpGraphOf(self.stub)\n    // 1. Choose keys available in this device which should be reachable from all other verified keys\n    const targetKeys = await this.transferTargetKeys(this.encryptionKeysManager, graph)\n    const res = []\n    for (const { fingerprint: targetKeyFp, pair: targetKey } of targetKeys) {\n      // 2. Find groups which can't reach the existing target keys\n      const candidatesFp = this.transferKeysCandidatesFp(targetKeyFp, graph)\n      // 3. Keep only groups which contain at least a verified candidate\n      const verifiedGroupCandidates = candidatesFp.filter((candidate) =>\n        graph.acyclicLabelToGroup[candidate].some((candidateGroupMember) => verifiedKeysFpSet.has(candidateGroupMember))\n      )\n      const verifiedCandidatesSet = new Set(verifiedGroupCandidates)\n      if (verifiedCandidatesSet.size == 0) continue\n      // 4. Drop all candidates which can already reach another candidate group: it is sufficient to create a transfer key from that group.\n      const reachSets = reachSetsAcyclic(graph.acyclicGraph)\n      const optimizedCandidates = verifiedGroupCandidates.filter((candidate) =>\n        Array.from(reachSets[candidate]).every((reachableNode) => !verifiedCandidatesSet.has(reachableNode))\n      )\n      if (optimizedCandidates.length == 0) throw new Error('Check failed: at least one candidate should survive optimization')\n      // 5. Transfer keys could also be faked: to make sure we are not giving access to unauthorised people we remap the candidates to a verified public\n      // keys\n      const verifiedOptimizedCandidates = optimizedCandidates.map((candidate) => {\n        const res = graph.acyclicLabelToGroup[candidate].find((groupMemberFp) => verifiedKeysFpSet.has(groupMemberFp))\n        if (!res) throw new Error('Check failed: optimized candidates groups should have at least a verified member')\n        return res\n      })\n      res.push({\n        sources: verifiedOptimizedCandidates,\n        target: targetKey,\n        targetFp: targetKeyFp,\n      })\n    }\n    return res\n  }\n}\n"]}

package/icc-x-api/crypto/UserEncryptionKeysManager.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserEncryptionKeysManager = void 0;
+const RSA_1 = require("./RSA");
 const utils_1 = require("../utils");
 const utils_2 = require("./utils");
 const CryptoActorStub_1 = require("../../icc-api/model/CryptoActorStub");
@@ -264,7 +265,7 @@ class UserEncryptionKeysManager {
     createAndSaveNewKeyPair(importedKeyPair, selfDataOwner) {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const keyPair = importedKeyPair !== null && importedKeyPair !== void 0 ? importedKeyPair : (yield this.primitives.RSA.generateKeyPair('sha-256'));
+            const keyPair = importedKeyPair !== null && importedKeyPair !== void 0 ? importedKeyPair : (yield this.primitives.RSA.generateKeyPair(RSA_1.ShaVersion.Sha256));
             const publicKeyHex = (0, utils_1.ua2hex)(yield this.primitives.RSA.exportKey(keyPair.publicKey, 'spki'));
             const jwKey = yield this.primitives.RSA.exportKey(keyPair.publicKey, 'jwk');
             if (jwKey.alg !== 'RSA-OAEP-256') {

package/icc-x-api/crypto/UserEncryptionKeysManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserEncryptionKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/UserEncryptionKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,oCAAiC;AAEjC,mCAAqE;AAKrE,yEAA8F;AAiB9F,MAAM,8BAA8B,GAA4B,CAAC,CAAC,EAAE,EAAE,CACpE,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,MAAM,CACN,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,iCAAM,GAAG,KAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,IAAG,EAC3G,EAKC,CACF,CACF,CAAA;AAGH;;GAEG;AACH,MAAa,yBAAyB;IAKpC,YACmB,UAA4B,EAC5B,YAA8B,EAC9B,YAAgC,EAChC,WAAwB,EACxB,UAA4B,EAC5B,oBAA6B,EAC7B,gBAAkC;QANlC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,iBAAY,GAAZ,YAAY,CAAoB;QAChC,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAkB;QAC5B,yBAAoB,GAApB,oBAAoB,CAAS;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAT7C,cAAS,GAA2F,SAAS,CAAA;IAUlH,CAAC;IAEJ;;;;;;;OAOG;IACG,wCAAwC;;YAU5C,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;YAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC7I,MAAM,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACnE,OAAO;gBACL,IAAI,EAAE;oBACJ,WAAW,EAAE,MAAM;oBACnB,IAAI,EAAE,QAAQ;iBACf;gBACD,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACtC,WAAW,EAAE,CAAC;oBACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;iBAC9H,CAAC,CAAC;aACJ,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,oCAAoC,CAAC,YAAqB;;YAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,IAAI,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC,CAAA;YAC/D,IAAI,YAAY,EAAE;gBAChB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAA;aAC/E;YACD,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAO,OAAO,EAAE,EAAE,gDAAC,OAAA,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA,GAAA,CAAC,CAAC,CAAA;QAC5I,CAAC;KAAA;IAED;;;;;OAKG;IACG,6CAA6C;;YACjD,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC;iBAC3B,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;iBAC1D,GAAG,CAAC,CAAO,WAAW,EAAE,EAAE,gDAAC,OAAA,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA,GAAA,CAAC,CAC/G,CAAA;QACH,CAAC;KAAA;IAED;;;;OAIG;IACH,wBAAwB,CAAC,WAAmB;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAA;QAC3F,IAAI,aAAa;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,CAAA;QACxD,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;OAMG;IACG,cAAc;;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,EACnG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CACtE,CAAA;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAChG,CAAC;KAAA;IAED;;;;;OAKG;IACG,UAAU;;YACd,MAAM,IAAI,CAAC,UAAU,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC1D,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAA;YAChH,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;;;;;;OASG;IACH,mBAAmB;;QACjB,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAU,CAAC,IAAI,CAAC,MAAO,CAAC,CAAA;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAE/C,MAAM,WAAW,GAAG,MAAA,IAAI,CAAC,mBAAmB,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;QACxD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACrE,MAAM,WAAW,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,UAAU,KAAI,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAE5H,SAAS,eAAe,CAAC,cAA0D;YACjF,OAAO,cAAc;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC;iBACtE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjB,oHAAoH;gBACpH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;IAC7I,CAAC;IAED;;;;OAIG;IACG,wBAAwB,CAAC,SAA0B;;YACvD,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAU,CAAC,SAAS,CAAC,EAAG,CAAC,CAAA;YACpD,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,2DAA2D,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACvI,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC9I,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAChI,CAAA;YACD,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,SAAS,CAAC;gBAC1D,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,SAAS,CAAC;aAC7D,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChB,MAAM,EAAE,GAAG,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAA;gBAC7B,OAAO,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACnE,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;OAIG;IACH,iBAAiB;QACf,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACzD,uCACK,GAAG,GACH,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EACrC;QACH,CAAC,EAAE,EAA0C,CAAC,CAAA;IAChD,CAAC;IAEa,UAAU,CACtB,uBAAgD,EAChD,wBAAkD;;YAElD,wCAAwC;YACxC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;;gBACrG,IAAI,SAAS,CAAC,SAAS,IAAI,EAAE,EAAE;oBAC7B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,SAAS,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,qDAAqD,CAAC,CAAA;oBAClG,OAAO,SAAS,CAAC,SAAS,CAAA;iBAC3B;gBACD,OAAO;oBACL,SAAS;oBACT,IAAI;iBACgB,CAAA;YACxB,CAAC,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAG,CAAA;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAA;YACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;gBACjE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;gBAC5D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;gBAC9D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAA;gBACxF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;oBAC5B,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC/D,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC;iBAClE,CAAC,CAAA;gBACF,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;oBAChE,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,CAAC,CAAC,CAAA;gBACF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,CAAC,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAG,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC,0CAAE,QAAQ,MAAK,IAAI,CAAC,CAAA,EAAA,CACzG,CAAA;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAA;aACrE;YACD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;YAClI,MAAM,6BAA6B,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtH,CAAC,CAAC,MAAM,uBAAuB,CAAC,YAAY,CAAC;gBAC7C,CAAC,CAAC,MAAM,8BAA8B,CAAC,YAAY,CAAC,CAAA;YACtD,MAAM,SAAS,GAA6D,EAAE,CAAA;YAC9E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;gBAC9B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,6BAA6B,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAC,eAAe,CAAC,CAAA;gBAC9H,MAAM,uBAAuB,GAAG,IAAI,CAAC,qBAAqB,CAAC,6BAA6B,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAC,aAAa,CAAC,CAAA;gBACnI,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE;oBACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;oBAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;iBAC/E;gBACD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CACrE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,EAC1B,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAChF,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,iCACZ,GAAG,KACN,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,uBAAuB,IAAI,gBAAgB,CAAC,MAAM,CAAC,IACvE,EACF,EAAE,CACH,CACF,CAAA;gBACD,MAAM,2BAA2B,mCAC5B,OAAO,CAAC,aAAa,GACrB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAClH,CAAA;gBACD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,CAAC,CAAA;gBACpI,MAAM,IAAI,mCACL,2BAA2B,GAC3B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAChH,CAAA;gBACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;aAClF;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;gBACpH,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAA;aAClH;iBAAM,IAAI,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAC,EAAE;gBAC7D,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;gBAC1B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAA;gBACnD,OAAO,SAAS,CAAA;aACjB;iBAAM;gBACL,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAA;gBACrD,IAAI,QAAQ,KAAK,KAAK,EAAE;oBACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,EAAE,mDAAmD,CAAC,CAAA;iBACnH;qBAAM;oBACL,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACrG,2BAA2B;oBAC3B,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAA;oBAChE,IAAI,CAAC,SAAS,mCACT,SAAS,KACZ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,kCACf,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,KAChC,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAEpG,CAAA;oBACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,oBAAoB,EAAE,CAAA;iBAClF;aACF;QACH,CAAC;KAAA;IAEa,uBAAuB,CACnC,eAA+C,EAC/C,aAAgC;;;YAEhC,MAAM,OAAO,GAAG,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAA;YACzF,MAAM,YAAY,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;YAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC3E,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;aAC5E;YACD,MAAM,oBAAoB,GAAG,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAA;YACxD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAC7B,aAAa,CAAC,SAAS,CAAC,EAAG,EAC3B,oBAAoB,EACpB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAC3D,IAAI,CACL,CAAA;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3G,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBAChE,IAAI,kCACC,iCAAe,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,KACzD,2BAA2B,EAAE,CAAC,GAAG,CAAC,MAAA,aAAa,CAAC,SAAS,CAAC,2BAA2B,mCAAI,EAAE,CAAC,EAAE,YAAY,CAAC,GAC5G;gBACD,IAAI,EAAE,aAAa,CAAC,IAAI;aACzB,CAAC,CAAA;YACF,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;;KAC/D;IAEa,cAAc,CAC1B,SAA4B,EAC5B,mBAAgD;;YAEhD,MAAM,8BAA8B,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE;gBACvG,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAyB,CAAC,CAAA;YAClE,CAAC,CAAC,CAAA;YACF,OAAO,MAAM,8BAA8B,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,kBAAkB,CAAC,EAAE,EAAE;gBACjG,MAAM,UAAU,GAAG,MAAM,GAAG,CAAA;gBAC5B,IAAI,UAAU,GAAgE,SAAS,CAAA;gBACvF,IAAI;oBACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,EAAE,kBAAkB,EAAE,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBACjI,IAAI,CAAC,CAAC,aAAa,EAAE;wBACnB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CACzD,KAAK,EACL,aAAa,CAAC,IAAI,CAAC,UAAU,EAC7B,KAAK,EACL,aAAa,CAAC,IAAI,CAAC,SAAS,EAC5B,UAAU,CACX,CAAA;wBACD,UAAU,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAA;qBACrE;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAA;iBACnE;gBACD,OAAO,UAAU;oBACf,CAAC,iCACM,UAAU,KACb,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAEpC,CAAC,CAAC,UAAU,CAAA;YAChB,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,CAAC,EAAsF,CAAC,CAAC,CAAA;QAC7G,CAAC;KAAA;IAEO,UAAU,CAChB,IAAsF,EACtF,eAAyD;QAEzD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CACtB,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,kCAAO,OAAO,KAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAG,EAAE,CAAC,MAAK,IAAI,IAA4B,CACjI,CACF,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,QAAuE;QAGpG,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChG,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAClF,CAAC;IAEa,mBAAmB,CAC/B,SAA4B,EAC5B,aAAkE;;YAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YAClF,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;gBACtD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;aAC9H;YACD,OAAO,aAAa,CAAA;QACtB,CAAC;KAAA;IAEa,qBAAqB,CAAC,SAA4B;;YAC9D,MAAM,mBAAmB,GAAG;gBAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC;gBACrH,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC;aAC1H,CAAA;YACD,MAAM,UAAU,GACd,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAClJ,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACtD,IACE,sBAAsB,CAAC,MAAM,KAAK,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,MAAM;gBAC7G,sBAAsB,CAAC,MAAM,GAAG,CAAC,EACjC;gBACA,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAA;gBACxG,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;oBACtD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;iBAC3C;aACF;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;KAAA;IAEO,qBAAqB,CAAI,GAAyC;QACxE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACvF,CAAC;IAEO,cAAc,CAAC,QAAuC;QAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IACxE,CAAC;CACF;AApZD,8DAoZC","sourcesContent":["import { DataOwner, DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair, ShaVersion } from './RSA'\nimport { ua2hex } from '../utils'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\nimport { fingerprintToPublicKeysMapOf, fingerprintV1 } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { KeyRecovery } from './KeyRecovery'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { DataOwnerWithType } from '../../icc-api/model/DataOwnerWithType'\nimport { CryptoActorStub, CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { BaseExchangeKeysManager } from './BaseExchangeKeysManager'\nimport { KeyPairRecoverer } from './KeyPairRecoverer'\n\ntype KeyPairData = { pair: KeyPair<CryptoKey>; isVerified: boolean; isDevice: boolean }\ntype KeyRecovererAndVerifier = (\n  keysData: {\n    dataOwner: DataOwnerWithType\n    unknownKeys: string[]\n    unavailableKeys: string[]\n  }[]\n) => Promise<{\n  [dataOwnerId: string]: {\n    recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n    keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n  }\n}>\nconst nothingKeyRecovererAndVerifier: KeyRecovererAndVerifier = (x) =>\n  Promise.resolve(\n    x.reduce(\n      (acc, { dataOwner }) => ({ ...acc, [dataOwner.dataOwner.id!]: { recoveredKeys: {}, keyAuthenticity: {} } }),\n      {} as {\n        [dataOwnerId: string]: {\n          recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n          keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n        }\n      }\n    )\n  )\ntype CurrentOwnerKeyGenerator = (self: DataOwnerWithType) => Promise<KeyPair<CryptoKey> | boolean>\n\n/**\n * Allows to manage public and private keys for the current user and his parent hierarchy.\n */\nexport class UserEncryptionKeysManager {\n  private selfId: string | undefined\n  private selfLegacyPublicKey: string | undefined\n  private keysCache: { [selfOrParentId: string]: { [pubKeyFingerprint: string]: KeyPairData } } | undefined = undefined\n\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly icureStorage: IcureStorageFacade,\n    private readonly keyRecovery: KeyRecovery,\n    private readonly strategies: CryptoStrategies,\n    private readonly initialiseParentKeys: boolean,\n    private readonly keypairRecoverer: KeyPairRecoverer\n  ) {}\n\n  /**\n   * @internal\n   * Get all key pairs available for the current data owner and his parents.\n   * @return an object with:\n   * - `self` an object containing the current data owner id and the list of key pairs available for the current data owner with verification details.\n   * - `parents` the list of parents to the current data owner with the list of key pairs available for each parent. The list is ordered from the\n   *   topmost ancestor (at index 0) to the direct parent of the current data owner (at the last index, may be 0).