@icure/api 8.2.3 → 8.2.5

package/icc-x-api/crypto/SecureDelegationsManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecureDelegationsManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wFAAoF;AAKpF,oFAA6E;AAC7E,mCAA8G;AAK9G,oCAAyC;AAIzC,2EAAuE;AACvE,sHAAkH;AAClH,IAAO,mBAAmB,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;AAClF,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,2EAAuE;AAEvE,+BAAkC;AAElC,MAAa,wBAAwB;IACnC,YACmB,mBAAwC,EACxC,sBAA8C,EAC9C,2BAAwD,EACxD,wBAAkD,EAClD,QAAmC,EACnC,UAA4B,EAC5B,YAA8B,EAC9B,gBAAkC,EAClC,6BAAsC;QARtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,aAAQ,GAAR,QAAQ,CAA2B;QACnC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kCAA6B,GAA7B,6BAA6B,CAAS;QAGxC,uBAAkB,GAO/B,IAAI,oDAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IATvD,CAAC;IAWJ;;;;;;;;;;;;OAYG;IACG,sCAAsC,CAC1C,MAA2C,EAC3C,UAAwC,EACxC,SAAmB,EACnB,eAAyB,EACzB,cAAwB,EACxB,eAA2E,EAC3E,uBAA2C;;YAE3C,MAAM,cAAc,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,sBAAsB,GAAG,uBAAuB,aAAvB,uBAAuB,cAAvB,uBAAuB,GAAI,MAAM,CAAA;YAChE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAC5D,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,cAAc,EACd,eAAe,EACf,eAAe,CAAC,KAAK,EACrB,SAAS,CACV,CAAA;YACD,MAAM,oBAAoB,GAKpB,EAAE,CAAA;YACR,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBACvE,IAAI,UAAU,KAAK,sBAAsB,EAAE;oBACzC,oBAAoB,CAAC,IAAI,CACvB,MAAM,IAAI,CAAC,wBAAwB,CACjC,cAAc,EACd,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,CAAC,aAAa,CACjC,CACF,CAAA;iBACF;aACF;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAClH,CAAA;YACD,MAAM,6BAA6B,GAAG,MAAM,IAAI,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAA;YAC7I,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,6BAA6B;iBAC1B,MAAM,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;iBAClE,GAAG,CAAC,CAAC,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,mBAAmB,EAAE,uBAAwB,CAAC,CAAC,CAC9G,CAAA;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAA;YAC7E,uCACK,MAAM,KACT,gBAAgB,EAAE,IAAI,mCAAgB,CAAC,EAAE,iBAAiB,EAAE,CAAC,IAC9D;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,8BAA8B,CAClC,cAAuC,EACvC,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;;YAExE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAA;YAC/F,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,cAAc,CAAC,IAAI,CAAC,CAAA;YACjJ,MAAM,wBAAwB,GAAG,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,0CAAG,mBAAmB,CAAC,CAAA;YACjH,IAAI,wBAAwB,EAAE;gBAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACrD,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;gBACD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;aAC3D;iBAAM;gBACL,MAAM,iBAAiB,GAAG,IAAA,cAAM,EAC9B,MAAM,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,cAAc,CAAC,IAAI,CAAC,CACnH,CAAA;gBACD,OAAO;oBACL,KAAK,EAAE,MAAM,IAAI,CAAC,sBAAsB,CACtC,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,CACzB;iBACF,CAAA;aACF;;KACF;IAEa,uBAAuB,CACnC,YAAoB,EACpB,kBAAoC,EACpC,gBAAqG,EACrG,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAE9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC5I,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAC/G,CAAA;YACD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAChH,CAAA;YACD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAChG,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE;gBAChF,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACjI,MAAM,0BAA0B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBAChJ,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAC/F,kBAAkB,EAClB,gBAAgB,CAAC,WAAW,CAC7B,CAAA;gBACD,OAAO,IAAI,qEAAiC,CAAC;oBAC3C,yBAAyB,EAAE,YAAY;oBACvC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClG,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9G,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC/G,CAAC,CAAA;aACH;;gBAAM,OAAO,SAAS,CAAA;QACzB,CAAC;KAAA;IAEa,sBAAsB,CAClC,gBAAqG,EACrG,gBAAwB,EACxB,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;YAExE,OAAO,IAAI,uCAAkB,iCACxB,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,KAC1I,oBAAoB,EAAE,wBAAwB,EAC9C,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,IACrC,CAAA;QACJ,CAAC;KAAA;IAEa,wBAAwB,CACpC,MAA+B,EAC/B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,WAA4B,EAC5B,mBAAuC;;YAOvC,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAA;YAC/F,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YACvI,MAAM,gBAAgB,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3I,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAC1E,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC;gBACtC,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,iBAAiB;gBACrD,QAAQ,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,gBAAgB;gBACnD,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,SAAS;gBAC7C,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,eAAe,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,eAAe;gBACzD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1E,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAA;YACF,OAAO;gBACL,aAAa,EAAE,iBAAiB;gBAChC,mBAAmB,EAAE,gBAAgB;gBACrC,UAAU;gBACV,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;aAC1E,CAAA;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,gBAAqG,EACrG,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAU9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,kBAAkB,GACtB,UAAU,KAAK,MAAM;gBACnB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3E,CAAC,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;YACrG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,cAAc,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAChI,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC/I,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAClJ,uCACK,kBAAkB,KACrB,SAAS,EAAE,kBAAkB,EAC7B,cAAc,EAAE,uBAAuB,EACvC,eAAe,EAAE,wBAAwB,IAC1C;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,MAAc,EACd,UAAkB,EAClB,YAA0B;;YAO1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5D,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACrF,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,gBAAgB,EAAE,UAAU;oBAC5B,cAAc,EAAE,YAAY,CAAC,EAAE;iBAChC,CAAA;aACF;iBAAM,IAAI,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC3F,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CACnF,YAAY,CAAC,EAAG,EAChB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAA,yBAAiB,EAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAC3I;iBACF,CAAA;aACF;iBAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,IAAI,CAAC,6BAA6B,EAAE;gBAC3F;;mBAEG;gBACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;gBACzF,MAAM,oBAAoB,GAAgC,EAAE,CAAA;gBAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY,CAAC,8BAA8B,EAAE,GAAG,YAAY,CAAC,gCAAgC,CAAC,EAAE;oBACvH,MAAM,MAAM,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAA;oBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAU,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAU,CAAC,MAAM,CAAA;oBACrH,IAAI,kCAAkC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;wBAClD,oBAAoB,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;qBACpH;iBACF;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM;oBAC3C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;gBAC3G,OAAO;oBACL,gBAAgB,EAAE,UAAU;oBAC5B,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAG,EAAE,oBAAoB,CAAC;iBAC9H,CAAA;aACF;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAEO,6BAA6B,CACnC,MAAc,EACd,YAA0B;QAO1B,IAAI,IAAI,CAAC,6BAA6B,EAAE;YACtC,OAAO,EAAE,CAAA;SACV;aAAM;YACL,OAAO;gBACL,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,iBAAiB,EAAE,MAAM;gBACzB,gBAAgB,EAAE,MAAM;aACzB,CAAA;SACF;IACH,CAAC;IAEa,gBAAgB,CAAC,WAAmB;;YAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAS,EAAE;gBACzD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACjF,OAAO;oBACL,IAAI,EAAE;wBACJ,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,iBAAiB,CAAC;wBAC3G,8BAA8B,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,+BAAuB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBAC3F,gCAAgC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,iCAAyB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;qBAChG;iBACF,CAAA;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;CACF;AA/VD,4DA+VC","sourcesContent":["import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { fingerprintV1toV2, fingerprintV2, hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of } from './utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { hex2ua, ua2hex } from '../utils'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest'\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { EntitySharedMetadataUpdateRequest } from '../../icc-api/model/requests/EntitySharedMetadataUpdateRequest'\nimport EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecurityMetadata } from '../../icc-api/model/SecurityMetadata'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\nimport { ShaVersion } from './RSA'\n\nexport class SecureDelegationsManager {\n  constructor(\n    private readonly exchangeDataManager: ExchangeDataManager,\n    private readonly exchangeDataMapManager: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    private readonly userKeys: UserEncryptionKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly selfNeedsAnonymousDelegations: boolean\n  ) {}\n\n  private readonly dataOwnerInfoCache: LruTemporisedAsyncCache<\n    string,\n    {\n      requiresAnonymousDelegations: boolean\n      availablePublicKeysHexWithSha1: string[]\n      availablePublicKeysHexWithSha256: string[]\n    }\n  > = new LruTemporisedAsyncCache(100, () => 30 * 60 * 1000)\n\n  /**\n   * Note: this method does not save the updated entity.\n   * @param entity an entity, must already have secret foreign keys initialised.\n   * @param entityType the type of the entity\n   * @param secretIds the initial secret ids to include and share with the auto-delegations\n   * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations\n   * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations\n   * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level\n   * they will have on the entity.\n   * @param alternateRootDelegation by default a new entity is created with a root delegation from self to self. In keyless mode this is not possible,\n   * and instead the root delegation will be from self to another. You have to specify which delegate will be part of the root delegation.\n   * @return the entity with the security metadata initialised for the provided parameters.\n   */\n  async entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T & { secretForeignKeys: string[] },\n    entityType: EntityWithDelegationTypeName,\n    secretIds: string[],\n    owningEntityIds: string[],\n    encryptionKeys: string[],\n    autoDelegations: { [delegateId: string]: SecureDelegation.AccessLevelEnum },\n    alternateRootDelegation: string | undefined\n  ): Promise<T> {\n    const entityWithType: EncryptedEntityWithType = { entity, type: entityType }\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const rootDelegationDelegate = alternateRootDelegation ?? selfId\n    const rootDelegationInfo = await this.makeSecureDelegationInfo(\n      entityWithType,\n      rootDelegationDelegate,\n      secretIds,\n      encryptionKeys,\n      owningEntityIds,\n      AccessLevelEnum.WRITE,\n      undefined\n    )\n    const otherDelegationsInfo: {\n      delegationKey: string\n      accessControlKeyHex: string\n      delegation: SecureDelegation\n      encryptedExchangeDataId: { [fp: string]: string } | undefined\n    }[] = []\n    for (const [delegateId, permissions] of Object.entries(autoDelegations)) {\n      if (delegateId !== rootDelegationDelegate) {\n        otherDelegationsInfo.push(\n          await this.makeSecureDelegationInfo(\n            entityWithType,\n            delegateId,\n            secretIds,\n            encryptionKeys,\n            owningEntityIds,\n            permissions,\n            rootDelegationInfo.delegationKey\n          )\n        )\n      }\n    }\n    const secureDelegations = Object.fromEntries(\n      [rootDelegationInfo, ...otherDelegationsInfo].map(({ delegationKey, delegation }) => [delegationKey, delegation])\n    )\n    const delegationForExchangeDataMaps = selfId == rootDelegationDelegate ? otherDelegationsInfo : [rootDelegationInfo, ...otherDelegationsInfo]\n    const newExchangeDataMaps = Object.fromEntries(\n      delegationForExchangeDataMaps\n        .filter(({ encryptedExchangeDataId }) => !!encryptedExchangeDataId)\n        .map(({ accessControlKeyHex, encryptedExchangeDataId }) => [accessControlKeyHex, encryptedExchangeDataId!])\n    )\n    await this.exchangeDataMapManager.createExchangeDataMaps(newExchangeDataMaps)\n    return {\n      ...entity,\n      securityMetadata: new SecurityMetadata({ secureDelegations }),\n    }\n  }\n\n  /**\n   * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or\n   * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation\n   * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to\n   * share the provided data.\n   * @param entityWithType an entity with type\n   * @param delegateId the id of the delegate\n   * @param shareSecretIds the secret ids to share\n   * @param shareEncryptionKeys the encryption keys to share\n   * @param shareOwningEntityIds the owning entity ids to share\n   * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an\n   * update request instead of a share request, this parameter is ignored.\n   * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update\n   * the entity to allow the delegate to access the provided data.\n   */\n  async makeShareOrUpdateRequestParams(\n    entityWithType: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareOrMetadataUpdateRequest | undefined> {\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId)\n    const secureDelegationKey = await this.accessControlSecretUtils.secureDelegationKeyFor(exchangeDataInfo.accessControlSecret, entityWithType.type)\n    const existingSecureDelegation = entityWithType.entity.securityMetadata?.secureDelegations?.[secureDelegationKey]\n    if (existingSecureDelegation) {\n      const updateParams = await this.makeUpdateRequestParams(\n        secureDelegationKey,\n        existingSecureDelegation,\n        exchangeDataInfo,\n        shareSecretIds,\n        shareEncryptionKeys,\n        shareOwningEntityIds\n      )\n      return updateParams ? { update: updateParams } : undefined\n    } else {\n      const accessControlKeys = ua2hex(\n        await this.accessControlSecretUtils.accessControlKeyFor(exchangeDataInfo.accessControlSecret, entityWithType.type)\n      )\n      return {\n        share: await this.makeShareRequestParams(\n          exchangeDataInfo,\n          accessControlKeys,\n          delegateId,\n          shareSecretIds,\n          shareEncryptionKeys,\n          shareOwningEntityIds,\n          newDelegationPermissions\n        ),\n      }\n    }\n  }\n\n  private async makeUpdateRequestParams(\n    canonicalKey: string,\n    existingDelegation: SecureDelegation,\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<EntitySharedMetadataUpdateRequest | undefined> {\n    const existingSecretIds = new Set(await this.secureDelegationsEncryption.decryptSecretIds(existingDelegation, exchangeDataInfo.exchangeKey))\n    const existingEncryptionKeys = new Set(\n      await this.secureDelegationsEncryption.decryptEncryptionKeys(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const existingOwningEntityIds = new Set(\n      await this.secureDelegationsEncryption.decryptOwningEntityIds(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const newSecretIds = shareSecretIds.filter((id) => !existingSecretIds.has(id))\n    const newEncryptionKeys = shareEncryptionKeys.filter((key) => !existingEncryptionKeys.has(key))\n    const newOwningEntityIds = shareOwningEntityIds.filter((id) => !existingOwningEntityIds.has(id))\n    if (newSecretIds.length || newEncryptionKeys.length || newOwningEntityIds.length) {\n      const encryptedNewSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(newSecretIds, exchangeDataInfo.exchangeKey)\n      const encryptedNewEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(newEncryptionKeys, exchangeDataInfo.exchangeKey)\n      const encryptedNewOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(\n        newOwningEntityIds,\n        exchangeDataInfo.exchangeKey\n      )\n      return new EntitySharedMetadataUpdateRequest({\n        metadataAccessControlHash: canonicalKey,\n        secretIds: Object.fromEntries(encryptedNewSecretIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n        encryptionKeys: Object.fromEntries(encryptedNewEncryptionKeys.map((key) => [key, EntryUpdateTypeEnum.CREATE])),\n        owningEntityIds: Object.fromEntries(encryptedNewOwningEntityIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n      })\n    } else return undefined\n  }\n\n  private async makeShareRequestParams(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    accessControlKey: string,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareRequest> {\n    return new EntityShareRequest({\n      ...(await this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds)),\n      requestedPermissions: newDelegationPermissions,\n      accessControlKeys: [accessControlKey],\n    })\n  }\n\n  private async makeSecureDelegationInfo(\n    entity: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    permissions: AccessLevelEnum,\n    parentDelegationKey: string | undefined\n  ): Promise<{\n    delegationKey: string\n    accessControlKeyHex: string\n    delegation: SecureDelegation\n    encryptedExchangeDataId: { [fp: string]: string } | undefined\n  }> {\n    // Be wary of explicit delegator and explicit delegate\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId)\n    const accessControlHash = await this.accessControlSecretUtils.secureDelegationKeyFor(exchangeDataInfo.accessControlSecret, entity.type)\n    const accessControlKey = ua2hex(await this.accessControlSecretUtils.accessControlKeyFor(exchangeDataInfo.accessControlSecret, entity.type))\n    const encryptedDelegationInfo = await this.makeSecureDelegationEncryptedData(\n      exchangeDataInfo,\n      delegateId,\n      shareSecretIds,\n      shareEncryptionKeys,\n      shareOwningEntityIds\n    )\n    const delegation = new SecureDelegation({\n      delegator: encryptedDelegationInfo?.explicitDelegator,\n      delegate: encryptedDelegationInfo?.explicitDelegate,\n      secretIds: encryptedDelegationInfo?.secretIds,\n      encryptionKeys: encryptedDelegationInfo?.encryptionKeys,\n      owningEntityIds: encryptedDelegationInfo?.owningEntityIds,\n      parentDelegations: parentDelegationKey ? [parentDelegationKey] : undefined,\n      exchangeDataId: encryptedDelegationInfo?.exchangeDataId,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      permissions: permissions,\n    })\n    return {\n      delegationKey: accessControlHash,\n      accessControlKeyHex: accessControlKey,\n      delegation,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n    }\n  }\n\n  private async makeSecureDelegationEncryptedData(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<{\n    explicitDelegator?: string\n    explicitDelegate?: string\n    secretIds?: string[]\n    encryptionKeys?: string[]\n    owningEntityIds?: string[]\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string } // TODO if secure delegation info, check cache before calculating\n  }> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const exchangeDataIdInfo =\n      delegateId === selfId\n        ? this.makeExchangeDataIdInfoForSelf(selfId, exchangeDataInfo.exchangeData)\n        : await this.makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeDataInfo.exchangeData)\n    const encryptedSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(shareSecretIds, exchangeDataInfo.exchangeKey)\n    const encryptedEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(shareEncryptionKeys, exchangeDataInfo.exchangeKey)\n    const encryptedOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(shareOwningEntityIds, exchangeDataInfo.exchangeKey)\n    return {\n      ...exchangeDataIdInfo,\n      secretIds: encryptedSecretIds,\n      encryptionKeys: encryptedEncryptionKeys,\n      owningEntityIds: encryptedOwningEntityIds,\n    }\n  }\n\n  private async makeExchangeDataIdInfoForDelegate(\n    selfId: string,\n    delegateId: string,\n    exchangeData: ExchangeData\n  ): Promise<{\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  }> {\n    const delegateInfo = await this.getDataOwnerInfo(delegateId)\n    if (!delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        explicitDelegate: delegateId,\n        exchangeDataId: exchangeData.id,\n      }\n    } else if (delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(\n          exchangeData.id!,\n          Object.fromEntries(this.userKeys.getSelfVerifiedKeys().map((keyInfo) => [fingerprintV1toV2(keyInfo.fingerprint), keyInfo.pair.publicKey]))\n        ),\n      }\n    } else if (!delegateInfo.requiresAnonymousDelegations && this.selfNeedsAnonymousDelegations) {\n      /**\n       * Important: this requires that the exchange data signature also validates the authenticity of the public keys included in there.\n       */\n      const fingerprintsOfVerifiedExchangeData = new Set(Object.keys(exchangeData.exchangeKey))\n      const delegateVerifiedKeys: { [fp: string]: CryptoKey } = {}\n      for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {\n        const currFp = fingerprintV2(keyHex)\n        const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? ShaVersion.Sha1 : ShaVersion.Sha256\n        if (fingerprintsOfVerifiedExchangeData.has(currFp)) {\n          delegateVerifiedKeys[currFp] = await this.primitives.RSA.importKey('spki', hex2ua(keyHex), ['encrypt'], shaVersion)\n        }\n      }\n      if (!Object.keys(delegateVerifiedKeys).length)\n        throw new Error('Illegal state: could not find any verified key for delegate in verified exchange data.')\n      return {\n        explicitDelegate: delegateId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id!, delegateVerifiedKeys),\n      }\n    } else return {}\n  }\n\n  private makeExchangeDataIdInfoForSelf(\n    selfId: string,\n    exchangeData: ExchangeData\n  ): {\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  } {\n    if (this.selfNeedsAnonymousDelegations) {\n      return {}\n    } else {\n      return {\n        exchangeDataId: exchangeData.id,\n        explicitDelegator: selfId,\n        explicitDelegate: selfId,\n      }\n    }\n  }\n\n  private async getDataOwnerInfo(dataOwnerId: string) {\n    return this.dataOwnerInfoCache.get(dataOwnerId, async () => {\n      const dataOwnerWithType = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n      return {\n        item: {\n          requiresAnonymousDelegations: this.cryptoStrategies.dataOwnerRequiresAnonymousDelegation(dataOwnerWithType),\n          availablePublicKeysHexWithSha1: Array.from(hexPublicKeysWithSha1Of(dataOwnerWithType.stub)),\n          availablePublicKeysHexWithSha256: Array.from(hexPublicKeysWithSha256Of(dataOwnerWithType.stub)),\n        },\n      }\n    })\n  }\n}\n"]}
