@icure/api 8.1.9 → 8.2.1

package/icc-x-api/crypto/BaseExchangeDataManager.d.ts

@@ -125,6 +125,7 @@ export declare class BaseExchangeDataManager {
         exchangeData: ExchangeData;
         exchangeKey: CryptoKey;
         accessControlSecret: string;
+        sharedSignatureKey: CryptoKey;
     }>;
     tryRawDecryptExchangeData(exchangeData: ExchangeData, decryptionKeys: {
         [publicKeyFingerprint: string]: KeyPair<CryptoKey>;
@@ -156,9 +157,18 @@ export declare class BaseExchangeDataManager {
     /**
      * Same as [tryUpdateExchangeData] but the decrypted content is already provided.
      */
-    updateExchangeDataWithRawDecryptedContent(exchangeData: ExchangeData, newEncryptionKeys: {
-        [keyPairFingerprint: string]: CryptoKey;
-    }, rawExchangeKey: ArrayBuffer, rawAccessControlSecret: ArrayBuffer, rawSharedSignatureKey: ArrayBuffer): Promise<{
+    updateExchangeDataWithRawDecryptedContent({ exchangeData, newEncryptionKeys, rawExchangeKey, rawAccessControlSecret, rawSharedSignatureKey, newDelegatorSignatureKeys, }: {
+        exchangeData: ExchangeData;
+        newEncryptionKeys: {
+            [fp: string]: CryptoKey;
+        };
+        newDelegatorSignatureKeys: {
+            [keyPairFingerprint: string]: CryptoKey;
+        };
+        rawExchangeKey: ArrayBuffer;
+        rawAccessControlSecret: ArrayBuffer;
+        rawSharedSignatureKey: ArrayBuffer;
+    }): Promise<{
         exchangeData: ExchangeData;
         exchangeKey: CryptoKey;
         accessControlSecret: string;
@@ -166,14 +176,14 @@ export declare class BaseExchangeDataManager {
     private bytesToSignForSharedSignature;
     private bytesToSignForDelegatorSignature;
     private generateExchangeKey;
-    private importExchangeKey;
-    private exportExchangeKey;
+    importExchangeKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey>;
+    exportExchangeKey(key: CryptoKey): Promise<ArrayBuffer>;
     private generateSharedSignatureKey;
-    private importSharedSignatureKey;
-    private exportSharedSignatureKey;
+    importSharedSignatureKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey>;
+    exportSharedSignatureKey(key: CryptoKey): Promise<ArrayBuffer>;
     private generateAccessControlSecret;
-    private importAccessControlSecret;
-    private exportAccessControlSecret;
+    importAccessControlSecret(decryptedBytes: ArrayBuffer): Promise<string>;
+    exportAccessControlSecret(secret: string): Promise<ArrayBuffer>;
     private encryptDataWithKeys;
     private extractHmacFromRsaPrivate;
     private signDataWithDelegatorKeys;

package/icc-x-api/crypto/BaseExchangeDataManager.js

@@ -230,8 +230,8 @@ class BaseExchangeDataManager {
     createExchangeData(delegateId, signatureKeys, encryptionKeys, optionalAttributes = {}) {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            if (!Object.keys(signatureKeys).length || !Object.keys(encryptionKeys).length) {
-                throw new Error('Must specify at least one signature key and ');
+            if (!Object.keys(encryptionKeys).length) {
+                throw new Error('Must specify at least one encryption key ');
             }
             const exchangeKey = yield this.generateExchangeKey();
             const accessControlSecret = yield this.generateAccessControlSecret();
@@ -262,6 +262,7 @@ class BaseExchangeDataManager {
                 exchangeData: yield this.api.createExchangeData(exchangeData),
                 exchangeKey: exchangeKey.key,
                 accessControlSecret: accessControlSecret.secret,
+                sharedSignatureKey: sharedSignatureKey.key,
             };
         });
     }
@@ -293,14 +294,23 @@ class BaseExchangeDataManager {
             const rawSharedSignatureKey = yield this.tryDecrypt(exchangeData.sharedSignatureKey, decryptionKeys);
             if (!rawExchangeKey || !rawAccessControlSecret || !rawSharedSignatureKey)
                 return undefined;
-            return yield this.updateExchangeDataWithRawDecryptedContent(exchangeData, newEncryptionKeys, rawExchangeKey, rawAccessControlSecret, rawSharedSignatureKey);
+            return yield this.updateExchangeDataWithRawDecryptedContent({
+                exchangeData: exchangeData,
+                newEncryptionKeys: newEncryptionKeys,
+                rawExchangeKey: rawExchangeKey,
+                rawAccessControlSecret: rawAccessControlSecret,
+                rawSharedSignatureKey: rawSharedSignatureKey,
+                newDelegatorSignatureKeys: {},
+            });
         });
     }
     /**
      * Same as [tryUpdateExchangeData] but the decrypted content is already provided.
      */
-    updateExchangeDataWithRawDecryptedContent(exchangeData, newEncryptionKeys, rawExchangeKey, rawAccessControlSecret, rawSharedSignatureKey) {
+    updateExchangeDataWithRawDecryptedContent({ exchangeData, newEncryptionKeys, rawExchangeKey, rawAccessControlSecret, rawSharedSignatureKey, newDelegatorSignatureKeys, }) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
+            const self = yield this.dataOwnerApi.getCurrentDataOwnerId();
             const exchangeKey = yield this.importExchangeKey(new Uint8Array(rawExchangeKey));
             const accessControlSecret = yield this.importAccessControlSecret(new Uint8Array(rawAccessControlSecret));
             const sharedSignatureKey = yield this.importSharedSignatureKey(new Uint8Array(rawSharedSignatureKey));
@@ -308,7 +318,9 @@ class BaseExchangeDataManager {
             const existingAcsEntries = new Set(Object.keys(exchangeData.accessControlSecret));
             const existingSharedSignatureKeyEntries = new Set(Object.keys(exchangeData.sharedSignatureKey));
             const missingEntries = Object.keys(newEncryptionKeys).filter((fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp) || !existingSharedSignatureKeyEntries.has(fp));
-            if (!missingEntries.length)
+            const existingDelegatorSignatureEntries = new Set(Object.keys((_a = exchangeData.delegatorSignature) !== null && _a !== void 0 ? _a : {}));
+            const missingDelegatorSignatureEntries = exchangeData.delegator == self ? Object.keys(newDelegatorSignatureKeys).filter((fp) => !existingDelegatorSignatureEntries.has(fp)) : [];
+            if (!missingEntries.length && !missingDelegatorSignatureEntries.length)
                 return { exchangeData, exchangeKey, accessControlSecret };
             const encryptionKeysForMissingEntries = missingEntries.reduce((obj, fp) => {
                 obj[fp] = newEncryptionKeys[fp];
@@ -333,6 +345,14 @@ class BaseExchangeDataManager {
                     publicKeysFingerprintsV2: Object.keys(updatedExchangeData.exchangeKey),
                 }), sharedSignatureKey);
             }
+            if (missingDelegatorSignatureEntries.length > 0) {
+                const bytesToSign = yield this.bytesToSignForDelegatorSignature({ sharedSignatureKey });
+                const newSigned = yield this.signDataWithDelegatorKeys(bytesToSign, missingDelegatorSignatureEntries.reduce((obj, fp) => {
+                    obj[fp] = newDelegatorSignatureKeys[fp];
+                    return obj;
+                }, {}));
+                updatedExchangeData.delegatorSignature = Object.assign(Object.assign({}, updatedExchangeData.delegatorSignature), newSigned);
+            }
             return { exchangeData: yield this.api.modifyExchangeData(new ExchangeData_1.ExchangeData(updatedExchangeData)), exchangeKey, accessControlSecret };
         });
     }