\n   */\n  async getCurrentUserHierarchyAvailableKeypairs(): Promise<{\n    self: {\n      dataOwnerId: string\n      keys: { pair: KeyPair<CryptoKey>; verified: boolean }[]\n    }\n    parents: {\n      dataOwnerId: string\n      keys: { pair: KeyPair<CryptoKey>; verified: boolean }[]\n    }[]\n  }> {\n    this.ensureInitialised()\n    const hierarchy = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n    const selfId = hierarchy[hierarchy.length - 1]\n    const selfKeys = Object.values(this.keysCache![selfId]).map(({ pair, isVerified, isDevice }) => ({ pair, verified: isVerified || isDevice }))\n    const remainingHierarchy = hierarchy.slice(0, hierarchy.length - 1)\n    return {\n      self: {\n        dataOwnerId: selfId,\n        keys: selfKeys,\n      },\n      parents: remainingHierarchy.map((x) => ({\n        dataOwnerId: x,\n        keys: Object.values(this.keysCache![x]).map(({ pair, isVerified, isDevice }) => ({ pair, verified: isVerified || isDevice })),\n      })),\n    }\n  }\n\n  /**\n   * Get the public keys of available key pairs for the current user in hex-encoded spki representation (uses cached keys: no request is done to the\n   * server).\n   * By setting {@link verifiedOnly} to true only the public keys for verified key pairs will be returned: these will include only key pairs created\n   * on this device or which have been verified using {@link CryptoStrategies} on this device.\n   * @param verifiedOnly if true only the verified public keys will be returned.\n   * @return the spki representation of public keys of available keypairs for the current user.\n   */\n  async getCurrentUserAvailablePublicKeysHex(verifiedOnly: boolean): Promise<string[]> {\n    this.ensureInitialised()\n    let selectedData = Object.values(this.keysCache![this.selfId!])\n    if (verifiedOnly) {\n      selectedData = selectedData.filter((data) => data.isVerified || data.isDevice)\n    }\n    return await Promise.all(selectedData.map(async (keyData) => ua2hex(await this.primitives.RSA.exportKey(keyData.pair.publicKey, 'spki'))))\n  }\n\n  /**\n   * Get the public keys of available key pairs for the current user and his parents in hex-encoded spki representation (uses cached keys: no request\n   * is done to the server).\n   * Note that this will also include unverified keys.\n   * @return the spki representation of public keys of available keypairs for the current user.\n   */\n  async getCurrentUserHierarchyAvailablePublicKeysHex(): Promise<string[]> {\n    return await Promise.all(\n      Object.values(this.keysCache!)\n        .flatMap((pairsForParent) => Object.values(pairsForParent))\n        .map(async (keyPairData) => ua2hex(await this.primitives.RSA.exportKey(keyPairData.pair.publicKey, 'spki')))\n    )\n  }\n\n  /**\n   * Get a key pair with the provided fingerprint if present.\n   * @param fingerprint a key-pair/public-key fingerprint\n   * @return the pair associated to the fingerprint and a boolean indicating if the pair is verified, if present, else undefined\n   */\n  getKeyPairForFingerprint(fingerprint: string): { pair: KeyPair<CryptoKey>; verified: boolean } | undefined {\n    const foundVerified = this.getSelfVerifiedKeys().find((x) => x.fingerprint === fingerprint)\n    if (foundVerified) return { pair: foundVerified.pair, verified: true }\n    const foundOther = this.getDecryptionKeys()[fingerprint]\n    if (foundOther) return { pair: foundOther, verified: false }\n    return undefined\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Initializes all keys for the current data owner. This method needs to be called before any other method of this class can be used.\n   * @throws if the current user is not a data owner, or if there is no key and no new key could be created according to this manager crypt\n   * strategies.\n   * @return if a new key was created during initialisation the newly created key, else undefined.\n   */\n  async initialiseKeys(): Promise<{ newKeyPair: KeyPair<CryptoKey>; newKeyFingerprint: string } | undefined> {\n    const newKey = await this.doLoadKeys(\n      (x) => this.strategies.recoverAndVerifySelfHierarchyKeys(x, this.primitives, this.keypairRecoverer),\n      (x) => this.strategies.generateNewKeyForDataOwner(x, this.primitives)\n    )\n    return newKey ? { newKeyPair: newKey.pair, newKeyFingerprint: newKey.fingerprint } : undefined\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Forces to reload keys for the current data owner. This could be useful if the data owner has logged in from another device in order to update the\n   * transfer keys.\n   * This method will complete only after keys have been reloaded successfully.\n   */\n  async reloadKeys(): Promise<void> {\n    await this.doLoadKeys(nothingKeyRecovererAndVerifier, (x) => {\n      throw new Error(\"Can't create new keys at reload time: it should have already been created on initialisation\")\n    })\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Get all verified key pairs for the current data owner which can safely be used for encryption. This includes all key pairs created on the current\n   * device and all recovered key pairs which have been verified.\n   * The keys returned by this method will be in the following order:\n   * 1. Legacy key pair if it is verified\n   * 2. All device key pais, in alphabetical order according to the fingerprint\n   * 3. Other verified key pairs, in alphabetical order according to the fingerprint\n   * @return all verified keys, in order.\n   */\n  getSelfVerifiedKeys(): { fingerprint: string; pair: KeyPair<CryptoKey> }[] {\n    this.ensureInitialised()\n    const selfKeys = this.keysCache![this.selfId!]\n    const allKeysEntries = Object.entries(selfKeys)\n\n    const legacyKeyFp = this.selfLegacyPublicKey?.slice(-32)\n    const legacyKeyData = legacyKeyFp ? selfKeys[legacyKeyFp] : undefined\n    const legacyEntry = legacyKeyData?.isVerified && legacyKeyFp ? [{ fingerprint: legacyKeyFp, pair: legacyKeyData.pair }] : []\n\n    function filteredEntries(filterFunction: (fp: string, data: KeyPairData) => boolean) {\n      return allKeysEntries\n        .filter(([fp, data]) => filterFunction(fp, data) && fp !== legacyKeyFp)\n        .sort(([a], [b]) => {\n          // need to make sure that the comparison is independent of the locale, but the actual ordering is not that important\n          return a == b ? 0 : a > b ? 1 : -1\n        })\n        .map(([fingerprint, { pair }]) => ({ fingerprint, pair }))\n    }\n    return [...legacyEntry, ...filteredEntries((_, data) => data.isDevice), ...filteredEntries((_, data) => !data.isDevice && data.isVerified)]\n  }\n\n  /**\n   * Get all verified keys for a member of the current data owner hierarchy in no particular order.\n   * @param dataOwner the current data owner or a member of his hierarchy.\n   * @throws if the provided data owner is not part of the current data owner hierarchy\n   */\n  async getVerifiedPublicKeysFor(dataOwner: DataOwnerOrStub): Promise<string[]> {\n    this.ensureInitialised()\n    const availableKeys = this.keysCache![dataOwner.id!]\n    if (!availableKeys) throw new Error(`Data owner ${dataOwner.id} is not part of the hierarchy of the current data owner ${this.selfId}`)\n    const availableVerifiedKeysFp = new Set(Object.entries(availableKeys).flatMap(([fp, info]) => (info.isVerified || info.isDevice ? [fp] : [])))\n    const otherVerifiedFp = new Set(\n      Object.entries(await this.icureStorage.loadSelfVerifiedKeys(dataOwner.id!)).flatMap(([fp, verified]) => (verified ? [fp] : []))\n    )\n    return Array.from([\n      ...this.dataOwnerApi.getHexPublicKeysWithSha1Of(dataOwner),\n      ...this.dataOwnerApi.getHexPublicKeysWithSha256Of(dataOwner),\n    ]).filter((key) => {\n      const fp = fingerprintV1(key)\n      return availableVerifiedKeysFp.has(fp) || otherVerifiedFp.has(fp)\n    })\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Get all key pairs for the current data owner and his parents. These keys should be used only for decryption as they may have not been verified.\n   * @return all key pairs available for decryption.\n   */\n  getDecryptionKeys(): { [fingerprint: string]: KeyPair<CryptoKey> } {\n    this.ensureInitialised()\n    return Object.values(this.keysCache!).reduce((acc, curr) => {\n      return {\n        ...acc,\n        ...this.plainKeysByFingerprint(curr),\n      }\n    }, {} as { [fp: string]: KeyPair<CryptoKey> })\n  }\n\n  private async doLoadKeys(\n    keyRecovererAndVerifier: KeyRecovererAndVerifier,\n    currentOwnerKeyGenerator: CurrentOwnerKeyGenerator\n  ): Promise<{ pair: KeyPair<CryptoKey>; fingerprint: string } | undefined> {\n    // Load all keys for self from key store\n    const hierarchy = (await this.dataOwnerApi.getCurrentDataOwnerHierarchy()).map(({ dataOwner, type }) => {\n      if (dataOwner.publicKey == '') {\n        if (Object.entries(dataOwner.hcPartyKeys ?? {}).length > 0)\n          throw new Error(`Data owner ${dataOwner.id} has \"\" as public key but has non-empty hcPartyKeys`)\n        delete dataOwner.publicKey\n      }\n      return {\n        dataOwner,\n        type,\n      } as DataOwnerWithType\n    })\n    const self = hierarchy[hierarchy.length - 1]\n    this.selfId = self.dataOwner.id!