+{"version":3,"file":"SecureDelegationsManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecureDelegationsManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wFAAoF;AAKpF,oFAA6E;AAC7E,mCAA8G;AAK9G,oCAAyC;AAIzC,2EAAuE;AACvE,sHAAkH;AAClH,IAAO,mBAAmB,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;AAClF,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,2EAAuE;AAEvE,+BAAkC;AAElC,MAAa,wBAAwB;IACnC,YACmB,mBAAwC,EACxC,sBAA8C,EAC9C,2BAAwD,EACxD,wBAAkD,EAClD,QAAmC,EACnC,UAA4B,EAC5B,YAA8B,EAC9B,gBAAkC,EAClC,6BAAsC;QARtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,aAAQ,GAAR,QAAQ,CAA2B;QACnC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kCAA6B,GAA7B,6BAA6B,CAAS;QAGxC,uBAAkB,GAO/B,IAAI,oDAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IATvD,CAAC;IAWJ;;;;;;;;;;;;OAYG;IACG,sCAAsC,CAC1C,MAA2C,EAC3C,UAAwC,EACxC,SAAmB,EACnB,eAAyB,EACzB,cAAwB,EACxB,eAA2E,EAC3E,uBAA2C;;YAE3C,MAAM,cAAc,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,sBAAsB,GAAG,uBAAuB,aAAvB,uBAAuB,cAAvB,uBAAuB,GAAI,MAAM,CAAA;YAChE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAC5D,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,cAAc,EACd,eAAe,EACf,eAAe,CAAC,KAAK,EACrB,SAAS,CACV,CAAA;YACD,MAAM,oBAAoB,GAKpB,EAAE,CAAA;YACR,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxE,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;oBAC1C,oBAAoB,CAAC,IAAI,CACvB,MAAM,IAAI,CAAC,wBAAwB,CACjC,cAAc,EACd,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,CAAC,aAAa,CACjC,CACF,CAAA;gBACH,CAAC;YACH,CAAC;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAClH,CAAA;YACD,MAAM,6BAA6B,GAAG,MAAM,IAAI,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,CAAA;YAC7I,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,6BAA6B;iBAC1B,MAAM,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;iBAClE,GAAG,CAAC,CAAC,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC,mBAAmB,EAAE,uBAAwB,CAAC,CAAC,CAC9G,CAAA;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAA;YAC7E,uCACK,MAAM,KACT,gBAAgB,EAAE,IAAI,mCAAgB,CAAC,EAAE,iBAAiB,EAAE,CAAC,IAC9D;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;;OAcG;IACG,8BAA8B,CAClC,cAAuC,EACvC,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;;YAExE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAA;YAC/F,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,cAAc,CAAC,IAAI,CAAC,CAAA;YACjJ,MAAM,wBAAwB,GAAG,MAAA,MAAA,cAAc,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,0CAAG,mBAAmB,CAAC,CAAA;YACjH,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACrD,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;gBACD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5D,CAAC;iBAAM,CAAC;gBACN,MAAM,iBAAiB,GAAG,IAAA,cAAM,EAC9B,MAAM,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,cAAc,CAAC,IAAI,CAAC,CACnH,CAAA;gBACD,OAAO;oBACL,KAAK,EAAE,MAAM,IAAI,CAAC,sBAAsB,CACtC,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,CACzB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;KAAA;IAEa,uBAAuB,CACnC,YAAoB,EACpB,kBAAoC,EACpC,gBAAqG,EACrG,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAE9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC5I,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAC/G,CAAA;YACD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAChH,CAAA;YACD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAChG,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,CAAC;gBACjF,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACjI,MAAM,0BAA0B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBAChJ,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAC/F,kBAAkB,EAClB,gBAAgB,CAAC,WAAW,CAC7B,CAAA;gBACD,OAAO,IAAI,qEAAiC,CAAC;oBAC3C,yBAAyB,EAAE,YAAY;oBACvC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClG,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9G,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC/G,CAAC,CAAA;YACJ,CAAC;;gBAAM,OAAO,SAAS,CAAA;QACzB,CAAC;KAAA;IAEa,sBAAsB,CAClC,gBAAqG,EACrG,gBAAwB,EACxB,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,wBAAwE;;YAExE,OAAO,IAAI,uCAAkB,iCACxB,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,KAC1I,oBAAoB,EAAE,wBAAwB,EAC9C,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,IACrC,CAAA;QACJ,CAAC;KAAA;IAEa,wBAAwB,CACpC,MAA+B,EAC/B,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B,EAC9B,WAA4B,EAC5B,mBAAuC;;YAOvC,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAA;YAC/F,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YACvI,MAAM,gBAAgB,GAAG,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3I,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAC1E,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,CACrB,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC;gBACtC,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,iBAAiB;gBACrD,QAAQ,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,gBAAgB;gBACnD,SAAS,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,SAAS;gBAC7C,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,eAAe,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,eAAe;gBACzD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1E,cAAc,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,cAAc;gBACvD,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;gBACzE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAA;YACF,OAAO;gBACL,aAAa,EAAE,iBAAiB;gBAChC,mBAAmB,EAAE,gBAAgB;gBACrC,UAAU;gBACV,uBAAuB,EAAE,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,uBAAuB;aAC1E,CAAA;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,gBAAqG,EACrG,UAAkB,EAClB,cAAwB,EACxB,mBAA6B,EAC7B,oBAA8B;;YAU9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC9D,MAAM,kBAAkB,GACtB,UAAU,KAAK,MAAM;gBACnB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3E,CAAC,CAAC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;YACrG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,cAAc,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAChI,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC/I,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAClJ,uCACK,kBAAkB,KACrB,SAAS,EAAE,kBAAkB,EAC7B,cAAc,EAAE,uBAAuB,EACvC,eAAe,EAAE,wBAAwB,IAC1C;QACH,CAAC;KAAA;IAEa,iCAAiC,CAC7C,MAAc,EACd,UAAkB,EAClB,YAA0B;;YAO1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5D,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;gBACtF,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,gBAAgB,EAAE,UAAU;oBAC5B,cAAc,EAAE,YAAY,CAAC,EAAE;iBAChC,CAAA;YACH,CAAC;iBAAM,IAAI,YAAY,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;gBAC5F,OAAO;oBACL,iBAAiB,EAAE,MAAM;oBACzB,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CACnF,YAAY,CAAC,EAAG,EAChB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAA,yBAAiB,EAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAC3I;iBACF,CAAA;YACH,CAAC;iBAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,IAAI,IAAI,CAAC,6BAA6B,EAAE,CAAC;gBAC5F;;mBAEG;gBACH,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;gBACzF,MAAM,oBAAoB,GAAgC,EAAE,CAAA;gBAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY,CAAC,8BAA8B,EAAE,GAAG,YAAY,CAAC,gCAAgC,CAAC,EAAE,CAAC;oBACxH,MAAM,MAAM,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAA;oBACpC,MAAM,UAAU,GAAG,YAAY,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAU,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAU,CAAC,MAAM,CAAA;oBACrH,IAAI,kCAAkC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;wBACnD,oBAAoB,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;oBACrH,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM;oBAC3C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;gBAC3G,OAAO;oBACL,gBAAgB,EAAE,UAAU;oBAC5B,uBAAuB,EAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAG,EAAE,oBAAoB,CAAC;iBAC9H,CAAA;YACH,CAAC;;gBAAM,OAAO,EAAE,CAAA;QAClB,CAAC;KAAA;IAEO,6BAA6B,CACnC,MAAc,EACd,YAA0B;QAO1B,IAAI,IAAI,CAAC,6BAA6B,EAAE,CAAC;YACvC,OAAO,EAAE,CAAA;QACX,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,iBAAiB,EAAE,MAAM;gBACzB,gBAAgB,EAAE,MAAM;aACzB,CAAA;QACH,CAAC;IACH,CAAC;IAEa,gBAAgB,CAAC,WAAmB;;YAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAS,EAAE;gBACzD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBACjF,OAAO;oBACL,IAAI,EAAE;wBACJ,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,iBAAiB,CAAC;wBAC3G,8BAA8B,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,+BAAuB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBAC3F,gCAAgC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAA,iCAAyB,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;qBAChG;iBACF,CAAA;YACH,CAAC,CAAA,CAAC,CAAA;QACJ,CAAC;KAAA;CACF;AA/VD,4DA+VC","sourcesContent":["import { EntityShareRequest } from '../../icc-api/model/requests/EntityShareRequest'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { EncryptedEntityWithType, EntityWithDelegationTypeName } from '../utils/EntityWithDelegationTypeName'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { fingerprintV1toV2, fingerprintV2, hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of } from './utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { hex2ua, ua2hex } from '../utils'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { EntityShareOrMetadataUpdateRequest } from '../../icc-api/model/requests/EntityShareOrMetadataUpdateRequest'\nimport { EncryptedEntity, EncryptedEntityStub } from '../../icc-api/model/models'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport { EntitySharedMetadataUpdateRequest } from '../../icc-api/model/requests/EntitySharedMetadataUpdateRequest'\nimport EntryUpdateTypeEnum = EntitySharedMetadataUpdateRequest.EntryUpdateTypeEnum\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport { SecurityMetadata } from '../../icc-api/model/SecurityMetadata'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\nimport { ShaVersion } from './RSA'\n\nexport class SecureDelegationsManager {\n  constructor(\n    private readonly exchangeDataManager: ExchangeDataManager,\n    private readonly exchangeDataMapManager: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly accessControlSecretUtils: AccessControlSecretUtils,\n    private readonly userKeys: UserEncryptionKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly cryptoStrategies: CryptoStrategies,\n    private readonly selfNeedsAnonymousDelegations: boolean\n  ) {}\n\n  private readonly dataOwnerInfoCache: LruTemporisedAsyncCache<\n    string,\n    {\n      requiresAnonymousDelegations: boolean\n      availablePublicKeysHexWithSha1: string[]\n      availablePublicKeysHexWithSha256: string[]\n    }\n  > = new LruTemporisedAsyncCache(100, () => 30 * 60 * 1000)\n\n  /**\n   * Note: this method does not save the updated entity.\n   * @param entity an entity, must already have secret foreign keys initialised.\n   * @param entityType the type of the entity\n   * @param secretIds the initial secret ids to include and share with the auto-delegations\n   * @param owningEntityIds the initial owning entity ids to include and share with the auto-delegations\n   * @param encryptionKeys the initial encryption keys to include and share with the auto-delegations\n   * @param autoDelegations the data owners which will initially have access to the entity in addition to the current data owner and the access level\n   * they will have on the entity.\n   * @param alternateRootDelegation by default a new entity is created with a root delegation from self to self. In keyless mode this is not possible,\n   * and instead the root delegation will be from self to another. You have to specify which delegate will be part of the root delegation.\n   * @return the entity with the security metadata initialised for the provided parameters.\n   */\n  async entityWithInitialisedEncryptedMetadata<T extends EncryptedEntity>(\n    entity: T & { secretForeignKeys: string[] },\n    entityType: EntityWithDelegationTypeName,\n    secretIds: string[],\n    owningEntityIds: string[],\n    encryptionKeys: string[],\n    autoDelegations: { [delegateId: string]: SecureDelegation.AccessLevelEnum },\n    alternateRootDelegation: string | undefined\n  ): Promise<T> {\n    const entityWithType: EncryptedEntityWithType = { entity, type: entityType }\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const rootDelegationDelegate = alternateRootDelegation ?? selfId\n    const rootDelegationInfo = await this.makeSecureDelegationInfo(\n      entityWithType,\n      rootDelegationDelegate,\n      secretIds,\n      encryptionKeys,\n      owningEntityIds,\n      AccessLevelEnum.WRITE,\n      undefined\n    )\n    const otherDelegationsInfo: {\n      delegationKey: string\n      accessControlKeyHex: string\n      delegation: SecureDelegation\n      encryptedExchangeDataId: { [fp: string]: string } | undefined\n    }[] = []\n    for (const [delegateId, permissions] of Object.entries(autoDelegations)) {\n      if (delegateId !== rootDelegationDelegate) {\n        otherDelegationsInfo.push(\n          await this.makeSecureDelegationInfo(\n            entityWithType,\n            delegateId,\n            secretIds,\n            encryptionKeys,\n            owningEntityIds,\n            permissions,\n            rootDelegationInfo.delegationKey\n          )\n        )\n      }\n    }\n    const secureDelegations = Object.fromEntries(\n      [rootDelegationInfo, ...otherDelegationsInfo].map(({ delegationKey, delegation }) => [delegationKey, delegation])\n    )\n    const delegationForExchangeDataMaps = selfId == rootDelegationDelegate ? otherDelegationsInfo : [rootDelegationInfo, ...otherDelegationsInfo]\n    const newExchangeDataMaps = Object.fromEntries(\n      delegationForExchangeDataMaps\n        .filter(({ encryptedExchangeDataId }) => !!encryptedExchangeDataId)\n        .map(({ accessControlKeyHex, encryptedExchangeDataId }) => [accessControlKeyHex, encryptedExchangeDataId!])\n    )\n    await this.exchangeDataMapManager.createExchangeDataMaps(newExchangeDataMaps)\n    return {\n      ...entity,\n      securityMetadata: new SecurityMetadata({ secureDelegations }),\n    }\n  }\n\n  /**\n   * Make a request for sharing an entity with a delegate or to update existing shared metadata by adding additional secretIds, encryptionKeys or\n   * owningEntityIds if there is already some metadata shared between the current data owner and the delegate. In case there is already a delegation\n   * for the delegate, and it already contains all the provided metadata, this method returns undefined, since there is no need to make any request to\n   * share the provided data.\n   * @param entityWithType an entity with type\n   * @param delegateId the id of the delegate\n   * @param shareSecretIds the secret ids to share\n   * @param shareEncryptionKeys the encryption keys to share\n   * @param shareOwningEntityIds the owning entity ids to share\n   * @param newDelegationPermissions the permissions to grant to the delegate in case a new delegation needs to be created. If this method creates an\n   * update request instead of a share request, this parameter is ignored.\n   * @return the request to share the entity, or the request to update the shared metadata for the entity, or undefined if there is no need to update\n   * the entity to allow the delegate to access the provided data.\n   */\n  async makeShareOrUpdateRequestParams(\n    entityWithType: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareOrMetadataUpdateRequest | undefined> {\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId)\n    const secureDelegationKey = await this.accessControlSecretUtils.secureDelegationKeyFor(exchangeDataInfo.accessControlSecret, entityWithType.type)\n    const existingSecureDelegation = entityWithType.entity.securityMetadata?.secureDelegations?.[secureDelegationKey]\n    if (existingSecureDelegation) {\n      const updateParams = await this.makeUpdateRequestParams(\n        secureDelegationKey,\n        existingSecureDelegation,\n        exchangeDataInfo,\n        shareSecretIds,\n        shareEncryptionKeys,\n        shareOwningEntityIds\n      )\n      return updateParams ? { update: updateParams } : undefined\n    } else {\n      const accessControlKeys = ua2hex(\n        await this.accessControlSecretUtils.accessControlKeyFor(exchangeDataInfo.accessControlSecret, entityWithType.type)\n      )\n      return {\n        share: await this.makeShareRequestParams(\n          exchangeDataInfo,\n          accessControlKeys,\n          delegateId,\n          shareSecretIds,\n          shareEncryptionKeys,\n          shareOwningEntityIds,\n          newDelegationPermissions\n        ),\n      }\n    }\n  }\n\n  private async makeUpdateRequestParams(\n    canonicalKey: string,\n    existingDelegation: SecureDelegation,\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<EntitySharedMetadataUpdateRequest | undefined> {\n    const existingSecretIds = new Set(await this.secureDelegationsEncryption.decryptSecretIds(existingDelegation, exchangeDataInfo.exchangeKey))\n    const existingEncryptionKeys = new Set(\n      await this.secureDelegationsEncryption.decryptEncryptionKeys(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const existingOwningEntityIds = new Set(\n      await this.secureDelegationsEncryption.decryptOwningEntityIds(existingDelegation, exchangeDataInfo.exchangeKey)\n    )\n    const newSecretIds = shareSecretIds.filter((id) => !existingSecretIds.has(id))\n    const newEncryptionKeys = shareEncryptionKeys.filter((key) => !existingEncryptionKeys.has(key))\n    const newOwningEntityIds = shareOwningEntityIds.filter((id) => !existingOwningEntityIds.has(id))\n    if (newSecretIds.length || newEncryptionKeys.length || newOwningEntityIds.length) {\n      const encryptedNewSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(newSecretIds, exchangeDataInfo.exchangeKey)\n      const encryptedNewEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(newEncryptionKeys, exchangeDataInfo.exchangeKey)\n      const encryptedNewOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(\n        newOwningEntityIds,\n        exchangeDataInfo.exchangeKey\n      )\n      return new EntitySharedMetadataUpdateRequest({\n        metadataAccessControlHash: canonicalKey,\n        secretIds: Object.fromEntries(encryptedNewSecretIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n        encryptionKeys: Object.fromEntries(encryptedNewEncryptionKeys.map((key) => [key, EntryUpdateTypeEnum.CREATE])),\n        owningEntityIds: Object.fromEntries(encryptedNewOwningEntityIds.map((id) => [id, EntryUpdateTypeEnum.CREATE])),\n      })\n    } else return undefined\n  }\n\n  private async makeShareRequestParams(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    accessControlKey: string,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    newDelegationPermissions: EntityShareRequest.RequestedPermissionInternal\n  ): Promise<EntityShareRequest> {\n    return new EntityShareRequest({\n      ...