package/icc-x-api/crypto/BaseExchangeDataManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"BaseExchangeDataManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/BaseExchangeDataManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,4EAAwE;AAExE,+CAA2C;AAE3C,oCAAoE;AACpE,4BAA2B;AAC3B,mCAA4D;AAC5D,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B;;;;GAIG;AACH,MAAa,uBAAuB;IAClC,YACW,GAAuB,EACf,YAA8B,EAC9B,UAA4B,EAC5B,gCAAyC,EACzC,eAAwB;QAJhC,QAAG,GAAH,GAAG,CAAoB;QACf,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,eAAU,GAAV,UAAU,CAAkB;QAC5B,qCAAgC,GAAhC,gCAAgC,CAAS;QACzC,oBAAe,GAAf,eAAe,CAAS;IACxC,CAAC;IAEJ;;;;;;OAMG;IACG,8CAA8C;;;YAClD,IAAI,CAAC,IAAI,CAAC,gCAAgC;gBAAE,OAAO,SAAS,CAAA;YAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAC5F,MAAM,YAAY,GAAG,MAAA,YAAY,CAAC,IAAI,mCAAI,EAAE,CAAA;YAC5C,OAAO,MAAA,YAAY,CAAC,WAAW,0CAAE,aAAa,EAAE;gBAC9C,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACrH,IAAI,YAAY,CAAC,IAAI;oBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;aAC/D;YACD,OAAO,YAAY,CAAA;;KACpB;IAED;;;;;OAKG;IACG,sCAAsC,CAAC,WAAmB,EAAE,UAAkB;;YAClF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACnF,CAAC;KAAA;IAED;;;;OAIG;IACG,mBAAmB,CAAC,cAAsB;;YAC9C,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpE,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;oBACjD,OAAO,SAAS,CAAA;iBACjB;;oBAAM,MAAM,CAAC,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAEK,oBAAoB,CAAC,eAAyB;;YAClD,IAAI,IAAI,CAAC,eAAe,EAAE;gBACxB,MAAM,GAAG,GAAmB,EAAE,CAAA;gBAC9B,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;wBAC1E,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,EAAE;4BAC3E,OAAO,SAAS,CAAA;yBACjB;;4BAAM,MAAM,CAAC,CAAA;oBAChB,CAAC,CAAC,CAAA;oBACF,IAAI,IAAI;wBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;iBACzB;gBACD,OAAO,GAAG,CAAA;aACX;iBAAM;gBACL,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;aACrE;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CACtB,IAKC,EACD,gBAA6C,EAC7C,iBAA0B;;YAE1B,IAAI,iBAAiB,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAA;YACxH,IAAI,iBAAiB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC;gBACpI,OAAO,KAAK,CAAA;YACd,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC;gBACnE,4BAA4B,EAAE,IAAI,CAAC,4BAA4B;gBAC/D,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS;gBACtC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;gBACpC,wBAAwB,EAAE;oBACxB,GAAG,IAAI,GAAG,CAAC;wBACT,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;wBAC7C,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC;wBACrD,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC;qBACrD,CAAC;iBACH;aACF,CAAC,CAAA;YACF,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,EAAE,IAAI,CAAC,2BAA2B,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;QACrI,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,6BAA6B,CACjC,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACzD,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,sBAAsB,CAC1B,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACjD,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,6BAA6B,CACjC,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACxD,CAAA;QACH,CAAC;KAAA;IAEa,sBAAsB,CAClC,YAA4B,EAC5B,cAAsE,EACtE,qBAAuF,EACvF,kBAA0D;;YAK1D,MAAM,qBAAqB,GAAQ,EAAE,CAAA;YACrC,MAAM,iBAAiB,GAAmB,EAAE,CAAA;YAC5C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;gBAC7B,IAAI;oBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAA;oBAClF,IAAI,SAAS,EAAE;wBACb,qBAAqB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAA;qBAChE;yBAAM;wBACL,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;qBAC3B;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;iBAC3B;aACF;YACD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAA;QACrD,CAAC;KAAA;IAEa,UAAU,CACtB,aAAyD,EACzD,cAAwE;;;YAExE,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC7E,uCACK,IAAI,KACP,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,IACvE;YACH,CAAC,EAAE,EAA4D,CAAC,CAAA;YAChE,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;gBAC3D,IAAI;oBACF,MAAM,GAAG,GAAG,MAAA,sBAAsB,CAAC,EAAE,CAAC,0CAAE,UAAU,CAAA;oBAClD,IAAI,GAAG;wBAAE,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAA;iBAC3E;gBAAC,OAAO,CAAC,EAAE;oBACV,uBAAuB;iBACxB;aACF;;KACF;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,UAAkB,EAClB,aAA0D,EAC1D,cAA2D,EAC3D,qBAEI,EAAE;;;YAMN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;gBAC7E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;aAChE;YACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAA;YACpD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAA;YACpE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAA;YAClE,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjG,MAAM,4BAA4B,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjH,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YAC/G,MAAM,gBAAgB,GAAG;gBACvB,EAAE,EAAE,MAAA,kBAAkB,CAAC,EAAE,mCAAI,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;gBACzD,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,oBAAoB;gBACjC,mBAAmB,EAAE,4BAA4B;gBACjD,kBAAkB,EAAE,2BAA2B;aAChD,CAAA;YACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACtD,MAAM,IAAI,CAAC,6BAA6B,CAAC;gBACvC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;gBACrC,4BAA4B,EAAE,mBAAmB,CAAC,MAAM;gBACxD,oBAAoB,EAAE,WAAW,CAAC,GAAG;gBACrC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,yBAAiB,CAAC;aAC7E,CAAC,EACF,kBAAkB,CAAC,GAAG,CACvB,CAAA;YACD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAC7D,MAAM,IAAI,CAAC,gCAAgC,CAAC;gBAC1C,kBAAkB,EAAE,kBAAkB,CAAC,GAAG;aAC3C,CAAC,EACF,aAAa,CACd,CAAA;YACD,MAAM,YAAY,GAAG,IAAI,2BAAY,iCAAM,gBAAgB,KAAE,kBAAkB,EAAE,eAAe,IAAG,CAAA;YACnG,OAAO;gBACL,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,GAAG;gBAC5B,mBAAmB,EAAE,mBAAmB,CAAC,MAAM;aAChD,CAAA;;KACF;IAEK,yBAAyB,CAC7B,YAA0B,EAC1B,cAAsE;;YAStE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;YACtF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;YACtG,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACpG,IAAI,CAAC,cAAc,IAAI,CAAC,sBAAsB,IAAI,CAAC,qBAAqB;gBAAE,OAAO,SAAS,CAAA;YAC1F,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,CAAA;QAC1E,CAAC;KAAA;IAED;;;;;;;;;;OAUG;IACG,qBAAqB,CACzB,YAA0B,EAC1B,cAAsE,EACtE,iBAA8D;;YAS9D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;YACtF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;YACtG,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACpG,IAAI,CAAC,cAAc,IAAI,CAAC,sBAAsB,IAAI,CAAC,qBAAqB;gBAAE,OAAO,SAAS,CAAA;YAC1F,OAAO,MAAM,IAAI,CAAC,yCAAyC,CACzD,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,CACtB,CAAA;QACH,CAAC;KAAA;IAED;;OAEG;IACG,yCAAyC,CAC7C,YAA0B,EAC1B,iBAA8D,EAC9D,cAA2B,EAC3B,sBAAmC,EACnC,qBAAkC;;YAMlC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;YAChF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAA;YACxG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAA;YACrG,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;YACjF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAA;YACjF,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAA;YAC/F,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAC1D,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC,CACzH,CAAA;YACD,IAAI,CAAC,cAAc,CAAC,MAAM;gBAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;YACrF,MAAM,+BAA+B,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;gBACxE,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;gBAC/B,OAAO,GAAG,CAAA;YACZ,CAAC,EAAE,EAAiD,CAAC,CAAA;YACrD,MAAM,mBAAmB,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YACrD,mBAAmB,CAAC,WAAW,mCAC1B,YAAY,CAAC,WAAW,GACxB,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC,CACrF,CAAA;YACD,mBAAmB,CAAC,mBAAmB,mCAClC,YAAY,CAAC,mBAAmB,GAChC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,+BAA+B,CAAC,CAAC,CAC7F,CAAA;YACD,mBAAmB,CAAC,kBAAkB,mCACjC,YAAY,CAAC,kBAAkB,GAC/B,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC,CAC5F,CAAA;YACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC9C;gBACE,YAAY;gBACZ,4BAA4B,EAAE,mBAAmB;gBACjD,oBAAoB,EAAE,WAAW;gBACjC,2BAA2B,EAAE,kBAAkB;aAChD,EACD,EAAE,EACF,KAAK,CACN,CAAA;YACD,IAAI,UAAU,EAAE;gBACd,mBAAmB,CAAC,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACpE,MAAM,IAAI,CAAC,6BAA6B,CAAC;oBACvC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ;oBACtC,SAAS,EAAE,mBAAmB,CAAC,SAAS;oBACxC,4BAA4B,EAAE,mBAAmB;oBACjD,oBAAoB,EAAE,WAAW;oBACjC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC;iBACvE,CAAC,EACF,kBAAkB,CACnB,CAAA;aACF;YACD,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,2BAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;QACrI,CAAC;KAAA;IAEa,6BAA6B,CAAC,IAM3C;;YACC,+GAA+G;YAC/G,wBAAwB;YACxB,MAAM,UAAU,GAAG;gBACjB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC7B,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;gBAC3B,CAAC,aAAa,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC9F,CAAC,qBAAqB,EAAE,IAAI,CAAC,4BAA4B,CAAC;gBAC1D,CAAC,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;aACjE,CAAA;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC3C,OAAO,IAAA,gBAAQ,EAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;KAAA;IAEa,gCAAgC,CAAC,IAAuC;;YACpF,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAC9F,CAAC;KAAA;IAED,+BAA+B;IACjB,mBAAmB;;YAI/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACtD,OAAO;gBACL,GAAG,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;gBAC3C,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEa,iBAAiB,CAAC,cAA2B;;YACzD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;QACnE,CAAC;KAAA;IAEa,iBAAiB,CAAC,GAAc;;YAC5C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACxD,CAAC;KAAA;IAEa,0BAA0B;;YAItC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;YACpD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;QACrE,CAAC;KAAA;IAEa,wBAAwB,CAAC,cAA2B;;YAChE,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC7D,CAAC;KAAA;IAEa,wBAAwB,CAAC,GAAc;;YACnD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAClD,CAAC;KAAA;IAED,wCAAwC;IAC1B,2BAA2B;;YAIvC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO;gBACL,MAAM,EAAE,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC;gBACtD,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEO,yBAAyB,CAAC,cAA2B;QAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,cAAc,CAAC,CAAC,CAAA;IAChD,CAAC;IAEO,yBAAyB,CAAC,MAAc;QAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,MAAM,CAAC,CAAC,CAAA;IACxC,CAAC;IAEa,mBAAmB,CAC/B,OAAoB,EACpB,IAAmD;;YAEnD,MAAM,GAAG,GAA+C,EAAE,CAAA;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;aAChI;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,yBAAyB,CAAC,aAAwB;;YAC9D,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,IAAI,UAAU,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC3F,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;aACjF;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC5E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC7D,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QACpE,CAAC;KAAA;IAEa,yBAAyB,CACrC,OAAoB,EACpB,IAAiD;;YAEjD,MAAM,GAAG,GAA6C,EAAE,CAAA;YACxD,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;aACzI;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,wBAAwB,CACpC,YAA0B,EAC1B,2BAAsC,EACtC,gBAA6D;;;YAE7D,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC;gBACzE,kBAAkB,EAAE,2BAA2B;aAChD,CAAC,CAAA;YACF,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAuB,EAAE,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAC7I,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,kBAAkB,mCAAI,EAAE,CAAC,EAAE;gBACnF,MAAM,eAAe,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;gBACtC,IACE,eAAe;oBACf,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,sBAAsB,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAC;oBAEtI,OAAO,IAAI,CAAA;aACd;YACD,OAAO,KAAK,CAAA;;KACb;IAEa,qBAAqB,CAAC,OAAoB,EAAE,GAAc;;YACtE,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC9E,CAAC;KAAA;IAEa,uBAAuB,CAAC,OAAoB,EAAE,GAAc,EAAE,SAAiB;;YAC3F,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAA;QAC5F,CAAC;KAAA;CACF;AAriBD,0DAqiBC","sourcesContent":["import { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair } from './RSA'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { IccExchangeDataApi } from '../../icc-api/api/internal/IccExchangeDataApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { b64_2ua, hex2ua, ua2b64, ua2hex, utf8_2ua } from '../utils'\nimport * as _ from 'lodash'\nimport { fingerprintIsV1, fingerprintV1toV2 } from './utils'\nimport XHRError = XHR.XHRError\n\n/**\n * @internal this class is intended for internal use only and may be modified without notice\n * Functions to create and get exchange data.\n * The methods of this api require to pass the appropriate keys for encryption/decryption manually.\n */\nexport class BaseExchangeDataManager {\n  constructor(\n    readonly api: IccExchangeDataApi,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly primitives: CryptoPrimitives,\n    private readonly selfRequiresAnonymousDelegations: boolean,\n    private readonly doNotUseBulkGet: boolean\n  ) {}\n\n  /**\n   * Get all the exchange data where the current data owner is the delegator or the delegate. However, some data owners, generally HCPs, may have a\n   * prohibitively high amount of exchange data. If the crypto strategies specify that the current data owner requires anonymous delegation this\n   * method returns all the exchange data found for the data owner, else the method returns undefined.\n   * @return all the exchange data for the current data owner or undefined if the crypto strategies don't allow to retrieve all data for the current\n   * data owner.\n   */\n  async getAllExchangeDataForCurrentDataOwnerIfAllowed(): Promise<ExchangeData[] | undefined> {\n    if (!this.selfRequiresAnonymousDelegations) return undefined\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    let latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, undefined, 1000)\n    const allRetrieved = latestResult.rows ?? []\n    while (latestResult.nextKeyPair?.startKeyDocId) {\n      latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, latestResult.nextKeyPair.startKeyDocId, 1000)\n      if (latestResult.rows) allRetrieved.push(...latestResult.rows)\n    }\n    return allRetrieved\n  }\n\n  /**\n   * Get all exchange data for the provided delegator-delegate pair.\n   * @param delegatorId id of a delegator data owner.\n   * @param delegateId id of a delegate data owner.\n   * @return all exchange data for the provided delegator-delegate pair.\n   */\n  async getExchangeDataByDelegatorDelegatePair(delegatorId: string, delegateId: string): Promise<ExchangeData[]> {\n    return await this.api.getExchangeDataByDelegatorDelegate(delegatorId, delegateId)\n  }\n\n  /**\n   * Get the exchange data with the provided id.\n   * @param exchangeDataId id of the exchange data.\n   * @return the exchange data with the provided id or undefined if no exchange data with such id could be found.\n   */\n  async getExchangeDataById(exchangeDataId: string): Promise<ExchangeData | undefined> {\n    return await this.api.getExchangeDataById(exchangeDataId).catch((e) => {\n      if (e instanceof XHRError && e.statusCode === 404) {\n        return undefined\n      } else throw e\n    })\n  }\n\n  async getExchangeDataByIds(exchangeDataIds: string[]): Promise<ExchangeData[]> {\n    if (this.doNotUseBulkGet) {\n      const res: ExchangeData[] = []\n      for (const exchangeDataId of exchangeDataIds) {\n        const curr = await this.api.getExchangeDataById(exchangeDataId).catch((e) => {\n          if (e instanceof XHRError && (e.statusCode === 404 || e.statusCode === 403)) {\n            return undefined\n          } else throw e\n        })\n        if (curr) res.push(curr)\n      }\n      return res\n    } else {\n      return await this.api.getExchangeDataByIds({ ids: exchangeDataIds })\n    }\n  }\n\n  /**\n   * Verifies the authenticity of the exchange data by checking the signature.\n   * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)\n   * will always be unverified.\n   * @param data collects the following information about the exchange data being verified:\n   * - exchangeData the exchange data to verify.\n   * - decryptedAccessControlSecret the access control secret decrypted from the exchange data.\n   * - decryptedExchangeKey the exchange key decrypted from the exchange data.\n   * - decryptedSharedSignatureKey the shared signature key decrypted from the exchange data.\n   * @param verificationKeys verification keys for delegator signature by fingerprint.\n   * @param verifyAsDelegator if true the method will also verify that the hmac key used for the signature was created by the delegator of the\n   * exchange data. If true and the data was not created by the current data owner this method will return false.\n   * @return the exchange data which could be verified given his signature and the available verification keys.\n   * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.\n   */\n  async verifyExchangeData(\n    data: {\n      exchangeData: ExchangeData\n      decryptedAccessControlSecret: string\n      decryptedExchangeKey: CryptoKey\n      decryptedSharedSignatureKey: CryptoKey\n    },\n    verificationKeys: { [fp: string]: CryptoKey },\n    verifyAsDelegator: boolean\n  ): Promise<boolean> {\n    if (verifyAsDelegator && data.exchangeData.delegator !== (await this.dataOwnerApi.getCurrentDataOwnerId())) return false\n    if (verifyAsDelegator && !(await this.verifyDelegatorSignature(data.exchangeData, data.decryptedSharedSignatureKey, verificationKeys)))\n      return false\n    const sharedSignatureData = await this.bytesToSignForSharedSignature({\n      decryptedAccessControlSecret: data.decryptedAccessControlSecret,\n      decryptedExchangeKey: data.decryptedExchangeKey,\n      delegator: data.exchangeData.delegator,\n      delegate: data.exchangeData.delegate,\n      publicKeysFingerprintsV2: [\n        ...new Set([\n          ...Object.keys(data.exchangeData.exchangeKey),\n          ...Object.keys(data.exchangeData.accessControlSecret),\n          ...Object.keys(data.exchangeData.sharedSignatureKey),\n        ]),\n      ],\n    })\n    return await this.verifyDataWithSharedKey(sharedSignatureData, data.decryptedSharedSignatureKey, data.exchangeData.sharedSignature)\n  }\n\n  /**\n   * Extracts and decrypts the access control secret from the provided exchange data.\n   * These need to be hashed together with the entity class and confidentiality level in order to get the actual access control key\n   * which will be sent to the server.\n   * @param exchangeData the exchange data from which to extract access control secrets.\n   * @param decryptionKeys rsa key pairs to use for decryption of the access control secret.\n   * @return an object composed of:\n   * - successfulDecryptions: array of all successfully decrypted access control keys\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptAccessControlSecret(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: string[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.accessControlSecret,\n      (d) => this.importAccessControlSecret(new Uint8Array(d))\n    )\n  }\n\n  /**\n   * Extract and decrypts the exchange keys from the provided exchange data.\n   * @param exchangeData the exchange data from which to extract exchange keys.\n   * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.\n   * @return an object composed of:\n   * - successfulDecryptions: array containing the successfully decrypted exchange keys.\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptExchangeKeys(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.exchangeKey,\n      (d) => this.importExchangeKey(new Uint8Array(d))\n    )\n  }\n\n  /**\n   * Extract and decrypts the shared signature key from the provided exchange data.\n   * @param exchangeData the exchange data from which to extract exchange keys.\n   * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.\n   * @return an object composed of:\n   * - successfulDecryptions: array containing the successfully decrypted exchange keys.\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptSharedSignatureKeys(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.sharedSignatureKey,\n      (d) => this.importSharedSignatureKey(new Uint8Array(d))\n    )\n  }\n\n  private async tryDecryptExchangeData<T>(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    encryptedDataSelector: (data: ExchangeData) => { [keyPairFingerprint: string]: string },\n    unmarshalDecrypted: (decrypted: ArrayBuffer) => Promise<T>\n  ): Promise<{\n    successfulDecryptions: T[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    const successfulDecryptions: T[] = []\n    const failedDecryptions: ExchangeData[] = []\n    for (const ed of exchangeData) {\n      try {\n        const decrypted = await this.tryDecrypt(encryptedDataSelector(ed), decryptionKeys)\n        if (decrypted) {\n          successfulDecryptions.push(await unmarshalDecrypted(decrypted))\n        } else {\n          failedDecryptions.push(ed)\n        }\n      } catch (e) {\n        failedDecryptions.push(ed)\n      }\n    }\n    return { successfulDecryptions, failedDecryptions }\n  }\n\n  private async tryDecrypt(\n    encryptedData: { [keyPairFingerprintV2: string]: string },\n    decryptionKeys: { [publicKeyFingerprintV1: string]: KeyPair<CryptoKey> }\n  ): Promise<ArrayBuffer | undefined> {\n    const decryptionKeysWithV2Fp = Object.keys(decryptionKeys).reduce((prev, fp) => {\n      return {\n        ...prev,\n        [fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp]: decryptionKeys[fp],\n      }\n    }, {} as { [publicKeyFingerprint: string]: KeyPair<CryptoKey> })\n    for (const [fp, encrypted] of Object.entries(encryptedData)) {\n      try {\n        const key = decryptionKeysWithV2Fp[fp]?.privateKey\n        if (key) return await this.primitives.RSA.decrypt(key, b64_2ua(encrypted))\n      } catch (e) {\n        // Try with another key\n      }\n    }\n  }\n\n  /**\n   * Creates exchange data from the current data owner to the provided delegate, uploading the newly created exchange data to the cloud.\n   * This assumes that the keys have been verified.\n   * @param delegateId id of the delegate for the new exchange data.\n   * @param signatureKeys private keys to use for signing the created data.\n   * @param encryptionKeys public keys to use for the encryption of the exchange data (from delegator and delegate).\n   * @param optionalAttributes optional precalculated attributes for the creation of data\n   * @return the newly created exchange data, and its decrypted exchange key and access control secret.\n   */\n  async createExchangeData(\n    delegateId: string,\n    signatureKeys: { [keyPairFingerprint: string]: CryptoKey },\n    encryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    optionalAttributes: {\n      id?: string\n    } = {}\n  ): Promise<{\n    exchangeData: ExchangeData\n    exchangeKey: CryptoKey\n    accessControlSecret: string\n  }> {\n    if (!Object.keys(signatureKeys).length || !Object.keys(encryptionKeys).length) {\n      throw new Error('Must specify at least one signature key and ')\n    }\n    const exchangeKey = await this.generateExchangeKey()\n    const accessControlSecret = await this.generateAccessControlSecret()\n    const sharedSignatureKey = await this.generateSharedSignatureKey()\n    const encryptedExchangeKey = await this.encryptDataWithKeys(exchangeKey.rawBytes, encryptionKeys)\n    const encryptedAccessControlSecret = await this.encryptDataWithKeys(accessControlSecret.rawBytes, encryptionKeys)\n    const encryptedSharedSignatureKey = await this.encryptDataWithKeys(sharedSignatureKey.rawBytes, encryptionKeys)\n    const baseExchangeData = {\n      id: optionalAttributes.id ?? this.primitives.randomUuid(),\n      delegator: await this.dataOwnerApi.getCurrentDataOwnerId(),\n      delegate: delegateId,\n      exchangeKey: encryptedExchangeKey,\n      accessControlSecret: encryptedAccessControlSecret,\n      sharedSignatureKey: encryptedSharedSignatureKey,\n    }\n    const sharedSignature = await this.signDataWithSharedKey(\n      await this.bytesToSignForSharedSignature({\n        delegate: baseExchangeData.delegate,\n        delegator: baseExchangeData.delegator,\n        decryptedAccessControlSecret: accessControlSecret.secret,\n        decryptedExchangeKey: exchangeKey.key,\n        publicKeysFingerprintsV2: Object.keys(encryptionKeys).map(fingerprintV1toV2),\n      }),\n      sharedSignatureKey.key\n    )\n    const delegatorSignature = await this.signDataWithDelegatorKeys(\n      await this.bytesToSignForDelegatorSignature({\n        sharedSignatureKey: sharedSignatureKey.key,\n      }),\n      signatureKeys\n    )\n    const exchangeData = new ExchangeData({ ...baseExchangeData, delegatorSignature, sharedSignature })\n    return {\n      exchangeData: await this.api.createExchangeData(exchangeData),\n      exchangeKey: exchangeKey.key,\n      accessControlSecret: accessControlSecret.secret,\n    }\n  }\n\n  async tryRawDecryptExchangeData(\n    exchangeData: ExchangeData,\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<\n    | {\n        rawExchangeKey: ArrayBuffer\n        rawAccessControlSecret: ArrayBuffer\n        rawSharedSignatureKey: ArrayBuffer\n      }\n    | undefined\n  > {\n    const rawExchangeKey = await this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys)\n    const rawAccessControlSecret = await this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys)\n    const rawSharedSignatureKey = await this.tryDecrypt(exchangeData.sharedSignatureKey, decryptionKeys)\n    if (!rawExchangeKey || !rawAccessControlSecret || !rawSharedSignatureKey) return undefined\n    return { rawExchangeKey, rawAccessControlSecret, rawSharedSignatureKey }\n  }\n\n  /**\n   * Updates existing exchange data and uploads it to the cloud in order to share it also with additional public keys, useful for example in cases\n   * where one of the data owners involved in the exchange data has lost one of his keys.