\n    const keysData = []\n    for (const dowt of this.initialiseParentKeys ? hierarchy : [self]) {\n      const availableKeys = await this.loadAndRecoverKeysFor(dowt)\n      const availableKeysFpSet = new Set(Object.keys(availableKeys))\n      const verifiedKeysMap = await this.icureStorage.loadSelfVerifiedKeys(dowt.dataOwner.id!)\n      const allPublicKeys = new Set([\n        ...this.dataOwnerApi.getHexPublicKeysWithSha1Of(dowt.dataOwner),\n        ...this.dataOwnerApi.getHexPublicKeysWithSha256Of(dowt.dataOwner),\n      ])\n      const unavailableKeys = Array.from(allPublicKeys).flatMap((key) => {\n        return availableKeysFpSet.has(key.slice(-32)) ? [] : [key]\n      })\n      const unknownKeys = Array.from(allPublicKeys).filter(\n        (x) => !(fingerprintV1(x) in verifiedKeysMap) && !(availableKeys?.[fingerprintV1(x)]?.isDevice === true)\n      )\n      keysData.push({ dowt, availableKeys, unavailableKeys, unknownKeys })\n    }\n    const recoveryInfo = keysData.map(({ dowt, unavailableKeys, unknownKeys }) => ({ dataOwner: dowt, unavailableKeys, unknownKeys }))\n    const recoveryAndVerificationResult = recoveryInfo.some((x) => x.unavailableKeys.length > 0 || x.unknownKeys.length > 0)\n      ? await keyRecovererAndVerifier(recoveryInfo)\n      : await nothingKeyRecovererAndVerifier(recoveryInfo)\n    const keysCache: { [dataOwnerId: string]: { [fp: string]: KeyPairData } } = {}\n    for (const keyData of keysData) {\n      const currAuthenticity = this.ensureFingerprintKeys(recoveryAndVerificationResult[keyData.dowt.dataOwner.id!].keyAuthenticity)\n      const currExternallyRecovered = this.ensureFingerprintKeys(recoveryAndVerificationResult[keyData.dowt.dataOwner.id!].recoveredKeys)\n      for (const [fp, keyPair] of Object.entries(currExternallyRecovered)) {\n        const jwkPair = await this.primitives.RSA.exportKeys(keyPair, 'jwk', 'jwk')\n        await this.icureStorage.saveKey(keyData.dowt.dataOwner.id!, fp, jwkPair, true)\n      }\n      const updatedVerifiedMap = await this.icureStorage.saveSelfVerifiedKeys(\n        keyData.dowt.dataOwner.id!,\n        [...Object.keys(currAuthenticity), ...Object.keys(currExternallyRecovered)].reduce(\n          (acc, currFp) => ({\n            ...acc,\n            [currFp]: currFp in currExternallyRecovered || currAuthenticity[currFp],\n          }),\n          {}\n        )\n      )\n      const keysWithExternallyRecovered = {\n        ...keyData.availableKeys,\n        ...Object.fromEntries(Object.entries(currExternallyRecovered).map(([k, v]) => [k, { pair: v, isDevice: false }])),\n      }\n      const additionallyRecovered = await this.recoverAndCacheKeys(keyData.dowt, this.plainKeysByFingerprint(keysWithExternallyRecovered))\n      const keys = {\n        ...keysWithExternallyRecovered,\n        ...Object.fromEntries(Object.entries(additionallyRecovered).map(([k, v]) => [k, { pair: v, isDevice: false }])),\n      }\n      keysCache[keyData.dowt.dataOwner.id!] = this.verifyKeys(keys, updatedVerifiedMap)\n    }\n    if (Object.entries(keysCache).some(([ownerId, data]) => ownerId !== self.dataOwner.id && !this.hasVerifiedKey(data))) {\n      throw new Error('Some parent hcps have no verified keys: impossible to generate locally a new key for a parent.')\n    } else if (this.hasVerifiedKey(keysCache[self.dataOwner.id!])) {\n      this.keysCache = keysCache\n      this.selfLegacyPublicKey = self.dataOwner.publicKey\n      return undefined\n    } else {\n      const whatToDo = await currentOwnerKeyGenerator(self)\n      if (whatToDo === false) {\n        throw new Error(`No verified key found for ${self.dataOwner.id} and settings do not allow creation of a new key.`)\n      } else {\n        const updateInfo = await this.createAndSaveNewKeyPair(whatToDo === true ? undefined : whatToDo, self)\n        // self may be outdated now\n        this.selfLegacyPublicKey = updateInfo.updatedSelf.stub.publicKey\n        this.keysCache = {\n          ...keysCache,\n          [self.dataOwner.id!]: {\n            ...keysCache[self.dataOwner.id!],\n            [updateInfo.publicKeyFingerprint]: { pair: updateInfo.keyPair, isDevice: true, isVerified: true },\n          },\n        }\n        return { pair: updateInfo.keyPair, fingerprint: updateInfo.publicKeyFingerprint }\n      }\n    }\n  }\n\n  private async createAndSaveNewKeyPair(\n    importedKeyPair: undefined | KeyPair<CryptoKey>,\n    selfDataOwner: DataOwnerWithType\n  ): Promise<{ publicKeyFingerprint: string; keyPair: KeyPair<CryptoKey>; updatedSelf: CryptoActorStubWithType }> {\n    const keyPair = importedKeyPair ?? (await this.primitives.RSA.generateKeyPair('sha-256'))\n    const publicKeyHex = ua2hex(await this.primitives.RSA.exportKey(keyPair.publicKey, 'spki'))\n    const jwKey = await this.primitives.RSA.exportKey(keyPair.publicKey, 'jwk')\n    if (jwKey.alg !== 'RSA-OAEP-256') {\n      throw new Error('Only keys generated with SHA-256 are currently supported')\n    }\n    const publicKeyFingerprint = fingerprintV1(publicKeyHex)\n    await this.icureStorage.saveKey(\n      selfDataOwner.dataOwner.id!,\n      publicKeyFingerprint,\n      await this.primitives.RSA.exportKeys(keyPair, 'jwk', 'jwk'),\n      true\n    )\n    await this.icureStorage.saveSelfVerifiedKeys(selfDataOwner.dataOwner.id!, { [publicKeyFingerprint]: true })\n    const updatedSelf = await this.dataOwnerApi.modifyCryptoActorStub({\n      stub: {\n        ...CryptoActorStub.fromDataOwner(selfDataOwner.dataOwner),\n        publicKeysForOaepWithSha256: [...(selfDataOwner.dataOwner.publicKeysForOaepWithSha256 ?? []), publicKeyHex],\n      },\n      type: selfDataOwner.type,\n    })\n    return { publicKeyFingerprint, keyPair: keyPair, updatedSelf }\n  }\n\n  private async loadStoredKeys(\n    dataOwner: DataOwnerWithType,\n    pubKeysFingerprints: { [key: string]: string[] }\n  ): Promise<{ [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }> {\n    const pubKeysFingerprintsWithVersion = Object.entries(pubKeysFingerprints).flatMap(([shaVersion, fps]) => {\n      return fps.map((fp) => [shaVersion, fp] as [ShaVersion, string])\n    })\n    return await pubKeysFingerprintsWithVersion.reduce(async (acc, [shaVersion, currentFingerprint]) => {\n      const awaitedAcc = await acc\n      let loadedPair: { pair: KeyPair<CryptoKey>; isDevice: boolean } | undefined = undefined\n      try {\n        const storedKeypair = await this.icureStorage.loadKey(dataOwner.dataOwner.id!, currentFingerprint, dataOwner.dataOwner.publicKey)\n        if (!!storedKeypair) {\n          const importedKey = await this.primitives.RSA.importKeyPair(\n            'jwk',\n            storedKeypair.pair.privateKey,\n            'jwk',\n            storedKeypair.pair.publicKey,\n            shaVersion\n          )\n          loadedPair = { pair: importedKey, isDevice: storedKeypair.isDevice }\n        }\n      } catch (e) {\n        console.warn('Error while loading keypair', currentFingerprint, e)\n      }\n      return loadedPair\n        ? {\n            ...awaitedAcc,\n            [currentFingerprint]: loadedPair,\n          }\n        : awaitedAcc\n    }, Promise.resolve({} as { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }))\n  }\n\n  private verifyKeys(\n    keys: { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } },\n    verifiedKeysMap: { [pubKeyFingerprint: string]: boolean }\n  ): { [pubKeyFingerprint: string]: KeyPairData } {\n    return Object.fromEntries(\n      Object.entries(keys).map(\n        ([fp, keyData]) => [fp, { ...keyData, isVerified: keyData.isDevice || verifiedKeysMap?.[fp] === true }] as [string, KeyPairData]\n      )\n    )\n  }\n\n  private plainKeysByFingerprint(richKeys: { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey> } }): {\n    [pubKeyFingerprint: string]: KeyPair<CryptoKey>\n  } {\n    return Object.fromEntries(Object.entries(richKeys).map(([fp, keyData]) => [fp, keyData.pair]))\n  }\n\n  private ensureInitialised() {\n    if (!this.keysCache) throw new Error('Key manager was not properly initialised')\n  }\n\n  private async recoverAndCacheKeys(\n    dataOwner: DataOwnerWithType,\n    availableKeys: { [pubKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{ [p: string]: KeyPair<CryptoKey> }> {\n    const recoveredKeys = await this.keyRecovery.recoverKeys(dataOwner, availableKeys)\n    for (const [fp, pair] of Object.entries(recoveredKeys)) {\n      await this.icureStorage.saveKey(dataOwner.dataOwner.id!, fp, await this.primitives.RSA.exportKeys(pair, 'jwk', 'jwk'), false)\n    }\n    return recoveredKeys\n  }\n\n  private async loadAndRecoverKeysFor(dataOwner: DataOwnerWithType): Promise<{ [keyFp: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }> {\n    const pubKeysFingerprints = {\n      'sha-1': [...new Set(this.dataOwnerApi.getHexPublicKeysWithSha1Of(dataOwner.dataOwner))].map((x) => fingerprintV1(x)),\n      'sha-256': [...new Set(this.dataOwnerApi.getHexPublicKeysWithSha256Of(dataOwner.dataOwner))].map((x) => fingerprintV1(x)),\n    }\n    const loadedKeys =\n      pubKeysFingerprints['sha-1'].length + pubKeysFingerprints['sha-256'].length > 0 ? await this.loadStoredKeys(dataOwner, pubKeysFingerprints) : {}\n    const loadedKeysFingerprints = Object.keys(loadedKeys)\n    if (\n      loadedKeysFingerprints.length !