(await this.makeSecureDelegationEncryptedData(exchangeDataInfo, delegateId, shareSecretIds, shareEncryptionKeys, shareOwningEntityIds)),\n      requestedPermissions: newDelegationPermissions,\n      accessControlKeys: [accessControlKey],\n    })\n  }\n\n  private async makeSecureDelegationInfo(\n    entity: EncryptedEntityWithType,\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[],\n    permissions: AccessLevelEnum,\n    parentDelegationKey: string | undefined\n  ): Promise<{\n    delegationKey: string\n    accessControlKeyHex: string\n    delegation: SecureDelegation\n    encryptedExchangeDataId: { [fp: string]: string } | undefined\n  }> {\n    // Be wary of explicit delegator and explicit delegate\n    const exchangeDataInfo = await this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId)\n    const accessControlHash = await this.accessControlSecretUtils.secureDelegationKeyFor(exchangeDataInfo.accessControlSecret, entity.type)\n    const accessControlKey = ua2hex(await this.accessControlSecretUtils.accessControlKeyFor(exchangeDataInfo.accessControlSecret, entity.type))\n    const encryptedDelegationInfo = await this.makeSecureDelegationEncryptedData(\n      exchangeDataInfo,\n      delegateId,\n      shareSecretIds,\n      shareEncryptionKeys,\n      shareOwningEntityIds\n    )\n    const delegation = new SecureDelegation({\n      delegator: encryptedDelegationInfo?.explicitDelegator,\n      delegate: encryptedDelegationInfo?.explicitDelegate,\n      secretIds: encryptedDelegationInfo?.secretIds,\n      encryptionKeys: encryptedDelegationInfo?.encryptionKeys,\n      owningEntityIds: encryptedDelegationInfo?.owningEntityIds,\n      parentDelegations: parentDelegationKey ? [parentDelegationKey] : undefined,\n      exchangeDataId: encryptedDelegationInfo?.exchangeDataId,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n      permissions: permissions,\n    })\n    return {\n      delegationKey: accessControlHash,\n      accessControlKeyHex: accessControlKey,\n      delegation,\n      encryptedExchangeDataId: encryptedDelegationInfo?.encryptedExchangeDataId,\n    }\n  }\n\n  private async makeSecureDelegationEncryptedData(\n    exchangeDataInfo: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey },\n    delegateId: string,\n    shareSecretIds: string[],\n    shareEncryptionKeys: string[],\n    shareOwningEntityIds: string[]\n  ): Promise<{\n    explicitDelegator?: string\n    explicitDelegate?: string\n    secretIds?: string[]\n    encryptionKeys?: string[]\n    owningEntityIds?: string[]\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string } // TODO if secure delegation info, check cache before calculating\n  }> {\n    const selfId = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const exchangeDataIdInfo =\n      delegateId === selfId\n        ? this.makeExchangeDataIdInfoForSelf(selfId, exchangeDataInfo.exchangeData)\n        : await this.makeExchangeDataIdInfoForDelegate(selfId, delegateId, exchangeDataInfo.exchangeData)\n    const encryptedSecretIds = await this.secureDelegationsEncryption.encryptSecretIds(shareSecretIds, exchangeDataInfo.exchangeKey)\n    const encryptedEncryptionKeys = await this.secureDelegationsEncryption.encryptEncryptionKeys(shareEncryptionKeys, exchangeDataInfo.exchangeKey)\n    const encryptedOwningEntityIds = await this.secureDelegationsEncryption.encryptOwningEntityIds(shareOwningEntityIds, exchangeDataInfo.exchangeKey)\n    return {\n      ...exchangeDataIdInfo,\n      secretIds: encryptedSecretIds,\n      encryptionKeys: encryptedEncryptionKeys,\n      owningEntityIds: encryptedOwningEntityIds,\n    }\n  }\n\n  private async makeExchangeDataIdInfoForDelegate(\n    selfId: string,\n    delegateId: string,\n    exchangeData: ExchangeData\n  ): Promise<{\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  }> {\n    const delegateInfo = await this.getDataOwnerInfo(delegateId)\n    if (!delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        explicitDelegate: delegateId,\n        exchangeDataId: exchangeData.id,\n      }\n    } else if (delegateInfo.requiresAnonymousDelegations && !this.selfNeedsAnonymousDelegations) {\n      return {\n        explicitDelegator: selfId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(\n          exchangeData.id!,\n          Object.fromEntries(this.userKeys.getSelfVerifiedKeys().map((keyInfo) => [fingerprintV1toV2(keyInfo.fingerprint), keyInfo.pair.publicKey]))\n        ),\n      }\n    } else if (!delegateInfo.requiresAnonymousDelegations && this.selfNeedsAnonymousDelegations) {\n      /**\n       * Important: this requires that the exchange data signature also validates the authenticity of the public keys included in there.\n       */\n      const fingerprintsOfVerifiedExchangeData = new Set(Object.keys(exchangeData.exchangeKey))\n      const delegateVerifiedKeys: { [fp: string]: CryptoKey } = {}\n      for (const keyHex of [...delegateInfo.availablePublicKeysHexWithSha1, ...delegateInfo.availablePublicKeysHexWithSha256]) {\n        const currFp = fingerprintV2(keyHex)\n        const shaVersion = delegateInfo.availablePublicKeysHexWithSha1.includes(keyHex) ? ShaVersion.Sha1 : ShaVersion.Sha256\n        if (fingerprintsOfVerifiedExchangeData.has(currFp)) {\n          delegateVerifiedKeys[currFp] = await this.primitives.RSA.importKey('spki', hex2ua(keyHex), ['encrypt'], shaVersion)\n        }\n      }\n      if (!Object.keys(delegateVerifiedKeys).length)\n        throw new Error('Illegal state: could not find any verified key for delegate in verified exchange data.')\n      return {\n        explicitDelegate: delegateId,\n        encryptedExchangeDataId: await this.secureDelegationsEncryption.encryptExchangeDataId(exchangeData.id!, delegateVerifiedKeys),\n      }\n    } else return {}\n  }\n\n  private makeExchangeDataIdInfoForSelf(\n    selfId: string,\n    exchangeData: ExchangeData\n  ): {\n    exchangeDataId?: string\n    encryptedExchangeDataId?: { [fp: string]: string }\n    explicitDelegator?: string\n    explicitDelegate?: string\n  } {\n    if (this.selfNeedsAnonymousDelegations) {\n      return {}\n    } else {\n      return {\n        exchangeDataId: exchangeData.id,\n        explicitDelegator: selfId,\n        explicitDelegate: selfId,\n      }\n    }\n  }\n\n  private async getDataOwnerInfo(dataOwnerId: string) {\n    return this.dataOwnerInfoCache.get(dataOwnerId, async () => {\n      const dataOwnerWithType = await this.dataOwnerApi.getCryptoActorStub(dataOwnerId)\n      return {\n        item: {\n          requiresAnonymousDelegations: this.cryptoStrategies.dataOwnerRequiresAnonymousDelegation(dataOwnerWithType),\n          availablePublicKeysHexWithSha1: Array.from(hexPublicKeysWithSha1Of(dataOwnerWithType.stub)),\n          availablePublicKeysHexWithSha256: Array.from(hexPublicKeysWithSha256Of(dataOwnerWithType.stub)),\n        },\n      }\n    })\n  }\n}\n"]}

package/icc-x-api/crypto/SecurityMetadataDecryptor.d.ts

@@ -15,7 +15,7 @@ export type DelegationMembersDetails = {
     accessLevel: AccessLevelEnum;
 };
 export declare enum SecurityMetadataType {
-    SecretId = 1,
+    SecretId = 1,// Start from 1, avoids issues with SecretId being falsy
     EncryptionKey = 2,
     OwningEntityId = 3
 }

package/icc-x-api/crypto/SecurityMetadataDecryptor.js

@@ -18,7 +18,7 @@ var SecurityMetadataType;
     SecurityMetadataType[SecurityMetadataType["SecretId"] = 1] = "SecretId";
     SecurityMetadataType[SecurityMetadataType["EncryptionKey"] = 2] = "EncryptionKey";
     SecurityMetadataType[SecurityMetadataType["OwningEntityId"] = 3] = "OwningEntityId";
-})(SecurityMetadataType = exports.SecurityMetadataType || (exports.SecurityMetadataType = {}));
+})(SecurityMetadataType || (exports.SecurityMetadataType = SecurityMetadataType = {}));
 class SecurityMetadataDecryptor {
     constructor(exchangeKeysManager, primitives, exchangeData, exchangeDataMap, secureDelegationsEncryption, dataOwnerApi) {
         this.exchangeKeysManager = exchangeKeysManager;
@@ -41,8 +41,8 @@ class SecurityMetadataDecryptor {
         });
     }
     extractFromLegacyDelegations(entity, dataOwnersHierarchySubset, metadataType) {
-        var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
             if (!dataOwnersHierarchySubset.length)
                 throw new Error("`dataOwnersHierarchySubset` can't be empty");
             let delegations;
@@ -117,8 +117,8 @@ class SecurityMetadataDecryptor {
         });
     }
     decryptSecureDelegationsUsingCache(entities, dataOwnersHierarchySubset, metadataType) {
-        var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
             const toSearchById = new Set([]);
             const toSearchByDelegationKey = new Set([]);
             for (const e of entities) {
@@ -167,8 +167,8 @@ class SecurityMetadataDecryptor {
         }
     }
     decryptSecureDelegationsUsingKnownExchangeData(entities, dataOwnersHierarchySubset, metadataType) {
-        var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
             const toSearchById = new Set([]);
             for (const e of entities) {
                 for (const delegation of Object.values((_b = (_a = e.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {})) {
@@ -196,8 +196,8 @@ class SecurityMetadataDecryptor {
         });
     }
     decryptSecureDelegationsUsingExchangeDataMap(entities, dataOwnersHierarchySubset, metadataType) {
-        var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
             const toSearchByExchangeDataMap = new Set([]);
             for (const e of entities) {
                 for (const [delegationKey, delegation] of Object.entries((_b = (_a = e.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {})) {
@@ -260,8 +260,8 @@ class SecurityMetadataDecryptor {
         });
     }
     decryptAllSecureDelegations(entity, dataOwnersHierarchySubset, metadataType) {
-        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const secureDelegationEntries = Object.entries((_b = (_a = entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {});
             const toSearchByDelegationKey = secureDelegationEntries.flatMap(([delegationKey, delegation]) => {
                 if (!delegation.exchangeDataId) {
@@ -330,8 +330,8 @@ class SecurityMetadataDecryptor {
         });
     }
     getDelegationMemberDetails(typedEntity) {
-        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const res = {};
             // 1. Add all explicit data owners, keep only delegations with at least an anonymous data owner to check later
             let remainingDelegations = Object.entries((_b = (_a = typedEntity.entity.securityMetadata) === null || _a === void 0 ? void 0 : _a.secureDelegations) !== null && _b !== void 0 ? _b : {});
@@ -440,8 +440,8 @@ class SecurityMetadataDecryptor {
         });
     }
     getEntityLegacyDelegationAccessLevel(entity, dataOwnersHierarchySubset) {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             if (!dataOwnersHierarchySubset.length)
                 throw new Error("`dataOwnersHierarchySubset` can't be empty");
             // Legacy delegations provide write access
@@ -452,8 +452,8 @@ class SecurityMetadataDecryptor {
         });
     }
     getEntitySecureDelegationAccessLevel(entity, dataOwnersHierarchySubset) {
-        var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
             if (!dataOwnersHierarchySubset.length)
                 throw new Error("`dataOwnersHierarchySubset` can't be empty");
             // If the data owner is explicit all delegations he can access has his id. If the delegator is anonymous all delegations he can access are

package/icc-x-api/crypto/SecurityMetadataDecryptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityMetadataDecryptor.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecurityMetadataDecryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAA4G;AAQ5G,uDAAmG;AAEnG,IAAO,eAAe,GAAG,yBAAgB,CAAC,eAAe,CAAA;AAUzD,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,uEAAY,CAAA;IACZ,iFAAa,CAAA;IACb,mFAAc,CAAA;AAChB,CAAC,EAJW,oBAAoB,GAApB,4BAAoB,KAApB,4BAAoB,QAI/B;AAED,MAAa,yBAAyB;IACpC,YACmB,mBAAwC,EACxC,UAA4B,EAC5B,YAAiC,EACjC,eAAuC,EACvC,2BAAwD,EACxD,YAA8B;QAL9B,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAqB;QACjC,oBAAe,GAAf,eAAe,CAAwB;QACvC,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,iBAAY,GAAZ,YAAY,CAAkB;IAC9C,CAAC;IAEE,wBAAwB,CAC5B,QAAmD,EACnD,yBAAmC,EACnC,YAAkC;;YAElC,uEAAuE;YACvE,MAAM,GAAG,GAAqC,EAAE,CAAA;YAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE;gBACxB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,CAAC,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAA;gBACxG,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;gBAC3E,GAAG,CAAC,CAAC,CAAC,EAAG,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAA;aACxC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,4BAA4B,CACxC,MAA6C,EAC7C,yBAAmC,EACnC,YAAkC;;;YAElC,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,IAAI,WAAmD,CAAA;YACvD,IAAI,iBAAiB,GAAyC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACzF,IAAI,YAAY,GAA+B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;YACvD,QAAQ,YAAY,EAAE;gBACpB,KAAK,oBAAoB,CAAC,QAAQ;oBAChC,WAAW,GAAG,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAA;oBACtC,MAAK;gBACP,KAAK,oBAAoB,CAAC,aAAa;oBACrC,WAAW,GAAG,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,CAAA;oBACzC,iBAAiB,GAAG,CAAO,GAAG,EAAE,EAAE;wBAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;4BAAE,OAAO,KAAK,CAAA;wBAChD,IAAI;4BACF,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;4BACzE,OAAO,IAAI,CAAA;yBACZ;wBAAC,OAAO,CAAC,EAAE;4BACV,OAAO,CAAC,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,EAAE,CAAC,CAAC,CAAA;4BACpE,OAAO,KAAK,CAAA;yBACb;oBACH,CAAC,CAAA,CAAA;oBACD,YAAY,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;oBAC7C,MAAK;gBACP,KAAK,oBAAoB,CAAC,cAAc;oBACtC,WAAW,GAAG,MAAA,MAAM,CAAC,kBAAkB,mCAAI,EAAE,CAAA;oBAC7C,MAAK;gBACP;oBACE,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAA;aAClF;YACD,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,CAC7F,yBAAyB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,UAAU,CAAC;gBACzE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,UAAU,EAAE,WAAW,CAAC;gBAChE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CACnC,UAAU,EACV,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CACpG,CACN,CAAA;YACD,MAAM,GAAG,GAA4D,EAAE,CAAA;YACvE,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE;gBAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;gBAChG,IAAI,SAAS;oBACX,GAAG,CAAC,IAAI,CAAC;wBACP,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;wBAClC,oBAAoB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAY,CAAC;qBACjH,CAAC,CAAA;aACL;YACD,OAAO,GAAG,CAAA;;KACX;IAEO,gCAAgC,CAAC,UAAkB,EAAE,WAAyB;QACpF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAM,CAAC,KAAE,WAAW,EAAE,UAAU,GAAE,CAAC,CAAC,CAAA;IACvG,CAAC;IAEa,0BAA0B,CACtC,UAAsB,EACtB,iBAAuD;;YAEvD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,UAAU,CAAC,KAAM,EAAE,UAAU,CAAC,WAAY,CAAC,CAAA;YAC5H,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE;gBAC9B,IAAI;oBACF,uIAAuI;oBACvI,gIAAgI;oBAChI,+HAA+H;oBAC/H,MAAM,SAAS,GAAG,IAAA,iBAAS,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,cAAM,EAAC,UAAU,CAAC,GAAI,CAAC,CAAC,CAAC,CAAA;oBAC5F,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC3C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/B,IAAI,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;4BAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAA;qBACzE;yBAAM;wBACL,OAAO,CAAC,IAAI,CAAC,qGAAqG,CAAC,CAAA;qBACpH;iBACF;gBAAC,OAAO,CAAC,EAAE;oBACV,wEAAwE;iBACzE;aACF;QACH,CAAC;KAAA;IAEK,kCAAkC,CACtC,QAAmD,EACnD,yBAAmC,EACnC,YAAkC;;;YAElC,MAAM,YAAY,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YAC7C,MAAM,uBAAuB,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE;gBACxB,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,CAAC,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE;oBACrG,IACE,CAAC,UAAU,CAAC,SAAS;wBACrB,CAAC,UAAU,CAAC,QAAQ;wBACpB,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAC/F;wBACA,IAAI,UAAU,CAAC,cAAc,EAAE;4BAC7B,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;yBAC5C;6BAAM;4BACL,uBAAuB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;yBAC3C;qBACF;iBACF;aACF;YACD,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,GAAG,YAAY,CAAC,EAAE,KAAK,CAAC,CAAA;YAC1G,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAA;YACjI,MAAM,GAAG,GAAqC,EAAE,CAAA;YAChD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE;gBAC7B,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9C,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE;oBAC1G,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAA;oBACnI,IACE,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW;wBACnB,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,eAAC,OAAA,EAAE,KAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,0CAAE,SAAS,CAAA,IAAI,EAAE,KAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,0CAAE,QAAQ,CAAA,CAAA,EAAA,CAAC,EACrH;wBACA,CAAC;wBAAA,CAAC,MAAM,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAChH,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAC7B,CAAA;qBACF;iBACF;gBACD,GAAG,CAAC,MAAM,CAAC,EAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAA;aACrC;YACD,OAAO,GAAG,CAAA;;KACX;IAED,yBAAyB,CAAC,UAA4B,EAAE,YAAkC;;QACxF,QAAQ,YAAY,EAAE;YACpB,KAAK,oBAAoB,CAAC,QAAQ;gBAChC,OAAO,CAAC,MAAA,UAAU,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;YAChD,KAAK,oBAAoB,CAAC,aAAa;gBACrC,OAAO,CAAC,MAAA,UAAU,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;YACrD,KAAK,oBAAoB,CAAC,cAAc;gBACtC,OAAO,CAAC,MAAA,UAAU,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;YACtD;gBACE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;SAC3D;IACH,CAAC;IAEK,8CAA8C,CAClD,QAAmD,EACnD,yBAAmC,EACnC,YAAkC;;;YAElC,MAAM,YAAY,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE;gBACxB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,CAAC,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE;oBACnF,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE;wBACnG,IAAI,UAAU,CAAC,cAAc,IAAI,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE;4BACzF,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;yBAC5C;qBACF;iBACF;aACF;YACD,MAAM,yBAAyB,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,GAAG,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACzI,MAAM,GAAG,GAAqC,EAAE,CAAA;YAChD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE;gBAC7B,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE;oBACxF,MAAM,0BAA0B,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC/H,IAAI,0BAA0B,aAA1B,0BAA0B,uBAA1B,0BAA0B,CAAE,WAAW,EAAE;wBAC3C,CAAC;wBAAA,CAAC,MAAM,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,YAAY,EAAE,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CACpI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAC7B,CAAA;qBACF;iBACF;gBACD,GAAG,CAAC,MAAM,CAAC,EAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAA;aACrC;YACD,OAAO,GAAG,CAAA;;KACX;IAEK,4CAA4C,CAChD,QAAmD,EACnD,yBAAmC,EACnC,YAAkC;;;YAElC,MAAM,yBAAyB,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YAC1D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE;gBACxB,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,CAAC,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE;oBACrG,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE;wBACnG,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE;4BAC1F,yBAAyB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;yBAC7C;qBACF;iBACF;aACF;YACD,MAAM,gBAAgB,GACpB,yBAAyB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC9H,MAAM,6BAA6B,GAAwC,EAAE,CAAA;YAC7E,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE;gBAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAA;gBACxH,IAAI,SAAS,EAAE;oBACb,6BAA6B,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,SAAS,CAAA;iBAC9D;aACF;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAA;YACrE,MAAM,yBAAyB,GAC7B,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,MAAM,GAAG,CAAC;gBACrD,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;gBACrH,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,GAAG,GAAqC,EAAE,CAAA;YAChD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE;gBAC7B,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9C,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE;oBAC1G,MAAM,cAAc,GAAG,6