\n   * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.\n   * This method assumes that the new encryption keys have been verified.\n   * @param exchangeData exchange data to update.\n   * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.\n   * @param newEncryptionKeys new keys to add to the exchange data.\n   * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not\n   * be decrypted and the exchange data could not be updated.\n   */\n  async tryUpdateExchangeData(\n    exchangeData: ExchangeData,\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    newEncryptionKeys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<\n    | {\n        exchangeData: ExchangeData\n        exchangeKey: CryptoKey\n        accessControlSecret: string\n      }\n    | undefined\n  > {\n    const rawExchangeKey = await this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys)\n    const rawAccessControlSecret = await this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys)\n    const rawSharedSignatureKey = await this.tryDecrypt(exchangeData.sharedSignatureKey, decryptionKeys)\n    if (!rawExchangeKey || !rawAccessControlSecret || !rawSharedSignatureKey) return undefined\n    return await this.updateExchangeDataWithRawDecryptedContent(\n      exchangeData,\n      newEncryptionKeys,\n      rawExchangeKey,\n      rawAccessControlSecret,\n      rawSharedSignatureKey\n    )\n  }\n\n  /**\n   * Same as [tryUpdateExchangeData] but the decrypted content is already provided.\n   */\n  async updateExchangeDataWithRawDecryptedContent(\n    exchangeData: ExchangeData,\n    newEncryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    rawExchangeKey: ArrayBuffer,\n    rawAccessControlSecret: ArrayBuffer,\n    rawSharedSignatureKey: ArrayBuffer\n  ): Promise<{\n    exchangeData: ExchangeData\n    exchangeKey: CryptoKey\n    accessControlSecret: string\n  }> {\n    const exchangeKey = await this.importExchangeKey(new Uint8Array(rawExchangeKey))\n    const accessControlSecret = await this.importAccessControlSecret(new Uint8Array(rawAccessControlSecret))\n    const sharedSignatureKey = await this.importSharedSignatureKey(new Uint8Array(rawSharedSignatureKey))\n    const existingExchangeKeyEntries = new Set(Object.keys(exchangeData.exchangeKey))\n    const existingAcsEntries = new Set(Object.keys(exchangeData.accessControlSecret))\n    const existingSharedSignatureKeyEntries = new Set(Object.keys(exchangeData.sharedSignatureKey))\n    const missingEntries = Object.keys(newEncryptionKeys).filter(\n      (fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp) || !existingSharedSignatureKeyEntries.has(fp)\n    )\n    if (!missingEntries.length) return { exchangeData, exchangeKey, accessControlSecret }\n    const encryptionKeysForMissingEntries = missingEntries.reduce((obj, fp) => {\n      obj[fp] = newEncryptionKeys[fp]\n      return obj\n    }, {} as { [keyPairFingerprint: string]: CryptoKey })\n    const updatedExchangeData = _.cloneDeep(exchangeData)\n    updatedExchangeData.exchangeKey = {\n      ...exchangeData.exchangeKey,\n      ...(await this.encryptDataWithKeys(rawExchangeKey, encryptionKeysForMissingEntries)),\n    }\n    updatedExchangeData.accessControlSecret = {\n      ...exchangeData.accessControlSecret,\n      ...(await this.encryptDataWithKeys(rawAccessControlSecret, encryptionKeysForMissingEntries)),\n    }\n    updatedExchangeData.sharedSignatureKey = {\n      ...exchangeData.sharedSignatureKey,\n      ...(await this.encryptDataWithKeys(rawSharedSignatureKey, encryptionKeysForMissingEntries)),\n    }\n    const isVerified = await this.verifyExchangeData(\n      {\n        exchangeData,\n        decryptedAccessControlSecret: accessControlSecret,\n        decryptedExchangeKey: exchangeKey,\n        decryptedSharedSignatureKey: sharedSignatureKey,\n      },\n      {},\n      false\n    )\n    if (isVerified) {\n      updatedExchangeData.sharedSignature = await this.signDataWithSharedKey(\n        await this.bytesToSignForSharedSignature({\n          delegate: updatedExchangeData.delegate,\n          delegator: updatedExchangeData.delegator,\n          decryptedAccessControlSecret: accessControlSecret,\n          decryptedExchangeKey: exchangeKey,\n          publicKeysFingerprintsV2: Object.keys(updatedExchangeData.exchangeKey),\n        }),\n        sharedSignatureKey\n      )\n    }\n    return { exchangeData: await this.api.modifyExchangeData(new ExchangeData(updatedExchangeData)), exchangeKey, accessControlSecret }\n  }\n\n  private async bytesToSignForSharedSignature(data: {\n    delegator: string\n    delegate: string\n    decryptedAccessControlSecret: string\n    decryptedExchangeKey: CryptoKey\n    publicKeysFingerprintsV2: string[]\n  }): Promise<ArrayBuffer> {\n    // Use array of array to ensure that order is preserved regardless of how the specific js implementation orders\n    // the keys of an object\n    const signObject = [\n      ['delegator', data.delegator],\n      ['delegate', data.delegate],\n      ['exchangeKey', ua2hex(await this.primitives.AES.exportKey(data.decryptedExchangeKey, 'raw'))],\n      ['accessControlSecret', data.decryptedAccessControlSecret],\n      ['publicKeysFingerprints', data.publicKeysFingerprintsV2.sort()],\n    ]\n    const signJson = JSON.stringify(signObject)\n    return utf8_2ua(signJson)\n  }\n\n  private async bytesToSignForDelegatorSignature(data: { sharedSignatureKey: CryptoKey }): Promise<ArrayBuffer> {\n    return this.primitives.sha256(await this.primitives.HMAC.exportKey(data.sharedSignatureKey))\n  }\n\n  // Generates a new exchange key\n  private async generateExchangeKey(): Promise<{\n    key: CryptoKey // the imported key\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = await this.primitives.randomBytes(32)\n    return {\n      key: await this.importExchangeKey(rawBytes),\n      rawBytes,\n    }\n  }\n\n  private async importExchangeKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey> {\n    return await this.primitives.AES.importKey('raw', decryptedBytes)\n  }\n\n  private async exportExchangeKey(key: CryptoKey): Promise<ArrayBuffer> {\n    return await this.primitives.AES.exportKey(key, 'raw')\n  }\n\n  private async generateSharedSignatureKey(): Promise<{\n    key: CryptoKey // the imported key\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const key = await this.primitives.HMAC.generateKey()\n    return { key, rawBytes: await this.primitives.HMAC.exportKey(key) }\n  }\n\n  private async importSharedSignatureKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey> {\n    return await this.primitives.HMAC.importKey(decryptedBytes)\n  }\n\n  private async exportSharedSignatureKey(key: CryptoKey): Promise<ArrayBuffer> {\n    return await this.primitives.HMAC.exportKey(key)\n  }\n\n  // Generates a new access control secret\n  private async generateAccessControlSecret(): Promise<{\n    secret: string // the imported secret\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = this.primitives.randomBytes(16)\n    return {\n      secret: await this.importAccessControlSecret(rawBytes),\n      rawBytes,\n    }\n  }\n\n  private importAccessControlSecret(decryptedBytes: ArrayBuffer): Promise<string> {\n    return Promise.resolve(ua2hex(decryptedBytes))\n  }\n\n  private exportAccessControlSecret(secret: string): Promise<ArrayBuffer> {\n    return Promise.resolve(hex2ua(secret))\n  }\n\n  private async encryptDataWithKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprintV1: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprintV2: string]: string }> {\n    const res: { [keyPairFingerprintV2: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp] = ua2b64(await this.primitives.RSA.encrypt(key, new Uint8Array(rawData)))\n    }\n    return res\n  }\n\n  private async extractHmacFromRsaPrivate(privateRsaKey: CryptoKey): Promise<CryptoKey> {\n    if (privateRsaKey.algorithm.name != 'RSA-OAEP' && !privateRsaKey.usages.includes('decrypt')) {\n      throw new Error('Internal error: got unexpected key for signature/verification')\n    }\n    const keyBytes = await this.primitives.RSA.exportKey(privateRsaKey, 'pkcs8')\n    const keyAsHmacBytes = await this.primitives.sha512(keyBytes)\n    return await this.primitives.HMAC.importKey(keyAsHmacBytes, false)\n  }\n\n  private async signDataWithDelegatorKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprint: string]: string }> {\n    const res: { [keyPairFingerprint: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fingerprintV1toV2(fp)] = ua2b64(await this.primitives.HMAC.sign(await this.extractHmacFromRsaPrivate(key), new Uint8Array(rawData)))\n    }\n    return res\n  }\n\n  private async verifyDelegatorSignature(\n    exchangeData: ExchangeData,\n    decryptedSharedSignatureKey: CryptoKey,\n    verificationKeys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<Boolean> {\n    const delegatorSignatureData = await this.bytesToSignForDelegatorSignature({\n      sharedSignatureKey: decryptedSharedSignatureKey,\n    })\n    const keysByV2Fp = Object.fromEntries(Object.entries(verificationKeys).map(([fp, key]): [string, CryptoKey] => [fingerprintV1toV2(fp), key]))\n    for (const [fp, signature] of Object.entries(exchangeData.delegatorSignature ?? {})) {\n      const verificationKey = keysByV2Fp[fp]\n      if (\n        verificationKey &&\n        (await this.primitives.HMAC.verify(await this.extractHmacFromRsaPrivate(verificationKey), delegatorSignatureData, b64_2ua(signature)))\n      )\n        return true\n    }\n    return false\n  }\n\n  private async signDataWithSharedKey(rawData: ArrayBuffer, key: CryptoKey): Promise<string> {\n    return ua2b64(await this.primitives.HMAC.sign(key, new Uint8Array(rawData)))\n  }\n\n  private async verifyDataWithSharedKey(rawData: ArrayBuffer, key: CryptoKey, signature: string): Promise<boolean> {\n    return await this.primitives.HMAC.verify(key, new Uint8Array(rawData), b64_2ua(signature))\n  }\n}\n"]}
+{"version":3,"file":"BaseExchangeDataManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/BaseExchangeDataManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,4EAAwE;AAExE,+CAA2C;AAE3C,oCAAoE;AACpE,4BAA2B;AAC3B,mCAA4D;AAC5D,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAE9B;;;;GAIG;AACH,MAAa,uBAAuB;IAClC,YACW,GAAuB,EACf,YAA8B,EAC9B,UAA4B,EAC5B,gCAAyC,EACzC,eAAwB;QAJhC,QAAG,GAAH,GAAG,CAAoB;QACf,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,eAAU,GAAV,UAAU,CAAkB;QAC5B,qCAAgC,GAAhC,gCAAgC,CAAS;QACzC,oBAAe,GAAf,eAAe,CAAS;IACxC,CAAC;IAEJ;;;;;;OAMG;IACG,8CAA8C;;;YAClD,IAAI,CAAC,IAAI,CAAC,gCAAgC;gBAAE,OAAO,SAAS,CAAA;YAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YACnE,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAC5F,MAAM,YAAY,GAAG,MAAA,YAAY,CAAC,IAAI,mCAAI,EAAE,CAAA;YAC5C,OAAO,MAAA,YAAY,CAAC,WAAW,0CAAE,aAAa,EAAE;gBAC9C,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACrH,IAAI,YAAY,CAAC,IAAI;oBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;aAC/D;YACD,OAAO,YAAY,CAAA;;KACpB;IAED;;;;;OAKG;IACG,sCAAsC,CAAC,WAAmB,EAAE,UAAkB;;YAClF,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACnF,CAAC;KAAA;IAED;;;;OAIG;IACG,mBAAmB,CAAC,cAAsB;;YAC9C,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpE,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;oBACjD,OAAO,SAAS,CAAA;iBACjB;;oBAAM,MAAM,CAAC,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAEK,oBAAoB,CAAC,eAAyB;;YAClD,IAAI,IAAI,CAAC,eAAe,EAAE;gBACxB,MAAM,GAAG,GAAmB,EAAE,CAAA;gBAC9B,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;wBAC1E,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,EAAE;4BAC3E,OAAO,SAAS,CAAA;yBACjB;;4BAAM,MAAM,CAAC,CAAA;oBAChB,CAAC,CAAC,CAAA;oBACF,IAAI,IAAI;wBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;iBACzB;gBACD,OAAO,GAAG,CAAA;aACX;iBAAM;gBACL,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;aACrE;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CACtB,IAKC,EACD,gBAA6C,EAC7C,iBAA0B;;YAE1B,IAAI,iBAAiB,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAA;YACxH,IAAI,iBAAiB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC;gBACpI,OAAO,KAAK,CAAA;YACd,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC;gBACnE,4BAA4B,EAAE,IAAI,CAAC,4BAA4B;gBAC/D,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS;gBACtC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;gBACpC,wBAAwB,EAAE;oBACxB,GAAG,IAAI,GAAG,CAAC;wBACT,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;wBAC7C,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC;wBACrD,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC;qBACrD,CAAC;iBACH;aACF,CAAC,CAAA;YACF,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,EAAE,IAAI,CAAC,2BAA2B,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;QACrI,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,6BAA6B,CACjC,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACzD,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,sBAAsB,CAC1B,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACjD,CAAA;QACH,CAAC;KAAA;IAED;;;;;;;OAOG;IACG,6BAA6B,CACjC,YAA4B,EAC5B,cAAsE;;YAKtE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CACtC,YAAY,EACZ,cAAc,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CACxD,CAAA;QACH,CAAC;KAAA;IAEa,sBAAsB,CAClC,YAA4B,EAC5B,cAAsE,EACtE,qBAAuF,EACvF,kBAA0D;;YAK1D,MAAM,qBAAqB,GAAQ,EAAE,CAAA;YACrC,MAAM,iBAAiB,GAAmB,EAAE,CAAA;YAC5C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE;gBAC7B,IAAI;oBACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAA;oBAClF,IAAI,SAAS,EAAE;wBACb,qBAAqB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAA;qBAChE;yBAAM;wBACL,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;qBAC3B;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;iBAC3B;aACF;YACD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAA;QACrD,CAAC;KAAA;IAEa,UAAU,CACtB,aAAyD,EACzD,cAAwE;;;YAExE,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC7E,uCACK,IAAI,KACP,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,IACvE;YACH,CAAC,EAAE,EAA4D,CAAC,CAAA;YAChE,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;gBAC3D,IAAI;oBACF,MAAM,GAAG,GAAG,MAAA,sBAAsB,CAAC,EAAE,CAAC,0CAAE,UAAU,CAAA;oBAClD,IAAI,GAAG;wBAAE,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAA;iBAC3E;gBAAC,OAAO,CAAC,EAAE;oBACV,uBAAuB;iBACxB;aACF;;KACF;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACtB,UAAkB,EAClB,aAA0D,EAC1D,cAA2D,EAC3D,qBAEI,EAAE;;;YAON,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;gBACvC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;aAC7D;YACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAA;YACpD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAA;YACpE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAA;YAClE,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjG,MAAM,4BAA4B,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YACjH,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;YAC/G,MAAM,gBAAgB,GAAG;gBACvB,EAAE,EAAE,MAAA,kBAAkB,CAAC,EAAE,mCAAI,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;gBACzD,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,oBAAoB;gBACjC,mBAAmB,EAAE,4BAA4B;gBACjD,kBAAkB,EAAE,2BAA2B;aAChD,CAAA;YACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACtD,MAAM,IAAI,CAAC,6BAA6B,CAAC;gBACvC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;gBACrC,4BAA4B,EAAE,mBAAmB,CAAC,MAAM;gBACxD,oBAAoB,EAAE,WAAW,CAAC,GAAG;gBACrC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,yBAAiB,CAAC;aAC7E,CAAC,EACF,kBAAkB,CAAC,GAAG,CACvB,CAAA;YACD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAC7D,MAAM,IAAI,CAAC,gCAAgC,CAAC;gBAC1C,kBAAkB,EAAE,kBAAkB,CAAC,GAAG;aAC3C,CAAC,EACF,aAAa,CACd,CAAA;YACD,MAAM,YAAY,GAAG,IAAI,2BAAY,iCAAM,gBAAgB,KAAE,kBAAkB,EAAE,eAAe,IAAG,CAAA;YACnG,OAAO;gBACL,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,GAAG;gBAC5B,mBAAmB,EAAE,mBAAmB,CAAC,MAAM;gBAC/C,kBAAkB,EAAE,kBAAkB,CAAC,GAAG;aAC3C,CAAA;;KACF;IAEK,yBAAyB,CAC7B,YAA0B,EAC1B,cAAsE;;YAStE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;YACtF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;YACtG,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACpG,IAAI,CAAC,cAAc,IAAI,CAAC,sBAAsB,IAAI,CAAC,qBAAqB;gBAAE,OAAO,SAAS,CAAA;YAC1F,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,CAAA;QAC1E,CAAC;KAAA;IAED;;;;;;;;;;OAUG;IACG,qBAAqB,CACzB,YAA0B,EAC1B,cAAsE,EACtE,iBAA8D;;YAS9D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;YACtF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAA;YACtG,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACpG,IAAI,CAAC,cAAc,IAAI,CAAC,sBAAsB,IAAI,CAAC,qBAAqB;gBAAE,OAAO,SAAS,CAAA;YAC1F,OAAO,MAAM,IAAI,CAAC,yCAAyC,CAAC;gBAC1D,YAAY,EAAE,YAAY;gBAC1B,iBAAiB,EAAE,iBAAiB;gBACpC,cAAc,EAAE,cAAc;gBAC9B,sBAAsB,EAAE,sBAAsB;gBAC9C,qBAAqB,EAAE,qBAAqB;gBAC5C,yBAAyB,EAAE,EAAE;aAC9B,CAAC,CAAA;QACJ,CAAC;KAAA;IAED;;OAEG;IACG,yCAAyC,CAAC,EAC9C,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,GAQ1B;;;YAKC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;YAChF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAA;YACxG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAA;YACrG,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;YACjF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAA;YACjF,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAA;YAC/F,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAC1D,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC,CACzH,CAAA;YACD,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,YAAY,CAAC,kBAAkB,mCAAI,EAAE,CAAC,CAAC,CAAA;YACrG,MAAM,gCAAgC,GACpC,YAAY,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACzI,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,gCAAgC,CAAC,MAAM;gBAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;YACjI,MAAM,+BAA+B,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;gBACxE,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;gBAC/B,OAAO,GAAG,CAAA;YACZ,CAAC,EAAE,EAAiD,CAAC,CAAA;YACrD,MAAM,mBAAmB,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YACrD,mBAAmB,CAAC,WAAW,mCAC1B,YAAY,CAAC,WAAW,GACxB,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC,CACrF,CAAA;YACD,mBAAmB,CAAC,mBAAmB,mCAClC,YAAY,CAAC,mBAAmB,GAChC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,+BAA+B,CAAC,CAAC,CAC7F,CAAA;YACD,mBAAmB,CAAC,kBAAkB,mCACjC,YAAY,CAAC,kBAAkB,GAC/B,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC,CAC5F,CAAA;YACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC9C;gBACE,YAAY;gBACZ,4BAA4B,EAAE,mBAAmB;gBACjD,oBAAoB,EAAE,WAAW;gBACjC,2BAA2B,EAAE,kBAAkB;aAChD,EACD,EAAE,EACF,KAAK,CACN,CAAA;YACD,IAAI,UAAU,EAAE;gBACd,mBAAmB,CAAC,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACpE,MAAM,IAAI,CAAC,6BAA6B,CAAC;oBACvC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ;oBACtC,SAAS,EAAE,mBAAmB,CAAC,SAAS;oBACxC,4BAA4B,EAAE,mBAAmB;oBACjD,oBAAoB,EAAE,WAAW;oBACjC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC;iBACvE,CAAC,EACF,kBAAkB,CACnB,CAAA;aACF;YACD,IAAI,gCAAgC,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBACvF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACpD,WAAW,EACX,gCAAgC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;oBAClD,GAAG,CAAC,EAAE,CAAC,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAA;oBACvC,OAAO,GAAG,CAAA;gBACZ,CAAC,EAAE,EAAiD,CAAC,CACtD,CAAA;gBACD,mBAAmB,CAAC,kBAAkB,mCACjC,mBAAmB,CAAC,kBAAkB,GACtC,SAAS,CACb,CAAA;aACF;YACD,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,2BAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;;KACpI;IAEa,6BAA6B,CAAC,IAM3C;;YACC,+GAA+G;YAC/G,wBAAwB;YACxB,MAAM,UAAU,GAAG;gBACjB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC7B,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;gBAC3B,CAAC,aAAa,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC9F,CAAC,qBAAqB,EAAE,IAAI,CAAC,4BAA4B,CAAC;gBAC1D,CAAC,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;aACjE,CAAA;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC3C,OAAO,IAAA,gBAAQ,EAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;KAAA;IAEa,gCAAgC,CAAC,IAAuC;;YACpF,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAC9F,CAAC;KAAA;IAED,+BAA+B;IACjB,mBAAmB;;YAI/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACtD,OAAO;gBACL,GAAG,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;gBAC3C,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAEK,iBAAiB,CAAC,cAA2B;;YACjD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;QACnE,CAAC;KAAA;IAEK,iBAAiB,CAAC,GAAc;;YACpC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACxD,CAAC;KAAA;IAEa,0BAA0B;;YAItC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;YACpD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;QACrE,CAAC;KAAA;IAEK,wBAAwB,CAAC,cAA2B;;YACxD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC7D,CAAC;KAAA;IAEK,wBAAwB,CAAC,GAAc;;YAC3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAClD,CAAC;KAAA;IAED,wCAAwC;IAC1B,2BAA2B;;YAIvC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO;gBACL,MAAM,EAAE,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC;gBACtD,QAAQ;aACT,CAAA;QACH,CAAC;KAAA;IAED,yBAAyB,CAAC,cAA2B;QACnD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,cAAc,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,yBAAyB,CAAC,MAAc;QACtC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,cAAM,EAAC,MAAM,CAAC,CAAC,CAAA;IACxC,CAAC;IAEa,mBAAmB,CAC/B,OAAoB,EACpB,IAAmD;;YAEnD,MAAM,GAAG,GAA+C,EAAE,CAAA;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,IAAA,uBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;aAChI;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,yBAAyB,CAAC,aAAwB;;YAC9D,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,IAAI,UAAU,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC3F,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;aACjF;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC5E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC7D,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QACpE,CAAC;KAAA;IAEa,yBAAyB,CACrC,OAAoB,EACpB,IAAiD;;YAEjD,MAAM,GAAG,GAA6C,EAAE,CAAA;YACxD,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC5C,GAAG,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,CAAC,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;aACzI;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,wBAAwB,CACpC,YAA0B,EAC1B,2BAAsC,EACtC,gBAA6D;;;YAE7D,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC;gBACzE,kBAAkB,EAAE,2BAA2B;aAChD,CAAC,CAAA;YACF,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAuB,EAAE,CAAC,CAAC,IAAA,yBAAiB,EAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAC7I,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,kBAAkB,mCAAI,EAAE,CAAC,EAAE;gBACnF,MAAM,eAAe,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;gBACtC,IACE,eAAe;oBACf,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,sBAAsB,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAC;oBAEtI,OAAO,IAAI,CAAA;aACd;YACD,OAAO,KAAK,CAAA;;KACb;IAEa,qBAAqB,CAAC,OAAoB,EAAE,GAAc;;YACtE,OAAO,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC9E,CAAC;KAAA;IAEa,uBAAuB,CAAC,OAAoB,EAAE,GAAc,EAAE,SAAiB;;YAC3F,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,CAAA;QAC5F,CAAC;KAAA;CACF;AAlkBD,0DAkkBC","sourcesContent":["import { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { KeyPair } from './RSA'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { IccExchangeDataApi } from '../../icc-api/api/internal/IccExchangeDataApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { b64_2ua, hex2ua, ua2b64, ua2hex, utf8_2ua } from '../utils'\nimport * as _ from 'lodash'\nimport { fingerprintIsV1, fingerprintV1toV2 } from './utils'\nimport XHRError = XHR.XHRError\n\n/**\n * @internal this class is intended for internal use only and may be modified without notice\n * Functions to create and get exchange data.\n * The methods of this api require to pass the appropriate keys for encryption/decryption manually.\n */\nexport class BaseExchangeDataManager {\n  constructor(\n    readonly api: IccExchangeDataApi,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly primitives: CryptoPrimitives,\n    private readonly selfRequiresAnonymousDelegations: boolean,\n    private readonly doNotUseBulkGet: boolean\n  ) {}\n\n  /**\n   * Get all the exchange data where the current data owner is the delegator or the delegate. However, some data owners, generally HCPs, may have a\n   * prohibitively high amount of exchange data. If the crypto strategies specify that the current data owner requires anonymous delegation this\n   * method returns all the exchange data found for the data owner, else the method returns undefined.