== pubKeysFingerprints['sha-1'].length + pubKeysFingerprints['sha-256'].length &&\n      loadedKeysFingerprints.length > 0\n    ) {\n      const recoveredKeys = await this.recoverAndCacheKeys(dataOwner, this.plainKeysByFingerprint(loadedKeys))\n      for (const [fp, pair] of Object.entries(recoveredKeys)) {\n        loadedKeys[fp] = { pair, isDevice: false }\n      }\n    }\n    return loadedKeys\n  }\n\n  private ensureFingerprintKeys<T>(obj: { [shouldBeFingerprint: string]: T }): { [definitelyFingerprint: string]: T } {\n    return Object.fromEntries(Object.entries(obj).map(([k, v]) => [fingerprintV1(k), v]))\n  }\n\n  private hasVerifiedKey(keysData: { [fp: string]: KeyPairData }) {\n    return Object.values(keysData).some((x) => x.isVerified || x.isDevice)\n  }\n}\n"]}
+{"version":3,"file":"UserEncryptionKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/UserEncryptionKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+BAA2C;AAC3C,oCAAiC;AAEjC,mCAAuC;AAKvC,yEAA8F;AAgB9F,MAAM,8BAA8B,GAA4B,CAAC,CAAC,EAAE,EAAE,CACpE,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,MAAM,CACN,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,iCAAM,GAAG,KAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,IAAG,EAC3G,EAKC,CACF,CACF,CAAA;AAGH;;GAEG;AACH,MAAa,yBAAyB;IAKpC,YACmB,UAA4B,EAC5B,YAA8B,EAC9B,YAAgC,EAChC,WAAwB,EACxB,UAA4B,EAC5B,oBAA6B,EAC7B,gBAAkC;QANlC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,iBAAY,GAAZ,YAAY,CAAoB;QAChC,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAkB;QAC5B,yBAAoB,GAApB,oBAAoB,CAAS;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAT7C,cAAS,GAA2F,SAAS,CAAA;IAUlH,CAAC;IAEJ;;;;;;;OAOG;IACG,wCAAwC;;YAU5C,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;YAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC7I,MAAM,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACnE,OAAO;gBACL,IAAI,EAAE;oBACJ,WAAW,EAAE,MAAM;oBACnB,IAAI,EAAE,QAAQ;iBACf;gBACD,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACtC,WAAW,EAAE,CAAC;oBACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;iBAC9H,CAAC,CAAC;aACJ,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,oCAAoC,CAAC,YAAqB;;YAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,IAAI,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC,CAAA;YAC/D,IAAI,YAAY,EAAE;gBAChB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAA;aAC/E;YACD,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAO,OAAO,EAAE,EAAE,gDAAC,OAAA,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA,GAAA,CAAC,CAAC,CAAA;QAC5I,CAAC;KAAA;IAED;;;;;OAKG;IACG,6CAA6C;;YACjD,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC;iBAC3B,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;iBAC1D,GAAG,CAAC,CAAO,WAAW,EAAE,EAAE,gDAAC,OAAA,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA,GAAA,CAAC,CAC/G,CAAA;QACH,CAAC;KAAA;IAED;;;;OAIG;IACH,wBAAwB,CAAC,WAAmB;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAA;QAC3F,IAAI,aAAa;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,CAAA;QACxD,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;OAMG;IACG,cAAc;;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,EACnG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CACtE,CAAA;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAChG,CAAC;KAAA;IAED;;;;;OAKG;IACG,UAAU;;YACd,MAAM,IAAI,CAAC,UAAU,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC1D,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAA;YAChH,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;;;;;;OASG;IACH,mBAAmB;;QACjB,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAU,CAAC,IAAI,CAAC,MAAO,CAAC,CAAA;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAE/C,MAAM,WAAW,GAAG,MAAA,IAAI,CAAC,mBAAmB,0CAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;QACxD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACrE,MAAM,WAAW,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,UAAU,KAAI,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAE5H,SAAS,eAAe,CAAC,cAA0D;YACjF,OAAO,cAAc;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC;iBACtE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjB,oHAAoH;gBACpH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;IAC7I,CAAC;IAED;;;;OAIG;IACG,wBAAwB,CAAC,SAA0B;;YACvD,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACxB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAU,CAAC,SAAS,CAAC,EAAG,CAAC,CAAA;YACpD,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,2DAA2D,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACvI,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC9I,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAChI,CAAA;YACD,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,SAAS,CAAC;gBAC1D,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,SAAS,CAAC;aAC7D,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChB,MAAM,EAAE,GAAG,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAA;gBAC7B,OAAO,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACnE,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;;;OAIG;IACH,iBAAiB;QACf,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACzD,uCACK,GAAG,GACH,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EACrC;QACH,CAAC,EAAE,EAA0C,CAAC,CAAA;IAChD,CAAC;IAEa,UAAU,CACtB,uBAAgD,EAChD,wBAAkD;;YAElD,wCAAwC;YACxC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;;gBACrG,IAAI,SAAS,CAAC,SAAS,IAAI,EAAE,EAAE;oBAC7B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,SAAS,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,qDAAqD,CAAC,CAAA;oBAClG,OAAO,SAAS,CAAC,SAAS,CAAA;iBAC3B;gBACD,OAAO;oBACL,SAAS;oBACT,IAAI;iBACgB,CAAA;YACxB,CAAC,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAG,CAAA;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAA;YACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;gBACjE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;gBAC5D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;gBAC9D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAA;gBACxF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;oBAC5B,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC/D,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC;iBAClE,CAAC,CAAA;gBACF,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;oBAChE,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,CAAC,CAAC,CAAA;gBACF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,CAAC,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAG,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC,0CAAE,QAAQ,MAAK,IAAI,CAAC,CAAA,EAAA,CACzG,CAAA;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAA;aACrE;YACD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;YAClI,MAAM,6BAA6B,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtH,CAAC,CAAC,MAAM,uBAAuB,CAAC,YAAY,CAAC;gBAC7C,CAAC,CAAC,MAAM,8BAA8B,CAAC,YAAY,CAAC,CAAA;YACtD,MAAM,SAAS,GAA6D,EAAE,CAAA;YAC9E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;gBAC9B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,6BAA6B,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAC,eAAe,CAAC,CAAA;gBAC9H,MAAM,uBAAuB,GAAG,IAAI,CAAC,qBAAqB,CAAC,6BAA6B,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAC,aAAa,CAAC,CAAA;gBACnI,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE;oBACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;oBAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;iBAC/E;gBACD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CACrE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,EAC1B,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAChF,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,iCACZ,GAAG,KACN,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,uBAAuB,IAAI,gBAAgB,CAAC,MAAM,CAAC,IACvE,EACF,EAAE,CACH,CACF,CAAA;gBACD,MAAM,2BAA2B,mCAC5B,OAAO,CAAC,aAAa,GACrB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAClH,CAAA;gBACD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,CAAC,CAAA;gBACpI,MAAM,IAAI,mCACL,2BAA2B,GAC3B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAChH,CAAA;gBACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;aAClF;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;gBACpH,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAA;aAClH;iBAAM,IAAI,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,CAAC,EAAE;gBAC7D,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;gBAC1B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAA;gBACnD,OAAO,SAAS,CAAA;aACjB;iBAAM;gBACL,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAA;gBACrD,IAAI,QAAQ,KAAK,KAAK,EAAE;oBACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,EAAE,mDAAmD,CAAC,CAAA;iBACnH;qBAAM;oBACL,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;oBACrG,2BAA2B;oBAC3B,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAA;oBAChE,IAAI,CAAC,SAAS,mCACT,SAAS,KACZ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,kCACf,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAG,CAAC,KAChC,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAEpG,CAAA;oBACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,oBAAoB,EAAE,CAAA;iBAClF;aACF;QACH,CAAC;KAAA;IAEa,uBAAuB,CACnC,eAA+C,EAC/C,aAAgC;;;YAEhC,MAAM,OAAO,GAAG,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,gBAAU,CAAC,MAAM,CAAC,CAAC,CAAA;YACjG,MAAM,YAAY,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;YAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC3E,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;aAC5E;YACD,MAAM,oBAAoB,GAAG,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAA;YACxD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAC7B,aAAa,CAAC,SAAS,CAAC,EAAG,EAC3B,oBAAoB,EACpB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAC3D,IAAI,CACL,CAAA;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3G,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBAChE,IAAI,kCACC,iCAAe,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,KACzD,2BAA2B,EAAE,CAAC,GAAG,CAAC,MAAA,aAAa,CAAC,SAAS,CAAC,2BAA2B,mCAAI,EAAE,CAAC,EAAE,YAAY,CAAC,GAC5G;gBACD,IAAI,EAAE,aAAa,CAAC,IAAI;aACzB,CAAC,CAAA;YACF,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;;KAC/D;IAEa,cAAc,CAC1B,SAA4B,EAC5B,mBAAgD;;YAEhD,MAAM,8BAA8B,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE;gBACvG,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAyB,CAAC,CAAA;YAClE,CAAC,CAAC,CAAA;YACF,OAAO,MAAM,8BAA8B,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,CAAC,UAAU,EAAE,kBAAkB,CAAC,EAAE,EAAE;gBACjG,MAAM,UAAU,GAAG,MAAM,GAAG,CAAA;gBAC5B,IAAI,UAAU,GAAgE,SAAS,CAAA;gBACvF,IAAI;oBACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,EAAE,kBAAkB,EAAE,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBACjI,IAAI,CAAC,CAAC,aAAa,EAAE;wBACnB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CACzD,KAAK,EACL,aAAa,CAAC,IAAI,CAAC,UAAU,EAC7B,KAAK,EACL,aAAa,CAAC,IAAI,CAAC,SAAS,EAC5B,UAAU,CACX,CAAA;wBACD,UAAU,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAA;qBACrE;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAA;iBACnE;gBACD,OAAO,UAAU;oBACf,CAAC,iCACM,UAAU,KACb,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAEpC,CAAC,CAAC,UAAU,CAAA;YAChB,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,CAAC,EAAsF,CAAC,CAAC,CAAA;QAC7G,CAAC;KAAA;IAEO,UAAU,CAChB,IAAsF,EACtF,eAAyD;QAEzD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CACtB,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,kCAAO,OAAO,KAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAG,EAAE,CAAC,MAAK,IAAI,IAA4B,CACjI,CACF,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,QAAuE;QAGpG,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChG,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAClF,CAAC;IAEa,mBAAmB,CAC/B,SAA4B,EAC5B,aAAkE;;YAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;YAClF,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;gBACtD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,EAAE,EAAE,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;aAC9H;YACD,OAAO,aAAa,CAAA;QACtB,CAAC;KAAA;IAEa,qBAAqB,CAAC,SAA4B;;YAC9D,MAAM,mBAAmB,GAAG;gBAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC;gBACrH,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC;aAC1H,CAAA;YACD,MAAM,UAAU,GACd,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAClJ,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACtD,IACE,sBAAsB,CAAC,MAAM,KAAK,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,MAAM;gBAC7G,sBAAsB,CAAC,MAAM,GAAG,CAAC,EACjC;gBACA,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAA;gBACxG,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;oBACtD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;iBAC3C;aACF;YACD,OAAO,UAAU,CAAA;QACnB,CAAC;KAAA;IAEO,qBAAqB,CAAI,GAAyC;QACxE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACvF,CAAC;IAEO,cAAc,CAAC,QAAuC;QAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IACxE,CAAC;CACF;AApZD,8DAoZC","sourcesContent":["import { DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair, ShaVersion } from './RSA'\nimport { ua2hex } from '../utils'\nimport { IcureStorageFacade } from '../storage/IcureStorageFacade'\nimport { fingerprintV1 } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { KeyRecovery } from './KeyRecovery'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { DataOwnerWithType } from '../../icc-api/model/DataOwnerWithType'\nimport { CryptoActorStub, CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { KeyPairRecoverer } from './KeyPairRecoverer'\n\ntype KeyPairData = { pair: KeyPair<CryptoKey>; isVerified: boolean; isDevice: boolean }\ntype KeyRecovererAndVerifier = (\n  keysData: {\n    dataOwner: DataOwnerWithType\n    unknownKeys: string[]\n    unavailableKeys: string[]\n  }[]\n) => Promise<{\n  [dataOwnerId: string]: {\n    recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n    keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n  }\n}>\nconst nothingKeyRecovererAndVerifier: KeyRecovererAndVerifier = (x) =>\n  Promise.resolve(\n    x.reduce(\n      (acc, { dataOwner }) => ({ ...acc, [dataOwner.dataOwner.id!]: { recoveredKeys: {}, keyAuthenticity: {} } }),\n      {} as {\n        [dataOwnerId: string]: {\n          recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n          keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n        }\n      }\n    )\n  )\ntype CurrentOwnerKeyGenerator = (self: DataOwnerWithType) => Promise<KeyPair<CryptoKey> | boolean>\n\n/**\n * Allows to manage public and private keys for the current user and his parent hierarchy.\n */\nexport class UserEncryptionKeysManager {\n  private selfId: string | undefined\n  private selfLegacyPublicKey: string | undefined\n  private keysCache: { [selfOrParentId: string]: { [pubKeyFingerprint: string]: KeyPairData } } | undefined = undefined\n\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly icureStorage: IcureStorageFacade,\n    private readonly keyRecovery: KeyRecovery,\n    private readonly strategies: CryptoStrategies,\n    private readonly initialiseParentKeys: boolean,\n    private readonly keypairRecoverer: KeyPairRecoverer\n  ) {}\n\n  /**\n   * @internal\n   * Get all key pairs available for the current data owner and his parents.\n   * @return an object with:\n   * - `self` an object containing the current data owner id and the list of key pairs available for the current data owner with verification details.\n   * - `parents` the list of parents to the current data owner with the list of key pairs available for each parent. The list is ordered from the\n   *   topmost ancestor (at index 0) to the direct parent of the current data owner (at the last index, may be 0).\n   */\n  async getCurrentUserHierarchyAvailableKeypairs(): Promise<{\n    self: {\n      dataOwnerId: string\n      keys: { pair: KeyPair<CryptoKey>; verified: boolean }[]\n    }\n    parents: {\n      dataOwnerId: string\n      keys: { pair: KeyPair<CryptoKey>; verified: boolean }[]\n    }[]\n  }> {\n    this.ensureInitialised()\n    const hierarchy = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n    const selfId = hierarchy[hierarchy.length - 1]\n    const selfKeys = Object.values(this.keysCache![selfId]).map(({ pair, isVerified, isDevice }) => ({ pair, verified: isVerified || isDevice }))\n    const remainingHierarchy = hierarchy.slice(0, hierarchy.length - 1)\n    return {\n      self: {\n        dataOwnerId: selfId,\n        keys: selfKeys,\n      },\n      parents: remainingHierarchy.map((x) => ({\n        dataOwnerId: x,\n        keys: Object.values(this.keysCache![x]).map(({ pair, isVerified, isDevice }) => ({ pair, verified: isVerified || isDevice })),\n      })),\n    }\n  }\n\n  /**\n   * Get the public keys of available key pairs for the current user in hex-encoded spki representation (uses cached keys: no request is done to the\n   * server).\n   * By setting {@link verifiedOnly} to true only the public keys for verified key pairs will be returned: these will include only key pairs created\n   * on this device or which have been verified using {@link CryptoStrategies} on this device.\n   * @param verifiedOnly if true only the verified public keys will be returned.\n   * @return the spki representation of public keys of available keypairs for the current user.