BAA6B,CAAC,aAAa,CAAC,CAAA;oBACnE,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBACrF,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW,EAAE;wBACvB,CAAC;wBAAA,CAAC,MAAM,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAChH,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAC7B,CAAA;qBACF;iBACF;gBACD,GAAG,CAAC,MAAM,CAAC,EAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAA;aACrC;YACD,OAAO,GAAG,CAAA;;KACX;IAEK,UAAU,CACd,MAA6C,EAC7C,yBAAmC,EACnC,YAAkC;;YAElC,MAAM,0BAA0B,GAAG;gBACjC,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAC;gBAC5F,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAC;aAC7F,CAAA;YACD,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;gBACjD,MAAM,4BAA4B,GAAG,0BAA0B;qBAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;qBACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBAC1B,OAAO;oBACL,OAAO,EAAE,SAAS;oBAClB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;iBACtD,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAEK,2BAA2B,CAC/B,MAA6C,EAC7C,yBAAmC,EACnC,YAAkC;;YAElC,OAAO,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAA;QAC3F,CAAC;KAAA;IAEK,2BAA2B,CAC/B,MAA6C,EAC7C,yBAAmC,EACnC,YAAkC;;;YAElC,MAAM,uBAAuB,GAAiC,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAA;YAC9H,MAAM,uBAAuB,GAAa,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAY,EAAE;gBAClH,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE;oBAC9B,OAAO,CAAC,aAAa,CAAC,CAAA;iBACvB;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC,uBAAuB,CAAC,CAAA;YAClI,MAAM,2BAA2B,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAY,EAAE;gBAC5G,IACE,CAAC,UAAU,CAAC,cAAc;oBAC1B,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;oBAC/F,CAAC,2BAA2B,CAAC,aAAa,CAAC;oBAC3C,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,EACxD;oBACA,OAAO,CAAC,aAAa,CAAC,CAAA;iBACvB;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,gBAAgB,GACpB,2BAA2B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC/H,MAAM,6BAA6B,GAAwC,EAAE,CAAA;YAC7E,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE;gBAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAA;gBACxH,IAAI,SAAS,EAAE;oBACb,6BAA6B,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,SAAS,CAAA;iBAC9D;aACF;YACD,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAY,EAAE;gBACrG,IACE,UAAU,CAAC,cAAc;oBACzB,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;oBAC/F,CAAC,2BAA2B,CAAC,aAAa,CAAC;oBAC3C,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,EACxD;oBACA,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;iBACnC;qBAAM;oBACL,OAAO,EAAE,CAAA;iBACV;YACH,CAAC,CAAC,CAAA;YACF,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAA;YAC5H,MAAM,gBAAgB,GACpB,2BAA2B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACpI,MAAM,0BAA0B,GAA4D,EAAE,CAAA;YAC9F,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,uBAAuB,EAAE;gBACjE,IAAI,YAAY,GAMA,SAAS,CAAA;gBACzB,IAAI,2BAA2B,CAAC,aAAa,CAAC,EAAE;oBAC9C,YAAY,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAA;iBAC1D;qBAAM,IAAI,UAAU,CAAC,cAAc,EAAE;oBACpC,YAAY,GAAG,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;iBAC3D;qBAAM,IAAI,6BAA6B,CAAC,aAAa,CAAC,EAAE;oBACvD,YAAY,GAAG,gBAAgB,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC,CAAA;iBAC9E;gBACD,IAAI,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE;oBAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,CAAA;oBAChH,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE;wBACzB,0BAA0B,CAAC,IAAI,CAAC;4BAC9B,SAAS,EAAE,CAAC;4BACZ,oBAAoB,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC;yBAChG,CAAC,CAAA;qBACH;iBACF;aACF;YACD,OAAO,0BAA0B,CAAA;;KAClC;IAEK,0BAA0B,CAAC,WAAoC;;;YAGnE,MAAM,GAAG,GAA0D,EAAE,CAAA;YACrE,8GAA8G;YAC9G,IAAI,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAA;YACvG,IAAI,2BAA2B,GAAiC,EAAE,CAAA;YAClE,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE;gBAClD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;gBACrC,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,EAAE;oBAC/C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG;wBACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC/B,aAAa,EAAE,IAAI;wBACnB,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,mBAAmB,EAAE,SAAS;qBAC/B,CAAA;iBACF;qBAAM;oBACL,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;iBAClD;aACF;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAA;YAC5C,2BAA2B,GAAG,EAAE,CAAA;YAChC,mIAAmI;YACnI,mFAAmF;YACnF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACvI,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE;gBAClD,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;gBACvE,IAAI,wBAAwB,EAAE;oBAC5B,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG;wBACxB,QAAQ,EAAE,wBAAwB,CAAC,YAAY,CAAC,QAAQ;wBACxD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS;wBAC1D,aAAa,EAAE,KAAK;wBACpB,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW;wBAC3C,mBAAmB,EAAE,wBAAwB,CAAC,mBAAmB;qBAClE,CAAA;iBACF;qBAAM;oBACL,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;iBAClD;aACF;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAA;YAC5C,2BAA2B,GAAG,EAAE,CAAA;YAChC,0IAA0I;YAC1I,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;YAC3E,MAAM,yBAAyB,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAClF,oBAAoB;iBACjB,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;iBACzG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAC5B,CAAA;YACD,MAAM,6BAA6B,GAAwC,EAAE,CAAA;YAC7E,KAAK,MAAM,eAAe,IAAI,yBAAyB,EAAE;gBACvD,IAAI,CAAC,CAAC,eAAe,CAAC,wBAAwB,EAAE;oBAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAA;oBACxH,IAAI,SAAS,EAAE;wBACb,6BAA6B,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,SAAS,CAAA;qBAC9D;iBACF;aACF;YACD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,CAAA;YAC/H,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,oBAAoB,EAAE;gBACrD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,EAAE;oBAClF,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAA;oBAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBACvE,IAAI,gBAAgB,EAAE;wBACpB,GAAG,CAAC,IAAI,CAAC,GAAG;4BACV,SAAS,EAAE,gBAAgB,CAAC,YAAY,CAAC,SAAS;4BAClD,QAAQ,EAAE,gBAAgB,CAAC,YAAY,CAAC,QAAQ;4BAChD,aAAa,EAAE,KAAK;4BACpB,WAAW,EAAE,UAAU,CAAC,WAAW;4BACnC,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB;yBAC1D,CAAA;qBACF;yBAAM;wBACL,2BAA2B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;qBACrD;iBACF;qBAAM;oBACL,2BAA2B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;iBACrD;aACF;YACD,uCACK,GAAG,GACH,MAAM,CAAC,WAAW,CACnB,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBAC5D,IAAI;gBACJ;oBACE,SAAS,EAAE,gBAAgB,CAAC,SAAS;oBACrC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,mBAAmB,EAAE,SAAS;iBAC/B;aACF,CAAC,CACH,EACF;;KACF;IAEK,+BAA+B,CAAC,UAA4B,EAAE,YAAkC,EAAE,GAAc;;YACpH,QAAQ,YAAY,EAAE;gBACpB,KAAK,oBAAoB,CAAC,QAAQ;oBAChC,OAAO,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAC3E,KAAK,oBAAoB,CAAC,aAAa;oBACrC,OAAO,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAChF,KAAK,oBAAoB,CAAC,cAAc;oBACtC,OAAO,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBACjF;oBACE,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAA;aAClF;QACH,CAAC;KAAA;IAEK,oCAAoC,CACxC,MAA6C,EAC7C,yBAAmC;;;YAEnC,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,0CAA0C;YAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE;gBAC1G,OAAO,eAAe,CAAC,KAAK,CAAA;aAC7B;YACD,OAAO,SAAS,CAAA;;KACjB;IAEK,oCAAoC,CACxC,MAA6C,EAC7C,yBAAmC;;;YAEnC,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,0IAA0I;YAC1I,kDAAkD;YAClD,IAAI,qBAAqB,GAAuB,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAC1I,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,SAAS,IAAI,SAAS,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CACnI,CAAA;YACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;gBACjC,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,CACrI,CAAA;gBACD,qBAAqB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA,EAAA,CAAC,CAAA;aACzH;YACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YACjG,IAAI,QAAQ,GAAgC,SAAS,CAAA;YACrD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE;gBACpC,IAAI,UAAU,KAAK,eAAe,CAAC,KAAK,EAAE;oBACxC,OAAO,eAAe,CAAC,KAAK,CAAA;iBAC7B;gBACD,IAAI,UAAU,KAAK,eAAe,CAAC,IAAI,EAAE;oBACvC,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAA;iBAChC;aACF;YACD,OAAO,QAAQ,CAAA;;KAChB;IAEK,oBAAoB,CACxB,MAA6C,EAC7C,yBAAmC;;YAEnC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAA;YACvG,IAAI,YAAY,IAAI,SAAS;gBAAE,OAAO,YAAY,CAAA;YAClD,OAAO,IAAI,CAAC,oCAAoC,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAA;QACrF,CAAC;KAAA;IAED,oBAAoB,CAAC,MAA6C;;QAChE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACxI,CAAC;CACF;AA7fD,8DA6fC","sourcesContent":["import { b64_2ab, EncryptedEntityWithType, EntityWithDelegationTypeName, hex2ua, ua2string } from '../utils'\nimport { ExchangeKeysManager } from './ExchangeKeysManager'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { Delegation } from '../../icc-api/model/Delegation'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { EncryptedEntity, EncryptedEntityStub, SecureDelegation } from '../../icc-api/model/models'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\n\nexport type DelegationMembersDetails = {\n  delegator: string | undefined\n  delegate: string | undefined\n  fullyExplicit: boolean\n  accessControlSecret: string | undefined\n  accessLevel: AccessLevelEnum\n}\n\nexport enum SecurityMetadataType {\n  SecretId = 1, // Start from 1, avoids issues with SecretId being falsy\n  EncryptionKey,\n  OwningEntityId,\n}\n\nexport class SecurityMetadataDecryptor {\n  constructor(\n    private readonly exchangeKeysManager: ExchangeKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly exchangeData: ExchangeDataManager,\n    private readonly exchangeDataMap: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly dataOwnerApi: IccDataOwnerXApi\n  ) {}\n\n  async decryptLegacyDelegations(\n    entities: (EncryptedEntityStub | EncryptedEntity)[],\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ [entityId: string]: string[] }> {\n    // For legacy delegations there is no advantage in doing stuff in bulk.\n    const res: { [entityId: string]: string[] } = {}\n    for (const e of entities) {\n      const allDecrypted = await this.extractFromLegacyDelegations(e, dataOwnersHierarchySubset, metadataType)\n      const deduplicatedDecrypted = new Set(allDecrypted.map((x) => x.decrypted))\n      res[e.id!] = [...deduplicatedDecrypted]\n    }\n    return res\n  }\n\n  private async extractFromLegacyDelegations(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    let delegations: { [delegateId: string]: Delegation[] }\n    let validateDecrypted: (result: string) => Promise<boolean> = (x) => Promise.resolve(!!x)\n    let mapDecrypted: (result: string) => string = (x) => x\n    switch (metadataType) {\n      case SecurityMetadataType.SecretId:\n        delegations = entity.delegations ?? {}\n        break\n      case SecurityMetadataType.EncryptionKey:\n        delegations = entity.encryptionKeys ?? {}\n        validateDecrypted = async (key) => {\n          if (!/^[0-9A-Fa-f\\-]+$/g.test(key)) return false\n          try {\n            await this.primitives.AES.importKey('raw', hex2ua(key.replace(/-/g, '')))\n            return true\n          } catch (e) {\n            console.warn(`Could not import key ${key} as an encryption key.`, e)\n            return false\n          }\n        }\n        mapDecrypted = (key) => key.replace(/-/g, '')\n        break\n      case SecurityMetadataType.OwningEntityId:\n        delegations = entity.cryptedForeignKeys ?? {}\n        break\n      default:\n        throw new Error(`Internal error: invalid SecurityMetadataType ${metadataType}`)\n    }\n    const delegationsWithOwner = Object.entries(delegations).flatMap(([delegateId, delegations]) =>\n      dataOwnersHierarchySubset.some((dataOwnerId) => dataOwnerId === delegateId)\n        ? this.populateLegacyDelegationDelegate(delegateId, delegations)\n        : this.populateLegacyDelegationDelegate(\n            delegateId,\n            delegations.filter((d) => dataOwnersHierarchySubset.some((dataOwnerId) => d.owner === dataOwnerId))\n          )\n    )\n    const res: { decrypted: string; dataOwnersWithAccess: string[] }[] = []\n    for (const delegation of delegationsWithOwner) {\n      const decrypted = await this.tryDecryptLegacyDelegation(delegation, (k) => validateDecrypted(k))\n      if (decrypted)\n        res.push({\n          decrypted: mapDecrypted(decrypted),\n          dataOwnersWithAccess: delegation.owner ? [delegation.owner, delegation.delegatedTo!] : [delegation.delegatedTo!],\n        })\n    }\n    return res\n  }\n\n  private populateLegacyDelegationDelegate(delegateId: string, delegations: Delegation[]): Delegation[] {\n    return delegations.map((d) => (d.delegatedTo === delegateId ? d : { ...d, delegatedTo: delegateId }))\n  }\n\n  private async tryDecryptLegacyDelegation(\n    delegation: Delegation,\n    validateDecrypted: (result: string) => Promise<boolean>\n  ): Promise<string | undefined> {\n    const exchangeKeys = await this.exchangeKeysManager.getDecryptionExchangeKeysFor(delegation.owner!, delegation.delegatedTo!)\n    for (const key of exchangeKeys) {\n      try {\n        // Format of encrypted key for any delegation should be entityId:key, but with the merging of entities the entityId might not match the\n        // current id. As a checksum we are only verifying that the decrypted bytes can be represented as a string with exactly one ':'.\n        // Additionally, we also have a validator that is specific for each type of delegation content (encryption key, secret id, ...)\n        const decrypted = ua2string(await this.primitives.AES.decrypt(key, hex2ua(delegation.key!)))\n        const decryptedSplit = decrypted.split(':')\n        if (decryptedSplit.length === 2) {\n          if (await validateDecrypted(decryptedSplit[1])) return decryptedSplit[1]\n        } else {\n          console.warn(\"Error in the decrypted delegation: content should contain exactly 1 ':', the delegation is ignored.\")\n        }\n      } catch (e) {\n        // Do nothing: the delegation uses another exchange key owner->delegator\n      }\n    }\n  }\n\n  async decryptSecureDelegationsUsingCache(\n    entities: (EncryptedEntityStub | EncryptedEntity)[],\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ [entityId: string]: string[] }> {\n    const toSearchById: Set<string> = new Set([])\n    const toSearchByDelegationKey: Set<string> = new Set([])\n    for (const e of entities) {\n      for (const [delegationKey, delegation] of Object.entries(e.securityMetadata?.secureDelegations ?? {})) {\n        if (\n          !delegation.delegator ||\n          !delegation.delegate ||\n          dataOwnersHierarchySubset.some((it) => it == delegation.delegator || it == delegation.delegate)\n        ) {\n          if (delegation.exchangeDataId) {\n            toSearchById.add(delegation.exchangeDataId)\n          } else {\n            toSearchByDelegationKey.add(delegationKey)\n          }\n        }\n      }\n    }\n    const cachedByExchangeDataId = await this.exchangeData.getDecryptionDataKeyByIds([...toSearchById], false)\n    const cachedByDelegationKey = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash([...toSearchByDelegationKey])\n    const res: { [entityId: string]: string[] } = {}\n    for (const entity of entities) {\n      const currEntityRes: Set<string> = new Set([])\n      for (const [delegationKey, delegation] of Object.entries(entity.securityMetadata?.secureDelegations ?? {})) {\n        const cached = delegation.exchangeDataId ? cachedByExchangeDataId[delegation.exchangeDataId] : cachedByDelegationKey[delegationKey]\n        if (\n          cached?.exchangeKey &&\n          dataOwnersHierarchySubset.some((it) => it == cached?.exchangeData?.delegator || it == cached?.exchangeData?.delegate)\n        ) {\n          ;(await this.decryptSecureDelegationMetadata(delegation, metadataType, cached.exchangeKey)).forEach((decrypted) =>\n            currEntityRes.add(decrypted)\n          )\n        }\n      }\n      res[entity.id!] = [...currEntityRes]\n    }\n    return res\n  }\n\n  hasSecurityMetadataOfType(delegation: SecureDelegation, metadataType: SecurityMetadataType): boolean {\n    switch (metadataType) {\n      case SecurityMetadataType.SecretId:\n        return (delegation.secretIds ?? []).length > 0\n      case SecurityMetadataType.EncryptionKey:\n        return (delegation.encryptionKeys ?? []).length > 0\n      case SecurityMetadataType.OwningEntityId:\n        return (delegation.owningEntityIds ?? []).length > 0\n      default:\n        throw new Error('Internal error: invalid metadata type')\n    }\n  }\n\n  async decryptSecureDelegationsUsingKnownExchangeData(\n    entities: (EncryptedEntityStub | EncryptedEntity)[],\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ [entityId: string]: string[] }> {\n    const toSearchById: Set<string> = new Set([])\n    for (const e of entities) {\n      for (const delegation of Object.values(e.securityMetadata?.secureDelegations ?? {})) {\n        if (dataOwnersHierarchySubset.some((it) => it == delegation.delegator || it == delegation.delegate)) {\n          if (delegation.exchangeDataId && this.hasSecurityMetadataOfType(delegation, metadataType)) {\n            toSearchById.add(delegation.exchangeDataId)\n          }\n        }\n      }\n    }\n    const retrievedByExchangeDataId = toSearchById.size > 0 ? await this.exchangeData.getDecryptionDataKeyByIds([...toSearchById], true) : {}\n    const res: { [entityId: string]: string[] } = {}\n    for (const entity of entities) {\n      const currEntityRes: Set<string> = new Set([])\n      for (const delegation of Object.values(entity.securityMetadata?.secureDelegations ?? {})) {\n        const currDelegationExchangeData = delegation.exchangeDataId ? retrievedByExchangeDataId[delegation.exchangeDataId] : undefined\n        if (currDelegationExchangeData?.exchangeKey) {\n          ;(await this.decryptSecureDelegationMetadata(delegation, metadataType, currDelegationExchangeData.exchangeKey)).forEach((decrypted) =>\n            currEntityRes.add(decrypted)\n          )\n        }\n      }\n      res[entity.id!] = [...currEntityRes]\n    }\n    return res\n  }\n\n  async decryptSecureDelegationsUsingExchangeDataMap(\n    entities: (EncryptedEntityStub | EncryptedEntity)[],\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ [entityId: string]: string[] }> {\n    const toSearchByExchangeDataMap: Set<string> = new Set([])\n    for (const e of entities) {\n      for (const [delegationKey, delegation] of Object.entries(e.securityMetadata?.secureDelegations ?? {})) {\n        if (dataOwnersHierarchySubset.some((it) => it == delegation.delegator || it == delegation.delegate)) {\n          if (!delegation.exchangeDataId && this.hasSecurityMetadataOfType(delegation, metadataType)) {\n            toSearchByExchangeDataMap.add(delegationKey)\n          }\n        }\n      }\n    }\n    const exchangeDataMaps =\n      toSearchByExchangeDataMap.size > 0 ? await this.exchangeDataMap.getExchangeDataMapBatch([...toSearchByExchangeDataMap]) : []\n    const exchangeDataIdByDelegationKey: { [delegationKey: string]: string } = {}\n    for (const exchangeDataMap of exchangeDataMaps) {\n      const decrypted = await this.secureDelegationsEncryption.decryptExchangeDataId(exchangeDataMap.encryptedExchangeDataIds)\n      if (decrypted) {\n        exchangeDataIdByDelegationKey[exchangeDataMap.id] = decrypted\n      }\n    }\n    if (Object.keys(exchangeDataIdByDelegationKey).length == 0) return {}\n    const retrievedByExchangeDataId =\n      Object.values(exchangeDataIdByDelegationKey).length > 0\n        ? await this.exchangeData.getDecryptionDataKeyByIds([...new Set(Object.values(exchangeDataIdByDelegationKey))], true)\n        : {}\n    const res: { [entityId: string]: string[] } = {}\n    for (const entity of entities) {\n      const currEntityRes: Set<string> = new Set([])\n      for (const [delegationKey, delegation] of Object.entries(entity.securityMetadata?.secureDelegations ?? {})) {\n        const exchangeDataId = exchangeDataIdByDelegationKey[delegationKey]\n        const cached = exchangeDataId ? retrievedByExchangeDataId[exchangeDataId] : undefined\n        if (cached?.exchangeKey) {\n          ;(await this.decryptSecureDelegationMetadata(delegation, metadataType, cached.exchangeKey)).forEach((decrypted) =>\n            currEntityRes.add(decrypted)\n          )\n        }\n      }\n      res[entity.id!] = [...currEntityRes]\n    }\n    return res\n  }\n\n  async decryptAll(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ ownerId: string; extracted: string[] }[]> {\n    const allExtractedWithDataOwners = [\n      ...