\n   * @return all the exchange data for the current data owner or undefined if the crypto strategies don't allow to retrieve all data for the current\n   * data owner.\n   */\n  async getAllExchangeDataForCurrentDataOwnerIfAllowed(): Promise<ExchangeData[] | undefined> {\n    if (!this.selfRequiresAnonymousDelegations) return undefined\n    const dataOwnerId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    let latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, undefined, 1000)\n    const allRetrieved = latestResult.rows ?? []\n    while (latestResult.nextKeyPair?.startKeyDocId) {\n      latestResult = await this.api.getExchangeDataByParticipant(dataOwnerId, latestResult.nextKeyPair.startKeyDocId, 1000)\n      if (latestResult.rows) allRetrieved.push(...latestResult.rows)\n    }\n    return allRetrieved\n  }\n\n  /**\n   * Get all exchange data for the provided delegator-delegate pair.\n   * @param delegatorId id of a delegator data owner.\n   * @param delegateId id of a delegate data owner.\n   * @return all exchange data for the provided delegator-delegate pair.\n   */\n  async getExchangeDataByDelegatorDelegatePair(delegatorId: string, delegateId: string): Promise<ExchangeData[]> {\n    return await this.api.getExchangeDataByDelegatorDelegate(delegatorId, delegateId)\n  }\n\n  /**\n   * Get the exchange data with the provided id.\n   * @param exchangeDataId id of the exchange data.\n   * @return the exchange data with the provided id or undefined if no exchange data with such id could be found.\n   */\n  async getExchangeDataById(exchangeDataId: string): Promise<ExchangeData | undefined> {\n    return await this.api.getExchangeDataById(exchangeDataId).catch((e) => {\n      if (e instanceof XHRError && e.statusCode === 404) {\n        return undefined\n      } else throw e\n    })\n  }\n\n  async getExchangeDataByIds(exchangeDataIds: string[]): Promise<ExchangeData[]> {\n    if (this.doNotUseBulkGet) {\n      const res: ExchangeData[] = []\n      for (const exchangeDataId of exchangeDataIds) {\n        const curr = await this.api.getExchangeDataById(exchangeDataId).catch((e) => {\n          if (e instanceof XHRError && (e.statusCode === 404 || e.statusCode === 403)) {\n            return undefined\n          } else throw e\n        })\n        if (curr) res.push(curr)\n      }\n      return res\n    } else {\n      return await this.api.getExchangeDataByIds({ ids: exchangeDataIds })\n    }\n  }\n\n  /**\n   * Verifies the authenticity of the exchange data by checking the signature.\n   * Note that all exchange data created by data owners other than the current data owner (including members of his hierarchy)\n   * will always be unverified.\n   * @param data collects the following information about the exchange data being verified:\n   * - exchangeData the exchange data to verify.\n   * - decryptedAccessControlSecret the access control secret decrypted from the exchange data.\n   * - decryptedExchangeKey the exchange key decrypted from the exchange data.\n   * - decryptedSharedSignatureKey the shared signature key decrypted from the exchange data.\n   * @param verificationKeys verification keys for delegator signature by fingerprint.\n   * @param verifyAsDelegator if true the method will also verify that the hmac key used for the signature was created by the delegator of the\n   * exchange data. If true and the data was not created by the current data owner this method will return false.\n   * @return the exchange data which could be verified given his signature and the available verification keys.\n   * @throws if any of the provided exchange data has been created by a data owner other than the current data owner.\n   */\n  async verifyExchangeData(\n    data: {\n      exchangeData: ExchangeData\n      decryptedAccessControlSecret: string\n      decryptedExchangeKey: CryptoKey\n      decryptedSharedSignatureKey: CryptoKey\n    },\n    verificationKeys: { [fp: string]: CryptoKey },\n    verifyAsDelegator: boolean\n  ): Promise<boolean> {\n    if (verifyAsDelegator && data.exchangeData.delegator !== (await this.dataOwnerApi.getCurrentDataOwnerId())) return false\n    if (verifyAsDelegator && !(await this.verifyDelegatorSignature(data.exchangeData, data.decryptedSharedSignatureKey, verificationKeys)))\n      return false\n    const sharedSignatureData = await this.bytesToSignForSharedSignature({\n      decryptedAccessControlSecret: data.decryptedAccessControlSecret,\n      decryptedExchangeKey: data.decryptedExchangeKey,\n      delegator: data.exchangeData.delegator,\n      delegate: data.exchangeData.delegate,\n      publicKeysFingerprintsV2: [\n        ...new Set([\n          ...Object.keys(data.exchangeData.exchangeKey),\n          ...Object.keys(data.exchangeData.accessControlSecret),\n          ...Object.keys(data.exchangeData.sharedSignatureKey),\n        ]),\n      ],\n    })\n    return await this.verifyDataWithSharedKey(sharedSignatureData, data.decryptedSharedSignatureKey, data.exchangeData.sharedSignature)\n  }\n\n  /**\n   * Extracts and decrypts the access control secret from the provided exchange data.\n   * These need to be hashed together with the entity class and confidentiality level in order to get the actual access control key\n   * which will be sent to the server.\n   * @param exchangeData the exchange data from which to extract access control secrets.\n   * @param decryptionKeys rsa key pairs to use for decryption of the access control secret.\n   * @return an object composed of:\n   * - successfulDecryptions: array of all successfully decrypted access control keys\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptAccessControlSecret(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: string[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.accessControlSecret,\n      (d) => this.importAccessControlSecret(new Uint8Array(d))\n    )\n  }\n\n  /**\n   * Extract and decrypts the exchange keys from the provided exchange data.\n   * @param exchangeData the exchange data from which to extract exchange keys.\n   * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.\n   * @return an object composed of:\n   * - successfulDecryptions: array containing the successfully decrypted exchange keys.\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptExchangeKeys(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.exchangeKey,\n      (d) => this.importExchangeKey(new Uint8Array(d))\n    )\n  }\n\n  /**\n   * Extract and decrypts the shared signature key from the provided exchange data.\n   * @param exchangeData the exchange data from which to extract exchange keys.\n   * @param decryptionKeys rsa key pairs to use for the decryption of the exchange keys.\n   * @return an object composed of:\n   * - successfulDecryptions: array containing the successfully decrypted exchange keys.\n   * - failedDecryptions: array containing all exchange data for which the access control key could not be decrypted (using the provided keys).\n   */\n  async tryDecryptSharedSignatureKeys(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<{\n    successfulDecryptions: CryptoKey[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    return await this.tryDecryptExchangeData(\n      exchangeData,\n      decryptionKeys,\n      (ed) => ed.sharedSignatureKey,\n      (d) => this.importSharedSignatureKey(new Uint8Array(d))\n    )\n  }\n\n  private async tryDecryptExchangeData<T>(\n    exchangeData: ExchangeData[],\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    encryptedDataSelector: (data: ExchangeData) => { [keyPairFingerprint: string]: string },\n    unmarshalDecrypted: (decrypted: ArrayBuffer) => Promise<T>\n  ): Promise<{\n    successfulDecryptions: T[]\n    failedDecryptions: ExchangeData[]\n  }> {\n    const successfulDecryptions: T[] = []\n    const failedDecryptions: ExchangeData[] = []\n    for (const ed of exchangeData) {\n      try {\n        const decrypted = await this.tryDecrypt(encryptedDataSelector(ed), decryptionKeys)\n        if (decrypted) {\n          successfulDecryptions.push(await unmarshalDecrypted(decrypted))\n        } else {\n          failedDecryptions.push(ed)\n        }\n      } catch (e) {\n        failedDecryptions.push(ed)\n      }\n    }\n    return { successfulDecryptions, failedDecryptions }\n  }\n\n  private async tryDecrypt(\n    encryptedData: { [keyPairFingerprintV2: string]: string },\n    decryptionKeys: { [publicKeyFingerprintV1: string]: KeyPair<CryptoKey> }\n  ): Promise<ArrayBuffer | undefined> {\n    const decryptionKeysWithV2Fp = Object.keys(decryptionKeys).reduce((prev, fp) => {\n      return {\n        ...prev,\n        [fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp]: decryptionKeys[fp],\n      }\n    }, {} as { [publicKeyFingerprint: string]: KeyPair<CryptoKey> })\n    for (const [fp, encrypted] of Object.entries(encryptedData)) {\n      try {\n        const key = decryptionKeysWithV2Fp[fp]?.privateKey\n        if (key) return await this.primitives.RSA.decrypt(key, b64_2ua(encrypted))\n      } catch (e) {\n        // Try with another key\n      }\n    }\n  }\n\n  /**\n   * Creates exchange data from the current data owner to the provided delegate, uploading the newly created exchange data to the cloud.\n   * This assumes that the keys have been verified.\n   * @param delegateId id of the delegate for the new exchange data.\n   * @param signatureKeys private keys to use for signing the created data.\n   * @param encryptionKeys public keys to use for the encryption of the exchange data (from delegator and delegate).\n   * @param optionalAttributes optional precalculated attributes for the creation of data\n   * @return the newly created exchange data, and its decrypted exchange key and access control secret.\n   */\n  async createExchangeData(\n    delegateId: string,\n    signatureKeys: { [keyPairFingerprint: string]: CryptoKey },\n    encryptionKeys: { [keyPairFingerprint: string]: CryptoKey },\n    optionalAttributes: {\n      id?: string\n    } = {}\n  ): Promise<{\n    exchangeData: ExchangeData\n    exchangeKey: CryptoKey\n    accessControlSecret: string\n    sharedSignatureKey: CryptoKey\n  }> {\n    if (!Object.keys(encryptionKeys).length) {\n      throw new Error('Must specify at least one encryption key ')\n    }\n    const exchangeKey = await this.generateExchangeKey()\n    const accessControlSecret = await this.generateAccessControlSecret()\n    const sharedSignatureKey = await this.generateSharedSignatureKey()\n    const encryptedExchangeKey = await this.encryptDataWithKeys(exchangeKey.rawBytes, encryptionKeys)\n    const encryptedAccessControlSecret = await this.encryptDataWithKeys(accessControlSecret.rawBytes, encryptionKeys)\n    const encryptedSharedSignatureKey = await this.encryptDataWithKeys(sharedSignatureKey.rawBytes, encryptionKeys)\n    const baseExchangeData = {\n      id: optionalAttributes.id ?? this.primitives.randomUuid(),\n      delegator: await this.dataOwnerApi.getCurrentDataOwnerId(),\n      delegate: delegateId,\n      exchangeKey: encryptedExchangeKey,\n      accessControlSecret: encryptedAccessControlSecret,\n      sharedSignatureKey: encryptedSharedSignatureKey,\n    }\n    const sharedSignature = await this.signDataWithSharedKey(\n      await this.bytesToSignForSharedSignature({\n        delegate: baseExchangeData.delegate,\n        delegator: baseExchangeData.delegator,\n        decryptedAccessControlSecret: accessControlSecret.secret,\n        decryptedExchangeKey: exchangeKey.key,\n        publicKeysFingerprintsV2: Object.keys(encryptionKeys).map(fingerprintV1toV2),\n      }),\n      sharedSignatureKey.key\n    )\n    const delegatorSignature = await this.signDataWithDelegatorKeys(\n      await this.bytesToSignForDelegatorSignature({\n        sharedSignatureKey: sharedSignatureKey.key,\n      }),\n      signatureKeys\n    )\n    const exchangeData = new ExchangeData({ ...baseExchangeData, delegatorSignature, sharedSignature })\n    return {\n      exchangeData: await this.api.createExchangeData(exchangeData),\n      exchangeKey: exchangeKey.key,\n      accessControlSecret: accessControlSecret.secret,\n      sharedSignatureKey: sharedSignatureKey.key,\n    }\n  }\n\n  async tryRawDecryptExchangeData(\n    exchangeData: ExchangeData,\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> }\n  ): Promise<\n    | {\n        rawExchangeKey: ArrayBuffer\n        rawAccessControlSecret: ArrayBuffer\n        rawSharedSignatureKey: ArrayBuffer\n      }\n    | undefined\n  > {\n    const rawExchangeKey = await this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys)\n    const rawAccessControlSecret = await this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys)\n    const rawSharedSignatureKey = await this.tryDecrypt(exchangeData.sharedSignatureKey, decryptionKeys)\n    if (!rawExchangeKey || !rawAccessControlSecret || !rawSharedSignatureKey) return undefined\n    return { rawExchangeKey, rawAccessControlSecret, rawSharedSignatureKey }\n  }\n\n  /**\n   * Updates existing exchange data and uploads it to the cloud in order to share it also with additional public keys, useful for example in cases\n   * where one of the data owners involved in the exchange data has lost one of his keys.\n   * If the content of the exchange data could not be decrypted using the provided keys the method will not update anything and will return undefined.\n   * This method assumes that the new encryption keys have been verified.\n   * @param exchangeData exchange data to update.\n   * @param decryptionKeys keys to use to extract the content of the exchange data which will be shared with the new keys.\n   * @param newEncryptionKeys new keys to add to the exchange data.\n   * @return the updated exchange data, and its decrypted exchange key and access control secret, or undefined if the exchange data content could not\n   * be decrypted and the exchange data could not be updated.\n   */\n  async tryUpdateExchangeData(\n    exchangeData: ExchangeData,\n    decryptionKeys: { [publicKeyFingerprint: string]: KeyPair<CryptoKey> },\n    newEncryptionKeys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<\n    | {\n        exchangeData: ExchangeData\n        exchangeKey: CryptoKey\n        accessControlSecret: string\n      }\n    | undefined\n  > {\n    const rawExchangeKey = await this.tryDecrypt(exchangeData.exchangeKey, decryptionKeys)\n    const rawAccessControlSecret = await this.tryDecrypt(exchangeData.accessControlSecret, decryptionKeys)\n    const rawSharedSignatureKey = await this.tryDecrypt(exchangeData.sharedSignatureKey, decryptionKeys)\n    if (!rawExchangeKey || !rawAccessControlSecret || !rawSharedSignatureKey) return undefined\n    return await this.updateExchangeDataWithRawDecryptedContent({\n      exchangeData: exchangeData,\n      newEncryptionKeys: newEncryptionKeys,\n      rawExchangeKey: rawExchangeKey,\n      rawAccessControlSecret: rawAccessControlSecret,\n      rawSharedSignatureKey: rawSharedSignatureKey,\n      newDelegatorSignatureKeys: {},\n    })\n  }\n\n  /**\n   * Same as [tryUpdateExchangeData] but the decrypted content is already provided.\n   */\n  async updateExchangeDataWithRawDecryptedContent({\n    exchangeData,\n    newEncryptionKeys,\n    rawExchangeKey,\n    rawAccessControlSecret,\n    rawSharedSignatureKey,\n    newDelegatorSignatureKeys,\n  }: {\n    exchangeData: ExchangeData\n    newEncryptionKeys: { [fp: string]: CryptoKey }\n    newDelegatorSignatureKeys: { [keyPairFingerprint: string]: CryptoKey }\n    rawExchangeKey: ArrayBuffer\n    rawAccessControlSecret: ArrayBuffer\n    rawSharedSignatureKey: ArrayBuffer\n  }): Promise<{\n    exchangeData: ExchangeData\n    exchangeKey: CryptoKey\n    accessControlSecret: string\n  }> {\n    const self = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const exchangeKey = await this.importExchangeKey(new Uint8Array(rawExchangeKey))\n    const accessControlSecret = await this.importAccessControlSecret(new Uint8Array(rawAccessControlSecret))\n    const sharedSignatureKey = await this.importSharedSignatureKey(new Uint8Array(rawSharedSignatureKey))\n    const existingExchangeKeyEntries = new Set(Object.keys(exchangeData.exchangeKey))\n    const existingAcsEntries = new Set(Object.keys(exchangeData.accessControlSecret))\n    const existingSharedSignatureKeyEntries = new Set(Object.keys(exchangeData.sharedSignatureKey))\n    const missingEntries = Object.keys(newEncryptionKeys).filter(\n      (fp) => !existingAcsEntries.has(fp) || !existingExchangeKeyEntries.has(fp) || !existingSharedSignatureKeyEntries.has(fp)\n    )\n    const existingDelegatorSignatureEntries = new Set(Object.keys(exchangeData.delegatorSignature ?? {}))\n    const missingDelegatorSignatureEntries =\n      exchangeData.delegator == self ? Object.keys(newDelegatorSignatureKeys).filter((fp) => !existingDelegatorSignatureEntries.has(fp)) : []\n    if (!missingEntries.length && !missingDelegatorSignatureEntries.length) return { exchangeData, exchangeKey, accessControlSecret }\n    const encryptionKeysForMissingEntries = missingEntries.reduce((obj, fp) => {\n      obj[fp] = newEncryptionKeys[fp]\n      return obj\n    }, {} as { [keyPairFingerprint: string]: CryptoKey })\n    const updatedExchangeData = _.cloneDeep(exchangeData)\n    updatedExchangeData.exchangeKey = {\n      ...exchangeData.exchangeKey,\n      ...(await this.encryptDataWithKeys(rawExchangeKey, encryptionKeysForMissingEntries)),\n    }\n    updatedExchangeData.accessControlSecret = {\n      ...exchangeData.accessControlSecret,\n      ...(await this.encryptDataWithKeys(rawAccessControlSecret, encryptionKeysForMissingEntries)),\n    }\n    updatedExchangeData.sharedSignatureKey = {\n      ...exchangeData.sharedSignatureKey,\n      ...(await this.encryptDataWithKeys(rawSharedSignatureKey, encryptionKeysForMissingEntries)),\n    }\n    const isVerified = await this.verifyExchangeData(\n      {\n        exchangeData,\n        decryptedAccessControlSecret: accessControlSecret,\n        decryptedExchangeKey: exchangeKey,\n        decryptedSharedSignatureKey: sharedSignatureKey,\n      },\n      {},\n      false\n    )\n    if (isVerified) {\n      updatedExchangeData.sharedSignature = await this.signDataWithSharedKey(\n        await this.bytesToSignForSharedSignature({\n          delegate: updatedExchangeData.delegate,\n          delegator: updatedExchangeData.delegator,\n          decryptedAccessControlSecret: accessControlSecret,\n          decryptedExchangeKey: exchangeKey,\n          publicKeysFingerprintsV2: Object.keys(updatedExchangeData.exchangeKey),\n        }),\n        sharedSignatureKey\n      )\n    }\n    if (missingDelegatorSignatureEntries.length > 0) {\n      const bytesToSign = await this.bytesToSignForDelegatorSignature({ sharedSignatureKey })\n      const newSigned = await this.signDataWithDelegatorKeys(\n        bytesToSign,\n        missingDelegatorSignatureEntries.reduce((obj, fp) => {\n          obj[fp] = newDelegatorSignatureKeys[fp]\n          return obj\n        }, {} as { [keyPairFingerprint: string]: CryptoKey })\n      )\n      updatedExchangeData.delegatorSignature = {\n        ...updatedExchangeData.delegatorSignature,\n        ...newSigned,\n      }\n    }\n    return { exchangeData: await this.api.modifyExchangeData(new ExchangeData(updatedExchangeData)), exchangeKey, accessControlSecret }\n  }\n\n  private async bytesToSignForSharedSignature(data: {\n    delegator: string\n    delegate: string\n    decryptedAccessControlSecret: string\n    decryptedExchangeKey: CryptoKey\n    publicKeysFingerprintsV2: string[]\n  }): Promise<ArrayBuffer> {\n    // Use array of array to ensure that order is preserved regardless of how the specific js implementation orders\n    // the keys of an object\n    const signObject = [\n      ['delegator', data.delegator],\n      ['delegate', data.delegate],\n      ['exchangeKey', ua2hex(await this.primitives.AES.exportKey(data.decryptedExchangeKey, 'raw'))],\n      ['accessControlSecret', data.decryptedAccessControlSecret],\n      ['publicKeysFingerprints', data.publicKeysFingerprintsV2.sort()],\n    ]\n    const signJson = JSON.stringify(signObject)\n    return utf8_2ua(signJson)\n  }\n\n  private async bytesToSignForDelegatorSignature(data: { sharedSignatureKey: CryptoKey }): Promise<ArrayBuffer> {\n    return this.primitives.sha256(await this.primitives.HMAC.exportKey(data.sharedSignatureKey))\n  }\n\n  // Generates a new exchange key\n  private async generateExchangeKey(): Promise<{\n    key: CryptoKey // the imported key\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = await this.primitives.randomBytes(32)\n    return {\n      key: await this.importExchangeKey(rawBytes),\n      rawBytes,\n    }\n  }\n\n  async importExchangeKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey> {\n    return await this.primitives.AES.importKey('raw', decryptedBytes)\n  }\n\n  async exportExchangeKey(key: CryptoKey): Promise<ArrayBuffer> {\n    return await this.primitives.AES.exportKey(key, 'raw')\n  }\n\n  private async generateSharedSignatureKey(): Promise<{\n    key: CryptoKey // the imported key\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const key = await this.primitives.HMAC.generateKey()\n    return { key, rawBytes: await this.primitives.HMAC.exportKey(key) }\n  }\n\n  async importSharedSignatureKey(decryptedBytes: ArrayBuffer): Promise<CryptoKey> {\n    return await this.primitives.HMAC.importKey(decryptedBytes)\n  }\n\n  async exportSharedSignatureKey(key: CryptoKey): Promise<ArrayBuffer> {\n    return await this.primitives.HMAC.exportKey(key)\n  }\n\n  // Generates a new access control secret\n  private async generateAccessControlSecret(): Promise<{\n    secret: string // the imported secret\n    rawBytes: ArrayBuffer // the bytes to encrypt for in the exchange data\n  }> {\n    const rawBytes = this.primitives.randomBytes(16)\n    return {\n      secret: await this.importAccessControlSecret(rawBytes),\n      rawBytes,\n    }\n  }\n\n  importAccessControlSecret(decryptedBytes: ArrayBuffer): Promise<string> {\n    return Promise.resolve(ua2hex(decryptedBytes))\n  }\n\n  exportAccessControlSecret(secret: string): Promise<ArrayBuffer> {\n    return Promise.resolve(hex2ua(secret))\n  }\n\n  private async encryptDataWithKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprintV1: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprintV2: string]: string }> {\n    const res: { [keyPairFingerprintV2: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fingerprintIsV1(fp) ? fingerprintV1toV2(fp) : fp] = ua2b64(await this.primitives.RSA.encrypt(key, new Uint8Array(rawData)))\n    }\n    return res\n  }\n\n  private async extractHmacFromRsaPrivate(privateRsaKey: CryptoKey): Promise<CryptoKey> {\n    if (privateRsaKey.algorithm.name != 'RSA-OAEP' && !privateRsaKey.usages.includes('decrypt')) {\n      throw new Error('Internal error: got unexpected key for signature/verification')\n    }\n    const keyBytes = await this.primitives.RSA.exportKey(privateRsaKey, 'pkcs8')\n    const keyAsHmacBytes = await this.primitives.sha512(keyBytes)\n    return await this.primitives.HMAC.importKey(keyAsHmacBytes, false)\n  }\n\n  private async signDataWithDelegatorKeys(\n    rawData: ArrayBuffer,\n    keys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<{ [keyPairFingerprint: string]: string }> {\n    const res: { [keyPairFingerprint: string]: string } = {}\n    for (const [fp, key] of Object.entries(keys)) {\n      res[fingerprintV1toV2(fp)] = ua2b64(await this.primitives.HMAC.sign(await this.extractHmacFromRsaPrivate(key), new Uint8Array(rawData)))\n    }\n    return res\n  }\n\n  private async verifyDelegatorSignature(\n    exchangeData: ExchangeData,\n    decryptedSharedSignatureKey: CryptoKey,\n    verificationKeys: { [keyPairFingerprint: string]: CryptoKey }\n  ): Promise<Boolean> {\n    const delegatorSignatureData = await this.bytesToSignForDelegatorSignature({\n      sharedSignatureKey: decryptedSharedSignatureKey,\n    })\n    const keysByV2Fp = Object.fromEntries(Object.entries(verificationKeys).map(([fp, key]): [string, CryptoKey] => [fingerprintV1toV2(fp), key]))\n    for (const [fp, signature] of Object.entries(exchangeData.delegatorSignature ?? {})) {\n      const verificationKey = keysByV2Fp[fp]\n      if (\n        verificationKey &&\n        (await this.primitives.HMAC.verify(await this.extractHmacFromRsaPrivate(verificationKey), delegatorSignatureData, b64_2ua(signature)))\n      )\n        return true\n    }\n    return false\n  }\n\n  private async signDataWithSharedKey(rawData: ArrayBuffer, key: CryptoKey): Promise<string> {\n    return ua2b64(await this.primitives.HMAC.sign(key, new Uint8Array(rawData)))\n  }\n\n  private async verifyDataWithSharedKey(rawData: ArrayBuffer, key: CryptoKey, signature: string): Promise<boolean> {\n    return await this.primitives.HMAC.verify(key, new Uint8Array(rawData), b64_2ua(signature))\n  }\n}\n"]}