\n   */\n  async getCurrentUserAvailablePublicKeysHex(verifiedOnly: boolean): Promise<string[]> {\n    this.ensureInitialised()\n    let selectedData = Object.values(this.keysCache![this.selfId!])\n    if (verifiedOnly) {\n      selectedData = selectedData.filter((data) => data.isVerified || data.isDevice)\n    }\n    return await Promise.all(selectedData.map(async (keyData) => ua2hex(await this.primitives.RSA.exportKey(keyData.pair.publicKey, 'spki'))))\n  }\n\n  /**\n   * Get the public keys of available key pairs for the current user and his parents in hex-encoded spki representation (uses cached keys: no request\n   * is done to the server).\n   * Note that this will also include unverified keys.\n   * @return the spki representation of public keys of available keypairs for the current user.\n   */\n  async getCurrentUserHierarchyAvailablePublicKeysHex(): Promise<string[]> {\n    return await Promise.all(\n      Object.values(this.keysCache!)\n        .flatMap((pairsForParent) => Object.values(pairsForParent))\n        .map(async (keyPairData) => ua2hex(await this.primitives.RSA.exportKey(keyPairData.pair.publicKey, 'spki')))\n    )\n  }\n\n  /**\n   * Get a key pair with the provided fingerprint if present.\n   * @param fingerprint a key-pair/public-key fingerprint\n   * @return the pair associated to the fingerprint and a boolean indicating if the pair is verified, if present, else undefined\n   */\n  getKeyPairForFingerprint(fingerprint: string): { pair: KeyPair<CryptoKey>; verified: boolean } | undefined {\n    const foundVerified = this.getSelfVerifiedKeys().find((x) => x.fingerprint === fingerprint)\n    if (foundVerified) return { pair: foundVerified.pair, verified: true }\n    const foundOther = this.getDecryptionKeys()[fingerprint]\n    if (foundOther) return { pair: foundOther, verified: false }\n    return undefined\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Initializes all keys for the current data owner. This method needs to be called before any other method of this class can be used.\n   * @throws if the current user is not a data owner, or if there is no key and no new key could be created according to this manager crypt\n   * strategies.\n   * @return if a new key was created during initialisation the newly created key, else undefined.\n   */\n  async initialiseKeys(): Promise<{ newKeyPair: KeyPair<CryptoKey>; newKeyFingerprint: string } | undefined> {\n    const newKey = await this.doLoadKeys(\n      (x) => this.strategies.recoverAndVerifySelfHierarchyKeys(x, this.primitives, this.keypairRecoverer),\n      (x) => this.strategies.generateNewKeyForDataOwner(x, this.primitives)\n    )\n    return newKey ? { newKeyPair: newKey.pair, newKeyFingerprint: newKey.fingerprint } : undefined\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Forces to reload keys for the current data owner. This could be useful if the data owner has logged in from another device in order to update the\n   * transfer keys.\n   * This method will complete only after keys have been reloaded successfully.\n   */\n  async reloadKeys(): Promise<void> {\n    await this.doLoadKeys(nothingKeyRecovererAndVerifier, (x) => {\n      throw new Error(\"Can't create new keys at reload time: it should have already been created on initialisation\")\n    })\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Get all verified key pairs for the current data owner which can safely be used for encryption. This includes all key pairs created on the current\n   * device and all recovered key pairs which have been verified.\n   * The keys returned by this method will be in the following order:\n   * 1. Legacy key pair if it is verified\n   * 2. All device key pais, in alphabetical order according to the fingerprint\n   * 3. Other verified key pairs, in alphabetical order according to the fingerprint\n   * @return all verified keys, in order.\n   */\n  getSelfVerifiedKeys(): { fingerprint: string; pair: KeyPair<CryptoKey> }[] {\n    this.ensureInitialised()\n    const selfKeys = this.keysCache![this.selfId!]\n    const allKeysEntries = Object.entries(selfKeys)\n\n    const legacyKeyFp = this.selfLegacyPublicKey?.slice(-32)\n    const legacyKeyData = legacyKeyFp ? selfKeys[legacyKeyFp] : undefined\n    const legacyEntry = legacyKeyData?.isVerified && legacyKeyFp ? [{ fingerprint: legacyKeyFp, pair: legacyKeyData.pair }] : []\n\n    function filteredEntries(filterFunction: (fp: string, data: KeyPairData) => boolean) {\n      return allKeysEntries\n        .filter(([fp, data]) => filterFunction(fp, data) && fp !== legacyKeyFp)\n        .sort(([a], [b]) => {\n          // need to make sure that the comparison is independent of the locale, but the actual ordering is not that important\n          return a == b ? 0 : a > b ? 1 : -1\n        })\n        .map(([fingerprint, { pair }]) => ({ fingerprint, pair }))\n    }\n    return [...legacyEntry, ...filteredEntries((_, data) => data.isDevice), ...filteredEntries((_, data) => !data.isDevice && data.isVerified)]\n  }\n\n  /**\n   * Get all verified keys for a member of the current data owner hierarchy in no particular order.\n   * @param dataOwner the current data owner or a member of his hierarchy.\n   * @throws if the provided data owner is not part of the current data owner hierarchy\n   */\n  async getVerifiedPublicKeysFor(dataOwner: DataOwnerOrStub): Promise<string[]> {\n    this.ensureInitialised()\n    const availableKeys = this.keysCache![dataOwner.id!]\n    if (!availableKeys) throw new Error(`Data owner ${dataOwner.id} is not part of the hierarchy of the current data owner ${this.selfId}`)\n    const availableVerifiedKeysFp = new Set(Object.entries(availableKeys).flatMap(([fp, info]) => (info.isVerified || info.isDevice ? [fp] : [])))\n    const otherVerifiedFp = new Set(\n      Object.entries(await this.icureStorage.loadSelfVerifiedKeys(dataOwner.id!)).flatMap(([fp, verified]) => (verified ? [fp] : []))\n    )\n    return Array.from([\n      ...this.dataOwnerApi.getHexPublicKeysWithSha1Of(dataOwner),\n      ...this.dataOwnerApi.getHexPublicKeysWithSha256Of(dataOwner),\n    ]).filter((key) => {\n      const fp = fingerprintV1(key)\n      return availableVerifiedKeysFp.has(fp) || otherVerifiedFp.has(fp)\n    })\n  }\n\n  /**\n   * @internal This method is intended for internal use only and may be changed without notice.\n   * Get all key pairs for the current data owner and his parents. These keys should be used only for decryption as they may have not been verified.\n   * @return all key pairs available for decryption.\n   */\n  getDecryptionKeys(): { [fingerprint: string]: KeyPair<CryptoKey> } {\n    this.ensureInitialised()\n    return Object.values(this.keysCache!).reduce((acc, curr) => {\n      return {\n        ...acc,\n        ...this.plainKeysByFingerprint(curr),\n      }\n    }, {} as { [fp: string]: KeyPair<CryptoKey> })\n  }\n\n  private async doLoadKeys(\n    keyRecovererAndVerifier: KeyRecovererAndVerifier,\n    currentOwnerKeyGenerator: CurrentOwnerKeyGenerator\n  ): Promise<{ pair: KeyPair<CryptoKey>; fingerprint: string } | undefined> {\n    // Load all keys for self from key store\n    const hierarchy = (await this.dataOwnerApi.getCurrentDataOwnerHierarchy()).map(({ dataOwner, type }) => {\n      if (dataOwner.publicKey == '') {\n        if (Object.entries(dataOwner.hcPartyKeys ?? {}).length > 0)\n          throw new Error(`Data owner ${dataOwner.id} has \"\" as public key but has non-empty hcPartyKeys`)\n        delete dataOwner.publicKey\n      }\n      return {\n        dataOwner,\n        type,\n      } as DataOwnerWithType\n    })\n    const self = hierarchy[hierarchy.length - 1]\n    this.selfId = self.dataOwner.id!\n    const keysData = []\n    for (const dowt of this.initialiseParentKeys ? hierarchy : [self]) {\n      const availableKeys = await this.loadAndRecoverKeysFor(dowt)\n      const availableKeysFpSet = new Set(Object.keys(availableKeys))\n      const verifiedKeysMap = await this.icureStorage.loadSelfVerifiedKeys(dowt.dataOwner.id!)\n      const allPublicKeys = new Set([\n        ...this.dataOwnerApi.getHexPublicKeysWithSha1Of(dowt.dataOwner),\n        ...this.dataOwnerApi.getHexPublicKeysWithSha256Of(dowt.dataOwner),\n      ])\n      const unavailableKeys = Array.from(allPublicKeys).flatMap((key) => {\n        return availableKeysFpSet.has(key.slice(-32)) ? [] : [key]\n      })\n      const unknownKeys = Array.from(allPublicKeys).filter(\n        (x) => !(fingerprintV1(x) in verifiedKeysMap) && !(availableKeys?.