(await this.decryptAllLegacyDelegations(entity, dataOwnersHierarchySubset, metadataType)),\n      ...(await this.decryptAllSecureDelegations(entity, dataOwnersHierarchySubset, metadataType)),\n    ]\n    return dataOwnersHierarchySubset.map((dataOwner) => {\n      const decryptedEntriesForDataOwner = allExtractedWithDataOwners\n        .filter((x) => x.dataOwnersWithAccess.some((d) => dataOwner == d))\n        .map((x) => x.decrypted)\n      return {\n        ownerId: dataOwner,\n        extracted: [...new Set(decryptedEntriesForDataOwner)],\n      }\n    })\n  }\n\n  async decryptAllLegacyDelegations(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n    return this.extractFromLegacyDelegations(entity, dataOwnersHierarchySubset, metadataType)\n  }\n\n  async decryptAllSecureDelegations(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n    const secureDelegationEntries: [string, SecureDelegation][] = Object.entries(entity.securityMetadata?.secureDelegations ?? {})\n    const toSearchByDelegationKey: string[] = secureDelegationEntries.flatMap(([delegationKey, delegation]): string[] => {\n      if (!delegation.exchangeDataId) {\n        return [delegationKey]\n      } else {\n        return []\n      }\n    })\n    const exchangeDataByDelegationKey = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(toSearchByDelegationKey)\n    const toSearchWithExchangeDataMap = secureDelegationEntries.flatMap(([delegationKey, delegation]): string[] => {\n      if (\n        !delegation.exchangeDataId &&\n        dataOwnersHierarchySubset.some((it) => delegation.delegate == it || delegation.delegator == it) &&\n        !exchangeDataByDelegationKey[delegationKey] &&\n        this.hasSecurityMetadataOfType(delegation, metadataType)\n      ) {\n        return [delegationKey]\n      } else {\n        return []\n      }\n    })\n    const exchangeDataMaps =\n      toSearchWithExchangeDataMap.length > 0 ? await this.exchangeDataMap.getExchangeDataMapBatch(toSearchWithExchangeDataMap) : []\n    const exchangeDataIdByDelegationKey: { [delegationKey: string]: string } = {}\n    for (const exchangeDataMap of exchangeDataMaps) {\n      const decrypted = await this.secureDelegationsEncryption.decryptExchangeDataId(exchangeDataMap.encryptedExchangeDataIds)\n      if (decrypted) {\n        exchangeDataIdByDelegationKey[exchangeDataMap.id] = decrypted\n      }\n    }\n    const toSearchDirectlyById = secureDelegationEntries.flatMap(([delegationKey, delegation]): string[] => {\n      if (\n        delegation.exchangeDataId &&\n        dataOwnersHierarchySubset.some((it) => delegation.delegate == it || delegation.delegator == it) &&\n        !exchangeDataByDelegationKey[delegationKey] &&\n        this.hasSecurityMetadataOfType(delegation, metadataType)\n      ) {\n        return [delegation.exchangeDataId]\n      } else {\n        return []\n      }\n    })\n    const allExchangeDataIdToRetrieve = [...new Set([...toSearchDirectlyById, ...Object.values(exchangeDataIdByDelegationKey)])]\n    const exchangeDataById =\n      allExchangeDataIdToRetrieve.length > 0 ? await this.exchangeData.getDecryptionDataKeyByIds(allExchangeDataIdToRetrieve, true) : {}\n    const allExtractedWithDataOwners: { decrypted: string; dataOwnersWithAccess: string[] }[] = []\n    for (const [delegationKey, delegation] of secureDelegationEntries) {\n      let exchangeData:\n        | {\n            exchangeKey: CryptoKey | undefined\n            accessControlSecret: string | undefined\n            exchangeData: ExchangeData\n          }\n        | undefined = undefined\n      if (exchangeDataByDelegationKey[delegationKey]) {\n        exchangeData = exchangeDataByDelegationKey[delegationKey]\n      } else if (delegation.exchangeDataId) {\n        exchangeData = exchangeDataById[delegation.exchangeDataId]\n      } else if (exchangeDataIdByDelegationKey[delegationKey]) {\n        exchangeData = exchangeDataById[exchangeDataIdByDelegationKey[delegationKey]]\n      }\n      if (exchangeData && exchangeData.exchangeKey) {\n        const decrypted = await this.decryptSecureDelegationMetadata(delegation, metadataType, exchangeData.exchangeKey)\n        for (const d of decrypted) {\n          allExtractedWithDataOwners.push({\n            decrypted: d,\n            dataOwnersWithAccess: [exchangeData.exchangeData.delegator, exchangeData.exchangeData.delegate],\n          })\n        }\n      }\n    }\n    return allExtractedWithDataOwners\n  }\n\n  async getDelegationMemberDetails(typedEntity: EncryptedEntityWithType): Promise<{\n    [delegationKey: string]: DelegationMembersDetails\n  }> {\n    const res: { [delegationKey: string]: DelegationMembersDetails } = {}\n    // 1. Add all explicit data owners, keep only delegations with at least an anonymous data owner to check later\n    let remainingDelegations = Object.entries(typedEntity.entity.securityMetadata?.secureDelegations ?? {})\n    let updatedRemainingDelegations: [string, SecureDelegation][] = []\n    for (const delegationEntry of remainingDelegations) {\n      const delegation = delegationEntry[1]\n      if (delegation.delegator && delegation.delegate) {\n        res[delegationEntry[0]] = {\n          delegate: delegation.delegate,\n          delegator: delegation.delegator,\n          fullyExplicit: true,\n          accessLevel: delegation.permissions,\n          accessControlSecret: undefined,\n        }\n      } else {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return res\n    updatedRemainingDelegations = []\n    // 2. Attempt to identify the anonymous data owner of remaining delegations by checking if we have the exchange data cached by hash\n    // Note: we can find exchange data by hash only if we could successfully decrypt it\n    const cachedExchangeData = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(remainingDelegations.map((d) => d[0]))\n    for (const delegationEntry of remainingDelegations) {\n      const exchangeDataOfDelegation = cachedExchangeData[delegationEntry[0]]\n      if (exchangeDataOfDelegation) {\n        res[delegationEntry[0]] = {\n          delegate: exchangeDataOfDelegation.exchangeData.delegate,\n          delegator: exchangeDataOfDelegation.exchangeData.delegator,\n          fullyExplicit: false,\n          accessLevel: delegationEntry[1].permissions,\n          accessControlSecret: exchangeDataOfDelegation.accessControlSecret,\n        }\n      } else {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return res\n    updatedRemainingDelegations = []\n    // 3. Attempt to identify the anonymous data owner of remaining delegations between us (or one of our parents) and an anonymous data owner\n    const hierarchy = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n    const remainingExchangeDataMaps = await this.exchangeDataMap.getExchangeDataMapBatch(\n      remainingDelegations\n        .filter(([_, delegation]) => hierarchy.some((x) => x == delegation.delegator || x == delegation.delegate))\n        .map(([hash, _]) => hash)\n    )\n    const exchangeDataIdByDelegationKey: { [delegationKey: string]: string } = {}\n    for (const exchangeDataMap of remainingExchangeDataMaps) {\n      if (!!exchangeDataMap.encryptedExchangeDataIds) {\n        const decrypted = await this.secureDelegationsEncryption.decryptExchangeDataId(exchangeDataMap.encryptedExchangeDataIds)\n        if (decrypted) {\n          exchangeDataIdByDelegationKey[exchangeDataMap.id] = decrypted\n        }\n      }\n    }\n    const exchangeDataByIds = await this.exchangeData.getDecryptionDataKeyByIds(Object.values(exchangeDataIdByDelegationKey), true)\n    for (const [hash, delegation] of remainingDelegations) {\n      if (hierarchy.some((x) => x === delegation.delegate || x === delegation.delegator)) {\n        const dataId = exchangeDataIdByDelegationKey[hash]\n        const exchangeDataInfo = dataId ? exchangeDataByIds[dataId] : undefined\n        if (exchangeDataInfo) {\n          res[hash] = {\n            delegator: exchangeDataInfo.exchangeData.delegator,\n            delegate: exchangeDataInfo.exchangeData.delegate,\n            fullyExplicit: false,\n            accessLevel: delegation.permissions,\n            accessControlSecret: exchangeDataInfo.accessControlSecret,\n          }\n        } else {\n          updatedRemainingDelegations.push([hash, delegation])\n        }\n      } else {\n        updatedRemainingDelegations.push([hash, delegation])\n      }\n    }\n    return {\n      ...res,\n      ...Object.fromEntries(\n        updatedRemainingDelegations.map(([hash, secureDelegation]) => [\n          hash,\n          {\n            delegator: secureDelegation.delegator,\n            delegate: secureDelegation.delegate,\n            fullyExplicit: false,\n            accessLevel: secureDelegation.permissions,\n            accessControlSecret: undefined,\n          },\n        ])\n      ),\n    }\n  }\n\n  async decryptSecureDelegationMetadata(delegation: SecureDelegation, metadataType: SecurityMetadataType, key: CryptoKey): Promise<string[]> {\n    switch (metadataType) {\n      case SecurityMetadataType.SecretId:\n        return this.secureDelegationsEncryption.decryptSecretIds(delegation, key)\n      case SecurityMetadataType.EncryptionKey:\n        return this.secureDelegationsEncryption.decryptEncryptionKeys(delegation, key)\n      case SecurityMetadataType.OwningEntityId:\n        return this.secureDelegationsEncryption.decryptOwningEntityIds(delegation, key)\n      default:\n        throw new Error(`Internal error: invalid SecurityMetadataType ${metadataType}`)\n    }\n  }\n\n  async getEntityLegacyDelegationAccessLevel(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[]\n  ): Promise<AccessLevelEnum | undefined> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    // Legacy delegations provide write access\n    if (Object.keys(entity.delegations ?? {}).some((delegate) => dataOwnersHierarchySubset.includes(delegate))) {\n      return AccessLevelEnum.WRITE\n    }\n    return undefined\n  }\n\n  async getEntitySecureDelegationAccessLevel(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[]\n  ): Promise<AccessLevelEnum | undefined> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    // If the data owner is explicit all delegations he can access has his id. If the delegator is anonymous all delegations he can access are\n    // accessible by hash. No mixed scenario possible.\n    let accessibleDelegations: SecureDelegation[] = Object.values(entity.securityMetadata?.secureDelegations ?? {}).filter((secureDelegation) =>\n      dataOwnersHierarchySubset.some((dataOwner) => dataOwner === secureDelegation.delegator || dataOwner === secureDelegation.delegate)\n    )\n    if (!accessibleDelegations.length) {\n      const availableCanonicalHashes = Object.keys(\n        await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(Object.keys(entity.securityMetadata?.secureDelegations ?? {}))\n      )\n      accessibleDelegations = availableCanonicalHashes.map((hash) => (entity.securityMetadata?.secureDelegations ?? {})[hash])\n    }\n    const permissions = accessibleDelegations.map((secureDelegation) => secureDelegation.permissions)\n    let maxLevel: AccessLevelEnum | undefined = undefined\n    for (const permission of permissions) {\n      if (permission === AccessLevelEnum.WRITE) {\n        return AccessLevelEnum.WRITE\n      }\n      if (permission === AccessLevelEnum.READ) {\n        maxLevel = AccessLevelEnum.READ\n      }\n    }\n    return maxLevel\n  }\n\n  async getEntityAccessLevel(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[]\n  ): Promise<AccessLevelEnum | undefined> {\n    const legacyAccess = await this.getEntityLegacyDelegationAccessLevel(entity, dataOwnersHierarchySubset)\n    if (legacyAccess != undefined) return legacyAccess\n    return this.getEntitySecureDelegationAccessLevel(entity, dataOwnersHierarchySubset)\n  }\n\n  hasAnyEncryptionKeys(entity: EncryptedEntityStub | EncryptedEntity): boolean {\n    return Object.keys(entity.encryptionKeys ?? {}).length > 0 || Object.keys(entity.securityMetadata?.secureDelegations ?? {}).length > 0\n  }\n}\n"]}
+{"version":3,"file":"SecurityMetadataDecryptor.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/SecurityMetadataDecryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAA4G;AAQ5G,uDAAmG;AAEnG,IAAO,eAAe,GAAG,yBAAgB,CAAC,eAAe,CAAA;AAUzD,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,uEAAY,CAAA;IACZ,iFAAa,CAAA;IACb,mFAAc,CAAA;AAChB,CAAC,EAJW,oBAAoB,oCAApB,oBAAoB,QAI/B;AAED,MAAa,yBAAyB;IACpC,YACmB,mBAAwC,EACxC,UAA4B,EAC5B,YAAiC,EACjC,eAAuC,EACvC,2BAAwD,EACxD,YAA8B;QAL9B,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAqB;QACjC,oBAAe,GAAf,eAAe,CAAwB;QACvC,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,iBAAY,GAAZ,YAAY,CAAkB;IAC9C,CAAC;IAEE,wBAAwB,CAC5B,QAAmD,EACnD,yBAAmC,EACnC,YAAkC;;YAElC,uEAAuE;YACvE,MAAM,GAAG,GAAqC,EAAE,CAAA;YAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,CAAC,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAA;gBACxG,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;gBAC3E,GAAG,CAAC,CAAC,CAAC,EAAG,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAA;YACzC,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,4BAA4B,CACxC,MAA6C,EAC7C,yBAAmC,EACnC,YAAkC;;;YAElC,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,IAAI,WAAmD,CAAA;YACvD,IAAI,iBAAiB,GAAyC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACzF,IAAI,YAAY,GAA+B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;YACvD,QAAQ,YAAY,EAAE,CAAC;gBACrB,KAAK,oBAAoB,CAAC,QAAQ;oBAChC,WAAW,GAAG,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAA;oBACtC,MAAK;gBACP,KAAK,oBAAoB,CAAC,aAAa;oBACrC,WAAW,GAAG,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,CAAA;oBACzC,iBAAiB,GAAG,CAAO,GAAG,EAAE,EAAE;wBAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;4BAAE,OAAO,KAAK,CAAA;wBAChD,IAAI,CAAC;4BACH,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,cAAM,EAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;4BACzE,OAAO,IAAI,CAAA;wBACb,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,OAAO,CAAC,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,EAAE,CAAC,CAAC,CAAA;4BACpE,OAAO,KAAK,CAAA;wBACd,CAAC;oBACH,CAAC,CAAA,CAAA;oBACD,YAAY,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;oBAC7C,MAAK;gBACP,KAAK,oBAAoB,CAAC,cAAc;oBACtC,WAAW,GAAG,MAAA,MAAM,CAAC,kBAAkB,mCAAI,EAAE,CAAA;oBAC7C,MAAK;gBACP;oBACE,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAA;YACnF,CAAC;YACD,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,CAC7F,yBAAyB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,UAAU,CAAC;gBACzE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,UAAU,EAAE,WAAW,CAAC;gBAChE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CACnC,UAAU,EACV,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CACpG,CACN,CAAA;YACD,MAAM,GAAG,GAA4D,EAAE,CAAA;YACvE,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;gBAChG,IAAI,SAAS;oBACX,GAAG,CAAC,IAAI,CAAC;wBACP,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;wBAClC,oBAAoB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAY,CAAC;qBACjH,CAAC,CAAA;YACN,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEO,gCAAgC,CAAC,UAAkB,EAAE,WAAyB;QACpF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAM,CAAC,KAAE,WAAW,EAAE,UAAU,GAAE,CAAC,CAAC,CAAA;IACvG,CAAC;IAEa,0BAA0B,CACtC,UAAsB,EACtB,iBAAuD;;YAEvD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,UAAU,CAAC,KAAM,EAAE,UAAU,CAAC,WAAY,CAAC,CAAA;YAC5H,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,uIAAuI;oBACvI,gIAAgI;oBAChI,+HAA+H;oBAC/H,MAAM,SAAS,GAAG,IAAA,iBAAS,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAA,cAAM,EAAC,UAAU,CAAC,GAAI,CAAC,CAAC,CAAC,CAAA;oBAC5F,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC3C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAChC,IAAI,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;4BAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAA;oBAC1E,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,IAAI,CAAC,qGAAqG,CAAC,CAAA;oBACrH,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,wEAAwE;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;KAAA;IAEK,kCAAkC,CACtC,QAAmD,EACnD,yBAAmC,EACnC,YAAkC;;;YAElC,MAAM,YAAY,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YAC7C,MAAM,uBAAuB,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,CAAC,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE,CAAC;oBACtG,IACE,CAAC,UAAU,CAAC,SAAS;wBACrB,CAAC,UAAU,CAAC,QAAQ;wBACpB,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAC/F,CAAC;wBACD,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;4BAC9B,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;wBAC7C,CAAC;6BAAM,CAAC;4BACN,uBAAuB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;wBAC5C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,GAAG,YAAY,CAAC,EAAE,KAAK,CAAC,CAAA;YAC1G,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAA;YACjI,MAAM,GAAG,GAAqC,EAAE,CAAA;YAChD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9C,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE,CAAC;oBAC3G,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAA;oBACnI,IACE,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW;wBACnB,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,eAAC,OAAA,EAAE,KAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,0CAAE,SAAS,CAAA,IAAI,EAAE,KAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,0CAAE,QAAQ,CAAA,CAAA,EAAA,CAAC,EACrH,CAAC;wBACD,CAAC;wBAAA,CAAC,MAAM,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAChH,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAC7B,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAA;YACtC,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAED,yBAAyB,CAAC,UAA4B,EAAE,YAAkC;;QACxF,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,oBAAoB,CAAC,QAAQ;gBAChC,OAAO,CAAC,MAAA,UAAU,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;YAChD,KAAK,oBAAoB,CAAC,aAAa;gBACrC,OAAO,CAAC,MAAA,UAAU,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;YACrD,KAAK,oBAAoB,CAAC,cAAc;gBACtC,OAAO,CAAC,MAAA,UAAU,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;YACtD;gBACE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IAEK,8CAA8C,CAClD,QAAmD,EACnD,yBAAmC,EACnC,YAAkC;;;YAElC,MAAM,YAAY,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,CAAC,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE,CAAC;oBACpF,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACpG,IAAI,UAAU,CAAC,cAAc,IAAI,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;4BAC1F,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;wBAC7C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,yBAAyB,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,GAAG,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACzI,MAAM,GAAG,GAAqC,EAAE,CAAA;YAChD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE,CAAC;oBACzF,MAAM,0BAA0B,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC/H,IAAI,0BAA0B,aAA1B,0BAA0B,uBAA1B,0BAA0B,CAAE,WAAW,EAAE,CAAC;wBAC5C,CAAC;wBAAA,CAAC,MAAM,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,YAAY,EAAE,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CACpI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAC7B,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAA;YACtC,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEK,4CAA4C,CAChD,QAAmD,EACnD,yBAAmC,EACnC,YAAkC;;;YAElC,MAAM,yBAAyB,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YAC1D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,CAAC,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE,CAAC;oBACtG,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACpG,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;4BAC3F,yBAAyB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;wBAC9C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,gBAAgB,GACpB,yBAAyB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC9H,MAAM,6BAA6B,GAAwC,EAAE,CAAA;YAC7E,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAA;gBACxH,IAAI,SAAS,EAAE,CAAC;oBACd,6BAA6B,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,SAAS,CAAA;gBAC/D,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAA;YACrE,MAAM,yBAAyB,GAC7B,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,MAAM,GAAG,CAAC;gBACrD,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;gBACrH,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,GAAG,GAAqC,EAAE,CAAA;YAChD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9C,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,EAAE,CAAC;oBAC3G,MAAM,cAAc,GAAG,6BAA6B,CAAC,aAAa,CAAC,CAAA;oBACnE,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBACrF,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW,EAAE,CAAC;wBACxB,CAAC;wBAAA,CAAC,MAAM,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAChH,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAC7B,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAA;YACtC,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEK,UAAU,CACd,MAA6C,EAC7C,yBAAmC,EACnC,YAAkC;;YAElC,MAAM,0BAA0B,GAAG;gBACjC,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAC;gBAC5F,GAAG,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAC;aAC7F,CAAA;YACD,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;gBACjD,MAAM,4BAA4B,GAAG,0BAA0B;qBAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;qBACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBAC1B,OAAO;oBACL,OAAO,EAAE,SAAS;oBAClB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;iBACtD,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KAAA;IAEK,2BAA2B,CAC/B,MAA6C,EAC7C,yBAAmC,EACnC,YAAkC;;YAElC,OAAO,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAA;QAC3F,CAAC;KAAA;IAEK,2BAA2B,CAC/B,MAA6C,EAC7C,yBAAmC,EACnC,YAAkC;;;YAElC,MAAM,uBAAuB,GAAiC,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAA;YAC9H,MAAM,uBAAuB,GAAa,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAY,EAAE;gBAClH,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;oBAC/B,OAAO,CAAC,aAAa,CAAC,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,EAAE,CAAA;gBACX,CAAC;YACH,CAAC,CAAC,CAAA;YACF,MAAM,2BAA2B,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC,uBAAuB,CAAC,CAAA;YAClI,MAAM,2BAA2B,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAY,EAAE;gBAC5G,IACE,CAAC,UAAU,CAAC,cAAc;oBAC1B,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;oBAC/F,CAAC,2BAA2B,CAAC,aAAa,CAAC;oBAC3C,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,EACxD,CAAC;oBACD,OAAO,CAAC,aAAa,CAAC,CAAA;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,EAAE,CAAA;gBACX,CAAC;YACH,CAAC,CAAC,CAAA;YACF,MAAM,gBAAgB,GACpB,2BAA2B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC/H,MAAM,6BAA6B,GAAwC,EAAE,CAAA;YAC7E,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAA;gBACxH,IAAI,SAAS,EAAE,CAAC;oBACd,6BAA6B,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,SAAS,CAAA;gBAC/D,CAAC;YACH,CAAC;YACD,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,EAAY,EAAE;gBACrG,IACE,UAAU,CAAC,cAAc;oBACzB,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;oBAC/F,CAAC,2BAA2B,CAAC,aAAa,CAAC;oBAC3C,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,EACxD,CAAC;oBACD,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;gBACpC,CAAC;qBAAM,CAAC;oBACN,OAAO,EAAE,CAAA;gBACX,CAAC;YACH,CAAC,CAAC,CAAA;YACF,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAA;YAC5H,MAAM,gBAAgB,GACpB,2BAA2B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACpI,MAAM,0BAA0B,GAA4D,EAAE,CAAA;YAC9F,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,uBAAuB,EAAE,CAAC;gBAClE,IAAI,YAAY,GAMA,SAAS,CAAA;gBACzB,IAAI,2BAA2B,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC/C,YAAY,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAA;gBAC3D,CAAC;qBAAM,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;oBACrC,YAAY,GAAG,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;gBAC5D,CAAC;qBAAM,IAAI,6BAA6B,CAAC,aAAa,CAAC,EAAE,CAAC;oBACxD,YAAY,GAAG,gBAAgB,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC,CAAA;gBAC/E,CAAC;gBACD,IAAI,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,CAAA;oBAChH,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;wBAC1B,0BAA0B,CAAC,IAAI,CAAC;4BAC9B,SAAS,EAAE,CAAC;4BACZ,oBAAoB,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC;yBAChG,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,0BAA0B,CAAA;QACnC,CAAC;KAAA;IAEK,0BAA0B,CAAC,WAAoC;;;YAGnE,MAAM,GAAG,GAA0D,EAAE,CAAA;YACrE,8GAA8G;YAC9G,IAAI,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAA,WAAW,CAAC,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAA;YACvG,IAAI,2BAA2B,GAAiC,EAAE,CAAA;YAClE,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE,CAAC;gBACnD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;gBACrC,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAChD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG;wBACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC/B,aAAa,EAAE,IAAI;wBACnB,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,mBAAmB,EAAE,SAAS;qBAC/B,CAAA;gBACH,CAAC;qBAAM,CAAC;oBACN,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;gBACnD,CAAC;YACH,CAAC;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAA;YAC5C,2BAA2B,GAAG,EAAE,CAAA;YAChC,mIAAmI;YACnI,mFAAmF;YACnF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACvI,KAAK,MAAM,eAAe,IAAI,oBAAoB,EAAE,CAAC;gBACnD,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;gBACvE,IAAI,wBAAwB,EAAE,CAAC;oBAC7B,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG;wBACxB,QAAQ,EAAE,wBAAwB,CAAC,YAAY,CAAC,QAAQ;wBACxD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS;wBAC1D,aAAa,EAAE,KAAK;wBACpB,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW;wBAC3C,mBAAmB,EAAE,wBAAwB,CAAC,mBAAmB;qBAClE,CAAA;gBACH,CAAC;qBAAM,CAAC;oBACN,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;gBACnD,CAAC;YACH,CAAC;YACD,oBAAoB,GAAG,2BAA2B,CAAA;YAClD,IAAI,CAAC,oBAAoB,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAA;YAC5C,2BAA2B,GAAG,EAAE,CAAA;YAChC,0IAA0I;YAC1I,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAA;YAC3E,MAAM,yBAAyB,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAClF,oBAAoB;iBACjB,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;iBACzG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAC5B,CAAA;YACD,MAAM,6BAA6B,GAAwC,EAAE,CAAA;YAC7E,KAAK,MAAM,eAAe,IAAI,yBAAyB,EAAE,CAAC;gBACxD,IAAI,CAAC,CAAC,eAAe,CAAC,wBAAwB,EAAE,CAAC;oBAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAA;oBACxH,IAAI,SAAS,EAAE,CAAC;wBACd,6BAA6B,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,SAAS,CAAA;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,CAAA;YAC/H,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,oBAAoB,EAAE,CAAC;gBACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnF,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAA;oBAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBACvE,IAAI,gBAAgB,EAAE,CAAC;wBACrB,GAAG,CAAC,IAAI,CAAC,GAAG;4BACV,SAAS,EAAE,gBAAgB,CAAC,YAAY,CAAC,SAAS;4BAClD,QAAQ,EAAE,gBAAgB,CAAC,YAAY,CAAC,QAAQ;4BAChD,aAAa,EAAE,KAAK;4BACpB,WAAW,EAAE,UAAU,CAAC,WAAW;4BACnC,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB;yBAC1D,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,2BAA2B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;oBACtD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,2BAA2B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;gBACtD,CAAC;YACH,CAAC;YACD,uCACK,GAAG,GACH,MAAM,CAAC,WAAW,CACnB,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBAC5D,IAAI;gBACJ;oBACE,SAAS,EAAE,gBAAgB,CAAC,SAAS;oBACrC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,mBAAmB,EAAE,SAAS;iBAC/B;aACF,CAAC,CACH,EACF;QACH,CAAC;KAAA;IAEK,+BAA+B,CAAC,UAA4B,EAAE,YAAkC,EAAE,GAAc;;YACpH,QAAQ,YAAY,EAAE,CAAC;gBACrB,KAAK,oBAAoB,CAAC,QAAQ;oBAChC,OAAO,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAC3E,KAAK,oBAAoB,CAAC,aAAa;oBACrC,OAAO,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAChF,KAAK,oBAAoB,CAAC,cAAc;oBACtC,OAAO,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBACjF;oBACE,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAA;YACnF,CAAC;QACH,CAAC;KAAA;IAEK,oCAAoC,CACxC,MAA6C,EAC7C,yBAAmC;;;YAEnC,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,0CAA0C;YAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC3G,OAAO,eAAe,CAAC,KAAK,CAAA;YAC9B,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;KAAA;IAEK,oCAAoC,CACxC,MAA6C,EAC7C,yBAAmC;;;YAEnC,IAAI,CAAC,yBAAyB,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YACpG,0IAA0I;YAC1I,kDAAkD;YAClD,IAAI,qBAAqB,GAAuB,MAAM,CAAC,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAC1I,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,SAAS,IAAI,SAAS,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CACnI,CAAA;YACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,CACrI,CAAA;gBACD,qBAAqB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,eAAC,OAAA,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA,EAAA,CAAC,CAAA;YAC1H,CAAC;YACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YACjG,IAAI,QAAQ,GAAgC,SAAS,CAAA;YACrD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,IAAI,UAAU,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;oBACzC,OAAO,eAAe,CAAC,KAAK,CAAA;gBAC9B,CAAC;gBACD,IAAI,UAAU,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;oBACxC,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAA;gBACjC,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC;KAAA;IAEK,oBAAoB,CACxB,MAA6C,EAC7C,yBAAmC;;YAEnC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAA;YACvG,IAAI,YAAY,IAAI,SAAS;gBAAE,OAAO,YAAY,CAAA;YAClD,OAAO,IAAI,CAAC,oCAAoC,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAA;QACrF,CAAC;KAAA;IAED,oBAAoB,CAAC,MAA6C;;QAChE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAA,MAAM,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,MAAM,CAAC,gBAAgB,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACxI,CAAC;CACF;AA7fD,8DA6fC","sourcesContent":["import { b64_2ab, EncryptedEntityWithType, EntityWithDelegationTypeName, hex2ua, ua2string } from '../utils'\nimport { ExchangeKeysManager } from './ExchangeKeysManager'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { Delegation } from '../../icc-api/model/Delegation'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { ExchangeDataMapManager } from './ExchangeDataMapManager'\nimport { SecureDelegationsEncryption } from './SecureDelegationsEncryption'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { EncryptedEntity, EncryptedEntityStub, SecureDelegation } from '../../icc-api/model/models'\nimport { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\n\nexport type DelegationMembersDetails = {\n  delegator: string | undefined\n  delegate: string | undefined\n  fullyExplicit: boolean\n  accessControlSecret: string | undefined\n  accessLevel: AccessLevelEnum\n}\n\nexport enum SecurityMetadataType {\n  SecretId = 1, // Start from 1, avoids issues with SecretId being falsy\n  EncryptionKey,\n  OwningEntityId,\n}\n\nexport class SecurityMetadataDecryptor {\n  constructor(\n    private readonly exchangeKeysManager: ExchangeKeysManager,\n    private readonly primitives: CryptoPrimitives,\n    private readonly exchangeData: ExchangeDataManager,\n    private readonly exchangeDataMap: ExchangeDataMapManager,\n    private readonly secureDelegationsEncryption: SecureDelegationsEncryption,\n    private readonly dataOwnerApi: IccDataOwnerXApi\n  ) {}\n\n  async decryptLegacyDelegations(\n    entities: (EncryptedEntityStub | EncryptedEntity)[],\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ [entityId: string]: string[] }> {\n    // For legacy delegations there is no advantage in doing stuff in bulk.\n    const res: { [entityId: string]: string[] } = {}\n    for (const e of entities) {\n      const allDecrypted = await this.extractFromLegacyDelegations(e, dataOwnersHierarchySubset, metadataType)\n      const deduplicatedDecrypted = new Set(allDecrypted.map((x) => x.decrypted))\n      res[e.id!] = [...deduplicatedDecrypted]\n    }\n    return res\n  }\n\n  private async extractFromLegacyDelegations(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    let delegations: { [delegateId: string]: Delegation[] }\n    let validateDecrypted: (result: string) => Promise<boolean> = (x) => Promise.resolve(!!x)\n    let mapDecrypted: (result: string) => string = (x) => x\n    switch (metadataType) {\n      case SecurityMetadataType.SecretId:\n        delegations = entity.delegations ?? {}\n        break\n      case SecurityMetadataType.EncryptionKey:\n        delegations = entity.encryptionKeys ?? {}\n        validateDecrypted = async (key) => {\n          if (!/^[0-9A-Fa-f\\-]+$/g.test(key)) return false\n          try {\n            await this.primitives.AES.importKey('raw', hex2ua(key.replace(/-/g, '')))\n            return true\n          } catch (e) {\n            console.warn(`Could not import key ${key} as an encryption key.`, e)\n            return false\n          }\n        }\n        mapDecrypted = (key) => key.replace(/-/g, '')\n        break\n      case SecurityMetadataType.OwningEntityId:\n        delegations = entity.cryptedForeignKeys ?? {}\n        break\n      default:\n        throw new Error(`Internal error: invalid SecurityMetadataType ${metadataType}`)\n    }\n    const delegationsWithOwner = Object.entries(delegations).flatMap(([delegateId, delegations]) =>\n      dataOwnersHierarchySubset.some((dataOwnerId) => dataOwnerId === delegateId)\n        ? this.populateLegacyDelegationDelegate(delegateId, delegations)\n        : this.populateLegacyDelegationDelegate(\n            delegateId,\n            delegations.filter((d) => dataOwnersHierarchySubset.some((dataOwnerId) => d.owner === dataOwnerId))\n          )\n    )\n    const res: { decrypted: string; dataOwnersWithAccess: string[] }[] = []\n    for (const delegation of delegationsWithOwner) {\n      const decrypted = await this.tryDecryptLegacyDelegation(delegation, (k) => validateDecrypted(k))\n      if (decrypted)\n        res.push({\n          decrypted: mapDecrypted(decrypted),\n          dataOwnersWithAccess: delegation.owner ? [delegation.owner, delegation.delegatedTo!] : [delegation.delegatedTo!],\n        })\n    }\n    return res\n  }\n\n  private populateLegacyDelegationDelegate(delegateId: string, delegations: Delegation[]): Delegation[] {\n    return delegations.map((d) => (d.delegatedTo === delegateId ? d : { ...d, delegatedTo: delegateId }))\n  }\n\n  private async tryDecryptLegacyDelegation(\n    delegation: Delegation,\n    validateDecrypted: (result: string) => Promise<boolean>\n  ): Promise<string | undefined> {\n    const exchangeKeys = await this.exchangeKeysManager.getDecryptionExchangeKeysFor(delegation.owner!, delegation.delegatedTo!)\n    for (const key of exchangeKeys) {\n      try {\n        // Format of encrypted key for any delegation should be entityId:key, but with the merging of entities the entityId might not match the\n        // current id. As a checksum we are only verifying that the decrypted bytes can be represented as a string with exactly one ':'.\n        // Additionally, we also have a validator that is specific for each type of delegation content (encryption key, secret id, ...)\n        const decrypted = ua2string(await this.primitives.AES.decrypt(key, hex2ua(delegation.key!)))\n        const decryptedSplit = decrypted.split(':')\n        if (decryptedSplit.length === 2) {\n          if (await validateDecrypted(decryptedSplit[1])) return decryptedSplit[1]\n        } else {\n          console.warn(\"Error in the decrypted delegation: content should contain exactly 1 ':', the delegation is ignored.\")\n        }\n      } catch (e) {\n        // Do nothing: the delegation uses another exchange key owner->delegator\n      }\n    }\n  }\n\n  async decryptSecureDelegationsUsingCache(\n    entities: (EncryptedEntityStub | EncryptedEntity)[],\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ [entityId: string]: string[] }> {\n    const toSearchById: Set<string> = new Set([])\n    const toSearchByDelegationKey: Set<string> = new Set([])\n    for (const e of entities) {\n      for (const [delegationKey, delegation] of Object.entries(e.securityMetadata?.secureDelegations ?? {})) {\n        if (\n          !delegation.delegator ||\n          !delegation.delegate ||\n          dataOwnersHierarchySubset.some((it) => it == delegation.delegator || it == delegation.delegate)\n        ) {\n          if (delegation.exchangeDataId) {\n            toSearchById.add(delegation.exchangeDataId)\n          } else {\n            toSearchByDelegationKey.add(delegationKey)\n          }\n        }\n      }\n    }\n    const cachedByExchangeDataId = await this.exchangeData.getDecryptionDataKeyByIds([...toSearchById], false)\n    const cachedByDelegationKey = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash([...toSearchByDelegationKey])\n    const res: { [entityId: string]: string[] } = {}\n    for (const entity of entities) {\n      const currEntityRes: Set<string> = new Set([])\n      for (const [delegationKey, delegation] of Object.entries(entity.securityMetadata?.secureDelegations ?? {})) {\n        const cached = delegation.exchangeDataId ? cachedByExchangeDataId[delegation.exchangeDataId] : cachedByDelegationKey[delegationKey]\n        if (\n          cached?.exchangeKey &&\n          dataOwnersHierarchySubset.some((it) => it == cached?.exchangeData?.delegator || it == cached?.exchangeData?.delegate)\n        ) {\n          ;(await this.decryptSecureDelegationMetadata(delegation, metadataType, cached.exchangeKey)).forEach((decrypted) =>\n            currEntityRes.add(decrypted)\n          )\n        }\n      }\n      res[entity.id!] = [...currEntityRes]\n    }\n    return res\n  }\n\n  hasSecurityMetadataOfType(delegation: SecureDelegation, metadataType: SecurityMetadataType): boolean {\n    switch (metadataType) {\n      case SecurityMetadataType.SecretId:\n        return (delegation.secretIds ?? []).length > 0\n      case SecurityMetadataType.EncryptionKey:\n        return (delegation.encryptionKeys ?? []).length > 0\n      case SecurityMetadataType.OwningEntityId:\n        return (delegation.owningEntityIds ?? []).length > 0\n      default:\n        throw new Error('Internal error: invalid metadata type')\n    }\n  }\n\n  async decryptSecureDelegationsUsingKnownExchangeData(\n    entities: (EncryptedEntityStub | EncryptedEntity)[],\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ [entityId: string]: string[] }> {\n    const toSearchById: Set<string> = new Set([])\n    for (const e of entities) {\n      for (const delegation of Object.values(e.securityMetadata?.secureDelegations ?? {})) {\n        if (dataOwnersHierarchySubset.some((it) => it == delegation.delegator || it == delegation.delegate)) {\n          if (delegation.exchangeDataId && this.hasSecurityMetadataOfType(delegation, metadataType)) {\n            toSearchById.add(delegation.exchangeDataId)\n          }\n        }\n      }\n    }\n    const retrievedByExchangeDataId = toSearchById.size > 0 ? await this.exchangeData.getDecryptionDataKeyByIds([...toSearchById], true) : {}\n    const res: { [entityId: string]: string[] } = {}\n    for (const entity of entities) {\n      const currEntityRes: Set<string> = new Set([])\n      for (const delegation of Object.values(entity.securityMetadata?.secureDelegations ?? {})) {\n        const currDelegationExchangeData = delegation.exchangeDataId ? retrievedByExchangeDataId[delegation.exchangeDataId] : undefined\n        if (currDelegationExchangeData?.exchangeKey) {\n          ;(await this.decryptSecureDelegationMetadata(delegation, metadataType, currDelegationExchangeData.exchangeKey)).forEach((decrypted) =>\n            currEntityRes.add(decrypted)\n          )\n        }\n      }\n      res[entity.id!] = [...currEntityRes]\n    }\n    return res\n  }\n\n  async decryptSecureDelegationsUsingExchangeDataMap(\n    entities: (EncryptedEntityStub | EncryptedEntity)[],\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ [entityId: string]: string[] }> {\n    const toSearchByExchangeDataMap: Set<string> = new Set([])\n    for (const e of entities) {\n      for (const [delegationKey, delegation] of Object.entries(e.securityMetadata?.secureDelegations ?? {})) {\n        if (dataOwnersHierarchySubset.some((it) => it == delegation.delegator || it == delegation.delegate)) {\n          if (!delegation.exchangeDataId && this.hasSecurityMetadataOfType(delegation, metadataType)) {\n            toSearchByExchangeDataMap.add(delegationKey)\n          }\n        }\n      }\n    }\n    const exchangeDataMaps =\n      toSearchByExchangeDataMap.size > 0 ? await this.exchangeDataMap.getExchangeDataMapBatch([...toSearchByExchangeDataMap]) : []\n    const exchangeDataIdByDelegationKey: { [delegationKey: string]: string } = {}\n    for (const exchangeDataMap of exchangeDataMaps) {\n      const decrypted = await this.secureDelegationsEncryption.decryptExchangeDataId(exchangeDataMap.encryptedExchangeDataIds)\n      if (decrypted) {\n        exchangeDataIdByDelegationKey[exchangeDataMap.id] = decrypted\n      }\n    }\n    if (Object.keys(exchangeDataIdByDelegationKey).length == 0) return {}\n    const retrievedByExchangeDataId =\n      Object.values(exchangeDataIdByDelegationKey).length > 0\n        ? await this.exchangeData.getDecryptionDataKeyByIds([...new Set(Object.values(exchangeDataIdByDelegationKey))], true)\n        : {}\n    const res: { [entityId: string]: string[] } = {}\n    for (const entity of entities) {\n      const currEntityRes: Set<string> = new Set([])\n      for (const [delegationKey, delegation] of Object.entries(entity.securityMetadata?.secureDelegations ?? {})) {\n        const exchangeDataId = exchangeDataIdByDelegationKey[delegationKey]\n        const cached = exchangeDataId ? retrievedByExchangeDataId[exchangeDataId] : undefined\n        if (cached?.exchangeKey) {\n          ;(await this.decryptSecureDelegationMetadata(delegation, metadataType, cached.exchangeKey)).forEach((decrypted) =>\n            currEntityRes.add(decrypted)\n          )\n        }\n      }\n      res[entity.id!] = [...currEntityRes]\n    }\n    return res\n  }\n\n  async decryptAll(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ ownerId: string; extracted: string[] }[]> {\n    const allExtractedWithDataOwners = [\n      ...