package/icc-x-api/crypto/CryptoStrategies.d.ts

@@ -65,8 +65,9 @@ export interface CryptoStrategies {
      * - If this method returns a key pair the crypto api loads the key pair and considers it as a device key.
      * - If this method returns false the initialisation will fail with a predefined error.
      * - If this method throws an error the initialisation will propagate the error.
+     * - If this method return the string "keyless" the api will be initialized in keyless mode.
      */
-    generateNewKeyForDataOwner(self: DataOwnerWithType, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean>;
+    generateNewKeyForDataOwner(self: DataOwnerWithType, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean | 'keyless'>;
     /**
      * Verifies if the public keys of a data owner which will be the delegate of a new exchange key do actually belong to the person the data owner
      * represents. This method is not called when the delegate would be the current data owner for the api.

package/icc-x-api/crypto/CryptoStrategies.js.map

@@ -1 +1 @@
-{"version":3,"file":"CryptoStrategies.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/CryptoStrategies.ts"],"names":[],"mappings":"","sourcesContent":["import { KeyPair } from './RSA'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { DataOwnerWithType } from '../../icc-api/model/DataOwnerWithType'\nimport { KeyPairRecoverer } from './KeyPairRecoverer'\n\n/**\n * Allows to customise the behaviour of the crypto api to better suit your needs.\n *\n * An important task which should be done in these crypto strategies is public key verification: in general there is no guarantee that the public keys\n * stored in the iCure database are authentic, i.e. created by the data owner they are associated to. This is because the database admins or a\n * malicious attacker may have added his own public keys to the data owner's public keys.\n * Sharing any kind of data using unverified public keys could potentially cause a data leak: this is why when creating new exchange keys or when\n * creating recovery data only verified keys will be considered. For decrypting existing data instead unverified keys will be used without issues.\n */\nexport interface CryptoStrategies {\n  /**\n   * Method called during initialisation of the crypto API to validate keys recovered through iCure's recovery methods and/or to allow recovery of\n   * missing keys using means external to iCure.\n   * On startup the iCure sdk will try to load all keys for the current data owner and its parent hierarchy: if the sdk can't find some of the keys\n   * for any of the data owners (according to the public keys for the data owner in the iCure server) and/or the sdk could recover some private keys\n   * but can't verify the authenticity of the key pairs this method will be called.\n   * The recovered and verified keys will automatically be cached using the current api {@link KeyStorageFacade} and {@link StorageFacade}\n   *\n   * The input is an array containing an object for each data owner part of the current data owner hierarchy. The objects are ordered from the data\n   * for the topmost parent of the current data owner hierarchy (first element) to the data for the current data owner (last element). Each object\n   * contains:\n   * - dataOwner: the data owner entity that this object refers to\n   * - unknownKeys: all public keys (in hex-encoded spki format) of `dataOwner` for which the authenticity status (verified or unverified) is unknown\n   *   (no result was cached from a previous api instantiation and the key was not generated on the current device).\n   * - unavailableKeys: all public keys (in hex-encoded spki format) of `dataOwner` for which the sdk could not recover a private key. May overlap\n   *   (partially or completely) with `unknownKeys`.\n   *\n   * The returned value must be an object associating to each data owner id an object with:\n   * - `recoveredKeys`: all recovered keys (will be automatically considered as verified), by fingerprint.\n   * - `keyAuthenticity`: an object associating to each public key fingerprint its authenticity. Note that if any of the keys from `unknownKeys` is\n   *   completely missing from this object the key will be considered as unverified in this api instance (same as if associated to false), but this\n   *   value won't be cached (will be again part of `unknownKeys` in future instances.\n   * @param keysData all information on unknown and unavailable keys for each data owner part of the current data owner hierarchy.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @param keyPairRecoverer a key pair recoverer.\n   * @return all recovered keys and key authenticity information, by data owner.\n   */\n  recoverAndVerifySelfHierarchyKeys(\n    keysData: {\n      dataOwner: DataOwnerWithType\n      unknownKeys: string[]\n      unavailableKeys: string[]\n    }[],\n    cryptoPrimitives: CryptoPrimitives,\n    keyPairRecoverer: KeyPairRecoverer\n  ): Promise<{\n    [dataOwnerId: string]: {\n      recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n      keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n    }\n  }>\n\n  /**\n   * The correct initialisation of the crypto API requires that at least 1 verified (or device) key pair is available for each data owner part of the\n   * current data owner hierarchy. If no verified key is available for any of the data owner parents the api initialisation will automatically fail,\n   * however if there is no verified key for the current data owner you can instead create a new crypto key.\n   * @param self the current data owner.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @return depending on which values you return the api initialisation will proceed differently:\n   * - If this method returns true a new key will be automatically generated by the sdk.\n   * - If this method returns a key pair the crypto api loads the key pair and considers it as a device key.\n   * - If this method returns false the initialisation will fail with a predefined error.\n   * - If this method throws an error the initialisation will propagate the error.\n   */\n  generateNewKeyForDataOwner(self: DataOwnerWithType, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean>\n\n  /**\n   * Verifies if the public keys of a data owner which will be the delegate of a new exchange key do actually belong to the person the data owner\n   * represents. This method is not called when the delegate would be the current data owner for the api.\n   *\n   * The user will have to obtain the verified public keys of the delegate from outside iCure, for example by email with another hcp, by checking the\n   * personal website of the other user, or by scanning verification qr codes at the doctor office...\n   *\n   * As long as one of the public keys is verified the creation of a new exchange key will succeed. If no public key is verified the operation will\n   * fail.\n   * @param delegate the potential data owner delegate.\n   * @param publicKeys public keys requiring verification, in spki hex-encoded format.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @return all verified public keys, in spki hex-encoded format.\n   */\n  verifyDelegatePublicKeys(delegate: CryptoActorStubWithType, publicKeys: string[], cryptoPrimitives: CryptoPrimitives): Promise<string[]>\n\n  /**\n   * Specifies if a data owner requires anonymous delegations, i.e. his id should not appear unencrypted in new secure delegations. This should always\n   * be the case for patient data owners.\n   * @param dataOwner a data owner.\n   * @return true if the delegations for the provided data owner should be anonymous.\n   */\n  dataOwnerRequiresAnonymousDelegation(dataOwner: CryptoActorStubWithType): boolean\n}\n"]}
+{"version":3,"file":"CryptoStrategies.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/CryptoStrategies.ts"],"names":[],"mappings":"","sourcesContent":["import { KeyPair } from './RSA'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { DataOwnerWithType } from '../../icc-api/model/DataOwnerWithType'\nimport { KeyPairRecoverer } from './KeyPairRecoverer'\n\n/**\n * Allows to customise the behaviour of the crypto api to better suit your needs.\n *\n * An important task which should be done in these crypto strategies is public key verification: in general there is no guarantee that the public keys\n * stored in the iCure database are authentic, i.e. created by the data owner they are associated to. This is because the database admins or a\n * malicious attacker may have added his own public keys to the data owner's public keys.\n * Sharing any kind of data using unverified public keys could potentially cause a data leak: this is why when creating new exchange keys or when\n * creating recovery data only verified keys will be considered. For decrypting existing data instead unverified keys will be used without issues.\n */\nexport interface CryptoStrategies {\n  /**\n   * Method called during initialisation of the crypto API to validate keys recovered through iCure's recovery methods and/or to allow recovery of\n   * missing keys using means external to iCure.\n   * On startup the iCure sdk will try to load all keys for the current data owner and its parent hierarchy: if the sdk can't find some of the keys\n   * for any of the data owners (according to the public keys for the data owner in the iCure server) and/or the sdk could recover some private keys\n   * but can't verify the authenticity of the key pairs this method will be called.\n   * The recovered and verified keys will automatically be cached using the current api {@link KeyStorageFacade} and {@link StorageFacade}\n   *\n   * The input is an array containing an object for each data owner part of the current data owner hierarchy. The objects are ordered from the data\n   * for the topmost parent of the current data owner hierarchy (first element) to the data for the current data owner (last element). Each object\n   * contains:\n   * - dataOwner: the data owner entity that this object refers to\n   * - unknownKeys: all public keys (in hex-encoded spki format) of `dataOwner` for which the authenticity status (verified or unverified) is unknown\n   *   (no result was cached from a previous api instantiation and the key was not generated on the current device).\n   * - unavailableKeys: all public keys (in hex-encoded spki format) of `dataOwner` for which the sdk could not recover a private key. May overlap\n   *   (partially or completely) with `unknownKeys`.\n   *\n   * The returned value must be an object associating to each data owner id an object with:\n   * - `recoveredKeys`: all recovered keys (will be automatically considered as verified), by fingerprint.\n   * - `keyAuthenticity`: an object associating to each public key fingerprint its authenticity. Note that if any of the keys from `unknownKeys` is\n   *   completely missing from this object the key will be considered as unverified in this api instance (same as if associated to false), but this\n   *   value won't be cached (will be again part of `unknownKeys` in future instances.\n   * @param keysData all information on unknown and unavailable keys for each data owner part of the current data owner hierarchy.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @param keyPairRecoverer a key pair recoverer.\n   * @return all recovered keys and key authenticity information, by data owner.\n   */\n  recoverAndVerifySelfHierarchyKeys(\n    keysData: {\n      dataOwner: DataOwnerWithType\n      unknownKeys: string[]\n      unavailableKeys: string[]\n    }[],\n    cryptoPrimitives: CryptoPrimitives,\n    keyPairRecoverer: KeyPairRecoverer\n  ): Promise<{\n    [dataOwnerId: string]: {\n      recoveredKeys: { [keyPairFingerprint: string]: KeyPair<CryptoKey> }\n      keyAuthenticity: { [keyPairFingerprint: string]: boolean }\n    }\n  }>\n\n  /**\n   * The correct initialisation of the crypto API requires that at least 1 verified (or device) key pair is available for each data owner part of the\n   * current data owner hierarchy. If no verified key is available for any of the data owner parents the api initialisation will automatically fail,\n   * however if there is no verified key for the current data owner you can instead create a new crypto key.\n   * @param self the current data owner.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @return depending on which values you return the api initialisation will proceed differently:\n   * - If this method returns true a new key will be automatically generated by the sdk.\n   * - If this method returns a key pair the crypto api loads the key pair and considers it as a device key.\n   * - If this method returns false the initialisation will fail with a predefined error.\n   * - If this method throws an error the initialisation will propagate the error.\n   * - If this method return the string \"keyless\" the api will be initialized in keyless mode.\n   */\n  generateNewKeyForDataOwner(self: DataOwnerWithType, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean | 'keyless'>\n\n  /**\n   * Verifies if the public keys of a data owner which will be the delegate of a new exchange key do actually belong to the person the data owner\n   * represents. This method is not called when the delegate would be the current data owner for the api.\n   *\n   * The user will have to obtain the verified public keys of the delegate from outside iCure, for example by email with another hcp, by checking the\n   * personal website of the other user, or by scanning verification qr codes at the doctor office...\n   *\n   * As long as one of the public keys is verified the creation of a new exchange key will succeed. If no public key is verified the operation will\n   * fail.\n   * @param delegate the potential data owner delegate.\n   * @param publicKeys public keys requiring verification, in spki hex-encoded format.\n   * @param cryptoPrimitives cryptographic primitives you can use to support the process.\n   * @return all verified public keys, in spki hex-encoded format.\n   */\n  verifyDelegatePublicKeys(delegate: CryptoActorStubWithType, publicKeys: string[], cryptoPrimitives: CryptoPrimitives): Promise<string[]>\n\n  /**\n   * Specifies if a data owner requires anonymous delegations, i.e. his id should not appear unencrypted in new secure delegations. This should always\n   * be the case for patient data owners.\n   * @param dataOwner a data owner.\n   * @return true if the delegations for the provided data owner should be anonymous.\n   */\n  dataOwnerRequiresAnonymousDelegation(dataOwner: CryptoActorStubWithType): boolean\n}\n"]}