[fingerprintV1(x)]?.isDevice === true)\n      )\n      keysData.push({ dowt, availableKeys, unavailableKeys, unknownKeys })\n    }\n    const recoveryInfo = keysData.map(({ dowt, unavailableKeys, unknownKeys }) => ({ dataOwner: dowt, unavailableKeys, unknownKeys }))\n    const recoveryAndVerificationResult = recoveryInfo.some((x) => x.unavailableKeys.length > 0 || x.unknownKeys.length > 0)\n      ? await keyRecovererAndVerifier(recoveryInfo)\n      : await nothingKeyRecovererAndVerifier(recoveryInfo)\n    const keysCache: { [dataOwnerId: string]: { [fp: string]: KeyPairData } } = {}\n    for (const keyData of keysData) {\n      const currAuthenticity = this.ensureFingerprintKeys(recoveryAndVerificationResult[keyData.dowt.dataOwner.id!].keyAuthenticity)\n      const currExternallyRecovered = this.ensureFingerprintKeys(recoveryAndVerificationResult[keyData.dowt.dataOwner.id!].recoveredKeys)\n      for (const [fp, keyPair] of Object.entries(currExternallyRecovered)) {\n        const jwkPair = await this.primitives.RSA.exportKeys(keyPair, 'jwk', 'jwk')\n        await this.icureStorage.saveKey(keyData.dowt.dataOwner.id!, fp, jwkPair, true)\n      }\n      const updatedVerifiedMap = await this.icureStorage.saveSelfVerifiedKeys(\n        keyData.dowt.dataOwner.id!,\n        [...Object.keys(currAuthenticity), ...Object.keys(currExternallyRecovered)].reduce(\n          (acc, currFp) => ({\n            ...acc,\n            [currFp]: currFp in currExternallyRecovered || currAuthenticity[currFp],\n          }),\n          {}\n        )\n      )\n      const keysWithExternallyRecovered = {\n        ...keyData.availableKeys,\n        ...Object.fromEntries(Object.entries(currExternallyRecovered).map(([k, v]) => [k, { pair: v, isDevice: false }])),\n      }\n      const additionallyRecovered = await this.recoverAndCacheKeys(keyData.dowt, this.plainKeysByFingerprint(keysWithExternallyRecovered))\n      const keys = {\n        ...keysWithExternallyRecovered,\n        ...Object.fromEntries(Object.entries(additionallyRecovered).map(([k, v]) => [k, { pair: v, isDevice: false }])),\n      }\n      keysCache[keyData.dowt.dataOwner.id!] = this.verifyKeys(keys, updatedVerifiedMap)\n    }\n    if (Object.entries(keysCache).some(([ownerId, data]) => ownerId !== self.dataOwner.id && !this.hasVerifiedKey(data))) {\n      throw new Error('Some parent hcps have no verified keys: impossible to generate locally a new key for a parent.')\n    } else if (this.hasVerifiedKey(keysCache[self.dataOwner.id!])) {\n      this.keysCache = keysCache\n      this.selfLegacyPublicKey = self.dataOwner.publicKey\n      return undefined\n    } else {\n      const whatToDo = await currentOwnerKeyGenerator(self)\n      if (whatToDo === false) {\n        throw new Error(`No verified key found for ${self.dataOwner.id} and settings do not allow creation of a new key.`)\n      } else {\n        const updateInfo = await this.createAndSaveNewKeyPair(whatToDo === true ? undefined : whatToDo, self)\n        // self may be outdated now\n        this.selfLegacyPublicKey = updateInfo.updatedSelf.stub.publicKey\n        this.keysCache = {\n          ...keysCache,\n          [self.dataOwner.id!]: {\n            ...keysCache[self.dataOwner.id!],\n            [updateInfo.publicKeyFingerprint]: { pair: updateInfo.keyPair, isDevice: true, isVerified: true },\n          },\n        }\n        return { pair: updateInfo.keyPair, fingerprint: updateInfo.publicKeyFingerprint }\n      }\n    }\n  }\n\n  private async createAndSaveNewKeyPair(\n    importedKeyPair: undefined | KeyPair<CryptoKey>,\n    selfDataOwner: DataOwnerWithType\n  ): Promise<{ publicKeyFingerprint: string; keyPair: KeyPair<CryptoKey>; updatedSelf: CryptoActorStubWithType }> {\n    const keyPair = importedKeyPair ?? (await this.primitives.RSA.generateKeyPair(ShaVersion.Sha256))\n    const publicKeyHex = ua2hex(await this.primitives.RSA.exportKey(keyPair.publicKey, 'spki'))\n    const jwKey = await this.primitives.RSA.exportKey(keyPair.publicKey, 'jwk')\n    if (jwKey.alg !== 'RSA-OAEP-256') {\n      throw new Error('Only keys generated with SHA-256 are currently supported')\n    }\n    const publicKeyFingerprint = fingerprintV1(publicKeyHex)\n    await this.icureStorage.saveKey(\n      selfDataOwner.dataOwner.id!,\n      publicKeyFingerprint,\n      await this.primitives.RSA.exportKeys(keyPair, 'jwk', 'jwk'),\n      true\n    )\n    await this.icureStorage.saveSelfVerifiedKeys(selfDataOwner.dataOwner.id!, { [publicKeyFingerprint]: true })\n    const updatedSelf = await this.dataOwnerApi.modifyCryptoActorStub({\n      stub: {\n        ...CryptoActorStub.fromDataOwner(selfDataOwner.dataOwner),\n        publicKeysForOaepWithSha256: [...(selfDataOwner.dataOwner.publicKeysForOaepWithSha256 ?? []), publicKeyHex],\n      },\n      type: selfDataOwner.type,\n    })\n    return { publicKeyFingerprint, keyPair: keyPair, updatedSelf }\n  }\n\n  private async loadStoredKeys(\n    dataOwner: DataOwnerWithType,\n    pubKeysFingerprints: { [key: string]: string[] }\n  ): Promise<{ [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }> {\n    const pubKeysFingerprintsWithVersion = Object.entries(pubKeysFingerprints).flatMap(([shaVersion, fps]) => {\n      return fps.map((fp) => [shaVersion, fp] as [ShaVersion, string])\n    })\n    return await pubKeysFingerprintsWithVersion.reduce(async (acc, [shaVersion, currentFingerprint]) => {\n      const awaitedAcc = await acc\n      let loadedPair: { pair: KeyPair<CryptoKey>; isDevice: boolean } | undefined = undefined\n      try {\n        const storedKeypair = await this.icureStorage.loadKey(dataOwner.dataOwner.id!, currentFingerprint, dataOwner.dataOwner.publicKey)\n        if (!!storedKeypair) {\n          const importedKey = await this.primitives.RSA.importKeyPair(\n            'jwk',\n            storedKeypair.pair.privateKey,\n            'jwk',\n            storedKeypair.pair.publicKey,\n            shaVersion\n          )\n          loadedPair = { pair: importedKey, isDevice: storedKeypair.isDevice }\n        }\n      } catch (e) {\n        console.warn('Error while loading keypair', currentFingerprint, e)\n      }\n      return loadedPair\n        ? {\n            ...awaitedAcc,\n            [currentFingerprint]: loadedPair,\n          }\n        : awaitedAcc\n    }, Promise.resolve({} as { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }))\n  }\n\n  private verifyKeys(\n    keys: { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } },\n    verifiedKeysMap: { [pubKeyFingerprint: string]: boolean }\n  ): { [pubKeyFingerprint: string]: KeyPairData } {\n    return Object.fromEntries(\n      Object.entries(keys).map(\n        ([fp, keyData]) => [fp, { ...keyData, isVerified: keyData.isDevice || verifiedKeysMap?.[fp] === true }] as [string, KeyPairData]\n      )\n    )\n  }\n\n  private plainKeysByFingerprint(richKeys: { [pubKeyFingerprint: string]: { pair: KeyPair<CryptoKey> } }): {\n    [pubKeyFingerprint: string]: KeyPair<CryptoKey>\n  } {\n    return Object.fromEntries(Object.entries(richKeys).map(([fp, keyData]) => [fp, keyData.pair]))\n  }\n\n  private ensureInitialised() {\n    if (!this.keysCache) throw new Error('Key manager was not properly initialised')\n  }\n\n  private async recoverAndCacheKeys(\n    dataOwner: DataOwnerWithType,\n    availableKeys: { [pubKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{ [p: string]: KeyPair<CryptoKey> }> {\n    const recoveredKeys = await this.keyRecovery.recoverKeys(dataOwner, availableKeys)\n    for (const [fp, pair] of Object.entries(recoveredKeys)) {\n      await this.icureStorage.saveKey(dataOwner.dataOwner.id!, fp, await this.primitives.RSA.exportKeys(pair, 'jwk', 'jwk'), false)\n    }\n    return recoveredKeys\n  }\n\n  private async loadAndRecoverKeysFor(dataOwner: DataOwnerWithType): Promise<{ [keyFp: string]: { pair: KeyPair<CryptoKey>; isDevice: boolean } }> {\n    const pubKeysFingerprints = {\n      'sha-1': [...new Set(this.dataOwnerApi.getHexPublicKeysWithSha1Of(dataOwner.dataOwner))].map((x) => fingerprintV1(x)),\n      'sha-256': [...new Set(this.dataOwnerApi.getHexPublicKeysWithSha256Of(dataOwner.dataOwner))].map((x) => fingerprintV1(x)),\n    }\n    const loadedKeys =\n      pubKeysFingerprints['sha-1'].length + pubKeysFingerprints['sha-256'].length > 0 ? await this.loadStoredKeys(dataOwner, pubKeysFingerprints) : {}\n    const loadedKeysFingerprints = Object.keys(loadedKeys)\n    if (\n      loadedKeysFingerprints.length !== pubKeysFingerprints['sha-1'].length + pubKeysFingerprints['sha-256'].length &&\n      loadedKeysFingerprints.length > 0\n    ) {\n      const recoveredKeys = await this.recoverAndCacheKeys(dataOwner, this.plainKeysByFingerprint(loadedKeys))\n      for (const [fp, pair] of Object.entries(recoveredKeys)) {\n        loadedKeys[fp] = { pair, isDevice: false }\n      }\n    }\n    return loadedKeys\n  }\n\n  private ensureFingerprintKeys<T>(obj: { [shouldBeFingerprint: string]: T }): { [definitelyFingerprint: string]: T } {\n    return Object.fromEntries(Object.entries(obj).map(([k, v]) => [fingerprintV1(k), v]))\n  }\n\n  private hasVerifiedKey(keysData: { [fp: string]: KeyPairData }) {\n    return Object.values(keysData).some((x) => x.isVerified || x.isDevice)\n  }\n}\n"]}