(await this.decryptAllLegacyDelegations(entity, dataOwnersHierarchySubset, metadataType)),\n      ...(await this.decryptAllSecureDelegations(entity, dataOwnersHierarchySubset, metadataType)),\n    ]\n    return dataOwnersHierarchySubset.map((dataOwner) => {\n      const decryptedEntriesForDataOwner = allExtractedWithDataOwners\n        .filter((x) => x.dataOwnersWithAccess.some((d) => dataOwner == d))\n        .map((x) => x.decrypted)\n      return {\n        ownerId: dataOwner,\n        extracted: [...new Set(decryptedEntriesForDataOwner)],\n      }\n    })\n  }\n\n  async decryptAllLegacyDelegations(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n    return this.extractFromLegacyDelegations(entity, dataOwnersHierarchySubset, metadataType)\n  }\n\n  async decryptAllSecureDelegations(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[],\n    metadataType: SecurityMetadataType\n  ): Promise<{ decrypted: string; dataOwnersWithAccess: string[] }[]> {\n    const secureDelegationEntries: [string, SecureDelegation][] = Object.entries(entity.securityMetadata?.secureDelegations ?? {})\n    const toSearchByDelegationKey: string[] = secureDelegationEntries.flatMap(([delegationKey, delegation]): string[] => {\n      if (!delegation.exchangeDataId) {\n        return [delegationKey]\n      } else {\n        return []\n      }\n    })\n    const exchangeDataByDelegationKey = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(toSearchByDelegationKey)\n    const toSearchWithExchangeDataMap = secureDelegationEntries.flatMap(([delegationKey, delegation]): string[] => {\n      if (\n        !delegation.exchangeDataId &&\n        dataOwnersHierarchySubset.some((it) => delegation.delegate == it || delegation.delegator == it) &&\n        !exchangeDataByDelegationKey[delegationKey] &&\n        this.hasSecurityMetadataOfType(delegation, metadataType)\n      ) {\n        return [delegationKey]\n      } else {\n        return []\n      }\n    })\n    const exchangeDataMaps =\n      toSearchWithExchangeDataMap.length > 0 ? await this.exchangeDataMap.getExchangeDataMapBatch(toSearchWithExchangeDataMap) : []\n    const exchangeDataIdByDelegationKey: { [delegationKey: string]: string } = {}\n    for (const exchangeDataMap of exchangeDataMaps) {\n      const decrypted = await this.secureDelegationsEncryption.decryptExchangeDataId(exchangeDataMap.encryptedExchangeDataIds)\n      if (decrypted) {\n        exchangeDataIdByDelegationKey[exchangeDataMap.id] = decrypted\n      }\n    }\n    const toSearchDirectlyById = secureDelegationEntries.flatMap(([delegationKey, delegation]): string[] => {\n      if (\n        delegation.exchangeDataId &&\n        dataOwnersHierarchySubset.some((it) => delegation.delegate == it || delegation.delegator == it) &&\n        !exchangeDataByDelegationKey[delegationKey] &&\n        this.hasSecurityMetadataOfType(delegation, metadataType)\n      ) {\n        return [delegation.exchangeDataId]\n      } else {\n        return []\n      }\n    })\n    const allExchangeDataIdToRetrieve = [...new Set([...toSearchDirectlyById, ...Object.values(exchangeDataIdByDelegationKey)])]\n    const exchangeDataById =\n      allExchangeDataIdToRetrieve.length > 0 ? await this.exchangeData.getDecryptionDataKeyByIds(allExchangeDataIdToRetrieve, true) : {}\n    const allExtractedWithDataOwners: { decrypted: string; dataOwnersWithAccess: string[] }[] = []\n    for (const [delegationKey, delegation] of secureDelegationEntries) {\n      let exchangeData:\n        | {\n            exchangeKey: CryptoKey | undefined\n            accessControlSecret: string | undefined\n            exchangeData: ExchangeData\n          }\n        | undefined = undefined\n      if (exchangeDataByDelegationKey[delegationKey]) {\n        exchangeData = exchangeDataByDelegationKey[delegationKey]\n      } else if (delegation.exchangeDataId) {\n        exchangeData = exchangeDataById[delegation.exchangeDataId]\n      } else if (exchangeDataIdByDelegationKey[delegationKey]) {\n        exchangeData = exchangeDataById[exchangeDataIdByDelegationKey[delegationKey]]\n      }\n      if (exchangeData && exchangeData.exchangeKey) {\n        const decrypted = await this.decryptSecureDelegationMetadata(delegation, metadataType, exchangeData.exchangeKey)\n        for (const d of decrypted) {\n          allExtractedWithDataOwners.push({\n            decrypted: d,\n            dataOwnersWithAccess: [exchangeData.exchangeData.delegator, exchangeData.exchangeData.delegate],\n          })\n        }\n      }\n    }\n    return allExtractedWithDataOwners\n  }\n\n  async getDelegationMemberDetails(typedEntity: EncryptedEntityWithType): Promise<{\n    [delegationKey: string]: DelegationMembersDetails\n  }> {\n    const res: { [delegationKey: string]: DelegationMembersDetails } = {}\n    // 1. Add all explicit data owners, keep only delegations with at least an anonymous data owner to check later\n    let remainingDelegations = Object.entries(typedEntity.entity.securityMetadata?.secureDelegations ?? {})\n    let updatedRemainingDelegations: [string, SecureDelegation][] = []\n    for (const delegationEntry of remainingDelegations) {\n      const delegation = delegationEntry[1]\n      if (delegation.delegator && delegation.delegate) {\n        res[delegationEntry[0]] = {\n          delegate: delegation.delegate,\n          delegator: delegation.delegator,\n          fullyExplicit: true,\n          accessLevel: delegation.permissions,\n          accessControlSecret: undefined,\n        }\n      } else {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return res\n    updatedRemainingDelegations = []\n    // 2. Attempt to identify the anonymous data owner of remaining delegations by checking if we have the exchange data cached by hash\n    // Note: we can find exchange data by hash only if we could successfully decrypt it\n    const cachedExchangeData = await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(remainingDelegations.map((d) => d[0]))\n    for (const delegationEntry of remainingDelegations) {\n      const exchangeDataOfDelegation = cachedExchangeData[delegationEntry[0]]\n      if (exchangeDataOfDelegation) {\n        res[delegationEntry[0]] = {\n          delegate: exchangeDataOfDelegation.exchangeData.delegate,\n          delegator: exchangeDataOfDelegation.exchangeData.delegator,\n          fullyExplicit: false,\n          accessLevel: delegationEntry[1].permissions,\n          accessControlSecret: exchangeDataOfDelegation.accessControlSecret,\n        }\n      } else {\n        updatedRemainingDelegations.push(delegationEntry)\n      }\n    }\n    remainingDelegations = updatedRemainingDelegations\n    if (!remainingDelegations.length) return res\n    updatedRemainingDelegations = []\n    // 3. Attempt to identify the anonymous data owner of remaining delegations between us (or one of our parents) and an anonymous data owner\n    const hierarchy = await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()\n    const remainingExchangeDataMaps = await this.exchangeDataMap.getExchangeDataMapBatch(\n      remainingDelegations\n        .filter(([_, delegation]) => hierarchy.some((x) => x == delegation.delegator || x == delegation.delegate))\n        .map(([hash, _]) => hash)\n    )\n    const exchangeDataIdByDelegationKey: { [delegationKey: string]: string } = {}\n    for (const exchangeDataMap of remainingExchangeDataMaps) {\n      if (!!exchangeDataMap.encryptedExchangeDataIds) {\n        const decrypted = await this.secureDelegationsEncryption.decryptExchangeDataId(exchangeDataMap.encryptedExchangeDataIds)\n        if (decrypted) {\n          exchangeDataIdByDelegationKey[exchangeDataMap.id] = decrypted\n        }\n      }\n    }\n    const exchangeDataByIds = await this.exchangeData.getDecryptionDataKeyByIds(Object.values(exchangeDataIdByDelegationKey), true)\n    for (const [hash, delegation] of remainingDelegations) {\n      if (hierarchy.some((x) => x === delegation.delegate || x === delegation.delegator)) {\n        const dataId = exchangeDataIdByDelegationKey[hash]\n        const exchangeDataInfo = dataId ? exchangeDataByIds[dataId] : undefined\n        if (exchangeDataInfo) {\n          res[hash] = {\n            delegator: exchangeDataInfo.exchangeData.delegator,\n            delegate: exchangeDataInfo.exchangeData.delegate,\n            fullyExplicit: false,\n            accessLevel: delegation.permissions,\n            accessControlSecret: exchangeDataInfo.accessControlSecret,\n          }\n        } else {\n          updatedRemainingDelegations.push([hash, delegation])\n        }\n      } else {\n        updatedRemainingDelegations.push([hash, delegation])\n      }\n    }\n    return {\n      ...res,\n      ...Object.fromEntries(\n        updatedRemainingDelegations.map(([hash, secureDelegation]) => [\n          hash,\n          {\n            delegator: secureDelegation.delegator,\n            delegate: secureDelegation.delegate,\n            fullyExplicit: false,\n            accessLevel: secureDelegation.permissions,\n            accessControlSecret: undefined,\n          },\n        ])\n      ),\n    }\n  }\n\n  async decryptSecureDelegationMetadata(delegation: SecureDelegation, metadataType: SecurityMetadataType, key: CryptoKey): Promise<string[]> {\n    switch (metadataType) {\n      case SecurityMetadataType.SecretId:\n        return this.secureDelegationsEncryption.decryptSecretIds(delegation, key)\n      case SecurityMetadataType.EncryptionKey:\n        return this.secureDelegationsEncryption.decryptEncryptionKeys(delegation, key)\n      case SecurityMetadataType.OwningEntityId:\n        return this.secureDelegationsEncryption.decryptOwningEntityIds(delegation, key)\n      default:\n        throw new Error(`Internal error: invalid SecurityMetadataType ${metadataType}`)\n    }\n  }\n\n  async getEntityLegacyDelegationAccessLevel(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[]\n  ): Promise<AccessLevelEnum | undefined> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    // Legacy delegations provide write access\n    if (Object.keys(entity.delegations ?? {}).some((delegate) => dataOwnersHierarchySubset.includes(delegate))) {\n      return AccessLevelEnum.WRITE\n    }\n    return undefined\n  }\n\n  async getEntitySecureDelegationAccessLevel(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[]\n  ): Promise<AccessLevelEnum | undefined> {\n    if (!dataOwnersHierarchySubset.length) throw new Error(\"`dataOwnersHierarchySubset` can't be empty\")\n    // If the data owner is explicit all delegations he can access has his id. If the delegator is anonymous all delegations he can access are\n    // accessible by hash. No mixed scenario possible.\n    let accessibleDelegations: SecureDelegation[] = Object.values(entity.securityMetadata?.secureDelegations ?? {}).filter((secureDelegation) =>\n      dataOwnersHierarchySubset.some((dataOwner) => dataOwner === secureDelegation.delegator || dataOwner === secureDelegation.delegate)\n    )\n    if (!accessibleDelegations.length) {\n      const availableCanonicalHashes = Object.keys(\n        await this.exchangeData.getCachedDecryptionDataKeyByAccessControlHash(Object.keys(entity.securityMetadata?.secureDelegations ?? {}))\n      )\n      accessibleDelegations = availableCanonicalHashes.map((hash) => (entity.securityMetadata?.secureDelegations ?? {})[hash])\n    }\n    const permissions = accessibleDelegations.map((secureDelegation) => secureDelegation.permissions)\n    let maxLevel: AccessLevelEnum | undefined = undefined\n    for (const permission of permissions) {\n      if (permission === AccessLevelEnum.WRITE) {\n        return AccessLevelEnum.WRITE\n      }\n      if (permission === AccessLevelEnum.READ) {\n        maxLevel = AccessLevelEnum.READ\n      }\n    }\n    return maxLevel\n  }\n\n  async getEntityAccessLevel(\n    entity: EncryptedEntityStub | EncryptedEntity,\n    dataOwnersHierarchySubset: string[]\n  ): Promise<AccessLevelEnum | undefined> {\n    const legacyAccess = await this.getEntityLegacyDelegationAccessLevel(entity, dataOwnersHierarchySubset)\n    if (legacyAccess != undefined) return legacyAccess\n    return this.getEntitySecureDelegationAccessLevel(entity, dataOwnersHierarchySubset)\n  }\n\n  hasAnyEncryptionKeys(entity: EncryptedEntityStub | EncryptedEntity): boolean {\n    return Object.keys(entity.encryptionKeys ?? {}).length > 0 || Object.keys(entity.securityMetadata?.secureDelegations ?? {}).length > 0\n  }\n}\n"]}

package/icc-x-api/crypto/ShamirKeysManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ShamirKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ShamirKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,oCAAyC;AAEzC,yEAA6E;AAC7E,mCAAuC;AAEvC;;GAEG;AACH,MAAa,iBAAiB;IAC5B,YACmB,UAA4B,EAC5B,YAA8B,EAC9B,qBAAgD,EAChD,mBAAwC;QAHxC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,0BAAqB,GAArB,qBAAqB,CAA2B;QAChD,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEJ;;;;;OAKG;IACH,qBAAqB,CAAC,SAA0B;;QAC9C,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,SAAS,CAAC,0BAA0B,mCAAI,EAAE,CAAC,CAAA;QACxF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE;YACvC,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,IAAI,IAAA,qBAAa,EAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACpE,IAAI,CAAC,EAAE,EAAE;gBACP,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAA;aAC5F;;gBAAM,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,wBAAwB,EAAE,CAAA;SACjD;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,iBAA+F,EAC/F,iBAA2B;;YAE3B,MAAM,IAAI,GAAG,yCAAuB,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAA;YACjG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACxF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACxF,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAClF,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAA;YAC9D,IAAI,WAAW,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBACxI,MAAM,IAAI,KAAK,CAAC,gDAAgD,iBAAiB,wBAAwB,iBAAiB,EAAE,CAAC,CAAA;YAC/H,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;YACpG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnE,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;aAC/I;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACpD,MAAM,IAAI,KAAK,CAAC,6EAA6E,iBAAiB,EAAE,CAAC,CAAA;aAClH;YACD,MAAM,aAAa,GAAwC,EAAE,CAAA;YAC7D,IAAI,WAAW,GAAG,IAAI,CAAA;YACtB,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;gBAChG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAA;gBAClF,aAAa,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,WAAW,CAAA;aAC5C;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE;gBAC7D,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAA,qBAAa,EAAC,GAAG,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;aACvI;YACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE;gBAC/B,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;aACtD;YACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAA;QACnE,CAAC;KAAA;IAED;;OAEG;IAEK,oBAAoB,CAAC,GAAW,EAAE,MAAoD;QAC5F,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE;YACjC,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE;gBAChD,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,+DAA+D,MAAM,EAAE,CAAC,CAAA;aAC1H;SACF;;YAAM,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sCAAsC,MAAM,EAAE,CAAC,CAAA;IACzG,CAAC;IAEO,cAAc,CAAC,SAAkC,EAAE,KAAa;QACtE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,IAAA,qBAAa,EAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YAClF,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;SAChG;QACD,OAAO;YACL,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,0BAA0B,EAAE,EAAE,GAC/B;SACF,CAAA;IACH,CAAC;IAEa,cAAc,CAC1B,SAAkC,EAClC,KAAa,EACb,WAAqB,EACrB,SAAiB,EACjB,aAAyC,EACzC,OAA4C;;YAE5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,IAAA,qBAAa,EAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;gBAClF,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;aAChG;YACD,OAAO;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,0BAA0B,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,GAClH;aACF,CAAA;QACH,CAAC;KAAA;IAEa,mBAAmB,CAC/B,OAA2B,EAC3B,WAAqB,EACrB,SAAiB,EACjB,aAAyC;;YAEzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACpF,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE;gBAC3B,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;aAC3E;iBAAM;gBACL,MAAM,eAAe,GAAG,IAAA,cAAM,EAAC,WAAW,CAAC,CAAA;gBAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBACjG,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,mEAAmE;gBAC/H,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE;oBACtC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;oBAC5I,IAAI,KAAK,KAAK,IAAA,cAAM,EAAC,IAAA,cAAM,EAAC,KAAK,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;iBACvG;gBACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAC7B,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,EACxC,WAAW,EACX,aAAa,CACd,CAAA;aACF;QACH,CAAC;KAAA;IAEa,aAAa,CACzB,MAAqB,EACrB,WAAqB,EACrB,aAAyC;;YAEzC,OAAO,WAAW,CAAC,MAAM,CACvB,CAAO,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;gBAAC,OAAA,iCAC7B,CAAC,MAAM,GAAG,CAAC,KACd,CAAC,UAAU,CAAC,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IACjG,CAAA;cAAA,EACF,OAAO,CAAC,OAAO,CAAC,EAAsC,CAAC,CACxD,CAAA;QACH,CAAC;KAAA;CACF;AAvJD,8CAuJC","sourcesContent":["import { DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { KeyPair } from './RSA'\nimport { hex2ua, ua2hex } from '../utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { fingerprintV1 } from './utils'\n\n/**\n * Allows to create or update shamir split keys.\n */\nexport class ShamirKeysManager {\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly encryptionKeysManager: UserEncryptionKeysManager,\n    private readonly exchangeDataManager: ExchangeDataManager\n  ) {}\n\n  /**\n   * Get information on existing private keys splits for the provided data owner. For each private key of the provided data owner which has been\n   * split using the Shamir sharing algorithm gives the list of the notaries (other data owners) which hold a copy of the key part.\n   * @param dataOwner a data owner\n   * @return the existing splits for the current data owner as a publicKeyFingerprint -> notariesIds object\n   */\n  getExistingSplitsInfo(dataOwner: DataOwnerOrStub): { [keyPairFingerprint: string]: string[] } {\n    const legacyPartitionDelegates = Object.keys(dataOwner.privateKeyShamirPartitions ?? {})\n    if (legacyPartitionDelegates.length > 0) {\n      const fp = dataOwner.publicKey && fingerprintV1(dataOwner.publicKey)\n      if (!fp) {\n        console.error('Invalid data owner: the owner has legacy key partitions but no legacy key.')\n      } else return { [fp]: legacyPartitionDelegates }\n    }\n    return {}\n  }\n\n  /**\n   * Creates, updates or deletes shamir splits for keys of the current data owner. Any request to update the splits for a specific key will completely\n   * replace any existing data on that split (all previous notaries will be ignored).\n   * Note: currently you can only split the legacy key pair.\n   * @param keySplitsToUpdate the fingerprints of key pairs which will have updated/new splits and the details on how to create the updated splits.\n   * @param keySplitsToDelete the fingerprints or hex-encoded spki public keys which will not be shared anymore.\n   * @throws if the parameters refer to non-existing or unavailable keys, have split creation details, or if they request to delete a non-existing\n   * split.\n   */\n  async updateSelfSplits(\n    keySplitsToUpdate: { [publicKeyHexOrFp: string]: { notariesIds: string[]; minShares: number } },\n    keySplitsToDelete: string[]\n  ): Promise<CryptoActorStubWithType> {\n    const self = CryptoActorStubWithType.fromDataOwner(await this.dataOwnerApi.getCurrentDataOwner())\n    const toUpdateSet = new Set(Object.keys(keySplitsToUpdate).map((x) => fingerprintV1(x)))\n    const toDeleteSet = new Set(Object.keys(keySplitsToDelete).map((x) => fingerprintV1(x)))\n    const intersection = Array.from(toDeleteSet).filter((x) => toUpdateSet.has(x))\n    const existingSplits = new Set(Object.keys(this.getExistingSplitsInfo(self.stub)))\n    const allKeys = this.encryptionKeysManager.getDecryptionKeys()\n    if (toDeleteSet.size !