package/icc-x-api/crypto/DelegationsDeAnonymization.js

@@ -228,7 +228,7 @@ class DelegationsDeAnonymization {
                 delegate: delegationMembersDetails.delegate,
                 delegator: delegationMembersDetails.delegator,
                 delegationKey: delegationKey,
-            }, entityType, undefined, undefined, true, Object.fromEntries(initialDelegates.map((x) => [x, AccessLevelEnum.READ])));
+            }, entityType, undefined, undefined, true, Object.fromEntries(initialDelegates.map((x) => [x, AccessLevelEnum.READ])), undefined);
             const encryptedKeyMap = (yield this.xapis.tryEncryptEntities([initalisedMapInfo.updatedEntity], entityType, this.delegationKeyMapFieldsToEncrypt, false, true, (x) => new SecureDelegationKeyMap_1.SecureDelegationKeyMap(x)))[0];
             yield this.delegationKeyMapApi.create(encryptedKeyMap, new XHR_1.XHR.Header(AccessControlKeysHeadersProvider_1.ACCESS_CONTROL_KEYS_HEADER, yield this.accessControlSecretUtils.getEncodedAccessControlKeys([delegationMembersDetails.accessControlSecret], entityType)));
         });

package/icc-x-api/crypto/DelegationsDeAnonymization.js.map

@@ -1 +1 @@
-{"version":3,"file":"DelegationsDeAnonymization.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/DelegationsDeAnonymization.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2EAAuE;AACvE,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,gGAA4F;AAE5F,qEAAiE;AACjE,wFAAoF;AACpF,IAAO,uBAAuB,GAAG,uCAAkB,CAAC,uBAAuB,CAAA;AAE3E,oCAAwE;AACxE,0GAAsG;AACtG,+CAA2C;AAC3C,2EAAiG;AACjG,yFAAiH;AAKjH,6CAA6C;AAC7C,MAAa,0BAA0B;IAIrC,YACmB,YAA8B,EAC9B,yBAAoD,EACpD,KAAwB,EACxB,gBAAkC,EAClC,wBAAkD,EACnE,IAAY,EACZ,OAAkC,EAClC,yBAAiD,IAAI,iDAAwB,EAAE,EAC/E,YAA2E,OAAO,MAAM,KAAK,WAAW;QACtG,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,KAAK,EACQ,gCAAkE;QAblE,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,UAAK,GAAL,KAAK,CAAmB;QACxB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,6BAAwB,GAAxB,wBAAwB,CAA0B;QASlD,qCAAgC,GAAhC,gCAAgC,CAAkC;QAEnF,IAAI,CAAC,+BAA+B,GAAG,IAAA,4BAAoB,EAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,wBAAwB,CAAC,CAAA;QAChH,IAAI,CAAC,mBAAmB,GAAG,IAAI,2DAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAA;IAC/G,CAAC;IAED;;;;OAIG;IACG,iCAAiC,CAAC,cAAuC,EAAE,mBAA6B;;YAC5G,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAChI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;oBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;wBACzB,OAAO,CAAC,KAAK,CAAC,CAAA;qBACf;yBAAM;wBACL,OAAO,EAAE,CAAA;qBACV;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAyC,CAAA;YAC7H,CAAC,CACF,CAAA;YACD,MAAM,+BAA+B,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACxF,kEAAkE;gBAClE,OAAO,CAAC,cAAc,CAAC,aAAa,CAAA;YACtC,CAAC,CAAC,CAAA;YACF,4IAA4I;YAC5I,MAAM,mCAAmC,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACzG,+FAA+F;gBAC/F,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAA;YACxG,CAAC,CAAC,CAAA;YACF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAC3E,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChD,cAAc,CAAC,IAAI,CACpB,CAAA;YACD,KAAK,MAAM,aAAa,IAAI,sBAAsB,EAAE;gBAClD,MAAM,IAAI,CAAC,gCAAgC,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAA;aACrG;YACD,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;YAC9F,MAAM,mBAAmB,GAAG,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACtH,KAAK,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,mBAAmB,EAAE;gBAC1D,MAAM,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAA;aAC1G;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,yBAAyB,CAAC,cAAuC;;;YAIrE,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC3B,MAAM,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC;gBACrE;oBACE,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,CAAC,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzI,6BAA6B,EAAE,KAAK;iBACrC;aACF,CAAC,CAAA;;KACH;IAEa,0CAA0C,CAAC,cAAuC;;YAI9F,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAA;YAC/G,MAAM,kCAAkC,GAAG,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBACxH,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;oBACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;wBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;4BACzB,OAAO,CAAC,KAAK,CAAC,CAAA;yBACf;6BAAM;4BACL,OAAO,EAAE,CAAA;yBACV;oBACH,CAAC,CAAC,CAAA;oBACF,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;iBAC1D;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,sCAAsC,GAAG,MAAM,CAAC,WAAW,CAC/D,CACE,MAAM,IAAI,CAAC,mCAAmC,CAC5C,kCAAkC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAC9D,cAAc,CAAC,IAAI,CACpB,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CACnC,CAAA;YACD,MAAM,wBAAwB,GAA+C,EAAE,CAAA;YAC/E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,SAAS,SAAS,CAAC,WAAmB,EAAE,KAAsB;gBAC5D,IAAI,wBAAwB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;oBACnE,wBAAwB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;iBAC9C;YACH,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE;gBAC/D,IAAI,UAAU,CAAC,QAAQ;oBAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;gBAC/E,IAAI,UAAU,CAAC,SAAS;oBAAE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;aAClF;YACD,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,kCAAkC,EAAE;gBACrE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9B,MAAM,OAAO,GAAG,sCAAsC,CAAC,CAAC,CAAC,CAAA;oBACzD,OAAO,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;gBAC7D,CAAC,CAAC,CAAA;gBACF,IAAI,OAAO,EAAE;oBACX,MAAM,MAAM,GAAG,sCAAsC,CAAC,OAAO,CAAC,CAAA;oBAC9D,SAAS,CAAC,MAAM,CAAC,QAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;oBACnD,SAAS,CAAC,MAAM,CAAC,SAAU,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBACrD;qBAAM;oBACL,6BAA6B,GAAG,IAAI,CAAA;iBACrC;aACF;YACD,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,CAAA;QACpE,CAAC;KAAA;IAEa,gBAAgB,CAC5B,MAGG;;YAKH,MAAM,sBAAsB,GAA+C,EAAE,CAAA;YAC7E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;gBACtB,6BAA6B,GAAG,6BAA6B,IAAI,CAAC,CAAC,6BAA6B,CAAA;gBAChG,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE;oBAC7E,IAAI,sBAAsB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;wBACjE,sBAAsB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;qBAC5C;iBACF;aACF;YACD,OAAO;gBACL,wBAAwB,EAAE,sBAAsB;gBAChD,6BAA6B;aAC9B,CAAA;QACH,CAAC;KAAA;IAEa,mCAAmC,CAC/C,aAAuB,EACvB,UAAwC;;YAExC,IAAI,aAAa,CAAC,MAAM,EAAE;gBACxB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CACtE,EAAE,GAAG,EAAE,aAAa,EAAE,EACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;gBACD,MAAM,GAAG,GAA6B,EAAE,CAAA;gBACxC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;oBACxC,+BAA+B;oBAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBACnI,IAAI,gBAAgB,CAAC,SAAS,EAAE;wBAC9B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;qBAClC;iBACF;gBACD,OAAO,GAAG,CAAA;aACX;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,gCAAgC,CAAC,UAAwC,EAAE,MAA8B,EAAE,SAAmB;;YAC1I,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;YAC3H,MAAM,0CAA0C,GAAG,MAAM,CAAC,MAAM,CAC9D,MAAM,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAAC;gBAC9D,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;aACf,CAAC,CACH;iBACE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;iBACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAa,CAAA;YACjC,8GAA8G;YAC9G,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,0CAA0C,CAAC,CAAC,CAAA;YAC7H,MAAM,sBAAsB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACzF,IAAI,sBAAsB,CAAC,MAAM,EAAE;gBACjC,CAAC;gBAAA,CACC,MAAM,IAAI,CAAC,KAAK,CAAC,0CAA0C,CACzD;oBACE,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,UAAU;iBACjB,EACD,MAAM,CAAC,WAAW,CAChB,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAChC,CAAC;oBACD;wBACE,cAAc,EAAE,EAAE;wBAClB,mBAAmB,EAAE,+CAAsB,CAAC,QAAQ;wBACpD,oBAAoB,EAAE,+CAAsB,CAAC,KAAK;wBAClD,oBAAoB,EAAE,uBAAuB,CAAC,SAAS;qBACxD;iBACF,CAAC,CACH,EACD,CAAO,OAAO,EAAE,EAAE;oBAChB,OAAA,IAAI,CAAC,mBAAmB,CAAC,+BAA+B,CACtD,OAAO,EACP,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;kBAAA,CACJ,CACF,CAAC,oBAAoB,CAAA;aACvB;QACH,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,4BAA4B,CACxC,UAAwC,EACxC,aAAqB,EACrB,wBAAkD,EAClD,SAAmB;;YAEnB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,IAAI,CAAC,wBAAwB,CAAC,SAAS,IAAI,CAAC,wBAAwB,CAAC,mBAAmB;gBAC5H,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAA;YAC7H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAChE,2IAA2I;YAC3I,4IAA4I;YAC5I,MAAM,gBAAgB,GAAG,CAAC,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAA;YAC3I,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAC/E;gBACE,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE;gBACtC,QAAQ,EAAE,wBAAwB,CAAC,QAAQ;gBAC3C,SAAS,EAAE,wBAAwB,CAAC,SAAS;gBAC7C,aAAa,EAAE,aAAa;aAC7B,EACD,UAAU,EACV,SAAS,EACT,SAAS,EACT,IAAI,EACJ,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAC3E,CAAA;YACD,MAAM,eAAe,GAAG,CACtB,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACjC,CAAC,iBAAiB,CAAC,aAAa,CAAC,EACjC,UAAU,EACV,IAAI,CAAC,+BAA+B,EACpC,KAAK,EACL,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CACrC,CACF,CAAC,CAAC,CAAC,CAAA;YACJ,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CACnC,eAAe,EACf,IAAI,SAAG,CAAC,MAAM,CACZ,6DAA0B,EAC1B,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,UAAU,CAAC,CAC5H,CACF,CAAA;QACH,CAAC;KAAA;CACF;AA9QD,gEA8QC","sourcesContent":["import { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecureDelegationKeyMap } from '../../icc-api/model/internal/SecureDelegationKeyMap'\nimport { ExtendedApisUtils } from './ExtendedApisUtils'\nimport { ShareMetadataBehaviour } from './ShareMetadataBehaviour'\nimport { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport RequestedPermissionEnum = EntityShareRequest.RequestedPermissionEnum\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { EncryptedFieldsManifest, parseEncryptedFields } from '../utils'\nimport { IccSecureDelegationKeyMapApi } from '../../icc-api/api/internal/IccSecureDelegationKeyMapApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { AuthenticationProvider, NoAuthenticationProvider } from '../auth/AuthenticationProvider'\nimport { ACCESS_CONTROL_KEYS_HEADER, AccessControlKeysHeadersProvider } from './AccessControlKeysHeadersProvider'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { DelegationMembersDetails, SecurityMetadataDecryptor } from './SecurityMetadataDecryptor'\n\n// TODO could be optimised using bulk methods\nexport class DelegationsDeAnonymization {\n  private readonly delegationKeyMapFieldsToEncrypt: EncryptedFieldsManifest\n  private readonly delegationKeyMapApi: IccSecureDelegationKeyMapApi\n\n  constructor(\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly securityMetadataDecryptor: SecurityMetadataDecryptor,\n    private readonly xapis: ExtendedApisUtils,\n    private readonly cryptoPrimitives: CryptoPrimitives,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    host: string,\n    headers: { [key: string]: string },\n    authenticationProvider: AuthenticationProvider = new NoAuthenticationProvider(),\n    fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response> = typeof window !== 'undefined'\n      ? window.fetch\n      : typeof self !== 'undefined'\n      ? self.fetch\n      : fetch,\n    private readonly accessControlKeysHeadersProvider: AccessControlKeysHeadersProvider\n  ) {\n    this.delegationKeyMapFieldsToEncrypt = parseEncryptedFields(['delegate', 'delegator'], 'SecureDelegationKeyMap')\n    this.delegationKeyMapApi = new IccSecureDelegationKeyMapApi(host, headers, authenticationProvider, fetchImpl)\n  }\n\n  /**\n   * Creates / updates information to allow the data owners in {@link shareWithDataOwners} to de-anonymize the delegations contained within\n   * {@link entity}.\n   * Note that the delegation de-anonymization information may be used also with other entities of the same type.\n   */\n  async createOrUpdateDeAnonymizationInfo(entityWithType: EncryptedEntityWithType, shareWithDataOwners: string[]) {\n    const delegationsDetails = Object.entries(await this.securityMetadataDecryptor.getDelegationMemberDetails(entityWithType)).flatMap(\n      ([canonicalKey, delegation]) => {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [[canonicalKey, delegation], ...aliases.map((alias) => [alias, delegation])] as [string, DelegationMembersDetails][]\n      }\n    )\n    const delegationsForDeanonInfoSharing = delegationsDetails.filter(([_, delegationInfo]) => {\n      // Drop fully explicit ones: they don't need de-anonymization info\n      return !delegationInfo.fullyExplicit\n    })\n    // A subset of delegations for which deanon info is relevant AND for which we can also create new info instead of sharing only existing one.\n    const delegationsForNewDeanonInfoCreation = delegationsForDeanonInfoSharing.filter(([_, delegationInfo]) => {\n      // Drop those for which we don't have the full information needed for the creation of new data.\n      return !!delegationInfo.delegate && !!delegationInfo.delegator && !!delegationInfo.accessControlSecret\n    })\n    const existingDelegationsMap = await this.getDecryptedSecureDelegationKeyMaps(\n      delegationsForDeanonInfoSharing.map((x) => x[0]),\n      entityWithType.type\n    )\n    for (const delMapToShare of existingDelegationsMap) {\n      await this.ensureDelegationKeyMapSharedWith(entityWithType.type, delMapToShare, shareWithDataOwners)\n    }\n    const existingDelegationsMapKeys = new Set(existingDelegationsMap.map((x) => x.delegationKey))\n    const delegationsToCreate = delegationsForNewDeanonInfoCreation.filter(([k, _]) => !existingDelegationsMapKeys.has(k))\n    for (const [delKey, membersDetails] of delegationsToCreate) {\n      await this.createSecureDelegationKeyMap(entityWithType.type, delKey, membersDetails, shareWithDataOwners)\n    }\n  }\n\n  /**\n   * Get the data owners which can access the entity. See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for more details.\n   * @param entityWithType an entity.\n   */\n  async getDataOwnersWithAccessTo(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    return this.mergePermissions([\n      await this.getDataOwnersWithAccessToSecureDelegations(entityWithType),\n      {\n        permissionsByDataOwnerId: Object.fromEntries(Object.keys(entityWithType.entity.delegations ?? {}).map((k) => [k, AccessLevelEnum.WRITE])),\n        hasUnknownAnonymousDataOwners: false,\n      },\n    ])\n  }\n\n  private async getDataOwnersWithAccessToSecureDelegations(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const secureDelegationDetails = await this.securityMetadataDecryptor.getDelegationMemberDetails(entityWithType)\n    const secureDelegationWithUnknownMembers = Object.entries(secureDelegationDetails).flatMap(([canonicalKey, delegation]) => {\n      if (!delegation.delegate || !delegation.delegator) {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [{ keys: [canonicalKey, ...aliases], delegation }]\n      } else {\n        return []\n      }\n    })\n    const secureDelegationKeyMapsByDelegationKey = Object.fromEntries(\n      (\n        await this.getDecryptedSecureDelegationKeyMaps(\n          secureDelegationWithUnknownMembers.flatMap(({ keys }) => keys),\n          entityWithType.type\n        )\n      ).map((x) => [x.delegationKey, x])\n    )\n    const permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    function addAccess(dataOwnerId: string, level: AccessLevelEnum) {\n      if (permissionsByDataOwnerId[dataOwnerId] !== AccessLevelEnum.WRITE) {\n        permissionsByDataOwnerId[dataOwnerId] = level\n      }\n    }\n    for (const delegation of Object.values(secureDelegationDetails)) {\n      if (delegation.delegate) addAccess(delegation.delegate, delegation.accessLevel)\n      if (delegation.delegator) addAccess(delegation.delegator, delegation.accessLevel)\n    }\n    for (const { keys, delegation } of secureDelegationWithUnknownMembers) {\n      const bestKey = keys.find((k) => {\n        const currMap = secureDelegationKeyMapsByDelegationKey[k]\n        return currMap && !!currMap.delegator && !!currMap.delegate\n      })\n      if (bestKey) {\n        const keyMap = secureDelegationKeyMapsByDelegationKey[bestKey]\n        addAccess(keyMap.delegate!, delegation.accessLevel)\n        addAccess(keyMap.delegator!, delegation.accessLevel)\n      } else {\n        hasUnknownAnonymousDataOwners = true\n      }\n    }\n    return { permissionsByDataOwnerId, hasUnknownAnonymousDataOwners }\n  }\n\n  private async mergePermissions(\n    values: {\n      permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n      hasUnknownAnonymousDataOwners: boolean\n    }[]\n  ): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const accumulatedPermissions: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    for (const v of values) {\n      hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || v.hasUnknownAnonymousDataOwners\n      for (const [dataOwnerId, level] of Object.entries(v.permissionsByDataOwnerId)) {\n        if (accumulatedPermissions[dataOwnerId] !== AccessLevelEnum.WRITE) {\n          accumulatedPermissions[dataOwnerId] = level\n        }\n      }\n    }\n    return {\n      permissionsByDataOwnerId: accumulatedPermissions,\n      hasUnknownAnonymousDataOwners,\n    }\n  }\n\n  private async getDecryptedSecureDelegationKeyMaps(\n    delegationIds: string[],\n    entityType: EntityWithDelegationTypeName\n  ): Promise<SecureDelegationKeyMap[]> {\n    if (delegationIds.length) {\n      const encryptedMaps = await this.delegationKeyMapApi.getByDelegationKeys(\n        { ids: delegationIds },\n        await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n      )\n      const res: SecureDelegationKeyMap[] = []\n      for (const encryptedMap of encryptedMaps) {\n        // Use the original entity type\n        const decryptionResult = (await this.xapis.tryDecryptEntities([encryptedMap], entityType, (x) => new SecureDelegationKeyMap(x)))[0]\n        if (decryptionResult.decrypted) {\n          res.push(decryptionResult.entity)\n        }\n      }\n      return res\n    } else return []\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async ensureDelegationKeyMapSharedWith(entityType: EntityWithDelegationTypeName, keyMap: SecureDelegationKeyMap, delegates: string[]) {\n    if (!keyMap.delegator || !keyMap.delegate) throw new Error('Illegal state: key map is missing delegator or delegate info.')\n    const dataOwnersWithAccessToMapThroughDelegation = Object.values(\n      await this.securityMetadataDecryptor.getDelegationMemberDetails({\n        type: entityType,\n        entity: keyMap,\n      })\n    )\n      .flatMap((x) => [x.delegate, x.delegator])\n      .filter((x) => !!x) as string[]\n    // Delegator and delegate got access to the entity when it was first created: no need to share with them ever.\n    const dataOwnersWithAccessToMap = new Set([keyMap.delegate, keyMap.delegator, ...dataOwnersWithAccessToMapThroughDelegation])\n    const dataOwnersNeedingShare = delegates.filter((x) => !dataOwnersWithAccessToMap.has(x))\n    if (dataOwnersNeedingShare.length) {\n      ;(\n        await this.xapis.simpleShareOrUpdateEncryptedEntityMetadata(\n          {\n            entity: keyMap,\n            type: entityType,\n          },\n          Object.fromEntries(\n            dataOwnersNeedingShare.map((x) => [\n              x,\n              {\n                shareSecretIds: [],\n                shareEncryptionKeys: ShareMetadataBehaviour.REQUIRED,\n                shareOwningEntityIds: ShareMetadataBehaviour.NEVER,\n                requestedPermissions: RequestedPermissionEnum.FULL_READ,\n              },\n            ])\n          ),\n          async (request) =>\n            this.delegationKeyMapApi.bulkShareSecureDelegationKeyMap(\n              request,\n              await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n            )\n        )\n      ).updatedEntityOrThrow\n    }\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async createSecureDelegationKeyMap(\n    entityType: EntityWithDelegationTypeName,\n    delegationKey: string,\n    delegationMembersDetails: DelegationMembersDetails,\n    delegates: string[]\n  ) {\n    if (!delegationMembersDetails.delegate || !delegationMembersDetails.delegator || !delegationMembersDetails.accessControlSecret)\n      throw new Error('Illegal state: delegation members details are missing delegate, delegator or access control secret info.')\n    const selfDoId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    // Ensure that both the delegator and delegate of the delegation this map refers tho can share it later on, even if they did not create it.\n    // Usually either the delegator or delegate are the current data owner, but sometimes also the child of the delegator or delegate can do it.\n    const initialDelegates = [delegationMembersDetails.delegate, delegationMembersDetails.delegator, ...delegates].filter((x) => x != selfDoId)\n    const initalisedMapInfo = await this.xapis.entityWithInitialisedEncryptedMetadata<SecureDelegationKeyMap>(\n      {\n        id: this.cryptoPrimitives.randomUuid(),\n        delegate: delegationMembersDetails.delegate,\n        delegator: delegationMembersDetails.delegator,\n        delegationKey: delegationKey,\n      },\n      entityType,\n      undefined,\n      undefined,\n      true,\n      Object.fromEntries(initialDelegates.map((x) => [x, AccessLevelEnum.READ]))\n    )\n    const encryptedKeyMap = (\n      await this.xapis.tryEncryptEntities(\n        [initalisedMapInfo.updatedEntity],\n        entityType,\n        this.delegationKeyMapFieldsToEncrypt,\n        false,\n        true,\n        (x) => new SecureDelegationKeyMap(x)\n      )\n    )[0]\n    await this.delegationKeyMapApi.create(\n      encryptedKeyMap,\n      new XHR.Header(\n        ACCESS_CONTROL_KEYS_HEADER,\n        await this.accessControlSecretUtils.getEncodedAccessControlKeys([delegationMembersDetails.accessControlSecret], entityType)\n      )\n    )\n  }\n}\n"]}
+{"version":3,"file":"DelegationsDeAnonymization.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/DelegationsDeAnonymization.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2EAAuE;AACvE,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,gGAA4F;AAE5F,qEAAiE;AACjE,wFAAoF;AACpF,IAAO,uBAAuB,GAAG,uCAAkB,CAAC,uBAAuB,CAAA;AAE3E,oCAAwE;AACxE,0GAAsG;AACtG,+CAA2C;AAC3C,2EAAiG;AACjG,yFAAiH;AAKjH,6CAA6C;AAC7C,MAAa,0BAA0B;IAIrC,YACmB,YAA8B,EAC9B,yBAAoD,EACpD,KAAwB,EACxB,gBAAkC,EAClC,wBAAkD,EACnE,IAAY,EACZ,OAAkC,EAClC,yBAAiD,IAAI,iDAAwB,EAAE,EAC/E,YAA2E,OAAO,MAAM,KAAK,WAAW;QACtG,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,KAAK,EACQ,gCAAkE;QAblE,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,UAAK,GAAL,KAAK,CAAmB;QACxB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,6BAAwB,GAAxB,wBAAwB,CAA0B;QASlD,qCAAgC,GAAhC,gCAAgC,CAAkC;QAEnF,IAAI,CAAC,+BAA+B,GAAG,IAAA,4BAAoB,EAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,wBAAwB,CAAC,CAAA;QAChH,IAAI,CAAC,mBAAmB,GAAG,IAAI,2DAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAA;IAC/G,CAAC;IAED;;;;OAIG;IACG,iCAAiC,CAAC,cAAuC,EAAE,mBAA6B;;YAC5G,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAChI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;oBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;wBACzB,OAAO,CAAC,KAAK,CAAC,CAAA;qBACf;yBAAM;wBACL,OAAO,EAAE,CAAA;qBACV;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAyC,CAAA;YAC7H,CAAC,CACF,CAAA;YACD,MAAM,+BAA+B,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACxF,kEAAkE;gBAClE,OAAO,CAAC,cAAc,CAAC,aAAa,CAAA;YACtC,CAAC,CAAC,CAAA;YACF,4IAA4I;YAC5I,MAAM,mCAAmC,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;gBACzG,+FAA+F;gBAC/F,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAA;YACxG,CAAC,CAAC,CAAA;YACF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,mCAAmC,CAC3E,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChD,cAAc,CAAC,IAAI,CACpB,CAAA;YACD,KAAK,MAAM,aAAa,IAAI,sBAAsB,EAAE;gBAClD,MAAM,IAAI,CAAC,gCAAgC,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAA;aACrG;YACD,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;YAC9F,MAAM,mBAAmB,GAAG,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACtH,KAAK,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,mBAAmB,EAAE;gBAC1D,MAAM,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAA;aAC1G;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,yBAAyB,CAAC,cAAuC;;;YAIrE,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC3B,MAAM,IAAI,CAAC,0CAA0C,CAAC,cAAc,CAAC;gBACrE;oBACE,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,CAAC,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzI,6BAA6B,EAAE,KAAK;iBACrC;aACF,CAAC,CAAA;;KACH;IAEa,0CAA0C,CAAC,cAAuC;;YAI9F,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAA;YAC/G,MAAM,kCAAkC,GAAG,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;;gBACxH,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;oBACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,gBAAgB,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;wBACxH,IAAI,KAAK,IAAI,YAAY,EAAE;4BACzB,OAAO,CAAC,KAAK,CAAC,CAAA;yBACf;6BAAM;4BACL,OAAO,EAAE,CAAA;yBACV;oBACH,CAAC,CAAC,CAAA;oBACF,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;iBAC1D;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,sCAAsC,GAAG,MAAM,CAAC,WAAW,CAC/D,CACE,MAAM,IAAI,CAAC,mCAAmC,CAC5C,kCAAkC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAC9D,cAAc,CAAC,IAAI,CACpB,CACF,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CACnC,CAAA;YACD,MAAM,wBAAwB,GAA+C,EAAE,CAAA;YAC/E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,SAAS,SAAS,CAAC,WAAmB,EAAE,KAAsB;gBAC5D,IAAI,wBAAwB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;oBACnE,wBAAwB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;iBAC9C;YACH,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE;gBAC/D,IAAI,UAAU,CAAC,QAAQ;oBAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;gBAC/E,IAAI,UAAU,CAAC,SAAS;oBAAE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;aAClF;YACD,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,kCAAkC,EAAE;gBACrE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9B,MAAM,OAAO,GAAG,sCAAsC,CAAC,CAAC,CAAC,CAAA;oBACzD,OAAO,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;gBAC7D,CAAC,CAAC,CAAA;gBACF,IAAI,OAAO,EAAE;oBACX,MAAM,MAAM,GAAG,sCAAsC,CAAC,OAAO,CAAC,CAAA;oBAC9D,SAAS,CAAC,MAAM,CAAC,QAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;oBACnD,SAAS,CAAC,MAAM,CAAC,SAAU,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;iBACrD;qBAAM;oBACL,6BAA6B,GAAG,IAAI,CAAA;iBACrC;aACF;YACD,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,CAAA;QACpE,CAAC;KAAA;IAEa,gBAAgB,CAC5B,MAGG;;YAKH,MAAM,sBAAsB,GAA+C,EAAE,CAAA;YAC7E,IAAI,6BAA6B,GAAG,KAAK,CAAA;YACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;gBACtB,6BAA6B,GAAG,6BAA6B,IAAI,CAAC,CAAC,6BAA6B,CAAA;gBAChG,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE;oBAC7E,IAAI,sBAAsB,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,KAAK,EAAE;wBACjE,sBAAsB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;qBAC5C;iBACF;aACF;YACD,OAAO;gBACL,wBAAwB,EAAE,sBAAsB;gBAChD,6BAA6B;aAC9B,CAAA;QACH,CAAC;KAAA;IAEa,mCAAmC,CAC/C,aAAuB,EACvB,UAAwC;;YAExC,IAAI,aAAa,CAAC,MAAM,EAAE;gBACxB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CACtE,EAAE,GAAG,EAAE,aAAa,EAAE,EACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;gBACD,MAAM,GAAG,GAA6B,EAAE,CAAA;gBACxC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;oBACxC,+BAA+B;oBAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBACnI,IAAI,gBAAgB,CAAC,SAAS,EAAE;wBAC9B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;qBAClC;iBACF;gBACD,OAAO,GAAG,CAAA;aACX;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,gCAAgC,CAAC,UAAwC,EAAE,MAA8B,EAAE,SAAmB;;YAC1I,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;YAC3H,MAAM,0CAA0C,GAAG,MAAM,CAAC,MAAM,CAC9D,MAAM,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAAC;gBAC9D,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;aACf,CAAC,CACH;iBACE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;iBACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAa,CAAA;YACjC,8GAA8G;YAC9G,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,0CAA0C,CAAC,CAAC,CAAA;YAC7H,MAAM,sBAAsB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACzF,IAAI,sBAAsB,CAAC,MAAM,EAAE;gBACjC,CAAC;gBAAA,CACC,MAAM,IAAI,CAAC,KAAK,CAAC,0CAA0C,CACzD;oBACE,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,UAAU;iBACjB,EACD,MAAM,CAAC,WAAW,CAChB,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAChC,CAAC;oBACD;wBACE,cAAc,EAAE,EAAE;wBAClB,mBAAmB,EAAE,+CAAsB,CAAC,QAAQ;wBACpD,oBAAoB,EAAE,+CAAsB,CAAC,KAAK;wBAClD,oBAAoB,EAAE,uBAAuB,CAAC,SAAS;qBACxD;iBACF,CAAC,CACH,EACD,CAAO,OAAO,EAAE,EAAE;oBAChB,OAAA,IAAI,CAAC,mBAAmB,CAAC,+BAA+B,CACtD,OAAO,EACP,MAAM,IAAI,CAAC,gCAAgC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CACpF,CAAA;kBAAA,CACJ,CACF,CAAC,oBAAoB,CAAA;aACvB;QACH,CAAC;KAAA;IAED,gJAAgJ;IAChJ,iFAAiF;IACnE,4BAA4B,CACxC,UAAwC,EACxC,aAAqB,EACrB,wBAAkD,EAClD,SAAmB;;YAEnB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,IAAI,CAAC,wBAAwB,CAAC,SAAS,IAAI,CAAC,wBAAwB,CAAC,mBAAmB;gBAC5H,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAA;YAC7H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAChE,2IAA2I;YAC3I,4IAA4I;YAC5I,MAAM,gBAAgB,GAAG,CAAC,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAA;YAC3I,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAC/E;gBACE,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE;gBACtC,QAAQ,EAAE,wBAAwB,CAAC,QAAQ;gBAC3C,SAAS,EAAE,wBAAwB,CAAC,SAAS;gBAC7C,aAAa,EAAE,aAAa;aAC7B,EACD,UAAU,EACV,SAAS,EACT,SAAS,EACT,IAAI,EACJ,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAC1E,SAAS,CACV,CAAA;YACD,MAAM,eAAe,GAAG,CACtB,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CACjC,CAAC,iBAAiB,CAAC,aAAa,CAAC,EACjC,UAAU,EACV,IAAI,CAAC,+BAA+B,EACpC,KAAK,EACL,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+CAAsB,CAAC,CAAC,CAAC,CACrC,CACF,CAAC,CAAC,CAAC,CAAA;YACJ,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CACnC,eAAe,EACf,IAAI,SAAG,CAAC,MAAM,CACZ,6DAA0B,EAC1B,MAAM,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,UAAU,CAAC,CAC5H,CACF,CAAA;QACH,CAAC;KAAA;CACF;AA/QD,gEA+QC","sourcesContent":["import { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecureDelegationKeyMap } from '../../icc-api/model/internal/SecureDelegationKeyMap'\nimport { ExtendedApisUtils } from './ExtendedApisUtils'\nimport { ShareMetadataBehaviour } from './ShareMetadataBehaviour'\nimport { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport RequestedPermissionEnum = EntityShareRequest.RequestedPermissionEnum\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { EncryptedFieldsManifest, parseEncryptedFields } from '../utils'\nimport { IccSecureDelegationKeyMapApi } from '../../icc-api/api/internal/IccSecureDelegationKeyMapApi'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { AuthenticationProvider, NoAuthenticationProvider } from '../auth/AuthenticationProvider'\nimport { ACCESS_CONTROL_KEYS_HEADER, AccessControlKeysHeadersProvider } from './AccessControlKeysHeadersProvider'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { DelegationMembersDetails, SecurityMetadataDecryptor } from './SecurityMetadataDecryptor'\n\n// TODO could be optimised using bulk methods\nexport class DelegationsDeAnonymization {\n  private readonly delegationKeyMapFieldsToEncrypt: EncryptedFieldsManifest\n  private readonly delegationKeyMapApi: IccSecureDelegationKeyMapApi\n\n  constructor(\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly securityMetadataDecryptor: SecurityMetadataDecryptor,\n    private readonly xapis: ExtendedApisUtils,\n    private readonly cryptoPrimitives: CryptoPrimitives,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    host: string,\n    headers: { [key: string]: string },\n    authenticationProvider: AuthenticationProvider = new NoAuthenticationProvider(),\n    fetchImpl: (input: RequestInfo, init?: RequestInit) => Promise<Response> = typeof window !== 'undefined'\n      ? window.fetch\n      : typeof self !== 'undefined'\n      ? self.fetch\n      : fetch,\n    private readonly accessControlKeysHeadersProvider: AccessControlKeysHeadersProvider\n  ) {\n    this.delegationKeyMapFieldsToEncrypt = parseEncryptedFields(['delegate', 'delegator'], 'SecureDelegationKeyMap')\n    this.delegationKeyMapApi = new IccSecureDelegationKeyMapApi(host, headers, authenticationProvider, fetchImpl)\n  }\n\n  /**\n   * Creates / updates information to allow the data owners in {@link shareWithDataOwners} to de-anonymize the delegations contained within\n   * {@link entity}.\n   * Note that the delegation de-anonymization information may be used also with other entities of the same type.\n   */\n  async createOrUpdateDeAnonymizationInfo(entityWithType: EncryptedEntityWithType, shareWithDataOwners: string[]) {\n    const delegationsDetails = Object.entries(await this.securityMetadataDecryptor.getDelegationMemberDetails(entityWithType)).flatMap(\n      ([canonicalKey, delegation]) => {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [[canonicalKey, delegation], ...aliases.map((alias) => [alias, delegation])] as [string, DelegationMembersDetails][]\n      }\n    )\n    const delegationsForDeanonInfoSharing = delegationsDetails.filter(([_, delegationInfo]) => {\n      // Drop fully explicit ones: they don't need de-anonymization info\n      return !delegationInfo.fullyExplicit\n    })\n    // A subset of delegations for which deanon info is relevant AND for which we can also create new info instead of sharing only existing one.\n    const delegationsForNewDeanonInfoCreation = delegationsForDeanonInfoSharing.filter(([_, delegationInfo]) => {\n      // Drop those for which we don't have the full information needed for the creation of new data.\n      return !!delegationInfo.delegate && !!delegationInfo.delegator && !!delegationInfo.accessControlSecret\n    })\n    const existingDelegationsMap = await this.getDecryptedSecureDelegationKeyMaps(\n      delegationsForDeanonInfoSharing.map((x) => x[0]),\n      entityWithType.type\n    )\n    for (const delMapToShare of existingDelegationsMap) {\n      await this.ensureDelegationKeyMapSharedWith(entityWithType.type, delMapToShare, shareWithDataOwners)\n    }\n    const existingDelegationsMapKeys = new Set(existingDelegationsMap.map((x) => x.delegationKey))\n    const delegationsToCreate = delegationsForNewDeanonInfoCreation.filter(([k, _]) => !existingDelegationsMapKeys.has(k))\n    for (const [delKey, membersDetails] of delegationsToCreate) {\n      await this.createSecureDelegationKeyMap(entityWithType.type, delKey, membersDetails, shareWithDataOwners)\n    }\n  }\n\n  /**\n   * Get the data owners which can access the entity. See {@link EncryptedEntityXApi.getDataOwnersWithAccessTo} for more details.\n   * @param entityWithType an entity.\n   */\n  async getDataOwnersWithAccessTo(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    return this.mergePermissions([\n      await this.getDataOwnersWithAccessToSecureDelegations(entityWithType),\n      {\n        permissionsByDataOwnerId: Object.fromEntries(Object.keys(entityWithType.entity.delegations ?? {}).map((k) => [k, AccessLevelEnum.WRITE])),\n        hasUnknownAnonymousDataOwners: false,\n      },\n    ])\n  }\n\n  private async getDataOwnersWithAccessToSecureDelegations(entityWithType: EncryptedEntityWithType): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const secureDelegationDetails = await this.securityMetadataDecryptor.getDelegationMemberDetails(entityWithType)\n    const secureDelegationWithUnknownMembers = Object.entries(secureDelegationDetails).flatMap(([canonicalKey, delegation]) => {\n      if (!delegation.delegate || !delegation.delegator) {\n        const aliases = Object.entries(entityWithType.entity.securityMetadata?.keysEquivalences ?? {}).flatMap(([alias, canon]) => {\n          if (canon == canonicalKey) {\n            return [alias]\n          } else {\n            return []\n          }\n        })\n        return [{ keys: [canonicalKey, ...aliases], delegation }]\n      } else {\n        return []\n      }\n    })\n    const secureDelegationKeyMapsByDelegationKey = Object.fromEntries(\n      (\n        await this.getDecryptedSecureDelegationKeyMaps(\n          secureDelegationWithUnknownMembers.flatMap(({ keys }) => keys),\n          entityWithType.type\n        )\n      ).map((x) => [x.delegationKey, x])\n    )\n    const permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    function addAccess(dataOwnerId: string, level: AccessLevelEnum) {\n      if (permissionsByDataOwnerId[dataOwnerId] !== AccessLevelEnum.WRITE) {\n        permissionsByDataOwnerId[dataOwnerId] = level\n      }\n    }\n    for (const delegation of Object.values(secureDelegationDetails)) {\n      if (delegation.delegate) addAccess(delegation.delegate, delegation.accessLevel)\n      if (delegation.delegator) addAccess(delegation.delegator, delegation.accessLevel)\n    }\n    for (const { keys, delegation } of secureDelegationWithUnknownMembers) {\n      const bestKey = keys.find((k) => {\n        const currMap = secureDelegationKeyMapsByDelegationKey[k]\n        return currMap && !!currMap.delegator && !!currMap.delegate\n      })\n      if (bestKey) {\n        const keyMap = secureDelegationKeyMapsByDelegationKey[bestKey]\n        addAccess(keyMap.delegate!, delegation.accessLevel)\n        addAccess(keyMap.delegator!, delegation.accessLevel)\n      } else {\n        hasUnknownAnonymousDataOwners = true\n      }\n    }\n    return { permissionsByDataOwnerId, hasUnknownAnonymousDataOwners }\n  }\n\n  private async mergePermissions(\n    values: {\n      permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n      hasUnknownAnonymousDataOwners: boolean\n    }[]\n  ): Promise<{\n    permissionsByDataOwnerId: { [dataOwnerId: string]: AccessLevelEnum }\n    hasUnknownAnonymousDataOwners: boolean\n  }> {\n    const accumulatedPermissions: { [dataOwnerId: string]: AccessLevelEnum } = {}\n    let hasUnknownAnonymousDataOwners = false\n    for (const v of values) {\n      hasUnknownAnonymousDataOwners = hasUnknownAnonymousDataOwners || v.hasUnknownAnonymousDataOwners\n      for (const [dataOwnerId, level] of Object.entries(v.permissionsByDataOwnerId)) {\n        if (accumulatedPermissions[dataOwnerId] !== AccessLevelEnum.WRITE) {\n          accumulatedPermissions[dataOwnerId] = level\n        }\n      }\n    }\n    return {\n      permissionsByDataOwnerId: accumulatedPermissions,\n      hasUnknownAnonymousDataOwners,\n    }\n  }\n\n  private async getDecryptedSecureDelegationKeyMaps(\n    delegationIds: string[],\n    entityType: EntityWithDelegationTypeName\n  ): Promise<SecureDelegationKeyMap[]> {\n    if (delegationIds.length) {\n      const encryptedMaps = await this.delegationKeyMapApi.getByDelegationKeys(\n        { ids: delegationIds },\n        await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n      )\n      const res: SecureDelegationKeyMap[] = []\n      for (const encryptedMap of encryptedMaps) {\n        // Use the original entity type\n        const decryptionResult = (await this.xapis.tryDecryptEntities([encryptedMap], entityType, (x) => new SecureDelegationKeyMap(x)))[0]\n        if (decryptionResult.decrypted) {\n          res.push(decryptionResult.entity)\n        }\n      }\n      return res\n    } else return []\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async ensureDelegationKeyMapSharedWith(entityType: EntityWithDelegationTypeName, keyMap: SecureDelegationKeyMap, delegates: string[]) {\n    if (!keyMap.delegator || !keyMap.delegate) throw new Error('Illegal state: key map is missing delegator or delegate info.')\n    const dataOwnersWithAccessToMapThroughDelegation = Object.values(\n      await this.securityMetadataDecryptor.getDelegationMemberDetails({\n        type: entityType,\n        entity: keyMap,\n      })\n    )\n      .flatMap((x) => [x.delegate, x.delegator])\n      .filter((x) => !!x) as string[]\n    // Delegator and delegate got access to the entity when it was first created: no need to share with them ever.\n    const dataOwnersWithAccessToMap = new Set([keyMap.delegate, keyMap.delegator, ...dataOwnersWithAccessToMapThroughDelegation])\n    const dataOwnersNeedingShare = delegates.filter((x) => !dataOwnersWithAccessToMap.has(x))\n    if (dataOwnersNeedingShare.length) {\n      ;(\n        await this.xapis.simpleShareOrUpdateEncryptedEntityMetadata(\n          {\n            entity: keyMap,\n            type: entityType,\n          },\n          Object.fromEntries(\n            dataOwnersNeedingShare.map((x) => [\n              x,\n              {\n                shareSecretIds: [],\n                shareEncryptionKeys: ShareMetadataBehaviour.REQUIRED,\n                shareOwningEntityIds: ShareMetadataBehaviour.NEVER,\n                requestedPermissions: RequestedPermissionEnum.FULL_READ,\n              },\n            ])\n          ),\n          async (request) =>\n            this.delegationKeyMapApi.bulkShareSecureDelegationKeyMap(\n              request,\n              await this.accessControlKeysHeadersProvider.getAccessControlKeysHeaders(entityType)\n            )\n        )\n      ).updatedEntityOrThrow\n    }\n  }\n\n  // Important: to avoid potentially leaking links between entities of different types the key map calculates the secure delegation keys using the\n  // same entity type as the delegation key for which they are mapping information.\n  private async createSecureDelegationKeyMap(\n    entityType: EntityWithDelegationTypeName,\n    delegationKey: string,\n    delegationMembersDetails: DelegationMembersDetails,\n    delegates: string[]\n  ) {\n    if (!delegationMembersDetails.delegate || !delegationMembersDetails.delegator || !delegationMembersDetails.accessControlSecret)\n      throw new Error('Illegal state: delegation members details are missing delegate, delegator or access control secret info.')\n    const selfDoId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    // Ensure that both the delegator and delegate of the delegation this map refers tho can share it later on, even if they did not create it.\n    // Usually either the delegator or delegate are the current data owner, but sometimes also the child of the delegator or delegate can do it.\n    const initialDelegates = [delegationMembersDetails.delegate, delegationMembersDetails.delegator, ...delegates].filter((x) => x != selfDoId)\n    const initalisedMapInfo = await this.xapis.entityWithInitialisedEncryptedMetadata<SecureDelegationKeyMap>(\n      {\n        id: this.cryptoPrimitives.randomUuid(),\n        delegate: delegationMembersDetails.delegate,\n        delegator: delegationMembersDetails.delegator,\n        delegationKey: delegationKey,\n      },\n      entityType,\n      undefined,\n      undefined,\n      true,\n      Object.fromEntries(initialDelegates.map((x) => [x, AccessLevelEnum.READ])),\n      undefined\n    )\n    const encryptedKeyMap = (\n      await this.xapis.tryEncryptEntities(\n        [initalisedMapInfo.updatedEntity],\n        entityType,\n        this.delegationKeyMapFieldsToEncrypt,\n        false,\n        true,\n        (x) => new SecureDelegationKeyMap(x)\n      )\n    )[0]\n    await this.delegationKeyMapApi.create(\n      encryptedKeyMap,\n      new XHR.Header(\n        ACCESS_CONTROL_KEYS_HEADER,\n        await this.accessControlSecretUtils.getEncodedAccessControlKeys([delegationMembersDetails.accessControlSecret], entityType)\n      )\n    )\n  }\n}\n"]}