== keySplitsToDelete.length || toUpdateSet.size !== Object.keys(keySplitsToUpdate).length || intersection.length > 0)\n      throw new Error(`Duplicate keys in input:\\nkeySplitsToUpdate: ${keySplitsToUpdate}\\nkeySplitsToDelete: ${keySplitsToDelete}`)\n    Object.entries(keySplitsToUpdate).forEach(([key, params]) => this.validateShamirParams(key, params))\n    if (!Array.from(existingSplits).every((x) => existingSplits.has(x))) {\n      throw new Error(`Requested to delete non-existing split.\\nexistingSplits: ${Array.from(existingSplits)}\\ntoDelete:${Array.from(toDeleteSet)}`)\n    }\n    if (Array.from(toUpdateSet).some((x) => !allKeys[x])) {\n      throw new Error(`Private key is not available for some of the requested key split updates. ${keySplitsToUpdate}`)\n    }\n    const delegatesKeys: { [delegateId: string]: CryptoKey } = {}\n    let updatedSelf = self\n    for (const delegateId of new Set(Object.values(keySplitsToUpdate).flatMap((x) => x.notariesIds))) {\n      const res = await this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId)\n      delegatesKeys[delegateId] = res.exchangeKey\n    }\n    for (const [key, params] of Object.entries(keySplitsToUpdate)) {\n      updatedSelf = await this.updateKeySplit(updatedSelf, fingerprintV1(key), params.notariesIds, params.minShares, delegatesKeys, allKeys)\n    }\n    for (const keyFp of toDeleteSet) {\n      updatedSelf = this.deleteKeySplit(updatedSelf, keyFp)\n    }\n    return await this.dataOwnerApi.modifyCryptoActorStub(updatedSelf)\n  }\n\n  /*TODO\n   * Get suggested recovery keys: analyse transfer keys and shamir to get keys which should be shared with shamir for optimal recovery.\n   */\n\n  private validateShamirParams(key: string, params: { notariesIds: string[]; minShares: number }) {\n    if (params.notariesIds.length > 0) {\n      if (params.minShares > params.notariesIds.length) {\n        throw new Error(`Invalid parameters for key ${key}: min shares can't be greater than the number of delegates. ${params}`)\n      }\n    } else throw new Error(`Invalid parameters for key ${key}: must have at least one delegate. ${params}`)\n  }\n\n  private deleteKeySplit(dataOwner: CryptoActorStubWithType, keyFp: string): CryptoActorStubWithType {\n    if (!dataOwner.stub.publicKey || keyFp !== fingerprintV1(dataOwner.stub.publicKey)) {\n      throw new Error('Currently it is possible to use shamir splits only for the legacy public key')\n    }\n    return {\n      type: dataOwner.type,\n      stub: {\n        ...dataOwner.stub,\n        privateKeyShamirPartitions: {},\n      },\n    }\n  }\n\n  private async updateKeySplit(\n    dataOwner: CryptoActorStubWithType,\n    keyFp: string,\n    delegateIds: string[],\n    minShares: number,\n    delegatesKeys: { [p: string]: CryptoKey },\n    allKeys: { [p: string]: KeyPair<CryptoKey> }\n  ): Promise<CryptoActorStubWithType> {\n    if (!dataOwner.stub.publicKey || keyFp !== fingerprintV1(dataOwner.stub.publicKey)) {\n      throw new Error('Currently it is possible to use shamir splits only for the legacy public key')\n    }\n    return {\n      type: dataOwner.type,\n      stub: {\n        ...dataOwner.stub,\n        privateKeyShamirPartitions: await this.createPartitionsFor(allKeys[keyFp], delegateIds, minShares, delegatesKeys),\n      },\n    }\n  }\n\n  private async createPartitionsFor(\n    keyPair: KeyPair<CryptoKey>,\n    delegateIds: string[],\n    minShares: number,\n    delegatesKeys: { [p: string]: CryptoKey }\n  ): Promise<{ [delegateId: string]: string }> {\n    const exportedKey = await this.primitives.RSA.exportKey(keyPair.privateKey, 'pkcs8')\n    if (delegateIds.length == 1) {\n      return await this.encryptShares([exportedKey], delegateIds, delegatesKeys)\n    } else {\n      const exportedKeysHex = ua2hex(exportedKey)\n      const stringShares = this.primitives.shamir.share(exportedKeysHex, delegateIds.length, minShares)\n      const paddedStringShares = stringShares.map((x) => `f${x}`) // Shares are uneven length, apart from that they are perfect hexes\n      for (const share of paddedStringShares) {\n        if (!/^(?:[0-9a-f][0-9a-f])+$/g.test(share)) throw new Error('Unexpected result of shamir split: padded shares should be a valid hex value')\n        if (share !== ua2hex(hex2ua(share))) throw new Error('Unexpected result with encoding-decoding share')\n      }\n      return await this.encryptShares(\n        paddedStringShares.map((x) => hex2ua(x)),\n        delegateIds,\n        delegatesKeys\n      )\n    }\n  }\n\n  private async encryptShares(\n    shares: ArrayBuffer[],\n    delegateIds: string[],\n    delegatesKeys: { [p: string]: CryptoKey }\n  ): Promise<{ [delegateId: string]: string }> {\n    return delegateIds.reduce(\n      async (acc, delegateId, index) => ({\n        ...(await acc),\n        [delegateId]: ua2hex(await this.primitives.AES.encrypt(delegatesKeys[delegateId], shares[index])),\n      }),\n      Promise.resolve({} as { [delegateId: string]: string })\n    )\n  }\n}\n"]}
+{"version":3,"file":"ShamirKeysManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ShamirKeysManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,oCAAyC;AAEzC,yEAA6E;AAC7E,mCAAuC;AAEvC;;GAEG;AACH,MAAa,iBAAiB;IAC5B,YACmB,UAA4B,EAC5B,YAA8B,EAC9B,qBAAgD,EAChD,mBAAwC;QAHxC,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,0BAAqB,GAArB,qBAAqB,CAA2B;QAChD,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEJ;;;;;OAKG;IACH,qBAAqB,CAAC,SAA0B;;QAC9C,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,SAAS,CAAC,0BAA0B,mCAAI,EAAE,CAAC,CAAA;QACxF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,IAAI,IAAA,qBAAa,EAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACpE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAA;YAC7F,CAAC;;gBAAM,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,wBAAwB,EAAE,CAAA;QAClD,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,iBAA+F,EAC/F,iBAA2B;;YAE3B,MAAM,IAAI,GAAG,yCAAuB,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAA;YACjG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACxF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACxF,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAClF,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAA;YAC9D,IAAI,WAAW,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBACxI,MAAM,IAAI,KAAK,CAAC,gDAAgD,iBAAiB,wBAAwB,iBAAiB,EAAE,CAAC,CAAA;YAC/H,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;YACpG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YAChJ,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,6EAA6E,iBAAiB,EAAE,CAAC,CAAA;YACnH,CAAC;YACD,MAAM,aAAa,GAAwC,EAAE,CAAA;YAC7D,IAAI,WAAW,GAAG,IAAI,CAAA;YACtB,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACjG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAA;gBAClF,aAAa,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,WAAW,CAAA;YAC7C,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC9D,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAA,qBAAa,EAAC,GAAG,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;YACxI,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;YACvD,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAA;QACnE,CAAC;KAAA;IAED;;OAEG;IAEK,oBAAoB,CAAC,GAAW,EAAE,MAAoD;QAC5F,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,+DAA+D,MAAM,EAAE,CAAC,CAAA;YAC3H,CAAC;QACH,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sCAAsC,MAAM,EAAE,CAAC,CAAA;IACzG,CAAC;IAEO,cAAc,CAAC,SAAkC,EAAE,KAAa;QACtE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,IAAA,qBAAa,EAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;QACjG,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,0BAA0B,EAAE,EAAE,GAC/B;SACF,CAAA;IACH,CAAC;IAEa,cAAc,CAC1B,SAAkC,EAClC,KAAa,EACb,WAAqB,EACrB,SAAiB,EACjB,aAAyC,EACzC,OAA4C;;YAE5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,IAAA,qBAAa,EAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;YACjG,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,IAAI,kCACC,SAAS,CAAC,IAAI,KACjB,0BAA0B,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,GAClH;aACF,CAAA;QACH,CAAC;KAAA;IAEa,mBAAmB,CAC/B,OAA2B,EAC3B,WAAqB,EACrB,SAAiB,EACjB,aAAyC;;YAEzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACpF,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,eAAe,GAAG,IAAA,cAAM,EAAC,WAAW,CAAC,CAAA;gBAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBACjG,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,mEAAmE;gBAC/H,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;oBACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;oBAC5I,IAAI,KAAK,KAAK,IAAA,cAAM,EAAC,IAAA,cAAM,EAAC,KAAK,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;gBACxG,CAAC;gBACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAC7B,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,cAAM,EAAC,CAAC,CAAC,CAAC,EACxC,WAAW,EACX,aAAa,CACd,CAAA;YACH,CAAC;QACH,CAAC;KAAA;IAEa,aAAa,CACzB,MAAqB,EACrB,WAAqB,EACrB,aAAyC;;YAEzC,OAAO,WAAW,CAAC,MAAM,CACvB,CAAO,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;gBAAC,OAAA,iCAC7B,CAAC,MAAM,GAAG,CAAC,KACd,CAAC,UAAU,CAAC,EAAE,IAAA,cAAM,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IACjG,CAAA;cAAA,EACF,OAAO,CAAC,OAAO,CAAC,EAAsC,CAAC,CACxD,CAAA;QACH,CAAC;KAAA;CACF;AAvJD,8CAuJC","sourcesContent":["import { DataOwnerOrStub, IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { KeyPair } from './RSA'\nimport { hex2ua, ua2hex } from '../utils'\nimport { ExchangeDataManager } from './ExchangeDataManager'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { fingerprintV1 } from './utils'\n\n/**\n * Allows to create or update shamir split keys.\n */\nexport class ShamirKeysManager {\n  constructor(\n    private readonly primitives: CryptoPrimitives,\n    private readonly dataOwnerApi: IccDataOwnerXApi,\n    private readonly encryptionKeysManager: UserEncryptionKeysManager,\n    private readonly exchangeDataManager: ExchangeDataManager\n  ) {}\n\n  /**\n   * Get information on existing private keys splits for the provided data owner. For each private key of the provided data owner which has been\n   * split using the Shamir sharing algorithm gives the list of the notaries (other data owners) which hold a copy of the key part.\n   * @param dataOwner a data owner\n   * @return the existing splits for the current data owner as a publicKeyFingerprint -> notariesIds object\n   */\n  getExistingSplitsInfo(dataOwner: DataOwnerOrStub): { [keyPairFingerprint: string]: string[] } {\n    const legacyPartitionDelegates = Object.keys(dataOwner.privateKeyShamirPartitions ?? {})\n    if (legacyPartitionDelegates.length > 0) {\n      const fp = dataOwner.publicKey && fingerprintV1(dataOwner.publicKey)\n      if (!fp) {\n        console.error('Invalid data owner: the owner has legacy key partitions but no legacy key.')\n      } else return { [fp]: legacyPartitionDelegates }\n    }\n    return {}\n  }\n\n  /**\n   * Creates, updates or deletes shamir splits for keys of the current data owner. Any request to update the splits for a specific key will completely\n   * replace any existing data on that split (all previous notaries will be ignored).\n   * Note: currently you can only split the legacy key pair.\n   * @param keySplitsToUpdate the fingerprints of key pairs which will have updated/new splits and the details on how to create the updated splits.\n   * @param keySplitsToDelete the fingerprints or hex-encoded spki public keys which will not be shared anymore.\n   * @throws if the parameters refer to non-existing or unavailable keys, have split creation details, or if they request to delete a non-existing\n   * split.\n   */\n  async updateSelfSplits(\n    keySplitsToUpdate: { [publicKeyHexOrFp: string]: { notariesIds: string[]; minShares: number } },\n    keySplitsToDelete: string[]\n  ): Promise<CryptoActorStubWithType> {\n    const self = CryptoActorStubWithType.fromDataOwner(await this.dataOwnerApi.getCurrentDataOwner())\n    const toUpdateSet = new Set(Object.keys(keySplitsToUpdate).map((x) => fingerprintV1(x)))\n    const toDeleteSet = new Set(Object.keys(keySplitsToDelete).map((x) => fingerprintV1(x)))\n    const intersection = Array.from(toDeleteSet).filter((x) => toUpdateSet.has(x))\n    const existingSplits = new Set(Object.keys(this.getExistingSplitsInfo(self.stub)))\n    const allKeys = this.encryptionKeysManager.getDecryptionKeys()\n    if (toDeleteSet.size !== keySplitsToDelete.length || toUpdateSet.size !== Object.keys(keySplitsToUpdate).length || intersection.length > 0)\n      throw new Error(`Duplicate keys in input:\\nkeySplitsToUpdate: ${keySplitsToUpdate}\\nkeySplitsToDelete: ${keySplitsToDelete}`)\n    Object.entries(keySplitsToUpdate).forEach(([key, params]) => this.validateShamirParams(key, params))\n    if (!Array.from(existingSplits).every((x) => existingSplits.has(x))) {\n      throw new Error(`Requested to delete non-existing split.\\nexistingSplits: ${Array.from(existingSplits)}\\ntoDelete:${Array.from(toDeleteSet)}`)\n    }\n    if (Array.from(toUpdateSet).some((x) => !allKeys[x])) {\n      throw new Error(`Private key is not available for some of the requested key split updates. ${keySplitsToUpdate}`)\n    }\n    const delegatesKeys: { [delegateId: string]: CryptoKey } = {}\n    let updatedSelf = self\n    for (const delegateId of new Set(Object.values(keySplitsToUpdate).flatMap((x) => x.notariesIds))) {\n      const res = await this.exchangeDataManager.getOrCreateEncryptionDataTo(delegateId)\n      delegatesKeys[delegateId] = res.exchangeKey\n    }\n    for (const [key, params] of Object.entries(keySplitsToUpdate)) {\n      updatedSelf = await this.updateKeySplit(updatedSelf, fingerprintV1(key), params.notariesIds, params.minShares, delegatesKeys, allKeys)\n    }\n    for (const keyFp of toDeleteSet) {\n      updatedSelf = this.deleteKeySplit(updatedSelf, keyFp)\n    }\n    return await this.dataOwnerApi.modifyCryptoActorStub(updatedSelf)\n  }\n\n  /*TODO\n   * Get suggested recovery keys: analyse transfer keys and shamir to get keys which should be shared with shamir for optimal recovery.\n   */\n\n  private validateShamirParams(key: string, params: { notariesIds: string[]; minShares: number }) {\n    if (params.notariesIds.length > 0) {\n      if (params.minShares > params.notariesIds.length) {\n        throw new Error(`Invalid parameters for key ${key}: min shares can't be greater than the number of delegates. ${params}`)\n      }\n    } else throw new Error(`Invalid parameters for key ${key}: must have at least one delegate. ${params}`)\n  }\n\n  private deleteKeySplit(dataOwner: CryptoActorStubWithType, keyFp: string): CryptoActorStubWithType {\n    if (!dataOwner.stub.publicKey || keyFp !== fingerprintV1(dataOwner.stub.publicKey)) {\n      throw new Error('Currently it is possible to use shamir splits only for the legacy public key')\n    }\n    return {\n      type: dataOwner.type,\n      stub: {\n        ...dataOwner.stub,\n        privateKeyShamirPartitions: {},\n      },\n    }\n  }\n\n  private async updateKeySplit(\n    dataOwner: CryptoActorStubWithType,\n    keyFp: string,\n    delegateIds: string[],\n    minShares: number,\n    delegatesKeys: { [p: string]: CryptoKey },\n    allKeys: { [p: string]: KeyPair<CryptoKey> }\n  ): Promise<CryptoActorStubWithType> {\n    if (!dataOwner.stub.publicKey || keyFp !== fingerprintV1(dataOwner.stub.publicKey)) {\n      throw new Error('Currently it is possible to use shamir splits only for the legacy public key')\n    }\n    return {\n      type: dataOwner.type,\n      stub: {\n        ...dataOwner.stub,\n        privateKeyShamirPartitions: await this.createPartitionsFor(allKeys[keyFp], delegateIds, minShares, delegatesKeys),\n      },\n    }\n  }\n\n  private async createPartitionsFor(\n    keyPair: KeyPair<CryptoKey>,\n    delegateIds: string[],\n    minShares: number,\n    delegatesKeys: { [p: string]: CryptoKey }\n  ): Promise<{ [delegateId: string]: string }> {\n    const exportedKey = await this.primitives.RSA.exportKey(keyPair.privateKey, 'pkcs8')\n    if (delegateIds.length == 1) {\n      return await this.encryptShares([exportedKey], delegateIds, delegatesKeys)\n    } else {\n      const exportedKeysHex = ua2hex(exportedKey)\n      const stringShares = this.primitives.shamir.share(exportedKeysHex, delegateIds.length, minShares)\n      const paddedStringShares = stringShares.map((x) => `f${x}`) // Shares are uneven length, apart from that they are perfect hexes\n      for (const share of paddedStringShares) {\n        if (!/^(?:[0-9a-f][0-9a-f])+$/g.test(share)) throw new Error('Unexpected result of shamir split: padded shares should be a valid hex value')\n        if (share !== ua2hex(hex2ua(share))) throw new Error('Unexpected result with encoding-decoding share')\n      }\n      return await this.encryptShares(\n        paddedStringShares.map((x) => hex2ua(x)),\n        delegateIds,\n        delegatesKeys\n      )\n    }\n  }\n\n  private async encryptShares(\n    shares: ArrayBuffer[],\n    delegateIds: string[],\n    delegatesKeys: { [p: string]: CryptoKey }\n  ): Promise<{ [delegateId: string]: string }> {\n    return delegateIds.reduce(\n      async (acc, delegateId, index) => ({\n        ...(await acc),\n        [delegateId]: ua2hex(await this.primitives.AES.encrypt(delegatesKeys[delegateId], shares[index])),\n      }),\n      Promise.resolve({} as { [delegateId: string]: string })\n    )\n  }\n}\n"]}

package/icc-x-api/crypto/ShareMetadataBehaviour.js

@@ -20,5 +20,5 @@ var ShareMetadataBehaviour;
      * The method must not share the metadata with the delegate, even if the current data owner can access it.
      */
     ShareMetadataBehaviour["NEVER"] = "NEVER";
-})(ShareMetadataBehaviour = exports.ShareMetadataBehaviour || (exports.ShareMetadataBehaviour = {}));
+})(ShareMetadataBehaviour || (exports.ShareMetadataBehaviour = ShareMetadataBehaviour = {}));
 //# sourceMappingURL=ShareMetadataBehaviour.js.map

package/icc-x-api/crypto/ShareMetadataBehaviour.js.map

@@ -1 +1 @@
-{"version":3,"file":"ShareMetadataBehaviour.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ShareMetadataBehaviour.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,IAAY,sBAeX;AAfD,WAAY,sBAAsB;IAChC;;;OAGG;IACH,+CAAqB,CAAA;IACrB;;;OAGG;IACH,uDAA6B,CAAA;IAC7B;;OAEG;IACH,yCAAe,CAAA;AACjB,CAAC,EAfW,sBAAsB,GAAtB,8BAAsB,KAAtB,8BAAsB,QAejC","sourcesContent":["/**\n * Specifies a behaviour for the sharing of encryption keys or owning entity ids in the extended apis 'share' methods.\n */\nexport enum ShareMetadataBehaviour {\n  /**\n   * The method must share the metadata with the delegate. If this is not possible, because for example the current user has no access to this kind of\n   * metadata, the method will throw an error.\n   */\n  REQUIRED = 'REQUIRED',\n  /**\n   * The method must share the metadata with the delegate if available. If this is not possible, because for example the current user has no access to\n   * this kind of metadata, the method will simply not share this metadata.\n   */\n  IF_AVAILABLE = 'IF_AVAILABLE',\n  /**\n   * The method must not share the metadata with the delegate, even if the current data owner can access it.\n   */\n  NEVER = 'NEVER',\n}\n"]}
+{"version":3,"file":"ShareMetadataBehaviour.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ShareMetadataBehaviour.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,IAAY,sBAeX;AAfD,WAAY,sBAAsB;IAChC;;;OAGG;IACH,+CAAqB,CAAA;IACrB;;;OAGG;IACH,uDAA6B,CAAA;IAC7B;;OAEG;IACH,yCAAe,CAAA;AACjB,CAAC,EAfW,sBAAsB,sCAAtB,sBAAsB,QAejC","sourcesContent":["/**\n * Specifies a behaviour for the sharing of encryption keys or owning entity ids in the extended apis 'share' methods.\n */\nexport enum ShareMetadataBehaviour {\n  /**\n   * The method must share the metadata with the delegate. If this is not possible, because for example the current user has no access to this kind of\n   * metadata, the method will throw an error.\n   */\n  REQUIRED = 'REQUIRED',\n  /**\n   * The method must share the metadata with the delegate if available. If this is not possible, because for example the current user has no access to\n   * this kind of metadata, the method will simply not share this metadata.\n   */\n  IF_AVAILABLE = 'IF_AVAILABLE',\n  /**\n   * The method must not share the metadata with the delegate, even if the current data owner can access it.\n   */\n  NEVER = 'NEVER',\n}\n"]}

package/icc-x-api/crypto/TransferKeysManager.js

@@ -34,8 +34,8 @@ class TransferKeysManager {
      * @return the updated data owner.
      */
     updateTransferKeys(self) {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             const newEdgesByTarget = yield this.getNewVerifiedTransferKeysEdges(self);
             if (!newEdgesByTarget.length)
                 return;