package/icc-x-api/crypto/ExchangeDataManager.d.ts

@@ -32,14 +32,21 @@ export interface ExchangeDataManager {
      * Gets any existing and verified exchange data from the current data owner to the provided delegate or creates new data if no verified data is
      * available, then caches it.
      * @param delegateId the id of the delegate.
-     * @param allowCreationWithoutDelegateKey if true, when creating new exchange data, even if no verified key is available for the delegate the method
+     * @param options
+     * - allowCreationWithoutDelegatorKey if true, when creating new exchange data, even if no verified key is available for the delegator the method
+     * will create the new exchange data anyway (will not be usable by the delegate without additional steps).
+     * - allowCreationWithoutDelegateKey if true, when creating new exchange data, even if no verified key is available for the delegate the method
      * will create the new exchange data anyway (will not be usable by the delegate without additional steps).
      * @return the access control secret and key of the data to use for encryption.
      */
-    getOrCreateEncryptionDataTo(delegateId: string, allowCreationWithoutDelegateKey: boolean): Promise<{
+    getOrCreateEncryptionDataTo(delegateId: string, options?: {
+        allowCreationWithoutDelegatorKey?: boolean;
+        allowCreationWithoutDelegateKey?: boolean;
+    }): Promise<{
         exchangeData: ExchangeData;
         accessControlSecret: string;
         exchangeKey: CryptoKey;
+        sharedSignatureKey: CryptoKey;
     }>;
     /**
      * Retrieve the cached decrypted exchange data key associated with any of the provided hashes/entry keys of secure delegations.
@@ -86,4 +93,20 @@ export interface ExchangeDataManager {
      * data owner, which can be used to search for data.
      */
     getAllDelegationKeys(entityType: EntityWithDelegationTypeName): Promise<string[] | undefined>;
+    /**
+     * Injects already decrypted exchange data, allowing it to be used by the sdk.
+     * @param exchangeDataDetails the exchange data to inject, with the decrypted content and verified status.
+     * Note that the SDK won't verify that the provided decrypted content actually matches what is stored in the exchange
+     * data.
+     * @param reEncryptWithOwnKeys if true all the provided exchange data that is not encrypted with any of the self
+     * verified keys of the user will be re-encrypted with them. In case the user is also the delegator and the data is
+     * verified the delegator signature will be updated.
+     */
+    injectDecryptedExchangeData(exchangeDataDetails: {
+        exchangeDataId: string;
+        accessControlSecret: ArrayBuffer;
+        exchangeKey: ArrayBuffer;
+        sharedSignatureKey: ArrayBuffer;
+        verified: boolean;
+    }[], reEncryptWithOwnKeys: boolean): Promise<void>;
 }